PDA

View Full Version : urgente: spyware

zio-zio
28-10-2004, 21:01
Dopo avermi reso inutilizzabile norton 2004 e cambiato le impostazioni di sicurezza del SP2 da qualche tempo durante la navigazione mi compare una finestra di un motore di ricerca "www.ntsearch.com" che io non ho mai visitato, ho provato ad eliminarlo con spybot ma niente da fare, ora ho fatto la scansione con hijackthis : Logfile of HijackThis v1.97.7
Scan saved at 21.21.16, on 28/10/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Programmi\Norton AntiVirus\navapsvc.exe
C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programmi\Creative\ShareDLL\CtNotify.exe
C:\Programmi\File comuni\Symantec Shared\ccApp.exe
C:\Programmi\Ahead\InCD\InCD.exe
C:\WINDOWS\system32\ciadmin0.exe
C:\WINDOWS\system32\appmgr43.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Documents and Settings\Administrator\Dati applicazioni\taaw.exe
C:\WINDOWS\system32\w?nlogon.exe
C:\Programmi\MSI\PC Alert III\alert.exe
C:\WINDOWS\twain_32\S6U12BX\WATCH.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Creative\ShareDLL\MediaDet.Exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe
C:\Programmi\File comuni\Symantec Shared\Security Center\SymWSC.exe
C:\Programmi\Norton AntiVirus\SAVScan.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\Internet Explorer\iexplore.exe
F:\PROGRAMMI PC\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\system32\SearchBar.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.google.it/
O2 - BHO: (no name) - BHO' - (no file)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: IE Privacy Keeper - Last IE Window Detector - {1201333E-BAD9-481C-BCF5-6904498CF85B} - C:\Programmi\UnH Solutions\IE Privacy Keeper\IEPKbho.dll
O2 - BHO: (no name) - {1ADB4229-C019-2CE2-8170-6C550A847D4F} - C:\WINDOWS\system32\djr.dll
O2 - BHO: Libero - {2170AE22-BED6-4BD8-8A30-775F233B45C0} - C:\Programmi\Libero Toolbar\LiberoDll.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmi\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\Programmi\SEP\sep.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmi\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Band Class - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\Programmi\SEP\sep.dll (file missing)
O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Disc Detector] C:\Programmi\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [CTStartup] C:\Programmi\Creative\SBAudigy\Program\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [InCD] C:\Programmi\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NgcD] C:\documents and settings\administrator\impostazioni locali\temp\NgcD.exe
O4 - HKLM\..\Run: [uDEg4ar] C:\documents and settings\administrator\impostazioni locali\temp\uDEg4ar.exe
O4 - HKLM\..\Run: [a85c085bbd65] C:\WINDOWS\system32\ciadmin0.exe
O4 - HKLM\..\Run: [WebRebates0] "C:\Programmi\Web_Rebates\WebRebates0.exe"
O4 - HKLM\..\Run: [2ce693a64725] C:\WINDOWS\system32\appmgr43.exe
O4 - HKLM\..\Run: [Uninstall_WinTools] C:\WINDOWS\Temp\WTuninst.exe /remove
O4 - HKLM\..\RunServices: [RunAlert] C:\Programmi\MSI\PC Alert III\AService.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Uebp] C:\Documents and Settings\Administrator\Dati applicazioni\taaw.exe
O4 - HKCU\..\Run: [Umeokns] C:\WINDOWS\system32\w?nlogon.exe
O4 - Global Startup: PC Alert III.lnk = C:\Programmi\MSI\PC Alert III\alert.exe
O4 - Global Startup: Watch.lnk = C:\WINDOWS\twain_32\S6U12BX\WATCH.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Web Rebates - file://C:\Programmi\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
O9 - Extra 'Tools' menuitem: MaxSpeed (HKLM)
O9 - Extra button: Ricerche (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {19E28AFC-EAE3-4CE5-AC83-2407B42F57C9} (MSSecurityAdvisor Class) - http://download.microsoft.com/download/0/5/c/05c905f4-dd30-427d-a3de-373c3e5552fc/msSecAdv.cab?1092312955704
O16 - DPF: {8EC18CE2-D7B4-11D2-88C8-006008A717FD} (NCSView Class) - http://ww3.atlanteitaliano.it/ecwplugins/ncs.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

questo è il risultato, ma prima di fare danni vorrei un vostro consiglio
GRAZIE A TUTTI
wgator
28-10-2004, 22:16
Ciao,

hai beccato un brutto spyware (C:\Programmi\Web_Rebates\WebRebates0.exe) più alcune altre cosette.

Ti consiglio di scaricare la trial di spysweeper (http://www.spyware-removal.com/free-spyware-removal.html) e di fare una bella pulizia con quella (anche da mod. provvisoria)

Prima cancella tutti i temporanei e i temporanei di internet.

Dopo l'operazione di pulizia, scarica la nuova versione di hijackthis (http://www.majorgeeks.com/download3155.html) e posta un nuovo log così vediamo se è rimasto qualcosa.

