|
|||||||
|
|
|
 |
|
|
Strumenti |
17-05-2008, 20:12
|
#1 |
|
Member
Iscritto dal: Apr 2008
Messaggi: 32
|
[winXP]...forse sono infettato, aiutatemi!
 da ormai una settimana non mi si apre la finestra di firefox, aprendo però il TaskManager vedo che c'è il suo processo...se apro internet explorer mentre c'è il processo ancora attivo di firefox nn si attiva neppure quello...quando termino il processo di firefox mi si apre la pagina di internet explorer  ho provato a disinstallare firefox ma nemmeno così funziona parte per pochi secondi e poi mi da errore e da lo stesso problema di prima...anche con versioni diverse...non so più che fare!!  ho anche un problema con la connessione...per connettermi a internet ho dovuto fare 2 connessioni a internet uguali perchè la prima k uso ogni volta non funziona...faccio un'esempio: quando accendo il pc se apro la 1° connessione nn si apre e se provo con la 2° invece si apre...se invece quando accendo il pc voglio aprire la 2° connessione questa nn si apre e si apre solo la 1°!!!cioè la prima che voglio usare non funziona mai e quindi ne ho dovute creare 2 uguali!!  scusatemi se non mi sono spiegato bene...sono situazioni difficili da spiegare!! penso sia a causa di un virus ma l'antivirus(avira) nn me li trova... vi posto il log fatto con gmer Codice:
GMER 1.0.14.14205 - http://www.gmer.net
Rootkit scan 2008-05-17 20:15:30
Windows 5.1.2600 Service Pack 2
---- System - GMER 1.0.14 ----
SSDT sptd.sys ZwCreateKey [0xF8487AC8]
SSDT F8C4D524 ZwCreateThread
SSDT sptd.sys ZwEnumerateKey [0xF8487C22]
SSDT sptd.sys ZwEnumerateValueKey [0xF8487F9A]
SSDT sptd.sys ZwOpenKey [0xF848798E]
SSDT F8C4D510 ZwOpenProcess
SSDT F8C4D515 ZwOpenThread
SSDT sptd.sys ZwQueryKey [0xF8488064]
SSDT sptd.sys ZwQueryValueKey [0xF8487EFC]
SSDT sptd.sys ZwSetValueKey [0xF84880EC]
SSDT F8C4D51F ZwTerminateProcess
SSDT F8C4D51A ZwWriteVirtualMemory
---- Kernel code sections - GMER 1.0.14 ----
? C:\WINDOWS\system32\drivers\sptd.sys Impossibile accedere al file. Il file è utilizzato da un altro processo.
? C:\WINDOWS\System32\Drivers\SPTD8797.SYS Impossibile accedere al file. Il file è utilizzato da un altro processo.
.text dtscsi.sys!A0DB34FC6FE35D429A28ADDE5467D4D7 F78334F0 16 Bytes [ 15, A9, B6, E2, 5C, 24, 97, ... ]
.text dtscsi.sys!A0DB34FC6FE35D429A28ADDE5467D4D7 + 11 F7833501 27 Bytes [ 20, 83, F7, E0, 17, 3D, 1B, ... ]
.text dtscsi.sys!A0DB34FC6FE35D429A28ADDE5467D4D7 + 2D F783351D 3 Bytes [ C6, 7C, F6 ]
? C:\WINDOWS\System32\Drivers\dtscsi.sys Impossibile accedere al file. Il file è utilizzato da un altro processo.
---- User code sections - GMER 1.0.14 ----
.text C:\WINDOWS\Explorer.EXE[976] ADVAPI32.dll!CryptDestroyKey 77F5A544 7 Bytes JMP 00DF2C2D
.text C:\WINDOWS\Explorer.EXE[976] ADVAPI32.dll!CryptDecrypt 77F5A7B1 7 Bytes JMP 00DF2BEA
.text C:\WINDOWS\Explorer.EXE[976] ADVAPI32.dll!CryptEncrypt 77F61558 7 Bytes JMP 00DF2BAE
.text C:\WINDOWS\Explorer.EXE[976] WS2_32.dll!send 71A3428A 5 Bytes JMP 00DF2A1F
.text C:\WINDOWS\Explorer.EXE[976] WS2_32.dll!WSARecv 71A34318 5 Bytes JMP 00DF2B11
.text C:\WINDOWS\Explorer.EXE[976] WS2_32.dll!recv 71A3615A 5 Bytes JMP 00DF2A57
.text C:\WINDOWS\Explorer.EXE[976] WS2_32.dll!WSASend 71A36233 5 Bytes JMP 00DF2A8F
.text C:\WINDOWS\Explorer.EXE[976] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 00DF2B93
---- Kernel IAT/EAT - GMER 1.0.14 ----
IAT pci.sys[ntoskrnl.exe!IoDetachDevice] [F849089E] sptd.sys
IAT pci.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F84A6D86] sptd.sys
IAT ftdisk.sys[ntoskrnl.exe!IoGetAttachedDeviceReference] [F8490E24] sptd.sys
IAT ftdisk.sys[ntoskrnl.exe!IoGetDeviceObjectPointer] [F8490D28] sptd.sys
IAT ftdisk.sys[ntoskrnl.exe!IofCallDriver] [F8490EF4] sptd.sys
IAT dmio.sys[ntoskrnl.exe!IofCallDriver] [F8490EF4] sptd.sys
IAT dmio.sys[ntoskrnl.exe!IoGetAttachedDeviceReference] [F8490E24] sptd.sys
IAT dmio.sys[ntoskrnl.exe!IoGetDeviceObjectPointer] [F8490D28] sptd.sys
IAT PartMgr.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F84A61AE] sptd.sys
IAT PartMgr.sys[ntoskrnl.exe!IoDetachDevice] [F8490A5A] sptd.sys
IAT atapi.sys[ntoskrnl.exe!IofCompleteRequest] [F84A604A] sptd.sys
IAT atapi.sys[ntoskrnl.exe!IoConnectInterrupt] [F84908F2] sptd.sys
IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [F8483AD2] sptd.sys
IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [F8483C0E] sptd.sys
IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [F8483B96] sptd.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [F848476C] sptd.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [F8484642] sptd.sys
IAT disk.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F84A6E4A] sptd.sys
IAT \WINDOWS\System32\DRIVERS\CLASSPNP.SYS[ntoskrnl.exe!IoDetachDevice] [F84958C6] sptd.sys
IAT \SystemRoot\System32\DRIVERS\USBPORT.SYS[ntoskrnl.exe!IofCompleteRequest] [F84A604A] sptd.sys
IAT \SystemRoot\System32\DRIVERS\cdrom.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F84A6E4A] sptd.sys
IAT \SystemRoot\System32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [F84A6056] sptd.sys
IAT \SystemRoot\System32\DRIVERS\rdbss.sys[ntoskrnl.exe!IofCallDriver] [F8490CC6] sptd.sys
IAT \SystemRoot\System32\DRIVERS\mrxsmb.sys[ntoskrnl.exe!IofCallDriver] [F8490CC6] sptd.sys
---- Devices - GMER 1.0.14 ----
Device \FileSystem\Ntfs \Ntfs 82B969C0
Device \FileSystem\Fastfat \FatCdrom 826D58D0
Device \Driver\NetBT \Device\NetBT_Tcpip_{D7C456AA-3C05-4484-942C-8D8AB935FE69} 826FB260
Device \Driver\dmio \Device\DmControl\DmIoDaemon 82BDF1D8
Device \Driver\dmio \Device\DmControl\DmConfig 82BDF1D8
Device \Driver\dmio \Device\DmControl\DmPnP 82BDF1D8
Device \Driver\dmio \Device\DmControl\DmInfo 82BDF1D8
Device \Driver\Ftdisk \Device\HarddiskVolume1 82BDF490
Device \Driver\Ftdisk \Device\HarddiskVolume2 82BDF490
Device \FileSystem\Rdbss \Device\FsWrap 826DC0E8
Device \Driver\atapi \Device\Ide\IdePort0 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\atapi \Device\Ide\IdePort1 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\USBSTOR \Device\00000082 82B06450
Device \Driver\USBSTOR \Device\00000082 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\NetBT \Device\NetBt_Wins_Export 826FB260
Device \Driver\NetBT \Device\NetbiosSmb 826FB260
Device \Driver\USBSTOR \Device\00000086 82B06450
Device \Driver\USBSTOR \Device\00000086 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\00000053 \Device\0000004d sptd.sys
Device \Driver\Disk \Device\Harddisk0\DR0 820DC8FC
Device \Driver\Disk \Device\Harddisk1\DR1 820DC8FC
Device \Driver\Disk \Device\Harddisk2\DR4 820DC8FC
Device \Driver\Disk \Device\Harddisk2\DP(1)0-0+5 820DC8FC
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 826CC670
Device \FileSystem\MRxSmb \Device\LanmanRedirector 826CC670
Device \FileSystem\Npfs \Device\NamedPipe 829100E8
Device \Driver\Ftdisk \Device\FtControl 82BDF490
