Rootkit Di Gromozon.com Alias Rootkit Linkoptimizer

[cobler]

Purtroppo come molti sono vittima di ROOTKIT DI GROMOZON.COM ALIAS ROOTKIT LINKOPTIMIZER
usavo Nod32....ma non è stato all'altezza.....ho provato a risolvere la cosa guardando altri casi...ma non sono sicuro di aver risolto

posto il log di Logfile of HijackThis v1.99.1 (non capisco perchè mi dia sempre (Unable to list running processes)....
continuo poi ad avere ad ogni riavvio in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
c:\windows\system32\userinit.exe,"c:\windows\servi ces.exe",

...qualche aiuto......un anticipato grazie


Logfile of HijackThis v1.99.1
Scan saved at 18.21.17, on 30/11/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
(Unable to list running processes)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe,,C:\WIND OWS\SERVICES.EXE
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Adobe Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {49E0E0F0-5C30-11D4-945D-000000000000} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar1.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programmi\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
O2 - BHO: (no name) - {DA39029C-D291-A968-3FF4-D0990D5CB5FC} - (no file)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmi\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar1.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - (no file)
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINDOWS\System32\PDesk\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [Iomega Startup Options] C:\Programmi\Iomega\Common\ImgStart.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Programmi\Iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Programmi\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [AdobeVersionCue] C:\Programmi\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
O4 - HKLM\..\Run: [Samsung LBP SM] "C:\WINDOWS\Samsung\LaserSMMgr\ssmmgr.exe" /autorun
O4 - HKLM\..\Run: [Openwares LiveUpdate] C:\Program Files\LiveUpdate\LiveUpdate.exe
O4 - HKLM\..\Run: [Aqua Dock] C:\Programmi\Aqua Dock\Aqua Dock.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Programmi\ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nod32kui] "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [VIRIT LITE MONITOR] C:\VEXPLITE\MONLITE.EXE
O4 - HKLM\..\Run: [idhsftao] C:\wskgvvtm.bat
O4 - HKCU\..\Run: [Iomega Active Disk] C:\Programmi\Iomega\AutoDisk\AD2KClient.exe
O4 - HKCU\..\Run: [NBJ] "C:\Programmi\ahead2\Nero BackItUp\NBJ.exe"
O4 - Global Startup: Acrobat Assistant.lnk = C:\Programmi\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programmi\InterVideo\Common\Bin\WinCinemaMgr.ex e
O8 - Extra context menu item: &Google Search - res://c:\programmi\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\programmi\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\programmi\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\programmi\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\programmi\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Sothink SWF Catcher - C:\Programmi\File comuni\SourceTec\SWF Catcher\InternetExplorer.htm
O8 - Extra context menu item: Translate Page into English - res://c:\programmi\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Programmi\File comuni\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Programmi\File comuni\SourceTec\SWF Catcher\InternetExplorer.htm
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - https://www-secure.symantec.com/tech...l/SymAData.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3D0DE763-73F4-46E2-87B2-06048398D166}: NameServer = 213.205.32.70,213.205.36.70
O17 - HKLM\System\CS1\Services\Tcpip\..\{3D0DE763-73F4-46E2-87B2-06048398D166}: NameServer = 213.205.32.70,213.205.36.70
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Adobe LM Service - Unknown owner - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Programmi\Adobe\Adobe Version Cue\service\VersionCue.exe
O23 - Service: Apache - Unknown owner - C:\PROGRA~1\EasyPHP\Apache\apache.exe" --ntservice (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Programmi\ahead\InCD\InCDsrv.exe
O23 - Service: Iomega Activity Disk2 - Iomega Corporation - C:\PROGRA~1\Iomega\System32\ActivityDisk.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Programmi\File comuni\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: MGABGEXE - Matrox Graphics Inc. - C:\WINDOWS\System32\mgabg.exe
O23 - Service: Mgc78xntckua - Matrox Graphics Inc. - (no file)
O23 - Service: MySql - Unknown owner - C:/Programmi/EasyPHP/mysql/bin/mysqld-nt.exe (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmi\Eset\nod32krn.exe
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Programmi\Prevx1\PXAgent.exe" -f (file missing)
O23 - Service: SAVScan - Unknown owner - C:\Programmi\Norton AntiVirus\SAVScan.exe (file missing)
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Programmi\TuneUp Utilities 2006\WinStylerThemeSvc.exe
O23 - Service: Virit eXplorer Lite (viritsvclite) - TG Soft Sas www.tgsoft.it - C:\VEXPLITE\viritsvc.exe

[Simeon]

Qui c'è un fritto misto tra linkoptimizer e Hacktool.Rootkit.

