virus csrs.exe come si elimina

[maryepucci]

ragazzi ho il virus csrs.exe come posso fare per eliminarlo??


vi metto quello che risulta da Hijack:


Logfile of HijackThis v1.99.1
Scan saved at 13.37.11, on 08/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\Programmi\Eset\nod32krn.exe
C:\WINDOWS\system32\SAgent4.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Webroot\Spy Sweeper\WRSSSDK.exe
C:\VEXPLITE\viritsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Programmi\Eset\nod32kui.exe
C:\BITWARE\NT\bwprnmon.exe
C:\Programmi\QuickTime\qttask.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programmi\HP\HP Software Update\HPWuSchd2.exe
C:\Programmi\HP\hpcoretech\hpcmpmgr.exe
C:\VEXPLITE\MONLITE.EXE
C:\Programmi\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Programmi\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Programmi\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
C:\Programmi\HP\Digital Imaging\bin\hpqgalry.exe
C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\Programmi\DataBrain\DataBrain.exe
C:\PAGINE BIANCHE 2005-06\CD\ServerCDItalia.exe
C:\Programmi\Microsoft Office\Office10\WINWORD.EXE
C:\Programmi\MSN Messenger\msnmsgr.exe
C:\Programmi\ewido anti-spyware 4.0\guard.exe
C:\VEXPLITE\VIRITEXP.EXE
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\zbianche\tuttomio\vari programmi utili\protezione\hjt (raffaele)\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.infoimprese.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Dati applicazioni\Prevx\pxbho.dll
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar4.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar4.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [CDWCheckRubrica] C:\SEAT\CDItalia\Chkrub_cdi
O4 - HKLM\..\Run: [nod32kui] "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [bwprnmon.exe] C:\BITWARE\NT\bwprnmon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HP Software Update] "C:\Programmi\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Programmi\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [PrevxOne] C:\Programmi\Prevx1\PXConsole.exe
O4 - HKLM\..\Run: [VIRIT LITE MONITOR] C:\VEXPLITE\MONLITE.EXE
O4 - HKLM\..\Run: [SpySweeper] "C:\Programmi\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Programmi\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [CheckRubAnniversari] C:\Documents and Settings\amministratore\Documenti\SeatCDItalia\127_0_0_1\chkrub_cdi.exe "C:\Documents and Settings\amministratore\Documenti\SeatCDItalia\127_0_0_1\PB.rub" "I"
O4 - Global Startup: Acrobat Assistant.lnk = C:\Programmi\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Avvio rapido di HP Image Zone.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Converti destinazione link in file PDF esistente - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Converti i link selezionati in Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Converti i link selezionati in file PDF esistente - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Converti nel file PDF esistente - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Converti selezione in file PDF esistente - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Programmi\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{4B76AAEB-55AC-4791-8617-449E45DC6705}: NameServer = 213.140.2.12,213.140.2.21
O17 - HKLM\System\CS1\Services\Tcpip\..\{4B76AAEB-55AC-4791-8617-449E45DC6705}: NameServer = 213.140.2.12,213.140.2.21
O17 - HKLM\System\CS2\Services\Tcpip\..\{4B76AAEB-55AC-4791-8617-449E45DC6705}: NameServer = 213.140.2.12,213.140.2.21
O17 - HKLM\System\CS3\Services\Tcpip\..\{4B76AAEB-55AC-4791-8617-449E45DC6705}: NameServer = 213.140.2.12,213.140.2.21
O17 - HKLM\System\CS4\Services\Tcpip\..\{4B76AAEB-55AC-4791-8617-449E45DC6705}: NameServer = 213.140.2.12,213.140.2.21
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: !SASWinLogon - C:\Programmi\SUPERAntiSpyware\SASWINLO.DLL
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Programmi\ewido anti-spyware 4.0\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Programmi\File comuni\LightScribe\LSSrvc.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmi\Eset\nod32krn.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Programmi\Prevx1\PXAgent.exe" -f (file missing)
O23 - Service: Epson Printer Status Agent4 (StatusAgent4) - SEIKO EPSON CORPORATION - C:\WINDOWS\system32\SAgent4.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Programmi\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Virit eXplorer Lite (viritsvclite) - TG Soft Sas http://www.tgsoft.it - C:\VEXPLITE\viritsvc.exe

[maryepucci]

aiuto...il file si duplica

[maryepucci]

ragazzi non mi abbandonate!!
Andorra ci sei???

[Luke57]

ragazzi non mi abbandonate!!
Andorra ci sei???

