sospetto dialer.

[tris84]

Ciao a tutti...sono nuova del forum!!vi ho scoperto mentre cercavo su internet un aiuto per un problema che da giorni mi da il tormento.
Credo di aver preso un dialer in quanto la mia linea adsl "cade" dopo circa 3 minuti e tenta di riconnettersi a un numero che inizia per 899.
Ho letto in giro che i modem adsl non sono in grado di comporre altri numeri però mi scoccia il non poter stare collegata per più di 3minuti...
Prima di chiedere aiuto a voi ho fatto una scansione con:
NOd32
Spybot search and destroy
a-squared
Tutti sia in modalità provvisoria che non... In modalità provvisoria non rileva nulla, mentre in modalità normale l'a-squared mi rileva un sospetto dialer che però non elimina...
Io non so più che fare... Potrei postare un log di hijackthis oppure cosa mi consigliereste?

Confido in voi!!!!

ps. sistema operativo: windows xp.

[amvinfe]

Ciao,

scarica sul desktop
http://www.suspectfile.com/systemscan
aprilo ed assicurati che tutte le opzioni siano spuntate, clicca su "Scan Now" al termine della scansione verranno rilasciati (sempre sul desktop all'interno della cartella suspectfile) due file.
Vai su http://www.freefilehosting.net carica il file con estensione .zip e scrivi, nella tua prossima replica l'URL per poterlo scaricare.

Ricordati d'effettuare la scansione senza connessione attiva e con l'antivirus disabilitato salvo poi riattivarlo a scansione terminata.

NB
la durata della scansione può risultare lunga, potrebbe addirittura sembrare che il programma non stia lavorando, non preoccuparti non è così

[tris84]

lo faccio subito....grazie tante....

[tris84]

TUtto fatto......Questa è la URL

13_05_2008_10_17_report.zip

[tris84]

Tanto per non tralasciare nessun dettaglio ho notato che quando la mia connessione cade, in START---->CONNETTI A------->MOSTRA TUTTE LE CONNESSIONI oltre la mia, ne appare un altra chiamata WINSERVICE che tenta di connettersi senza riuscita e dopo pochi secondi scompare.
Magari non è importante ma forse può essere utile a darmi una mano!!!

[amvinfe]

scusa il ritardo ma torno dal lavoro proprio ora.

In serata ti posto la soluzione.

Grazie per la pazienza.

[tris84]

ma ci mancherebbe....grazie a te invece per l'aiuto....

[amvinfe]

altro che dialer... è presente anche un rootkit nel mbr.

Sto preparando il tutto, abbi pazienza

[amvinfe]

Scarica
http://www.ccleaner.com/download
installalo.

Scarica
http://www2.gmer.net/mbr/mbr.exe
metti l'eseguibile in C:\

Non connesso e con l'antivirus disabilitato:

- da Start>Esegui scrivi
C:\mbr.exe -f

dai l'OK

Riavvia il pc.

- Portati in Installazioni Applicazione e verifica la presenza di AskTBar, se è presente disinstallala.
Se viene chiesto il riavvio procedi.

- Apri SystemScan clicca su "Removal Script".
Allinterno del box bianco copia ed incolla i valori riportati qui sotto in rosso:

Registry values to replace with dummy:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows | AppInit_DLLs

registry values to delete:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\ShellServiceObjectDelayLoad | {42445467-183A-C20F-DD27-CF14D224B679}
HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\ShellExecuteHooks | {11635C4A-ECC7-4ED7-A172-FA5D54D3E3EE}

registry keys to delete:
HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects\{11635C4A-ECC7-4ED7-A172-FA5D54D3E3EE}
HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects\{E006915A-42F5-4FEF-A907-ED9B4E010967}
HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects\{A8D83A8E-B7D4-40D9-B0F1-60B4528DB626}
HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects\{91BA3F3A-3E16-4D3C-A7C6-D089279D5C24}
HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects\{8DBBBC71-E019-4917-8DAF-30954ED315BF}
HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects\{6166D6F6-992B-4069-8CF2-4F523205D610}
HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects\{51323C91-EE33-4AA3-8925-284255DA0455}
HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects\{2B83B087-6BCE-43F7-A6A9-ADB4C51D5543}
HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}

