Condividi:        

AIUTOOO: Virus di tipo exploit che nn riesco ad eliminare!

Come rimuovere virus e spyware? Le carte di credito sono davvero sicure in rete? È possibile navigare anonimi? Con quali programmi tutelare la propria privacy? Come proteggere i file importanti? Se volete una risposta a queste e altre domande questo è il luogo giusto!

Moderatori: m.paolo, kadosh, Luke57

AIUTOOO: Virus di tipo exploit che nn riesco ad eliminare!

Postdi mario86 » 30/07/10 14:11

Salve, purtroppo ultimamente qst virus si stanno accanendo sui miei computer, ora è stato colpito il mio portatile.

Ho un virus che mi impedisce di ruotare le foto e poi salvarle, il nome del virus è EXP/MS04-028.JPEG.A

il mio antivirus (avira antivir personal free) lo rileva ogni volta che provo a ruotare una foto ma nn riesce ad eliminarlo.

Ho provato ad installare svariati programmi anti malware per provare ad eliminarlo ma nulla di fatto,

ho provato anche con combofix ma nulla da fare.

Tra l'altro ho notato, attraverso le svariate scansioni che ho effettuato, che non è l'unico virus presente sul mio pc.

Potreste aiutarmi per favoreee????

Vi ringrazio anticipatamente per la vostra cortesia e disponibilità.
mario86
Utente Junior
 
Post: 20
Iscritto il: 12/07/10 13:41

Sponsor
 

Re: AIUTOOO: Virus di tipo exploit che nn riesco ad eliminare!

Postdi FDAC » 30/07/10 14:12

Scarica ed installa Hijackthis: http://www.hijackthis.de/downloads/HJTInstall.exe
• lancia Hijackthis e pulisci gli ADS (esclusivamente se la partizione e in NTFS):
• clicca sulla voce Open the misc tool section
• clicca su Open ads spy
• togli la spunta alla voce Quick scan (windows base folder only)
• clicca su Scan
• se venissero rilevati ADS, spunta tutte le caselline e clicca su Remove selected
• rilancia Hijackthis
• clicca su Do a system scan and save a logfile
• al termine della scansione verrà rilasciato un log: salvalo sul Desktop perché lo dovrai allegare
MSN/Email: supercesco94@hotmail.it
Skype: francesco240194
Sito Web: http://windowspertutti.altervista.org
FDAC
Utente Senior
 
Post: 235
Iscritto il: 30/07/10 08:39
Località: Trento

Re: AIUTOOO: Virus di tipo exploit che nn riesco ad eliminare!

Postdi mario86 » 30/07/10 20:08

Ho seguito le tue istruzioni, xò nn si sn cancellati tt gli ads rilevati.

Cmq ora ti allego il file log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21.04.49, on 30/07/2010
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18882)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Windows\WindowsMobile\wmdSync.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Nokia\PC Connectivity Solution\Transports\NclMSBTSrv.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE= ... on&pf=cnnb
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.167.9.178:3128
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AOL Toolbar BHO - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O3 - Toolbar: Nero Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\2.0"
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles
O4 - HKLM\..\Run: [Nokia FastStart] "C:\Program Files\Nokia\Nokia Music\NokiaMusic.exe" /command:faststart
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &AOL Toolbar Cerca - C:\ProgramData\AOL\ieToolbar\resources\it-IT\local\search.html
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Mario\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm
O8 - Extra context menu item: Invia immagine alla periferica &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Invia pagina alla periferica &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_030ac640\aestsrv.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: HP Service (hpsrv) - Hewlett-Packard Corporation - C:\Windows\system32\Hpservice.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: Recovery Service for Windows - Unknown owner - C:\Windows\SMINST\BLService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Nokia\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\STacSV.exe

--
End of file - 9216 bytes
mario86
Utente Junior
 
Post: 20
Iscritto il: 12/07/10 13:41

Re: AIUTOOO: Virus di tipo exploit che nn riesco ad eliminare!

