pc-facile • mi date una controllata al log?
mi date una controllata al log?
di zero87 » 01/02/08 19:23
ciao ragazzi un paio di settimane fa sono incappato nel virus beagle è stata un odissea rimuoverlo e installare un buon antivurs. e fino a qui tutto ok da un paio di giorni però mi è capitato di notare che aprendo internet explore o firefox che mi appaio finestre con su scritto che il mio pc è infettato o che è a rischio e questo su ogni sito che vado se questo non bastasse ho notato una notevole diminuzione della velocità di connessione. In più ho notato che aprendo il task manager di processi mai visti prima. Mi potreste dare un occhiata al mio log e di consegueza un aiuto possibile?
vi ringrazzio in anticipo delle future risposte e mi scuso se ho infranto qualche regola oh se ho sbagliato la sezione da postare ^_^
http://www.zshare.net/download/7092576d8ac617/
(il log lo trovate al link qui sopra scusate ma con firefox non mi apre la paginetta per allegare i file)
Re: mi date una controllata al log?
di hydra » 01/02/08 19:33
di zero87 » 03/02/08 11:03
ragazzi proprio nessuno che mi da una mano?
di Luke57 » 03/02/08 11:22
Ciao, scarica questi 2 files sul desktop
di zero87 » 03/02/08 12:09
grazie luke della repentiva risposta ti metto i log dei programmi che mi hai fatto partite
Scan started at 11.36.30 03/02/2008
C:\windows\system32\aazkeykw.dllbox
C:\WINDOWS\system32\alwgywrm.dll
C:\WINDOWS\system32\aqbxubar.dll
C:\WINDOWS\system32\bkwxrhwe.ini
C:\WINDOWS\system32\cqpushwk.dll
C:\WINDOWS\system32\djmyjfwj.dll
C:\WINDOWS\system32\ewhrxwkb.dll
C:\WINDOWS\system32\kwhsupqc.ini
C:\WINDOWS\system32\mrwygwla.ini
C:\WINDOWS\system32\rbbafvru.dll
C:\WINDOWS\system32\sehasmwr.dll
Attempting to delete C:\windows\system32\aazkeykw.dllbox
C:\windows\system32\aazkeykw.dllbox Has been deleted!
Attempting to delete C:\WINDOWS\system32\alwgywrm.dll
C:\WINDOWS\system32\alwgywrm.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\aqbxubar.dll
C:\WINDOWS\system32\aqbxubar.dll Could not be deleted.
Attempting to delete C:\WINDOWS\system32\bkwxrhwe.ini
C:\WINDOWS\system32\bkwxrhwe.ini Has been deleted!
Attempting to delete C:\WINDOWS\system32\cqpushwk.dll
C:\WINDOWS\system32\cqpushwk.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\djmyjfwj.dll
C:\WINDOWS\system32\djmyjfwj.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\ewhrxwkb.dll
C:\WINDOWS\system32\ewhrxwkb.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\kwhsupqc.ini
C:\WINDOWS\system32\kwhsupqc.ini Has been deleted!
Attempting to delete C:\WINDOWS\system32\mrwygwla.ini
C:\WINDOWS\system32\mrwygwla.ini Has been deleted!
Attempting to delete C:\WINDOWS\system32\rbbafvru.dll
C:\WINDOWS\system32\rbbafvru.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\sehasmwr.dll
C:\WINDOWS\system32\sehasmwr.dll Has been deleted!
C:\WINDOWS\system32\aqbxubar.dll Has been deleted!
