ecco il log di smitfraudfix e gmer (a seguire)
SmitFraudFix v2.97
Scan done at 9.34.22,19, 22/09/2006
Run from C:\Documents and Settings\nicola\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Versione 5.1.2600] - Windows_NT
Fix ran in safe mode
»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{AC1B4DA2-12FA-31F2-1A7D-CD2B14E6AD4E}"="USB Mouse Driver"
»»»»»»»»»»»»»»»»»»»»»»»» Killing process
»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
GenericRenosFix by S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files
C:\uniq Deleted
C:\Programmi\SpywareQuake.com\ Deleted
»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files
»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning
Registry Cleaning done.
»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» End
GMER 1.0.10.10122 -
http://www.gmer.net
Rootkit 2006-09-22 10:08:21
Windows 5.1.2600
---- Devices - GMER 1.0.10 ----
Device \FileSystem\Fastfat \Fat IRP_MJ_CREATE
F3948F08
---- Files - GMER 1.0.10 ----
File C:\System Volume Information\tracking.log
File C:\System Volume
Information\_restore{1FEEB6FD-CFF3-4DAF-8F5E-A1B54B3B351C}
---- EOF - GMER 1.0.10 ----
GMER 1.0.10.10122 -
http://www.gmer.net
Autostart 2006-09-22 10:09:11
Windows 5.1.2600
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems@Windows =
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows
SharedSection=1024,3072,512 Windows=On SubSystemType=Windows
ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3
ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off
MaxRequestThreads=16
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon@Userinit =
C:\WINNT\system32\userinit.exe,
HKLM\Software\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\WRNotifier@DLLName = WRLogonNTF.dll
HKLM\SYSTEM\CurrentControlSet\Services\ >>>
C-DillaCdaC11BA /*C-DillaCdaC11BA*/@ = C:\WINNT\System32\drivers\CDAC11BA.EXE
EPSONStatusAgent2 /*EPSON Printer Status Agent2*/@ = C:\Programmi\File
comuni\EPSON\EBAPI\SAgent2.exe
Fax /*Fax*/@ = %systemroot%\system32\fxssvc.exe
Spooler /*Spooler di stampa*/@ = %SystemRoot%\system32\spoolsv.exe
UMWdf /*Windows User Mode Driver Framework*/@ = C:\WINNT\System32\wdfmgr.exe
UpdDle /*UpdDle*/@ = "C:\Programmi\File comuni\System\Nsf.exe" /*file not
found*/
HKLM\Software\Microsoft\Windows\CurrentVersion\Run >>>
@Synchronization Managermobsync.exe /logon = mobsync.exe /logon
@STICAPC:\Programmi\Trust\WB-3500T USB2 Webcam\SnapTrap.exe =
C:\Programmi\Trust\WB-3500T USB2 Webcam\SnapTrap.exe
@KernelFaultCheck%systemroot%\system32\dumprep 0 -k =
%systemroot%\system32\dumprep 0 -k
@zBrowser LauncherC:\Programmi\Logitech\iTouch\iTouch.exe =
C:\Programmi\Logitech\iTouch\iTouch.exe
@EM_EXECC:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE =
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
@NeroCheckC:\WINNT\system32\NeroCheck.exe = C:\WINNT\system32\NeroCheck.exe
@QuickTime Task"C:\Programmi\QuickTime\qttask.exe" -atboottime =
"C:\Programmi\QuickTime\qttask.exe" -atboottime
@CnxDslTaskBarC:\Programmi\Conexant\AccessRunner ADSL\CnxDslTb.exe =
C:\Programmi\Conexant\AccessRunner ADSL\CnxDslTb.exe
@IMprocessC:\Programmi\Instant Messenger Names\IM-svr.EXE /*file not found*/
= C:\Programmi\Instant Messenger Names\IM-svr.EXE /*file not found*/
HKCU\Software\Microsoft\Windows\CurrentVersion\Run >>>
@MsnMsgr"C:\Programmi\MSN Messenger\MsnMsgr.Exe" /background =
"C:\Programmi\MSN Messenger\MsnMsgr.Exe" /background
@LDMC:\Programmi\Logitech\Desktop
Messenger\8876480\Program\LogitechDesktopMessenger.exe =
C:\Programmi\Logitech\Desktop
Messenger\8876480\Program\LogitechDesktopMessenger.exe
@DW4"C:\Programmi\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
= "C:\Programmi\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
@Skype"C:\Programmi\Skype\Phone\Skype.exe" /nosplash /minimized =
"C:\Programmi\Skype\Phone\Skype.exe" /nosplash /minimized
@swgC:\Programmi\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotif
ier.exe =
C:\Programmi\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.
exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved >>>
@{42071714-76d4-11d1-8b24-00a0c9068ff3} /*Estensione panoramica video del
Pannello di controllo*/deskpan.dll /*file not found*/ = deskpan.dll /*file
not found*/
@{8BEBB290-52D0-11D0-B7F4-00C04FD706EC}
/*Anteprima*/C:\WINNT\System32\thumbvw.dll /*file not found*/ =
C:\WINNT\System32\thumbvw.dll /*file not found*/
@{1AEB1360-5AFC-11D0-B806-00C04FD706EC} /*Programma di estrazione filtri
grafici di Office in anteprima*/C:\WINNT\System32\thumbvw.dll /*file not
found*/ = C:\WINNT\System32\thumbvw.dll /*file not found*/
@{500202A0-731E-11D0-B829-00C04FD706EC} /*LNK file thumbnail interface
delegator*/(null) =
@{fe1290f0-cfbd-11cf-a330-00aa00c16e65} /*Directory Namespace*/(null) =
@{BDEADF00-C265-11D0-BCED-00A0C90AB50F} /*Cartelle
Web*/C:\PROGRA~1\FILECO~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL =
C:\PROGRA~1\FILECO~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
@{0006F045-0000-0000-C000-000000000046} /*Microsoft Outlook Custom Icon
Handler*/C:\Programmi\Microsoft Office\Office10\OLKFSTUB.DLL =
C:\Programmi\Microsoft Office\Office10\OLKFSTUB.DLL
@{42042206-2D85-11D3-8CFF-005004838597} /*Microsoft Office HTML Icon
Handler*/C:\Programmi\Microsoft Office\Office10\msohev.dll =
C:\Programmi\Microsoft Office\Office10\msohev.dll
@{B41DB860-8EE4-11D2-9906-E49FADC173CA} /*WinRAR shell
extension*/C:\Programmi\WinRAR\rarext.dll = C:\Programmi\WinRAR\rarext.dll
@{B4B3001E-0F56-4E51-8250-BDE11547EC55} /*Super Ad Blocker Toolbar*/(null) =
@{AC1DB655-4F9A-4c39-8AD2-A65324A4C446} /*Autodesk Drawing
Preview*/C:\Programmi\File comuni\Autodesk Shared\Thumbnail\AcThumbnail16.dll
= C:\Programmi\File comuni\Autodesk Shared\Thumbnail\AcThumbnail16.dll
@{36A21736-36C2-4C11-8ACB-D4136F2B57BD} /*Gestore icona firma digitale di
AutoCAD*/C:\WINNT\System32\AcSignIcon.dll = C:\WINNT\System32\AcSignIcon.dll
@CorelDRAW Shell Extension Component /*CorelDRAW Shell Extension
Component*/(null) =
@{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D} /*Messenger Sharing
Folders*/C:\Programmi\MSN Messenger\fsshext.8.0.0792.00.dll =
C:\Programmi\MSN Messenger\fsshext.8.0.0792.00.dll
HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ >>>
Symantec.Norton.Antivirus.IEContextMenu@{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2
} = C:\Programmi\Norton AntiVirus\NavShExt.dll /*file not found*/
WinRAR@{B41DB860-8EE4-11D2-9906-E49FADC173CA} =
C:\Programmi\WinRAR\rarext.dll
HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\WinRAR@{B41DB860-
8EE4-11D2-9906-E49FADC173CA} = C:\Programmi\WinRAR\rarext.dll
HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ >>>
Symantec.Norton.Antivirus.IEContextMenu@{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2
} = C:\Programmi\Norton AntiVirus\NavShExt.dll /*file not found*/
WinRAR@{B41DB860-8EE4-11D2-9906-E49FADC173CA} =
C:\Programmi\WinRAR\rarext.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper
Objects >>>
