Olimpo Informatico

[martello85]

ciao a tutti...purtroppo ho accettato per sbaglio un file su msn che si è rivelato essere un virus trojan horse...sono abbastanza inesperto e non saprei come eliminarlo...anche perchè il mio antivirus (AVG free) non sembra essere d'aiuto...potreste darmi dei consigli su come posso rimuovere il virus??
grazie mille e ciao!

[bdoriano]

Ciao martello85,

Segui le istruzioni di questo topic per postare il log di hijackthis.

PS: se vuoi, puoi presentarti qui

[martello85]

ho scaricato hijackthis...vi scrivo il log prima di eliminare qualcosa di importante:

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 15.29.33, on 18/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
H:\Programmi\Alwil Software\Avast4\ashServ.exe
H:\WINDOWS\system32\spoolsv.exe
H:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
H:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
H:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
H:\PROGRA~1\Grisoft\AVG7\avgemc.exe
H:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
H:\Programmi\Microsoft LifeCam\MSCamS32.exe
H:\WINDOWS\system32\nvsvc32.exe
H:\WINDOWS\System32\svchost.exe
H:\PROGRA~1\Grisoft\AVG7\avgcc.exe
H:\Programmi\Analog Devices\Core\smax4pnp.exe
H:\Programmi\Analog Devices\SoundMAX\Smax4.exe
H:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
H:\Programmi\Alwil Software\Avast4\ashWebSv.exe
H:\WINDOWS\system32\RUNDLL32.EXE
H:\Programmi\Java\jre1.6.0_03\bin\jusched.exe
H:\Programmi\CyberLink\PowerDVD\PDVDServ.exe
H:\Programmi\File comuni\Real\Update_OB\realsched.exe
H:\WINDOWS\vVX1000.exe
H:\Programmi\iTunes\iTunesHelper.exe
H:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
H:\WINDOWS\system32\ctfmon.exe
H:\Programmi\iPod\bin\iPodService.exe
H:\WINDOWS\system32\WgaTray.exe
H:\Programmi\Mozilla Firefox\firefox.exe
H:\WINDOWS\explorer.exe
H:\Documents and Settings\Luca\Desktop\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - H:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - H:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - H:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7BED1F14-57E9-4E35-943F-CE1688F6CB4E} - H:\WINDOWS\system32\byxwwus.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - H:\Programmi\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: (no name) - {D514F04F-7FF1-41E3-8CA8-4D178268D1C5} - H:\WINDOWS\system32\gebcd.dll
O4 - HKLM\..\Run: [AVG7_CC] H:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SoundMAXPnP] H:\Programmi\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "H:\Programmi\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "H:\Programmi\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [RemoteControl] H:\Programmi\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [REGSHAVE] H:\Programmi\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [TkBellExe] "H:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "H:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "H:\Programmi\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [LifeCam] "H:\Programmi\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [VX1000] H:\WINDOWS\vVX1000.exe
O4 - HKLM\..\Run: [iTunesHelper] "H:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Registry Service] regsvc.exe
O4 - HKLM\..\Run: [avast!] H:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] H:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] H:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] H:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] H:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] H:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = H:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://H:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - H:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Programmi\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Programmi\Messenger\msmsgs.exe (file missing)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1177809555591
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - H:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: byxwwus - H:\WINDOWS\SYSTEM32\byxwwus.dll
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - H:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - H:\WINDOWS\System32\browseui.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - H:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - H:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - H:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - H:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - H:\Programmi\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - H:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - H:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - H:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - H:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - H:\Programmi\iPod\bin\iPodService.exe
O23 - Service: NMIndexingService - Unknown owner - H:\Programmi\File comuni\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - H:\WINDOWS\system32\nvsvc32.exe

--
End of file - 7526 bytes

[bdoriano]

Usa combofix come indicato in questo messaggio e posta il log generato (C:\Combofix.txt).

[martello85]

ecco fatto...cmq grazie mille x l'aiuto!

ComboFix 07-12-18.1 - Luca 2007-12-18 15.47.47.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1040.18.514 [GMT 1:00]
Eseguito da: H:\Documents and Settings\Luca\Desktop\ComboFix.exe
* Creato nuovo punto di ripristino
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

H:\WINDOWS\system32\byxwwus.dll
H:\WINDOWS\system32\dcbeg.ini
H:\WINDOWS\system32\dcbeg.ini2
H:\WINDOWS\system32\gebcd.dll
H:\WINDOWS\system32\pmnkhef.dll
H:\WINDOWS\system32\wvurrsr.dll

.
((((((((((((((((((((((((( Files Creati Da 2007-11-18 al 2007-12-18 )))))))))))))))))))))))))))))))))))
.

