Olimpo Informatico

[*mara*]

Ciao a Tutti
chi mi può aiutare con questo virus (?)
mi collega a siti porno e mi rallenta il computer.

leggendo qua e la ho ricavato il mio LOG con hijackthis ma ora non sono capace ad interpretarlo e non so cosa fare per risolvere il problema .... chi mi può aiutare ??

Logfile of HijackThis v1.99.1
Scan saved at 11.39.09, on 01/07/06
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\\WINDOWS\\SYSTEM\\KERNEL32.DLL
C:\\WINDOWS\\SYSTEM\\MSGSRV32.EXE
C:\\WINDOWS\\SYSTEM\\MPREXE.EXE
C:\\WINDOWS\\SYSTEM\\MSTASK.EXE
C:\\WINDOWS\\SYSTEM\\mmtask.tsk
C:\\WINDOWS\\EXPLORER.EXE
C:\\WINDOWS\\SYSTEM\\HIDSERV.EXE
C:\\WINDOWS\\TASKMON.EXE
C:\\WINDOWS\\SYSTEM\\SYSTRAY.EXE
C:\\PROGRAMMI\\FILE COMUNI\\REAL\\UPDATE_OB\\REALSCHED.EXE
C:\\PROGRAMMI\\AHEAD\\INCD\\INCD.EXE
C:\\PROGRAMMI\\CYBERLINK DVD SOLUTION\\POWERDVD\\PDVDSERV.EXE
C:\\PROGRAMMI\\FILE COMUNI\\REAL\\UPDATE_OB\\REALONEMESSAGECENTER.EXE
C:\\WINDOWS\\SYSTEM\\SYSMON.EXE
C:\\PROGRAMMI\\AWS\\WEATHERBUG\\WEATHERBUG.EXE
C:\\PROGRAMMI\\MICROSOFT OFFICE\\OFFICE\\OSA.EXE
C:\\PROGRAMMI\\MICROSOFT OFFICE\\OFFICE\\FINDFAST.EXE
C:\\PROGRAMMI\\SIEMENS\\SANTIS\\WLM.EXE
C:\\WINDOWS\\SYSTEM\\WMIEXE.EXE
C:\\PROGRAMMI\\ALICE TI AIUTA\\BIN\\MPBTN.EXE
C:\\PROGRAMMI\\INTERNET EXPLORER\\IEXPLORE.EXE
C:\\PROGRAMMI\\INTERNET EXPLORER\\IEXPLORE.EXE
C:\\PROGRAMMI\\INTERNET EXPLORER\\IEXPLORE.EXE
C:\\HIJACKTHIS.EXE

