"Si è verificato un errore in symlcsvc.exe. L'applicazione verrà chiusa."
Allego il log dello scan del Roottkit e dell'Autostart effettuati con gmer.
---
GMER 1.0.10.10122 - http://www.gmer.net
Rootkit 2006-09-15 12:04:05
Windows 5.1.2600 Service Pack 2
---- System - GMER 1.0.10 ----
SSDT 86DEC948 ZwAlertResumeThread
SSDT 86DEEC28 ZwAlertThread
SSDT 86E0D110 ZwAllocateVirtualMemory
SSDT 86BDFBC0 ZwConnectPort
SSDT \??\C:\Programmi\Symantec\SYMEVENT.SYS ZwCreateKey
SSDT 86CB9D38 ZwCreateMutant
SSDT 86EE3138 ZwCreateThread
SSDT \??\C:\Programmi\Symantec\SYMEVENT.SYS ZwDeleteKey
SSDT \??\C:\Programmi\Symantec\SYMEVENT.SYS ZwDeleteValueKey
SSDT 86E8B2C0 ZwFreeVirtualMemory
SSDT 86CB9D70 ZwImpersonateAnonymousToken
SSDT 86DED688 ZwImpersonateThread
SSDT 86DEE8E0 ZwMapViewOfSection
SSDT 86D65240 ZwOpenEvent
SSDT 86DB3F40 ZwOpenProcessToken
SSDT 86EE4748 ZwOpenThreadToken
SSDT 86ED2608 ZwQueryValueKey
SSDT 86DB6BF0 ZwResumeThread
SSDT 86F23560 ZwSetContextThread
SSDT 86F62CC8 ZwSetInformationProcess
SSDT 86C4E498 ZwSetInformationThread
SSDT \??\C:\Programmi\Symantec\SYMEVENT.SYS ZwSetValueKey
SSDT 86D65208 ZwSuspendProcess
SSDT 86DF8E70 ZwSuspendThread
SSDT 86EA9548 ZwTerminateProcess
SSDT 86C5C560 ZwTerminateThread
SSDT 86F629C8 ZwUnmapViewOfSection
SSDT 86CC4780 ZwWriteVirtualMemory
---- Processes - GMER 1.0.10 ----
Library C:\WINDOWS\ohljx1.dll (*** hidden *** ) @ C:\WINDOWS\Explorer.EXE [880] 0x04DB0000 <-- ROOTKIT !!!
---- Files - GMER 1.0.10 ----
File C:\MIGRA\adaware\aaw6181.exe
File C:\MIGRA\adaware\reflist.ref
File C:\MIGRA\adaware\reflist.zip
File C:\MIGRA\palladio\DISK1
File C:\MIGRA\palladio\HSFINST.DLL
File C:\MIGRA\palladio\HXFsetup.exe
File C:\MIGRA\palladio\InstPalUsbV92.txt
File C:\MIGRA\palladio\MdmXSdk.dll
File C:\MIGRA\palladio\MDMXSDK.SYS
File C:\MIGRA\palladio\PallUsbV92301.zip
File C:\MIGRA\palladio\UXpPal92.cat
File C:\MIGRA\palladio\UXpPal92.CTY
File C:\MIGRA\palladio\UXpPal92.inf
File C:\MIGRA\palladio\WINACUSB.SYS
File C:\MIGRA\ue10_20\dictam.gip
File C:\MIGRA\ue10_20\uesetup.exe
File C:\MIGRA\ue10_20\ue_english.gip
File C:\System Volume Information\MountPointManagerRemoteDatabase
File C:\System Volume Information\tracking.log
File C:\System Volume Information\_restore{AB2E20B0-3BC2-46C8-8A1F-D8891E10C9FD}
File C:\WINDOWS\ohljx1.dll
File C:\WINDOWS\system32\lpt2.ibt
---- EOF - GMER 1.0.10 ----
GMER 1.0.10.10122 - http://www.gmer.net
Autostart 2006-09-15 12:05:53
Windows 5.1.2600 Service Pack 2
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems@Windows = %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon@Userinit = C:\WINDOWS\system32\userinit.exe,
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ >>>
igfxcui@DLLName = igfxsrvc.dll
WgaLogon@DLLName = WgaLogon.dll
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows@AppInit_DLLs = \\?\C:\WINDOWS\System32\lpt2.ibt
HKLM\SYSTEM\CurrentControlSet\Services\ >>>
