Rootkit.Win32.Agent.go!!!pc in fase di demolizione!!!

BEY0ND · 12-07-2007, 15:40

IERI
Ieri sera ho avuto la "brillante" idea di installare sul portatile ashampoo antispyware in accoppiata con superantispyware...
Al riavvio ecco la sorpresa:F-secure mi segnala il rootkit in questione...ma non riusciva ad eliminarlo,mi diceva accesso negato...
Ho sospettato subito che era inerente ad ashampoo,perchè se spuntavo l'opzione guard f-secure lo segnalava,se la deselezionavo non c'era più l'avviso al riavvio.Alla fine l'ho disinstallato.Ho appena fatto scansioni rootkit con sophos,panda,trend,bitdefen...
Solo panda mi trova questo: c:/WINDOWS/system32/shdocvw.dll
OGGi
Forse già l'ospite sta iniziando la sua demolizione...
f-secure non monitorato,comodo disattivato
mi rimangono prevx2,terminator,a-squared
fatta pure scansione con gmer niente voci rosse...

aiuto

BEY0ND · 12-07-2007, 16:02

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16.55.47, on 12/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Intel\Wireless\Bin\EvtEng.exe
C:\Programmi\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\a-squared Free\a2service.exe
C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
C:\Programmi\Comodo\Firewall\cmdagent.exe
C:\Programmi\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
C:\Programmi\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
C:\Programmi\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
C:\Programmi\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
C:\Programmi\F-Secure Internet Security\Common\FSMA32.EXE
C:\Programmi\F-Secure Internet Security\Anti-Virus\fssm32.exe
C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Programmi\F-Secure Internet Security\Common\FSMB32.EXE
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\F-Secure Internet Security\Common\FCH32.EXE
C:\Programmi\Prevx2\PXAgent.exe
C:\Programmi\F-Secure Internet Security\Common\FAMEH32.EXE
C:\Programmi\F-Secure Internet Security\Anti-Virus\fsqh.exe
C:\Programmi\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\Programmi\F-Secure Internet Security\Anti-Virus\fsrw.exe
C:\Programmi\Wireless Console 2\wcourier.exe
C:\Programmi\ASUS\ATK Media\DMEDIA.EXE
C:\Programmi\Sandboxie\SbieSvc.exe
C:\Programmi\SiteAdvisor\6066\SAService.exe
C:\Programmi\ATI Technologies\ATI.ACE\cli.exe
C:\Programmi\ASUS\Power4 Gear\BatteryLife.exe
C:\Programmi\Spyware Terminator\sp_rsser.exe
C:\Programmi\ASUSTeK\ASUSDVD\PDVDServ.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\SiteAdvisor\6066\SiteAdv.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Programmi\F-Secure Internet Security\Common\FSM32.EXE
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Comodo\Firewall\CPF.exe
C:\Programmi\Prevx2\PXConsole.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Programmi\F-Secure Internet Security\FWES\Program\fsdfwd.exe
C:\Programmi\F-Secure Internet Security\Anti-Virus\fsav32.exe
C:\PROGRA~1\F-SECU~1\ANTI-S~1\fsaw.exe
C:\Programmi\F-Secure Internet Security\FSGUI\fsguidll.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmi\ATI Technologies\ATI.ACE\cli.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.asus.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - Default URLSearchHook is missing
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Programmi\SiteAdvisor\6066\SiteAdv.dll
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Dati applicazioni\Prevx\pxbho.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.0.301.5672\swg.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Programmi\SiteAdvisor\6066\SiteAdv.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar1.dll
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [Wireless Console 2] C:\Programmi\Wireless Console 2\wcourier.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Programmi\ASUS\ATK Media\DMEDIA.EXE
O4 - HKLM\..\Run: [ABLKSR] C:\WINDOWS\ABLKSR\ABLKSR.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Programmi\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Power_Gear] C:\Programmi\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [RemoteControl] C:\Programmi\ASUSTeK\ASUSDVD\PDVDServ.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SiteAdvisor] C:\Programmi\SiteAdvisor\6066\SiteAdv.exe
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Programmi\F-Secure Internet Security\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Programmi\F-Secure Internet Security\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Programmi\F-Secure Internet Security\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Programmi\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [PrevxOne] "C:\Programmi\Prevx2\PXConsole.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Programmi\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: F-Secure Anti-Virus 2006.lnk = C:\Programmi\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
O8 - Extra context menu item: &Blocca questo popup - C:\Programmi\F-Secure Internet Security\Anti-Spyware\blockpopups.htm
O9 - Extra button: Protezione IE - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Programmi\F-Secure Internet Security\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: Protezione IE... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Programmi\F-Secure Internet Security\Anti-Spyware\ieshield.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com
O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} - http://messenger.zone.msn.com/binary...t.cab55762.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - http://messenger.zone.msn.com/binary...o.cab55579.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} - http://messenger.zone.msn.com/binary/Chess.cab55200.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9868DB82-8AD7-408C-A19A-5FBA9C5C81F8}: NameServer = 85.37.17.50 85.38.28.76
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Programmi\a-squared Free\a2service.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: F-Secure Anti-Virus 2006 (BackWeb Plug-in - 4476822) - F-Secure Internet Security 2005 - C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Programmi\Comodo\Firewall\cmdagent.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Programmi\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Programmi\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Programmi\F-Secure Internet Security\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Programmi\F-Secure Internet Security\Common\FSMA32.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe
O23 - Service: Prevx Agent (PREVXAgent) - Prevx - C:\Programmi\Prevx2\PXAgent.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Sandboxie Service (SbieSvc) - tzuk - C:\Programmi\Sandboxie\SbieSvc.exe
O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Programmi\SiteAdvisor\6066\SAService.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Programmi\Spyware Terminator\sp_rsser.exe