R0 - HKCU\\Software\\Microsoft\\Internet Explorer\\Main,Start Page = http://www.m-w.com/
R1 - HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\\Software\\Microsoft\\Internet Explorer\\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\\programmi\\google\\googletoolbar.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\\PROGRAMMI\\ADOBE\\ACROBAT 6.0\\READER\\ACTIVEX\\ACROIEHELPER.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\\PROGRA~1\\SPYBOT~1\\SDHELPER.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\\programmi\\google\\googletoolbar.dll
O3 - Toolbar: Yahoo! Toolbar con blocco Pop-Up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\\PROGRAMMI\\YAHOO!\\COMPANION\\INSTALLS\\CPN\\YT.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\\WINDOWS\\SYSTEM\\MSDXM.OCX
O4 - HKLM\\..\\Run: [ScanRegistry] C:\\WINDOWS\\scanregw.exe /autorun
O4 - HKLM\\..\\Run: [TaskMonitor] C:\\WINDOWS\\taskmon.exe
O4 - HKLM\\..\\Run: [SystemTray] SysTray.Exe
O4 - HKLM\\..\\Run: [TkBellExe] \"C:\\Programmi\\File comuni\\Real\\Update_OB\\realsched.exe\" -osboot
O4 - HKLM\\..\\Run: [InCD] C:\\Programmi\\Ahead\\InCD\\InCD.exe
O4 - HKLM\\..\\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\\..\\Run: [RemoteControl] \"C:\\Programmi\\CyberLink DVD Solution\\PowerDVD\\PDVDServ.exe\"
O4 - HKLM\\..\\Run: [rock] rock.exe
O4 - HKLM\\..\\Run: [MsgCenterExe] \"C:\\Programmi\\File comuni\\Real\\Update_OB\\RealOneMessageCenter.exe\" -osboot
O4 - HKLM\\..\\Run: [Systems] C:\\WINDOWS\\SYSTEM\\sysmon.exe
O4 - HKLM\\..\\RunServices: [Hidserv] Hidserv.exe run
O4 - HKLM\\..\\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\\..\\RunServices: [SchedulingAgent] C:\\WINDOWS\\SYSTEM\\mstask.exe
O4 - HKCU\\..\\Run: [WeatherBug] C:\\PROGRAMMI\\AWS\\WEATHERBUG\\WEATHERBUG.EXE
O4 - Startup: Avvio Office.lnk = C:\\Programmi\\Microsoft Office\\Office\\OSA.EXE
O4 - Startup: Ricerca rapida.lnk = C:\\Programmi\\Microsoft Office\\Office\\FINDFAST.EXE
O4 - Startup: Alice ti aiuta.lnk = C:\\Programmi\\Alice ti aiuta\\bin\\matcli.exe
O4 - Startup: Siemens Wireless LAN Monitor Utility.lnk = C:\\Programmi\\Siemens\\Santis\\WLM.exe
O8 - Extra context menu item: &Google Search - res://C:\\PROGRAMMI\\GOOGLE\\GOOGLETOOLBAR.DLL/cmsearch.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\\PROGRAMMI\\GOOGLE\\GOOGLETOOLBAR.DLL/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\\PROGRAMMI\\GOOGLE\\GOOGLETOOLBAR.DLL/cmsimilar.html
O8 - Extra context menu item: Backward &Links - res://C:\\PROGRAMMI\\GOOGLE\\GOOGLETOOLBAR.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate into English - res://C:\\PROGRAMMI\\GOOGLE\\GOOGLETOOLBAR.DLL/cmtrans.html
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\\WINDOWS\\web\\related.htm
O9 - Extra \'Tools\' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\\WINDOWS\\web\\related.htm
O15 - Trusted Zone: www.1987324.com


grazie M.

[Typhoon90]

per i poco esperti consiglio di copiare il logfile di hijackthis in questo sito e verificarlo

http://hijackthis.de/index.php?langselect=italian

[Typhoon90]

ho verificato e di pericoloso c'è di sicuro

O15 - Trusted Zone: www.1987324.com

poi ce ne sono parecchi sconosciuti e per quelli lascio la parola ai + esperti

[*mara*]

grazie !!
spero che qualcuno mi possa aiutare con quelli sconosciuti.



Ciao M.

[Typhoon90]

[holifay]

ciao Mara e benvenuta

1 ) Abilita la visualizzazione dei file nascosti

[*mara*]

Ciao holifay
non so come ringraziarti ..... sembra che il problema sia risolto anche se kspersky ha trovato qualche virus

risultato:

Logfile of HijackThis v1.99.1
Scan saved at 19.04.00, on 01/07/06
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\HIDSERV.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAMMI\AHEAD\INCD\INCD.EXE
C:\PROGRAMMI\CYBERLINK DVD SOLUTION\POWERDVD\PDVDSERV.EXE
C:\PROGRAMMI\FILE COMUNI\REAL\UPDATE_OB\REALONEMESSAGECENTER.EXE
C:\PROGRAMMI\AWS\WEATHERBUG\WEATHERBUG.EXE
C:\PROGRAMMI\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\PROGRAMMI\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE
C:\PROGRAMMI\SIEMENS\SANTIS\WLM.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAMMI\ALICE TI AIUTA\BIN\MPBTN.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAMMI\FILE COMUNI\REAL\UPDATE_OB\REALSCHED.EXE
C:\HIJACK THIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.m-w.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMMI\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar.dll
O3 - Toolbar: Yahoo! Toolbar con blocco Pop-Up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAMMI\YAHOO!\COMPANION\INSTALLS\CPN\YT.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [InCD] C:\Programmi\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [RemoteControl] "C:\Programmi\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [MsgCenterExe] "C:\Programmi\File comuni\Real\Update_OB\RealOneMessageCenter.exe" -osboot
O4 - HKLM\..\RunServices: [Hidserv] Hidserv.exe run
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKCU\..\Run: [WeatherBug] C:\PROGRAMMI\AWS\WEATHERBUG\WEATHERBUG.EXE
O4 - Startup: Avvio Office.lnk = C:\Programmi\Microsoft Office\Office\OSA.EXE
O4 - Startup: Ricerca rapida.lnk = C:\Programmi\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Alice ti aiuta.lnk = C:\Programmi\Alice ti aiuta\bin\matcli.exe
O4 - Startup: Siemens Wireless LAN Monitor Utility.lnk = C:\Programmi\Siemens\Santis\WLM.exe
O8 - Extra context menu item: &Google Search - res://C:\PROGRAMMI\GOOGLE\GOOGLETOOLBAR.DLL/cmsearch.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\PROGRAMMI\GOOGLE\GOOGLETOOLBAR.DLL/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\PROGRAMMI\GOOGLE\GOOGLETOOLBAR.DLL/cmsimilar.html
O8 - Extra context menu item: Backward &Links - res://C:\PROGRAMMI\GOOGLE\GOOGLETOOLBAR.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate into English - res://C:\PROGRAMMI\GOOGLE\GOOGLETOOLBAR.DLL/cmtrans.html
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_ansi.cab

