Olimpo Informatico

[f.denart]

salve a tutti, ho un pc con sistema operativo Windows XP home edition. Un attimo fa si è aperta una finestra di allarme di NOD32 che dice che il seguente file C.\Windows\system32\itggynpg.dll è infetto da Win32/Adware.Virtumonde
Cerco di chiudere la finestra di allarme ed eliminare il file ma riappare continuamente, anche riavviando il pc.

Cosa devo fare?

GRAZIE

[bdoriano]

Ciao f.denart,

• Scarica VundoFix e VirtumundoBegone e salvali sul desktop.
  
• Avvia VundoFix
  Seleziona Scan for Vundo e a scansione terminata scegli Remove Vundo.
  Clicca Yes e alla richiesta di riavviare il Pc rispondi Ok.
  Al riavvio dovrebbe comparire il blocco-note con dentro il log, copia e posta sul forum il contenuto.
  
• Ora avvia in modalità provvisoria
  Avvia VirtumundoBeGone e segui le indicazioni a video.
  riavvia il Pc in modalità normale e posta il log.
  
• Segui le istruzioni di questo topic per postare il log di combofix.
  
• Fai anche un nuovo log di HijackThis e mettilo qui.

PS: se vuoi, puoi presentarti qui

[f.denart]

ho avviato VundoFix ma al riavvio compare il blocco note VBG ma è vuoto.
Cmq adesso avvio l'altro

Grazie

[f.denart]

[02/07/2008, 20:33:18] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\FEDERICO\Desktop\VirtumundoBeGone.exe" )
[02/07/2008, 20:33:26] - Detected System Information:
[02/07/2008, 20:33:26] - Windows Version: 5.1.2600, Service Pack 2
[02/07/2008, 20:33:26] - Current Username: FEDERICO (Admin)
[02/07/2008, 20:33:26] - Windows is in SAFE mode with Networking.
[02/07/2008, 20:33:26] - Searching for Browser Helper Objects:
[02/07/2008, 20:33:26] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Supporto di collegamento per Adobe PDF Reader)
[02/07/2008, 20:33:26] - BHO 2: {22BF413B-C6D2-4d91-82A9-A0F997BA588C} (Skype add-on (mastermind))
[02/07/2008, 20:33:26] - BHO 3: {5E85C971-F9E7-4F4D-A059-14FA00220C7A} ()
[02/07/2008, 20:33:26] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/07/2008, 20:33:26] - Checking for HKLM\...\Winlogon\Notify\byxwtrs
[02/07/2008, 20:33:26] - Found: HKLM\...\Winlogon\Notify\byxwtrs - This is probably Virtumundo.
[02/07/2008, 20:33:26] - Assigning {5E85C971-F9E7-4F4D-A059-14FA00220C7A} MSEvents Object
[02/07/2008, 20:33:26] - BHO list has been changed! Starting over...
[02/07/2008, 20:33:26] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Supporto di collegamento per Adobe PDF Reader)
[02/07/2008, 20:33:26] - BHO 2: {22BF413B-C6D2-4d91-82A9-A0F997BA588C} (Skype add-on (mastermind))
[02/07/2008, 20:33:26] - BHO 3: {5E85C971-F9E7-4F4D-A059-14FA00220C7A} (MSEvents Object)
[02/07/2008, 20:33:26] - ALERT: Found MSEvents Object!
[02/07/2008, 20:33:26] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[02/07/2008, 20:33:26] - BHO 5: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[02/07/2008, 20:33:26] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/07/2008, 20:33:26] - No filename found. Continuing.
[02/07/2008, 20:33:26] - BHO 6: {838B6A16-8E22-4EFA-82FA-9ED139C3F2C0} ()
[02/07/2008, 20:33:26] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/07/2008, 20:33:26] - Checking for HKLM\...\Winlogon\Notify\jkklk
[02/07/2008, 20:33:26] - Key not found: HKLM\...\Winlogon\Notify\jkklk, continuing.
[02/07/2008, 20:33:26] - BHO 7: {880c501f-3393-4ddd-b6c9-4667e55afb28} ()
[02/07/2008, 20:33:26] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/07/2008, 20:33:26] - Checking for HKLM\...\Winlogon\Notify\itggynpg
[02/07/2008, 20:33:26] - Key not found: HKLM\...\Winlogon\Notify\itggynpg, continuing.
[02/07/2008, 20:33:27] - BHO 8: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[02/07/2008, 20:33:27] - BHO 9: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[02/07/2008, 20:33:27] - Finished Searching Browser Helper Objects
[02/07/2008, 20:33:27] - *** Detected MSEvents Object
[02/07/2008, 20:33:27] - Trying to remove MSEvents Object...
[02/07/2008, 20:33:28] - Terminating Process: IEXPLORE.EXE
[02/07/2008, 20:33:28] - Terminating Process: RUNDLL32.EXE
[02/07/2008, 20:33:28] - Disabling Automatic Shell Restart
[02/07/2008, 20:33:28] - Terminating Process: EXPLORER.EXE
[02/07/2008, 20:33:28] - Suspending the NT Session Manager System Service
[02/07/2008, 20:33:28] - Terminating Windows NT Logon/Logoff Manager
[02/07/2008, 20:33:28] - Re-enabling Automatic Shell Restart
[02/07/2008, 20:33:28] - File to disable: C:\WINDOWS\system32\byxwtrs.dll
[02/07/2008, 20:33:28] - Renaming C:\WINDOWS\system32\byxwtrs.dll -> C:\WINDOWS\system32\byxwtrs.dll.vir
[02/07/2008, 20:33:28] - File successfully renamed!
[02/07/2008, 20:33:28] - Removing HKLM\...\Browser Helper Objects\{5E85C971-F9E7-4F4D-A059-14FA00220C7A}
[02/07/2008, 20:33:28] - Removing HKCR\CLSID\{5E85C971-F9E7-4F4D-A059-14FA00220C7A}
[02/07/2008, 20:33:28] - Adding Kill Bit for ActiveX for GUID: {5E85C971-F9E7-4F4D-A059-14FA00220C7A}
[02/07/2008, 20:33:28] - Deleting ATLEvents/MSEvents Registry entries
[02/07/2008, 20:33:28] - Removing HKLM\...\Winlogon\Notify\byxwtrs
[02/07/2008, 20:33:28] - Searching for Browser Helper Objects:
[02/07/2008, 20:33:28] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Supporto di collegamento per Adobe PDF Reader)
[02/07/2008, 20:33:29] - BHO 2: {22BF413B-C6D2-4d91-82A9-A0F997BA588C} (Skype add-on (mastermind))
[02/07/2008, 20:33:29] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[02/07/2008, 20:33:29] - BHO 4: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[02/07/2008, 20:33:29] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/07/2008, 20:33:29] - No filename found. Continuing.
[02/07/2008, 20:33:29] - BHO 5: {838B6A16-8E22-4EFA-82FA-9ED139C3F2C0} ()
[02/07/2008, 20:33:29] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/07/2008, 20:33:29] - Checking for HKLM\...\Winlogon\Notify\jkklk
[02/07/2008, 20:33:29] - Key not found: HKLM\...\Winlogon\Notify\jkklk, continuing.
[02/07/2008, 20:33:29] - BHO 6: {880c501f-3393-4ddd-b6c9-4667e55afb28} ()
[02/07/2008, 20:33:29] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/07/2008, 20:33:29] - Checking for HKLM\...\Winlogon\Notify\itggynpg
[02/07/2008, 20:33:29] - Key not found: HKLM\...\Winlogon\Notify\itggynpg, continuing.
[02/07/2008, 20:33:29] - BHO 7: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[02/07/2008, 20:33:29] - BHO 8: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[02/07/2008, 20:33:29] - Finished Searching Browser Helper Objects
[02/07/2008, 20:33:29] - Finishing up...
[02/07/2008, 20:33:29] - A restart is needed.
[02/07/2008, 20:33:48] - Attempting to Restart via STOP error (Blue Screen!)