--
End of file - 9562 bytes

Questo alle 17.45

senza fare nulla

d.gordon · 12-07-2007, 16:56

Beyond non so se hai già visto nella sezione Antivirus e sicurezza c'è gia un post specifico vedi un pò...

BEY0ND · 12-07-2007, 17:03

Quote:

Originariamente inviato da d.gordon

Beyond non so se hai già visto nella sezione Antivirus e sicurezza c'è gia un post specifico vedi un pò...

vengo proprio da lì...

ritenendomi già infetto...mi sono trasferito qui,mi sembrava la sezione giusta...
grazie cmq

wizard1993 · 12-07-2007, 17:25

fai una scan con gmer

juninho85 · 12-07-2007, 17:25

...ma la tua convinzione di avere il rootkit e non che sia un falso positivo da cosa deriva?!

juninho85 · 12-07-2007, 17:34

fermi tutti

Quote:

Originariamente inviato da BEY0ND

O4 - HKLM\..\Run: [ABLKSR] C:\WINDOWS\ABLKSR\ABLKSR.exe

fallo analizzare qui

BEY0ND · 12-07-2007, 17:44

Quote:

Originariamente inviato da wizard1993

fai una scan con gmer

quando ci clicco su,mi spuntano queste voci,ma nessuna è rossa

Quote:

Originariamente inviato da juninho85

...ma la tua convinzione di avere il rootkit e non che sia un falso positivo da cosa deriva?!

Dal fatto che nel centro sicurezza pc,almeno fino a un'oretta fà avessi f-secure e comodo disattivati...
sicuramente non sarà una motivazione valida,ma meglio essere previdenti,penso...

juninho85 · 12-07-2007, 17:46

per caso hai aggiornato entrambi senza aver dopo riavviato il pc?

BEY0ND · 12-07-2007, 17:55

Quote:

Originariamente inviato da juninho85

per caso hai aggiornato entrambi senza aver dopo riavviato il pc?

Gli aggiornamenti sono automatici su entrambi,ma dopo l'update avevo cmq riavviato...
se clicco sul link non mi apre la pagina mi da errore not found 404,però se vado sul sito virus total me lo apre,solo che non saprei dove andare per farlo analizzare...

Di gmer che mi dici?

