Olimpo Informatico

[Blax]

Salve a tutti,
ho il solito problema di AVG che si è disattivato e ora mi è impossibile installarlo perchè mi da un errore verso la fine dell'installazione riguardante un file (non ricordo quale).
Ho anche il problema che ogni tanto il pc si riavvia da solo, ma quello non so se è per colpa di un virus poichè essendo che ho l'hard-disk semi-danneggiato potrebbe anche essere dovuto a quello.
Comunque vi posto qui il log di Hijack e grazie per l'aiuto che mi darete


Logfile of HijackThis v1.99.1
Scan saved at 11.54.22, on 05/04/2008
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\setrysvc.exe
C:\WINNT\System32\semwltry.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.exe
C:\Programmi\MessengerPlus! 3\MsgPlus.exe
C:\WINNT\System32\internat.exe
C:\WINNT\Belkinwcui.exe
C:\Programmi\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programmi\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [GCXX-Manager-Class] "C:\Programmi\Sony Ericsson\Wireless Manager\GCXXManager.exe" -startup
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Programmi\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - Global Startup: Belkin Wireless Utility.lnk = C:\WINNT\Belkinwcui.exe
O14 - IERESET.INF: START_PAGE_URL=http://it.msn.com
O14 - IERESET.INF: MS_START_PAGE_URL=http://it.msn.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab55762.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab55579.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab55200.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: MsgPlusLoader.dll
O23 - Service: Servizio amministrativo di Gestione disco logico (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: setrysvc - Unknown owner - C:\WINNT\System32\setrysvc.exe

[bdoriano]

Ciao Blax,
Nel log, c'è una voce indicata come pericolosa.
Segui le istruzioni di questo topic per postare il log di combofix.

[Blax]

Ecco il log di Combofix e quello nuovo di Hijack.


ComboFix 08-04-04.1 - Stefania 06/04/2008 21.03.28.1 - FAT32x86
Microsoft Windows 2000 Professional 5.0.2195.4.1252.1.1040.18.11 [GMT 2:00]
Eseguito da: C:\Documents and Settings\Stefania\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINNT\Web\default.htt

.
((((((((((((((((((((((((( Files Creati Da 2008-03-06 al 2008-04-06 )))))))))))))))))))))))))))))))))))
.