Iniziamo con il linkoptimizer.

prova a vedere se riesci a far girare questi tools:

http://info.prevx.com/download.asp?grab=GROMOZONREMTOOL
rilascia il log Gromozon_Removal.log in in C:\

http://securityresponse.symantec.com...FixLinkopt.exe
rilascia il log nella cartella da cui esegui il file;
(utilizzalo dalla modalità provvisoria)

Se i tools vengono riconosciuti e bloccati dal malware prova a rinominarli con un nome a caso.

Al termine posta i log.

[cobler]

....ti ringrazio moltissimo per avermi risposto e per il tuo interessamento....viste le molte richieste credo non sia facile rispondere a tutti.....

Primariamente quanto ai metodi usati per cercare di risolvere la questione ho cercato di usare quasi tutti quelli che ho letto in altri post( anche i tool della PrevX e quello della Symantec...di cui posto solo il log di prevx ) ......(pulizia file temporanei registro di configurzione, scansione VirIT)

ho cancellato il files services come indicato da HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
c:\windows\system32\userinit.exe,"c:\windows\servi ces.exe",

solo che ad ogni riavvio la chiave di registro è esattamente come prima........

Ho individuato nei servizi le voci MQK "C:\Programmi\BxQehQmoA.exe" (ho eliminato il file) e SecTnz "C:\Programmi\File comuni\System\IWe.exe" (ho eliminato il file)....ma non so come si eliminano le voci dalla colonna...
Per il resto c'è sicuramente ancora qualcosa che non va...si apre infatti talvolta un finistra con indicato " Tanservice" non ho trovato alcun modem per la connessione......alcuni dei tool indicati lavorano ad intermittenza ( a volte funzionano a volte si chiudono) la cartella dove li ho inseriti ( con grande fantasia chiamata Virus in Programmi) alla prima apertura non mostra nulla e solo dopo molti aggiornamenti della visualizzazione mostra qualcosa)...

Posto il Logfile of Runanalyzer
il log di VirIT
Il log di un programma di analisi ( non ricordo adesso il nome)

Grazie ancora per la risposta e spero che tu possa ancora aiutarmi.....

[Simeon]

Sì, magari i log postali così abbiamo una panormaica migliore...
sarebbe utile quello di Virit e quelli dei due tools consigliati.

Dal momento che sei riuscito ad utilizzare i tools consigliati e a fare una scansione con Virit (aggiornato spero) il linkoptimizer non dovrebbe essere più attivo in memoria.

Proviamo dunque a mettere mano al log di HijackThis.

Abilita la visualizzazione dei file nascosti:
Strumenti => Opzioni cartella => Visualizzazione => Visualizza cartelle e file nascosti.

Stampati queste istruzioni poiché non potrai utilizzare la connessione:

Entra in modalità provvisoria (tasto F8 subito al riavvio => Modalità provvisoria).

Fixa queste voci:
F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe,,C:\WIND OWS\SERVICES.EXE
O2 - BHO: (no name) - {49E0E0F0-5C30-11D4-945D-000000000000} - (no file)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
O2 - BHO: (no name) - {DA39029C-D291-A968-3FF4-D0990D5CB5FC} - (no file)
O4 - HKLM\..\Run: [idhsftao] C:\wskgvvtm.bat

Cerca ed elimina (se presenti):
- services.exe in C:\windows (attenzione: quello in system32 è legittimo e non va toccato!)
- wskgvvtm.bat in C:\

Riavvia.
Posta un nuovo log di HijackThis.

[cobler]

.....Grazie per l'aiuto..........posto l'ultimo log HijackThis ....ci sono poi tutta una serie di files che non mi convincono.....

