Newsgroup: it.comp.sicurezza.windows
Titolo: Come rimuovere here4search.com win-eto.com

Mi hanno detto che serve il log di questo programma HijackThis e ve l'ho
postato, poi che devo fare?
Logfile of HijackThis v1.99.0
Scan saved at 9.32.12, on 09/01/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\mqsvc.exe
C:\WINDOWS\System32\mqtgsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programmi\QuickTime\qttask.exe
C:\Programmi\Java\j2re1.4.2_03\bin\jusched.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ohjjihoxyjd0lthd.exe
C:\Programmi\Messenger\MSMSGS.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\LG PC Suite\LG PC Sync\LGSyncManager.exe
C:\Programmi\Outlook Express\msimn.exe
C:\Programmi\OE-QuoteFix\oequotefix.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\WinRAR\WinRAR.exe
C:\Documents and Settings\Casa\Desktop\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL =
http://win-eto.com/sp.htm?id=31130
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://win-eto.com/sp.htm?id=31130
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
http://win-eto.com/hp.htm?id=31130
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://win-eto.com/hp.htm?id=31130
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://gw.aliceadsl.it/home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://win-eto.com/hp.htm?id=31130
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title =
Microsoft Internet Explorer fornito da Alice
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings,ProxyOverride = 127.0.0.1;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} -
(no file)
O2 - BHO: (no name) - {467FAEB2-5F5B-4c81-BAE0-2A4752CA7F4E} -
C:\WINDOWS\system32\75IU8H~1.DLL
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE
C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Openwares LiveUpdate] C:\Program
Files\LiveUpdate\LiveUpdate.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe"
-atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched]
C:\Programmi\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File
comuni\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program
Files\webHancer\Programs\whSurvey.exe"
O4 - HKLM\..\Run: [Control handler]
C:\WINDOWS\system32\ohjjihoxyjd0lthd.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\MSMSGS.EXE"
/background
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE
C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: LG SyncManager.lnk = ?
O8 - Extra context menu item: Download all by Free Download Manager -
file://C:\Programmi\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download by Free Download Manager -
file://C:\Programmi\Free Download Manager\dllink.htm
O8 - Extra context menu item: Download selected by Free Download Manager
- file://C:\Programmi\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download web site by Free Download Manager
- file://C:\Programmi\Free Download Manager\dlpage.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Yahoo! Messenger -
{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} -
C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger -
{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} -
C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Programmi\Messenger\msmsgs.exe
O9 - Extra button: Alice - {7D86027B-F5A1-4D33-BC25-0B9AEAB6C4A3} -
http://gw.aliceadsl.it/alice
 (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=
http://gw.aliceadsl.it/home
O15 - Trusted Zone: *.
greg-search.com
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} -
http://sib1.od2.com/common/Member/ClientInstall/10.20.0002/OCI/setup.exe
O17 -
HKLM\System\CCS\Services\Tcpip\..\{B78787CC-113A-4329-9546-09521822BB97}:
NameServer = 212.216.112.112,212.216.172.62
O20 - AppInit_DLLs: isgipkp5uxmcvddll.dll.dll.dll.dll.dll
O23 - Service: LexBce Server - Lexmark International, Inc. -
C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation -
C:\WINDOWS\System32\nvsvc32.exe
-- 
Posted via Mailgate.ORG Server - 
http://www.Mailgate.ORG

 Scan saved at 9.32.12, on 09/01/2005
[...]
No dai, piazzare un log di HJT in questo modo IMHO non ha significato.
Mica per qualcosa, sono i modi e le operazioni preliminari che contano alla
grande in caso di infezione. E tu non ne parli.
Segui per bene qui: 
http://snipurl.com/MS_Technet_Spy
Usa anche CWShredder ultima release (non è indicata nell'articolo):
http://www.intermute.com/spysubtract/cwshredder_download.html
Poi se hai ancora problemi fatti risentire ;-)
--
Vincenzo Di Russo
Microsoft® MVP - Windows - Internet Explorer/OE
http://support.microsoft.com/newsgroups
http://mvp.support.microsoft.com/

