portatile che non naviga (log di hijack this e processi sospetti)

**blekm** · 10-09-2006, 13:10

Win Xp Home Edition.

scansione con Ad-Aware, Spybot, AntiVir Pe (aggiornato al 31/05/2006) Ewido. Cancellato quello che aveva trovato (tra cui tr/crypt.f.gen).

Non ci sono conflitti hardware, da quel punto di vista è tutto ok.
Sto provando a scaricare l'aggiornamento manuale per AntiVir Pe da un altro pc, per vedere se riesco ad installarlo sul portatile.
Non chiedetemi di scaricare grossi file, ho solo la linea 56k..

Però il portatile non naviga, e non riesco proprio a capire perchè.

Ecco una lista di processi sospetti, a mio parere, che si trovano all'avvio in Task Manager
csrss.exe
csscv.exe
ctrl.vol
lsass.exe
sched.exe
services.exe
smss.exe
soundman.exe
spoolsvc.exe
spoolsv.exe
syntpenh.exe
syntplpr.exe
wbutton.exe

ecco il log di Hijack This.

Logfile of HijackThis v1.99.1
Scan saved at 12.48.03, on 10/09/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\AntiVir PersonalEdition Classic\sched.exe
C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe
C:\Programmi\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\system32\csscv.exe
C:\PROGRA~1\OUTPOS~1.0\outpost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\PowerKey.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\CtrlVol.exe
C:\Program Files\Launch Manager\OSDCtrl.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC 2.EXE
D:\Programmi\HP\HP Software Update\HPWuSchd2.exe
C:\Programmi\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsvc.exe
C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Programmi\Nikon\NkView6\NkvMon.exe
C:\Programmi\HP\hpcoretech\comp\hptskmgr.exe
D:\Programmi\HP\Digital Imaging\bin\hpqgalry.exe
C:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.luccaportal.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Programmi\Outlook Express\msimn.exe"
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [preload] C:\Windows\RUNXMLPL.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LtMoh] C:\Programmi\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe
O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey.exe"
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\HotkeyApp.exe
O4 - HKLM\..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe
O4 - HKLM\..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSDCtrl.exe
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [EPSON Stylus C64 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC 2.EXE /P23 "EPSON Stylus C64 Series" /O6 "USB001" /M "Stylus C64"
O4 - HKLM\..\Run: [HP Software Update] "D:\Programmi\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Programmi\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [Spooler SubSystem App] C:\WINDOWS\system32\spoolsvc.exe
O4 - HKLM\..\Run: [ChkMail] C:\Program Files\Launch Manager\ChkMail.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Outpost Firewall] "C:\Programmi\Outpost Firewall 1.0\outpost.exe" /waitservice
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ChkMail] C:\Program Files\Launch Manager\ChkMail.exe
O4 - Global Startup: Avvio rapido di HP Image Zone.lnk = D:\Programmi\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = D:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Programmi\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NkvMon.exe.lnk = D:\Programmi\Nikon\NkView6\NkvMon.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmi\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programmi\ewido anti-malware\ewidoctrl.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum - C:\PROGRA~1\OUTPOS~1.0\outpost.exe

qualche dritta? consigli?

**blekm** · 10-09-2006, 15:58

aggiornamento: ho fatto la scansione con AntivirPE aggiornato, ed il log è questo:

AntiVir PersonalEdition Classic
Report file date: domenica 10 settembre 2006 14:02

Scanning for 500490 virus strains and unwanted programs.

Licensed to: AntiVir PersonalEdition Classic
Serial number: 0000149996-WURGE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: marikar
Computer name: MARIKA

Version informations:
AVSCAN.EXE : 7.0.0.42 557096 09/09/2006 18:28:32
AVSCAN.DLL : 7.0.0.42 53288 09/09/2006 18:28:32
LUKE.DLL : 7.0.0.42 118824 09/09/2006 18:28:32
LUKERES.DLL : 7.0.0.42 25640 09/09/2006 18:28:32
ANTIVIR0.VDF : 6.35.0.1 7371264 09/09/2006 18:28:31
ANTIVIR1.VDF : 6.35.1.122 1270784 09/09/2006 18:28:31
ANTIVIR2.VDF : 6.35.1.200 237056 09/09/2006 18:28:31
ANTIVIR3.VDF : 6.35.1.208 17920 09/09/2006 18:28:31
AVEWIN32.DLL : 7.1.1.16 1835520 09/09/2006 18:28:31
AVPREF.DLL : 7.0.0.1 49192 09/09/2006 18:28:32
AVREP.DLL : 6.35.1.191 794664 09/09/2006 18:28:32
AVRPBASE.DLL : 7.0.0.0 2162728 09/09/2006 18:28:32
AVPACK32.DLL : 7.1.0.1 335912 09/09/2006 18:28:32
AVREG.DLL : 6.31.0.90 27688 09/09/2006 18:28:32
NETNT.DLL : 6.32.0.0 6696 09/09/2006 18:28:32
NETNW.DLL : 6.32.0.0 9768 09/09/2006 18:28:32
RCIMAGE.DLL : 7.0.0.71 1642536 09/09/2006 18:28:33
RCTEXT.DLL : 7.0.0.75 77864 09/09/2006 18:28:33