ComboFix 08-02.03.1 - Daniele 2008-02-03 11.56.48.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1040.18.501 [GMT 1:00]
Eseguito da: C:\Documents and Settings\Daniele\Desktop\ComboFix.exe
C:\WINDOWS\system32\bujlomrg.ini
C:\WINDOWS\system32\cgcwettw.ini
C:\WINDOWS\system32\dehhmguj.ini
C:\WINDOWS\system32\exymakix.ini
C:\WINDOWS\system32\gcudythg.ini
C:\WINDOWS\system32\kmxcgqrc.ini
C:\WINDOWS\system32\ltgodfdu.ini
C:\WINDOWS\system32\tiamryuo.ini
C:\WINDOWS\system32\trtswqty.ini
C:\WINDOWS\system32\ucukhond.ini
C:\WINDOWS\system32\wifhcniw.ini
C:\WINDOWS\system32\ytqwstrt.dll
((((((((((((((((((((((((( Files Creati Da 2008-01-03 al 2008-02-03 )))))))))))))))))))))))))))))))))))
2008-02-03 11:36 . 2008-02-03 11:50	<DIR>	d--------	C:\VundoFix Backups
2008-02-02 20:13 . 2008-02-02 20:14	<DIR>	d--------	C:\Programmi\Bubble
2008-02-02 20:13 . 1997-01-22 16:34	312,320	--a------	C:\WINDOWS\IsUninst.exe
2008-02-02 20:13 . 2008-02-02 20:13	31	--a------	C:\dxerror.ini
2008-02-02 20:11 . 2008-02-02 20:11	724,992	--a------	C:\WINDOWS\iun6002.exe
2008-02-01 19:40 . 2008-02-01 19:42	<DIR>	d--------	C:\Programmi\Unlocker
2008-01-30 22:07 . 2008-01-30 22:07	<DIR>	d--------	C:\Programmi\Act-3D
2008-01-30 11:50 . 2008-01-30 14:33	<DIR>	d--------	C:\Programmi\Proantivirus Lab
2008-01-30 11:44 . 2008-01-30 11:48	38,400	--a------	C:\WINDOWS\system32\tuvsrrr.dll.vir
2008-01-30 11:42 . 2008-01-30 11:42	294	--ahs----	C:\WINDOWS\system32\ftalciab.ini
2008-01-30 11:41 . 2008-01-30 11:47	<DIR>	d-a------	C:\Documents and Settings\All Users\Dati applicazioni\TEMP
2008-01-30 11:40 . 2008-01-30 11:40	<DIR>	d--------	C:\Documents and Settings\Daniele\Dati applicazioni\Simply Super Software
2008-01-30 11:40 . 2008-01-30 11:40	<DIR>	d--------	C:\Documents and Settings\All Users\Dati applicazioni\Simply Super Software
2008-01-30 00:19 . 2008-01-12 18:32	23,904	--a------	C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-01-30 00:19 . 2008-01-15 09:54	10,537	--a------	C:\WINDOWS\system32\drivers\COH_Mon.cat
2008-01-30 00:19 . 2008-01-15 05:28	706	--a------	C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-01-29 20:12 . 2008-01-29 20:12	<DIR>	d--------	C:\Documents and Settings\Daniele\Dati applicazioni\DAEMON Tools
2008-01-29 19:57 . 2008-01-29 19:57	716,272	--a------	C:\WINDOWS\system32\drivers\sptd.sys
2008-01-29 12:11 . 2008-01-29 12:11	94	--a------	C:\WINDOWS\wininit.ini
2008-01-29 11:50 . 2008-01-30 10:06	1,144,171	--a------	C:\WINDOWS\system32\trtswqty.ini.vir
2008-01-29 11:37 . 2008-01-29 11:37	<DIR>	d--------	C:\Programmi\Spybot - Search & Destroy
2008-01-29 11:37 . 2008-01-29 11:48	<DIR>	d--------	C:\Documents and Settings\All Users\Dati applicazioni\Spybot - Search & Destroy
2008-01-29 11:35 . 2008-02-03 11:31	13,452	--a------	C:\WINDOWS\BM8b5202e2.xml
2008-01-29 11:35 . 2008-02-03 10:51	22	--a------	C:\WINDOWS\pskt.ini
2008-01-28 19:44 . 2006-10-26 19:56	32,592	--a------	C:\WINDOWS\system32\msonpmon.dll
2008-01-28 19:27 . 2008-01-28 19:27	<DIR>	d--------	C:\Programmi\Microsoft Works
2008-01-28 19:26 . 2008-01-28 19:26	<DIR>	d--------	C:\Programmi\MSBuild
2008-01-28 19:10 . 2008-01-29 01:03	<DIR>	d--------	C:\Documents and Settings\All Users\Dati applicazioni\Microsoft Help
2008-01-27 17:46 . 2008-01-27 17:46	<DIR>	d--------	C:\Programmi\File comuni\Wise Installation Wizard
2008-01-27 17:46 . 2008-01-27 17:48	<DIR>	d--------	C:\Documents and Settings\All Users\Dati applicazioni\Lavasoft
2008-01-24 17:56 . 2007-03-21 20:33	503,808	--a------	C:\WINDOWS\system32\MSVCP71.DL1
