mi sta togliendo la vita sto virus...da tutto quello che ho letto qui sopra, dovrebbe essere un beagle o giù di li...sto bastardo nn mi fa accedere alle pagine web ufficiali degli antivirus....e ad ogni modo, non me li fa installare...ho provato con avg e avast...
seguendo varie istruzioni, mi sono dapprima cimentato con findykill e poi ci sono passato sopra con combofix. vi prego aiutatemi altrimenti posso ufficialmente dichiararmi in un mare di...di...ehm, lasciamo perdere dai...vi posto il log venuto fuori da combofix...
oh, grazie a tutti...
ComboFix 09-09-16.05 - archivio 17/09/2009 19.13.21.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1252.39.1040.18.1023.738 [GMT 2:00]
Eseguito da: c:\documents and settings\archivio\Desktop\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))) )
.
c:\documents and settings\archivio\Dati applicazioni\bcrypt.html
c:\recycler\S-1-5-21-2328158976-2851905619-555882660-7458
c:\recycler\S-1-5-21-2505850652-4675211581-599699662-6546
c:\recycler\S-1-5-21-2505850652-4675211581-599699662-6546\Desktop.ini
c:\recycler\S-1-5-21-2505850652-4675211581-599699662-6546\winmap.exe
c:\windows\system32\iexplore.exe
c:\windows\system32\msvcrt2.dll
c:\windows\system32\sysmgr.exe
c:\windows\system32\winamp.exe
c:\windows\system32\qmgr.dll . . . è infetto!!
.
((((((((((((((((((((((((((((((((((((((( Driver/Servizi )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_BNDMSS
-------\Service_BNDMSS
((((((((((((((((((((((((( Files Creati Da 2009-08-17 al 2009-09-17 )))))))))))))))))))))))))))))))))))
.
2009-09-17 16:53 . 2009-09-17 16:53 69632 ----a-w- c:\windows\system32\qcgwqfj.exe
2009-09-17 16:53 . 2009-09-17 16:53 105984 ----a-w- c:\windows\system32\idmqeiuc.exe
2009-09-17 16:51 . 2009-09-17 16:51 49152 ----a-w- c:\windows\system32\ejnqj.exe
2009-09-17 16:33 . 2009-09-17 16:33 49152 ----a-w- c:\windows\system32\zbli.exe
2009-09-17 16:25 . 2009-09-17 16:25 69632 ----a-w- c:\windows\system32\qavlng.exe
2009-09-17 16:25 . 2009-09-17 16:25 105984 ----a-w- c:\windows\system32\mcmnul.exe
2009-09-17 15:48 . 2009-09-17 16:42 -------- d-----w- C:\FindyKill
2009-09-17 13:31 . 2009-09-17 13:31 105984 ----a-w- c:\windows\system32\moceua.exe
2009-09-17 13:31 . 2009-09-17 13:31 69632 ----a-w- c:\windows\system32\hduq.exe
2009-09-17 13:30 . 2009-09-17 13:30 49152 ----a-w- c:\windows\system32\orblmtpa.exe
2009-09-17 13:04 . 2009-09-17 13:04 0 ----a-w- c:\windows\nsreg.dat
2009-09-17 13:04 . 2009-09-17 13:04 -------- d-----w- c:\documents and settings\archivio\Impostazioni locali\Dati applicazioni\Mozilla
2009-09-17 13:01 . 2009-09-17 13:02 -------- d-----w- c:\documents and settings\archivio\Impostazioni locali\Dati applicazioni\Google
2009-09-17 12:59 . 2009-09-17 13:15 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Spybot - Search & Destroy
2009-09-17 12:59 . 2009-09-17 13:01 -------- d-----w- c:\programmi\Spybot - Search & Destroy
2009-09-17 12:54 . 2009-09-17 12:54 69632 ----a-w- c:\windows\system32\ftbokj.exe
2009-09-17 12:54 . 2009-09-17 12:54 105984 ----a-w- c:\windows\system32\lnfnuli.exe
2009-09-17 12:54 . 2009-09-17 12:54 -------- d-----w- c:\windows\OPTIONS
2009-09-17 12:54 . 1999-12-23 09:04 41852 ----a-r- c:\windows\system32\UpdDrv2K.exe
2009-09-17 12:50 . 2001-08-30 17:48 36096 -c--a-w- c:\windows\system32\dllcache\isapnp.sys
2009-09-17 12:50 . 2001-08-30 17:48 36096 ----a-w- c:\windows\system32\drivers\isapnp.sys
2009-09-17 12:50 . 2002-09-09 11:35 63488 -c--a-w- c:\windows\system32\dllcache\pci.sys
2009-09-17 12:50 . 2002-09-09 11:35 63488 ----a-w- c:\windows\system32\drivers\pci.sys
2009-09-17 12:50 . 2003-05-20 17:20 53248 ------w- c:\windows\system32\SETUPVIA.DLL
2009-09-17 12:50 . 2003-05-20 17:20 70272 ----a-r- c:\windows\system32\drivers\viaraid.sys
2009-09-17 12:50 . 2009-09-17 12:50 -------- d-----w- c:\programmi\VIA
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) )
.
