PDA

View Full Version : Finestre Internet Explorer si aprono da sole

boysna
15-05-2007, 11:38
Salve a tutti, come da titolo vi scrivo perchè ho questo problema di apertura finestre di Internet Explorer in automatico (senza che io faccia niente). Ovviamente vanno su siti vietati.

Non se dipende dalla stessa ragione ma se faccio una ricerca su Google con Internet Explorer mi da sempre come primo risultato "The most popular site for..." e poi la chiave di ricerca inserita.

Inoltre Internet Explorer mi sta dando sempre strani problemi quando inserisco degli annunci su siti appositi al momento di premere il pulsante "invio". Problemi del tipo "method not implemented" oppure ci mette una vita a caricare la pagina e poi da "Impossibile visualizzare la pagina".

Tutto ciò non accade con altri browser.
Bugs Bunny
15-05-2007, 11:49
Posta un log di hijackthis (download nella mia firma)
boysna
15-05-2007, 20:10
Ok, grazie. Ora vedo....
boysna
15-05-2007, 20:11
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 13.24.59, on 15/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\csrss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Programmi\WIDCOMM\Bluetooth Software\bin\btwdins.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
d:\programmi\file comuni\logitech\lvmvfm\LVPrcSrv.exe
D:\WINDOWS\Explorer.EXE
E:\AntiVir\AntiVir PersonalEdition Premium\avgnt.exe
E:\Java\jre1.5.0\bin\jusched.exe
D:\WINDOWS\AdobeR.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Programmi\Messenger\msmsgs.exe
D:\Programmi\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
E:\Acrobat 6.0\Distillr\acrotray.exe
D:\Programmi\WIDCOMM\Bluetooth Software\BTTray.exe
E:\AntiVir\AntiVir PersonalEdition Premium\sched.exe
E:\Java\jre1.5.0\bin\jucheck.exe
E:\AntiVir\AntiVir PersonalEdition Premium\avguard.exe
E:\AntiVir\AntiVir PersonalEdition Premium\avesvc.exe
D:\WINDOWS\system32\drivers\CDAC11BA.EXE
E:\ewido\ewido anti-spyware 4.0\guard.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\system32\svchost.exe
E:\AntiVir\AntiVir PersonalEdition Premium\avmailc.exe
D:\WINDOWS\System32\alg.exe
E:\FireFox\firefox.exe
D:\Programmi\MSN Messenger\msnmsgr.exe
D:\Programmi\MSN Messenger\usnsvc.exe
E:\eMule\emule.exe
E:\Microsoft Office\OFFICE11\WINWORD.EXE
D:\WINDOWS\system32\NOTEPAD.EXE
G:\eseguibili e programmi\HiJackThis_v2.exe
D:\WINDOWS\system32\wbem\wmiprvse.exe
boysna
15-05-2007, 20:17
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
F2 - REG:system.ini: UserInit=D:\WINDOWS\system32\userinit.exe,D:\WINDOWS\system32\ntos.exe,,D:\WINDOWS\436X.EXE
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Spybot - Search & Destroy\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: bho3 Class - {58FB2CBB-C874-45FC-A1C9-B62CC9E3BED9} - D:\Documents and Settings\Stefano\514175554.dll
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\programmi\google\googletoolbar2.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - E:\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Programmi\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Programmi\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - E:\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\programmi\google\googletoolbar2.dll
boysna
15-05-2007, 20:17
O4 - HKLM\..\Run: [zzGBK] H:\setup.exe
O4 - HKLM\..\Run: [avgnt] "E:\AntiVir\AntiVir PersonalEdition Premium\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "E:\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SpyClean] d:\windows\system32\spywinclean.exe
O4 - HKLM\..\Run: [crtfmon] D:\WINDOWS\TEMP\8C.tmp
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] E:\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [RavAV] D:\WINDOWS\AdobeR.exe
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "D:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] D:\Programmi\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [userinit] D:\WINDOWS\system32\ntos.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Acrobat Assistant.lnk = E:\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = E:\Microsoft Office\Office10\OSA.EXE
boysna
15-05-2007, 20:18
O8 - Extra context menu item: &Windows Live Search - res://D:\Programmi\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://E:\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Invia a periferica &Bluetooth... - D:\Programmi\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Programmi\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Programmi\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: rsvp32_2.dll
O10 - Unknown file in Winsock LSP: rsvp32_2.dll
O10 - Unknown file in Winsock LSP: rsvp32_2.dll
O10 - Unknown file in Winsock LSP: rsvp32_2.dll
O10 - Unknown file in Winsock LSP: rsvp32_2.dll
O10 - Unknown file in Winsock LSP: rsvp32_2.dll
O10 - Unknown file in Winsock LSP: rsvp32_2.dll
O10 - Unknown file in Winsock LSP: rsvp32_2.dll
O10 - Unknown file in Winsock LSP: rsvp32_2.dll
O10 - Unknown file in Winsock LSP: rsvp32_2.dll
O10 - Unknown file in Winsock LSP: rsvp32_2.dll
O10 - Unknown file in Winsock LSP: rsvp32_2.dll
O10 - Unknown file in Winsock LSP: rsvp32_2.dll
O10 - Unknown file in Winsock LSP: rsvp32_2.dll
O10 - Unknown file in Winsock LSP: rsvp32_2.dll
O10 - Unknown file in Winsock LSP: rsvp32_2.dll
boysna
15-05-2007, 20:19
O10 - Unknown file in Winsock LSP: rsvp32_2.dll
O10 - Unknown file in Winsock LSP: rsvp32_2.dll
O10 - Unknown file in Winsock LSP: rsvp32_2.dll
O10 - Unknown file in Winsock LSP: rsvp32_2.dll
O10 - Unknown file in Winsock LSP: rsvp32_2.dll
O10 - Unknown file in Winsock LSP: rsvp32_2.dll
O20 - AppInit_DLLs: D:\WINDOWS\system32\perfc000.dat
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - D:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\WINDOWS\system32\browseui.dll
O23 - Service: AntiVir Mail Security Service (AntiVirMailService) - H+BEDV Datentechnik GmbH - E:\AntiVir\AntiVir PersonalEdition Premium\avmailc.exe
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - H+BEDV Datentechnik GmbH - E:\AntiVir\AntiVir PersonalEdition Premium\sched.exe
O23 - Service: AntiVir PersonalEdition Premium Service (AntiVirService) - H+BEDV Datentechnik GmbH - E:\AntiVir\AntiVir PersonalEdition Premium\avguard.exe
O23 - Service: AntiVir Engine Service (AVEService) - H+BEDV Datentechnik GmbH - E:\AntiVir\AntiVir PersonalEdition Premium\avesvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - D:\Programmi\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - D:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - E:\ewido\ewido anti-spyware 4.0\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - D:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - d:\programmi\file comuni\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Apache Tomcat (Tomcat5) - Unknown owner - E:\Apache Software Foundation\Tomcat 5.5\bin\tomcat5.exe (file missing)

