• A
    User Newbie •

    [Risolto] Virtumonde

    Salve ragazzi. All'avvio del mio PC, NOD32 ha riscontrato la presenza del virus Virtumonde su alcuni files dll collegati a processi in corso di esecuzione e non eliminabili. Ho lanciato VundoFix che è riuscito a individuare e cancellare i files infetti. Al successivo riavvio, ho riscontrato un problema: dopo aver eliminato i files corrotti con Remove Vundo, mi compare il seguente messaggio: "RUNDLL: Errore durante il caricamento di C:\WINDOWS\system32\orwaoncs.dll. Impossibile trovare il modulo specificato.". Avviato Cclean per la cancellazione di un po' di spazzatura e successivamente HijackThis di cui posto il log:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 20.20.04, on 20/02/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Programmi\Belkin\Bluetooth Software\bin\btwdins.exe
    C:\Programmi\Eset\nod32krn.exe
    C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Programmi\Analog Devices\SoundMAX\SMax4PNP.exe
    C:\Programmi\Analog Devices\SoundMAX\smax4.exe
    C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Programmi\QuickTime\qttask.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE
    C:\WINDOWS\vsnpstd.exe
    C:\Programmi\Java\jre1.6.0_03\bin\jusched.exe
    C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
    C:\Programmi\Mindjet\MindManager 6\MMReminderService.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Programmi\Eset\nod32kui.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Programmi\Messenger\msmsgs.exe
    C:\Programmi\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe
    C:\Programmi\File comuni\PCSuite\Services\ServiceLayer.exe
    C:\Programmi\DAEMON Tools\daemon.exe
    C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\Programmi\Belkin\Bluetooth Software\BTTray.exe
    C:\Programmi\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Documents and Settings\Massimo\Desktop\HiJackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = add-hhh.info
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {23D44BCF-AA7A-41D6-8905-E808F16322EF} - C:\WINDOWS\system32\iifffec.dll (file missing)
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: CmjBrowserHelperObject Object - {AC41D38F-B56D-40AD-94E0-B493D130C959} - C:\Programmi\Mindjet\MindManager 6\Mm6InternetExplorer.dll
    O2 - BHO: (no name) - {B8DF1ABB-AC36-433F-BCA8-66FB51ED78F8} - C:\WINDOWS\system32\gebyv.dll (file missing)
    O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O2 - BHO: {3400f133-60e9-ae89-1fa4-03255f2517af} - {fa7152f5-5230-4af1-98ea-9e06331f0043} - C:\WINDOWS\system32\dfbxbxlt.dll (file missing)
    O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O4 - HKLM..\Run: [SoundMAXPnP] C:\Programmi\Analog Devices\SoundMAX\SMax4PNP.exe
    O4 - HKLM..\Run: [SoundMAX] "C:\Programmi\Analog Devices\SoundMAX\smax4.exe" /tray
    O4 - HKLM..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
    O4 - HKLM..\Run: [EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O6 "USB001" /M "Stylus CX3600"
    O4 - HKLM..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
    O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
    O4 - HKLM..\Run: [MMReminderService] C:\Programmi\Mindjet\MindManager 6\MMReminderService.exe
    O4 - HKLM..\Run: [CnxTrApp] rundll32.exe "C:\Programmi\StarModem\StarModem USB Network\CnxTrApp.dll",AppEntry -REG "Conexant\Conexant USB Network"
    O4 - HKLM..\Run: [nod32kui] "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
    O4 - HKLM..\Run: [2067c531] rundll32.exe "C:\WINDOWS\system32\orwaoncs.dll",b
    O4 - HKLM..\Run: [SpyHunter Security Suite] C:\Programmi\Enigma Software Group\SpyHunter\SpyHunter3.exe
    O4 - HKCU..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
    O4 - HKCU..\Run: [pdfSaver3] "C:\Programmi\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe"
    O4 - HKCU..\Run: [updateMgr] C:\Programmi\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
    O4 - HKCU..\Run: [DAEMON Tools] "C:\Programmi\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKCU..\Policies\Explorer\Run: [NTSpool] NTSpool.exe
    O4 - HKCU..\Policies\Explorer\Run: [System Patcher] BTCPatcher.exe
    O4 - HKUS\S-1-5-19..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO LOCALE')
    O4 - HKUS\S-1-5-20..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO DI RETE')
    O4 - HKUS\S-1-5-18..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS.DEFAULT..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: BTTray.lnk = ?
    O8 - Extra context menu item: Invia a periferica &Bluetooth... - C:\Programmi\Belkin\Bluetooth Software\btsendto_ie_ctx.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Send to Mindjet MindManager - {531B9DC0-D8EE-4c76-A6EE-6C1E50569655} - C:\Programmi\Mindjet\MindManager 6\Mm6InternetExplorer.dll
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\Belkin\Bluetooth Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\Belkin\Bluetooth Software\btsendto_ie.htm
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
    O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} - ysbweb.com/ist/softwares/v4.0/ysb_cracks.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - v5.windowsupdate.microsoft.co...?1093879561578
    O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\TempEI4\EI40_\msxml4.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
    O20 - Winlogon Notify: iifffec - iifffec.dll (file missing)
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Programmi\Belkin\Bluetooth Software\bin\btwdins.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1150\Intel 32\IDriverT.exe
    O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmi\Eset\nod32krn.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Programmi\File comuni\PCSuite\Services\ServiceLayer.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe

    --
    End of file - 7809 bytes

    Potete cortesemente darmi una mano a risolvere entrambi i problemi? Grazie per l'aiuto.

    0
  • wolf.otakar
    Consiglio Direttivo •

    Ciao Allymax e benvenuto nel forum GT! 🙂

    Fixa con hijackthis queste chiavi:

    O2 - BHO: (no name) - {23D44BCF-AA7A-41D6-8905-E808F16322EF} - C:\WINDOWS\system32\iifffec.dll (file missing)

    O2 - BHO: (no name) - {B8DF1ABB-AC36-433F-BCA8-66FB51ED78F8} - C:\WINDOWS\system32\gebyv.dll (file missing)

    O2 - BHO: {3400f133-60e9-ae89-1fa4-03255f2517af} - {fa7152f5-5230-4af1-98ea-9e06331f0043} - C:\WINDOWS\system32\dfbxbxlt.dll (file missing)

      	O4 - HKCU\..\Policies\Explorer\Run: [NTSpool] NTSpool.exe

    O4 - HKCU..\Policies\Explorer\Run: [System Patcher] BTCPatcher.exe

      	O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} - ysbweb.com/ist/softwares/v4.0/ysb_cracks.cab

    O20 - Winlogon Notify: iifffec - iifffec.dll (file missing)

    Questa > O4 - HKLM..\Run: [2067c531] rundll32.exe "C:\WINDOWS\system32\orwaoncs.dll",b per ora non fixarla. Credo che parti da qui parte l'errore: > "RUNDLL: Errore durante il caricamento di C:\WINDOWS\system32\orwaoncs.dll. Impossibile trovare il modulo specificato."

    Fixato le voci elencate in alto, riavvia il pc e posta un nuovo log!
    :ciauz:

