VIRUS FROM ITALY

hello

download hijackthis here:
http://www.merijn.org/files/hijackthis.zip
run hijackthis.exe
click on "do a system scan and save logfile" button
when notepad will open, copy/paste the rapport here.

do you speak french ? because my english is too bad

ciao

hi Moe31,

I don't speak France language but I can read.
My english is very bad. :-) Don't worry.

thanks for your responce.

I test the tool program.
See you later.

Ottavio
Naples - Italy

Logfile of HijackThis v1.99.1
Scan saved at 12.29.24, on 12/07/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\THOTKEY.EXE
C:\WINDOWS\SYSTEM\MDM.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAMMI\FILE COMUNI\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAMMI\NORTON ANTIVIRUS\ADVTOOLS\NPROTECT.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\IRMON.EXE
C:\WINDOWS\SYSTEM\ALISNDMG.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\TPWRTRAY.EXE
C:\WINDOWS\SYSTEM\TFNCKY.EXE
C:\PROGRAMMI\FILE COMUNI\CMEII\CMESYS.EXE
C:\PROGRAMMI\FILE COMUNI\SYMANTEC SHARED\CCAPP.EXE
C:\WINDOWS\SYSTEM\HPZTSB04.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAMMI\SPYWARE NUKER 2004\SWN2.EXE
C:\PROGRAMMI\FILE COMUNI\GMT\GMT.EXE
C:\PROGRAMMI\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\PROGRAMMI\SYMANTEC\WINFAX\WFXCTL32.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAMMI\SYMANTEC\WINFAX\WFXMOD32.EXE
C:\WINDOWS\TEMP\TD_0001.DIR\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://gw.aliceadsl.it/minisearch
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.specialgoods.info/ad/ad0411/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://gw.aliceadsl.it/home
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fornito da Alice
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;127.0.0.1;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: transURL Class - {C7EDAB2E-D7F9-11D8-BA48-C79B0C409D70} - C:\WINDOWS\SYSTEM32\SEARCH~1.DLL (file missing)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmi\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmi\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [IrMon] irmon.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [ALiSndMgr] ALiSndMg.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [Tpwrtray] TPWRTRAY.EXE
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Programmi\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Programmi\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Programmi\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [CMESys] "C:\PROGRAMMI\FILE COMUNI\CMEII\CMESYS.EXE"
O4 - HKLM\..\Run: [PC-CAM 600 STI App Registration] RunDLL32.exe PD023pin.dll,RunDLL32EP 512
O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Programmi\File comuni\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\ADVTOOLS\ADVCHK.EXE
O4 - HKLM\..\Run: [NPROTECT] C:\PROGRA~1\NORTON~1\ADVTOOLS\NPROTECT.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb04.exe
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMON.EXE
O4 - HKLM\..\Run: [Spyware Nuker] C:\Programmi\Spyware Nuker 2004\swn2.exe /h
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [THotkey] C:\WINDOWS\SYSTEM\THotkey.exe
O4 - HKLM\..\RunServices: [Machine Debug Manager] C:\WINDOWS\SYSTEM\MDM.EXE
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [NPROTECT] C:\PROGRA~1\NORTON~1\ADVTOOLS\NPROTECT.EXE
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Programmi\File comuni\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - Startup: AVVIO OFFICE.LNK = C:\Programmi\Microsoft Office\Office\OSA.EXE
O4 - Startup: GSTARTUP.LNK = C:\Programmi\File comuni\GMT\GMT.exe
O4 - Startup: Controller.LNK = C:\Programmi\Symantec\WinFax\WFXCTL32.EXE
O4 - User Startup: AVVIO OFFICE.LNK = C:\Programmi\Microsoft Office\Office\OSA.EXE
O4 - User Startup: GSTARTUP.LNK = C:\Programmi\File comuni\GMT\GMT.exe
O4 - User Startup: Controller.LNK = C:\Programmi\Symantec\WinFax\WFXCTL32.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - http://ricercaperfetta.com/ (file missing)
O9 - Extra 'Tools' menuitem: Loghi e suonerie - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - http://ricercaperfetta.com/ (file missing)
O9 - Extra button: Organizzatore ricerche - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Programmi\File comuni\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
O9 - Extra button: Alice - {56F8B48B-F476-4CB6-8B17-3B38E92B0B2D} - http://gw.aliceadsl.it/alice (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://gw.aliceadsl.it/home
O15 - Trusted Zone: www.redfunny.com
O15 - Trusted Zone: www.skymasters.biz
O15 - Trusted Zone: www.archiviosex.net
O16 - DPF: {11120607-1001-1111-1000-110199901123} - ms-its:mhtml:file://c:default.mht!http://www.wearehosters.com/v411/dropper.chm::/dropper.exe