Ah, disattiva anche il ripristino della configurazione del sistema
zio-zio
30-10-2004, 20:48
GRAZIE per la sollecitudine, ora provo e ti farò sapere
canapa
30-10-2004, 21:12
Si in effetti sembrano esserci un pò di cose fori posto.
Tipo:
ciadmin0.exe
appmgr43.exe

Non sò dirti il motivo giusto ma non mi sono mai piaciuti gli exe con numeri nel nome forse perchè il più delle volte corrispondono a processi "virus".

Poi ci sono anche altre cose che non quadrano.
Comunque fai come ti ha detto wgator e poi riposta il log magari co l'ultima versione di hijackthis 1.98.2
zio-zio
30-10-2004, 22:02
Questo è il risultato della pulizia, che ne dite? Logfile of HijackThis v1.97.7
Scan saved at 22.53.52, on 30/10/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Programmi\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe
C:\Programmi\File comuni\Symantec Shared\Security Center\SymWSC.exe
C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programmi\Creative\ShareDLL\CtNotify.exe
C:\Programmi\File comuni\Symantec Shared\ccApp.exe
C:\Programmi\Ahead\InCD\InCD.exe
C:\WINDOWS\system32\ciadmin0.exe
C:\WINDOWS\system32\appmgr43.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Documents and Settings\Administrator\Dati applicazioni\taaw.exe
C:\WINDOWS\system32\w?nlogon.exe
C:\Programmi\Webroot\Spy Sweeper\SpySweeper.exe
C:\Programmi\MSI\PC Alert III\alert.exe
C:\WINDOWS\twain_32\S6U12BX\WATCH.exe
C:\Programmi\Creative\ShareDLL\MediaDet.Exe
C:\Programmi\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
F:\PROGRAMMI PC\HijackThis2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.it
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.it
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.google.it/
O2 - BHO: (no name) - BHO' - (no file)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: IE Privacy Keeper - Last IE Window Detector - {1201333E-BAD9-481C-BCF5-6904498CF85B} - C:\Programmi\UnH Solutions\IE Privacy Keeper\IEPKbho.dll
O2 - BHO: (no name) - {1ADB4229-C019-2CE2-8170-6C550A847D4F} - C:\WINDOWS\system32\djr.dll
O2 - BHO: Libero - {2170AE22-BED6-4BD8-8A30-775F233B45C0} - C:\Programmi\Libero Toolbar\LiberoDll.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmi\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmi\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Disc Detector] C:\Programmi\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [CTStartup] C:\Programmi\Creative\SBAudigy\Program\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [InCD] C:\Programmi\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NgcD] C:\documents and settings\administrator\impostazioni locali\temp\NgcD.exe
O4 - HKLM\..\Run: [uDEg4ar] C:\documents and settings\administrator\impostazioni locali\temp\uDEg4ar.exe
O4 - HKLM\..\Run: [a85c085bbd65] C:\WINDOWS\system32\ciadmin0.exe
O4 - HKLM\..\Run: [2ce693a64725] C:\WINDOWS\system32\appmgr43.exe
O4 - HKLM\..\Run: [Uninstall_WinTools] C:\WINDOWS\Temp\WTuninst.exe /remove
O4 - HKLM\..\RunServices: [RunAlert] C:\Programmi\MSI\PC Alert III\AService.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Uebp] C:\Documents and Settings\Administrator\Dati applicazioni\taaw.exe
O4 - HKCU\..\Run: [Umeokns] C:\WINDOWS\system32\w?nlogon.exe
O4 - HKCU\..\Run: [SpySweeper] "C:\Programmi\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - Global Startup: PC Alert III.lnk = C:\Programmi\MSI\PC Alert III\alert.exe
O4 - Global Startup: Watch.lnk = C:\WINDOWS\twain_32\S6U12BX\WATCH.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Ricerche (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {19E28AFC-EAE3-4CE5-AC83-2407B42F57C9} (MSSecurityAdvisor Class) - http://download.microsoft.com/download/0/5/c/05c905f4-dd30-427d-a3de-373c3e5552fc/msSecAdv.cab?1092312955704
O16 - DPF: {8EC18CE2-D7B4-11D2-88C8-006008A717FD} (NCSView Class) - http://ww3.atlanteitaliano.it/ecwplugins/ncs.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

ancora GRAZIE CIAO
canapa
30-10-2004, 22:28
Oltre a quelli elencati poco fà ci sono altri processi che non conosco:
C:\Documents and Settings\Administrator\Dati applicazioni\taaw.exe
C:\WINDOWS\system32\w?nlogon.exe
---- dovrebbe essere "winlogon" qui c'è un "?" strano..

Prova a fare anche una bella scansione on-line con panda (http://www.pandasoftware.com/activescan/com/activescan_principal.htm)

E vediamo se riusciamo a risolvere qualcosa.