TR/Crypt.XPACK.Gen come eliminarlo?

[mauri1974]

Non riesco a scaricare combofix.
Mi si è aperta una finestra di windows dove mi dice che è impossibile aprire il file: nircmd.cfxxe

Per aprire il file occorre indicare il programma con cui è stato creato. E' possibile eseguire una ricerca automatica sul web.....

mi lascia due opzioni:

Utilizza il servizio di ricerca sul web ........

seleziona il programma da 1 elenco

Mi ha bloccato il computer e ho dovuto resettare perchè non mi andava più avanti...

Spero che ci sia qualcuno stamattina che mi possa aiutare, perchè il computer è il server di un internet point e ho tutto bloccato.... grazie !!

[gahan]

Ciao,
esegui prima Malwarebytes come descritto sopra

[gahan]

Successivamente scarica combofix in questo modo:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

prima di salvarlo sul desktop rinomina il file in abc.exe
Una volta scaricato il programma, clicca su start --> esegui --> nel box bianco copia e incolla questo comando, virgolette comprese:

"%userprofile%\desktop\abc.exe" /killall

Premi OK...lascia lavorare il programma senza interferire
A fine scansione verrà rilasciato un rapporto situato in C:\ComboFix.txt dove sono contenute tutte le operazioni di rimozione effettuate.
Posta il log qui sul forum.

[mauri1974]

Ecco il risultato della scansione malwarebytes:
Malwarebytes' Anti-Malware 1.44
Versione del database: 3560
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

18/01/2010 11.00.22
mbam-log-2010-01-18 (11-00-22).txt

Tipo di scansione: Scansione completa (A:\|C:\|D:\|E:\|F:\|G:\|H:\|J:\|)
Elementi scansionati: 142083
Tempo trascorso: 13 minute(s), 47 second(s)

Processi delle memoria infetti: 0
Moduli della memoria infetti: 0
Chiavi di registro infette: 0
Valori di registro infetti: 0
Elementi dato del registro infetti: 0
Cartelle infette: 0
File infetti: 3

Processi delle memoria infetti:
(Nessun elemento malevolo rilevato)

Moduli della memoria infetti:
(Nessun elemento malevolo rilevato)

Chiavi di registro infette:
(Nessun elemento malevolo rilevato)

Valori di registro infetti:
(Nessun elemento malevolo rilevato)

Elementi dato del registro infetti:
(Nessun elemento malevolo rilevato)

Cartelle infette:
(Nessun elemento malevolo rilevato)

File infetti:
C:\32788R22FWJFW\Combo-Fix.sys (Malware.Trace) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{CCECFB43-0799-4F87-A932-841E72594C38}\RP304\A0032085.sys (Malware.Trace) -> Quarantined and deleted successfully.
J:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx (Trojan.Agent) -> Quarantined and deleted successfully.

[mauri1974]

Ho scaricato il file abc.exe
Soltanto che se inserisco la dicitura dopo start ed esegui "%userprofile%\desktop\abc.exe" /killall nello spazio
bianco mi si apre una finestra con la x rossa che dice:
C:/Documents and Settings/admin/desktop/abc.exe
Impossibile trovare il file. Verificare il percorso o il nome del file che siano corretti. Per cercare un file fare clic sul pulsante start e poi trova

Ma capitano tutte a me ???
Scusa se ti rompo, ma sono veramente incasinato .....

[gahan]

Hai salvato combofix (abc.exe) sul desktop?

[mauri1974]

Risultato combofix da allegato log che mi si è aperto da solo.


ComboFix 10-01-17.02 - Admin 18/01/2010 12.00.56.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.39.1040.18.446.266 [GMT 1:00]
Eseguito da: c:\documents and settings\Admin\desktop\abc.exe
Opzioni usate :: /killall
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {00000002-0002-0000-6C25-9E7C08000A00}

ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\mswins.sys

.
((((((((((((((((((((((((( Files Creati Da 2009-12-18 al 2010-01-18 )))))))))))))))))))))))))))))))))))
.

