URL nocivo

[StefySte]

Ciao a tutti.
E' la prima volta che scrivo in questo Forum...
Ho un problema: l'assistente di ie di Spybot ha individuato un url noto come risorsa nociva.
Alcuni di questi URL sono:
http:em.pc-on-internet.com/eas?cu=610log
http:em.pc-on-internet.com/eas?cu=667log
http:em.pc-on-internet.com/eas?cu=2568lo
http:em.pc-on-internet.com/eas?cu=2937lo

Dal log di hijackthis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22.00.24, on 06/01/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Stardock\Object Desktop\WindowBlinds\wbload.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Programmi\Bonjour\mDNSResponder.exe
C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Programmi\Java\jre6\bin\jqs.exe
C:\Programmi\File comuni\Panda Software\PavShld\pavprsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\File comuni\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\VM_STI.EXE
C:\windows\system32\svchost.exe
C:\Programmi\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Programmi\Java\jre6\bin\jusched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Programmi\iTunes\iTunesHelper.exe
C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
C:\documents and settings\stefy\impostazioni locali\dati applicazioni\drhweahw.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Programmi\IncrediMail\bin\IMApp.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmi\Windows Live\Messenger\usnsvc.exe
C:\Programmi\eMule\emule.exe
C:\Programmi\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\File comuni\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\DOCUME~1\Stefy\IMPOST~1\Temp\Directory temporanea 1 per HiJackThis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Yahoo! Toolbar con blocco Pop-Up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programmi\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Programmi\AVG\AVG8\avgtoolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmi\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: (no name) - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - (no file)
O2 - BHO: XBTBPos00 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Programmi\My.Freeze.com Toolbar with NetAssistant\freeze_int.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar1.dll
O3 - Toolbar: My.Freeze.com Toolbar - {D0523BB4-21E7-11DD-9AB7-415B56D89593} - C:\Programmi\My.Freeze.com Toolbar with NetAssistant\freeze_int.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Programmi\AVG\AVG8\avgtoolbar.dll
O4 - HKLM\..\Run: [EPSON Stylus DX4200 Series (Copia 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEE.EXE /P36 "EPSON Stylus DX4200 Series (Copia 1)" /O6 "USB001" /M "Stylus DX4200"
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Philips SPC 200NC PC Camera
O4 - HKLM\..\Run: [monabuai] "c:\windows\system32\monabuai.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programmi\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Programmi\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [drhweahw] "c:\documents and settings\stefy\impostazioni locali\dati applicazioni\drhweahw.exe" drhweahw
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Programmi\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Inserisci blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programmi\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: Inserisci &blog in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programmi\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - (no file)
O9 - Extra button: (no name) - {925DAB62-F9AC-4221-806A-057BFB1014AA} - (no file)
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/ms ... b56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} (Java Plug-in 1.6.0_05) -
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programmi\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: wbsys.dll,avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Programmi\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmi\Java\jre6\bin\jqs.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Programmi\File comuni\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\SNDSrvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Programmi\File comuni\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 10070 bytes


Per favore, potete dirmi come posso risolvere questo fastidioso problema?

[Luke57]

Ciao, disattiva l'antivirus e anche il tea timer di spybot
(per disattivare TeaTimer apri Spybot, vai sulla barra di sinistra e imposta la MODALITA' AVANZATA dal menu MODALITA'...Ora sempre dalla barra sinistra, clicca sul bottone UTILITA', quindi clicca su RESIDENT
al centro vedi una opzione relativa al TeaTimer...disattivala)
scarica combofix sul desktop
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Vai in start>esegui>nel box bianco copia e incolla, virgolette comprese:

"%userprofile%\desktop\combofix.exe" /killall

Premi OK, parte il programma che potrebbe impiegare molto (non fare altre manovre durante la scansione, se dovessero scomparire le icone sul desktop e la barra delle applicazioni, non è nulla di cui preoccuparsi),una volta terminata, se tutto è andato bene, in C:\ dovresti trovare il file combofix.txt , posta il contenuto del file.

[StefySte]

Ciao Luke!

