riepilogo la situazione:
ho disattivato il ripristino di configurazione, ho fatto girare CWShredder che quasi subito mi si chiede e chiude tutte le applicazioni aperte, sono andato sul sito (
http://www.spywareinfo.com/~merijn/downloads.html) e ho letto questo:
There is a variant of the Coolwebsearch trojan spreading that closes several anti-spyware apps when you try to open them.
If this is happening to you, download PepiMK's CoolWWWSearch.SmartKiller removal tool first and run it. After it does its job, CWShredder and HijackThis will run properly (as well Spybot S&D, Ad-aware and several anti-spyware forums).
l'ho scaricato ma non ha trovato nulla, poi ho riavviato in mod. provvisioria e ho fatto girare adware-se e poi HiJackThis (le ultime versioni), ma non ho risolto nulla....
come pagina iniziale mi carica sempre about
:blank e il pc mi sembra rallentato (con i giochi soprattutto).
questo è l'ultimo log:
Logfile of HijackThis v1.99.0
Scan saved at 0.09.17, on 15/02/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Real\RealPlayer\RealPlay.exe
C:\Programmi\Logitech\iTouch\iTouch.exe
C:\WINDOWS\downlo~1\9fub9qt\s42xrr.exe
C:\Programmi\Eset\nod32krn.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Programmi\Microsoft Office\Office10\msoffice.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\WINDOWS\System32\rundll32.exe
C:\Downloads\Antivirus\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Stefano\IMPOST~1\Temp\se.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about
:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about
:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Stefano\IMPOST~1\Temp\se.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about
:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about
:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about
:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about
:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about
:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about
:blank
O2 - BHO: (no name) - {8FEDFD25-E586-4FEE-AE55-0482CC16013D} - C:\WINDOWS\System32\phemajb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [RealTray] C:\Programmi\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmi\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\Stefano\IMPOST~1\Temp\se.dll,DllInstall
O4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c
O4 - Startup: Barra degli strumenti Microsoft Office.lnk = ?
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IncrediMail) -
http://www2.incredimail.com/contents...1/imloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7C7B6F96-2E12-48CC-99CA-6F0289C402FA}: NameServer = 62.211.69.150,212.48.4.15
O18 - Filter hijack: application/octet-stream - {6585E5B4-4D2A-4A1D-A219-4102C64BA999} - C:\WINDOWS\chp.dll
O18 - Filter: text/html - {BEFAC71B-1471-439A-82AA-2475D0472176} - C:\WINDOWS\System32\phemajb.dll
O18 - Filter: text/plain - {BEFAC71B-1471-439A-82AA-2475D0472176} - C:\WINDOWS\System32\phemajb.dll
O23 - Service: NOD32 Kernel Service - Unknown - C:\Programmi\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
li fisso ma mi ritornano tutti (lo 018), ma come li trovo e li cancello definitivamente ?
grazie