    0
  • A
    User Newbie •

    Ok, fatto. Posto il nuovo log:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 0.01.45, on 23/02/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Programmi\Belkin\Bluetooth Software\bin\btwdins.exe
    C:\Programmi\Eset\nod32krn.exe
    C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Programmi\Analog Devices\SoundMAX\SMax4PNP.exe
    C:\Programmi\Analog Devices\SoundMAX\smax4.exe
    C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Programmi\QuickTime\qttask.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE
    C:\WINDOWS\vsnpstd.exe
    C:\Programmi\Java\jre1.6.0_03\bin\jusched.exe
    C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
    C:\Programmi\Mindjet\MindManager 6\MMReminderService.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Programmi\Eset\nod32kui.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Programmi\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe
    C:\Programmi\DAEMON Tools\daemon.exe
    C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\Programmi\Belkin\Bluetooth Software\BTTray.exe
    C:\Programmi\File comuni\PCSuite\Services\ServiceLayer.exe
    C:\Programmi\Azureus\Azureus.exe
    C:\WINDOWS\system32\wuauclt.exe
    G:\eBook personali\Internet\HiJackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    add-hhh.info/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: CmjBrowserHelperObject Object - {AC41D38F-B56D-40AD-94E0-B493D130C959} - C:\Programmi\Mindjet\MindManager 6\Mm6InternetExplorer.dll
    O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O4 - HKLM..\Run: [SoundMAXPnP] C:\Programmi\Analog Devices\SoundMAX\SMax4PNP.exe
    O4 - HKLM..\Run: [SoundMAX] "C:\Programmi\Analog Devices\SoundMAX\smax4.exe" /tray
    O4 - HKLM..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
    O4 - HKLM..\Run: [EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O6 "USB001" /M "Stylus CX3600"
    O4 - HKLM..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
    O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
    O4 - HKLM..\Run: [MMReminderService] C:\Programmi\Mindjet\MindManager 6\MMReminderService.exe
    O4 - HKLM..\Run: [CnxTrApp] rundll32.exe "C:\Programmi\StarModem\StarModem USB Network\CnxTrApp.dll",AppEntry -REG "Conexant\Conexant USB Network"
    O4 - HKLM..\Run: [nod32kui] "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
    O4 - HKLM..\Run: [2067c531] rundll32.exe "C:\WINDOWS\system32\orwaoncs.dll",b
    O4 - HKCU..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
    O4 - HKCU..\Run: [pdfSaver3] "C:\Programmi\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe"
    O4 - HKCU..\Run: [updateMgr] C:\Programmi\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
    O4 - HKCU..\Run: [DAEMON Tools] "C:\Programmi\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKUS\S-1-5-19..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO LOCALE')
    O4 - HKUS\S-1-5-20..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO DI RETE')
    O4 - HKUS\S-1-5-18..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS.DEFAULT..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: BTTray.lnk = ?
    O8 - Extra context menu item: Invia a periferica &Bluetooth... - C:\Programmi\Belkin\Bluetooth Software\btsendto_ie_ctx.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Send to Mindjet MindManager - {531B9DC0-D8EE-4c76-A6EE-6C1E50569655} - C:\Programmi\Mindjet\MindManager 6\Mm6InternetExplorer.dll
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\Belkin\Bluetooth Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\Belkin\Bluetooth Software\btsendto_ie.htm
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1093879561578
    O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\TempEI4\EI40_\msxml4.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Programmi\Belkin\Bluetooth Software\bin\btwdins.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1150\Intel 32\IDriverT.exe
    O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmi\Eset\nod32krn.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Programmi\File comuni\PCSuite\Services\ServiceLayer.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe

    --
    End of file - 6986 bytes

    Il messaggio RUNDLL continua ad apparire...

    0
  • wolf.otakar
    Consiglio Direttivo •

    @Allymax said:

    .....Il messaggio RUNDLL continua ad apparire...

    Fixa con hijackthis questa voce:

                              O4 - HKLM\..\Run: [2067c531] rundll32.exe "C:\WINDOWS\system32\orwaoncs.dll",b

    Fatto questo, riavvia e verifica la presenza di orwaoncs.dll nel pc!

