Problemi di sicurezza

[alevirtuale]

un saluto , potete dare un'occhiata a questo Log , ultimamente ho avuto qualche problema di stabilita' , ho provato con combo ma ho avuto problemi , non potevo piu' accedere ai file , mi diceva che erano stati segnalati per essere cancellati ,per fortuna ne sono venuto a capo , quindi posto hijack trovo per esempio iexplore.exe multiplo pur avendo una pagina sola aperta. inoltre se vado in attivita' spuntando anche " mostra i processi di tutti gli utenti" visualizzo per un secondo due DLLhost.exe poi provo a cilccarci ma spariscono e non posso risalire a questi file. Dwm.exe mi ha dato noie parecchie volte . a volte mi chiude explorer generando un errore.
se puo' servire a qualche utente poco pratico come me , ho dovuto modificare i permessi di Hijack nelle proprieta' del file inserendo la spunta su esegui come amministratore e salvare altrimenti non scansionava tutti i file . Ho il dubbio che questo software comunque non legga tutte le attivita' aperte .

nel registro ho qualche voce scritta in una cartella PowerOffer , c'è Plauncher.exe (launchername) , se non ho capito male questo Plauncher.exe e derivati raccolgono informazioni per una societa' , posso eliminarlo dai registri con un click ? Pservice.exe lo ritrovo nella stessa cartella nel registro ,non è chiato anche questo cosa sia .

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:19:51, on 04/03/2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v8.00 (8.00.7601.17514)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\system32\taskhost.exe
C:\Windows\System32\WTClient.exe
C:\Windows\System32\StikyNot.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Program Files\AVG\AVG2012\avgtray.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN Hotmail.fr, Messenger, Actualité, Sport, People, Femmes - MSN France
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Search
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: PoBHO - {01510931-ff61-46af-b84b-8aa0d35b49a9} - mscoree.dll (file missing)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: PoUpdBHO - {dda30906-49b7-4b41-84ca-0b598c7fbefb} - mscoree.dll (file missing)
O4 - HKLM\..\Run: [WTClient] WTClient.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AVG_TRAY] "C:\Program Files\AVG\AVG2012\avgtray.exe"
O4 - HKCU\..\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVIZIO DI RETE')
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.7.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A093A7A3-877E-40FF-82FE-D0C9797608EE}: NameServer = 176.31.229.24,176.31.229.25
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll
O20 - AppInit_DLLs:
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\avgwdsvc.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: McciCMService - Alcatel-Lucent - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Pos Service (PowerOffer Service) - PowerOfferService - C:\Users\LUCA\AppData\Local\PService\Pos.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: WinTab Service (WinTabService) - Tablet Driver - C:\Windows\System32\Drivers\WTSRV.EXE
--
End of file - 4459 bytes

 

[tecnico24]

Ciao , in effetti il pc è infetto da Power off Service e similari.

In Hijackthis la voce 017 mostra un IP francese , inerente sempre all'infezione stessa.

Posta il log di Combofix , con le dovute precauzioni : disattiva antivirus , firewall e connessione prima di eseguirlo altrimenti può fare danni.

 

[alevirtuale]

grazie tecnico
tenete presente che prima di questo ho rimosso dei portoni aperti nella mia rete grazie a google update .exe e plugin sempre di google che sono pericolosissimi a questo punto , non ho indagato troppo , pero' anche hearth plugin di google era infetto al punto che quando sono arrivato a lui e ho deciso di rimuoverlo mi ha blocatto il computer . poi sono riuscito a toglierlo al riavvio.

l'home page addirittura di google era contraffatta , me ne sono accorto soprattutto perchè un pulsante era in inglese sulla page in italiano ) che dementi