2007-12-18 14:37 . 2007-12-18 15:46 143 --a------ H:\WINDOWS\system32\mcrh.tmp
2007-12-18 14:05 . 2007-12-18 14:25 <DIR> d-------- H:\Programmi\The Cleaner Free
2007-12-18 10:21 . 2007-07-30 19:19 271,224 --a------ H:\WINDOWS\system32\mucltui.dll
2007-12-18 10:21 . 2007-07-30 19:19 207,736 --a------ H:\WINDOWS\system32\muweb.dll
2007-12-18 10:21 . 2007-07-30 19:18 30,072 --a------ H:\WINDOWS\system32\mucltui.dll.mui
2007-12-17 17:45 . 2007-12-17 18:32 <DIR> d-------- H:\Programmi\Windows Live Toolbar
2007-12-17 17:45 . 2007-12-17 17:45 <DIR> d-------- H:\Programmi\Microsoft SQL Server Compact Edition
2007-12-17 17:27 . 2007-12-17 17:38 <DIR> d--hsc--- H:\Programmi\File comuni\WindowsLiveInstaller
2007-12-17 17:27 . 2007-12-18 15:40 <DIR> d-------- H:\Documents and Settings\All Users\Dati applicazioni\WLInstaller
2007-12-17 16:57 . 2007-12-17 16:57 <DIR> d-------- H:\Programmi\Alwil Software
2007-12-17 16:57 . 2003-03-18 21:20 1,060,864 --a------ H:\WINDOWS\system32\MFC71.dll
2007-12-17 16:57 . 2007-12-04 14:04 837,496 --a------ H:\WINDOWS\system32\aswBoot.exe
2007-12-17 16:57 . 2004-01-09 10:13 380,928 --a------ H:\WINDOWS\system32\actskin4.ocx
2007-12-17 16:57 . 2007-12-04 13:54 95,608 --a------ H:\WINDOWS\system32\AvastSS.scr
2007-12-17 16:57 . 2007-12-04 15:55 94,544 --a------ H:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-17 16:57 . 2007-12-04 15:56 93,264 --a------ H:\WINDOWS\system32\drivers\aswmon.sys
2007-12-17 16:57 . 2007-12-04 15:51 42,912 --a------ H:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-17 16:57 . 2007-12-04 15:49 26,624 --a------ H:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-17 16:57 . 2007-12-04 15:53 23,152 --a------ H:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-08 10:22 . 2007-12-08 10:22 <DIR> d-------- H:\Programmi\PQDVD
2007-12-04 02:33 . 2007-12-04 02:33 823,296 --a------ H:\WINDOWS\system32\divx_xx0c.dll
2007-12-04 02:33 . 2007-12-04 02:33 823,296 --a------ H:\WINDOWS\system32\divx_xx07.dll
2007-12-04 02:33 . 2007-12-04 02:33 802,816 --a------ H:\WINDOWS\system32\divx_xx11.dll
2007-12-04 02:33 . 2007-12-04 02:33 682,496 --a------ H:\WINDOWS\system32\DivX.dll
2007-12-04 02:33 . 2007-12-04 02:33 630,784 --a------ H:\WINDOWS\system32\divxdec.ax
2007-11-29 23:30 . 2007-11-29 23:30 3,596,288 --a------ H:\WINDOWS\system32\qt-dx331.dll
2007-11-29 23:30 . 2007-11-29 23:30 1,044,480 --a------ H:\WINDOWS\system32\libdivx.dll
2007-11-29 23:30 . 2007-11-29 23:30 524,288 --a------ H:\WINDOWS\system32\DivXsm.exe
2007-11-29 23:30 . 2007-11-29 23:30 200,704 --a------ H:\WINDOWS\system32\ssldivx.dll
2007-11-29 23:30 . 2007-11-29 23:30 4,816 --a------ H:\WINDOWS\system32\divxsm.tlb
2007-11-29 23:28 . 2007-11-29 23:28 196,608 --a------ H:\WINDOWS\system32\dtu100.dll
2007-11-29 23:28 . 2007-11-29 23:28 81,920 --a------ H:\WINDOWS\system32\dpl100.dll
2007-11-29 23:28 . 2007-11-29 23:28 416 --a------ H:\WINDOWS\system32\dtu100.dll.manifest
2007-11-29 23:28 . 2007-11-29 23:28 416 --a------ H:\WINDOWS\system32\dpl100.dll.manifest
2007-11-28 22:55 . 2007-11-28 22:55 156,992 --a------ H:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-11-28 22:53 . 2007-11-28 22:53 593,920 --a------ H:\WINDOWS\system32\dpuGUI11.dll
2007-11-28 22:53 . 2007-11-28 22:53 352,401 --a------ H:\WINDOWS\system32\DivXMedia.ax
2007-11-28 22:53 . 2007-11-28 22:53 344,064 --a------ H:\WINDOWS\system32\dpus11.dll
