Olimpo Informatico

[FaFa86]

ECCO COMBOFIX:



ComboFix 08-04-27.2 - Mazzella 2008-04-28 14.17.10.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1040.18.210 [GMT 2:00]
Eseguito da: C:\Documents and Settings\Mazzella\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
ADS - svchost.exe: deleted 68 bytes in 1 streams.
ADS - ntoskrnl.exe: deleted 36 bytes in 1 streams.
ADS - explorer.exe: deleted 100 bytes in 1 streams.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\Downloaded Program Files\lfgjvq2
C:\WINDOWS\system32\alog.txt
C:\WINDOWS\system32\appcert
C:\WINDOWS\system32\install.exe
C:\WINDOWS\system32\ps1.dat
C:\WINDOWS\system32\rc.dat
C:\WINDOWS\system32\ddrawf.dll . . . . Eliminazione Fallita

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_tzrvhowt
-------\Service_tzrvhowt


((((((((((((((((((((((((( Files Creati Da 2008-03-28 al 2008-04-28 )))))))))))))))))))))))))))))))))))
.

2008-04-16 13:20 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-04-16 13:18 . 2008-04-16 13:20 <DIR> d-------- C:\Programmi\Java
2008-04-16 13:17 . 2008-04-16 13:17 <DIR> d-------- C:\Programmi\File comuni\Java
2008-04-12 12:30 . 2008-04-12 12:31 <DIR> d-------- C:\Programmi\File comuni\Mozilla Shared
2008-04-12 12:30 . 2008-04-12 12:30 6,490,880 --a------ C:\WINDOWS\system32\ybkksdyh.dat
2008-04-12 12:30 . 2008-04-12 12:30 1,015,808 --a------ C:\WINDOWS\system32\libeay32.dll
2008-04-12 12:30 . 2008-04-13 13:27 638,208 --a------ C:\WINDOWS\system32\tkqwjoub.dat
2008-04-12 12:30 . 2008-04-12 12:30 196,608 --a------ C:\WINDOWS\system32\libssl32.dll
2008-04-12 12:30 . 2008-04-22 22:10 43,264 --a------ C:\WINDOWS\system32\bduspgus.dat
2008-04-12 12:30 . 2008-04-13 13:27 36,608 --a------ C:\WINDOWS\system32\qonxwegv.dat
2008-04-12 12:30 . 2008-04-13 13:27 35,584 --a------ C:\WINDOWS\system32\vskoawnx.dat
2008-04-12 12:30 . 20,608 C:\WINDOWS\system32\drivers\mvyyqsgx.dat
2008-04-12 12:21 . 2005-12-07 13:31 88,064 --a------ C:\WINDOWS\system32\CddbCddap.dll
2008-04-12 12:20 . 2008-04-22 22:10 83,456 --a------ C:\WINDOWS\system32\ddrawf.dll.bak

