FraCre09
06-10-2009, 23:54
:help: Buonasera,
ho bisogno di aiuto..
Sono ormai 4 mesi che avast mi trova un file infetto da trojan di nome gysuaegup.tmp
Ho cercato in google ma questo file non esiste....
Ho cercato nel sistema e ho visto che nell'avvio c'č gysuaeg.exe
Avast elimina il file .temp, ma non il file .exe che non riesco ad eliminare manualmente poichč mi dice che non ho l'autorizzazione.
Sono andata in esegui, regedit, ho trovato il file, ma č un no remove, insieme ad altri due diversi.
Ora mi chiedo, se io li elimino manualmente potrebbe diventarmi instabile il sistema?e cos'altro devo eliminare?
Non so pių come fare.....
la scansione del virustotal (consigliato da voi in una discussione) mi dice questo:
File gysuaeg.exe ricevuto il 2009.10.06 22:12:01 (UTC)
Stato corrente: finito
Risultato: 12/41 (29.27%)
Formattato Stampa risultati
Antivirus Versione Ultimo aggiornamento Risultato
a-squared 4.5.0.41 2009.10.06 Trojan.NaviPromo!IK
AhnLab-V3 5.0.0.2 2009.10.06 -
AntiVir 7.9.1.33 2009.10.06 ADSPY/Adware.Gen
Antiy-AVL 2.0.3.7 2009.10.05 -
Authentium 5.1.2.4 2009.10.06 W32/Skintrim.1!Generic
Avast 4.8.1351.0 2009.10.06 -
AVG 8.5.0.420 2009.10.04 -
BitDefender 7.2 2009.10.06 Gen:Adware.Heur.sq0@de@3TGoi
CAT-QuickHeal 10.00 2009.10.06 -
ClamAV 0.94.1 2009.10.05 -
Comodo 2524 2009.10.06 -
DrWeb 5.0.0.12182 2009.10.06 -
eSafe 7.0.17.0 2009.10.06 -
eTrust-Vet 35.1.7054 2009.10.06 -
F-Prot 4.5.1.85 2009.10.06 W32/Skintrim.1!Generic
F-Secure 8.0.14470.0 2009.10.06 Trojan:W32/Skintrim.gen!B
Fortinet 3.120.0.0 2009.10.06 -
GData 19 2009.10.06 Gen:Adware.Heur.sq0@de@3TGoi
Ikarus T3.1.1.72.0 2009.10.06 Trojan.NaviPromo
Jiangmin 11.0.800 2009.10.06 -
K7AntiVirus 7.10.863 2009.10.06 -
Kaspersky 7.0.0.125 2009.10.06 Trojan.Win32.Hrup.gen
McAfee 5763 2009.10.06 -
McAfee+Artemis 5763 2009.10.06 -
McAfee-GW-Edition 6.8.5 2009.10.06 Ad-Spyware.Adware.Gen
Microsoft 1.5101 2009.10.06 Trojan:Win32/Skintrim.H
NOD32 4485 2009.10.06 -
Norman 6.01.09 2009.10.06 -
nProtect 2009.1.8.0 2009.10.06 -
Panda 10.0.2.2 2009.10.06 Suspicious file
PCTools 4.4.2.0 2009.10.06 -
Prevx 3.0 2009.10.07 -
Rising 21.49.22.00 2009.09.30 -
Sophos 4.45.0 2009.10.06 -
Sunbelt 3.2.1858.2 2009.10.06 -
Symantec 1.4.4.12 2009.10.06 -
TheHacker 6.5.0.2.032 2009.10.06 -
TrendMicro 8.950.0.1094 2009.10.06 -
VBA32 3.12.10.11 2009.10.05 -
ViRobot 2009.10.6.1972 2009.10.06 -
VirusBuster 4.6.5.0 2009.10.06 -
Informazioni addizionali
File size: 299008 bytes
MD5 : b2d44e4706253706dc43f8ce3e6ea742
SHA1 : 34ae4503452b2df37e30c05ac4a651902fbd549d
SHA256: a19a7b17cdfcb594f724e0983f5086f157be48cbbeb5a9686e57078e7ddc2546
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x36107
timedatestamp.....: 0x403E9A2B (Fri Feb 27 02:15:23 2004)
machinetype.......: 0x14C (Intel I386)
( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x39024 0x3A000 7.35 7e86571b60b821e7da420cbbf9eb7952
