Newsgroup: it.comp.sicurezza.windows
Titolo: Trojan.Win32.Rootkit.E

Da un paio di giorni ho rilevato problemi al pc ke risultano
coincidere con i problemi procurati dal trojan Trojan.Win32.Rootkit.E
Logfile of HijackThis v1.99.0
Scan saved at 21.51.30, on 05/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\REGSHAVE\bak\REGSHAVE.EXE
C:\Programmi\LG PC Suite\LG PC Sync\LGSyncManager.exe
C:\Programmi\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exe
C:\Programmi\Mustek 1200 UB Plus\Driver\WATCH.exe
C:\Programmi\WinZip\WZQKPICK.EXE
C:\Programmi\iPod\bin\iPodService.exe
C:\Programmi\MSN Messenger\msnmsgr.exe
C:\Programmi\MSN Messenger\usnsvc.exe
C:\Programmi\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Programmi\MSN Messenger\livecall.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Dadde\Impostazioni
locali\Temp\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://hp.rossoalice.alice.it/
R0 - HKCU\Software\Microsoft\Internet
Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Yahoo! Toolbar Helper -
{02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class -
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -
C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} -
(no file)
O2 - BHO: Windows Live Sign-in Helper -
{9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File
comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper -
{AA58ED58-01DD-4d91-8333-CF10577473F7} -
c:\programmi\google\googletoolbar3.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} -
c:\programmi\google\googletoolbar3.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [REGSHAVE] C:\Programmi\REGSHAVE\REGSHAVE.EXE
/AUTORUN
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [outlook] C:\Programmi\outlook\outlook.exe /auto
O4 - HKLM\..\Run: [winlog] winlog.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File
comuni\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task]
"C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper]
"C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\RunServices: [winlog] winlog.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe"
/background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot -
Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [swg]
C:\Programmi\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = ?
O4 - Global Startup: Corel Family & Friends Reminders.LNK =
C:\cffrem.exe
O4 - Global Startup: LG SyncManager.lnk = C:\Programmi\LG PC
Suite\LG PC Sync\LGSyncManager.exe
O4 - Global Startup: Microsoft Office.lnk =
C:\Programmi\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Ulead Photo Express SE Calendar Checker.lnk
= C:\Programmi\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exe
O4 - Global Startup: Watch.lnk = C:\Programmi\Mustek 1200 UB
Plus\Driver\WATCH.exe
O4 - Global Startup: WinZip Quick Pick.lnk =
C:\Programmi\WinZip\WZQKPICK.EXE
O9 - Extra button: Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers
Class) - 
http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows
Genuine Advantage Validation Tool) -
http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo
Upload Tool) -
http://thedhreign.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX
Class) - 
http://simcity.ea.com/update/EARTPX.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl
Class) - 
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan
Installer Class) -
http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - 
O16 - DPF: {BF985246-09BF-11D2-BE62-006097DF57F6} - 
O16 - DPF: {C36661D7-3590-45B1-80B5-520839E94DAD} - 
O17 -
HKLM\System\CCS\Services\Tcpip\..\{D7201422-19AE-44D9-B11C-500038B4EC4A}:
NameServer = 85.37.17.8 85.38.28.73
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F}
- C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} -
C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj -
{AAA288BA-9A4C-45B0-95D7-94D524869DB5} -
C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: 
ASP.NET
 State Service - Unknown -
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
(file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. -
C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Updater Service - Google -
C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager - Macrovision
Corporation - C:\Programmi\File
comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Servizio iPod - Apple Inc. -
C:\Programmi\iPod\bin\iPodService.exe
Vi prego se potete, AIUTATEMI!!!!
-- 
Postato da Alice Newsgroup: lo usi da web ma con le funzioni del newsreader 
http://newsgroup.alice.it
Gerarchie it, italia, it-alt, tin, it.binari. Unico!

*Davide Guglielmini* bifonchio':
|> Da un paio di giorni ho rilevato problemi al pc ke risultano
|> coincidere con i problemi procurati dal trojan Trojan.Win32.Rootkit.E
[...]
|> {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
Io cancellerei
|> O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} -
|> (no file)
Stessa sorte
|> O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
|> O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File
|> comuni\Real\Update_OB\realsched.exe"  -osboot
|> O4 - HKLM\..\Run: [QuickTime Task]
|> "C:\Programmi\QuickTime\qttask.exe" -atboottime
|> O4 - HKLM\..\Run: [iTunesHelper]
|> "C:\Programmi\iTunes\iTunesHelper.exe"
Roba inutile in avvio automatico, IMO
|> Vi prego se potete, AIUTATEMI!!!!
Prova a cancellare il suggerito e magari volendo, senti altre campane.
ciao
-- 
Lo Zio Fizzy ©
       /)/)
     (  '.')
   o(_('')('')

 Logfile of HijackThis v1.99.0
Quasi del tutto inutile.
Con hijackthis non te ne liberi.
http://blogs.dotnethell.it/vincent/Info-Alert-Trojan-Linkoptimizer-and-Gromozon__6384.aspx
-- 
           |Save our planet!
    Ciao   |Save wildlife!
   roberto |For your E-MAIL use ONLY recycled Bytes  !!
           |roberto poggi   
rpo...@softhome.net

 Vi prego se potete, AIUTATEMI!!!!
http://free.grisoft.com/doc/avg-anti-rootkit-free/lng/us/tpl/v5
-- 
Andrea
- - - - - - - - - - - - - - - - - - - - - - - - -
www.yogajap.com
 * 
www.italiatibet.org