--
End of file - 9003 bytes
fede86.exe
15-05-2007, 20:32
stai messo molto male
Aspetta qualcuno che ti consiglia cosa fare.
Tidus Strife
15-05-2007, 20:47
Le cose che ho notato io sono:

D:\WINDOWS\AdobeR.exe
F2 - REG:system.ini: UserInit=D:\WINDOWS\system32\userinit.exe,D:\WINDOWS\system32\ntos.exe,,D:\WINDO WS\436X.EXE
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [SpyClean] d:\windows\system32\spywinclean.exe
O4 - HKLM\..\Run: [crtfmon] D:\WINDOWS\TEMP\8C.tmp
O4 - HKLM\..\Run: [RavAV] D:\WINDOWS\AdobeR.exe
O4 - HKCU\..\Run: [userinit] D:\WINDOWS\system32\ntos.exe
O20 - AppInit_DLLs: D:\WINDOWS\system32\perfc000.dat

Tutte queste righe:
O10 - Unknown file in Winsock LSP: rsvp32_2.dll

Poi questo sembra sicuro, ma se notate ha uno spazio nell'estensione, che sarebbe ".ex e" quindi secondo me è un malware... comunque non ne sono sicuro...

D:\Programmi\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.ex e

Poi ci sarebbe da inserire questo script con The Avenger:

Files to delete:
D:\WINDOWS\AdobeR.exe
d:\windows\system32\spywinclean.exe
D:\WINDOWS\TEMP\8C.tmp
D:\WINDOWS\system32\ntos.exe
D:\WINDOWS\system32\perfc000.dat
boysna
16-05-2007, 10:43
Le cose che ho notato io sono:

D:\WINDOWS\AdobeR.exe
F2 - REG:system.ini: UserInit=D:\WINDOWS\system32\userinit.exe,D:\WINDOWS\system32\ntos.exe,,D:\WINDO WS\436X.EXE
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [SpyClean] d:\windows\system32\spywinclean.exe
O4 - HKLM\..\Run: [crtfmon] D:\WINDOWS\TEMP\8C.tmp
O4 - HKLM\..\Run: [RavAV] D:\WINDOWS\AdobeR.exe
O4 - HKCU\..\Run: [userinit] D:\WINDOWS\system32\ntos.exe
O20 - AppInit_DLLs: D:\WINDOWS\system32\perfc000.dat

Tutte queste righe:
O10 - Unknown file in Winsock LSP: rsvp32_2.dll

Poi questo sembra sicuro, ma se notate ha uno spazio nell'estensione, che sarebbe ".ex e" quindi secondo me è un malware... comunque non ne sono sicuro...