edit:sto analizzando il file...
ecco il responso:
File ABLKSR.EXE
Antivirus Version Last Update Result
AhnLab-V3 2007.7.13.0 2007.07.12 no virus found
AntiVir 7.4.0.39 2007.07.12 no virus found
Authentium 4.93.8 2007.07.12 no virus found
Avast 4.7.997.0 2007.07.12 no virus found
AVG 7.5.0.476 2007.07.12 no virus found
BitDefender 7.2 2007.07.12 no virus found
CAT-QuickHeal 9.00 2007.07.12 no virus found
ClamAV devel-20070416 2007.07.12 no virus found
DrWeb 4.33 2007.07.12 no virus found
eSafe 7.0.15.0 2007.07.10 no virus found
eTrust-Vet 30.8.3781 2007.07.12 no virus found
Ewido 4.0 2007.07.12 no virus found
FileAdvisor 1 2007.07.12 no virus found
Fortinet 2.91.0.0 2007.07.12 no virus found
F-Prot 4.3.2.48 2007.07.11 no virus found
Ikarus T3.1.1.8 2007.07.12 no virus found
Kaspersky 4.0.2.24 2007.07.12 no virus found
McAfee 5073 2007.07.12 no virus found
Microsoft 1.2704 2007.07.12 no virus found
NOD32v2 2395 2007.07.12 no virus found
Norman 5.80.02 2007.07.12 no virus found
Panda 9.0.0.4 2007.07.12 no virus found
Sophos 4.19.0 2007.07.06 no virus found
Sunbelt 2.2.907.0 2007.07.12 no virus found
Symantec 10 2007.07.12 no virus found
TheHacker 6.1.6.145 2007.07.12 no virus found
VBA32 3.12.0.2 2007.07.12 no virus found
VirusBuster 4.3.23:9 2007.07.12 no virus found
Webwasher-Gateway 6.0.1 2007.07.12 no virus found

http://www.liutilities.com/products/...ibrary/ablksr/
ho trovato questo,mi viene il buddio che sia qualcosa collegata ad asus...o non c'entra niente?

juninho85 · 12-07-2007, 20:34

esatto è della asus...con gmer c'hai già detto di non aver trovato nulla no?

comunque tieni sotto controllo la situazione riguardo il centro di sicurezza ed eventualmente facci sapere

BEY0ND · 12-07-2007, 21:04

Quote:

Originariamente inviato da juninho85

esatto è della asus...con gmer c'hai già detto di non aver trovato nulla no?

comunque tieni sotto controllo la situazione riguardo il centro di sicurezza ed eventualmente facci sapere

C'è l'ha anche un amico su un portatile asus...cmq finora tutto sembra tranquillo...
una curiosità:il fatto che nel centro sicurezza risultino disattivati equivale a dire che sono realmente disattivati,perchè vedo che comodo si aggiorna,e lavora normalmente,lo stesso dicasi per f-secure(almeno per gli aggiornamenti)...

juninho85 · 12-07-2007, 22:04

ciò non fa che avvalorare la mia tesi riguardo il centro di sicurezza di windows:NON SERVE

BEY0ND · 12-07-2007, 22:42

Quote:

Originariamente inviato da juninho85

ciò non fa che avvalorare la mia tesi riguardo il centro di sicurezza di windows:NON SERVE

presumo,senza offesa per il verbo...che tu l'abbia disattivato

occhio non vede...cuore non duole(almeno per il mio caso)...

Saluti

lancetta · 12-07-2007, 22:55

Quote:

R3 - Default URLSearchHook is missing

fixa questo

BEY0ND · 12-07-2007, 23:25

Quote:

Originariamente inviato da lancetta

fixa questo

ok lo faccio,ma prima toglimi una curiosità,puoi dare un'occhiata a questo...
http://www.hwupgrade.it/forum/showthread.php?t=1508575
Se vedi il log è lo stesso valore che non mi permette l'installazione di ie7?
grazie

