Olimpo Informatico

[rusuf]

cerco aiuto.
purtroppo ho contratto un trojan bastardello poco riconosciuto dalle case antivirus.
il file infetto si chiama acctres32.dll, si trova nella cartella WINDOWS\System32 e sono sicuro che sia il file infetto in quanto ho controllato con diversi antivirus online (sotto trovate il report di virus total).
il file a differenza di acctres.dll, che è veramente un file di sistema, in realtà non esiste e credo sia stato creato ad hoc dal trojan.
ho cercato indicazioni su come rimuovere questa seccatura, ma non ho trovato nessun aiuto.
sfogliando il registro ho scoperto che sotto \HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify esiste una cartella dedicata a acctres32.
credo quindi che tale libreria sia legata all'eseguibile winlogon.
non è il primo virus che mi prendo, tuttavia è la prima volta che mi ritrovo con questo problema e non sono molto pratico. non so come cancellare la dll infetta dalla cartella di sistema e non so se e come modificare il registro.
ho scaricato per l'occasione hijackthis. sotto riporto il log effettuato.
credo che la riga o20 sia sospetta, ma non so come muovermi. non ho ancora capito esattamente come usare questo software.
qualcuno è in grado di spiegare in maniera chiara ed esaustiva i passaggi che devo fare per liberarmi da questa rogna?
a cosa serve hijackthis oltre a fare questo log? per rimuovere una libreria da una cartella di sistema devo entrare in modalità provvisoria? ...?
eternamente grato ai salvatori.
rusuf

report di virustotal sul file acctres32.dll

Antivirus Version Last Update Result
AhnLab-V3 2008.1.24.10 2008.01.23 -
AntiVir 7.6.0.48 2008.01.23 TR/Hijacker.Gen
Authentium 4.93.8 2008.01.22 -
Avast 4.7.1098.0 2008.01.23 -
AVG 7.5.0.516 2008.01.23 Downloader.Small.60.AO
BitDefender 7.2 2008.01.23 -
CAT-QuickHeal 9.00 2008.01.23 -
ClamAV 0.91.2 2008.01.23 -
DrWeb 4.44.0.09170 2008.01.23 -
eSafe 7.0.15.0 2008.01.16 -
eTrust-Vet 31.3.5481 2008.01.23 -
Ewido 4.0 2008.01.23 -
FileAdvisor 1 2008.01.23 -
Fortinet 3.14.0.0 2008.01.23 -
F-Prot 4.4.2.54 2008.01.23 -
F-Secure 6.70.13260.0 2008.01.23 Trojan.Win32.Agent.dwg
Ikarus T3.1.1.20 2008.01.23 Virus.Trojan.Win32.Agent.dwg
Kaspersky 7.0.0.125 2008.01.23 Trojan.Win32.Agent.dwg
McAfee 5214 2008.01.23 -
Microsoft 1.3109 2008.01.23 VirTool:Win32/Obfuscator!Mal
NOD32v2 2818 2008.01.23 -
Norman 5.80.02 2008.01.23 -
Panda 9.0.0.4 2008.01.23 -
Prevx1 V2 2008.01.23 -
Rising 20.28.22.00 2008.01.23 -
Sophos 4.24.0 2008.01.23 Sus/Behav-1021
Sunbelt 2.2.907.0 2008.01.23 -
Symantec 10 2008.01.23 -
TheHacker 6.2.9.196 2008.01.23 -
VBA32 3.12.2.5 2008.01.21 -
VirusBuster 4.3.26:9 2008.01.23 -
Webwasher-Gateway 6.6.2 2008.01.23 Trojan.Hijacker.Gen



Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 1.27.13, on 24/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\programmi\file comuni\logitech\lvmvfm\LVPrcSrv.exe
C:\Acer\Empowering Technology\admServ.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\LAUNCH~1\LManager.exe
C:\Acer\Empowering Technology\admtray.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Programmi\Acer\OrbiCam\CameraAssistant.exe
C:\WINDOWS\system32\ElkCtrl.exe
C:\Programmi\Java\jre1.6.0_01\bin\jusched.exe
C:\DOCUME~1\rusuf\IMPOST~1\Temp\RtkBtMnt.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\eMule\emule.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\Programmi\Agnitum\Outpost Firewall\outpost.exe
C:\Programmi\hijackthis\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Programmi\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [ADMTray.exe] "C:\Acer\Empowering Technology\admtray.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Programmi\Acer\OrbiCam\CameraAssistant.exe
O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Programmi\Acer\OrbiCam\InstallHelper.exe /inspect
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Outpost Firewall] "C:\Programmi\Agnitum\Outpost Firewall\outpost.exe" /waitservice
O4 - HKLM\..\Run: [OutpostFeedBack] C:\Programmi\Agnitum\Outpost Firewall\feedback.exe /dump:os_startup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O20 - Winlogon Notify: acctres32 - C:\WINDOWS\SYSTEM32\acctres32.dll
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
O23 - Service: Servizio iPod (iPod Service) - Unknown owner - C:\Programmi\iPod\bin\iPodService.exe (file missing)
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:\programmi\file comuni\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\Programmi\Agnitum\Outpost Firewall\outpost.exe

--
End of file - 6874 bytes

[bdoriano]

Ciao rusuf,

fai questa scansione con FindAWF

PS: se vuoi, puoi presentarti qui

[rusuf]

grazie per l'immediato interessamento al mio caso.
scaricato ed eseguito.
sotto trovi il report di findawf.
mi sembra di capire che non c'è niente!
oggi ho letto la guida di hijackthis che ho trovato sul sito e ed è stata abbastanza istruttiva. che faccio, provo a seguirla fedelemente e vedo cosa succede?
se puoi darmi qualche indicazione specifica al mio caso te ne sarei grato.
attendo ulteriori istruzioni, sono nelle tue mani.
ciao rusuf


