Olimpo Informatico

[matteosa]

salve ho la cpu che ogni tanto skizza alta e mi impalla il pc probabilmente il bagle che avevo preso non è andato via del tutto mi aiutate a mandalo via? grazie...

sistema op Xp elibabla mi da tutto pulito vi allego questo log helpatemi grazieeee

COMBOFIX LOG


ComboFix 08-07-24.3 - Owner 2010-02-05 19.15.44.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2272 [GMT 1:00]
Running from: C:\DOCUME~1\Owner\LOCALS~1\Temp\Rar$EX01.843\combofix\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
- REDUCED FUNCTIONALITY MODE -
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\InfoSat.txt
C:\WINDOWS\system32\MSINET.oca

.
((((((((((((((((((((((((( Files Created from 2010-01-05 to 2010-02-05 )))))))))))))))))))))))))))))))
.

2010-02-04 14:28 . 2010-02-04 14:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AGeeksToy
2010-02-03 00:25 . 2010-02-05 18:41 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\vlc
2010-01-22 15:31 . 2010-01-22 16:13 78 --a------ C:\WINDOWS\options.dat
2010-01-22 15:26 . 2010-01-22 16:22 <DIR> d-------- C:\Program Files\Evisoft
2010-01-18 12:56 . 2010-01-18 13:51 <DIR> d-------- C:\Program Files\PokerStars.IT

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-05 17:43 --------- d-----w C:\Documents and Settings\Owner\Application Data\Azureus
2010-01-21 22:50 --------- d-----w C:\Program Files\Java
2010-01-08 18:58 --------- d-----w C:\Documents and Settings\Owner\Application Data\dvdcss
2010-01-03 20:36 --------- d-----w C:\Program Files\Zuma's Revenge!
2010-01-03 20:31 --------- d-----w C:\Documents and Settings\Owner\Application Data\SpinTop
2010-01-03 20:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\TEMP
2010-01-03 15:13 --------- d-----w C:\Program Files\PopCap Games
2010-01-01 14:57 --------- d-----w C:\Program Files\Azureus
2009-12-17 17:30 --------- d-----w C:\Program Files\Sacra
2009-12-17 17:25 74,752 -c--a-w C:\WINDOWS\ST6UNST.EXE
2009-12-17 17:25 253,952 -c----w C:\WINDOWS\Setup1.exe
2009-12-16 11:06 --------- d-----w C:\Program Files\Alwil Software
2009-12-16 01:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-12-16 00:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg8
2009-12-15 20:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\TVU Networks
2009-04-20 19:38 12,998 -c--a-w C:\Documents and Settings\Custom Settings\IE Favorite Links.bat
2009-04-20 17:04 31,052 -c--a-w C:\Documents and Settings\Custom Settings\System Settings.reg
2009-04-20 11:46 30,813 -c--a-w C:\Documents and Settings\Custom Settings\User Settings.reg
2009-04-19 23:23 2,677 -c--a-w C:\Documents and Settings\Custom Settings\User Settings.bat
2009-04-19 14:39 4,466 -c--a-w C:\Documents and Settings\Custom Settings\Auto Config.bat
2009-04-18 12:18 2,419 -c--a-w C:\Documents and Settings\Custom Settings\System Settings.bat
2009-04-18 11:21 653 -c--a-w C:\Documents and Settings\Custom Settings\IExpress Shortcut Creator.vbs
2009-04-17 23:32 1,086 -c--a-w C:\Documents and Settings\Custom Settings\WMP Shortcut Creator.vbs
2009-01-24 14:15 898 -c--a-w C:\Documents and Settings\Custom Settings\Apply Theme.vbs
2006-03-03 10:15 9,216 -c--a-w C:\Documents and Settings\Custom Settings\TaskBarCmd v1.1.exe
2003-09-03 16:33 131,072 -c--a-w C:\Documents and Settings\Custom Settings\ToggleQL.exe
2009-08-04 17:34 16,384 -csha-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
2009-08-04 17:34 245,760 -csha-w C:\WINDOWS\system32\config\systemprofile\IETldCache\index.dat
2009-08-04 17:34 16,384 -csha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
2009-08-04 17:34 32,768 -csha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.

------- Sigcheck -------

2009-04-20 19:25 361600 ba8c046d98345129723e6bcaa1e8ab99 C:\WINDOWS\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
2009-01-14 17:49 92504 --a------ C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
2009-02-06 18:17 1068904 --a------ C:\Program Files\Windows Live\Toolbar\wltcore.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{21FA44EF-376D-4D53-9B0F-8A89D3229068}"= "C:\Program Files\Windows Live\Toolbar\wltcore.dll" [2009-02-06 18:17 1068904]

[HKEY_CLASSES_ROOT\clsid\{21fa44ef-376d-4d53-9b0f-8a89d3229068}]
[HKEY_CLASSES_ROOT\TypeLib\{182E05A4-F4FF-4F73-8C84-D36B87D915AF}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{21FA44EF-376D-4D53-9B0F-8A89D3229068}"= "C:\Program Files\Windows Live\Toolbar\wltcore.dll" [2009-02-06 18:17 1068904]

