|
|||||||
|
|
|
 |
|
|
Strumenti |
14-08-2007, 18:26
|
#1 |
|
Registered User
Iscritto dal: Aug 2006
Messaggi: 305
|
Necessito di aiuto
Codice:
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 19.18.03, on 14/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\TGTSoft\StyleXP\StyleXPService.exe
C:\Programmi\Intel\Wireless\Bin\EvtEng.exe
C:\Programmi\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe
C:\Programmi\Intel\Wireless\Bin\RegSrvc.exe
C:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\acer\epm\epm-dm.exe
C:\Programmi\Google\Gmail Notifier\gnotify.exe
C:\Programmi\Launch Manager\QtZgAcer.EXE
C:\Programmi\QuickTime\qttask.exe
C:\Programmi\Unlocker\UnlockerAssistant.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Programmi\WIDCOMM\Software Bluetooth\BTTray.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Stefano\Desktop\HiJackThis_v2.exe
C:\WINDOWS\exefnd\74437.exe
C:\WINDOWS\exefnd\77687.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 131.175.12.65:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: ContextualAds Class - {3AAC4C68-AFC8-11DB-80EF-8AF955D89593} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Alcohol Toolbar Helper - {8126A4A5-BFD3-46FE-BBDF-BFB5CF78E489} - C:\Programmi\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Alcohol Toolbar - {ED4BD629-C1B6-4399-8A34-02CCAA921DC9} - C:\Programmi\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Programmi\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [LManager] C:\Programmi\Launch Manager\QtZgAcer.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Programmi\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Programmi\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: &Clean Traces - C:\Programmi\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Programmi\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Programmi\DAP\dapextie2.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Invia a &Bluetooth - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie.htm
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programmi\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programmi\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20070501/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2A56CA5D-A513-48C8-89DB-62A90E5269AF}: NameServer = 192.168.0.1
O20 - AppInit_DLLs: ? ??C
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe
O23 - Service: EvtEng - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Servizio iPod (iPod Service) - Unknown owner - C:\Programmi\iPod\bin\iPodService.exe (file missing)
O23 - Service: RegSrvc - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: StyleXPService - Unknown owner - C:\Programmi\TGTSoft\StyleXP\StyleXPService.exe
--
End of file - 8455 bytes
Nel caso provo a reinstallarlo, non riesco perché quei files spariscono durante l'estrazione dal rar. Ad-Aware se non trova niente. All'avvio del sistema si formano 3 o più processi con nomi casuali inizianti per tilde che occupano tutta la cpu. Se provo ad installare kaspersky esce ad un certo punto una schermata blu e il sistema si riavvia. Non posso accedere alla modalità provvisoria poiché appare una schermata blu. Non so che fare |
|
|
|
14-08-2007, 18:51
|
#2 |
|
Registered User
Iscritto dal: Aug 2006
Messaggi: 305
|
|
|
|
|
|
14-08-2007, 18:53
|
#3 |
|
Member
Iscritto dal: Aug 2007
Messaggi: 39
|
Vediamo di provare con una procedura manuale
Fixa queste stringhe in hijackthis O2 - BHO: ContextualAds Class - {3AAC4C68-AFC8-11DB-80EF-8AF955D89593} - (no file) O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O20 - AppInit_DLLs: ? ??C Preleva avenger da qui Scompattalo in una cartella a lui dedicata Apri la cartella e lancia avenger seleziona Input Script Manually, clicca sul pulsante con la lente e copiaincolla dentro alla finestra che ti si aprirà Registry values to replace with dummy: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows | AppInit_DLLs Files to delete: C:\WINDOWS\exefnd\74437.exe C:\WINDOWS\exefnd\77687.exe Fatto questo clicka sul pulsante Done, poi su quello col semaforo, e dai il consenso alle domande che ti verranno poste subito dopo; il pc si riavvierà automaticamente ( se non dovesse farlo riavvialo manualmente ). Scarica anche ATF Cleaner (pulizia files temporanei) http://www.atribune.org/ccount/click.php?id=1 Avvia ATF Cleaner.exe con un doppio click clicca sul menu main seleziona la casella Select All clicca sul pulsante Empty selected aspetta l'avviso Done Cleaning. Bye
__________________
SALVIAMO L'AMAZZONIA |
|
|
|
|
14-08-2007, 19:06
|
#4 | |
|
Registered User
Iscritto dal: Aug 2006
Messaggi: 305
|
Quote:
 Però posso sapere cosa ho fatto? E come fai a sapere che va fixato questo? Ora procedo con gli altri punti, grazie |
|
|
|
|
|
14-08-2007, 19:15
|
#5 |
|
Registered User
Iscritto dal: Aug 2006
Messaggi: 305
|
Fatto.