2010-01-16 10:28 . 2010-01-16 10:28 -------- d-----w- c:\documents and settings\User\Dati applicazioni\Yahoo!
2010-01-14 15:12 . 2010-01-14 15:38 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Yahoo! Companion
2010-01-14 15:12 . 2010-01-14 15:12 -------- d-----w- c:\documents and settings\Admin\Dati applicazioni\Yahoo!
2010-01-14 15:12 . 2010-01-14 15:12 -------- d-----w- c:\programmi\Yahoo!
2010-01-14 15:12 . 2010-01-14 15:12 -------- d-----w- c:\programmi\CCleaner
2010-01-14 15:09 . 2010-01-14 15:09 -------- d-----w- c:\programmi\Trend Micro
2010-01-14 14:08 . 2010-01-14 14:08 -------- d-----w- c:\documents and settings\Admin\Dati applicazioni\Malwarebytes
2010-01-14 14:08 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-14 14:08 . 2010-01-14 14:08 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Malwarebytes
2010-01-14 14:08 . 2010-01-14 14:08 -------- d-----w- c:\programmi\Malwarebytes' Anti-Malware
2010-01-14 14:08 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-13 18:01 . 2003-03-18 19:14 499712 ----a-w- c:\windows\system32\MSVCP71.dll
2010-01-13 18:01 . 2010-01-13 18:01 -------- d-----w- c:\programmi\Alwil Software
2010-01-11 10:57 . 2010-01-11 11:00 -------- d-----w- c:\documents and settings\Admin\Impostazioni locali\Dati applicazioni\Temp
2010-01-11 10:57 . 2010-01-11 11:00 -------- d-----w- c:\documents and settings\Admin\Impostazioni locali\Dati applicazioni\Google

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-18 11:08 . 2009-03-26 18:52 -------- d-----w- c:\documents and settings\Admin\Dati applicazioni\Skype
2010-01-18 09:41 . 2009-11-13 13:02 79488 ----a-w- c:\documents and settings\Admin\Dati applicazioni\Sun\Java\jre1.6.0_17\gtapi.dll
2010-01-16 10:33 . 2009-11-14 06:46 79488 ----a-w- c:\documents and settings\User\Dati applicazioni\Sun\Java\jre1.6.0_17\gtapi.dll
2010-01-14 16:04 . 2009-03-31 13:49 1 ----a-w- c:\documents and settings\Admin\Dati applicazioni\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-01-14 11:26 . 2009-05-09 09:24 -------- d-----w- c:\programmi\Mozilla Thunderbird
2010-01-11 10:44 . 2009-11-09 13:59 441921 --sha-w- c:\windows\system32\mswins.DLL
2009-12-14 12:30 . 2009-12-14 12:30 -------- d-----w- c:\programmi\Avira
2009-12-14 12:30 . 2009-12-14 12:30 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Avira
2009-12-10 23:47 . 2009-05-01 20:35 -------- d-----w- c:\programmi\PokerStars.IT
2009-11-25 13:59 . 2009-11-25 13:59 -------- d-----w- c:\programmi\Google
2009-11-25 10:19 . 2009-12-14 12:31 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-10-25 09:03 . 2008-04-14 12:00 47592 ----a-w- c:\windows\system32\perfc010.dat
2009-10-25 09:03 . 2008-04-14 12:00 345010 ----a-w- c:\windows\system32\perfh010.dat
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\programmi\Skype\Phone\Skype.exe" [2009-03-11 24095528]
"msnmsgr"="c:\programmi\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"Google Update"="c:\documents and settings\Admin\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe" [2010-01-11 135664]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-31 7634944]
"nwiz"="nwiz.exe" [2006-10-31 1622016]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-31 86016]
"RTHDCPL"="RTHDCPL.EXE" [2009-02-03 18085888]
"SSBkgdUpdate"="c:\programmi\File comuni\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"PaperPort PTD"="c:\programmi\ScanSoft\PaperPort\pptd40nt.exe" [2007-10-11 29984]
"IndexSearch"="c:\programmi\ScanSoft\PaperPort\IndexSearch.exe" [2007-10-11 46368]
"PPort11reminder"="c:\programmi\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-08-31 328992]
"BrMfcWnd"="c:\programmi\Brother\Brmfcmon\BrMfcWnd.exe" [2007-11-05 741376]
"ControlCenter3"="c:\programmi\Brother\ControlCenter3\brctrcen.exe" [2007-10-30 77824]
"SunJavaUpdateSched"="c:\programmi\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"avgnt"="c:\programmi\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Admin\Menu Avvio\Programmi\Esecuzione automatica\
OpenOffice.org 3.0.lnk - c:\programmi\OpenOffice.org 3\program\quickstart.exe [2008-12-15 384000]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
"c:\\Programmi\\Java\\jre6\\bin\\java.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programmi\\Skype\\Phone\\Skype.exe"=