2007-11-28 22:53 . 2007-11-28 22:53 294,912 --a------ H:\WINDOWS\system32\dpu11.dll
2007-11-28 22:53 . 2007-11-28 22:53 294,912 --a------ H:\WINDOWS\system32\dpu10.dll
2007-11-28 22:53 . 2007-11-28 22:53 57,344 --a------ H:\WINDOWS\system32\dpv11.dll
2007-11-28 22:53 . 2007-11-28 22:53 53,248 --a------ H:\WINDOWS\system32\dpuGUI10.dll
2007-11-28 22:52 . 2007-11-28 22:52 12,288 --a------ H:\WINDOWS\system32\DivXWMPExtType.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-18 14:42 --------- d-----w H:\Programmi\Windows Live
2007-12-18 13:53 --------- d-----w H:\Documents and Settings\All Users\Dati applicazioni\MSN6
2007-12-18 13:49 --------- d-----w H:\Documents and Settings\Luca\Dati applicazioni\MSN6
2007-12-18 12:35 --------- d-----w H:\Documents and Settings\All Users\Dati applicazioni\Spybot - Search & Destroy
2007-12-18 10:33 --------- d-----w H:\Documents and Settings\Luca\Dati applicazioni\AVG7
2007-12-17 14:28 --------- d-----w H:\Documents and Settings\All Users\Dati applicazioni\Google Updater
2007-12-16 14:34 --------- d-----w H:\Programmi\eMule
2007-12-14 14:26 --------- d-----w H:\Documents and Settings\Luca\Dati applicazioni\Skype
2007-12-08 09:27 --------- d-----w H:\Programmi\DivX
2007-11-13 10:25 20,480 ----a-w H:\WINDOWS\system32\drivers\secdrv.sys
2007-10-27 13:19 --------- d-----w H:\Programmi\Picasa2
2007-10-20 00:56 43,528 ------w H:\WINDOWS\system32\drivers\pxhelp20.sys
2007-05-01 11:56 24,192 ----a-w H:\Documents and Settings\Luca\usbsermptxp.sys
2007-05-01 11:56 22,768 ----a-w H:\Documents and Settings\Luca\usbsermpt.sys
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* i valori vuoti & legittimi/default non sono visualizzati.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="H:\WINDOWS\system32\ctfmon.exe" [2004-08-19 23:39]
"MsnMsgr"="H:\Programmi\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="H:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-10-25 19:48]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 14:21 H:\WINDOWS\system32\HdAShCut.exe]
"SoundMAXPnP"="H:\Programmi\Analog Devices\Core\smax4pnp.exe" [2005-05-18 09:00]
"SoundMAX"="H:\Programmi\Analog Devices\SoundMAX\Smax4.exe" [2005-07-26 08:54]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-19 23:39 H:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2006-06-01 10:22 H:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="RunDLL32.exe" [2004-08-19 23:39 H:\WINDOWS\system32\rundll32.exe]
"SunJavaUpdateSched"="H:\Programmi\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11]
"RemoteControl"="H:\Programmi\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 19:24]
"REGSHAVE"="H:\Programmi\REGSHAVE\REGSHAVE.exe" [2002-02-04 21:32]
"TkBellExe"="H:\Programmi\File comuni\Real\Update_OB\realsched.exe" [2007-06-15 11:12]
"Adobe Reader Speed Launcher"="H:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51]
"QuickTime Task"="H:\Programmi\QuickTime\QTTask.exe" [2007-06-29 05:24]
"LifeCam"="H:\Programmi\Microsoft LifeCam\LifeExp.exe" [2007-01-13 02:48]
"VX1000"="H:\WINDOWS\vVX1000.exe" [2006-12-06 00:38]
"iTunesHelper"="H:\Programmi\iTunes\iTunesHelper.exe" [2007-09-26 13:42]
"Registry Service"="regsvc.exe" []
"avast!"="H:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="H:\WINDOWS\System32\CTFMON.EXE" [2004-08-19 23:39]
"AVG7_Run"="H:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-25 19:48]

