Problemi Virus

[clanto]

Qui di seguito allego un log per analisi problemi vari, non riesco più a disinstallare una copia di AVAST PRO antivirus (non funzionante), e non riesco nemmeno ad installarne uno nuovo. All'avvio del PC, dalla scelta utente di XP alla schermata Desktop occorrono circa 10 minuti. Appaiono continuamente errori di explorer.
Chi mi può aiutare?
Logfile of HijackThis v1.99.1
Scan saved at 0.02.14, on 01/03/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Programmi\VIA\RAID\raid_tool.exe
C:\WINDOWS\System32\hldrrr.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmi\WinZip\WZQKPICK.EXE
C:\Programmi\Antiy Labs\Alive\bak\ALiveCenter_.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\mmc.exe
C:\WINDOWS\system32\DfrgNtfs.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Jessi\Desktop\HijackThis.exe
C:\Programmi\Internet Explorer\iexplore.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programmi\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Encarta Web Companion Oggetto helper - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Programmi\File comuni\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O3 - Toolbar: Encarta Web Companion - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Programmi\File comuni\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [Antiy Auto Update] C:\Programmi\Antiy Labs\Alive\bak\ALiveCenter.exe
O4 - HKLM\..\Run: [Windows Management] stmng32.exe
O4 - HKLM\..\Run: [Win32] msnsrv.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RaidTool] C:\Programmi\VIA\RAID\raid_tool.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [mysvcig38] mysvcc.exe
O4 - HKLM\..\Run: [MSN Live Messanger] msnlive.exe
O4 - HKLM\..\Run: [MS System Call Function] MSSCF32.exe
O4 - HKLM\..\Run: [Mgsgi service] ojbkv.exe
O4 - HKLM\..\Run: [Intec Services Driverrs] winrvc.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\RunServices: [Mgsgi service] ojbkv.exe
O4 - HKLM\..\RunServices: [Win32] msnsrv.exe
O4 - HKLM\..\RunServices: [Windows Management] stmng32.exe
O4 - HKLM\..\RunServices: [MSN Live Messanger] msnlive.exe
O4 - HKLM\..\RunServices: [MS System Call Function] MSSCF32.exe
O4 - HKLM\..\RunServices: [mysvcig38] mysvcc.exe
O4 - HKLM\..\RunServices: [Intec Services Driverrs] winrvc.exe
O4 - HKLM\..\RunServices: [Topic lnternat] lnternat.exe
O4 - HKCU\..\Run: [E06IXLRD_74546] "C:\Programmi\Microsoft Encarta\Microsoft Encarta Enciclopedia DVD - 2006\EDICT.EXE" -m
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\RunServices: [Intec Services Driverrs] winrvc.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programmi\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://c:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: E&xport to Microsoft Excel - res://c:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O10 - Broken Internet access because of LSP chain gap (#18 in chain of 23 missing)
O12 - Plugin for .spop: C:\Programmi\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1167948462843
O16 - DPF: {C1B7E532-3ECB-4E9E-BB3A-2951FFE67C61} (DownloaderActiveX Control) - http://c6.community.alice.it/download/DownloaderActiveX.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: awtss - C:\WINDOWS\
O20 - Winlogon Notify: rpcc - C:\WINDOWS\
O20 - Winlogon Notify: ssttt - C:\WINDOWS\
O23 - Service: Adobe LT Service (ALTS) - Unknown owner - C:\WINDOWS\system32\msasvc.exe (file missing)
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Unknown owner - C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\guard.exe (file missing)
O23 - Service: AVG E-mail Scanner (AVGEMS) - Unknown owner - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\System32\msasvc.exe (file missing)
O23 - Service: Network helper Service (MSDisk) - Unknown owner - C:\WINDOWS\System32\irdvxc.exe" /service (file missing)
O23 - Service: Microsoft Sata emulation (mside) - Unknown owner - C:\WINDOWS\system\mside.exe (file missing)
O23 - Service: Print Spooler Service (oy87eii8kyh12eu) - Unknown owner - C:\WINDOWS\System32\sklrr7y9851058.exe (file missing)
O23 - Service: Remote Procedure Call (RPC) Monitoring (RpcMon) - Unknown owner - C:\WINDOWS\System32\Rpcmon.exe (file missing)
O23 - Service: SecDqe - Unknown owner - C:\WINDOWS\TEMP\6D.tmp (file missing)
O23 - Service: SecKbr - Unknown owner - \\?\C:\Programmi\File comuni\System\com7.exe (file missing)
O23 - Service: SysNpd - Unknown owner - C:\WINDOWS\TEMP\5.tmp (file missing)
O23 - Service: SysTpu - Unknown owner - \\?\C:\Programmi\File comuni\System\lpt4.exe (file missing)
O23 - Service: SysZhw - Unknown owner - C:\WINDOWS\TEMP\69.tmp (file missing)
O23 - Service: TCP Monitor Manager - Unknown owner - C:\WINDOWS\system32\symon.exe (file missing)
O23 - Service: Windows Process Manager - Unknown owner - C:\WINDOWS\system32\spoolsc.exe (file missing)
O23 - Service: WinHdx - Unknown owner - \\?\C:\Programmi\File comuni\nul.exe (file missing)
O23 - Service: Windows Host Services (WINHOST32) - Unknown owner - C:\WINDOWS\system\services.exe (file missing)