Ciao, Andorra purtroppo ci ha abbandonato
Nel log non lo vedo comunque, scarica
SDFIX: http://downloads.andymanchesta.com/Remo ... /SDFix.exe

- Doppio click su SDFix.exe e il tool andrà ad estrarsi in C:\SDFix
- avvia il sistema in modalità provvisoria (premendo il tasto f8 ripetutamente all'accensione del computer e spostandoti con le freccette nella schermata grigia che appare).
- Apri la cartella SDFix situata in C:\ e fai un doppio click su RunThis.bat per lanciare lo script
- seleziona Y per avviare la pulizia
- Quando te lo chiederà premi un tasto per riavviare(il sistema sarà piu lungo nell'avviarsi perchè lo script eseguirà l'eliminazione dei file trovati)
- Quando apparirà il desktop il tool terminerà il suo lavoro e visualizzerà il messaggio "Finished"
- Premi un tasto per terminare lo script e ricaricare le icone del desktop
- Il log sarà visualizzato automaticamente,altrimenti potrai trovarlo in C:\SDFix\Report.txt
Posta il report.

[maryepucci]

Luke ecco:


SDFix: Version 1.87

Run by amministratore - 12/06/2007 - 9.31.20,79

Microsoft Windows XP [Versione 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:






Restoring Windows Registry Values
Restoring Windows Default Hosts File
Restoring Missing Security Center Service

Rebooting...


Normal Mode:
Checking Files:

Below files will be copied to Backups folder then removed:

C:\WINDOWS\SYSTEM32\CMMGR32.EXE - Deleted



Removing Temp Files...

ADS Check:

Checking if ADS is attached to system32 Folder
C:\WINDOWS\system32
No streams found.

Checking if ADS is attached to svchost.exe
C:\WINDOWS\system32\svchost.exe
No streams found.

Checking if ADS is attached to ntoskrnl.exe
C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\

standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-2

2019"
"C:\\Programmi\\eMule\\emule.exe"="C:\\Programmi\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\PAGINE BIANCHE 2005-06\\CD\\ServerCDItalia.exe"="C:\\PAGINE BIANCHE

2005-06\\CD\\ServerCDItalia.exe:*:Enabled:ServerCDItalia"
"C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"="C:\\WINDOWS\\system32\\spoo

l\\drivers\\w32x86\\3\\SAGENT4.EXE:*:Disabled:SAgent4"
"C:\\Programmi\\Internet Explorer\\IEXPLORE.EXE"="C:\\Programmi\\Internet

Explorer\\IEXPLORE.EXE:*:Enabled:Internet Explorer"
"D:\\CD\\ServerCDItalia.exe"="D:\\CD\\ServerCDItalia.exe:*:Enabled:ServerCDItalia"
"E:\\CD\\ServerHttp.exe"="E:\\CD\\ServerHttp.exe:*:Enabled:ServerHttp"
"C:\\Programmi\\MSN Messenger\\livecall.exe"="C:\\Programmi\\MSN

Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Programmi\\MSN Messenger\\msnmsgr.exe"="C:\\Programmi\\MSN

Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\

domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-2

2019"
"C:\\Programmi\\MSN Messenger\\livecall.exe"="C:\\Programmi\\MSN

Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Programmi\\MSN Messenger\\msnmsgr.exe"="C:\\Programmi\\MSN

Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"

Remaining Files:
---------------

Backups Folder: - C:\SDFix\backups\backups.zip

Listing Files with Hidden Attributes:

C:\Programmi\File comuni\Adobe\ESD\DLMCleanup.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\Outlook Express\msimn.exe
C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}$BACKUP$\Syste

m\wmplayer.exe
C:\Documents and Settings\amministratore\Documenti\relazione\rintracci mery\~WRL0740.tmp
C:\WINDOWS\system32\config\default.tmp.LOG
C:\WINDOWS\system32\config\software.tmp.LOG
C:\WINDOWS\system32\config\system.tmp.LOG

Listing User Accounts:

Account utente per \\MARIA1

Administrator amministratore ASPNET
Guest HelpAssistant nne
SUPPORT_388945a0 vlOrhKKhK
Esecuzione comando riuscita.


Finished

Luke credo che ci sia anche un altro virus BHO.C3.A (Startup: [58FB2CBB-C874-45FC-A1C9-B62CC9E3BED9]

[maryepucci]

ragazzi ma nessuno mi sà dare una mano????

[Luke57]

ragazzi ma nessuno mi sà dare una mano????

Ciao, se possibile scarica systemscan da qui (ne leggi anche le proprietà così)
http://www.suspectfile.com/forum/viewtopic.php?t=466
aprilo ed assicurati che tutte le opzioni siano spuntate, chiudi tutti i programmi e le applicazioni aperti, clicca su "Scan Now" al termine della scansione verrà rilasciato in C:\suspectfile un file con estensione .zip (data+ora+.zip)
Vai su http://www.easy-share.com carica il file e nella tua prossima risposta scrivi l'URL per scaricarlo , il primo che ti sarà fornito(il report è molto lungo e non entra in un post)

[maryepucci]

ragazzi ma nessuno mi sà dare una mano????