 l'ho postato, poi che devo fare?
E' un superspider.
Comincia a leggere qui. Magari qualcuno vuol farti un riassunto in italiano. 
:-p
SuperSpider
Parasites
more unsolicited commercial software
Description
SuperSpider is a family of browser hijacker trojans aimed at sites 
affiliated to 
super-spider.com
, itself affiliated to CoolWebSearch.
SuperSpider consists of an Internet Explorer Browser Helper Object (BHO), 
loaded with Internet Explorer and the normal Windows explorer.exe shell, and 
a process (EXE) set to run at Windows startup which protects the software 
from removal.
Variants
SuperSpider/Pre: may include only the randomly-named BHO, no additional 
process. Not widely distributed; may be a prototype.
SuperSpider/Jopa: hijacks to 
solongas.com
 or 69.31.79.180. Process filename 
is always sysstartup.exe; the BHO (if present) is randomly-named and has a 
new class ID.
SuperSpider/Romahere: hijacks to 
super-spider.com
. Process filename is 
matrixhere.exe; the BHO has a new class ID.
SuperSpider/Romahere2: hijacks to windowws.cc. Process and BHO filenames are 
now both random.
SuperSpider/Romahere3: hijacks to 
win-eto.com
 (which then redirects to 
another site such as 
kitasearch.com
 or 
t.swapx.cc
). Two different processes 
are run at startup, both with random filenames. There is also a .tmp file 
held open in the Temp folder with a six-digit random name containing a 
backup . Only installed on Windows 95/98/Me; if the installer is run on 
NT-based Windows versions, SuperSpider/App will be installed instead.
SuperSpider/App: hijacks to 
win-eto.com
 (which then redirects to another 
site such as 
kitasearch.com
 or 
t.swapx.cc
). As well as the startup process, 
installs an AppInit_DLL which run with every Windows application, making 
removal trickier. Two .bak files are added to contain backup copies of the 
software, as well as the six-digit .tmp file in the Temp folder. Only 
installed on Windows NT/2000/XP/2003; if the installer is run on Win9X, 
SuperSpider/Romahere3 will be installed instead.
Also known as
Melkosoft Cassandra, after the company and product name given by the files. 
Greg-Search after a distributing domain. DNSErrObj, after the BHO class 
name.
Detected by some anti-parasite tools generically as a CoolWebSearch variant. 
Detected by some anti-virus software generically as a trojan, for example 
Troj.Krepper or Troj.Small.
Distribution
Installed by a range of Internet Explorer security exploits typical of the 
CoolWebSearch family of parasites, served from 
greg-search.com
, 
greg-tut.com
 
and 
t34rulit.com
, from around May 2004.
What it does
Advertising
Yes. The BHO monitors URLs for targeted sites, mostly porn-related or other 
junk-portals, and opens pop-ups from 66.250.130.200.
It can also open untargeted pop-ups as directed by its controlling servers 
t34rulit.com
, 
cc20foreva.com
 and 
mig29here.com
, as well as adding bookmarks 
and changing the home, search and error page hijacks and adding Hosts file 
hijacks.
Privacy violation
No.
Security issues
Yes. The controlling servers can also direct the software to downloade and 
execute arbitrary unsigned code. The controlling servers and 
thestas.com
 
