Olimpo Informatico

[patty]

ciao a tutti spero mi possiate autare perchè sto diventando matta...
ho un virus che crea due file solamente nele cartelle condivise
i file sono setup.exe e autorun.inf se li cancello dopo qualche minuto si ricreano. ho provato tutti i tipi di antivirus e spyware ma niente. ho fatto la scansione online con kaspersky è mi dice che e un trojan-proxy.win32.horstbq, ma se poi faccio un'altra scansione non me lo riconosce più. ieri l'avg l'ha riconosciuto come Gaelicum.A ma la volta successiva non l'ha riconosciuto. oggi ha anche cambiato dimensione il file exe prima era da 56kb ora è da 72kb. Ho già formattato 2 volte ma il problema si ripresenta...qualcuno mi può aiutare grazie
Patty

[Smjert]

Il virus o meglio trojan che hai tu è una parte minore che viene creata dal Tenga.A.
Sembra che Panda riesca a eliminarlo, quindi la prima cosa che ti faccio fare è una bella scansione online con Panda, salva il rapporto e postalo qua.
Poi scarica HijackThis, decomprimilo in una cartella tutta sua (tipo C:\HijackThis), avvialo e clicca su Do a system scan and save a log file, poi copia e incolla qua il contenuto della finestra di Notepad che ti appare.

[patty]

grazie 1000

questo è il report di panda

Incident Status Location

Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\gigio\Cookies\gigio@atdmt[2].txt
Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\gigio\Cookies\gigio@bluestreak[1].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\gigio\Cookies\gigio@com[1].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\gigio\Cookies\gigio@doubleclick[2].txt
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\gigio\Cookies\gigio@ehg-ati.hitbox[1].txt
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\gigio\Cookies\gigio@hitbox[2].txt
Spyware:Cookie/Hitslink Not disinfected C:\Documents and Settings\gigio\Dati applicazioni\Mozilla\Firefox\Profiles\2kdwv4h4.default\cookies.txt[counter.hitslink.com/]
Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\gigio\Dati applicazioni\Mozilla\Firefox\Profiles\2kdwv4h4.default\cookies.txt[searchportal.information.com/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\gigio\Dati applicazioni\Mozilla\Firefox\Profiles\2kdwv4h4.default\cookies.txt[.doubleclick.net/]
Spyware:Cookie/Clickbank Not disinfected C:\Documents and Settings\gigio\Dati applicazioni\Mozilla\Firefox\Profiles\2kdwv4h4.default\cookies.txt[.clickbank.net/]
Spyware:Cookie/MetriWeb Not disinfected C:\Documents and Settings\gigio\Dati applicazioni\Mozilla\Firefox\Profiles\2kdwv4h4.default\cookies.txt[.metriweb.be/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\gigio\Dati applicazioni\Mozilla\Firefox\Profiles\2kdwv4h4.default\cookies.txt[.atdmt.com/]
Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\gigio\Dati applicazioni\Mozilla\Firefox\Profiles\2kdwv4h4.default\cookies.txt[.tradedoubler.com/]
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\gigio\Dati applicazioni\Mozilla\Firefox\Profiles\2kdwv4h4.default\cookies.txt[.statcounter.com/]
Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\gigio\Dati applicazioni\Mozilla\Firefox\Profiles\2kdwv4h4.default\cookies.txt[as1.falkag.de/]
Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\gigio\Dati applicazioni\Mozilla\Firefox\Profiles\2kdwv4h4.default\cookies.txt[.as-eu.falkag.net/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\gigio\Dati applicazioni\Mozilla\Firefox\Profiles\2kdwv4h4.default\cookies.txt[.serving-sys.com/]
Spyware:Cookie/Weborama Not disinfected C:\Documents and Settings\gigio\Dati applicazioni\Mozilla\Firefox\Profiles\2kdwv4h4.default\cookies.txt[.weborama.fr/]
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\gigio\Dati applicazioni\Mozilla\Firefox\Profiles\2kdwv4h4.default\cookies.txt[.xiti.com/]
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\gigio\Dati applicazioni\Mozilla\Firefox\Profiles\2kdwv4h4.default\cookies.txt[.mediaplex.com/]
Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\gigio\Dati applicazioni\Mozilla\Firefox\Profiles\2kdwv4h4.default\cookies.txt[.burstnet.com/]
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\gigio\Dati applicazioni\Mozilla\Firefox\Profiles\2kdwv4h4.default\cookies.txt[.tribalfusion.com/]
Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\gigio\Dati applicazioni\Mozilla\Firefox\Profiles\2kdwv4h4.default\cookies.txt[statse.webtrendslive.com/]
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\gigio\Dati applicazioni\Mozilla\Firefox\Profiles\2kdwv4h4.default\cookies.txt[.2o7.net/]
Spyware:Cookie/WUpd Not disinfected C:\Documents and Settings\gigio\Dati applicazioni\Mozilla\Firefox\Profiles\2kdwv4h4.default\cookies.txt[.revenue.net/]
Spyware:Cookie/bravenetA Not disinfected C:\Documents and Settings\gigio\Dati applicazioni\Mozilla\Firefox\Profiles\2kdwv4h4.default\cookies.txt[.bravenet.com/]
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\gigio\Dati applicazioni\Mozilla\Firefox\Profiles\2kdwv4h4.default\cookies.txt[ad.yieldmanager.com/]
Virus:W32/Puce.E.worm Not disinfected F:\downloads F\Password de PS2 100 ultimos juegos de ps2rip.com TODO DVDRIP.rar[setup.exe]
Spyware:Spyware/SafeSurf Not disinfected G:\20 settembre\programmi\evillyrics.zip[SETUP.EXE][²ÜÇ\ExtractDLL.dll]