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-27 17:59 --------- d-----w C:\Programmi\eMule
2008-04-27 17:56 --------- d-----w C:\Programmi\MSN Messenger
2008-04-27 17:20 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\Downloaded Installations
2008-04-10 19:34 --------- d-----w C:\Programmi\Messenger Plus! Live
2008-03-27 23:08 --------- d-----w C:\Programmi\File comuni\Adobe
2008-03-15 16:16 --------- d-----w C:\Documents and Settings\Mazzella\Dati applicazioni\dvdcss
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* i valori vuoti & legittimi/default non sono visualizzati.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{11F61896-1AA7-49E2-9206-FC4756555230}]
2005-12-07 13:31 88064 --a------ C:\WINDOWS\system32\CddbCddap.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D2F3BDF6-A745-401F-9989-02CAA90D77B0}]
2001-08-31 22:00 82432 --a------ c:\windows\system32\ddrawf.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"SunJavaUpdateSched"="C:\Programmi\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]
"UnlockerAssistant"="C:\Programmi\Unlocker\UnlockerAssistant.exe" [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Antiwpa]
antiwpa.dll 2005-09-18 03:32 5376 C:\WINDOWS\system32\antiwpa.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vjigpuvy]
ddrawf.dll 2001-08-31 22:00 82432 C:\WINDOWS\system32\ddrawf.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^WinZip Quick Pick.lnk]
path=C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\WinZip Quick Pick.lnk
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Mazzella^Menu Avvio^Programmi^Esecuzione automatica^Adobe Gamma.lnk]
path=C:\Documents and Settings\Mazzella\Menu Avvio\Programmi\Esecuzione automatica\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
--a------ 2005-05-12 22:05 344064 C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2004-08-19 15:39 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a--c--- 2001-07-09 12:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Smapp]
--a------ 2003-07-30 10:08 143360 C:\Programmi\Analog Devices\SoundMAX\SMTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programmi\\Messenger\\msmsgs.exe"=
"C:\\Programmi\\Internet Explorer\\IEXPLORE.EXE"=
"C:\\Programmi\\eMule\\emule.exe"=
"C:\\Programmi\\NetMeeting\\conf.exe"=
"C:\\WINDOWS\\explorer.exe"=
"C:\\Programmi\\MSN Messenger\\msnmsgr.exe"=
"C:\\Programmi\\MSN Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26062:TCP"= 26062:TCP:*:Disabled:BitComet 26062 TCP
"26062:UDP"= 26062:UDP:*:Disabled:BitComet 26062 UDP
"31953:TCP"= 31953:TCP:@xpsp2res.dll,-22009
"80:TCP"= 80:TCP:@xpsp2res.dll,-22009
"3037:TCP"= 3037:TCP:@xpsp2res.dll,-22009
"63192:TCP"= 63192:TCP:@xpsp2res.dll,-22009
"18201:TCP"= 18201:TCP:@xpsp2res.dll,-22009
"19225:TCP"= 19225:TCP:@xpsp2res.dll,-22009
"28304:TCP"= 28304:TCP:@xpsp2res.dll,-22009
"26889:TCP"= 26889:TCP:@xpsp2res.dll,-22009
"59891:TCP"= 59891:TCP:@xpsp2res.dll,-22009
"47298:TCP"= 47298:TCP:@xpsp2res.dll,-22009
"39108:TCP"= 39108:TCP:@xpsp2res.dll,-22009
"7169:TCP"= 7169:TCP:@xpsp2res.dll,-22009
"16384:TCP"= 16384:TCP:@xpsp2res.dll,-22009
"56858:TCP"= 56858:TCP:@xpsp2res.dll,-22009
"51905:TCP"= 51905:TCP:@xpsp2res.dll,-22009
"14324:TCP"= 14324:TCP:@xpsp2res.dll,-22009
"34776:TCP"= 34776:TCP:@xpsp2res.dll,-22009
"30919:TCP"= 30919:TCP:@xpsp2res.dll,-22009
"32721:TCP"= 32721:TCP:@xpsp2res.dll,-22009
"1523:TCP"= 1523:TCP:@xpsp2res.dll,-22009
"43245:TCP"= 43245:TCP:@xpsp2res.dll,-22009
"29634:TCP"= 29634:TCP:@xpsp2res.dll,-22009
"8712:TCP"= 8712:TCP:@xpsp2res.dll,-22009
"29656:TCP"= 29656:TCP:@xpsp2res.dll,-22009
"21702:TCP"= 21702:TCP:@xpsp2res.dll,-22009
"62144:TCP"= 62144:TCP:@xpsp2res.dll,-22009
"19676:TCP"= 19676:TCP:@xpsp2res.dll,-22009
"32477:TCP"= 32477:TCP:@xpsp2res.dll,-22009
"39769:TCP"= 39769:TCP:@xpsp2res.dll,-22009
"32512:TCP"= 32512:TCP:@xpsp2res.dll,-22009
"45300:TCP"= 45300:TCP:@xpsp2res.dll,-22009
"47326:TCP"= 47326:TCP:@xpsp2res.dll,-22009
"45272:TCP"= 45272:TCP:@xpsp2res.dll,-22009