@{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}C:\Programmi\Adobe\Acrobat
7.0\ActiveX\AcroIEHelper.dll = C:\Programmi\Adobe\Acrobat
7.0\ActiveX\AcroIEHelper.dll
@{5CC30395-E4A0-AF73-8212-0238EDBB6586}C:\WINNT\wphhl1.dll /*file not found*/
= C:\WINNT\wphhl1.dll /*file not found*/
@{A30D56AA-C844-5FFB-0887-16271BFB4F16}C:\WINNT\wphhl1.dll /*file not found*/
= C:\WINNT\wphhl1.dll /*file not found*/
@{AA58ED58-01DD-4d91-8333-CF10577473F7}c:\programmi\google\googletoolbar2.dll
= c:\programmi\google\googletoolbar2.dll
@{BDF3E430-B101-42AD-A544-FADC6B084872}C:\Programmi\Norton
AntiVirus\NavShExt.dll /*file not found*/ = C:\Programmi\Norton
AntiVirus\NavShExt.dll /*file not found*/
HKCU\Control Panel\Desktop@SCRNSAVE.EXE = C:\WINNT\System32\logon.scr
HKLM\Software\Microsoft\Internet Explorer\Plugins\Extension\.pdf@Location =
C:\Programmi\Internet Explorer\PLUGINS\nppdf32.dll
HKLM\Software\Microsoft\Internet Explorer\Main >>>
@Default_Page_URLhttp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=ms
nhome =
http://www.microsoft.com/isapi/redir.dl ... ar=msnhome
@Start
Pagehttp://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&
pver={SUB_PVER}&ar=home =
http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver
={SUB_PVER}&ar=home
@Local PageC:\windows\system32\blank.htm = C:\windows\system32\blank.htm
HKCU\Software\Microsoft\Internet Explorer\Main >>>
@Start
Pagehttp://www.microsoft.com/isapi/redi ... ar=msnhome
=
http://www.microsoft.com/isapi/redir.dl ... ar=msnhome
@Local PageC:\windows\system32\blank.htm = C:\windows\system32\blank.htm
HKLM\Software\Classes\PROTOCOLS\Handler\ >>>
cdo@CLSID = C:\Programmi\File comuni\Microsoft Shared\Web Folders\PKMCDO.DLL
dvd@CLSID = C:\WINNT\System32\msvidctl.dll
its@CLSID = C:\WINNT\System32\itss.dll
lid@CLSID = C:\WINNT\System32\msvidctl.dll
livecall@CLSID = C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
mhtml@CLSID = %SystemRoot%\System32\inetcomm.dll
ms-its@CLSID = C:\WINNT\System32\itss.dll
ms-itss@CLSID = C:\Programmi\File comuni\Microsoft Shared\Information
Retrieval\msitss.dll
msnim@CLSID = C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
mso-offdap@CLSID = C:\PROGRA~1\FILECO~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
tv@CLSID = C:\WINNT\System32\msvidctl.dll
vnd.ms.radio@CLSID = C:\WINNT\System32\msdxm.ocx
wia@CLSID = C:\WINNT\System32\wiascr.dll
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{F4F7069E-
E56B-4500-8481-6D1C5E3881E5} /*Connessione alla rete locale (LAN)*/ >>>
@IPAddress10.0.0.8 = 10.0.0.8
@NameServer193.70.192.25,193.70.152.25 = 193.70.192.25,193.70.152.25
@DefaultGateway10.0.0.2 = 10.0.0.2
@Domain =
C:\Documents and Settings\nicola\Menu Avvio\Programmi\Esecuzione automatica =
My 190.it.lnk
C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione
automatica >>>
EPSON Status Monitor 3 Environment Check 2.lnk = EPSON Status Monitor 3
Environment Check 2.lnk
Logitech Desktop Messenger.lnk = Logitech Desktop Messenger.lnk
---- EOF - GMER 1.0.10 ----
di muffo » 21/09/06 12:28 
