Ciao a tutti ! Ciao Habanero se mi leggi !
C'é in giro qualche santo che mi può dare un indicazione ?
Ho un problema :
Avast! ha pizzicato Win32 Neptunia-WB [Trj] in un file compresso (taskmanager17.exe) che ho scaricato da non so più dove per installare un progr. chiamato Security Task Manager.
E' infetto anche il file .exe nella cartella programmi (Taskman.exe).
Il resto, nella cartella del programma sembra normale, c'é anche un link ad un sito
www.neuber.com/taskmanager da dove ho scaricato un'altro file compresso (per la stessa applicazione) che Avast! segnala come pulito. Boh !
Eppure, sono giorni e giorni che ho dei timout su vari servizi:
Timout..si, non TimEout...!???
Timout (30000 millisecondi) durante l'attesa della risposta alla transazione dal servizio TrkWks / idem x: servizio ShellHWDetection / idem x: servizio dmserver / idem x: servizio SharedAccess.
Timeout che fra l'altro mi impallano anche Acronis TrueImageEchoWorkstation che ho appena installato.
Le domande sono:
cosa potrà aver combinato il trojan ?
qualcuno può essere entrato nel mio PC ed aver letto i miei dati o peggio rubati ?
come posso porcedere alla disinstallazione degli altri componenti il programma, che non sono stati messi nel cestino virus di Avast! ?
C'é un legame fra sto virus ed i Timeout ?
Ho fatto uno scan completo sempre con Avast! e non segnala nulla.
Qui sotto metto il report di Hijack, allego il report di Avast! ed un jpg della descrizione del virus. Che dire......aiutooooo !!! : )
Scherzi a parte, tante grazie al Santo che vorrà gentilmente rispondere a questa mia, aiutando coloro che non sanno cavarsela da soli.
Ciao a tutti, grazie.
Avast!
30/05/2008 6.07.05 Bubu 3380 Sign of "Win32:Neptunia-WB [Trj]" has been found in "C:\Documents and Settings\Bubu\Desktop\Utility\taskmanager17.exe\Ta skMan.exe" file.
30/05/2008 12.38.16 Bubu 3380 Sign of "Win32:Neptunia-WB [Trj]" has been found in "C:\Documents and Settings\Bubu\Desktop\Utility\taskmanager17.exe" file.
30/05/2008 13.05.06 Bubu 3380 Sign of "Win32:Neptunia-WB [Trj]" has been found in "C:\Programmi\Security Task Manager\TaskMan.exe" file.
30/05/2008 13.07.58 SYSTEM 480 Sign of "Win32:Neptunia-WB [Trj]" has been found in "C:\Programmi\Security Task Manager\TaskMan.exe" file.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1.13.41, on 31/05/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\File comuni\EPSON\EBAPI\eEBSVC.exe
C:\Programmi\File comuni\Acronis\Schedule2\schedul2.exe
C:\WINDOWS\System32\dllhost.exe
C:\Programmi\File comuni\EPSON\EBAPI\eEBAgent.exe
C:\WINDOWS\System32\GEARSec.exe
C:\WINDOWS\system32\mgabg.exe
C:\Programmi\WinPcap\rpcapd.exe
C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\dllhost.exe
C:\Programmi\UPHClean\uphclean.exe
C:\WINDOWS\System32\vssvc.exe
C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programmi\VIA\RAID\raid_tool.exe
C:\WINDOWS\system32\PDesk\PDesk.exe
C:\Programmi\File comuni\InterVideo\FastTVSync\FastTVSync.exe
C:\Programmi\EPSON\Creativity Suite\Event Manager\EEventManager.exe
C:\Programmi\Unlocker\UnlockerAssistant.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programmi\Windows Defender\MSASCui.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Acronis\TrueImageEchoWorkstation\True ImageMonitor.exe
C:\Programmi\Acronis\TrueImageEchoWorkstation\Timo unterMonitor.exe
C:\Programmi\File comuni\Acronis\Schedule2\schedhlp.exe
C:\Programmi\DU Meter\DUMeter.exe
C:\Programmi\Java\jre1.6.0_06\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\Microsoft Office\Office\OUTLOOK.EXE
C:\WINDOWS\msagent\AgentSvr.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\PROGRA~1\CLARIS~1\FILEMA~1.0\FILEMA~1.EXE
C:\Programmi\Acronis\TrueImageEchoWorkstation\True Image.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Programmi\Adobe\Photoshop 7.0\Photoshop.exe
C:\Documents and Settings\Bubu\Documenti\Z thebrain Aleks\Z Registro di Sistema\HiJackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [RaidTool] C:\Programmi\VIA\RAID\raid_tool.exe
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINDOWS\system32\PDesk\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [FastTVSync] "C:\Programmi\File comuni\InterVideo\FastTVSync\FastTVSync.exe"
O4 - HKLM\..\Run: [EEventManager] C:\Programmi\EPSON\Creativity Suite\Event Manager\EEventManager.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [MGA_CD_Install] D:\mgasetup.exe /No_Welcome /Lang:Italiano
O4 - HKLM\..\Run: [Matrox PowerSpace] "C:\Programmi\Matrox Graphics Inc\PowerSpace\PowerSpace.exe" /StartUp
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Programmi\Unlocker\UnlockerAssistant.exe" -H
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Programmi\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Programmi\Acronis\TrueImageEchoWorkstation\True ImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Programmi\Acronis\TrueImageEchoWorkstation\Timo unterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Programmi\File comuni\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [DU Meter] C:\Programmi\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_06\bin\jusched.exe "
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: ERUNT AutoBackup.lnk = C:\Programmi\ERUNT\AUTOBACK.EXE
O4 - Startup: taskmgr.exe.lnk = C:\WINDOWS\system32\taskmgr.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Programmi\VIA\RAID\raid_tool.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=67633
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1202221123371
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD42/JSCDL/...ws-i586-jc.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D05F6632-5C65-4B0F-91F1-169DA6331DBA}: NameServer = 212.183.164.11
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Programmi\File comuni\Acronis\Schedule2\schedul2.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: EpsonBidirectionalAgent - SEIKO EPSON CORPORATION - C:\Programmi\File comuni\EPSON\EBAPI\eEBAgent.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Programmi\File comuni\EPSON\EBAPI\eEBSVC.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programmi\File comuni\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: MGABGEXE - Matrox Graphics Inc. - C:\WINDOWS\system32\mgabg.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Programmi\WinPcap\rpcapd.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programmi\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
--
End of file - 8618 bytes
Rispondi quotando