Virus --> Trojan horse generic9.xld

[rohan80]

Salve ho un problema, praticamente un virus sconosciuto che non riesco ad eliminare.
Cercando su Google non sono riuscito a trovare soluzioni.

Il file infettato è il dxmrtpg.dll che sta in --> C\Windows\System32\

L'antivirus (AVG) me lo riconosce come Trojan horse generic9.XLD ma non lo riesce ad eliminare.

Ho provato con HiJackThis, spy bot & destroy, anche in in modalità provvisoria, ma non c'è verso di cancellarlo.

Potete aiutarmi?

Grazie, Ignazio.

[rohan80]

nessuno che mi possa aiutare??

[Luke57]

nessuno che mi possa aiutare??

Ciao, prova con killbox
http://www.bleepingcomputer.com/files/s ... illBox.zip
estrai il file .exe, lo apri, spunti l'opzione "delete on rebot", incolli nello spazio bianco:
C\Windows\System32\dxmrtpg.dll
premi la crocetta bianca su sfondo rosso sulla destra, acconsenti al riavvio del computer.

[rohan80]

ti ringrazio x la risposta..

ho provato come mi hai detto... ma nulla da fare.. al riavvio ho controllato e subito avg... mi ha segnalato sto virus..

[Luke57]

Ciao, non vorrei che fosse un'infezione più estesa, scarica The Avenger
http://swandog46.geekstogo.com/avenger.zip
lo salvi in una cartella, scompatti il file .zip. individua avenger.exe, lo avvii.

Seleziona l'opzione Input Script Manually, clicca sulla lente di ingrandimento e all'interno dello spazio bianco copia ed incolla questo script:


Files to delete:
C\Windows\System32\dxmrtpg.dll

Clicca sul pulsante Done
Adesso clicca sul semaforo con la luce verde
Rispondi Yes 2 volte
Il pc si dovrebbe riavviare,se non si riavvia,riavvialo manualmente

Al riavvio collegati e allega il file C:\Avenger.txt

[rohan80]

Credo... che nn l'abbia cancellato...

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\dlndvibl

*******************

Script file located at: \??\C:\WINDOWS\System32\jagxonkj.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



Could not open file C\Windows\System32\dxmrtpg.dll for deletion
Deletion of file C\Windows\System32\dxmrtpg.dll failed!

Could not process line:
C\Windows\System32\dxmrtpg.dll
Status: 0xc0000022


Completed script processing.

*******************

Finished! Terminate.

[Luke57]

Ciao, scarica hijackthis da qui, per fare un controllo:
http://www.trendsecure.com/portal/en-US ... ckThis.exe
metti il file in una cartella appositamente creata del disco fisso (ad es. C:\HJT). Fatto ciò lo apri cliccando due volte, scegli l'opzione "do a system scan and save a log file", attendi che venga elaborato un file di testo. Appena il file appare, copi tutto il suo contenuto e lo incolli in un post qui nel forum.

[rohan80]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13.12.36, on 24/11/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmi\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Programmi\MSN Messenger\usnsvc.exe
C:\Programmi\Microsoft Office\Office10\WINWORD.EXE
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Programmi\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Programmi\Prolink\PlayTV Pro\PIXELTV.EXE
C:\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {8688A533-6600-4CC3-9F2A-CF248960A81E} - C:\WINDOWS\System32\dxmrtpg.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {C5EE7D24-8FFB-4BD6-B1A8-451F6AB4FC4B} - c:\windows\system32\dciman32a.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Alice ti aiuta.lnk = C:\Programmi\Alice ti aiuta\bin\matcli.exe
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: LG SyncManager.lnk = C:\Programmi\LG PC Suite\LG PC Sync\LGSyncManager.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Remote Controller.lnk = C:\Programmi\Prolink\PlayTV Pro\TVRMVCR.EXE
O4 - Global Startup: TV Scheduler.lnk = C:\Programmi\Prolink\PlayTV Pro\TVSCHL.EXE
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.adobe.com/pub/shockwa ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5C10D6C7-AD2A-4364-8052-85DD87CBF3B0}: NameServer = 85.37.17.39 85.38.28.71
O20 - Winlogon Notify: cuppsnyz - dciman32a.dll (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