D:\Programmi\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.ex e

Poi ci sarebbe da inserire questo script con The Avenger:

Files to delete:
D:\WINDOWS\AdobeR.exe
d:\windows\system32\spywinclean.exe
D:\WINDOWS\TEMP\8C.tmp
D:\WINDOWS\system32\ntos.exe
D:\WINDOWS\system32\perfc000.dat


In effetti il file Google Toolbar.ex è anomalo anche se sembra strano perchè dovrebbe essere l'eseguibile della toolbar, in ogni caso non la uso la toolbar quindi posso rimuoverla.
Facendo cosi nelle ricerche con Google non mi trova piu come primo risultato il sito con "The most popular site for....."

Puo essere solo un caso e forse si ripresenterà il problema, comunque vi terrò aggiornati, intanto attendo suggerimenti sugli altri elementi strani del log.
black92
16-05-2007, 14:23
per me faresti prima a formattare :D
xcdegasp
16-05-2007, 17:07
Io consiglierei poi una passata di "a-squared free" e l'uso di un buon cips come prevx1..
Tidus Strife
16-05-2007, 17:48
In effetti il file Google Toolbar.ex è anomalo anche se sembra strano perchè dovrebbe essere l'eseguibile della toolbar, in ogni caso non la uso la toolbar quindi posso rimuoverla.
Facendo cosi nelle ricerche con Google non mi trova piu come primo risultato il sito con "The most popular site for....."

Puo essere solo un caso e forse si ripresenterà il problema, comunque vi terrò aggiornati, intanto attendo suggerimenti sugli altri elementi strani del log.

Ecco, bene... cmq gli altri elementi del log li hai fixati? Prova a rifare il log e vedi se non ci sono +... poi hai fatto la passata con The Avenger mettendo lo script che ti ho detto?
boysna
17-05-2007, 13:25
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 13.19.52, on 17/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Programmi\WIDCOMM\Bluetooth Software\bin\btwdins.exe
D:\WINDOWS\system32\spoolsv.exe
d:\programmi\file comuni\logitech\lvmvfm\LVPrcSrv.exe
D:\WINDOWS\Explorer.EXE
E:\AntiVir\AntiVir PersonalEdition Premium\avgnt.exe
E:\Java\jre1.5.0\bin\jusched.exe
D:\Programmi\iTunes\iTunesHelper.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Programmi\Messenger\msmsgs.exe
E:\Java\jre1.5.0\bin\jucheck.exe
E:\Acrobat 6.0\Distillr\acrotray.exe
D:\Programmi\WIDCOMM\Bluetooth Software\BTTray.exe
E:\AntiVir\AntiVir PersonalEdition Premium\sched.exe
E:\AntiVir\AntiVir PersonalEdition Premium\avguard.exe
E:\AntiVir\AntiVir PersonalEdition Premium\avesvc.exe
D:\WINDOWS\system32\drivers\CDAC11BA.EXE
E:\ewido\ewido anti-spyware 4.0\guard.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\system32\svchost.exe
E:\AntiVir\AntiVir PersonalEdition Premium\avmailc.exe
D:\Programmi\iPod\bin\iPodService.exe
D:\WINDOWS\system32\wuauclt.exe
D:\Programmi\MSN Messenger\msnmsgr.exe
E:\eMule\emule.exe
D:\Programmi\MSN Messenger\usnsvc.exe
G:\eseguibili e programmi\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Spybot - Search & Destroy\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: bho3 Class - {58FB2CBB-C874-45FC-A1C9-B62CC9E3BED9} - D:\Documents and Settings\Stefano\514175554.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - E:\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Programmi\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Programmi\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - E:\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [zzGBK] H:\setup.exe
O4 - HKLM\..\Run: [avgnt] "E:\AntiVir\AntiVir PersonalEdition Premium\avgnt.exe" /min
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] E:\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] "D:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [vwsodvyr] D:\jvliwfob.bat
O4 - HKLM\..\Run: [cdbxmbah] D:\umgsohfs.bat
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "D:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Acrobat Assistant.lnk = E:\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://D:\Programmi\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://E:\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Invia a periferica &Bluetooth... - D:\Programmi\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Programmi\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Programmi\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe
O20 - AppInit_DLLs: D:\WINDOWS\system32\perfc000.dat
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - D:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\WINDOWS\system32\browseui.dll
O23 - Service: AntiVir Mail Security Service (AntiVirMailService) - H+BEDV Datentechnik GmbH - E:\AntiVir\AntiVir PersonalEdition Premium\avmailc.exe
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - H+BEDV Datentechnik GmbH - E:\AntiVir\AntiVir PersonalEdition Premium\sched.exe
O23 - Service: AntiVir PersonalEdition Premium Service (AntiVirService) - H+BEDV Datentechnik GmbH - E:\AntiVir\AntiVir PersonalEdition Premium\avguard.exe
O23 - Service: AntiVir Engine Service (AVEService) - H+BEDV Datentechnik GmbH - E:\AntiVir\AntiVir PersonalEdition Premium\avesvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - D:\Programmi\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - D:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - E:\ewido\ewido anti-spyware 4.0\guard.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - D:\Programmi\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - d:\programmi\file comuni\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Apache Tomcat (Tomcat5) - Unknown owner - E:\Apache Software Foundation\Tomcat 5.5\bin\tomcat5.exe (file missing)

--
End of file - 6750 bytes

Questo è il nuovo log.

