PC INFETTO

[saurus]

SALVE A A TUTTI HO UN PROBLEMA ,HO IL PC INFETTO DA QUALCOSA MA NON SO COSA DI PARTICOLARE:AVAST ME LO IDENTIFICA COME UN VIRUS /......PURE MORPH NELLA CARTELLA WIN 32 - SPYBOAT INVECE MI HA TROVATO UN SACCCO DI NOMI STRANI INSOMMA NON Sò COME IDENTIFICARE ED ELIMINARE LA MINACCIA.
HO FATTO LA SCANSIONE SIA CON AVAST CHE CON SPY BOT MA QUANDO HO RIAVVIATO IL PC ERA TUTTO COME PRIMA CON UN MESSAGGIO DI ALLARME AL POSTO DELLA SOLITA IMMAGINE DESKTOP.
COME POSSO FARE AIUTATEMI ,GRAZIE.

[Luke57]

Ciao, per prima cosa non scrivere in stampatello, equivale a urlare e il regolamento lo vieta, per il tuo problema scarica systemscan:
http://www.suspectfile.com/systemscan
disconnetti il pc da internet => disattiva l'antivirus => esegui systemscan => clicca su "Scan Now". Finita la scansione, riattiva l'antivirus e verranno rilasciati (sempre sul desktop all'interno della cartella suspectfile) due file. Utilizzando la possibilità che ti dà il forum, allega il file con estensione .zip nella tua prossima risposta.

[saurus]

Scusa se ho scritto in stampatello,ma non me ne sono reso conto:ho provato a fare una scansione con suspectfile ma mi ha dato alcuni problemi in quanto mi si bloccava alla nona fase,ora ti allego il log eseguito con hijackthis sperando che vada bene nel frattempo cercherò di rivedere meglio suspect file,grazie.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15.57.12, on 21/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Lavasoft\Ad-Aware\aawservice.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\lphccsrj0ejfa.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programmi\Bonjour\mDNSResponder.exe
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\cmd.exe
C:\DOCUME~1\Ranieri\IMPOST~1\Temp\nsv177.tmp\uuoywfrygn.exe
C:\Programmi\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\WINDOWS\system32\cmd.exe
C:\DOCUME~1\Ranieri\IMPOST~1\Temp\nsz179.tmp\uuoywfrygn.exe
C:\WINDOWS\system32\cmd.exe
C:\DOCUME~1\Ranieri\IMPOST~1\Temp\nsg185.tmp\uuoywfrygn.exe
C:\WINDOWS\system32\cmd.exe
C:\DOCUME~1\Ranieri\IMPOST~1\Temp\nsf187.tmp\uuoywfrygn.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [lphccsrj0ejfa] C:\WINDOWS\system32\lphccsrj0ejfa.exe
O4 - HKLM\..\Run: [SMrhc9srj0ejfa] C:\Programmi\rhc9srj0ejfa\rhc9srj0ejfa.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [sysadm] C:\WINDOWS\system32\jidsfkrw.exe
O4 - HKLM\..\Policies\Explorer\Run: [4s5lMpWQH2] C:\Documents and Settings\Ranieri\Documenti\AdobeFlashPlayerHD.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Programmi\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Programmi\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe

--
End of file - 4673 bytes

[Luke57]

Ciao, sei molto infetto, Scarica combofix sul desktop
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Una volta scaricato il programma , disattiva il tea timer di spybot.

Poi avvia combofix.exe, parte il programma che potrebbe impiegare molto (non fare altre manovre durante la scansione, se dovessero scomparire le icone sul desktop e la barra delle applicazioni, non è nulla di cui preoccuparsi),una volta terminata, se tutto è andato bene, in C:\ dovresti trovare il file combofix.txt , posta il contenuto del file.

[saurus]

io ho disattivato tea timer come tu mi hai detto, prima di usare combo fix ,poi ho fatto partire il programma, il pc si è riavviato da solo quindi c'è stata la scansione automatica, non sò ... penso vada bene. P.S :grazie per la disponibilità


ComboFix 08-09-20.05 - Ranieri 2008-09-22 3:53:00.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1040.18.1065 [GMT 2:00]
Eseguito da: C:\Documents and Settings\Ranieri\Documenti\ComboFix.exe
* Creato nuovo punto di ripristino