R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [17/02/2009 9.41.44 13696]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [17/02/2009 15.27.53 1684736]
.
Contenuto della cartella 'Scheduled Tasks'

2010-01-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2025429265-1004336348-1417001333-1003Core.job
- c:\documents and settings\Admin\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe [2010-01-11 10:57]

2010-01-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2025429265-1004336348-1417001333-1003UA.job
- c:\documents and settings\Admin\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe [2010-01-11 10:57]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
IE: {{C4046502-6524-4d87-896C-878F57D1FF07} - c:\programmi\PokerStars.IT\PokerStarsUpdate.exe
.
.
------- Associazioni dei file -------
.
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-18 12:07
Windows 5.1.2600 Service Pack 3 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\programmi\Avira\AntiVir Desktop\sched.exe
c:\programmi\Avira\AntiVir Desktop\avguard.exe
c:\programmi\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
c:\programmi\Java\jre6\bin\jqs.exe
c:\programmi\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
c:\windows\system32\nvsvc32.exe
c:\programmi\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
c:\programmi\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\RTHDCPL.EXE
c:\programmi\Brother\ControlCenter3\brccMCtl.exe
c:\programmi\Brother\Brmfcmon\BrMfcmon.exe
c:\programmi\OpenOffice.org 3\program\soffice.exe
c:\programmi\OpenOffice.org 3\program\soffice.bin
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Ora fine scansione: 2010-01-18 12:12:27 - Il pc è stato riavviato
ComboFix-quarantined-files.txt 2010-01-18 11:12

Pre-Run: 74.502.963.200 byte disponibili
Post-Run: 74.492.530.688 byte disponibili

- - End Of File - - 3E76A152D24AD84EF22A5F226E6EBF9E

[gahan]

Apri un file di testo (blocco note), ed inserisci il seguente script:

Codice: Seleziona tutto

files::
c:\windows\system32\mswins.DLL

salva il file sul desktop (posizione nella quale hai salvato ComboFix) chiamandolo

obbligatoriamente CFScript.txt,
quindi con il tasto sinistro del mouse trascina il file sull'icona di combofix.

Il programma effettuerà una nuova scansione....attendi la fine senza fare nulla e al termine

riavvia il PC (dovrebbe farlo in automatico).
Posta sul forum il nuovo log situato sempre in c:\combofix.txt.

[gahan]

scusami, avevo messo di nuovo una s di troppo

Codice: Seleziona tutto

file::
c:\windows\system32\mswins.DLL

[mauri1974]

Eccolo:

ComboFix 10-01-17.02 - Admin 18/01/2010 13.31.34.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.39.1040.18.446.203 [GMT 1:00]
Eseguito da: c:\documents and settings\Admin\Desktop\abc.exe
Opzioni usate :: c:\documents and settings\Admin\Desktop\CFScript.txt,.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {00000002-0002-0000-6C25-9E7C08000A00}

FILE ::
"c:\windows\system32\mswins.DLL"
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\mswins.DLL

.
((((((((((((((((((((((((( Files Creati Da 2009-12-18 al 2010-01-18 )))))))))))))))))))))))))))))))))))
.

