Virus o danni al registro?

Help!
Sto lottando da due giorni contro un pc che: non si coonnette ad internet; non consente l'installazione di patch; non apre msconfig; non apre task manager; non avvia Zone Alarm.
Funziona perfettamente per tutto il resto (programmi e giochi).
Ho provato chkdsk /p /r da consolle: niente.
Ho provato sfc /scannow: niente!
Ho provato la scansione con l'ultimo stinger, Avg7, trend micro... Niente!
Ho reinstallato Xp senza formattare: niente!
Ho provato a dividere l'hard disk in due partizioni per salvare i dati: PM7 dà un errore e si riavvia...
Devo proprio formattare?

[Thor]

hai provato, per internet, con Winsockfix?
http://www.spychecker.com/program/winsockxpfix.html

No, non ho neanche provato, pechè dovrei rifare la connessione (mi è stato portato), ma non escludo di farlo per provare le scansioni online. AVG, per la verità, mi segnala un trojan, msdirectx.sys che si trova della cartella utente: ogni volta che lo cancello si ricrea.

[TomasMilian]

Perchè non fai una scansione del pc con Hijackthis e ci posti il log?
Così possiamo vedere bene cosa c'è da eliminare.
E' molto probabile che i tuoi problemi siano dovuti a porcherie presenti nel tuo pc.

Originariamente inviato da TomasMilian
Perchè non fai una scansione del pc con Hijackthis e ci posti il log?
Così possiamo vedere bene cosa c'è da eliminare.
E' molto probabile che i tuoi problemi siano dovuti a porcherie presenti nel tuo pc.

Hai letto proprio tutto? Non è mio, il pc...
HijackThis me lo ha fatto installare, ma non me lo fa usare...

Però adesso si connette, e sembra funzionare anche ZoneAlarm.
La scansione online di Panda è quasi terminata, senza esito.

Funziona tutto... Ma è impedito l'accesso a: Regedit, msconfig e task manager. Appaiono per un attimo e poi spariscono. Lo stesso avviene per la scansione dei singoli file con AVG.

Originariamente inviato da Eccomi
Però adesso si connette, e sembra funzionare anche ZoneAlarm.
La scansione online di Panda è quasi terminata, senza esito.

Trovato e ripulito: Virus:W32/Gaobot.GJJ.worm

[Lionsquid]

e se entri in modalità provvisoria , regedit & co funzionano???

ci sono task attivi strani?? us aproceXP per visualizzare tutti i processi e anche la loro posizione di esecuzione...

Ottimo, Lion!
Ma sembra che sia tutto regolare... Tutt'alpiù manca qualcosa... Ma cosa?

Il log:

Process PID CPU Description Company Name
System Idle Process 0 93.33
Interrupts n/a Hardware Interrupts
DPCs n/a Deferred Procedure Calls
System 4
smss.exe 452 Windows NT Session Manager Microsoft Corporation
csrss.exe 516 Client Server Runtime Process Microsoft Corporation
winlogon.exe 540 Applicazione Accesso a Windows NT Microsoft Corporation
services.exe 584 0.95 Applicazione Servizi e Controller Microsoft Corporation
svchost.exe 764 Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 780 Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 844 Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 904 Generic Host Process for Win32 Services Microsoft Corporation
spoolsv.exe 1016 Spooler SubSystem App Microsoft Corporation
avgamsvr.exe 148 AVG Alert Manager GRISOFT, s.r.o.
avgupsvc.exe 172 AVG Update Service GRISOFT, s.r.o.
svchost.exe 264 Generic Host Process for Win32 Services Microsoft Corporation
locator.exe 1848 Rpc Locator Microsoft Corporation
lsass.exe 596 0.95 LSA Shell (Export Version) Microsoft Corporation
explorer.exe 1228 Esplora risorse Microsoft Corporation
winDLL32.exe 1556 0.95
avgcc.exe 1564 AVG Control Center GRISOFT, s.r.o.
zlclient.exe 1572 Zone Labs Client Zone Labs, LLC
vsmon.exe 1648 TrueVector Service Zone Labs, LLC
iexplore.exe 1868 Internet Explorer Microsoft Corporation
iexplore.exe 396 Internet Explorer Microsoft Corporation
iexplore.exe 3920 Internet Explorer Microsoft Corporation
WINZIP32.EXE 2080 WinZip WinZip Computing, Inc.
procexp.exe 2508 3.81 Sysinternals Process Explorer Sysinternals

Process: explorer.exe Pid: 1228

[Lionsquid]

aspetta che consulto la mia sfera di cristallo ....








ma metti uno shot!!

(non ho capito però se hai il pc a portata di mano... o no)

[Lionsquid]

http://securityresponse.symantec.com...glieder.l.html

hai un bel virus nella winDLL32.exe 1556 0.95

dovrai fare una scansione con scangui e l'ultimo sdat da modalità provvisoria... o ancora meglio a riga di comando usando gli switch al posto dello scangui

Un momento! Pant, pant...

Type Name
Desktop \Default
Directory \Windows
Directory \BaseNamedObjects
Directory \KnownDlls
Event \BaseNamedObjects\userenv: User Profile setup event
Event \BaseNamedObjects\ShellReadyEvent
Event \BaseNamedObjects\crypt32LogoffEvent
Event \BaseNamedObjects\mixercallback
Event \BaseNamedObjects\HPlugEjectEvent
Event \BaseNamedObjects\hardwaremixercallback
File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1643_x-ww_7c3a9bc6
File C:\Documents and Settings\Oro\Desktop
File C:\Documents and Settings\All Users\Desktop
File C:\Documents and Settings\Oro\Impostazioni locali\Dati applicazioni\Microsoft\Masterizzazione CD
File C:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1643_x-ww_7c3a9bc6
File \Device\Tcp
File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1643_x-ww_7c3a9bc6
File \Device\Tcp
File \Device\Ip
File \Device\Ip
File \Device\Ip
File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1643_x-ww_7c3a9bc6
File \Device\NamedPipe\ntsvcs
File C:\Documents and Settings\Oro\Menu Avvio\Programmi
File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1643_x-ww_7c3a9bc6
File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1643_x-ww_7c3a9bc6
File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1643_x-ww_7c3a9bc6
File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1643_x-ww_7c3a9bc6
File C:\Documents and Settings\Oro\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat
File C:\Documents and Settings\Oro\Cookies\index.dat
File C:\Documents and Settings\Oro\Impostazioni locali\Cronologia\History.IE5\index.dat
File \Device\KSENUM#00000008\{9B365890-165F-11D0-A195-0020AFD156E4}
File C:\Documents and Settings\Oro\Dati applicazioni\Microsoft\Internet Explorer\Quick Launch
File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1643_x-ww_7c3a9bc6
File \Device\Tcp
File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1643_x-ww_7c3a9bc6
File \Device\WMIDataDevice
File C:\Documents and Settings\Oro\Risorse di stampa
File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1643_x-ww_7c3a9bc6
File C:\Documents and Settings\Oro\Impostazioni locali\Cronologia\History.IE5\MSHist01200505222005 0523\index.dat
File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1643_x-ww_7c3a9bc6
File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1643_x-ww_7c3a9bc6
File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1643_x-ww_7c3a9bc6
File C:\Documents and Settings\Oro\Impostazioni locali\Cronologia
File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1643_x-ww_7c3a9bc6
File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1643_x-ww_7c3a9bc6
File \Device\NamedPipe\ROUTER
File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1643_x-ww_7c3a9bc6
File C:\Documents and Settings\All Users\Menu Avvio\Programmi
File C:\Documents and Settings\All Users\Menu Avvio
File \Device\KsecDD
File \Device\Harddisk1\DP(1)0-0+3\
File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.2600.1360_x-ww_24a2ed47
File C:\Documents and Settings\Oro\Preferiti
File C:\Documents and Settings\Oro\Menu Avvio
File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1643_x-ww_7c3a9bc6
File C:\Documents and Settings\Oro\Preferiti\Collegamenti
File C:\Documents and Settings\Oro
File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1643_x-ww_7c3a9bc6
Key HKCU\Software\Microsoft\Plus!\Themes\Apply
Key HKCU\Software\Microsoft\Internet Explorer\Security\P3Global
Key HKCU\Software\Microsoft\Internet Explorer\Security\P3Sites
Key HKCU\Software\Microsoft\Internet Explorer\Security\P3Global
Key HKCR\HTTP\shell
Key HKCU\Software\Microsoft\Internet Explorer\Security\P3Sites
Key HKCU\Software\Microsoft\Windows\ShellNoRoam
Key HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICac he
Key HKLM
Key HKCU\Software\Microsoft\Windows\CurrentVersion\Exp lorer\FileExts
Key HKCU\Software\Microsoft\Windows\Shell
Key HKU
Key HKCR\CLSID
Key HKLM\SYSTEM\ControlSet003\Services\Tcpip\Linkage
Key HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameter s
Key HKLM\SYSTEM\ControlSet003\Services\NetBT\Parameter s\Interfaces
Key HKLM\SYSTEM\ControlSet003\Services\NetBT\Parameter s
Key HKCU\Software\Microsoft\Windows\CurrentVersion\Exp lorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count
Key

Finale...