R0 afrodhzv;afrodhzv;C:\WINDOWS\system32\drivers\mvyyqsgx.dat []
R0 m5289;m5289;C:\WINDOWS\system32\DRIVERS\m5289.sys [2004-12-01 11:49]
R0 uliagpkx;ULi AGP Bus Filter Driver;C:\WINDOWS\system32\DRIVERS\agpkx.sys [2004-07-08 16:58]
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
R3 PAC207;Trust WB-1400T Webcam;C:\WINDOWS\system32\DRIVERS\pfc027.sys [2005-02-24 12:29]
R3 ULI5261;ULi Based Ethernet NT Driver;C:\WINDOWS\system32\DRIVERS\ULILAN.SYS [2004-12-31 16:24]
S2 apanr;Accesso pannello remoto;C:\WINDOWS\Downlo~1\lfgjvq2\b3w9gj.exe []

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
tzrvhowt

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{071ab282-4f27-11dc-b63c-0013d47a2e5f}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
\Shell\Open(&0)\command - Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bd3345a0-b875-11db-b4e8-0013d47a2e5f}]
\Shell\auto\command - Knight.exe open
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Knight.exe open
\Shell\explore\command - Knight.exe open
\Shell\find\command - Knight.exe open
\Shell\install\command - Knight.exe open
\Shell\open\command - Knight.exe open

.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-28 14:23:18
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 47

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\afrodhzv]
"ImagePath"="system32\drivers\mvyyqsgx.dat"
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
.
**************************************************************************
.
Ora fine scansione: 2008-04-28 14:27:32 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-28 12:27:21

10 Directory 35,880,337,408 byte disponibili
13 Directory 35,847,323,648 byte disponibili

182

[daysleeper]

uhm...scarica questo
http://downloads5.kaspersky-labs.com/devbuilds/AVPTool/
prendi quello piu recente,installalo,dovrebbe crearsi una cartella sul desktop,al suo interno clicca sulla k,seleziona il disco C,esegui la scan e al termine riporta il log che verrà rilasciato.
se nemmeno questo funziona ci vuole un giro con combo.

Cmq onde evitare fraintendimenti,vedi se prima i moderatori spostano la discussione nella loro area di competenza e se magari ti suggeriscono altre procedure rispetto alla mia(quindi aspetta un loro parere prima di eseguirla).
ciao

[FaFa86]

Ok aspetto qualcuno.....

Cmq io ho postato anche il log di combofix......
mi sembra d'aver capito che sto "coso" nemmeno sia stato eliminato vero?Ma che cosa è?
ne sono 2 : ddrawf e cdd..... una cosa del genere

[chemicalbit]

Sì, i moderatori dovranno spostarlo,
conviene procedere qui comunque, senza aspettare (il malware va tolto ...)

Piuttosto ci vorrebbe qualcuno in grado di leggere il log di combofix.

Mi "puzzano" quei
* " ADS - svchost.exe: deleted 68 bytes in 1 streams." e simili
* "C:\WINDOWS\system32\ddrawf.dll . . . . Eliminazione Fallita " perché non è riuscito ad eliminarli come gli altri?
* Files nascosti: 47
e mi "puzza" di rootkit.

Posta un nuovo log di HijackThis, vediamo se è cambiato qualcosa,
poi procedi con la scansione con AVPTool

Copio le istruzioni da un'altra discussione:

[bdoriano]

Sembrerebbero tracce di Virtumonde.

Fai il passaggio indicato da chemicalbit e daysleeper.

Dopo:

1. Scarica VundoFix e VirtumundoBegone e salvali sul desktop.
   
2. Avvia VundoFix
   Seleziona Scan for Vundo e a scansione terminata scegli Remove Vundo.
   Clicca Yes e alla richiesta di riavviare il Pc rispondi Ok.
   Al riavvio dovrebbe comparire il blocco-note con dentro il log, copia e posta sul forum il contenuto.
   
3. Ora avvia in modalità provvisoria
   Avvia VirtumundoBeGone e segui le indicazioni a video.
   riavvia il Pc in modalità normale e posta il log.
   
4. Segui le istruzioni di questo topic per postare il log di combofix.
   
5. Fai questa scansione con SystemScan e posta il log su FreeFileHosting come indicato qui.

[daysleeper]

ciao bdoriano,ci avevo pensato anch'io all'inizio ma poi non ho visto piazzata nel run alcuna dll ,cmq una passata con quei tool male non fa,attendiamo i log

[FaFa86]

sto facendo la scansione con questo kaspersky.......quando finisce vi posto il log

intanto ecco hijackthis ORA che cosa dice:

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 20.09.27, on 28/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Java\jre1.6.0_06\bin\jusched.exe
C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\Programmi\MSN Messenger\msnmsgr.exe
C:\Programmi\MSN Messenger\usnsvc.exe
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\All Users\Desktop\Kaspersky Lab Tool\setup_7.0.0.180_28.04.2008_20-26.exe
C:\Documents and Settings\All Users\Desktop\Kaspersky Lab Tool\setup_7.0.0.180_28.04.2008_20-26.exe
C:\Documents and Settings\Mazzella\Documenti\Programmi\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://virgilio.alice.it/index.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {11F61896-1AA7-49E2-9206-FC4756555230} - C:\WINDOWS\system32\CddbCddap.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: (no name) - {D2F3BDF6-A745-401F-9989-02CAA90D77B0} - c:\windows\system32\ddrawf.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Programmi\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [AVP] "C:\Documents and Settings\All Users\Desktop\Kaspersky Lab Tool\setup_7.0.0.180_28.04.2008_20-26.exe"
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_06\bin\ssv.dll
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://pastaeteritemi.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4351170D-2D78-411A-99A4-CEFA88ED54B1}: NameServer = 85.37.17.11 85.38.28.69
O17 - HKLM\System\CS1\Services\Tcpip\..\{4351170D-2D78-411A-99A4-CEFA88ED54B1}: NameServer = 85.37.17.11 85.38.28.69
O20 - Winlogon Notify: Antiwpa - C:\WINDOWS\SYSTEM32\antiwpa.dll
O20 - Winlogon Notify: vjigpuvy - C:\WINDOWS\SYSTEM32\ddrawf.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Accesso pannello remoto (apanr) - Unknown owner - C:\WINDOWS\Downlo~1\lfgjvq2\b3w9gj.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: setup_7.0.0.180_28.04.2008_20-26 - Kaspersky Lab - C:\Documents and Settings\All Users\Desktop\Kaspersky Lab Tool\setup_7.0.0.180_28.04.2008_20-26.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 4800 bytes

[FaFa86]

Ok......ho fatto kaspersky......ecco la prima e l'ultima parte del log (enorme!)...ho fatto l'upload



[URL="http://www.freefilehosting.net/files/3g9f1"]kaspersky ridotto.txt[/URL]

[FaFa86]

ecco di nuovo combofix

ComboFix 08-04-27.3 - Mazzella 2008-04-28 22.40.30.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1040.18.221 [GMT 2:00]
Eseguito da: C:\Documents and Settings\Mazzella\Desktop\ComboFix.exe
* Creato nuovo punto di ripristino

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\ddrawf.dll . . . . Eliminazione Fallita

.
((((((((((((((((((((((((( Files Creati Da 2008-03-28 al 2008-04-28 )))))))))))))))))))))))))))))))))))
.

2008-04-28 20:05 . 2008-04-28 22:47 170,016 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-04-28 20:05 . 2008-04-28 22:44 3,968 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-04-16 13:20 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-04-16 13:18 . 2008-04-16 13:20 <DIR> d-------- C:\Programmi\Java
2008-04-16 13:17 . 2008-04-16 13:17 <DIR> d-------- C:\Programmi\File comuni\Java
2008-04-12 12:30 . 2008-04-12 12:31 <DIR> d-------- C:\Programmi\File comuni\Mozilla Shared
2008-04-12 12:30 . 2008-04-12 12:30 6,490,880 --a------ C:\WINDOWS\system32\ybkksdyh.dat
2008-04-12 12:30 . 2008-04-12 12:30 1,015,808 --a------ C:\WINDOWS\system32\libeay32.dll
2008-04-12 12:30 . 2008-04-13 13:27 638,208 --a------ C:\WINDOWS\system32\tkqwjoub.dat
2008-04-12 12:30 . 2008-04-12 12:30 196,608 --a------ C:\WINDOWS\system32\libssl32.dll
2008-04-12 12:30 . 2008-04-22 22:10 43,264 --a------ C:\WINDOWS\system32\bduspgus.dat
2008-04-12 12:30 . 2008-04-13 13:27 36,608 --a------ C:\WINDOWS\system32\qonxwegv.dat
2008-04-12 12:30 . 2008-04-13 13:27 35,584 --a------ C:\WINDOWS\system32\vskoawnx.dat
2008-04-12 12:30 . 20,608 C:\WINDOWS\system32\drivers\mvyyqsgx.dat
2008-04-12 12:21 . 2005-12-07 13:31 88,064 --a------ C:\WINDOWS\system32\CddbCddap.dll
2008-04-12 12:20 . 2008-04-22 22:10 83,456 --a------ C:\WINDOWS\system32\ddrawf.dll.bak

