|
|||||||
|
|
|
 |
|
|
Strumenti |
30-05-2005, 23:06
|
#1 |
|
Senior Member
Iscritto dal: Nov 2003
Messaggi: 335
|
Nuovo Coolwebsearch
Ciao ragazzi, penso di aver preso una nuova versione del famoso virus CWS.
L' anti virus McAfee in modalità provvisoria mi ha eliminato quattro o cinque files. Inoltre ho utilizzato ad-ware e spysweper i quali mi hanno rimosso dei files (trojan e coolwebsearch). Ho scaricato l'apposito programma CWShreader(penso) ma non mi ha trovato nulla. Il problema è che non so come pulire il PC. Ho effettuato una scanzione con HJThis ma non c'ho capito molto.... vi posto il mio precedente file log e quello attuale(dopo l'infezione). L'antivirus pur avendo eliminato il virus ogni volta che apro explorer la pagina iniziale mi viene rimpostata. Inoltre ho notato numerosi files nella cartella winnt di dubbia provenienza (APIWX.exe e nelle proprietà mi da size 0 byte). Ho provato a fare la ricerca su google di alcuni files ma non ho trovato nessuna informazione. FILE LOG precedente all'infezione.. Logfile of HijackThis v1.99.1 Scan saved at 6:05:09 PM, on 5/17/2005 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe C:\WINNT\system32\nvsvc32.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\system32\svchost.exe c:\PROGRA~1\mcafee.com\vso\mcshield.exe C:\WINNT\Explorer.EXE C:\WINNT\SOUNDMAN.EXE C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe C:\PROGRA~1\mcafee.com\agent\mcagent.exe c:\progra~1\mcafee.com\vso\mcvsescn.exe C:\WINNT\system32\internat.exe C:\WINNT\System32\svchost.exe C:\Documents and Settings\Vittorio\Desktop\hijackthis_199\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.google.it/ O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe O4 - HKCU\..\Run: [internat.exe] internat.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/Sha...in/AvSniff.cab O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{175E744A-C76C-4388-A42F-3ECBFD25837D}: NameServer = 212.216.112.112,212.216.172.62 O17 - HKLM\System\CS1\Services\Tcpip\..\{175E744A-C76C-4388-A42F-3ECBFD25837D}: NameServer = 212.216.112.112,212.216.172.62 O17 - HKLM\System\CS2\Services\Tcpip\..\{175E744A-C76C-4388-A42F-3ECBFD25837D}: NameServer = 212.216.112.112,212.216.172.62 O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe FILE LOG 2 Dopo l'infezione Logfile of HijackThis v1.99.1 Scan saved at 1:40:41 AM, on 5/27/2005 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\nvsvc32.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\system32\svchost.exe C:\WINNT\Explorer.EXE C:\WINNT\SOUNDMAN.EXE C:\PROGRA~1\mcafee.com\agent\mcagent.exe c:\progra~1\mcafee.com\vso\mcvsescn.exe C:\WINNT\system32\internat.exe c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe c:\PROGRA~1\mcafee.com\vso\mcshield.exe C:\Documents and Settings\Vittorio\Desktop\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\xkbeo.dll/sp.html#55135 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\system32\xkbeo.dll/sp.html#55135 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\system32\xkbeo.dll/sp.html#55135 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\xkbeo.dll/sp.html#55135 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\xkbeo.dll/sp.html#55135 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\xkbeo.dll/sp.html#55135 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.google.it/ R3 - Default URLSearchHook is missing O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Class - {4291F166-34AB-044D-0284-41F60256B33F} - C:\WINNT\crtk.dll (file missing) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\mcupdate.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe O4 - HKLM\..\Run: [IEXPLORE.EXE] C:\Program Files\Internet Explorer\IEXPLORE.EXE O4 - HKLM\..\Run: [CleanUp] C:\PROGRA~1\McAfee.com\Shared\mcappins.exe /v=3 /cleanup O4 - HKCU\..\Run: [internat.exe] internat.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/Sha...in/AvSniff.cab O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{175E744A-C76C-4388-A42F-3ECBFD25837D}: NameServer = 212.216.112.112,212.216.172.62 O17 - HKLM\System\CS1\Services\Tcpip\..\{175E744A-C76C-4388-A42F-3ECBFD25837D}: NameServer = 212.216.112.112,212.216.172.62 O17 - HKLM\System\CS2\Services\Tcpip\..\{175E744A-C76C-4388-A42F-3ECBFD25837D}: NameServer = 212.216.112.112,212.216.172.62 O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe Spero qualcuno mi riesca ad aiutare. ciao |
|
|
|
31-05-2005, 00:37
|
#2 |
|
Senior Member
Iscritto dal: Dec 2004
Città: Magenta(MI)
Messaggi: 1513
|
Prova a seguire le istruzioni presenti in questo forum:
http://www.pchell.com/support/aboutblank.shtml e questo utile programma http://www.adwareaway.com/ |
|
|
|
|
31-05-2005, 09:44
|
#3 |
|
Senior Member
Iscritto dal: Nov 2003
Città: Mordor
Messaggi: 336
|
Dovresti fixare le seguenti voci.