--
End of file - 5117 bytes

[Luke57]

Ciao, scarica COMBOFIX sul desktop http://download.bleepingcomputer.com/sUBs/ComboFix.exe
- Una volta scaricato,avvialo con un doppio click.
- Si aprirà una finestra blu , attendi
- Dopo qualche attimo apparirà un avviso che declina l'autore da ogni responsabilità.
- A questo punto seleziona 1 e premi ENTER per lanciare lo scan.
- Attendere.....
Il tool ti avviserà una volta lo scan finito e in qualche attimo visualizzerà il rapporto con i dettagli. (C:\ComboFix.txt)
Inserisci in un post il log (C:\ComboFix.txt)

[rohan80]

ComboFix 07-11-19.3 - user 2007-11-24 14.21.00.1 - NTFSx86
Eseguito da: C:\Documents and Settings\user\Desktop\Ignazio\ComboFix.exe
* Creato nuovo punto di ripristino
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\nwan.dat

.
((((((((((((((((((((((((( Files Creati Da 2007-10-24 al 2007-11-24 )))))))))))))))))))))))))))))))))))
.

2007-11-24 13:08 <DIR> d-------- C:\HiJackThis
2007-11-20 20:04 <DIR> d--h----- C:\Documents and Settings\Administrator\Risorse di stampa
2007-11-20 20:04 <DIR> d--h----- C:\Documents and Settings\Administrator\Risorse di rete
2007-11-20 20:04 <DIR> d-------- C:\Documents and Settings\Administrator\Preferiti
2007-11-20 20:04 <DIR> d--h----- C:\Documents and Settings\Administrator\Modelli
2007-11-20 20:04 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Avvio
2007-11-20 20:04 <DIR> d--h----- C:\Documents and Settings\Administrator\Impostazioni locali
2007-11-20 20:04 <DIR> d-------- C:\Documents and Settings\Administrator\Documenti
2007-11-20 20:04 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dati applicazioni
2007-11-19 15:21 <DIR> d-------- C:\Documents and Settings\Antonella\Dati applicazioni\AVG7
2007-11-19 09:15 <DIR> d-------- C:\Documents and Settings\Giuseppe.PC-LB3EJ53HPQW9\Dati applicazioni\AVG7
2007-11-18 23:47 <DIR> d-------- C:\WINDOWS\Sun
2007-11-18 23:43 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2007-11-18 23:41 5,677 --a------ C:\WINDOWS\system32\jupdate-1.6.0_03-b05.log
2007-11-18 23:40 <DIR> d-------- C:\Programmi\Java
2007-11-18 23:38 <DIR> d-------- C:\Programmi\File comuni\Java
2007-11-18 20:07 1,261 --a------ C:\WINDOWS\mozver.dat
2007-11-18 20:05 0 --a------ C:\WINDOWS\nsreg.dat
2007-11-18 18:34 <DIR> d-------- C:\Documents and Settings\user\Dati applicazioni\Avant Profiles
2007-11-17 17:33 <DIR> d-------- C:\Documents and Settings\user\Dati applicazioni\AVG7
2007-11-17 17:33 <DIR> d-------- C:\Documents and Settings\LocalService\Dati applicazioni\AVG7
2007-11-17 16:49 60,856 --a------ C:\Documents and Settings\user\Dati applicazioni\GDIPFONTCACHEV1.DAT
2007-11-17 15:31 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Grisoft
2007-11-17 15:03 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Avg7
2007-11-17 11:48 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Prevx
2007-11-17 00:50 <DIR> d-------- C:\Programmi\File comuni\Wise Installation Wizard
2007-11-16 19:04 <DIR> d-------- C:\Documents and Settings\Giuseppe.PC-LB3EJ53HPQW9\Dati applicazioni\LG Electronics
2007-11-16 16:32 741,632 --a------ C:\WINDOWS\system32\nhtvoohr.dat
2007-11-16 16:32 41,728 --a------ C:\WINDOWS\system32\pudbsbct.dat
2007-11-16 16:32 35,072 --a------ C:\WINDOWS\system32\vkqkcwcs.dat
2007-11-16 16:22 120,064 --a------ C:\WINDOWS\system32\dzdowwln.dat
2007-11-16 16:14 93,696 --a------ C:\WINDOWS\system32\dxmrtpg.dll
2007-11-13 21:43 <DIR> d-------- C:\Programmi\Real
2007-11-13 21:43 <DIR> d-------- C:\Programmi\Google
2007-11-13 21:43 <DIR> d-------- C:\Programmi\File comuni\Real
2007-11-11 15:21 <DIR> d-------- C:\Documents and Settings\Antonella\Dati applicazioni\LG Electronics
2007-11-11 11:40 <DIR> d--h----- C:\LGFolder
2007-11-11 11:38 <DIR> d-------- C:\WINDOWS\LastGood
2007-11-11 11:37 <DIR> d-------- C:\Programmi\LG Electronics
2007-11-11 10:30 <DIR> d-------- C:\Documents and Settings\Antonella\Dati applicazioni\Apple Computer
2007-11-11 10:24 <DIR> d-------- C:\Programmi\QuickTime