2008-01-24 17:56 . 2007-03-21 20:33	348,160	--a------	C:\WINDOWS\system32\MSVCR71.DL1
2008-01-24 16:16 . 2008-01-24 16:23	10,740	--a------	C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-01-24 16:16 . 2008-01-24 16:23	805	--a------	C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-01-24 15:59 . 2008-01-24 18:03	<DIR>	d--------	C:\Programmi\Norton AntiVirus
2008-01-24 15:58 . 2008-01-24 16:23	123,952	--a------	C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-01-24 15:58 . 2008-01-24 16:23	60,800	--a------	C:\WINDOWS\system32\S32EVNT1.DLL
2008-01-24 15:57 . 2008-01-24 16:23	<DIR>	d--------	C:\Programmi\Symantec
2008-01-24 15:57 . 2008-02-01 09:52	<DIR>	d--------	C:\Documents and Settings\All Users\Dati applicazioni\Symantec
2008-01-24 15:56 . 2008-01-31 21:05	<DIR>	d--------	C:\Programmi\File comuni\Symantec Shared
2008-01-24 10:46 . 2008-01-24 10:59	<DIR>	d--------	C:\WINDOWS\system32\ActiveScan
2008-01-24 10:46 . 2008-01-24 10:46	30,590	--a------	C:\WINDOWS\system32\pavas.ico
2008-01-24 10:46 . 2008-01-24 10:46	2,550	--a------	C:\WINDOWS\system32\Uninstall.ico
2008-01-24 10:46 . 2008-01-24 10:46	1,406	--a------	C:\WINDOWS\system32\Help.ico
2008-01-23 22:22 . 2008-01-23 22:22	38,400	--a------	C:\WINDOWS\system32\tuvsrrr.dll
2008-01-21 18:41 . 2008-01-21 18:41	<DIR>	d--------	C:\Programmi\File comuni\Skype
2008-01-21 18:41 . 2008-02-03 10:52	<DIR>	d--------	C:\Documents and Settings\Daniele\Dati applicazioni\skypePM
2008-01-21 18:41 . 2008-01-21 18:41	32	--a------	C:\Documents and Settings\All Users\Dati applicazioni\ezsid.dat
2008-01-19 00:18 . 2008-01-24 12:07	<DIR>	d--------	C:\Documents and Settings\All Users\Dati applicazioni\SiteAdvisor
2008-01-18 21:12 . 2008-01-24 11:55	250	--a------	C:\WINDOWS\gmer.ini
2008-01-18 20:54 . 2008-01-18 20:54	<DIR>	d--------	C:\Documents and Settings\All Users\Dati applicazioni\Kaspersky Lab Setup Files
2008-01-18 19:11 . 2008-01-24 15:37	<DIR>	d--------	C:\Documents and Settings\All Users\Dati applicazioni\McAfee
2008-01-16 13:11 . 2008-01-16 13:11	<DIR>	d--------	C:\Programmi\iPod
2008-01-16 13:11 . 2008-02-03 12:03	54,156	--ah-----	C:\WINDOWS\QTFont.qfn
2008-01-16 13:11 . 2008-01-16 13:11	1,409	--a------	C:\WINDOWS\QTFont.for
2008-01-16 13:10 . 2008-01-24 11:01	<DIR>	d--------	C:\Programmi\iTunes
2008-01-14 19:01 . 2008-01-14 19:01	<DIR>	d--------	C:\Documents and Settings\Daniele\Dati applicazioni\vlc
2008-01-14 19:00 . 2008-01-14 19:02	<DIR>	d--------	C:\Programmi\VideoLAN
2008-01-05 13:31 . 2008-01-05 13:31	54	--a------	C:\WINDOWS\Composer.INI
2008-02-03 10:53	---------	d-----w	C:\Documents and Settings\Daniele\Dati applicazioni\Skype
2008-02-01 18:44	---------	d-----w	C:\Programmi\eMule
2008-02-01 10:12	141,612	----a-w	C:\WINDOWS\system32\drivers\dump_wmimmc.sys
2008-02-01 09:47	---------	d-----w	C:\Documents and Settings\Daniele\Dati applicazioni\LimeWire
2008-01-27 16:48	9,344	----a-w	C:\WINDOWS\system32\drivers\NSDriver.sys
2008-01-27 16:48	8,320	----a-w	C:\WINDOWS\system32\drivers\AWRTRD.sys
2008-01-27 16:46	---------	d-----w	C:\Programmi\Lavasoft
2008-01-24 10:01	---------	d-----w	C:\Programmi\QuickTime
2008-01-24 10:01	---------	d-----w	C:\Programmi\Messenger Plus! Live
2008-01-24 10:00	---------	d-----w	C:\Programmi\PC Connectivity Solution
2008-01-24 09:59	---------	d-----w	C:\Programmi\Star Downloader
2008-01-22 23:10	---------	d-----w	C:\Documents and Settings\Daniele\Dati applicazioni\PC Suite
2008-01-18 23:00	---------	d-----w	C:\Programmi\Yahoo!