Find AWF report by noahdfear ©2006
Version 1.40



bak folders found
~~~~~~~~~~~



Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~



end of report

[bdoriano]

Segui le istruzioni di questo topic per postare il log di combofix.

[rusuf]

ecco il log di combofix.
che cosa ne deduci?
ciao rusuf

ComboFix 08-01-29.3 - rusuf 2008-01-29 17:49:58.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1040.18.1366 [GMT 1:00]
Eseguito da: C:\Documents and Settings\rusuf\Desktop\novità\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\rusuf\Dati applicazioni\inst.exe

.
((((((((((((((((((((((((( Files Creati Da 2007-12-28 al 2008-01-29 )))))))))))))))))))))))))))))))))))
.

2008-01-23 17:51 . 2008-01-23 17:51 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-01-23 17:51 . 2008-01-23 17:51 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Kaspersky Lab
2008-01-23 13:24 . 2008-01-23 13:24 135 --a------ C:\WINDOWS\asquared.ini
2008-01-07 14:18 . 2008-01-07 14:18 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-07 14:18 . 2008-01-07 14:18 1,409 --a------ C:\WINDOWS\QTFont.for

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-29 08:52 --------- d-----w C:\Programmi\eMule
2008-01-24 17:50 --------- d-----w C:\Documents and Settings\rusuf\Dati applicazioni\dvdcss
2008-01-01 21:06 --------- d-----w C:\Programmi\Azureus
2008-01-01 21:06 --------- d-----w C:\Documents and Settings\rusuf\Dati applicazioni\Azureus
2007-12-22 18:17 --------- d-----w C:\Programmi\Alwil Software
2007-12-19 16:47 --------- d-----w C:\Programmi\File comuni\Agnitum Shared
2007-12-19 16:47 --------- d-----w C:\Programmi\Agnitum
2007-12-18 00:45 --------- d--h--w C:\Programmi\InstallShield Installation Information
2007-12-08 11:03 --------- d-----w C:\Documents and Settings\rusuf\Dati applicazioni\ACD Systems
2007-12-08 10:35 --------- d-----w C:\Programmi\File comuni\ACD Systems
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2007-12-03 23:02 --------- d-----w C:\Programmi\File comuni\Magix Shared
2007-12-03 18:52 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\MAGIX
2007-12-01 17:59 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\Azureus
2007-12-01 16:17 --------- d---a-w C:\Documents and Settings\All Users\Dati applicazioni\TEMP
2007-11-29 11:21 --------- d-----w C:\Programmi\MAGIX
2007-11-28 12:35 --------- d-----w C:\Documents and Settings\rusuf\Dati applicazioni\Vso
2007-06-12 08:10 47,360 ----a-w C:\Documents and Settings\rusuf\Dati applicazioni\pcouffin.sys
2006-08-16 08:42 488,448 ----a-w C:\Programmi\OEView.exe
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* i valori vuoti & legittimi/default non sono visualizzati.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 14:39 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-07-20 20:58 7581696]
"nwiz"="nwiz.exe" [2006-07-20 20:58 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-07-20 20:58 86016]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-28 13:54 16248320 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 17:04 2879488 C:\WINDOWS\SkyTel.exe]
"AzMixerSel"="C:\Programmi\Realtek\InstallShield\AzMixerSel.exe" [2005-12-21 14:02 53248]
"SynTPEnh"="C:\Programmi\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 13:07 761946]
"LManager"="C:\PROGRA~1\LAUNCH~1\LManager.exe" [2006-07-20 22:15 593920]
"ADMTray.exe"="C:\Acer\Empowering Technology\admtray.exe" [2005-10-24 15:45 2462208]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2006-06-23 09:39 225280]
"LogitechCameraAssistant"="C:\Programmi\Acer\OrbiCam\CameraAssistant.exe" [2006-06-26 14:47 331776]
"LogitechVideo[inspector]"="C:\Programmi\Acer\OrbiCam\InstallHelper.exe" [2006-06-26 14:55 73728]
"LogitechCameraService(E)"="C:\WINDOWS\system32\ElkCtrl.exe" [2004-11-01 17:22 262144]
"NWEReboot"="" []
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"QuickTime Task"="C:\Programmi\QuickTime\qttask.exe" [2007-04-27 08:41 282624]
