• F
    User Attivo •

    [Risotlo] E' solo un avviso o un virus?

    Da un paio di giorno mi compare una finestra di avviso mentre navigo, a intervalli irregolari (tipo 1 volta in 3 ore, poi niente, oppure ancora dopo un paio d'ore...) che contiene questa scritta:

    client1048.com:443 utilizza un certificato di sicurezza non valido.

    Il certificato non è affidabile in quanto auto-firmato.
    Il certificato è valido solo per <a id="cert_domain_link" title="LiquidNet Ltd.">LiquidNet Ltd.</a>.

    (Codice di errore: sec_error_ca_cert_invalid)

    Mi devo preoccupare oppure non è niente? Avg e Spybot non rilevano nulla...

    0
  • M
    User •

    posta un log di hijackthis

    0
  • F
    User Attivo •

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 22.32.23, on 18/09/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Programmi\CyberLink\Shared files\RichVideo.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\RTHDCPL.EXE
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\Programmi\digicomt\Michelangelo USB ADSL\CnxDslTb.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe
    C:\Programmi\File comuni\Ahead\Lib\NMIndexStoreSvr.exe
    C:\Programmi\DNA\btdna.exe
    C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Documents and Settings\Utente\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe
    C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
    C:\Programmi\Windows Live\Messenger\usnsvc.exe
    C:\Programmi\Messenger\msmsgs.exe
    C:\Programmi\Mozilla Firefox\firefox.exe
    C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
    O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programmi\AVG\AVG8\avgssie.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Programmi\AVG\AVG8\avgtoolbar.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar1.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\4.1.805.1852\swg.dll
    O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Programmi\AVG\AVG8\avgtoolbar.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar1.dll
    O4 - HKLM..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM..\Run: [CnxDslTaskBar] "C:\Programmi\digicomt\Michelangelo USB ADSL\CnxDslTb.exe"
    O4 - HKLM..\Run: [QuickTime Task] "C:\Programmi\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe"
    O4 - HKCU..\Run: [BitTorrent DNA] "C:\Programmi\DNA\btdna.exe"
    O4 - HKCU..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU..\Run: [Google Update] "C:\Documents and Settings\Utente\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe" /c
    O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU..\Run: [Netlog Music Tool] "C:\Programmi\Netlog Music Tool\NetlogMusicTool.exe"
    O4 - HKUS\S-1-5-19..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
    O4 - HKUS\S-1-5-20..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
    O4 - HKUS\S-1-5-18..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS.DEFAULT..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: Adobe Gamma.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Inserisci blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programmi\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: Inserisci &blog in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programmi\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
    O15 - Trusted Zone: http://application.arbseek.com
    O15 - ESC Trusted Zone: http://application.arbseek.com
    O17 - HKLM\System\CCS\Services\Tcpip..{CFB24F6A-AE1B-441E-B087-C6721ECF2EC2}: NameServer = 85.37.17.57 85.38.28.80
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programmi\AVG\AVG8\avgpp.dll
    O20 - AppInit_DLLs: avgrsstx.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: ATK Keyboard Service (ATKKeyboardService) - Unknown owner - C:\WINDOWS\ATKKBService.exe (file missing)
    O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
    O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Programmi\File comuni\Macromedia Shared\Service\Macromedia Licensing.exe
    O23 - Service: NBService - Nero AG - C:\Programmi\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Programmi\CyberLink\Shared files\RichVideo.exe

    --
    End of file - 7095 bytes

    0
  • G
    User Attivo •

    Fai controllare su www.virustotal.com questo file:
    C:\Documents and Settings\Utente\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe
    mi sembra strano che è in questo percorso, poi posta il permalink con i risultati.

    0
  • F
    User Attivo •

    Ok fatto! Adesso vediamo cosa mi dicono, però sinceramente pensavo di avere chissa che cosa nel sistema... :yuppi:
    Comunque in quella cartella ci sono anche le cartelle Chrome - Crash Reports - Custom Buttons, speriamo bene...

    0
  • F
    User Attivo •

    Complete scanning result of "GoogleUpdate.exe", processed in VirusTotal at 09/19/2008 10:39:42 (CET).

    [ file data ]

    • name..: GoogleUpdate.exe
    • size..: 133104
    • md5...: 626a24ed1228580b9518c01930936df9
    • sha1..: dcb86149b70829bb4320811b12686ae00131dbc3
    • peid..: -

    [ scan result ]
    AhnLab-V3 2008.9.19.0/20080919 found nothing
    AntiVir 7.8.1.34/20080919 found nothing
    Authentium 5.1.0.4/20080919 found nothing
    Avast 4.8.1195.0/20080918 found nothing
    AVG 8.0.0.161/20080918 found nothing
    BitDefender 7.2/20080919 found nothing
    CAT-QuickHeal 9.50/20080919 found nothing
    ClamAV 0.93.1/20080919 found nothing
    DrWeb 4.44.0.09170/20080919 found nothing
    eSafe 7.0.17.0/20080918 found nothing
    eTrust-Vet 31.6.6094/20080918 found nothing
    Ewido 4.0/20080918 found nothing
    F-Prot 4.4.4.56/20080919 found nothing
    F-Secure 8.0.14332.0/20080919 found nothing
    Fortinet 3.113.0.0/20080919 found nothing
    GData 19/20080919 found nothing
    Ikarus T3.1.1.34.0/20080919 found nothing
    K7AntiVirus 7.10.461/20080918 found nothing
    Kaspersky 7.0.0.125/20080919 found nothing
    McAfee 5387/20080918 found nothing
    Microsoft 1.3903/20080919 found nothing
    NOD32v2 3454/20080919 found nothing
    Norman 5.80.02/20080918 found nothing
    Panda 9.0.0.4/20080919 found nothing
    PCTools 4.4.2.0/20080918 found nothing
    Prevx1 V2/20080919 found nothing
    Rising 20.62.41.00/20080919 found nothing
    Sophos 4.33.0/20080919 found nothing
    Sunbelt 3.1.1647.1/20080918 found nothing
    Symantec 10/20080919 found nothing
    TheHacker 6.3.0.9.087/20080918 found nothing
    TrendMicro 8.700.0.1004/20080919 found nothing
    VBA32 3.12.8.5/20080918 found nothing
    ViRobot 2008.9.19.1382/20080919 found nothing
    VirusBuster 4.5.11.0/20080918 found nothing
    Webwasher-Gateway 6.6.2/20080919 found nothing

    [ notes ]
    ThreatExpert info: http://www.threatexpert.com/report.aspx?md5=626a24ed1228580b9518c01930936df9

    No virus found in this incoming message.
    Checked by AVG - http://www.avg.com
    Version: 8.0.169 / Virus Database: 270.6.21/1678 - Release Date: 18/09/2008 9.01

    0
  • G
    User Attivo •

    Il file è pulito come il pc.
    Quel messaggio non dipende da eventuali malware;)

    0
  • F
    User Attivo •

    @gio! said:

    Il file è pulito come il pc.
    Quel messaggio non dipende da eventuali malware;)

    Perfetto, grazie mille per l'assistenza, in rete non si trovavano informazioni valide 🙂

    0
Effettua l'accesso per rispondere