Olimpo Informatico

[ppino]

Ciao a tutti,
mi unisco a questo topic perchè in questi giorni ho avuto lo stesso virus... finestra di "computer infected" e sparizione del pannello di controllo. Sono riuscito a far sparire la finestra "computer infected", con scansioni antivirus e altri programmi antispyware, ma il pannello di controllo non torna... sospetto ancora problemi!
Vi posto il log di hijack sperando in un vostro aiuto!

Logfile of HijackThis v1.99.1
Scan saved at 18.10.01, on 15/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Netropa\Multimedia Keyboard\nhksrv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\Programmi\Netropa\Multimedia Keyboard\MMKeybd.exe
C:\Programmi\Trust\Ami Mouse 300 Optical Dual Scroll\Amoumain.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Programmi\Netropa\Multimedia Keyboard\TrayMon.exe
C:\Programmi\Netropa\Onscreen Display\OSD.exe
C:\Programmi\Outlook Express\msimn.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Fabio\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - Default URLSearchHook is missing
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Programmi\DAP\DAPIEBar.dll
O3 - Toolbar: (no name) - {5BD7EA6A-0418-31A3-7DCD-C58ED56D3E76} - (no file)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmi\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar2.dll
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Programmi\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [WheelMouse] C:\Programmi\Trust\Ami Mouse 300 Optical Dual Scroll\Amoumain.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [WinAVX] C:\WINDOWS\system32\WinAvXX.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.ballroomdancingworld.com
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/229e3446b7d3484b2b06/netzip/RdxIE601_it.cab
O16 - DPF: {640DB888-6A57-409C-A329-5D87FEF1EC06} - http://gromozon.com/8d1f0c43/50300/1/xp/FreeAccess.ocx
O16 - DPF: {A335EC30-2007-4F57-A0D1-4FDFCCA18B91} - http://td8eau9td.com/1a5645f6/50310/1/xp/FreeAccess.cab
O16 - DPF: {E61135DF-716D-49A7-B29B-8287A1CD072C} (WidelookX Control) - http://welcome2.immanens.com/it/widelook/widelookX.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0C3DE83F-CB7F-476E-BD6A-C3B6E006D589}: NameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{0C3DE83F-CB7F-476E-BD6A-C3B6E006D589}: NameServer = 192.168.1.1
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Programmi\Netropa\Multimedia Keyboard\nhksrv.exe
O23 - Service: WebKhv - Unknown owner - C:\Programmi\File comuni\System\GBWCC.exe (file missing)

[Sante62]

Ciao ppino
Avvia il PC in modalità provvisoria: http://forum.zeusnews.com/viewtopic.php?t=22084

Avvia Hijackthis e metti la spunta a sinistra di queste righe, quelle segnate in rosso se le conosci per ora non toglierle:-

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R3 - Default URLSearchHook is missing
O3 - Toolbar: (no name) - {5BD7EA6A-0418-31A3-7DCD-C58ED56D3E76} - (no file)
O16 - DPF: {640DB888-6A57-409C-A329-5D87FEF1EC06} - http://gromozon.com/8d1f0c43/50300/1/xp/FreeAccess.ocx
O16 - DPF: {A335EC30-2007-4F57-A0D1-4FDFCCA18B91} - http://td8eau9td.com/1a5645f6/50310/1/xp/FreeAccess.cab
O15 - Trusted Zone: http://www.ballroomdancingworld.com
O4 - HKLM\..\Run: [WinAVX] C:\WINDOWS\system32\WinAvXX.exe
Clicca fix Checked
Riavvia il PC e posta un nuovo log di HJT

Poi, fai anche questi passaggi:
http://forum.zeusnews.com/viewtopic.php?p=194965#194965 passaggio 1 -

http://forum.zeusnews.com/viewtopic.php?p=194966#194966 passaggio 2 -

[ppino]

Ciao Sante,
ecco il nuovo log, il pannello di controllo ancora non compare, vado a fare gli altri passaggi. Grazie

