Problema grave virus e connessioni di rete

[claudio601]

Salve,
Sono sicuro di essere strainfettato di virus, in quanto ho provato a cercare su google i nomi di alcuni processi attivi e risultano essere tutti trojan e affini .
Vi posto il logo hjackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 0.20.19, on 08/03/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programmi\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Creative\Shared Files\CTDevSrv.exe
C:\Programmi\File comuni\Nero\Nero BackItUp 4\NBService.exe
C:\Programmi\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Programmi\D-Link\AirPlus G\AirGCFG.exe
C:\WINDOWS\system32\devldr32.exe
C:\Programmi\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\Programmi\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\Programmi\Creative\Software Update 3\SoftAuto.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Programmi\Windows Media Player\wmplayer.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\syre32.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,EXPLORER.EXE
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programmi\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmi\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Programmi\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programmi\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Programmi\D-Link\AirPlus G\AirGCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Programmi\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Microsoft Update Setup] C:\WINDOWS\jjdrive32.exe
O4 - HKLM\..\Run: [upd32] C:\WINDOWS\system32\upd32.exe
O4 - HKLM\..\Run: [avsys] C:\WINDOWS\system32\avsys.exe
O4 - HKLM\..\Run: [] C:\WINDOWS\system32\.exe
O4 - HKLM\..\Run: [oo] C:\WINDOWS\ndll.exe
O4 - HKLM\..\Run: [253] C:\WINDOWS\system32\umdmgr.exe
O4 - HKLM\..\Run: [099] C:\WINDOWS\system32\umdmgr.exe
O4 - HKLM\..\Run: [572] C:\WINDOWS\system32\umdmgr.exe
O4 - HKLM\..\Run: [167] C:\WINDOWS\system32\umdmgr.exe
O4 - HKLM\..\Run: [286] C:\WINDOWS\system32\umdmgr.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [417] C:\WINDOWS\system32\umdmgr.exe
O4 - HKLM\..\Run: [535] C:\WINDOWS\system32\umdmgr.exe
O4 - HKLM\..\Run: [010] C:\WINDOWS\system32\umdmgr.exe
O4 - HKLM\..\Run: [768] C:\WINDOWS\system32\umdmgr.exe
O4 - HKLM\..\Run: [809] C:\WINDOWS\system32\umdmgr.exe
O4 - HKLM\..\Run: [489] C:\WINDOWS\system32\umdmgr.exe
O4 - HKLM\..\Run: [701] C:\WINDOWS\system32\umdmgr.exe
O4 - HKLM\..\Run: [851] C:\WINDOWS\system32\umdmgr.exe
O4 - HKLM\..\Run: [955] C:\WINDOWS\system32\umdmgr.exe
O4 - HKLM\..\Run: [533] C:\WINDOWS\system32\umdmgr.exe
O4 - HKLM\..\Run: [123] C:\WINDOWS\system32\umdmgr.exe
O4 - HKLM\..\Run: [670] C:\WINDOWS\system32\umdmgr.exe
O4 - HKLM\..\Run: [607] C:\WINDOWS\system32\umdmgr.exe
O4 - HKLM\..\Run: [240] C:\WINDOWS\system32\umdmgr.exe
O4 - HKLM\..\Run: [911] C:\WINDOWS\system32\umdmgr.exe
O4 - HKLM\..\Run: [syre32] C:\WINDOWS\system32\syre32.exe
O4 - HKLM\..\Run: [474] C:\WINDOWS\system32\umdmgr.exe
O4 - HKLM\..\Run: [771] C:\WINDOWS\system32\umdmgr.exe
O4 - HKLM\..\Run: [156] C:\WINDOWS\system32\umdmgr.exe
O4 - HKLM\..\Run: [356] C:\WINDOWS\system32\umdmgr.exe
O4 - HKLM\..\Run: [257] C:\WINDOWS\system32\umdmgr.exe
O4 - HKLM\..\Run: [243] C:\WINDOWS\system32\umdmgr.exe
O4 - HKLM\..\Run: [376] C:\WINDOWS\system32\umdmgr.exe
O4 - HKLM\..\Run: [116] C:\WINDOWS\system32\umdmgr.exe
O4 - HKLM\..\Run: [657] C:\WINDOWS\system32\umdmgr.exe
O4 - HKLM\..\Run: [350] C:\WINDOWS\system32\umdmgr.exe
O4 - HKLM\..\Run: [003] C:\WINDOWS\system32\umdmgr.exe
O4 - HKLM\..\Run: [751] C:\WINDOWS\system32\umdmgr.exe