Postdi FDAC » 30/07/10 20:35

Sei vulnerabile agli Exploit, perchè non hai il SP1 invece del 2.
MSN/Email: supercesco94@hotmail.it
Skype: francesco240194
Sito Web: http://windowspertutti.altervista.org
FDAC
Utente Senior
 
Post: 235
Iscritto il: 30/07/10 08:39
Località: Trento

Re: AIUTOOO: Virus di tipo exploit che nn riesco ad eliminare!

Postdi mario86 » 31/07/10 09:13

e quindi???

come devo fare per eliminarlo???

e come posso rendere il mio pc + sicuro???

Ringrazio sempre tt x la disponibilità
mario86
Utente Junior
 
Post: 20
Iscritto il: 12/07/10 13:41

Re: AIUTOOO: Virus di tipo exploit che nn riesco ad eliminare!

Postdi gahan » 31/07/10 09:29

Ciao,

- chiudi tutte le applicazioni
- apri hijackthis
- clicca su do a system scan only
- spunta le seguenti voci e clicca su Fix Checked

Codice: Seleziona tutto
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: Nero Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Mario\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm



- scarica Malwarebytes dal link sottostante per un controllo:
http://majorgeeks.com/downloadget.php?i ... 666f809b26

- installa il programma
- aggiornalo
- fai una scansione completa del sistema cliccando sul pulsante scansione completa
- a fine scansione rimuovi eventuali minacce trovate cliccando su rimuovi selezionati...
- posta il log nella tua prossima risposta.
words like violence, break the silence
Avatar utente
gahan
Moderatore
 
Post: 1397
Iscritto il: 23/01/08 16:09

Re: AIUTOOO: Virus di tipo exploit che nn riesco ad eliminare!

Postdi mario86 » 01/08/10 17:44

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Versione database: 4377

Windows 6.0.6001 Service Pack 1
Internet Explorer 8.0.6001.18882

01/08/2010 18.35.58
mbam-log-2010-08-01 (18-35-58).txt

Tipo di scansione: Scansione completa (C:\|D:\|)
Elementi esaminati: 306683
Tempo trascorso: 1 ore, 1 minuti, 48 secondi

Processi infetti in memoria: 0
Moduli di memoria infetti: 0
Chiavi di registro infette: 0
Valori di registro infetti: 0
Voci infette nei dati di registro: 0
Cartelle infette: 0
File infetti: 0

Processi infetti in memoria:
(Non sono stati rilevati elementi nocivi)

Moduli di memoria infetti:
(Non sono stati rilevati elementi nocivi)

Chiavi di registro infette:
(Non sono stati rilevati elementi nocivi)

Valori di registro infetti:
(Non sono stati rilevati elementi nocivi)

Voci infette nei dati di registro:
(Non sono stati rilevati elementi nocivi)

Cartelle infette:
(Non sono stati rilevati elementi nocivi)

File infetti:
(Non sono stati rilevati elementi nocivi)

IL VIRUS CMQ C'è SEMPRE, IL PROBLEMA NN è STATO RISOLTO A QUANTO PARE.

Tra l'altro ho anche provato ad installare un anti-virus completo (Kaspersky 2010), ho fatto la scansione completa ma nulla da fare.

Non sò davvero come fare raga?!? :-?
mario86
Utente Junior
 
Post: 20
Iscritto il: 12/07/10 13:41

Re: AIUTOOO: Virus di tipo exploit che nn riesco ad eliminare!

Postdi gahan » 01/08/10 19:40

Ciao,

antivir è un antivirus che rileva molti falsi positivi e in questo caso potrebbe darsi che sia successo proprio questo.

Ad ogni modo visto che nè Hijackthis nè Malwarebytes hanno segnalato nulla di rilevante, effettuiamo un controllo piu approfondito.

