File Highlander?!

[ciby]

Ciao ragazzi,
il titolo è ironico ma la sostanza è quella.
Da circa un mesetto ho a che fare con file che dopo esser stati spostati o cancellati,ricompaiono ,e non son "finti",mantengono il loro "peso" in Mb nonostante siano inutilizzabili(per es. se sposto un avi e riappare,quest'ultimo non viene riprodotto da nessun player,invece l'originale si).
Leggendo qua e là mi son convinto che fosse un problema di hard disk vecchio o usurato dallo stare spesso al limite della capienza,o prossimo a "bucarsi",quindi,rassegnato ,ho cominciato ad utilizzare un piccolo programma di nome UNLOCKER,il quale nell'80% dei casi è efficace.
Ieri però gl'highlander son apparsi anche in un hd esterno che ho preso 2mesi fà,perciò il tutto comincia a "puzzarmi" di virus o simili...
Parola agl'esperti...o a chi ci è già passato

[gahan]

il tutto comincia a "puzzarmi" di virus o simili...

Ciao,

per toglierci il dubbio esegui quanto segue:

scarica ed installa HijackThis togliendo la spunta dalla Yahoo toolbar verso fine installazione:
http://www.hijackthis.de/downloads/HJTInstall.exe

- apri il software
- accetta i termini di licenza
- clicca su "do a system scan and save a logfile"
- posta qui sul forum il log risultante

[gahan]

Grazie mille per l'interesse Gahan
Ecco il log ottenuto seguendo i tuoi suggerimenti:

Codice: Seleziona tutto

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 0.58.28, on 16/03/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Intel\Wireless\Bin\EvtEng.exe
C:\Programmi\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Avira\AntiVir Desktop\avguard.exe
C:\Programmi\File comuni\InterVideo\DeviceService\DevSvc.exe
C:\Programmi\Java\jre6\bin\jqs.exe
C:\WINDOWS\runservice.exe
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
c:\Programmi\File comuni\Protexis\License Service\PsiService_2.exe
C:\Programmi\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\Programmi\ASUSTeK\ASUSDVD\PDVDServ.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\Intel\Wireless\bin\ZCfgSvc.exe
C:\Programmi\Intel\Wireless\Bin\ifrmewrk.exe
C:\Programmi\Intel\Wireless\Bin\EOUWiz.exe
C:\Programmi\Windows Defender\MSASCui.exe
C:\Programmi\File comuni\Java\Java Update\jusched.exe
C:\Programmi\Unlocker\UnlockerAssistant.exe
C:\Programmi\Avira\AntiVir Desktop\avgnt.exe
C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Microsoft ActiveSync\wcescomm.exe
C:\documents and settings\utente\impostazioni locali\dati applicazioni\vcraoetb.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Programmi\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Programmi\Windows Live\Messenger\msnmsgr.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.forospyware.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: Adparatus - {8B2C7C9D-716D-4e9e-9358-B9C80A81B7ED} - C:\Programmi\Adparatus\Adparatus.dll (file missing)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmi\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ABLKSR] C:\WINDOWS\ABLKSR\ABLKSR.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Programmi\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\File comuni\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Programmi\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Programmi\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [swg] "C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [FACE DELETE] C:\DOCUME~1\utente\DATIAP~1\DrawCopy\bendamenball.exe
O4 - HKCU\..\Run: [updateMgr] c:\Programmi\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programmi\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [RamBooster] C:\Programmi\RamBooster 2.0\Rambooster.exe
O4 - HKCU\..\Run: [vcraoetb] "c:\documents and settings\utente\impostazioni locali\dati applicazioni\vcraoetb.exe" vcraoetb
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\Shockwave 11\SwHelper_1150600.exe -Update -1150600 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.1)" -"http://arena.fueps.com/t/v/client/info?action=gameClient&tournamentSessionId=30227028&pwd=KXMYDWBONHNX"
O4 - Startup: Banshee Screamer Alarm.lnk = C:\Programmi\Banshee Screamer Alarm\alarm.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Crea preferiti portatile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: 4APoker - {47DDC1F4-8611-4f89-806E-3CBD8B7F924F} - C:\Programmi\4A\4APoker\RunApp.exe
O9 - Extra 'Tools' menuitem: 4APoker - {47DDC1F4-8611-4f89-806E-3CBD8B7F924F} - C:\Programmi\4A\4APoker\RunApp.exe
O9 - Extra button: PartyPoker.it - {4B21E152-BA59-4ebf-B522-8C55B265EE1A} - C:\Programmi\PartyItalia\PartyPokerIt\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.it - {4B21E152-BA59-4ebf-B522-8C55B265EE1A} - C:\Programmi\PartyItalia\PartyPokerIt\RunApp.exe
O9 - Extra button: PokerStars.it - {C4046502-6524-4d87-896C-878F57D1FF07} - C:\Programmi\PokerStars.IT\PokerStarsUpdate.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {1A781DED-C22D-4153-3213-A3211E29DF13} (GameDesire Card Games) - http://194.244.16.123/g_bin/eng/cards_2_0_0_77.cab
O16 - DPF: {41ACD49D-1974-791A-0981-AA9872721044} (Ganymede Board Games) - http://194.244.16.123/g_bin/eng/boards_2_0_0_35.cab
O16 - DPF: {4BFD075D-C36E-4F28-BB0A-5D472795197A} (PowerLoader Class) - http://www.powerchallenge.com/applet/PowerLoader.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8942.cab
O16 - DPF: {A1FE3DE0-CF77-11D4-8340-0080C8D7ED4A} (GameDesire Pinball Demon) - http://194.244.16.123/g_bin/eng/demon_2_0_0_30.cab
O16 - DPF: {A1FE3DEF-CF77-11D4-8340-0080C8D7ED4A} (GameDesire Pinball Pirate) - http://194.244.16.123/g_bin/eng/pirate_2_0_0_30.cab
O16 - DPF: {A7196C8E-35A5-4FF0-9E46-E28918B5CAF6} (GameDesire Domino) - http://194.244.16.123/g_bin/eng/domino_2_0_0_33.cab
O16 - DPF: {AC120B1D-9411-4111-AF52-118052D85D45} (GameDesire Darts Games) - http://194.244.16.123/g_bin/eng/darts_2_0_0_42.cab
O16 - DPF: {AD7013FF-1D9A-4F36-94A6-3CD408A663F9} (GameDesire BreakOut) - http://194.244.16.123/g_bin/eng/breakout_2_0_0_29.cab
O16 - DPF: {E23FABEE-12E3-33DA-DA12-195DAC123984} (GameDesire Mahjong) - http://194.244.16.117/g_bin/eng/mahjong_2_0_0_31.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E95CF138-A587-4C54-8175-3AD80997CB14} (GameDesire Soccer) - http://194.244.16.123/g_bin/eng/soccer_2_0_0_20.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://194.244.16.123/g_bin/eng/billard8_2_0_0_35.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B17FD737-CA2C-41B0-9616-3C337E3EDC75}: NameServer = 192.168.1.1
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Programmi\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmi\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programmi\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Capture Device Service - InterVideo Inc. - C:\Programmi\File comuni\InterVideo\DeviceService\DevSvc.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmi\Java\jre6\bin\jqs.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Programmi\File comuni\Protexis\License Service\PsiService_2.exe
O23 - Service: stllssvr - Unknown owner - C:\Programmi\File comuni\SureThing Shared\stllssvr.exe (file missing)

