Chiedo aiuto (con screenshot)

[birikkino]

Ciao a tutti. Ho provato a seguire le istruzioni che ci sono nella guida in evidenza nel topic ma continuo ad avere il problema. Spero possiate aiutarmi: dopo un pò che il browser è aperto mi si aprono altre finestre come quella in allegato e mi viene chiesto di scaricare un certo "fast track". Che posso fare? Se volete posso postare un report di hijackthis...

[tecnico24]

fast track e una dialer/trojan che danneggia gravemente il sistema.
posta un report di hijackthis.

[birikkino]

Eccolo:

Logfile of HijackThis v1.99.1
Scan saved at 18.54.55, on 25/08/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmi\Promise\Utility\MsgAgt.exe
C:\Programmi\Promise\Utility\MsgSvr.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Venturi2\Client\ventc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Programmi\UltraVNC\WinVNC.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Programmi\QuickTime\qttask.exe
C:\Programmi\iTunes\iTunesHelper.exe
C:\WINNT\NETVISION.exe
C:\WINNT\system32\ctfmon.exe
C:\programmi\WCESCOMM.EXE
C:\Programmi\Blues2002\Bminer.exe
C:\Programmi\Blues2002\Bluesrec1\BRec2000.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\Documents and Settings\VILLAM\Desktop\CARTELLA DARIO\Picture Package Menu\SonyTray.exe
C:\Documents and Settings\VILLAM\Desktop\CARTELLA DARIO\Picture Package Applications\Residence.exe
C:\Programmi\Q-Type Pro\MagicKey.exe
C:\Program Files\Venturi2\Configurator\ventcfg.exe
C:\Programmi\Q-Type Pro\OSD.EXE
C:\Programmi\Q-Type Pro\MulMouse.exe
C:\Programmi\iTunes\iTunes.exe
C:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dalcorsohotellerie.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Programmi\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_0.dll
O2 - BHO: MSX - {037CE595-57CB-4EB5-9775-97BC112F3BB3} - C:\WINNT\system32\msx.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Active sync - {25E1A054-1262-459F-9F14-BF06148F4253} - C:\WINNT\system32\kaboom.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_0.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [WinVNC] "C:\Programmi\UltraVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [FASTTRACKNETVISION] C:\WINNT\NETVISION.exe -A
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\programmi\WCESCOMM.EXE"
O4 - HKCU\..\Run: [FASTTRACKNETVISION] C:\WINNT\NETVISION.exe -A
O4 - Global Startup: Blue's Miner 2002.lnk = C:\Programmi\Blues2002\Bminer.exe
O4 - Global Startup: Blue's Recorder COM1.lnk = C:\Programmi\Blues2002\Bluesrec1\BRec2000.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Picture Package Menu.lnk = C:\Documents and Settings\VILLAM\Desktop\CARTELLA DARIO\Picture Package Menu\SonyTray.exe
O4 - Global Startup: Picture Package VCD Maker.lnk = C:\Documents and Settings\VILLAM\Desktop\CARTELLA DARIO\Picture Package Applications\Residence.exe
O4 - Global Startup: Q-Type Pro.lnk = C:\Programmi\Q-Type Pro\MagicKey.exe
O4 - Global Startup: Venturi 2.lnk = C:\Program Files\Venturi2\Configurator\ventcfg.exe
O9 - Extra button: Crea preferiti portatile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - c:\programmi\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - c:\programmi\inetrepl.dll
O9 - Extra 'Tools' menuitem: Crea preferiti portatile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - c:\programmi\inetrepl.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O12 - Plugin for .spop: C:\Programmi\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {08BEF711-06DA-48B2-9534-802ECAA2E4F9} (PlxInstall Class) - https://www.plaxo.com/down/latest/PlaxoInstall.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} (iNotes Class) - https://www.fgapostoffice.com/iNotes.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yaho...st20040510.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1131007850562
O16 - DPF: {8D7AFAB7-42D6-4671-A53E-CD355673F026} (SonySncMView Control) - http://192.168.0.249/SonySncMView.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://www.quinordest.it/traffico/AxisCamControl.ocx
O16 - DPF: {DB893839-10F0-4AF9-92FA-B23528F530AF} - http://deposito.quickstaraccess.com/11836-23.exe
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = HotelVillaFranceschi.local
O17 - HKLM\System\CCS\Services\Tcpip\..\{76D7EA0A-0B07-4B1E-9691-EC1AD829AEC4}: NameServer = 192.168.0.2,213.21.141.2
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = HotelVillaFranceschi.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = HotelVillaFranceschi.local
O20 - Winlogon Notify: igfxcui - igfxsrvc.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Servizio amministrativo di Gestione disco logico (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: Promise RAID message agent (RAIDmAgt) - Unknown owner - C:\Programmi\Promise\Utility\MsgAgt.exe
O23 - Service: Promise RAID message server (RAIDmSvr) - Unknown owner - C:\Programmi\Promise\Utility\MsgSvr.exe
O23 - Service: Venturi2 Client (Venturi2) - Fourelle Systems, Inc - C:\Program Files\Venturi2\Client\ventc.exe
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Programmi\UltraVNC\WinVNC.exe" -service (file missing)