ATENÇÃO - ESTA MAQUINA NAO TEM A CONSOLE DE RECUPERAÇÃO INSTALADA !!
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Menu Avvio\Programmi\Antivirus XP 2008.lnk
C:\Documents and Settings\Ranieri\Dati applicazioni\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk
C:\Documents and Settings\Ranieri\Dati applicazioni\rhc9srj0ejfa
C:\WINDOWS\system32\akttzn.exe
C:\WINDOWS\system32\anticipator.dll
C:\WINDOWS\system32\awtoolb.dll
C:\WINDOWS\system32\bdn.com
C:\WINDOWS\system32\bsva-egihsg52.exe
C:\WINDOWS\system32\dpcproxy.exe
C:\WINDOWS\system32\emesx.dll
C:\WINDOWS\system32\hoproxy.dll
C:\WINDOWS\system32\hxiwlgpm.dat
C:\WINDOWS\system32\hxiwlgpm.exe
C:\WINDOWS\system32\lphccsrj0ejfa.exe
C:\WINDOWS\system32\medup012.dll
C:\WINDOWS\system32\msgp.exe
C:\WINDOWS\system32\msnbho.dll
C:\WINDOWS\system32\mssecu.exe
C:\WINDOWS\system32\msvchost.exe
C:\WINDOWS\system32\mtr2.exe
C:\WINDOWS\system32\mwin32.exe
C:\WINDOWS\system32\netode.exe
C:\WINDOWS\system32\newsd32.exe
C:\WINDOWS\system32\phccsrj0ejfa.bmp
C:\WINDOWS\system32\ps1.exe
C:\WINDOWS\system32\psof1.exe
C:\WINDOWS\system32\psoft1.exe
C:\WINDOWS\system32\regc64.dll
C:\WINDOWS\system32\regm64.dll
C:\WINDOWS\system32\Rundl1.exe
C:\WINDOWS\system32\smp
C:\WINDOWS\system32\smp\msrc.exe
C:\WINDOWS\system32\sncntr.exe
C:\WINDOWS\system32\ssurf022.dll
C:\WINDOWS\system32\ssvchost.com
C:\WINDOWS\system32\ssvchost.exe
C:\WINDOWS\system32\sysreq.exe
C:\WINDOWS\system32\taack.dat
C:\WINDOWS\system32\taack.exe
C:\WINDOWS\system32\temp#01.exe
C:\WINDOWS\system32\thun.dll
C:\WINDOWS\system32\thun32.dll
C:\WINDOWS\system32\VBIEWER.OCX
C:\WINDOWS\system32\vbsys2.dll
C:\WINDOWS\system32\vcatchpi.dll
C:\WINDOWS\system32\winlogonpc.exe
C:\WINDOWS\system32\winsystem.exe
C:\WINDOWS\system32\WINWGPX.EXE

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_{DEF85C80-216A-43AB-AF70-1665EDBE2780}
-------\Service_{DEF85C80-216A-43ab-AF70-1665EDBE2780}


((((((((((((((((((((((((( Files Creati Da 2008-08-22 al 2008-09-22 )))))))))))))))))))))))))))))))))))
.

2008-09-18 15:09 . 2008-09-20 12:56 <DIR> d-------- C:\Programmi\zlqenr
2008-09-18 15:09 . 2008-09-18 15:09 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\lytgtqji
2008-08-27 19:35 . 2008-08-28 15:47 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Skype
2008-08-22 19:35 . 2008-08-22 19:35 <DIR> d-------- C:\Programmi\DVD Shrink
2008-08-22 19:35 . 2008-08-22 19:35 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\DVD Shrink

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-21 14:31 --------- d-----w C:\Programmi\eMule
2008-09-17 14:12 21,088 ----a-w C:\Documents and Settings\Ranieri\Dati applicazioni\GDIPFONTCACHEV1.DAT
2008-09-03 21:59 --------- d-----w C:\Programmi\Notepad++
2008-09-03 21:59 --------- d-----w C:\Documents and Settings\Ranieri\Dati applicazioni\Notepad++
2008-08-23 18:18 --------- d-----w C:\Documents and Settings\Ranieri\Dati applicazioni\BitTorrent
2008-08-20 13:45 --------- d-----w C:\Programmi\Spybot - Search & Destroy
2008-08-08 15:06 --------- d-----w C:\Programmi\Dolphin
2008-08-06 00:46 --------- d-----w C:\Programmi\Google
2008-07-25 11:41 --------- d-----w C:\Programmi\File comuni\Adobe
2008-07-23 17:35 --------- d-----w C:\Programmi\Riva
2008-07-23 17:35 --------- d-----w C:\Programmi\File comuni\SWF Studio
2008-07-23 17:12 --------- d-----w C:\Programmi\Uplink
2008-03-25 23:11 13,195 ----a-w C:\Documents and Settings\Ranieri\zguicfgw.dat
2003-08-16 17:56 579,584 --sha-r C:\WINDOWS\system32\cd.exe
2005-12-04 19:24 185,634 --sha-r C:\WINDOWS\system32\patcher.exe
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2007-08-02 15360]
"SpybotSD TeaTimer"="C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 1832272]
"MSMSGS"="C:\Programmi\Messenger\msmsgs.exe" [2004-10-13 1694208]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Programmi\\eMule\\emule.exe"=
"C:\\Programmi\\BitTorrent_DNA\\dna.exe"=
"C:\\Programmi\\BitTorrent\\bittorrent.exe"=
"C:\\Programmi\\DNA\\btdna.exe"=
"C:\\Programmi\\Bonjour\\mDNSResponder.exe"=

R0 SI3112r;Silicon Image SiI 3112 SATARaid Controller;C:\WINDOWS\system32\DRIVERS\SI3112r.sys [2004-05-12 97408]
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
S3 ADM8511;Convertitore ADMtek ADM8511/AN986 da USB a Fast Ethernet;C:\WINDOWS\system32\DRIVERS\ADM8511.SYS [2001-08-17 20160]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{258eee43-da82-11dc-993d-806d6172696f}]
\Shell\AutoRun\command - E:\ShelExec.exe wpi.hta
.
Contenuto della cartella 'Scheduled Tasks'
.
- - - - ORFÇOS REMOVIDOS - - - -

HKCU-Run-sysadm - C:\WINDOWS\system32\jidsfkrw.exe
HKLM-Run-lphccsrj0ejfa - C:\WINDOWS\system32\lphccsrj0ejfa.exe
HKLM-Run-SMrhc9srj0ejfa - C:\Programmi\rhc9srj0ejfa\rhc9srj0ejfa.exe
HKLM-Explorer_Run-4s5lMpWQH2 - C:\Documents and Settings\Ranieri\Documenti\AdobeFlashPlayerHD.exe


.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Ranieri\Dati applicazioni\Mozilla\Firefox\Profiles\liq5fgrs.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://search.conduit.com/ResultsExt.as ... ource=3&q=
FF -: plugin - C:\Programmi\DNA\plugins\npbtdna.dll
FF -: plugin - C:\Programmi\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF -: plugin - C:\Programmi\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-22 03:56:05
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\Programmi\Lavasoft\Ad-Aware\aawservice.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programmi\Bonjour\mDNSResponder.exe
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\ComboFix\pv.cfexe
.
**************************************************************************
.
Ora fine scansione: 2008-09-22 3:58:16 - machine was rebooted [Ranieri]
ComboFix-quarantined-files.txt 2008-09-22 01:58:13

Pre-Run: 102,770,835,456 byte disponibili
Post-Run: 103,657,246,720 byte disponibili

162 --- E O F --- 2008-09-20 01:40:40

[Luke57]

Ciao, dal blocco note di windows, apri un file di testo, copia e incolla il seguente script nel file:

Codice: Seleziona tutto

KILLALL::

File::
C:\Documents and Settings\Ranieri\zguicfgw.dat

Folder::
C:\Programmi\zlqenr
C:\Documents and Settings\All Users\Dati applicazioni\lytgtqji

salva il file di testo, chiamandolo obbligatoriamente CFScript.txt nella stessa direzione di combofix, trascinalo con il puntatore del mouse sull'icona di combofix per una nuova scansione e riavvio del computer. Allega nuovo report se prodotto.

[saurus]

ecco qui :

ComboFix 08-09-20.05 - Ranieri 2008-09-22 13.37.34.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1040.18.1134 [GMT 2:00]
Eseguito da: C:\Documents and Settings\Ranieri\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Ranieri\Desktop\CFScript.txt
* Creato nuovo punto di ripristino

ATENÇÃO - ESTA MAQUINA NAO TEM A CONSOLE DE RECUPERAÇÃO INSTALADA !!

FILE ::
C:\Documents and Settings\Ranieri\zguicfgw.dat
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Dati applicazioni\lytgtqji
C:\Documents and Settings\Ranieri\zguicfgw.dat
C:\Programmi\zlqenr

.
((((((((((((((((((((((((( Files Creati Da 2008-08-22 al 2008-09-22 )))))))))))))))))))))))))))))))))))
.

2008-08-27 19:35 . 2008-08-28 15:47 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Skype
2008-08-22 19:35 . 2008-08-22 19:35 <DIR> d-------- C:\Programmi\DVD Shrink
2008-08-22 19:35 . 2008-08-22 19:35 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\DVD Shrink

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-22 02:13 --------- d-----w C:\Programmi\eMule
2008-09-17 14:12 21,088 ----a-w C:\Documents and Settings\Ranieri\Dati applicazioni\GDIPFONTCACHEV1.DAT
2008-09-03 21:59 --------- d-----w C:\Programmi\Notepad++
2008-09-03 21:59 --------- d-----w C:\Documents and Settings\Ranieri\Dati applicazioni\Notepad++
2008-08-23 18:18 --------- d-----w C:\Documents and Settings\Ranieri\Dati applicazioni\BitTorrent
2008-08-20 13:45 --------- d-----w C:\Programmi\Spybot - Search & Destroy
2008-08-08 15:06 --------- d-----w C:\Programmi\Dolphin
2008-08-06 00:46 --------- d-----w C:\Programmi\Google
2008-07-25 11:41 --------- d-----w C:\Programmi\File comuni\Adobe
2008-07-23 17:35 --------- d-----w C:\Programmi\Riva
2008-07-23 17:35 --------- d-----w C:\Programmi\File comuni\SWF Studio
2008-07-23 17:12 --------- d-----w C:\Programmi\Uplink
2003-08-16 17:56 579,584 --sha-r C:\WINDOWS\system32\cd.exe
2005-12-04 19:24 185,634 --sha-r C:\WINDOWS\system32\patcher.exe
.

((((((((((((((((((((((((((((( snapshot@2008-09-22_ 3.57.54.98 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-09-22 11:38:24 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_69c.dat
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2007-08-02 15360]
"SpybotSD TeaTimer"="C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 1832272]
"MSMSGS"="C:\Programmi\Messenger\msmsgs.exe" [2004-10-13 1694208]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Programmi\\eMule\\emule.exe"=
"C:\\Programmi\\BitTorrent_DNA\\dna.exe"=
"C:\\Programmi\\BitTorrent\\bittorrent.exe"=
"C:\\Programmi\\DNA\\btdna.exe"=
"C:\\Programmi\\Bonjour\\mDNSResponder.exe"=

R0 SI3112r;Silicon Image SiI 3112 SATARaid Controller;C:\WINDOWS\system32\DRIVERS\SI3112r.sys [2004-05-12 97408]
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
S3 ADM8511;Convertitore ADMtek ADM8511/AN986 da USB a Fast Ethernet;C:\WINDOWS\system32\DRIVERS\ADM8511.SYS [2001-08-17 20160]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{258eee43-da82-11dc-993d-806d6172696f}]
\Shell\AutoRun\command - E:\ShelExec.exe wpi.hta
.
Contenuto della cartella 'Scheduled Tasks'
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-22 13:38:35
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\Programmi\Lavasoft\Ad-Aware\aawservice.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programmi\Bonjour\mDNSResponder.exe
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\ComboFix\pv.cfexe
.
**************************************************************************
.
Ora fine scansione: 2008-09-22 13:41:09 - machine was rebooted [Ranieri]
ComboFix-quarantined-files.txt 2008-09-22 11:41:05
ComboFix2.txt 2008-09-22 01:58:18

Pre-Run: 103.436.165.120 byte disponibili
Post-Run: 103,622,078,464 byte disponibili

104 --- E O F --- 2008-09-20 01:40:40

[Luke57]

Ciao, ok, adesso vai qui:
http://www.virustotal.com/it/
fai analizzare questo file:
C:\WINDOWS\system32\patcher.exe
indica il responso del sito.

[saurus]

dovrebbe essere questo :

File patcher.exe ricevuto il 2008.09.22 18:36:11 (CET)
Stato corrente: Carico ... in coda attesa scansione finito NON TROVATO INTERROTTO


Risultato: 1/36 (2.78%)
Carico informazioni server...
Il tuo file è in coda in posizione: ___.
Tempo stimato inizio tra ___ e ___ .
Non chiudere la finestra fino al termine della scansione.
Lo scanner che stava processando il tuo file si è fermato in questo momento, stiamo aspettando alcuni secondi per tentare di recuperare i tuoi risultati.
Se stai aspettando da più di cinque minuti devi rimandare il tuo file.
VirusTotal sta controllando il tuo file in questo momento,
i risultati saranno visualizzati mentre vengono generati.
Formattato Stampa risultati
Il tuo file è scaduto o non esiste.
Il servizio è fermo in questo momento, il tuo file sta aspettando di essere controllato (posizione: ) da un tempo indefinito.