2010-01-18 10:59 . 2010-01-18 11:12 -------- d-----w- C:\abc
2010-01-16 10:28 . 2010-01-16 10:28 -------- d-----w- c:\documents and settings\User\Dati applicazioni\Yahoo!
2010-01-14 15:12 . 2010-01-14 15:38 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Yahoo! Companion
2010-01-14 15:12 . 2010-01-14 15:12 -------- d-----w- c:\documents and settings\Admin\Dati applicazioni\Yahoo!
2010-01-14 15:12 . 2010-01-14 15:12 -------- d-----w- c:\programmi\Yahoo!
2010-01-14 15:12 . 2010-01-14 15:12 -------- d-----w- c:\programmi\CCleaner
2010-01-14 15:09 . 2010-01-14 15:09 -------- d-----w- c:\programmi\Trend Micro
2010-01-14 14:08 . 2010-01-14 14:08 -------- d-----w- c:\documents and settings\Admin\Dati applicazioni\Malwarebytes
2010-01-14 14:08 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-14 14:08 . 2010-01-14 14:08 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Malwarebytes
2010-01-14 14:08 . 2010-01-14 14:08 -------- d-----w- c:\programmi\Malwarebytes' Anti-Malware
2010-01-14 14:08 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-13 18:01 . 2003-03-18 19:14 499712 ----a-w- c:\windows\system32\MSVCP71.dll
2010-01-13 18:01 . 2010-01-13 18:01 -------- d-----w- c:\programmi\Alwil Software
2010-01-11 10:57 . 2010-01-11 11:00 -------- d-----w- c:\documents and settings\Admin\Impostazioni locali\Dati applicazioni\Temp
2010-01-11 10:57 . 2010-01-11 11:00 -------- d-----w- c:\documents and settings\Admin\Impostazioni locali\Dati applicazioni\Google

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-18 12:24 . 2009-03-26 18:52 -------- d-----w- c:\documents and settings\Admin\Dati applicazioni\Skype
2010-01-18 09:41 . 2009-11-13 13:02 79488 ----a-w- c:\documents and settings\Admin\Dati applicazioni\Sun\Java\jre1.6.0_17\gtapi.dll
2010-01-16 10:33 . 2009-11-14 06:46 79488 ----a-w- c:\documents and settings\User\Dati applicazioni\Sun\Java\jre1.6.0_17\gtapi.dll
2010-01-14 16:04 . 2009-03-31 13:49 1 ----a-w- c:\documents and settings\Admin\Dati applicazioni\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-01-14 11:26 . 2009-05-09 09:24 -------- d-----w- c:\programmi\Mozilla Thunderbird
2009-12-14 12:30 . 2009-12-14 12:30 -------- d-----w- c:\programmi\Avira
2009-12-14 12:30 . 2009-12-14 12:30 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Avira
2009-12-10 23:47 . 2009-05-01 20:35 -------- d-----w- c:\programmi\PokerStars.IT
2009-11-25 13:59 . 2009-11-25 13:59 -------- d-----w- c:\programmi\Google
2009-11-25 10:19 . 2009-12-14 12:31 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-10-25 09:03 . 2008-04-14 12:00 47592 ----a-w- c:\windows\system32\perfc010.dat
2009-10-25 09:03 . 2008-04-14 12:00 345010 ----a-w- c:\windows\system32\perfh010.dat
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\programmi\Skype\Phone\Skype.exe" [2009-03-11 24095528]
"msnmsgr"="c:\programmi\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"Google Update"="c:\documents and settings\Admin\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe" [2010-01-11 135664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-31 7634944]
"nwiz"="nwiz.exe" [2006-10-31 1622016]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-31 86016]
"RTHDCPL"="RTHDCPL.EXE" [2009-02-03 18085888]
"SSBkgdUpdate"="c:\programmi\File comuni\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"PaperPort PTD"="c:\programmi\ScanSoft\PaperPort\pptd40nt.exe" [2007-10-11 29984]
"IndexSearch"="c:\programmi\ScanSoft\PaperPort\IndexSearch.exe" [2007-10-11 46368]
"PPort11reminder"="c:\programmi\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-08-31 328992]
"BrMfcWnd"="c:\programmi\Brother\Brmfcmon\BrMfcWnd.exe" [2007-11-05 741376]
"ControlCenter3"="c:\programmi\Brother\ControlCenter3\brctrcen.exe" [2007-10-30 77824]
"SunJavaUpdateSched"="c:\programmi\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"avgnt"="c:\programmi\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Admin\Menu Avvio\Programmi\Esecuzione automatica\
OpenOffice.org 3.0.lnk - c:\programmi\OpenOffice.org 3\program\quickstart.exe [2008-12-15 384000]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
"c:\\Programmi\\Java\\jre6\\bin\\java.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programmi\\Skype\\Phone\\Skype.exe"=