2008-01-17 18:41	---------	d-----w	C:\Programmi\File comuni\Elecard
2008-01-16 16:02	---------	d-----w	C:\Documents and Settings\Daniele\Dati applicazioni\IMVU
2008-01-12 16:44	---------	d-----w	C:\Programmi\K-Lite Codec Pack
2008-01-12 16:44	---------	d-----w	C:\Programmi\BitComet
2008-01-05 14:32	---------	d--h--w	C:\Programmi\InstallShield Installation Information
2008-01-05 12:15	---------	d-----w	C:\Programmi\IMVU
2007-12-30 19:35	---------	d-----w	C:\Programmi\Fireplace 3D Screensaver
2007-12-30 19:35	---------	d-----w	C:\Programmi\3Planesoft Screensaver Manager
2007-12-30 19:31	---------	d-----w	C:\Programmi\3D Realistic Fireplace 3
2007-12-30 17:21	---------	d-----w	C:\Programmi\Magic Video Studio
2007-12-29 09:37	---------	d-----w	C:\Programmi\RegCleaner
2007-12-26 23:15	---------	d-----w	C:\Programmi\LifeView TVR
2007-12-17 10:53	---------	d-----w	C:\Programmi\MSN Messenger
2007-12-10 19:49	---------	d-----w	C:\Programmi\Windows Live
2007-12-10 19:48	---------	d-----w	C:\Documents and Settings\All Users\Dati applicazioni\WLInstaller
2007-12-01 11:29	81,920	----a-w	C:\Documents and Settings\Daniele\Dati applicazioni\ezpinst.exe
2007-12-01 11:29	47,360	----a-w	C:\Documents and Settings\Daniele\Dati applicazioni\pcouffin.sys
2007-11-27 13:22	2,521,600	----a-w	C:\WINDOWS\3D Realistic Fireplace 3.scr
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{04272D89-0DF7-420D-B998-65A93EA9DEF6}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0dbc62e1-a9d0-41e9-82e9-6c336ee5bb90}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0F39250B-0BCA-437D-9D03-ED60CD956600}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{18DCA410-C9E3-4123-9CB6-1B319C05DB29}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1edaaf16-1d22-432d-b04a-a07abd776287}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{39FF2B40-72B6-4C69-B886-AD4A649769E4}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{437A71AC-2867-41E9-8BC7-901761C35B80}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4873EC3E-BA5A-47F8-A36B-64763924CA3C}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{56402C34-F423-42E8-B537-D4E0CCC77BDE}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5BED7523-B667-41A0-A0E6-9296D67F8FCF}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{82BDA718-794F-44C1-A1CB-3301FAAC00FD}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A85EC2C8-D667-429D-8BC6-FB187E48DBE4}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CAD210E1-BBF5-4396-BD1E-78D43DDE7054}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D7B8BAF8-F917-44DC-B2BA-7833AAFA0623}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EF465E3F-A595-458B-ADFF-AEB82A53A625}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{f4bdc11b-67a4-4ddd-86d1-7fbf7b0a6be5}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{f8bdc543-292d-48b4-ab6e-2c6e31336cb8}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FA24E381-2835-4256-BDE2-07705B1FF87C}]
"MsnMsgr"="C:\Programmi\Windows Live\Messenger\MsnMsgr.exe" [2007-12-10 20:50 5724184]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe" [2005-09-25 19:11 94208]
"Skype"="C:\Programmi\Skype\Phone\Skype.exe" [2007-12-07 15:08 21686568]
"DAEMON Tools Lite"="C:\Programmi\DAEMON Tools Lite\daemon.exe" [ ]
"SW20"="C:\WINDOWS\system32\sw20.exe" [2006-05-18 02:15 208896]