Ciao, se possibile scarica systemscan da qui (ne leggi anche le proprietà così)
http://www.suspectfile.com/forum/viewtopic.php?t=466
aprilo ed assicurati che tutte le opzioni siano spuntate, chiudi tutti i programmi e le applicazioni aperti, clicca su "Scan Now" al termine della scansione verrà rilasciato in C:\suspectfile un file con estensione .zip (data+ora+.zip)
Vai su http://www.easy-share.com carica il file e nella tua prossima risposta scrivi l'URL per scaricarlo , il primo che ti sarà fornito(il report è molto lungo e non entra in un post)

ho il blocco popup non me lo fà scaricare

[Luke57]

Ciao, scaricalo da qui:
http://w13.easy-share.com/1225227.html

[maryepucci]

Ciao, scaricalo da qui:
http://w13.easy-share.com/1225227.html

grazie luke

ecco il link

http://w13.easy-share.com/1225517.html

[Luke57]

Ciao, scarica avenger sul desktop
http://swandog46.geekstogo.com/avenger.zip
scompatta il file.zip
Avvia il file avenger.exe
Seleziona l'opzione "Input Script Manually"
Clicca sulla lente di ingrandimento

Ti si apre una finestra "View/edit script"
All'interno del box bianco,copia e incolla (ctl+v)le scritte in neretto:


Registry keys to delete:
HKLM\Softare\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
HKLM\Softare\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{55EA1964-F5E4-4D6A-B9B2-125B37655FCB}

Files to delete:
C:\WINDOWS\tasks\ukyctun.job
C:\WINDOWS\tasks\tmjsad.job
C:\WINDOWS\tasks\uvin.job
C:\WINDOWS\tasks\yzblr.job
C:\WINDOWS\tasks\yre.job
C:\WINDOWS\tasks\xiynpx.job
C:\WINDOWS\tasks\gruecste.job
C:\WINDOWS\tasks\ezwthb.job
C:\WINDOWS\tasks\cjj.job
C:\WINDOWS\tasks\jflbf.job
C:\WINDOWS\tasks\qzopiao.job
C:\WINDOWS\taks\mpjpa.job
C:\WINDOWS\tasks\jfpzqcux.job


Clicca sul pulsante Done
Clicca sull'icona del semaforo verde
Rispondi due volte Yes
Il pc dovrebbe riavviarsi da solo,se così non fosse riavvialo manualmente

Il programma rilascia un log con le operazioni eseguite.

Posta il log di Avenger (C:/avenger.txt) con l´esito dello script.

[maryepucci]

Ecco :

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\qccvy

nkp

*******************

Script file located at: \??\C:\Documents and

Settings\xasadmnc.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\tasks\ukyctun.job deleted successfully.
File C:\WINDOWS\tasks\tmjsad.job deleted successfully.
File C:\WINDOWS\tasks\uvin.job deleted successfully.
File C:\WINDOWS\tasks\yzblr.job deleted successfully.
File C:\WINDOWS\tasks\yre.job deleted successfully.
File C:\WINDOWS\tasks\xiynpx.job deleted successfully.
File C:\WINDOWS\tasks\gruecste.job deleted successfully.
File C:\WINDOWS\tasks\ezwthb.job deleted successfully.
File C:\WINDOWS\tasks\cjj.job deleted successfully.
File C:\WINDOWS\tasks\jflbf.job deleted successfully.
File C:\WINDOWS\tasks\qzopiao.job deleted successfully.


Could not open file C:\WINDOWS\taks\mpjpa.job for deletion
Deletion of file C:\WINDOWS\taks\mpjpa.job failed!

Could not process line:
C:\WINDOWS\taks\mpjpa.job
Status: 0xc000003a

File C:\WINDOWS\tasks\jfpzqcux.job deleted successfully.


Registry key

HKLM\Softare\Microsoft\Windows\CurrentVersion\Explorer\Br

owser Helper

Objects\{EF99BD32-C1FB-11D2-892F-0090271D4F88} not

found!
Deletion of registry key

HKLM\Softare\Microsoft\Windows\CurrentVersion\Explorer\Br

owser Helper

Objects\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

failed!
Status: 0xc0000034



Registry key

HKLM\Softare\Microsoft\Windows\CurrentVersion\Explorer\Br

owser Helper

Objects\{55EA1964-F5E4-4D6A-B9B2-125B37655FCB} not

found!
Deletion of registry key

HKLM\Softare\Microsoft\Windows\CurrentVersion\Explorer\Br

owser Helper

Objects\{55EA1964-F5E4-4D6A-B9B2-125B37655FCB}

failed!
Status: 0xc0000034


Completed script processing.

*******************

Finished! Terminate.