R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [17/02/2009 9.41.44 13696]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [17/02/2009 15.27.53 1684736]
.
Contenuto della cartella 'Scheduled Tasks'

2010-01-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2025429265-1004336348-1417001333-1003Core.job
- c:\documents and settings\Admin\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe [2010-01-11 10:57]

2010-01-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2025429265-1004336348-1417001333-1003UA.job
- c:\documents and settings\Admin\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe [2010-01-11 10:57]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
IE: {{C4046502-6524-4d87-896C-878F57D1FF07} - c:\programmi\PokerStars.IT\PokerStarsUpdate.exe
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-18 13:35
Windows 5.1.2600 Service Pack 3 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
Ora fine scansione: 2010-01-18 13:36:59
ComboFix-quarantined-files.txt 2010-01-18 12:36
ComboFix2.txt 2010-01-18 11:12

Pre-Run: 74.482.667.520 byte disponibili
Post-Run: 74.476.216.320 byte disponibili

WindowsXP-KB310994-SP2-Pro-BootDisk-ITA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 5D195E64E1687EC3943C5052FC4E00C4

[gahan]

Adesso esegui CCleaner e fai una pulizia seguendo le istruzioni di cui sopra.

[mauri1974]

Sembra tutto ok.
Cosa posso fare per essere tranquillo, basta una scansione con avira o mi consiglia qualcos' altro ???
Intanto oltre a ringraziarti volevo dirti che ho un altro computer da verificare forse con un virus diverso....
che mi consigli ???
Intanto mille grazieeeeeeee !!!!!

[gahan]

Di niente,

posta qui il log di HijackThis dell'altro PC

[mauri1974]

Scusa il ritardo .. non dipendeva da me !
Eccolo:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15.14.18, on 18/01/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20772)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Programmi\HyperTechnologies\Deep Freeze\DfServEx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Programmi\Java\jre6\bin\jqs.exe
C:\Programmi\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\Programmi\HyperTechnologies\Deep Freeze\_$Df\FrzState.exe
C:\Programmi\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programmi\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\WINDOWS\system32\winlogon.exe
C:\Programmi\HyperTechnologies\Deep Freeze\_$Df\FrzState.exe
C:\Programmi\Java\jre6\bin\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Programmi\CyberLink\PowerDVD8\PDVD8Serv.exe
C:\Programmi\Cyberlink\Shared Files\brs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\explorer.exe
C:\Programmi\Yahoo!\Messenger\ymsgr_tray.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://it.rd.yahoo.com/customize/ie/def ... .yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.icmsoft.com/myhome.asp?cl=02 ... 0915021201
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://it.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://it.rd.yahoo.com/customize/ie/def ... .yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://it.rd.yahoo.com/customize/ie/def ... .yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.ez-tracks.com/?fromOMB=1
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://it.rd.yahoo.com/customize/ie/def ... .yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre6\bin\ssv.dll
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmi\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O2 - BHO: Ask Toolbar BHO - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - C:\Programmi\AskTBar\bar\1.bin\ASKTBAR.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - C:\Programmi\AskTBar\bar\1.bin\ASKTBAR.DLL
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Media Codec Update Service] C:\Programmi\Essentials Codec Pack\update.exe -silent
O4 - HKLM\..\Run: [RemoteControl8] C:\Programmi\CyberLink\PowerDVD8\PDVD8Serv.exe
O4 - HKLM\..\Run: [PDVD8LanguageShortcut] C:\Programmi\CyberLink\PowerDVD8\Language\Language.exe
O4 - HKLM\..\Run: [BDRegion] C:\Programmi\Cyberlink\Shared Files\brs.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Programmi\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [ICMClient] C:\Programmi\ICMClient\ICMClient.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Programmi\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmi\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [AdobeUpdater] "C:\Programmi\File comuni\Adobe\Updater5\AdobeUpdater.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-21-448539723-2146991089-1801674531-1005\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'User')
O4 - HKUS\S-1-5-21-448539723-2146991089-1801674531-1005\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe -p (User 'User')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD5/JSCDL/ ... 586-jc.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol ... _en_dl.cab
O20 - Winlogon Notify: DfLogon - C:\WINDOWS\SYSTEM32\LogonDll.dll
O23 - Service: DFServEx - Hyper Technologies Inc. - C:\Programmi\HyperTechnologies\Deep Freeze\DfServEx.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Programmi\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmi\Java\jre6\bin\jqs.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Programmi\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Programmi\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 8557 bytes

