worm CONFLICKER.X

di **seriz** » 05/01/09 12:43

sul server dell'ufficio dove lavoro abbiamo beccato il virus variante win32/conficker.x worm
il worm è stato rilevato dal nod 32 e bloccato, ma non eliminato

come fare ?

grazie

di **shel** » 05/01/09 12:49

ciao

posta un log di hijackthis - http://www.trendsecure.com/portal/en-US ... kthis.php#

Una volta scaricato l'eseguibile, posizionalo in una sua cartella specifica, che avrai creato in precedenza, ad esempio in C:\Programmi. Questo perché se non ha una sua cartella dedicata, non riesce a creare un backup delle voci rimosse prima di effettuare la pulizia.
Ora lancia il programma cliccando l’eseguibile e avvia la scansione, scegliendo la voce "Do a system scan and save a logfile" Posta il report qui nel forum

di **seriz** » 05/01/09 13:15

ecco il risultato:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13.13.52, on 05/01/2009
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\termsrv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\msdtc.exe
C:\Programmi\Lavasoft\Ad-Aware\aawservice.exe
C:\WINNT\System32\cisvc.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\llssrv.exe
C:\Programmi\Eset\nod32krn.exe
C:\Programmi\Persits Software\AspEmail\BIN\EmailAgent.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\tcpsvcs.exe
C:\WINNT\System32\snmp.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Programmi\RealVNC\VNC4\WinVNC4.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\CPQNiMgt\cpqnimgt.exe
C:\WINNT\System32\CPQMgmt\CqMgServ\cqmgserv.exe
C:\WINNT\System32\CPQMgmt\CqMgStor\cqmgstor.exe
C:\WINNT\system32\Dfssvc.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
C:\WINNT\System32\CPQMgmt\CqMgHost\cqmghost.exe
C:\WINNT\System32\CPQMgmt\cpqwmgmt.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\cpqteam.exe
C:\Programmi\Eset\nod32kui.exe
C:\Programmi\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Programmi\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Programmi\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\WINNT\System32\svchost.exe
C:\Programmi\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINNT\System32\cidaemon.exe
C:\WINNT\System32\cidaemon.exe
C:\WINNT\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\rdpclip.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\cpqteam.exe
C:\Programmi\Eset\nod32kui.exe
C:\Programmi\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Programmi\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Programmi\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Programmi\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\PAGINE BIANCHE 2005-06\CD\ServerCDItalia.exe
C:\Documents and Settings\Administrator\Desktop\PULIZIA COMPUTER\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.infoimprese.it/impr/index.jsp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Yahoo! Toolbar con blocco Pop-Up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar1.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar con blocco Pop-Up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [CPQTEAM] cpqteam.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Programmi\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINNT\system32\PSDrvCheck.exe -CheckReg
O4 - HKUS\S-1-5-21-854245398-1708537768-839522115-1006\..\Run: [internat.exe] internat.exe (User 'ASPNET')
O4 - HKUS\S-1-5-21-854245398-1708537768-839522115-1006\..\RunOnce: [^SetupICWDesktop] C:\Programmi\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'ASPNET')
O4 - HKUS\.DEFAULT\..\Run: [internat.exe] internat.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Programmi\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Acrobat Assistant.lnk = C:\Programmi\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Gestione servizi.lnk = C:\Programmi\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O12 - Plugin for .spop: C:\Programmi\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resour ... se6662.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9F000E49-1E38-4431-A857-FE0754C53C9B}: NameServer = 192.168.10.75,213.140.2.21
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Programmi\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: NIC Agent (CpqNicMgmt) - Hewlett-Packard Company - C:\WINNT\System32\CPQNiMgt\cpqnimgt.exe
O23 - Service: Compaq Remote Monitor Service (CpqRcmc) - Compaq - C:\WINNT\System32\CpqRcmc.exe
O23 - Service: Version Control Agent (cpqvcagent) - Hewlett-Packard Company - C:\Compaq\vcagent\vcagent.exe
O23 - Service: Web Agent (CpqWebMgmt) - HP Corporation - C:\WINNT\System32\CPQMgmt\cpqwmgmt.exe
O23 - Service: Foundation Agent (CqMgHost) - Hewlett-Packard Company - C:\WINNT\System32\CPQMgmt\CqMgHost\cqmghost.exe
O23 - Service: Server Agents (CqMgServ) - Hewlett-Packard Company - C:\WINNT\System32\CPQMgmt\CqMgServ\cqmgserv.exe
O23 - Service: Storage Agents (CqMgStor) - Hewlett-Packard Company - C:\WINNT\System32\CPQMgmt\CqMgStor\cqmgstor.exe
O23 - Service: Servizio amministrativo di Gestione disco logico (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmi\Eset\nod32krn.exe
O23 - Service: Persits Software EmailAgent - Persits Software, Inc. - C:\Programmi\Persits Software\AspEmail\BIN\EmailAgent.exe
O23 - Service: Surveyor - Hewlett-Packard Development Group, L.P. - C:\compaq\survey\Surveyor.EXE
O23 - Service: HP ProLiant System Shutdown Service (sysdown) - Compaq Computer Corporation - C:\WINNT\System32\sysdown.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Programmi\RealVNC\VNC4\WinVNC4.exe

--
End of file - 6673 bytes

di **shel** » 05/01/09 13:44

per togliere quello che hai nel pc, fai una scansione online

http://www.bitdefender.com/scan8/ie.html

devi usare il browser internet explorer

di **seriz** » 05/01/09 15:17

ho fatto la scansione con bit defender ma non è risultato nulla.......
:-((

di **Luke57** » 05/01/09 16:56

Ciao, nel report non c'è niente, disattiva l'antivirus e scarica combofix sul desktop
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Fatto questo, clicca su start>esegui, nel box bianco copia e incolla questo comando, virgolette comprese:

"%userprofile%\desktop\combofix.exe" /killall

Premi OK, se tutto va bene parte il programma che potrebbe impiegare molto (non fare altre manovre durante la scansione),una volta terminata, se tutto è andato bene, in C:\ dovresti trovare il file combofix.txt , riavvia in modalità normale e posta il contenuto del file o allegalo.

di **seriz** » 08/01/09 09:52

pare si sia tolto, senza fare l'ultima istruzione che mi avevi indicato.........
non esce + l'avviso di nod32 relativo al worm......

vedremo
grazie

di **paolop** » 14/01/09 11:01

CIao credo di essermi "ammalato" !!!

ComboFix 09-01-13.04 - MANUTP2KDE 2009-01-14 10.43.36.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1040.18.503.224 [GMT 1:00]
Eseguito da: c:\documents and settings\MANUTP2KDE\desktop\combofix.exe
Opzioni usate :: /killall
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Outdated)
* Creato nuovo punto di ripristino
* Resident AV is active

ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\MANUTP~1\IMPOST~1\Temp\rasesnet.exe
c:\docume~1\MANUTP~1\IMPOST~1\Temp\snapsnet.exe
c:\docume~1\MANUTP~1\IMPOST~1\Temp\wavvsnet.exe
c:\recycled\Recycled
c:\windows\17PHolmes1535.exe

.
((((((((((((((((((((((((( Files Creati Da 2008-12-14 al 2009-01-14 )))))))))))))))))))))))))))))))))))
.

2009-01-14 09:52 . 2009-01-14 09:52 <DIR> d--h----- c:\windows\$hf_mig$
2009-01-13 18:06 . 2009-01-14 10:22 <DIR> d-------- C:\a-virus
2009-01-13 17:21 . 2009-01-13 17:21 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\ESET

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-13 16:23 --------- d-----w c:\programmi\ESET
2004-08-19 12:00 166,512 --sha-r c:\windows\system32\ebxmap.dll
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-19 15360]
"DBISQL9"="c:\programmi\Sybase\SQL Anywhere 9\win32\dbisqlg.exe" [2006-11-24 139264]
"SybaseCentral43"="c:\programmi\Sybase\Shared\Sybase Central 4.3\win32\scjview.exe" [2006-09-28 102400]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\programmi\ESET\ESET NOD32 Antivirus\egui.exe" [2008-10-08 1451264]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360]

c:\documents and settings\MANUTP2KDE\Menu Avvio\Programmi\Esecuzione automatica\
Creazione dischi.bat.lnk - C:\Creazione dischi.bat [2008-01-14 48]
SETTIME.lnk - C:\SETTIME.BAT [2008-01-11 26]

c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Avvio veloce di Adobe Reader.lnk - c:\programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
Firewall Client Connectivity Monitor.LNK - c:\programmi\Microsoft Firewall Client\ISATRAY.EXE [2008-01-11 52496]
UltraVNC Server.lnk - c:\programmi\UltraVNC\winvnc.exe [2008-01-14 712704]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\Sybase\\SQL Anywhere 9\\win32\\dbisqlg.exe"=
"c:\\Programmi\\Sybase\\Shared\\Sybase Central 4.3\\win32\\scjview.exe"=
"c:\\Programmi\\UltraVNC\\winvnc.exe"=

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2008-10-08 34312]
R4 ekrn;Eset Service;c:\programmi\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-10-08 468224]
R4 vnccom;vnccom;c:\windows\system32\drivers\vnccom.SYS [2008-01-14 6016]
S3 VSPerfDrv;Performance Tools Driver;c:\programmi\Microsoft Visual Studio 8\Team Tools\Performance Tools\VSPerfDrv.sys [2006-12-02 48128]
S4 ccahvno;Update Config;c:\windows\system32\svchost.exe -k netsvcs [2004-08-19 14336]
S4 ibwow;Driver Task;c:\windows\system32\svchost.exe -k netsvcs [2004-08-19 14336]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\programmi\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [2006-12-02 2805000]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ibwow
ccahvno
.
Contenuto della cartella 'Scheduled Tasks'

2009-01-13 c:\windows\Tasks\At1.job
- c:\windows\system32\g5104iMO.exe []

