Tiriamoci su le maniche ed incominciamo a tagliare
per prima cosa farei girare il tool bar di rimozione di EliteToolBar:
http://www.softpedia.com/get/Interne...-Remover.shtml
poi, disabilitare il ripristino di sistema
reboot in modalitā provvisoria
Fixare con Hijackthis queste linee:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
www.sfonditalia.biz?1746
R3 - URLSearchHook: (no name) - _{20EC3D2D-33C1-4C9D-BC37-C2D500688DA2} - (no file)
O2 - BHO: Band Class - {BDF6CE3D-F5C5-4462-9814-3C8EAC330CA8} - C:\WINDOWS\AdRoar.dll (file missing)
O2 - BHO: (no name) - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - (no file)
O3 - Toolbar: Band Class - {BDF6CE3D-F5C5-4462-9814-3C8EAC330CA8} - C:\WINDOWS\AdRoar.dll (file missing)
O4 - HKLM\..\Run: [4ac63fd0267c] C:\WINDOWS\System32\comcat10.exe
O4 - HKLM\..\Run: [Media Pass] C:\Program Files\Media Pass\MediaPassK.exe
O4 - HKLM\..\Run: [etbrun] C:\windows\system32\eliteabh32.exe
O4 - HKLM\..\Run: [Olympic] C:\Documents and Settings\claudio\Dati applicazioni\sgrunt\IE4321.exe
O4 - HKLM\..\Run: [AdRoarUpdate] C:\WINDOWS\ARUpdate.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKCU\..\Run: [Windows Media Player] 50cent.exe
O4 - HKCU\..\Run: [Los5RjH3R] msahe319.exe
O4 - HKCU\..\Run: [McAfee Windows Protection] mcafee32.exe
O4 - HKCU\..\Run: [System] mah.exe
O4 - HKCU\..\Run: [Messanger] phqghume.exe
O9 - Extra button: (no name) - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\maxspeed.exe (file missing)
O9 - Extra 'Tools' menuitem: MaxSpeed - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\maxspeed.exe (file missing)
O15 - Trusted Zone:
www.archiviosex.net
O15 - Trusted Zone:
www.master70.biz
O15 - Trusted Zone:
www.master71.biz
O15 - Trusted Zone:
www.sfonditalia.biz
O15 - Trusted Zone:
www.skymasters.biz
O15 - Trusted Zone:
www.xbeta69.com
O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab
O16 - DPF: {EAA105FE-7BBD-4196-8B96-D46743894195} (MjpegControl Class) -
http://213.203.169.142:50/plugin/mjpegcontrol.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) -
http://www2.incredimail.com/contents...r/imloader.cab
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - C:\WINDOWS\System32\vbsys2.dll (file missing)
oltre a questi sono sospetti:
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,userinit32.exe
da cancellare i files o le directory(se esistono):
C:\WINDOWS\AdRoar.dll
C:\WINDOWS\System32\comcat10.exe
C:\Program Files\Media Pass (directory)
C:\windows\system32\eliteabh32.exe
C:\Documents and Settings\claudio\Dati applicazioni\sgrunt (directory)
C:\WINDOWS\ARUpdate.exe
C:\Program Files\AutoUpdate (directory)
50cent.exe
msahe319.exe
mcafee32.exe
mah.exe
phqghume.exe
C:\WINDOWS\System32\maxspeed.exe
C:\WINDOWS\System32\vbsys2.dll
reboot in modalitā normale
riposta il log per controllare il risultato
ciao
ciao
Abbiamo finalmente vinto qualcosa(W Inter). Era ora...
