PDA

View Full Version : Le ho provate tutte .....

talking
07-03-2005, 11:12
Ragazzi vi invio il filelog di hijack per cercare di risolvere un problema che ormai mi assilla da 2 settimane:

l'apertura di finestre tipo Search.... e Free... quando utilizzo il mio PC.

Se potete aiutatemi. please sto impazzendo.

P.S. utilizzo normalmente AD Aware e SpyBot ed ho installato Sygate firewall.

Logfile of HijackThis v1.99.1
Scan saved at 12.12.26, on 07/03/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\Programmi\Sygate\SPF\smc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\cisvc.exe
C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
C:\WINNT\System32\svchost.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Programmi\File comuni\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\htpatch.exe
C:\WINNT\system32\RunDll32.exe
C:\Programmi\Logitech\iTouch\iTouch.exe
C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Programmi\QuickTime\qttask.exe
C:\Programmi\Real\RealPlayer\RealPlay.exe
C:\Programmi\EPSON\EPSON CardMonitor\EPSON CardMonitor1.1.exe
C:\WINNT\system32\spool\drivers\w32x86\3\CAP3LAK.EXE
C:\Programmi\Logitech\iTouch\kbdtray.exe
C:\WINNT\SYSTEM32\SPOOL\DRIVERS\W32X86\3\CAP3SWK.EXE
C:\Program Files\interMute\SpySubtract\SpySub.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\WINNT\system32\wuauclt.exe
C:\WINNT\System32\cidaemon.exe
C:\Programmi\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Documents and Settings\xx\Documenti\Antispyware\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [HTpatch] C:\WINNT\htpatch.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmi\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [CAP3ON] C:\WINNT\system32\spool\drivers\w32x86\3\CAP3ONN.EXE
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [antiware] C:\winnt\system32\elitepbs32.exe
O4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O10 - Unknown file in Winsock LSP: c:\programmi\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-beta.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/2291f5097421f7be8b14/netzip/RdxIE601_it.cab
O16 - DPF: {7876E4A5-78B7-4020-B08F-C960A1ED54C9} (WebWatch Class) - http://192.168.1.20/LT/WinWebPush.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup/downloader/imloader.cab
O20 - AppInit_DLLs: PAVWAIT.DLL
O23 - Service: Servizio amministrativo di Gestione disco logico (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Programmi\Sygate\SPF\smc.exe
sharon
07-03-2005, 11:33
Ciao talking,
Ti scrivo quello che avevo scritto per un'altro utente prima.
start, guida in linea e supporto, ripristino configurazione di sistema, impostazione ripristino configurazione di sistema e disattiva ripristino configurazione.
Poi fai la scan con adaware.
Devi fare solo questo, devi disattivare il ripristino di configurazione, tutto qua.
Ciao
trevi63
07-03-2005, 11:37
Non ho ben chiaro perche' si deve disattivare il ripristino del sistema.
Lo si deve fare quando si fa una scanzione in modalita' provvisoria, oppure bisogna sempre settarlo cosi'??
ciao
sharon
07-03-2005, 11:39
fallo senza modalità provisoria. Come ti avevo scritto sopra.
lester99
07-03-2005, 11:59
Originariamente inviato da talking

P.S. utilizzo normalmente AD Aware e SpyBot ed ho installato Sygate firewall.



Spybot ti consiglio di usarlo in modalità avanzata. Se non riesci a ripulire nemmeno cosi prova altre alternativecome spysweeper o microsoft antispyware.
71104
07-03-2005, 14:25
un momento, c'è una DLL in AppInit_DLLs!!! prova a toglierla e facci sapere.
ciao
juninho85
07-03-2005, 14:48
per curiosità:quanti mega di memoria avevi occupati al momento dello scan di hijack?
bluepix
07-03-2005, 15:15
io eliminerei questa voce:

O4 - HKLM\..\Run: [antiware] C:\winnt\system32\elitepbs32.exe

come specificato qui:

http://www.sophos.com/virusinfo/analyses/trojdloaderhw.html
71104
07-03-2005, 19:29
io direi di eliminare ANCHE la DLL in AppInit_DLLs; di solito quel valore deve stare vuoto!
quella DLL mi pare proprio sospetta, sai...
io gli darei anche una passatina col Dependency Walker...
talking
10-03-2005, 08:35
Scusate l'ignoranza ma dove trovo AppInit_DLLs?
bluepix
10-03-2005, 08:50
è nella riga O20 del report.

però è da investigare. Sembra una componente di Panda Software.

Se hai o hai usato Panda antivirus è una dll regolare.
talking
11-03-2005, 08:17
Ragazzi sono allo stremo.
Ho fatto tutto quello che mi avete consigliato ma i problemi rimangono.
Quelle maledette finestre pubblicitarie continuano ad aprirsi soprattutto quando uso browsers (IE e Firefox).
Siccome non vorrei formattare tutto cos'altro posso fare?

Vi riinvio il flielog di hijack:
Logfile of HijackThis v1.99.1
Scan saved at 9.20.01, on 11/03/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\Programmi\Sygate\SPF\smc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\cisvc.exe
C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
C:\WINNT\System32\svchost.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Programmi\File comuni\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\htpatch.exe
C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\WINNT\system32\wuauclt.exe
C:\WINNT\System32\cidaemon.exe
c:\Program Files\interMute\SpySubtract\SpySub.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Documents and Settings\xx\Documenti\Antispyware\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [HTpatch] C:\WINNT\htpatch.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmi\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [CAP3ON] C:\WINNT\system32\spool\drivers\w32x86\3\CAP3ONN.EXE
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [antiware] C:\winnt\system32\elitepbs32.exe
O4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O10 - Unknown file in Winsock LSP: c:\programmi\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-beta.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/2291f5097421f7be8b14/netzip/RdxIE601_it.cab
O16 - DPF: {7876E4A5-78B7-4020-B08F-C960A1ED54C9} (WebWatch Class) - http://192.168.1.20/LT/WinWebPush.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup/downloader/imloader.cab
O20 - AppInit_DLLs: PAVWAIT.DLL
O23 - Service: Servizio amministrativo di Gestione disco logico (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Programmi\Sygate\SPF\smc.exe
bluepix
11-03-2005, 08:39
Beh .... questa c'è ancora.:( :nonsifa:

O4 - HKLM\..\Run: [antiware] C:\winnt\system32\elitepbs32.exe


ma l'avevi già fixata o no?
talking
11-03-2005, 08:46
Si, ma è ricomparsa....
bluepix
11-03-2005, 09:47
O4 - HKLM\..\Run: [antiware] C:\winnt\system32\elitepbs32.exe

cancella anche il file elitepbs32.exe

se non ci riesci prova ad usare

http://www.bleepingcomputer.com/files/killbox.php

oltre a quella che ti ho segnalato fixa pure queste altre 2:

O16 - DPF: {7876E4A5-78B7-4020-B08F-C960A1ED54C9} (WebWatch Class) - http://192.168.1.20/LT/WinWebPush.cab

O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/content...er/imloader.cab