[Log Hijackthis] Dialer Hiberfil, ctfrmon e altri file di cui non riesco a liberarmi

[YuZzoLo]

Ho letto diversi topic a riguardo. Ho provato la procedura dei vari antivirus e antispyware che sta sticcata sul forum. Niente, non riesco a sbarazzarmene.

Potete darmi una mano?

Ecco il log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12.53.14, on 23/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Programmi\Java\jre1.6.0_01\bin\jusched.exe
C:\windows\system32\svchost.exe
C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\File comuni\Sony Shared\AVLib\SSScsiSV.exe
C:\Programmi\MSN Messenger\MsnMsgr.Exe
C:\Programmi\ICQ6\ICQ.exe
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\Programmi\File comuni\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\YuZzoLo\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.it/0SEITIT/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.it/0SEITIT/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.it/0SEITIT/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {c9368e7b-2578-4eba-a065-c3a2c53d9d9a} - C:\WINDOWS\system32\commgr.dll (file missing)
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_01\bin\jusched.exe "
O4 - HKLM\..\Run: [hzqsaa.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\hzqsaa.exe
O4 - HKLM\..\Run: [winopqiy] "c:\windows\system32\winopqiy.exe"
O4 - HKLM\..\Run: [hzftda.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\hzftda.exe
O4 - HKLM\..\Run: [kis] "C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"
O4 - HKLM\..\Run: [oospra.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\oospra.exe
O4 - HKLM\..\Run: [eezzda.exe] C:\Documents and Settings\YuZzoLo\Impostazioni locali\Temp\eezzda.exe
O4 - HKLM\..\Run: [tpzkfa.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\tpzkfa.exe
O4 - HKLM\..\Run: [zwbzab.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\zwbzab.exe
O4 - HKLM\..\Run: [bzllgb.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\bzllgb.exe
O4 - HKLM\..\Run: [hzkhaa.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\hzkhaa.exe
O4 - HKLM\..\Run: [wzzdlb.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\wzzdlb.exe
O4 - HKLM\..\Run: [lezzba.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\lezzba.exe
O4 - HKLM\..\Run: [zounaa.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\zounaa.exe
O4 - HKLM\..\Run: [uzzbha.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\uzzbha.exe
O4 - HKLM\..\Run: [dshhha.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\dshhha.exe
O4 - HKLM\..\Run: [iqexaa.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\iqexaa.exe
O4 - HKLM\..\Run: [mkzcza.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\mkzcza.exe
O4 - HKLM\..\Run: [lbazab.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\lbazab.exe
O4 - HKLM\..\Run: [ggxqcb.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\ggxqcb.exe
O4 - HKLM\..\Run: [zziupa.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\zziupa.exe
O4 - HKLM\..\Run: [zflzwa.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\zflzwa.exe
O4 - HKLM\..\Run: [bznzcb.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\bznzcb.exe
O4 - HKLM\..\Run: [zjzwda.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\zjzwda.exe
O4 - HKLM\..\Run: [homgaa.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\homgaa.exe
O4 - HKLM\..\Run: [nefcza.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\nefcza.exe
O4 - HKLM\..\Run: [jzzkfa.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\jzzkfa.exe
O4 - HKLM\..\Run: [osalfa.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\osalfa.exe
O4 - HKLM\..\Run: [hhuvcb.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\hhuvcb.exe
O4 - HKLM\..\Run: [znhcha.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\znhcha.exe
O4 - HKLM\..\Run: [uzvcta.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\uzvcta.exe
O4 - HKLM\..\Run: [mqfrob.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\mqfrob.exe
O4 - HKLM\..\Run: [zvbdza.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\zvbdza.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ICQ] "C:\Programmi\ICQ6\ICQ.exe" silent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programmi\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: Aggiungi a Kaspersky Anti-Banner - C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 6.0\\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programmi\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programmi\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B81E38A2-8D2E-4F8E-9D21-FD8F3A206D43}: NameServer = 212.17.192.216,212.17.192.49
O20 - AppInit_DLLs: ,C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O20 - Winlogon Notify: commgr - commgr.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Kaspersky Lab - C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\SSScsiSV.exe

--
End of file - 8557 bytes



Grazie anticipato a tutti!