Ora ho i processi wintems.exe hidr.exe che partono all'avvio di windows prendendosi la CPU. Li devo chiudere manualmente perché altrimenti non posso fare niente. Poi parte un processo duecentomilaqualcosa.exe (non ricordo bene il numero) che prende il 99% della CPU e iexplore.exe anche se non apro internet. Codice:
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 20.16.42, on 14/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\TGTSoft\StyleXP\StyleXPService.exe
C:\Programmi\Intel\Wireless\Bin\EvtEng.exe
C:\Programmi\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe
C:\Programmi\Intel\Wireless\Bin\RegSrvc.exe
C:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\acer\epm\epm-dm.exe
C:\Programmi\Google\Gmail Notifier\gnotify.exe
C:\Programmi\QuickTime\qttask.exe
C:\Programmi\Unlocker\UnlockerAssistant.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Programmi\WIDCOMM\Software Bluetooth\BTTray.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Programmi\MSN Messenger\msnmsgr.exe
C:\Programmi\MSN Messenger\usnsvc.exe
C:\Programmi\MSN Messenger\livecall.exe
C:\Documents and Settings\Stefano\Desktop\HiJackThis_v2.exe
C:\Programmi\Internet Explorer\IEXPLORE.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 131.175.12.65:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Alcohol Toolbar Helper - {8126A4A5-BFD3-46FE-BBDF-BFB5CF78E489} - C:\Programmi\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Alcohol Toolbar - {ED4BD629-C1B6-4399-8A34-02CCAA921DC9} - C:\Programmi\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Programmi\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [LManager] C:\Programmi\Launch Manager\QtZgAcer.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Programmi\Unlocker\UnlockerAssistant.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Programmi\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: &Clean Traces - C:\Programmi\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Programmi\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Programmi\DAP\dapextie2.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Invia a &Bluetooth - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie.htm
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programmi\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programmi\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20070501/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2A56CA5D-A513-48C8-89DB-62A90E5269AF}: NameServer = 192.168.0.1
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe
O23 - Service: EvtEng - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Servizio iPod (iPod Service) - Unknown owner - C:\Programmi\iPod\bin\iPodService.exe (file missing)
O23 - Service: RegSrvc - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: StyleXPService - Unknown owner - C:\Programmi\TGTSoft\StyleXP\StyleXPService.exe
--
End of file - 8279 bytes
Ultima modifica di Barbalbero : 14-08-2007 alle 19:18. |
|
|
|
|
14-08-2007, 19:18
|
#6 |
|
Bannato
Iscritto dal: Jan 2003
Città: Lucca
Messaggi: 9119
|
Che sia il Bagle?
 (il che spiegherebbe perchè ti si è disattivato l'AV...)http://www.megalab.it/articoli.php?id=948  Segui cmq le indicazioni che ti ha dato yanoama... |
|
|
|
|
14-08-2007, 19:22
|
#7 |
|
Bannato
Iscritto dal: Jan 2003
Città: Lucca
Messaggi: 9119
|
PS: su megalab è descritta tutta la procedura di rimozione...
|
|
|
|
|
14-08-2007, 19:23
|
#8 | |
|
Registered User
Iscritto dal: Aug 2006
Messaggi: 305
|
Quote:
danke |
|
|
|
|
|
14-08-2007, 19:36
|
#9 | |
|
Member
Iscritto dal: Aug 2007
Messaggi: 39
|
Quote:
Se non riesci a debellarlo usando le informazioni fornite dal link di Nv25, bisognerebbe vedere dei log più approfonditi come gmer o Systemscan. Comunque, fai anche questo tentativo, come suggerito dall'utente eraser in questo post http://www.hwupgrade.it/forum/showthread.php?t=1142673 preleva il tool drwebCureit (lo trovi nel post di eraser), per mia esperienza personale questo tool, pur dando qualche falso positivo, è ottimo nella rimozione di malaware particolarmente ostinati. Non necessita di installazione, basta scaricarlo e lanciarlo, all'inizio effetua una scansione veloce, terminata la quale devi selezionare i tuo hardisk ed effettuare uno scan completo. Auguri  Bye
__________________
SALVIAMO L'AMAZZONIA |
|
|
|
|
|
14-08-2007, 19:36
|
#10 | |
|
Registered User
Iscritto dal: Aug 2006
Messaggi: 305
|
Quote:
Però non c'è scritto come rimuoverlo... |
|
|
|
|
|
14-08-2007, 19:38
|
#11 | |
|
Registered User
Iscritto dal: Aug 2006
Messaggi: 305
|
Quote:
|
|
|
|
|
|
14-08-2007, 19:52
|
#12 |
|
Registered User
Iscritto dal: Aug 2006
Messaggi: 305
|
Ho obbedito. Ora non vedo più processi strani, ma Kaspersky non me lo installa lo stesso: schermata blu.
|
|
|
|
|
14-08-2007, 19:55
|
#13 |
|
Bannato
Iscritto dal: Jan 2003
Città: Lucca
Messaggi: 9119
|
sicuro di aver rimosso correttamente la componente rootkit del malware e i suoi file?