Scarica combofix direttamente sul desktop dal seguente link:
http://www.forospyware.com/sUBs/ComboFix.exe

- chiudi tutte le applicazioni
- disconnettiti da internet
- disattiva momentaneamente il tuo antivirus
- doppio click su combofix (icona rossa sul desktop)
- NON installare la recovery console quando ti verrà chiesto
- NON interferire durante la scansione (non toccare è mouse nè tastiera)

una volta terminata la scansione, in C:\ dovresti trovare il file combofix.txt
posta il contenuto del file nella tua prossima risposta.
words like violence, break the silence
Avatar utente
gahan
Moderatore
 
Post: 1397
Iscritto il: 23/01/08 16:09

Re: AIUTOOO: Virus di tipo exploit che nn riesco ad eliminare!

Postdi mario86 » 02/08/10 14:05

ECCO IL FILE DI TESTO DI COMBOFIX: (CMQ IO AVEVO GIà UTILIZZATO COMBOFIX QUALCHE GIORNO Fà)

ComboFix 10-07-29.02 - Mario 02/08/2010 14.48.51.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.39.1040.18.3038.2267 [GMT 2:00]
Eseguito da: c:\users\Mario\Desktop\abc.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((( Files Creati Da 2010-07-02 al 2010-08-02 )))))))))))))))))))))))))))))))))))
.

2010-08-02 12:55 . 2010-08-02 12:55 -------- d-----w- c:\users\Mario\AppData\Local\temp
2010-08-02 12:55 . 2010-08-02 12:55 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-08-02 12:55 . 2010-08-02 12:55 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-08-01 15:33 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-01 15:32 . 2010-08-01 15:33 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-08-01 15:32 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-08-01 12:26 . 2010-08-01 12:26 932368 ----a-w- c:\programdata\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\profiles-1-6.dll
2010-08-01 12:26 . 2010-08-01 12:26 678416 ----a-w- c:\programdata\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\content_interpreter-1-1.dll
2010-08-01 12:26 . 2010-08-01 12:26 604688 ----a-w- c:\programdata\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\gsg-3-9.dll
2010-08-01 12:26 . 2010-08-01 12:26 522768 ----a-w- c:\programdata\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\database-1-5.dll
2010-08-01 12:26 . 2010-08-01 12:26 1096208 ----a-w- c:\programdata\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\filtration-4-6.dll
2010-08-01 11:58 . 2010-08-02 12:17 -------- d-----w- c:\programdata\Kaspersky Lab
2010-08-01 11:58 . 2010-08-01 11:58 -------- d-----w- c:\program files\Kaspersky Lab
2010-08-01 11:56 . 2010-08-01 11:56 -------- d-----w- c:\programdata\Kaspersky Lab Setup Files
2010-07-30 18:45 . 2010-07-30 18:45 -------- d-----w- c:\program files\Trend Micro
2010-07-30 12:33 . 2010-07-30 12:42 -------- d-----w- C:\ComboFix
2010-07-29 20:01 . 2010-07-29 20:01 -------- d-----w- c:\users\Mario\AppData\Roaming\Malwarebytes
2010-07-29 20:01 . 2010-07-29 20:01 -------- d-----w- c:\programdata\Malwarebytes
2010-07-29 19:12 . 2010-07-29 19:12 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2010-07-29 19:06 . 2010-07-29 19:06 -------- d-----w- c:\program files\CCleaner
2010-07-18 10:43 . 2010-07-18 10:43 -------- d-----w- c:\users\Mario\AppData\Roaming\DVDVideoSoftIEHelpers
2010-07-18 10:43 . 2010-07-30 13:48 -------- d-----w- c:\program files\Common Files\DVDVideoSoft
2010-07-18 10:43 . 2010-07-30 13:47 -------- d-----w- c:\program files\DVDVideoSoft
2010-07-11 00:03 . 2010-07-11 00:03 -------- d-----w- c:\program files\BurnAware Free

