PDA

View Full Version : spyware vx2

antonio86
13-05-2005, 18:05
ragazzi ho un problema con questi cavolo di spyware
non riesco ad eliminare vx2 uno spyware fastidiosissimo
poi inoltre vi posto il log do hijackthis e ditemi se c'è qualcosa di anomalo

Logfile of HijackThis v1.99.1
Scan saved at 18.37.54, on 13/05/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Anti-Trojan-55\Anti-Trojan.exe
C:\Documents and Settings\Bax\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.freeze.com/start.shtml
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.qsrch.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Quick! - {4E7BD74F-2B8D-469E-C0FF-FD67B79CAF2C} - C:\Programmi\quickbar\quickbar.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: (no name) - {44BE0690-5429-47f0-85BB-3FFD8020233E} - (no file)
O3 - Toolbar: Quick! - {4E7BD74F-2B8D-469E-C0FF-FD67B79CAF2C} - C:\Programmi\quickbar\quickbar.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [I/O Controllers] svcnet.exe
O4 - HKLM\..\Run: [glv] C:\WINDOWS\glv.exe
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Programmi\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [eDonkey2000] "C:\Programmi\eDonkey2000\edonkey2000.exe" -t
O4 - HKLM\..\Run: [WinampAgent] C:\Programmi\Winamp\winampa.exe
O4 - HKLM\..\Run: [avirex] "C:\WINDOWS\avirex.exe"
O4 - HKLM\..\Run: [wavdriver] "C:\WINDOWS\wavdriver.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmi\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [I/O Controllers] svcnet.exe
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Programmi\AdunanzA Fastweb\eMule_AdnzA.exe -AutoStart
O4 - HKCU\..\RunOnce: [eZstub] Command /c del C:\WINDOWS\system32\eZstub.exe
O4 - HKCU\..\RunOnce: [Web Offer] Command /c del C:\WINDOWS\system32\EZPOPS~1.EXE
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Windows Update.hta
O15 - Trusted Zone: *.slotchbar.com
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted IP range: 67.19.185.246
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/CDT/ie/bridge-c7.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Programmi\Netropa\Multimedia Keyboard\nhksrv.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
3dsst
13-05-2005, 18:44
ragazzi ho un problema con questi cavolo di spyware
non riesco ad eliminare vx2 uno spyware fastidiosissimo
poi inoltre vi posto il log do hijackthis e ditemi se c'è qualcosa di anomalo