hi,
there is the log files.

Help me.

Thank you!
Ottavio

ok

Boot to safe mode
http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/619dc956e2367ad48525695b005ca28a/a85cc2544149a27b80256c2c004a04d8?OpenDocument

run HijackThis, click on "do a system scan only" button
and put checks next to all the following:

O4 - HKLM\..\Run: [CMESys] "C:\PROGRAMMI\FILE COMUNI\CMEII\CMESYS.EXE"
O4 - Startup: GSTARTUP.LNK = C:\Programmi\File comuni\GMT\GMT.exe
O4 - User Startup: GSTARTUP.LNK = C:\Programmi\File comuni\GMT\GMT.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - http://ricercaperfetta.com/ (file missing)
O15 - Trusted Zone: www.redfunny.com
O15 - Trusted Zone: www.skymasters.biz
O15 - Trusted Zone: www.archiviosex.net
O16 - DPF: {11120607-1001-1111-1000-110199901123} - ms-its:mhtml:file://c:default.mht!http://www.wearehosters.com/v411/dropper.chm::/dropper.exe

then click "Fix Checked"

delete this files or folders

C:\Programmi\File comuni\GMT
C:\PROGRAMMI\FILE COMUNI\CMEII
C:\WINDOWS\SYSTEM\itDD.exe

reboot normaly and perform an antivirus scan online here:
http://www.pandasoftware.com/activescan/fr/activescan_principal.htm

wahooo

international moe, çà fait 20 mn que je me tapais un message en anglais pensant que tu mangeais.

çà m'a fait reviser. lol

jean

salut jean

lol, mon anglais est tellement mauvais que j'ai du piocher sur des forums anglais...

Mais si tu as pu détailler un peu plus la manip, n'hésite pas à poster.
J'ai fais au plus court...

a+

trop bete j'ai tout viré, pourtant il etait beau... enfin on le verra jamais.

une petite question, je t'ai vu preconiser processxp.exe dans un autre post, tu peux me dire son action/ kill box ou autre??

merci Moe

vacances J-0,8

processxp c'est un gestionnaire des taches beaucoup plus complet que celui de windows.
comme la dll du post auquel tu fais reference, est chargée par explorer.exe et winlogon.exe, tant que ceux ci sont actifs impossible de la supprimer.(et ils sont actifs en sans echec aussi).
En gros Processxp permet de killer juste la dll dans explorer.exe et winlogon.exe sans avoir besoin de les arreter auparavant.
les fix avec hijack pour supprimer les entrées dans le registre et killbox pour finir le boulot.
Personnellement, j'utilise processxp, car beaucoup plus d'infos qu'avec le gestionnaire des taches.
Et plus généralement, sur le site de sysinternals on trouve de tres bons freewares comme filemon et regmon qui permettent une surveillance en temps reel de l'activitée des processus ou de tout se qui s'inscrit dans le registre.
En anglais, mais impressionnant.

a+

Thanks for your cooperation and availability.
You have resolved my big big problem.

Thanks from Italy

Ottavio
NAPLES

;-)

Sono contento per te, ottavio

un grande buongiorno a tutta l'Italia.

ciao

moe

Grazie. Merci.