trojan.agent.wf

[Laplaciano]

Device \Driver\usbstor \Device\000000a8 IRP_MJ_POWER 829FF008
Device \Driver\usbstor \Device\000000a8 IRP_MJ_SYSTEM_CONTROL 829FF008
Device \Driver\usbstor \Device\000000a8 IRP_MJ_DEVICE_CHANGE 829FF008
Device \Driver\usbstor \Device\000000a8 IRP_MJ_QUERY_QUOTA 829FF008
Device \Driver\usbstor \Device\000000a8 IRP_MJ_SET_QUOTA 829FF008
Device \Driver\usbstor \Device\000000a8 IRP_MJ_PNP 829FF008
Device \Driver\usbstor \Device\000000a8 IRP_MJ_PNP_POWER 829FF008
Device \Driver\usbstor \Device\000000ad IRP_MJ_CREATE 829FF008
Device \Driver\usbstor \Device\000000ad IRP_MJ_CREATE_NAMED_PIPE 829FF008
Device \Driver\usbstor \Device\000000ad IRP_MJ_CLOSEIRP_MJ_READ 829FF008
Device \Driver\usbstor \Device\000000ad IRP_MJ_WRITE 829FF008
Device \Driver\usbstor \Device\000000ad IRP_MJ_QUERY_INFORMATION 829FF008
Device \Driver\usbstor \Device\000000ad IRP_MJ_SET_INFORMATION 829FF008
Device \Driver\usbstor \Device\000000ad IRP_MJ_QUERY_EA 829FF008
Device \Driver\usbstor \Device\000000ad IRP_MJ_SET_EA 829FF008
Device \Driver\usbstor \Device\000000ad IRP_MJ_FLUSH_BUFFERS 829FF008
Device \Driver\usbstor \Device\000000ad IRP_MJ_QUERY_VOLUME_INFORMATION 829FF008
Device \Driver\usbstor \Device\000000ad IRP_MJ_SET_VOLUME_INFORMATION 829FF008
Device \Driver\usbstor \Device\000000ad IRP_MJ_DIRECTORY_CONTROL 829FF008
Device \Driver\usbstor \Device\000000ad IRP_MJ_FILE_SYSTEM_CONTROL 829FF008
Device \Driver\usbstor \Device\000000ad IRP_MJ_DEVICE_CONTROL 829FF008
Device \Driver\usbstor \Device\000000ad IRP_MJ_INTERNAL_DEVICE_CONTROL 829FF008
Device \Driver\usbstor \Device\000000ad IRP_MJ_SHUTDOWN 829FF008
Device \Driver\usbstor \Device\000000ad IRP_MJ_LOCK_CONTROL 829FF008
Device \Driver\usbstor \Device\000000ad IRP_MJ_CLEANUP 829FF008
Device \Driver\usbstor \Device\000000ad IRP_MJ_CREATE_MAILSLOT 829FF008
Device \Driver\usbstor \Device\000000ad IRP_MJ_QUERY_SECURITY 829FF008
Device \Driver\usbstor \Device\000000ad IRP_MJ_SET_SECURITY 829FF008
Device \Driver\usbstor \Device\000000ad IRP_MJ_POWER 829FF008
Device \Driver\usbstor \Device\000000ad IRP_MJ_SYSTEM_CONTROL 829FF008
Device \Driver\usbstor \Device\000000ad IRP_MJ_DEVICE_CHANGE 829FF008
Device \Driver\usbstor \Device\000000ad IRP_MJ_QUERY_QUOTA 829FF008
Device \Driver\usbstor \Device\000000ad IRP_MJ_SET_QUOTA 829FF008
Device \Driver\usbstor \Device\000000ad IRP_MJ_PNP 829FF008
Device \Driver\usbstor \Device\000000ad IRP_MJ_PNP_POWER 829FF008
Device \Driver\usbstor \Device\000000ae IRP_MJ_CREATE 829FF008
Device \Driver\usbstor \Device\000000ae IRP_MJ_CREATE_NAMED_PIPE 829FF008
Device \Driver\usbstor \Device\000000ae IRP_MJ_CLOSEIRP_MJ_READ 829FF008
Device \Driver\usbstor \Device\000000ae IRP_MJ_WRITE 829FF008
Device \Driver\usbstor \Device\000000ae IRP_MJ_QUERY_INFORMATION 829FF008
Device \Driver\usbstor \Device\000000ae IRP_MJ_SET_INFORMATION 829FF008
Device \Driver\usbstor \Device\000000ae IRP_MJ_QUERY_EA 829FF008
Device \Driver\usbstor \Device\000000ae IRP_MJ_SET_EA 829FF008
Device \Driver\usbstor \Device\000000ae IRP_MJ_FLUSH_BUFFERS 829FF008
Device \Driver\usbstor \Device\000000ae IRP_MJ_QUERY_VOLUME_INFORMATION 829FF008
Device \Driver\usbstor \Device\000000ae IRP_MJ_SET_VOLUME_INFORMATION 829FF008
Device \Driver\usbstor \Device\000000ae IRP_MJ_DIRECTORY_CONTROL 829FF008
Device \Driver\usbstor \Device\000000ae IRP_MJ_FILE_SYSTEM_CONTROL 829FF008
Device \Driver\usbstor \Device\000000ae IRP_MJ_DEVICE_CONTROL 829FF008
Device \Driver\usbstor \Device\000000ae IRP_MJ_INTERNAL_DEVICE_CONTROL 829FF008
Device \Driver\usbstor \Device\000000ae IRP_MJ_SHUTDOWN 829FF008
Device \Driver\usbstor \Device\000000ae IRP_MJ_LOCK_CONTROL 829FF008
Device \Driver\usbstor \Device\000000ae IRP_MJ_CLEANUP 829FF008
Device \Driver\usbstor \Device\000000ae IRP_MJ_CREATE_MAILSLOT 829FF008
Device \Driver\usbstor \Device\000000ae IRP_MJ_QUERY_SECURITY 829FF008
Device \Driver\usbstor \Device\000000ae IRP_MJ_SET_SECURITY 829FF008
Device \Driver\usbstor \Device\000000ae IRP_MJ_POWER 829FF008
Device \Driver\usbstor \Device\000000ae IRP_MJ_SYSTEM_CONTROL 829FF008
Device \Driver\usbstor \Device\000000ae IRP_MJ_DEVICE_CHANGE 829FF008