"SW24"="C:\WINDOWS\system32\sw24.exe" [2006-05-17 03:37 69632]
"RecSche"="C:\Programmi\LifeView TVR\RecSche.exe" [2003-11-12 07:38 466944]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2005-09-25 19:11 155648]
"CloneCDTray"="C:\Programmi\SlySoft\CloneCD\CloneCDTray.exe" [2005-05-19 14:47 57344]
"TkBellExe"="C:\Programmi\File comuni\Real\Update_OB\realsched.exe" [2007-02-21 18:17 185896]
"QuickTime Task"="C:\Programmi\QuickTime\QTTask.exe" [2008-01-10 15:27 385024]
"iTunesHelper"="C:\Programmi\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048]
"ccApp"="C:\Programmi\File comuni\Symantec Shared\ccApp.exe" [2006-09-03 00:04 84640]
"osCheck"="C:\Programmi\Norton AntiVirus\osCheck.exe" [2006-09-05 18:22 26248]
"Symantec PIF AlertEng"="C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 10:22 517768]
"VX1000"="C:\WINDOWS\vVX1000.exe" [2006-06-30 00:42 707376]
"BM8b5202e2"="C:\WINDOWS\system32\aqbxubar.dll" [ ]
"Alcmtr"="ALCMTR.EXE" [2005-05-03 11:43 69632 C:\WINDOWS\ALCMTR.EXE]
"8861317e"="C:\WINDOWS\system32\ytqwstrt.dll" [ ]
"SpybotDeletingC7852"="cmd /c del C:\WINDOWS\system32\nxhfhoce.dllbox" [ ]
C:\Documents and Settings\Daniele\Menu Avvio\Programmi\Esecuzione automatica\
Adobe Gamma.lnk - C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50 113664]
IMVU.lnk - C:\Programmi\IMVU\IMVUClient.exe [2008-01-15 20:49:10 49408]
Ritaglio schermata e avvio di OneNote 2007.lnk - C:\Programmi\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 20:24:54 98632]
Avvio veloce di Adobe Reader.lnk - C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 04:44:06 29696]
WinZip Quick Pick.lnk - C:\Programmi\WinZip\WZQKPICK.EXE [2007-02-15 17:13:34 122880]
"Service"= C:\WINDOWS\sysnet32.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\aazkeykw]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tuvsrrr]
tuvsrrr.dll 2008-01-23 22:22 38400 C:\WINDOWS\system32\tuvsrrr.dll
-ra------ 2006-06-30 00:42 707376 C:\WINDOWS\vVX1000.exe
R2 Utilità di pianificazione di LiveUpdate automatico;Utilità di pianificazione di LiveUpdate automatico;"C:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe" [2007-09-26 10:54]
S3 usbscan;Driver scanner USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 VX1000;VX-1000;C:\WINDOWS\system32\DRIVERS\VX1000.sys [2006-06-30 00:42]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2d793008-ce9e-11dc-aae7-001617d98ee1}]
"2008-01-30 11:50:14 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
"2008-02-01 19:22:10 C:\WINDOWS\Tasks\Norton AntiVirus - Scansione completa sistema - Daniele.job"
- C:\PROGRA~1\NORTON~1\Navw32.exei/TASK:
Rootkit scan 2008-02-03 12:03:59
-> C:\WINDOWS\system32\tuvsrrr.dll
Ora fine scansione: 2008-02-03 12:06:44 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-03 11:06:39
2008-01-29 00:03:19	--- E O F ---
di Luke57 » 03/02/08 17:16
C:\WINDOWS\system32\tuvsrrr.dll.vir
C:\WINDOWS\system32\trtswqty.ini.vir
C:\WINDOWS\system32\tuvsrrr.dll