.rdata 0x3B000 0x8FE8 0x9000 5.72 dca94f3d556ca62657331a2e280b0ca9
.data 0x44000 0x3ABC 0x4000 1.72 6dedd0063181d8f28cb47f55b2e9cc9e
.rsrc 0x48000 0x2C0 0x1000 0.74 9df203e3436a8bd2197f72796f77620e
( 11 imports )
> advapi32.dll: RegEnumKeyExW, CreateServiceW, RegQueryValueExA, RegSetKeySecurity
> comctl32.dll: ImageList_GetImageCount, ImageList_DragEnter
> comdlg32.dll: ChooseColorA, CommDlgExtendedError, GetSaveFileNameA
> gdi32.dll: Polyline, CreatePen
> kernel32.dll: InterlockedIncrement, InterlockedDecrement, GetStringTypeW, LCMapStringW, VirtualAlloc, lstrlenA, SetCurrentDirectoryA, GetLastError, VerSetConditionMask, CreateProcessA, GetWindowsDirectoryW, GetConsoleOutputCP, MapViewOfFile, CreateFileW, LockResource, GetPrivateProfileSectionA, GetCurrentThreadId, GetEnvironmentStringsW, GetThreadLocale, GlobalAddAtomW, GetTickCount, QueueUserWorkItem, GetLongPathNameW, lstrcmpA, FindNextChangeNotification, DeleteCriticalSection, SetEnvironmentVariableW, GlobalDeleteAtom, DeleteTimerQueueTimer, IsDebuggerPresent, GlobalGetAtomNameW, ReleaseMutex, GlobalGetAtomNameA, GetUserGeoID, ExpandEnvironmentStringsW, lstrcpynW, GetStartupInfoW, GetConsoleMode, _llseek, GetQueuedCompletionStatus, IsValidLocale, GetCurrentThread, DeleteTimerQueueEx, DuplicateHandle, HeapAlloc, UnhandledExceptionFilter, GetVersionExA, GetFileAttributesW, SetCurrentDirectoryW, TlsGetValue, GetStringTypeA, LCMapStringA, ResumeThread, SetThreadExecutionState, lstrcmpiW, GetFileType, WriteProfileStringA, SetEnvironmentVariableA, OpenMutexW, VirtualFree, WriteFile, QueryPerformanceFrequency, GlobalFindAtomW, GetDiskFreeSpaceW, CompareFileTime, GetFileSizeEx, GetLocalTime, QueryPerformanceCounter, GlobalMemoryStatus, GetPriorityClass, FindResourceW, WaitForMultipleObjectsEx, GetPrivateProfileIntW, WritePrivateProfileStringA, OpenEventA, WinExec, ReleaseSemaphore, GetSystemPowerStatus, HeapSize, CreateEventA, LocalFree, GetDiskFreeSpaceA, SystemTimeToFileTime, WriteConsoleW, GetEnvironmentVariableA, SetFilePointer, CreateFileMappingW, OutputDebugStringA, HeapReAlloc, BackupRead, FreeEnvironmentStringsW, lstrcmpW, GetFullPathNameW, lstrcpyA, LoadResource, CompareStringA, GetModuleHandleA, TlsAlloc, GetStartupInfoA, GetCommandLineA, GetVersion, ExitProcess, TerminateProcess, GetCurrentProcess, GetModuleFileNameA, FreeEnvironmentStringsA, WideCharToMultiByte, GetEnvironmentStrings, SetHandleCount, GetStdHandle, TlsSetValue, SetLastError, HeapDestroy, HeapCreate, HeapFree, RtlUnwind, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, GetCPInfo, GetACP, GetOEMCP, GetProcAddress, LoadLibraryA, MultiByteToWideChar
> ole32.dll: OleCreateFromData, OleCreateMenuDescriptor, CoCreateInstance, OleLoad, CoGetTreatAsClass, OleLockRunning, CoSetProxyBlanket, CoFreeUnusedLibraries
> oleaut32.dll: -
> shell32.dll: DragQueryFileW, SHGetFolderPathAndSubDirW
