|
|||||||
|
|
|
 |
|
|
Strumenti |
22-12-2004, 17:30
|
#1 |
|
Junior Member
Iscritto dal: Nov 2004
Messaggi: 24
|
SALVARE IL PC DAI WORM: MISSIONE IMPOSSIBILE
Sono veramente in una brutta situazione con il mio pc: sono infestato da worm credo pure un virus, non so come sbarazzarmene, ho usato ad-ware search and destroy, scanspyware spybot, ma i maledetti rimangono, ho pure l hijakcer di bullsoft-search che mi reindirizza sempre in quella pagina; la cosa brutta è che mi hanno messo fuori uso l antivirus, e credo che lo utilizzino addirittuara come worm, infatti ho sygate personal firewall e mcafee e vedo che il file lucomserver (file del norton) tenta di collegarsi. Poi ho tanti altri fastidiosi file tipo hhnt.exe, syshost.exe (mi pare questo sia un file del worm francette) iotc.exe bcep.exe cmq utilizzo anche emule e msn messenger; ho letto che è meglio nn usare i messenger quando si è infettati... Ho fatto lo scan con hijackthis vi lascio qui sotto il log:
1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:NavigationFailure R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:NavigationFailure R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAMMI\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_18_0.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMMI\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL O2 - BHO: (no name) - {6F68F6AC-1B51-40E0-9DD5-4669CF15ABAF} - C:\WINDOWS\SYSTEM\EDIB.DLL O2 - BHO: (no name) - {0C3E679E-F52D-8EAC-0A46-FBCACFD79B95} - C:\WINDOWS\SYSTEM\REAC.DLL O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmi\Norton AntiVirus\NavShExt.dll O3 - Toolbar: @msdxmLC.dll,-1@1040,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAMMI\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_18_0.DLL O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmi\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [3dfx Tools] rundll32.exe 3dfxCmn.dll,UpdateRegSettings O4 - HKLM\..\Run: [DSLSTATEXE] C:\Programmi\IPM\Adsl\DataWay\dslstat.exe icon O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime O4 - HKLM\..\Run: [LoadQM] loadqm.exe O4 - HKLM\..\Run: [kydgwoqvvxkj] C:\WINDOWS\SYSTEM\xdcbxawd.exe O4 - HKLM\..\Run: [WinInit] Win86.exe O4 - HKLM\..\Run: [FLMK08KB] C:\Programmi\Trust\302KS\Keyboard\MMKEYBD.EXE O4 - HKLM\..\Run: [FLMBROWSEMOUSE] C:\Programmi\Trust\302KS\Mouse\mouse32a.exe O4 - HKLM\..\Run: [AdsPlus] c:\Program Files\AdsPlus\AdsPlus.exe O4 - HKLM\..\Run: [qfiduz] C:\WINDOWS\qfiduz.exe O4 - HKLM\..\Run: [securer] C:\WINDOWS\SYSTEM\SECURER\SYSHOST.EXE O4 - HKLM\..\Run: [ControlPanel] C:\WINDOWS\SYSTEM\cmd32.exe internat.dll,LoadKeyboardProfile O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [ccRegVfy] "C:\Programmi\File comuni\Symantec Shared\ccRegVfy.exe" O4 - HKLM\..\Run: [bgULeSdCe] C:\WINDOWS\XDFABH.EXE O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\SYGATE\SPF\SMC.EXE -startgui O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE O4 - HKLM\..\Run: [CreateCD] C:\PROGRA~1\ADAPTEC\EASYCD~1\CREATECD\CREATECD.EXE -r O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe" O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Programmi\File comuni\Symantec Shared\Script Blocking\SBServ.exe" -reg O4 - HKLM\..\RunServices: [SmcService] C:\PROGRAMMI\SYGATE\SPF\SMC.EXE O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [MSAgent] C:\WINDOWS\HHNT.EXE O4 - HKCU\..\Run: [Satc] C:\WINDOWS\Application Data\bcep.exe O4 - HKCU\..\Run: [nscu] C:\WINDOWS\SYSTEM\iotc.exe O4 - Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE10\EXCEL.EXE/3000 O15 - Trusted Zone: *.windupdates.com O15 - Trusted Zone: *.skoobidoo.com O15 - Trusted Zone: *.slotchbar.com O15 - Trusted Zone: *.iframedollars.biz O15 - Trusted Zone: *.windupdates.com (HKLM) O15 - Trusted Zone: *.skoobidoo.com (HKLM) O15 - Trusted Zone: *.slotchbar.com (HKLM) O15 - Trusted Zone: *.iframedollars.biz (HKLM) O15 - Trusted IP range: 69.50.161.82 O15 - Trusted IP range: (HKLM) O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/game...ts/y/ct2_x.cab O16 - DPF: {E56347B0-6C2B-4C2E-939F-EE513EAC80BC} (Creative Product Registration ActiveX Control Module) - http://www.creative.com/register/OCX...n98SENoMFC.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary...o.cab30149.cab O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab30149.cab O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary...t.cab30149.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab30149.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab30149.cab O16 - DPF: {15320607-1001-1831-1000-118599957123} - ms-its:mhtml:file://C:\PATH.MHT!http://195.225.176.5//d//izgdrqn//rp...::/painter.exe O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yaho.../yinst0401.cab O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...n.cab31267.cab O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab O18 - Filter: text/html - {936E9AEC-366F-44EA-9789-4A14810FF65A} - C:\WINDOWS\SYSTEM\EDIB.DLL O18 - Filter: text/plain - {936E9AEC-366F-44EA-9789-4A14810FF65A} - C:\WINDOWS\SYSTEM\EDIB.DLL SAREI MOLTO GRATO A CHIUNQUE SAPPIA DARMI QUALCHE INFORMAZIONE UTILE, NON VOGLIO DARLA VINTA A QUESTI WORM FORMATTANDO IL PC |
|
|
|
22-12-2004, 21:52
|
#2 |
|
Senior Member
Iscritto dal: Oct 2002
Città: Mi
Messaggi: 8047
|
Inserisci il log qui e vedi che ti dice , ma attento che il risulato è indicativo non infallibile e cancalla solo quello che è segnato in rosso :
http://www.ilsoftware.it/hijackthis.asp |
|
|
|
|
|
| Strumenti | |
|
|
Tutti gli orari sono GMT +1. Ora sono le: 08:38.