--
End of file - 10659 bytes

[ciby]

Ragazzi che mi dite del log?ci sono "intrusi"???

[gahan]

Ciao ciby,

- chiudi tutte le applicazioni
- apri hijackthis
- clicca su "do a system scan only"
- spunta le seguenti voci e clicca su "fix checked"

Codice: Seleziona tutto

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: Adparatus - {8B2C7C9D-716D-4e9e-9358-B9C80A81B7ED} - C:\Programmi\Adparatus\Adparatus.dll (file missing)
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O4 - HKCU\..\Run: [FACE DELETE] C:\DOCUME~1\utente\DATIAP~1\DrawCopy\bendamenball.exe
O4 - HKCU\..\Run: [vcraoetb] "c:\documents and settings\utente\impostazioni locali\dati applicazioni\vcraoetb.exe" vcraoetb

In seguito, scarica ed installa Malwarebytes dal link sottostante:
http://www.techportal.it/dl/mbam-setup.exe

- aggiorna il software dopo l'installazione
- disconnettiti da internet
- disattiva il tuo antivirus
- fai una scansione completa
- rimuovi eventuali minacce rilevate cliccando sul pulsante "rimuovi elementi selezionati"
- posta il log risultante dalla scansione

[gahan]

Eccomi...
Passaggi eseguti con hijackthis.
Per il resto,avevo già Malwarebytes ed insieme all'antivirus(Avira) e ad AD-Aware,scansiono tutto almeno 1 o 2 volte al mese,l'ultima,se non ricordo male,risale a una decina di giorni fà,tutto ok,eppure ora mi ha trovato 20 infetti.
Strano...Sarà dipeso dall'averlo usato senza antivirus o dall'averlo aggiornato poco prima di usarlo?
Comunque,ecco il log:

Codice: Seleziona tutto

Malwarebytes' Anti-Malware 1.44
Versione del database: 3510
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

16/03/2010 18.16.56
mbam-log-2010-03-16 (18-16-47).txt

Tipo di scansione: Scansione completa (C:\|D:\|X:\|)
Elementi scansionati: 202073
Tempo trascorso: 30 minute(s), 8 second(s)

Processi delle memoria infetti: 0
Moduli della memoria infetti: 0
Chiavi di registro infette: 13
Valori di registro infetti: 0
Elementi dato del registro infetti: 4
Cartelle infette: 4
File infetti: 7

Processi delle memoria infetti:
(Nessun elemento malevolo rilevato)

Moduli della memoria infetti:
(Nessun elemento malevolo rilevato)

Chiavi di registro infette:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\BitDownload (Trojan.Swizzor) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> No action taken.

Valori di registro infetti:
(Nessun elemento malevolo rilevato)

Elementi dato del registro infetti:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> No action taken.

Cartelle infette:
C:\Documents and Settings\utente\Dati applicazioni\FunWebProducts (Adware.MyWebSearch) -> No action taken.
C:\Documents and Settings\utente\Dati applicazioni\FunWebProducts\Data (Adware.MyWebSearch) -> No action taken.
C:\Documents and Settings\utente\Dati applicazioni\FunWebProducts\Data\utente (Adware.MyWebSearch) -> No action taken.
C:\Documents and Settings\All Users\Menu Avvio\Programmi\BitDownload (Trojan.Swizzor) -> No action taken.

File infetti:
C:\Documents and Settings\utente\Impostazioni locali\Temp\yVtg.dll (Rootkit.MBR) -> No action taken.
C:\Documents and Settings\utente\Desktop\Mirc\mIRC 6.2 in Italiano by TuttoIRC +addon nuovi\html.dll (Trojan.Agent) -> No action taken.
C:\Programmi\Mozilla Firefox\plugins\NPMyWebS.dll (Adware.MyWebSearch) -> No action taken.
C:\Documents and Settings\utente\Dati applicazioni\FunWebProducts\Data\utente\avatar.dat (Adware.MyWebSearch) -> No action taken.
C:\Documents and Settings\utente\Dati applicazioni\FunWebProducts\Data\utente\zbucks.dat (Adware.MyWebSearch) -> No action taken.
C:\Documents and Settings\All Users\Menu Avvio\Programmi\BitDownload\BitDownload.lnk (Trojan.Swizzor) -> No action taken.
C:\Documents and Settings\All Users\Menu Avvio\Programmi\BitDownload\Uninstall BitDownload.lnk (Trojan.Swizzor) -> No action taken.

p.s.:Gahan GRAZIE!!!