e

Infected Object Name Virus Name Last Action
c:\WINDOWS\SYSTEM\sysfind.exe Infected: not-a-virus:Porn-Dialer.Win32.Archiviosex.c skipped

c:\WINDOWS\WIN386.SWP Object is locked skipped

c:\WINDOWS\SchedLog.Txt Object is locked skipped

c:\WINDOWS\Application Data\Identities\{62086C40-D81D-11D8-B650-CE7471DF544C}\Microsoft\Outlook Express\Posta eliminata.dbx/[From romolo.quaglia@tin.it][Date Mon, 21 Nov 2005 22:03:33 +0100]/UNNAMED/poster.com Infected: Email-Worm.Win32.NetSky.c skipped

c:\WINDOWS\Application Data\Identities\{62086C40-D81D-11D8-B650-CE7471DF544C}\Microsoft\Outlook Express\Posta eliminata.dbx/[From romolo.quaglia@tin.it][Date Mon, 21 Nov 2005 22:03:33 +0100]/UNNAMED Infected: Email-Worm.Win32.NetSky.c skipped

c:\WINDOWS\Application Data\Identities\{62086C40-D81D-11D8-B650-CE7471DF544C}\Microsoft\Outlook Express\Posta eliminata.dbx Mail MS Outlook 5: infected - 2 skipped

c:\WINDOWS\Desktop\rock.zip/rock.exe Infected: Trojan.Win32.LowZones.dn skipped

c:\WINDOWS\Desktop\rock.zip ZIP: infected - 1 skipped

c:\WINDOWS\Desktop\sysmon.zip/sysmon.exe Infected: Trojan-Downloader.Win32.Vixup.b skipped

c:\WINDOWS\Desktop\sysmon.zip ZIP: infected - 1 skipped

c:\WINDOWS\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

c:\WINDOWS\Cookies\index.dat Object is locked skipped

c:\WINDOWS\Cronologia\History.IE5\index.dat Object is locked skipped

c:\WINDOWS\Impostazioni locali\Dati applicazioni\Microsoft\Internet Explorer\MSIMGSIZ.DAT Object is locked skipped

c:\WINDOWS\Appunti.exe Infected: Trojan.Win32.Diamin.i skipped

c:\Programmi\Alice ti aiuta\log\mpbtn.log Object is locked skipped

c:\web.exe Infected: Trojan.Win32.LowZones.dn skipped

c:\lo1296086237.exe Infected: Trojan-Downloader.Win32.Vixup.b skipped


Cosa mi sai dire ??? Posso stare tranquilla ???
Grazie M.

[holifay]

l fatto che Kaspersky ti scriva "skipped" vuolk dire che non ha cancellato quei file infetti. QUindi devi farlo tu, altrimenti poi se ci clicchi sopra ri infdetti di nuovo.

Cerca ed elimina:
c:\WINDOWS\SYSTEM\sysfind.exe
c:\WINDOWS\Desktop\rock.zip
c:\WINDOWS\Desktop\sysmon.zip
c:\WINDOWS\Appunti.exe
c:\web.exe
c:\lo1296086237.exe

Svuota il cestino e la cartella della posta eliminata in Outlook


Il log è a posto adesso. Se non vuoi infettarti di nuovo, installa un antivirus e un firewall


Ciao

[*mara*]

Fatto ...... Grazie !!

Ciao M.