Olimpo Informatico

[brand]

Ciao a tutti,da un paio di giorni ho notato un notevole rallentamento del mio pc,ho pensato a un malware cosi mi è stato consigliato di fare una scansione con Combofix e Hijack, i rispettivi file di log mi risultano però incomprensibili, quindi non so se è stato effetivamente riscontrato qualcosa e cosa eventualmente dovrei eliminare.Avrei bisogno di una mano, grazie.
Questo è il report di Hijack:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8.36.14, on 05/05/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS.0\System32\smss.exe
C:\WINDOWS.0\system32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\System32\svchost.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS.0\system32\spoolsv.exe
C:\Programmi\Java\jre6\bin\jqs.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Programmi\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS.0\system32\nvsvc32.exe
C:\Programmi\Advanced Registry Doctor\RegManServ.exe
C:\Programmi\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Programmi\Java\jre6\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programmi\Vista Drive Icon\DrvIcon.exe
C:\Programmi\Visual ToolTip\VisualToolTip.exe
C:\Programmi\Winamp\winampa.exe
C:\WINDOWS.0\system32\ctfmon.exe
C:\Programmi\Windows Sidebar\sidebar.exe
C:\Documents and Settings\Andrea\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe
C:\Programmi\OpenOffice.org 3\program\soffice.exe
C:\Programmi\OpenOffice.org 3\program\soffice.bin
C:\Programmi\Styler\Styler.exe
C:\WINDOWS.0\system32\wbem\wmiapsrv.exe
C:\Programmi\Java\jre6\bin\jucheck.exe
C:\WINDOWS.0\explorer.exe
C:\Documents and Settings\Andrea\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Programmi\Styler\TB\StylerTB.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programmi\Windows Live\Toolbar\wltcore.dll (file missing)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Programmi\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [DrvIcon] C:\Programmi\Vista Drive Icon\DrvIcon.exe
O4 - HKLM\..\Run: [VisualTooltip] C:\Programmi\Visual ToolTip\VisualToolTip.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Programmi\Winamp\winampa.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime Alternative\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\ctfmon.exe
O4 - HKCU\..\Run: [Sidebar] C:\Programmi\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Andrea\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Programmi\OpenOffice.org 3\program\quickstart.exe
O4 - Startup: Styler.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Inserisci blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programmi\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: Inserisci &blog in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programmi\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS.0\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS.0\Network Diagnostic\xpnetdiag.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmi\Java\jre6\bin\jqs.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Programmi\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS.0\system32\nvsvc32.exe
O23 - Service: Registry Management Service (RegManServ) - Unknown owner - C:\Programmi\Advanced Registry Doctor\RegManServ.exe

--
End of file - 5831 bytes



Questo è il report di Combofix:


ComboFix 09-05-03.3 - Andrea 05/05/2009 8.32.03.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.39.1040.18.767.505 [GMT 2:00]
Eseguito da: c:\documents and settings\Andrea\Desktop\ComboFix.exe

ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.

((((((((((((((((((((((((( Files Creati Da 2009-04-05 al 2009-05-05 )))))))))))))))))))))))))))))))))))
.

2009-05-04 13:45 . 2009-05-04 13:45 -------- d-----w c:\documents and settings\Andrea\Dati applicazioni\Malwarebytes
2009-05-04 13:45 . 2009-04-06 13:32 15504 ----a-w c:\windows.0\system32\drivers\mbam.sys
2009-05-04 13:45 . 2009-04-06 13:32 38496 ----a-w c:\windows.0\system32\drivers\mbamswissarmy.sys
2009-05-04 13:45 . 2009-05-04 13:45 -------- d-----w c:\documents and settings\All Users\Dati applicazioni\Malwarebytes
2009-05-04 13:45 . 2009-05-04 13:45 -------- d-----w c:\programmi\Malwarebytes' Anti-Malware
2009-05-04 09:18 . 2009-05-04 09:18 -------- d-----w c:\windows.0\srchasst
2009-05-04 09:18 . 2009-05-04 09:18 -------- d-----w c:\windows.0\system32\xircom
2009-05-03 17:34 . 2009-05-03 17:41 -------- d-----w c:\programmi\SopCast
2009-05-02 23:45 . 2009-05-02 23:46 -------- d-----w c:\documents and settings\Andrea\Dati applicazioni\TOMXPP
2009-04-26 09:33 . 2009-04-26 09:33 -------- d-----w c:\programmi\Microsoft FrontPage
2009-04-26 09:32 . 2009-04-26 09:32 -------- d-----w c:\windows.0\ShellNew
2009-04-26 09:30 . 2009-04-26 09:30 -------- d-----w c:\documents and settings\Andrea\Dati applicazioni\Microsoft Web Folders
2009-04-24 12:34 . 2009-04-24 12:34 -------- d-----w c:\documents and settings\NetworkService\Impostazioni locali\Dati applicazioni\Apple
2009-04-22 08:30 . 2009-04-22 08:30 -------- d-----w c:\documents and settings\Andrea\Dati applicazioni\BitSpirit
2009-04-22 08:29 . 2009-04-22 08:40 -------- d-----w c:\programmi\BitSpirit
2009-04-22 07:07 . 2009-04-22 08:35 -------- d-----w C:\Downloads
2009-04-22 07:06 . 2009-04-22 08:40 -------- d-----w c:\programmi\BitComet
2009-04-15 22:03 . 2009-04-15 22:03 -------- d-----w c:\documents and settings\Andrea\Impostazioni locali\Dati applicazioni\Apple
2009-04-15 22:03 . 2009-04-15 22:03 -------- d-----w c:\programmi\Apple Software Update
2009-04-15 22:03 . 2009-04-15 22:03 -------- d-----w c:\documents and settings\All Users\Dati applicazioni\Apple
2009-04-15 22:02 . 2009-04-15 22:02 -------- d-----w c:\documents and settings\Andrea\Impostazioni locali\Dati applicazioni\Apple Computer
2009-04-08 17:55 . 2009-04-08 17:55 -------- d-----w c:\programmi\HTTP-Tunnel

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-05 06:31 . 2008-11-27 09:21 6 -c-ha-w c:\windows.0\Tasks\SA.DAT
2009-05-04 22:20 . 2008-12-30 21:55 942 -c--a-w c:\windows.0\Tasks\GoogleUpdateTaskUserS-1-5-21-484763869-764733703-839522115-1003.job
2009-05-04 15:07 . 2008-11-27 10:15 -------- d-----w c:\programmi\RocketDock
2009-05-04 14:38 . 2008-11-27 10:15 -------- d-----w c:\programmi\LClock
2009-05-04 14:38 . 2008-12-19 09:05 -------- d-----w c:\programmi\eMule
2009-05-04 12:53 . 2008-11-28 17:21 -------- d-----w c:\programmi\Everest Poker.net
2009-05-04 11:45 . 2008-11-27 11:57 416 -c-ha-w c:\windows.0\Tasks\User_Feed_Synchronization-{0F83DC1E-B736-4376-867D-2BDEBFED9DBE}.job
2009-05-03 08:34 . 2001-08-31 19:00 77676 -c--a-w c:\windows.0\system32\perfc010.dat
2009-05-03 08:34 . 2001-08-31 19:00 456624 -c--a-w c:\windows.0\system32\perfh010.dat
2009-04-27 00:13 . 2008-11-27 10:03 73080 -c--a-w c:\documents and settings\Andrea\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2009-04-26 09:35 . 2009-04-26 09:35 4990 ----a-w c:\windows.0\Help\hhcolreg.dat
2009-04-24 12:34 . 2009-04-15 22:03 276 ----a-w c:\windows.0\Tasks\AppleSoftwareUpdate.job
2009-04-16 15:39 . 2009-01-30 08:40 -------- d-----w c:\programmi\Avidemux 2.4
2009-04-15 22:03 . 2008-11-27 09:58 -------- d-----w c:\programmi\QuickTime Alternative
2009-04-11 08:56 . 2009-03-21 19:02 -------- d-----w c:\programmi\Microsoft
2009-03-30 05:26 . 2009-02-15 17:28 -------- d-----w c:\programmi\Microsoft Silverlight
2009-03-21 19:07 . 2008-11-27 10:02 -------- d-----w c:\programmi\Windows Live
2009-03-21 19:06 . 2009-03-21 19:06 -------- d-----w c:\programmi\Microsoft Sync Framework
2009-03-21 19:01 . 2009-03-21 19:01 -------- d-----w c:\programmi\Windows Live SkyDrive
2009-03-21 18:25 . 2009-03-21 18:25 -------- d-----w c:\programmi\File comuni\Windows Live
2009-02-06 19:01 . 2009-02-06 19:01 308088 ----a-w c:\windows.0\WLXPGSS.SCR
2009-02-06 17:52 . 2009-02-06 17:52 49504 ----a-w c:\windows.0\system32\sirenacm.dll
2009-02-06 17:08 . 2009-03-21 19:07 55152 ----a-w c:\windows.0\system32\drivers\fssfltr_tdi.sys
2008-11-27 10:23 . 2008-11-27 10:23 2508 -c--a-w c:\programmi\File comuni\unins000.dat
2008-11-27 10:23 . 2008-11-27 10:23 730138 -c--a-w c:\programmi\File comuni\unins000.exe
2008-03-09 06:25 . 2008-11-27 10:23 236 -c-ha-w c:\programmi\File comuni\dx.reg
.

------- Sigcheck -------

[-] 2008-05-03 04:29 361344 ACCF5A9A1FFAA490F33DBA1C632B95E1 c:\windows.0\system32\drivers\tcpip.sys

[-] 2008-05-03 04:02 549888 6DC43081C760EEC1130D2C8C145DF375 c:\windows.0\system32\winlogon.exe

[-] 2008-05-03 04:07 1554432 C08C29D743BB88E6DE929CA6B9C23979 c:\windows.0\explorer.exe

[-] 2008-05-03 04:00 25088 91B6AAC828F8BBE1796275424E44DFB0 c:\windows.0\system32\ctfmon.exe

[-] 2008-05-03 03:54 1571840 3316C8A8EC07A9D4C0BE10310809A9E5 c:\windows.0\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot@2009-05-04_08.55.39 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-05 06:16 . 2009-05-05 06:16 16384 c:\windows.0\Temp\Perflib_Perfdata_794.dat
+ 2009-05-05 06:16 . 2009-05-05 06:16 16384 c:\windows.0\Temp\Perflib_Perfdata_52c.dat
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows.0\system32\ctfmon.exe" [2008-05-03 25088]
"Sidebar"="c:\programmi\Windows Sidebar\sidebar.exe" [2008-04-16 1274880]
"Google Update"="c:\documents and settings\Andrea\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe" [2008-11-29 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="NvQTwk" [X]
"SunJavaUpdateSched"="c:\programmi\Java\jre6\bin\jusched.exe" [2008-12-07 136600]
"UnlockerAssistant"="c:\programmi\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872]
"Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
"DrvIcon"="c:\programmi\Vista Drive Icon\DrvIcon.exe" [2008-04-13 49152]
"VisualTooltip"="c:\programmi\Visual ToolTip\VisualToolTip.exe" [2007-12-06 988672]
"WinampAgent"="c:\programmi\Winamp\winampa.exe" [2008-08-03 36352]
"QuickTime Task"="c:\programmi\QuickTime Alternative\qttask.exe" [2009-01-05 413696]
"nwiz"="nwiz.exe" - c:\windows.0\system32\nwiz.exe [2002-12-12 438272]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows.0\system32\CTFMON.EXE" [2008-05-03 25088]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
"nltide_3"="advpack.dll" - c:\windows.0\system32\advpack.dll [2008-10-16 124928]

c:\documents and settings\Andrea\Menu Avvio\Programmi\Esecuzione automatica\
OpenOffice.org 3.0.lnk - c:\programmi\OpenOffice.org 3\program\quickstart.exe [2008-9-12 384000]
Styler.lnk - c:\documents and settings\Andrea\Dati applicazioni\Microsoft\Installer\{E9ECF354-2422-4FDB-9ABF-D8ADAC0EF941}\_585b207a.exe [2008-11-27 15086]

c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Microsoft Office.lnk - c:\programmi\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\SopCast\\adv\\SopAdver.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programmi\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"13819:TCP"= 13819:TCP:BitComet 13819 TCP
"13819:UDP"= 13819:UDP:BitComet 13819 UDP