2009-01-14 c:\windows\Tasks\At10.job
- c:\windows\system32\g5104iMO.exe []

2009-01-14 c:\windows\Tasks\At11.job
- c:\windows\system32\g5104iMO.exe []

2009-01-13 c:\windows\Tasks\At12.job
- c:\windows\system32\g5104iMO.exe []

2009-01-13 c:\windows\Tasks\At13.job
- c:\windows\system32\g5104iMO.exe []

2009-01-13 c:\windows\Tasks\At14.job
- c:\windows\system32\g5104iMO.exe []

2009-01-13 c:\windows\Tasks\At15.job
- c:\windows\system32\g5104iMO.exe []

2009-01-13 c:\windows\Tasks\At16.job
- c:\windows\system32\g5104iMO.exe []

2009-01-13 c:\windows\Tasks\At17.job
- c:\windows\system32\g5104iMO.exe []

2009-01-13 c:\windows\Tasks\At18.job
- c:\windows\system32\g5104iMO.exe []

2009-01-13 c:\windows\Tasks\At19.job
- c:\windows\system32\g5104iMO.exe []

2009-01-14 c:\windows\Tasks\At2.job
- c:\windows\system32\g5104iMO.exe []

2009-01-13 c:\windows\Tasks\At20.job
- c:\windows\system32\g5104iMO.exe []

2009-01-13 c:\windows\Tasks\At21.job
- c:\windows\system32\g5104iMO.exe []

2009-01-13 c:\windows\Tasks\At22.job
- c:\windows\system32\g5104iMO.exe []

2009-01-13 c:\windows\Tasks\At23.job
- c:\windows\system32\g5104iMO.exe []

2009-01-13 c:\windows\Tasks\At24.job
- c:\windows\system32\g5104iMO.exe []

2009-01-14 c:\windows\Tasks\At3.job
- c:\windows\system32\g5104iMO.exe []

2009-01-14 c:\windows\Tasks\At4.job
- c:\windows\system32\g5104iMO.exe []

2009-01-14 c:\windows\Tasks\At5.job
- c:\windows\system32\g5104iMO.exe []

2009-01-14 c:\windows\Tasks\At6.job
- c:\windows\system32\g5104iMO.exe []

2009-01-14 c:\windows\Tasks\At7.job
- c:\windows\system32\g5104iMO.exe []

2009-01-14 c:\windows\Tasks\At8.job
- c:\windows\system32\g5104iMO.exe []

2009-01-14 c:\windows\Tasks\At9.job
- c:\windows\system32\g5104iMO.exe []
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://it.yahoo.com/
uInternet Settings,ProxyServer = PROXYSRV:8080
uInternet Settings,ProxyOverride = <local>
IE: Add to &Teleport - c:\programmi\Teleport Pro\teleport.htm
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
LSP: c:\programmi\Microsoft Firewall Client\wspwsp.dll
FF - ProfilePath - c:\documents and settings\MANUTP2KDE\Dati applicazioni\Mozilla\Firefox\Profiles\ati7cnhb.default\
FF - prefs.js: browser.startup.homepage - hxxp://it.yahoo.com/
FF - prefs.js: network.proxy.ftp - PROXYSRV
FF - prefs.js: network.proxy.ftp_port - 8080
FF - prefs.js: network.proxy.gopher - PROXYSRV
FF - prefs.js: network.proxy.gopher_port - 8080
FF - prefs.js: network.proxy.http - PROXYSRV
FF - prefs.js: network.proxy.http_port - 8080
FF - prefs.js: network.proxy.socks - PROXYSRV
FF - prefs.js: network.proxy.socks_port - 8080
FF - prefs.js: network.proxy.ssl - PROXYSRV
FF - prefs.js: network.proxy.ssl_port - 8080
FF - prefs.js: network.proxy.type - 1
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-14 10:50:39
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ccahvno]
"ServiceDll"="c:\windows\system32\ebxmap.dll"
--

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ibwow]
"ServiceDll"="c:\windows\system32\ebxmap.dll"
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\programmi\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
.
**************************************************************************
.
Ora fine scansione: 2009-01-14 10:54:27 - Il pc è stato riavviato
ComboFix-quarantined-files.txt 2009-01-14 09:54:24

Pre-Run: 4.980.981.760 byte disponibili
Post-Run: 5,628,350,464 byte disponibili

165

di **Luke57** » 14/01/09 11:40

Ciao, apri un file di testo dal blocco note, al suo interno copi e incolli il seguente codice:

Codice: Seleziona tutto: Driver:: ccahvno ibwow Folder:: c:\windows\Tasks File:: c:\windows\system32\ebxmap.dll

lo chiami CFScript.txt e lo salvi nella stessa direzione (directory) di combofix.
Poi, con il puntatore del mouse, lo trascina sull'icona di combofix e il programma avvierà una nuova scansione. Al termine, riavvia il computer e posta il nuovo report, se prodotto.

di **paolop** » 14/01/09 14:04

GRAZIE 1000

Sembra che ora sia tutto ok: il fatto di avere il virus o no lo capivo da un'eccezione nel firewall di Windows con un nome strano (lettere a caso) presente ad ogni riavvio, ora non c'è più!

Cmq ecco il log

ComboFix 09-01-13.04 - MANUTP2KDE 2009-01-14 13:48:18.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1040.18.503.93 [GMT 1:00]
Eseguito da: c:\documents and settings\MANUTP2KDE\Desktop\ComboFix.exe
Opzioni usate :: c:\documents and settings\MANUTP2KDE\Desktop\CFScript.txt
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Outdated)
* Creato nuovo punto di ripristino

ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!

FILE ::
c:\windows\system32\ebxmap.dll
c:\windows\Tasks -- Whitelisted --
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\ebxmap.dll

.
((((((((((((((((((((((((((((((((((((((( Driver/Servizi )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_CCAHVNO
-------\Legacy_IBWOW
-------\Service_ccahvno
-------\Service_ibwow

((((((((((((((((((((((((( Files Creati Da 2008-12-14 al 2009-01-14 )))))))))))))))))))))))))))))))))))
.

2009-01-14 11:05 . 2009-01-14 11:06 <DIR> d-------- c:\windows\BDOSCAN8
2009-01-14 09:52 . 2009-01-14 09:52 <DIR> d--h----- c:\windows\$hf_mig$
2009-01-13 18:06 . 2009-01-14 10:22 <DIR> d-------- C:\a-virus
2009-01-13 17:21 . 2009-01-13 17:21 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\ESET

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-13 16:23 --------- d-----w c:\programmi\ESET
.

((((((((((((((((((((((((((((( snapshot@2009-01-14_10.53.38.29 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-01-09 14:01:48 118,784 ----a-w c:\windows\BDOSCAN8\bdupd.dll
+ 2008-01-09 14:01:48 53,248 ----a-w c:\windows\BDOSCAN8\ipsupd.dll
+ 2008-01-09 14:01:48 53,248 ----a-w c:\windows\bdoscandel.exe
+ 2008-01-09 14:01:48 118,784 ----a-w c:\windows\Downloaded Program Files\bdupd.dll
+ 2008-01-09 14:01:48 53,248 ----a-w c:\windows\Downloaded Program Files\ipsupd.dll
+ 2005-10-20 19:02:28 163,328 ----a-w c:\windows\ERDNT\subs\ERDNT.EXE
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-19 15360]
"DBISQL9"="c:\programmi\Sybase\SQL Anywhere 9\win32\dbisqlg.exe" [2006-11-24 139264]
"SybaseCentral43"="c:\programmi\Sybase\Shared\Sybase Central 4.3\win32\scjview.exe" [2006-09-28 102400]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\programmi\ESET\ESET NOD32 Antivirus\egui.exe" [2008-10-08 1451264]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360]

c:\documents and settings\MANUTP2KDE\Menu Avvio\Programmi\Esecuzione automatica\
Creazione dischi.bat.lnk - C:\Creazione dischi.bat [2008-01-14 48]
SETTIME.lnk - C:\SETTIME.BAT [2008-01-11 26]

c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Avvio veloce di Adobe Reader.lnk - c:\programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
Firewall Client Connectivity Monitor.LNK - c:\programmi\Microsoft Firewall Client\ISATRAY.EXE [2008-01-11 52496]
UltraVNC Server.lnk - c:\programmi\UltraVNC\winvnc.exe [2008-01-14 712704]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\Sybase\\SQL Anywhere 9\\win32\\dbisqlg.exe"=
"c:\\Programmi\\Sybase\\Shared\\Sybase Central 4.3\\win32\\scjview.exe"=
"c:\\Programmi\\UltraVNC\\winvnc.exe"=

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2008-10-08 34312]
R4 ekrn;Eset Service;c:\programmi\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-10-08 468224]
R4 vnccom;vnccom;c:\windows\system32\drivers\vnccom.SYS [2008-01-14 6016]
S3 VSPerfDrv;Performance Tools Driver;c:\programmi\Microsoft Visual Studio 8\Team Tools\Performance Tools\VSPerfDrv.sys [2006-12-02 48128]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\programmi\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [2006-12-02 2805000]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contenuto della cartella 'Scheduled Tasks'

2009-01-13 c:\windows\Tasks\At1.job
- c:\windows\system32\g5104iMO.exe []

2009-01-14 c:\windows\Tasks\At10.job
- c:\windows\system32\g5104iMO.exe []

2009-01-14 c:\windows\Tasks\At11.job
- c:\windows\system32\g5104iMO.exe []

2009-01-14 c:\windows\Tasks\At12.job
- c:\windows\system32\g5104iMO.exe []

2009-01-14 c:\windows\Tasks\At13.job
- c:\windows\system32\g5104iMO.exe []

2009-01-14 c:\windows\Tasks\At14.job
- c:\windows\system32\g5104iMO.exe []