Directory di C:\WINDOWS


01/12/2006 09.57 <DIR> Temp
30/11/2006 21.01 <DIR> system32
26/10/2006 08.14 <DIR> system
26/10/2006 08.20 <DIR> ShellNew
30/11/2006 10.49 <DIR> Registration
01/12/2006 09.55 <DIR> Debug
01/12/2006 09.44 <DIR> Prefetch
30/11/2006 15.20 <DIR> Enfocus Prefs Folder
30/11/2006 12.20 <DIR> Minidump
20/10/2006 15.33 <DIR> Help
28/11/2006 09.13 90.112 gert0.dll
28/11/2006 10.56 528.446 gmer.dll
28/11/2006 11.19 745.531 gmer.exe
30/11/2006 22.07 250 gmer.ini
17/10/2006 09.06 89.687 iis6.log
17/10/2006 09.06 1.393 imsins.log
17/10/2006 09.06 46.467 FaxSetup.log
17/10/2006 09.06 2.985 msgsocm.log
17/10/2006 09.06 8.937 MSI30-KB884016.log
17/10/2006 09.06 26.574 msmqinst.log
26/10/2006 09.45 155 NeroDigital.ini
17/10/2006 09.06 5.626 netfxocm.log
28/11/2006 13.06 690.482 ntbtlog.txt
17/10/2006 09.06 16.115 ntdtcsetup.log
17/10/2006 09.06 39.882 ocgen.log
17/10/2006 09.06 2.682 ocmsn.log
30/11/2006 10.28 424 ODBC.INI
25/10/2006 19.42 1.901 panose.bin
26/11/2006 19.27 1.702 pxinstall_log.txt
26/10/2006 20.11 167 ConverterCore.INI
24/11/2006 17.30 32.588 SchedLgU.Txt
27/11/2006 16.38 16.468 SERVICES.EXE
28/11/2006 19.09 369.685 setupapi.log
17/10/2006 09.06 27.633 comsetup.log
01/12/2006 09.57 15.445 svcq16.exe
01/12/2006 09.57 15.445 svcq32.exe 30/11/2006 13.44 227 system.ini
01/12/2006 09.57 863 system32.dll
24/10/2006 18.01 72.704 cadkasdeinst01e.exe
17/10/2006 09.06 1.230 tabletoc.log
01/12/2006 09.57 13.976 tanservice.exe
17/10/2006 09.06 31.093 tsoc.log
26/10/2006 08.39 61.540 ATMREG.ATM
01/12/2006 09.55 159 wiadebug.log
01/12/2006 09.55 50 wiaservc.log
13/11/2006 18.37 750 win.ini
04/11/2006 10.44 1.129.988 WindowsUpdate.log
21/11/2006 17.58 114.605 wmsetup.log
24/10/2006 09.58 754 WORDPAD.INI
01/12/2006 09.55 0 0.log


Directory di C:\WINDOWS\system32


26/11/2006 20.22 <DIR> log
28/11/2006 19.09 <DIR> Kaspersky Lab
30/11/2006 20.35 <DIR> drivers
17/10/2006 09.06 <DIR> dllcache
28/11/2006 11.30 <DIR> config
28/11/2006 19.11 <DIR> CatRoot2
30/11/2006 15.20 292 CJPrefs.cjp
26/10/2006 15.24 333.120 FNTCACHE.DAT
28/11/2006 10.01 206.800 ikhcore.log
27/11/2006 22.11 93 imon1.dat
30/11/2006 20.38 6.925.509 NRJLP
29/10/2006 09.09 37.896 perfc009.dat
29/10/2006 09.09 45.120 perfc010.dat
29/10/2006 09.09 305.454 perfh009.dat
29/10/2006 09.09 338.802 perfh010.dat
29/10/2006 09.09 733.374 PerfStringBackup.INI
01/12/2006 09.57 15.445 svcq16.exe
01/12/2006 09.57 25.000 svcq64.exe
30/11/2006 08.53 2.262 wpa.dbl

C:\Programmi\lcHgO.exe
C:\Programmi\mJLuHWML.exe
C:\Programmi\mNC.exe
C:\Programmi\mtUVJj.exe
C:\Programmi\QvY.exe
C:\Programmi\tBpOYaN.exe
C:\Programmi\WUfZQTXYq.exe
C:\Programmi\zJ.exe


