Olimpo Informatico

[mde]

ciao a tutti. avrei un problema e spero che qualcuno riesca a darmi una mano: una mia amica utilizza avast come antivirus e dagli ultimi giorni a questa parte riceve in continuazione messaggi di avviso di "troppe email identiche nell'intervallo di tempo selezionato".ho scaricato hijackthis per riscontrare il problema ma non ci capisco piu di tanto. lo copio qui sotto e spero che qualcuno mi riesca a dare una mano. grazie mille

[Orange]

Sposto in Pronto Soccorso

[bdoriano]

Ciao mde,

Segui le istruzioni di questo topic per postare il log di combofix.

[mde]

ciao e grazie per la risposta.
ho fatto come li scritto ed ecco la lista di combofix
ComboFix 08-02-13.2 - Lory 2008-02-13 23.55.24.2 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1040.18.567 [GMT 1:00]
Eseguito da: C:\Documents and Settings\Lory\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Creati Da 2008-01-13 al 2008-02-13 )))))))))))))))))))))))))))))))))))
.

2008-02-13 23:51 . 2008-02-13 23:51 <DIR> d-------- C:\Programmi\RogueRemover FREE
2008-02-13 23:48 . 2008-02-13 23:48 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-02-13 15:47 . 2008-02-13 15:47 268 --ah----- C:\sqmdata16.sqm
2008-02-13 15:47 . 2008-02-13 15:47 244 --ah----- C:\sqmnoopt16.sqm
2008-02-13 15:24 . 2008-02-13 15:24 268 --ah----- C:\sqmdata15.sqm
2008-02-13 15:24 . 2008-02-13 15:24 244 --ah----- C:\sqmnoopt15.sqm
2008-02-13 14:01 . 2008-02-13 14:01 172 --ah----- C:\sqmnoopt14.sqm
2008-02-13 14:01 . 2008-02-13 14:01 172 --ah----- C:\sqmdata14.sqm
2008-02-13 10:38 . 2008-02-13 10:38 268 --ah----- C:\sqmdata13.sqm
2008-02-13 10:38 . 2008-02-13 10:38 244 --ah----- C:\sqmnoopt13.sqm
2008-02-04 21:12 . 2008-02-04 21:12 <DIR> d-------- C:\Programmi\Spybot - Search & Destroy
2008-02-04 21:12 . 2008-02-04 21:12 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Spybot - Search & Destroy
2008-02-04 20:42 . 2008-02-04 20:42 <DIR> d-------- C:\Programmi\Trend Micro
2008-01-30 09:26 . 2008-01-30 09:26 268 --ah----- C:\sqmdata12.sqm
2008-01-30 09:26 . 2008-01-30 09:26 244 --ah----- C:\sqmnoopt12.sqm
2008-01-26 16:29 . 2008-01-26 16:29 38,400 -r-hs---- C:\WINDOWS\system32\Setupz.exe
2008-01-26 16:29 . 2008-01-26 16:29 32 --a-s---- C:\WINDOWS\system32\4187985077.dat
2008-01-26 16:27 . 2008-01-26 16:27 11,008 --a------ C:\WINDOWS\vmm32dll.exe
2008-01-26 16:27 . 2008-01-26 16:35 2 --a------ C:\839718926
2008-01-26 16:27 . 2008-02-11 09:11 0 --a------ C:\WINDOWS\vmm32dll.ex_
2008-01-26 16:26 . 54,764 C:\WINDOWS\system32\drivers\fak32.sys
2008-01-26 16:23 . 2007-06-13 14:22 1,074,177 --a------ C:\WINDOWS\dvtmuxw.exe
2008-01-15 22:59 . 2008-01-15 22:59 268 --ah----- C:\sqmdata11.sqm
2008-01-15 22:59 . 2008-01-15 22:59 244 --ah----- C:\sqmnoopt11.sqm

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-24 15:25 --------- d-----w C:\Documents and Settings\Lory\Dati applicazioni\Windows Live Writer
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2007-11-14 07:27 450,560 ----a-w C:\WINDOWS\system32\dllcache\jscript.dll
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* i valori vuoti & legittimi/default non sono visualizzati.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 05:00 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe" [2005-09-25 19:11 94208]
"swg"="C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-21 18:55 68856]
"MessengerPlus3"="C:\Programmi\MessengerPlus! 3\MsgPlus.exe" [2007-12-08 21:53 190024]
"msnmsgr"="C:\Programmi\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
"MSMSGS"="C:\Programmi\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]
"vmm32dll"="C:\WINDOWS\vmm32dll.exe" [2008-01-26 16:27 11008]
"SpybotSD TeaTimer"="C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" []
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-02-07 19:36 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-02-07 19:32 126976]
"SynTPLpr"="C:\Programmi\Synaptics\SynTP\SynTPLpr.exe" [2004-10-07 23:44 98394]
"SynTPEnh"="C:\Programmi\Synaptics\SynTP\SynTPEnh.exe" [2004-10-07 23:43 688218]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-19 05:00 110592 C:\WINDOWS\system32\bthprops.cpl]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-19 05:00 208952]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-19 05:00 59392]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-19 05:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-19 05:00 455168]
"ATIPTA"="C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-04-28 21:05 344064]
"EPM-DM"="c:\acer\epm\epm-dm.exe" [2005-03-28 18:04 188416]
"ePowerManagement"="C:\Acer\ePM\ePM.exe" [2005-03-24 09:13 2880512]
"LManager"="C:\Programmi\Launch Manager\QtZgAcer.EXE" [2005-09-05 11:43 319488]
"eRecoveryService"="C:\Programmi\Acer\eRecovery\Monitor.exe" [2005-06-29 17:26 352256]
"PDFCreatorClient"="C:\Programmi\JawsSystems\Jaws PDF Creator\PDFClient.exe" [2005-03-21 08:19 450560]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2005-09-25 19:11 155648]
"OpwareSE2"="C:\Programmi\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 12:00 49152]
"OPSE reminder"="C:\Programmi\ScanSoft\OmniPageSE2.0\EregIta\Ereg.exe" [2003-07-07 10:30 729088]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 05:00 15360]