[OYS]

1) Scarica ATF Cleaner . Avvialo, seleziona tutte le voci e premi "empty selected". Se usi Firefox o Opera ripeti l'azione dopo aver selezionato le relative opzioni di menu.



2) Fixa questi:


O2 - BHO: (no name) - {c9368e7b-2578-4eba-a065-c3a2c53d9d9a} - C:\WINDOWS\system32\commgr.dll (file missing)

O4 - HKLM\..\Run: [hzqsaa.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\hzqsaa.exe

O4 - HKLM\..\Run: [winopqiy] "c:\windows\system32\winopqiy.exe"

O4 - HKLM\..\Run: [hzftda.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\hzftda.exe

O4 - HKLM\..\Run: [oospra.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\oospra.exe

O4 - HKLM\..\Run: [eezzda.exe] C:\Documents and Settings\YuZzoLo\Impostazioni
locali\Temp\eezzda.exe

O4 - HKLM\..\Run: [tpzkfa.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\tpzkfa.exe

O4 - HKLM\..\Run: [zwbzab.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\zwbzab.exe

O4 - HKLM\..\Run: [bzllgb.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\bzllgb.exe

O4 - HKLM\..\Run: [hzkhaa.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\hzkhaa.exe

O4 - HKLM\..\Run: [wzzdlb.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\wzzdlb.exe

O4 - HKLM\..\Run: [lezzba.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\lezzba.exe

O4 - HKLM\..\Run: [zounaa.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\zounaa.exe

O4 - HKLM\..\Run: [uzzbha.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\uzzbha.exe

O4 - HKLM\..\Run: [dshhha.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\dshhha.exe

O4 - HKLM\..\Run: [iqexaa.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\iqexaa.exe

O4 - HKLM\..\Run: [mkzcza.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\mkzcza.exe

O4 - HKLM\..\Run: [lbazab.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\lbazab.exe

O4 - HKLM\..\Run: [ggxqcb.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\ggxqcb.exe

O4 - HKLM\..\Run: [zziupa.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\zziupa.exe

O4 - HKLM\..\Run: [zflzwa.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\zflzwa.exe

O4 - HKLM\..\Run: [bznzcb.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\bznzcb.exe

O4 - HKLM\..\Run: [zjzwda.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\zjzwda.exe

O4 - HKLM\..\Run: [homgaa.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\homgaa.exe

O4 - HKLM\..\Run: [nefcza.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\nefcza.exe

O4 - HKLM\..\Run: [jzzkfa.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\jzzkfa.exe

O4 - HKLM\..\Run: [osalfa.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\osalfa.exe

O4 - HKLM\..\Run: [hhuvcb.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\hhuvcb.exe

O4 - HKLM\..\Run: [znhcha.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\znhcha.exe

O4 - HKLM\..\Run: [uzvcta.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\uzvcta.exe

O4 - HKLM\..\Run: [mqfrob.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\mqfrob.exe

O4 - HKLM\..\Run: [zvbdza.exe] C:\DOCUME~1\YuZzoLo\IMPOST~1\Temp\zvbdza.exe

O20 - Winlogon Notify: commgr - commgr.dll (file missing)



3)Scarica http://swandog46.geekstogo.com/avenger.zip

clicca su input script manually e poi sulla lente di ingrandimento.
nello spazio bianco inserisci con copia incolla questo:


C:\WINDOWS\system32\commgr.dll
c:\windows\system32\winopqiy.exe
C:\Documents and Settings\YuZzoLo\Impostazioni
locali\Temp\eezzda.exe
C:\Programmi\Google\bipsetup.mcd
C:\Programmi\Google\exsetup.mcd
C:\Programmi\Google\googletoolbar1.dll
c:\Documents and Settings\User\kd678.exe
C:\Programmi\kd678.exe
C:\Documents and Settings\User\Impostazioni locali\Temp\temp77726.exe



4) Scarica PrevX e fai una scansione

5) Scarica VirIt e fai una scansione

6) Scarica SuperAntispyware e fai una scansione

7) Scarica FindAWF.
Avvialo, premi invio, scrivi 1 e premi invio.