Antivirus Versione Ultimo aggiornamento Risultato
AhnLab-V3 2008.9.23.0 2008.09.22 -
AntiVir 7.8.1.34 2008.09.22 -
Authentium 5.1.0.4 2008.09.22 -
Avast 4.8.1195.0 2008.09.22 -
AVG 8.0.0.161 2008.09.22 -
BitDefender 7.2 2008.09.22 -
CAT-QuickHeal 9.50 2008.09.20 -
ClamAV 0.93.1 2008.09.22 -
DrWeb 4.44.0.09170 2008.09.22 -
eSafe 7.0.17.0 2008.09.22 Suspicious File
eTrust-Vet 31.6.6099 2008.09.22 -
Ewido 4.0 2008.09.22 -
F-Prot 4.4.4.56 2008.09.21 -
F-Secure 8.0.14332.0 2008.09.22 -
Fortinet 3.113.0.0 2008.09.22 -
GData 19 2008.09.22 -
Ikarus T3.1.1.34.0 2008.09.22 -
K7AntiVirus 7.10.467 2008.09.22 -
Kaspersky 7.0.0.125 2008.09.22 -
McAfee 5388 2008.09.19 -
Microsoft 1.3903 2008.09.22 -
NOD32v2 3460 2008.09.22 -
Norman 5.80.02 2008.09.19 -
Panda 9.0.0.4 2008.09.22 -
PCTools 4.4.2.0 2008.09.22 -
Prevx1 V2 2008.09.22 -
Rising 20.63.02.00 2008.09.22 -
Sophos 4.33.0 2008.09.22 -
Sunbelt 3.1.1660.1 2008.09.22 -
Symantec 10 2008.09.22 -
TheHacker 6.3.0.9.090 2008.09.20 -
TrendMicro 8.700.0.1004 2008.09.22 -
VBA32 3.12.8.5 2008.09.22 -
ViRobot 2008.9.22.1387 2008.09.22 -
VirusBuster 4.5.11.0 2008.09.22 -
Webwasher-Gateway 6.6.2 2008.09.22 -

INFORMAZIONI ADDIZIONALI
File size: 185634 bytes
MD5...: 22b396afe7a6897bce406a01fa5b6317
SHA1..: 7b09e56d0fdba5ea8eed9a6a1238585493522657
SHA256: 5dc9df52dc558ffd8edfa7019fb28e3df132805c82765b586e9fb94c0616bda6
SHA512: 51ba54f92a4fbb63c2798998534c095f775722b5b4768247257b6f42446983e6
364a18feddab220c9c11cca25f3c07ede6567923cbc49a3d359f413395564e51
PEiD..: UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser
TrID..: File type identification
UPX compressed Win32 Executable (39.5%)
Win32 EXE Yoda's Crypter (34.3%)
Win32 Executable Generic (11.0%)
Win32 Dynamic Link Library (generic) (9.8%)
Generic Win/DOS Executable (2.5%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x463f10
timedatestamp.....: 0x438f1a82 (Thu Dec 01 15:45:06 2005)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
UPX0 0x1000 0x38000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
UPX1 0x39000 0x2c000 0x2b200 7.92 ea6883d672a1ffb8d8db7a48ad992850
.rsrc 0x65000 0x2000 0x1e00 4.88 8fdfc6e66bf93aafe936092629a07322

( 12 imports )
> KERNEL32.DLL: LoadLibraryA, GetProcAddress, ExitProcess
> ADVAPI32.dll: RegCloseKey
> COMCTL32.dll: -
> comdlg32.dll: GetOpenFileNameA
> GDI32.dll: BitBlt
> ole32.dll: CoInitialize
> OLEAUT32.dll: -
> SHELL32.dll: DragFinish
> USER32.dll: GetDC
> VERSION.dll: VerQueryValueA
> WINMM.dll: mixerOpen
> WSOCK32.dll: -

( 0 exports )

packers (Kaspersky): UPX
packers (F-Prot): UPX

-Da quello che ho capito è stato riconosciuto file sospetto da un solo antivirus