Logfile of HijackThis v1.99.1
Scan saved at 13.11.00, on 16/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Netropa\Multimedia Keyboard\nhksrv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Netropa\Multimedia Keyboard\MMKeybd.exe
C:\Programmi\Trust\Ami Mouse 300 Optical Dual Scroll\Amoumain.exe
C:\Programmi\Netropa\Multimedia Keyboard\TrayMon.exe
C:\Programmi\Netropa\Onscreen Display\OSD.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Fabio\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.libero.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Programmi\DAP\DAPIEBar.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmi\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar2.dll
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Programmi\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [WheelMouse] C:\Programmi\Trust\Ami Mouse 300 Optical Dual Scroll\Amoumain.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [WinAVX] C:\WINDOWS\system32\WinAvXX.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.ballroomdancingworld.com
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/229e3446b7d3484b2b06/netzip/RdxIE601_it.cab
O16 - DPF: {640DB888-6A57-409C-A329-5D87FEF1EC06} - http://gromozon.com/8d1f0c43/50300/1/xp/FreeAccess.ocx
O16 - DPF: {A335EC30-2007-4F57-A0D1-4FDFCCA18B91} - http://td8eau9td.com/1a5645f6/50310/1/xp/FreeAccess.cab
O16 - DPF: {E61135DF-716D-49A7-B29B-8287A1CD072C} (WidelookX Control) - http://welcome2.immanens.com/it/widelook/widelookX.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0C3DE83F-CB7F-476E-BD6A-C3B6E006D589}: NameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{0C3DE83F-CB7F-476E-BD6A-C3B6E006D589}: NameServer = 192.168.1.1
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Programmi\Netropa\Multimedia Keyboard\nhksrv.exe
O23 - Service: WebKhv - Unknown owner - C:\Programmi\File comuni\System\GBWCC.exe (file missing)

[bdoriano]

Scusate, posso?

ppino con hijackthis elimina senza pietà anche queste voci:

[ppino]

Grazie doriano, ho fatto e riposto il log:

Logfile of HijackThis v1.99.1
Scan saved at 15.31.39, on 16/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Netropa\Multimedia Keyboard\nhksrv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Programmi\Netropa\Multimedia Keyboard\MMKeybd.exe
C:\Programmi\Trust\Ami Mouse 300 Optical Dual Scroll\Amoumain.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Programmi\Netropa\Multimedia Keyboard\TrayMon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\Netropa\Onscreen Display\OSD.exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Fabio\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.libero.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Programmi\DAP\DAPIEBar.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmi\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar2.dll
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Programmi\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [WheelMouse] C:\Programmi\Trust\Ami Mouse 300 Optical Dual Scroll\Amoumain.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.ballroomdancingworld.com
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/229e3446b7d3484b2b06/netzip/RdxIE601_it.cab
O16 - DPF: {E61135DF-716D-49A7-B29B-8287A1CD072C} (WidelookX Control) - http://welcome2.immanens.com/it/widelook/widelookX.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0C3DE83F-CB7F-476E-BD6A-C3B6E006D589}: NameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{0C3DE83F-CB7F-476E-BD6A-C3B6E006D589}: NameServer = 192.168.1.1
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Programmi\Netropa\Multimedia Keyboard\nhksrv.exe
O23 - Service: WebKhv - Unknown owner - C:\Programmi\File comuni\System\GBWCC.exe (file missing)


Vi posto anche il log di AWF:


Find AWF report by noahdfear ©2006


bak folders found
~~~~~~~~~~~

Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 5049-46AF

Directory di C:\PROGRA~1\DAP\BAK

24/07/2003 23.45 1.445.888 DAP.EXE
1 File 1.445.888 byte
2 Directory 4.067.205.120 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 5049-46AF

Directory di C:\PROGRA~1\MESSEN~1\BAK

0 File 0 byte
2 Directory 4.067.205.120 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 5049-46AF

Directory di C:\WINDOWS\SYSTEM32\BAK

20/08/2004 00.39 15.360 ctfmon.exe
1 File 15.360 byte
2 Directory 4.067.201.024 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 5049-46AF

Directory di C:\PROGRA~1\ANI\ANIWZC~1\BAK

19/10/2005 18.19 49.152 WZCSLDR2.exe
1 File 49.152 byte
2 Directory 4.067.201.024 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 5049-46AF

Directory di C:\PROGRA~1\D-LINK\AIRPLU~1\BAK

23/11/2005 15.04 1.544.192 AirGCFG.exe
1 File 1.544.192 byte
2 Directory 4.067.201.024 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 5049-46AF

Directory di C:\PROGRA~1\GRISOFT\AVG7\BAK

18/03/2007 21.52 411.648 avgcc.exe
1 File 411.648 byte
2 Directory 4.067.201.024 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 5049-46AF

Directory di C:\PROGRA~1\NETROPA\MULTIM~1\BAK

23/07/2002 01.55 167.936 MMKeybd.exe
1 File 167.936 byte
2 Directory 4.067.201.024 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 5049-46AF

Directory di C:\PROGRA~1\TRUST\AMIMOU~1\BAK

15/11/2001 13.44 196.608 Amoumain.exe
1 File 196.608 byte
2 Directory 4.067.201.024 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 5049-46AF

Directory di C:\PROGRA~1\GOOGLE\GOOGLE~2\121128~1.546\BAK

26/01/2007 00.26 171.448 GoogleToolbarNotifier.exe
1 File 171.448 byte
2 Directory 4.067.201.024 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 5049-46AF

Directory di C:\PROGRA~1\JAVA\JRE15~1.0_1\BIN\BAK

09/11/2006 16.07 49.263 jusched.exe
1 File 49.263 byte
2 Directory 4.067.201.024 byte disponibili


Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~

1445888 24 Jul 2003 "C:\Programmi\DAP\DAP.EXE"
1445888 24 Jul 2003 "C:\Programmi\DAP\bak\DAP.EXE"
15360 20 Aug 2004 "C:\WINDOWS\system32\ctfmon.exe"
15360 20 Aug 2004 "C:\WINDOWS\system32\bak\ctfmon.exe"
49152 19 Oct 2005 "C:\Programmi\ANI\ANIWZCS2 Service\bak\WZCSLDR2.exe"
1544192 23 Nov 2005 "C:\Programmi\D-Link\AirPlus G\bak\AirGCFG.exe"
416256 23 Apr 2007 "C:\Programmi\Grisoft\AVG7\avgcc.exe"
411648 18 Mar 2007 "C:\Programmi\Grisoft\AVG7\bak\avgcc.exe"
167936 23 Jul 2002 "C:\Programmi\Netropa\Multimedia Keyboard\MMKeybd.exe"
167936 23 Jul 2002 "C:\Programmi\Netropa\Multimedia Keyboard\bak\MMKeybd.exe"
196608 15 Nov 2001 "C:\Programmi\Trust\Ami Mouse 300 Optical Dual Scroll\Amoumain.exe"
196608 15 Nov 2001 "C:\Programmi\Trust\Ami Mouse 300 Optical Dual Scroll\bak\Amoumain.exe"
52272 26 Jan 2007 "C:\Programmi\Google\googletoolbar2user.exe"
68856 19 Jun 2007 "C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
608936 22 Dec 2005 "C:\Programmi\File comuni\Real\GToolbar\GoogleToolbarInstaller.exe"
138168 26 Jan 2007 "C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe"
171448 26 Jan 2007 "C:\Programmi\Google\GoogleToolbarNotifier\1.2.1128.5462\bak\GoogleToolbarNotifier.exe"
832576 18 Oct 2006 "G:\Documenti\Downloads\GoogleToolbarInstaller.exe"
36975 3 May 2006 "C:\Programmi\Java\jre1.5.0_07\bin\jusched.exe"
49263 9 Nov 2006 "C:\Programmi\Java\jre1.5.0_10\bin\jusched.exe"
49263 9 Nov 2006 "C:\Programmi\Java\jre1.5.0_10\bin\bak\jusched.exe"


end of report


Devo procurarmi anche quello di GMER?
Grazie per la collaborazione!

[Sante62]

Il log di HJT adesso sembra pulito come pure quello di FindAWF.

Si...fai anche quelli di GMER

[ppino]

Ok farò anche con GMER! Anche perchè il pannello di controllo ancora non si vede... e questo mi sembra strano!
Grazie

[ppino]

Ecco i risultati di GMER, aspetto vostro commento!!


http://www.freefilehosting.net/download/MTI2NTg=

http://www.freefilehosting.net/download/MTI2NjU=

[bdoriano]

Ciao ppino,
rifai il log del tab RootKit, perchè mi sembra incompleto.
E' stranamente corto...

Eventualmente, rileggiti le istruzioni della scansione con GMER, in particolare il secondo passaggio.

[ppino]

Ci riprovo...

http://www.freefilehosting.net/download/MTI3MDU=

[bdoriano]

Va già meglio... è saltato fuori qualcosa di sospetto.

Scarica questo e scompattalo in una sua cartella non temporanea e non sul desktop

Avvia AVENGER
Clicca su input script manually
Clicca sulla lente d'ingrandimento
Inserisci queste righe:

[ppino]

Ecco il log di hijack

Logfile of HijackThis v1.99.1
Scan saved at 18.39.45, on 17/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Netropa\Multimedia Keyboard\nhksrv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Netropa\Multimedia Keyboard\MMKeybd.exe
C:\Programmi\Trust\Ami Mouse 300 Optical Dual Scroll\Amoumain.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Programmi\Netropa\Multimedia Keyboard\TrayMon.exe
C:\Programmi\Netropa\Onscreen Display\OSD.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Messenger\msmsgs.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Fabio\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.libero.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Programmi\DAP\DAPIEBar.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmi\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar2.dll