2009-01-14 c:\windows\Tasks\At15.job
- c:\windows\system32\g5104iMO.exe []

2009-01-13 c:\windows\Tasks\At16.job
- c:\windows\system32\g5104iMO.exe []

2009-01-13 c:\windows\Tasks\At17.job
- c:\windows\system32\g5104iMO.exe []

2009-01-13 c:\windows\Tasks\At18.job
- c:\windows\system32\g5104iMO.exe []

2009-01-13 c:\windows\Tasks\At19.job
- c:\windows\system32\g5104iMO.exe []

2009-01-14 c:\windows\Tasks\At2.job
- c:\windows\system32\g5104iMO.exe []

2009-01-13 c:\windows\Tasks\At20.job
- c:\windows\system32\g5104iMO.exe []

2009-01-13 c:\windows\Tasks\At21.job
- c:\windows\system32\g5104iMO.exe []

2009-01-13 c:\windows\Tasks\At22.job
- c:\windows\system32\g5104iMO.exe []

2009-01-13 c:\windows\Tasks\At23.job
- c:\windows\system32\g5104iMO.exe []

2009-01-13 c:\windows\Tasks\At24.job
- c:\windows\system32\g5104iMO.exe []

2009-01-14 c:\windows\Tasks\At3.job
- c:\windows\system32\g5104iMO.exe []

2009-01-14 c:\windows\Tasks\At4.job
- c:\windows\system32\g5104iMO.exe []

2009-01-14 c:\windows\Tasks\At5.job
- c:\windows\system32\g5104iMO.exe []

2009-01-14 c:\windows\Tasks\At6.job
- c:\windows\system32\g5104iMO.exe []

2009-01-14 c:\windows\Tasks\At7.job
- c:\windows\system32\g5104iMO.exe []

2009-01-14 c:\windows\Tasks\At8.job
- c:\windows\system32\g5104iMO.exe []

2009-01-14 c:\windows\Tasks\At9.job
- c:\windows\system32\g5104iMO.exe []
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://it.yahoo.com/
uInternet Settings,ProxyServer = PROXYSRV:8080
uInternet Settings,ProxyOverride = <local>
IE: Add to &Teleport - c:\programmi\Teleport Pro\teleport.htm
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
LSP: c:\programmi\Microsoft Firewall Client\wspwsp.dll
FF - ProfilePath - c:\documents and settings\MANUTP2KDE\Dati applicazioni\Mozilla\Firefox\Profiles\ati7cnhb.default\
FF - prefs.js: browser.startup.homepage - hxxp://it.yahoo.com/
FF - prefs.js: network.proxy.ftp - PROXYSRV
FF - prefs.js: network.proxy.ftp_port - 8080
FF - prefs.js: network.proxy.gopher - PROXYSRV
FF - prefs.js: network.proxy.gopher_port - 8080
FF - prefs.js: network.proxy.http - PROXYSRV
FF - prefs.js: network.proxy.http_port - 8080
FF - prefs.js: network.proxy.socks - PROXYSRV
FF - prefs.js: network.proxy.socks_port - 8080
FF - prefs.js: network.proxy.ssl - PROXYSRV
FF - prefs.js: network.proxy.ssl_port - 8080
FF - prefs.js: network.proxy.type - 1
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-14 13:57:55
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\programmi\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
.
**************************************************************************
.
Ora fine scansione: 2009-01-14 14:01:35 - Il pc è stato riavviato
ComboFix-quarantined-files.txt 2009-01-14 13:01:33
ComboFix2.txt 2009-01-14 10:16:34
ComboFix3.txt 2009-01-14 09:54:28

Pre-Run: 5,590,958,080 byte disponibili
Post-Run: 5,486,202,880 byte disponibili

170

di **paolop** » 19/01/09 17:25

Scusatemi ancora, credo che un mio amico abbia un problema simile, ma non so come impostare il CFScript.txt per risolvere il problema.

Ecco il suo log, credo che sia un servizio che crea il virus ogni volta

ComboFix 09-01-15.01 - maggi 2009-01-16 16:22:28.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1040.18.3062.2279 [GMT 1:00]
Eseguito da: c:\documents and settings\MAGGI\Desktop\ComboFix.exe
Opzioni usate :: c:\documents and settings\MAGGI\Desktop\CFScript.txt
AV: Trend Micro OfficeScan Antivirus *On-access scanning disabled* (Outdated)
FW: Trend Micro Personal Firewall *disabled*
* Creato nuovo punto di ripristino

ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!

FILE ::
c:\windows\system32\umsof.dll
c:\windows\Tasks -- Whitelisted --
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Driver/Servizi )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ZEXSGX
-------\Service_zexsgx

((((((((((((((((((((((((( Files Creati Da 2008-12-16 al 2009-01-16 )))))))))))))))))))))))))))))))))))
.

2009-01-16 16:27 . 2009-01-16 16:27 <DIR> d-------- c:\temp\WPDNSE
2009-01-16 16:27 . 2009-01-16 16:27 53,248 --a------ c:\temp\catchme.dll
2009-01-16 16:25 . 2007-05-08 01:43 300,656 --a------ c:\temp\GQA943.EXE
2009-01-16 16:25 . 2009-01-16 16:25 16,384 --a----t- c:\temp\Perflib_Perfdata_ad4.dat
2009-01-16 16:25 . 2009-01-16 16:25 16,384 --a----t- c:\temp\Perflib_Perfdata_134.dat
2009-01-16 16:20 . 2009-01-16 16:27 <DIR> d-------- c:\temp\Rar$DR00.547
2009-01-15 10:18 . 2009-01-08 11:00 706,872 --a------ C:\WindowsXP-KB921883-x86-ITA.exe
2009-01-15 10:18 . 2009-01-08 11:01 654,704 --a------ C:\WindowsXP-KB958644-x86-ITA.exe
2009-01-15 09:19 . 2009-01-15 09:19 <DIR> d-------- c:\windows\ServicePackFiles
2009-01-15 08:46 . 2009-01-15 08:47 38 --a------ c:\windows\AviSplitter.INI
2009-01-15 08:43 . 2008-07-25 09:38 323,000,872 --a------ C:\WindowsXP-KB936929-SP3-x86-ITA.exe
2009-01-14 11:44 . 2007-11-26 12:24 49,152 --a------ c:\windows\system32\LMJCALCOCX.OCX
2009-01-14 11:42 . 2009-01-14 11:48 <DIR> d-------- c:\temp\PUNCH5
2009-01-13 08:37 . 2009-01-13 08:37 <DIR> d-------- c:\temp\is-DG3OS.tmp
2009-01-13 08:37 . 2009-01-13 12:52 <DIR> d-------- c:\documents and settings\MAGGI\Dati applicazioni\Vso
2009-01-13 08:37 . 2009-01-13 08:37 47,360 --a------ c:\documents and settings\MAGGI\Dati applicazioni\pcouffin.sys
2009-01-08 16:24 . 2009-01-08 16:24 <DIR> d--h----- c:\windows\$hf_mig$
2009-01-08 16:24 . 2008-10-15 17:36 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll
2008-12-18 08:47 . 2008-12-18 08:47 <DIR> d-------- c:\programmi\XP Codec Pack
2008-12-18 08:47 . 2008-07-09 10:05 421,888 --a------ c:\windows\system32\ac3filter.acm
2008-12-16 16:31 . 2008-12-16 16:31 <DIR> d-------- c:\temp\Div2D9.tmp
2008-12-16 16:04 . 2008-12-16 16:04 <DIR> d-------- c:\programmi\vso
2008-12-16 16:04 . 2009-01-13 08:37 47,360 --a------ c:\windows\system32\drivers\pcouffin.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-16 14:33 --------- d-----w c:\documents and settings\MAGGI\Dati applicazioni\Skype
2009-01-15 08:10 --------- d-----w c:\programmi\ContabilitaPMI
2009-01-15 08:09 --------- d-----w c:\documents and settings\MAGGI\Dati applicazioni\Eltima Software
2009-01-12 13:53 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Microsoft Help
2008-12-15 12:56 8,864 ----a-w c:\windows\system32\drivers\CDAC15BA.SYS
2008-12-15 12:56 39,936 ----a-w c:\windows\system32\drivers\CDAC11BA.EXE
2008-12-15 12:56 30,720 ---h--r c:\windows\CdaC13BA.EXE
2008-12-15 12:56 112,128 ---h--r c:\windows\CdaC14BA.DLL
2008-12-04 13:05 --------- d-----w c:\programmi\File comuni\Adobe
2008-12-04 12:51 --------- d-----w c:\documents and settings\MAGGI\Dati applicazioni\GiMagazzinoWeb
2008-12-04 09:34 --------- d-----w c:\documents and settings\MAGGI\Dati applicazioni\TortoiseSVN
2008-12-04 09:21 --------- d-----w c:\documents and settings\MAGGI\Dati applicazioni\Subversion
2008-12-04 09:20 --------- d-----w c:\programmi\TortoiseSVN
2008-12-04 09:20 --------- d-----w c:\programmi\File comuni\TortoiseOverlays
2008-12-04 09:20 --------- d-----w c:\programmi\AnkhSvn 2.0
2008-11-26 12:46 --------- d-----w c:\programmi\Axis Communications
2008-11-24 07:44 --------- d-----w c:\programmi\Beyond Compare 2
.

((((((((((((((((((((((((((((( snapshot@2009-01-16_12.35.50.44 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-20 19:02:28 163,328 ----a-w c:\windows\ERDNT\subs\ERDNT.EXE
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
@="{C5994560-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 17:52 80384 --a------ c:\programmi\File comuni\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
@="{C5994561-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 17:52 80384 --a------ c:\programmi\File comuni\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
@="{C5994562-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 17:52 80384 --a------ c:\programmi\File comuni\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
@="{C5994563-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 17:52 80384 --a------ c:\programmi\File comuni\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
@="{C5994564-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 17:52 80384 --a------ c:\programmi\File comuni\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
@="{C5994565-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 17:52 80384 --a------ c:\programmi\File comuni\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
@="{C5994566-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 17:52 80384 --a------ c:\programmi\File comuni\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
@="{C5994567-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 17:52 80384 --a------ c:\programmi\File comuni\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
@="{C5994568-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 17:52 80384 --a------ c:\programmi\File comuni\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DBISQL9"="c:\programmi\File comuni\ASA9\win32\dbisqlg.exe" [2006-11-24 139264]
"SybaseCentral43"="c:\programmi\File comuni\ASA9\shared\Sybase Central 4.3\win32\scjview.exe" [2006-09-28 102400]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"Skype"="c:\programmi\Skype\Phone\Skype.exe" [2008-05-30 21718312]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\programmi\File comuni\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-09-11 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-09-11 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-11 137752]
"SoundMAXPnP"="c:\programmi\Analog Devices\Core\smax4pnp.exe" [2006-05-01 843776]
"OfficeScanNT Monitor"="c:\programmi\Trend Micro\OfficeScan Client\pccntmon.exe" [2007-05-08 702072]
"NeroFilterCheck"="c:\programmi\File comuni\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"WinVNC"="c:\programmi\UltraVNC\winvnc.exe" [2006-06-18 712704]
"Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]

c:\documents and settings\MAGGI\Menu Avvio\Programmi\Esecuzione automatica\
DB Server 14.0.lnk - c:\programmi\File comuni\ASA9\win32\dbsrv9.exe [2008-05-21 73728]
dbserver P2000.lnk - c:\programmi\File comuni\ASA9\win32\dbsrv9.exe [2008-05-21 73728]
Monitor License.lnk - c:\asis1v11\BIN\tool\AprMonitorLicense.exe [2008-05-20 61440]
Sdd Service Manager.lnk - c:\asis1v11\BIN\Sddmangr.exe [2008-05-20 172138]
settime.cmd [2005-08-25 30]
Skype.lnk - c:\windows\Installer\{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}\Skype.ico [2008-07-02 94334]

c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Service Manager.lnk - c:\programmi\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2005-05-03 81920]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= ffdshow.ax
"msacm.ac3filter"= ac3filter.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntivirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Asis1v11\\BIN\\tool\\AprMonitorLicense.exe"=
"c:\\Programmi\\File comuni\\SafeNet Sentinel\\Sentinel Protection Server\\WinNT\\spnsrvnt.exe"=
"c:\\Programmi\\File comuni\\SafeNet Sentinel\\Sentinel Keys Server\\sntlkeyssrvr.exe"=
"c:\\Programmi\\File comuni\\ASA9\\win32\\dbeng9.exe"=
"c:\\Programmi\\File comuni\\ASA9\\win32\\dbsrv9.exe"=
"c:\\Programmi\\File comuni\\ASA9\\win32\\dbisqlg.exe"=
"c:\\Programmi\\File comuni\\ASA9\\shared\\Sybase Central 4.2\\scjview.exe"=
"c:\\Programmi\\File comuni\\ASA9\\shared\\Sybase Central 4.3\\win32\\scjview.exe"=
"c:\\Programmi\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Programmi\\Microsoft Visual Studio\\COMMON\\MSDev98\\Bin\\MSDEV.EXE"=
"c:\\CARLO\\Half\\hl.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmi\\Skype\\Phone\\Skype.exe"=

R3 tmcfw;Trend Micro Common Firewall Service;c:\windows\system32\drivers\TM_CFW.sys [2007-04-20 307984]
R4 dpinject;DevPartner Injection Driver;c:\programmi\File comuni\Compuware\NMShared\Injector\2.12\DPInject.sys [2007-08-10 65896]
R4 dpinjsvc;DevPartner Injection Service;c:\programmi\File comuni\Compuware\NMShared\Injector\2.12\DPInjCfgService.exe [2007-08-01 40960]
R4 NCS;DevPartner Control Service;c:\progra~1\COMPUW~1\DEVPAR~1\Analysis\NCS.exe [2007-08-10 52736]
R4 SDDServerService;SDDServerService;c:\asis1v11\BIN\SDDServerService.exe [2008-05-20 28672]
R4 SentinelKeysServer;Sentinel Keys Server;c:\programmi\File comuni\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe [2008-03-21 327800]
R4 TmPreFilter;Trend Micro PreFilter;c:\programmi\Trend Micro\OfficeScan Client\tmpreflt.sys [2006-09-27 36368]
R4 vnccom;vnccom;c:\windows\system32\drivers\vnccom.SYS [2008-05-21 6016]
S3 mach5;mach5;c:\windows\system32\mach5.sys [2007-08-01 26624]
S3 TmPfw;OfficeScan NT Firewall;c:\programmi\Trend Micro\OfficeScan Client\TmPfw.exe [2007-04-04 943696]
S3 TmProxy;OfficeScan NT Proxy Service;c:\programmi\Trend Micro\OfficeScan Client\TmProxy.exe [2007-04-27 575064]
S3 VSPerfDrv90;Performance Tools Driver 9.0;c:\programmi\Microsoft Visual Studio 9.0\Team Tools\Performance Tools\VSPerfDrv90.sys [2007-09-05 55664]
S4 TmFilter;Trend Micro Filter;c:\programmi\Trend Micro\OfficeScan Client\tmxpflt.sys [2006-09-27 205328]
.
Contenuto della cartella 'Scheduled Tasks'
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
uInternet Settings,ProxyServer = 172.17.6.2:8080
uInternet Settings,ProxyOverride = 172.17.*;127.0.0.1;localhost;192.168.211.*;*.computesweb.it;l*.computes.lan;<local>
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
LSP: imon.dll

O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd

O16 -: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://190.203.79.142/activex/AMC.cab
c:\windows\Downloaded Program Files\setup.inf
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-16 16:27:45
Windows 5.1.2600 Service Pack 3 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\windows\system32\drivers\CDAC11BA.EXE
c:\programmi\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
c:\programmi\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
c:\programmi\File comuni\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
c:\programmi\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\programmi\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\programmi\TortoiseSVN\bin\TSVNCache.exe
c:\windows\system32\igfxsrvc.exe
c:\programmi\File comuni\Ahead\Lib\NMIndexingService.exe
c:\programmi\File comuni\Ahead\Lib\NMIndexStoreSvr.exe
c:\programmi\Trend Micro\OfficeScan Client\Misc\xpupg.exe
c:\programmi\Trend Micro\OfficeScan Client\PccNTUpd.exe
.
**************************************************************************
.
Ora fine scansione: 2009-01-16 16:31:45 - Il pc è stato riavviato
ComboFix-quarantined-files.txt 2009-01-16 15:31:42
ComboFix2.txt 2009-01-16 11:36:30

Pre-Run: 38,749,265,920 byte disponibili
Post-Run: 38,636,982,272 byte disponibili

218

di **Luke57** » 19/01/09 23:28

Ciao, nel report del tuo amico non appare niente, fagli fare un scan on line qui:
http://www.kaspersky.com/virusscanner
e poi postare il report.
Invece, tu apri la cartella C:\windows\tasks, vai nel menu Avanzate, metti la spunta a "visualizza operazioni nascoste" poi elimina i file con estensione .job presenti, per intendersi quelli che sono nel tuo report di combofix nel settore
"Contenuto della cartella 'Scheduled Tasks'.

di **paolop** » 20/01/09 08:22

Ancora grazie... non 1000... 10.000,
stiamo seguendo le indicazioni

di **paolop** » 20/01/09 13:46

Ecco il log

Tuesday, January 20, 2009
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Tuesday, January 20, 2009 08:05:17
Records in database: 1652194
Scan settings
Scan using the following database extended
Scan archives yes
Scan mail databases yes
Scan area Critical Areas
C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica
C:\Documents and Settings\MAGGI\Menu Avvio\Programmi\Esecuzione automatica
C:\Program Files
C:\Programmi
C:\WINDOWS
Scan statistics
Files scanned 75943
Threat name 2
Infected objects 3
Suspicious objects 0
Duration of the scan 01:35:21

File name Threat name Threats count
C:\Programmi\UltraVNC\vnchooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c 1
C:\Programmi\UltraVNC\vncviewer.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.1102 1
C:\Programmi\UltraVNC\winvnc.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c 1
The selected area was scanned.

di **conf** » 20/02/09 17:55

Luke57 ha scritto:Ciao, nel report non c'è niente, disattiva l'antivirus e scarica combofix sul desktop
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Fatto questo, clicca su start>esegui, nel box bianco copia e incolla questo comando, virgolette comprese:

"%userprofile%\desktop\combofix.exe" /killall

Premi OK, se tutto va bene parte il programma che potrebbe impiegare molto (non fare altre manovre durante la scansione),una volta terminata, se tutto è andato bene, in C:\ dovresti trovare il file combofix.txt , riavvia in modalità normale e posta il contenuto del file o allegalo.

Ciao a tutti,

cercando in internet ho trovato questo thread relativo a questo worm.
Io sono esattamente nella stessa situazione, il Nod 32 mih a rilevato questo Conflicker.x, compaionio Operazioni pianificate in continuazione (At1, At2) che lanciano rundll32.exe più quelli che sono parametri del malware.

Ho updatato Windows, aggiornato Nod ed eseguito la scansione ma ad ogni riavvio dopo un pò ricompare il problema.

Seguendo i consigli di questo thread ho scaricato combofix e questo è il logo che mi ha estratto (ma è solo un logo o esegue già un'azione?)

Codice: Seleziona tutto: ComboFix 09-02-19.01 - maspero 2009-02-20 17.25.30.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1040.18.3071.2576 [GMT 1:00] Eseguito da: c:\documents and settings\maspero\desktop\combofix.exe Opzioni usate :: /killall AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated) * Creato nuovo punto di ripristino * Resident AV is active ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !! . ((((((((((((((((((((((((((((((((((((( Altre eliminazioni ))))))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((((( Driver/Servizi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_SROSA ((((((((((((((((((((((((( Files Creati Da 2009-01-20 al 2009-02-20 ))))))))))))))))))))))))))))))))))) . 2009-02-20 17:02 . 2009-02-20 17:05 <DIR> d-------- c:\programmi\Windows Live Safety Center 2009-02-20 16:36 . 2009-02-20 16:37 <DIR> d-------- c:\windows\BDOSCAN8 2009-02-20 10:56 . 2009-02-20 11:01 <DIR> d-------- c:\windows\NV3040468.TMP 2009-02-20 10:56 . 2008-09-17 23:55 201,050 --a------ c:\windows\system32\nvapps.nvb 2009-02-20 10:38 . 2009-02-20 10:38 <DIR> d-------- c:\windows\system32\XPSViewer 2009-02-20 10:38 . 2009-02-20 10:38 <DIR> d-------- c:\programmi\Reference Assemblies 2009-02-20 10:38 . 2009-02-20 10:38 <DIR> d-------- c:\programmi\MSBuild 2009-02-20 10:37 . 2009-02-20 10:38 <DIR> d-------- C:\32640fef16eaf6c9274a1b 2009-02-20 10:37 . 2008-07-06 13:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll 2009-02-20 10:37 . 2008-07-06 13:06 1,676,288 -----c--- c:\windows\system32\dllcache\xpssvcs.dll 2009-02-20 10:37 . 2008-07-06 11:50 597,504 -----c--- c:\windows\system32\dllcache\printfilterpipelinesvc.exe 2009-02-20 10:37 . 2008-07-06 13:06 575,488 --------- c:\windows\system32\xpsshhdr.dll 2009-02-20 10:37 . 2008-07-06 13:06 575,488 -----c--- c:\windows\system32\dllcache\xpsshhdr.dll 2009-02-20 10:37 . 2008-07-06 13:06 117,760 --------- c:\windows\system32\prntvpt.dll 2009-02-20 10:37 . 2008-07-06 13:06 89,088 -----c--- c:\windows\system32\dllcache\filterpipelineprintproc.dll 2009-02-20 10:34 . 2009-02-20 10:35 <DIR> d-------- C:\836fb87bb6d6da5fdd63c7e9 2009-02-20 10:34 . 2009-02-20 10:34 <DIR> d-------- C:\4a3fa52be2d3d727af70c6 2009-02-19 22:25 . 2009-02-19 22:25 <DIR> d-------- c:\programmi\AnswerWorks 4.0 2009-02-19 22:16 . 2009-02-19 22:26 <DIR> d-------- c:\programmi\AutoCAD 2007 2009-02-19 22:16 . 2009-02-19 22:27 <DIR> d-------- c:\documents and settings\maspero\Dati applicazioni\Autodesk 2009-02-19 22:16 . 2009-02-19 22:16 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\Autodesk 2009-02-19 22:14 . 2009-02-19 22:26 <DIR> d-------- c:\programmi\File comuni\Autodesk Shared 2009-02-19 22:14 . 2009-02-19 22:14 <DIR> d-------- c:\programmi\Autodesk 2009-02-19 20:24 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys 2009-02-19 20:22 . 2009-02-19 20:22 <DIR> d-------- c:\programmi\MSXML 4.0 2009-02-19 20:22 . 2008-12-11 11:57 333,952 -----c--- c:\windows\system32\dllcache\srv.sys 2009-02-19 20:00 . 2009-02-19 20:00 <DIR> d-------- c:\windows\ServicePackFiles 2009-02-19 20:00 . 2008-04-13 19:14 294,912 -----c--- c:\windows\system32\dllcache\dlimport.exe 2009-02-19 19:56 . 2006-12-28 12:01 19,569 --a------ c:\windows\[u]0[/u]02829_.tmp 2009-02-19 19:41 . 2008-06-14 18:32 272,768 -----c--- c:\windows\system32\dllcache\bthport.sys 2009-02-19 19:40 . 2008-09-15 16:24 1,846,400 -----c--- c:\windows\system32\dllcache\win32k.sys 2009-02-19 18:20 . 2008-06-17 20:01 8,490,496 -----c--- c:\windows\system32\dllcache\shell32.dll 2009-02-19 18:07 . 2009-02-19 18:07 <DIR> d--h----- c:\windows\system32\GroupPolicy 2009-02-19 16:47 . 2008-08-14 14:22 2,192,896 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe 2009-02-19 16:47 . 2008-08-14 14:22 2,148,864 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe 2009-02-19 16:47 . 2008-08-14 14:22 2,069,760 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe 2009-02-19 16:47 . 2008-08-14 14:22 2,027,520 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe 2009-02-19 16:42 . 2008-04-11 20:04 691,712 -----c--- c:\windows\system32\dllcache\inetcomm.dll 2009-02-19 16:42 . 2008-05-01 15:34 331,776 -----c--- c:\windows\system32\dllcache\msadce.dll 2009-02-19 16:39 . 2008-09-04 18:15 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll 2009-02-19 16:39 . 2008-10-15 17:36 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll 2009-02-19 16:27 . 2008-10-16 14:08 27,672 --a------ c:\windows\system32\wuapi.dll.mui 2009-02-19 14:33 . 2009-02-20 10:40 1,374 --a------ c:\windows\imsins.BAK 2009-02-09 10:37 . 2009-02-09 10:37 <DIR> d-------- c:\programmi\TortoiseSVN 2009-02-09 10:37 . 2009-02-09 10:37 <DIR> d-------- c:\programmi\File comuni\TortoiseOverlays 2009-01-29 15:55 . 2009-02-20 14:19 664 --a------ c:\windows\system32\d3d9caps.dat . (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-20 15:34 --------- d-----w c:\documents and settings\maspero\Dati applicazioni\foobar2000 2009-02-20 15:30 --------- d-----w c:\programmi\Mozilla Thunderbird 2009-02-20 11:22 --------- d-----w c:\documents and settings\Administrator.DPC\Dati applicazioni\foobar2000 2009-02-19 21:09 --------- d-----w c:\programmi\Microsoft Silverlight 2009-02-19 19:34 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Microsoft Help 2009-02-19 09:46 --------- d-----w c:\programmi\foobar2000 2009-02-18 13:08 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Spybot - Search & Destroy 2009-02-17 10:47 --------- d-----w c:\programmi\Spybot - Search & Destroy 2009-02-17 10:38 --------- d-----w c:\programmi\Malwarebytes' Anti-Malware 2009-02-16 13:13 --------- d-----w c:\documents and settings\maspero\Dati applicazioni\FileZilla 2009-02-12 13:10 --------- d-----w c:\programmi\Google 2009-02-11 09:19 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys 2009-02-11 09:19 15,504 ----a-w c:\windows\system32\drivers\mbam.sys 2009-01-28 10:24 --------- d-----w c:\programmi\GuildFTPd 2009-01-22 10:04 --------- d-----w c:\programmi\CCleaner . ((((((((((((((((((((((((((((((((((((( Punti Reg Caricati )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* i valori vuoti & legittimi/default non sono visualizzati. REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal] @="{C5994560-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}] 2008-01-16 17:52 80384 --a------ c:\programmi\File comuni\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified] @="{C5994561-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}] 2008-01-16 17:52 80384 --a------ c:\programmi\File comuni\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict] @="{C5994562-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}] 2008-01-16 17:52 80384 --a------ c:\programmi\File comuni\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked] @="{C5994563-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}] 2008-01-16 17:52 80384 --a------ c:\programmi\File comuni\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly] @="{C5994564-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}] 2008-01-16 17:52 80384 --a------ c:\programmi\File comuni\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted] @="{C5994565-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}] 2008-01-16 17:52 80384 --a------ c:\programmi\File comuni\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded] @="{C5994566-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}] 2008-01-16 17:52 80384 --a------ c:\programmi\File comuni\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored] @="{C5994567-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}] 2008-01-16 17:52 80384 --a------ c:\programmi\File comuni\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned] @="{C5994568-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}] 2008-01-16 17:52 80384 --a------ c:\programmi\File comuni\TortoiseOverlays\TortoiseOverlays.