Internet Explorer infettato [Archivio]

enzo82

27-11-2004, 17:41

Allora quando apro ie come pagina iniziale mi ha impostato "http://mysearchnow.com/". Io imposto un'altra pagina e mi apre sempre la stessa pagina. Ho provato tutti i programmi che indica la guida e niente.
Cos'altro posso fare???

Cionno

27-11-2004, 19:00

a: prova spysweeper
b: se non funziona prova una scansione con solo antivirus
c: butta IE e passa a firefox

Matx

27-11-2004, 19:09

C'è un programma sotto che ti modifica la pagina iniziale

Magari guarda tra quelli che hai installato da poco o fai una scansione con spybot s&d

Ciaba

27-11-2004, 21:10

...e anche con AdAware

enzo82

27-11-2004, 21:21

si si ho installato 2000 prog

Leron

27-11-2004, 21:57

ormai mi si sta incarnando questo link

http://forum.hwupgrade.it/showthread.php?s=&threadid=688842

enzo82

28-11-2004, 09:04

ma spiegatemi una cosa. Cosa devo fare con HjackìThis??
Devo selezionare tutto e fare Fix e checked:confused:
Perchè ci sono voci di windows importanti. Cmq forse per la home page ho risolto ma non riesco a rimuore le barre pubblicitarie.:mc:

giacomo_uncino

28-11-2004, 14:59

no posti il log (come un testo) qui poi qualcuno di eperto ti dice cosa cancellare ;)

prova conCWShredder http://www.spywareinfo.com/~merijn/downloads.html
http://www.intermute.com/spysubtract/cwshredder_download.html
Scaricati solo lui e fai una scansione

enzo82

28-11-2004, 15:28

Ecco il log file. Ho provato tutti e due i programmi ma niente.

Logfile of HijackThis v1.98.2
Scan saved at 15.28.49, on 28/11/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe
C:\Programmi\File comuni\Symantec Shared\SNDSrvc.exe
C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\File comuni\Symantec Shared\ccProxy.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\Programmi\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Programmi\File comuni\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\carpserv.exe
C:\Programmi\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\WINDOWS\System32\CTHELPER.EXE
C:\Programmi\QuickTime\qttask.exe
C:\Programmi\Messenger Plus! 3\MsgPlus.exe
C:\Programmi\Java\j2re1.4.2_06\bin\jusched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmi\Creative\MediaSource\GO\CTCMSGo.exe
C:\Programmi\Creative\MediaSource\RemoteControl\RCMan.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_AICN03.EXE
C:\Programmi\Skype\Phone\Skype.exe
C:\Programmi\Internet Explorer\iexplore.exe
c:\progra~1\intern~1\iexplore.exe
c:\progra~1\intern~1\iexplore.exe
C:\Programmi\MSN Messenger\msnmsgr.exe
C:\Programmi\Outlook Express\msimn.exe
C:\Programmi\Norton Internet Security\Norton AntiVirus\OPScan.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
D:\SOFTWARE\anti spyware\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://txkjgvoicuerbhgstubb.com/poN0S5xspk/JkZTpbauo3AjD7KY865M5cuM_9ncpQIeS8vj5RBNLj/ELX6kDJEuN.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://web.oaoayolxqwonugh.info/poN0S5xspk9hcV3HoyHJWMX09ssHfW5SerHN5UIF6FA.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.libero.it
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7D44F8A8-8421-F9B0-52FB-381BFEDB30FA} - C:\DOCUME~1\Vincenzo\DATIAP~1\LiteGrey\army ford.exe
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Programmi\File comuni\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmi\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Programmi\File comuni\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmi\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Programmi\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Programmi\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programmi\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [fork tick shim base] C:\Documents and Settings\All Users\Dati applicazioni\multiwebforktick\1 debug.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Creative MediaSource Go] C:\Programmi\Creative\MediaSource\GO\CTCMSGo.exe /SCB
O4 - HKCU\..\Run: [RemoteCenter] C:\Programmi\Creative\MediaSource\RemoteControl\RCMan.EXE
O4 - HKCU\..\Run: [EPSON Stylus COLOR 580] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_AICN03.EXE /P22 "EPSON Stylus COLOR 580" /O6 "USB001" /M "Stylus COLOR 580"
O4 - HKCU\..\Run: [Skype] "C:\Programmi\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Programmi\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [Frag32] C:\DOCUME~1\Vincenzo\DATIAP~1\THISTI~1\BodyTeamDead.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmi\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://C:\Programmi\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Collegamenti a ritroso - res://C:\Programmi\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Pagine simili - res://C:\Programmi\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Versione cache della pagina - res://C:\Programmi\Google\GoogleToolbar1.dll/cmcache.html

Adric

28-11-2004, 22:52

Originariamente inviato da Cionno
c: butta IE e passa a firefox
oppure a Mozilla Suite od Opera, sicuri quanto Firefox.

enzo82

01-12-2004, 19:38

difatti ho installato Fiefox. E' 1000 volte meglio di IE