R2 MSCamSvc;MSCamSvc;"H:\Programmi\Microsoft LifeCam\MSCamS32.exe" [2007-01-04 23:13]
R3 AEAudioService;AEAudio Service;H:\WINDOWS\system32\drivers\AEAudio.sys [2005-12-19 09:00]
S3 GVCplDrv;GVCplDrv;H:\WINDOWS\system32\drivers\GVCplDrv.sys [2004-05-02 09:47]
S3 VX1000;VX-1000;H:\WINDOWS\system32\DRIVERS\VX1000.sys [2006-12-06 00:39]

*Newly Created Service* - HTTPFILTER
.
Contenuto della cartella 'Scheduled Tasks'
"2007-12-17 09:06:04 H:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- H:\Programmi\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-18 15:51:51
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
Ora fine scansione: 2007-12-18 15:52:48 - machine was rebooted
.
2007-12-17 19:27:08 --- E O F ---

[bdoriano]

Bene. Qualcosa è già stato eliminato.

Fai queste scansioni con GMER e posta i logs su FreeFileHosting come indicato qui.

[martello85]

il forum link del 1° passaggio è questo:

gmer 18-12-2007.txt

ora faccio il secondo passaggio

[martello85]

ecco il forum link del 2° passaggio:

gmer225.txt

come stiamo andando?

[bdoriano]

Sii paziente.
Nel frattempo, scarica avenger e scompattalo in una sua cartella non temporanea e non sul desktop. Lo useremo dopo.

Scarica anche ATF-Cleaner.
Avvia ATF-Cleaner (serve a eliminare i files temporanei)
Metti il segno di spunta a Select All
(se vuoi conservare i files del cestino, togli il segno di spunta a Recycle bin)
Clicca su Empty selected

[bdoriano]

Domandina: dopo che hai fatto girare ComboFix, hai riavviato il pc?

Collegati a Kaspersky on-line scanner e fai la scansione estesa, come indicato qui.
Salva il risultato della scansione in un file (in formato HTML), carica il file su Freefilehosting e posta qui il link che ti viene assegnato.

[martello85]

ok fatto tutto come mi hai detto...ora?

[martello85]

con combofix mi si è riavviato da solo...è normale??
ora faccio quello che mi hai detto nel post precedente

[bdoriano]

Si, è normale che Combofix riavvii il pc.
Solo che mi sembrava fosse ancora attivo durante la scansione con gmer.

[martello85]

l'antivirus che mi hai detto ha rilevato 2 virus e 15 file infetti...il forum link è questo:

virus.html


come faccio a eliminarli?

[bdoriano]

• Disabilita il ripristino di sistema
  
  
• Scarica VundoFix.exe sul desktop
  
  - Esegui VundoFix.exe
  - Clicca Scan for Vundo.
  - al termine della scansione, clicca Remove Vundo.
  - ti chiede se vuoi eliminare i files infetti, clicca YES
  - il tuo video diventerà nero durante la rimozione di Vundo.
  - al termine ti chiederà di riavviare il pc, clicca OK.
  - Copia qui il contenuto del log C:\vundofix.txt e un nuovo log di hijackthis.
  
  Nota: VundoFix potrebbe non riuscire ad eliminare qualche file. In questo caso, VundoFix si avvierà automaticamente al riavvio del pc, ripeti le operazioni indicate sopra partendo da "Clicca Scan for Vundo" quando VundoFix apparirà al riavvio.
  
  
• Avvia AVENGER
  Clicca su input script manually
  Clicca sulla lente d'ingrandimento
  Inserisci queste righe:
  

  Citazione:

  Files to delete: H:\Programmi\Alwil Software\Avast4\DATA\clnr0.dll H:\WINDOWS\system32\mcrh.tmp

  
  Clicca su Done
  Clicca sul semaforo
  Il pc dovrebbe riavviarsi, se così non fosse, riavvialo tu.
  Al termine dell'operazione, posta qui il risultato con un log aggiornato di hijackthis.

