log di ht- Nod non si vede più

[Storia]

trovo user e all user

mi fai un'esempio pratico?

le altre dove non ci sono le ****faccio semplicemente copia/incolla?

Gentilissimo, grazie.

[OYS]

Copia e incolla questo:


Files to delete:
C:\Documents and Settings\User\Dati applicazioni\hidires\m_hook.sys
C:\Documents and Settings\User\Dati applicazioni\hidires\hidr.exe
C:\WINDOWS\system32\wintems.exe
C:\WINDOWS\system32\hldrrr.exe

folders to delete:
C:\Documents and Settings\User\Dati applicazioni\hidires
C:\WINDOWS\exefld

registry keys to delete:
HKLM\SYSTEM\CurrentControlSet\Services\m_hook
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_M_H OOK

registry values to delete:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run | hldrrr

[tognazzi]

O15 - Trusted Zone: http://adesioni.forza-italia.it
questo non l'avevo mai visto. che roba è il malware di forza italia?

[OYS]

Originariamente inviato da tognazzi
O15 - Trusted Zone: http://adesioni.forza-italia.it
questo non l'avevo mai visto. che roba è il malware di forza italia?

Mi sa che hijackthis è di parte, e appena a lo ha visto lo ha postato nel log...

[Storia]

Non si è scoperto chi voto

comunque ho fatto ma non si è risolto nulla il pc rimane lento, l'antivirus non si vede ...

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Service s\hqmdvrca

*******************

Script file located at: \??\C:\WINDOWS\bmxxidjj.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



Could not open file C:\Documents and Settings\User\Dati applicazioni\hidires\m_hook.sys for deletion
Deletion of file C:\Documents and Settings\User\Dati applicazioni\hidires\m_hook.sys failed!

Could not process line:
C:\Documents and Settings\User\Dati applicazioni\hidires\m_hook.sys
Status: 0xc000003a



Could not open file C:\Documents and Settings\User\Dati applicazioni\hidires\hidr.exe for deletion
Deletion of file C:\Documents and Settings\User\Dati applicazioni\hidires\hidr.exe failed!

Could not process line:
C:\Documents and Settings\User\Dati applicazioni\hidires\hidr.exe
Status: 0xc000003a



File C:\WINDOWS\system32\wintems.exe not found!
Deletion of file C:\WINDOWS\system32\wintems.exe failed!

Could not process line:
C:\WINDOWS\system32\wintems.exe
Status: 0xc0000034



File C:\WINDOWS\system32\hldrrr.exe not found!
Deletion of file C:\WINDOWS\system32\hldrrr.exe failed!

Could not process line:
C:\WINDOWS\system32\hldrrr.exe
Status: 0xc0000034



Folder C:\Documents and Settings\User\Dati applicazioni\hidires not found!
Deletion of folder C:\Documents and Settings\User\Dati applicazioni\hidires failed!

Could not process line:
C:\Documents and Settings\User\Dati applicazioni\hidires
Status: 0xc0000034



Folder C:\WINDOWS\exefld not found!
Deletion of folder C:\WINDOWS\exefld failed!

Could not process line:
C:\WINDOWS\exefld
Status: 0xc0000034



Registry key HKLM\SYSTEM\CurrentControlSet\Services\m_hook not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Services\m_hook failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Services\m_hook
Status: 0xc0000034



Registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_M_H OOK not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_M_H OOK failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_M_H OOK
Status: 0xc0000034



Could not delete registry value HKLM\Software\Microsoft\Windows\CurrentVersion\Run |hldrrr
Deletion of registry value HKLM\Software\Microsoft\Windows\CurrentVersion\Run |hldrrr failed!
Status: 0xc0000034


Completed script processing.

*******************

Finished! Terminate.

[OYS]

Rifai la stessa operazione ma mettici all user al posto di user

[Storia]

Non cambia nulla

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Service s\sysgokyk

*******************

Script file located at: \??\C:\WINDOWS\system32\yvhfbnwl.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



Could not open file C:\Documents and Settings\All Users\Dati applicazioni\hidires\m_hook.sys for deletion
Deletion of file C:\Documents and Settings\All Users\Dati applicazioni\hidires\m_hook.sys failed!

Could not process line:
C:\Documents and Settings\All Users\Dati applicazioni\hidires\m_hook.sys
Status: 0xc000003a



Could not open file C:\Documents and Settings\All UsersDati applicazioni\hidires\hidr.exe for deletion
Deletion of file C:\Documents and Settings\All UsersDati applicazioni\hidires\hidr.exe failed!

Could not process line:
C:\Documents and Settings\All UsersDati applicazioni\hidires\hidr.exe
Status: 0xc000003a



File C:\WINDOWS\system32\wintems.exe not found!
Deletion of file C:\WINDOWS\system32\wintems.exe failed!

Could not process line:
C:\WINDOWS\system32\wintems.exe
Status: 0xc0000034



File C:\WINDOWS\system32\hldrrr.exe not found!
Deletion of file C:\WINDOWS\system32\hldrrr.exe failed!

Could not process line:
C:\WINDOWS\system32\hldrrr.exe
Status: 0xc0000034



Folder C:\Documents and Settings\All Users\Dati applicazioni\hidires not found!
Deletion of folder C:\Documents and Settings\All Users\Dati applicazioni\hidires failed!

Could not process line:
C:\Documents and Settings\All Users\Dati applicazioni\hidires
Status: 0xc0000034



Folder C:\WINDOWS\exefld not found!
Deletion of folder C:\WINDOWS\exefld failed!

Could not process line:
C:\WINDOWS\exefld
Status: 0xc0000034



Registry key HKLM\SYSTEM\CurrentControlSet\Services\m_hook not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Services\m_hook failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Services\m_hook
Status: 0xc0000034



Registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_M_H OOK not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_M_H OOK failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_M_H OOK
Status: 0xc0000034



Could not delete registry value HKLM\Software\Microsoft\Windows\CurrentVersion\Run |hldrrr
Deletion of registry value HKLM\Software\Microsoft\Windows\CurrentVersion\Run |hldrrr failed!
Status: 0xc0000034


Completed script processing.

*******************

Finished! Terminate.

[OYS]

Scarica questo strumento di rimozione:

tool rimozione symantec


Se non ti trova niente allora vuol dire che non è colpa di bagle ma di un rootkit o simile...
Quindi scarica questi antirootkit (tranne gli ultimi due)

http://www.notrace.it/Download/Sicurezza/Anti-Rootkit/

e avg anti-rootkit

[Storia]

nessun virus trovato ma il problema rimane- inoltre non riesco a far partire il pc in mod.provvisorio

[OYS]

Scarica questo file:

http://www.savefile.com/files/576122

Aprilo facci doppio click, esegui, ok. Poi vedi se riesci ad andare in modalità provvisoria ed eventualmente a scansionare con HijackThis