Virus Explorer Internet

massimiliano1977 · December 8, 2011

Ciao a tutti e buona festività

Spero di aver postato nel posto giusto

Vi scrivo perchè sono gia 4 giorni che provo a togliere un virus che mi sta facendo buttare il sangue.

Se utilizzo firefox sembrerebbe che sia tutto a posto, anche se è lentissimo ma appena navigo con explorer e mi collego sul sito www.groupalia.com (acquisti di gruppo) e visualizzo la pagine delle offerte di qualsiasi città si imballa tutto e per poter sbloccare devo chiudere explorer con il Task Manager Windows. La cosa strana pero e che sulla barra di stato vedo una successione di indizizzi web che cambiano e si ripetono tra cui anche facebook come nella foto che ho generato con il tasto Stamp (groupalia imbal.jpg)

per risovere il problema ho provato a fare una scansione con avira che mi ha cancellato e riparato un il JS/Agent.agx.01

Invece avast mi ha trovato ed eliminato i seguenti files C:\gfweq23.b\c08436d1757.exe Ho fatto pulizia con ccleaner ma puntualmente il problema persiste. Sono disperato. Aiutatemi.

Vi posto qui di seguito il log ottenuto con HiJackThis.

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 19.28.47, on 08/12/2011

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Programmi\AVAST Software\Avast\AvastSvc.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\system32\LVCOMSX.EXE

C:\Programmi\Logitech\Video\LogiTray.exe

C:\Programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe

C:\Programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe

C:\Programmi\AVAST Software\Avast\avastUI.exe

C:\Programmi\Vtune\TBPanel.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programmi\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe

C:\Programmi\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programmi\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe

C:\Programmi\Logitech\Video\FxSvr2.exe

C:\Programmi\File comuni\LightScribe\LSSrvc.exe

C:\WINDOWS\system32\svchost.exe

C:\Programmi\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Programmi\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Utente\Desktop\pr max\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programmi\AVAST Software\Avast\aswWebRepIE.dll

O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programmi\AVAST Software\Avast\aswWebRepIE.dll

O4 - HKLM\..\Run: [nwiz] C:\Programmi\NVIDIA Corporation\nView\nwiz.exe /installquiet

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE

O4 - HKLM\..\Run: [LogitechVideoTray] C:\Programmi\Logitech\Video\LogiTray.exe

O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Programmi\Logitech\Video\ISStart.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [avast] "C:\Programmi\AVAST Software\Avast\avastUI.exe" /nogui

O4 - HKCU\..\Run: [TBPanel] C:\Programmi\Vtune\TBPanel.exe /A

O4 - HKCU\..\Run: [LogitechSoftwareUpdate] C:\Programmi\Logitech\Video\ManifestEngine.exe boot

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')

O4 - HKUS\S-1-5-19\..\Run: [MsnMsgr] "C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe" /background (User 'SERVIZIO LOCALE')

O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVIZIO LOCALE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')

O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVIZIO DI RETE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')

O4 - Global Startup: hp psc 2000 Series.lnk = C:\Programmi\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe

O4 - Global Startup: hpoddt01.exe.lnk = ?

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL

O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: avast! Antivirus - AVAST Software - C:\Programmi\AVAST Software\Avast\AvastSvc.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe

O23 - Service: NBService - Nero AG - C:\Programmi\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--

End of file - 5527 bytes

Aiutatemi a capire se sono infetto e come posso fare per rimettere tutto a posto.

Grazie a tutti per gli aiuti che sempre ci offrite.

Luna75 · December 8, 2011

Ciao,

allega anche i due log di combofix e di malwarebytes e di Superantispyware.

http://forum.wininiz...ida-illustrata/

www.malwarebytes.org (ultima versione)

http://www.superanti...blescanner.html

dopo le operazioni di pulizia, ti consiglio di togliere anche programmi zavorra all'avvio...

:anna:

pike · December 8, 2011

E aggiorna Internet Explorer alla versione 8

massimiliano1977 · December 8, 2011

Grazie per per avermi risposto ecco qui di seguito i log richiesti:

COMBOFIX

ComboFix 11-12-06.02 - Utente 08/12/2011 22.04.25.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.39.1040.18.2047.1215 [GMT 1:00]

Eseguito da: c:\documents and settings\Utente\Desktop\pr rimoz vir\ComboFix.exe

AV: AntiVir Desktop *Enabled/Outdated* {0012F2B4-5CC9-7C92-0300-000000000000}

AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

.

ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!

.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\docume~1\Utente\IMPOST~1\Temp\is-MSI2E.tmp\mbam.dll

c:\docume~1\Utente\IMPOST~1\Temp\is-QFIR0.tmp\MalwareBytes mbam-setup-1.51.2.1300.tmp

c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\hpoddt01.exe.lnk

c:\documents and settings\Utente\Dati applicazioni\oemfpc.dat

c:\documents and settings\Utente\Impostazioni locali\Temp\is-MSI2E.tmp\mbam.dll

c:\documents and settings\Utente\Impostazioni locali\Temp\is-QFIR0.tmp\MalwareBytes mbam-setup-1.51.2.1300.tmp

C:\gfweq23.Bi

c:\gfweq23.bi\EB749E08EDD9DED

C:\Recycle.Bin

c:\recycle.bin\0583516EEDD9DED

C:\WinLogon

c:\winlogon\E6B4A0A5EDD9DED

.

((((((((((((((((((((((((((((((((((((((( Driver/Servizi )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_usnjsvc

.

((((((((((((((((((((((((( Files Creati Da 2011-11-08 al 2011-12-08 )))))))))))))))))))))))))))))))))))

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-11-08 21:26 . 2011-06-17 17:17 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-10-02 12:00 . 2011-10-02 12:00 388096 ----a-r- c:\documents and settings\Utente\Dati applicazioni\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-11-10 22:00 . 2011-08-24 19:10 134104 ----a-w- c:\programmi\mozilla firefox\components\browsercomps.dll

.

------- Sigcheck -------

Note: Unsigned files aren't necessarily malware.

.

[-] 2008-12-16 . F7B4492810FA46B8011574D8F0F81E59 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll

.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* i valori vuoti & legittimi/default non sono visualizzati.

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2011-11-28 18:01 122512 ----a-w- c:\programmi\AVAST Software\Avast\ashShell.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"TBPanel"="c:\programmi\Vtune\TBPanel.exe" [2010-12-23 2236416]

"LogitechSoftwareUpdate"="c:\programmi\Logitech\Video\ManifestEngine.exe" [2005-06-08 196608]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"nwiz"="c:\programmi\NVIDIA Corporation\nView\nwiz.exe" [2010-08-25 1753192]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-12-12 110696]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-12-12 13851752]

"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2005-07-19 221184]

"LogitechVideoTray"="c:\programmi\Logitech\Video\LogiTray.exe" [2005-06-08 217088]

"LogitechVideoRepair"="c:\programmi\Logitech\Video\ISStart.exe" [2005-06-08 458752]

"Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]

"Adobe ARM"="c:\programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]

"avast"="c:\programmi\AVAST Software\Avast\avastUI.exe" [2011-11-28 3744552]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

"MsnMsgr"="c:\programmi\Windows Live\Messenger\MsnMsgr.Exe" [2008-12-16 5724184]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"_nltide_2"="shell32" [X]

"_nltide_3"="advpack.dll" [2008-03-01 124928]

.

c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\

hp psc 2000 Series.lnk - c:\programmi\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2003-4-9 323646]

.

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]

"ForceClassicControlPanel"= 1 (0x1)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Programmi\\Windows Live\\Messenger\\livecall.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Programmi\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Programmi\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Programmi\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Programmi\\TeamViewer\\Version6\\TeamViewer.exe"=

"c:\\Programmi\\TeamViewer\\Version6\\TeamViewer_Service.exe"=

"c:\\Documents and Settings\\Utente\\Impostazioni locali\\Dati applicazioni\\Facebook\\Video\\Skype\\FacebookVideoCalling.exe"=

.

R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [08/12/2011 18.58.11 435032]

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [08/12/2011 18.58.13 314456]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [08/12/2011 18.58.13 20568]

R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [17/06/2011 18.12.49 100456]

S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [17/06/2011 18.07.30 1691480]

S3 Lavasoft Kernexplorer;Lavasoft helper driver;\??\c:\programmi\Lavasoft\Ad-Aware\KernExplorer.sys --> c:\programmi\Lavasoft\Ad-Aware\KernExplorer.sys [?]