> shlwapi.dll: PathStripToRootW
> user32.dll: GetSystemMetrics, ClientToScreen, GetCursorPos, TrackPopupMenuEx, GetCaretBlinkTime, SetKeyboardState, GetTopWindow, LoadImageA, VkKeyScanW, DdeConnect, DefWindowProcW, DestroyCaret, FindWindowExA, OpenIcon, DdeCreateStringHandleW, LoadStringA, CreateIconIndirect, CharLowerBuffW, MonitorFromWindow, SetClassLongW, MapWindowPoints, GetMessageTime, IntersectRect, DefFrameProcA, SendDlgItemMessageW, GetDlgItem, UnionRect, SetRect, GetWindowTextLengthA, ShowCaret, ModifyMenuW, IsCharAlphaNumericW, IsWindowUnicode, IsWindowVisible, MsgWaitForMultipleObjects, TabbedTextOutA, LoadCursorA, GetDialogBaseUnits, PeekMessageW, RemovePropA, GetFocus, LoadMenuA, DrawTextExA, CheckRadioButton, EnumThreadWindows, TrackPopupMenu, SetClipboardData, ScrollDC, GetDlgCtrlID, IsWindow, GetInputState, InsertMenuItemW, DefWindowProcA, GetActiveWindow, SetWindowsHookExW, DdeAccessData, DdeFreeDataHandle, InsertMenuItemA, MapDialogRect, IsCharAlphaW, GetDlgItemTextW
> version.dll: GetFileVersionInfoA
( 0 exports )
TrID : File type identification
Win64 Executable Generic (54.6%)
Win32 Executable MS Visual C++ (generic) (24.0%)
Windows Screen Saver (8.3%)
Win32 Executable Generic (5.4%)
Win32 Dynamic Link Library (generic) (4.8%)
ssdeep: 6144:q038S0qMqzy2743BG2b6StdVrp5cxpDbn1nHXogD8zhf5fdI:q0WqMqV4xG1S1MxpDbF41
PEiD : -
RDS : NSRL Reference Data Set
Grazie mille....:help: :cry: :help: :confused:
ho bisogno di aiuto..
Sono ormai 4 mesi che avast mi trova un file infetto da trojan di nome gysuaegup.tmp
Ho cercato in google ma questo file non esiste....
Ho cercato nel sistema e ho visto che nell'avvio c'č gysuaeg.exe
Avast elimina il file .temp, ma non il file .exe che non riesco ad eliminare manualmente poichč mi dice che non ho l'autorizzazione.
Sono andata in esegui, regedit, ho trovato il file, ma č un no remove, insieme ad altri due diversi.
Ora mi chiedo, se io li elimino manualmente potrebbe diventarmi instabile il sistema?e cos'altro devo eliminare?
Non so pių come fare.....
la scansione del virustotal (consigliato da voi in una discussione) mi dice questo:
File gysuaeg.exe ricevuto il 2009.10.06 22:12:01 (UTC)
Stato corrente: finito
Risultato: 12/41 (29.27%)
Formattato Stampa risultati
Antivirus Versione Ultimo aggiornamento Risultato
a-squared 4.5.0.41 2009.10.06 Trojan.NaviPromo!IK
AhnLab-V3 5.0.0.2 2009.10.06 -
AntiVir 7.9.1.33 2009.10.06 ADSPY/Adware.Gen
Antiy-AVL 2.0.3.7 2009.10.05 -
Authentium 5.1.2.4 2009.10.06 W32/Skintrim.1!Generic
Avast 4.8.1351.0 2009.10.06 -
AVG 8.5.0.420 2009.10.04 -
BitDefender 7.2 2009.10.06 Gen:Adware.Heur.sq0@de@3TGoi
CAT-QuickHeal 10.00 2009.10.06 -
ClamAV 0.94.1 2009.10.05 -
Comodo 2524 2009.10.06 -
DrWeb 5.0.0.12182 2009.10.06 -
eSafe 7.0.17.0 2009.10.06 -
eTrust-Vet 35.1.7054 2009.10.06 -
F-Prot 4.5.1.85 2009.10.06 W32/Skintrim.1!Generic