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\programmi\File comuni\Ahead\lib\NMBgMonitor.exe" [2005-09-25 94208] "Google Update"="c:\documents and settings\maspero\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe" [2008-09-08 133104] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13574144] "Acrobat Assistant 7.0"="c:\programmi\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 483328] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2005-09-25 155648] "SunJavaUpdateSched"="c:\programmi\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "QuickTime Task"="c:\programmi\QuickTime\qttask.exe" [2008-01-31 385024] "OODefragTray"="c:\windows\system32\oodtray.exe" [2007-05-11 2512392] "Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "HP Software Update"="c:\programmi\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152] "UnlockerAssistant"="c:\programmi\Unlocker\UnlockerAssistant.exe" [2006-09-07 15872] "egui"="c:\programmi\ESET\ESET NOD32 Antivirus\egui.exe" [2008-07-01 1447168] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-17 86016] "nwiz"="nwiz.exe" [2008-09-17 c:\windows\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360] c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\ AutoCAD Startup Accelerator.lnk - c:\programmi\File comuni\Autodesk Shared\acstart17.exe [2006-03-05 11000] Launchy.lnk - c:\programmi\Launchy\Launchy.exe [2008-12-04 286720] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\[u]0[/u]OODBS [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^Avvio veloce di Adobe Acrobat.lnk] path=c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\Avvio veloce di Adobe Acrobat.lnk backup=c:\windows\pss\Avvio veloce di Adobe Acrobat.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^maspero^Menu Avvio^Programmi^Esecuzione automatica^Adobe Gamma.lnk] path=c:\documents and settings\maspero\Menu Avvio\Programmi\Esecuzione automatica\Adobe Gamma.lnk backup=c:\windows\pss\Adobe Gamma.lnkStartup [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Programmi\\Windows Live\\Messenger\\livecall.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2008-07-01 34312] R2 Apache2.2;Apache2.2;c:\xampp\apache\bin\apache.exe [2008-01-18 24635] R2 ekrn;Eset Service;c:\programmi\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-07-01 468224] S2 gupdate1c8f7ab5b44c074;Google Update Service (gupdate1c8f7ab5b44c074);c:\programmi\Google\Update\GoogleUpdate.exe [2008-08-06 133104] S2 ipjnuvrdb;Installer Shell;c:\windows\system32\svchost.exe -k netsvcs [2006-03-02 14336] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] hpdevmgmt REG_MULTI_SZ hpqcxs08 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs ipjnuvrdb . Contenuto della cartella 'Scheduled Tasks' 2009-02-20 c:\windows\Tasks\GoogleUpdateTaskMachine.job - c:\programmi\Google\Update\GoogleUpdate.exe [2008-09-08 08:37] 2009-02-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1107963886-539718272-1231754661-3393.job - c:\documents and settings\maspero\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe [2008-09-08 08:37] 2009-02-19 c:\windows\Tasks\OGADaily.job - c:\windows\system32\OGAVerify.exe [2008-12-31 17:04] 2009-02-20 c:\windows\Tasks\OGALogon.job - c:\windows\system32\OGAVerify.exe [2008-12-31 17:04] . . ------- Scansione supplementare ------- . uStart Page = about:blank uInternet Settings,ProxyServer = 192.168.206.213:3128 uInternet Settings,ProxyOverride = *.local;<local> IE: Converti destinazione link in Adobe PDF - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Converti destinazione link in file PDF esistente - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Converti i link selezionati in Adobe PDF - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Converti i link selezionati in file PDF esistente - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Converti in Adobe PDF - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Converti nel file PDF esistente - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Converti selezione in Adobe PDF - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Converti selezione in file PDF esistente - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: Sothink SWF Catcher - c:\programmi\File comuni\SourceTec\SWF Catcher\InternetExplorer.htm TCP: {38021B14-24E5-45EB-9E23-2AECE18ED78A} = 192.168.202.202 FF - ProfilePath - c:\documents and settings\maspero\Dati applicazioni\Mozilla\Firefox\Profiles\e75lyydo.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.it/ FF - component: c:\documents and settings\maspero\Dati applicazioni\Mozilla\Firefox\Profiles\e75lyydo.default\extensions\{3b56bcc7-54e5-44a2-9b44-66c3ef58c13e}\components\nstidy.dll FF - component: c:\documents and settings\maspero\Dati applicazioni\Mozilla\Firefox\Profiles\e75lyydo.default\extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326}\platform\WINNT\components\ColorZilla.dll FF - component: c:\documents and settings\maspero\Dati applicazioni\Mozilla\Firefox\Profiles\e75lyydo.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc.dll FF - component: c:\programmi\Google\Google Gears\Firefox\components\gears.dll FF - plugin: c:\documents and settings\maspero\Impostazioni locali\Dati applicazioni\Google\Update\1.2.141.5\npGoogleOneClick7.dll FF - plugin: c:\programmi\Google\Google Earth Plugin\npgeplugin.dll FF - plugin: c:\programmi\Google\Update\1.2.141.5\npGoogleOneClick7.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-20 17:30:08 Windows 5.1.2600 Service Pack 3 NTFS scansione processi nascosti ... scansione entrate autostart nascoste ... Scansione files nascosti ... Scansione completata con successo Files nascosti: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ipjnuvrdb] "ServiceDll"="c:\windows\system32\jyifu.dll" . --------------------- CHIAVI DI REGISTRO BLOCCATE --------------------- [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•9~*] "0140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*] "OODEFRAG10.00.00.01WORKSTATION"="F7C0667230F202213193EB00DAFC49221F2146D65D2E18E3CB3D1F010A4FE21CE7D8992D8A28F28CD8DA522D7D3B351E563AF2B699CF91531A7D5602E2CFD88A1E78382F74763C0EEAE27B8156C9D972783BF76460E7D6C617FEE0453625891AF32DB53C4776B0C6A396C4876E2E4615C10B3C4D0E89D1A922C5D03B4D0ED54B88376B6A5E34CBEB81966F985162AC1034C689327DBC0B7BDB0C172B78C042B0C11015A398B1A8C64936A0E590D3E082143F0F2892FA334EAC3F8D2E88637575C3E052A75AE3873404FCE1714066DE9F6CF75F18B1B31C4B3C006EB1D5123C53FB89A98A0A34CFFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79339DB7CE019D40AA5CBA7FD869164D6794A6A0AC4980AC7933EB0FF43D79C750198F8C474C09FBBD242ED65073669074A056F2DE9FC196EAAFA415CD695A39DAF440198A032CC32F4D2E1466BE65B5429B70F23D23316B67A578A9E9854D55C9FB646D0A44F6BC1872140815089E1B7F2F05B43B127201FBC1040FA024380A7151308D5C6DF3E69751C9184F13E0F23BD0D11E4BBC3AD7C5D37B4B01BC54491ABD6C42CABD8245C5C94D6C3D88516F77992B588F559377D0CD2729CA2B300AFEAB7414D35B54DFA8622F6F3AF7E8CB2AC9F64FE1715867A2C6E037F4AFABC7D12EB9D42ACC70C13F429553D4D16F43BDC22E35CE8B3B37327918C5A9EB7E01B4F53F9535FEB17B79B8B78AD1EA88950F88DF7E9682BEF7E846D0EB45E8B137415C9DAD8E434720BCB364CE27FCA68970C5AE65AD98BE3EA62E22045910A372025C0239054D3447E2CAFC9A032690E62949D065BBF3E5A5BF5937ACAAB285BBF717AB979BB44E8CB7B476AFC166E279F1048FC11F9FB5C978914FC6B382DDA31750EF6A08F7C0107CCF5A9179A40E13F80DCA7D670982CD8E473EF92319843CC7EEB59AB4750BF5E69CC408702A5587619CF263D803F5D6308CE93059EF299BE480F951C1F17E641F3F6820A1234F3040928F00ECC58B8D7E98CE16EAE7CCDBBF32CD00FE964388C2020A29BE216A681FEE3AA44F6815A113447B9EA2C2C59D1BDA545876EF529062D00337291BE3137DD8A26661EAB643F7911400FD29BC813070C5D1DFEDFC3183BC4123F868D0934C1A091EB5B06A29ACA1CF352E263130AA10EFA6AA6464221FFA45887AC898D1F19FC569177F7B8B233C787B18A873522AF8B157798C7F9E23642348ACDB76BAC87CC1A801000CA9434B6E555705A917C28F7FA7228219656E750606C2A6FB401E667B02A4430FC3E65EA508B6F14E327D5BE09CB0C7D0BB574F2BA825948A56B3B6845E65BACE205F29A41F3A8AAED8D308F303623E98E8A6B7E25F6E71DBF5406B856A5C3CE7096D0186E895506BC7B965E7" . --------------------- Dlls caricate dai processi in esecuzione --------------------- - - - - - - - > 'lsass.exe'(760) c:\programmi\Bonjour\mdnsNSP.dll . ------------------------ Altri processi in esecuzione ------------------------ . c:\programmi\Bonjour\mDNSResponder.exe c:\programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE c:\windows\system32\nvsvc32.exe c:\windows\system32\oodag.exe c:\programmi\Analog Devices\SoundMAX\SMAgent.exe c:\programmi\TortoiseSVN\bin\TSVNCache.exe c:\windows\system32\rundll32.exe c:\programmi\Adobe\Acrobat 7.0\Distillr\acrodist.exe c:\windows\system32\rundll32.exe . ************************************************************************** . Ora fine scansione: 2009-02-20 17:33:34 - Il pc è stato riavviato ComboFix-quarantined-files.txt 2009-02-20 16:33:31 Pre-Run: 57.036.423.168 byte disponibili Post-Run: 57,056,944,128 byte disponibili 250 --- E O F --- 2009-02-20 09:43:39

