Notebook con diversi trojan.

[darkkik]

Ciao a tutti

Ho sottomano un notebook che definire pieno è poco...

Primo problema: all'avvio non partiva explorer.exe, risolto con un topic di deifobe.

Lanciato spybot, qualche voce l'ha rimossa, ma non riesce a immunizzare completamente il sistema.

Ho riscontrato: spoolw.exe, igfxsvc.exe, XP Antivirus, etc etc...qualcosa è stato ripulito, ma è ancora lontano dall'essere a posto.

posto un log di hijackthis confidando in voi:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16.19.28, on 10/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Programmi\HPQ\IAM\bin\asghost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Programmi\Analog Devices\Core\smax4pnp.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\WINDOWS\SMINST\Scheduler.exe
C:\Programmi\File comuni\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\1\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: HP Credential Manager for ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Programmi\HPQ\IAM\Bin\ItIeAddIN.dll
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Programmi\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Programmi\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Programmi\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [Scheduler] C:\WINDOWS\SMINST\Scheduler.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Programmi\File comuni\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [auoie] C:\Documents and Settings\MAURIZIO\Dati applicazioni\semanatiba\syslcznp.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB1631] command /c del "C:\Programmi\Video Add-on\ot.ico"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {16930DCA-0910-4C00-86FF-0C73872D4ABA} - javascript:window.location.href="http://www.cercasulweb.com/" (file missing)
O9 - Extra 'Tools' menuitem: cerca sul web - {16930DCA-0910-4C00-86FF-0C73872D4ABA} - javascript:window.location.href="http://www.cercasulweb.com/" (file missing)
O9 - Extra button: cerca sul web - {810B72CB-566A-409B-B6A3-31F720C16FAE} - C:\WINDOWS\system32\cerca sul web (file missing)
O9 - Extra button: (no name) - {A2199168-22AC-44A3-BA5F-8A83E693FEBF} - javascript:window.location.href="http://www.sexy-nipples.com/it/videochats3/" (file missing)
O9 - Extra 'Tools' menuitem: videochats - {A2199168-22AC-44A3-BA5F-8A83E693FEBF} - javascript:window.location.href="http://www.sexy-nipples.com/it/videochats3/" (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: ssesso - {EF6D6AE3-2625-40D6-A5AB-920DFD2DAF8C} - C:\Documents and Settings\MAURIZIO\Dati applicazioni\ssesso[1].exe (file missing)
O9 - Extra button: videochats - {F4445FEB-6D20-47CB-9ACF-9D142A7F680A} - C:\WINDOWS\system32\videochats (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {FF55FC7B-F2EB-4F50-9409-2F726DD0E112} - javascript:window.location.href="http://www.sexy-nipples.com/" (file missing)
O9 - Extra 'Tools' menuitem: sesso - {FF55FC7B-F2EB-4F50-9409-2F726DD0E112} - javascript:window.location.href="http://www.sexy-nipples.com/" (file missing)
O15 - Trusted Zone: http://www.2mug.com
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1204893886265
O16 - DPF: {DF1C8E21-4045-4D67-B528-335F1A4F0DE9} - http://es6-scripts.dlv4.com/binaries...1073_em_XP.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{52B8588C-CB97-4F74-8A1C-F103236023BB}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{71564838-C48F-498E-BA3E-A829D75EA944}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{A37DDA37-4AD4-4845-9FE2-B53FEBFC23DC}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS1\Services\Tcpip\..\{52B8588C-CB97-4F74-8A1C-F103236023BB}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS2\Services\Tcpip\..\{52B8588C-CB97-4F74-8A1C-F103236023BB}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O20 - Winlogon Notify: OneCard - C:\Programmi\HPQ\IAM\Bin\AsWlnPkg.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Programmi\Bonjour\mDNSResponder.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO. EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID. EXE
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Programmi\File comuni\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe
O23 - Service: PC Angel (PCA) - SoftThinks - C:\WINDOWS\SMINST\PCAngel.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 8502 bytes

[hell's bells]

Ciao darkkik, esegui questa scansione preliminare, poi ti verrà detto come procedere, ti lascero' alle cure di Deifobe