2009-09-17 12:54 . 2008-05-25 12:00 -------- d-----w- c:\programmi\File comuni\InstallShield
2009-09-17 12:51 . 2009-09-17 12:51 -------- d-----w- c:\programmi\Intel
2009-09-17 12:50 . 2008-05-25 12:00 -------- d--h--w- c:\programmi\InstallShield Installation Information
2002-09-09 11:50 . 2002-09-09 11:50 161768 --sha-r- c:\windows\system32\ulylxsd.dll
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"MSMSGS"="c:\programmi\Messenger\msmsgs.exe" [2002-08-20 1511453]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"ATIPTA"="c:\programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-29 339968]
"DVDTray"="c:\programmi\Ahead\ODD Toolkit\DVDTray.exe" [2004-09-03 65536]
"SoundMAXPnP"="c:\programmi\Analog Devices\SoundMAX\SMax4PNP.exe" [2003-05-29 790528]
"SpeedTouch USB Diagnostics"="c:\programmi\Alcatel\SpeedTouch USB\Dragdiag.exe" [2002-11-12 860672]
c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Adobe Reader Speed Launch.lnk.disabled [2008-7-15 1737]
[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\run-]
"12CFG214-K641-12SF-N55P"=c:\recycler\S-1-5-21-0243936033-3052116371-385863508-1815\vsrah.exe
"32NFG94-H61-2SF-N1P-5M1ERH6L6"=c:\recycler\S-1-5-21-0532613747-5759964151-978487440-9622\winIgn.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\run-]
"Microsoft Internet Explorer"=c:\windows\System32\iexplore.exe
"NeroFilterCheck"=c:\windows\system32\NeroCheck.ex e
R0 viaraid;viaraid;c:\windows\system32\drivers\viarai d.sys [17/09/2009 14.50.28 70272]
S2 jehhcw;Center Update;c:\windows\system32\svchost.exe -k netsvcs [13/09/2002 16.22.58 12800]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
jehhcw
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm
TCP: {ADC3BC4C-2BBD-4324-9CD6-610CE86C7B0A} = 208.67.222.222
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\archivio\Dati applicazioni\Mozilla\Firefox\Profiles\5z5et2a1.def ault\
.
- - - - CHIAVI ORFANE RIMOSSE - - - -
HKLM-Run-Microsoft(R) System Manager - c:\windows\system32\sysmgr.exe
************************************************** ************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-17 19:17
Windows 5.1.2600 Service Pack 1 NTFS
scansione processi nascosti ...
scansione entrate autostart nascoste ...
Scansione files nascosti ...
Scansione completata con successo
Files nascosti: 0
************************************************** ************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\j ehhcw]
"ServiceDll"="c:\windows\System32\ulylxsd.dll"
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{1911415 6-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\System32\\Macrome d\\Flash\\FlashUtil10c.exe,-101"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{1911415 6-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{1911415 6-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\System32\\Macromed\\Flash\\FlashUt il10c.exe"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{1911415 6-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4 C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4 C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4 C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------
- - - - - - - > 'winlogon.exe'(716)
c:\windows\System32\ODBC32.dll
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'lsass.exe'(772)
c:\windows\System32\dssenh.dll
- - - - - - - > 'explorer.exe'(1788)
c:\windows\System32\msi.dll
c:\programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
c:\windows\System32\ODBC32.dll
c:\programmi\Microsoft Office\OFFICE11\msohev.dll
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\programmi\File comuni\LightScribe\LSSrvc.exe
c:\programmi\Analog Devices\SoundMAX\SMAgent.exe
c:\windows\system32\ati2evxx.exe
.
************************************************** ************************
.
Ora fine scansione: 2009-09-17 19.19.02 - Il pc è stato riavviato
ComboFix-quarantined-files.txt 2009-09-17 17:19
Pre-Run: 70.436.528.128 byte disponibili
Post-Run: 70.369.583.104 byte disponibili
winxpsp1_it_pro_bf.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOW S
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Micro soft Windows XP Professional" /fastdetect
160
Rispondi quotando