2008-04-06 21:03 . 06/04/08 21.03 16,384 --a----t- C:\WINNT\system32\Perflib_Perfdata_26c.dat
2008-04-04 15:00 . 04/04/08 15.01 16,384 --a------ C:\WINNT\system32\Perflib_Perfdata_260.dat
2008-03-31 13:05 . 31/03/08 15.32 16,384 --a------ C:\WINNT\system32\Perflib_Perfdata_258.dat
2008-03-28 16:43 . 28/03/08 16.43 5,110,375 --a------ C:\cdc-35c.exe
2008-03-22 11:07 . 22/03/08 11.07 <DIR> d-------- C:\Programmi\XviD
2008-03-22 11:07 . 22/03/08 11.07 <DIR> d-------- C:\Programmi\Lame MP3 Codec
2008-03-22 11:07 . 03/12/02 22.13 1,048,576 --a------ C:\WINNT\system32\lameACM.acm
2008-03-22 11:07 . 03/05/05 09.33 299,008 --a------ C:\WINNT\system32\LAME_MP3.dll
2008-03-22 11:07 . 10/12/04 21.29 401 --a------ C:\WINNT\system32\lame_acm.xml
2008-03-22 10:57 . 22/03/08 10.57 <DIR> d-------- C:\Programmi\File comuni\Adaptec Shared
2008-03-22 10:56 . 12/12/02 01.34 225,280 --a------ C:\WINNT\system32\wmpdxm.dll
2008-03-22 10:55 . 12/12/02 19.45 301,712 --a------ C:\WINNT\system32\drmclien.dll
2008-03-22 10:55 . 12/12/02 19.45 301,712 --a------ C:\WINNT\system32\dllcache\drmclien.dll
2008-03-22 10:55 . 12/12/02 01.34 82,432 --a------ C:\WINNT\system32\drmstor.dll
2008-03-22 10:55 . 12/12/02 01.34 82,432 --a------ C:\WINNT\system32\dllcache\drmstor.dll
2008-03-22 10:28 . 22/03/08 10.28 13,951,112 --a------ C:\MPSetup.exe
2008-03-21 20:19 . 30/05/03 09.00 1,962,496 --a------ C:\WINNT\system32\quartz.dll
2008-03-21 20:14 . 21/03/08 20.14 <DIR> d-------- C:\Directx9c
2008-03-21 19:23 . 21/03/08 19.23 297,528 --a------ C:\dxwebsetup.exe
2008-03-21 19:13 . 21/03/08 19.13 72,829,472 --a------ C:\directx_mar2008_redist.exe
2008-03-21 18:48 . 21/03/08 18.48 65 --a------ C:\WINNT\FISHUI.INI
2008-03-21 18:20 . 21/03/08 18.20 <DIR> d-------- C:\MCL
2008-03-21 18:19 . 01/02/08 08.40 110,592 --a------ C:\WINNT\system32\TG_DUMP0708.DLL
2008-03-21 17:04 . 22/03/08 10.57 58,000 --a------ C:\WINNT\system32\drivers\cdr4_2k.sys
2008-03-21 17:04 . 22/03/08 10.57 49,152 --a------ C:\WINNT\system32\cdrtc.dll
2008-03-21 17:04 . 22/03/08 10.57 45,056 --a------ C:\WINNT\system32\cdral.dll
2008-03-21 17:04 . 22/03/08 10.57 23,420 --a------ C:\WINNT\system32\drivers\cdralw2k.sys
2008-03-21 17:02 . 11/12/02 23.09 20,480 --a------ C:\WINNT\system32\wmpcore.dll
2008-03-21 17:02 . 11/12/02 23.09 20,480 --a------ C:\WINNT\system32\wmpcd.dll
2008-03-21 17:01 . 13/12/02 15.46 2,973,696 --a------ C:\WINNT\system32\wmploc.dll
2008-03-21 17:01 . 11/12/02 23.09 20,480 --a------ C:\WINNT\system32\wmpui.dll
2008-03-21 17:01 . 11/12/02 23.09 20,480 --a------ C:\WINNT\system32\wmp.ocx
2008-03-21 16:23 . 21/03/08 17.08 134 --a------ C:\WINNT\ODBC.INI
2008-03-21 16:11 . 21/03/08 16.11 <DIR> d-------- C:\Programmi\Adaptec
2008-03-21 16:11 . 11/05/01 20.18 276,816 --a------ C:\WINNT\system32\wmv8ds32.ax
2008-03-21 16:11 . 11/05/01 20.18 264,528 --a------ C:\WINNT\system32\wmvds32.ax
2008-03-21 16:11 . 11/05/01 20.18 264,528 --a------ C:\WINNT\system32\mpg4ds32.ax
2008-03-21 16:11 . 11/05/01 20.18 227,936 --a------ C:\WINNT\system32\msadds32.ax
2008-03-21 16:11 . 11/05/01 20.18 76,112 --a------ C:\WINNT\system32\msscds32.ax
2008-03-21 16:11 . 14/05/01 17.03 71,680 --a------ C:\WINNT\system32\wmerrita.dll
2008-03-21 16:10 . 14/05/01 19.37 1,210,368 --a------ C:\WINNT\system32\msdxm.ocx
2008-03-21 16:10 . 14/05/01 19.37 644,096 --a------ C:\WINNT\system32\dxmasf.dll