AntiVirScheduler /*AntiVir PersonalEdition Classic Scheduler*/@ = C:\Programmi\AntiVir PersonalEdition Classic\sched.exe
AntiVirService /*AntiVir PersonalEdition Classic Guard*/@ = C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe
Ati HotKey Poller@ = %SystemRoot%\System32\Ati2evxx.exe
btwdins /*Bluetooth Service*/@ = C:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe
ccEvtMgr /*Symantec Event Manager*/@ = "C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe"
ccSetMgr /*Symantec Settings Manager*/@ = "C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe"
LogVof /*LogVof*/@ = "C:\Programmi\File comuni\System\wAg.exe"
navapsvc /*Servizio Auto-Protect di Norton AntiVirus*/@ = "C:\Programmi\Norton AntiVirus\navapsvc.exe"
NPFMntor /*Norton AntiVirus Firewall Monitor Service*/@ = "C:\Programmi\Norton AntiVirus\IWP\NPFMntor.exe"
OracleMTSRecoveryService /*OracleMTSRecoveryService*/@ = C:\oraclexe\app\oracle\product\10.2.0\server\bin\omtsreco.exe OracleMTSRecoveryService /*file not found*/
ScsiPort@ = %SystemRoot%\system32\drivers\scsiport.sys
SNDSrvc /*Symantec Network Drivers Service*/@ = "C:\Programmi\File comuni\Symantec Shared\SNDSrvc.exe"
SoundMAX Agent Service (default) /*SoundMAX Agent Service*/@ = C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
SPBBCSvc /*SPBBCSvc*/@ = "C:\Programmi\File comuni\Symantec Shared\SPBBC\SPBBCSvc.exe"
Spooler /*Spooler di stampa*/@ = %SystemRoot%\system32\spoolsv.exe
Symantec Core LC /*Symantec Core LC*/@ = C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe
Utilità di pianificazione di LiveUpdate automatico /*Utilità di pianificazione di LiveUpdate automatico*/@ = "C:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe"
WinDefend /*Windows Defender Service*/@ = "C:\Programmi\Windows Defender\MsMpEng.exe"
HKLM\Software\Microsoft\Windows\CurrentVersion\Run >>>
@IgfxTrayC:\WINDOWS\System32\igfxtray.exe = C:\WINDOWS\System32\igfxtray.exe
@HotKeysCmdsC:\WINDOWS\System32\hkcmd.exe = C:\WINDOWS\System32\hkcmd.exe
@SmappC:\Programmi\Analog Devices\SoundMAX\SMTray.exe = C:\Programmi\Analog Devices\SoundMAX\SMTray.exe
@DrvLsnrC:\Programmi\Analog Devices\SoundMAX\DrvLsnr.exe = C:\Programmi\Analog Devices\SoundMAX\DrvLsnr.exe
@srmcleanC:\Cpqs\Scom\srmclean.exe = C:\Cpqs\Scom\srmclean.exe
@SetRefreshC:\Programmi\Compaq\SetRefresh\SetRefresh.exe = C:\Programmi\Compaq\SetRefresh\SetRefresh.exe
@CPQEASYACCC:\Programmi\COMPAQ\Easy Access Button Support\StartEAK.exe = C:\Programmi\COMPAQ\Easy Access Button Support\StartEAK.exe
@QuickTime Task"C:\Programmi\QuickTime\qttask.exe" -atboottime = "C:\Programmi\QuickTime\qttask.exe" -atboottime
@HP Network Registry AgentC:\WINDOWS\System32\hpnra.exe = C:\WINDOWS\System32\hpnra.exe
@helpw"helpw.exe" /*file not found*/ = "helpw.exe" /*file not found*/
@NeroFilterCheckC:\WINDOWS\system32\NeroCheck.exe = C:\WINDOWS\system32\NeroCheck.exe
@SunJavaUpdateSched"C:\Programmi\Java\jre1.5.0_08\bin\jusched.exe" = "C:\Programmi\Java\jre1.5.0_08\bin\jusched.exe"