[f.denart]

ComboFix 08-02.05.3 - FEDERICO 2008-02-07 20.41.06.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1040.18.642 [GMT 1:00]
Eseguito da: C:\Documents and Settings\FEDERICO\Desktop\ComboFix.exe
* Creato nuovo punto di ripristino

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr1.dat
C:\WINDOWS\system32\crscxxjv.ini
C:\WINDOWS\system32\fnjgvkpq.dll
C:\WINDOWS\system32\fqylvwqx.dll
C:\WINDOWS\system32\lkwdvemw.ini
C:\WINDOWS\system32\tqoctqdh.ini
D:\Autorun.inf

----- BITS: Possible infected sites -----

hxxp://www.download.windowsupdate.com
.
((((((((((((((((((((((((( Files Creati Da 2008-01-07 al 2008-02-07 )))))))))))))))))))))))))))))))))))
.

2008-02-07 20:43 . 2008-02-07 20:43 268 --ah----- C:\sqmdata11.sqm
2008-02-07 20:43 . 2008-02-07 20:43 244 --ah----- C:\sqmnoopt11.sqm
2008-02-07 20:31 . 2008-02-07 20:31 268 --ah----- C:\sqmdata10.sqm
2008-02-07 20:31 . 2008-02-07 20:31 244 --ah----- C:\sqmnoopt10.sqm
2008-02-07 20:22 . 2008-02-07 20:22 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2008-02-07 20:15 . 2008-02-07 20:15 <DIR> d-------- C:\VundoFix Backups
2008-02-07 19:55 . 2008-02-07 19:55 36,864 --a------ C:\WINDOWS\system32\byxwtrs.V00dll
2008-02-07 19:27 . 2008-02-07 19:27 268 --ah----- C:\sqmdata09.sqm
2008-02-07 19:27 . 2008-02-07 19:27 244 --ah----- C:\sqmnoopt09.sqm
2008-02-07 19:13 . 2008-02-07 19:13 36,864 --a------ C:\WINDOWS\system32\byxwtrs.Vdll
2008-02-07 19:13 . 2008-02-07 19:13 268 --ah----- C:\sqmdata08.sqm
2008-02-07 19:13 . 2008-02-07 19:13 244 --ah----- C:\sqmnoopt08.sqm
2008-02-07 01:31 . 2008-02-07 01:31 268 --ah----- C:\sqmdata07.sqm
2008-02-07 01:31 . 2008-02-07 01:31 244 --ah----- C:\sqmnoopt07.sqm
2008-02-06 23:25 . 2008-02-06 23:26 92,224 --a------ C:\WINDOWS\system32\itggynpg.dll
2008-02-06 18:23 . 2008-02-06 18:23 268 --ah----- C:\sqmdata06.sqm
2008-02-06 18:23 . 2008-02-06 18:23 244 --ah----- C:\sqmnoopt06.sqm
2008-02-06 00:16 . 2008-02-06 00:16 268 --ah----- C:\sqmdata05.sqm
2008-02-06 00:16 . 2008-02-06 00:16 244 --ah----- C:\sqmnoopt05.sqm
2008-02-06 00:00 . 2008-02-06 00:00 268 --ah----- C:\sqmdata04.sqm
2008-02-06 00:00 . 2008-02-06 00:00 244 --ah----- C:\sqmnoopt04.sqm
2008-02-05 01:05 . 2008-02-05 01:05 268 --ah----- C:\sqmdata03.sqm
2008-02-05 01:05 . 2008-02-05 01:05 244 --ah----- C:\sqmnoopt03.sqm
2008-02-03 23:32 . 2008-02-03 23:32 268 --ah----- C:\sqmdata02.sqm
2008-02-03 23:32 . 2008-02-03 23:32 244 --ah----- C:\sqmnoopt02.sqm
2008-02-03 16:10 . 2008-02-03 16:10 268 --ah----- C:\sqmdata01.sqm
2008-02-03 16:10 . 2008-02-03 16:10 244 --ah----- C:\sqmnoopt01.sqm
2008-02-03 04:28 . 2008-02-03 04:28 268 --ah----- C:\sqmdata00.sqm
2008-02-03 04:28 . 2008-02-03 04:28 244 --ah----- C:\sqmnoopt00.sqm
2008-02-03 00:16 . 2004-08-19 15:39 91,136 --a------ C:\WINDOWS\system32\kswdmcap.ax
2008-01-30 21:09 . 2008-01-30 21:09 <DIR> d-------- C:\Programmi\Nero
2008-01-30 21:09 . 2008-01-30 21:12 <DIR> d-------- C:\Programmi\File comuni\Nero
2008-01-30 21:07 . 2008-01-30 21:07 36,864 --a------ C:\WINDOWS\system32\efcdeef.dll
2008-01-30 21:07 . 2008-01-30 21:07 36,352 --a------ C:\WINDOWS\system32\cbxyxvu.dll
2008-01-30 21:04 . 2008-01-30 21:04 36,352 --a------ C:\WINDOWS\system32\xxyayxx.dll
2008-01-30 21:00 . 2008-01-30 21:01 36,864 --a------ C:\WINDOWS\system32\byxwtrs.dll.vir
2008-01-30 13:57 . 2008-01-30 14:38 <DIR> d-a------ C:\Documents and Settings\All Users\Dati applicazioni\TEMP
2008-01-29 21:52 . 2008-02-03 13:53 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2008-01-29 21:52 . 2008-02-02 09:44 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2008-01-29 21:52 . 2008-02-03 13:53 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-01-29 21:50 . 2008-01-29 21:50 <DIR> dr-h----- C:\Documents and Settings\FEDERICO\Dati applicazioni\SecuROM
