WinFixer2005Scanner! Help [Archivio] - Hardware Upgrade Forum

The Dark Shadow

08-09-2005, 23:54

Non ho ben capito cos'è, se è un virus o un torjan o un'altra porcheria fatto sta che non riesco a toglierlo!
Ho usato Nod 32, Spybot, Ad-Ware, CounterSpy e C-Cleaner (tutti aggiornati a stasera) ma non riesco a toglierlo! Continua ad aprire finestre di Firefox con il download di sto coso oppure mi redirecta ogni tanto mentre sono su un qualunque sito, quando vuole lui!

Che devo fare? Aiutatemi vi prego! :muro:

skirzo

09-09-2005, 00:24

Non ho ben capito cos'è, se è un virus o un torjan o un'altra porcheria fatto sta che non riesco a toglierlo!
Ho usato Nod 32, Spybot, Ad-Ware, CounterSpy e C-Cleaner (tutti aggiornati a stasera) ma non riesco a toglierlo! Continua ad aprire finestre di Firefox con il download di sto coso oppure mi redirecta ogni tanto mentre sono su un qualunque sito, quando vuole lui!

Che devo fare? Aiutatemi vi prego! :muro:
allora riscansiona con tutti in modalità provvisoria disattivando anche il ripristino di sistema, ed eventualmente posta un log di hijackthis

The Dark Shadow

09-09-2005, 00:38

ehm come ci vado in modalità provvisoria? non mi ricordo il tasto :mc:

teuz84

09-09-2005, 00:49

start....esegui...scrivi msconfig....scegli boot.ini....e poi spunti safeboot
ciao,

The Dark Shadow

09-09-2005, 01:44

ci sono riuscito ho provato mi ha trovato una cosa solo con spybot l'ho tolta e con gli altri niente ho riavviato in mod normale ma c'è di nuovo!

ecco il log di hijackthis (in caso vi servisse):

Logfile of HijackThis v1.99.0
Scan saved at 2.40.05, on 09/09/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\WINDOWS\system32\ezSP_Px.exe
C:\Programmi\QuickTime\qttask.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programmi\Java\jre1.5.0_04\bin\jusched.exe
C:\Programmi\File comuni\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\Trust\280KSK~1\Keyboard\Ikeymain.exe
C:\PROGRA~1\Trust\280KSK~1\Mouse\Amoumain.exe
C:\WINDOWS\rchpxyg.EXE
C:\Programmi\D-Tools\daemon.exe
C:\WINDOWS\system32\sys2349.exe
C:\Programmi\Eset\nod32kui.exe
C:\Programmi\Sunbelt Software\CounterSpy Client\sunasDTServ.exe
C:\Programmi\Sunbelt Software\CounterSpy Client\sunasServ.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Programmi\File comuni\Autodesk Shared\Service\AdskScSrv.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\Programmi\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programmi\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe
C:\WINDOWS\kqlfuxv.exe
C:\Programmi\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\update\start.exe
C:\WINDOWS\update\WinUpdate.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\FRAEL SPA\Desktop\HijackThis.exe
C:\WINDOWS\update\pv.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.accoona.com/search_assistant/accoona_search_assistant.jsp?&utm_id=400011&utm_content=leftnav&utm_source=wdz1&utm_medium=bund&utm_campaign=wdz0605a
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.accoona.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://69.50.190.135/?to=FED&from=remuver&type=remuver
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.accoona.com/search_assistant/accoona_search_assistant.jsp?&utm_id=400011&utm_content=leftnav&utm_source=wdz1&utm_medium=bund&utm_campaign=wdz0605a
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.accoona.com/search?q=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1085D4FD-199E-49B5-B405-695C306F96C0} - (no file)
O2 - BHO: PicShow Class - {4487598C-2EC7-43A2-870E-6D8D720FDD9F} - C:\WINDOWS\system32\pkshmnnz.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: LANBridge Class - {71D1708F-973D-4600-AF01-AD86688403AE} - C:\WINDOWS\system32\fnuydcru.dll
O2 - BHO: ADefaultSearch Class - {944864A5-3916-46E2-96A9-A2E84F3F1208} - C:\Programmi\Accoona\ASearchAssist.dll
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] C:\Programmi\Creative\SBLive\PROGRAM\ADGJDet.exe
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\system32\ezSP_Px.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Shellapi32] svcnet.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FILECO~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Programmi\File comuni\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [lanbrup] C:\WINDOWS\system32\lanbrup.exe
O4 - HKLM\..\Run: [TrustKeybd] C:\PROGRA~1\Trust\280KSK~1\Keyboard\Ikeymain.exe
O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\Trust\280KSK~1\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [rchpxyg] C:\WINDOWS\rchpxyg.EXE
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programmi\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [sys2349] C:\WINDOWS\system32\sys2349.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [sunasDTServ] C:\Programmi\Sunbelt Software\CounterSpy Client\sunasDTServ.exe
O4 - HKLM\..\Run: [srpikh] C:\WINDOWS\system32\qnlbjc.exe r
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programmi\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [Microsoft Security Hot Fix Update] "%SystemRoot%\mshotfix.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [update] C:\WINDOWS\update\hide C:\WINDOWS\update\ess.bat
O4 - HKCU\..\Run: [Shellapi32] svcnet.exe
O4 - HKCU\..\Run: [CMAPP] "C:\Programmi\CMAPP\Client\cmappclient.exe"
O4 - HKCU\..\Run: [pshower] C:\WINDOWS\system32\pshwr.exe
O4 - HKCU\..\Run: [InstantTray] C:\Programmi\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe
O4 - HKCU\..\Run: [IW_Drop_Icon] C:\Programmi\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe /DropDisc
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [AWMON] "C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe"
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{829E4156-656A-48E9-A4C0-A75E39C33A43}: NameServer = 85.37.17.5 151.99.125.1
O18 - Filter: text/html - {8293D547-38DD-4325-B35A-F1817EDFA5FC} - (no file)
O23 - Service: Autodesk Licensing Service - Unknown - C:\Programmi\File comuni\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: License Management Service ESD - Unknown - C:\Programmi\File comuni\element5 Shared\Service\Licence Manager ESD.exe
O23 - Service: Macromedia Licensing Service - Unknown - C:\Programmi\File comuni\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NOD32 Kernel Service - Unknown - C:\Programmi\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Windows Overlay Components - Unknown - C:\WINDOWS\kqlfuxv.exe