Ho disattivato l'antivirus.
Ho disattivato anche il tea timer di Spybot, ma ho lasciato attivo "SD Helper" di Resident. Avrei dovuto disattivare anche quello?
Ho scaricato combofix sul desktop dal link che hai postato.
Poi tu mi hai detto - Vai in start>esegui>nel box bianco copia e incolla, virgolette comprese:
"%userprofile%\desktop\combofix.exe" /killall".
Non c'è nessun "Start", nè "esegui" e il box è blu, non bianco...
Io ho cliccato due volte sull'icona del combofix sul desktop, e ho visualizzato una finestra blu dove in alto a sinistra c'era C:\. In quella finestra ho incollato "%userprofile%\desktop\combofix.exe" /killall" (non c'era nessun ok e ho fatto "invio"). Un attimo prima di effettuare la scansione, mi è stato consigliato (è apparsa una scritta) di scaricare la "Console windows di emergenza". Per "ovvi" motivi non ho potuto sottoscrivere il contratto di licenza e quindi non ho potuto scaricare la "Console" che mi è stata consigliata.
Inizialmente sembrava che stesse andando tutto bene...
Alla fine della scansione è apparso un log che ho copiato. Subito dopo sono apparse numerosissime finestre di Spybot dove mi veniva chiesto di negare, o meno, le modifiche (su non so che cosa) che erano state fatte.
Dopo la scansione si è bloccato tutto, e le icone sul desktop non c'erano più!!
Nemmeno con taskmanager non sono riuscita a fare nulla!
Alla fine sono stata costretta a spegnere il pc, quindi quel log che avevo copiato (e non so nemmeno se fosse quello corretto) non l'ho potuto salvare.

Che cosa ho sbagliato?
Cosa posso fare?

[Luke57]

Ciao, ma non hai start nella barra dei menu? Su xp ci deve essere, intendevo quello start lì. Spyubot non gradisce quello che va combofix per questo andava disabilitato. Rpeti la scansione disattivando spybot, poi doppio clik sull'icona di combofix, nello spazio blu digiti 1 e lasci lavorare il computer. Alla fine posti il report.

[StefySte]

Ho fatto tutto quello che mi hai detto...
Spero di aver fatto bene questa volta!
Questo è il report:

ComboFix 09-01-06.02 - Stefy 2009-01-07 17.16.37.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1040.18.479.214 [GMT 1:00]
Running from: c:\documents and settings\Stefy\desktop\combofix.exe
Command switches used :: /killall
AV: AVG Anti-Virus Free *On-access scanning disabled* (Outdated)
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Stefy\Impostazioni locali\Dati applicazioni\drhweahw.dat
c:\documents and settings\Stefy\Impostazioni locali\Dati applicazioni\drhweahw.exe
c:\documents and settings\Stefy\Impostazioni locali\Dati applicazioni\drhweahw_nav.dat
c:\documents and settings\Stefy\Impostazioni locali\Dati applicazioni\drhweahw_navps.dat

.
((((((((((((((((((((((((( Files Created from 2008-12-07 to 2009-01-07 )))))))))))))))))))))))))))))))
.