2008-01-29 21:50 . 2008-01-29 21:50 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2008-01-29 21:25 . 2008-01-29 21:25 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-01-29 21:08 . 2007-05-16 16:45 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll
2008-01-29 21:08 . 2007-05-16 16:45 1,124,720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll
2008-01-29 21:08 . 2007-03-12 16:42 1,123,696 --a------ C:\WINDOWS\system32\D3DCompiler_33.dll
2008-01-29 21:08 . 2007-05-16 16:45 443,752 --a------ C:\WINDOWS\system32\d3dx10_34.dll
2008-01-29 21:08 . 2007-03-15 16:57 443,752 --a------ C:\WINDOWS\system32\d3dx10_33.dll
2008-01-29 21:08 . 2007-06-20 20:46 266,088 --a------ C:\WINDOWS\system32\xactengine2_8.dll
2008-01-29 21:08 . 2007-04-04 18:55 261,480 --a------ C:\WINDOWS\system32\xactengine2_7.dll
2008-01-29 21:08 . 2007-04-04 18:53 81,768 --a------ C:\WINDOWS\system32\xinput1_3.dll
2008-01-29 21:08 . 2007-06-20 20:45 18,280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll
2008-01-29 21:07 . 2007-03-12 16:42 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll
2008-01-29 21:07 . 2007-01-24 15:27 255,848 --a------ C:\WINDOWS\system32\xactengine2_6.dll
2008-01-29 21:07 . 2007-03-05 12:42 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll
2008-01-28 18:29 . 2008-01-28 18:29 43,520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll
2008-01-25 20:34 . 2008-01-25 20:34 <DIR> d-------- C:\Programmi\Creative
2008-01-25 20:34 . 2002-06-06 14:38 139,264 --a------ C:\WINDOWS\system32\eax.dll
2008-01-25 20:23 . 2003-04-09 10:39 233,472 -ra------ C:\WINDOWS\system32\MafiaSetup.exe
2008-01-25 20:20 . 2008-01-25 20:21 <DIR> d-------- C:\Documents and Settings\FEDERICO\Dati applicazioni\DAEMON Tools Pro
2008-01-25 20:16 . 2008-01-25 20:21 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\DAEMON Tools Pro
2008-01-25 14:11 . 2008-01-25 14:11 715,248 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-01-21 11:30 . 2008-01-21 11:30 <DIR> d-------- C:\WINDOWS\Cache
2008-01-21 11:30 . 2008-01-21 11:30 7,319 --a------ C:\WINDOWS\SETUP.LST
2008-01-21 11:30 . 2008-01-21 11:30 327 --a------ C:\WINDOWS\ST6UNST.002
2008-01-21 11:30 . 2008-01-21 11:30 327 --a------ C:\WINDOWS\ST6UNST.001
2008-01-21 11:30 . 2008-01-21 11:30 327 --a------ C:\WINDOWS\ST6UNST.000
2008-01-19 15:36 . 2008-01-19 15:36 <DIR> d-------- C:\Programmi\Microsoft SQL Server Compact Edition
2008-01-19 15:36 . 2006-11-29 13:06 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll
2008-01-19 15:28 . 2008-01-19 15:28 <DIR> d-------- C:\Documents and Settings\FEDERICO\Contacts
2008-01-19 15:05 . 2008-01-19 15:27 <DIR> d--hsc--- C:\Programmi\File comuni\WindowsLiveInstaller
2008-01-19 15:04 . 2008-02-02 11:04 <DIR> d-------- C:\Programmi\Windows Live
2008-01-19 15:04 . 2008-01-19 15:04 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\WLInstaller
2008-01-15 18:44 . 2008-01-15 18:44 196 --a------ C:\WINDOWS\Spaix2PC.INI
2008-01-15 18:44 . 2008-01-15 18:44 174 --a------ C:\WINDOWS\Wilo30.INI
2008-01-15 18:43 . 2004-11-18 16:02 3,392,512 --a------ C:\WINDOWS\system32\vsImport.exe
2008-01-15 18:43 . 2000-02-03 06:01 2,023,424 --a------ C:\WINDOWS\system32\vcl50.bpl
2008-01-15 18:43 . 2003-03-12 16:18 452,608 --a------ C:\WINDOWS\system32\WiloRemoteSrv.exe
2008-01-15 18:43 . 2003-09-01 15:19 383,488 --a------ C:\WINDOWS\system32\SpaixLocalSrv.dll
2008-01-15 18:43 . 2000-02-03 06:01 265,216 --a------ C:\WINDOWS\system32\midas.dll