Logfile of HijackThis v1.99.1
Scan saved at 18.37.54, on 13/05/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Anti-Trojan-55\Anti-Trojan.exe
C:\Documents and Settings\Bax\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.freeze.com/start.shtml
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.qsrch.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Quick! - {4E7BD74F-2B8D-469E-C0FF-FD67B79CAF2C} - C:\Programmi\quickbar\quickbar.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: (no name) - {44BE0690-5429-47f0-85BB-3FFD8020233E} - (no file)
O3 - Toolbar: Quick! - {4E7BD74F-2B8D-469E-C0FF-FD67B79CAF2C} - C:\Programmi\quickbar\quickbar.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [I/O Controllers] svcnet.exe
O4 - HKLM\..\Run: [glv] C:\WINDOWS\glv.exe
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Programmi\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [eDonkey2000] "C:\Programmi\eDonkey2000\edonkey2000.exe" -t
O4 - HKLM\..\Run: [WinampAgent] C:\Programmi\Winamp\winampa.exe
O4 - HKLM\..\Run: [avirex] "C:\WINDOWS\avirex.exe"
O4 - HKLM\..\Run: [wavdriver] "C:\WINDOWS\wavdriver.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmi\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [I/O Controllers] svcnet.exe
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Programmi\AdunanzA Fastweb\eMule_AdnzA.exe -AutoStart
O4 - HKCU\..\RunOnce: [eZstub] Command /c del C:\WINDOWS\system32\eZstub.exe
O4 - HKCU\..\RunOnce: [Web Offer] Command /c del C:\WINDOWS\system32\EZPOPS~1.EXE
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Windows Update.hta
O15 - Trusted Zone: *.slotchbar.com
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted IP range: 67.19.185.246
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/CDT/ie/bridge-c7.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Programmi\Netropa\Multimedia Keyboard\nhksrv.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
da fixare:
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.qsrch.com/
O2 - BHO: Quick! - {4E7BD74F-2B8D-469E-C0FF-FD67B79CAF2C} - C:\Programmi\quickbar\quickbar.dll
O3 - Toolbar: (no name) - {44BE0690-5429-47f0-85BB-3FFD8020233E} - (no file)
O3 - Toolbar: Quick! - {4E7BD74F-2B8D-469E-C0FF-FD67B79CAF2C} - C:\Programmi\quickbar\quickbar.dll
O4 - HKLM\..\Run: [I/O Controllers] svcnet.exe
O4 - HKLM\..\Run: [glv] C:\WINDOWS\glv.exe
O4 - HKLM\..\Run: [avirex] "C:\WINDOWS\avirex.exe"
O4 - HKLM\..\Run: [wavdriver] "C:\WINDOWS\wavdriver.exe" ???? questo controllalo
O4 - HKCU\..\Run: [I/O Controllers] svcnet.exe
O4 - Global Startup: Windows Update.hta
O15 - Trusted Zone: *.slotchbar.com
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM
O15 - Trusted Zone: *.windupdates.com (HKLM)
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/CDT/ie/bridge-c7.cab
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O4 - HKCU\..\RunOnce: [eZstub] Command /c del C:\WINDOWS\system32\eZstub.exe
O4 - HKCU\..\RunOnce: [Web Offer] Command /c del C:\WINDOWS\system32\EZPOPS~1.EXE
O4 - Startup: PowerReg Scheduler V3.exe questo potrebbe essere un prog che hai installato tu???controllalo
cmq sei mal ridotto disabilita il ripristino del sistema poi fai una passata con i vari antivirus spyware ecc ecc a proposito tu hai un antivirus????
antonio86
13-05-2005, 19:22
non riesco a rimuovere vx2
ho fixato quello che cera da fixare con hijacthis
poi quando apro proprieta non mi spunta ne desktop ne aspetto un cazzo
lp79
13-05-2005, 19:25
ragazzi ho un problema con questi cavolo di spyware
non riesco ad eliminare vx2 uno spyware fastidiosissimo


non sono un esperto ma su una rivista del settore ho letto qualcosa proprio in merito a questo spyware. si diceva che ad-aware di Lavasoft (free (http://download.com/3000-2144-10045910.html?part=69274&subj=dlpage&tag=button)) ha un apposito ad-on (http://download.lavasoft.de.edgesuite.net/public/plvx2cleaner.exe) per rimuoverlo.

ciao
bluepix
13-05-2005, 21:10
La soluzione più semplice è questa.
Scarichi Ad-Aware, lo aggiorni.
Aggiungi il plug-in specifico per VX2 Cleaner http://www.lavasoft.de/software/plugins/messenger.shtml
e fai uno scan.
3dsst
13-05-2005, 23:17
La soluzione più semplice è questa.
Scarichi Ad-Aware, lo aggiorni.
Aggiungi il plug-in specifico per VX2 Cleaner http://www.lavasoft.de/software/plugins/messenger.shtml
e fai uno scan.
;)
juninho85
14-05-2005, 16:02
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Anti-Trojan-55\Anti-Trojan.exe

quando si dice un sistema ottimizato....;)
BravoGT83
14-05-2005, 16:05
ma mancano il firewall e antivirus
juninho85
14-05-2005, 16:13
ma mancano il firewall e antivirus
per l'AV secondo quello che fa potrebbe anche non servirgli,con quell anti-trojan poi ancora meno.....per il FW potrebbe avere un router
BravoGT83
14-05-2005, 16:15
av e antispyware servono sempre..... ;)
MrOZ
14-05-2005, 16:37
Anti-Trojan-55 serve a poco, visto che è da molto tempo che non viene + aggiornato
3dsst
14-05-2005, 16:39
Anti-Trojan-55 serve a poco, visto che è da molto tempo che non viene + aggiornato
;) concordo io e da un pò che l'ho levato
BravoGT83
15-05-2005, 09:07
Anti-Trojan-55 serve a poco, visto che è da molto tempo che non viene + aggiornato
sicuramente ;)