2008-03-21 16:10 . 02/05/01 01.06 352,256 --a------ C:\WINNT\system32\lyrasp.dll
2008-03-21 16:10 . 14/05/01 19.37 251,904 --a------ C:\WINNT\system32\strmdll.dll
2008-03-21 16:10 . 02/05/01 01.06 53,248 --a------ C:\WINNT\system32\mspmspsv.exe
2008-03-21 16:10 . 03/03/01 04.51 45,056 --a------ C:\WINNT\system32\wmplenc.dll
2008-03-21 16:10 . 14/05/01 19.37 5,120 --a------ C:\WINNT\system32\msdxmlc.dll
2008-03-21 13:50 . 21/03/08 13.50 <DIR> d-------- C:\My Video
2008-03-21 13:50 . 21/03/08 13.50 <DIR> d-------- C:\My Music
2008-03-21 13:49 . 22/03/08 11.07 65,024 --a------ C:\WINNT\IFinst26.exe
2008-03-21 13:47 . 21/03/08 13.47 <DIR> d-------- C:\Documents and Settings\Stefania\Dati applicazioni\DataCast
2008-03-21 13:46 . 21/03/08 13.46 <DIR> d-------- C:\Programmi\Samsung
2008-03-21 13:46 . 20/11/07 15.36 118,784 --a------ C:\WINNT\system32\MaDRM.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-05 13:56 3,786,760 ----a-w C:\WINNT\system32\D3DX9_37.dll
2008-03-05 13:56 1,420,824 ----a-w C:\WINNT\system32\D3DCompiler_37.dll
2008-03-05 13:50 80,896 ----a-w C:\WINNT\system32\dxdllreg.exe
2008-03-03 11:15 90,864 ----a-w C:\WINNT\system32\drivers\ndiswan.sys
2008-03-03 11:15 90,864 ----a-w C:\WINNT\system32\dllcache\ndiswan.sys
2008-03-03 11:15 84,752 ----a-w C:\WINNT\system32\drivers\ipsec.sys
2008-03-03 11:15 84,752 ----a-w C:\WINNT\system32\dllcache\ipsec.sys
2008-03-03 11:15 496,400 ----a-w C:\WINNT\system32\lsasrv.dll
2008-03-03 11:15 496,400 ----a-w C:\WINNT\system32\dllcache\lsasrv.dll
2008-03-03 11:15 146,192 ----a-w C:\WINNT\system32\dllcache\dssenh.dll
2008-03-03 11:15 139,536 ----a-w C:\WINNT\system32\schannel.dll
2008-03-03 11:15 139,536 ----a-w C:\WINNT\system32\dllcache\schannel.dll
2008-03-03 11:15 134,416 ----a-w C:\WINNT\system32\dllcache\rsaenh.dll
2008-02-27 08:56 31,768,752 ----a-w C:\avg75free_516a1225.exe
2008-02-05 21:07 462,864 ----a-w C:\WINNT\system32\d3dx10_37.dll
2008-02-01 06:40 40,960 ----a-w C:\WINNT\system32\MAMACExtract.dll
2007-12-24 10:41 32 ----a-w C:\Documents and Settings\All Users\Dati applicazioni\ezsid.dat
2007-08-28 09:02 2,720,456 ----a-w C:\Programmi\ccsetup141.exe
2007-08-05 20:39 12,695,208 ----a-w C:\Programmi\Install_ICQ6.exe
2007-06-11 10:23 6,469,352 ----a-w C:\Programmi\avgas-setup-7[1].5.0.50.exe
2007-05-25 19:20 3,858,985 ----a-w C:\Programmi\eMule0.48a-Installer.exe
2007-04-05 13:07 13,101,168 ----a-w C:\Programmi\MPSetup.exe
2007-04-04 22:40 10,466,176 ----a-w C:\Programmi\MP71.exe
2007-03-24 15:34 4,322,304 ----a-w C:\Programmi\aawsepersonal.exe
2007-03-18 14:44 5,037,072 ----a-w C:\Programmi\spybotsd14.exe
2007-03-18 14:42 2,566,736 ----a-w C:\Programmi\spywareblastersetup351.exe
2007-02-12 23:37 4,313,608 ----a-w C:\Programmi\libero_icq5.exe
2007-01-02 19:07 1,106,121 ----a-w C:\Programmi\wrar362it.exe
2007-01-02 18:52 6,438,224 ----a-w C:\Programmi\sdsetup-3.5.0.478Q-winrar.exe
2006-12-26 15:20 5,713,840 ----a-w C:\Programmi\Firefox Setup 2.0.0.1.exe
2006-12-03 12:23 17,515,272 ----a-w C:\Programmi\avg75free_430a848.exe
2006-12-03 12:07 8,282,187 ----a-w C:\Programmi\vlc-0.8.5-win32.exe
2006-10-22 13:34 12,841,064 ----a-w C:\Programmi\SkypeSetup.exe
2006-10-14 19:36 271 ---h--w C:\Programmi\desktop.ini
2006-10-14 19:36 22,075 ---h--w C:\Programmi\folder.htt
2000-08-10 22:00 32,528 ----a-w C:\WINNT\inf\wbfirdma.sys
.

