overthetop
24-06-2004, 20:18
Ogni volta che sono costretto a disabilitare il sygate 5.5, tutti i virus che ci sono in rete:D si infiltrano nella mia bestia
Le ho provate, tutte.
Avg aggiornato
La scansione on-line
Cancellare a manina tutti gli eseguibili infettati, ma niente.premetto che i miei antivirus trova ogni volta tutta la roba, ma appena disabilito il sygate, rientrano nuovamente.
Eccovi il log di Hijack
Logfile of HijackThis v1.97.7
Scan saved at 21.22.21, on 24/06/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\Programmi\Sygate\SPF\Smc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Programmi\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\Programmi\Grisoft\AVG6\avgcc32.exe
D:\01 - Installazione\06. MbProbe 1.31\MBProbe.exe
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\Programmi\WinRAR\WinRAR.exe
C:\Programmi\Prassi PrimoDVD 2.0 (Italian)\PrimoDVD.exe
C:\Documents and Settings\Mast11\Desktop\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://it.msn.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://it.msn.com/
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Programmi\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [AVG_CC] C:\Programmi\Grisoft\AVG6\avgcc32.exe /startup
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Mozilla Firefox v0.901] netconfig.exe
O4 - HKLM\..\Run: [windlll] systemkk.exe
O4 - HKLM\..\RunServices: [Microsoft DLL Manager] dllmnr.exe
O4 - HKLM\..\RunServices: [Microsoft Sys Manager] sysmgr.exe
O4 - HKLM\..\RunServices: [Sysmon] sysmon.exe
O4 - HKLM\..\RunServices: [Microsoft Internet System] svchosts.exe
O4 - HKLM\..\RunServices: [Monitor TynManager] fqdv.exe
O4 - HKLM\..\RunServices: [MBsync] wuapdc.exe
O4 - HKLM\..\RunServices: [Mozilla Firefox v0.901] netconfig.exe
O4 - HKLM\..\RunServices: [windlll] systemkk.exe
O4 - HKLM\..\RunServices: [MonTest] vccxzq.exe
O4 - HKCU\..\Run: [Microsoft DLL Manager] dllmnr.exe
O4 - HKCU\..\Run: [Monitor TynManager] fqdv.exe
O4 - HKCU\..\Run: [Microsoft Internet System] svchosts.exe
O4 - HKCU\..\Run: [Microsoft Synchronization Manager] svhost.exe
O4 - HKCU\..\Run: [Mozilla Firefox v0.901] netconfig.exe
O4 - HKCU\..\Run: [MBsync] wuapdc.exe
O4 - HKCU\..\Run: [windlll] systemkk.exe
O4 - Startup: emule.lnk = D:\eMule\emule.exe
O4 - Startup: MBProbe.lnk = D:\01 - Installazione\06. MbProbe 1.31\MBProbe.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Ricerche (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38140.5974074074
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{FBB5C2C8-6BF1-4A2C-9CFA-79929D24E028}: NameServer = 62.211.69.150 212.48.4.15
Le ho provate, tutte.
Avg aggiornato
La scansione on-line
Cancellare a manina tutti gli eseguibili infettati, ma niente.premetto che i miei antivirus trova ogni volta tutta la roba, ma appena disabilito il sygate, rientrano nuovamente.
Eccovi il log di Hijack
Logfile of HijackThis v1.97.7
Scan saved at 21.22.21, on 24/06/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\Programmi\Sygate\SPF\Smc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Programmi\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\Programmi\Grisoft\AVG6\avgcc32.exe
D:\01 - Installazione\06. MbProbe 1.31\MBProbe.exe
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\Programmi\WinRAR\WinRAR.exe
C:\Programmi\Prassi PrimoDVD 2.0 (Italian)\PrimoDVD.exe
C:\Documents and Settings\Mast11\Desktop\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://it.msn.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://it.msn.com/
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Programmi\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [AVG_CC] C:\Programmi\Grisoft\AVG6\avgcc32.exe /startup
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Mozilla Firefox v0.901] netconfig.exe
O4 - HKLM\..\Run: [windlll] systemkk.exe
O4 - HKLM\..\RunServices: [Microsoft DLL Manager] dllmnr.exe
O4 - HKLM\..\RunServices: [Microsoft Sys Manager] sysmgr.exe
O4 - HKLM\..\RunServices: [Sysmon] sysmon.exe
O4 - HKLM\..\RunServices: [Microsoft Internet System] svchosts.exe
O4 - HKLM\..\RunServices: [Monitor TynManager] fqdv.exe
O4 - HKLM\..\RunServices: [MBsync] wuapdc.exe
O4 - HKLM\..\RunServices: [Mozilla Firefox v0.901] netconfig.exe
O4 - HKLM\..\RunServices: [windlll] systemkk.exe
O4 - HKLM\..\RunServices: [MonTest] vccxzq.exe
O4 - HKCU\..\Run: [Microsoft DLL Manager] dllmnr.exe
O4 - HKCU\..\Run: [Monitor TynManager] fqdv.exe
O4 - HKCU\..\Run: [Microsoft Internet System] svchosts.exe
O4 - HKCU\..\Run: [Microsoft Synchronization Manager] svhost.exe
O4 - HKCU\..\Run: [Mozilla Firefox v0.901] netconfig.exe
O4 - HKCU\..\Run: [MBsync] wuapdc.exe
O4 - HKCU\..\Run: [windlll] systemkk.exe
O4 - Startup: emule.lnk = D:\eMule\emule.exe
O4 - Startup: MBProbe.lnk = D:\01 - Installazione\06. MbProbe 1.31\MBProbe.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Ricerche (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38140.5974074074
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{FBB5C2C8-6BF1-4A2C-9CFA-79929D24E028}: NameServer = 62.211.69.150 212.48.4.15