Sono riuscito a rimettere mano su questa cosa! Ho fatto in ordine cronologico:
-aggiornamento di Spybot e Malwarebytes e relativa scansione prima con spybot (da cui ho cancellato tutte le voci della sezione ripristina) e poi con Malwarebytes in modalità provvisoria.
In modalità ordinaria:
-cerca Virtumonde.prx su disco fisso con esito negativo
-cerca di muwatibi.dll, wukoraga.dll, jokigaju.dll, kegezadu.dll su disco fisso con esito negativo.
Però ho trovato kegezadu.dll_old (C:\WINDOWS\system32), questa è l'analisi su virustotal:
a-squared 4.0.0.101 2009.03.27 Packed.Win32.Mondera!IK
AhnLab-V3 5.0.0.2 2009.03.27 -
AntiVir 7.9.0.129 2009.03.27 TR/Vundo.Gen
Antiy-AVL 2.0.3.1 2009.03.27 Packed/Win32.Mondera
Authentium 5.1.2.4 2009.03.27 W32/Vundo.A!Generic
Avast 4.8.1335.0 2009.03.26 Win32:Trojan-gen {Other}
AVG 8.5.0.283 2009.03.27 Vundo.BZ
BitDefender 7.2 2009.03.27 Gen:Trojan.Heur.Vundo.306D928282
CAT-QuickHeal 10.00 2009.03.26 Win32.Packed.Mondera.b.5
ClamAV 0.94.1 2009.03.27 Trojan.Spy-58747
Comodo 1086 2009.03.27 -
DrWeb 4.44.0.09170 2009.03.27 Trojan.DownLoad.12946
eSafe 7.0.17.0 2009.03.26 Suspicious File
eTrust-Vet 31.6.6420 2009.03.27 Win32/Vundo.BNP
F-Prot 4.4.4.56 2009.03.26 W32/Vundo.A!Generic
F-Secure 8.0.14470.0 2009.03.27 Packed.Win32.Mondera.b
Fortinet 3.117.0.0 2009.03.27 -
GData 19 2009.03.27 Gen:Trojan.Heur.Vundo.306D928282
Ikarus T3.1.1.48.0 2009.03.27 Packed.Win32.Mondera
K7AntiVirus 7.10.683 2009.03.27 -
Kaspersky 7.0.0.125 2009.03.27 Packed.Win32.Mondera.b
McAfee 5565 2009.03.26 Vundo.gen.q
McAfee+Artemis 5565 2009.03.26 Vundo.gen.q
McAfee-GW-Edition 6.7.6 2009.03.27 Trojan.Vundo.Gen
Microsoft 1.4502 2009.03.27 Trojan:Win32/Vundo.gen!AH
NOD32 3969 2009.03.27 a variant of Win32/Adware.Virtumonde.NDN
Norman 6.00.06 2009.03.27 W32/Virtumonde.AGNU
nProtect 2009.1.8.0 2009.03.27 Trojan-PWS/W32.WebGame.65132.B
Panda 10.0.0.10 2009.03.27 -
PCTools 4.4.2.0 2009.03.27 -
Prevx1 V2 2009.03.27 Medium Risk Malware
Rising 21.22.41.00 2009.03.27 Trojan.Win32.VUNDO.bym
Sophos 4.40.0 2009.03.27 Troj/Virtum-Gen
Sunbelt 3.2.1858.2 2009.03.26 Virtumonde
Symantec 1.4.4.12 2009.03.27 Trojan.Vundo
TheHacker 6.3.3.7.292 2009.03.26 -
TrendMicro 8.700.0.1004 2009.03.27 Mal_Vundo11
VBA32 3.12.10.1 2009.03.26 -
ViRobot 2009.3.27.1666 2009.03.27 -
Informazioni addizionali
File size: 65315 bytes
MD5...: 0dcd9f375e26e15802755b697e9f60f8
SHA1..: 044a279f61653e72a70bed3cbae272e163b93f71
SHA256: 66252a432a7d58f028964cecd70be55d7de0af08142907a9e93b2e7cab0ce362
SHA512: 2706544aba60f3290b75809adddc9db3d395502ba966bf5881a788f6f933fb37
533e6ee67ec668cfe0dcf926f9822067eded3a42a4a43185529fd7d1a3a011eb
ssdeep: 1536:9gmD9lPUtdXXQPS2eBMmDboEsd5qIKP6LbKZ:9gmJNSiPWBZ3QAIKP66Z
PEiD..: -
TrID..: File type identification
Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x107c
timedatestamp.....: 0x3b7dfe99 (Sat Aug 18 05:35:21 2001)
machinetype.......: 0x14c (I386)
( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
CODE 0x1000 0x5405 0x5600 7.88 2d92eb06bbbbe37b9ac77c3880f4aab2
.rdata 0x7000 0x681b 0x6a00 7.88 654e5f5c1b621853cf5ca038b4a999c3
.data 0xe000 0x2fd0 0x2a00 7.97 82037360956d0cf3cfaf6030670fd432
.rsrc 0x11000 0x410 0x600 2.46 cc50c25956a152a140858ad7769718e9
.reloc 0x12000 0xb97b 0xa00 0.74 cba707946139aa82ea6dd6c2687a5361
( 4 imports )
> user32.dll: ToAscii, FillRect
> KERNEL32.dll: LoadLibraryW, SetHandleCount, ExitProcess, FreeEnvironmentStringsW, GetACP, GetEnvironmentStringsA, GetTimeZoneInformation, GetUserDefaultLCID, LocalFree
> advapi32.dll: RegSetValueExW, RegCloseKey
> comdlg32.dll: GetOpenFileNameW, GetFileTitleW
( 0 exports )
RDS...: NSRL Reference Data Set
-
Prevx info: <a href='http://info.prevx.com/aboutprogramtext.asp?PX5=19F9D12223E8B227FFA800E92FDC2B009D814F47' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=19F9D12223E8B227FFA800E92FDC2B009D814F47</a>
Poi passo al registro:
delle prime due righe e cioè
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\"WindowsUpd" = "[ADWARE FILENAME]"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\"SysUpd" = "[ADWARE FILENAME]"
non ho capito cosa cercare, anche se "ad occhio" non mi sembra ci siano voci da eliminare (a parte la riga con /r /s). Qui c'è l'immagine del tutto:
http://img21.imageshack.us/my.php?image=senzatitolo1bmj.jpg
per i file da cercare quelli dell'ultima parte con il contrassegno "%" non li ho trovati sul disco fisso