2008-01-15 18:43 . 2001-11-09 11:52 157,696 --a------ C:\WINDOWS\system32\vsRt32v3.dll
2008-01-15 18:43 . 2000-02-03 06:01 36,864 --a------ C:\WINDOWS\system32\VCL50.DE
2008-01-15 18:43 . 2000-02-03 06:01 20,480 --a------ C:\WINDOWS\system32\STDVCL40.DE
2008-01-15 18:43 . 1998-07-10 06:00 3,324 --a------ C:\WINDOWS\system32\stdvcl40.tlb
2008-01-15 18:38 . 2008-01-15 18:38 <DIR> d-------- C:\WINDOWS\_ISTMP1.DIR
2008-01-15 18:38 . 2008-01-15 18:38 <DIR> d-------- C:\Programmi\File comuni\VSX
2008-01-15 18:38 . 2008-01-15 18:44 782,289 --a------ C:\WINDOWS\UninstWilo3.isu
2008-01-15 18:38 . 2008-01-15 18:44 125 --a------ C:\WINDOWS\VsProg.INI
2008-01-15 18:38 . 2008-01-15 18:44 44 --a------ C:\WINDOWS\VsxSetup.INI
2008-01-15 17:10 . 2008-01-15 18:44 <DIR> d-------- C:\Documents and Settings\FEDERICO\Dati applicazioni\VSX
2008-01-15 17:10 . 2005-02-17 14:12 6,656,000 --a------ C:\WINDOWS\system32\ddVue.ocx
2008-01-15 17:10 . 2004-04-30 14:29 4,632,064 --a------ C:\WINDOWS\system32\vsPCv1.dll
2008-01-15 17:10 . 2003-07-18 19:37 621,568 --a------ C:\WINDOWS\system32\vsDataset.dll
2008-01-15 17:10 . 2000-02-03 06:01 453,632 --a------ C:\WINDOWS\system32\stdvcl40.dll
2008-01-15 17:10 . 2004-03-12 19:18 273,408 --a------ C:\WINDOWS\system32\vsRt32v4.dll
2008-01-15 17:10 . 2006-05-15 15:25 268,048 --a------ C:\WINDOWS\system32\dxtmeta2.dll
2008-01-15 17:10 . 2005-01-21 12:49 232,960 --a------ C:\WINDOWS\system32\WiloLocalSrv.dll
2008-01-12 16:30 . 2008-02-01 15:03 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Polysun4Demo
2008-01-10 18:21 . 2008-02-07 19:14 <DIR> d-------- C:\Documents and Settings\FEDERICO\Dati applicazioni\BitTorrent
2008-01-09 17:57 . 2008-01-09 17:57 1,142 --a------ C:\WINDOWS\mozver.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-10 14:55 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\DesignBuilder
2008-02-07 18:04 --------- d-----w C:\Documents and Settings\FEDERICO\Dati applicazioni\Skype
2008-02-02 23:16 --------- d--h--w C:\Programmi\InstallShield Installation Information
2008-01-14 20:23 --------- d-----w C:\Documents and Settings\FEDERICO\Dati applicazioni\Winamp
2008-01-11 10:30 --------- d-----w C:\Documents and Settings\FEDERICO\Dati applicazioni\BSplayer PRO
2008-01-09 11:25 --------- d-----w C:\Programmi\File comuni\Sonic Shared
2008-01-09 11:25 --------- d-----w C:\Programmi\File comuni\InstallShield
2008-01-09 11:24 --------- d-----w C:\Programmi\Sonic
2008-01-09 10:35 --------- d-----w C:\Programmi\Microsoft Works
2008-01-07 19:47 --------- d-----w C:\Programmi\Google
2008-01-07 08:57 --------- d-----w C:\Programmi\File comuni\Symantec Shared
2008-01-07 08:57 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\Symantec
2008-01-04 21:05 --------- d-----w C:\Programmi\Skype
2008-01-04 21:05 --------- d-----w C:\Programmi\File comuni\Skype
2008-01-04 21:05 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\Skype
2008-01-04 20:15 --------- d-----w C:\Programmi\Synaptics
2008-01-04 20:14 --------- d-----w C:\Programmi\Servizi in linea
2008-01-04 20:13 --------- d-----w C:\Programmi\microsoft frontpage
2008-01-04 20:13 --------- d-----w C:\Programmi\Java
2008-01-04 20:13 --------- d-----w C:\Programmi\Intel
2008-01-04 20:13 --------- d-----w C:\Programmi\HP
2008-01-04 20:12 --------- d-----w C:\Programmi\Hewlett-Packard
2008-01-04 20:11 --------- d-----w C:\Programmi\File comuni\SpeechEngines
2008-01-04 20:11 --------- d-----w C:\Programmi\File comuni\ODBC
2008-01-04 20:11 --------- d-----w C:\Programmi\File comuni\MSSoap
2008-01-04 20:11 --------- d-----w C:\Programmi\File comuni\LightScribe