2007-11-11 10:23 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Apple Computer
2007-11-10 13:11 <DIR> d-------- C:\Documents and Settings\user\Dati applicazioni\LG Electronics
2007-11-10 12:54 77,472 -ra------ C:\WINDOWS\system32\drivers\U81xmgmt.sys
2007-11-10 12:54 75,456 -ra------ C:\WINDOWS\system32\drivers\U81xobex.sys
2007-11-10 12:54 6,144 -ra------ C:\WINDOWS\system32\drivers\U81xcmnt.sys
2007-11-10 12:54 6,144 -ra------ C:\WINDOWS\system32\drivers\U81xcm.sys
2007-11-10 12:53 84,480 -ra------ C:\WINDOWS\system32\drivers\U81xmdm.sys
2007-11-10 12:53 6,064 -ra------ C:\WINDOWS\system32\drivers\U81xmdfl.sys
2007-11-10 12:52 <DIR> d-------- C:\WINDOWS\LastGood.Tmp
2007-11-10 12:52 52,352 -ra------ C:\WINDOWS\system32\drivers\U81xbus.sys
2007-11-10 12:52 5,744 -ra------ C:\WINDOWS\system32\drivers\U81xwhnt.sys
2007-11-10 12:52 5,744 -ra------ C:\WINDOWS\system32\drivers\U81xwh.sys
2007-11-10 12:45 <DIR> d-------- C:\Programmi\LG PC Suite
2007-11-08 11:16 <DIR> d-------- C:\Documents and Settings\Antonella\Dati applicazioni\CyberLink
2007-11-08 11:15 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\CyberLink
2007-11-04 00:15 753,664 --a--c--- C:\WINDOWS\system32\dllcache\setup_wm.exe
2007-11-04 00:15 225,280 --a------ C:\WINDOWS\system32\wmpdxm.dll
2007-11-04 00:15 186,368 --a------ C:\WINDOWS\system32\wmerror.dll
2007-11-04 00:15 106,496 --a------ C:\WINDOWS\system32\wmpasf.dll
2007-11-04 00:15 20,480 --a------ C:\WINDOWS\system32\wmpcore.dll
2007-11-04 00:15 20,480 --a------ C:\WINDOWS\system32\wmpcd.dll
2007-11-04 00:15 20,480 --a------ C:\WINDOWS\system32\wmp.ocx
2007-11-04 00:14 365,704 --a------ C:\WINDOWS\system32\msscp.dll
2007-11-04 00:14 246,272 --a------ C:\WINDOWS\system32\mswmdm.dll
2007-11-04 00:14 201,728 --a------ C:\WINDOWS\system32\mspmsp.dll
2007-11-04 00:14 52,736 --a------ C:\WINDOWS\system32\mspmsnsv.dll
2007-11-04 00:14 27,136 --a------ C:\WINDOWS\system32\wmdmlog.dll
2007-11-04 00:14 23,552 --a------ C:\WINDOWS\system32\wmdmps.dll
2007-11-03 17:59 <DIR> d-------- C:\Programmi\Prolink
2007-11-03 17:59 204,800 --a------ C:\WINDOWS\TVXAPP.EXE
2007-11-03 17:59 159,800 --a------ C:\WINDOWS\PS.exe
2007-11-03 17:59 159,800 --a------ C:\WINDOWS\PowerS.exe
2007-11-03 17:59 99,206 --a------ C:\WINDOWS\system32\drivers\BT848.SYS
2007-11-03 17:59 76,800 --a------ C:\WINDOWS\system32\NUVISION.AX
2007-11-03 17:59 13,898 --a------ C:\WINDOWS\system32\drivers\Bttuner.sys
2007-11-03 17:59 6,872 --a------ C:\WINDOWS\system32\drivers\Btxbar.sys
2007-11-03 17:01 290,816 --a------ C:\WINDOWS\system32\msh263.drv
2007-11-03 17:01 50,688 --a------ C:\WINDOWS\system32\vfwwdm32.dll
2007-11-03 17:01 45,568 --a------ C:\WINDOWS\system32\iyuv_32.dll
2007-11-03 17:01 8,192 --a--c--- C:\WINDOWS\system32\dllcache\tsbyuv.dll
2007-11-03 16:56 804 --a------ C:\WINDOWS\TSCTVDIV.BIN
2007-11-03 16:52 <DIR> d-------- C:\Programmi\PIXEL
2007-11-03 16:51 <DIR> d-------- C:\Documents and Settings\user\WINDOWS
2007-11-03 16:51 299,520 --a------ C:\WINDOWS\uninst.exe
2007-11-03 16:38 8,704 --a------ C:\WINDOWS\system32\kbdjpn.dll
2007-11-03 16:38 8,192 --a------ C:\WINDOWS\system32\kbdkor.dll
2007-11-03 16:38 6,144 --a------ C:\WINDOWS\system32\kbd106.dll
2007-11-03 16:38 6,144 --a------ C:\WINDOWS\system32\kbd101c.dll
2007-11-03 16:38 6,144 --a------ C:\WINDOWS\system32\kbd101b.dll
2007-11-03 16:38 5,632 --a------ C:\WINDOWS\system32\kbd103.dll
2007-11-03 15:17 <DIR> d-------- C:\Documents and Settings\user\Dati applicazioni\vlc
2007-11-03 15:14 <DIR> d-------- C:\Programmi\VideoLAN
2007-11-03 14:11 <DIR> d-------- C:\Programmi\Riva
2007-11-03 13:55 737,280 --a------ C:\WINDOWS\iun6002.exe
2007-11-03 13:54 <DIR> d-------- C:\Programmi\Replay Converter
2007-11-03 13:51 <DIR> d-------- C:\Documents and Settings\user\Dati applicazioni\GetRightToGo
2007-11-03 13:44 <DIR> d-------- C:\Programmi\File comuni\SWF Studio
2007-11-03 12:03 23,392 --a------ C:\WINDOWS\system32\nscompat.tlb
2007-10-30 19:40 <DIR> d-------- C:\Documents and Settings\Giuseppe.PC-LB3EJ53HPQW9\Dati applicazioni\AdobeUM