F-Secure 8.0.14470.0 2009.10.06 Trojan:W32/Skintrim.gen!B
Fortinet 3.120.0.0 2009.10.06 -
GData 19 2009.10.06 Gen:Adware.Heur.sq0@de@3TGoi
Ikarus T3.1.1.72.0 2009.10.06 Trojan.NaviPromo
Jiangmin 11.0.800 2009.10.06 -
K7AntiVirus 7.10.863 2009.10.06 -
Kaspersky 7.0.0.125 2009.10.06 Trojan.Win32.Hrup.gen
McAfee 5763 2009.10.06 -
McAfee+Artemis 5763 2009.10.06 -
McAfee-GW-Edition 6.8.5 2009.10.06 Ad-Spyware.Adware.Gen
Microsoft 1.5101 2009.10.06 Trojan:Win32/Skintrim.H
NOD32 4485 2009.10.06 -
Norman 6.01.09 2009.10.06 -
nProtect 2009.1.8.0 2009.10.06 -
Panda 10.0.2.2 2009.10.06 Suspicious file
PCTools 4.4.2.0 2009.10.06 -
Prevx 3.0 2009.10.07 -
Rising 21.49.22.00 2009.09.30 -
Sophos 4.45.0 2009.10.06 -
Sunbelt 3.2.1858.2 2009.10.06 -
Symantec 1.4.4.12 2009.10.06 -
TheHacker 6.5.0.2.032 2009.10.06 -
TrendMicro 8.950.0.1094 2009.10.06 -
VBA32 3.12.10.11 2009.10.05 -
ViRobot 2009.10.6.1972 2009.10.06 -
VirusBuster 4.6.5.0 2009.10.06 -
Informazioni addizionali
File size: 299008 bytes
MD5 : b2d44e4706253706dc43f8ce3e6ea742
SHA1 : 34ae4503452b2df37e30c05ac4a651902fbd549d
SHA256: a19a7b17cdfcb594f724e0983f5086f157be48cbbeb5a9686e57078e7ddc2546
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x36107
timedatestamp.....: 0x403E9A2B (Fri Feb 27 02:15:23 2004)
machinetype.......: 0x14C (Intel I386)
( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x39024 0x3A000 7.35 7e86571b60b821e7da420cbbf9eb7952
.rdata 0x3B000 0x8FE8 0x9000 5.72 dca94f3d556ca62657331a2e280b0ca9
.data 0x44000 0x3ABC 0x4000 1.72 6dedd0063181d8f28cb47f55b2e9cc9e
.rsrc 0x48000 0x2C0 0x1000 0.74 9df203e3436a8bd2197f72796f77620e
( 11 imports )
> advapi32.dll: RegEnumKeyExW, CreateServiceW, RegQueryValueExA, RegSetKeySecurity
> comctl32.dll: ImageList_GetImageCount, ImageList_DragEnter
> comdlg32.dll: ChooseColorA, CommDlgExtendedError, GetSaveFileNameA
> gdi32.dll: Polyline, CreatePen
> kernel32.dll: InterlockedIncrement, InterlockedDecrement, GetStringTypeW, LCMapStringW, VirtualAlloc, lstrlenA, SetCurrentDirectoryA, GetLastError, VerSetConditionMask, CreateProcessA, GetWindowsDirectoryW, GetConsoleOutputCP, MapViewOfFile, CreateFileW, LockResource, GetPrivateProfileSectionA, GetCurrentThreadId, GetEnvironmentStringsW, GetThreadLocale, GlobalAddAtomW, GetTickCount, QueueUserWorkItem, GetLongPathNameW, lstrcmpA, FindNextChangeNotification, DeleteCriticalSection, SetEnvironmentVariableW, GlobalDeleteAtom, DeleteTimerQueueTimer, IsDebuggerPresent, GlobalGetAtomNameW, ReleaseMutex, GlobalGetAtomNameA, GetUserGeoID, ExpandEnvironmentStringsW, lstrcpynW, GetStartupInfoW, GetConsoleMode, _llseek, GetQueuedCompletionStatus, IsValidLocale, GetCurrentThread, DeleteTimerQueueEx, DuplicateHandle, HeapAlloc, UnhandledExceptionFilter, GetVersionExA, GetFileAttributesW, SetCurrentDirectoryW, TlsGetValue, GetStringTypeA, LCMapStringA, ResumeThread, SetThreadExecutionState, lstrcmpiW, GetFileType, WriteProfileStringA, SetEnvironmentVariableA, OpenMutexW, VirtualFree, WriteFile, QueryPerformanceFrequency, GlobalFindAtomW, GetDiskFreeSpaceW, CompareFileTime, GetFileSizeEx, GetLocalTime, QueryPerformanceCounter, GlobalMemoryStatus, GetPriorityClass, FindResourceW, WaitForMultipleObjectsEx, GetPrivateProfileIntW, WritePrivateProfileStringA, OpenEventA, WinExec, ReleaseSemaphore, GetSystemPowerStatus, HeapSize, CreateEventA, LocalFree, GetDiskFreeSpaceA, SystemTimeToFileTime, WriteConsoleW, GetEnvironmentVariableA, SetFilePointer, CreateFileMappingW, OutputDebugStringA, HeapReAlloc, BackupRead, FreeEnvironmentStringsW, lstrcmpW, GetFullPathNameW, lstrcpyA, LoadResource, CompareStringA, GetModuleHandleA, TlsAlloc, GetStartupInfoA, GetCommandLineA, GetVersion, ExitProcess, TerminateProcess, GetCurrentProcess, GetModuleFileNameA, FreeEnvironmentStringsA, WideCharToMultiByte, GetEnvironmentStrings, SetHandleCount, GetStdHandle, TlsSetValue, SetLastError, HeapDestroy, HeapCreate, HeapFree, RtlUnwind, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, GetCPInfo, GetACP, GetOEMCP, GetProcAddress, LoadLibraryA, MultiByteToWideChar
> ole32.dll: OleCreateFromData, OleCreateMenuDescriptor, CoCreateInstance, OleLoad, CoGetTreatAsClass, OleLockRunning, CoSetProxyBlanket, CoFreeUnusedLibraries
> oleaut32.dll: -
> shell32.dll: DragQueryFileW, SHGetFolderPathAndSubDirW
> shlwapi.dll: PathStripToRootW
> user32.dll: GetSystemMetrics, ClientToScreen, GetCursorPos, TrackPopupMenuEx, GetCaretBlinkTime, SetKeyboardState, GetTopWindow, LoadImageA, VkKeyScanW, DdeConnect, DefWindowProcW, DestroyCaret, FindWindowExA, OpenIcon, DdeCreateStringHandleW, LoadStringA, CreateIconIndirect, CharLowerBuffW, MonitorFromWindow, SetClassLongW, MapWindowPoints, GetMessageTime, IntersectRect, DefFrameProcA, SendDlgItemMessageW, GetDlgItem, UnionRect, SetRect, GetWindowTextLengthA, ShowCaret, ModifyMenuW, IsCharAlphaNumericW, IsWindowUnicode, IsWindowVisible, MsgWaitForMultipleObjects, TabbedTextOutA, LoadCursorA, GetDialogBaseUnits, PeekMessageW, RemovePropA, GetFocus, LoadMenuA, DrawTextExA, CheckRadioButton, EnumThreadWindows, TrackPopupMenu, SetClipboardData, ScrollDC, GetDlgCtrlID, IsWindow, GetInputState, InsertMenuItemW, DefWindowProcA, GetActiveWindow, SetWindowsHookExW, DdeAccessData, DdeFreeDataHandle, InsertMenuItemA, MapDialogRect, IsCharAlphaW, GetDlgItemTextW
> version.dll: GetFileVersionInfoA
( 0 exports )
TrID : File type identification
Win64 Executable Generic (54.6%)
Win32 Executable MS Visual C++ (generic) (24.0%)
Windows Screen Saver (8.3%)
Win32 Executable Generic (5.4%)
Win32 Dynamic Link Library (generic) (4.8%)
ssdeep: 6144:q038S0qMqzy2743BG2b6StdVrp5cxpDbn1nHXogD8zhf5fdI:q0WqMqV4xG1S1MxpDbF41
PEiD : -
RDS : NSRL Reference Data Set
Grazie mille....:help: :cry: :help: :confused: