Trojan.Gen

[Barbara66]

salve a tutti.
Ho un PC HP con Windows 7Pro
Come antivirus ho installati Norton Internet Security 2010 + Spyware doctor.
Ogni volta che accendo il PC Norton blocca Trojan.Gen e/o Suspicious.DLoader
Come faccio a rimuoverli completamente?
Grazie per l'aiuto.
Saluti barbara

[shel]

ciao

scarica hijackthis e mettilo nella directory C dove avrai preparato una cartella con il suo nome.
Lanci l'eseguibile e clicchi su " do a system scan and save a log" alla fine salvi questo file con estensione *.TXT e lo alleghi ad un post sul forum.

[BarbaraNava66]

Scaricato hijackthis. Avviato. Ecco il risultato.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:42:47, on 12/05/2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\igfxtray.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Norton Utilities 14\RMTray.exe
C:\Hijackthis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.uk.msn.com/HPCOM/11
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.uk.msn.com/HPCOM/11
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.uk.msn.com/HPCOM/11
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Browser Defender BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll
O2 - BHO: (no name) - {5F1D2BCC-6BFB-49BC-8A33-5716CDBCB2Cf} - (no file)
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\17.6.0.32\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\17.6.0.32\IPSBHO.DLL
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\17.6.0.32\coIEPlg.dll
O3 - Toolbar: PC Tools Browser Guard - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
O4 - HKLM\..\Run: [picon] "C:\Program Files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe" -startup
O4 - HKLM\..\Run: [NortonOnlineBackupReminder] "C:\Program Files\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED
O4 - HKLM\..\Run: [PDF Complete] C:\Program Files\PDF Complete\pdfsty.exe
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [NortonUtilities] C:\Program Files\Norton Utilities 14\RMTray.exe /H
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O15 - Trusted Zone: http://*.mcafee.com (HKLM)
O15 - Trusted Zone: http://betavscan.mcafeeasap.com (HKLM)
O15 - Trusted Zone: http://vs.mcafeeasap.com (HKLM)
O15 - Trusted Zone: http://www.mcafeeasap.com (HKLM)
O15 - ESC Trusted Zone: http://*.mcafee.com (HKLM)
O15 - ESC Trusted Zone: http://betavscan.mcafeeasap.com (HKLM)
O15 - ESC Trusted Zone: http://vs.mcafeeasap.com (HKLM)
O15 - ESC Trusted Zone: http://www.mcafeeasap.com (HKLM)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.3.1_18) - http://javadl-esd.sun.com/update/1.3.1/ ... -win32.cab
O20 - AppInit_DLLs: C:\Windows\System32\dfdts32.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Browser Defender Update Service - Unknown owner - C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files\Intel\AMT\LMS.exe
O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\17.6.0.32\ccSvcHst.exe
O23 - Service: PDF Document Manager (pdfcDispatcher) - PDF Complete Inc - C:\Program Files\PDF Complete\pdfsvc.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: ThreatFire - PC Tools - C:\Program Files\Spyware Doctor\TFEngine\TFService.exe
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files\Common Files\Intel\Privacy Icon\UNS\UNS.exe

--
End of file - 5855 bytes

[shel]

c'e' un processo a me sconosciuto, facciamo un controllo per maggior sicurezza

scarica malwarebytes

Aggiornalo: clicca sulla scheda "aggiornamenti" => "controlla aggiornamenti"
Esegui una "scansione completa" (seleziona l'opzione)
A scansione completata, posta il rapporto.

[BarbaraNava66]

Ecco fatto. E ora?
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Versione database: 4092

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

12/05/2010 14:31:40
mbam-log-2010-05-12 (14-31-40).txt

Tipo di scansione: Scansione completa (C:\|)
Elementi esaminati: 192129
Tempo trascorso: 30 minuti, 39 secondi

Processi infetti in memoria: 0
Moduli di memoria infetti: 2
Chiavi di registro infette: 4
Valori di registro infetti: 0
Voci infette nei dati di registro: 2
Cartelle infette: 2
File infetti: 63

Processi infetti in memoria:
(Non sono stati rilevati elementi nocivi)

Moduli di memoria infetti:
C:\Windows\System32\dfdts32.dll (Trojan.Tracur) -> Delete on reboot.
C:\ProgramData\correngine32.dll (Trojan.Tracur) -> Delete on reboot.

Chiavi di registro infette:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{17c74af3-6bfb-49bc-8a33-5716cdbcb2cf} (Trojan.BHO.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{17c74af3-6bfb-49bc-8a33-5716cdbcb2cf} (Trojan.BHO.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{17c74af3-6bfb-49bc-8a33-5716cdbcb2cf} (Trojan.Tracur) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\.fsharproj (Trojan.Tracur) -> Quarantined and deleted successfully.

Valori di registro infetti:
(Non sono stati rilevati elementi nocivi)

Voci infette nei dati di registro:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Tracur) -> Data: c:\windows\system32\dfdts32.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Tracur) -> Data: system32\dfdts32.dll -> Quarantined and deleted successfully.

Cartelle infette:
C:\ProgramData\909430090 (Rogue.WindowsSmartSecurity) -> Quarantined and deleted successfully.
C:\Users\EleAp\AppData\Roaming\SystemProc (Trojan.Agent) -> Quarantined and deleted successfully.

File infetti:
C:\ProgramData\correngine32.dll (Trojan.BHO.H) -> Quarantined and deleted successfully.
C:\Windows\System32\dfdts32.dll (Trojan.Tracur) -> Delete on reboot.
C:\Users\ELE.AP\AppData\Local\Temp\AD1B.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\ELE.AP\AppData\Local\Temp\B928.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\ELE.AP\AppData\Local\Temp\CD1A.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\ELE.AP\AppData\Local\Temp\E8E0.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\ELE.AP\AppData\Roaming\8D.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\EleAp\AppData\Local\Temp\1.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\EleAp\AppData\Local\Temp\1C28.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\EleAp\AppData\Local\Temp\1F6C.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\EleAp\AppData\Local\Temp\2A32.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\EleAp\AppData\Local\Temp\4161.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\EleAp\AppData\Local\Temp\41F9.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\EleAp\AppData\Local\Temp\428C.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\EleAp\AppData\Local\Temp\45D0.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\EleAp\AppData\Local\Temp\4605.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\EleAp\AppData\Local\Temp\46F5.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\EleAp\AppData\Local\Temp\4B2.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\EleAp\AppData\Local\Temp\52A2.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\EleAp\AppData\Local\Temp\52C1.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\EleAp\AppData\Local\Temp\5322.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\EleAp\AppData\Local\Temp\54A3.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\EleAp\AppData\Local\Temp\6712.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\EleAp\AppData\Local\Temp\672B.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\EleAp\AppData\Local\Temp\6C50.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\EleAp\AppData\Local\Temp\76C6.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\EleAp\AppData\Local\Temp\76F7.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\EleAp\AppData\Local\Temp\8556.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\EleAp\AppData\Local\Temp\B440.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\EleAp\AppData\Local\Temp\D3A7.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\EleAp\AppData\Local\Temp\D40C.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\EleAp\AppData\Local\Temp\D4CC.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\EleAp\AppData\Local\Temp\DAF4.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\EleAp\AppData\Local\Temp\DBFD.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\EleAp\AppData\Local\Temp\E24E.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\EleAp\AppData\Local\Temp\E5A4.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\EleAp\AppData\Local\Temp\EC36.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\EleAp\AppData\Local\Temp\FEB3.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\EleAp\AppData\Local\Temp\98B6.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\EleAp\AppData\Roaming\SystemProc\lsass.exe (Trojan.Tracur) -> Delete on reboot.
C:\$RECYCLE.BIN\S-1-5-21-3553604259-2151522640-836713269-1001\$RFOGBRH.tmp (Worm.Prolaco.M) -> Quarantined and deleted successfully.
C:\$RECYCLE.BIN\S-1-5-21-3553604259-2151522640-836713269-1001\$RFTDCWX.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\$RECYCLE.BIN\S-1-5-21-3553604259-2151522640-836713269-1001\$RYRX967.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\$RECYCLE.BIN\S-1-5-21-3553604259-2151522640-836713269-1001\$RZ5NG0O.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\ProgramData\cofiredm32.dll (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\ProgramData\colorui32.dll (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\ProgramData\cryptbase32.dll (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\ProgramData\cryptui32.dll (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\ProgramData\dispex32.dll (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\ProgramData\dmloader32.dll (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\ProgramData\dmscript32.dll (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\ProgramData\dot3api32.dll (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\ProgramData\ctl3dv232.dll (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\ProgramData\d3d10level932.dll (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\ProgramData\d3dim70032.dll (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\ProgramData\defragproxy32.dll (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\ProgramData\DeviceCenter32.dll (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\ProgramData\DevicePairingFolder32.dll (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\ProgramData\DeviceUxRes32.dll (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Windows\System32\dbgeng32.dll (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Windows\System32\dfshim32.dll (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Windows\Temp\TMP0000032FBB441585C3D953BA (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\ProgramData\909430090\new.i0 (Rogue.WindowsSmartSecurity) -> Quarantined and deleted successfully.

[shel]

beh diciamo che avevi parecchie infezioni nel pc....hai installato WindowsSmartSecurity?

ecco cos'e' SmartSecurity

eliminiamo cio' che rimane di questo rogue

scarica ccleaner

1) per il download dell'ultima versione clicca a destra in alto sotto la freccia verde
2) installalo
3) clicca su "avvia pulizia", ripeti il procedimento 2 volte


Correzione errori File di Registro

Clicca i tasti:
- Registro (Secondo tasto in alto a Sinistra)
- Trova Problemi (Pulsante in basso Centrale)
- Ripara selezionati (Pulsante in basso a Destra)
- alla domanda:
- Vuoi eseguire il Backup delle modifiche del Registro” rispondi SI

scarica ATFCleaner
1) seleziona la casella Select All
2) clicca sul pulsante Empty selected
3) aspetta l'avviso Done Cleaning.
(se non vuoi eliminare le password togli la spunta) - (se usi opera o firefox,spunta anche le loro sezioni)

disattiva l'antivirus


scarica combofix sul desktop ed eseguilo
(non installare la recovery console)
Doppio click su combofix.exe (comparirà una videata.)
Digita 1 premi Invio e segui le indicazioni.
Al termine, verrà creato un file log chiamato C:\ComboFix.txt. Postalo qui.
Durante l'operazione di scansione è importante non usare il PC e attendere pazientemente la fine delle operazioni.

[BarbaraNava66]

BENE, di bene in meglio.
Dopo aver lanciato malwarebytes, mi viene richiesto in reboot.
Il PC non parte più. Si impalla sulla finestra avvio di windows.
Ottimo, pensando che è un PC acquistato il 15 Aprile....

[BarbaraNava66]

P.S. Non riesco neanche a trovare il tasto giusto per farlo partire in modalità provvisoria.
Menomale che ho il mio vecchio PC con XP pro che funziona eccellentemente.
Mi girano un po' perchè ho acquistato appositamente dei programmi monolicenza e al solo pensiero di dover riformattare tutto mi viene il nervoso.
Scusate lo sfogo precedente e questo ma non so più che fare...

[shel]

BarbaraNava66 i programmi che vengono utilizzati in questo forum vengono consigliati per eliminare le infezioni che sono nei pc infetti: probabilmente il tuo pc, anche se acquistato recentemente, ha una serie di problemi che non puoi esporre in questa sede.
Se non sei sicura dell'assistenza che ti viene offerta puoi benissimo portarlo in assistenza dove sapranno, con adeguato compenso, risolvere il tuo problema.
Per cio' che mi riguarda, malwarebytes e combofix sono i programmi piu' usati(e non solo in questo forum) e non hanno mai creato nessun problema.

Ciao

[BarbaraNava66]

caro sig. Shel, io non me la sono presa ne con Lei ne con lo staff di PC-Facile. Mi sono arrabbiata con me stessa e, chiedo ancora scusa, se mi sono sfogata.
Mi avete risolto tanti altri problemi (anche non di virus) e ve ne sono veramente grata.
E' che già ero molto scettica ad acquistare un PC nuovo con Win 7 ora, dopo ripristino tramite disco apposito, sono riuscita a rimmettere tutti i programmi di lavoro che mi servono a parte uno.
Vi ringrazio ancora per l'aiuto fornito e Vi saluto.
Barbara Nava