Quando hai finito posta tutti i log nel tuo prossimo messaggio, compreso un nuovo log di HijackThis.

[YuZzoLo]

Originariamente inviato da OYS
3)Scarica http://swandog46.geekstogo.com/avenger.zip

clicca su input script manually e poi sulla lente di ingrandimento.
nello spazio bianco inserisci con copia incolla questo:


C:\WINDOWS\system32\commgr.dll
c:\windows\system32\winopqiy.exe
C:\Documents and Settings\YuZzoLo\Impostazioni
locali\Temp\eezzda.exe
C:\Programmi\Google\bipsetup.mcd
C:\Programmi\Google\exsetup.mcd
C:\Programmi\Google\googletoolbar1.dll
c:\Documents and Settings\User\kd678.exe
C:\Programmi\kd678.exe
C:\Documents and Settings\User\Impostazioni locali\Temp\temp77726.exe


.

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Service s\sduqlbuq

*******************

Script file located at: \??\C:\Documents and Settings\gvtatdhn.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



File C:\WINDOWS\system32\commgr.dll not found!
Deletion of file C:\WINDOWS\system32\commgr.dll failed!

Could not process line:
C:\WINDOWS\system32\commgr.dll
Status: 0xc0000034

File c:\windows\system32\winopqiy.exe deleted successfully.


File C:\Documents and Settings\YuZzoLo\Impostazioni not found!
Deletion of file C:\Documents and Settings\YuZzoLo\Impostazioni failed!

Could not process line:
C:\Documents and Settings\YuZzoLo\Impostazioni
Status: 0xc0000034



Could not open file locali\Temp\eezzda.exe for deletion
Deletion of file locali\Temp\eezzda.exe failed!

Could not process line:
locali\Temp\eezzda.exe
Status: 0xc000003a



File C:\Programmi\Google\bipsetup.mcd not found!
Deletion of file C:\Programmi\Google\bipsetup.mcd failed!

Could not process line:
C:\Programmi\Google\bipsetup.mcd
Status: 0xc0000034



File C:\Programmi\Google\exsetup.mcd not found!
Deletion of file C:\Programmi\Google\exsetup.mcd failed!

Could not process line:
C:\Programmi\Google\exsetup.mcd
Status: 0xc0000034



File C:\Programmi\Google\googletoolbar1.dll not found!
Deletion of file C:\Programmi\Google\googletoolbar1.dll failed!

Could not process line:
C:\Programmi\Google\googletoolbar1.dll
Status: 0xc0000034



Could not open file c:\Documents and Settings\User\kd678.exe for deletion
Deletion of file c:\Documents and Settings\User\kd678.exe failed!

Could not process line:
c:\Documents and Settings\User\kd678.exe
Status: 0xc000003a



File C:\Programmi\kd678.exe not found!
Deletion of file C:\Programmi\kd678.exe failed!

Could not process line:
C:\Programmi\kd678.exe
Status: 0xc0000034



Could not open file C:\Documents and Settings\User\Impostazioni locali\Temp\temp77726.exe[/color] for deletion
Deletion of file C:\Documents and Settings\User\Impostazioni locali\Temp\temp77726.exe[/color] failed!

Could not process line:
C:\Documents and Settings\User\Impostazioni locali\Temp\temp77726.exe[/color]
Status: 0xc000003a


Completed script processing.