Folders to delete:
C:\Programmi\AskTBar

Files to delete:
C:\WINDOWS\system32\xxyxVlMg.dll
C:\WINDOWS\system32\mlJYpooO.dll
C:\WINDOWS\system32\xxywVnNE.dll
C:\WINDOWS\system32\cbXQiHXp.dll
C:\WINDOWS\system32\efcATKDv.dll
C:\WINDOWS\system32\wvUllJAs.dll
C:\WINDOWS\system32\ddcYqqOi.dll
C:\WINDOWS\system32\qoMffEXp.dll
C:\WINDOWS\system32\ENnVwyxx.ini
C:\WINDOWS\system32\ENnVwyxx.ini2
C:\WINDOWS\system32\sAJllUvw.ini
C:\WINDOWS\system32\sAJllUvw.ini2
C:\WINDOWS\system32\gMlVxyxx.ini
C:\WINDOWS\system32\gMlVxyxx.ini2
C:\WINDOWS\system32\vDKTAcfe.ini
C:\WINDOWS\system32\vDKTAcfe.ini2
C:\WINDOWS\system32\OoopYJlm.ini2
C:\WINDOWS\system32\OoopYJlm.ini
C:\WINDOWS\system32\pXHiQXbc.ini
C:\WINDOWS\system32\pXHiQXbc.ini2
C:\WINDOWS\system32\qoMffEXp.dll
C:\WINDOWS\system32\wdaol.dll
C:\WINDOWS\system32\iOqqYcdd.ini
C:\WINDOWS\system32\iOqqYcdd.ini2
C:\WINDOWS\system32\ycfOoXyb.ini
C:\WINDOWS\system32\ycfOoXyb.ini2
C:\WINDOWS\vsnpstd2.exe2033452306
C:\WINDOWS\vsnpstd2.exe2930990258
C:\WINDOWS\vsnpstd2.exe882835518
C:\WINDOWS\vsnpstd2.exe3549919376
C:\WINDOWS\vsnpstd2.exe3820832747

ora clicca su "Proceed with removal" e poi su OK.

Il pc dovrebbe riavviarsi da solo, diversamente riavvialo manualmente

Apri CCleaner>Opzioni>Avanzate
togli la spunta da
"Cancella file in windows temp......."

ora portati nuovamente sulla schermata principale, clicca in basso a dx su "Avvia pulizia"

Riavvia la macchina postami il log di avenger (lo trovi in C:\)
il log di mbrfix
ed un nuovo report di SystemScan

spero d'averti scritto tutto


PS

NB!
tutte le operazione DEVONO essere effettuate NON connesso e con l'antivirus disabilitato

[tris84]

Ho fatto tutte le operazioni, spero di aver fatto tutto giusto!!!!

QUesto è il reporto di avenger
Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Service s\vqcmjiip

*******************

Script file located at: \??\C:\WINDOWS\system32\adwjyjxb.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



Folder C:\Programmi\AskTBar not found!
Deletion of folder C:\Programmi\AskTBar failed!

Could not process line:
C:\Programmi\AskTBar
Status: 0xc0000034



File C:\WINDOWS\system32\xxyxVlMg.dll not found!
Deletion of file C:\WINDOWS\system32\xxyxVlMg.dll failed!

Could not process line:
C:\WINDOWS\system32\xxyxVlMg.dll
Status: 0xc0000034



File C:\WINDOWS\system32\mlJYpooO.dll not found!
Deletion of file C:\WINDOWS\system32\mlJYpooO.dll failed!

Could not process line:
C:\WINDOWS\system32\mlJYpooO.dll
Status: 0xc0000034



File C:\WINDOWS\system32\xxywVnNE.dll not found!
Deletion of file C:\WINDOWS\system32\xxywVnNE.dll failed!

Could not process line:
C:\WINDOWS\system32\xxywVnNE.dll
Status: 0xc0000034



File C:\WINDOWS\system32\cbXQiHXp.dll not found!
Deletion of file C:\WINDOWS\system32\cbXQiHXp.dll failed!

Could not process line:
C:\WINDOWS\system32\cbXQiHXp.dll
Status: 0xc0000034



File C:\WINDOWS\system32\efcATKDv.dll not found!
Deletion of file C:\WINDOWS\system32\efcATKDv.dll failed!

Could not process line:
C:\WINDOWS\system32\efcATKDv.dll
Status: 0xc0000034



File C:\WINDOWS\system32\wvUllJAs.dll not found!
Deletion of file C:\WINDOWS\system32\wvUllJAs.dll failed!

Could not process line:
C:\WINDOWS\system32\wvUllJAs.dll
Status: 0xc0000034



File C:\WINDOWS\system32\ddcYqqOi.dll not found!
Deletion of file C:\WINDOWS\system32\ddcYqqOi.dll failed!