Device \FileSystem\Msfs \Device\Mailslot 82757D28
Device \Driver\dtscsi \Device\Scsi\dtscsi1Port2Path0Target1Lun0 82989840
Device \Driver\dtscsi \Device\Scsi\dtscsi1Port2Path0Target1Lun0 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\dtscsi \Device\Scsi\dtscsi1Port2Path0Target0Lun0 82989840
Device \Driver\dtscsi \Device\Scsi\dtscsi1Port2Path0Target0Lun0 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\dtscsi \Device\Scsi\dtscsi1Port2Path0Target2Lun0 82989840
Device \Driver\dtscsi \Device\Scsi\dtscsi1Port2Path0Target2Lun0 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\dtscsi \Device\Scsi\dtscsi1 82989840
Device \Driver\dtscsi \Device\Scsi\dtscsi1 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\dtscsi \Device\Scsi\dtscsi1Port2Path0Target3Lun0 82989840
Device \Driver\dtscsi \Device\Scsi\dtscsi1Port2Path0Target3Lun0 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \FileSystem\Fastfat \Fat 826D58D0
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
Device \FileSystem\Cdfs \Cdfs 828F40E8
---- Threads - GMER 1.0.14 ----
Thread 4:1512 820DCC74
Thread 4:1528 820DEA1E
Thread 4:1532 820D6E64
Thread 4:1536 820DCFB6
Thread 4:1664 820D688E
Thread 4:1696 820D688E
Thread 4:3684 8210F120
Thread 4:3680 820FC220
Thread 4:1284 82144E50
Thread 4:1960 820E82A0
Thread 4:548 820DCDA0
---- Registry - GMER 1.0.14 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s0 40705962
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 -1954676755
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 -7616810
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programmi\DAEMON Tools\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x17 0x3D 0x2C 0x36 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x76 0x3B 0x6C 0x1E ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x6D 0x7B 0xFD 0x74 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0xF0 0xC6 0x8B 0xDE ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42@khjeh 0xF0 0xC6 0x8B 0xDE ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43@khjeh 0xF0 0xC6 0x8B 0xDE ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\ssmdrv\Products@Avira AntiVir Personal \x2013 Free Antivirus C:\Programmi\Avira\AntiVir PersonalEdition Classic\??????????????????????????????????????????????????????????????????????????????
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programmi\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xCA 0xE4 0xF0 0xF3 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xA1 0xE2 0xE3 0xF2 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xF4 0xAA 0x02 0x54 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programmi\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x17 0x3D 0x2C 0x36 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x76 0x3B 0x6C 0x1E ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x6D 0x7B 0xFD 0x74 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0xF0 0xC6 0x8B 0xDE ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42@khjeh 0xF0 0xC6 0x8B 0xDE ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43@khjeh 0xF0 0xC6 0x8B 0xDE ...
Reg HKLM\SYSTEM\ControlSet003\Services\ssmdrv\Products@Avira AntiVir Personal \x2013 Free Antivirus C:\Programmi\Avira\AntiVir PersonalEdition Classic\??????????????????????????????????????????????????????????????????????????????
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Cpls@Avira AntiVir Personal \x2013 Free Antivirus C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl
---- EOF - GMER 1.0.14 ----
|
|
|
|
17-05-2008, 20:48
|
#2 |
|
Moderatore
Iscritto dal: Jun 2007
Città: 127.0.0.1
Messaggi: 25885
|
Segui la Guida alla disinfezione allegando tutti i log prodotti in un'unico post secondo le sottoindicate modalità, grazie per la collaborazione
MODALITA' DI PUBBLICAZIONE DEI LOG RICHIESTI: Ogni singolo log, esclusivamente in formato txt a parte SynInspector e nell'ordine indicato in Guida, deve essere hostato su Wikisend, clicca qui per raggiungere Wikisend, pubblicando, nella discussione, singolarmente, per ogni log, il link che verrà rilasciato per il download
__________________
Try again and you will be luckier.
|
|
|
|
|
|
| Strumenti | |
|
|
Tutti gli orari sono GMT +1. Ora sono le: 22:34.