2008-01-04 20:11 --------- d-----w C:\Programmi\File comuni\Java
2008-01-04 20:11 --------- d-----w C:\Programmi\File comuni\HP
2008-01-04 20:11 --------- d-----w C:\Programmi\CONEXANT
2008-01-04 20:08 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\Sonic
2008-01-04 20:08 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\SBSI
2008-01-04 20:08 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\InstallShield
2008-01-04 20:08 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\HP
2008-01-04 20:08 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\CyberLink
2008-01-04 12:12 1,749 ----a-w C:\WINDOWS\system32\drivers\103C_HP_NTBK_HP Pavilion dv5000 (EW789EA#ABZ)_YN_0Pavi_QCND621013Z_E398803063_46_I30A7_SHP_V56.25_BF.0A_T060413_WXH2_L410_M1023_J100_7Intel_8T2400_91.83_#080104_N80861092_(EW789EA#ABZ)_XMOBILE_CN10_Z_2F.0A.MRK
2008-01-04 11:46 --------- d-----w C:\Programmi\HPQ
2007-12-13 18:09 972,072 ----a-w C:\WINDOWS\UNNeroMediaHome.exe
2007-12-04 08:59 972,072 ----a-w C:\WINDOWS\UNRecode.exe
2005-09-23 22:49 12,288 ----a-w C:\WINDOWS\Fonts\RandFont.dll
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* i valori vuoti & legittimi/default non sono visualizzati.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{838B6A16-8E22-4EFA-82FA-9ED139C3F2C0}]
C:\WINDOWS\system32\jkklk.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{880c501f-3393-4ddd-b6c9-4667e55afb28}]
2008-02-06 23:26 92224 --a------ C:\WINDOWS\system32\itggynpg.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2007-08-30 17:43 4670704]
"swg"="C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-01-15 21:24 68856]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 09:00 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Programmi\File comuni\Nero\Lib\NMBgMonitor.exe" [2007-12-13 19:10 103720]
"MsnMsgr"="C:\Programmi\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
"AlcoholAutomount"="C:\Programmi 2\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-12-22 08:23 221568]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-12-15 12:42 7331840]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-12-15 12:42 86016]
"nwiz"="nwiz.exe" [2005-12-15 12:42 1519616 C:\WINDOWS\system32\nwiz.exe]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-02-16 14:16 61952 C:\WINDOWS\system32\CHDAudPropShortcut.exe]
"SunJavaUpdateSched"="C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 12:03 36975]
"HP Software Update"="C:\Programmi\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 22:11 49152]
"SynTPEnh"="C:\Programmi\Synaptics\SynTP\SynTPEnh.exe" [2005-11-11 09:04 761945]
"hpWirelessAssistant"="C:\Programmi\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-12-13 15:45 507904]
"QPService"="C:\Programmi\HP\QuickPlay\QPService.exe" [2005-12-12 10:39 94208]
"eabconfg.cpl"="C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe" [2005-12-22 07:57 405504]
"Cpqset"="C:\Programmi\HPQ\Default Settings\cpqset.exe" [2005-06-29 12:48 233534]
"RecGuard"="C:\Windows\SMINST\RecGuard.exe" [2005-10-11 09:23 1187840]
"NBKeyScan"="C:\Programmi\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-12-03 14:21 2213160]
"nod32kui"="C:\Programmi\Eset\nod32kui.exe" [2008-01-09 16:22 949376]
"WinampAgent"="C:\Programmi 2\Winamp\winampa.exe" [2007-10-10 06:28 36352]
"Adobe Reader Speed Launcher"="C:\Programmi 2\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"NeroFilterCheck"="C:\Programmi\File comuni\Nero\Lib\NeroCheck.exe" [2007-03-01 14:57 153136]
"c877808c"="C:\WINDOWS\system32\vjxxcsrc.dll" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 09:00 15360]