[gahan]

Dal log di hijackthis avevo notato delle infezioni.

Elimina le voci trovate dalla scansione di Malwarebytes (se non lo hai già fatto), e procedi con questo controllo finale del tuo sistema:

- scarica Combofix direttamente sul desktop dal link seguente:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

- disconnetti da internet
- disattiva il tuo antivirus
- esegui ComboFix.exe
- non installare la RECOVERY CONSOLE quando ti verrà chiesto
- non interferire con la scansione del programma
- a scansione ultimata vai in C:\ e copia/incolla qui sul forum il log contentuto nel file
Combofix.txt

[ciby]

Ecco il log,ma ho capito bene?mi ha eliminato porcherie per un tot di 5Gb???

Codice: Seleziona tutto

ComboFix 10-03-15.06 - utente 16/03/2010  19.32.48.1.2 - FAT32x86
Microsoft Windows XP Home Edition  5.1.2600.3.1252.39.1040.18.1535.1054 [GMT 1:00]
Eseguito da: c:\documents and settings\utente\Desktop\Soft Hacker\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {00000002-0002-0000-7C25-9E7C08000A00}

ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.

(((((((((((((((((((((((((((((((((((((   Altre eliminazioni   )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\utente\Impostazioni locali\Dati applicazioni\gfizb.dat
c:\documents and settings\utente\Impostazioni locali\Dati applicazioni\gfizb_nav.dat
c:\documents and settings\utente\Impostazioni locali\Dati applicazioni\gfizb_navps.dat
c:\documents and settings\utente\Impostazioni locali\Dati applicazioni\vcraoetb.dat
c:\documents and settings\utente\Impostazioni locali\Dati applicazioni\vcraoetb.exe
c:\documents and settings\utente\Impostazioni locali\Dati applicazioni\vcraoetb_nav.dat
c:\documents and settings\utente\Impostazioni locali\Dati applicazioni\vcraoetb_navps.dat
c:\programmi\Fast Browser Search
c:\windows\Downloaded Program Files\f3initialsetup1.0.1.1.inf
c:\windows\Downloaded Program Files\popcaploader.inf
c:\windows\struct~.ini
c:\windows\system32\Ijl11.dll
c:\windows\system32\vbzlib1.dll

.
(((((((((((((((((((((((((((((((((((((((   Driver/Servizi   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MYWEBSEARCHSERVICE


(((((((((((((((((((((((((   Files Creati Da 2010-02-16 al 2010-03-16  )))))))))))))))))))))))))))))))))))
.

2010-03-16 14:19 . 2010-01-07 15:07   38224   ----a-w-   c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-12 02:53 . 2010-03-12 02:53   --------   d-----w-   c:\programmi\File comuni\Protexis
2010-03-12 02:50 . 2010-03-12 02:50   --------   d-----w-   c:\programmi\File comuni\Corel
2010-03-12 02:49 . 2010-03-12 02:49   --------   d-----w-   c:\programmi\Corel
2010-03-10 07:31 . 2009-10-23 15:28   3558912   ------w-   c:\windows\system32\dllcache\moviemk.exe
2010-03-09 17:29 . 2010-03-09 17:29   --------   d-----w-   c:\documents and settings\utente\Dati applicazioni\gtk-2.0
2010-03-09 17:29 . 2010-03-09 17:29   --------   d-----w-   c:\documents and settings\utente\.thumbnails
2010-03-09 17:25 . 2010-03-09 17:25   --------   d-----w-   c:\documents and settings\utente\.gimp-2.6
2010-03-09 17:24 . 2010-03-09 17:24   --------   d-----w-   c:\programmi\GIMP-2.0
2010-03-08 01:30 . 2010-03-08 01:30   --------   d-----w-   c:\programmi\PC Inspector File Recovery
2010-03-06 11:34 . 2010-02-12 10:03   293376   ------w-   c:\windows\system32\browserchoice.exe
2010-02-18 16:38 . 2008-04-14 03:13   21504   ----a-w-   c:\windows\system32\hidserv.dll
2010-02-18 16:38 . 2008-04-14 03:13   21504   ----a-w-   c:\windows\system32\dllcache\hidserv.dll
2010-02-18 16:38 . 2008-04-14 02:53   14720   ----a-w-   c:\windows\system32\drivers\kbdhid.sys
2010-02-18 16:38 . 2008-04-14 02:53   14720   ----a-w-   c:\windows\system32\dllcache\kbdhid.sys
2010-02-18 16:38 . 2008-04-13 19:45   32128   ----a-w-   c:\windows\system32\drivers\usbccgp.sys
2010-02-18 16:38 . 2008-04-13 19:45   32128   ----a-w-   c:\windows\system32\dllcache\usbccgp.sys
2010-02-18 08:46 . 2010-02-18 08:46   --------   d-----w-   c:\documents and settings\utente\Dati applicazioni\avidemux
2010-02-18 08:46 . 2010-02-18 08:46   --------   d-----w-   c:\programmi\Avidemux 2.5
2010-02-18 05:13 . 2010-02-18 05:13   --------   d-----w-   c:\programmi\DVD Shrink
2010-02-16 06:35 . 2010-02-16 06:35   --------   d-----w-   c:\documents and settings\utente\Dati applicazioni\Toshiba