ComboFix 12-03-03.02 - XXXX 04/03/2012   - x86
Microsoft Windows 7 Ultimate   6.1.7601.1.1252.39.1040.18.1023.308 [GMT 1:00]
Eseguito da: c:\users\XXXX\Downloads\COMBO\ComboFix.exe
disabled  =miei antivirus correto 
ho editato
.
(((((((((((((((((((((((((   Files Creati Da 2012-02-04 al 2012-03-04  )))))))))))))))))))))))))))))))))))
.
.
2012-03-04 18:37 . 2012-03-04 18:37 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2012-03-04 18:37 . 2012-03-04 18:37 -------- d-----w- c:\users\UpdatusUser.XXXX-PC\AppData\Local\temp
2012-03-04 18:37 . 2012-03-04 18:37 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-03-04 15:55 . 2012-03-04 15:55 -------- d-----w- c:\users\XXXX\AppData\Roaming\AVG2012
2012-03-04 15:54 . 2012-03-04 16:35 -------- d-----w- c:\windows\system32\drivers\AVG
2012-03-04 15:52 . 2012-03-04 15:52 -------- d-----w- c:\program files\AVG
2012-03-04 13:21 . 2012-03-04 18:37 -------- d-----w- c:\users\XXXX\AppData\Local\temp
2012-03-04 01:34 . 2012-03-04 01:34 14664 ----a-w- c:\windows\stinger.sys
2012-03-04 01:30 . 2012-03-04 01:32 -------- dc----w- c:\users\XXXX\AppData\Local\MigWiz
2012-03-03 20:29 . 2012-03-04 01:34 -------- d-----w- c:\program files\stinger
2012-03-03 19:33 . 2012-03-03 19:33 -------- d-----w- c:\users\XXXX\AppData\Local\Norman Malware Cleaner
2012-03-03 19:33 . 2012-03-03 19:33 -------- d-----w- c:\program files\SecurityXploded
2012-03-03 18:54 . 2012-03-03 18:54 -------- d--h--w- c:\programdata\Common Files
2012-03-03 18:54 . 2012-03-04 16:02 -------- d-----w- c:\programdata\AVG2012
2012-03-03 18:42 . 2012-03-04 15:57 -------- d-----w- c:\programdata\MFAData
2012-03-02 11:20 . 2012-03-02 11:20 388096 ----a-r- c:\users\XXXX\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2012-03-02 11:20 . 2012-03-02 11:20 -------- d-----w- c:\program files\Trend Micro
2012-03-01 23:41 . 2012-03-01 23:50 -------- d-----w- c:\users\XXXX\AppData\Roaming\MyGuitar
2012-03-01 23:40 . 2012-03-01 23:40 -------- d-----w- c:\programdata\AppSoft
2012-03-01 18:17 . 2012-03-01 18:17 -------- d-----w- c:\users\XXXX\AppData\Roaming\gtk-2.0
2012-03-01 18:17 . 2012-03-01 18:48 -------- d-----w- c:\users\XXXX\.zenmap
2012-03-01 18:16 . 2012-03-03 19:53 -------- d-----w- c:\program files\Nmap
2012-02-29 23:28 . 2012-01-31 08:50 293712 ----a-w- c:\windows\npappworld.dll
2012-02-29 23:28 . 2012-01-31 08:50 385360 ----a-w- c:\windows\appworld.dll
2012-02-29 22:13 . 2012-02-29 22:13 -------- d-----w- c:\program files\Research In Motion Limited
2012-02-29 21:12 . 2012-02-29 21:12 -------- d-----w- c:\users\XXXX\AppData\Local\MetaGeek,_LLC
2012-02-29 21:05 . 2012-02-29 21:05 -------- d-----w- c:\program files\MetaGeek
2012-02-29 14:28 . 2006-05-16 10:58 73728 ----a-w- c:\windows\system32\ISUSPM.cpl
2012-02-29 14:28 . 2006-05-16 10:58 213936 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe
2012-02-29 14:28 . 2006-05-16 10:58 368640 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\_ispmres.dll
2012-02-29 12:13 . 2012-02-29 12:13 -------- d-----w- c:\users\XXXX\AppData\Roaming\InstallShield
2012-02-26 10:51 . 2002-07-25 15:07 614532 ----a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
2012-02-26 10:51 . 2001-09-05 03:18 77824 ----a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\ctor.dll
2012-02-26 10:51 . 2001-09-05 03:18 225280 ----a-w- c:\program files\Common Files\InstallShield\IScript\iscript.dll
2012-02-26 10:51 . 2001-09-05 03:14 176128 ----a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\iuser.dll
2012-02-26 10:51 . 2001-09-05 03:13 32768 ----a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\objectps.dll
2012-02-26 10:50 . 2009-06-17 16:18 552960 ----a-w- c:\windows\system32\drivers\Dnetr73.sys
2012-02-26 10:50 . 2009-03-06 17:09 12800 ----a-w- c:\windows\system32\drivers\anodlwf.sys
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-19 09:01 . 2011-10-29 14:17 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-01-31 08:49 . 2012-01-31 08:49 22784 ----a-w- c:\windows\system32\drivers\RimUsb.sys
2012-01-11 21:32 . 2012-01-05 15:37 140072 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2012-01-11 21:32 . 2012-01-05 15:37 280904 ----a-w- c:\windows\system32\PnkBstrB.exe
2012-01-11 21:32 . 2011-10-29 13:42 280904 ----a-w- c:\windows\system32\PnkBstrB.xtr
2012-01-11 21:26 . 2012-01-05 15:37 280904 ----a-w- c:\windows\system32\PnkBstrB.ex0
2012-01-05 15:37 . 2012-01-05 15:37 75136 ----a-w- c:\windows\system32\PnkBstrA.exe
2011-12-06 18:59 . 2012-01-05 15:30 3919976 ----a-w- c:\windows\system32\drivers\RTKVHDA.sys
2011-12-06 15:07 . 2012-01-05 15:30 2489856 ----a-w- c:\windows\system32\RCoRes.dat
.
.
(((((((((((((((((((((((((((((   SnapShot@2012-03-04_13.23.15   )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-11-20 21:20 . 2012-03-04 15:55 41456              c:\windows\System32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 04:55 . 2012-03-04 17:35 44834              c:\windows\System32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2011-10-29 10:47 . 2012-03-04 17:35 10974              c:\windows\System32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1442339671-2015013838-1698196794-1000_UserData.bin