S3 ute4mtyw;AVZ Kernel Driver;\??\c:\windows\system32\Drivers\ute4mtyw.sys --> c:\windows\system32\Drivers\ute4mtyw.sys [?]

.

Contenuto della cartella 'Scheduled Tasks'

.

2011-12-08 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1275210071-1614895754-1801674531-1005Core.job

- c:\documents and settings\Utente\Impostazioni locali\Dati applicazioni\Facebook\Update\FacebookUpdate.exe [2011-10-13 18:07]

.

2011-12-08 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1275210071-1614895754-1801674531-1005UA.job

- c:\documents and settings\Utente\Impostazioni locali\Dati applicazioni\Facebook\Update\FacebookUpdate.exe [2011-10-13 18:07]

.

2011-09-25 c:\windows\Tasks\FRU Task 2003-04-10 00:56ewlett-Packard2003-04-10 00:56p psc 2100 series272A572217594EBCF1CEE215E352B92AD073FDE4308587946.job

- c:\programmi\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-09 15:56]

.

------- Scansione supplementare -------

.

uStart Page = hxxp://www.google.it/

TCP: DhcpNameServer = 95.211.73.230 212.117.175.185

FF - ProfilePath - c:\documents and settings\Utente\Dati applicazioni\Mozilla\Firefox\Profiles\oaid6al8.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.it/

FF - prefs.js: network.proxy.type - 0

FF - user.js: network.cookie.cookieBehavior - 0

FF - user.js: privacy.clearOnShutdown.cookies - false

FF - user.js: security.warn_viewing_mixed - false

FF - user.js: security.warn_viewing_mixed.show_once - false

FF - user.js: security.warn_submit_insecure - false

FF - user.js: security.warn_submit_insecure.show_once - false

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-12-08 22:11

Windows 5.1.2600 Service Pack 3 NTFS

.

scansione processi nascosti ...

.

scansione entrate autostart nascoste ...

.

Scansione files nascosti ...

.

C:\## aswSnx private storage

.

Scansione completata con successo

Files nascosti: 1

.

**************************************************************************

.

--------------------- Dlls caricate dai processi in esecuzione ---------------------

.

- - - - - - - > 'explorer.exe'(2256)

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

c:\programmi\Microsoft Office\Office12\1040\GrooveIntlResource.dll

c:\programmi\File comuni\Adobe\Acrobat\ActiveX\PDFShell.dll

c:\programmi\File comuni\Adobe\Acrobat\ActiveX\PDFShell.ITA

c:\programmi\Vtune\TBPanelExt.dll

c:\windows\system32\nvcpl.dll

c:\windows\system32\NVRSIT.DLL

c:\programmi\NVIDIA Corporation\nView\nvshell.dll

.

------------------------ Altri processi in esecuzione ------------------------

.

c:\windows\system32\nvsvc32.exe

c:\programmi\AVAST Software\Avast\AvastSvc.exe

c:\programmi\File comuni\LightScribe\LSSrvc.exe

c:\windows\system32\wscntfy.exe

c:\windows\system32\RUNDLL32.EXE

c:\programmi\Logitech\Video\FxSvr2.exe

c:\programmi\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe

c:\windows\system32\HPZipm12.exe

c:\programmi\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe

.

**************************************************************************

.

Ora fine scansione: 2011-12-08 22:14:13 - Il pc è stato riavviato

ComboFix-quarantined-files.txt 2011-12-08 21:14

.

Pre-Run: 488.180.727.808 byte disponibili

Post-Run: 488.031.268.864 byte disponibili

.

WindowsXP-KB310994-SP2-Pro-BootDisk-ITA.exe

.

- - End Of File - - 85D7BCE9A2631E894DDA3EF1D6C68F11

MALWAREBYTES

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org

Versione database: 8336

Windows 5.1.2600 Service Pack 3

Internet Explorer 7.0.5730.13

08/12/2011 22.25.00

mbam-log-2011-12-08 (22-25-00).txt

Tipo di scansione: Scansione completa (C:\|)

Elementi esaminati: 202091

Tempo impiegato: 8 minuti, 20 secondi

Processi infetti in memoria: 0

Moduli di memoria infetti: 0

Chiavi di registro infette: 0

Valori di registro infetti: 0

Voci infette nei dati di registro: 0

Cartelle infette: 0

File infetti: 0

Processi infetti in memoria: