Olimpo Informatico

[Trinidad]

Ho un bel problemino con questo Worm

nella macchina ho l' antivirus trend micro officescan che mi dice:

Virus Alert!!
WORM_NYXEM.E is detected
------------------------------------------------------
Infected file: C:\WINNT\SYSTEM32\WINZIP.EXE
-------------------------------------------------------

in internet ho trovato questa soluzione:

Removing Autostart Entry from the Registry
On Windows ME, NT, 2000, XP, and Server 2003

Removing autostart entry from the registry prevents the malware from executing at startup.

If the registry entry below is not found, the malware may not have executed as of detection. If so, proceed to the succeeding solution set.

Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>
Windows>CurrentVersion>Run
In the right panel, locate and delete the entry:
ScanRegistry = "scanregw.exe /scan"
Restoring Modified Registry Entry

Still in Registry Editor, in the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>
Windows>CurrentVersion>Explorer>Advanced
In the right panel, locate the following registry entry:
ShowSuperHidden = "dword:00000000"
Right-click on the registry entry and select Modify. Change the value to the following:
ShowSuperHidden = "dword:00000001"
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>
Windows>CurrentVersion>Explorer>CabinetState
In the right panel, locate the following registry entry:
FullPath= "dword:00000001"
Right-click on the registry entry and select Modify. Change the value to the following:
ShowSuperHidden = "dword:00000000"
Close Registry Editor.

ma devo farlo in modalità provvisoria o no?

il log di Hijakthis :


Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 10.09.02, on 24/05/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\ctfmon.exe
C:\WINNT\system32\wuauclt.exe
C:\WINNT\SYSTEM32\Winzip.exe
C:\WINNT\SYSTEM32\Update.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\Trend Micro\OfficeScan Client\tmlisten.exe
C:\Programmi\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\Programmi\Trend Micro\OfficeScan Client\ofcdog.exe
C:\Programmi\Trend Micro\OfficeScan Client\Pccntmon.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\PROGRA~1\LAVASOFT\AD-AWA~1\AD-AWARE.EXE
C:\Documents and Settings\Administrator\Desktop\HijakThis\HiJackThis_v2.exe
C:\WINNT\SYSTEM32\at.exe
C:\WINNT\SYSTEM32\at.exe
C:\WINNT\SYSTEM32\Net.exe

O23 - Service: OfficeScanNT Listener (tmlisten) - Unknown owner - C:\Programmi\Trend Micro\OfficeScan Client\tmlisten.exe

--
End of file - 1423 bytes

che mi sembra un po scarso...

ciao
Trinidad

[bdoriano]

Corto, è corto!!!
Quando usi il pc, hai diritti amministrativi?

Per eliminare programmi dall'avvio, ti conviene utilizzare programmi come:
- msconfig
- Autoruns
- SpyBot
- EasyCleaner
o similari. Che ti consentono anche la semplice disabilitazione dei programmi.

[Trinidad]

ho risolto con spybot e officescan in mod provvisoria e con la procedura che ho scritto prima, ma in inglese che pa...!!!

Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>
Windows>CurrentVersion>Run
In the right panel, locate and delete the entry:
ScanRegistry = "scanregw.exe /scan"
Restoring Modified Registry Entry

Still in Registry Editor, in the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>
Windows>CurrentVersion>Explorer>Advanced
In the right panel, locate the following registry entry:
ShowSuperHidden = "dword:00000000"
Right-click on the registry entry and select Modify. Change the value to the following:
ShowSuperHidden = "dword:00000001"
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>
Windows>CurrentVersion>Explorer>CabinetState
In the right panel, locate the following registry entry:
FullPath= "dword:00000001"
Right-click on the registry entry and select Modify. Change the value to the following:
ShowSuperHidden = "dword:00000000"
Close Registry Editor.