Ho fixato gli elementi segnalati con hijackthis.
Ho messo lo script in "the avenger".
Tutte quelle righe10 - unknown le ho eliminate poi con lspfix.

Pare che in conclusione tutte le righe anomale siano sparite.

Date uno sguardo al nuovo log e ditemi se c'è qualcos'altro che non va.

Comunque all'avvio non si apre piu la pagina in automatico e non appre piu un messaggio d'errore che recentemente si visualizzava ad ogni avvio.
boysna
17-05-2007, 13:26
Un'altra conquista è il fatto di essere riuscito a scivere tutto il log in un solo messaggio, prima come noterete ho dovuto scrivere piu messaggi perchè stranamente mi dava degli errori se era troppo lungo.
boysna
17-05-2007, 13:33
UN'ALTRA GRANDE CONQUISTA!!!

Riesco ad inserire annunci su Internet senza errori strani di Internet Explorer. Credo che tutti i problemai orano siano proprio finiti. Se non si blocca di brutto il pc (altra cosa che stava capitando in questo periodo) credo che ho superato tutti gli scogli.

:D

Fatemi sapere sempre notizie a riguardo del nuovo log. :D
wearethechampions
17-05-2007, 14:35
O4 - HKLM\..\Run: [zzGBK] H:\setup.exe
O4 - HKLM\..\Run: [vwsodvyr] D:\jvliwfob.bat
O4 - HKLM\..\Run: [cdbxmbah] D:\umgsohfs.bat
O2 - BHO: bho3 Class - {58FB2CBB-C874-45FC-A1C9-B62CC9E3BED9} - D:\Documents and Settings\Stefano\514175554.dll
O20 - AppInit_DLLs: D:\WINDOWS\system32\perfc000.dat


hai un sacco di m**** nel pc....ti consiglio di eseguire un altro script con the avenger:

Files to delete:
H:\setup.exe

Registry values to delete:
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run | setup.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | jvliwfob.bat
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | umgsohfs.bat

ps è uno dei primi script di the avenger che faccio....se ho sbagliato correggetemi...
boysna
17-05-2007, 15:13
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 15.12.31, on 17/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Programmi\WIDCOMM\Bluetooth Software\bin\btwdins.exe
D:\WINDOWS\system32\spoolsv.exe
d:\programmi\file comuni\logitech\lvmvfm\LVPrcSrv.exe
D:\WINDOWS\Explorer.EXE
E:\AntiVir\AntiVir PersonalEdition Premium\avgnt.exe
E:\Java\jre1.5.0\bin\jusched.exe
D:\Programmi\iTunes\iTunesHelper.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Programmi\Messenger\msmsgs.exe
E:\Java\jre1.5.0\bin\jucheck.exe
E:\Acrobat 6.0\Distillr\acrotray.exe
D:\Programmi\WIDCOMM\Bluetooth Software\BTTray.exe
E:\AntiVir\AntiVir PersonalEdition Premium\sched.exe
E:\AntiVir\AntiVir PersonalEdition Premium\avguard.exe
E:\AntiVir\AntiVir PersonalEdition Premium\avesvc.exe
D:\WINDOWS\system32\drivers\CDAC11BA.EXE
E:\ewido\ewido anti-spyware 4.0\guard.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\system32\svchost.exe
E:\AntiVir\AntiVir PersonalEdition Premium\avmailc.exe
D:\Programmi\iPod\bin\iPodService.exe
D:\Programmi\MSN Messenger\msnmsgr.exe
D:\Programmi\MSN Messenger\usnsvc.exe
D:\WINDOWS\system32\wuauclt.exe
E:\FireFox\firefox.exe
G:\eseguibili e programmi\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Spybot - Search & Destroy\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: bho3 Class - {58FB2CBB-C874-45FC-A1C9-B62CC9E3BED9} - D:\Documents and Settings\Stefano\514175554.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - E:\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Programmi\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Programmi\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - E:\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [zzGBK] H:\setup.exe
O4 - HKLM\..\Run: [avgnt] "E:\AntiVir\AntiVir PersonalEdition Premium\avgnt.exe" /min
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] E:\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] "D:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [vwsodvyr] D:\jvliwfob.bat
O4 - HKLM\..\Run: [cdbxmbah] D:\umgsohfs.bat
O4 - HKLM\..\Run: [hrwwnhep] D:\jrmuvvpc.bat
O4 - HKLM\..\Run: [mhdggdav] D:\aibnumud.bat
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "D:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Acrobat Assistant.lnk = E:\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://D:\Programmi\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://E:\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Invia a periferica &Bluetooth... - D:\Programmi\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Programmi\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Programmi\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe
O20 - AppInit_DLLs: D:\WINDOWS\system32\perfc000.dat
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - D:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\WINDOWS\system32\browseui.dll
O23 - Service: AntiVir Mail Security Service (AntiVirMailService) - H+BEDV Datentechnik GmbH - E:\AntiVir\AntiVir PersonalEdition Premium\avmailc.exe
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - H+BEDV Datentechnik GmbH - E:\AntiVir\AntiVir PersonalEdition Premium\sched.exe
O23 - Service: AntiVir PersonalEdition Premium Service (AntiVirService) - H+BEDV Datentechnik GmbH - E:\AntiVir\AntiVir PersonalEdition Premium\avguard.exe
O23 - Service: AntiVir Engine Service (AVEService) - H+BEDV Datentechnik GmbH - E:\AntiVir\AntiVir PersonalEdition Premium\avesvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - D:\Programmi\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - D:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - E:\ewido\ewido anti-spyware 4.0\guard.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - D:\Programmi\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - d:\programmi\file comuni\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Apache Tomcat (Tomcat5) - Unknown owner - E:\Apache Software Foundation\Tomcat 5.5\bin\tomcat5.exe (file missing)