R3 fsssvc;Windows Live Family Safety;c:\programmi\Windows Live\Family Safety\fsssvc.exe [2009-02-06 533360]
S1 aswSP;avast! Self Protection; [x]
S2 aswFsBlk;aswFsBlk;c:\windows.0\system32\DRIVERS\aswFsBlk.sys [2008-11-26 20560]
S2 fssfltr;fssfltr;c:\windows.0\system32\DRIVERS\fssfltr_tdi.sys [2009-02-06 55152]
S2 SeaPort;SeaPort;c:\programmi\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-01-14 226656]


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D58F39FF-953E-4F45-898F-59F243B9A523}]
RUNDLL32 advpack.dll,LaunchINFSection Sidebar.inf,Register
.
Contenuto della cartella 'Scheduled Tasks'

2009-04-24 c:\windows.0\Tasks\AppleSoftwareUpdate.job
- c:\programmi\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2009-05-04 c:\windows.0\Tasks\GoogleUpdateTaskUserS-1-5-21-484763869-764733703-839522115-1003.job
- c:\documents and settings\Andrea\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe [2008-11-29 15:11]

2009-05-04 c:\windows.0\Tasks\User_Feed_Synchronization-{0F83DC1E-B736-4376-867D-2BDEBFED9DBE}.job
- c:\windows.0\system32\msfeedssync.exe [2008-05-03 03:53]
.
- - - - CHIAVI ORFANE RIMOSSE - - - -

HKCU-Run-RocketDock - c:\programmi\RocketDock\RocketDock.exe


.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.com/
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Andrea\Dati applicazioni\Mozilla\Firefox\Profiles\8hs6iecw.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - plugin: c:\documents and settings\Andrea\Dati applicazioni\Mozilla\Firefox\Profiles\8hs6iecw.default\extensions\tcastv1@tom.com\plugins\nptcast40.dll
FF - plugin: c:\documents and settings\Andrea\Dati applicazioni\Mozilla\Firefox\Profiles\8hs6iecw.default\extensions\tomxpp@tom.com\plugins\npXPPFF.dll
FF - plugin: c:\documents and settings\Andrea\Impostazioni locali\Dati applicazioni\Google\Update\1.2.141.5\npGoogleOneClick7.dll
FF - plugin: c:\programmi\Windows Live\Photo Gallery\NPWLPG.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-05 08:33
Windows 5.1.2600 Service Pack 3 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------

- - - - - - - > 'winlogon.exe'(632)
c:\windows.0\system32\sfc_os.dll
c:\windows.0\system32\COMRes.dll
c:\windows.0\system32\cscui.dll

- - - - - - - > 'lsass.exe'(688)
c:\windows.0\system32\scecli.dll

- - - - - - - > 'explorer.exe'(4016)
c:\windows.0\system32\SHDOCVW.dll
c:\programmi\Visual ToolTip\VisualTooltip.dll
c:\windows.0\system32\COMRes.dll
c:\windows.0\System32\cscui.dll
c:\windows.0\system32\msi.dll
c:\windows.0\system32\LINKINFO.dll
c:\windows.0\system32\ntshrui.dll
c:\windows.0\system32\wpdshserviceobj.dll
c:\windows.0\system32\portabledevicetypes.dll
c:\windows.0\system32\NETSHELL.dll
c:\windows.0\system32\credui.dll
c:\windows.0\system32\MSVCP60.dll
c:\windows.0\system32\portabledeviceapi.dll
.
Ora fine scansione: 2009-05-05 8.36.01
ComboFix-quarantined-files.txt 2009-05-05 06:35
ComboFix2.txt 2009-05-04 12:07

Pre-Run: 11.569.852.416 byte disponibili
Post-Run: 11.629.928.448 byte disponibili

185 --- E O F --- 2008-12-19 07:56

[Riverside]

[brand]

No, niente di tutto ciò.L'unica operazione sospetta che mi viene in mente è stato scaricare uno di quei programmi da un sito cinese per guardare lo sport in streaming (si chiama Tom Live Player e l'ho poi disinstallato).Riporto i link dei log:

link

link

[Riverside]

[brand]

Mi era stata consigliata da un conoscente una scansione con ComboFix e HiJack ma mi sono poi ritrovato con quei due file di report per me incomprensibili.Il mio sistema operativo è Windows Ice XP.Cosa mi consigli per capire il problema?