Hai seguito le istruzioni alla lettera? Mi fai vedere uno screen di gmer? (tanto il programmino per fare le foto lo hai...) |
|
|
|
|
14-08-2007, 20:05
|
#14 |
|
Registered User
Iscritto dal: Aug 2006
Messaggi: 305
|
Gmer padre di Pdor?
No, scherzi a parte cos'è? Io ho seguito le istruzioni copiando e incollando lo script di Avenger: Codice:
Files to delete: %SystemDrive%:\Documents and Settings\%UserProfile%\Dati applicazioni\hidires\m_hook.sys %SystemDrive%:\Documents and Settings\%UserProfile%\Dati applicazioni\hidires\hidr.exe %SystemDrive%:\WINDOWS\system32\wintems.exe %SystemDrive%:\WINDOWS\system32\hldrrr.exe folders to delete: %SystemDrive%:\Documents and Settings\%UserProfile%\Dati applicazioni\hidires %SystemDrive%:\WINDOWS\exefld registry keys to delete: HKLM\SYSTEM\CurrentControlSet\Services\m_hook HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_M_HOOK registry values to delete: HKLM\Software\Microsoft\Windows\CurrentVersion\Run | hldrrr |
|
|
|
|
14-08-2007, 20:12
|
#15 |
|
Member
Iscritto dal: Aug 2007
Messaggi: 39
|
Credo che Nv25 volesse vedere un log di gmer
http://www.notrace.it/Download/Sicur...otkit/gmer.htm in particolare i log rootkit e autostart che il programmino genera Scusa la domanda banale, ma il Norton lo hai disinstallato completamente prima di installare il Kaspersky? Sai ma disinstallare completamente una suite di sicurezza (in particolare Norton) è sempre un impresa abbastanza difficoltosa e qualche traccia rimane sempre. Prova ad installare un altro antivirus, ad esempio Antivir o Avast e vedi se ti da lo stesso problema, il che potrebbe voler dire che beagle è ancora attivo. Bye
__________________
SALVIAMO L'AMAZZONIA |
|
|
|
|
14-08-2007, 20:15
|
#16 |
|
Registered User
Iscritto dal: Aug 2006
Messaggi: 305
|
Norton l'ho disinstallato con l'apposito tool della symantech.
Provo ad installare altri antivirus e provvederò a postare il log di gmer |
|
|
|
|
14-08-2007, 20:18
|
#17 | |
|
Bannato
Iscritto dal: Jan 2003
Città: Lucca
Messaggi: 9119
|
Quote:
Se però si leggessero attentamente le risorse che vengono fornite (per es, il link a megalab...), probabilmente si evitava di fare domande retoriche.... La battuta, cmq, era carina... |
|
|
|
|
|
14-08-2007, 20:19
|
#18 |
|
Registered User
Iscritto dal: Aug 2006
Messaggi: 305
|
Codice:
GMER 1.0.13.12551 - http://www.gmer.net Rootkit scan 2007-08-14 21:18:07 Windows 5.1.2600 Service Pack 2 ---- System - GMER 1.0.13 ---- SSDT 86583BE0 ZwEnumerateKey SSDT 8658392C ZwEnumerateValueKey SSDT 86583E80 ZwQueryDirectoryFile SSDT 86584026 ZwQuerySystemInformation ---- Devices - GMER 1.0.13 ---- Device \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE 873D01E8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_CLOSE 873D01E8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_READ 873D01E8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_WRITE 873D01E8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_INFORMATION 873D01E8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_INFORMATION 873D01E8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_EA 873D01E8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_EA 873D01E8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_FLUSH_BUFFERS 873D01E8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_VOLUME_INFORMATION 873D01E8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_VOLUME_INFORMATION 873D01E8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_DIRECTORY_CONTROL 873D01E8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_FILE_SYSTEM_CONTROL 873D01E8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CONTROL 873D01E8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_SHUTDOWN 873D01E8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_LOCK_CONTROL 873D01E8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_CLEANUP 873D01E8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_SECURITY 873D01E8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_SECURITY 873D01E8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_QUOTA 873D01E8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_QUOTA 873D01E8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_PNP 873D01E8 Device \FileSystem\Fastfat \Fat IRP_MJ_CREATE 8707F790 Device \FileSystem\Fastfat \Fat IRP_MJ_CLOSE 8707F790 Device \FileSystem\Fastfat \Fat IRP_MJ_READ 8707F790 Device \FileSystem\Fastfat \Fat IRP_MJ_WRITE 8707F790 Device \FileSystem\Fastfat \Fat IRP_MJ_QUERY_INFORMATION 8707F790 Device \FileSystem\Fastfat \Fat IRP_MJ_SET_INFORMATION 8707F790 Device \FileSystem\Fastfat \Fat IRP_MJ_QUERY_EA 8707F790 Device \FileSystem\Fastfat \Fat IRP_MJ_SET_EA 8707F790 Device \FileSystem\Fastfat \Fat IRP_MJ_FLUSH_BUFFERS 8707F790 Device \FileSystem\Fastfat \Fat IRP_MJ_QUERY_VOLUME_INFORMATION 8707F790 Device \FileSystem\Fastfat \Fat IRP_MJ_SET_VOLUME_INFORMATION 8707F790 Device \FileSystem\Fastfat \Fat IRP_MJ_DIRECTORY_CONTROL 8707F790 Device \FileSystem\Fastfat \Fat IRP_MJ_FILE_SYSTEM_CONTROL 8707F790 Device \FileSystem\Fastfat \Fat IRP_MJ_DEVICE_CONTROL 8707F790 