|
|||||||
|
|
|
 |
|
|
Strumenti |
19-11-2010, 18:16
|
#1 |
|
Junior Member
Iscritto dal: Nov 2010
Messaggi: 16
|
ho bisogno di aiuto(rogue virus,ecc) WinXP
ragazzi,ho letto il regolamento e le varie sezioni di aiuto ma non è servito a granchè...premessa:
da un mesetto avevo un rogue virus ( Windows security essential alert) che inizialmente si avviava poi con AVG ero riuscito a bloccarlo o almeno lo pensavo... infatti uno dei vari segni che la bomba stava per esplodere sono stati: internet lento...mi apriva sempre una seconda pagina di internet che nn serviva a nulla..ovvero era un fake... oggi di colpo è partito quel falso antivirus che mi ha bloccato tutto...internt non và più..AVG mi trova 2 trjan e non riesce a rimuoverli...alcuni programmi e alcuni giochi in internet risultano sempre in caricamento...ho scaricato Malwarebytes Anti-Malware,mi ha trovato 8 infezioni tra cui il Windows secur e avendolo mandato in modalità provvisoria risulta tutto eliminato...però il problema persiste... sto impazzendo aiutatemi perfavore... vi posto i log di Malwerbytes e di HiJackThis :Logfile of Trend Micro HijackThis v2.0.3 (BETA) Scan saved at 19:12:01, on 19/11/2010 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Programmi\AVG\AVG9\avgchsvx.exe C:\Programmi\AVG\AVG9\avgrsx.exe C:\WINDOWS\system32\spoolsv.exe C:\Programmi\AVG\AVG9\avgcsrvx.exe C:\WINDOWS\Explorer.EXE C:\Documents and Settings\utente\Dati applicazioni\Microsoft\Windows\shell.exe C:\DOCUME~1\utente\IMPOST~1\Temp\dwm.exe C:\WINDOWS\RTHDCPL.EXE C:\Programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe C:\Programmi\Microsoft Office\Office12\GrooveMonitor.exe C:\Programmi\ASUSTek\ASUSDVD\PDVDServ.exe C:\PROGRA~1\AVG\AVG9\avgtray.exe C:\Programmi\iTunes\iTunesHelper.exe C:\Programmi\File comuni\Nokia\MPlatform\NokiaMServer.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\system32\igfxsrvc.exe C:\DOCUME~1\utente\IMPOST~1\Temp\sesdessetri.exe C:\WINDOWS\System32\svchost.exe C:\Programmi\File comuni\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Programmi\AVG\AVG9\avgwdsvc.exe C:\Programmi\Bonjour\mDNSResponder.exe C:\Programmi\Java\jre6\bin\jqs.exe C:\Programmi\File comuni\LightScribe\LSSrvc.exe C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\mdm.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\Programmi\iPod\bin\iPodService.exe C:\WINDOWS\system32\msiexec.exe C:\Programmi\TrendMicro\HiJackThis\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.divx.com/divx/webplayerdem...6.8&yo=ietyie7 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:50370 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti F3 - REG:win.ini: load=C:\DOCUME~1\utente\IMPOST~1\Temp\dwm.exe O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programmi\AVG\AVG9\avgssie.dll O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programmi\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmi\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programmi\DAEMON Tools Toolbar\DTToolbar.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [GrooveMonitor] "C:\Programmi\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [RemoteControl] C:\Programmi\ASUSTek\ASUSDVD\PDVDServ.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [NokiaMServer] C:\Programmi\File comuni\Nokia\MPlatform\NokiaMServer /watchfiles startup O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u O4 - HKLM\..\Run: [Driver Control Manager v8.1] C:\DOCUME~1\utente\IMPOST~1\Temp\sesdessetri.exe O4 - HKLM\..\Run: [wxnoscrame.tmp] "C:\DOCUME~1\utente\IMPOST~1\Temp\wxnoscrame.tmp" O4 - HKCU\..\Run: [Driver Control Manager v8.1] C:\DOCUME~1\utente\IMPOST~1\Temp\sesdessetri.exe O4 - HKCU\..\Run: [{907446BD-5D77-3D91-5566-5C19BF2D4142}] "C:\Documents and Settings\utente\Dati applicazioni\Oddiub\goop.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: MuPhoenix Launcher.lnk = C:\Documents and Settings\utente\Desktop\launcher Phoenix.rar O4 - Startup: Ritaglio schermata e avvio di OneNote 2007.lnk = C:\Programmi\Microsoft Office\Office12\ONENOTEM.EXE O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O9 - Extra button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: I&nvia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programmi\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programmi\AVG\AVG9\avgpp.dll O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing) O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\AppleMobileDeviceService.exe O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Programmi\AVG\AVG9\avgwdsvc.exe O23 - Service: Servizio Bonjour (Bonjour Service) - Apple Inc. - C:\Programmi\Bonjour\mDNSResponder.exe O23 - Service: Sony SPTI Service for DVE (ICDSPTSV) - Sony Corporation - C:\WINDOWS\system32\IcdSptSv.exe O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - C:\Programmi\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmi\Java\jre6\bin\jqs.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe O23 - Service: ServiceLayer - Nokia - C:\Programmi\PC Connectivity Solution\ServiceLayer.exe -- End of file - 9301 bytes malw: Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Versione database: 4052 Windows 5.1.2600 Service Pack 3 (Safe Mode) Internet Explorer 8.0.6001.18702 19/11/2010 19.08.17 mbam-log-2010-11-19 (19-08-17).txt Tipo di scansione: Scansione completa (C:\|D:\|) Elementi esaminati: 224790 Tempo trascorso: 1 ore, 19 minuti, 57 secondi Processi infetti in memoria: 1 Moduli di memoria infetti: 0 Chiavi di registro infette: 3 Valori di registro infetti: 1 Voci infette nei dati di registro: 0 Cartelle infette: 0 File infetti: 3 Processi infetti in memoria: C:\Documents and Settings\utente\Dati applicazioni\Microsoft\svchost.exe (Backdoor.Bot) -> Unloaded process successfully. Moduli di memoria infetti: (Non sono stati rilevati elementi nocivi) Chiavi di registro infette: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sshnas (Trojan.Downloader) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully. Valori di registro infetti: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost (Backdoor.Bot) -> Quarantined and deleted successfully. Voci infette nei dati di registro: (Non sono stati rilevati elementi nocivi) Cartelle infette: (Non sono stati rilevati elementi nocivi) File infetti: C:\Documents and Settings\utente\Impostazioni locali\Temp\sshnas21.dll (Trojan.Downloader) -> Quarantined and deleted successfully. C:\WINDOWS\system32\sshnas21.dll (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\utente\Dati applicazioni\Microsoft\svchost.exe (Backdoor.Bot) -> Quarantined and deleted successfully. grazie e scusate il disturbo perdonatemi ma nn sn riuscito a mettere i file se non in questo modo Ultima modifica di Rikijy : 19-11-2010 alle 22:00. |
|
|
20-11-2010, 08:48
|
#2 | |
|
Moderatore
Iscritto dal: Jun 2007
Città: 127.0.0.1
Messaggi: 25885
|
Quote:
successivamente segui la Guida dedicata alla rimozione dei Rogue http://www.hwupgrade.it/forum/showthread.php?t=1789446 NB: prima di ripete la scansione con MBAM devi aggiornare il database delle firme virali.
__________________
Try again and you will be luckier.
Ultima modifica di Chill-Out : 20-11-2010 alle 09:07. |
|
|
|
|
|
| Strumenti | |
|
|
Tutti gli orari sono GMT +1. Ora sono le: 05:47.