2009-01-07 17:14 . 2009-01-07 17:14 <DIR> d-------- C:\32788R22FWJFW
2009-01-07 14:26 . 2009-01-07 14:33 <DIR> d-------- C:\RECYCLER(2)
2009-01-07 13:44 . 2009-01-07 14:33 <DIR> d-------- C:\ComboFix(2)
2009-01-01 03:09 . 2009-01-01 03:09 410,984 --a------ c:\windows\system32\deploytk.dll
2008-12-10 21:05 . 2005-08-24 17:27 <DIR> d--h----- c:\documents and settings\Administrator\Risorse di stampa
2008-12-10 21:05 . 2005-08-24 17:27 <DIR> d--h----- c:\documents and settings\Administrator\Risorse di rete
2008-12-10 21:05 . 2005-08-24 17:27 <DIR> d-------- c:\documents and settings\Administrator\Preferiti
2008-12-10 21:05 . 2006-11-11 14:58 <DIR> d--h----- c:\documents and settings\Administrator\Modelli
2008-12-10 21:05 . 2005-08-24 17:27 <DIR> dr------- c:\documents and settings\Administrator\Menu Avvio
2008-12-10 21:05 . 2009-01-07 13:17 <DIR> d--h----- c:\documents and settings\Administrator\Impostazioni locali
2008-12-10 21:05 . 2005-08-24 17:27 <DIR> d-------- c:\documents and settings\Administrator\Documenti
2008-12-10 21:05 . 2008-08-01 19:26 <DIR> dr-h----- c:\documents and settings\Administrator\Dati applicazioni
2008-12-10 21:05 . 2009-01-07 14:34 <DIR> d-------- c:\documents and settings\Administrator
2008-12-08 12:51 . 2008-12-08 12:51 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-07 13:43 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Google Updater
2009-01-06 23:11 --------- d-----w c:\programmi\eMule
2009-01-01 02:09 --------- d-----w c:\programmi\Java
2008-12-13 17:33 --------- d-----w c:\programmi\epson
2008-12-13 17:32 --------- d--h--w c:\programmi\InstallShield Installation Information
2008-12-10 17:51 --------- d-----w c:\programmi\QuickTime
2008-12-10 16:00 --------- d-----w c:\programmi\Winferno
2008-12-10 15:47 --------- d-----w c:\programmi\Google
2008-12-10 15:36 --------- d-----w c:\programmi\K-Lite Codec Pack
2008-12-10 09:51 --------- d-----w c:\programmi\Common Files
2008-12-08 12:18 --------- d-----w c:\programmi\Fighters
2008-12-08 11:51 --------- d-----w c:\programmi\iTunes
2008-12-08 11:51 --------- d-----w c:\programmi\iPod
2008-12-08 11:51 --------- d-----w c:\programmi\File comuni\Apple
2008-12-06 10:33 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Fighters
2008-11-28 11:22 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Avg8
2008-11-16 01:07 97,928 ----a-w c:\windows\system32\drivers\avgldx86.sys
2008-11-16 01:07 76,040 ----a-w c:\windows\system32\drivers\avgtdix.sys
2008-11-10 12:55 --------- d-----w c:\programmi\Microsoft CAPICOM 2.1.0.2
2008-11-09 22:40 --------- d-----w c:\programmi\7-Zip
2008-11-09 20:58 --------- d-----w c:\programmi\Free Offers from Freeze.com
2008-11-09 20:56 --------- d-----w c:\programmi\Yahoo!
2008-11-09 20:54 --------- d-----w c:\programmi\My.Freeze.com Toolbar with NetAssistant
2008-11-09 19:56 --------- d-----w c:\programmi\File comuni\Real
2008-11-09 19:50 774,144 ----a-w c:\programmi\RngInterstitial.dll
2008-11-09 19:50 --------- d-----w c:\programmi\Real
2008-11-09 19:38 --------- d-----w c:\programmi\Freeze.com
2008-11-09 19:38 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Winferno
2008-11-08 01:08 --------- d-----w c:\programmi\FTP Explorer
2008-03-19 02:57 32 ----a-w c:\documents and settings\All Users\Dati applicazioni\ezsid.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D0523BB4-21E7-11DD-9AB7-415B56D89593}"= "c:\programmi\My.Freeze.com Toolbar with NetAssistant\freeze_int.dll" [2008-11-03 1916024]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D0523BB4-21E7-11DD-9AB7-415B56D89593}"= "c:\programmi\My.Freeze.com Toolbar with NetAssistant\freeze_int.dll" [2008-11-03 1916024]

[HKEY_CLASSES_ROOT\clsid\{d0523bb4-21e7-11dd-9ab7-415b56d89593}]
[HKEY_CLASSES_ROOT\TBSB00001.TBSB00001.3]
[HKEY_CLASSES_ROOT\TypeLib\{77AA25E8-6083-4949-A831-9CB11861DC10}]
[HKEY_CLASSES_ROOT\TBSB00001.TBSB00001]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\programmi\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"swg"="c:\programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-04-05 68856]
"IncrediMail"="c:\programmi\IncrediMail\bin\IncMail.exe" [2008-07-24 243072]
"drhweahw"="c:\documents and settings\stefy\impostazioni locali\dati applicazioni\drhweahw.exe" [BU]
"SpybotSD TeaTimer"="c:\programmi\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EPSON Stylus DX4200 Series (Copia 1)"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIAEE.EXE" [2005-03-07 98304]
"BigDogPath"="c:\windows\VM_STI.EXE" [2004-06-09 40960]
"monabuai"="c:\windows\system32\monabuai.exe" [2004-08-20 9682]
"Adobe Photo Downloader"="c:\programmi\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 63712]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-03 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"SunJavaUpdateSched"="c:\programmi\Java\jre6\bin\jusched.exe" [2009-01-01 136600]
"Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-28 1261336]
"iTunesHelper"="c:\programmi\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"QuickTime Task"="c:\programmi\QuickTime\qttask.exe" [2008-09-06 413696]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-20 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
2001-12-20 21:34 24576 c:\progra~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon]
[BU]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll,avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.dvacm"= c:\progra~1\FILECO~1\ULEADS~1\Vio\Dvacm.acm