BEY0ND · 12-07-2007, 23:36

Logfile of HijackThis v1.99.1
Scan saved at 0.31.24, on 13/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Intel\Wireless\Bin\EvtEng.exe
C:\Programmi\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\a-squared Free\a2service.exe
C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
C:\Programmi\Comodo\Firewall\cmdagent.exe
C:\Programmi\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
C:\Programmi\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
C:\Programmi\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
C:\Programmi\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
C:\Programmi\F-Secure Internet Security\Common\FSMA32.EXE
C:\Programmi\F-Secure Internet Security\Anti-Virus\fssm32.exe
C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Programmi\F-Secure Internet Security\Common\FSMB32.EXE
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\F-Secure Internet Security\Common\FCH32.EXE
C:\Programmi\Prevx2\PXAgent.exe
C:\Programmi\F-Secure Internet Security\Common\FAMEH32.EXE
C:\Programmi\F-Secure Internet Security\Anti-Virus\fsqh.exe
C:\Programmi\F-Secure Internet Security\Anti-Virus\fsrw.exe
C:\Programmi\Intel\Wireless\Bin\RegSrvc.exe
C:\Programmi\Sandboxie\SbieSvc.exe
C:\Programmi\SiteAdvisor\6066\SAService.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\Programmi\Wireless Console 2\wcourier.exe
C:\Programmi\Spyware Terminator\sp_rsser.exe
C:\Programmi\ASUS\ATK Media\DMEDIA.EXE
C:\Programmi\ATI Technologies\ATI.ACE\cli.exe
C:\Programmi\ASUS\Power4 Gear\BatteryLife.exe
C:\Programmi\ASUSTeK\ASUSDVD\PDVDServ.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\SiteAdvisor\6066\SiteAdv.exe
C:\Programmi\F-Secure Internet Security\Common\FSM32.EXE
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Programmi\Comodo\Firewall\CPF.exe
C:\Programmi\Prevx2\PXConsole.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Programmi\F-Secure Internet Security\FWES\Program\fsdfwd.exe
C:\Programmi\F-Secure Internet Security\Anti-Virus\fsav32.exe
C:\PROGRA~1\F-SECU~1\ANTI-S~1\fsaw.exe
C:\Programmi\F-Secure Internet Security\FSGUI\fsguidll.exe
C:\Programmi\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Utente\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.asus.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - Default URLSearchHook is missing
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Programmi\SiteAdvisor\6066\SiteAdv.dll
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Dati applicazioni\Prevx\pxbho.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.0.301.5672\swg.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Programmi\SiteAdvisor\6066\SiteAdv.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar1.dll
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [Wireless Console 2] C:\Programmi\Wireless Console 2\wcourier.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Programmi\ASUS\ATK Media\DMEDIA.EXE
O4 - HKLM\..\Run: [ABLKSR] C:\WINDOWS\ABLKSR\ABLKSR.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Programmi\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Power_Gear] C:\Programmi\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [RemoteControl] C:\Programmi\ASUSTeK\ASUSDVD\PDVDServ.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SiteAdvisor] C:\Programmi\SiteAdvisor\6066\SiteAdv.exe
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Programmi\F-Secure Internet Security\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Programmi\F-Secure Internet Security\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Programmi\F-Secure Internet Security\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Programmi\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [PrevxOne] "C:\Programmi\Prevx2\PXConsole.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Programmi\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - Global Startup: F-Secure Anti-Virus 2006.lnk = C:\Programmi\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
O8 - Extra context menu item: &Blocca questo popup - C:\Programmi\F-Secure Internet Security\Anti-Spyware\blockpopups.htm
O9 - Extra button: Protezione IE - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Programmi\F-Secure Internet Security\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: Protezione IE... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Programmi\F-Secure Internet Security\Anti-Spyware\ieshield.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com
O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} - http://messenger.zone.msn.com/binary...t.cab55762.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - http://messenger.zone.msn.com/binary...o.cab55579.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} - http://messenger.zone.msn.com/binary/Chess.cab55200.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9868DB82-8AD7-408C-A19A-5FBA9C5C81F8}: NameServer = 85.37.17.50 85.38.28.76
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Programmi\SiteAdvisor\6066\SiteAdv.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Programmi\a-squared Free\a2service.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: F-Secure Anti-Virus 2006 (BackWeb Plug-in - 4476822) - F-Secure Internet Security 2005 - C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Programmi\Comodo\Firewall\cmdagent.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Programmi\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Programmi\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Programmi\F-Secure Internet Security\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Programmi\F-Secure Internet Security\Common\FSMA32.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Programmi\Prevx2\PXAgent.exe" -f (file missing)
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Sandboxie Service (SbieSvc) - tzuk - C:\Programmi\Sandboxie\SbieSvc.exe
O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Programmi\SiteAdvisor\6066\SAService.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Programmi\Spyware Terminator\sp_rsser.exe

Anche se fixo la voce rifacendo il log rispunta...

Un'altra info:ho volutamente fare il log della versione precedente perchè ho notato diversità con quello postato in precedenza,mi sembra che qua ci siano più cose da fixare o sbaglio?
Ps:la voce naturalmente ritorna su entrambe le versioni...

mausap · 13-07-2007, 00:00

C:\Programmi\Sandboxie\SbieSvc.exe

Ma hai preso un virus con sandboxie?
Porca .......

Ma non l'hai usato mentri navigavi altrimenti qua veramente è un casino

a C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll è vunerabile

fai una passata con secunia software inspector

BEY0ND · 13-07-2007, 00:16

Quote:

Originariamente inviato da mausap

C:\Programmi\Sandboxie\SbieSvc.exe

Ma hai preso un virus con sandboxie?
Porca .......

Ma non l'hai usato mentri navigavi altrimenti qua veramente è un casino

a C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll è vunerabile

fai una passata con secunia software inspector

Ma scusa non è un servizio di sandboxie?
Cmq non lo uso per navigare,perchè non mi avventuro...
lo uso raramente,ad es. per testare programmi che non conosco...

verificato su virus total:non è un virus...
adobe lo aggiorno al più presto...