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-16 18:39 . 2009-08-14 02:51   1361   --sha-w-   c:\windows\system32\mmf.sys
2010-03-16 14:18 . 2010-03-16 14:18   5115823   ----a-w-   c:\documents and settings\All Users\Dati applicazioni\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-03-12 02:56 . 2007-01-31 14:32   124896   ----a-w-   c:\documents and settings\utente\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2010-03-12 02:55 . 2009-06-16 09:06   2984   --sha-w-   c:\documents and settings\All Users\Dati applicazioni\KGyGaAvL.sys
2010-03-12 02:55 . 2009-06-16 09:06   2984   --sha-w-   c:\documents and settings\All Users\Dati applicazioni\KGyGaAvL.sys
2010-03-12 02:55 . 2009-06-16 09:06   88   --sh--r-   c:\documents and settings\All Users\Dati applicazioni\8FAB86E885.sys
2010-03-12 02:55 . 2009-06-16 09:06   88   --sh--r-   c:\documents and settings\All Users\Dati applicazioni\8FAB86E885.sys
2010-02-28 14:29 . 2010-02-28 14:26   5514304   ----a-w-   c:\documents and settings\utente\Dati applicazioni\TVU networks\AutoUpgrade\TVUPlayer2.5.2.2.exe
2010-02-24 08:16 . 2009-10-03 11:48   181632   ------w-   c:\windows\system32\MpSigStub.exe
2010-02-09 00:03 . 2010-02-09 00:03   --------   d-----w-   c:\programmi\Banshee Screamer Alarm
2010-02-04 17:35 . 2008-06-08 03:37   88640   ---ha-w-   c:\windows\system32\mlfcache.dat
2010-02-01 16:27 . 2010-02-01 16:27   --------   d-----w-   c:\programmi\PartyItalia
2010-01-25 07:58 . 2010-01-25 07:58   503808   ----a-w-   c:\documents and settings\utente\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-7b14df9a-n\msvcp71.dll
2010-01-25 07:58 . 2010-01-25 07:58   499712   ----a-w-   c:\documents and settings\utente\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-7b14df9a-n\jmc.dll
2010-01-25 07:58 . 2010-01-25 07:58   348160   ----a-w-   c:\documents and settings\utente\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-7b14df9a-n\msvcr71.dll
2010-01-25 07:58 . 2010-01-25 07:58   61440   ----a-w-   c:\documents and settings\utente\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-24f18e46-n\decora-sse.dll
2010-01-25 07:58 . 2010-01-25 07:58   12800   ----a-w-   c:\documents and settings\utente\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-24f18e46-n\decora-d3d.dll
2010-01-25 00:57 . 2010-01-25 00:57   --------   d-----w-   c:\documents and settings\All Users\Dati applicazioni\TVU Networks
2010-01-20 20:05 . 2010-01-20 20:05   503808   ----a-w-   c:\documents and settings\utente\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-34a5fc91-n\msvcp71.dll
2010-01-20 20:05 . 2010-01-20 20:05   499712   ----a-w-   c:\documents and settings\utente\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-34a5fc91-n\jmc.dll
2010-01-20 20:05 . 2010-01-20 20:05   348160   ----a-w-   c:\documents and settings\utente\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-34a5fc91-n\msvcr71.dll
2010-01-20 20:05 . 2010-01-20 20:05   114688   ----a-w-   c:\documents and settings\utente\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\62\6baea4fe-394be18b-n\jogl_cg.dll
2010-01-20 20:05 . 2010-01-20 20:05   61440   ----a-w-   c:\documents and settings\utente\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-34a5fc91-n\decora-sse.dll
2010-01-20 20:05 . 2010-01-20 20:05   315392   ----a-w-   c:\documents and settings\utente\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\62\6baea4fe-394be18b-n\jogl.dll
2010-01-20 20:05 . 2010-01-20 20:05   20480   ----a-w-   c:\documents and settings\utente\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\62\6baea4fe-394be18b-n\jogl_awt.dll
2010-01-20 20:05 . 2010-01-20 20:05   20480   ----a-w-   c:\documents and settings\utente\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\45\4f710eed-73a5364e-n\gluegen-rt.dll
2010-01-20 20:05 . 2010-01-20 20:05   12800   ----a-w-   c:\documents and settings\utente\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-34a5fc91-n\decora-d3d.dll
2010-01-20 20:04 . 2004-09-16 14:31   85330   ----a-w-   c:\windows\system32\perfc010.dat
2010-01-20 20:04 . 2004-09-16 14:31   492504   ----a-w-   c:\windows\system32\perfh010.dat
2010-01-09 06:14 . 2010-01-08 06:13   56816   ----a-w-   c:\windows\system32\drivers\avgntflt.sys
2010-01-07 15:07 . 2008-06-24 10:19   19160   ----a-w-   c:\windows\system32\drivers\mbam.sys
2009-12-31 16:50 . 2004-09-16 14:31   353792   ----a-w-   c:\windows\system32\drivers\srv.sys
2009-12-21 19:06 . 2004-09-16 14:31   916480   ----a-w-   c:\windows\system32\wininet.dll
2009-12-21 10:15 . 2009-11-29 11:39   319   ----a-w-   C:\drmHeader.bin
2009-12-17 16:14 . 2008-12-18 02:31   411368   ----a-w-   c:\windows\system32\deploytk.dll
2009-12-17 07:40 . 2006-09-29 11:05   346112   ----a-w-   c:\windows\system32\mspaint.exe
2005-06-22 06:37 . 2006-05-24 18:37   45568   --sha-r-   c:\windows\system32\cygz.dll
.