Device \Driver\usbstor \Device\000000ae IRP_MJ_QUERY_QUOTA 829FF008
Device \Driver\usbstor \Device\000000ae IRP_MJ_SET_QUOTA 829FF008
Device \Driver\usbstor \Device\000000ae IRP_MJ_PNP 829FF008
Device \Driver\usbstor \Device\000000ae IRP_MJ_PNP_POWER 829FF008
Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_CREATE 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_CREATE_NAMED_PIPE 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_CLOSEIRP_MJ_READ 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_WRITE 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_QUERY_INFORMATION 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_SET_INFORMATION 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_QUERY_EA 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_SET_EA 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_FLUSH_BUFFERS 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_QUERY_VOLUME_INFORMATION 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_SET_VOLUME_INFORMATION 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_DIRECTORY_CONTROL 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_FILE_SYSTEM_CONTROL 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_DEVICE_CONTROL 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_INTERNAL_DEVICE_CONTROL 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_SHUTDOWN 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_LOCK_CONTROL 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_CLEANUP 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_CREATE_MAILSLOT 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_QUERY_SECURITY 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_SET_SECURITY 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_POWER 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_SYSTEM_CONTROL 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_DEVICE_CHANGE 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_QUERY_QUOTA 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_SET_QUOTA 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_PNP 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 IRP_MJ_PNP_POWER 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_CREATE 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_CREATE_NAMED_PIPE 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_CLOSEIRP_MJ_READ 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_WRITE 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_QUERY_INFORMATION 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_SET_INFORMATION 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_QUERY_EA 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_SET_EA 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_FLUSH_BUFFERS 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_QUERY_VOLUME_INFORMATION 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_SET_VOLUME_INFORMATION 829D5430
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_DIRECTORY_CONTROL 829D5430

[holifay]

OK, bene.

Ascolta: mancano queste informazioni

1) il nome e la data di creazione delle cartelle in C:/documents and settings/
2) eventuali file in C:/programmi o C:/WINDOWS/SYSTEM creati di recente (in questi giorni). Soprattutto se con estensione exe tmp dll
3) presenza di una cartella linkoptimizer nel PC

Non vedi il trojan perchè è nascosto con tecniche di Rootkit e tra l´altro si trova negli ADS.

Finchè io o qualcun altro non ti prepara una procedura di rimozione, per favore non riavviare. Io adesso devo uscire, potrò guardare la tua risposta dopo cena.

Spero che arrivi qualcun altro, altrimenti ci sentiamo per le 10.

Ciao



PS: quando cerchi i file come ti ho chiesto sopra, abilita la visualizzazione dei file nascosti e di sistema

- apri gestione risorse
- dal menu selezona strumenti >> opzioni cartella


AH, una cosa: sicuro che l´ultimo log di GMER che hai postato è completo?
- seleziona il tab visualizzazione
- metti la spunta alla casella visualizza file e cartelle nascoste
- togli la spunta alla casella nascondi file di sistema (consigliato) (trovi l´ozione più in basso)
- clicca Si, poi Applica, poi OK.