ho provato, ma se guardo la penultima sottochiave da lei indicata con il passaggio: users-software-microsoft ecc... risulta alla fine che precision time non contiene nessun file all' interno. ( con il passaggio Start Menu 2 prima di Programs )
Non è possibile invece trovare la sequenza users-software-gator.com
Non importa.. L'importante è che siano eliminati quelli in HKEY_LOCAL_MACHINE, e più importante di tutti, è che sia eliminata la cartella stessa:Originariamente inviato da danny81
ho provato, ma se guardo la penultima sottochiave da lei indicata con il passaggio: users-software-microsoft ecc... risulta alla fine che precision time non contiene nessun file all' interno. ( con il passaggio Start Menu 2 prima di Programs )
Non è possibile invece trovare la sequenza users-software-gator.com
c:\programmi\precisiontime
ok, ho eliminato questa cartella. Devo eliminare altre cose ? Se no, Vi ringrazio comunque per il Vostro aiuto.
Danny
Per quanto riguarda PrecisionTime è tutto ok.
quindi non dovrei avere più problemi con il dialer dtyqi ?
il dialer si è presentato di nuovo. cosa posso fare ? vi invio una nuova scansione.
Runscanner logfile http://www.runscanner.net
000 General info
----------------
Computer name : NOME-8I55LI28RN
Type of scan : Full scan
RunScanner Version : 0.9.0.0
Creation time : 16/04/2007 19.27.08
OS : Microsoft Windows XP
OS Build : 2600
OS SP : Service Pack 2
User Language : Italiano (Italia)
IE version : 6.0.2900.2180
Windows folder : C:\WINDOWS
001 Running processes
---------------------
* c:\programmi\alwil software\avast4\aswupdsv.exe (ALWIL Software)
* c:\programmi\alwil software\avast4\ashserv.exe (ALWIL Software)
* c:\windows\system32\ati2evxx.exe
c:\programmi\file comuni\epson\ebapi\sagent2.exe (SEIKO EPSON CORPORATION)
c:\windows\soundman.exe (Avance Logic, Inc.)
c:\programmi\microsoft hardware\keyboard\type32.exe (Microsoft Corporation)
c:\programmi\microsoft hardware\mouse\point32.exe (Microsoft Corporation)
c:\windows\system32\spool\drivers\w32x86\3\e_s10ic 2.exe (SEIKO EPSON CORPORATION)
* c:\progra~1\alwils~1\avast4\ashdisp.exe (ALWIL Software)
* c:\programmi\alwil software\avast4\ashmaisv.exe (ALWIL Software)
* c:\programmi\alwil software\avast4\ashwebsv.exe (ALWIL Software)
c:\docume~1\danilo\impost~1\temp\directory temporanea 2 per runscanner1.zip\runscanner.exe (Runscanner.net)
002 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run (+subkeys)
-----------------------------------------------------------------
C:\WINDOWS\soundman.exe (Avance Logic, Inc.)
c:\programmi\microsoft hardware\keyboard\type32.exe (Microsoft Corporation)
- point32.exe
c:\windows\system32\spool\drivers\w32x86\3\e_s10ic 2.exe (SEIKO EPSON CORPORATION)
c:\windows\system32\nerocheck.exe (Ahead Software Gmbh)
* c:\progra~1\alwils~1\avast4\ashdisp.exe (ALWIL Software)
010 HKLM\SYSTEM\CurrentControlSet\Services (Services)
-----------------------------------------------------
* c:\programmi\alwil software\avast4\aswupdsv.exe (avast! iAVS4 Control Service)
* C:\WINDOWS\system32\ati2evxx.exe (ati2evxx.exe)
c:\windows\system32\ati2sgag.exe (ATI Smart)
* c:\programmi\alwil software\avast4\ashserv.exe (avast! Antivirus)
* c:\programmi\alwil software\avast4\ashmaisv.exe (avast! Mail Scanner)
* c:\programmi\alwil software\avast4\ashwebsv.exe (avast! Web Scanner)
c:\programmi\file comuni\epson\ebapi\sagent2.exe (EPSON Printer Status Agent2)
011 HKLM\SYSTEM\CurrentControlSet\Services (drivers)
----------------------------------------------------
C:\WINDOWS\system32\drivers\alcxwdm.sys (Service for Avance AC97 Audio (WDM))
* C:\WINDOWS\system32\drivers\ati2mtag.sys (Video)
* C:\WINDOWS\system32\drivers\hsf_bsc2.sys (NTRksample driver)
* C:\WINDOWS\system32\drivers\hsf_fall.sys (Fallback driver)
* C:\WINDOWS\system32\drivers\hsf_fsks.sys (FSKsNT driver)
- d:\install\gmsipci.sys (GMSIPCI)
* C:\WINDOWS\system32\drivers\hcf_msft.sys (Modem)
* C:\WINDOWS\system32\drivers\hsf_msft.sys (WinACHSF driver)
* C:\WINDOWS\system32\drivers\hsf_k56k.sys (K56NT driver)
- d:\ntaccess.sys (NTACCESS)
* C:\WINDOWS\system32\drivers\ptilink.sys (Driver Direct Parallel Link)
* C:\WINDOWS\system32\drivers\hsf_samp.sys (Rksample WDM driver)
* C:\WINDOWS\system32\drivers\secdrv.sys (Secdrv)
- d:\ntglm7x.sys (SetupNTGLM7X)
* C:\WINDOWS\system32\drivers\hsf_faxx.sys (FaxNT driver)
* C:\WINDOWS\system32\drivers\hsf_tone.sys (TonesNT driver)
* C:\WINDOWS\system32\drivers\hsf_v124.sys (V124NT driver)
031 HKLM\SOFTWARE\Classes\PROTOCOLS\Handler
-------------------------------------------
c:\programmi\file comuni\microsoft shared\web folders\pkmcdo.dll (Microsoft Corporation) {CD00020A-8B95-11D1-82DB-00C04FB1625D}
* c:\progra~1\copern~1\copern~1.dll (Copernic Technologies Inc.) {A979B6BD-E40B-4A07-ABDD-A62C64A4EBF6}
* c:\progra~1\copern~1\copern~1.dll (Copernic Technologies Inc.) {AAC34CFD-274D-4A9D-B0DC-C74C05A67E1D}
c:\programmi\file comuni\system\ole db\msdaipp.dll (Microsoft Corporation) {E1D2BF42-A96B-11d1-9C6B-0000F875AC61}
c:\programmi\file comuni\system\ole db\msdaipp.dll (Microsoft Corporation) {E1D2BF42-A96B-11d1-9C6B-0000F875AC61}
c:\programmi\file comuni\system\ole db\msdaipp.dll (Microsoft Corporation) {E1D2BF40-A96B-11d1-9C6B-0000F875AC61}
036 HKCU\Software\Microsoft\Internet Explorer\Desktop\Components
----------------------------------------------------------------
About:Home
041 HKLM-HKCU\Software\Microsoft\Internet Explorer\Toolbar
----------------------------------------------------------
* c:\programmi\copernic agent\copernicagentext.dll (Copernic Technologies Inc.) {F2E259E8-0FC8-438C-A6E0-342DD80FA53E}
042 HKLM\Software\Microsoft\Internet Explorer\Extensions
--------------------------------------------------------
* c:\progra~1\copern~1\copern~1.exe (Copernic Technologies Inc.) {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084}
* c:\progra~1\copern~1\copern~1.exe (Copernic Technologies Inc.) {688DC797-DC11-46A7-9F1B-445F4F58CE6E}
044 HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser
------------------------------------------------------------------
* c:\programmi\copernic agent\copernicagentext.dll (Copernic Technologies Inc.) {F2E259E8-0FC8-438C-A6E0-342DD80FA53E}
045 HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
----------------------------------------------------------------
* c:\programmi\copernic agent\copernicagentext.dll (Copernic Technologies Inc.) {F2E259E8-0FC8-438C-A6E0-342DD80FA53E}
061 HKLM\Software\Microsoft\Windows\CurrentVersion\She ll Extensions\Approved
----------------------------------------------------------------------------
- deskpan.dll {42071714-76d4-11d1-8b24-00a0c9068ff3}
* c:\windows\system32\hticons.dll (Hilgraeve, Inc.) {88895560-9AA2-1069-930E-00AA0030EBC8}
c:\progra~1\fileco~1\micros~1\webfol~1\msonsext.dl l (Microsoft Corporation) {BDEADF00-C265-11D0-BCED-00A0C90AB50F}
c:\programmi\alwil software\avast4\ashshell.dll (ALWIL Software) {472083B0-C522-11CF-8763-00608CC02F24}
063 HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute
---------------------------------------------------------------------
autocheck autochk *
065 HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
----------------------------------------------------------------------------------
explorer.exe : c:\windows\system32\vkeufpiw.txt (Microsoft Corporation)
069 HKLM\SYSTEM\CurrentControlSet\Control\Print\Monito rs
--------------------------------------------------------