(((((((((((((((((((((((((((((((((((((   Punti Reg Caricati   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\programmi\File comuni\Ahead\lib\NMBgMonitor.exe" [2005-11-24 94208]
"swg"="c:\programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-27 68856]
"Yahoo! Pager"="c:\programmi\Yahoo!\Messenger\YahooMessenger.exe" [2007-01-19 4670968]
"updateMgr"="c:\programmi\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Shockwave Updater"="c:\windows\system32\Adobe\Shockwave 11\SwHelper_1150600.exe" [2009-06-05 468408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HControl"="c:\windows\ATK0100\HControl.exe" [2006-02-22 106496]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-11-21 7335936]
"nwiz"="nwiz.exe" [2005-11-21 1519616]
"RemoteControl"="c:\programmi\ASUSTeK\ASUSDVD\PDVDServ.exe" [2004-11-02 32768]
"SynTPEnh"="c:\programmi\Synaptics\SynTP\SynTPEnh.exe" [2005-10-21 761945]
"Wireless Console 2"="c:\programmi\Wireless Console 2\wcourier.exe" [2005-10-17 987136]
"IntelZeroConfig"="c:\programmi\Intel\Wireless\bin\ZCfgSvc.exe" [2006-04-14 667718]
"IntelWireless"="c:\programmi\Intel\Wireless\Bin\ifrmewrk.exe" [2006-04-14 602182]
"EOUApp"="c:\programmi\Intel\Wireless\Bin\EOUWiz.exe" [2006-04-14 569413]
"Power_Gear"="c:\programmi\ASUS\Power4 Gear\BatteryLife.exe" [2006-03-06 86016]
"ASUS Live Update"="c:\programmi\ASUS\ASUS Live Update\ALU.exe" [2006-02-21 180224]
"ABLKSR"="c:\windows\ABLKSR\ABLKSR.exe" [2006-01-02 61440]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"QuickTime Task"="c:\programmi\QuickTime\qttask.exe" [2007-02-09 77824]
"Collegamento alla pagina delle proprietà di High Definition Audio"="HDAShCut.exe" [2005-01-07 61952]
"Windows Defender"="c:\programmi\Windows Defender\MSASCui.exe" [2006-11-03 866584]
"SunJavaUpdateSched"="c:\programmi\File comuni\Java\Java Update\jusched.exe" [2010-01-11 246504]
"UnlockerAssistant"="c:\programmi\Unlocker\UnlockerAssistant.exe" [2009-10-26 15872]
"avgnt"="c:\programmi\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

c:\documents and settings\utente\Menu Avvio\Programmi\Esecuzione automatica\
Banshee Screamer Alarm.lnk - c:\programmi\Banshee Screamer Alarm\alarm.exe [2010-2-9 274432]

c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Bluetooth Manager.lnk - c:\programmi\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe [2005-6-16 49152]
Adobe Reader Speed Launch.lnk - c:\programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\eMule\\emule.exe"=
"c:\\Programmi\\Messenger\\MSMSGS.EXE"=
"c:\\Programmi\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Programmi\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Documents and Settings\\UTENTE\\Desktop\\Mirc\\mIRC 6.2 in Italiano by TuttoIRC +addon nuovi\\TuttoIRC.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\UTENTE\\Dati applicazioni\\PowerChallenge\\PowerSoccer\\PowerSoccer.exe"=
"c:\programmi\Microsoft ActiveSync\rapimgr.exe"= c:\programmi\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\programmi\Microsoft ActiveSync\wcescomm.exe"= c:\programmi\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\programmi\Microsoft ActiveSync\WCESMgr.exe"= c:\programmi\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Programmi\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programmi\\TVUPlayer\\TVUPlayer.exe"=
"c:\\Programmi\\SopCast\\adv\\SopAdver.exe"=
"c:\\Programmi\\SopCast\\SopCast.exe"=
"c:\\Programmi\\uTorrent\\uTorrent.exe"=
"c:\\Programmi\\KONAMI\\Pro Evolution Soccer 2010\\pes2010.exe"=
"c:\\Documents and Settings\\UTENTE\\Desktop\\pes2010.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"11682:TCP"= 11682:TCP:bit1
"11682:UDP"= 11682:UDP:bit2
"3000:TCP"= 3000:TCP:DCC1
"3001:TCP"= 3001:TCP:DCC2
"3002:TCP"= 3002:TCP:DCC3
"3003:TCP"= 3003:TCP:DCC4
"3004:TCP"= 3004:TCP:DCC5
"3005:TCP"= 3005:TCP:DCC6
"3006:TCP"= 3006:TCP:DCC7
"3007:TCP"= 3007:TCP:DCC8
"3008:TCP"= 3008:TCP:DCC9
"3009:TCP"= 3009:TCP:DCC10
"3010:TCP"= 3010:TCP:DCC11
"113:TCP"= 113:TCP:IDENTD
"6669:TCP"= 6669:TCP:PORTAMIRC
"59:UDP"= 59:UDP:PORTAMIRC2

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
"AllowInboundTimestampRequest"= 1 (0x1)
"AllowInboundMaskRequest"= 1 (0x1)
"AllowInboundRouterRequest"= 1 (0x1)
"AllowOutboundDestinationUnreachable"= 1 (0x1)
"AllowOutboundSourceQuench"= 1 (0x1)
"AllowOutboundParameterProblem"= 1 (0x1)
"AllowOutboundTimeExceeded"= 1 (0x1)
"AllowRedirect"= 1 (0x1)
"AllowOutboundPacketTooBig"= 1 (0x1)

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [04/07/2007 3.13.37 716272]
R1 c2scsi;c2scsi;c:\windows\system32\drivers\c2scsi.sys [03/03/2009 19.18.31 241664]
R2 io.sys;IO.DLL Driver;c:\windows\system32\drivers\io.sys [02/12/2008 3.10.22 5152]
R2 LicCtrlService;LicCtrl Service;c:\windows\Runservice.exe [14/08/2009 3.51.22 2560]
R2 WinDefend;Windows Defender;c:\programmi\Windows Defender\MsMpEng.exe [03/11/2006 19.19.58 13592]
R3 SynMini;USB2.0 1.3M Web Cam;c:\windows\system32\drivers\SynMini.sys [29/09/2006 12.35.37 720470]
R3 SynScan;USB2.0 1.3M Web Cam Still Image;c:\windows\system32\drivers\SynScan.sys [29/09/2006 12.35.37 8278]
S3 teamviewervpn;TeamViewer VPN Adapter;c:\windows\system32\drivers\teamviewervpn.sys [25/01/2008 10.12.34 25088]
S3 vaxscsi;vaxscsi;c:\windows\system32\Drivers\vaxscsi.sys --> c:\windows\system32\Drivers\vaxscsi.sys [?]
.
Contenuto della cartella 'Scheduled Tasks'