Configuration settings for the scan:
Jobname: '%s'.................: Manual Selection
Configuration file............: C:\Documents and Settings\All Users\Dati applicazioni\AntiVir PersonalEdition Classic\PROFILES\folder.avp
Boot sectors..................: C,D
Scan memory...................: 1
Process scan..................: 1
Scan all files................: 1
Scan archives.................: 1
Recursion depth...............: 20
Smart extensions..............: 1
Macro heuristic...............: 1
File heuristic................: -1
Primary action................: 1
Secondary action..............: 0

Start of the scan: domenica 10 settembre 2006 14:02

The scan over running processes will be started
C:\WINDOWS\system32\spoolsvc.exe
[DETECTION] Is the Trojan horse TR/PSW.Lineage.aeh.1
[INFO] The file was deleted!

45 Processes was scanned

Start scanning boot sectors:

Boot sector 'C:\'
[NOTE] No virus was found!
Boot sector 'D:\'
[NOTE] No virus was found!

Starting to scan the registry.

The registry was scanned ( 39 files ).

Starting the file scan:

C:\pagefile.sys
[WARNING] The file could not be opened!
C:\hiberfil.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\scmt16.exe
[DETECTION] Is the Trojan horse TR/Dldr.Small.dib.3
[INFO] The file was deleted!
C:\WINDOWS\system32\config\system.LOG
[WARNING] The file could not be opened!
C:\WINDOWS\system32\config\software.LOG
[WARNING] The file could not be opened!
C:\WINDOWS\system32\config\default.LOG
[WARNING] The file could not be opened!
C:\WINDOWS\system32\config\SECURITY
[WARNING] The file could not be opened!
C:\WINDOWS\system32\config\SAM
[WARNING] The file could not be opened!
C:\WINDOWS\system32\config\SAM.LOG
[WARNING] The file could not be opened!
C:\WINDOWS\system32\config\SECURITY.LOG
[WARNING] The file could not be opened!
C:\WINDOWS\system32\config\SYSTEM
[WARNING] The file could not be opened!
C:\WINDOWS\system32\config\SOFTWARE
[WARNING] The file could not be opened!
C:\WINDOWS\system32\config\DEFAULT
[WARNING] The file could not be opened!
C:\Documents and Settings\NetworkService\NTUSER.DAT
[WARNING] The file could not be opened!
C:\Documents and Settings\NetworkService\ntuser.dat.LOG
[WARNING] The file could not be opened!
C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat
[WARNING] The file could not be opened!
C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG
[WARNING] The file could not be opened!
C:\Documents and Settings\LocalService\NTUSER.DAT
[WARNING] The file could not be opened!
C:\Documents and Settings\LocalService\ntuser.dat.LOG
[WARNING] The file could not be opened!
C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat
[WARNING] The file could not be opened!
C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG
[WARNING] The file could not be opened!
C:\Documents and Settings\marikar\NTUSER.DAT
[WARNING] The file could not be opened!
C:\Documents and Settings\marikar\ntuser.dat.LOG
[WARNING] The file could not be opened!
C:\Documents and Settings\marikar\Impostazioni locali\Temp\newsploit.exe
[DETECTION] Is the Trojan horse TR/Dldr.Small.dib.3
[INFO] The file was deleted!
C:\Documents and Settings\marikar\Impostazioni locali\Temp\a.exe
[DETECTION] Is the Trojan horse TR/Dldr.Small.dib.3
[INFO] The file was deleted!
C:\Documents and Settings\marikar\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG
[WARNING] The file could not be opened!
C:\Documents and Settings\marikar\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat
[WARNING] The file could not be opened!
C:\System Volume Information\_restore{BAAE55C2-8AA3-44CE-8A5D-1CF73D62D0CA}\RP17\A0014016.EXE
[DETECTION] Is the Trojan horse TR/PSW.Lineage.aeh.1
[INFO] The file was deleted!
C:\System Volume Information\_restore{BAAE55C2-8AA3-44CE-8A5D-1CF73D62D0CA}\RP17\A0014017.exe
[DETECTION] Is the Trojan horse TR/Dldr.Small.dib.3
[INFO] The file was deleted!

End of the scan: domenica 10 settembre 2006 14:21
Used time: 18:53 min

The scan has been done completely.