C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Avvio veloce di Adobe Reader.lnk - C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 04:44:06 29696]
WinZip Quick Pick.lnk - C:\Programmi\WinZip\WZQKPICK.EXE [2007-08-08 16:53:11 118784]
Adobe Gamma Loader.lnk - C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe [2007-08-29 09:55:46 113664]
Tasto di scelta rapida per l'avvio di AutoCAD.lnk - C:\Programmi\File comuni\Autodesk Shared\acstart17.exe [2006-03-05 13:43:54 11000]

R1 UBHelper;UBHelper;C:\WINDOWS\system32\drivers\UBHelper.sys [2004-12-17 17:14]
R2 EpmPsd;Acer EPM Power Scheme Driver;C:\WINDOWS\system32\drivers\epm-psd.sys [2004-07-19 13:10]
R2 EpmShd;Acer EPM System Hardware Driver;C:\WINDOWS\system32\drivers\epm-shd.sys [2005-03-24 16:54]
R2 int15.sys;int15.sys;C:\Programmi\Acer\eRecovery\int15.sys [2005-01-13 14:46]
R2 osaio;osaio;C:\WINDOWS\system32\drivers\osaio.sys [2005-06-30 16:58]
R2 osanbm;osanbm;C:\WINDOWS\system32\drivers\osanbm.sys [2005-01-14 15:57]
S0 xjxfycjn;xjxfycjn;C:\WINDOWS\system32\drivers\hezvupwf.dat []
S2 aspnet_state Web Scanner;Servizio stato di ASP.NET aspnet_state Web Scanner;C:\WINDOWS\system32\Setupz.exe srv []
S3 PAC207;Trust WB-1400T Webcam;C:\WINDOWS\system32\DRIVERS\pfc027.sys [2005-02-24 12:29]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{02094bba-d1b7-11dc-bf1e-0013ce5d9dc5}]
\Shell\AutoRun\command - G:\0hct8ybw.bat
\Shell\explore\Command - G:\0hct8ybw.bat
\Shell\open\Command - G:\0hct8ybw.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{341ea8c1-78ab-11dc-be08-0013ce5d9dc5}]
\Shell\auto\command - Knight.exe open
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Knight.exe open
\Shell\explore\command - Knight.exe open
\Shell\find\command - Knight.exe open
\Shell\install\command - Knight.exe open
\Shell\open\command - Knight.exe open

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7ab366ce-929a-11dc-be44-0013ce5d9dc5}]
\Shell\auto\command - F:\Knight.exe open
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Knight.exe open
\Shell\explore\command - F:\Knight.exe open
\Shell\find\command - F:\Knight.exe open
\Shell\install\command - F:\Knight.exe open
\Shell\open\command - F:\Knight.exe open

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7e4e8ada-480c-11dc-bdbc-0013ce5d9dc5}]
\Shell\Auto\command - F:\Cn911.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Cn911.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9a71bafb-4c2d-11dc-bdbe-0013ce5d9dc5}]
\Shell\auto\command - F:\Knight.exe open
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Knight.exe open
\Shell\explore\command - F:\Knight.exe open
\Shell\find\command - F:\Knight.exe open
\Shell\install\command - F:\Knight.exe open
\Shell\open\command - F:\Knight.exe open

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9ed18eec-9618-11dc-be58-0013ce5d9dc5}]
\Shell\AutoRun\command - ntde1ect.com
\Shell\explore\Command - ntde1ect.com
\Shell\open\Command - ntde1ect.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d8f2967e-7805-11dc-be06-0013ce5d9dc5}]
\Shell\Auto\command - Cn911.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Cn911.exe

*Newly Created Service* - HTTPFILTER
.
Contenuto della cartella 'Scheduled Tasks'
"2008-02-13 22:06:02 C:\WINDOWS\Tasks\Verifica aggiornamenti per Windows Live Toolbar.job"
- C:\Programmi\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-13 23:56:53
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
Ora fine scansione: 2008-02-13 23.57.30
ComboFix-quarantined-files.txt 2008-02-13 22:57:28
ComboFix2.txt 2008-02-13 22:49:22
.
2008-01-26 20:25:08 --- E O F ---

[bdoriano]

Apri il notepad, e copia/incolla questo codice