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^Avvio Veloce di WinZip.lnk]
path=c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\Avvio Veloce di WinZip.lnk
backup=c:\windows\pss\Avvio Veloce di WinZip.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^TrayMin300.exe.lnk]
path=c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\TrayMin300.exe.lnk
backup=c:\windows\pss\TrayMin300.exe.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]
c:\programmi\AntiVir PersonalEdition Classic\avgnt.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2004-08-20 04:39 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus DX4200 Series]
--a------ 2005-03-07 20:00 98304 c:\windows\system32\spool\drivers\w32x86\3\E_FATIAEE.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MPB]
--a------ 2003-08-13 17:45 286720 c:\windows\system32\MPB.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-10-13 17:24 1694208 c:\programmi\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
c:\programmi\MSN Messenger\MsnMsgr.Exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 11:50 155648 c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiS KHooker]
--a------ 2002-09-24 00:50 290816 c:\windows\system32\khooker.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiS Tray]
--a------ 2002-11-17 09:36 303104 c:\windows\system32\sistray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor]
--a------ 2006-10-19 00:58 100056 c:\progra~1\SYMNET~1\SNDMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCTVOICE]
--a------ 2002-03-08 20:29 163840 c:\windows\system32\pctspk.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\eMule\\emule.exe"=
"c:\\Programmi\\IncrediMail\\bin\\IMApp.exe"=
"c:\\Programmi\\IncrediMail\\bin\\IncMail.exe"=
"c:\\Programmi\\IncrediMail\\bin\\ImpCnt.exe"=
"c:\\Programmi\\IncrediMail\\bin\\ImLc.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Programmi\\Bonjour\\mDNSResponder.exe"=
"c:\\Programmi\\AVG\\AVG8\\avgemc.exe"=
"c:\\Programmi\\AVG\\AVG8\\avgupd.exe"=
"c:\\Programmi\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8006:TCP"= 8006:TCP:CHAT ELLEXELLE
"4662:TCP"= 4662:TCP:eMule : TCP in ingresso 127.0.0.1
"4672:UDP"= 4672:UDP:eMule : UDP in ingresso 127.0.0.1
"42761:TCP"= 42761:TCP:Current Port
"4711:TCP"= 4711:TCP:127.0.0.1

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-11-16 97928]
R1 ShldDrv;Panda File Shield Driver;c:\windows\system32\drivers\ShldDrv.sys [2006-10-16 26656]
R3 MTC0001_MPB;MPB device driver;c:\windows\system32\NTMPB.SYS [2005-08-25 5072]
R3 ZD1211U(3COM Corporation);3COM OfficeConnect Wireless 11g Compact USB Adapter(3COM Corporation);c:\windows\system32\drivers\ZD1211U.sys [2006-06-14 248320]
R4 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-11-16 875288]
R4 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-11-16 231704]
R4 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-11-16 76040]
R4 PavProc;Panda Process Protection Driver;c:\windows\system32\drivers\PavProc.sys [2006-10-16 163856]
S3 iMSPQMn;iMSPQMn;\??\c:\docume~1\Stefy\IMPOST~1\Temp\iMSPQMn.sys --> c:\docume~1\Stefy\IMPOST~1\Temp\iMSPQMn.sys [?]
S3 ZD1201U;ZyDAS ZD1201 IEEE 802.11b Wireless LAN Driver (USB);c:\windows\system32\drivers\ZD1201U.sys [2006-05-21 38656]
S3 ZDNDIS5;ZDNDIS5 Protocol Driver;\??\c:\windows\system32\ZDNDIS5.SYS --> c:\windows\system32\ZDNDIS5.SYS [?]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c4748811-3240-11dd-a595-e1f4056b4578}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
\Shell\Open(&0)\command - Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c4748812-3240-11dd-a595-e1f4056b4578}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
\Shell\Open(&0)\command - Recycled\ctfmon.exe
.
Contents of the 'Scheduled Tasks' folder

2009-01-01 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programmi\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2009-01-07 c:\windows\Tasks\PCConfidential.job
- c:\programmi\Winferno\PC Confidential\PCConfidential.exe []

2009-01-07 c:\windows\Tasks\pfhinz.job
- c:\windows\system32\monabuai.exe [2004-08-20 04:39]

2009-01-07 c:\windows\Tasks\Symantec NetDetect.job
- c:\programmi\Symantec\LiveUpdate\NDETECT.EXE [2003-08-20 09:20]

2009-01-07 c:\windows\Tasks\Verifica aggiornamenti per Windows Live Toolbar.job
- c:\programmi\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.it/
mStart Page = hxxp://home.sweetim.com
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Windows Live Search - c:\programmi\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Stefy\Dati applicazioni\Mozilla\Firefox\Profiles\anrkso8r.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.as ... ource=3&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.it/
FF - prefs.js: keyword.URL - chrome://google-cjk-partner/locale/partner.properties
FF - component: c:\programmi\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\programmi\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll
FF - component: c:\programmi\Mozilla Firefox\extensions\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}\components\FFAlert.dll
FF - plugin: c:\programmi\Google\Google Updater\2.4.1368.5602\npCIDetect13.dll
FF - plugin: c:\programmi\Mozilla Firefox\plugins\npracplug.dll
FF - plugin: c:\programmi\Real\RealArcade\Plugins\Mozilla\npracplug.dll
FF - plugin: c:\programmi\Yahoo!\Common\npyaxmpb.dll

