non ha eliminato niente le infezioni sono ancora nel pc
hai eseguito bene le indicazioni? ora rinomina combofix in uninstall ed eseguilo poi scarica nuovamente combofix da qui e mettilo sul desktop trascina sull'icona rossa di combofix quello script che deve essere salvato sul desktop come CFScript.txt
Durante le operazioni non toccare niente
Allega il log ottenuto che troverai
Originariamente inviata da menatwork
ComboFix 15-10-28.01 - cristian 02/11/2015 21:19:29.3.2 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.39.1040.18.2047.1306 [GMT 1:00]
Eseguito da: c:\users\cristian\Desktop\ComboFix.exe
Opzioni usate :: c:\users\cristian\Desktop\CFScript.txt.txt
AV: ESET NOD32 Antivirus 4.2 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
SP: ESET NOD32 Antivirus 4.2 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Resident AV is active
.
.
FILE ::
"c:\programdata\Application\Offertz\oftzscv.ex e"
"c:\programdata\services\updater\oftzupd.exe"
.
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))) )
.
.
.
((((((((((((((((((((((((((((((((((((((( Driver/Servizi )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_oftzsvc
-------\Service_oftzupd
.
.
((((((((((((((((((((((((( Files Creati Da 2015-10-02 al 2015-11-02 )))))))))))))))))))))))))))))))))))
.
.
2015-11-02 20:30 . 2013-06-12 04:18 7068072 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{98296833-23F8-417E-9C33-E51FF463456A}\mpengine.dll
2015-10-30 16:46 . 2015-10-13 09:30 8985080 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{1019DE9F-4A63-4FCD-9575-7EE0913355FC}\mpengine.dll
2015-10-28 16:55 . 2015-11-02 20:30 -------- d-----w- c:\users\cristian\AppData\Local\temp
2015-10-14 17:55 . 2015-07-18 13:08 901264 ----a-w- c:\windows\system32\ucrtbase.dll
2015-10-14 17:54 . 2015-09-01 17:52 868864 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\tipskins.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) )
.
2015-09-02 02:48 . 2015-09-10 08:46 26624 ----a-w- c:\windows\system32\lpk.dll
2015-09-02 02:48 . 2015-09-10 08:46 70656 ----a-w- c:\windows\system32\fontsub.dll
2015-09-02 02:48 . 2015-09-10 08:46 10240 ----a-w- c:\windows\system32\dciman32.dll
2015-09-02 02:48 . 2015-09-10 08:46 34304 ----a-w- c:\windows\system32\atmlib.dll
2015-09-02 01:36 . 2015-09-10 08:46 2384896 ----a-w- c:\windows\system32\win32k.sys
2015-09-02 01:33 . 2015-09-10 08:46 299520 ----a-w- c:\windows\system32\atmfd.dll
2015-08-27 17:58 . 2015-09-10 08:46 1391104 ----a-w- c:\windows\system32\msxml6.dll
2015-08-27 17:58 . 2015-09-10 08:46 1241088 ----a-w- c:\windows\system32\msxml3.dll
2015-08-27 17:51 . 2015-09-10 08:46 2048 ----a-w- c:\windows\system32\msxml6r.dll
2015-08-27 17:51 . 2015-09-10 08:46 2048 ----a-w- c:\windows\system32\msxml3r.dll
2015-08-05 17:41 . 2015-09-10 08:46 751104 ----a-w- c:\windows\system32\schedsvc.dll
2015-08-05 17:40 . 2015-09-10 08:46 216064 ----a-w- c:\windows\system32\InkEd.dll
2015-08-05 17:40 . 2015-09-10 08:46 22528 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\jnwppr.d ll
2015-08-05 17:40 . 2015-09-10 08:46 19968 ----a-w- c:\windows\system32\jnwmon.dll
.
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-09-20 202024]
"uTorrent"="c:\users\cristian\AppData\Roaming\uTor rent\uTorrent.exe" [2015-10-13 1822048]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2011-01-14 2219184]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 1836328]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-12-19 1022152]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2011-10-28 49208]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-09-13 59720]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2014-10-02 421888]
.
c:\users\cristian\AppData\Roaming\Microsoft\Window s\Start Menu\Programs\Startup\
Ritaglio schermata e avvio di OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE /tsr [2009-2-26 97680]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R3 BBUpdate;BBUpdate;c:\program files\Microsoft\BingBar\7.3.132.0\SeaPort.exe [2014-03-11 247968]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2015-09-16 102912]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\dr ivers\MBAMSwissArmy.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominipor t.sys [2015-06-11 15872]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\ synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsus bflt.sys [2010-11-20 52224]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsus bhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Servizio Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.e xe [2012-06-10 1343400]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2012-06-10 721904]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-12-21 115008]
S2 BBSvc;BingBar Service;c:\program files\Microsoft\BingBar\7.3.132.0\BBSvc.exe [2014-03-11 193696]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe [2009-07-14 20992]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.s ys [2010-12-21 137144]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2011-01-14 810144]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfw wfpr.sys [2010-12-21 95384]
S3 Atc002;Driver miniport NDIS per controller Atheros L2 Fast Ethernet;c:\windows\system32\DRIVERS\l260x86.sys [2009-07-13 29184]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
utcsvc REG_MULTI_SZ DiagTrack
.
Contenuto della cartella 'Scheduled Tasks'
.
2015-11-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpda teService.exe [2012-06-10 17:22]
.
2015-11-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-06-11 15:42]
.
2015-11-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-06-11 15:42]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.com/
mStart Page = www.google.com
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
.
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3B F-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macrome d\\Flash\\FlashUtil32_16_0_0_305_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3B F-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3B F-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUt il32_16_0_0_305_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3B F-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299 817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299 817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299 817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\ESET\ESET Security\CurrentVersion\Info]
@Denied: (2) (LocalSystem)
"AppDataDir"="c:\\ProgramData\\ESET\\ESET NOD32 Antivirus\\"
"DataDir"="ESET\\ESET NOD32 Antivirus\\"
"EditionName"=" "
"InstallDir"="c:\\Program Files\\ESET\\ESET NOD32 Antivirus\\"
"LanguageId"=dword:00000410
"PackageTag"=dword:6090e758
"ProductBase"=dword:00000000
"ProductCode"="{67E87475-0B32-47F4-926A-D911C3377379}"
"ProductName"="ESET NOD32 Antivirus"
"ProductType"="eav"
"ProductVersion"="4.2.71.3"
"UniqueId"="00272FE64FD44138"
"ScannerBuild"=dword:00002cf1
"ScannerVersionId"=dword:00001c28
"ScannerVersion"="Locked/open ESET for status."
"ei2"=hex(b):a7,fd,ac,6b,3b,0c,f4,fc
"ei1"=hex(b):00,1d,60,75,16,65,00,00
"ei3"=hex(b):a7,41,d4,4f,00,00,00,00
"ei4"=dword:00000000
"FixId"=dword:00000009
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PC W\Security]
@Denied: (Full) (Everyone)
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\program files\NVIDIA Corporation\Display\nvxdsync.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\windows\system32\taskhost.exe
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\windows\system32\conhost.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\GWX\GWX.exe
c:\windows\system32\sppsvc.exe
c:\program files\Common Files\Nero\Lib\NMIndexingService.exe
c:\program files\Microsoft Office\Office12\ONENOTEM.EXE
c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
c:\program files\NVIDIA Corporation\Display\nvtray.exe
c:\users\cristian\AppData\Roaming\uTorrent\updates \3.4.5_41202\utorrentie.exe
c:\users\cristian\AppData\Roaming\uTorrent\updates \3.4.5_41202\utorrentie.exe
c:\program files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
c:\windows\system32\DllHost.exe
.
************************************************** ************************
.
Ora fine scansione: 2015-11-02 21:35:54 - Il pc è stato riavviato
ComboFix-quarantined-files.txt 2015-11-02 20:35
ComboFix2.txt 2015-11-01 12:00
.
Pre-Run: 52.362.817.536 byte disponibili
Post-Run: 51.930.292.224 byte disponibili
.
- - End Of File - - EF4674F7B67F2F16527E60BBDFA17FA4
A36C5E4F47E84449FF07ED3517B43A31
Il pc questa volta si è anche riavviato....
codice:Il pc questa volta si è anche riavviato....
dopo le eliminazioni deve riavviarsi, e' normale
dimmi se il problema persiste poi fai questa scansione, e' di sola lettura
Scarica OTL e salvalo sul desktop
Metti la spunta su SCAN ALL USERS.
Sotto output, metti la spunta su minimal output
Clicca sulla freccettina di File Age e seleziona 60 Days
Metti la spunta a LOP Check e Purity Check.
Clicca su RUN SCAN
Lascia fare la scansione senza interferire.
Al termine della scansione trovi due log sul desktop. OTL.txt ed Extras.txt, salvali e caricali su Wikisend come il precedente
Grazie mille!!!!!!!! Per il momento è tutto ok.
Permessi di invio
Rispondi quotando