2010-03-16 c:\windows\Tasks\Google Software Updater.job
- c:\programmi\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-02-06 03:48]

2010-03-16 c:\windows\Tasks\MP Scheduled Scan.job
- c:\programmi\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mStart Page = hxxp://www.forospyware.com
mWindow Title =
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{47DDC1F4-8611-4f89-806E-3CBD8B7F924F} - c:\programmi\4A\4APoker\RunApp.exe
IE: {{4B21E152-BA59-4ebf-B522-8C55B265EE1A} - c:\programmi\PartyItalia\PartyPokerIt\RunApp.exe
IE: {{C4046502-6524-4d87-896C-878F57D1FF07} - c:\programmi\PokerStars.IT\PokerStarsUpdate.exe
TCP: {B17FD737-CA2C-41B0-9616-3C337E3EDC75} = 192.168.1.1
DPF: {112857FE-03FF-11D5-9A3F-0080C8D85044} - hxxp://194.244.16.123/g_bin/eng/solitaire_2_0_0_28.cab
DPF: {18506D80-9B80-11D4-82C2-0080C8D7ED4A} - hxxp://194.244.16.123/g_bin/eng/roulette_2_0_0_27.cab
DPF: {4539348E-01D7-11D5-9A39-0080C8D85044} - hxxp://194.244.16.123/g_bin/eng/slots90_2_0_0_35.cab
DPF: {4BFD075D-C36E-4F28-BB0A-5D472795197A} - hxxp://www.powerchallenge.com/applet/PowerLoader.cab
DPF: {9085316E-42BA-11D4-BAA3-0080C8D7ED4A} - hxxp://194.244.16.123/g_bin/eng/hunter_2_0_0_27.cab
DPF: {A1FE3DE0-CF77-11D4-8340-0080C8D7ED4A} - hxxp://194.244.16.123/g_bin/eng/demon_2_0_0_30.cab
DPF: {A1FE3DEF-CF77-11D4-8340-0080C8D7ED4A} - hxxp://194.244.16.123/g_bin/eng/pirate_2_0_0_30.cab
DPF: {A6212120-01D4-11D5-9A39-0080C8D85044} - hxxp://194.244.16.123/g_bin/eng/slots70_2_0_0_35.cab
DPF: {A854AD6D-6DB5-41FB-8044-0BD38092A007} - hxxp://194.244.16.123/g_bin/eng/sudoku_2_0_0_15.cab
DPF: {A9ED6AA2-D9D4-4D71-9586-E293E2E3580B} - hxxp://194.244.16.123/g_bin/eng/marbles_2_0_0_32.cab
DPF: {AC120B1D-9411-4111-AF52-118052D85D45} - hxxp://194.244.16.123/g_bin/eng/darts_2_0_0_42.cab
DPF: {AD7013FF-1D9A-4F36-94A6-3CD408A663F9} - hxxp://194.244.16.123/g_bin/eng/breakout_2_0_0_29.cab
DPF: {BFA1F11D-3121-AFE1-4112-894323212DAC} - hxxp://194.244.16.123/g_bin/eng/words_2_0_0_51.cab
DPF: {BFA1F11D-3121-AFE1-4112-983219421AEF} - hxxp://194.244.16.123/g_bin/eng/wordssingle_2_0_0_48.cab
DPF: {E23FABEE-12E3-33DA-DA12-195DAC123984} - hxxp://194.244.16.117/g_bin/eng/mahjong_2_0_0_31.cab
DPF: {E95CF138-A587-4C54-8175-3AD80997CB14} - hxxp://194.244.16.123/g_bin/eng/soccer_2_0_0_20.cab
DPF: {ECEAD8AE-01D6-11D5-9A39-0080C8D85044} - hxxp://194.244.16.123/g_bin/eng/slots80_2_0_0_35.cab
DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C4} - hxxp://194.244.16.123/g_bin/eng/billardt_2_0_0_35.cab
FF - ProfilePath - c:\documents and settings\utente\Dati applicazioni\Mozilla\Firefox\Profiles\rrwhwr47.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - plugin: c:\documents and settings\utente\Dati applicazioni\Mozilla\Firefox\Profiles\rrwhwr47.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
FF - plugin: c:\documents and settings\utente\Dati applicazioni\Mozilla\Firefox\Profiles\rrwhwr47.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll
FF - plugin: c:\progra~1\YAHOO!\COMMON\npyaxmpb.dll
FF - plugin: c:\programmi\Google\Google Updater\2.4.1399.3742\npCIDetect13.dll
FF - plugin: c:\programmi\Mozilla Firefox\plugins\NPPOKER.dll
FF - plugin: c:\programmi\Mozilla Firefox\plugins\NPWORDSSINGLE.dll
FF - plugin: c:\programmi\Veetle\VLCBroadcast\npvbp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - CHIAVI ORFANE RIMOSSE - - - -

HKCU-Run-Luxor2.exe - c:\docume~1\utente\Desktop\GIOCHI\Luxor\LUXOR2~1.EXE
HKCU-Run-RamBooster - c:\programmi\RamBooster 2.0\Rambooster.exe
AddRemove-AviSynth - c:\programmi\AviSynth 2.5\Uninstall.exe
AddRemove-vcraoetb - c:\documents and settings\utente\impostazioni locali\dati applicazioni\vcraoetb.exe
AddRemove-Coolrdrextra - c:\docume~1\utente\DATIAP~1\DrawCopy\bendamenball.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-16 19:39
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll prosync1.sys atapi.sys spuv.sys >>UNKNOWN [0x8A5A8938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xba90cf28
\Driver\ACPI -> ACPI.sys @ 0xba64acb8
\Driver\atapi -> prosync1.sys @ 0xbadb0661
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
 ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
 ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
NDIS: Intel(R) PRO/Wireless 3945ABG Network Connection -> SendCompleteHandler -> NDIS.sys @ 0xba559bb0
 PacketIndicateHandler -> NDIS.sys @ 0xba548a0d
 SendHandler -> NDIS.sys @ 0xba55cb40
user & kernel MBR OK