------- Sigcheck -------

Cryptography Services Error !!
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* i valori vuoti & legittimi/default non sono visualizzati.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"internat.exe"="internat.exe" [11/08/00 00.00 20752 C:\WINNT\system32\internat.exe]
"updateMgr"="C:\Programmi\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [30/03/06 16.45 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [11/08/00 00.00 111376 C:\WINNT\system32\mobsync.exe]
"MessengerPlus3"="C:\Programmi\MessengerPlus! 3\MsgPlus.exe" [15/10/06 21.15 190024]
"GCXX-Manager-Class"="C:\Programmi\Sony Ericsson\Wireless Manager\GCXXManager.exe" [19/01/05 13.37 802921]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"internat.exe"="internat.exe" [11/08/00 00.00 20752 C:\WINNT\system32\internat.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"^SetupICWDesktop"="C:\Programmi\Internet Explorer\Connection Wizard\icwconn1.exe" [19/06/03 12.05 188176]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=MsgPlusLoader.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"= mmdrv.dll
"msacm.lhacm"= lhacm.acm
"MSVideo8"= VfWWDM32.dll
"msacm.lameacm"= LameACM.acm

R3 apmbatt;Driver batteria precedente Microsoft APM;C:\WINNT\System32\DRIVERS\apmbatt.sys [25/09/99 18.36 ]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-06 21:11:22
Windows 5.0.2195 Service Pack 4 FAT NTAPI

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
Ora fine scansione: 06/04/2008 21.15.27
ComboFix-quarantined-files.txt 2008-04-06 19:14:34
29 Directory 12,000,608,256 byte disponibili
30 Directory 11,993,333,760 byte disponibili
.
2007-08-20 09:54:31 --- E O F ---







Logfile of HijackThis v1.99.1
Scan saved at 21.38.29, on 06/04/2008
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\setrysvc.exe
C:\WINNT\System32\semwltry.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.exe
C:\Programmi\MessengerPlus! 3\MsgPlus.exe
C:\WINNT\System32\internat.exe
C:\WINNT\Belkinwcui.exe
C:\Programmi\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programmi\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [GCXX-Manager-Class] "C:\Programmi\Sony Ericsson\Wireless Manager\GCXXManager.exe" -startup
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Programmi\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - Global Startup: Belkin Wireless Utility.lnk = C:\WINNT\Belkinwcui.exe
O14 - IERESET.INF: START_PAGE_URL=http://it.msn.com
O14 - IERESET.INF: MS_START_PAGE_URL=http://it.msn.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab55762.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab55579.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab55200.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: MsgPlusLoader.dll
O23 - Service: Servizio amministrativo di Gestione disco logico (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: setrysvc - Unknown owner - C:\WINNT\System32\setrysvc.exe

[Blax]

Scusate l'up, ma non più avuto una risposta sulla situazione del mio pc (magari è una semplice dimenticanza) e io necessito ancora di aiuto, visto che il mio pc mi sembra sempre più lento e non ho neanche la protezione di un antivirus. Grazie

[chemicalbit]

[Sante62]

Ciao Blax....

Combofix ha eliminato qualcosa e non si vedono altre cose strane...

Nel frattempo scaricati Virit
Aggiornalo mediante l'icona della parabola posta nella barra in alto e fagli fare la scansione completa del PC.
Fai in modo che rimuova automaticamente i file infetti trovati.
Non dimenticare di disattivare momentaneamente il tuo antivirus.
Incolla poi quì il risultato.

Fai anche la scansione con Systemscan e posta il log generato come
indicato quì;

comunque, se come dici hai l'hard disk danneggiato credo che il problema persisterà...

[Blax]

@ chemicalbit:
non ho provato ad installare altri anti-virus perchè AVG è l'unico che mi interessa e poi le altre volte in cui ho avuto questo stesso problema non funzionavano neanche gli altri. Sì ho installato Msn Plus.

@ Sante62:
Ecco i log di Virit, SystemScan e Hijackthis (fatto in automatico da Systemscan).
Link del log di Systemscan : [URL="http://www.freefilehosting.net/files/3g042"]21_04_2008_23_57_report.zip[/URL]
Grazie dell'aiuto. E speriamo non ci sia più nulla.

VirIT eXplorer Lite Log

[SCANSIONE DELLA MEMORIA]
OK
[SCANSIONE DELLA MEMORIA]
OK
--------------------------------------------------------
21/04/2008 - 16:20:33

[SCANSIONE DEL REGISTRO]
OK

[C:]
MASTER BOOT RECORD: OK
BOOT SECTOR: OK

C:\Giochi\hand\Hand game.exe Infetto da Trojan.Win32.Agent.AOO
* * * RIMOSSO * * *

Chiavi Registro infette: 0.
Files Infetti: 1.
Files Sospetti: 0.
Files Analizzati: 25269.
Files Totali: 25269.
Chiavi Registro rimosse: 0.
Virus Rimossi: 1.





