Spyware e log hijackthiis

[fox80129]

Salve ragazzi,
Ho windows xp sp1 e purtroppo navigando in rete ho beccato uno spyware che mi modifica automaticamente la homepage di explorer (con aboutblank) e si aprono di continuo finestre pop-up.

Ho utilizzato sia Ad-Aware che Spybot,che nonostante trovavano gli spyware e li cancellavano non hanno funzionato.

Vi posto un log di hijackthis....spero possiate aiutarmi...grazie!



Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\digicom\Michelangelo USB ADSL\CnxDslTb.exe
C:\Programmi\Google\Gmail Notifier\gnotify.exe
C:\Programmi\QuickTime\qttask.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmi\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\rundll32.exe
C:\Programmi\Yahoo!\Messenger\ymsgr_tray.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Documents and Settings\FOX\Documenti\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\FOX\IMPOST~1\Temp\se.dll/space.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\FOX\IMPOST~1\Temp\se.dll/space.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://loginnet.passport.com/ppsecu...th.srf?lc=1040
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2E7764A7-F611-4921-BA18-C70454B84969} - C:\WINDOWS\System32\dcng.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [CnxDslTaskBar] C:\Programmi\digicom\Michelangelo USB ADSL\CnxDslTb.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Programmi\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\FOX\IMPOST~1\Temp\se.dll,DllInstall
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Programmi\Yahoo!\Messenger\ypager.exe -quiet
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesit.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesit.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programmi\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary...o.cab32846.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Filter: text/html - {0EE6E743-DCD0-40E4-9851-E3DC9E1425FD} - C:\WINDOWS\System32\dcng.dll
O18 - Filter: text/plain - {0EE6E743-DCD0-40E4-9851-E3DC9E1425FD} - C:\WINDOWS\System32\dcng.dll

[LUCASS]

Ciao,meglio se sposti la cartella di hijack in C: o C:\programmi
Scaricati
CWShredder
About Buster
SpSeHjfix112
Clean Up

Per about buster devi aggiornarlo quindi aprilo e clicca su Update,creati cartelle separate per ognuno dei programmi

1-Disattiva il ripristino di configurazione di sistema
2-Avvia in modalita provvisoria
3-Apri hijack clicca sul 2 pulsante metti le spunte nelle caselle che corrispondono alle stringhe che ti metto sotto e clicca su fix cheked per eliminarle

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\FOX\IMPOST~1\Temp\se.dll/space.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about :blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\FOX\IMPOST~1\Temp\se.dll/space.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about :blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about :blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about :blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about :blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about :blank
O2 - BHO: (no name) - {2E7764A7-F611-4921-BA18-C70454B84969} - C:\WINDOWS\System32\dcng.dll
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\FOX\IMPOST~1\Temp\se.dll,DllInstall
O18 - Filter: text/html - {0EE6E743-DCD0-40E4-9851-E3DC9E1425FD} - C:\WINDOWS\System32\dcng.dll
O18 - Filter: text/plain - {0EE6E743-DCD0-40E4-9851-E3DC9E1425FD} - C:\WINDOWS\System32\dcng.dll

4-Apri SpSeHjfix112 e clicca su "Start Disinfection"

5-Apri about buster e clicca su "Begin Removal"

6-Apri CWShredder e clicca su "Fix"

7-Con esplora risorse elimina il file in rosso(ricorda di visualizzare i file e le cartelle nascoste e quelle di sistema da opzioni cartelle)
C:\WINDOWS\System32\dcng.dll

8-Apri Clan up,clicca su "Options" mettti le spunte in queste caselle
-Empty Recycle Bins
-Delete Cookies
-Delete Prefetch files (XP only)
-Scan local drives for temporary files
-Cleanup! All Users
Clicca su OK e poi su "CleanUp!"

Finito la pulizia riavvia il pc in modalita normale e posta questi log
-Hijack
-SpSeHjfix112(lo trovi nella sua cartella)
-About buster(lo trovi nella sua cartella)

[thomas_anderson]

gesù grande, LUCASS! ci hai dato dentro colla sicurezza! ottimo!

[LUCASS]

tutto cose riportate dai forum inglesi e molte cose lette nei post di amvinfe nei forum inglesi si impara molto riguardo le tecniche di rimozione