**************************************************************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \D25BC253F035D347]
"1"=hex:6a,0b,56,13,c1,93,dc,9c,fb,61,a2,a0,e4,ff,91,20,60,bf,2f,c2,35,91,ae,
   25
"2"=hex:fb,e6,50,7f,41,f4,51,a7,7f,ec,2d,f9,42,45,3a,02,3a,b7,45,15,3f,9d,8b,
   c3
"3"=hex:6a,0b,56,13,c1,93,dc,9c,fb,61,a2,a0,e4,ff,91,20,5d,f5,58,d1,21,e0,48,
   8b,38,57,44,9c,4e,8d,78,88,fd,f1,01,9d,86,d8,b5,cb,d9,bf,23,55,4a,bb,31,1f

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \D25BC253F035D347\B7F5EA513569EA3E98352E3A3D1D6A3D]
"1"=hex:df,c7,3a,96,ab,66,13,d2,36,78,6c,b8,10,1c,c4,b0,a6,93,a9,25,23,fb,66,
   2c,77,d8,5d,6a,fe,59,6e,ef
"2"=hex:14,ce,87,8d,79,74,ee,b2
"3"=hex:81,20,8f,ab,28,6a,52,9c
"4"=hex:2f,ad,a2,e7,8a,bf,05,5e
"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
   1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
"6"=hex:bf,e5,23,7b,b0,66,d6,fc,bc,64,22,fb,7e,d3,39,3e,a3,00,33,13,c0,21,f4,
   51,6c,4e,0c,96,e2,dd,ad,8a,b6,c4,05,e8,5a,bd,9a,e9,d4,1a,3d,68,9d,00,32,20
"7"=hex:58,eb,3b,8d,af,31,32,62,22,1b,23,79,6d,f4,12,c1,db,b4,20,3e,7f,80,2a,
   0f,6a,a6,22,9f,10,4c,a5,77,df,44,a4,37,10,4b,bc,75,d7,98,0e,82,a4,8d,85,b3,\
"8"=hex:9d,9e,b2,b9,a7,a5,f4,ae,53,0a,a4,47,47,f9,fb,53,c1,3b,50,30,cf,b5,2b,
   a2,b5,c0,40,d8,1b,d8,5d,e6,82,b2,50,6b,1d,24,d1,8e,f4,33,92,91,28,ba,97,d6,\
"9"=hex:81,20,8f,ab,28,6a,52,9c
"18"=hex:b6,dd,00,4d,9d,38,11,d1
"10"=hex:81,20,8f,ab,28,6a,52,9c
"11"=hex:81,20,8f,ab,28,6a,52,9c
"12"=hex:81,20,8f,ab,28,6a,52,9c
"13"=hex:81,20,8f,ab,28,6a,52,9c
"14"=hex:81,20,8f,ab,28,6a,52,9c
"24"=hex:81,20,8f,ab,28,6a,52,9c
"26"=hex:81,20,8f,ab,28,6a,52,9c
"27"=hex:81,20,8f,ab,28,6a,52,9c
"19"=hex:81,20,8f,ab,28,6a,52,9c
"22"=hex:81,20,8f,ab,28,6a,52,9c

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\ð•€|ÿÿÿÿ.•€|ù•9~*]
"0140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------

- - - - - - - > 'explorer.exe'(3900)
c:\windows\system32\WININET.dll
c:\programmi\Unlocker\UnlockerHook.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\programmi\File comuni\Ahead\lib\NeroDigitalExt.dll
c:\programmi\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\programmi\Intel\Wireless\Bin\EvtEng.exe
c:\programmi\Intel\Wireless\Bin\S24EvMon.exe
c:\programmi\Avira\AntiVir Desktop\sched.exe
c:\programmi\Avira\AntiVir Desktop\avguard.exe
c:\programmi\File comuni\InterVideo\DeviceService\DevSvc.exe
c:\programmi\Java\jre6\bin\jqs.exe
c:\programmi\File comuni\LightScribe\LSSrvc.exe
c:\programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\programmi\File comuni\Protexis\License Service\PsiService_2.exe
c:\programmi\Intel\Wireless\Bin\RegSrvc.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\ATK0100\ATKOSD.exe
c:\programmi\Microsoft ActiveSync\wcescomm.exe
c:\progra~1\Intel\Wireless\Bin\Dot1XCfg.exe
c:\progra~1\MI3AA1~1\rapimgr.exe
c:\programmi\Yahoo!\Messenger\ymsgr_tray.exe
c:\programmi\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
c:\programmi\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
c:\programmi\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
c:\programmi\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
c:\programmi\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
c:\programmi\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe
.
**************************************************************************
.
Ora fine scansione: 2010-03-16  19:43:54 - Il pc è stato riavviato
ComboFix-quarantined-files.txt  2010-03-16 18:43

Pre-Run: 5.582.258.176 byte disponibili
Post-Run: 10.974.593.024 byte disponibili

- - End Of File - - 24A9E77AA2B806034032E335F157FC2E

[gahan]

Ciao,

scarica CCleaner da questo link:
http://www.piriform.com/ccleaner/download/standard
installa il software spuntando la casella della "yahoo toolbar" verso fine installazione
avvialo --> vai in opzioni sulla sinistra--> avanzate--> togli la spunta da "cancella file in windows temp se più vecchi di 24 ore".
Ritorna in "pulizia" e clicca su "avvia pulizia".