* C:\WINDOWS\system32\ebpmon2.dll (SEIKO EPSON CORPORATION)
073 %windir%\Tasks
------------------
c:\windows\tasks\bxsghkmm.job
c:\windows\tasks\vdaq.job
c:\windows\tasks\ukweiyyf.job
c:\windows\tasks\wyvccvdd.job
c:\windows\tasks\nygpir.job
c:\windows\tasks\npr.job
c:\windows\tasks\uwptfo.job
c:\windows\tasks\uqano.job
c:\windows\tasks\cwieed.job
c:\windows\tasks\kcmkhcg.job
c:\windows\tasks\pbopl.job
c:\windows\tasks\rldmzb.job
c:\windows\tasks\agwujrvm.job
c:\windows\tasks\frp.job
c:\windows\tasks\gqbm.job
c:\windows\tasks\fiyjdonp.job
c:\windows\tasks\uguvp.job
c:\windows\tasks\xadeu.job
c:\windows\tasks\fwjitxf.job
c:\windows\tasks\wzsjqkbu.job
c:\windows\tasks\kytgxpzo.job
c:\windows\tasks\zhjonjr.job
c:\windows\tasks\vnhkz.job
c:\windows\tasks\fjmbukl.job
c:\windows\tasks\nxg.job
c:\windows\tasks\jqmf.job
c:\windows\tasks\ztck.job
c:\windows\tasks\dnwd.job
c:\windows\tasks\hiaxjiup.job
c:\windows\tasks\smgy.job
c:\windows\tasks\cmffrt.job
c:\windows\tasks\noxgptdr.job
c:\windows\tasks\dbvo.job
c:\windows\tasks\vwcqz.job
c:\windows\tasks\zlcb.job
c:\windows\tasks\dlw.job
c:\windows\tasks\ahwlaokx.job
c:\windows\tasks\ixy.job
c:\windows\tasks\azl.job
c:\windows\tasks\ekpcyj.job
c:\windows\tasks\szkiv.job
c:\windows\tasks\yntkxun.job
c:\windows\tasks\rlqzmi.job
c:\windows\tasks\zvhvq.job
c:\windows\tasks\xgayemvf.job
c:\windows\tasks\ymehzrhy.job
100 Internet Explorer settings
------------------------------
Start Page HKCU : about:blank
Start Page HKLM : http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=hom e
Search Page HKCU : http://www.microsoft.com/isapi/redir...ie&ar=iesearch
Search Page HKLM : http://www.microsoft.com/isapi/redir...ie&ar=iesearch
Default_Page_URL HKLM : http://www.wellcome.it
Default_Search_URL HKLM : http://www.microsoft.com/isapi/redir...ie&ar=iesearch
SearchAssistant HKLM : http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
CustomizeSearch HKLM : http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
ShellNext HKCU : iexplore
102 HKLM - HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars
------------------------------------------------------------------
* c:\programmi\copernic agent\copernicagentext.dll (Copernic Technologies Inc.) {6F480F82-C3A6-4D35-96F7-B297AD49FBE8}
* c:\programmi\copernic agent\copernicagentext.dll (Copernic Technologies Inc.) {F2E259E8-0FC8-438C-A6E0-342DD80FA53E}
104 HKLM\Software\Microsoft\Code Store Database\Distribution Units
------------------------------------------------------------------
* c:\windows\system32\macromed\flash\flash6.ocx (Macromedia, Inc.) {D27CDB6E-AE6D-11CF-96B8-444553540000}
106 HKLM\Software\Microsoft\Windows\CurrentVersion\URL
------------------------------------------------------
Default : http://
ftp : ftp://
gopher : gopher://
home : http://
mosaic : http://
www : http://
161 HKLM\Software\Microsoft\Windows\CurrentVersion\Pol icies\System
------------------------------------------------------------------
dontdisplaylastusername : 0
shutdownwithoutlogon : 1
undockwithoutlogon : 1
173 HKCR\*\shellex\ContextMenuHandlers
--------------------------------------
c:\programmi\alwil software\avast4\ashshell.dll (ALWIL Software) {472083B0-C522-11CF-8763-00608CC02F24}
180 FileType Hijacking
----------------------
HKEY_CLASSES_ROOT batfile : "%1" %*
HKEY_CLASSES_ROOT cmdfile : "%1" %*
HKEY_CLASSES_ROOT comfile : "%1" %*
HKEY_CLASSES_ROOT exefile : "%1" %*
HKEY_CLASSES_ROOT htafile : C:\WINDOWS\System32\mshta.exe "%1" %*
HKEY_CLASSES_ROOT piffile : "%1" %*
HKEY_CLASSES_ROOT scrfile : "%1" /S
Non so se è collegato al dialer. Si tratta della nuova variante LinkOptimizer.B: http://www.suspectfile.com/blog/?postid=25, ed è per quello che programmi come hijackthis e systemscan non vanno.