S3 usbscan;Driver scanner USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Driver archiviazione di massa USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-07 20:45:05
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Programmi\HPQ\Default Settings\cpqset.exe???????????????????|?????? ???B?????????????hLC????????

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180]
-> C:\Programmi\Eset\pr_imon.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Programmi\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Programmi\HP\Digital Imaging\bin\hpqimzone.exe
C:\PROGRA~1\HPQ\SHARED\HPQTOA~1.EXE
.
**************************************************************************
.
Ora fine scansione: 2008-02-07 20:46:41 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-07 19:46:38

[f.denart]

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 20.51.22, on 07/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Programmi\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
C:\Programmi\Hp\HP Software Update\HPWuSchd2.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Programmi\HP\QuickPlay\QPService.exe
C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe
C:\Programmi\Eset\nod32kui.exe
C:\Programmi 2\Winamp\winampa.exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Programmi\HP\Digital Imaging\bin\hpqimzone.exe
C:\PROGRA~1\HPQ\SHARED\HPQTOA~1.EXE
C:\Documents and Settings\FEDERICO\Desktop\virus\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.hp.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://msg.edit.yahoo.com/config/reset_cookies?&.y=Y%3dv%3d1%26n%3daislrs2k0862k%26l%3di8ced0_3h02ki7eh/o%26p%3df2lvvro1133o0500%26jb%3d24%7c69%7c%26iz%3d700120%26r%3dc7%26lg%3den-US%26intl%3dus%26np%3d1%3b%20path%3d/%3b%20domain%3d.yahoo.com&.t=T%3dz%3dTCfgHBTI0gHB9.UWZ6iLtKoMjYxBjU2MDUwNjY2TzY-%26a%3dQAE%26sk%3dDAAIKo3Wlup1rx%26ks%3dEAAb5uA0iYPX_1wZfCCOtBSwg--~A%26d%3dc2wBTlRFMkFUSXhOekkzTVRFeE9ERS0BYQFRQUUBenoBVENmZ0hCZ1dBAXRpcAFYQ2pQMkI-%3b%20path%3d/%3b%20domain%3d.yahoo.com&.ver=2&.done=http://it.rd.yahoo.com/messenger/client/%3fhttp://it.mail.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {838B6A16-8E22-4EFA-82FA-9ED139C3F2C0} - C:\WINDOWS\system32\jkklk.dll (file missing)
O2 - BHO: {82bfa55e-7664-9c6b-ddd4-3933f105c088} - {880c501f-3393-4ddd-b6c9-4667e55afb28} - C:\WINDOWS\system32\itggynpg.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Programmi\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Programmi\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [QPService] "C:\Programmi\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Programmi\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Programmi\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [WinampAgent] "C:\Programmi 2\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi 2\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmi\File comuni\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [c877808c] rundll32.exe "C:\WINDOWS\system32\vjxxcsrc.dll",b
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Programmi 2\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Avvio rapido HP Photosmart Premier.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: I&nvia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programmi\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{9C779E52-035E-4D2C-8841-8436B3336C75}: NameServer = 192.168.0.2
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Programmi\File comuni\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Programmi\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programmi\File comuni\Nero\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmi\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 9101 bytes

[bdoriano]