Device \FileSystem\Fastfat \Fat IRP_MJ_SHUTDOWN 8707F790 Device \FileSystem\Fastfat \Fat IRP_MJ_LOCK_CONTROL 8707F790 Device \FileSystem\Fastfat \Fat IRP_MJ_CLEANUP 8707F790 Device \FileSystem\Fastfat \Fat IRP_MJ_PNP 8707F790 AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CREATE [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CREATE_NAMED_PIPE [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CLOSE [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_READ [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_WRITE [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_INFORMATION [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SET_INFORMATION [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_EA [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SET_EA [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_FLUSH_BUFFERS [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_VOLUME_INFORMATION [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SET_VOLUME_INFORMATION [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_DIRECTORY_CONTROL [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_FILE_SYSTEM_CONTROL [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_DEVICE_CONTROL [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_INTERNAL_DEVICE_CONTROL [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SHUTDOWN [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_LOCK_CONTROL [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CLEANUP [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CREATE_MAILSLOT [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_SECURITY [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SET_SECURITY [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_POWER [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SYSTEM_CONTROL [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_DEVICE_CHANGE [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_QUOTA [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SET_QUOTA [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_CREATE [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_CREATE_NAMED_PIPE [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_CLOSE [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_READ [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_WRITE [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_QUERY_INFORMATION [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_SET_INFORMATION [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_QUERY_EA [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_SET_EA [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_FLUSH_BUFFERS [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_QUERY_VOLUME_INFORMATION [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_SET_VOLUME_INFORMATION [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_DIRECTORY_CONTROL [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_FILE_SYSTEM_CONTROL [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_DEVICE_CONTROL [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_INTERNAL_DEVICE_CONTROL [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_SHUTDOWN [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_LOCK_CONTROL [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_CLEANUP [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_CREATE_MAILSLOT [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_QUERY_SECURITY [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_SET_SECURITY [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_POWER [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_SYSTEM_CONTROL [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_DEVICE_CHANGE [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_QUERY_QUOTA [F6883E00] SynTP.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_SET_QUOTA [F6883E00] SynTP.sys ---- EOF - GMER 1.0.13 ---- |
|
|
|
|
14-08-2007, 20:31
|
#19 |
|
Senior Member
Iscritto dal: Aug 2006
Messaggi: 4350
|
Visto che il log di hijackthis postato inizialmente da questo utente risulti "pulito all'origine" nonostante siano presenti nel pc diversi problemi,colgo l'occasione per mettere all'attenzione un soft ( ma in versione beta) già messo in luce su vari siti internet:
http://www.runscanner.net/ Potrebbe essere l'occasione per una prova. Ma ripeto sempre con molta cautela. Ultima modifica di sampei.nihira : 14-08-2007 alle 20:34. |
|
|
|
|
14-08-2007, 20:37
|
#20 |
|
Member
Iscritto dal: Aug 2007
Messaggi: 39
|
Non sono espertissimo dei log di gmer, però ad una prima occhiata mi sembra pulito, se non altro perchè non si vedono processi hidden....
Nv25, tu che dici? Posta anche un log Autostart, per farlo clicca in gmer in alto a sinistra sulle freccette a fianco alla scritta rootkit. Ti si aprirà un nuovo menù, selezione autostart, metti il flag a show all e fai la scansione, poi posta il log.
__________________
SALVIAMO L'AMAZZONIA |
|
|
|
|
|
| Strumenti | |
|
|
Tutti gli orari sono GMT +1. Ora sono le: 16:47.