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-02 12:46 . 2008-09-26 23:42 94059 ----a-w- c:\programdata\nvModes.dat
2010-08-02 12:45 . 2008-09-26 23:09 1660 ----a-w- c:\windows\bthservsdp.dat
2010-08-02 12:21 . 2008-07-18 17:13 671010 ----a-w- c:\windows\system32\perfh010.dat
2010-08-02 12:21 . 2008-07-18 17:13 123620 ----a-w- c:\windows\system32\perfc010.dat
2010-08-01 15:31 . 2010-05-04 18:48 -------- d-----w- c:\program files\Ask.com
2010-07-29 19:08 . 2009-09-22 18:07 -------- d-----w- c:\programdata\Lavasoft
2010-07-29 19:08 . 2009-09-22 18:07 -------- d-----w- c:\program files\Lavasoft
2010-07-26 16:38 . 2010-05-02 08:27 7808 ----a-w- c:\users\Mario\AppData\Local\d3d9caps.dat
2010-07-23 00:14 . 2009-04-27 21:26 -------- d-----w- c:\program files\Messenger Plus! Live
2010-07-23 00:14 . 2008-07-18 08:52 -------- d-----w- c:\program files\MSN Messenger
2010-07-18 20:43 . 2009-09-20 13:09 -------- d-----w- c:\users\Mario\AppData\Roaming\Free Audio Editor
2010-06-30 21:32 . 2009-04-26 21:27 75648 ----a-w- c:\users\Mario\AppData\Local\GDIPFONTCACHEV1.DAT
2010-06-30 20:22 . 2008-07-18 08:39 -------- d-----w- c:\programdata\Microsoft Help
2010-06-27 23:05 . 2006-11-02 12:37 -------- d-----w- c:\program files\Microsoft Games
2010-06-25 20:28 . 2010-06-25 20:28 50354 ----a-w- c:\users\Mario\AppData\Roaming\Facebook\uninstall.exe
2010-06-25 20:28 . 2010-06-25 20:28 -------- d-----w- c:\users\Mario\AppData\Roaming\Facebook
2010-06-23 23:04 . 2010-06-23 23:04 2728840 ----a-w- c:\users\Mario\AppData\Roaming\Mozilla\Firefox\Profiles\0an13atz.default\extensions\toolbar@ask.com\chrome\temp\askToolbar.exe
2010-06-09 10:45 . 2010-06-09 10:45 5591040 ----a-w- c:\users\Mario\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll
2010-06-06 12:34 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-06-05 17:22 . 2009-04-27 13:40 -------- d-----w- c:\users\Mario\AppData\Roaming\HP
2010-05-26 13:24 . 2010-07-17 08:21 18488 ----a-w- c:\windows\Help\OEM\scripts\HPHC_BUY_BATTERY.exe
2010-05-21 12:14 . 2009-10-05 00:01 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-05-17 22:43 . 2009-11-11 19:54 153304 ----a-w- c:\windows\hpoins15.dat
2008-07-18 17:15 . 2008-07-18 17:15 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-02-26 2289664]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1045800]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-04-15 178712]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-12-24 222504]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2008-04-23 468264]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-03-14 202032]
"OnScreenDisplay"="c:\program files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe" [2007-11-01 554288]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-11-20 488752]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2008-06-27 442467]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2008-01-21 215552]
"Nokia FastStart"="c:\program files\Nokia\Nokia Music\NokiaMusic.exe" [2009-02-26 2376992]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 75008]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-07-23 13797920]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe" [2009-10-20 340456]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-1-16 727592]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-3-11 210520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\mzvkbd3.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-02-07 193840]
R3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2009-03-19 136704]
R3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2009-03-19 8320]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2009-09-30 716272]
S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-10-14 36880]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2009-09-14 21520]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_030ac640\aestsrv.exe [2008-02-12 73728]
S2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe [2008-01-21 21504]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2008-03-18 19456]
S2 Recovery Service for Windows;Recovery Service for Windows;c:\windows\SMINST\BLService.exe [2008-08-22 361808]
S3 AVerAF15;HP DVB-T TV Tuner;c:\windows\system32\Drivers\AVerAF15.sys [2008-03-14 280192]
S3 enecir;ENE CIR Receiver;c:\windows\system32\DRIVERS\enecir.sys [2008-01-24 52736]
S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [2008-04-01 81296]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2009-10-02 19472]
S3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\NETw5v32.sys [2008-11-17 3668480]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2008-05-23 43552]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ezSharedSvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-02-26 12:06 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contenuto della cartella 'Scheduled Tasks'