Logfile of HijackThis v1.99.1
Scan saved at 17.32.53, on 01/12/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Iomega\System32\ActivityDisk.exe
C:\WINDOWS\System32\mgabg.exe
C:\Programmi\Eset\nod32krn.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\PDesk\PDesk.exe
C:\VEXPLITE\viritsvc.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Programmi\Iomega\DriveIcons\ImgIcon.exe
C:\Programmi\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
C:\WINDOWS\Samsung\LaserSMMgr\ssmmgr.exe
C:\Programmi\ahead\InCD\InCD.exe
C:\Programmi\Eset\nod32kui.exe
C:\VEXPLITE\MONLITE.EXE
C:\Programmi\Iomega\AutoDisk\AD2KClient.exe
C:\Programmi\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
C:\Programmi\InterVideo\Common\Bin\WinCinemaMgr.ex e
C:\Programmi\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Programmi\virus\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Adobe Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar1.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programmi\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: (no name) - {DA39029C-D291-A968-3FF4-D0990D5CB5FC} - (no file)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmi\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINDOWS\System32\PDesk\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [Iomega Startup Options] C:\Programmi\Iomega\Common\ImgStart.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Programmi\Iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Programmi\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [AdobeVersionCue] C:\Programmi\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
O4 - HKLM\..\Run: [Samsung LBP SM] "C:\WINDOWS\Samsung\LaserSMMgr\ssmmgr.exe" /autorun
O4 - HKLM\..\Run: [Openwares LiveUpdate] C:\Program Files\LiveUpdate\LiveUpdate.exe
O4 - HKLM\..\Run: [Aqua Dock] C:\Programmi\Aqua Dock\Aqua Dock.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Programmi\ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nod32kui] "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [VIRIT LITE MONITOR] C:\VEXPLITE\MONLITE.EXE
O4 - HKCU\..\Run: [Iomega Active Disk] C:\Programmi\Iomega\AutoDisk\AD2KClient.exe
O4 - HKCU\..\Run: [NBJ] "C:\Programmi\ahead2\Nero BackItUp\NBJ.exe"
O4 - Global Startup: Acrobat Assistant.lnk = C:\Programmi\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programmi\InterVideo\Common\Bin\WinCinemaMgr.ex e
O8 - Extra context menu item: &Google Search - res://c:\programmi\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\programmi\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\programmi\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\programmi\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\programmi\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Sothink SWF Catcher - C:\Programmi\File comuni\SourceTec\SWF Catcher\InternetExplorer.htm
O8 - Extra context menu item: Translate Page into English - res://c:\programmi\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Programmi\File comuni\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Programmi\File comuni\SourceTec\SWF Catcher\InternetExplorer.htm
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - https://www-secure.symantec.com/tech...l/SymAData.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3D0DE763-73F4-46E2-87B2-06048398D166}: NameServer = 213.205.32.70,213.205.36.70
O17 - HKLM\System\CS1\Services\Tcpip\..\{3D0DE763-73F4-46E2-87B2-06048398D166}: NameServer = 213.205.32.70,213.205.36.70
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Adobe LM Service - Unknown owner - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Programmi\Adobe\Adobe Version Cue\service\VersionCue.exe
O23 - Service: Apache - Unknown owner - C:\PROGRA~1\EasyPHP\Apache\apache.exe" --ntservice (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Programmi\ahead\InCD\InCDsrv.exe
O23 - Service: Iomega Activity Disk2 - Iomega Corporation - C:\PROGRA~1\Iomega\System32\ActivityDisk.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Programmi\File comuni\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: MGABGEXE - Matrox Graphics Inc. - C:\WINDOWS\System32\mgabg.exe
O23 - Service: Mgc78xntckua - Matrox Graphics Inc. - (no file)
O23 - Service: MySql - Unknown owner - C:/Programmi/EasyPHP/mysql/bin/mysqld-nt.exe (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmi\Eset\nod32krn.exe
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Programmi\Prevx1\PXAgent.exe" -f (file missing)
O23 - Service: SYNORNBS - Sysinternals - www.sysinternals.com - C:\DOCUME~1\max\IMPOST~1\Temp\SYNORNBS.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Programmi\TuneUp Utilities 2006\WinStylerThemeSvc.exe
O23 - Service: Virit eXplorer Lite (viritsvclite) - TG Soft Sas www.tgsoft.it - C:\VEXPLITE\viritsvc.exe

[Simeon]

Scarica The Avenger
estrailo sul desktop, avvialo, seleziona “Input script manually”, clicca sulla lente di ingrandimento ed incolla nella finestra che si apre quanto segue:

FILES TO DELETE:
C:\Windows\SERVICES.EXE
C:\Programmi\lcHgO.exe
C:\Programmi\mJLuHWML.exe
C:\Programmi\mNC.exe
C:\Programmi\mtUVJj.exe
C:\Programmi\QvY.exe
C:\Programmi\tBpOYaN.exe
C:\Programmi\WUfZQTXYq.exe
C:\Programmi\zJ.exe
C:\WINDOWS\svcq16.exe
C:\WINDOWS\svcq32.exe
C:\WINDOWS\tanservice.exe
C:\WINDOWS\system32\svcq16.exe
C:\WINDOWS\system32\svcq64.exe 

REGISTRY KEYS TO DELETE:
HKLM\SOFTWARE\Micosoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DA39029C-D291-A968-3FF4-D0990D5CB5FC}

Clicca su “Done”, poi sul semaforo; conferma i messaggi che appaiono; il computer si riavvierà.