- 2011-10-29 10:42 . 2012-03-04 12:09 32768              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-10-29 10:42 . 2012-03-04 18:14 32768              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-10-29 10:42 . 2012-03-04 18:14 49152              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2011-10-29 10:42 . 2012-03-04 12:09 49152              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:41 . 2012-03-04 12:09 32768              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:41 . 2012-03-04 18:14 32768              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-10-29 10:54 . 2012-03-04 17:35 16384              c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-10-29 10:54 . 2012-03-04 08:55 16384              c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-10-29 10:54 . 2012-03-04 17:35 32768              c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2011-10-29 10:54 . 2012-03-04 08:55 32768              c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2011-10-29 10:54 . 2012-03-04 08:55 16384              c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-10-29 10:54 . 2012-03-04 17:35 16384              c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-10-29 10:54 . 2012-03-04 18:08 16384              c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-10-29 10:54 . 2012-03-04 13:10 16384              c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-10-29 10:54 . 2012-03-04 18:08 16384              c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2011-10-29 10:54 . 2012-03-04 13:10 16384              c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2012-03-03 19:45 . 2012-03-04 13:22 2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-03-04 15:53 . 2012-03-04 17:33 2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-03-04 15:53 . 2012-03-04 17:33 2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2012-03-03 19:45 . 2012-03-04 13:22 2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2010-11-20 21:00 . 2012-03-04 12:09 262144              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2010-11-20 21:00 . 2012-03-04 18:14 262144              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2009-07-14 04:47 . 2012-03-04 15:52 419976              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 04:47 . 2012-03-03 11:08 419976              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
.
(((((((((((((((((((((((((((((((((((((   Punti Reg Caricati   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{01510931-ff61-46af-b84b-8aa0d35b49a9}]
2010-11-20 21:29 297808 ----a-w- c:\windows\System32\mscoree.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{dda30906-49b7-4b41-84ca-0b598c7fbefb}]
2010-11-20 21:29 297808 ----a-w- c:\windows\System32\mscoree.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RESTART_STICKY_NOTES"="c:\windows\System32\StikyNot.exe" [2009-07-14 354304]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2012-01-24 2416480]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ    autocheck autochk *\0c:\progra~2\AVG\AVG2012\avgrsx.exe /sync /restart
.
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\AVGIDSAgent.exe [2011-10-12 4433248]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-10-15 2253120]
R2 PowerOffer Service;Pos Service;c:\users\LUCA\AppData\Local\PService\Pos.exe [2011-12-15 164864]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
R3 Dnetr73;D-Link USB Extensible Wireless LAN Card Driver;c:\windows\system32\DRIVERS\Dnetr73.sys [2009-06-17 552960]
R3 netr73;Driver scheda LAN wireless USB RT73 per Vista;c:\windows\system32\DRIVERS\netr73.sys [2009-07-13 545792]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [2010-11-20 77184]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [2010-11-20 25600]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [2010-11-20 112640]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
R4 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
R4 PowerOffer Upd Service;ServiceUpd;c:\users\LUCA\AppData\Local\ServiceUpd\ServiceUpd.exe [2011-12-15 156160]
S0 AVGIDSEH;AVGIDSEH;c:\windows\system32\DRIVERS\AVGIDSEH.Sys [2011-07-11 23120]
S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [2011-09-13 32592]
S1 anodlwf;ANOD Network Security Filter driver;c:\windows\system32\DRIVERS\anodlwf.sys [2009-03-06 12800]
S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [2011-10-07 230608]
S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [2011-07-11 295248]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-11-20 239168]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [2011-08-02 192776]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-10-14 381248]
S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [2011-07-11 134736]
S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [2011-07-11 24272]
S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\AVGIDSShim.Sys [2011-10-04 16720]
S3 dfmirage;dfmirage;c:\windows\system32\DRIVERS\dfmirage.sys [2008-03-26 34128]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2011-07-07 139880]
S3 PTSimBus;PenTablet Bus Enumerator;c:\windows\system32\DRIVERS\PTSimBus.sys [2009-06-22 23208]
S3 PTSimHid;PenTablet Simulated HID MiniDriver;c:\windows\system32\DRIVERS\PTSimHid.sys [2009-06-22 14504]
S3 RTL8167;Driver Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]
.
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
mStart Page = hxxp://search.findeer.com
Trusted Zone: graphicdesignforum.com\www
TCP: DhcpNameServer = xxxxxxxxxxxxxxxxxxmio router corrisponde
TCP: Interfaces\{A093A7A3-877E-40FF-82FE-D0C9797608EE}: NameServer = 176.31.229.24,176.31.229.25
.
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Ora fine scansione: 2012-03-04  19:42:53
ComboFix-quarantined-files.txt  2012-03-04 18:42
ComboFix2.txt  2012-03-04 13:32
.
Pre-Run: 294.129.983.488 byte disponibili
Post-Run: 294.087.086.080 byte disponibili
.
- - End Of File - - A93EAA266C639735B3F62AFFAC504E61

 

[tecnico24]

Ciao ,
scarica il file CFScript.txt sul desktop che ti ho allegato qui in basso.

Trascina il file CFScript.txt sull'icona di combofix a forma di leone (posizionata sul desktop , qualora non fosse posizionala).

Attendi il lavoro del programma ed al termine inviaci il log delle operazioni effettuate.

Scarica AdwCleaner
Chiudi tutti i programmi aperti
Clicca sul pulsante Search
Attendi la scansione del programma
Al termine clicca sul pulsante Delete.
Il pc si riavvierà e il programma ti mostrera le pulizie effettuate , posta il suo report ​insieme a quello di combofix.

 

[alevirtuale]

Ciao ,
scarica il file CFScript.txt sul desktop che ti ho allegato qui in basso.

Trascina il file CFScript.txt sull'icona di combofix a forma di leone (posizionata sul desktop , qualora non fosse posizionala).

Attendi il lavoro del programma ed al termine inviaci il log delle operazioni effettuate.

Scarica AdwCleaner
Chiudi tutti i programmi aperti
Clicca sul pulsante Search
Attendi la scansione del programma
Al termine clicca sul pulsante Delete.
Il pc si riavvierà e il programma ti mostrera le pulizie effettuate , posta il suo report ​insieme a quello di combofix.

Buongiorno , Ho provato mi dice impossibile eseguire perchè il file è in uso , ho provato in modalita' provvisoria con rete, è partito l'antivirus ma non ha eseguita nessuna operazione se non un controllo generale su tutti i file. sapendo che sono malware e societa' che si occupano di rubare dati li ho fissati con hijhack e ho fatto una leggera pulizia nel registro manualmente. c'è un consumo anomalo della memoria in explorer ogni tanto , appena posso vi posto un log pulito dopo aver eliminato alcuni driver nvidia che erano per il 3d e non uso, e update vari di nvidia che lavoravano in background ma non usavo e secondo me erano pericolosi , e altri servizi update legati ad applicazioni che sicuramente erano pericolosi .


Download SVChost Viewer 0.5.0.1 Free - A program to see what all those svchost.exe are running. - Softpedia

vi segnalo un programmino interessante Svchost viewer , immagino che nel caso di computer infetto questa applicazione si moltiplichi mangiando molta ram e lasciando dei portoni aperti nel computer , con questa leggerissima applicazione potete scoprire immediatamente se quei file sono file di sistema o dannosi .