@TkBellExe"C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot = "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
@ccApp"C:\Programmi\File comuni\Symantec Shared\ccApp.exe" = "C:\Programmi\File comuni\Symantec Shared\ccApp.exe"
@NAV CfgWiz"C:\Programmi\Norton AntiVirus\CfgWiz.exe" /GUID {0D7956A2-5A08-4ec2-A72C-DF8495A66016} /MODE CfgWiz /CMDLINE "REBOOT" = "C:\Programmi\Norton AntiVirus\CfgWiz.exe" /GUID {0D7956A2-5A08-4ec2-A72C-DF8495A66016} /MODE CfgWiz /CMDLINE "REBOOT"
@avgnt"C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe" /min = "C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe" /min
@Windows Defender"C:\Programmi\Windows Defender\MSASCui.exe" -hide = "C:\Programmi\Windows Defender\MSASCui.exe" -hide
HKCU\Software\Microsoft\Windows\CurrentVersion\Run >>>
@CTFMON.EXEC:\WINDOWS\system32\ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe
@MSMSGS"C:\Programmi\Messenger\msmsgs.exe" /background = "C:\Programmi\Messenger\msmsgs.exe" /background
@MsnMsgr"C:\Programmi\MSN Messenger\MsnMsgr.Exe" /background /*file not found*/ = "C:\Programmi\MSN Messenger\MsnMsgr.Exe" /background /*file not found*/
@Skype"C:\Programmi\Skype\Phone\Skype.exe" /nosplash /minimized = "C:\Programmi\Skype\Phone\Skype.exe" /nosplash /minimized
HKLM\Software\Classes\.hta@ =
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks@{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} = C:\PROGRA~1\WIFD1F~1\MpShHook.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved >>>
@{596AB062-B4D2-4215-9F74-E9109B0A8153} /*Previous Versions Property Page*/C:\WINDOWS\System32\twext.dll = C:\WINDOWS\System32\twext.dll
@{9DB7A13C-F208-4981-8353-73CC61AE2783} /*Previous Versions*/C:\WINDOWS\System32\twext.dll = C:\WINDOWS\System32\twext.dll
@{692F0339-CBAA-47e6-B5B5-3B84DB604E87} /*Extensions Manager Folder*/C:\WINDOWS\System32\extmgr.dll = C:\WINDOWS\System32\extmgr.dll
@{45AC2688-0253-4ED8-97DE-B5370FA7D48A} /*Shell Extension for Malware scanning*/C:\Programmi\AntiVir PersonalEdition Classic\shlext.dll = C:\Programmi\AntiVir PersonalEdition Classic\shlext.dll
HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved@{BDEADF00-C265-11d0-BCED-00A0C90AB50F} /*Cartelle Web*/ = C:\PROGRA~1\FILECO~1
\MICROS~1\WEBFOL~1\MSONSEXT.DLL
HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ >>>
Shell Extension for Malware scanning@{45AC2688-0253-4ED8-97DE-B5370FA7D48A} = C:\Programmi\AntiVir PersonalEdition Classic\shlext.dll
Symantec.Norton.Antivirus.IEContextMenu@{FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} = C:\Programmi\Norton AntiVirus\NavShExt.dll
UltraEdit-32@{b5eedee0-c06e-11cf-8c56-444553540000} = C:\Programmi\UltraEdit\ue32ctmn.dll
WinRAR@{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Programmi\WinRAR\rarext.dll
WinZip@{E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL
WS_FTP@{797F3885-5429-11D4-8823-0050DA59922B} = C:\Programmi\WS_FTP Pro\wsftpsi.dll
HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ >>>
WinRAR@{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Programmi\WinRAR\rarext.dll
WinZip@{E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL
HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ >>>
Shell Extension for Malware scanning@{45AC2688-0253-4ED8-97DE-B5370FA7D48A} = C:\Programmi\AntiVir PersonalEdition Classic\shlext.dll
Symantec.Norton.Antivirus.IEContextMenu@{FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} = C:\Programmi\Norton AntiVirus\NavShExt.dll
WinRAR@{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Programmi\WinRAR\rarext.dll
WinZip@{E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL
WS_FTP@{797F3885-5429-11D4-8823-0050DA59922B} = C:\Programmi\WS_FTP Pro\wsftpsi.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects >>>
@{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx = C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
@{66E85853-A84A-96A9-4209-8BCAF3D52618}C:\WINDOWS\ohljx1.dll = C:\WINDOWS\ohljx1.dll
@{A8F38D8D-E480-4D52-B7A2-731BB6995FDD}C:\Programmi\Norton AntiVirus\NavShExt.dll = C:\Programmi\Norton AntiVirus\NavShExt.dll
@{AA58ED58-01DD-4d91-8333-CF10577473F7}c:\programmi\google\googletoolbar1.dll = c:\programmi\google\googletoolbar1.dll
@{FCFB6CE7-DEFC-BD8C-FDAD-455869D77138}C:\WINDOWS\ohljx1.dll = C:\WINDOWS\ohljx1.dll
HKCU\Control Panel\Desktop@SCRNSAVE.EXE = C:\WINDOWS\System32\ssflwbox.scr
HKLM\Software\Microsoft\Internet Explorer\Main >>>
@Default_Page_URLhttp://www.msn.com/ = http://www.msn.com/
@Start Pagehttp://www.microsoft.com/isapi/redi ... ar=msnhome = http://www.microsoft.com/isapi/redir.dl ... ar=msnhome
@Local Page%SystemRoot%\system32\blank.htm = %SystemRoot%\system32\blank.htm
HKCU\Software\Microsoft\Internet Explorer\Main >>>
@Start Pagehttp://www.libero.it/ = http://www.libero.it/
@Local PageC:\WINDOWS\system32\blank.htm = C:\WINDOWS\system32\blank.htm
HKLM\Software\Classes\PROTOCOLS\Handler\ >>>
dvd@CLSID = C:\WINDOWS\system32\msvidctl.dll
its@CLSID = C:\WINDOWS\System32\itss.dll
mhtml@CLSID = %SystemRoot%\System32\inetcomm.dll
ms-its@CLSID = C:\WINDOWS\System32\itss.dll
qrev@CLSID = C:\PROGRA~1\QUESTS~1\TOAD\RNetPin.dll /*file not found*/
tv@CLSID = C:\WINDOWS\system32\msvidctl.dll
wia@CLSID = C:\WINDOWS\System32\wiascr.dll
widimg@CLSID = C:\WINDOWS\System32\btxppanel.dll
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters@Domain = spes2000
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{0836D02E-AA9E-4E6F-BFA8-719AAC95FDD3} /*Connessione alla rete locale (LAN)*/ >>>
@IPAddress192.168.10.157 = 192.168.10.157
@NameServer192.168.10.100,213.174.160.2 = 192.168.10.100,213.174.160.2
@DefaultGateway192.168.10.254 = 192.168.10.254
@Domain =
C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica >>>
BTTray.lnk = BTTray.lnk
Microsoft Office.lnk = Microsoft Office.lnk
WinZip Quick Pick.lnk = WinZip Quick Pick.lnk
---- EOF - GMER 1.0.10 ----
-