--
End of file - 6846 bytes

Il lo dopo aver messo lo script in "the avenger" e aver riavviato...
Tidus Strife
17-05-2007, 15:30
Non sono sparite le chiavi infette, anzi sono aumentate o_O:

O4 - HKLM\..\Run: [zzGBK] H:\setup.exe
O4 - HKLM\..\Run: [vwsodvyr] D:\jvliwfob.bat
O4 - HKLM\..\Run: [cdbxmbah] D:\umgsohfs.bat
O4 - HKLM\..\Run: [hrwwnhep] D:\jrmuvvpc.bat
O4 - HKLM\..\Run: [mhdggdav] D:\aibnumud.bat
O20 - AppInit_DLLs: D:\WINDOWS\system32\perfc000.dat

Fixale tutte, ma stavolta in modalità provvisoria e rigorosamente con system restore disablitato.
(X disabilitarlo click destro su risorse del computer, scheda Ripristino conf di sistema, spunta la casella Disabilita ripristino conf di sys su tutte le unità.)

Inoltre, inserisci questo script in The Avenger:

Files to delete:
H:\setup.exe
D:\jvliwfob.bat
D:\umgsohfs.bat
D:\jrmuvvpc.bat
D:\aibnumud.bat
D:\WINDOWS\system32\perfc000.dat


Così non dovrebbero più riapparire, nè le voci di hijackthis, né i file nel sistema.
wizard1993
17-05-2007, 17:22
non ci scommetteri
boysna
22-05-2007, 23:42
Non sono sparite le chiavi infette, anzi sono aumentate o_O:

O4 - HKLM\..\Run: [zzGBK] H:\setup.exe
O4 - HKLM\..\Run: [vwsodvyr] D:\jvliwfob.bat
O4 - HKLM\..\Run: [cdbxmbah] D:\umgsohfs.bat
O4 - HKLM\..\Run: [hrwwnhep] D:\jrmuvvpc.bat
O4 - HKLM\..\Run: [mhdggdav] D:\aibnumud.bat
O20 - AppInit_DLLs: D:\WINDOWS\system32\perfc000.dat

Fixale tutte, ma stavolta in modalità provvisoria e rigorosamente con system restore disablitato.
(X disabilitarlo click destro su risorse del computer, scheda Ripristino conf di sistema, spunta la casella Disabilita ripristino conf di sys su tutte le unità.)

Inoltre, inserisci questo script in The Avenger:

Files to delete:
H:\setup.exe
D:\jvliwfob.bat
D:\umgsohfs.bat
D:\jrmuvvpc.bat
D:\aibnumud.bat
D:\WINDOWS\system32\perfc000.dat