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-20 20:12 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\Spybot - Search & Destroy
2007-11-17 10:14 --------- d--h--w C:\Programmi\InstallShield Installation Information
2007-11-16 15:32 246,545 ----a-w C:\WINDOWS\system32\libssl32.dll
2007-11-16 15:32 1,188,375 ----a-w C:\WINDOWS\system32\libeay32.dll
2007-11-16 15:26 18,688 ----a-w C:\WINDOWS\system32\drivers\ghelncsj.dat
2007-11-10 11:44 --------- d-----w C:\Programmi\File comuni\InstallShield
2007-10-24 19:28 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\Messenger Plus!
2007-10-23 22:26 --------- d-----w C:\Programmi\MSN Messenger
2007-10-23 22:23 --------- d-----w C:\Programmi\Windows Live
2007-10-23 22:23 --------- d-----w C:\Programmi\Messenger Plus! Live
2007-10-23 22:01 --------- d-----w C:\Programmi\Outlook Express Backup Wizard
2007-10-23 21:38 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2007-10-23 21:38 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2007-10-23 21:19 --------- d-----w C:\Programmi\Servizi in linea
2007-10-23 21:15 --------- d-----w C:\Programmi\Pirelli
2007-10-23 21:15 --------- d-----w C:\Programmi\Motive
2007-10-23 21:15 --------- d-----w C:\Programmi\Common Files
2007-10-23 21:15 --------- d-----w C:\Programmi\Alice ti aiuta
2007-10-23 21:13 --------- d-----w C:\Programmi\Telecom Italia
2007-10-22 16:52 --------- d-----w C:\Programmi\File comuni\SpeechEngines
2007-10-22 16:52 --------- d-----w C:\Programmi\File comuni\ODBC
2007-10-22 16:06 --------- d-----w C:\Programmi\microsoft frontpage
2007-10-22 16:01 --------- d-----w C:\Programmi\File comuni\MSSoap
2007-09-28 16:08 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-09-28 16:07 9,464 ------w C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-09-28 16:07 9,336 ------w C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-09-28 16:07 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2007-09-28 16:07 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2007-09-28 16:07 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-09-28 16:07 129,784 ------w C:\WINDOWS\system32\pxafs.dll
2007-09-28 16:07 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe
2007-09-28 16:07 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe
2007-09-28 16:07 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-09-28 16:05 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-09-28 16:05 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2007-09-28 16:05 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2007-09-28 16:05 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2007-09-28 16:05 739,840 ----a-w C:\WINDOWS\system32\DivX.dll
2007-09-28 16:05 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2007-09-28 16:05 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2007-09-28 16:05 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2007-09-28 16:05 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2007-09-28 16:05 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2007-09-28 16:05 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2007-09-28 16:05 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2007-09-28 16:05 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8688A533-6600-4CC3-9F2A-CF248960A81E}]
2001-08-31 11:00 93696 --a------ C:\WINDOWS\System32\dxmrtpg.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C5EE7D24-8FFB-4BD6-B1A8-451F6AB4FC4B}]
c:\windows\system32\dciman32a.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2001-08-31 11:00]
"MsnMsgr"="C:\Programmi\MSN Messenger\MsnMsgr.exe" [2007-01-19 11:54]
"MSMSGS"="C:\Programmi\Messenger\msmsgs.exe" [2001-08-02 06:14]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-11-17 17:32]
"SunJavaUpdateSched"="C:\Programmi\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2001-08-31 11:00]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-11-17 17:32]