[patty]

questo è il log hijackthis

Logfile of HijackThis v1.99.1
Scan saved at 17.29.38, on 03/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Sygate\SPF\smc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Programmi\Trust\Trust 235A USB ADSL MODEM\CnxDslTb.exe
C:\Programmi\ATI Technologies\ATI.ACE\cli.exe
C:\Programmi\VIAudioi\SBADeck\ADeck.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\ATI Technologies\ATI.ACE\cli.exe
C:\Programmi\Outlook Express\msimn.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.it
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.it
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Programmi\Trust\Trust 235A USB ADSL MODEM\CnxDslTb.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Programmi\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [AudioDeck] C:\Programmi\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: Scarica con FlashGet - C:\Programmi\FlashGet\jc_link.htm
O8 - Extra context menu item: Scarica tutto con FlashGet - C:\Programmi\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{47F4D45C-384C-48A0-A137-BBEAFB04FF63}: NameServer = 193.12.150.2 212.247.152.2
O17 - HKLM\System\CS1\Services\Tcpip\..\{47F4D45C-384C-48A0-A137-BBEAFB04FF63}: NameServer = 193.12.150.2 212.247.152.2
O17 - HKLM\System\CS2\Services\Tcpip\..\{47F4D45C-384C-48A0-A137-BBEAFB04FF63}: NameServer = 193.12.150.2 212.247.152.2
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Programmi\Sygate\SPF\smc.exe

[Smjert]

Hai un bel po' di schifezze..
1)Apri Firefox e svuota i Cookie (Strumenti->Opzioni->Privacy->scheda Cookie)
2)Se non sei stata tu ad installare FlashGet che è un download manager allora l'ha fatto un trojan backdoor, in quest'ultimo caso avvia HijackThis e premi Do a system scan only poi cerca queste voci e premi Fix Checked:

[patty]

Scusa se rispondo solo ora ma sono stata senza connessione per cambio gestore.
flashget l'avevo installato io ma l'ho cancellato lo stesso
log avenger:
//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Syntax error in line --- does not appear to be a valid registry path. Line will be ignored.
Error code: 0
Line: HKEY_CLASSES_ROOT\clsid\{a5366673-e8ca-11d3-9cd9-0090271d075b}


Syntax error in line --- does not appear to be a valid registry path. Line will be ignored.
Error code: 0
Line: HKEY_CLASSES_ROOT\clsid\{e0e899ab-f487-11d5-8d29-0050ba6940e3}


//////////////////////////////////////////


Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\qcdsydtc

*******************

Script file located at: \??\C:\WINDOWS\llinjyii.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



Could not open file F:\downloads F\Password de PS2 100 ultimos juegos de ps2rip.com TODO DVDRIP.rar for deletion
Deletion of file F:\downloads F\Password de PS2 100 ultimos juegos de ps2rip.com TODO DVDRIP.rar failed!

Could not process line:
F:\downloads F\Password de PS2 100 ultimos juegos de ps2rip.com TODO DVDRIP.rar
Status: 0xc000003a



File G:\20 settembre\programmi\evillyrics.zip not found!
Deletion of file G:\20 settembre\programmi\evillyrics.zip failed!

Could not process line:
G:\20 settembre\programmi\evillyrics.zip
Status: 0xc0000034



File C:\WINDOWS\system\msdoh.dll not found!
Deletion of file C:\WINDOWS\system\msdoh.dll failed!

Could not process line:
C:\WINDOWS\system\msdoh.dll
Status: 0xc0000034

Folder C:\Programmi\FlashGet deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\classes\clsid\{a5366673-e8ca-11d3-9cd9-0090271d075b} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\classes\clsid\{e0e899ab-f487-11d5-8d29-0050ba6940e3} deleted successfully.