- sucessivamente scarica systemscan dal link seguente (vorrei verificare una cosa):
http://www.suspectfile.com/systemscan
- disattiva il tuo antivirus
- esegui il programma
la finestra si presenta con molte opzioni
- togli la spunta a tutte le voci, lasciando abilitata solo "master boot record" e quindi clicca su "scan now"
Alla fine verrà creato un log.
Postalo qui sul forum per un controllo.
ricorda di usare il comando [code] quando inserisci dei log/codici nelle tue risposte

[ciby]

Eseguito passaggio con C-cleaner.
Ecco il log di systemscan(non ho ben capito la sua funzione?forse un controllo dell'integrità dell'hd? )

Codice: Seleziona tutto

SystemScan - www.suspectfile.com - ver. 3.6.7 (code: holifay & bReAkdOWn)

Running on: Windows XP HOME Edition, Service Pack 3 (2600.5.1)
System directory: C:\WINDOWS
SystemScan file: C:\Documents and Settings\utente\Desktop\Soft Hacker\sys77879.exe
Running in: User mode
Date: 17/03/2010
Time: 14.59.35
 
Output limited to:
 -Master Boot Record

===================== MASTER BOOT RECORD =====================


device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK

==========================================
Scan completed in 0 minutes
End of report


~~~~~~~~~~~~~~~~~~~~~-----CREDITS-----~~~~~~~~~~~~~~~~~~~~~
SystemScan uses some freeware tools that remain property of their authors:

* SteelWerX Registry Console Tool, Who Am I (Bobby Flekman: www.xs4all.nl/~fstaal01) --> "Registry scan", "PC accounts "
* dumphive (Markus Stephany)--> "Registry scan"
* Listdlls (M.Russinovich, B.Cogswell: www.sysinternals.com) --> "Loaded modules"
* Catchme & MBR Rootkit detector (gmer: www.gmer.net) --> "Hidden objects", "Alternate Data Streams" & "Master Boot Record"
---> NOTE: SystemScan integrates "The Avenger" from Swandog46 (http://swandog46.geekstogo.com) to allow you to remove malwares found in this log

Thanks to all of them for their hard work



[gahan]

Ciao,

il controllo che ti ho chiesto con il software "system scan" era per verificare se era infetto anche il settore di avvio el sistema: MBR = Master Boot Record

Direi che ora è tutto a posto;

aspetto tuoi aggiornamenti

[ciby]

Ciao,
ho appena spostato 5 avi da C: ad un hd esterno multimediale,tutto è filato liscio,ho chiuso la cartella d'origine,è una cartella dove finiscono i download di un client IRC(non sò se posso postare il nome,ma è famoso e avrai già capito),ora l'ho riaperta e 3 dei 5 file avi son riapparsi...

[gahan]

Prova a cancellarli manualmente e poi a fare nuovamente una pulizia con CCleaner

[ciby]

Quando provo a cancellarli vien fuori un avviso con scritto "impossibile eliminare il file -pincopalino-accesso negato.Controllare che il disco non sia pieno o protetto da scrittur,o che il file non sia attualmente in uso",a sto punto si attiva il programma che ho citato nel primo post,UNLOCKER,il quale in una sua finestra mi mostra quali sono i processi che bloccano il file,da me il processo segnalato è sempre explorer.exe,rpoi in questa finestra cliko sblocca tutto e il file sparisce(senza passare dal cestino).
Ora riprovo il passaggio che mi hai consigliato...

[ciby]

Eseguita pulizia con CC..
Un'altra cosa,magari può esserti d'aiuto per risolvere il problema,spesso,dopo averlo svuotato,mi ritrovo con l'icona del cestino come se ancora ci fossero file..
Inoltre,sia falso cestino pieno che file "highlander",spariscono al riavvio del pc...
Ahi ahi...Gahan mi dispiace stressarti con tutto sto caos...

[thedregs]

Per cancellare gli avi
Se hai un minimo di dimestichezza col registro puoi provare ad eliminare la funzione prewiev (anteprima) dei filmati in explorer, che con i files corrotti, da problemi simili al tuo (soluzione trovata qui: http://www.tweakxp.com/article37544.aspx)
La chiave è: HKEY_CLASSES_ROOT\SystemFileAssociations\.avi\shellex\PropertyHandler
Prima di eliminarla, salvala in modo da poterla ripristinare nel caso servisse.

Un altra modo:
http://www.wintricks.it/faqreg/xp/anteprima_avi.zip

Altro ancora:
Start -> esegui -> e digitare
REGSVR32 /U SHMEDIA.DLL

Sistema drastico
Creare un file .reg con questo testo:
Windows Registry Editor Version 5.00
[-HKEY_CLASSES_ROOT\.avi\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}]
@="{c5a40261-cd64-4ccf-84cb-c394da41d590}"

[-HKEY_CLASSES_ROOT\.mpeg\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}]
@="{c5a40261-cd64-4ccf-84cb-c394da41d590}"

[-HKEY_CLASSES_ROOT\.mpg\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}]
@="{c5a40261-cd64-4ccf-84cb-c394da41d590}"

[-HKEY_CLASSES_ROOT\CLSID\{87D62D94-71B3-4b9a-9489-5FE6850DC73E}]
@="Avi Properties Handler"

[-HKEY_CLASSES_ROOT\CLSID\{87D62D94-71B3-4b9a-9489-5FE6850DC73E}\InProcServer32]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,68,00,\
6d,00,65,00,64,00,69,00,61,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Both"

[thedregs]

Non è che sono files condivisi?

[ciby]

Ciao Thedregs,ringrazio anche te per l'interesse
Non sono esperto in ste cose,comunque ci sono arrivato,ho salvato e poi cancellato la chiave HKEY_CLASSES_ROOT\SystemFileAssociations\.avi\shellex\PropertyHandler .
Cosa intendi per files condivisi?

[thedregs]

Cosa intendi per files condivisi?

No, niente, non ci azzecca, come direbbe qualcuno.
Come non detto.

[gahan]

Cosa intendi per files condivisi?

I files condivisi sono tutti quei files (presenti in una specifica cartella) che sono appunto "condivisi" con altri utenti nei programmi P2P (peer-to-peer).