[Riverside]

[brand]

Procedura eseguita alla lettera.Ecco i log:

SUPERAntiSpyware Scan Log - 05-06-2009 - 19-32-26.log

mbam-log-2009-05-06 (20-20-18).txt

hijackthis.log

[brand]

Scusa li riposto:

link

link


hijackthis.log

[brand]

Scusami ancora,non capisco perchè i primi due non li prende come link,comunque copiando gli URL ci si arriva.

[Riverside]

● rilancia Hijacthis e:
● spunta la casellina fianco di ogni singola voce che ti indicherò sotto
● una volta spuntate le voci:
● chiudi tutte le applicazioni aperte
● chiudi tutte le pagine del browser aperte
● in Hijkackthis fixa le voci cliccando su Fixchecked

Queste le voci da fixare:

O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

O3 - Toolbar: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - (no file)

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize

O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Programmi\Unlocker\UnlockerAssistant.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [DrvIcon] C:\Programmi\Vista Drive Icon\DrvIcon.exe

O4 - HKLM\..\Run: [VisualTooltip] C:\Programmi\Visual ToolTip\VisualToolTip.exe

O4 - HKLM\..\Run: [WinampAgent] C:\Programmi\Winamp\winampa.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime Alternative\qttask.exe" -atboottime

O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Andrea\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe" /c

O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')

O4 - Startup: OpenOffice.org 3.0.lnk = C:\Programmi\OpenOffice.org 3\program\quickstart.exe

O4 - Startup: Styler.lnk = ?

O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE

Fixate le voci, riavvia il sistema.
Dopo il riavvio, dall'icona presente sulla traybar, cessa l'esecuzione di quella sottospecie di antivirus con cui giri (Avast SIVirus) e disinstallalo (possibilimente dal suo uninstall se è presente in Start - Tutti i Programmi) altrimenti, da Installazione Applicazioni.

Una volta eseguita la disinstallazione, esegui una pulizia con CCleaner (sia normale che pulizia del Registro), e riavvia il Sistema.

Dopo il riavvio allega un nuovo log di Hijackthis e ti farò installare un antivirus serio.

[brand]

Fatto tutto.Ecco il nuovo log:

hijackthis.log

[Riverside]

Ti sei perso per strada queste due (ripeti la stessa operazione suggerita prima)

R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Programmi\Styler\TB\StylerTB.dll

Poi, partendo dal punto 3) di questa guida scarica, installa e configura (come da guida) Avira Antivir Personal Free
Una volta conclusa la fase di configurazione, esegui una scansione completa del sistema ed allega il log che verrà rilasciato al termine della scansione.

[brand]

Anche questo è fatto.Ecco il log di Avira:

AVSCAN-20090507-054019-27935070.LOG

[Riverside]

[brand]

Fatto.A te il log:

hijackthis.log

[Riverside]

● rilancia Hijacthis e:
● spunta la casellina fianco di ogni singola voce che ti indicherò sotto
● una volta spuntate le voci:
● chiudi tutte le applicazioni aperte
● chiudi tutte le pagine del browser aperte
● in Hijkackthis fixa le voci cliccando su Fixchecked

Queste le voci da fixare:

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmi\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\RunOnce: [Uninstall getPlus(R) for Adobe] "C:\Programmi\NOS\bin\getPlus_HelperSvc.exe" /UninstallGet1noarp

O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Andrea\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe" /c

O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')

E, se non noti ancora problemi al computer, dovresti essere a posto.

[brand]

Ho fatto.Tra le voci però non ho eliminato questa perchè non c'era:

O4 - HKLM\..\RunOnce: [Uninstall getPlus(R) for Adobe] "C:\Programmi\NOS\bin\getPlus_HelperSvc.exe" /UninstallGet1noarp

Spero non sia fonte di nuovi problemi.

Per il resto ho notato che la situazione è decisamente migliorata,grazie mille Syd

P.S. Un'ultima cosa se è possibile,dato che tutta questa procedura potrebbe sempre tornare utile, volevo sapere se c'è un modo più o meno "standard" per capire quale voci fixare con Hijack in modo da farlo da solo senza dover rompere le scatole agli altri

[Riverside]