Devo eseguire qualche particolare operazione adesso?
Altrimenti dopo due giorni a tentare mi toccherà formattare.
grazie in anticipo.

di **Luke57** » 21/02/09 10:41

Ciao, nel report era presente anche un'infezione da worm bagle, apri un file di testo dal blocco note di windowws, incollaci al suo interno il seguente script:

Codice: Seleziona tutto: Driver:: ipjnuvrdb File:: c:\windows\system32\jyifu.dll c:\windows\[u]0[/u]02829_.tmp c:\windows\imsins.BAK

salcvalo con il nome di CFScript.txt sulla stessa directory di combofix poi trascinalo con il puntatore del mouse sull'icona di combofix, il programma eseguirà una nuova scansione. Al termine posta il nuovo report C:\combofix.txt.

di **conf** » 23/02/09 13:01

Grazie delle info.

Ecco il log generato dal ComboFix con lo script che mi hai detto.
Prima di lanciarlo ho disabilitato il nod e ripristinato il file incriminato jyifu.dll, dato che il nod ogni volta che lo trova lo cancella, ma si ricrea continuamente.
Ho pensato fosse meglio rimetterlo dove stava.

ecco il risultato:

Codice: Seleziona tutto: ComboFix 09-02-21.01 - maspero 2009-02-23 12:50:16.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1040.18.3071.2514 [GMT 1:00] Eseguito da: C:\ComboFix.exe Opzioni usate :: C:\CFScript.txt AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated) * Creato nuovo punto di ripristino ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !! FILE :: c:\windows\[u]0[/u]02829_.tmp c:\windows\imsins.BAK c:\windows\system32\jyifu.dll . ((((((((((((((((((((((((((((((((((((( Altre eliminazioni ))))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\imsins.BAK . ((((((((((((((((((((((((((((((((((((((( Driver/Servizi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_IPJNUVRDB -------\Service_ipjnuvrdb ((((((((((((((((((((((((( Files Creati Da 2009-01-23 al 2009-02-23 ))))))))))))))))))))))))))))))))))) . 2009-02-23 09:45 . 2009-02-23 09:45 171,362 --ahs---- c:\windows\system32\jyifu.hd 2009-02-20 17:22 . 2009-02-23 12:47 2,924,943 -ra------ C:\ComboFix.exe 2009-02-20 17:02 . 2009-02-20 17:05 <DIR> d-------- c:\programmi\Windows Live Safety Center 2009-02-20 16:36 . 2009-02-20 16:37 <DIR> d-------- c:\windows\BDOSCAN8 2009-02-20 10:56 . 2009-02-20 11:01 <DIR> d-------- c:\windows\NV3040468.TMP 2009-02-20 10:56 . 2008-09-17 23:55 201,050 --a------ c:\windows\system32\nvapps.nvb 2009-02-20 10:38 . 2009-02-20 10:38 <DIR> d-------- c:\windows\system32\XPSViewer 2009-02-20 10:38 . 2009-02-20 10:38 <DIR> d-------- c:\programmi\Reference Assemblies 2009-02-20 10:38 . 2009-02-20 10:38 <DIR> d-------- c:\programmi\MSBuild 2009-02-20 10:37 . 2009-02-20 10:38 <DIR> d-------- C:\32640fef16eaf6c9274a1b 2009-02-20 10:37 . 2008-07-06 13:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll 2009-02-20 10:37 . 2008-07-06 13:06 1,676,288 -----c--- c:\windows\system32\dllcache\xpssvcs.dll 2009-02-20 10:37 . 2008-07-06 11:50 597,504 -----c--- c:\windows\system32\dllcache\printfilterpipelinesvc.exe 2009-02-20 10:37 . 2008-07-06 13:06 575,488 --------- c:\windows\system32\xpsshhdr.dll 2009-02-20 10:37 . 2008-07-06 13:06 575,488 -----c--- c:\windows\system32\dllcache\xpsshhdr.dll 2009-02-20 10:37 . 2008-07-06 13:06 117,760 --------- c:\windows\system32\prntvpt.dll 2009-02-20 10:37 . 2008-07-06 13:06 89,088 -----c--- c:\windows\system32\dllcache\filterpipelineprintproc.dll 2009-02-20 10:34 . 2009-02-20 10:35 <DIR> d-------- C:\836fb87bb6d6da5fdd63c7e9 2009-02-20 10:34 . 2009-02-20 10:34 <DIR> d-------- C:\4a3fa52be2d3d727af70c6 2009-02-19 22:25 . 2009-02-19 22:25 <DIR> d-------- c:\programmi\AnswerWorks 4.0 2009-02-19 22:16 . 2009-02-19 22:26 <DIR> d-------- c:\programmi\AutoCAD 2007 2009-02-19 22:16 . 2009-02-19 22:27 <DIR> d-------- c:\documents and settings\maspero\Dati applicazioni\Autodesk 2009-02-19 22:16 . 2009-02-19 22:16 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\Autodesk 2009-02-19 22:14 . 2009-02-19 22:26 <DIR> d-------- c:\programmi\File comuni\Autodesk Shared 2009-02-19 22:14 . 2009-02-19 22:14 <DIR> d-------- c:\programmi\Autodesk 2009-02-19 20:24 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys 2009-02-19 20:22 . 2009-02-19 20:22 <DIR> d-------- c:\programmi\MSXML 4.0 2009-02-19 20:22 . 2008-12-11 11:57 333,952 -----c--- c:\windows\system32\dllcache\srv.sys 2009-02-19 20:00 . 2009-02-19 20:00 <DIR> d-------- c:\windows\ServicePackFiles 2009-02-19 20:00 . 2008-04-13 19:14 294,912 -----c--- c:\windows\system32\dllcache\dlimport.exe 2009-02-19 19:56 . 2006-12-28 12:01 19,569 --a------ c:\windows\[u]0[/u]02829_.tmp 2009-02-19 19:41 . 2008-06-14 18:32 272,768 -----c--- c:\windows\system32\dllcache\bthport.sys 2009-02-19 19:40 . 2008-09-15 16:24 1,846,400 -----c--- c:\windows\system32\dllcache\win32k.sys 2009-02-19 18:20 . 2008-06-17 20:01 8,490,496 -----c--- c:\windows\system32\dllcache\shell32.dll 2009-02-19 18:07 . 2009-02-19 18:07 <DIR> d--h----- c:\windows\system32\GroupPolicy 2009-02-19 16:47 . 2008-08-14 14:22 2,192,896 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe 2009-02-19 16:47 . 2008-08-14 14:22 2,148,864 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe 2009-02-19 16:47 . 2008-08-14 14:22 2,069,760 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe 2009-02-19 16:47 . 2008-08-14 14:22 2,027,520 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe 2009-02-19 16:42 . 2008-04-11 20:04 691,712 -----c--- c:\windows\system32\dllcache\inetcomm.dll 2009-02-19 16:42 . 2008-05-01 15:34 331,776 -----c--- c:\windows\system32\dllcache\msadce.dll 2009-02-19 16:39 . 2008-09-04 18:15 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll 2009-02-19 16:39 . 2008-10-15 17:36 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll 2009-02-19 16:27 . 2008-10-16 14:08 27,672 --a------ c:\windows\system32\wuapi.dll.mui 2009-02-09 10:37 . 2009-02-09 10:37 <DIR> d-------- c:\programmi\TortoiseSVN 2009-02-09 10:37 . 2009-02-09 10:37 <DIR> d-------- c:\programmi\File comuni\TortoiseOverlays 2009-01-29 15:55 . 2009-02-20 14:19 664 --a------ c:\windows\system32\d3d9caps.dat . (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-23 11:45 --------- d-----w c:\documents and settings\maspero\Dati applicazioni\foobar2000 2009-02-23 08:24 --------- d-----w c:\programmi\Mozilla Thunderbird 2009-02-20 11:22 --------- d-----w c:\documents and settings\Administrator.DPC\Dati applicazioni\foobar2000 2009-02-19 21:09 --------- d-----w c:\programmi\Microsoft Silverlight 2009-02-19 19:34 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Microsoft Help 2009-02-19 09:46 --------- d-----w c:\programmi\foobar2000 2009-02-18 13:08 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Spybot - Search & Destroy 2009-02-17 10:47 --------- d-----w c:\programmi\Spybot - Search & Destroy 2009-02-17 10:38 --------- d-----w c:\programmi\Malwarebytes' Anti-Malware 2009-02-16 13:13 --------- d-----w c:\documents and settings\maspero\Dati applicazioni\FileZilla 2009-02-12 13:10 --------- d-----w c:\programmi\Google 2009-02-11 09:19 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys 2009-02-11 09:19 15,504 ----a-w c:\windows\system32\drivers\mbam.sys 2009-01-28 10:24 --------- d-----w c:\programmi\GuildFTPd 2009-01-22 10:04 --------- d-----w c:\programmi\CCleaner . ((((((((((((((((((((((((((((( SnapShot@2009-02-20_17.32.18.41 ))))))))))))))))))))))))))))))))))))))))) . - 2009-02-20 14:45:34 67,312 ----a-w c:\windows\system32\perfc009.dat + 2009-02-23 08:16:40 67,312 ----a-w c:\windows\system32\perfc009.dat - 2009-02-20 14:45:34 79,292 ----a-w c:\windows\system32\perfc010.dat + 2009-02-23 08:16:40 79,292 ----a-w c:\windows\system32\perfc010.dat - 2009-02-20 14:45:34 432,356 ----a-w c:\windows\system32\perfh009.dat + 2009-02-23 08:16:40 432,356 ----a-w c:\windows\system32\perfh009.dat - 2009-02-20 14:45:34 478,808 ----a-w c:\windows\system32\perfh010.dat + 2009-02-23 08:16:40 478,808 ----a-w c:\windows\system32\perfh010.dat . ((((((((((((((((((((((((((((((((((((( Punti Reg Caricati )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* i valori vuoti & legittimi/default non sono visualizzati. REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal] @="{C5994560-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}] 2008-01-16 17:52 80384 --a------ c:\programmi\File comuni\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified] @="{C5994561-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}] 2008-01-16 17:52 80384 --a------ c:\programmi\File comuni\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict] @="{C5994562-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}] 2008-01-16 17:52 80384 --a------ c:\programmi\File comuni\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked] @="{C5994563-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}] 2008-01-16 17:52 80384 --a------ c:\programmi\File comuni\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly] @="{C5994564-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}] 2008-01-16 17:52 80384 --a------ c:\programmi\File comuni\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted] @="{C5994565-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}] 2008-01-16 17:52 80384 --a------ c:\programmi\File comuni\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded] @="{C5994566-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}] 2008-01-16 17:52 80384 --a------ c:\programmi\File comuni\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored] @="{C5994567-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}] 2008-01-16 17:52 80384 --a------ c:\programmi\File comuni\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned] @="{C5994568-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}] 2008-01-16 17:52 80384 --a------ c:\programmi\File comuni\TortoiseOverlays\TortoiseOverlays.