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-27 17:59 --------- d-----w C:\Programmi\eMule
2008-04-27 17:56 --------- d-----w C:\Programmi\MSN Messenger
2008-04-27 17:20 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\Downloaded Installations
2008-04-10 19:34 --------- d-----w C:\Programmi\Messenger Plus! Live
2008-03-27 23:08 --------- d-----w C:\Programmi\File comuni\Adobe
2008-03-15 16:16 --------- d-----w C:\Documents and Settings\Mazzella\Dati applicazioni\dvdcss
.

((((((((((((((((((((((((((((( snapshot@2008-04-28_14.26.51.07 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-28 12:21:50 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-04-28 20:45:45 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2007-07-05 12:34:52 134,160 ----a-w C:\WINDOWS\system32\drivers\klif.sys
- 2008-04-28 12:11:02 41,068 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-04-28 16:38:49 41,068 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-04-28 12:11:02 48,796 ----a-w C:\WINDOWS\system32\perfc010.dat
+ 2008-04-28 16:38:49 48,796 ----a-w C:\WINDOWS\system32\perfc010.dat
- 2008-04-28 12:11:02 315,124 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-04-28 16:38:49 315,124 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2008-04-28 12:11:02 348,582 ----a-w C:\WINDOWS\system32\perfh010.dat
+ 2008-04-28 16:38:49 348,582 ----a-w C:\WINDOWS\system32\perfh010.dat
+ 2008-04-28 20:46:02 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_6d4.dat
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* i valori vuoti & legittimi/default non sono visualizzati.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{11F61896-1AA7-49E2-9206-FC4756555230}]
2005-12-07 13:31 88064 --a------ C:\WINDOWS\system32\CddbCddap.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D2F3BDF6-A745-401F-9989-02CAA90D77B0}]
2001-08-31 22:00 82432 --a------ c:\windows\system32\ddrawf.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"SunJavaUpdateSched"="C:\Programmi\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]
"UnlockerAssistant"="C:\Programmi\Unlocker\UnlockerAssistant.exe" [ ]
"AVP"="C:\Documents and Settings\All Users\Desktop\Kaspersky Lab Tool\setup_7.0.0.180_28.04.2008_20-26.exe" [2007-10-12 16:29 212992]
"combofix"="C:\WINDOWS\system32\CF12263.exe" [2004-08-19 15:39 397824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Antiwpa]
antiwpa.dll 2005-09-18 03:32 5376 C:\WINDOWS\system32\antiwpa.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vjigpuvy]
ddrawf.dll 2001-08-31 22:00 82432 C:\WINDOWS\system32\ddrawf.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^WinZip Quick Pick.lnk]
path=C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\WinZip Quick Pick.lnk
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Mazzella^Menu Avvio^Programmi^Esecuzione automatica^Adobe Gamma.lnk]
path=C:\Documents and Settings\Mazzella\Menu Avvio\Programmi\Esecuzione automatica\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
--a------ 2005-05-12 22:05 344064 C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2004-08-19 15:39 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a--c--- 2001-07-09 12:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Smapp]
--a------ 2003-07-30 10:08 143360 C:\Programmi\Analog Devices\SoundMAX\SMTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programmi\\Messenger\\msmsgs.exe"=
"C:\\Programmi\\Internet Explorer\\IEXPLORE.EXE"=
"C:\\Programmi\\eMule\\emule.exe"=
"C:\\Programmi\\NetMeeting\\conf.exe"=
"C:\\WINDOWS\\explorer.exe"=
"C:\\Programmi\\MSN Messenger\\msnmsgr.exe"=
"C:\\Programmi\\MSN Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26062:TCP"= 26062:TCP:*:Disabled:BitComet 26062 TCP
"26062:UDP"= 26062:UDP:*:Disabled:BitComet 26062 UDP
"31953:TCP"= 31953:TCP:@xpsp2res.dll,-22009
"80:TCP"= 80:TCP:@xpsp2res.dll,-22009
"3037:TCP"= 3037:TCP:@xpsp2res.dll,-22009
"63192:TCP"= 63192:TCP:@xpsp2res.dll,-22009
"18201:TCP"= 18201:TCP:@xpsp2res.dll,-22009
"19225:TCP"= 19225:TCP:@xpsp2res.dll,-22009
"28304:TCP"= 28304:TCP:@xpsp2res.dll,-22009
"26889:TCP"= 26889:TCP:@xpsp2res.dll,-22009
"59891:TCP"= 59891:TCP:@xpsp2res.dll,-22009
"47298:TCP"= 47298:TCP:@xpsp2res.dll,-22009
"39108:TCP"= 39108:TCP:@xpsp2res.dll,-22009
"7169:TCP"= 7169:TCP:@xpsp2res.dll,-22009
"16384:TCP"= 16384:TCP:@xpsp2res.dll,-22009
"56858:TCP"= 56858:TCP:@xpsp2res.dll,-22009
"51905:TCP"= 51905:TCP:@xpsp2res.dll,-22009
"14324:TCP"= 14324:TCP:@xpsp2res.dll,-22009
"34776:TCP"= 34776:TCP:@xpsp2res.dll,-22009
"30919:TCP"= 30919:TCP:@xpsp2res.dll,-22009
"32721:TCP"= 32721:TCP:@xpsp2res.dll,-22009
"1523:TCP"= 1523:TCP:@xpsp2res.dll,-22009
"43245:TCP"= 43245:TCP:@xpsp2res.dll,-22009
"29634:TCP"= 29634:TCP:@xpsp2res.dll,-22009
"8712:TCP"= 8712:TCP:@xpsp2res.dll,-22009
"29656:TCP"= 29656:TCP:@xpsp2res.dll,-22009
"21702:TCP"= 21702:TCP:@xpsp2res.dll,-22009
"62144:TCP"= 62144:TCP:@xpsp2res.dll,-22009
"19676:TCP"= 19676:TCP:@xpsp2res.dll,-22009
"32477:TCP"= 32477:TCP:@xpsp2res.dll,-22009
"39769:TCP"= 39769:TCP:@xpsp2res.dll,-22009
"32512:TCP"= 32512:TCP:@xpsp2res.dll,-22009
"45300:TCP"= 45300:TCP:@xpsp2res.dll,-22009
"47326:TCP"= 47326:TCP:@xpsp2res.dll,-22009
"45272:TCP"= 45272:TCP:@xpsp2res.dll,-22009