2725 Scanning directories
144988 Files were scanned
7 viruses and/or unwanted programs was found
6 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
6038 Archives were scanned
24 Warnings
1 Notes

non ci sono più tracce di file sospetti/dannosi. Scansioni aggiornate con Spybot, Ad Aware, AntivirPE.
Riesco a connettermi, però non naviga...

**LUCASS** · 10-09-2006, 17:50

Il pc è infetto,senza che mi dilungo con te

Termina il processo spoolsvc.exe
(non confonderlo con il leggittimo spoolsv.exe)

Avvi Hijackthis,clicca su "Open the misc tools section"
"Delete a file on reboot"
Inserisci questo percorso
C:\WINDOWS\system32\spoolsvc.exe
Clicca su "Apri" ti chiederà il riavvio non riavviare
Clicca sul pulsante "Back"(in basso a destra)
Clicca su "Scan"

Dalla lista elimina:
O4 - HKLM\..\Run: [Spooler SubSystem App] C:\WINDOWS\system32\spoolsvc.exe

Riavvia il pc ed aggiorna il sistema

**blekm** · 10-09-2006, 18:43

ho fatto come dicevi tu, eccoti il nuovo log. Non riesco ancora a navigare. I due computerini non comunicano...

Logfile of HijackThis v1.99.1
Scan saved at 18.41.14, on 10/09/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\csscv.exe
C:\PROGRA~1\OUTPOS~1.0\outpost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Programmi\ltmoh\Ltmoh.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\PowerKey.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\CtrlVol.exe
C:\Program Files\Launch Manager\OSDCtrl.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC 2.EXE
D:\Programmi\HP\HP Software Update\HPWuSchd2.exe
C:\Programmi\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Programmi\HP\Digital Imaging\bin\hpqgalry.exe
D:\Programmi\Nikon\NkView6\NkvMon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Programmi\Outlook Express\msimn.exe"
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [preload] C:\Windows\RUNXMLPL.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LtMoh] C:\Programmi\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe
O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey.exe"
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\HotkeyApp.exe
O4 - HKLM\..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe
O4 - HKLM\..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSDCtrl.exe
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [EPSON Stylus C64 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC 2.EXE /P23 "EPSON Stylus C64 Series" /O6 "USB001" /M "Stylus C64"
O4 - HKLM\..\Run: [HP Software Update] "D:\Programmi\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Programmi\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [ChkMail] C:\Program Files\Launch Manager\ChkMail.exe
O4 - HKLM\..\Run: [Outpost Firewall] "C:\Programmi\Outpost Firewall 1.s0\outpost.exe" /waitservice
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ChkMail] C:\Program Files\Launch Manager\ChkMail.exe
O4 - Global Startup: Avvio rapido di HP Image Zone.lnk = D:\Programmi\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = D:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Programmi\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NkvMon.exe.lnk = D:\Programmi\Nikon\NkView6\NkvMon.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum - C:\PROGRA~1\OUTPOS~1.0\outpost.exe

**LUCASS** · 10-09-2006, 18:44

Adsl e connettività

**LUCASS** · 10-09-2006, 18:48

ma questo processo ctrl.vol che è? :master: :master:

**blekm** · 10-09-2006, 22:22

Originariamente inviato da LUCASS

Adsl e connettività

che dici, devo postare in ADSL e connettività? Non mi pare, visto che mi hai fatto rimuovere delle voci..

Originariamente inviato da LUCASS
ma questo processo ctrl.vol che è? :master: :master:

non ne ho la più pallida idea.

**holifay** · 11-09-2006, 13:10

Ciao Blekm,
puoi inviare questo file a suspectfile?
C:/WINDOWS/system32/csscv.exe

Dopo di che, direi di eliminarlo:
http://fileinfo.prevx.com/adware/qqf...CSSCV.EXE.html

**blekm** · 11-09-2006, 20:21

Originariamente inviato da holifay
Ciao Blekm,
puoi inviare questo file a suspectfile?
C:/WINDOWS/system32/csscv.exe

Dopo di che, direi di eliminarlo:
http://fileinfo.prevx.com/adware/qqf...CSSCV.EXE.html

ti ho inviato il file, come volevi.

proverò ad eseguire questo file che mi stai facendo scaricare, sperando che la connessione torni a funzionare..

domani ti farò sapere se ho risolto o meno.

**holifay** · 11-09-2006, 22:48

Grazie Blekm, non so se risolverai il problema della connessione, ma almeno lo abbiamo inviato alle aziede che ancora non lo riconoscono.

E\' una backdoor
http://www.suspectfile.com/forum/viewtopic.php?t=306

Discussione: portatile che non naviga (log di hijack this e processi sospetti)

Strumenti discussione

Ricerca discussione

Visualizza

portatile che non naviga (log di hijack this e processi sospetti)

Permessi di invio