Per scaricare Malwarebytes Malwarebytes
1) lo installi
2) lo aggiorni
3) fai una scansione scegliendo la modalità completa
4) elimina le ventuali minacce che rileva
5) finita la scansione seleziona il tabellino log, apri il file di testo e salvalo

per postare il log sul forum segui questa scaletta

1) andare sul sito http://www.savefile.com/
2) clicca su Upload My file
3) clicca su upload oppure registrarsi per avere più opzioni
4) clicca su browser e scegli il file di log, txt ecc dal tuo computer
5) compila i restanti campi e clicca su Upload File
6) copia ed incolla sul forum il link per il download che trovi sotto la voce [If you want to link directly to the file: ]

[Deifobe]

(se avevi un falso antivirus è importante che posti il rapporto di Malwarebytes.. vorrei controllare una cosa..)

già che ci sei, dopo fixa, se le trovi ancora:

O4 - HKLM\..\Run: [auoie] C:\Documents and Settings\MAURIZIO\Dati applicazioni\semanatiba\syslcznp.exe
O9 - Extra button: (no name) - {16930DCA-0910-4C00-86FF-0C73872D4ABA} - javascript:window.location.href="http://www.cercasulweb.com/" (file missing)
O9 - Extra 'Tools' menuitem: cerca sul web - {16930DCA-0910-4C00-86FF-0C73872D4ABA} - javascript:window.location.href="http://www.cercasulweb.com/" (file missing)
O9 - Extra button: cerca sul web - {810B72CB-566A-409B-B6A3-31F720C16FAE} - C:\WINDOWS\system32\cerca sul web (file missing)
O9 - Extra button: (no name) - {A2199168-22AC-44A3-BA5F-8A83E693FEBF} - javascript:window.location.href="http://www.sexy-nipples.com/it/videochats3/" (file missing)
O9 - Extra 'Tools' menuitem: videochats - {A2199168-22AC-44A3-BA5F-8A83E693FEBF} - javascript:window.location.href="http://www.sexy-nipples.com/it/videochats3/" (file missing)
O9 - Extra button: ssesso - {EF6D6AE3-2625-40D6-A5AB-920DFD2DAF8C} - C:\Documents and Settings\MAURIZIO\Dati applicazioni\ssesso[1].exe (file missing)
O9 - Extra button: videochats - {F4445FEB-6D20-47CB-9ACF-9D142A7F680A} - C:\WINDOWS\system32\videochats (file missing)
O9 - Extra button: (no name) - {FF55FC7B-F2EB-4F50-9409-2F726DD0E112} - javascript:window.location.href="http://www.sexy-nipples.com/" (file missing)
O9 - Extra 'Tools' menuitem: sesso - {FF55FC7B-F2EB-4F50-9409-2F726DD0E112} - javascript:window.location.href="http://www.sexy-nipples.com/" (file missing)
O15 - Trusted Zone: http://www.2mug.com
O16 - DPF: {DF1C8E21-4045-4D67-B528-335F1A4F0DE9} - http://es6-scripts.dlv4.com/binaries...1073_em_XP.cab

(la O15 non la conosco.. e visto che non puoi chiedere al proprietario, fixala e non se ne parla più.. tanto resta il backup)

Scarica navilog1.exe_il mafioso sul desktop e installalo. Eseguilo, scegli la lingua e al menù di scelta seleziona l'opzione 1 (non scegliere le altre). Ad un certo punto uscirà una scritta "Analysis ... Terminate", premi un tasto come richiesto e si aprirà un file di testo (il rapporto della scansione che dovrai postare).

ciao


edit: fixa la O15 tranquillamente... ed elimina la cartella in rosso (semanatiba), se ancora presente

[darkkik]

Intanto grazie delle risposte

Seguirò i consigli e ci aggiorniamo.

[darkkik]

Originariamente inviato da hell's bells
...

