Non riesco a liberarmi da questo worm.... potete aiutarmi?
Questo il log di Hijackthis:
Logfile of HijackThis v1.99.1
Scan saved at 16.52.10, on 06/10/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
F:\Programmi\Sophos\Remote Update\cachemgr.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Programmi\Sophos SWEEP for NT\SWNETSUP.EXE
C:\Programmi\Sophos SWEEP for NT\SWEEPSRV.SYS
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\SOUNDMAN.EXE
C:\Programmi\Java\jre1.5.0_01\bin\jusched.exe
F:\Programmi\Stunnel\stunnel.exe
C:\WINNT\system32\internat.exe
F:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Programmi\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Programmi\Sophos SWEEP for NT\ICMON.EXE
F:\Programmi\Sophos\Remote Update\imonitor.exe
C:\Documents and Settings\Administrator\Menu Avvio\Programmi\Esecuzione automatica\ms.exe
C:\WINNT\system32\wuauclt.exe
C:\Documents and Settings\Administrator\Desktop\hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Programmi\Adobe6\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2ee25147-37d4-4640-832c-fccfac8b21d9} - C:\WINNT\system32\koaa.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\NeroCheck.exe
il processo ms.exe è segnalato sospetto, facendo una scansione on-line ottengo:
Checked file ms.exe
Filesize: 13312 Bytes
MD5-Hashvalue: 8c21e7eab926ce40112c227021f8eef7
SHA1-Hashvalue: ac02b5b3f8e491af3bbf3ea01e9264918fabf265
=======================================
F-Prot Antivirus: No virus found.
Clam AV: No virus found.
VirusBlokAda: infected Trojan.Win32.Agent.vp
Se elimino il prcesso con HijackThis poi ricompare al riavvio del sistema!
Ho fatto girare stinger, cwshredder, SUPERAntiSpyware Free Edition, ma non mi eliminano il problema!
Qualche indicazione a riguardo?
grazie....
Registrazione