[HKEY_CLASSES_ROOT\clsid\{21fa44ef-376d-4d53-9b0f-8a89d3229068}]
[HKEY_CLASSES_ROOT\TypeLib\{182E05A4-F4FF-4F73-8C84-D36B87D915AF}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 16:44 3883856]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 13:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2009-05-01 06:30 13750272]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 13:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 13:00 455168]
"CoolSwitch"="C:\WINDOWS\system32\taskswitch.exe" [2002-03-19 23:30 45632]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-25 00:51 81000]
"nwiz"="nwiz.exe" [2009-05-01 06:31 1657376 C:\WINDOWS\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 13:00 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 1 (0x1)
"NoDesktopCleanupWizard"= 1 (0x1)
"MaxRecentDocs"= 18 (0x12)
"NoSMConfigurePrograms"= 1 (0x1)
"NoRecentDocsNetHood"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
-ra------ 2009-09-04 12:08 935288 C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2009-10-03 04:08 35696 C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a--c--- 2007-10-15 03:17 49152 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpqSRMon]
--a--c--- 2007-08-22 22:31 80896 C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
--a--c--- 2008-04-14 13:00 208952 C:\WINDOWS\ime\IMJP8_1\imjpmig.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
-rahs---- 2009-03-05 15:07 2260480 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2009-10-11 04:17 149280 C:\Program Files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualCloneDrive]
--a------ 2009-05-26 23:31 85160 C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\eMule AdunanzA\\eMule_AdnzA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\Azureus\\Azureus.exe"=
"C:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"C:\\Program Files\\SopCast\\SopCast.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\Java\\jre6\\bin\\javaws.exe"=
"C:\\WINDOWS\\system32\\javaws.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

R0 iastor78;iastor78;C:\WINDOWS\system32\drivers\iastor78.sys [2009-04-20 19:32]
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2009-11-25 00:50]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2009-11-25 00:50]
R2 fssfltr;FssFltr;C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys [2009-08-05 22:48]
S3 NPF;Netgroup Packet Filter;C:\WINDOWS\system32\drivers\npf.sys []
S4 RsFx0102;RsFx0102 Driver;C:\WINDOWS\system32\DRIVERS\RsFx0102.sys [2008-07-10 01:49]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b3f3e34c-a647-11de-957e-001e68679015}]
\Shell\AutoRun\command - E:\AutoRun.exe

*Newly Created Service* - CATCHME
.
- - - - ORPHANS REMOVED - - - -

BHO-{5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
BHO-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)


.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.com/
R1 -: HKCU-Internet Settings,ProxyOverride = local
O8 -: E&sporta in Microsoft Excel - C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O17 -: HKLM\CCS\Interface\{0A89D2C2-623F-464B-B26E-FE0FFFC17A4F}: NameServer = 208.67.220.220,208.67.222.222


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-05 19:15:55
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2010-02-05 19:16:53
ComboFix-quarantined-files.txt 2010-02-05 18:16:40

Pre-Run: 173,260,570,624 bytes free
Post-Run: 173,179,916,288 bytes free

172

[JeanGrey]

Ciao matteosa e benvenuto.

Combofix non va lanciato da cartelle temporanee.
Non mi pare di vedere infezioni, ma meglio fare un controllo completo.

1) Scarica ed installa CCleaner
Una volta installato configuralo in questo modo:
lancia il programma, nel menu di sinistra portati alla voce Opzioni e nella finestra successiva clicca su:
* Impostazioni, e spunta la voce Cancellazione sicura (lenta) e nel menu a tendina seleziona la voce DOD 520.22-M (3 passaggi)
poi clicca su:
* Avanzate togli la spunta alla voce Cancella solo file più vecchi di 48 ore
* alla voce Pulizia nella sezione Avanzate spunta le voci Vecchi dati Prefetch e Disinstallatori aggiornamenti di WinUpdate
* nel menu a sinistra, clicca sulla voce Pulizia e clicca su tasto Avvia pulizia per eseguire la scansione
* finita la scansione, sempre nel menu a sinistra, clicca sulla voce Registro e spunta tutte le voci comprese nella sezione meno la voce Estensioni file non usate
* clicca sul tasto Trova problemi ed avvia una scansione
* al termine della scansione clicca sulla voce Ripara selezionati e prosegui con la riparazione (questo ultimo passaggio ripetilo più volte, fino a quando non verranno rilevati più problemi da correggere)

2) Scarica ed installa Malwarebytes come descritto in questa discussione
Esegui una scansione completa ed allega il rapporto.

3) Scarica ed installa Hijackthis
* lancia Hijackthis e pulisci gli ADS (esclusivamente se la partizione e in NTFS):
* clicca sulla voce Open the misc tool section
* clicca su Open ads spy
* togli la spunta alla voce Quick scan (windows base folder only)
* clicca su Scan
* se venissero rilevati ADS, spunta tutte le caselline e clicca su Remove selected
* rilancia Hijackthis
* clicca su Do a system scan and save a logfile
* al termine della scansione verrà rilasciato un log: salvalo sul Desktop perché lo dovrai allegare.

4) Scarica OTS.exe by OldTimer sul desktop
chiudi tutti i programmi
avvia OTS, seleziona "scan all users"
clicca su "Run Scan"
salva il report ed allegalo nella tua risposta.

Segui le indicazioni di questa discussione per postare i rapporti.

[matteosa]

[JeanGrey]

Anche da questi rapporti non si vedono infezioni.

Ti avevo suggerito il modo corretto di allegare i file, mentre tu hai fatto un copia/incolla, inoltre manca il rapporto di Malwarebytes (suppongo sia pulito).

1) Chiudi tutti i programmi
avvia OTS, incolla questo script nel box bianco a destra, dove dice "Paste fix here"