"SunJavaUpdateSched"="C:\Programmi\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 02:43 83608]
"Adobe Reader Speed Launcher"="C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"Outpost Firewall"="C:\Programmi\Agnitum\Outpost Firewall\outpost.exe" [2007-03-15 12:59 94720]
"OutpostFeedBack"="C:\Programmi\Agnitum\Outpost Firewall\feedback.exe" [2007-03-16 17:08 335872]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 14:39 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\acctres32]
acctres32.dll 2004-04-12 11:18 8704 C:\WINDOWS\system32\acctres32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wscsvc"=2 (0x2)

R1 OsaFsLoc;OsaFsLoc;C:\WINDOWS\system32\drivers\OsaFsLoc.sys [2005-10-15 17:20]
R1 SandBox;Outpost Firewall Sandbox Driver;C:\Programmi\Agnitum\Outpost Firewall\kernel\Sandbox.SYS [2007-03-09 19:08]
R1 VFILT;Outpost Firewall Kernel Driver;C:\Programmi\Agnitum\Outpost Firewall\kernel\FILTNT.SYS [2007-03-15 12:59]
R2 osaio;osaio;C:\WINDOWS\system32\drivers\osaio.sys [2005-06-30 15:58]
R2 osanbm;osanbm;C:\WINDOWS\system32\drivers\osanbm.sys [2005-01-14 14:57]
R3 lv321av;Logitech USB PC Camera (VC0321);C:\WINDOWS\system32\DRIVERS\lv321av.sys [2006-06-19 11:20]
R3 LVPrcMon;Logitech LVPrcMon Driver;C:\WINDOWS\system32\drivers\LVPrcMon.sys [2006-06-23 09:40]
R3 NdisFilt;OSA NdisFilter Protocol;C:\WINDOWS\system32\Drivers\NdisFilt.sys [2005-09-13 14:34]
S3 Linux.DLL;Outpost Firewall PlugIn (Linux.DLL);C:\Programmi\Agnitum\Outpost Firewall\kernel\Linux.DLL [2007-03-15 13:00]
S3 ARP.DLL;Outpost Firewall PlugIn (ARP.DLL);C:\Programmi\Agnitum\Outpost Firewall\kernel\ARP.DLL [2007-03-15 13:00]
S3 CONTENT.DLL;Outpost Firewall PlugIn (CONTENT.DLL);C:\Programmi\Agnitum\Outpost Firewall\kernel\CONTENT.DLL [2007-03-15 13:00]
S3 DNSCACHE.DLL;Outpost Firewall PlugIn (DNSCACHE.DLL);C:\Programmi\Agnitum\Outpost Firewall\kernel\DNSCACHE.DLL [2007-03-15 13:00]
S3 FTPFILT.DLL;Outpost Firewall PlugIn (FTPFILT.DLL);C:\Programmi\Agnitum\Outpost Firewall\kernel\FTPFILT.DLL [2007-03-15 13:00]
S3 HTMLFILT.DLL;Outpost Firewall PlugIn (HTMLFILT.DLL);C:\Programmi\Agnitum\Outpost Firewall\kernel\HTMLFILT.DLL [2007-03-15 13:00]
S3 HTTPFILT.DLL;Outpost Firewall PlugIn (HTTPFILT.DLL);C:\Programmi\Agnitum\Outpost Firewall\kernel\HTTPFILT.DLL [2007-03-15 13:00]
S3 IMAPFILT.DLL;Outpost Firewall PlugIn (IMAPFILT.DLL);C:\Programmi\Agnitum\Outpost Firewall\kernel\IMAPFILT.DLL [2007-03-15 13:00]
S3 MAILFILT.DLL;Outpost Firewall PlugIn (MAILFILT.DLL);C:\Programmi\Agnitum\Outpost Firewall\kernel\MAILFILT.DLL [2007-03-15 13:00]
S3 NNTPFILT.DLL;Outpost Firewall PlugIn (NNTPFILT.DLL);C:\Programmi\Agnitum\Outpost Firewall\kernel\NNTPFILT.DLL [2007-03-15 13:00]
S3 POP3FILT.DLL;Outpost Firewall PlugIn (POP3FILT.DLL);C:\Programmi\Agnitum\Outpost Firewall\kernel\POP3FILT.DLL [2007-03-15 13:00]
S3 PROTECT.DLL;Outpost Firewall PlugIn (PROTECT.DLL);C:\Programmi\Agnitum\Outpost Firewall\kernel\PROTECT.DLL [2007-03-15 13:00]
S3 SECRET.DLL;Outpost Firewall PlugIn (SECRET.DLL);C:\Programmi\Agnitum\Outpost Firewall\kernel\SECRET.DLL [2007-03-15 13:00]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c4b5798c-8145-11dc-b92b-0018de48927c}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
\Shell\Open(&0)\command - Recycled\ctfmon.exe

*Newly Created Service* - PROCEXP90
.
Contenuto della cartella 'Scheduled Tasks'
"2008-01-27 16:50:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Programmi\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-29 17:51:10
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
Ora fine scansione: 2008-01-29 17:51:30
ComboFix-quarantined-files.txt 2008-01-29 16:51:28

[bdoriano]

Combofix ha eliminato una voce pericolosa.
Vediamo se ce ne sono altre:
Collegati a Kaspersky on-line scanner e fai la scansione estesa, come indicato qui.
Salva il risultato della scansione in un file (in formato HTML), carica il file su Freefilehosting e posta qui il link che ti viene assegnato.