[mauri1974]

Risposta scasione MALWAREBYTES:

Malwarebytes' Anti-Malware 1.44
Versione del database: 3588
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

18/01/2010 16.06.32
mbam-log-2010-01-18 (16-06-31).txt

Tipo di scansione: Scansione completa (C:\|D:\|)
Elementi scansionati: 164547
Tempo trascorso: 23 minute(s), 22 second(s)

Processi delle memoria infetti: 0
Moduli della memoria infetti: 0
Chiavi di registro infette: 1
Valori di registro infetti: 0
Elementi dato del registro infetti: 3
Cartelle infette: 0
File infetti: 0

Processi delle memoria infetti:
(Nessun elemento malevolo rilevato)

Moduli della memoria infetti:
(Nessun elemento malevolo rilevato)

Chiavi di registro infette:
HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Valori di registro infetti:
(Nessun elemento malevolo rilevato)

Elementi dato del registro infetti:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Cartelle infette:
(Nessun elemento malevolo rilevato)

File infetti:
(Nessun elemento malevolo rilevato)

[mauri1974]

Report combofix:

ComboFix 10-01-17.02 - Admin 18/01/2010 16.29.13.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.39.1040.18.382.144 [GMT 1:00]
Eseguito da: c:\documents and settings\Admin\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\User\Desktop\EZ-Tracks.com.lnk

.
((((((((((((((((((((((((( Files Creati Da 2009-12-18 al 2010-01-18 )))))))))))))))))))))))))))))))))))
.

2010-01-18 15:23 . 2010-01-18 15:23 -------- d-----w- c:\programmi\CCleaner
2010-01-18 15:20 . 2010-01-18 15:20 79488 ----a-w- c:\documents and settings\Admin\Dati applicazioni\Sun\Java\jre1.6.0_17\gtapi.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-18 15:12 . 2001-08-31 11:00 72884 ----a-w- c:\windows\system32\perfc010.dat
2010-01-18 15:12 . 2001-08-31 11:00 446384 ----a-w- c:\windows\system32\perfh010.dat
2010-01-18 15:11 . 2009-02-06 17:53 7372288 ----a-w- C:\Persi0.sys
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Messenger (Yahoo!)"="c:\programmi\Yahoo!\Messenger\YahooMessenger.exe" [2009-02-04 4363504]
"msnmsgr"="c:\programmi\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"AdobeUpdater"="c:\programmi\File comuni\Adobe\Updater5\AdobeUpdater.exe" [2009-08-05 2356088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\programmi\Java\jre6\bin\jusched.exe" [2009-02-06 136600]
"RTHDCPL"="RTHDCPL.EXE" [2007-10-16 16855552]
"SkyTel"="SkyTel.EXE" [2007-10-11 1826816]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-31 7634944]
"nwiz"="nwiz.exe" [2006-10-31 1622016]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-31 86016]
"Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"Media Codec Update Service"="c:\programmi\Essentials Codec Pack\update.exe" [2007-04-08 303104]
"RemoteControl8"="c:\programmi\CyberLink\PowerDVD8\PDVD8Serv.exe" [2008-03-20 83240]
"PDVD8LanguageShortcut"="c:\programmi\CyberLink\PowerDVD8\Language\Language.exe" [2007-12-14 50472]
"BDRegion"="c:\programmi\Cyberlink\Shared Files\brs.exe" [2008-03-21 91432]
"ICMClient"="c:\programmi\ICMClient\ICMClient.exe" [2008-05-09 286720]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DfLogon]
2002-08-26 10:17 49152 ----a-w- c:\windows\system32\LogonDll.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
"c:\\Programmi\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Programmi\\ICMClient\\ICMClient.exe"=
"c:\\Programmi\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Programmi\\Java\\jre6\\bin\\java.exe"=
"c:\\Programmi\\Messenger\\msmsgs.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5432:TCP"= 5432:TCP:EgestioneServer

