worm b.exe

[barney79]

ciao a tutto il forum vi chiedo una mano
installando un sw YouUnistaller 2008
il pc mi si è riempito improvvisamente di virus

premetto che ho kaspersky internet security, prontamente lanciato dopo un riavvio forzato
ho disinstallato tutto ma ho notato che si generaro di continuo messaggi di "errore b.exe"

ho provato ad eseguire un ripristino di configurazione di sistema
ma non parte più
clikkando sull'icona non va
ho provato ad utilizzare un sw di ripristino forzato
System Restore Repair
ma dopo molti tentativi i risultati sono stati inesistenti
ho fatto un log con hijackthis
lo posto
di seguito magari qualcuno di voi è in grado di verificare l'eventuale presenza di valori dannosi
grazie


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19.47.19, on 23/07/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programmi\CyberLink\PowerDVD8\PDVD8Serv.exe
C:\Programmi\Cyberlink\Shared Files\brs.exe
C:\Programmi\Java\jre6\bin\jusched.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\File comuni\Nero\Lib\NMIndexStoreSvr.exe
C:\Programmi\HDD Thermometer\HDD Thermometer.exe
C:\Programmi\Nokia\Nokia PC Suite 6\PCSuite.exe
C:\DOCUME~1\ADMINI~1\IMPOST~1\Temp\b.exe
C:\Programmi\Java\jre6\bin\jqs.exe
C:\WINDOWS\msa.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmi\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\File comuni\Nero\Lib\NMIndexingService.exe
C:\Programmi\PC Connectivity Solution\ServiceLayer.exe
C:\Programmi\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Programmi\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Programmi\WinRAR\WinRAR.exe
C:\Documents and Settings\Administrator\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O1 - Hosts: 92.241.176.188 advanced-virus-remover2009.com
O1 - Hosts: 92.241.176.188 www.advanced-virus-remover2009.com
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [RemoteControl8] C:\Programmi\CyberLink\PowerDVD8\PDVD8Serv.exe
O4 - HKLM\..\Run: [PDVD8LanguageShortcut] C:\Programmi\CyberLink\PowerDVD8\Language\Language.exe
O4 - HKLM\..\Run: [BDRegion] C:\Programmi\Cyberlink\Shared Files\brs.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmi\File comuni\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Programmi\File comuni\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [EPSON Stylus D68 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /O6 "USB001" /M "Stylus D68"
O4 - HKLM\..\Run: [avp] "C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [RSD_HDDThermo] C:\Programmi\HDD Thermometer\HDD Thermometer.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Programmi\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Monopod] C:\DOCUME~1\ADMINI~1\IMPOST~1\Temp\b.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Programmi\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Aggiungi ad Anti-Banner - C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: &Tastiera Virtuale - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: C&ontrollo URL - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{3501A5F9-E06A-428E-9037-240ED2BA0F40}: NameServer = 85.37.17.16 85.38.28.68
O17 - HKLM\System\CS3\Services\Tcpip\..\{3501A5F9-E06A-428E-9037-240ED2BA0F40}: NameServer = 85.37.17.16 85.38.28.68
O17 - HKLM\System\CS4\Services\Tcpip\..\{3501A5F9-E06A-428E-9037-240ED2BA0F40}: NameServer = 85.37.17.16 85.38.28.68
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~2\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~2\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~2\kloehk.dll
O22 - SharedTaskScheduler: rtasgvfu76ew8ndkfno94 - {D76AB2A1-00F3-42BD-F434-00BBC39C8953} - (no file)
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Programmi\File comuni\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmi\Java\jre6\bin\jqs.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programmi\File comuni\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Programmi\CyberLink\Shared files\RichVideo.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Programmi\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Programmi\Spyware Doctor\pctsSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programmi\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe

--
End of file - 8548 bytes

[Luke57]

Ciao Scarica Combofix sul desktop
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
disattiva il tuo antivirus e disconnettiti da internet
avvia combofix.exe e premi il tasto 1
(non installare la recovery console quando il programma lo propone)
Lascia lavorare il programma senza interferire, se spariscono le icone del desktop è normale
Al termine, allega il rapporto C:\ComboFix.txt nella tua risposta.

[barney79]

ho provato a scariarlo più di una volta ma
combofix proprio non mi funziona
continua a darmi questo messaggio
!!ALERT!! it is not safe to continue!
the contents of combofix package has been compromised please download a fresh copy frorm (...)
Note: you may be infected with a file patching virus "Virut"

[Luke57]

Ciao, Scarica CCleaner http://www.ccleaner.com/download

installalo (deseleziona l'opzione che installa la barra di Yahoo) poi avvialo >Opzioni>Avanzate, togli la spunta a "cancella file windows più vecchi di 48 ore".
Poi premi "avvia pulizia".

4) Scarica Malwarebytes, installa il programma ed aggiorna le firme.
http://www.download.com/Malwarebytes-An ... 04572.html
Nella scheda scansione, seleziona "scansione completa"
Allega il rapporto.

[barney79]

effettuate operazioni consigliate ora?

Malwarebytes' Anti-Malware 1.39
Versione del database: 2421
Windows 5.1.2600 Service Pack 3

24/07/2009 14.47.10
mbam-log-2009-07-24 (14-47-03).txt

Tipo di scansione: Scansione completa (C:\|E:\|)
Elementi scansionati: 159434
Tempo trascorso: 42 minute(s), 37 second(s)

Processi delle memoria infetti: 1
Moduli della memoria infetti: 0
Chiavi di registro infette: 4
Valori di registro infetti: 2
Elementi dato del registro infetti: 0
Cartelle infette: 2
File infetti: 25

Processi delle memoria infetti:
C:\WINDOWS\msa.exe (Trojan.Agent) -> No action taken.

Moduli della memoria infetti:
(Nessun elemento malevolo rilevato)

Chiavi di registro infette:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{d76ab2a1-00f3-42bd-f434-00bbc39c8953} (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sfx (Trojan.Agent) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\ColdWare (Malware.Trace) -> No action taken.

Valori di registro infetti:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{d76ab2a1-00f3-42bd-f434-00bbc39c8953} (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\sfx (Rootkit.Agent) -> No action taken.

Elementi dato del registro infetti:
(Nessun elemento malevolo rilevato)

Cartelle infette:
C:\Programmi\Jcore (Trojan.BHO) -> No action taken.
C:\Documents and Settings\Administrator\Dati applicazioni\pridl (Trojan.Downloader) -> No action taken.

File infetti:
c:\cbbukm.exe (Trojan.Agent) -> No action taken.
c:\programmi\sFX\SfX.DlL (Trojan.Agent) -> No action taken.
c:\programmi\Jcore\Jcore2.dll (Trojan.BHO) -> No action taken.
c:\system volume information\_restore{a79e0999-dda1-4de5-afd3-16b96be4417f}\RP118\A0035670.exe (Trojan.Agent) -> No action taken.
c:\system volume information\_restore{a79e0999-dda1-4de5-afd3-16b96be4417f}\RP118\A0035677.exe (Trojan.Agent) -> No action taken.
c:\WINDOWS\system32\3BC4.tmp (Trojan.Dropper) -> No action taken.
c:\WINDOWS\system32\config\systemprofile\impostazioni locali\Temp\gaopdx14754937 (Trojan.Dropper) -> No action taken.
c:\WINDOWS\system32\config\systemprofile\impostazioni locali\Temp\gaopdx818234 (Trojan.Dropper) -> No action taken.
c:\WINDOWS\system32\drivers\smss.exe (Trojan.Agent) -> No action taken.
c:\WINDOWS\system32\drivers\smss.exe_ (Trojan.Agent) -> No action taken.
c:\documents and settings\administrator\dati applicazioni\pridl\pridl.exe (Trojan.Downloader) -> No action taken.
C:\WINDOWS\msa.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\reader_s.exe (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Administrator\reader_s.exe (Trojan.Agent) -> No action taken.
c:\WINDOWS\Tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\system32\msxml71.dll (Trojan.FakeAlert) -> No action taken.
C:\Documents and Settings\Administrator\oashdihasidhasuidhiasdhiashdiuasdhasd (Trace.Pandex) -> No action taken.
C:\WINDOWS\system32\MSIVXcount (Trojan.Agent) -> No action taken.
C:\WINDOWS\010112010146118114.dat (Worm.KoobFace) -> No action taken.
c:\WINDOWS\system32\hjgruijftwlixi.dll (Trojan.Agent) -> No action taken.
c:\WINDOWS\system32\hjgruikrihbgix.dll (Trojan.Agent) -> No action taken.
c:\WINDOWS\system32\hjgruiktkvtwsi.dll (Trojan.Agent) -> No action taken.
c:\WINDOWS\system32\hjgruiydrwwjoq.dll (Trojan.Agent) -> No action taken.
c:\WINDOWS\system32\drivers\hjgruiemqstklu.sys (Trojan.Agent) -> No action taken.
c:\WINDOWS\system32\drivers\hjgruiltnqvewp.sys (Trojan.Agent) -> No action taken.

[Luke57]

Ciao, adesso seleziona gli elementi trovati e premi Rimuovi elementi selezionati.

[barney79]

fatto ora?

ps: grazie per l'aiuto...ovviamente

[Luke57]

Ciao, scusa il ritardo, riesci ad eseguire combofix adesso?

[barney79]

ciao...
ho dovuto formattare il disco principale.
kis mi ha trovato sul disco secondario che non avevo formattato degli exe infettati.
gli ho disinfettati e rimossi
come posso essere certo di non essesre ancora infatto?
grazie sempre e cmq