Saluti

mausap · 13-07-2007, 00:35

Quote:

Originariamente inviato da BEY0ND

Ma scusa non è un servizio di sandboxie?
Cmq non lo uso per navigare,perchè non mi avventuro...
lo uso raramente,ad es. per testare programmi che non conosco...

verificato su virus total:non è un virus...
adobe lo aggiorno al più presto...

Saluti

No non è un virus ovviamente, dicevo che se hai sendboxie e navighi usandolo sul browser è difficilissimo essere infettati

12-07-2007, 15:40	#1
BEY0ND Senior Member Iscritto dal: Apr 2007 Messaggi: 2306	Rootkit.Win32.Agent.go!!!pc in fase di demolizione!!! IERI Ieri sera ho avuto la "brillante" idea di installare sul portatile ashampoo antispyware in accoppiata con superantispyware... Al riavvio ecco la sorpresa:F-secure mi segnala il rootkit in questione...ma non riusciva ad eliminarlo,mi diceva accesso negato... Ho sospettato subito che era inerente ad ashampoo,perchè se spuntavo l'opzione guard f-secure lo segnalava,se la deselezionavo non c'era più l'avviso al riavvio.Alla fine l'ho disinstallato.Ho appena fatto scansioni rootkit con sophos,panda,trend,bitdefen... Solo panda mi trova questo: c:/WINDOWS/system32/shdocvw.dll OGGi Forse già l'ospite sta iniziando la sua demolizione... f-secure non monitorato,comodo disattivato mi rimangono prevx2,terminator,a-squared fatta pure scansione con gmer niente voci rosse... aiuto Ultima modifica di BEY0ND : 12-07-2007 alle 16:33.