skirzo

09-09-2005, 02:45

mamma mia che log..
tu stai un pò inguaiato :) ed è strano che i software classici non trovino niente.
cmq devi fixare sicuramente:
C:\WINDOWS\update\start.exe
C:\WINDOWS\update\WinUpdate.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.accoona.com/search_assistant/accoona_search_assistant.jsp?&utm_id=400011&utm_content=leftnav&utm_source=wdz1&utm_medium=bund&utm_campaign=wdz0605a
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.accoona.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://69.50.190.135/?to=FED&from=remuver&type=remuver
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.accoona.com/search_assistant/accoona_search_assistant.jsp?&utm_id=400011&utm_content=leftnav&utm_source=wdz1&utm_medium=bund&utm_campaign=wdz0605a
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.accoona.com/search?q=%s
O2 - BHO: ADefaultSearch Class - {944864A5-3916-46E2-96A9-A2E84F3F1208} - C:\Programmi\Accoona\ASearchAssist.dll
O4 - HKLM\..\Run: [lanbrup] C:\WINDOWS\system32\lanbrup.exe
O4 - HKLM\..\Run: [Microsoft Security Hot Fix Update] "%SystemRoot%\mshotfix.exe"
O4 - HKCU\..\Run: [Shellapi32] svcnet.exe
O4 - HKCU\..\Run: [CMAPP] "C:\Programmi\CMAPP\Client\cmappclient.exe"
O4 - HKCU\..\Run: [update] C:\WINDOWS\update\hide C:\WINDOWS\update\ess.bat
O4 - HKCU\..\Run: [pshower] C:\WINDOWS\system32\pshwr.exe
O23 - Service: Windows Overlay Components - Unknown - C:\WINDOWS\kqlfuxv.exe.

poi ci sono questi che mi puzzano molto:
C:\WINDOWS\rchpxyg.EXE
C:\WINDOWS\system32\sys2349.exe
C:\WINDOWS\kqlfuxv.exe
R3 - Default URLSearchHook is missing.

chiudi tutti i programmi e fixa con hijackthis
poi vai in c:\programmi o program files e cancella tutti i riferimenti ad "accona"

poi ti conviene fare una scansione online con Bitdefender (http://www.bitdefender.com/scan8/ie.html) o con mcafee (http://virusscan.nl.nu/) perchè sei pieno di immondizia e... buona fortuna!

The Dark Shadow

09-09-2005, 10:31

:cry: aaah :cry: sono pieno di porcate! ora provo con hijackthis.
Mi hanno anche consigliato di usare un "anti-malware" per win fix che ne dite?