Aiuto!security Toolbar 7.1!

[Sar.79]

Ciao a tutti,

sono una nuova iscritta, mi chiamo Sara e spero di poter trovare tra voi qualcuno che possa aiutarmi.

So, perchè ho gia avuto modo di leggerlo, che molti stanno avendo problemi con lo Spyware "Security Toolbar 7.1": io sono una di quelle, purtroppo!

Ho seguito i consigli di utenti esperti ed ho installato HiJackThis!

Ho salvato il log e lo invio nella speranza che possiate aiutarmi!Quali sono le voci che devo togliere?E che procedura devo seguire?

Vi ringrazio in anticipo per l'aiuto che sparete darmi!

Sara.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 9.53.31, on 28/03/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Programmi\Eset\nod32krn.exe

C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\Explorer.EXE

C:\Programmi\NetProject\scit.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Programmi\Analog Devices\SoundMAX\SMTray.exe

C:\Programmi\Eset\nod32kui.exe

C:\Programmi\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programmi\MSN Messenger\MsnMsgr.Exe

C:\Programmi\NetProject\scm.exe

C:\Programmi\iPod\bin\iPodService.exe

C:\Programmi\MSN Messenger\usnsvc.exe

C:\Programmi\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Corriere della Sera

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Live Search

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyServer = www-proxy.ericsson.se:8080

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = 141.137.*;<local>

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti

O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {7C109800-A5D5-438F-9640-18D17E168B88} - C:\Programmi\NetProject\sbmdl.dll (file missing)

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O3 - Toolbar: Internet Service - {DB9FBA9D-AB1B-4CC6-9745-F3B549D64E40} - C:\Programmi\NetProject\wamdl.dll

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [smapp] C:\Programmi\Analog Devices\SoundMAX\SMTray.exe

O4 - HKLM\..\Run: [nod32kui] "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKLM\..\Policies\Explorer\Run: [some] C:\Programmi\NetProject\scit.exe

O4 - HKLM\..\Policies\Explorer\Run: [start] C:\Programmi\NetProject\sbmntr.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - IE Anti-Spyware (file missing)

O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - IE Anti-Spyware (file missing)

O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1196765170281

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - C:\Programmi\iPod\bin\iPodService.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmi\Eset\nod32krn.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe

--

End of file - 5609 bytes

Modificato March 28, 2008 da angelique

[$angelique!?]

[ben]Sar.79[/ben]

Ciao Sar.79,

ho trovato dei strani collegamenti ipertestuali nel tuo log

Scarica SDFix http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

e salvalo sul desktop

- Doppio click su SDFix.exe e il tool andrà ad estrarsi in C:\SDFix

* Adesso avvia il sistema in modalità provvisoria http://www.kuma215.it/WI/Mod_Provv.html

- Apri la cartella SDFix situata in C:\ e fai un doppio click su RunThis.bat per lanciare lo script

- seleziona Y per avviare la pulizia

- Quando te lo chiederà premi un tasto per riavviare

(il sistema sarà piu lungo nell'avviarsi perchè lo script eseguirà l'eliminazione dei file trovati)

- Quando apparirà il desktop il tool terminerà il suo lavoro e visualizzerà il messaggio "Finished"

- Premi un tasto per terminare lo script e ricaricare le icone del desktop

- Il log sarà visualizzato automaticamente,altrimenti potrai trovarlo in C:\SDFix\Report.txt

al termine allega un nuovo log di hijackthis.

[Sar.79]

Ciao Angelique!

Grazie per la veloce ed efficace risposta!

Ho fatto quanto da te indicato e Security Tool 7.1 è sparito!

Questo il log di HiJackThis dopo l'ultimo riavvio!

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 14.40.42, on 28/03/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Boot mode: Safe mode

log rimosso

Riscontri qualche ulteriore anomalia?

Segnalo anche il log di SDFix, qualora ti servisse ulteriormente!

SDFix: Version 1.163

Run by User on 28/03/2008 at 14.29

Microsoft Windows XP [Versione 5.1.2600]

Running From: C:\SDFix

Checking Services :

Restoring Windows Registry Values

Restoring Windows Default Hosts File

Restoring Default IE HomePage

Rebooting

Checking Files :

Trojan Files Found:

C:\Documents and Settings\All Users\Menu Avvio\Online Security Guide.url - Deleted

C:\Documents and Settings\All Users\Menu Avvio\Security Troubleshooting.url - Deleted

C:\Programmi\NetProject\ot.ico - Deleted

C:\Programmi\NetProject\sbun.exe - Deleted

C:\Programmi\NetProject\scit.exe - Deleted

C:\Programmi\NetProject\scm.exe - Deleted

C:\Programmi\NetProject\scu.exe - Deleted

C:\Programmi\NetProject\ts.ico - Deleted

C:\Programmi\NetProject\wamdl.dll - Deleted

C:\Programmi\NetProject\waun.exe - Deleted

Folder C:\Programmi\NetProject - Removed

Removing Temp Files

ADS Check :

Final Check :

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-03-28 14:42:39

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a347scsi\Config\jdgg40]

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E9F81423-211E-46B6-9AE0-38568BC5CF6F}]

"DisplayName"="Alcohol 120%"

scanning hidden files ...

scan completed successfully

hidden processes: 0

hidden services: 0

hidden files: 115

Remaining Services :

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

"C:\\Programmi\\Messenger\\msmsgs.exe"="C:\\Programmi\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"

"C:\\Programmi\\MSN Messenger\\msncall.exe"="C:\\Programmi\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"

"C:\\Programmi\\MSN Messenger\\msnmsgr.exe"="C:\\Programmi\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"

"C:\\Programmi\\MSN Messenger\\livecall.exe"="C:\\Programmi\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

"C:\\Programmi\\AdunanzA\\eMule_AdnzA.exe"="C:\\Programmi\\AdunanzA\\eMule_AdnzA.exe:*:Enabled:eMule"

"C:\\Programmi\\iTunes\\iTunes.exe"="C:\\Programmi\\iTunes\\iTunes.exe:*:Enabled:iTunes"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

"C:\\Programmi\\MSN Messenger\\msncall.exe"="C:\\Programmi\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"

"C:\\Programmi\\MSN Messenger\\msnmsgr.exe"="C:\\Programmi\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"

"C:\\Programmi\\MSN Messenger\\livecall.exe"="C:\\Programmi\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

Remaining Files :

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Fri 25 Jan 2008 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"

Wed 2 Jan 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"

Fri 14 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\eed0eb90e3e924174e431be388f7b127\BIT66.tmp"

Finished!

Grazie mille per il prezioso aiuto!Se hai riscontrato qualcosa di anomalo, ti prego di farmelo sapere!

Sara.

Modificato March 28, 2008 da angelique

[$angelique!?]

il log di hijackthis lo devi eseguire in modalità normale