Ciao a tutti!
Ho un grosso problema con 3 trojan horse che mi vengono segnalati da ANTIVIR ad ogni avvio di Explorer.
Ho provato ogni tipo di software per la rimozione di tutte queste schifezze ma niente, continuano a comparire, inoltre mi si apre anche una finestra di explorer in pop up con una pagina di ricerche che non voglio usare.
Di seguito posto il log di hijackthis per dare più info possibili.
inoltre do anche i messaggi di avviso dell'Antivir, sono 3 uno seguito dall'altro ad ogni apertura di explorer.
Premetto che i files segnalati poi non riesco a trovarli, anche perchè i files cambiano ogni vlta ma i tojani sono sempre quelli. Ho cercato notizie su internet ma ci sono solo poche discussioni specie in tedesco a riguardo, ringrazio anticipatamente per ogni suggerimento utile.Ciaooo
Luca
1) C:windows\system32\quovy.dll
trojan horse TR/Dldr.Agent.AP.2
2) C:windows\system32\d3pq32.exe
trojan horse TR/Dldr.Agent.BQ
3) C:windows\syspt.exe
trojan horse TR/Dldr.Agent.AP.3
Logfile of HijackThis v1.98.2
Scan saved at 9.44.28, on 12/13/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
G:\Antivir\AVGUARD.EXE
G:\Antivir\AVWUPSRV.EXE
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\GEARSec.exe
C:\Programmi\Symantec\Norton Ghost\Agent\PQV2iSvc.exe
C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Trust\270KDS~1\Keyboard\Ikeymain.exe
C:\PROGRA~1\Trust\270KDS~1\Mouse\Amoumain.exe
C:\Programmi\Analog Devices\SoundMAX\SMTray.exe
C:\Programmi\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programmi\Symantec\Norton Ghost\Agent\GhostTray.exe
G:\Programmi\PestPatrol\PPMemCheck.exe
G:\Programmi\PestPatrol\PPControl.exe
G:\Text Bridge\opware32.exe
G:\Programmi\PestPatrol\CookiePatrol.exe
G:\VOCABOLARI\Hazon Garzanti\HAZON.EXE
G:\Antivir\AVGNT.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Programmi\BullsEye Network\bin\bargains.exe
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Wutanes_Heer\Desktop\hijackthis_198\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\quovy.dll/sp.html#37680
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\quovy.dll/sp.html#37680
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\quovy.dll/sp.html#37680
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\quovy.dll/sp.html#37680
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\quovy.dll/sp.html#37680
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\quovy.dll/sp.html#37680
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\quovy.dll/sp.html#37680
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {33AC2EFD-E2CC-A763-26F4-E66BD8536E46} - C:\WINDOWS\system32\mfcga.dll
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\System32\msbe.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [TrustKeybd] C:\PROGRA~1\Trust\270KDS~1\Keyboard\Ikeymain.exe
O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\Trust\270KDS~1\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [Microsoft Office] lserv.exe
O4 - HKLM\..\Run: [Smapp] C:\Programmi\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [Diagnostica SpeedTouch USB] "C:\Programmi\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Norton Ghost 9.0] C:\Programmi\Symantec\Norton Ghost\Agent\GhostTray.exe
O4 - HKLM\..\Run: [SmcService] G:\Sygate\smc.exe -startgui
O4 - HKLM\..\Run: [PPMemCheck] G:\Programmi\PestPatrol\PPMemCheck.exe
O4 - HKLM\..\Run: [PestPatrol Control Center] G:\Programmi\PestPatrol\PPControl.exe
O4 - HKLM\..\Run: [Omnipage] G:\Text Bridge\opware32.exe
O4 - HKLM\..\Run: [CookiePatrol] G:\Programmi\PestPatrol\CookiePatrol.exe
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "G:\Clone CD\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [Hazon clic] "G:\VOCABOLARI\Hazon Garzanti\HAZON.EXE" -I
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AVGCtrl] G:\Antivir\AVGNT.EXE /min
O4 - HKLM\..\RunServices: [Microsoft Office] lserv.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://G:\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - G:\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: iFinger - {936E5D60-596C-11D3-BB96-00600816DF55} - C:\WINDOWS\System32\SHDOCVW.DLL
O15 - Trusted Zone: *.05p.com
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.scoobidoo.com
O15 - Trusted Zone: *.searchmiracle.com
O15 - Trusted Zone: *.static.topconverting.com
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v ... 0623531237
O16 - DPF: {79849612-A98F-45B8-95E9-4D13C7B6B35C} (Loader2 Control) - http://static.topconverting.com/activex/loader2.ocx
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{34E3471B-124E-46D1-BED1-8C0DD763DF64}: NameServer = 62.211.69.150 212.48.4.15
Registrazione