Questo messaggio è stato aggiornato da clanto il 01/03/2007  alle ore  13:56:05

[Ninfea]

Ciao clanto, devi terminare questi processi da ctrl+alt+canc:
C:\WINDOWS\System32\hldrrr.exe
C:\Programmi\Antiy Labs\Alive\bak\ALiveCenter_.exe


e poi eliminare queste chiavi:

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
Sconosciuto
O4 - HKLM\..\Run: [Antiy Auto Update] C:\Programmi\Antiy Labs\Alive\bak\ALiveCenter.exe
O4 - HKLM\..\Run: [Windows Management] stmng32.exe
O4 - HKLM\..\Run: [Win32] msnsrv.exe
Sconosciuto
O4 - HKLM\..\Run: [mysvcig38] mysvcc.exe
O4 - HKLM\..\Run: [Intec Services Driverrs] winrvc.exe
O4 - HKCU\..\RunServices: [Intec Services Driverrs] winrvc.exe
O10 - Broken Internet access because of LSP chain gap (#18 in chain of 23 missing)
O23 - Service: Adobe LT Service (ALTS) - Unknown owner - C:\WINDOWS\system32\msasvc.exe (file missing)
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\System32\msasvc.exe (file missing)
O23 - Service: Network helper Service (MSDisk) - Unknown owner - C:\WINDOWS\System32\irdvxc.exe" /service (file missing)
O23 - Service: Microsoft Sata emulation (mside) - Unknown owner - C:\WINDOWS\system\mside.exe (file missing)
O23 - Service: TCP Monitor Manager - Unknown owner - C:\WINDOWS\system32\symon.exe (file missing)
O23 - Service: Windows Host Services (WINHOST32) - Unknown owner - C:\WINDOWS\system\services.exe (file missing)


Hai due trojan di certo e sono questi: W32.Beagle.KF,  Trojan.Downloader-Intec/WinRVC.Process, per eliminare le chiavi premi fix dopo averle selezionate in hijackthis.


Purtroppo non è ancora finita, visita questo sito:
http://www.symantec.com/region/it/techsupp/avcenter/venc/data/it-trojan.tooso.r.html
ed elimina tutte le chiavi che ti consigliano, dal registro di sistema.

Hai anche un worm purtroppo, anche in questo caso visita questo sito: http://www.avira.com/it/threats/section/fulldetails/id_vir/3108/worm_rbot.78462.1.html
e segui le istruzioni per toglierlo.

Dopo tutto ciò scarica Ccleaner e fai una pulizia del registro automatica,e riavvia in modalità provvissoria facendo una scansione con active virus shield: www.activevirusshield.com


Infine dovrai postare un nuovo log di hijackthis per vedere se è rimasto qualcosa.
Hai il pc un pò disastrato:gray:





Questo messaggio è stato aggiornato da Ninfea il 01/03/2007  alle ore  15:04:55

[peppos83]

Azz... Fa prima a formattare quasi

Bye

[dasoca]

Azz... Fa prima a formattare quasi

Bye

Forse sarebbe meglio....

[Ninfea]

Azz... Fa prima a formattare quasi

Bye

Toglierei quel quasi

[clanto]

Grazie, ho deciso che stasera formatto!!

[peppos83]

Grazie, ho deciso che stasera formatto!!

Clanto

Ottima scelta

Bye

[Ninfea]

Figurati, se devi salvare i dati prima ti sconsiglio il backup altrimenti backupperesti anke i virus ...

[dasoca]

Figurati, se devi salvare i dati prima ti sconsiglio il backup altrimenti backupperesti anke i virus ...

:sag:Pensa che storia.....