have been used to serve the downloaded software. Additionally the software 
can delete registry keys and file, which seems to be used to sabotage rival 
parasites. The file-deletion function actually creates dummy files with the 
targeted filenames, leaving the filesystem rather cluttered with hidden 
zero-byte files.
As the software updates itself, the System32 and Temp folders will fill up 
with more and more backup copies of the software, including, in the App 
variant a small temporary DLL whose name (due to a bug?) gains more and more 
copies of the file extension '.dll'.
One of the programs run by the downloader adds 
greg-search.com
 to Internet 
Explorer's Trusted Sites zone, allowing the site to install arbitrary code. 
It then opens a pop-up that uses this to install ISTbar/XXXToolbar and 
/SideFind (which in turn installs many further parasites).
Stability problems
None known.
Removal
All variants
Open the registry (click 'Start', choose 'Run', enter 'regedit') and select 
the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. 
There should be an entry on the right called 'jopa' pointing to 
sysstartup.exe (Jopa variant), 'romahere' pointing to matrixhere.exe 
(Romahere variant) or 'Control handler' pointing to a randomly-named process 
(Romahere3, App variants). If so, Open the Task Manager (press 
ctrl-alt-delete), find the process of this name in Processes list and End 
it. Then delete the entry in the Run key.
Select the key 
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. There 
should be an entry on the right called 'jopa' pointing to sysstartup.exe 
(Jopa variant), 'romahere' pointing to matrixhere.exe (Romahere variant) or 
'romahere2' or 'romahere3' pointing to a randomly-named process (Romahere2, 
Romahere3 variants). If so, Open the Task Manager (press ctrl-alt-delete), 
find the process of this name in Processes list and End it. Then delete the 
entry in the Run key.
Next, open the registry key 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer, and 
delete the entire 'Cassandra' subkey inside that. Then open the subkey 
'Browser Helper Objects' and delete the subkey 
'{0388EC16-BA98-416f-9D9B-B9A031E427AF}' (Pre variant), 
'{A9A674BF-771F-42E5-A440-D20DDA85A862}' (Jopa variant) or 
'{467FAEB2-5F5B-4c81-BAE0-2A4752CA7F4E}' (other variants).
App variant
Now select the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows 
NT\CurrentVersion\Windows. On the right, you should see an 'AppInit_DLLs' 
entry holding another random filename. Open the System32 folder (inside the 
Windows folder) and find this file, then rename it (for example, add 
'.delete' to the end of the filename).
All variants
Restart the computer and you should be able to delete the files from the 
System. Apart from the few fixed filenames mentioned, SuperSpider normally 
uses random names 10-20 characters long. The easiest way to find them is to 
open the System folder (inside the Windows folder; called 'System' on 
Windows 95/98/Me and 'System32' on Windows NT/2000/XP/2003), and use the 
option 'View->Arrange Icons By->Modified' so that you can group the newest 
files together.
Usually the long random names are quite obvious, but if you're unsure, 
right-click the suspect file and choose 'Properties'. There should be a 
'Version' tab, on which choosing 'Company' will give the name 'Melkosoft 
Corporation', for files belonging to SuperSpider.
You can also delete the six-number .TMP files from the Temp folder to clean 
up (in general, it is a good idea to keep the Temp folder empty in any 
case). You can find the Temp folder inside 'Local Settings' in the folder 
named after your username, inside 'Documents and Settings', or, under 
Windows NT, in the Profiles folder inside Windows. The Local Settings folder 
is hidden, so make sure Windows is showing hidden files, from Tools->Folder 
Options->View->Show hidden files and folders.
For the App variant, you should also delete the AppInit_DLLs registry entry 
detailed above. You can also delete the registry key 
HKEY_LOCAL_MACHINE\SOFTWARE\Melcosoft to clean up, and, for the Romahere2, 
Romahere3 and App variants the following BHO keys:
HKEY_CLASSES_ROOT\CLSID\{467FAEB2-5F5B-4c81-BAE0-2A4752CA7F4E}
HKEY_CLASSES_ROOT\TypeLib\{444A5674-FF85-45D4-9AE2-4199D8D70C85}
HKEY_CLASSES_ROOT\Interface\{0D721150-AEF3-457B-B03A-5097B623CE45}
HKEY_CLASSES_ROOT\Plugin6.DNSErrObj
HKEY_CLASSES_ROOT\Plugin6.DNSErrObj.1
Finally, open Internet Options and use the 'Reset Web Settings' button on 
the 'Programs' tab to remove the hijacked homepage and search settings. Go 
to the Security tab, select 'Trusted Sites' and click 'Zones...'. If 
greg-search.com
 is listed here, remove it. (Some CoolWebSearch exploits may 
put other questionable domains here too; feel free to remove these too if 
you find them.) If you normally turn the Advanced option 'Enable third-party 
browser extensions' off, you'll have to set it back again, as SuperSpider 
turns it back on so its BHO is unimpeded.
-- 
Nico
"Haec immatura a me iam frustra leguntur oy"
[HT] Sporting Bojano (51842) in IV.59
http://sportingbojano.altervista.org
 

 No dai, piazzare un log di HJT in questo modo IMHO non ha significato.
Beh, al volo, questo ohi-ohi-ohi non è che mi piaccia molto :-)
C:\WINDOWS\system32\ohjjihoxyjd0lthd.exe
O4 - HKLM\..\Run: [Control handler]
C:\WINDOWS\system32\ohjjihoxyjd0lthd.exe
e direi che fa parte di coolwebsearch
-- 
Bye by V.

 e direi che fa parte di coolwebsearch
Ehm, appunto. Il mio intento era proprio quello di rivedere il nostro amico
dopo il lancio (e la possibile positiva pulizia) di CWShredder.
*ohjjihoxyjd0lthd.exe* ? Cos'ha che non ti piace? :-D
Ciao ;-)


 *ohjjihoxyjd0lthd.exe* ? Cos'ha che non ti piace? :-D
Ha i capelli troppo lunghi, dovrebbe andare dal barbiere, fa cosě
sciattone messo in quel modo... 
-- 
Bye by V.(ipera e it.comp.portineria)

 
http://www.intermute.com/spysubtract/cwshredder_download.html
Ci ho messo una giornata, ma ho letto tutto, istallato tutto e fatto
tutto il virus si è levato, ma ora non stampa, ho messo un altro
messaggio per chiedere spiegazioni perché l'argomento è cambiato. Se per
piacere potete leggerlo... Grazie.