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\programmi\File comuni\Ahead\lib\NMBgMonitor.exe" [2005-09-25 94208] "Google Update"="c:\documents and settings\maspero\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe" [2008-09-08 133104] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13574144] "Acrobat Assistant 7.0"="c:\programmi\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 483328] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2005-09-25 155648] "SunJavaUpdateSched"="c:\programmi\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "QuickTime Task"="c:\programmi\QuickTime\qttask.exe" [2008-01-31 385024] "OODefragTray"="c:\windows\system32\oodtray.exe" [2007-05-11 2512392] "Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "HP Software Update"="c:\programmi\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152] "UnlockerAssistant"="c:\programmi\Unlocker\UnlockerAssistant.exe" [2006-09-07 15872] "egui"="c:\programmi\ESET\ESET NOD32 Antivirus\egui.exe" [2008-07-01 1447168] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-17 86016] "nwiz"="nwiz.exe" [2008-09-17 c:\windows\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360] c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\ AutoCAD Startup Accelerator.lnk - c:\programmi\File comuni\Autodesk Shared\acstart17.exe [2006-03-05 11000] Launchy.lnk - c:\programmi\Launchy\Launchy.exe [2008-12-04 286720] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\[u]0[/u]OODBS [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^Avvio veloce di Adobe Acrobat.lnk] path=c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\Avvio veloce di Adobe Acrobat.lnk backup=c:\windows\pss\Avvio veloce di Adobe Acrobat.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^maspero^Menu Avvio^Programmi^Esecuzione automatica^Adobe Gamma.lnk] path=c:\documents and settings\maspero\Menu Avvio\Programmi\Esecuzione automatica\Adobe Gamma.lnk backup=c:\windows\pss\Adobe Gamma.lnkStartup [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Programmi\\Windows Live\\Messenger\\livecall.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2008-07-01 34312] R2 Apache2.2;Apache2.2;c:\xampp\apache\bin\apache.exe [2008-01-18 24635] R2 ekrn;Eset Service;c:\programmi\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-07-01 468224] S2 gupdate1c8f7ab5b44c074;Google Update Service (gupdate1c8f7ab5b44c074);c:\programmi\Google\Update\GoogleUpdate.exe [2008-08-06 133104] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] hpdevmgmt REG_MULTI_SZ hpqcxs08 . Contenuto della cartella 'Scheduled Tasks' 2009-02-23 c:\windows\Tasks\GoogleUpdateTaskMachine.job - c:\programmi\Google\Update\GoogleUpdate.exe [2008-09-08 08:37] 2009-02-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1107963886-539718272-1231754661-3393.job - c:\documents and settings\maspero\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe [2008-09-08 08:37] 2009-02-23 c:\windows\Tasks\OGADaily.job - c:\windows\system32\OGAVerify.exe [2008-12-31 17:04] 2009-02-23 c:\windows\Tasks\OGALogon.job - c:\windows\system32\OGAVerify.exe [2008-12-31 17:04] . . ------- Scansione supplementare ------- . uStart Page = about:blank uInternet Settings,ProxyServer = 192.168.206.213:3128 uInternet Settings,ProxyOverride = *.local;<local> IE: Converti destinazione link in Adobe PDF - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Converti destinazione link in file PDF esistente - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Converti i link selezionati in Adobe PDF - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Converti i link selezionati in file PDF esistente - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Converti in Adobe PDF - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Converti nel file PDF esistente - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Converti selezione in Adobe PDF - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Converti selezione in file PDF esistente - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: Sothink SWF Catcher - c:\programmi\File comuni\SourceTec\SWF Catcher\InternetExplorer.htm TCP: {38021B14-24E5-45EB-9E23-2AECE18ED78A} = 192.168.202.202 FF - ProfilePath - c:\documents and settings\maspero\Dati applicazioni\Mozilla\Firefox\Profiles\e75lyydo.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.it/ FF - component: c:\documents and settings\maspero\Dati applicazioni\Mozilla\Firefox\Profiles\e75lyydo.default\extensions\{3b56bcc7-54e5-44a2-9b44-66c3ef58c13e}\components\nstidy.dll FF - component: c:\documents and settings\maspero\Dati applicazioni\Mozilla\Firefox\Profiles\e75lyydo.default\extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326}\platform\WINNT\components\ColorZilla.dll FF - component: c:\documents and settings\maspero\Dati applicazioni\Mozilla\Firefox\Profiles\e75lyydo.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc.dll FF - component: c:\programmi\Google\Google Gears\Firefox\components\gears.dll FF - plugin: c:\documents and settings\maspero\Impostazioni locali\Dati applicazioni\Google\Update\1.2.141.5\npGoogleOneClick7.dll FF - plugin: c:\programmi\Google\Google Earth Plugin\npgeplugin.dll FF - plugin: c:\programmi\Google\Update\1.2.141.5\npGoogleOneClick7.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-23 12:54:55 Windows 5.1.2600 Service Pack 3 NTFS scansione processi nascosti ... scansione entrate autostart nascoste ... Scansione files nascosti ... Scansione completata con successo Files nascosti: 0 ************************************************************************** . --------------------- CHIAVI DI REGISTRO BLOCCATE --------------------- [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•9~*] "0140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*] "OODEFRAG10.00.00.01WORKSTATION"="F7C0667230F202213193EB00DAFC49221F2146D65D2E18E3CB3D1F010A4FE21CE7D8992D8A28F28CD8DA522D7D3B351E563AF2B699CF91531A7D5602E2CFD88A1E78382F74763C0EEAE27B8156C9D972783BF76460E7D6C617FEE0453625891AF32DB53C4776B0C6A396C4876E2E4615C10B3C4D0E89D1A922C5D03B4D0ED54B88376B6A5E34CBEB81966F985162AC1034C689327DBC0B7BDB0C172B78C042B0C11015A398B1A8C64936A0E590D3E082143F0F2892FA334EAC3F8D2E88637575C3E052A75AE3873404FCE1714066DE9F6CF75F18B1B31C4B3C006EB1D5123C53FB89A98A0A34CFFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79339DB7CE019D40AA5CBA7FD869164D6794A6A0AC4980AC7933EB0FF43D79C750198F8C474C09FBBD242ED65073669074A056F2DE9FC196EAAFA415CD695A39DAF440198A032CC32F4D2E1466BE65B5429B70F23D23316B67A578A9E9854D55C9FB646D0A44F6BC1872140815089E1B7F2F05B43B127201FBC1040FA024380A7151308D5C6DF3E69751C9184F13E0F23BD0D11E4BBC3AD7C5D37B4B01BC54491ABD6C42CABD8245C5C94D6C3D88516F77992B588F559377D0CD2729CA2B300AFEAB7414D35B54DFA8622F6F3AF7E8CB2AC9F64FE1715867A2C6E037F4AFABC7D12EB9D42ACC70C13F429553D4D16F43BDC22E35CE8B3B37327918C5A9EB7E01B4F53F9535FEB17B79B8B78AD1EA88950F88DF7E9682BEF7E846D0EB45E8B137415C9DAD8E434720BCB364CE27FCA68970C5AE65AD98BE3EA62E22045910A372025C0239054D3447E2CAFC9A032690E62949D065BBF3E5A5BF5937ACAAB285BBF717AB979BB44E8CB7B476AFC166E279F1048FC11F9FB5C978914FC6B382DDA31750EF6A08F7C0107CCF5A9179A40E13F80DCA7D670982CD8E473EF92319843CC7EEB59AB4750BF5E69CC408702A5587619CF263D803F5D6308CE93059EF299BE480F951C1F17E641F3F6820A1234F3040928F00ECC58B8D7E98CE16EAE7CCDBBF32CD00FE964388C2020A29BE216A681FEE3AA44F6815A113447B9EA2C2C59D1BDA545876EF529062D00337291BE3137DD8A26661EAB643F7911400FD29BC813070C5D1DFEDFC3183BC4123F868D0934C1A091EB5B06A29ACA1CF352E263130AA10EFA6AA6464221FFA45887AC898D1F19FC569177F7B8B233C787B18A873522AF8B157798C7F9E23642348ACDB76BAC87CC1A801000CA9434B6E555705A917C28F7FA7228219656E750606C2A6FB401E667B02A4430FC3E65EA508B6F14E327D5BE09CB0C7D0BB574F2BA825948A56B3B6845E65BACE205F29A41F3A8AAED8D308F303623E98E8A6B7E25F6E71DBF5406B856A5C3CE7096D0186E895506BC7B965E7" . --------------------- Dlls caricate dai processi in esecuzione --------------------- - - - - - - - > 'lsass.exe'(760) c:\programmi\Bonjour\mdnsNSP.dll . ------------------------ Altri processi in esecuzione ------------------------ . c:\programmi\Bonjour\mDNSResponder.exe c:\programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE c:\windows\system32\nvsvc32.exe c:\windows\system32\oodag.exe c:\programmi\Analog Devices\SoundMAX\SMAgent.exe c:\programmi\TortoiseSVN\bin\TSVNCache.exe c:\windows\system32\rundll32.exe c:\programmi\Adobe\Acrobat 7.0\Distillr\acrodist.exe c:\windows\system32\rundll32.exe . ************************************************************************** . Ora fine scansione: 2009-02-23 12:58:09 - Il pc è stato riavviato [maspero] ComboFix-quarantined-files.txt 2009-02-23 11:58:06 Pre-Run: 57,003,790,336 byte disponibili Post-Run: 56,996,306,944 byte disponibili 262 --- E O F --- 2009-02-20 09:43:39

worm CONFLICKER.X

worm CONFLICKER.X

Re: worm CONFLICKER.X

Re: worm CONFLICKER.X

Re: worm CONFLICKER.X

Re: worm CONFLICKER.X

Re: worm CONFLICKER.X

Re: worm CONFLICKER.X

Re: worm CONFLICKER.X

Re: worm CONFLICKER.X

Re: worm CONFLICKER.X

Re: worm CONFLICKER.X

Re: worm CONFLICKER.X

Re: worm CONFLICKER.X

Re: worm CONFLICKER.X

Re: worm CONFLICKER.X

Re: worm CONFLICKER.X

Re: worm CONFLICKER.X

Topic correlati a "worm CONFLICKER.X":

Chi c’è in linea