Olimpo Informatico

[frax_bigos]

Non ci posso credere! Il mio PC si e' beccato di nuovo lo stesso trojan!
Vi prego di aiutarmi a capire perche'! (ho cercato di fare qualcosa con sante e tecnico ma alla fine ho formattato)
Come protezione ho sempre usato Zone alarm e da allora il pc non si era piu' infettato, ma ora sembra che non funzioni piu'.
Sara' colpa di eMule?

Il virus colpisce fondamentalmente internet explorer. Il segnale di riconoscimento e' che quando apro un link in una nuova finestra si apre puntualmente una finestra che porta ad un sito "search daily" o qualcosa del genere!
Inoltre explorer crasha spesso e quando eseguo le procedure di eliminazione delle infezioni da voi indicate il desktop rimane incantato senza icone e menu' di avvio.


Grazie per l'attenzione

[Orange]

questa sì che è sfortuna...

puoi postare i logs di Gmer?

[frax_bigos]

Il sito a cui inviare i log di gmer non funziona!
Posto qui i log?

[bdoriano]

No, se non funziona FreefileHosting caricali su SendMeFiles

Grazie per la collaborazione.

[frax_bigos]

Dunque...

Ho seguito le procedure indicate su questo forum da Orange istallando i vari AdAware, SpyBot ecc ecc.

In modalita' provvisoria ho scansionato con Ad Aware che mi ha trovato questo:

20070923 19-07-23 : Successfully Quarantined File: C:\Documents and Settings\Trussiana\Local Settings\Temp\0x57s.exe belonging to Win32.TrojanDownloader.Murlo

20070923 19-07-23 : Successfully Quarantined File: C:\Documents and Settings\Trussiana\Local Settings\Temp\0x57u.exe belonging to Win32.TrojanDownloader.Murlo

20070923 19-07-23 : Successfully Quarantined File: C:\WINDOWS\system32\basesrvw.dll belonging to Win32.TrojanDownloader.Murlo

20070923 19-07-23 : Successfully Quarantined File: C:\WINDOWS\system32\cmutilqe.dll belonging to Win32.TrojanDownloader.Murlo

20070923 19-07-23 : Successfully Quarantined File: C:\WINDOWS\system32\dspropw.dll belonging to Win32.TrojanDownloader.Murlo

BitDefender non mi parte in modalita' provvisoria.

Ogni volta che accedo a C:\ o a D:\ (due hard disc) si carica il processo temp2.exe che crasha e nei processi mi appare un altro file temp1.exe
Inoltre c'e' un altro processo sospetto 9uhdv.exe.
Nel momento in cui vengono caricati il PC cerca di accedere in continuazione al floppy drive.

Ah... ho dovuto fare il ripristino di windows perche' all'avvio mi si incantava il desktop (niente icone e barra di avvio) e se caricavo explorer.exe non riuscivo comunque a connettermi ad internet (uso l'adsl alice bussines).

Ho fatto le scansioni con gmer, ecco i link:

gmerlog1.txt

gmerlog21.txt

Ho fatto la scansione con CWshredder e mi ha trovato questa variante:

CWS.Aboutblank

L'ultima cosa: quando parte windows mi da un messaggio di file mancante relativo a svchost.exe

Posto qui il log di Hjt:

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 11.40.19, on 24/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE
C:\WINDOWS\system32\9uhdv.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\sistray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\temp1.exe
C:\Program Files\Gmer\gmer.exe
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
c:\program files\softwin\bitdefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\Program Files\HiJackThis\HiJackThis_v2.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.it/0SEITIT/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.it/0SEITIT/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.it/0SEITIT/SAOS01?FORM=TOOLBR
F3 - REG:win.ini: load=C:\WINDOWS\svchost.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0D55D1E1-CE10-4D88-AE62-6592A74A34F8} - C:\WINDOWS\system32\clbcatqo.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {973FE99A-3173-4E82-85C9-60534FE3CA2C} - c:\windows\system32\qqfwxpon.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {DA428B16-10C0-4667-A190-727ED9858762} - c:\windows\system32\cmutilq.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [EPSON Stylus D68 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /O6 "USB001" /M "Stylus D68"
O4 - HKLM\..\Run: [9uhdv] C:\WINDOWS\system32\9uhdv.exe
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [9uhdv] C:\WINDOWS\system32\9uhdv.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: dvueuzof - C:\WINDOWS\SYSTEM32\cmutilq.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

--
End of file - 6451 bytes

Credo che il PC sia rimasto infettato anche dopo la formattazione perche' mi sa che c'e' qualche virus anche sul secondo hard disc (D:\)

Spero che mi possiate aiutare.
Resto in ascolto.