C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Alice ti aiuta.lnk - C:\Programmi\Alice ti aiuta\bin\matcli.exe [2007-10-23 22:15:12]
Avvio veloce di Adobe Reader.lnk - C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 20:05:26]
LG SyncManager.lnk - C:\Programmi\LG PC Suite\LG PC Sync\LGSyncManager.exe [2007-11-10 12:45:23]
Microsoft Office.lnk - C:\Programmi\Microsoft Office\Office10\OSA.EXE [2001-02-13 08:01:04]
Remote Controller.lnk - C:\Programmi\Prolink\PlayTV Pro\TVRMVCR.EXE [2007-11-03 17:59:35]
TV Scheduler.lnk - C:\Programmi\Prolink\PlayTV Pro\TVSCHL.EXE [2007-11-03 17:59:36]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cuppsnyz]
dciman32a.dll

R0 sgrvakto;sgrvakto;C:\WINDOWS\System32\drivers\ghelncsj.dat
R2 BT848;BtCap, WDM Video Capture;C:\WINDOWS\System32\drivers\BT848.sys
R2 BTTUNER;BtTuner, WDM TvTuner;C:\WINDOWS\System32\drivers\BTTUNER.sys
R2 BTXBAR;BtXBar, WDM Crossbar;C:\WINDOWS\System32\drivers\BTXBAR.sys
R3 ati2mtaa;ati2mtaa;C:\WINDOWS\System32\DRIVERS\ati2mtaa.sys
S2 nybpseae; filtro SerenumHelper;C:\WINDOWS\System32\svchost.exe -k netsvcs
S3 ati2mpaa;ati2mpaa;C:\WINDOWS\System32\DRIVERS\ati2mpaa.sys
S4 NOTEPAD;NOTEPAD;"C:\WINDOWS\system\NOTEPAD.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
nybpseae

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-24 14:26:43
Windows 5.1.2600 NTFS

scansione processi nascosti ...