Fatto:

http://www.savefile.com/files/1660328
Adesso seguo i passi di deifobe

[darkkik]

Ecco il log:

_____________

Search Navipromo version 3.6.0 began on 11/07/2008 at 10.03.28,98

!!! Warning, this report may include legitimate files/programs !!!
!!! Post this report on the forum you are being helped !!!
!!! Don't continue with removal unless instructed by an authorized helper !!!
Fix running from C:\Programmi\navilog1
Actual User Account : "MAURIZIO"

Updated on 27.06.2008 at 23h00 by IL-MAFIOSO


Microsoft Windows XP [Versione 5.1.2600]
Version Internet Explorer : 6.0.2900.2180
Filesystem type : NTFS

Search done in normal mode

*** Searching for installed Software ***

Instant Access

*** Search folders in "C:\WINDOWS" ***


*** Search folders in "C:\Programmi" ***


*** Search folders in "c:\docume~1\alluse~1\datiap~1" ***


*** Search folders in "c:\docume~1\alluse~1\menuav~1\progra~1" ***


*** Search folders in "C:\Documents and Settings\MAURIZIO\datiap~1" ***


*** Search folders in "C:\DOCUME~1\ADMINI~4\datiap~1" ***


*** Search folders in "C:\DOCUME~1\FRANCE~1\datiap~1" ***


*** Search folders in "C:\Documents and Settings\MAURIZIO\impost~1\datiap~1" ***


*** Search folders in "C:\DOCUME~1\ADMINI~4\impost~1\datiap~1" ***


*** Search folders in "C:\DOCUME~1\FRANCE~1\impost~1\datiap~1" ***


*** Search folders in "C:\Documents and Settings\MAURIZIO\menuav~1\progra~1" ***


*** Search folders in "C:\DOCUME~1\ADMINI~4\menuav~1\progra~1" ***


*** Search folders in "C:\DOCUME~1\FRANCE~1\menuav~1\progra~1" ***

*** Search with Catchme-rootkit/stealth malware detector by gmer ***
for more info : http://www.gmer.net

No file found


*** Search with GenericNaviSearch ***
!!! Possibility of legitimate files in the result !!!
!!! Must always be checked before manually deleting !!!

* Scan in "C:\WINDOWS\system32" *

Files found :

skqwqccoo.exe found !
skqwqccoo.dat found !

* Scan in "C:\Documents and Settings\MAURIZIO\impost~1\datiap~1" *

* Scan in "C:\DOCUME~1\ADMINI~4\impost~1\datiap~1" *

* Scan in "C:\DOCUME~1\FRANCE~1\impost~1\datiap~1" *



*** Search files ***


C:\WINDOWS\Downloaded Program Files\IaLdr32.inf found !

*** Search specific Registry keys ***

HKEY_CURRENT_USER\Software\Lanconfig found !

*** Complementary Search ***
(Search specific files)

1)Search new Instant Access files :


2)Heuristic Search :

* In "C:\WINDOWS\system32" :

skqwqccoo.dat found !

* In "C:\Documents and Settings\MAURIZIO\impost~1\datiap~1" :

fbffipynf.dat found !
fbffipynf_nav.dat found !
fbffipynf_navps.dat found !

* In "C:\DOCUME~1\ADMINI~4\impost~1\datiap~1" :


* In "C:\DOCUME~1\FRANCE~1\impost~1\datiap~1" :


3)Certificates Search :

Egroup certificate found !
Electronic-Group certificate found !
OOO-Favorit certificate found !
Sunny-Day-Design-Ltd certificate not found !

4)Search known files :



*** Search completed on 11/07/2008 at 10.06.33,25 ***

__________

[darkkik]

Il sito www.2mug.com non riesco a rimuoverlo dalla trusted zone...sia con hijack che manualmente dalle impostazioni del browser IE7 (che fra parentesi non va...infatti ho dovuto navigare con FF).

[Deifobe]

Ciao Darkkik

hai anche navipromo:
fbffipynf.dat found !
fbffipynf_nav.dat found !
fbffipynf_navps.dat found !

skqwqccoo.exe found !
skqwqccoo.dat found !

Per ripristinare la Trusted Zone scarica DelDomains e salvalo sul desktop. Fai clic con tasto destro del mouse e scegli "Installa".