[Orange]

Scarica VundoFix sul desktop, avvialo, seleziona Scan for Vundo
e poi premi Remove Vundo

scarica anche questo tool e fai lo scan


scarica Avenger e scompattalo sul desktop
avvialo, seleziona Input script manually
clicca sulla lente d'ingrandimento
nella finestra che si apre View/Edit scrit copia/incolla queste righe:

[frax_bigos]

Allora: ho un problema che si verifica regolarmente quando uso Avenger.
Al riavvio del pc non parte piu' explorer.exe e mi rimante il desktop incantato. Seguo il vostro consiglio e lo lancio come new task. Si carica, ma non riesco piu' ad accedere ad internet (anche se alice bussines e' connessa) e quindi non posso piu' postare su questo forum.
Devo quindi fare il ripristino di windows per potere usufruire di internet!!!
Ogni volta che cancello qualche file con avenger!!!

Quale puo' essere la causa? e quale il rimedio?

Ma veniamo all'eliminazione di questo maledetto virus (o qualunque cosa sia)

Ho fatto la scansione con i due tools e non mi ha trovato niente.
Poi ho lanciato lo script di avenger e al riavvio mi e' ricapitato il problema sopra citato, quindi non ho il log. Pero' sembra aver funzionato (almeno in parte).

Ho fatto la scansione con suspectfile ed ecco il link:

report47.txt

Ho avviato e fixato in mod provvisoria ed ecco il risultato di hjt, alcune voci sono scomparse altre no:

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 14.46.29, on 25/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\sistray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\HiJackThis\HiJackThis_v2.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.it/0SEITIT/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.it/0SEITIT/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.it/0SEITIT/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0D55D1E1-CE10-4D88-AE62-6592A74A34F8} - C:\WINDOWS\system32\clbcatqo.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {973FE99A-3173-4E82-85C9-60534FE3CA2C} - c:\windows\system32\qqfwxpon.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {DA428B16-10C0-4667-A190-727ED9858762} - c:\windows\system32\cmutilq.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [EPSON Stylus D68 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /O6 "USB001" /M "Stylus D68"
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: dvueuzof - C:\WINDOWS\SYSTEM32\cmutilq.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

--
End of file - 6256 bytes


ho letto che per far si che questa voce venga fixata:
O20 - Winlogon Notify: dvueuzof - C:\WINDOWS\SYSTEM32\cmutilq.dll
bisogna eliminare il file ad essa associato ma windows mi impedisce persino di modificarlo.

Comunque aspetto altre indicazioni... con la speranza di non dover reistallare di nuovo windows!!!
Grazie

[frax_bigos]

AGGIORNAMENTO
Il problema del desktop me lo fa anche quando SpyBot o altri programmi mi rimuovono i virus!
Per favore qualcuno mi aiuti
Ho dovuto reinstallare ancora una volta windows!!!

[bdoriano]

Proviamo

Apri il notepad, e copia/incolla il codice seguente:

[frax_bigos]

Fatto.
Al riavvio del PC mi e' apparsa dinuovo la finestra vuota del desktop, pero' ho avuto pazienza, ho aspettato e wuindows si e' riavviato da solo. Al ricaricamento del desktop e' andato tutto bene (sospiro di sollievo)
il file fix.reg non me lo ha trovato anche se era in c:\ come mi hai detto tu
ecco il log:

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\gbu^umai

*******************

Script file located at: \??\C:\Documents and Settings\quplcbfn.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



Could not open registry key \Registry\Machine\System\CurrentControlSet\Services\xsquyvne for deletion
Unload of driver xsquyvne failed!

Could not process line:
xsquyvne
Status: 0xc0000022



File C:\WINDOWS\svchost.exe not found!
Deletion of file C:\WINDOWS\svchost.exe failed!

Could not process line:
C:\WINDOWS\svchost.exe
Status: 0xc0000034



File C:\WINDOWS\system32\9uhdv.exe not found!
Deletion of file C:\WINDOWS\system32\9uhdv.exe failed!

Could not process line:
C:\WINDOWS\system32\9uhdv.exe
Status: 0xc0000034



Could not open file C:\WINDOWS\system32\clbcatqo.dll for deletion
Deletion of file C:\WINDOWS\system32\clbcatqo.dll failed!

Could not process line:
C:\WINDOWS\system32\clbcatqo.dll
Status: 0xc0000022

File c:\windows\system32\qqfwxpon.dll deleted successfully.


Could not open file c:\windows\system32\cmutilq.dll for deletion
Deletion of file c:\windows\system32\cmutilq.dll failed!