Essenzialmente il virus è questo:
c:\windows\system32\vkeufpiw.txt
SOLUZIONE: start-->esegui-->regedit (premere invio)
In alto a destra, click su modifica-->autorizzazioni click su Users, spunta su consenti e click su ok. Lasciare aperto il regedit, schicciare ctrl-->alt-->canc PROCESSI e terminare il processo explorer.exe. A quel punto dovrebbero scomparire la barra in basso e le icone sul desktop. Quindi procedere andando in
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
ed eliminando explorer.exe nel regedit.
Alla fine, ctrl-->alt-->canc-->APPLICAZIONI-->nuova operazione-->explorer.exe ( e premi invio)
A questo punto dovresti riuscire ad usare hijackthis e ad avere il log per poterlo analizzare
seguendo l' operazione da lei consigliata il sistema mi dice che è impossibile eliminarlo.
E' possibile eliminarlo entrando nel disco rigido direttamente ?
vi inserisco la scansione hijack:
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 12.43.36, on 17/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\windows\system32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\Ati2evxx.exe
C:\Programmi\Microsoft Hardware\Keyboard\type32.exe
C:\Programmi\Microsoft Hardware\Mouse\point32.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC 2.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\explorer.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\DOCUME~1\Danilo\IMPOST~1\Temp\Directory temporanea 2 per HiJackThis_v2.zip\HiJackThis_v2.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = C:\Programmi\Copernic Agent\Web\SearchBar.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.wellcome.it
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\Programmi\Copernic Agent\CopernicAgentExt.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IntelliType] "C:\Programmi\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [EPSON Stylus C42 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC 2.EXE /P23 "EPSON Stylus C42 Series" /O6 "USB001" /M "Stylus C42"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-18 Startup: Tiscali Accesso Remoto Setup Wizard.lnk = C:\Programmi\Internet\setupwd.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Tiscali Accesso Remoto Setup Wizard.lnk = C:\Programmi\Internet\setupwd.exe (User 'Default user')
O4 - .DEFAULT User Startup: Tiscali Accesso Remoto Setup Wizard.lnk = C:\Programmi\Internet\setupwd.exe (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Search Using Copernic Agent - C:\Programmi\Copernic Agent\Web\SearchExt.htm
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE (file missing)
O9 - Extra 'Tools' menuitem: Launch Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE (file missing)
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.wellcome.it
O16 - DPF: {018B7EC3-EECA-11D3-8E71-0000E82C6C0D} - http://www.lyricsdomain.com/download.mp3.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{12152858-840F-42C6-89E7-0C0C44701654}: NameServer = 212.151.136.246 130.244.127.169
O17 - HKLM\System\CS1\Services\Tcpip\..\{12152858-840F-42C6-89E7-0C0C44701654}: NameServer = 212.151.136.246 130.244.127.169
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
--
End of file - 5431 bytes
Fix checked dopo aver selezionato la seguente stringa:
O16 - DPF: {018B7EC3-EECA-11D3-8E71-0000E82C6C0D} - http://www.lyricsdomain.com/download.mp3.exe
Scansiona con systemscan selezionando più cose possibili.
Una volta eseguita la scansione verra generato il log in C:\suspectfile. Siccome è molto lungo il file report.txt, sarebbe meglio caricarlo su www.sendmefile.com e scrivere il link per poterlo scaricare.
Permessi di invio
Rispondi quotando