*******************

Finished! Terminate.



Ti posto il log intanto.
Procedo con i vari scan


Prevx CSI mi rileva

c:\WINDOWS\services.dll

[OYS]

Ok, procedi.

[YuZzoLo]

Ho fatto tutti gli scan con i programmi da te elencati.

ecco il log di FindAWF

Find AWF report by noahdfear ©2006
Version 1.40



bak folders found
~~~~~~~~~~~

Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 782C-60FF

Directory di C:\PROGRA~1\DAEMON~1\BAK

10/12/2005 15.57 133.016 daemon.exe
1 File 133.016 byte
2 Directory 9.911.001.088 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 782C-60FF

Directory di C:\PROGRA~1\MSNMES~1\BAK

0 File 0 byte
2 Directory 9.911.001.088 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 782C-60FF

Directory di C:\WINDOWS\SYSTEM32\BAK

19/08/2004 14.39 15.360 ctfmon.exe
09/07/2001 10.50 155.648 NeroCheck.exe
2 File 171.008 byte
2 Directory 9.910.996.992 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 782C-60FF

Directory di C:\PROGRA~1\ATITEC~1\ATICON~1\BAK

07/11/2002 20.00 294.912 atiptaxx.exe
1 File 294.912 byte
2 Directory 9.910.996.992 byte disponibili


Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~

133016 10 Dec 2005 "C:\Programmi\DAEMON Tools\bak\daemon.exe"
15360 19 Aug 2004 "C:\WINDOWS\system32\ctfmon.exe"
15360 19 Aug 2004 "C:\WINDOWS\system32\bak\ctfmon.exe"
155648 9 Jul 2001 "C:\WINDOWS\system32\bak\NeroCheck.exe"
294912 7 Nov 2002 "C:\Programmi\ATI Technologies\ATI Control Panel\bak\atiptaxx.exe"


end of report



Ecco il nuovo log di Hijack

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14.56.06, on 26/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
C:\VEXPLITE\viritsvc.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Programmi\Java\jre1.6.0_01\bin\jusched.exe
C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\VEXPLITE\MONLITE.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\MSN Messenger\MsnMsgr.Exe
C:\Programmi\ICQ6\ICQ.exe
C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Programmi\File comuni\Sony Shared\AVLib\SSScsiSV.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\File comuni\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\YuZzoLo\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.it/0SEITIT/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.it/0SEITIT/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.it/0SEITIT/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_01\bin\jusched.exe "
O4 - HKLM\..\Run: [kis] "C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"
O4 - HKLM\..\Run: [VIRIT LITE MONITOR] C:\VEXPLITE\MONLITE.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ICQ] "C:\Programmi\ICQ6\ICQ.exe" silent
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programmi\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: Aggiungi a Kaspersky Anti-Banner - C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 6.0\\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programmi\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programmi\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B81E38A2-8D2E-4F8E-9D21-FD8F3A206D43}: NameServer = 212.17.192.216,212.17.192.49
O20 - AppInit_DLLs: ,C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Programmi\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Kaspersky Lab - C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Virit eXplorer Lite (viritsvclite) - TG Soft Sas www.tgsoft.it - C:\VEXPLITE\viritsvc.exe

--
End of file - 6479 bytes

[OYS]

Esegui questo script con avenger:


files to move:
C:\Programmi\DAEMON Tools\bak\daemon.exe | C:\Programmi\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\bak\ctfmon.exe | C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\bak\NeroCheck.exe | C:\WINDOWS\system32\NeroCheck.exe
C:\Programmi\ATI Technologies\ATI Control Panel\bak\atiptaxx.exe | C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe

[YuZzoLo]

Sembra filare tutto liscio finalmente!
Grazie mille, credo sia la prima volta che lotto contro queste cose. Mi son spesso arreso a tediosi format.

Ciao e grazie ancora OYS!

[OYS]

Ciao