12-07-2007, 16:02	#2
BEY0ND Senior Member Iscritto dal: Apr 2007 Messaggi: 2306	ecco il log Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16.55.47, on 12/07/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Programmi\Intel\Wireless\Bin\EvtEng.exe C:\Programmi\Intel\Wireless\Bin\S24EvMon.exe C:\WINDOWS\SYSTEM32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Programmi\a-squared Free\a2service.exe C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE C:\Programmi\Comodo\Firewall\cmdagent.exe C:\Programmi\F-Secure Internet Security\Anti-Virus\fsgk32st.exe C:\Programmi\F-Secure Internet Security\Anti-Virus\FSGK32.EXE C:\Programmi\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe C:\Programmi\F-Secure Internet Security\backweb\4476822\Program\fspex.exe C:\Programmi\F-Secure Internet Security\Common\FSMA32.EXE C:\Programmi\F-Secure Internet Security\Anti-Virus\fssm32.exe C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe C:\Programmi\F-Secure Internet Security\Common\FSMB32.EXE C:\Programmi\File comuni\LightScribe\LSSrvc.exe C:\Programmi\F-Secure Internet Security\Common\FCH32.EXE C:\Programmi\Prevx2\PXAgent.exe C:\Programmi\F-Secure Internet Security\Common\FAMEH32.EXE C:\Programmi\F-Secure Internet Security\Anti-Virus\fsqh.exe C:\Programmi\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\ATK0100\HControl.exe C:\Programmi\F-Secure Internet Security\Anti-Virus\fsrw.exe C:\Programmi\Wireless Console 2\wcourier.exe C:\Programmi\ASUS\ATK Media\DMEDIA.EXE C:\Programmi\Sandboxie\SbieSvc.exe C:\Programmi\SiteAdvisor\6066\SAService.exe C:\Programmi\ATI Technologies\ATI.ACE\cli.exe C:\Programmi\ASUS\Power4 Gear\BatteryLife.exe C:\Programmi\Spyware Terminator\sp_rsser.exe C:\Programmi\ASUSTeK\ASUSDVD\PDVDServ.exe C:\Programmi\Synaptics\SynTP\SynTPEnh.exe C:\Programmi\SiteAdvisor\6066\SiteAdv.exe C:\WINDOWS\ATK0100\ATKOSD.exe C:\Programmi\F-Secure Internet Security\Common\FSM32.EXE C:\WINDOWS\system32\svchost.exe C:\Programmi\Comodo\Firewall\CPF.exe C:\Programmi\Prevx2\PXConsole.exe C:\WINDOWS\system32\ctfmon.exe C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Programmi\F-Secure Internet Security\FWES\Program\fsdfwd.exe C:\Programmi\F-Secure Internet Security\Anti-Virus\fsav32.exe C:\PROGRA~1\F-SECU~1\ANTI-S~1\fsaw.exe C:\Programmi\F-Secure Internet Security\FSGUI\fsguidll.exe C:\WINDOWS\system32\wuauclt.exe C:\Programmi\ATI Technologies\ATI.ACE\cli.exe C:\Programmi\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Programmi\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.it/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.asus.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti R3 - Default URLSearchHook is missing O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Programmi\SiteAdvisor\6066\SiteAdv.dll O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Dati applicazioni\Prevx\pxbho.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.0.301.5672\swg.dll O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Programmi\SiteAdvisor\6066\SiteAdv.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar1.dll O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe O4 - HKLM\..\Run: [Wireless Console 2] C:\Programmi\Wireless Console 2\wcourier.exe O4 - HKLM\..\Run: [ATKMEDIA] C:\Programmi\ASUS\ATK Media\DMEDIA.EXE O4 - HKLM\..\Run: [ABLKSR] C:\WINDOWS\ABLKSR\ABLKSR.exe O4 - HKLM\..\Run: [ATICCC] "C:\Programmi\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [Power_Gear] C:\Programmi\ASUS\Power4 Gear\BatteryLife.exe 1 O4 - HKLM\..\Run: [RemoteControl] C:\Programmi\ASUSTeK\ASUSDVD\PDVDServ.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [SiteAdvisor] C:\Programmi\SiteAdvisor\6066\SiteAdv.exe O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [F-Secure Manager] "C:\Programmi\F-Secure Internet Security\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Programmi\F-Secure Internet Security\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Programmi\F-Secure Internet Security\FSGUI\FSSW.EXE" /reboot O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Programmi\Comodo\Firewall\CPF.exe" /background O4 - HKLM\..\Run: [PrevxOne] "C:\Programmi\Prevx2\PXConsole.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [updateMgr] "C:\Programmi\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1 O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: F-Secure Anti-Virus 2006.lnk = C:\Programmi\F-Secure Internet Security\backweb\4476822\Program\fspex.exe O8 - Extra context menu item: &Blocca questo popup - C:\Programmi\F-Secure Internet Security\Anti-Spyware\blockpopups.htm O9 - Extra button: Protezione IE - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Programmi\F-Secure Internet Security\Anti-Spyware\ieshield.dll O9 - Extra 'Tools' menuitem: Protezione IE... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Programmi\F-Secure Internet Security\Anti-Spyware\ieshield.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} - http://messenger.zone.msn.com/binary...t.cab55762.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - http://messenger.zone.msn.com/binary...o.cab55579.cab O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} - http://messenger.zone.msn.com/binary/Chess.cab55200.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{9868DB82-8AD7-408C-A19A-5FBA9C5C81F8}: NameServer = 85.37.17.50 85.38.28.76 O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Programmi\a-squared Free\a2service.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: F-Secure Anti-Virus 2006 (BackWeb Plug-in - 4476822) - F-Secure Internet Security 2005 - C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Programmi\Comodo\Firewall\cmdagent.exe O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\EvtEng.exe O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Programmi\F-Secure Internet Security\Anti-Virus\fsgk32st.exe O23 - Service: fsbwsys - F-Secure Corp. - C:\Programmi\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Programmi\F-Secure Internet Security\FWES\Program\fsdfwd.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Programmi\F-Secure Internet Security\Common\FSMA32.EXE O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe O23 - Service: Prevx Agent (PREVXAgent) - Prevx - C:\Programmi\Prevx2\PXAgent.exe O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: Sandboxie Service (SbieSvc) - tzuk - C:\Programmi\Sandboxie\SbieSvc.exe O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Programmi\SiteAdvisor\6066\SAService.exe O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Programmi\Spyware Terminator\sp_rsser.exe -- End of file - 9562 bytes Questo alle 17.45 senza fare nulla Ultima modifica di BEY0ND : 12-07-2007 alle 16:48.