[tecnico24]

ciao,avvia hijackthis,spunta a sinistra su queste voci:

O20 - Winlogon Notify: igfxcui - igfxsrvc.dll (file missing)
O16 - DPF: {DB893839-10F0-4AF9-92FA-B23528F530AF} - http://deposito.quickstaraccess.com/11836-23.exe
O16 - DPF: {8D7AFAB7-42D6-4671-A53E-CD355673F026} (SonySncMView Control) - http://192.168.0.249/SonySncMView.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yah...nst20040510.cab
O4 - Global Startup: Picture Package VCD Maker.lnk = C:\Documents and Settings\VILLAM\Desktop\CARTELLA DARIO\Picture Package Applications\Residence.exe
O4 - Global Startup: Blue's Miner 2002.lnk = C:\Programmi\Blues2002\Bminer.exe
O4 - HKCU\..\Run: [FASTTRACKNETVISION] C:\WINNT\NETVISION.exe -A
O4 - HKLM\..\Run: [FASTTRACKNETVISION] C:\WINNT\NETVISION.exe -A
O2 - BHO: Active sync - {25E1A054-1262-459F-9F14-BF06148F4253} - C:\WINNT\system32\kaboom.dll (file missing)
O2 - BHO: MSX - {037CE595-57CB-4EB5-9775-97BC112F3BB3} - C:\WINNT\system32\msx.dll (file missing)

poi clicca sotto su fix checked.





poi
scarica The Avenger
http://swandog46.geekstogo.com/avenger.zip
Avvia il programma,clicca su Input Script Manually
clicca sulla icona con la lente di ingrandimento
si aprirà una nuova finestra con scritto View/edit script

In quella finestra bianca copia e incolla (ctrl+v) le scritte:


files to delete:
C:\WINNT\NETVISION.exe
C:\Programmi\Blues2002\Bminer.exe


poi su done,sul semaforo,due volte si,riavvia il pc e postami qui il logfile di avenger che si trova in c:|avenger.txt
poi penso sia tutto pulito.

[birikkino]

Ora sembra ok...grazie 1000 !

[ste_95]

per sicurezza se ne vuoi postare il log come detto da tecnico:

...postami qui il logfile di avenger che si trova in c:|avenger.txt...

se poi vuoi avere un controllo fai una scansione sul sito della kaspersky e poi postane il log...

[birikkino]

Ops...ho dimenticato di postare il log di avenger...sorry. Il computer era quello che ho a lavoro...mi sa che hanno cancellato tutto ora. Se dovessi riavere problemi cmq riscrivo ok? Grazie 1000 intanto.