Così non dovrebbero più riapparire, nè le voci di hijackthis, né i file nel sistema.
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 23.41.38, on 22/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Programmi\WIDCOMM\Bluetooth Software\bin\btwdins.exe
D:\WINDOWS\system32\spoolsv.exe
d:\programmi\file comuni\logitech\lvmvfm\LVPrcSrv.exe
D:\WINDOWS\Explorer.EXE
E:\AntiVir\AntiVir PersonalEdition Premium\avgnt.exe
E:\Java\jre1.5.0\bin\jusched.exe
D:\Programmi\iTunes\iTunesHelper.exe
D:\WINDOWS\AdobeR.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Programmi\Messenger\msmsgs.exe
E:\Java\jre1.5.0\bin\jucheck.exe
E:\Acrobat 6.0\Distillr\acrotray.exe
D:\Programmi\WIDCOMM\Bluetooth Software\BTTray.exe
E:\AntiVir\AntiVir PersonalEdition Premium\sched.exe
E:\AntiVir\AntiVir PersonalEdition Premium\avguard.exe
E:\AntiVir\AntiVir PersonalEdition Premium\avesvc.exe
D:\WINDOWS\system32\drivers\CDAC11BA.EXE
E:\ewido\ewido anti-spyware 4.0\guard.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\system32\svchost.exe
E:\AntiVir\AntiVir PersonalEdition Premium\avmailc.exe
D:\Programmi\iPod\bin\iPodService.exe
G:\eseguibili e programmi\HiJackThis_v2.exe
E:\FireFox\firefox.exe
D:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Spybot - Search & Destroy\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: bho3 Class - {58FB2CBB-C874-45FC-A1C9-B62CC9E3BED9} - D:\Documents and Settings\Stefano\522212638.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - E:\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Programmi\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Programmi\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - E:\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [avgnt] "E:\AntiVir\AntiVir PersonalEdition Premium\avgnt.exe" /min
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] E:\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] "D:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [RavAV] D:\WINDOWS\AdobeR.exe
O4 - HKLM\..\Run: [sltvyxfy] D:\auodkesq.bat
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "D:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-21-1482476501-484763869-839522115-1003\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Acrobat Assistant.lnk = E:\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://D:\Programmi\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://E:\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Invia a periferica &Bluetooth... - D:\Programmi\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Programmi\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Programmi\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - D:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\WINDOWS\system32\browseui.dll
O23 - Service: AntiVir Mail Security Service (AntiVirMailService) - H+BEDV Datentechnik GmbH - E:\AntiVir\AntiVir PersonalEdition Premium\avmailc.exe
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - H+BEDV Datentechnik GmbH - E:\AntiVir\AntiVir PersonalEdition Premium\sched.exe
O23 - Service: AntiVir PersonalEdition Premium Service (AntiVirService) - H+BEDV Datentechnik GmbH - E:\AntiVir\AntiVir PersonalEdition Premium\avguard.exe
O23 - Service: AntiVir Engine Service (AVEService) - H+BEDV Datentechnik GmbH - E:\AntiVir\AntiVir PersonalEdition Premium\avesvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - D:\Programmi\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - D:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - E:\ewido\ewido anti-spyware 4.0\guard.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - D:\Programmi\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - d:\programmi\file comuni\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Apache Tomcat (Tomcat5) - Unknown owner - E:\Apache Software Foundation\Tomcat 5.5\bin\tomcat5.exe (file missing)

--
End of file - 6692 bytes


Fatto.. Questo è il nuovo log...

Posso riabilitare il system restore?
boysna
24-05-2007, 11:30
up
boysna
25-05-2007, 11:14
Qualcuno mi da una controllata al log?
Le finstre si riaprono di nuovo su siti proibiti...
wizard1993
25-05-2007, 14:42
vedo che hai avira il modulo antirootk non segnala nulla?,non sono in grado di interpretare il log, pazienta qualche utente esperto ti risponderà ciao

è ancora molto acerbo; prende molto poco
wizard1993
25-05-2007, 14:44
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 23.41.38, on 22/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal


FIXA
D:\WINDOWS\AdobeR.exe
O4 - HKLM\..\Run: [RavAV] D:\WINDOWS\AdobeR.exe
O4 - HKLM\..\Run: [sltvyxfy] D:\auodkesq.bat