12-07-2007, 17:25	#5
wizard1993 Senior Member Iscritto dal: Apr 2006 Messaggi: 22462	fai una scan con gmer __________________ amd a64x2 4400+ sk939;asus a8n-sli; 2x1gb ddr400; x850 crossfire; 2 x western digital abys 320gb\|\| asus g1 Se striscia fulmina, se svolazza l'ammazza

13-07-2007, 00:00	#18
mausap Senior Member Iscritto dal: Jan 2007 Messaggi: 308	C:\Programmi\Sandboxie\SbieSvc.exe Ma hai preso un virus con sandboxie? Porca ....... Ma non l'hai usato mentri navigavi altrimenti qua veramente è un casino a C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll è vunerabile fai una passata con secunia software inspector __________________ maipiugromozon.blogspot.com Ultima modifica di mausap : 13-07-2007 alle 00:04.

12-07-2007, 16:56	#3
d.gordon Member Iscritto dal: Jun 2007 Messaggi: 119	Beyond non so se hai già visto nella sezione Antivirus e sicurezza c'è gia un post specifico vedi un pò...

12-07-2007, 17:25	#6
juninho85 Bannato Iscritto dal: Mar 2004 Città: Galapagos Attenzione:utente flautolente,tienilo a mente Messaggi: 28978	...ma la tua convinzione di avere il rootkit e non che sia un falso positivo da cosa deriva?!

12-07-2007, 17:46	#9
juninho85 Bannato Iscritto dal: Mar 2004 Città: Galapagos Attenzione:utente flautolente,tienilo a mente Messaggi: 28978	per caso hai aggiornato entrambi senza aver dopo riavviato il pc?

12-07-2007, 20:34	#11
juninho85 Bannato Iscritto dal: Mar 2004 Città: Galapagos Attenzione:utente flautolente,tienilo a mente Messaggi: 28978	esatto è della asus...con gmer c'hai già detto di non aver trovato nulla no? comunque tieni sotto controllo la situazione riguardo il centro di sicurezza ed eventualmente facci sapere

12-07-2007, 22:04	#13
juninho85 Bannato Iscritto dal: Mar 2004 Città: Galapagos Attenzione:utente flautolente,tienilo a mente Messaggi: 28978	ciò non fa che avvalorare la mia tesi riguardo il centro di sicurezza di windows:NON SERVE