ATTENTION: FIREFOX POLICIES ARE IN FORCE
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-07 17:21:28
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*NULL*]
"0140110900063D11C8EF10054038389C"="C?\\WINDOWS\\System32\\FM20ENU.DLL"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(640)
c:\progra~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll
.
------------------------ Other Running Processes ------------------------
.
c:\programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\programmi\Bonjour\mDNSResponder.exe
c:\programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\programmi\Java\jre6\bin\jqs.exe
c:\programmi\File comuni\Panda Software\PavShld\PavPrSrv.exe
c:\programmi\File comuni\Ulead Systems\DVD\ULCDRSvr.exe
c:\programmi\AVG\AVG8\avgrsx.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Completion time: 2009-01-07 17:28:24 - machine was rebooted
ComboFix-quarantined-files.txt 2009-01-07 16:28:19
ComboFix2.txt 2009-01-07 12:16:56

Pre-Run: 6.015.627.264 byte disponibili
Post-Run: 6,008,143,872 byte disponibili

248 --- E O F --- 2008-12-18 12:35:22

[StefySte]

Ho disattivato sia "Tea timer" che "SD Helper" di Resident...
Durante la scansione di combofix, ad un certo punto il pc si è "riavviato" DA SOLO.
Poi è riapparsa la finestra blu con la scritta "Preparing log report" e sul desktop è apparsa un'altra icona (che c'era già) per avviare Internet Explorer.
- E' normale che sia capitato questo?
- Posso cancellare l'icona "in eccesso"?
- Posso riattivare l'antivirus e Spybot dal momento che ho terminato la scanzione con combofix?

Ti ringrazio Luke.
(Attendo nuove istruzioni).

[StefySte]

ScanSione...

[Luke57]

ScanSione...

Meno male
Ciao, apri un file di testo con il blocco note (da start>programmi>accessori>blocco note), incollaci il seguente testo:

Codice: Seleziona tutto

Driver::
iMSPQMn

File::
c:\docume~1\Stefy\IMPOST~1\Temp\iMSPQMn.sys
c:\windows\Tasks\pfhinz.job

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"drhweahw"=-
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c4748811-3240-11dd-a595-e1f4056b4578}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c4748812-3240-11dd-a595-e1f4056b4578}]

SALVA IL FILE DI TESTO NELLA STESSA DIREZIONE DI COMBOFIX, chiamandolo obbligatoriamente CFScript.txt
trascinalo con il puntatore del mouse sull'icona di combofix. Il programma avvierà una nuova scansione. Al termine riavvia il computer ed allega il nuovo report (C:\combofix.txt).

[StefySte]

Ciao Luke,
ho fatto tutto...Spero!
(Ho salvato il file di testo chiamandolo CFScript.txt, anche se non so che cosa significa "NELLA STESSA DIREZIONE DI COMBOFIX").

[Luke57]

Ciao, sembra tutto a posto. Hai sempre problemi?

[StefySte]

Ciao Luke!

Poco fa ho acceso il pc e dopo un po' (dopo che sono apparse tutte le icone sul desktop) è apparsa una pagina blu dove c'era scritto in bianco:
Si è verificato un problema e windows è stato arrestato per impedire danni al computer
PAGE_FAULT_IN_NONPAGED_AREA


E poi sotto c'erano scritte altre cose...

[StefySte]

Ho riavviato il pc; ho cancellato Combofix; ho riattivato il tea timer di Spybot, la modalità predefinita e l'antivirus.
Poi ho riavviato il pc e ad un certo punto è apparsa una finestra (forse in riferimento alla pagina blu con la scritta bianca) dove c'era scritto:
E' stato creato un registro relativo all'errore
Per visualizzare i dati contenuti nella segnalazione errori clicca qui

Ho cliccato lì e ho visualizzato questo codice:

BCCode : 50 BCP1 : D40C0000 BCP2 : 00000000 BCP3 : 8058DB40
BCP4 : 00000000 OSVer : 5_1_2600 SP : 2_0 Product : 256_1

[Luke57]

Hai sempre problemi?

[StefySte]

Ciao Luke,
sembra che sia tutto a posto. Il pc non mi ha dato problemi!
(C'era la barra di "freeze Toolbar" dove c'era scritto "Toolbar is corrupted", e l'ho disinstallato...)


Luke, ti ringrazio tanto!