Registry key HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar {e0e899ab-f487-11d5-8d29-0050ba6940e3} not found!
Deletion of registry key HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar {e0e899ab-f487-11d5-8d29-0050ba6940e3} failed!
Status: 0xc0000034



Registry key HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{a5366673-e8ca-11d3-9cd9-0090271d075b} not found!
Deletion of registry key HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{a5366673-e8ca-11d3-9cd9-0090271d075b} failed!
Status: 0xc0000034


Completed script processing.

*******************

Finished! Terminate.

log hijack:

Logfile of HijackThis v1.99.1
Scan saved at 8.05.45, on 12/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Sygate\SPF\smc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Programmi\ATI Technologies\ATI.ACE\cli.exe
C:\Programmi\VIAudioi\SBADeck\ADeck.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
C:\Programmi\Trust\Trust 235A USB ADSL MODEM\CnxDslTb.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Documents and Settings\gigio\Desktop\programmi\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.it
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.it
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [ATICCC] "C:\Programmi\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [AudioDeck] C:\Programmi\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Programmi\Trust\Trust 235A USB ADSL MODEM\CnxDslTb.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: Scarica con FlashGet - C:\Programmi\FlashGet\jc_link.htm
O8 - Extra context menu item: Scarica tutto con FlashGet - C:\Programmi\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{47F4D45C-384C-48A0-A137-BBEAFB04FF63}: NameServer = 85.37.17.43 151.99.125.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{47F4D45C-384C-48A0-A137-BBEAFB04FF63}: NameServer = 85.37.17.43 151.99.125.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{47F4D45C-384C-48A0-A137-BBEAFB04FF63}: NameServer = 85.37.17.43 151.99.125.1
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Programmi\Sygate\SPF\smc.exe

file trovati i ricerca

fgiebar.dll c:\programmi\FlashGet
flashget.exe c:\programmi\FlashGet
flashget.exe.manifest c:\programmi\FlashGet
jccatch.dll c:\programmi\FlashGet

grazie ancora
dimenticavo che l'avenger mi ha dato alcuni errori di sintassi

Patty

[patty]

scusa il log giusto di hijack è questo

Logfile of HijackThis v1.99.1
Scan saved at 8.12.17, on 12/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Sygate\SPF\smc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Programmi\ATI Technologies\ATI.ACE\cli.exe
C:\Programmi\VIAudioi\SBADeck\ADeck.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
C:\Programmi\Trust\Trust 235A USB ADSL MODEM\CnxDslTb.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\ATI Technologies\ATI.ACE\cli.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Documents and Settings\gigio\Desktop\programmi\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.it
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.it
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [ATICCC] "C:\Programmi\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [AudioDeck] C:\Programmi\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Programmi\Trust\Trust 235A USB ADSL MODEM\CnxDslTb.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{47F4D45C-384C-48A0-A137-BBEAFB04FF63}: NameServer = 85.37.17.43 151.99.125.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{47F4D45C-384C-48A0-A137-BBEAFB04FF63}: NameServer = 85.37.17.43 151.99.125.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{47F4D45C-384C-48A0-A137-BBEAFB04FF63}: NameServer = 85.37.17.43 151.99.125.1
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Programmi\Sygate\SPF\smc.exe

[Smjert]

Avenger non è riuscito a vedere se c'erano 2 chiavi di registro perchè non ha la definizione di HKEY_CLASSES_ROOT, l'unico modo è farlo a mano quindi:

Vai sulla barra di Start->Esegui->digita regedit e dai invio-> ti si apre l'editor di registro, naviga perfavore fino a questa chiave HKEY_CLASSES_ROOT\clsid\ (a sinistra ci sono le "cartelle" che hanno un + di fianco, quello serve per mostrare le sottocartelle).
A questo punto controlla se ci sono queste due chiavi e se ci sono cancellale {a5366673-e8ca-11d3-9cd9-0090271d075b} e {e0e899ab-f487-11d5-8d29-0050ba6940e3}.

Riavvia il pc in Modalità Provvisoria, poi:

[patty]

quella chiave di registo non c'è

i due file li ho cancellati

ora faccio la scansione con panda e purtroppo tutte le cartelle condivise hanno di di nuovo i due file
non riuscirò mai a togliermeli di torno

