divertimento2.exe

[fabri70]

Che posso fare per togliermelo dalle scatrole...è un programmino che a volte mi ritrovo attivo, non è in esecuzione automatica, non è in msconfig e non lo trovo in regedit.
Fatto sta che:
mi cambia la pagina iniziale internet in www.capitan-trash.com
a volte mi scollega il modem
mi fa apparire una finestrella pop-up con scritto "ADV"
...mi rompe troppo il ca22o!!!!!

Adaware non lo trova.
avast! antivirus non lo trova.
la scansione online di pc cillin non lo trova.
Che posso fare per togliermelo dalle scatole???
ciao e grazie....

[MrOZ]

scarica hijackthis, fai uno scan, salva il log e copia-incollalo qui.

[fabri70]

Originariamente inviato da MrOZ
scarica hijackthis, fai uno scan, salva il log e copia-incollalo qui.

Logfile of HijackThis v1.97.7
Scan saved at 17.39.32, on 29/06/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
f:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
f:\Programmi\Alwil Software\Avast4\ashServ.exe
f:\Programmi\CPUCooL\CooLSrv.exe
E:\WINDOWS\System32\tcpsvcs.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\System32\DRIVERS\WtSrv.exe
E:\WINDOWS\Explorer.EXE
F:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
F:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
f:\Programmi\Logitech\MouseWare\system\em_exec.exe
F:\Programmi\SAMSUNG\Samsung Internet Keyboard\MMKbd.exe
F:\Programmi\CPUCooL\CPUCooL.exe
F:\Programmi\MUSICMATCH\MUSICMATCH Jukebox\mmjb.exe
F:\Programmi\MUSICMATCH\MUSICMATCH Jukebox\MMDiag.exe
f:\Programmi\MUSICMATCH\MUSICMATCH Jukebox\mm_director.exe
F:\PROGRA~1\MICROS~1\OFFICE11\OUTLOOK.EXE
F:\Programmi\Microsoft Office\OFFICE11\WINWORD.EXE
E:\Programmi\Internet Explorer\iexplore.exe
F:\PROGRA~1\GoZilla\Go.exe
H:\Doc-Izio\Downloads\HijackThis.exe
E:\Programmi\Internet Explorer\iexplore.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchcentral.cc/search.php?v=4&aff=4341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freeinternet.it?PC=1
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O1 - Hosts file is located at: E:\WINDOWS\nsdb\hosts
O1 - Hosts: 81.211.105.69 lender-search.com
O1 - Hosts: 81.211.105.68 hot-searches.com
O2 - BHO: (no name) - {01FB9C55-FC66-4476-A199-389241193188} - E:\WINDOWS\System32\CUPATN~1.DLL
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - f:\Programmi\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {CD4C3CF0-4B15-11D1-ABED-709549C10000} - F:\PROGRA~1\GoZilla\GoIEHlp.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [Go!Zilla dial-up fix] "F:\PROGRA~1\GoZilla\Go.exe" /FIXRAS
O4 - HKLM\..\Run: [avast!] f:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroCheck] E:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ashMaiSv] F:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
O4 - HKCU\..\Run: [TClockEx] F:\Programmi\Orologio\TCLOCKEX.EXE
O4 - HKCU\..\Run: [divertimento2] E:\WINDOWS\ADDINS\divertimento2.exe /go
O4 - Startup: CPUCooL.lnk = F:\Programmi\CPUCooL\CPUCooL.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = E:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Samsung Internet Keyboard.lnk = ?
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://F:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Ricerche (HKLM)
O9 - Extra button: ICQ Lite (HKLM)
O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O14 - IERESET.INF: START_PAGE_URL=http://www.freeinternet.it?PC=1
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-9.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9AC4A2FE-BED4-460D-B0EB-217BE72B24D6}: NameServer = 193.70.192.25 193.70.152.25

[MrOZ]

scarica CWShredder e lancialo. poi fai uno scan con adaware6 aggiornato. infine dopo aver fatto tutto riposta un nuovo log di hijackthi.,

[Norwegian17]

try the "seek" option that you find at Start
enter divertimento2, than you find two files..simply delete the .exe -file