PDA

View Full Version : istsvc.exe

orpheus
21-02-2005, 18:25
Oggi sono andato da una mia amica per un problema di spyware sul suo pc. In pratica dopo 10 minuti (o poco +) ke è in internet gli appare la finestra ke un processo Generic Host Win32 è andato in crash (con conseguente possibilità di inviare l'errore a microsoft) ..dopodichè pochi minuti dopo l'apparizione di questa finestra la connessione e tutto il pc s'impallano tanto da dover riavviare il tutto.

Ho fatto una scansione con adware e mi ha trovato questo malware istsvc con le relative kiavi di registro, ovviamente in esecuzione e quindi ineliminabile anke se termino fisicamente tale processo dal taskmanager mi dice ke il file nn puo' essere cancellato poichè in esecuzione.

Allora disattivo il ripristino di sistema, vado in modalità provvisoria e da lì riesco a cancellarlo (faccio due passate per sicurezza sia di adware ke di spybot e il problema sembra risolto)

Riavvio normalmente il pc e faccio una nuova scansione con adware
e tutto è regolare... appena accedo a internet xo' il file si ricrea e torna in esecuzione rendendo inutile tutto quello ke ho fatto.


Ki mi sa dare una mano?? qcuno ha avuto un problema simile??

grazie per eventuali risposte
bluepix
21-02-2005, 20:41
posta il log di hijackthis che si da un'occhiata ...
orpheus
22-02-2005, 17:15
Questo è il log del pc col problema

Logfile of HijackThis v1.99.1
Scan saved at 17.09.59, on 22/02/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe
C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\Ati2evxx.exe
C:\Programmi\Norton AntiVirus\navapsvc.exe
C:\Programmi\Norton AntiVirus\SAVScan.exe
C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programmi\File comuni\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\rundll32.exe
C:\Programmi\File comuni\Symantec Shared\Security Center\UsrPrmpt.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE
C:\WINDOWS\System32\explorer.exe
C:\WINDOWS\pgtxmhp.exe
C:\top.exe
C:\WINDOWS\System32\dnsrslve.exe
C:\Documents and Settings\User\winworks.exe
C:\WINDOWS\System32\vrsprtc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\cap3d1ag.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\WinRAR\WinRAR.exe
C:\DOCUME~1\User\IMPOST~1\Temp\Rar$EX00.482\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.virgilio.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://trento.freeinternet.it
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: (no name) - _{CA0E28FA-1AFD-4C21-A8DC-70EB5BE2F076} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmi\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Programmi\File comuni\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE /P30 "EPSON Stylus Photo R300 Series" /O6 "USB002" /M "Stylus Photo R300"
O4 - HKLM\..\Run: [Internet Content Publisher] icp.exe
O4 - HKLM\..\Run: [Microsoft Update] explorer.exe
O4 - HKLM\..\Run: [OZu1nGao] C:\WINDOWS\pgtxmhp.exe
O4 - HKLM\..\Run: [¢‰¸u0–4C
}ïÁzî[8C:\Programmi\ISTsvc\istsvc.exe] C:\WINDOWS\pgtxmhp.exe
O4 - HKLM\..\Run: [¢‰¸u0–4C
}ïÁzîžigÝC:\Programmi\ISTsvc\istsvc.exe] C:\WINDOWS\pgtxmhp.exe
O4 - HKLM\..\Run: [¢‰¸u0Ô@ÔÁß]_ú"ü‰üžiC:\Programmi\ISTsvc\istsvc.exe] C:\WINDOWS\pgtxmhp.exe
O4 - HKLM\..\Run: [¢‰¸u0Ô@ÔÁß]_ú"ü‰¸u0C:\Programmi\ISTsvc\istsvc.exe] C:\WINDOWS\pgtxmhp.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [MS Updating Utility] msupdater.exe
O4 - HKLM\..\Run: [REGRUN_5] C:\top.exe
O4 - HKLM\..\Run: [¢‰¸u0ÔÁß]_ú"ü‰üžigÝC:\Programmi\ISTsvc\istsvc.exe] C:\WINDOWS\pgtxmhp.exe
O4 - HKLM\..\Run: [hjohkj] c:\windows\system32\hjohkj.exe
O4 - HKLM\..\Run: [farmmext] C:\WINDOWS\farmmext.exe
O4 - HKLM\..\Run: [Dns Resolver] dnsrslve.exe
O4 - HKLM\..\Run: [AutoLoader4xp61LJLUaKN] "C:\WINDOWS\System32\spmhept.exe" /HideDir /HideUninstall /PC="CP.AMS" /ShowLegalNote="nonbranded"
O4 - HKLM\..\Run: [426g39U] spmhept.exe
O4 - HKLM\..\Run: [Windows Service Pack Auto Update] C:\Documents and Settings\User\winworks.exe
O4 - HKLM\..\Run: [Virus Protect] vrsprtc.exe
O4 - HKLM\..\RunServices: [Microsoft Update] explorer.exe
O4 - HKLM\..\RunServices: [MS Updating Utility] msupdater.exe
O4 - HKLM\..\RunServices: [Dns Resolver] dnsrslve.exe
O4 - HKLM\..\RunServices: [Virus Protect] vrsprtc.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Microsoft Update] explorer.exe
O4 - HKCU\..\Run: [MS Updating Utility] msupdater.exe
O4 - HKCU\..\Run: [L1pmRVYFP] cap3d1ag.exe
O4 - HKCU\..\Run: [Dns Resolver] dnsrslve.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\MSMSGS.EXE
O14 - IERESET.INF: START_PAGE_URL=http://trento.freeinternet.it
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-9.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O18 - Filter: text/html - {4CF279DD-3D71-4A8E-9B74-B93C9E758E43} - C:\Documents and Settings\User\Impostazioni locali\Dati applicazioni\microsoft\internet explorer\V0.26.dat
O20 - Winlogon Notify: MediaContentIndex - C:\WINDOWS\system32\enj6l11s1.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: zfriisrqxnwb (atmaxnbm5) - Unknown owner - C:\WINDOWS\System32\lauwvswu5.exe (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Servizio Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Programmi\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Programmi\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FILECO~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\Security Center\SymWSC.exe
bluepix
22-02-2005, 17:59
Senza responsabilità .... ci sono un po' di cosw da eliminare:


C:\WINDOWS\pgtxmhp.exe
C:\top.exe
C:\WINDOWS\System32\dnsrslve.exe
C:\Documents and Settings\User\winworks.exe
C:\WINDOWS\System32\vrsprtc.exe


C:\WINDOWS\System32\cap3d1ag.exe



R3 - URLSearchHook: (no name) - _{CA0E28FA-1AFD-4C21-A8DC-70EB5BE2F076} - (no file)


O4 - HKLM\..\Run: [Internet Content Publisher] icp.exe
O4 - HKLM\..\Run: [Microsoft Update] explorer.exe
O4 - HKLM\..\Run: [OZu1nGao] C:\WINDOWS\pgtxmhp.exe
O4 - HKLM\..\Run: [¢‰¸u0–4C
}ïÁzî[8C:\Programmi\ISTsvc\istsvc.exe] C:\WINDOWS\pgtxmhp.exe
O4 - HKLM\..\Run: [¢‰¸u0–4C
}ïÁzîžigÝC:\Programmi\ISTsvc\istsvc.exe] C:\WINDOWS\pgtxmhp.exe
O4 - HKLM\..\Run: [¢‰¸u0Ô@ÔÁß]_ú"ü‰üžiC:\Programmi\ISTsvc\istsvc.exe] C:\WINDOWS\pgtxmhp.exe
O4 - HKLM\..\Run: [¢‰¸u0Ô@ÔÁß]_ú"ü‰¸u0C:\Programmi\ISTsvc\istsvc.exe] C:\WINDOWS\pgtxmhp.exe

O4 - HKLM\..\Run: [MS Updating Utility] msupdater.exe
O4 - HKLM\..\Run: [REGRUN_5] C:\top.exe
O4 - HKLM\..\Run: [¢‰¸u0ÔÁß]_ú"ü‰üžigÝC:\Programmi\ISTsvc\istsvc.exe] C:\WINDOWS\pgtxmhp.exe
O4 - HKLM\..\Run: [hjohkj] c:\windows\system32\hjohkj.exe
O4 - HKLM\..\Run: [farmmext] C:\WINDOWS\farmmext.exe
O4 - HKLM\..\Run: [Dns Resolver] dnsrslve.exe
O4 - HKLM\..\Run: [AutoLoader4xp61LJLUaKN] "C:\WINDOWS\System32\spmhept.exe" /HideDir /HideUninstall /PC="CP.AMS" /ShowLegalNote="nonbranded"
O4 - HKLM\..\Run: [426g39U] spmhept.exe
O4 - HKLM\..\Run: [Windows Service Pack Auto Update] C:\Documents and Settings\User\winworks.exe
O4 - HKLM\..\Run: [Virus Protect] vrsprtc.exe
O4 - HKLM\..\RunServices: [Microsoft Update] explorer.exe
O4 - HKLM\..\RunServices: [MS Updating Utility] msupdater.exe
O4 - HKLM\..\RunServices: [Dns Resolver] dnsrslve.exe
O4 - HKLM\..\RunServices: [Virus Protect] vrsprtc.exe


O4 - HKCU\..\Run: [Microsoft Update] explorer.exe
O4 - HKCU\..\Run: [MS Updating Utility] msupdater.exe
O4 - HKCU\..\Run: [L1pmRVYFP] cap3d1ag.exe
O4 - HKCU\..\Run: [Dns Resolver] dnsrslve.exe


O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/...all/xscan53.cab
O18 - Filter: text/html - {4CF279DD-3D71-4A8E-9B74-B93C9E758E43} - C:\Documents and Settings\User\Impostazioni locali\Dati applicazioni\microsoft\internet explorer\V0.26.dat
O20 - Winlogon Notify: MediaContentIndex - C:\WINDOWS\system32\enj6l11s1.dll

O23 - Service: zfriisrqxnwb (atmaxnbm5) - Unknown owner - C:\WINDOWS\System32\lauwvswu5.exe (file missing)

ciao
orpheus
22-02-2005, 19:11
grazie per aiuto..ti faro' sapere come è andata


ciao