[patty]

ecco il log di Panda

Incidente Stato Percorso

Possibile Virus. Non Disinfettato C:\Documents and Settings\All Users\Documenti\setup.exe
Spyware:Cookie/Atlas DMT Non Disinfettato C:\Documents and Settings\gigio\Cookies\gigio@atdmt[2].txt
Spyware:Cookie/Bluestreak Non Disinfettato C:\Documents and Settings\gigio\Cookies\gigio@bluestreak[1].txt
Spyware:Cookie/Com.com Non Disinfettato C:\Documents and Settings\gigio\Cookies\gigio@com[1].txt
Spyware:Cookie/Doubleclick Non Disinfettato C:\Documents and Settings\gigio\Cookies\gigio@doubleclick[2].txt
Spyware:Cookie/Hitbox Non Disinfettato C:\Documents and Settings\gigio\Cookies\gigio@ehg-ati.hitbox[1].txt
Spyware:Cookie/Hitbox Non Disinfettato C:\Documents and Settings\gigio\Cookies\gigio@hitbox[2].txt
Spyware:Cookie/Tribalfusion Non Disinfettato C:\Documents and Settings\gigio\Dati applicazioni\Mozilla\Firefox\Profiles\2kdwv4h4.default\cookies.txt[.tribalfusion.com/]
Spyware:Cookie/Doubleclick Non Disinfettato C:\Documents and Settings\gigio\Dati applicazioni\Mozilla\Firefox\Profiles\2kdwv4h4.default\cookies.txt[.doubleclick.net/]
Spyware:Cookie/Hitbox Non Disinfettato C:\Documents and Settings\gigio\Dati applicazioni\Mozilla\Firefox\Profiles\2kdwv4h4.default\cookies.txt[.hitbox.com/]
Spyware:Cookie/Statcounter Non Disinfettato C:\Documents and Settings\gigio\Dati applicazioni\Mozilla\Firefox\Profiles\2kdwv4h4.default\cookies.txt[.statcounter.com/]
Possibile Virus. Non Disinfettato C:\Documents and Settings\gigio\Desktop\varie\setup.exe
Possibile Virus. Non Disinfettato C:\Programmi\WhereIsIt\setup.exe

i possibili virus sono nelle cartelle condivise
in questi giorni che non avevo la connessione non c'erano
oggi dopo qualche ora che ero connessa si sono ricreati.......
ho notato una cosa forse è colpa di Emule si creano dopo che l'ho aperto....forse

[Smjert]

Fammi capire... se tu cancelli setup.exe quello si ricrea? perchè Panda con il TruePrevent potrebbe segnalare dei file come infettati quando non lo sono (falso positivo).
D'altra parte nel log ti dice Possibile Virus.
Prova allora a fare anche una scansione con Kaspersky, database esteso (quando ha finito di fare gli aggiornamenti appare il pulsante Next, premilo, poi appare Scan Settings, vai lì e spunta la voce extended, poi fai la scansione).
Alla fine se ha trovato qualcosa di fa salvare il report (appare il pulsante Save Report As)

[holifay]

per favore mi mandi quel file setup.exe zippato a www.suspectfile.com?
Vorrei studiarlo un po´

[patty]

holifay...ho inviato il file

Smjert ecco il report di kaspersky
ovviamente l'ha trovato solo sulle cartelle condivise che avevo lasciato
tra l'altro li avevo cancellati più o meno alle 23 di ieri sera e all'una di questa notte si sono ricreati

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Friday, October 13, 2006 9:42:45 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 13/10/2006
Kaspersky Anti-Virus database records: 231370
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\

Scan Statistics:
Total number of scanned objects: 36939
Number of viruses found: 1
Number of infected objects: 2 / 0
Number of suspicious objects: 0
Duration of the scan process: 01:31:20

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Dati applicazioni\avg7\Log\emc.log Object is locked skipped
C:\Documents and Settings\All Users\Dati applicazioni\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users\Dati applicazioni\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\gigio\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\gigio\Desktop\prova\setup.exe Infected: Trojan-Proxy.Win32.Horst.ko skipped
C:\Documents and Settings\gigio\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\gigio\Impostazioni locali\Cronologia\History.IE5\MSHist012006101320061014\index.dat Object is locked skipped
C:\Documents and Settings\gigio\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\gigio\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\gigio\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\gigio\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\gigio\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\gigio\UserData\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Programmi\Sygate\SPF\debug.log Object is locked skipped
C:\Programmi\Sygate\SPF\rawlog.log Object is locked skipped
C:\Programmi\Sygate\SPF\seclog.log Object is locked skipped
C:\Programmi\Sygate\SPF\syslog.log Object is locked skipped
C:\Programmi\Sygate\SPF\tralog.log Object is locked skipped
C:\Programmi\WhereIsIt\setup.exe Infected: Trojan-Proxy.Win32.Horst.ko skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\CnxDslWz.log Object is locked skipped
C:\WINDOWS\system32\config\ACEEvent.evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\LogFiles\HTTPERR\httperr1.log Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
F:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
G:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
H:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

Scan process completed.

[patty]

ho risolto.....ho cambiato firewall e il virus non si è più ripresentato