Could not process line:
c:\windows\system32\cmutilq.dll
Status: 0xc0000022



File C:\WINDOWS\system32\temp1.exe not found!
Deletion of file C:\WINDOWS\system32\temp1.exe failed!

Could not process line:
C:\WINDOWS\system32\temp1.exe
Status: 0xc0000034

File C:\WINDOWS\system32\sxwhgjzo.dll.bak deleted successfully.
File C:\WINDOWS\system32\kbusehzv.dll deleted successfully.
File C:\WINDOWS\system32\zipxzwjn.dll deleted successfully.
File C:\WINDOWS\system32\bgwmncdj.dll deleted successfully.
File C:\WINDOWS\system32\tmmuavsz.dll.bak deleted successfully.


Could not open file C:\WINDOWS\system32\cmutilq.dll.bak for deletion
Deletion of file C:\WINDOWS\system32\cmutilq.dll.bak failed!

Could not process line:
C:\WINDOWS\system32\cmutilq.dll.bak
Status: 0xc0000022

File C:\WINDOWS\system32\tmmuavsz.dll deleted successfully.
File C:\WINDOWS\system32\sxwhgjzo.dll deleted successfully.


Could not open file C:\WINDOWS\system32\drivers\vdgllehx.sys for deletion
Deletion of file C:\WINDOWS\system32\drivers\vdgllehx.sys failed!

Could not process line:
C:\WINDOWS\system32\drivers\vdgllehx.sys
Status: 0xc0000022

File C:\WINDOWS\system32\drivers\yhqlqefi.sys deleted successfully.
File C:\WINDOWS\autorun.inf deleted successfully.


Could not delete registry value HKLM\Software\Microsoft\Windows\CurrentVersion\Run|9uhdv
Deletion of registry value HKLM\Software\Microsoft\Windows\CurrentVersion\Run|9uhdv failed!
Status: 0xc0000034



Could not open registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dvueuzof for deletion
Deletion of registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dvueuzof failed!
Status: 0xc0000022



Could not open registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0D55D1E1-CE10-4D88-AE62-6592A74A34F8} for deletion
Deletion of registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0D55D1E1-CE10-4D88-AE62-6592A74A34F8} failed!
Status: 0xc0000022

Registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{973FE99A-3173-4E82-85C9-60534FE3CA2C} deleted successfully.


Could not open registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DA428B16-10C0-4667-A190-727ED9858762} for deletion
Deletion of registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DA428B16-10C0-4667-A190-727ED9858762} failed!
Status: 0xc0000022

Program c:\fix.reg successfully set up to run once on reboot.

Completed script processing.

*******************

Finished! Terminate.

Alcuni file non sono stati cancellati e' sono ancora in windows\system32\
Ecco il log di hjt:

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 10.52.48, on 26/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\sistray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\HiJackThis\HiJackThis_v2.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.it/0SEITIT/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.it/0SEITIT/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.it/0SEITIT/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0D55D1E1-CE10-4D88-AE62-6592A74A34F8} - C:\WINDOWS\system32\clbcatqo.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {973FE99A-3173-4E82-85C9-60534FE3CA2C} - c:\windows\system32\qqfwxpon.dll (file missing)
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {DA428B16-10C0-4667-A190-727ED9858762} - c:\windows\system32\cmutilq.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [EPSON Stylus D68 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /O6 "USB001" /M "Stylus D68"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: dvueuzof - C:\WINDOWS\SYSTEM32\cmutilq.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 5369 bytes

[Orange]

prova con questo.
scarica il file e salvalo sul desktop
avvia in modalità provvisoria e fai girare il tool, seguendo le indicazioni a video.

alla fine riavvia e posta il log generato

[frax_bigos]

Fatto,
naturalmente al riavvio ho dovuto reistallare windows per il solito problema del desktop bloccato.
Non riesco a capire perche' avvenga sempre questo (tra l'altro per istallare windows ci vogliono 30 minuti... )
Comunque ecco il log:

[09/26/2007, 11:57:29] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Administrator\Desktop\VirtumundoBeGone.exe" )
[09/26/2007, 11:57:35] - Detected System Information:
[09/26/2007, 11:57:35] - Windows Version: 5.1.2600, Service Pack 2
[09/26/2007, 11:57:35] - Current Username: Administrator (Admin)
[09/26/2007, 11:57:35] - Windows is in SAFE mode with Networking.
[09/26/2007, 11:57:35] - Searching for Browser Helper Objects:
[09/26/2007, 11:57:35] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[09/26/2007, 11:57:35] - BHO 2: {0D55D1E1-CE10-4D88-AE62-6592A74A34F8} ()
[09/26/2007, 11:57:35] - WARNING: BHO has no default name. Checking for Winlogon reference.
[09/26/2007, 11:57:35] - Checking for HKLM\...\Winlogon\Notify\clbcatqo
[09/26/2007, 11:57:35] - Key not found: HKLM\...\Winlogon\Notify\clbcatqo, continuing.
[09/26/2007, 11:57:35] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[09/26/2007, 11:57:35] - BHO 4: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[09/26/2007, 11:57:35] - BHO 5: {973FE99A-3173-4E82-85C9-60534FE3CA2C} ()
[09/26/2007, 11:57:35] - WARNING: BHO has no default name. Checking for Winlogon reference.
[09/26/2007, 11:57:35] - Checking for HKLM\...\Winlogon\Notify\qqfwxpon
[09/26/2007, 11:57:35] - Key not found: HKLM\...\Winlogon\Notify\qqfwxpon, continuing.
[09/26/2007, 11:57:35] - BHO 6: {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} (Windows Live Toolbar Helper)
[09/26/2007, 11:57:35] - BHO 7: {DA428B16-10C0-4667-A190-727ED9858762} ()
[09/26/2007, 11:57:35] - WARNING: BHO has no default name. Checking for Winlogon reference.
[09/26/2007, 11:57:35] - Checking for HKLM\...\Winlogon\Notify\cmutilq
[09/26/2007, 11:57:35] - Key not found: HKLM\...\Winlogon\Notify\cmutilq, continuing.
[09/26/2007, 11:57:35] - Finished Searching Browser Helper Objects
[09/26/2007, 11:57:35] - Finishing up...
[09/26/2007, 11:57:35] - Nothing found! Exiting...

All'avvio dopol'istallazione SpyBot mi ha trovato questo:
26/09/2007 12.35.16 Negato (based on user decision) value "Local Page" (new data: "%SystemRoot%\system32\blank.htm") aggiunto in Browser page!

Quando clicco su inva in questo forum SpyBot mi rileva questo:
http://ad.it.doubleclick.net/adi/N1120.zeus/DoubleClick

e quando sono su google e clicco su un link mi porta qui:
http://201.218.196.152/click.php?c=27d61687072a07b2c66f4002&r=1

Vorrei, se possibile, non reistallare piu' windows...

[Orange]

non ha risolto nulla il tool...
io no sò piu dove sbattere la testa, onestamente...
ma invece di perdere ogni giorno 30 minuti per ripristinare Windows, perche non formatti HD e basta? almeno così sei sicuro di trovarti con il PC pulito come il giorno in cui l'hai comprato.

naturalmente è solo una mia opinione... aspetta bdoriano, vediamo se gli viene qualche idea migliore

[frax_bigos]

Infatti e' quello che ho appena finito di fare
Vi ringrazio comunque per il tentativo di aiutarmi! Siete davvero molto disponibili e gentili.
Comunque mi resta il dubbio se sul mio secondo HD sia nascosto qualcosa... magari faccio una bella scansione totale con i vari tools...
Comunque ho istallato Zone Alarm, SpyBot e Bit defender e li ho aggiornati, credo che così dovrei essere abbastanza protetto.
Credo comunque che la causa di tutto erano quei malefici .dll che non si potevano cancellare nemmeno in modalita' provvisoria. In qualche modo mi corrompevano il sistema (forse proprio explorer.exe o addirittura il registro di sistema) e mi rendevano impossibile usare Avenger ecc.

Se magari avete qualche consiglio da darmi per rendere il PC una fortezza inespugnabile fate pure, perche' sti malware mi stanno facendo girare i XXXXXX!!!!

Ciao e grazie ancora!!!!


PS
Come mai SpyBot mi segnala ancora un messaggio URL: "http://ad.it.doubleclick.net/adi/N1120.ZEUS Riguardante Doubleclick ????????
succede quando navigo su questo forum!!!

[Orange]

una volta ogni tanto un sano formattone non fà male, anzi

[bdoriano]

Solo una curiosità: BitDefender è la versione free o a pagamento?
Perché, se è free, non dispone della scansione in tempo reale.

[frax_bigos]

[bdoriano]

Qui trovi un elenco di prodotti free.
Ti consiglio di scegliere tra i primi 3 (Antivir, AVG, Avast).

Tieni comunque BitDefender per le scansioni "su richiesta".

[frax_bigos]

Grazie!
Usero' AVG, mi ci sono trovato bene in passato 8)