12-07-2007, 23:36	#17
BEY0ND Senior Member Iscritto dal: Apr 2007 Messaggi: 2306	Logfile of HijackThis v1.99.1 Scan saved at 0.31.24, on 13/07/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Programmi\Intel\Wireless\Bin\EvtEng.exe C:\Programmi\Intel\Wireless\Bin\S24EvMon.exe C:\WINDOWS\SYSTEM32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Programmi\a-squared Free\a2service.exe C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE C:\Programmi\Comodo\Firewall\cmdagent.exe C:\Programmi\F-Secure Internet Security\Anti-Virus\fsgk32st.exe C:\Programmi\F-Secure Internet Security\Anti-Virus\FSGK32.EXE C:\Programmi\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe C:\Programmi\F-Secure Internet Security\backweb\4476822\Program\fspex.exe C:\Programmi\F-Secure Internet Security\Common\FSMA32.EXE C:\Programmi\F-Secure Internet Security\Anti-Virus\fssm32.exe C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe C:\Programmi\F-Secure Internet Security\Common\FSMB32.EXE C:\Programmi\File comuni\LightScribe\LSSrvc.exe C:\Programmi\F-Secure Internet Security\Common\FCH32.EXE C:\Programmi\Prevx2\PXAgent.exe C:\Programmi\F-Secure Internet Security\Common\FAMEH32.EXE C:\Programmi\F-Secure Internet Security\Anti-Virus\fsqh.exe C:\Programmi\F-Secure Internet Security\Anti-Virus\fsrw.exe C:\Programmi\Intel\Wireless\Bin\RegSrvc.exe C:\Programmi\Sandboxie\SbieSvc.exe C:\Programmi\SiteAdvisor\6066\SAService.exe C:\WINDOWS\ATK0100\HControl.exe C:\Programmi\Wireless Console 2\wcourier.exe C:\Programmi\Spyware Terminator\sp_rsser.exe C:\Programmi\ASUS\ATK Media\DMEDIA.EXE C:\Programmi\ATI Technologies\ATI.ACE\cli.exe C:\Programmi\ASUS\Power4 Gear\BatteryLife.exe C:\Programmi\ASUSTeK\ASUSDVD\PDVDServ.exe C:\WINDOWS\system32\svchost.exe C:\Programmi\Synaptics\SynTP\SynTPEnh.exe C:\Programmi\SiteAdvisor\6066\SiteAdv.exe C:\Programmi\F-Secure Internet Security\Common\FSM32.EXE C:\WINDOWS\ATK0100\ATKOSD.exe C:\Programmi\Comodo\Firewall\CPF.exe C:\Programmi\Prevx2\PXConsole.exe C:\WINDOWS\system32\ctfmon.exe C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Programmi\F-Secure Internet Security\FWES\Program\fsdfwd.exe C:\Programmi\F-Secure Internet Security\Anti-Virus\fsav32.exe C:\PROGRA~1\F-SECU~1\ANTI-S~1\fsaw.exe C:\Programmi\F-Secure Internet Security\FSGUI\fsguidll.exe C:\Programmi\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\system32\wuauclt.exe C:\Programmi\Mozilla Firefox\firefox.exe C:\Documents and Settings\Utente\Desktop\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.it/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.asus.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti R3 - Default URLSearchHook is missing O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Programmi\SiteAdvisor\6066\SiteAdv.dll O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Dati applicazioni\Prevx\pxbho.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.0.301.5672\swg.dll O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Programmi\SiteAdvisor\6066\SiteAdv.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar1.dll O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe O4 - HKLM\..\Run: [Wireless Console 2] C:\Programmi\Wireless Console 2\wcourier.exe O4 - HKLM\..\Run: [ATKMEDIA] C:\Programmi\ASUS\ATK Media\DMEDIA.EXE O4 - HKLM\..\Run: [ABLKSR] C:\WINDOWS\ABLKSR\ABLKSR.exe O4 - HKLM\..\Run: [ATICCC] "C:\Programmi\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [Power_Gear] C:\Programmi\ASUS\Power4 Gear\BatteryLife.exe 1 O4 - HKLM\..\Run: [RemoteControl] C:\Programmi\ASUSTeK\ASUSDVD\PDVDServ.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [SiteAdvisor] C:\Programmi\SiteAdvisor\6066\SiteAdv.exe O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [F-Secure Manager] "C:\Programmi\F-Secure Internet Security\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Programmi\F-Secure Internet Security\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Programmi\F-Secure Internet Security\FSGUI\FSSW.EXE" /reboot O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Programmi\Comodo\Firewall\CPF.exe" /background O4 - HKLM\..\Run: [PrevxOne] "C:\Programmi\Prevx2\PXConsole.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [updateMgr] "C:\Programmi\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1 O4 - Global Startup: F-Secure Anti-Virus 2006.lnk = C:\Programmi\F-Secure Internet Security\backweb\4476822\Program\fspex.exe O8 - Extra context menu item: &Blocca questo popup - C:\Programmi\F-Secure Internet Security\Anti-Spyware\blockpopups.htm O9 - Extra button: Protezione IE - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Programmi\F-Secure Internet Security\Anti-Spyware\ieshield.dll O9 - Extra 'Tools' menuitem: Protezione IE... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Programmi\F-Secure Internet Security\Anti-Spyware\ieshield.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} - http://messenger.zone.msn.com/binary...t.cab55762.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - http://messenger.zone.msn.com/binary...o.cab55579.cab O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} - http://messenger.zone.msn.com/binary/Chess.cab55200.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{9868DB82-8AD7-408C-A19A-5FBA9C5C81F8}: NameServer = 85.37.17.50 85.38.28.76 O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Programmi\SiteAdvisor\6066\SiteAdv.dll O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Programmi\a-squared Free\a2service.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: F-Secure Anti-Virus 2006 (BackWeb Plug-in - 4476822) - F-Secure Internet Security 2005 - C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Programmi\Comodo\Firewall\cmdagent.exe O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\EvtEng.exe O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Programmi\F-Secure Internet Security\Anti-Virus\fsgk32st.exe O23 - Service: fsbwsys - F-Secure Corp. - C:\Programmi\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Programmi\F-Secure Internet Security\FWES\Program\fsdfwd.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Programmi\F-Secure Internet Security\Common\FSMA32.EXE O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Programmi\Prevx2\PXAgent.exe" -f (file missing) O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: Sandboxie Service (SbieSvc) - tzuk - C:\Programmi\Sandboxie\SbieSvc.exe O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Programmi\SiteAdvisor\6066\SAService.exe O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Programmi\Spyware Terminator\sp_rsser.exe Anche se fixo la voce rifacendo il log rispunta... Un'altra info:ho volutamente fare il log della versione precedente perchè ho notato diversità con quello postato in precedenza,mi sembra che qua ci siano più cose da fixare o sbaglio? Ps:la voce naturalmente ritorna su entrambe le versioni...

Strumenti
Mostra una versione stampabile Invia questa pagina per email