[Luke57]

Ciao, utilizza avenger con questo script (chiudi le applicazioni e programmi, disattiva temporeanamente l'antivirus):

files to delete:
C:\WINDOWS\system32\nhtvoohr.dat
C:\WINDOWS\system32\pudbsbct.dat
C:\WINDOWS\system32\vkqkcwcs.dat
C:\WINDOWS\system32\dzdowwln.dat
C:\WINDOWS\system32\dxmrtpg.dll
c:\windows\system32\dciman32a.dll
C:\WINDOWS\System32\drivers\ghelncsj.dat

registry keys to delete:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8688A533-6600-4CC3-9F2A-CF248960A81E}
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C5EE7D24-8FFB-4BD6-B1A8-451F6AB4FC4B}
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cuppsnyz


Posta il report.

[rohan80]

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\nfulyvob

*******************

Script file located at: \??\C:\ccpyfrcu.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\system32\nhtvoohr.dat deleted successfully.
File C:\WINDOWS\system32\pudbsbct.dat deleted successfully.
File C:\WINDOWS\system32\vkqkcwcs.dat deleted successfully.
File C:\WINDOWS\system32\dzdowwln.dat deleted successfully.


Could not open file C:\WINDOWS\system32\dxmrtpg.dll for deletion
Deletion of file C:\WINDOWS\system32\dxmrtpg.dll failed!

Could not process line:
C:\WINDOWS\system32\dxmrtpg.dll
Status: 0xc0000022



Could not open file c:\windows\system32\dciman32a.dll for deletion
Deletion of file c:\windows\system32\dciman32a.dll failed!

Could not process line:
c:\windows\system32\dciman32a.dll
Status: 0xc0000022



Could not open file C:\WINDOWS\System32\drivers\ghelncsj.dat for deletion
Deletion of file C:\WINDOWS\System32\drivers\ghelncsj.dat failed!

Could not process line:
C:\WINDOWS\System32\drivers\ghelncsj.dat
Status: 0xc0000022


Completed script processing.

*******************

Finished! Terminate.



Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\nfulyvob

*******************

Script file located at: \??\C:\ccpyfrcu.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\system32\nhtvoohr.dat deleted successfully.
File C:\WINDOWS\system32\pudbsbct.dat deleted successfully.
File C:\WINDOWS\system32\vkqkcwcs.dat deleted successfully.
File C:\WINDOWS\system32\dzdowwln.dat deleted successfully.


Could not open file C:\WINDOWS\system32\dxmrtpg.dll for deletion
Deletion of file C:\WINDOWS\system32\dxmrtpg.dll failed!

Could not process line:
C:\WINDOWS\system32\dxmrtpg.dll
Status: 0xc0000022



Could not open file c:\windows\system32\dciman32a.dll for deletion
Deletion of file c:\windows\system32\dciman32a.dll failed!

Could not process line:
c:\windows\system32\dciman32a.dll
Status: 0xc0000022



Could not open file C:\WINDOWS\System32\drivers\ghelncsj.dat for deletion
Deletion of file C:\WINDOWS\System32\drivers\ghelncsj.dat failed!

Could not process line:
C:\WINDOWS\System32\drivers\ghelncsj.dat
Status: 0xc0000022


Completed script processing.

*******************

Finished! Terminate.

[Luke57]

Ciao, hai inserito lo script per le voci di registro? Parrebbe di no, rifai la procedura con questo script:

files to delete:
C:\WINDOWS\system32\dxmrtpg.dll

registry keys to delete:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8688A533-6600-4CC3-9F2A-CF248960A81E}
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C5EE7D24-8FFB-4BD6-B1A8-451F6AB4FC4B}
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cuppsnyz

[rohan80]

si.. l'ho fatto...


ero pieno di virus, per cui alla fine ho formattato...

cosa mi consigli x evitare di prendere virus??

ad esempio ho messo mozilla come browser, installato avg e spybot e destroy, e hijackthis... bastano??