R0 afrodhzv;afrodhzv;C:\WINDOWS\system32\drivers\mvyyqsgx.dat []
R0 m5289;m5289;C:\WINDOWS\system32\DRIVERS\m5289.sys [2004-12-01 11:49]
R0 uliagpkx;ULi AGP Bus Filter Driver;C:\WINDOWS\system32\DRIVERS\agpkx.sys [2004-07-08 16:58]
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
R3 PAC207;Trust WB-1400T Webcam;C:\WINDOWS\system32\DRIVERS\pfc027.sys [2005-02-24 12:29]
R3 ULI5261;ULi Based Ethernet NT Driver;C:\WINDOWS\system32\DRIVERS\ULILAN.SYS [2004-12-31 16:24]
S2 apanr;Accesso pannello remoto;C:\WINDOWS\Downlo~1\lfgjvq2\b3w9gj.exe []
S2 setup_7.0.0.180_28.04.2008_20-26;setup_7.0.0.180_28.04.2008_20-26;"C:\Documents and Settings\All Users\Desktop\Kaspersky Lab Tool\setup_7.0.0.180_28.04.2008_20-26.exe" -r []

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
tzrvhowt

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{071ab282-4f27-11dc-b63c-0013d47a2e5f}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
\Shell\Open(&0)\command - Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bd3345a0-b875-11db-b4e8-0013d47a2e5f}]
\Shell\auto\command - Knight.exe open
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Knight.exe open
\Shell\explore\command - Knight.exe open
\Shell\find\command - Knight.exe open
\Shell\install\command - Knight.exe open
\Shell\open\command - Knight.exe open

.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-28 22:47:05
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 47

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\afrodhzv]
"ImagePath"="system32\drivers\mvyyqsgx.dat"
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
.
**************************************************************************
.
Ora fine scansione: 2008-04-28 22:51:38 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-28 20:51:26

10 Directory 35,341,381,632 byte disponibili
13 Directory 35,381,325,824 byte disponibili

190

[FaFa86]

ecco di nuovo hijack this (a me sembrano tutti uguali sti log ragazzi...mi state facendo fare lavoro inutile???)