2010-08-01 c:\windows\Tasks\User_Feed_Synchronization-{4D5135F4-DE2B-4635-8856-A09A3DBCAEC1}.job
- c:\windows\system32\msfeedssync.exe [2010-02-23 04:56]

2010-07-29 c:\windows\Tasks\WebReg Photosmart C4200 series.job
- c:\program files\HP\Digital Imaging\bin\hpqwrg.exe [2007-03-11 20:27]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE= ... on&pf=cnnb
uInternet Settings,ProxyOverride = local
uInternet Settings,ProxyServer = 192.167.9.178:3128
IE: &AOL Toolbar Cerca - c:\programdata\AOL\ieToolbar\resources\it-IT\local\search.html
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Invia immagine alla periferica &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Invia pagina alla periferica &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
FF - ProfilePath - c:\users\Mario\AppData\Roaming\Mozilla\Firefox\Profiles\0an13atz.default\
FF - prefs.js: browser.search.selectedEngine - Trova Rapido
FF - prefs.js: browser.startup.homepage - hxxp://it.start3.mozilla.com/firefox?cl ... t:official
FF - component: c:\program files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\components\KavLinkFilter.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - plugin: c:\users\Mario\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - CHIAVI ORFANE RIMOSSE - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-02 14:55
Windows 6.0.6001 Service Pack 1 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Ora fine scansione: 2010-08-02 14:57:48
ComboFix-quarantined-files.txt 2010-08-02 12:57
ComboFix2.txt 2010-07-30 12:42

Pre-Run: 211.708.891.136 byte disponibili
Post-Run: 211.668.287.488 byte disponibili

- - End Of File - - C5621AB923A738AEFE4432123208E53A
mario86
Utente Junior
 
Post: 20
Iscritto il: 12/07/10 13:41

Re: AIUTOOO: Virus di tipo exploit che nn riesco ad eliminare!

Postdi gahan » 02/08/10 14:39

Dalla scansione non noto nulla di strano...

A questo punto credo che si tratti proprio di un falso positivo segnalato da Avira Antivir.
words like violence, break the silence
Avatar utente
gahan
Moderatore
 
Post: 1397
Iscritto il: 23/01/08 16:09

Re: AIUTOOO: Virus di tipo exploit che nn riesco ad eliminare!

Postdi mario86 » 03/08/10 03:02

Guarda che il problema c'è sempre, al di là del rilevamento di avira. Io nn riesco a ruotare + le foto, o meglio qnd le ruoto mi esce un messaggio di errore. Dal nome del virus rilevato da avira risulta essere un tipo di virus che agisce sui file jpeg, ciò significa che la rilevazione di avira è attendibile.
mario86
Utente Junior
 
Post: 20
Iscritto il: 12/07/10 13:41

Re: AIUTOOO: Virus di tipo exploit che nn riesco ad eliminare!

Postdi gahan » 03/08/10 09:16

In uno dei tuoi post precedenti ho letto che hai installato la versione completa di Kaspersky.

Bene. Prova a disinstallare Avira, e sostituirlo con Kaspersky (che tra l'altro è anche migliore). Quindi prova ad lavorare con qualche JPEG.



PS - Il problema emerge con tutte le immagini JPEG?
Hai provato con altri tipi di immagini, per esempio PNG o GIF?
E ancora, con quale software esegui le operazioni di rotazione e salvataggio?
words like violence, break the silence
Avatar utente
gahan
Moderatore
 
Post: 1397
Iscritto il: 23/01/08 16:09


Torna a Sicurezza e Privacy


Topic correlati a "AIUTOOO: Virus di tipo exploit che nn riesco ad eliminare!":


Chi c’è in linea

Visitano il forum: Nessuno e 84 ospiti