Tech Support Forum - View Single Post - Continuous pop ups - Win32:Agent LVW(Trj) + CVE-2007-0038 found by AVAST

Axo · 01-29-2008, 10:24 AM

Tetontob, my saviour!

don't worry, I feel very lucky you care about me... do you remember De Niro in Mission movie? yopu seem the same to me!

Sorry it takes so long for the reply, I'm GMT+1 so may our "time window" is little...
Here Combofix log. Please note that my CPU had a reboot before combofix finished. I did not use any program, but normal startup occurred, and combofix finished after a normal strtup.

ComboFix 08-01-29.3 - Alessio Zanibelli 2008-01-29 17.45.33.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1040.18.483 [GMT 2:00]
Eseguito da: C:\Documents and Settings\Alessio Zanibelli\Desktop\ComboFix.exe
* Creato nuovo punto di ripristino
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\core.sys
C:\Documents and Settings\Alessio Zanibelli\Dati applicazioni\macromedia\Flash Player\#SharedObjects\LQ4AXGGX\iforex.com
C:\Documents and Settings\Alessio Zanibelli\Dati applicazioni\macromedia\Flash Player\#SharedObjects\LQ4AXGGX\iforex.com\Emerp\Events\flash_object.swf\user_data.sol
C:\Documents and Settings\Alessio Zanibelli\Dati applicazioni\macromedia\Flash Player\#SharedObjects\LQ4AXGGX\www.broadcaster.com
C:\Documents and Settings\Alessio Zanibelli\Dati applicazioni\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com
C:\Documents and Settings\Alessio Zanibelli\Dati applicazioni\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com\settings.sol
C:\Documents and Settings\Alessio Zanibelli\Dati applicazioni\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Documents and Settings\Alessio Zanibelli\Dati applicazioni\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\temp\tn3
C:\WINDOWS\Fonts\acrsecB.fon
C:\WINDOWS\Fonts\acrsecI.fon
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\core.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_CORE
-------\LEGACY_IPRIP
-------\core
-------\Iprip

((((((((((((((((((((((((( Files Creati Da 2007-12-28 al 2008-01-29 )))))))))))))))))))))))))))))))))))
.

2008-01-29 17:18 . 2006-09-07 17:34 261,312 -r-hs---- C:\cmldr
2008-01-29 17:18 . 2005-05-24 10:18 211 -rahs---- C:\BOOT.BAK
2008-01-25 09:50 . 2008-01-25 09:50 <DIR> d-------- C:\Documents and Settings\Guest\Dati applicazioni\Toshiba
2008-01-22 09:26 . 2008-01-22 09:26 <DIR> d-------- C:\Documents and Settings\Alessio Zanibelli\Dati applicazioni\TrojanHunter
2008-01-21 18:31 . 2008-01-21 18:32 <DIR> d-------- C:\Programmi\TrojanHunter 5.0
2008-01-16 09:30 . 2008-01-16 09:30 <DIR> d-------- C:\Deckard
2008-01-16 08:59 . 2008-01-21 18:03 <DIR> d-------- C:\Programmi\SpywareBlaster
2008-01-16 08:59 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX
2008-01-15 17:14 . 2008-01-15 20:15 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2008-01-15 17:14 . 2008-01-15 17:16 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-01-15 17:14 . 2008-01-15 17:16 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-01-15 17:14 . 2008-01-15 17:16 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-01-15 17:08 . 2007-12-14 01:59 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-01-15 17:07 . 2008-01-15 17:07 <DIR> d-------- C:\Programmi\File comuni\Java
2008-01-11 10:31 . 2004-09-09 12:07 <DIR> d--h----- C:\Documents and Settings\Administrator\Risorse di stampa
2008-01-11 10:31 . 2004-09-09 12:07 <DIR> d--h----- C:\Documents and Settings\Administrator\Risorse di rete
2008-01-11 10:31 . 2004-09-09 12:19 <DIR> dr------- C:\Documents and Settings\Administrator\Preferiti
2008-01-11 10:31 . 2004-09-09 12:07 <DIR> d--h----- C:\Documents and Settings\Administrator\Modelli
2008-01-11 10:31 . 2004-09-09 12:07 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Avvio
2008-01-11 10:31 . 2008-01-29 17:50 <DIR> d--h----- C:\Documents and Settings\Administrator\Impostazioni locali
2008-01-11 10:31 . 2004-09-09 12:19 <DIR> dr------- C:\Documents and Settings\Administrator\Documenti
2008-01-11 10:31 . 2005-05-21 00:48 <DIR> d-------- C:\Documents and Settings\Administrator\Dati applicazioni\Sonic
2008-01-11 10:31 . 2005-05-21 00:46 <DIR> d-------- C:\Documents and Settings\Administrator\Dati applicazioni\Jasc Software Inc
2008-01-11 10:31 . 2005-05-21 00:36 <DIR> d-------- C:\Documents and Settings\Administrator\Dati applicazioni\Intel
2008-01-11 10:31 . 2008-01-11 10:31 <DIR> d-------- C:\Documents and Settings\Administrator\Dati applicazioni\Grisoft
2008-01-11 10:31 . 2008-01-11 10:31 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dati applicazioni
2008-01-10 12:02 . 2008-01-10 12:02 <DIR> d-------- C:\Documents and Settings\Alessio Zanibelli\Dati applicazioni\Grisoft
2008-01-10 12:02 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-01-09 09:38 . 2008-01-09 09:46 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\SlySoft
2008-01-08 18:36 . 2008-01-24 10:26 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-08 18:36 . 2008-01-08 18:36 1,409 --a------ C:\WINDOWS\QTFont.for
2008-01-08 16:41 . 2008-01-09 09:34 24 --ahs---- C:\WINDOWS\SA2048A55.tmp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-29 15:57 --------- d-----w C:\Documents and Settings\Alessio Zanibelli\Dati applicazioni\Skype
2008-01-29 14:58 --------- d-----w C:\Documents and Settings\Alessio Zanibelli\Dati applicazioni\OpenOffice.org2
2008-01-27 11:21 --------- d-----w C:\Documents and Settings\Alessio Zanibelli\Dati applicazioni\Hamachi
2008-01-25 07:50 --------- d-----w C:\Documents and Settings\Guest\Dati applicazioni\OpenOffice.org2
2008-01-21 07:57 --------- d-----w C:\Programmi\NCH Swift Sound
2008-01-15 18:09 --------- d-----w C:\Programmi\Windows Defender
2008-01-15 18:08 --------- d-----w C:\Programmi\PC Connectivity Solution
2008-01-15 17:58 --------- d-----w C:\Programmi\File comuni\LightScribe
2008-01-15 17:57 --------- d-----w C:\Programmi\File comuni\Autodesk Shared
2008-01-15 17:57 --------- d-----w C:\Programmi\Digital Line Detect
2008-01-15 17:36 --------- d-----w C:\Programmi\AVerTV
2008-01-15 17:32 --------- d-----w C:\Programmi\Apoint
2008-01-15 17:32 --------- d-----w C:\Programmi\7-Zip
2008-01-15 15:08 --------- d-----w C:\Programmi\Java
2008-01-14 15:48 --------- d-----w C:\Documents and Settings\Alessio Zanibelli\Dati applicazioni\uTorrent
2008-01-14 14:51 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\DVD Shrink
2007-12-07 08:19 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys
2007-12-05 09:17 --------- d-----w C:\Documents and Settings\Alessio Zanibelli\Dati applicazioni\Blackberry Desktop
2007-12-05 09:10 --------- d-----w C:\Documents and Settings\Alessio Zanibelli\Dati applicazioni\Research In Motion
2007-12-05 08:59 --------- d-----w C:\Programmi\File comuni\Research In Motion
2007-12-05 08:58 --------- d-----w C:\Programmi\Research In Motion
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2007-11-14 07:27 450,560 ----a-w C:\WINDOWS\system32\dllcache\jscript.dll
2007-11-07 09:27 727,552 ----a-w C:\WINDOWS\system32\lsasrv.dll
2007-11-07 09:27 727,552 ------w C:\WINDOWS\system32\dllcache\lsasrv.dll
2007-10-30 17:20 360,064 ------w C:\WINDOWS\system32\dllcache\tcpip.sys
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* i valori vuoti & legittimi/default non sono visualizzati.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="C:\Programmi\Skype\Phone\Skype.exe" [2007-09-13 13:31 22880040]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 13:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-12-01 00:05 4636672]
"nwiz"="nwiz.exe" [2004-12-01 00:05 921600 C:\WINDOWS\system32\nwiz.exe]
"IntelWireless"="C:\Programmi\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 15:59 385024]
"Apoint"="C:\Programmi\Apoint\Apoint.exe" [2004-09-13 17:33 155648]
"Client Access Service"="C:\Programmi\IBM\Client Access\cwbsvstr.exe" [2002-05-07 06:20 20530]
"Client Access Help Update"="C:\Programmi\IBM\Client Access\cwbinhlp.exe" [2002-05-07 06:20 24626]
"Client Access Check Version"="C:\Programmi\IBM\Client Access\cwbckver.exe" [2002-05-07 06:20 45056]
"Client Access Express Welcome"="C:\Programmi\IBM\Client Access\cwbwlwiz.exe" [2002-05-07 06:20 20530]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-10-08 12:52 221184]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 15:00 79224]
"Google Desktop Search"="C:\Programmi\Google\Google Desktop Search\GoogleDesktop.exe" [2007-08-23 14:58 1838592]
"Windows Defender"="C:\Programmi\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]
"Detect Kbd Daemon"="SK2000DM.EXE" [2001-03-12 20:50 29184 C:\WINDOWS\system32\SK2000DM.EXE]
"PCSuiteTrayApplication"="C:\Programmi\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10 271360]
"QuickTime Task"="C:\Programmi\QuickTime\qttask.exe" [2006-09-01 16:57 282624]
"SunJavaUpdateSched"="C:\Programmi\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 03:42 144784]
"THGuard"="C:\Programmi\TrojanHunter 5.0\THGuard.exe" [2007-09-09 09:31 1046688]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 13:00 15360]
"Nokia.PCSync"="C:\Programmi\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17 1241088]
"DWQueuedReporting"="C:\PROGRA~1\FILECO~1\MICROS~1\DW\dwtrig20.exe" [2006-11-13 19:54 34832]

C:\Documents and Settings\Alessio Zanibelli\Menu Avvio\Programmi\Esecuzione automatica\
OpenOffice.org 2.3.lnk - C:\Programmi\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 22:57:56 393216]

C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Bluetooth Manager.lnk - C:\Programmi\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2005-01-14 20:59:06 483328]
Digital Line Detect.lnk - C:\Programmi\Digital Line Detect\DLG.exe [2005-05-21 00:37:02 24576]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= C:\Programmi\Qualcomm\Eudora\EuShlExt.dll [2006-08-17 15:57 86016]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Programmi\Intel\Wireless\Bin\LgNotify.dll 2004-09-07 17:08 110592 C:\Programmi\Intel\Wireless\Bin\LgNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

R1 LUMDriver;LUMDriver;C:\WINDOWS\system32\drivers\LUMDriver.sys [2003-07-11 15:22]
R2 BBDemon;Backbone Service;"C:\Programmi\Dassault Systemes\B16\intel_a\code\bin\CATSysDemon.exe" [2005-09-06 23:11]
R3 SKUSBKBF;USB Keyboard Filter Driver;C:\WINDOWS\system32\DRIVERS\SKUSBKBF.sys [2001-03-12 20:51]
S3 AX88772;ASIX AX88772 USB2.0 to Fast Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\ax88772.sys [2004-12-03 04:04]
S3 Cap7134;Cap7134 Capture;C:\WINDOWS\system32\DRIVERS\Cap7134.sys [2007-01-26 19:22]
S3 p2pgasvc;Autenticazione gruppo rete peer;C:\WINDOWS\system32\svchost.exe [2004-08-19 13:00]
S3 p2pimsvc;Gestione identità rete peer;C:\WINDOWS\system32\svchost.exe [2004-08-19 13:00]
S3 p2psvc;Rete peer;C:\WINDOWS\system32\svchost.exe [2004-08-19 13:00]
S3 PhTVTune;Cap7134 TVTuner;C:\WINDOWS\system32\DRIVERS\PhTVTune.sys [2007-01-26 19:22]
S3 PNRPSvc;Peer Name Resolution Protocol (PNRP);C:\WINDOWS\system32\svchost.exe [2004-08-19 13:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

.
Contenuto della cartella 'Scheduled Tasks'
"2008-01-22 19:13:08 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Programmi\Apple Software Update\SoftwareUpdate.exe
"2008-01-09 07:46:16 C:\WINDOWS\Tasks\jkevny.job"

And this is a fresh Hijackthis log. Also Hijack reported an error before doing the scan and asked me to email the error to somebody... but when I closed the error window had no more the address: after posting this will try to reproduce the error and inform the "owner"

Logfile of HijackThis v1.99.1
Scan saved at 18:16, on 2008-01-29
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Intel\Wireless\Bin\EvtEng.exe
C:\Programmi\Intel\Wireless\Bin\S24EvMon.exe
C:\Programmi\Intel\Wireless\Bin\WLKeeper.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\Programmi\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\system32\spoolsv.exe
c:\windows\system32\svchost.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Programmi\Dassault Systemes\B16\intel_a\code\bin\CATSysDemon.exe
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programmi\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Intel\Wireless\Bin\ifrmewrk.exe
C:\Programmi\Apoint\Apoint.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programmi\Windows Defender\MSASCui.exe
C:\Programmi\Apoint\Apntex.exe
C:\Programmi\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\WINDOWS\system32\Sktempdm.exe
C:\Programmi\Java\jre1.6.0_04\bin\jusched.exe
C:\WINDOWS\system32\Skdaemon.exe
C:\Programmi\TrojanHunter 5.0\THGuard.exe
C:\Programmi\PC Connectivity Solution\ServiceLayer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Programmi\Digital Line Detect\DLG.exe
C:\Programmi\OpenOffice.org 2.3\program\soffice.exe
C:\Programmi\OpenOffice.org 2.3\program\soffice.BIN
C:\Programmi\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Programmi\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\Documents and Settings\Alessio Zanibelli\Documenti\Old PC\Scaricati da Internet\Software Downloads\Antivirus e firewall\Hijack this\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: (no name) - {259F616C-A300-44F5-B04A-ED001A26C85C} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_04\bin\ssv.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [IntelWireless] C:\Programmi\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [Apoint] C:\Programmi\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Client Access Service] "C:\Programmi\IBM\Client Access\cwbsvstr.exe"
O4 - HKLM\..\Run: [Client Access Help Update] "C:\Programmi\IBM\Client Access\cwbinhlp.exe"
O4 - HKLM\..\Run: [Client Access Check Version] "C:\Programmi\IBM\Client Access\cwbckver.exe" LOGIN
O4 - HKLM\..\Run: [Client Access Express Welcome] "C:\Programmi\IBM\Client Access\cwbwlwiz.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Programmi\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Windows Defender] "C:\Programmi\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Detect Kbd Daemon] SK2000DM.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Programmi\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKLM\..\Run: [THGuard] "C:\Programmi\TrojanHunter 5.0\THGuard.exe"
O4 - HKCU\..\Run: [Skype] "C:\Programmi\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Programmi\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: &Search - http://kn.bar.need2find.com/KN/menusearch.html?p=KN
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O12 - Plugin for .csm: C:\Programmi\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .csml: C:\Programmi\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .cub: C:\Programmi\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .cube: C:\Programmi\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .dx: C:\Programmi\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .emb: C:\Programmi\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .embl: C:\Programmi\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .gau: C:\Programmi\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .jdx: C:\Programmi\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .mol: C:\Programmi\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .mop: C:\Programmi\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .pdb: C:\Programmi\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .rxn: C:\Programmi\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .scr: C:\Programmi\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .skc: C:\Programmi\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .spt: C:\Programmi\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .tgf: C:\Programmi\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .xyz: C:\Programmi\Internet Explorer\Plugins\npchime.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://C:\Programmi\AutoCAD 2002\InstBanr.ocx
O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - http://locator1.cdn.imagesrvr.com/si...Install_it.cab
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file://C:\Programmi\AutoCAD 2002\InstFred.ocx
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} - file://C:\Programmi\AutoCAD 2002\AcPreview.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{22C1497E-DFE3-44E6-9300-E3C8BEEA8A53}: NameServer = 213.140.2.12,213.140.2.21
O17 - HKLM\System\CCS\Services\Tcpip\..\{E91340B6-0763-419C-8972-99E1AB391528}: NameServer = 213.140.2.12,213.140.2.21
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: IntelWireless - C:\Programmi\Intel\Wireless\Bin\LgNotify.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Programmi\File comuni\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Backbone Service (BBDemon) - Unknown owner - C:\Programmi\Dassault Systemes\B16\intel_a\code\bin\CATSysDemon.exe" -service (file missing)
O23 - Service: Comando remoto iSeries Access per Windows (Cwbrxd) - IBM Corporation - C:\WINDOWS\CWBRXD.EXE
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Programmi\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: EvtEng - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: GoogleDesktopManager - Google - C:\Programmi\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Programmi\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Programmi\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programmi\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Programmi\Intel\Wireless\Bin\WLKeeper.exe

Bye and thankyou again!!

01-29-2008, 10:24 AM	#6 (permalink)
Axo Registered User Join Date: Jan 2008 Posts: 15 OS: win xp home	Re: Continuous pop ups - Win32:Agent LVW(Trj) + CVE-2007-0038 found by AVAST Tetontob, my saviour! don't worry, I feel very lucky you care about me... do you remember De Niro in Mission movie? yopu seem the same to me! Sorry it takes so long for the reply, I'm GMT+1 so may our "time window" is little... Here Combofix log. Please note that my CPU had a reboot before combofix finished. I did not use any program, but normal startup occurred, and combofix finished after a normal strtup. ComboFix 08-01-29.3 - Alessio Zanibelli 2008-01-29 17.45.33.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1040.18.483 [GMT 2:00] Eseguito da: C:\Documents and Settings\Alessio Zanibelli\Desktop\ComboFix.exe * Creato nuovo punto di ripristino . ((((((((((((((((((((((((((((((((((((( Altre eliminazioni ))))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\drivers\core.cache.dsk C:\WINDOWS\system32\drivers\core.sys C:\Documents and Settings\Alessio Zanibelli\Dati applicazioni\macromedia\Flash Player\#SharedObjects\LQ4AXGGX\iforex.com C:\Documents and Settings\Alessio Zanibelli\Dati applicazioni\macromedia\Flash Player\#SharedObjects\LQ4AXGGX\iforex.com\Emerp\Events\flash_object.swf\user_data.sol C:\Documents and Settings\Alessio Zanibelli\Dati applicazioni\macromedia\Flash Player\#SharedObjects\LQ4AXGGX\www.broadcaster.com C:\Documents and Settings\Alessio Zanibelli\Dati applicazioni\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com C:\Documents and Settings\Alessio Zanibelli\Dati applicazioni\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com\settings.sol C:\Documents and Settings\Alessio Zanibelli\Dati applicazioni\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com C:\Documents and Settings\Alessio Zanibelli\Dati applicazioni\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol C:\temp\tn3 C:\WINDOWS\Fonts\acrsecB.fon C:\WINDOWS\Fonts\acrsecI.fon C:\WINDOWS\system32\drivers\core.cache.dsk C:\WINDOWS\system32\drivers\core.sys . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_CORE -------\LEGACY_IPRIP -------\core -------\Iprip ((((((((((((((((((((((((( Files Creati Da 2007-12-28 al 2008-01-29 ))))))))))))))))))))))))))))))))))) . 2008-01-29 17:18 . 2006-09-07 17:34 261,312 -r-hs---- C:\cmldr 2008-01-29 17:18 . 2005-05-24 10:18 211 -rahs---- C:\BOOT.BAK 2008-01-25 09:50 . 2008-01-25 09:50 <DIR> d-------- C:\Documents and Settings\Guest\Dati applicazioni\Toshiba 2008-01-22 09:26 . 2008-01-22 09:26 <DIR> d-------- C:\Documents and Settings\Alessio Zanibelli\Dati applicazioni\TrojanHunter 2008-01-21 18:31 . 2008-01-21 18:32 <DIR> d-------- C:\Programmi\TrojanHunter 5.0 2008-01-16 09:30 . 2008-01-16 09:30 <DIR> d-------- C:\Deckard 2008-01-16 08:59 . 2008-01-21 18:03 <DIR> d-------- C:\Programmi\SpywareBlaster 2008-01-16 08:59 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX 2008-01-15 17:14 . 2008-01-15 20:15 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2008-01-15 17:14 . 2008-01-15 17:16 30,590 --a------ C:\WINDOWS\system32\pavas.ico 2008-01-15 17:14 . 2008-01-15 17:16 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico 2008-01-15 17:14 . 2008-01-15 17:16 1,406 --a------ C:\WINDOWS\system32\Help.ico 2008-01-15 17:08 . 2007-12-14 01:59 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-01-15 17:07 . 2008-01-15 17:07 <DIR> d-------- C:\Programmi\File comuni\Java 2008-01-11 10:31 . 2004-09-09 12:07 <DIR> d--h----- C:\Documents and Settings\Administrator\Risorse di stampa 2008-01-11 10:31 . 2004-09-09 12:07 <DIR> d--h----- C:\Documents and Settings\Administrator\Risorse di rete 2008-01-11 10:31 . 2004-09-09 12:19 <DIR> dr------- C:\Documents and Settings\Administrator\Preferiti 2008-01-11 10:31 . 2004-09-09 12:07 <DIR> d--h----- C:\Documents and Settings\Administrator\Modelli 2008-01-11 10:31 . 2004-09-09 12:07 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Avvio 2008-01-11 10:31 . 2008-01-29 17:50 <DIR> d--h----- C:\Documents and Settings\Administrator\Impostazioni locali 2008-01-11 10:31 . 2004-09-09 12:19 <DIR> dr------- C:\Documents and Settings\Administrator\Documenti 2008-01-11 10:31 . 2005-05-21 00:48 <DIR> d-------- C:\Documents and Settings\Administrator\Dati applicazioni\Sonic 2008-01-11 10:31 . 2005-05-21 00:46 <DIR> d-------- C:\Documents and Settings\Administrator\Dati applicazioni\Jasc Software Inc 2008-01-11 10:31 . 2005-05-21 00:36 <DIR> d-------- C:\Documents and Settings\Administrator\Dati applicazioni\Intel 2008-01-11 10:31 . 2008-01-11 10:31 <DIR> d-------- C:\Documents and Settings\Administrator\Dati applicazioni\Grisoft 2008-01-11 10:31 . 2008-01-11 10:31 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dati applicazioni 2008-01-10 12:02 . 2008-01-10 12:02 <DIR> d-------- C:\Documents and Settings\Alessio Zanibelli\Dati applicazioni\Grisoft 2008-01-10 12:02 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2008-01-09 09:38 . 2008-01-09 09:46 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\SlySoft 2008-01-08 18:36 . 2008-01-24 10:26 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-01-08 18:36 . 2008-01-08 18:36 1,409 --a------ C:\WINDOWS\QTFont.for 2008-01-08 16:41 . 2008-01-09 09:34 24 --ahs---- C:\WINDOWS\SA2048A55.tmp . (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-29 15:57 --------- d-----w C:\Documents and Settings\Alessio Zanibelli\Dati applicazioni\Skype 2008-01-29 14:58 --------- d-----w C:\Documents and Settings\Alessio Zanibelli\Dati applicazioni\OpenOffice.org2 2008-01-27 11:21 --------- d-----w C:\Documents and Settings\Alessio Zanibelli\Dati applicazioni\Hamachi 2008-01-25 07:50 --------- d-----w C:\Documents and Settings\Guest\Dati applicazioni\OpenOffice.org2 2008-01-21 07:57 --------- d-----w C:\Programmi\NCH Swift Sound 2008-01-15 18:09 --------- d-----w C:\Programmi\Windows Defender 2008-01-15 18:08 --------- d-----w C:\Programmi\PC Connectivity Solution 2008-01-15 17:58 --------- d-----w C:\Programmi\File comuni\LightScribe 2008-01-15 17:57 --------- d-----w C:\Programmi\File comuni\Autodesk Shared 2008-01-15 17:57 --------- d-----w C:\Programmi\Digital Line Detect 2008-01-15 17:36 --------- d-----w C:\Programmi\AVerTV 2008-01-15 17:32 --------- d-----w C:\Programmi\Apoint 2008-01-15 17:32 --------- d-----w C:\Programmi\7-Zip 2008-01-15 15:08 --------- d-----w C:\Programmi\Java 2008-01-14 15:48 --------- d-----w C:\Documents and Settings\Alessio Zanibelli\Dati applicazioni\uTorrent 2008-01-14 14:51 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\DVD Shrink 2007-12-07 08:19 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys 2007-12-05 09:17 --------- d-----w C:\Documents and Settings\Alessio Zanibelli\Dati applicazioni\Blackberry Desktop 2007-12-05 09:10 --------- d-----w C:\Documents and Settings\Alessio Zanibelli\Dati applicazioni\Research In Motion 2007-12-05 08:59 --------- d-----w C:\Programmi\File comuni\Research In Motion 2007-12-05 08:58 --------- d-----w C:\Programmi\Research In Motion 2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys 2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr 2007-11-14 07:27 450,560 ----a-w C:\WINDOWS\system32\dllcache\jscript.dll 2007-11-07 09:27 727,552 ----a-w C:\WINDOWS\system32\lsasrv.dll 2007-11-07 09:27 727,552 ------w C:\WINDOWS\system32\dllcache\lsasrv.dll 2007-10-30 17:20 360,064 ------w C:\WINDOWS\system32\dllcache\tcpip.sys . ((((((((((((((((((((((((((((((((((((( Punti Reg Caricati )))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 Nota i valori vuoti & legittimi/default non sono visualizzati. [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Skype"="C:\Programmi\Skype\Phone\Skype.exe" [2007-09-13 13:31 22880040] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 13:00 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-12-01 00:05 4636672] "nwiz"="nwiz.exe" [2004-12-01 00:05 921600 C:\WINDOWS\system32\nwiz.exe] "IntelWireless"="C:\Programmi\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 15:59 385024] "Apoint"="C:\Programmi\Apoint\Apoint.exe" [2004-09-13 17:33 155648] "Client Access Service"="C:\Programmi\IBM\Client Access\cwbsvstr.exe" [2002-05-07 06:20 20530] "Client Access Help Update"="C:\Programmi\IBM\Client Access\cwbinhlp.exe" [2002-05-07 06:20 24626] "Client Access Check Version"="C:\Programmi\IBM\Client Access\cwbckver.exe" [2002-05-07 06:20 45056] "Client Access Express Welcome"="C:\Programmi\IBM\Client Access\cwbwlwiz.exe" [2002-05-07 06:20 20530] "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-10-08 12:52 221184] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 15:00 79224] "Google Desktop Search"="C:\Programmi\Google\Google Desktop Search\GoogleDesktop.exe" [2007-08-23 14:58 1838592] "Windows Defender"="C:\Programmi\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584] "Detect Kbd Daemon"="SK2000DM.EXE" [2001-03-12 20:50 29184 C:\WINDOWS\system32\SK2000DM.EXE] "PCSuiteTrayApplication"="C:\Programmi\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10 271360] "QuickTime Task"="C:\Programmi\QuickTime\qttask.exe" [2006-09-01 16:57 282624] "SunJavaUpdateSched"="C:\Programmi\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 03:42 144784] "THGuard"="C:\Programmi\TrojanHunter 5.0\THGuard.exe" [2007-09-09 09:31 1046688] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 13:00 15360] "Nokia.PCSync"="C:\Programmi\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17 1241088] "DWQueuedReporting"="C:\PROGRA~1\FILECO~1\MICROS~1\DW\dwtrig20.exe" [2006-11-13 19:54 34832] C:\Documents and Settings\Alessio Zanibelli\Menu Avvio\Programmi\Esecuzione automatica\ OpenOffice.org 2.3.lnk - C:\Programmi\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 22:57:56 393216] C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\ Bluetooth Manager.lnk - C:\Programmi\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2005-01-14 20:59:06 483328] Digital Line Detect.lnk - C:\Programmi\Digital Line Detect\DLG.exe [2005-05-21 00:37:02 24576] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= C:\Programmi\Qualcomm\Eudora\EuShlExt.dll [2006-08-17 15:57 86016] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless] C:\Programmi\Intel\Wireless\Bin\LgNotify.dll 2004-09-07 17:08 110592 C:\Programmi\Intel\Wireless\Bin\LgNotify.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL R1 LUMDriver;LUMDriver;C:\WINDOWS\system32\drivers\LUMDriver.sys [2003-07-11 15:22] R2 BBDemon;Backbone Service;"C:\Programmi\Dassault Systemes\B16\intel_a\code\bin\CATSysDemon.exe" [2005-09-06 23:11] R3 SKUSBKBF;USB Keyboard Filter Driver;C:\WINDOWS\system32\DRIVERS\SKUSBKBF.sys [2001-03-12 20:51] S3 AX88772;ASIX AX88772 USB2.0 to Fast Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\ax88772.sys [2004-12-03 04:04] S3 Cap7134;Cap7134 Capture;C:\WINDOWS\system32\DRIVERS\Cap7134.sys [2007-01-26 19:22] S3 p2pgasvc;Autenticazione gruppo rete peer;C:\WINDOWS\system32\svchost.exe [2004-08-19 13:00] S3 p2pimsvc;Gestione identità rete peer;C:\WINDOWS\system32\svchost.exe [2004-08-19 13:00] S3 p2psvc;Rete peer;C:\WINDOWS\system32\svchost.exe [2004-08-19 13:00] S3 PhTVTune;Cap7134 TVTuner;C:\WINDOWS\system32\DRIVERS\PhTVTune.sys [2007-01-26 19:22] S3 PNRPSvc;Peer Name Resolution Protocol (PNRP);C:\WINDOWS\system32\svchost.exe [2004-08-19 13:00] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc . Contenuto della cartella 'Scheduled Tasks' "2008-01-22 19:13:08 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Programmi\Apple Software Update\SoftwareUpdate.exe "2008-01-09 07:46:16 C:\WINDOWS\Tasks\jkevny.job" And this is a fresh Hijackthis log. Also Hijack reported an error before doing the scan and asked me to email the error to somebody... but when I closed the error window had no more the address: after posting this will try to reproduce the error and inform the "owner" Logfile of HijackThis v1.99.1 Scan saved at 18:16, on 2008-01-29 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Programmi\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\Programmi\Intel\Wireless\Bin\EvtEng.exe C:\Programmi\Intel\Wireless\Bin\S24EvMon.exe C:\Programmi\Intel\Wireless\Bin\WLKeeper.exe C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe C:\Programmi\Alwil Software\Avast4\ashServ.exe C:\Programmi\Intel\Wireless\Bin\ZcfgSvc.exe C:\WINDOWS\system32\spoolsv.exe c:\windows\system32\svchost.exe C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Programmi\Dassault Systemes\B16\intel_a\code\bin\CATSysDemon.exe C:\Programmi\File comuni\LightScribe\LSSrvc.exe C:\Programmi\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\WINDOWS\system32\nvsvc32.exe C:\Programmi\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\tcpsvcs.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Programmi\Intel\Wireless\Bin\ifrmewrk.exe C:\Programmi\Apoint\Apoint.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Programmi\Windows Defender\MSASCui.exe C:\Programmi\Apoint\Apntex.exe C:\Programmi\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\WINDOWS\system32\Sktempdm.exe C:\Programmi\Java\jre1.6.0_04\bin\jusched.exe C:\WINDOWS\system32\Skdaemon.exe C:\Programmi\TrojanHunter 5.0\THGuard.exe C:\Programmi\PC Connectivity Solution\ServiceLayer.exe C:\WINDOWS\system32\ctfmon.exe C:\Programmi\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe C:\Programmi\Digital Line Detect\DLG.exe C:\Programmi\OpenOffice.org 2.3\program\soffice.exe C:\Programmi\OpenOffice.org 2.3\program\soffice.BIN C:\Programmi\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe C:\Programmi\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe C:\Programmi\Alwil Software\Avast4\ashWebSv.exe C:\Documents and Settings\Alessio Zanibelli\Documenti\Old PC\Scaricati da Internet\Software Downloads\Antivirus e firewall\Hijack this\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti O2 - BHO: (no name) - {259F616C-A300-44F5-B04A-ED001A26C85C} - (no file) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_04\bin\ssv.dll O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file) O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet O4 - HKLM\..\Run: [IntelWireless] C:\Programmi\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [Apoint] C:\Programmi\Apoint\Apoint.exe O4 - HKLM\..\Run: [Client Access Service] "C:\Programmi\IBM\Client Access\cwbsvstr.exe" O4 - HKLM\..\Run: [Client Access Help Update] "C:\Programmi\IBM\Client Access\cwbinhlp.exe" O4 - HKLM\..\Run: [Client Access Check Version] "C:\Programmi\IBM\Client Access\cwbckver.exe" LOGIN O4 - HKLM\..\Run: [Client Access Express Welcome] "C:\Programmi\IBM\Client Access\cwbwlwiz.exe" O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Google Desktop Search] "C:\Programmi\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [Windows Defender] "C:\Programmi\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [Detect Kbd Daemon] SK2000DM.EXE O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Programmi\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_04\bin\jusched.exe" O4 - HKLM\..\Run: [THGuard] "C:\Programmi\TrojanHunter 5.0\THGuard.exe" O4 - HKCU\..\Run: [Skype] "C:\Programmi\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Startup: OpenOffice.org 2.3.lnk = C:\Programmi\OpenOffice.org 2.3\program\quickstart.exe O4 - Global Startup: Bluetooth Manager.lnk = ? O4 - Global Startup: Digital Line Detect.lnk = ? O8 - Extra context menu item: &Search - http://kn.bar.need2find.com/KN/menusearch.html?p=KN O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_04\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_04\bin\ssv.dll O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O12 - Plugin for .csm: C:\Programmi\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .csml: C:\Programmi\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .cub: C:\Programmi\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .cube: C:\Programmi\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .dx: C:\Programmi\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .emb: C:\Programmi\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .embl: C:\Programmi\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .gau: C:\Programmi\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .jdx: C:\Programmi\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .mol: C:\Programmi\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .mop: C:\Programmi\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .pdb: C:\Programmi\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .rxn: C:\Programmi\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .scr: C:\Programmi\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .skc: C:\Programmi\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .spt: C:\Programmi\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .tgf: C:\Programmi\Internet Explorer\Plugins\npchime.dll O12 - Plugin for .xyz: C:\Programmi\Internet Explorer\Plugins\npchime.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) - O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://C:\Programmi\AutoCAD 2002\InstBanr.ocx O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - http://locator1.cdn.imagesrvr.com/si...Install_it.cab O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file://C:\Programmi\AutoCAD 2002\InstFred.ocx O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} - file://C:\Programmi\AutoCAD 2002\AcPreview.ocx O17 - HKLM\System\CCS\Services\Tcpip\..\{22C1497E-DFE3-44E6-9300-E3C8BEEA8A53}: NameServer = 213.140.2.12,213.140.2.21 O17 - HKLM\System\CCS\Services\Tcpip\..\{E91340B6-0763-419C-8972-99E1AB391528}: NameServer = 213.140.2.12,213.140.2.21 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL O20 - Winlogon Notify: IntelWireless - C:\Programmi\Intel\Wireless\Bin\LgNotify.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Programmi\File comuni\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Backbone Service (BBDemon) - Unknown owner - C:\Programmi\Dassault Systemes\B16\intel_a\code\bin\CATSysDemon.exe" -service (file missing) O23 - Service: Comando remoto iSeries Access per Windows (Cwbrxd) - IBM Corporation - C:\WINDOWS\CWBRXD.EXE O23 - Service: Diskeeper - Diskeeper Corporation - C:\Programmi\Diskeeper Corporation\Diskeeper\DkService.exe O23 - Service: EvtEng - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\EvtEng.exe O23 - Service: GoogleDesktopManager - Google - C:\Programmi\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe O23 - Service: NBService - Nero AG - C:\Programmi\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Programmi\Dell\NICCONFIGSVC\NICCONFIGSVC.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: RegSrvc - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: ServiceLayer - Nokia. - C:\Programmi\PC Connectivity Solution\ServiceLayer.exe O23 - Service: WLANKEEPER - Intel® Corporation - C:\Programmi\Intel\Wireless\Bin\WLKeeper.exe Bye and thankyou again!!