vai su Virustotal e analizza il file C:\Windows\system32\conime.exe
posta il link dell'analisi

fai la stessa cosa per C:\Windows\system32\drivers\zazerlixzam.sys (posta il link)


Scarica ed esegui Avenger e nella finestra che si apre copia/incolla:

files to delete:
C:\Users\Utente\AppData\Local\Temp\5782671
C:\Users\Utente\AppData\Local\Temp\magFCF6.tmp
C:\Users\Utente\AppData\Local\Temp\0057fd06.jpg
C:\Users\Utente\AppData\Local\Temp\5501265
C:\Users\Utente\AppData\Local\Temp\5500562
C:\Users\Utente\AppData\Local\Temp\5500796
C:\Users\Utente\AppData\Local\Temp\5099390.exe
C:\Windows\system32\xwr97408.dll
C:\Windows\system32\drivers\TDSSmccb.sys

registry keys to delete:
HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects\{CC5FF842-D7A2-349B-A2B6-9C4803BDE9C8}
HKEY_LOCAL_MACHINE\system\controlset001\services\T DSSserv.sys
HKEY_LOCAL_MACHINE\system\controlset002\services\T DSSserv.sys
HKEY_LOCAL_MACHINE\system\currentcontrolset\servic es\TDSSserv.sys
HKEY_LOCAL_MACHINE\system\controlset001\enum\root\ legacy_TDSSserv.sys
HKEY_LOCAL_MACHINE\system\controlset002\enum\root\ legacy_TDSSserv.sys
HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\r oot\legacy_TDSSserv.sys
Spunta "Automatically disable any rootkits found" e clicca su "execute".
Il pc dovrebbe riavviarsi da solo, altrimenti riavvialo tu.

Posta anche un nuovo systemscan



NOTA: se zazerlixzam.sys (quello da analizzare) risulta infetto, esegui questo script invece di quello postato sopra:

files to delete:
C:\Users\Utente\AppData\Local\Temp\5782671
C:\Users\Utente\AppData\Local\Temp\magFCF6.tmp
C:\Users\Utente\AppData\Local\Temp\0057fd06.jpg
C:\Users\Utente\AppData\Local\Temp\5501265
C:\Users\Utente\AppData\Local\Temp\5500562
C:\Users\Utente\AppData\Local\Temp\5500796
C:\Users\Utente\AppData\Local\Temp\5099390.exe
C:\Windows\system32\xwr97408.dll
C:\Windows\system32\drivers\zazerlixzam.sys
C:\Windows\system32\drivers\TDSSmccb.sys

registry keys to delete:
HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects\{CC5FF842-D7A2-349B-A2B6-9C4803BDE9C8}
HKEY_LOCAL_MACHINE\system\controlset001\services\z azerlixzam.sys
HKEY_LOCAL_MACHINE\system\controlset002\services\z azerlixzam.sys
HKEY_LOCAL_MACHINE\system\currentcontrolset\servic es\zazerlixzam.sys
HKEY_LOCAL_MACHINE\system\controlset001\services\T DSSserv.sys
HKEY_LOCAL_MACHINE\system\controlset002\services\T DSSserv.sys
HKEY_LOCAL_MACHINE\system\currentcontrolset\servic es\TDSSserv.sys
HKEY_LOCAL_MACHINE\system\controlset001\enum\root\ legacy_TDSSserv.sys
HKEY_LOCAL_MACHINE\system\controlset002\enum\root\ legacy_TDSSserv.sys
HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\r oot\legacy_TDSSserv.sys