con the avanger http://www.megalab.it/articoli.php?id=946

insersci questo script
Files to delete:
D:\WINDOWS\AdobeR.exe
boysna
26-05-2007, 14:41
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 14.36.24, on 26/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Programmi\WIDCOMM\Bluetooth Software\bin\btwdins.exe
D:\WINDOWS\system32\spoolsv.exe
d:\programmi\file comuni\logitech\lvmvfm\LVPrcSrv.exe
D:\WINDOWS\Explorer.EXE
E:\AntiVir\AntiVir PersonalEdition Premium\avgnt.exe
E:\Java\jre1.5.0\bin\jusched.exe
D:\Programmi\iTunes\iTunesHelper.exe
E:\Java\jre1.5.0\bin\jucheck.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Programmi\Messenger\msmsgs.exe
E:\Acrobat 6.0\Distillr\acrotray.exe
D:\Programmi\WIDCOMM\Bluetooth Software\BTTray.exe
E:\AntiVir\AntiVir PersonalEdition Premium\sched.exe
E:\AntiVir\AntiVir PersonalEdition Premium\avguard.exe
E:\AntiVir\AntiVir PersonalEdition Premium\avesvc.exe
D:\WINDOWS\system32\drivers\CDAC11BA.EXE
E:\ewido\ewido anti-spyware 4.0\guard.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\system32\svchost.exe
E:\AntiVir\AntiVir PersonalEdition Premium\avmailc.exe
D:\Programmi\iPod\bin\iPodService.exe
D:\WINDOWS\system32\wuauclt.exe
G:\eseguibili e programmi\HiJackThis_v2.exe
E:\FireFox\firefox.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Spybot - Search & Destroy\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: bho3 Class - {58FB2CBB-C874-45FC-A1C9-B62CC9E3BED9} - D:\Documents and Settings\Stefano\522212638.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - E:\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Programmi\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Programmi\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - E:\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [avgnt] "E:\AntiVir\AntiVir PersonalEdition Premium\avgnt.exe" /min
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] E:\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] "D:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [reyovwab] D:\plbclnyi.bat
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "D:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Acrobat Assistant.lnk = E:\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://D:\Programmi\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://E:\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Invia a periferica &Bluetooth... - D:\Programmi\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Programmi\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Programmi\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - D:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\WINDOWS\system32\browseui.dll
O23 - Service: AntiVir Mail Security Service (AntiVirMailService) - H+BEDV Datentechnik GmbH - E:\AntiVir\AntiVir PersonalEdition Premium\avmailc.exe
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - H+BEDV Datentechnik GmbH - E:\AntiVir\AntiVir PersonalEdition Premium\sched.exe
O23 - Service: AntiVir PersonalEdition Premium Service (AntiVirService) - H+BEDV Datentechnik GmbH - E:\AntiVir\AntiVir PersonalEdition Premium\avguard.exe
O23 - Service: AntiVir Engine Service (AVEService) - H+BEDV Datentechnik GmbH - E:\AntiVir\AntiVir PersonalEdition Premium\avesvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - D:\Programmi\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - D:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - E:\ewido\ewido anti-spyware 4.0\guard.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - E:\Common\Database\bin\fbserver.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - D:\Programmi\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - d:\programmi\file comuni\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Apache Tomcat (Tomcat5) - Unknown owner - E:\Apache Software Foundation\Tomcat 5.5\bin\tomcat5.exe (file missing)

--
End of file - 6661 bytes



Ho fatto quanto detto....
Guardate un po...
nispo
26-05-2007, 14:50
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 14.36.24, on 26/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Programmi\WIDCOMM\Bluetooth Software\bin\btwdins.exe
D:\WINDOWS\system32\spoolsv.exe
d:\programmi\file comuni\logitech\lvmvfm\LVPrcSrv.exe
D:\WINDOWS\Explorer.EXE
E:\AntiVir\AntiVir PersonalEdition Premium\avgnt.exe
E:\Java\jre1.5.0\bin\jusched.exe
D:\Programmi\iTunes\iTunesHelper.exe
E:\Java\jre1.5.0\bin\jucheck.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Programmi\Messenger\msmsgs.exe
E:\Acrobat 6.0\Distillr\acrotray.exe
D:\Programmi\WIDCOMM\Bluetooth Software\BTTray.exe
E:\AntiVir\AntiVir PersonalEdition Premium\sched.exe
E:\AntiVir\AntiVir PersonalEdition Premium\avguard.exe
E:\AntiVir\AntiVir PersonalEdition Premium\avesvc.exe
D:\WINDOWS\system32\drivers\CDAC11BA.EXE
E:\ewido\ewido anti-spyware 4.0\guard.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\system32\svchost.exe
E:\AntiVir\AntiVir PersonalEdition Premium\avmailc.exe
D:\Programmi\iPod\bin\iPodService.exe
D:\WINDOWS\system32\wuauclt.exe
G:\eseguibili e programmi\HiJackThis_v2.exe
E:\FireFox\firefox.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Spybot - Search & Destroy\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: bho3 Class - {58FB2CBB-C874-45FC-A1C9-B62CC9E3BED9} - D:\Documents and Settings\Stefano\522212638.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - E:\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Programmi\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Programmi\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - E:\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [avgnt] "E:\AntiVir\AntiVir PersonalEdition Premium\avgnt.exe" /min
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] E:\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] "D:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [reyovwab] D:\plbclnyi.bat
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "D:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Acrobat Assistant.lnk = E:\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://D:\Programmi\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://E:\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Invia a periferica &Bluetooth... - D:\Programmi\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Programmi\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Programmi\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - D:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\WINDOWS\system32\browseui.dll
O23 - Service: AntiVir Mail Security Service (AntiVirMailService) - H+BEDV Datentechnik GmbH - E:\AntiVir\AntiVir PersonalEdition Premium\avmailc.exe
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - H+BEDV Datentechnik GmbH - E:\AntiVir\AntiVir PersonalEdition Premium\sched.exe
O23 - Service: AntiVir PersonalEdition Premium Service (AntiVirService) - H+BEDV Datentechnik GmbH - E:\AntiVir\AntiVir PersonalEdition Premium\avguard.exe
O23 - Service: AntiVir Engine Service (AVEService) - H+BEDV Datentechnik GmbH - E:\AntiVir\AntiVir PersonalEdition Premium\avesvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - D:\Programmi\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - D:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - E:\ewido\ewido anti-spyware 4.0\guard.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - E:\Common\Database\bin\fbserver.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - D:\Programmi\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - d:\programmi\file comuni\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Apache Tomcat (Tomcat5) - Unknown owner - E:\Apache Software Foundation\Tomcat 5.5\bin\tomcat5.exe (file missing)

--
End of file - 6661 bytes



Ho fatto quanto detto....
Guardate un po...

tutto ok
boysna
27-05-2007, 10:49
Anche io pensavo che era tutto risolto ma purtroppo all'avvio si apre di nuovo una finestra da sola.... :(

Questo è il log dopo la riproposizione del problema.... Guardate un po se c'è qualche problema ancora....

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 10.46.12, on 27/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Programmi\WIDCOMM\Bluetooth Software\bin\btwdins.exe
D:\WINDOWS\system32\spoolsv.exe
d:\programmi\file comuni\logitech\lvmvfm\LVPrcSrv.exe
D:\WINDOWS\Explorer.EXE
E:\AntiVir\AntiVir PersonalEdition Premium\avgnt.exe
E:\Java\jre1.5.0\bin\jusched.exe
D:\Programmi\iTunes\iTunesHelper.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Programmi\Messenger\msmsgs.exe
E:\Java\jre1.5.0\bin\jucheck.exe
E:\Acrobat 6.0\Distillr\acrotray.exe
D:\Programmi\WIDCOMM\Bluetooth Software\BTTray.exe
E:\AntiVir\AntiVir PersonalEdition Premium\sched.exe
E:\AntiVir\AntiVir PersonalEdition Premium\avguard.exe
E:\AntiVir\AntiVir PersonalEdition Premium\avesvc.exe
D:\WINDOWS\system32\drivers\CDAC11BA.EXE
E:\ewido\ewido anti-spyware 4.0\guard.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\system32\svchost.exe
E:\AntiVir\AntiVir PersonalEdition Premium\avmailc.exe
D:\Programmi\iPod\bin\iPodService.exe
D:\Programmi\MSN Messenger\msnmsgr.exe
D:\Programmi\MSN Messenger\usnsvc.exe
E:\FireFox\firefox.exe
G:\eseguibili e programmi\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Spybot - Search & Destroy\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: bho3 Class - {58FB2CBB-C874-45FC-A1C9-B62CC9E3BED9} - D:\Documents and Settings\Stefano\522212638.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - E:\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Programmi\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Programmi\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - E:\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [avgnt] "E:\AntiVir\AntiVir PersonalEdition Premium\avgnt.exe" /min
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] E:\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] "D:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [reyovwab] D:\plbclnyi.bat
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "D:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Acrobat Assistant.lnk = E:\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://D:\Programmi\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://E:\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Invia a periferica &Bluetooth... - D:\Programmi\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Programmi\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Programmi\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - D:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\WINDOWS\system32\browseui.dll
O23 - Service: AntiVir Mail Security Service (AntiVirMailService) - H+BEDV Datentechnik GmbH - E:\AntiVir\AntiVir PersonalEdition Premium\avmailc.exe
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - H+BEDV Datentechnik GmbH - E:\AntiVir\AntiVir PersonalEdition Premium\sched.exe
O23 - Service: AntiVir PersonalEdition Premium Service (AntiVirService) - H+BEDV Datentechnik GmbH - E:\AntiVir\AntiVir PersonalEdition Premium\avguard.exe
O23 - Service: AntiVir Engine Service (AVEService) - H+BEDV Datentechnik GmbH - E:\AntiVir\AntiVir PersonalEdition Premium\avesvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - D:\Programmi\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - D:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - E:\ewido\ewido anti-spyware 4.0\guard.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - E:\Common\Database\bin\fbserver.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - D:\Programmi\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - d:\programmi\file comuni\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Apache Tomcat (Tomcat5) - Unknown owner - E:\Apache Software Foundation\Tomcat 5.5\bin\tomcat5.exe (file missing)

--
End of file - 6707 bytes
Tidus Strife
27-05-2007, 11:11
La colpa è tutta di questo file bast... con nomi a caso...

O4 - HKLM\..\Run: [reyovwab] D:\plbclnyi.bat

Se fixi la voce riappare, se usi avenger riappare, anche con sys restore disabilitato... usa GMER per vedere se ci sono voci in rosso (il mio sospetto è che ci siano processi nascosti che lo creano tutte le volte all'avvio...)
boysna
27-05-2007, 11:43
Ho aperto GMER e mi ha dato questo processo in rosso:

D:\WINDOWS\winlogon32.exe.

Faccio la scansione e vediamo che ne esce.
wizard1993
27-05-2007, 11:57
Ho aperto GMER e mi ha dato questo processo in rosso:

D:\WINDOWS\winlogon32.exe.

Faccio la scansione e vediamo che ne esce.

con the avanger http://www.megalab.it/articoli.php?id=946

insersci questo script
Files to delete:
D:\WINDOWS\winlogon32.exe
boysna
09-06-2007, 14:35
Ok è tutto riusolto.... Grazie mille a tutti...