[martello85]

fatto tutto...però Vundo non ha rilevato nessun file infetto...quindi non ha eliminato niente...

ti posto il log aggiornato dopo avenger:

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 18.16.29, on 18/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
H:\Programmi\Alwil Software\Avast4\ashServ.exe
H:\WINDOWS\system32\spoolsv.exe
H:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
H:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
H:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
H:\PROGRA~1\Grisoft\AVG7\avgemc.exe
H:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
H:\Programmi\Microsoft LifeCam\MSCamS32.exe
H:\WINDOWS\system32\nvsvc32.exe
H:\WINDOWS\System32\svchost.exe
H:\WINDOWS\Explorer.EXE
H:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
H:\Programmi\Alwil Software\Avast4\ashWebSv.exe
H:\WINDOWS\system32\WgaTray.exe
H:\PROGRA~1\Grisoft\AVG7\avgcc.exe
H:\Programmi\Analog Devices\Core\smax4pnp.exe
H:\Programmi\Analog Devices\SoundMAX\Smax4.exe
H:\Programmi\Java\jre1.6.0_03\bin\jusched.exe
H:\Programmi\CyberLink\PowerDVD\PDVDServ.exe
H:\WINDOWS\system32\RUNDLL32.EXE
H:\Programmi\File comuni\Real\Update_OB\realsched.exe
H:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe
H:\WINDOWS\vVX1000.exe
H:\Programmi\iTunes\iTunesHelper.exe
H:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
H:\WINDOWS\system32\ctfmon.exe
H:\Programmi\Windows Live\Messenger\MsnMsgr.Exe
H:\Programmi\iPod\bin\iPodService.exe
H:\Programmi\Mozilla Firefox\firefox.exe
H:\WINDOWS\system32\wuauclt.exe
H:\WINDOWS\system32\wuauclt.exe
H:\Documents and Settings\Luca\Desktop\PC Health\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - H:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - H:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - H:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - H:\Programmi\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O4 - HKLM\..\Run: [AVG7_CC] H:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SoundMAXPnP] H:\Programmi\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "H:\Programmi\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "H:\Programmi\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [RemoteControl] H:\Programmi\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [REGSHAVE] H:\Programmi\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [TkBellExe] "H:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "H:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "H:\Programmi\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [LifeCam] "H:\Programmi\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [VX1000] H:\WINDOWS\vVX1000.exe
O4 - HKLM\..\Run: [iTunesHelper] "H:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Registry Service] regsvc.exe
O4 - HKLM\..\Run: [avast!] H:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "H:\Programmi\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] H:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] H:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] H:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] H:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] H:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = H:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://H:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - H:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Programmi\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Programmi\Messenger\msmsgs.exe (file missing)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1177809555591
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - H:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - H:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - H:\WINDOWS\System32\browseui.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - H:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - H:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - H:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - H:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - H:\Programmi\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - H:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - H:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - H:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - H:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - H:\Programmi\iPod\bin\iPodService.exe
O23 - Service: NMIndexingService - Unknown owner - H:\Programmi\File comuni\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - H:\WINDOWS\system32\nvsvc32.exe

--
End of file - 7684 bytes

[martello85]

ti posto anche il log di vundofix:


VundoFix V6.7.7

Checking Java version...

Sun Java not detected
Scan started at 17.53.02 18/12/2007

Listing files found while scanning....

No infected files were found.


Beginning removal...



e quello di avenger:

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\uckiulsy

*******************

Script file located at: \??\H:\WINDOWS\bgxcuhsp.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at H:\Avenger

*******************

Beginning to process script file:



File H:\Programmi\Alwil Software\Avast4\DATA\clnr0.dll not found!
Deletion of file H:\Programmi\Alwil Software\Avast4\DATA\clnr0.dll failed!

Could not process line:
H:\Programmi\Alwil Software\Avast4\DATA\clnr0.dll
Status: 0xc0000034

File H:\WINDOWS\system32\mcrh.tmp deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

[martello85]

stavo pensando di eliminare tutti i file infetti che mi ha segnalato kaspersky in modalità provvisoria...faccio bene??

[bdoriano]

La maggior parte di quei files si trova nel ripristino di sistema. Se l'hai disabilitato, sono già stati eliminati.
Gli altri files sono stati messi in quarantena da ComboFix.
C'è rimasta solo una voce sospetta: regsvc.exe e non capisco dove si trovi il file a cui si riferisce.

Scarica VirIt, installalo, aggiornalo (importante) e fai lo scan completo.

[martello85]

ora eseguo...ma il ripristino di sistema poi lo posso riattivare?