Logfile of HijackThis v1.99.1
Scan saved at 23.57.37, on 21/04/2008
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\setrysvc.exe
C:\WINNT\System32\semwltry.exe
C:\VEXPLITE\viritsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.exe
C:\Programmi\MessengerPlus! 3\MsgPlus.exe
C:\WINNT\System32\internat.exe
C:\WINNT\Belkinwcui.exe
C:\Documents and Settings\Stefania\Desktop\sys45574.exe
C:\DOCUME~1\Stefania\IMPOST~1\Temp\nst3.tmp\runme.exe
C:\Programmi\Hijackthis\HIJACKTHIS.exe
C:\WINNT\System32\cmd.exe
C:\WINNT\system32\notepad.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programmi\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [GCXX-Manager-Class] "C:\Programmi\Sony Ericsson\Wireless Manager\GCXXManager.exe" -startup
O4 - HKLM\..\Run: [VIRIT LITE MONITOR] C:\VEXPLITE\MONLITE.EXE
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Programmi\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - Global Startup: Belkin Wireless Utility.lnk = C:\WINNT\Belkinwcui.exe
O14 - IERESET.INF: START_PAGE_URL=http://it.msn.com
O14 - IERESET.INF: MS_START_PAGE_URL=http://it.msn.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab55762.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab55579.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab55200.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: MsgPlusLoader.dll
O23 - Service: Servizio amministrativo di Gestione disco logico (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: setrysvc - Unknown owner - C:\WINNT\System32\setrysvc.exe
O23 - Service: Virit eXplorer Lite (viritsvclite) - TG Soft Sas www.tgsoft.it - C:\VEXPLITE\viritsvc.exe

[Sante62]

Allora, dai logs l'unica voce sospetta, come già detto, è quella di Msn Plus;

pare sia pericoloso e portatore di numerosi malware;

quindi, ti consiglierei di avviare HJT, selezionare questa riga e cliccare su fix Checked:

[Blax]

Ok.
Riposto solo qui il log di Systemscan perchè nel post precedente non ha funzionato.
http://www.freefilehosting.net/download/3g042

[chemicalbit]

[Sante62]

[chemicalbit]

[Sante62]

Allora non ci sono più dubbi....

[Blax]

Allora, ho cancellato Msn Plus (anche se non avevo lo sponsor) e ho eseguito Ccleaner.
Mentre invece Kaspersky non mi fa fare lo scan perchè dice che non ho Windows 2000 o superiore e Internet Explorer 6 o superiore, cosa non vera perchè ho esattamente quelle versioni (avevo provato anche ad aggiornare explorer alla versione 6 ma mi diceva che è già aggiornato), e lui mi dice invece che ho Windows NT 5 e Explorer 5.
Inoltre AVG ancora non funziona, continua a darmi l'errore di prima, che è questo:

Local machine: installation failed
Installation:
Error: Action failed for file avg7core.sys: starting service....
Risorse di sistema insufficienti per completare il servizio richiesto. (1450)


A questo punto non credo che l'errore sia dovuto a un virus.

PS: prima di partire con l'installazione AVG mi dice che ho una versione non aggiornata di Roxio easy cd e dvd creator, e che ciò potrebbe causare problemi ad AVG, non so se c'entra qualcosa con l'errore di cui sopra, comunque io non ho installato quel programma

[Sante62]

E' strana questa cosa.....

Per sicurezza, guarda questa discussione scarica e fai la scansione con Elibagla;

a prescindere dall'esito, fai anche un test dell'hard disk con HD_TUNE;

Il software è scaricabile da quì;

[chemicalbit]

[Blax]

@ Sante62:

Ho eseguito lo scan con Elibagla e non ha trovato nulla.
Ho fatto lo scan con HD_tune e mi ha rilevato l'8,2% di hard-disk danneggiato (cosa che mi aspettavo).

@ chemicalbit:

Sì io ho Windows 2000 SP 4 e IE 6.

Un'ipotesi che posso fare riguardo alla falsa versione che Kaspersky rileva, è che tempo fa ho fatto un ripristino dell'installazione di Windows per un errore di sistema che mi dava, e quindi ora magari la versione di Windows e Explorer è tornata a quella base mentre Windows rileva ancora quella precedente al ripristino. Potrebbe essere?