Scarica avenger e scompattalo in una sua cartella non temporanea e non sul desktop

Avvia AVENGER
Clicca su input script manually
Clicca sulla lente d'ingrandimento
Inserisci queste righe:

[f.denart]

Buongiorno bdoriano.
Ho lanciato Avenger e dopo aver riavviato il pc compare un file di blocco note Avenger completamente bianco.
C'è un'altra cosa: ad ogni avvio del pc compare sempre il seguente messaggio di errore RUNDLL "Errore durante il caricamento di C:\WINDOWS\system32\vjxxcsrc.dll

[f.denart]

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 9.54.48, on 08/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
C:\Programmi\Hp\HP Software Update\HPWuSchd2.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Programmi\HP\QuickPlay\QPService.exe
C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe
C:\Programmi\Eset\nod32kui.exe
C:\Programmi 2\Winamp\winampa.exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Programmi\HP\Digital Imaging\bin\hpqimzone.exe
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Programmi\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\HPQ\SHARED\HPQTOA~1.EXE
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Documents and Settings\FEDERICO\Desktop\virus\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.hp.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://msg.edit.yahoo.com/config/reset_cookies?&.y=Y%3dv%3d1%26n%3daislrs2k0862k%26l%3di8ced0_3h02ki7eh/o%26p%3df2lvvro1133o0500%26jb%3d24%7c69%7c%26iz%3d700120%26r%3dc7%26lg%3den-US%26intl%3dus%26np%3d1%3b%20path%3d/%3b%20domain%3d.yahoo.com&.t=T%3dz%3dTCfgHBTI0gHB9.UWZ6iLtKoMjYxBjU2MDUwNjY2TzY-%26a%3dQAE%26sk%3dDAAIKo3Wlup1rx%26ks%3dEAAb5uA0iYPX_1wZfCCOtBSwg--~A%26d%3dc2wBTlRFMkFUSXhOekkzTVRFeE9ERS0BYQFRQUUBenoBVENmZ0hCZ1dBAXRpcAFYQ2pQMkI-%3b%20path%3d/%3b%20domain%3d.yahoo.com&.ver=2&.done=http://it.rd.yahoo.com/messenger/client/%3fhttp://it.mail.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {838B6A16-8E22-4EFA-82FA-9ED139C3F2C0} - C:\WINDOWS\system32\jkklk.dll (file missing)
O2 - BHO: {82bfa55e-7664-9c6b-ddd4-3933f105c088} - {880c501f-3393-4ddd-b6c9-4667e55afb28} - C:\WINDOWS\system32\itggynpg.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Programmi\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Programmi\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [QPService] "C:\Programmi\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Programmi\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Programmi\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [WinampAgent] "C:\Programmi 2\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi 2\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmi\File comuni\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [c877808c] rundll32.exe "C:\WINDOWS\system32\vjxxcsrc.dll",b
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Programmi 2\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Avvio rapido HP Photosmart Premier.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: I&nvia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programmi\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{9C779E52-035E-4D2C-8841-8436B3336C75}: NameServer = 192.168.0.2
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Programmi\File comuni\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Programmi\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programmi\File comuni\Nero\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmi\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 9190 bytes

[f.denart]

freefilehosting mi assegna il seguente link

http://www.freefilehosting.net/download/3bjd5

grazie

[bdoriano]

C'è ancora qualche rimasuglio...

Disabilita il ripristino di sistema

Poi, fai queste scansioni con GMER (sono 2: autostart e rootkit) e posta i logs su FreeFileHosting come indicato qui.

[f.denart]

Buonguiorno a tutti,
da quando ho rimosso alcuni files infetti dal mio pc(windows XP HOME, SP2), ad ogni avvio compare sempre il seguente messaggio di errore RUNDLL "Errore durante il caricamento di C:\WINDOWS\system32\vjxxcsrc.dll

E' un errore grave o posso ignorarlo?

Aiutatemi

Grazie

[bdoriano]

Forse ti era sfuggito il mio ultimo messaggio:

[f.denart]

salve bdoriano,
mi scuso ma nn mi ero accorto della risposta.

Dunque riporto quanto ottenuto da freefile hosting:

Dalla scansione con GMER autostart:

http://www.freefilehosting.net/download/3bmim

[f.denart]

adesso arriva anche il secondo

[f.denart]

ed ecco lo scan con GMER rootkit:

http://www.freefilehosting.net/download/3bmjc

[bdoriano]

Avvia AVENGER
Clicca su input script manually
Clicca sulla lente d'ingrandimento
Inserisci queste righe:

[f.denart]

una volta terminata la scansione con Avenger ottengo un errore e nessun altro risultato.