O4 - HKLM\..\Run: [304] C:\WINDOWS\system32\umdmgr.exe
O4 - HKLM\..\Run: [154] C:\WINDOWS\system32\umdmgr.exe
O4 - HKLM\..\Run: [447] C:\WINDOWS\system32\umdmgr.exe
O4 - HKLM\..\Run: [sysgif32] C:\WINDOWS\TEMP\~TM14.tmp
O4 - HKLM\..\Run: [12621012] C:\DOCUME~1\ALLUSE~1\DATIAP~1\12621012\12621012.exe
O4 - HKLM\..\Run: [468] C:\WINDOWS\system32\umdmgr.exe
O4 - HKCU\..\Run: [cdoosoft] C:\DOCUME~1\Claudio\IMPOST~1\Temp\herss.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Programmi\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [wsctf.exe] wsctf.exe
O4 - HKCU\..\Run: [EXPLORER.EXE] EXPLORER.EXE
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SoftAuto.exe] "C:\Programmi\Creative\Software Update 3\SoftAuto.exe"
O4 - HKCU\..\Run: [12CFG214-K641-12SF-N85P] C:\RECYCLER\S-1-5-21-0243936033-3052116371-381863308-1811\vsbntlo.exe
O4 - HKCU\..\Run: [psysnew] C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-1455\psysnew.exe
O4 - HKLM\..\Policies\Explorer\Run: [Microsoft Update Setup] C:\WINDOWS\jjdrive32.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: msconfig32.exe
O4 - Startup: winesm32.exe
O9 - Extra button: Inserisci blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programmi\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: Inserisci &blog in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programmi\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{1FB49C13-0BFE-4D4B-A62B-2500A7D76087}: NameServer = 151.99.125.2,151.99.125.3
O17 - HKLM\System\CCS\Services\Tcpip\..\{768A36DE-B690-481A-9685-8B7FCCCB231B}: NameServer = 151.99.125.2,151.99.125.3
O17 - HKLM\System\CS1\Services\Tcpip\..\{1FB49C13-0BFE-4D4B-A62B-2500A7D76087}: NameServer = 151.99.125.2,151.99.125.3
O17 - HKLM\System\CS2\Services\Tcpip\..\{1FB49C13-0BFE-4D4B-A62B-2500A7D76087}: NameServer = 151.99.125.2,151.99.125.3
O17 - HKLM\System\CS3\Services\Tcpip\..\{1FB49C13-0BFE-4D4B-A62B-2500A7D76087}: NameServer = 151.99.125.2,151.99.125.3
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Programmi\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Programmi\Bonjour\mDNSResponder.exe
O23 - Service: CT Device Query service (CTDevice_Srv) - Creative Technology Ltd - C:\Programmi\Creative\Shared Files\CTDevSrv.exe
O23 - Service: Creative Centrale Media Server (CTUPnPSv) - Creative Technology Ltd - C:\Programmi\Creative\Creative Centrale\CTUPnPSv.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Programmi\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmi\Java\jre6\bin\jqs.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Programmi\File comuni\Nero\Nero BackItUp 4\NBService.exe

--
End of file - 9754 bytes

Sicuramente ho dei trojan vedi syre32.exe o umdmgr.exe. Altro non saprei.
Comunque osservando la mia penna di connessione wireless vedo ke viene molto usata (il led act che indica il flusso delle operazioni) per la maggior parte del tempo anche se io nn effettuo nessuna connessione lampeggia ad una velocità impressionante e ciò significa che cè qualcosa che usa la rete e che quindi apre e chiude connessioni.
Se qualcuno può aiutarmi osservando il log di hjackthis per favore...Grazie

[claudio601]

nessuno?

[wjmat]

Ciao

segui la guida alla disinfezione per infetti ed esegui, in ordine, tutte le scansioni ed il caricamento dei relativi log in un unico post e secondo le regole di sezione (esempio1 & esempio2)
Qui trovi ulteriori dettagli e consigli per una corretta esecuzione della procedura

link caricamento log generici ► wikisend ■ fileqube
link caricamento immagini ► imageshack ■ fileqube