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Programmi\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [WheelMouse] C:\Programmi\Trust\Ami Mouse 300 Optical Dual Scroll\Amoumain.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.ballroomdancingworld.com
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/229e3446b7d3484b2b06/netzip/RdxIE601_it.cab
O16 - DPF: {E61135DF-716D-49A7-B29B-8287A1CD072C} (WidelookX Control) - http://welcome2.immanens.com/it/widelook/widelookX.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0C3DE83F-CB7F-476E-BD6A-C3B6E006D589}: NameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{0C3DE83F-CB7F-476E-BD6A-C3B6E006D589}: NameServer = 192.168.1.1
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Programmi\Netropa\Multimedia Keyboard\nhksrv.exe



E in più ti posto il log di Avenger, mi sembra che non sia riuscito a cancellare qualcosa...

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\oxorqrxw

*******************

Script file located at: \??\C:\Documents and Settings\yrsobhnh.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



File c:\windows\system32\incmfegx.sys not found!
Deletion of file c:\windows\system32\incmfegx.sys failed!

Could not process line:
c:\windows\system32\incmfegx.sys
Status: 0xc0000034



File C:\Programmi\File comuni\System\GBWCC.exe not found!
Deletion of file C:\Programmi\File comuni\System\GBWCC.exe failed!

Could not process line:
C:\Programmi\File comuni\System\GBWCC.exe
Status: 0xc0000034

Registry key HKLM\SYSTEM\CurrentControlSet\Services\WebKhv deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

[ppino]

Aspetta colpa mia... devo spostare avenger, è sul desktop
Riprovo tutto, scusami!!!

[ppino]

Questi sono giusti (almeno spero..)

Logfile of HijackThis v1.99.1
Scan saved at 19.07.54, on 17/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Netropa\Multimedia Keyboard\nhksrv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Netropa\Multimedia Keyboard\MMKeybd.exe
C:\Programmi\Trust\Ami Mouse 300 Optical Dual Scroll\Amoumain.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Programmi\Netropa\Multimedia Keyboard\TrayMon.exe
C:\Programmi\Netropa\Onscreen Display\OSD.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Messenger\msmsgs.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Fabio\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.libero.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Programmi\DAP\DAPIEBar.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmi\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar2.dll
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Programmi\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [WheelMouse] C:\Programmi\Trust\Ami Mouse 300 Optical Dual Scroll\Amoumain.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.ballroomdancingworld.com
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/229e3446b7d3484b2b06/netzip/RdxIE601_it.cab
O16 - DPF: {E61135DF-716D-49A7-B29B-8287A1CD072C} (WidelookX Control) - http://welcome2.immanens.com/it/widelook/widelookX.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0C3DE83F-CB7F-476E-BD6A-C3B6E006D589}: NameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{0C3DE83F-CB7F-476E-BD6A-C3B6E006D589}: NameServer = 192.168.1.1
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Programmi\Netropa\Multimedia Keyboard\nhksrv.exe


E il log di Avenger:

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\tbgtcgee

*******************

Script file located at: ysqjwxhu

Could not open script file! Error

Could not open script file! Status: 0xc000003b Abort!

[bdoriano]

Il log di hijackthis sembra ok.

Una curiosità, conosci questo comando o sito:

[ppino]

Avevi ragione... c'è qualcosa che non va... ho scaricato il programma lo apro ma ecco un messaggio

"Warning you don't have the SeDebug privilege, wich is required for system scan to work.SeDebug privilege will restored to Administators Group. a REBOOT is required for changes to take effect. Please save all unsaved data and press OK or reboot your sy stem now or cancel to reboot later."

Se chiudo questa finestra mi si chiude automaticamente anche systemscan!

P.S. Il pc si è anche "falsamente" (ha solo simulato di chiudersi e riaprirsi) riavviato.

Attendo istruzioni, grazie per la pazienza...

[bdoriano]

Sembrerebbe un rimasuglio di gromozon o un suo derivato...

XP Home o XP Professional?

Scarica ed esegui questo programmino, poi ritenta la scansione con SystemScan e facci sapere.

[ppino]

Eccomi!! Ho eseguito alla lettera e systemscan è partito (sei un grande! ).
Questo il link:
http://www.freefilehosting.net/download/MTI5MzU=

e queste le info che mi hai chiesto:
-ho wndows xp home
-non conosco il file
O16 - DPF: {E61135DF-716D-49A7-B29B-8287A1CD072C} (WidelookX Control) - http://welcome2.immanens.com/it/widelook/widelookX.cab
e aggiungo che il pannello di controllo è ancora in vacanza...

[bdoriano]

Dunque, c'è qualche rimasuglio di Gromozon (che devi avere precedentemente eliminato).

pre-fase)
Disabilita il ripristino di sistema

1a fase)
eliminiamo l'utente creato dal virus. Procedi così:
Clicca Start
Clicca Esegui...
Digita:

[ppino]

Allora iniziamo bene...vado a disabilitare il ripristino di sistema, vado a click con destro su proprietà e mi dice:


"Operazione annullata.Sul computer sono attivate delle restrizioni. Contattare l'amministratore del sistema".