Posta il log di The Avenger (è il file formato testo che trovi in C:\).

[cobler]

....grazie per l'aiuto.....ho seguito le indicazioni (ho aggiunto l'eliminazione di services.dll)...
posto il log di avenger....dopo cansione di viritIT......

[SCANSIONE DEL REGISTRO]
{DA39029C-D291-A968-3FF4-D0990D5CB5FC} Infetto da BHO.LinkOptimizer.B
* * * RIMOSSO * * *
{DA39029C-D291-A968-3FF4-D0990D5CB5FC} Infetto da BHO.LinkOptimizer.D



Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Service s\rcalxpay

*******************

Script file located at: \??\C:\Documents and Settings\ppvxxyrs.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



File C:\Windows\SERVICES.dll not found!
Deletion of file C:\Windows\SERVICES.dll failed!

Could not process line:
C:\Windows\SERVICES.dll
Status: 0xc0000034

File C:\Programmi\lcHgO.exe deleted successfully.
File C:\Programmi\mJLuHWML.exe deleted successfully.
File C:\Programmi\mNC.exe deleted successfully.
File C:\Programmi\mtUVJj.exe deleted successfully.
File C:\Programmi\QvY.exe deleted successfully.
File C:\Programmi\tBpOYaN.exe deleted successfully.
File C:\Programmi\WUfZQTXYq.exe deleted successfully.
File C:\Programmi\zJ.exe deleted successfully.


File C:\WINDOWS\svcq16.exe not found!
Deletion of file C:\WINDOWS\svcq16.exe failed!

Could not process line:
C:\WINDOWS\svcq16.exe
Status: 0xc0000034

File C:\WINDOWS\svcq32.exe deleted successfully.


File C:\WINDOWS\tanservice.exe not found!
Deletion of file C:\WINDOWS\tanservice.exe failed!

Could not process line:
C:\WINDOWS\tanservice.exe
Status: 0xc0000034

File C:\WINDOWS\system32\svcq16.exe deleted successfully.


File C:\WINDOWS\system32\svcq64.exe not found!
Deletion of file C:\WINDOWS\system32\svcq64.exe failed!

Could not process line:
C:\WINDOWS\system32\svcq64.exe
Status: 0xc0000034



Registry key HKLM\SOFTWARE\Micosoft\Windows\CurrentVersion\Expl orer\Browser Helper Objects\{DA39029C-D291-A968-3FF4-D0990D5CB5FC} not found!
Deletion of registry key HKLM\SOFTWARE\Micosoft\Windows\CurrentVersion\Expl orer\Browser Helper Objects\{DA39029C-D291-A968-3FF4-D0990D5CB5FC} failed!
Status: 0xc0000034


Completed script processing.

*******************

Finished! Terminate.

[Simeon]

Ok, siamo a fine.

Con HijackThis elimina (se ancora presente):
O2 - BHO: (no name) - {DA39029C-D291-A968-3FF4-D0990D5CB5FC} - (no file)

assicurati poi che non ricompaia.

[cobler]

Con HijackThis ho eliminato
O2 - BHO: (no name) - {DA39029C-D291-A968-3FF4-D0990D5CB5FC} - (no file)

solo che ricompare subito

con RegSeeker ho cercato la chiave che compare come da immagine.... ( non ho capito come si inseriscano le immagini)

posso eliminare comunque queste voci tranquillamente?

[Simeon]

Ok, procedi così:
Start >> Esegui >> scrivi "regedit" e dai invio.
Raggiungi questo percorso:
HKEY_LOCAL_MACHINE\SOFTWARE\Micosoft\Windows\Curre ntVersion\Explorer\Browser Helper Objects ed individua il CLSID: {DA39029C-D291-A968-3FF4-D0990D5CB5FC}
click destro su di esso >> Autorizzazioni >> Avanzate >> Proprietario, evidenzia il nome della tua utenza e dai ok; nella precedente finestra consenti adesso il controllo completo mettendo le relative spunte su "consenti" e dai ok. Click destro sul CLSID >> Elimina.
Dovresti così riuscire ad eliminarlo definitivamente.