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\xkbeo.dll/sp.html#55135 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\system32\xkbeo.dll/sp.html#55135 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\system32\xkbeo.dll/sp.html#55135 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\xkbeo.dll/sp.html#55135 R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\xkbeo.dll/sp.html#55135 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\xkbeo.dll/sp.html#55135 R3 - Default URLSearchHook is missing O2 - BHO: Class - {4291F166-34AB-044D-0284-41F60256B33F} - C:\WINNT\crtk.dll (file missing) O4 - HKLM\..\Run: [IEXPLORE.EXE] C:\Program Files\Internet Explorer\IEXPLORE.EXE Poi dimmi se è tutto OK |
|
|
|
|
31-05-2005, 12:24
|
#4 |
|
Senior Member
Iscritto dal: Nov 2003
Messaggi: 335
|
Oggi provo a fixare le voci da te elencate.. poi ti faccio sapere se il problema si è risolto.
Ma il file xkbeo.dll lo devo cancellare? L'ho spostato preventivamente di directory, ho fatto bene? |
|
|
|
|
31-05-2005, 13:57
|
#5 |
|
Member
Iscritto dal: May 2005
Città: Roma
Messaggi: 37
|
non so se il semplice fixare le voci possa cancellare i file dannosi...non sono esperta ma questo tipo di problema io ho dovuto "diciamo" risolverlo andando in provvisorio e riavviando windows con l'ultimo arresto disponibile prima del virus...però non so se va bene così...per il momento non ho avuto problemi anche perchè non avevo installato nulla di nuovo...
prima di ciò avevo provato con tutto ciò che da questo forum avevo letto *_* ma tutto si ricreava... siccome è un virus antipatico mi leggerò per bene le istruzioni di bluepix...anche se sono in inglese -_- |
|
|
|
|
31-05-2005, 14:58
|
#6 | |
|
Senior Member
Iscritto dal: Nov 2003
Città: Mordor
Messaggi: 336
|
Quote:
Fammi sapere |
|
|
|
|
|
01-06-2005, 00:28
|
#7 | |
|
Bannato
Iscritto dal: Mar 2004
Città: Galapagos Attenzione:utente flautolente,tienilo a mente
Messaggi: 29023
|
Quote:
|
|
|
|
|
|
01-06-2005, 00:32
|
#8 |
|
Bannato
Iscritto dal: Mar 2004
Città: Galapagos Attenzione:utente flautolente,tienilo a mente
Messaggi: 29023
|
pulisci il sistema da:
C:\WINNT\system32\internat.exe O4 - HKCU\..\Run: [internat.exe] internat.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\xkbeo.dll/sp.html#55135 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\system32\xkbeo.dll/sp.html#55135 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\system32\xkbeo.dll/sp.html#55135 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\xkbeo.dll/sp.html#55135 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\xkbeo.dll/sp.html#55135 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\xkbeo.dll/sp.html#55135 O2 - BHO: Class - {4291F166-34AB-044D-0284-41F60256B33F} - C:\WINNT\crtk.dll (file missing) O4 - HKCU\..\Run: [internat.exe] internat.exe installati il service pack 4 |
|
|
|
|
|
| Strumenti | |
|
|
Tutti gli orari sono GMT +1. Ora sono le: 23:58.