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 22.55.52, on 28/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\Programmi\Java\jre1.6.0_06\bin\jusched.exe
C:\WINDOWS\explorer.exe
C:\Programmi\internet explorer\iexplore.exe
C:\Documents and Settings\Mazzella\Documenti\Programmi\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://virgilio.alice.it/index.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {11F61896-1AA7-49E2-9206-FC4756555230} - C:\WINDOWS\system32\CddbCddap.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: (no name) - {D2F3BDF6-A745-401F-9989-02CAA90D77B0} - c:\windows\system32\ddrawf.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Programmi\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [AVP] "C:\Documents and Settings\All Users\Desktop\Kaspersky Lab Tool\setup_7.0.0.180_28.04.2008_20-26.exe"
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_06\bin\ssv.dll
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://pastaeteritemi.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4351170D-2D78-411A-99A4-CEFA88ED54B1}: NameServer = 85.37.17.11 85.38.28.69
O17 - HKLM\System\CS1\Services\Tcpip\..\{4351170D-2D78-411A-99A4-CEFA88ED54B1}: NameServer = 85.37.17.11 85.38.28.69
O20 - Winlogon Notify: Antiwpa - C:\WINDOWS\SYSTEM32\antiwpa.dll
O20 - Winlogon Notify: vjigpuvy - C:\WINDOWS\SYSTEM32\ddrawf.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Accesso pannello remoto (apanr) - Unknown owner - C:\WINDOWS\Downlo~1\lfgjvq2\b3w9gj.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: setup_7.0.0.180_28.04.2008_20-26 - Kaspersky Lab - C:\Documents and Settings\All Users\Desktop\Kaspersky Lab Tool\setup_7.0.0.180_28.04.2008_20-26.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 4519 bytes

[FaFa86]

ho fatto tutto quello che mi hanno detto chemicalbit e sleepy

ora faccio quello che ha detto doriano?datemi una risposta vi prego sto impazzendo....

[FaFa86]

bene....mi avete abbandonato.Adesso basta il pc funziona nn voglio eliminare più niente visto che non ci riusciamo.
Però adesso ho sul desktop una cartella che non va via!!cioè Kaspersky Lab Tool
come eliminarlo?inoltre se riavvio il pc mi compare sempre la facciata che mi vuole far fare la scansione

i problemi invece di diminuire crescono bene!

[daysleeper]

disinstallalo cosi:
-lancia il programma,clicca sulla "complete virus protection",dai conferma con ok,si aprirà una pagina web(chiudila)quindi ti apparià una finestra per la disinstllazione(clicca su yes),dovrebbe chiederti un riavvio del pc,fallo.

[FaFa86]

l'HO ELIMINATO andando in modalità provvisoria....
sono traumatizzato
adesso basta.grazie a tutti.

[daysleeper]

scarica questo:
http://downloads2.superantispyware.com/downloads/SUPERAntiSpyware.exe
installalo,aggiornalo e fagli fare una "perform complete scan" spuntando il drive C,al termine della scansione salva e allega qui il relativo log.

scarica quest'altro:
http://research.pandasoftware.com/blogs/images/antirootkit.Zip
scompatta il file sul desktop,lancialo,aggiornalo e scansiona,se trova qualcosa la rimuove in automatico,siccome non rilascia log,nel caso trovi qualcosa salva lo screen finale della scan e lo metti qui

scarica questo:
http://www.trendmicro.com/ftp/products/rootkitbuster/RootkitBuster2.2.1014.zip
scompattalo in una cartella dedicata,avvia la scansione al termine della quale ti verrà chiesto di salvare il log,clicca yes e lo posti qui

[chemicalbit]

[bdoriano]