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{04272D89-0DF7-420D-B998-65A93EA9DEF6}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0dbc62e1-a9d0-41e9-82e9-6c336ee5bb90}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0F39250B-0BCA-437D-9D03-ED60CD956600}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{18DCA410-C9E3-4123-9CB6-1B319C05DB29}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1edaaf16-1d22-432d-b04a-a07abd776287}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{39FF2B40-72B6-4C69-B886-AD4A649769E4}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{437A71AC-2867-41E9-8BC7-901761C35B80}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4873EC3E-BA5A-47F8-A36B-64763924CA3C}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{49D63E18-33B1-46F2-82C2-39431FB94794}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{56402C34-F423-42E8-B537-D4E0CCC77BDE}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5BED7523-B667-41A0-A0E6-9296D67F8FCF}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{82BDA718-794F-44C1-A1CB-3301FAAC00FD}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A85EC2C8-D667-429D-8BC6-FB187E48DBE4}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CAD210E1-BBF5-4396-BD1E-78D43DDE7054}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D7B8BAF8-F917-44DC-B2BA-7833AAFA0623}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EF465E3F-A595-458B-ADFF-AEB82A53A625}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{f8bdc543-292d-48b4-ab6e-2c6e31336cb8}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FA24E381-2835-4256-BDE2-07705B1FF87C}]
"BM8b5202e2"=-
8861317e"=-
"Service"= -
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\aazkeykw]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tuvsrrr]
apri un file di testo (start>esegui>notepad.exe>OK), ci incolli il codice, lo salvi obbligatoriamente con il nome
CFScript.txt.
Lo trascini con il puntatore del mouse sopra l'icona di combofix e attendi una nuova scansione del programma con eventuale riavvio. Posta poi il nuovo report.
di zero87 » 03/02/08 18:25
ComboFix 08-02.03.1 - Daniele 2008-02-03 18.15.40.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1040.18.497 [GMT 1:00]
Eseguito da: C:\Documents and Settings\Daniele\Desktop\CombFix.exe
2008-01-21 18:41 . 2008-02-03 16:04	<DIR>	d--------	C:\Documents and Settings\Daniele\Dati applicazioni\skypePM
2008-02-03 17:11	---------	d-----w	C:\Documents and Settings\Daniele\Dati applicazioni\Skype
2008-01-27 16:48	12,632	----a-w	C:\WINDOWS\system32\lsdelete.exe
2007-12-27 13:45	3,489,792	----a-w	C:\WINDOWS\system32\Fireplace 3D Screensaver.exe
2007-12-26 15:10	850,944	----a-w	C:\WINDOWS\system32\Fireplace_3D_Screensaver.scr
2007-12-24 15:45	450,560	----a-w	C:\WINDOWS\system32\3Planesoft_Screensaver_Manager.scr
Rootkit scan 2008-02-03 18:18:06
Ora fine scansione: 2008-02-03 18.18.28
ComboFix-quarantined-files.txt 2008-02-03 17:18:25
ComboFix2.txt 2008-02-03 11:06:44
di zero87 » 07/02/08 18:30
scusa luke che altro devo fare ora?
di Luke57 » 07/02/08 19:54
C:\WINDOWS\BM8b5202e2.xml
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f4bdc11b-67a4-4ddd-86d1-7fbf7b0a6be5}
di zero87 » 07/02/08 23:48
\Registry\Machine\System\CurrentControlSet\Services\ouxwoehq
Script file located at: \??\C:\hmlscluq.txt
File C:\WINDOWS\system32\tuvsrrr.dll.vir deleted successfully.
File C:\WINDOWS\system32\trtswqty.ini.vir deleted successfully.
File C:\WINDOWS\BM8b5202e2.xml deleted successfully.
File C:\WINDOWS\system32\tuvsrrr.dll deleted successfully.
Registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f4bdc11b-67a4-4ddd-86d1-7fbf7b0a6be5} deleted successfully.
Topic correlati a "mi date una controllata al log?":
Autore: alberto marziali Forum: Consigli per gli acquisti