Hijackthis riporta:

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 14.08.25, on 11/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
C:\Programmi\Hp\HP Software Update\HPWuSchd2.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Programmi\HP\QuickPlay\QPService.exe
C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe
C:\Programmi\Eset\nod32kui.exe
C:\Programmi 2\Winamp\winampa.exe
C:\Programmi 2\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Programmi\HP\Digital Imaging\bin\hpqimzone.exe
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Programmi\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\HPQ\SHARED\HPQTOA~1.EXE
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\FEDERICO\Desktop\virus\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.hp.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://msg.edit.yahoo.com/config/reset_cookies?&.y=Y%3dv%3d1%26n%3daislrs2k0862k%26l%3di8ced0_3h02ki7eh/o%26p%3df2lvvro1133o0500%26jb%3d24%7c69%7c%26iz%3d700120%26r%3dc7%26lg%3den-US%26intl%3dus%26np%3d1%3b%20path%3d/%3b%20domain%3d.yahoo.com&.t=T%3dz%3dTCfgHBTI0gHB9.UWZ6iLtKoMjYxBjU2MDUwNjY2TzY-%26a%3dQAE%26sk%3dDAAIKo3Wlup1rx%26ks%3dEAAb5uA0iYPX_1wZfCCOtBSwg--~A%26d%3dc2wBTlRFMkFUSXhOekkzTVRFeE9ERS0BYQFRQUUBenoBVENmZ0hCZ1dBAXRpcAFYQ2pQMkI-%3b%20path%3d/%3b%20domain%3d.yahoo.com&.ver=2&.done=http://it.rd.yahoo.com/messenger/client/%3fhttp://it.mail.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {838B6A16-8E22-4EFA-82FA-9ED139C3F2C0} - C:\WINDOWS\system32\jkklk.dll (file missing)
O2 - BHO: {82bfa55e-7664-9c6b-ddd4-3933f105c088} - {880c501f-3393-4ddd-b6c9-4667e55afb28} - C:\WINDOWS\system32\itggynpg.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Programmi\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Programmi\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [QPService] "C:\Programmi\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Programmi\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Programmi\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [WinampAgent] "C:\Programmi 2\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi 2\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmi\File comuni\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [c877808c] rundll32.exe "C:\WINDOWS\system32\vjxxcsrc.dll",b
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Programmi 2\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Avvio rapido HP Photosmart Premier.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: I&nvia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programmi\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{9C779E52-035E-4D2C-8841-8436B3336C75}: NameServer = 192.168.0.2
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Programmi\File comuni\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Programmi\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programmi\File comuni\Nero\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmi\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 9349 bytes

[f.denart]

adesso è andato a buon fine


Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\ksbdcrwd

*******************

Script file located at: \??\C:\mymchkdo.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



File C:\WINDOWS\system32\vjxxcsrc.dll not found!
Deletion of file C:\WINDOWS\system32\vjxxcsrc.dll failed!

Could not process line:
C:\WINDOWS\system32\vjxxcsrc.dll
Status: 0xc0000034

Registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{838B6A16-8E22-4EFA-82FA-9ED139C3F2C0} deleted successfully.
Registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{880c501f-3393-4ddd-b6c9-4667e55afb28} deleted successfully.
Registry value HKLM\Software\Microsoft\Windows\CurrentVersion\Run|c877808c deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

[f.denart]

e questo è quanto mi ritorna HiJackThis

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 14.18.09, on 11/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
C:\Programmi\Hp\HP Software Update\HPWuSchd2.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Programmi\HP\QuickPlay\QPService.exe
C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe
C:\Programmi\Eset\nod32kui.exe
C:\Programmi 2\Winamp\winampa.exe
C:\Programmi 2\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Programmi\HP\Digital Imaging\bin\hpqimzone.exe
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Programmi\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\HPQ\SHARED\HPQTOA~1.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\FEDERICO\Desktop\virus\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.hp.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://msg.edit.yahoo.com/config/reset_cookies?&.y=Y%3dv%3d1%26n%3daislrs2k0862k%26l%3di8ced0_3h02ki7eh/o%26p%3df2lvvro1133o0500%26jb%3d24%7c69%7c%26iz%3d700120%26r%3dc7%26lg%3den-US%26intl%3dus%26np%3d1%3b%20path%3d/%3b%20domain%3d.yahoo.com&.t=T%3dz%3dTCfgHBTI0gHB9.UWZ6iLtKoMjYxBjU2MDUwNjY2TzY-%26a%3dQAE%26sk%3dDAAIKo3Wlup1rx%26ks%3dEAAb5uA0iYPX_1wZfCCOtBSwg--~A%26d%3dc2wBTlRFMkFUSXhOekkzTVRFeE9ERS0BYQFRQUUBenoBVENmZ0hCZ1dBAXRpcAFYQ2pQMkI-%3b%20path%3d/%3b%20domain%3d.yahoo.com&.ver=2&.done=http://it.rd.yahoo.com/messenger/client/%3fhttp://it.mail.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Programmi\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Programmi\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [QPService] "C:\Programmi\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Programmi\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Programmi\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [WinampAgent] "C:\Programmi 2\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi 2\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmi\File comuni\Nero\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Programmi 2\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Avvio rapido HP Photosmart Premier.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: I&nvia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programmi\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{9C779E52-035E-4D2C-8841-8436B3336C75}: NameServer = 192.168.0.2
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Programmi\File comuni\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Programmi\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programmi\File comuni\Nero\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmi\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 9052 bytes