R0 DepFrzHi;DepFrzHi;c:\windows\system32\drivers\DepFrzHi.sys [26/08/2002 11.16.12 12288]
R0 DepFrzLo;DepFrzLo;c:\windows\system32\drivers\DepFrzLo.sys [26/08/2002 11.15.54 52709]
R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [24/09/2008 15.57.40 13696]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};c:\programmi\CyberLink\PowerDVD8\000.fcl [01/02/2008 16.24.04 41456]
S3 ZD1211BU(TP-LINK);TL-WN322G/WN322G+ Wireless USB Adapter Driver(TP-LINK);c:\windows\system32\drivers\ZD1211BU.sys [06/02/2009 17.22.25 500736]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.icmsoft.com/myhome.asp?cl=02 ... 0915021201
mStart Page = hxxp://home.ez-tracks.com/?fromOMB=1
uSearchURL,(Default) = hxxp://it.rd.yahoo.com/customize/ie/def ... .yahoo.com
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Admin\Dati applicazioni\Mozilla\Firefox\Profiles\1ag6za8t.default\

---- FIREFOX POLICIES ----
c:\programmi\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDFE0BD779-44EE-4A4B-AA2E-743C63F2E5E6", "AllAccess");
.
- - - - CHIAVI ORFANE RIMOSSE - - - -

HKLM-Run-NBKeyScan - c:\programmi\Nero\Nero8\Nero BackItUp\NBKeyScan.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-18 16:32
Windows 5.1.2600 Service Pack 3 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}]
"ImagePath"="\??\c:\programmi\CyberLink\PowerDVD8\000.fcl"
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------

- - - - - - - > 'winlogon.exe'(676)
c:\windows\system32\LogonDll.dll
.
Ora fine scansione: 2010-01-18 16:34:32
ComboFix-quarantined-files.txt 2010-01-18 15:34

Pre-Run: 71.040.012.288 byte disponibili
Post-Run: 71.838.203.904 byte disponibili

WindowsXP-KB310994-SP2-Pro-BootDisk-ITA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 063AD1FDF8A3F267E849B34D2AC0A105

[gahan]

Il log è apposto.

Esegui anche su questo PC la pulizia con CCleaner.

[mauri1974]

Ho fatto anche la pulizia con cleaner sull' ultimo computer...
Soltanto una cosa....
Nel primo computer di ieri ho provato a fare una scansione con avira antivirus e non mi ha trovato niente, poi per una mia sicurezza totale l'ho fatto anche con avast perchè il primo computer è il server dell' internet point e volevo essere tranquillo... soltanto che mi si aprte la finestra con il virus TR/Crypt.XPACK.Gen
Lo sposto in quarantena, ma ogni volta che faccio la scansione con l'antivirus mi riviene fuori .........
Che dici ??????

[gahan]

Allora, ti consiglio innanzitutto di disinstallare un antivirus e di lasciarne solo uno installato sul tuo PC, perchè potrebbero andare in conflitto.

[mauri1974]

Ho disinstallato avira e stavolta avast non ha trovato nulla !!
Dovrei essere a posto.....
Ultima cosa e scusa se ti stresso ancora.........
In un computer che non mi ha mai dato problemi ho fatto una scansione con avira e mi ha trovato un virus denominato TR/Fake.scanspyware.A ... per risolvere anche questo problema seguo tutti i procedimenti di cui sopra e ti posso postare i risultati ????
Grazie ancora gahan !!
Alla fine mi dici cosa ci guadagni a risolvere i problemi di tutti per tutti i santi giorni !!!