Poi, riavvia il computer in modalità provvisoria (e' necessario)
Esegui Navilog1 e scegli l'opzione di rimozione automatica (dovrebbe essere o la 2 o la 3, non ho la possibilita' di controllare, ora)

Quando finisce, riavvia il pc in modalità normale

Svuota C:\WINDOWS\Prefetch

Posta un nuovo rapporto di navilog1 cosi' come lo hai eseguito stamattina (cioe' da modalita' normale e con l'opzione 1) e controlla da hjt la voce O15

ciao

[darkkik]

Fatto, ecco il log:

Search Navipromo version 3.6.0 began on 11/07/2008 at 12.10.40,79

!!! Warning, this report may include legitimate files/programs !!!
!!! Post this report on the forum you are being helped !!!
!!! Don't continue with removal unless instructed by an authorized helper !!!
Fix running from C:\Programmi\navilog1
Actual User Account : "MAURIZIO"

Updated on 27.06.2008 at 23h00 by IL-MAFIOSO


Microsoft Windows XP [Versione 5.1.2600]
Version Internet Explorer : 7.0.5730.13
Filesystem type : NTFS

Search done in normal mode

*** Searching for installed Software ***


*** Search folders in "C:\WINDOWS" ***


*** Search folders in "C:\Programmi" ***


*** Search folders in "c:\docume~1\alluse~1\datiap~1" ***


*** Search folders in "c:\docume~1\alluse~1\menuav~1\progra~1" ***


*** Search folders in "C:\Documents and Settings\MAURIZIO\datiap~1" ***


*** Search folders in "C:\DOCUME~1\ADMINI~4\datiap~1" ***


*** Search folders in "C:\DOCUME~1\FRANCE~1\datiap~1" ***


*** Search folders in "C:\Documents and Settings\MAURIZIO\impost~1\datiap~1" ***


*** Search folders in "C:\DOCUME~1\ADMINI~4\impost~1\datiap~1" ***


*** Search folders in "C:\DOCUME~1\FRANCE~1\impost~1\datiap~1" ***


*** Search folders in "C:\Documents and Settings\MAURIZIO\menuav~1\progra~1" ***


*** Search folders in "C:\DOCUME~1\ADMINI~4\menuav~1\progra~1" ***


*** Search folders in "C:\DOCUME~1\FRANCE~1\menuav~1\progra~1" ***

*** Search with Catchme-rootkit/stealth malware detector by gmer ***
for more info : http://www.gmer.net

No file found


*** Search with GenericNaviSearch ***
!!! Possibility of legitimate files in the result !!!
!!! Must always be checked before manually deleting !!!

* Scan in "C:\WINDOWS\system32" *

* Scan in "C:\Documents and Settings\MAURIZIO\impost~1\datiap~1" *

* Scan in "C:\DOCUME~1\ADMINI~4\impost~1\datiap~1" *

* Scan in "C:\DOCUME~1\FRANCE~1\impost~1\datiap~1" *



*** Search files ***



*** Search specific Registry keys ***


*** Complementary Search ***
(Search specific files)

1)Search new Instant Access files :


2)Heuristic Search :

* In "C:\WINDOWS\system32" :


* In "C:\Documents and Settings\MAURIZIO\impost~1\datiap~1" :


* In "C:\DOCUME~1\ADMINI~4\impost~1\datiap~1" :


* In "C:\DOCUME~1\FRANCE~1\impost~1\datiap~1" :


3)Certificates Search :

Egroup certificate not found !
Electronic-Group certificate not found !
OOO-Favorit certificate not found !
Sunny-Day-Design-Ltd certificate not found !

4)Search known files :



*** Search completed on 11/07/2008 at 12.13.59,32 ***

[Deifobe]

ok, avrai già visto che navipromo non c'è più.
non mi hai detto nulla sulla O15 da eliminare

- con Malwarebytes ripulisci quanto trovato, se ancora non l'hai fatto..
- posta un rapporto di SystemScan, lo trovi sul desktop a fine scansione, nella cartella suspectfile (eseguilo non connesso ad internet + antivirus disattivato)

ciao...