Could not process line:
C:\WINDOWS\system32\ddcYqqOi.dll
Status: 0xc0000034



File C:\WINDOWS\system32\qoMffEXp.dll not found!
Deletion of file C:\WINDOWS\system32\qoMffEXp.dll failed!

Could not process line:
C:\WINDOWS\system32\qoMffEXp.dll
Status: 0xc0000034

File C:\WINDOWS\system32\ENnVwyxx.ini deleted successfully.
File C:\WINDOWS\system32\ENnVwyxx.ini2 deleted successfully.
File C:\WINDOWS\system32\sAJllUvw.ini deleted successfully.
File C:\WINDOWS\system32\sAJllUvw.ini2 deleted successfully.
File C:\WINDOWS\system32\gMlVxyxx.ini deleted successfully.
File C:\WINDOWS\system32\gMlVxyxx.ini2 deleted successfully.
File C:\WINDOWS\system32\vDKTAcfe.ini deleted successfully.
File C:\WINDOWS\system32\vDKTAcfe.ini2 deleted successfully.
File C:\WINDOWS\system32\OoopYJlm.ini2 deleted successfully.
File C:\WINDOWS\system32\OoopYJlm.ini deleted successfully.
File C:\WINDOWS\system32\pXHiQXbc.ini deleted successfully.
File C:\WINDOWS\system32\pXHiQXbc.ini2 deleted successfully.


File C:\WINDOWS\system32\qoMffEXp.dll not found!
Deletion of file C:\WINDOWS\system32\qoMffEXp.dll failed!

Could not process line:
C:\WINDOWS\system32\qoMffEXp.dll
Status: 0xc0000034

File C:\WINDOWS\system32\wdaol.dll deleted successfully.
File C:\WINDOWS\system32\iOqqYcdd.ini deleted successfully.
File C:\WINDOWS\system32\iOqqYcdd.ini2 deleted successfully.
File C:\WINDOWS\system32\ycfOoXyb.ini deleted successfully.
File C:\WINDOWS\system32\ycfOoXyb.ini2 deleted successfully.
File C:\WINDOWS\vsnpstd2.exe2033452306 deleted successfully.
File C:\WINDOWS\vsnpstd2.exe2930990258 deleted successfully.
File C:\WINDOWS\vsnpstd2.exe882835518 deleted successfully.
File C:\WINDOWS\vsnpstd2.exe3549919376 deleted successfully.
File C:\WINDOWS\vsnpstd2.exe3820832747 deleted successfully.
Registry value HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows|AppInit_DLLs replaced with dummy successfully.


Could not delete registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\ShellServiceObjectDelayLoad|{42445467-183A-C20F-DD27-CF14D224B679}
Deletion of registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\ShellServiceObjectDelayLoad|{42445467-183A-C20F-DD27-CF14D224B679} failed!
Status: 0xc0000034

Registry value HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\ShellExecuteHooks|{11635C4A-ECC7-4ED7-A172-FA5D54D3E3EE} deleted successfully.
Registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects\{11635C4A-ECC7-4ED7-A172-FA5D54D3E3EE} deleted successfully.
Registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects\{E006915A-42F5-4FEF-A907-ED9B4E010967} deleted successfully.
Registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects\{A8D83A8E-B7D4-40D9-B0F1-60B4528DB626} deleted successfully.
Registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects\{91BA3F3A-3E16-4D3C-A7C6-D089279D5C24} deleted successfully.
Registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects\{8DBBBC71-E019-4917-8DAF-30954ED315BF} deleted successfully.
Registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects\{6166D6F6-992B-4069-8CF2-4F523205D610} deleted successfully.
Registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects\{51323C91-EE33-4AA3-8925-284255DA0455} deleted successfully.
Registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects\{2B83B087-6BCE-43F7-A6A9-ADB4C51D5543} deleted successfully.
Registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects\{FE063DB1-4EC0-403e-8DD8-394C54984B2C} deleted successfully.
Program C:\Documents and Settings\User\Desktop\sys74772.exe successfully set up to run once on reboot.

Completed script processing.

*******************

Finished! Terminate.

Questo è il report di mbrfix

Stealth MBR rootkit detector 0.2.4 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK
malicious code @ sector 0x950a600 size 0x1e8 !
copy of MBR has been found in sector 62 !


Questo è il report di system scan
14_05_2008_12_24_report.zip