Ciao, purtroppo continuo ad avere problemi con virus? Ho disabilitato Ripristina Configurazione di sistema. Poi:
-
con hijackthis non riesco a fixare 3 delle righe che mi avete indicato. Al comando mi appare questa finestra: Hijackthis is about to remove a BHO and the corresponding file from your system. Close all internet explorer windows and all windows explorer windows before continuing for the best chance of success. Tutto questo sia in modalità provvisoria che normale (ovviamente con nessuna finestra di explorer aperta).
Solo con la riga O20 - Winlogon Notify: yixrxboh - C:\WINDOWS\SYSTEM32\cfgbkendt.dll non mi da questo messaggio, ma al successivo Scan la ritrovo.
Logfile of HijackThis v1.99.1
Scan saved at 9.23.32, on 19/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.it/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Yahoo! Toolbar con blocco Pop-Up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {266A60E9-C119-4BC0-917A-F3A77DE06DDB} - c:\windows\system32\cfgbkendt.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {79725B5E-C9E4-4122-8AA5-BF289CF28F76} - C:\WINDOWS\system32\btpanuin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar1.dll
O4 - HKLM..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM..\Run: [nwiz] nwiz.exe /install
O4 - HKLM..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM..\Run: [CHotkey] zHotkey.exe
O4 - HKLM..\Run: [ShowWnd] ShowWnd.exe
O4 - HKLM..\Run: [AVP] "C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM..\Run: [ISUSPM Startup] "C:\Programmi\File comuni\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM..\Run: [ISUSScheduler] "C:\Programmi\File comuni\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM..\Run: [Profiler] C:\Programmi\Saitek\Software\Profiler.exe
O4 - HKLM..\Run: [SaiSmart] C:\Programmi\Saitek\Software\SaiSmart.exe
O4 - HKLM..\Run: [VIRIT LITE MONITOR] C:\VEXPLITE\MONLITE.EXE
O4 - HKCU..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU..\Run: [UIWatcher] C:\Programmi\Ashampoo\Ashampoo UnInstaller Platinum 2\UIWatcher.exe
O4 - HKCU..\Run: [DAEMON Tools] "C:\Programmi\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: CountDown.lnk = C:\Programmi\CountDown\CountDown.exe
O4 - Global Startup: Alice ti aiuta.lnk = C:\Programmi\Alice ti aiuta\bin\matcli.exe
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Anti-virus web - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\programmi\bonjour\mdnsnsp.dll
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programmi\Yahoo!\Common\yinsthelper.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Programmi\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: yixrxboh - C:\WINDOWS\SYSTEM32\cfgbkendt.dll
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Programmi\Canon\CAL\CALMAIN.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programmi\File comuni\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Programmi\Spyware Doctor\swdsvc.exe
O23 - Service: Virit eXplorer Lite (viritsvclite) - TG Soft Sas www.tgsoft.it - C:\VEXPLITE\viritsvc.exe
-
VundoFix non mi rileva alcun file infetto né in modalità provvisoria né normale -
VirIT Explorer Lite antivirus non mi rileva alcun file infetto né in modalità provvisoria né normale, escludendo Kaspersky -
Ho usato anche Win32DelfKil ma non trova nulla :
WIN32DELFKIL LOGFILE - by Marckie
version 3.131
19/10/2007 8.32.53,65
running from: "C:"
--- File(s) found in Windows directory ---
--- File(s) found in system32 folder ---
--- Services ---
--- Export SharedTaskScheduler key ---
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Precaricatore Browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Daemon di cache delle categorie di componenti"
--- Notify key ---
--- rebooting the computer ---
--- File(s) found in Windows directory ---
--- File(s) found in system32 folder ---
--- Services ---
--- Export SharedTaskSchedulerkey ---
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Precaricatore Browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Daemon di cache delle categorie di componenti"
--- Notify key ---
Finished!
-
SuperAntiSpiware sia in modalità provvisoria che normale mi rileva file infetti. Inizialmente 12, poi 7 che però sono costanti:
SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 10/19/2007 at 10:32 AM
Application Version : 3.9.1008
Core Rules Database Version : 3326
Trace Rules Database Version: 1327
Scan type : Custom Scan
Total Scan Time : 00:24:49
Memory items scanned : 170
Memory threats detected : 1
Registry items scanned : 5996
Registry threats detected : 4
File items scanned : 27366
File threats detected : 2
Trojan.Spam-MultiSite/Gen
C:\WINDOWS\SYSTEM32\CFGBKENDT.DLL
C:\WINDOWS\SYSTEM32\CFGBKENDT.DLL
Trojan.Download-Gen/DSPRPRE
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{79725B5E-C9E4-4122-8AA5-BF289CF28F76}
HKCR\CLSID{79725B5E-C9E4-4122-8AA5-BF289CF28F76}
HKCR\CLSID{79725B5E-C9E4-4122-8AA5-BF289CF28F76}\InprocServer32
HKCR\CLSID{79725B5E-C9E4-4122-8AA5-BF289CF28F76}\InprocServer32#ThreadingModel
C:\WINDOWS\SYSTEM32\BTPANUIN.DLL
-
Ogni volta che comunque lancio un comando qualsiasi (SUPERAntiSpyware, Task manager, explorer, word per esempio ma comunque per ogni programma) Kaspersky mi segnala il solito trojan.Win32.Delf.ahte i file infetti svchost.exe (che ho notato essere in task manager 3 in servizio di rete e 3 in system) , iexplorer.exe, services.exe e ultimamente anche c:Vexplite\monlite.exe -
Con CCleaner vengono sempre rilevati
Dettaglio dei file da cancellare (NB: Non è ancora stato cancellato nessun file)
C:\Documents and Settings\Homer\Impostazioni locali\Temporary Internet Files\Content.IE5\89MVGXAN\bye1[1].gif 1,12KB
C:\Documents and Settings\Homer\Impostazioni locali\Temporary Internet Files\Content.IE5\89MVGXAN\search[1].htm 17,08KB
C:\Documents and Settings\Homer\Impostazioni locali\Temporary Internet
ECC??
Io non so proprio che pesci pigliare?.. AIUTO!!!!!