    Fammi sapere! :ciauz:

    0
  • A
    User Newbie •

    Tutto ha ripreso a funzionare correttamente. Grazie infinite, Wolf!:gthi:

    0
  • wolf.otakar
    Consiglio Direttivo •

    @Allymax said:

    Grazie infinite, Wolf!:gthi:

    :ciauz:

    p.s. installa un buon firewall; quello di windows non basta! 😉

    0
  • C
    User Newbie •

    Salve a tutti, ho letto ripetutamente il questi post nel tentativo di non rompervi le scatole ma non ci sono riuscito. Sono afflitto anch'io da questo maledetto Vitumonde e non sono riuscito a trovare le voci HijackThis che avete evidenziato per cui vi propongo il mio log nella speranza che qualcuno di voi possa darmi una mano..... Grazie mille.......

    0
  • C
    User Newbie •

    ecco l'allegato.....

    0
  • G
    User Attivo •

    Apri hijackthis con do a system scan only e nella lista metti la selezione a queste voci, poi premi in basso fix checked:
    O2 - BHO: (no name) - {0347C33E-8762-4905-BF09-768834316C61} - (no file)
    O2 - BHO: (no name) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - (no file)
    O2 - BHO: (no name) - {1E9FC8B8-377B-4B16-AF11-BB72B1D85F3B} - (no file)
    O2 - BHO: (no name) - {50EC7FDA-5382-42D2-BFDE-7D0B3551FAE4} - (no file)
    O2 - BHO: (no name) - {587B6BB8-0457-4AD3-913F-EDABCB6BD9EA} - (no file)
    O2 - BHO: (no name) - {5ECAF0E2-6A85-45DC-AD6D-C6A562074D83} - (no file)
    O2 - BHO: (no name) - {71A3593D-0C1A-4534-89B9-E096D74E68C1} - (no file)
    O2 - BHO: (no name) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - (no file)
    O2 - BHO: (no name) - {D57D904F-DE0E-451C-8029-93288EAD2358} - (no file)
    O2 - BHO: (no name) - {E3D90832-6954-4115-8728-9BEAA39C0E56} - (no file)

    Scarica avenger dal link che ho scritto sopra e nella casella bianca scrivi:

    Files to delete:
    F:\Programmi\DNA\btdna.exe

    Premi execute, fai riavviare e posta il log più un nuovo log hijackthis.

    0
  • C
    User Newbie •

    Speriamo bene.....

    0
  • J
    User Newbie •

    Buon giorno, anche io ho avuto questo problema, ma non so se sia già risolto. Mi potete dire se ancora è infetto il mio computer? Grazie.
    Allego il mio log.

    0
  • G
    User Attivo •

    @Camora: dal log non si vede più niente.
    Per sicurezza esegui una scansione con combofix.
    Scarica combifix http://subs.geekstogo.com/ComboFix.exe salvalo sul desktop -->chiudi tutti i programmi-->avvialo-->segui le istruzioni a video e inizia la scansione.
    Al termine posta il log che comparirà.
    **NB: Combofix è rilevato come infetto dal alcuni AV, è un errore nega l'avviso.

    Edit:
    @ Jeronima: **dal tuo log fixa:
    O4 - HKUS\S-1-5-19..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVIZIO LOCALE')
    O4 - HKUS\S-1-5-19..\RunOnce: [] (User 'SERVIZIO LOCALE')
    O4 - HKUS\S-1-5-20..\RunOnce: [] (User 'SERVIZIO DI RETE')
    O4 - HKUS\S-1-5-18..\RunOnce: [] (User 'SYSTEM')
    O4 - HKUS.DEFAULT..\RunOnce: [] (User 'Default user')
    O4 - Global Startup: BTTray.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: QuickSet.lnk = C:\Program Files\Dell\QuickSet\quickset.exe

    0
  • J
    User Newbie •

    Ho fissato quello che mi hai detto e ho fatto pure la scansione con combofix. Ecco addesso il mio log.

    0
  • J
    User Newbie •

    Ho fixato quello che mi hai detto e ho fatto la scansione con combofix. Ecco addesso il mio log:

    0
Effettua l'accesso per rispondere