HKCU\Software\Microsoft\Windows\CurrentVersion\Exp lorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count
Key HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings
Key HKCU\Software\Microsoft\Internet Explorer\Security\P3Global
Key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32
Key HKCU
Key HKCU\Software\Classes
Key HKLM\SYSTEM\ControlSet003\Control\NetworkProvider\ HwOrder
Key HKCU\Software\Microsoft\Internet Explorer\Security\P3Global
Key HKCR
Key HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings\ZoneMap
Key HKCU\Software\Microsoft\Internet Explorer\Security\P3Sites
Key HKCU\Software\Microsoft\Internet Explorer\Security\P3Sites
Key HKCU\Software\Microsoft\Windows\CurrentVersion\Exp lorer\RunMRU
Key HKLM\SYSTEM\Setup
Key HKCU\Software\Microsoft\Windows\CurrentVersion\Exp lorer
Key HKLM\SOFTWARE\Microsoft\Tracing\RASDLG
Key HKLM\SOFTWARE\Microsoft\Windows\Shell
Key HKCU\Software\Microsoft\Windows\ShellNoRoam\DUIBag s\ShellFolders\{21EC2020-3AEA-1069-A2DD-08002B30309D}
Key HKLM\SYSTEM\ControlSet003\Services\WinSock2\Parame ters\Protocol_Catalog9
Key HKLM\SYSTEM\ControlSet003\Services\WinSock2\Parame ters\NameSpace_Catalog5
Key HKCU\Software\Microsoft\Internet Explorer\Security\P3Global
Key HKLM\SOFTWARE\Microsoft\Tracing\RASAPI32
Key HKCU\Software\Microsoft\Windows\ShellNoRoam\Bags\5 0\Shell
Key HKCU\Software\Microsoft\Internet Explorer\TypedURLs
Key HKCU\Software\Microsoft\Internet Explorer\Security\P3Global
Key HKCU\Software\Microsoft\Windows\CurrentVersion\Exp lorer\MenuOrder\Start Menu2\Programs
Key HKCU\Software\Microsoft\Internet Explorer\Security\P3Sites
Key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Exp lorer
Key HKCU\Software\Microsoft\Internet Explorer\Security\P3Global
Key HKCU\Software\Microsoft\Internet Explorer\Security\P3Global
Key HKCU\Software\Microsoft\Internet Explorer\Security\P3Global
Key HKCU\Software\Microsoft\Internet Explorer\Security\P3Sites
Key HKCR
Key HKCU\Software\Microsoft\Internet Explorer\Security\P3Sites
Key HKCU\Software\Microsoft\Internet Explorer\Security\P3Global
Key HKCU\Software\Microsoft\Internet Explorer\Security\P3Sites
Key HKCU\Software\Microsoft\Internet Explorer\Security\P3Sites
Key HKLM\SOFTWARE\Microsoft\COM3
Key HKCU\Software\Microsoft\Windows NT\CurrentVersion\Extensions
Key HKCU\Software\Microsoft\Internet Explorer\Security\P3Sites
Key HKCU\Software\Microsoft\Internet Explorer\Security\P3Global
Key HKU
Key HKCU\Software\Microsoft\Windows\CurrentVersion\Exp lorer\RunMRU
Key HKCU\Software\Microsoft\Internet Explorer\Security\P3Sites
Key HKCR
Key HKU
Key HKLM\SOFTWARE\Microsoft\COM3
Key HKLM\SOFTWARE\Microsoft\COM3
Key HKCR\CLSID
Key HKCR
Key HKLM\SOFTWARE\Microsoft\COM3
Key HKU
Key HKLM\SOFTWARE\Microsoft\COM3
Key HKLM\SOFTWARE\Microsoft\COM3
Key HKCR\CLSID
Key HKCU\Software\Microsoft\Windows\CurrentVersion\Exp lorer
KeyedEvent \KernelObjects\CritSecOutOfMemoryEvent
Mutant \BaseNamedObjects\c:!documents and settings!utente!impostazioni locali!cronologia!history.ie5!mshist01200505222005 0523!
Mutant \BaseNamedObjects\WininetConnectionMutex
Mutant \BaseNamedObjects\_!MSFTHISTORY!_
Mutant \BaseNamedObjects\_SHuassist.mtx
Mutant \BaseNamedObjects\c:!documents and settings!utente!impostazioni locali!temporary internet files!content.ie5!
Mutant \BaseNamedObjects\ZonesCacheCounterMutex
Mutant \BaseNamedObjects\ZonesCounterMutex
Mutant \BaseNamedObjects\c:!documents and settings!utente!cookies!
Mutant \BaseNamedObjects\c:!documents and settings!utente!impostazioni locali!cronologia!history.ie5!
Mutant \BaseNamedObjects\MidiMapper_Configure
Mutant \BaseNamedObjects\MidiMapper_modLongMessage_RefCnt
Mutant \BaseNamedObjects\RasPbFile
Mutant \BaseNamedObjects\RasPbFile
Mutant \BaseNamedObjects\WininetProxyRegistryMutex
Mutant \BaseNamedObjects\WininetStartupMutex
Mutant \BaseNamedObjects\ExplorerIsShellMutex
Mutant \BaseNamedObjects\ShimCacheMutex
Mutant \BaseNamedObjects\_!SHMSFTHISTORY!_
Port \RPC Control\OLE4
Section \BaseNamedObjects\C:_Documents and Settings_Utente_Impostazioni locali_Cronologia_History.IE5_MSHist01200505222005 0523_index.dat_49152
Section \BaseNamedObjects\UrlZonesSM_Oro
Section \BaseNamedObjects\C:_Documents and Settings_Utente_Impostazioni locali_Temporary Internet Files_Content.IE5_index.dat_278528
Section \BaseNamedObjects\C:_Documents and Settings_Utente_Cookies_index.dat_98304
Section \BaseNamedObjects\C:_Documents and Settings_Utente_Impostazioni locali_Cronologia_History.IE5_index.dat_81920
Section \BaseNamedObjects\mmGlobalPnpInfo
Section \BaseNamedObjects\WDMAUD_Path_Size
Section \BaseNamedObjects\WDMAUD_Path_Size
Section \BaseNamedObjects\WDMAUD_Callbacks
Section \BaseNamedObjects\RotHintTable
Section \BaseNamedObjects\ShimSharedMemory

Section \BaseNamedObjects\__R_00000000003d_SMem__
Semaphore \BaseNamedObjects\shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
Semaphore \BaseNamedObjects\shell.{7CB834F0-527B-11D2-9D1F-0000F805CA57}
Semaphore \BaseNamedObjects\shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
Semaphore \BaseNamedObjects\PowerProfileRegistrySemaphore
Semaphore \BaseNamedObjects\shell.{210A4BA0-3AEA-1069-A2D9-08002B30309D}
Semaphore \BaseNamedObjects\shell.{6D5313C0-8C62-11D1-B2CD-006097DF8C11}
Semaphore \BaseNamedObjects\shell.{090851A5-EB96-11D2-8BE4-00C04FA31A66}
Thread explorer.exe(1228): 1232
Thread explorer.exe(1228): 1276
Thread explorer.exe(1228): 1280
Thread explorer.exe(1228): 1288
Thread explorer.exe(1228): 1436
Thread explorer.exe(1228): 1436
Thread explorer.exe(1228): 976
Thread explorer.exe(1228): 1692
Thread explorer.exe(1228): 1700
Thread explorer.exe(1228): 1996
Thread explorer.exe(1228): 2292
Thread explorer.exe(1228): 2152
Thread explorer.exe(1228): 1124
Thread explorer.exe(1228): 2144
Thread explorer.exe(1228): 1436
Token NT AUTHORITY\SYSTEM
Token NT AUTHORITY\SYSTEM
Token L-GXH7XW6NHT789\Utente
Token L-GXH7XW6NHT789\Utente
WindowStation \Windows\WindowStations\WinSta0
WindowStation \Windows\WindowStations\WinSta0

Non ci capisco più niente... Il task manager alternativo aveva poche voci... Il log tutte quelleche ho postato...