|
|||||||
|
|
|
 |
|
|
Strumenti |
20-04-2007, 21:37
|
#1 |
|
Member
Iscritto dal: Apr 2007
Città: Bari
Messaggi: 31
|
finestre pubblictà ke si aprono da sole.
Ciao a tutti,sn nuovo di qst forum.Da qlk giorno ho 1 piccolo problema.qnd apro ie7 o firefox mi si aprono finestre ke mosrano pubbblicità di vari prodotti.So ke x eliminare qt probblema bisogna utilizza hijackthis e x qst vi mostro il mio log: Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 22.36.00, on 20/04/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\Programmi\Alwil Software\Avast4\aswUpdSv.exe D:\Programmi\Alwil Software\Avast4\ashServ.exe D:\WINDOWS\system32\spoolsv.exe D:\PROGRA~1\FILECO~1\Stardock\SDMCP.exe D:\Programmi\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe D:\Programmi\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe D:\Programmi\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe D:\Programmi\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe D:\WINDOWS\system32\nvsvc32.exe D:\Programmi\CyberLink\Shared files\RichVideo.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\system32\wwSecure.exe D:\Programmi\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe D:\WINDOWS\Explorer.EXE D:\WINDOWS\RTHDCPL.EXE D:\Programmi\Trust\Trust MD3100 USB ADSL MODEM\CnxDslTb.exe D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe D:\Programmi\File comuni\Real\Update_OB\realsched.exe D:\Programmi\Adobe\Photoshop Elements 4.0\apdproxy.exe D:\Programmi\eBay\eBay Toolbar2\eBayTBDaemon.exe D:\WINDOWS\system32\rundll32.exe D:\Programmi\CyberLink\PowerDVD\PDVDServ.exe D:\Programmi\TopDesk\topdesk.exe D:\WINDOWS\system32\ctfmon.exe D:\WINDOWS\system32\svchost.exe D:\Programmi\Messenger\msmsgs.exe D:\Programmi\VisualTaskTips\VisualTaskTips.exe D:\Programmi\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe D:\Programmi\Thoosje Vista Sidebar v1.7.8\thoosje's sidebar.exe D:\Programmi\Alwil Software\Avast4\ashMaiSv.exe D:\Programmi\Alwil Software\Avast4\ashWebSv.exe D:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe D:\Documents and Settings\Nino\Documenti\emule0.47c-Xtreme5.4\emule.exe D:\Programmi\File comuni\Microsoft Shared\Encarta Web Companion\2007\ENCWCSVR.EXE D:\Programmi\Adobe\Acrobat 7.0\Reader\AcroRd32.exe D:\Programmi\Internet Explorer\IEXPLORE.EXE D:\WINDOWS\system32\svchost.exe D:\Programmi\Mozilla Firefox\firefox.exe D:\DOCUME~1\Nino\IMPOST~1\Temp\62exinjs.a6.exe D:\Programmi\Mozilla Firefox\firefox.exe D:\Programmi\MSN Messenger\msnmsgr.exe D:\Documents and Settings\Nino\Desktop\HiJackThis_v2.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.libero.it/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti R3 - URLSearchHook: Coolstreaming Tool-Bar v1.0 Toolbar - {bd0e4d83-654e-4213-965b-fcbe887061f4} - D:\Programmi\Coolstreaming_Tool-Bar_v1.0\tbCoo1.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - D:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1557B435-8242-4686-9AA3-9265BF7525A4} - D:\WINDOWS\system32\iuamqdnf.dll O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - D:\Programmi\eBay\eBay Toolbar2\eBayTB.dll O2 - BHO: (no name) - {2EDB63B7-7432-42B8-B484-B7DE2779F848} - D:\WINDOWS\system32\urqpqqq.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Programmi\Java\jre1.5.0_10\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Encarta Web Companion Oggetto helper - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - D:\Programmi\File comuni\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\programmi\google\googletoolbar3.dll O2 - BHO: Coolstreaming Tool-Bar v1.0 Toolbar - {bd0e4d83-654e-4213-965b-fcbe887061f4} - D:\Programmi\Coolstreaming_Tool-Bar_v1.0\tbCoo1.dll O2 - BHO: (no name) - {CAC5F578-24AF-47D0-8B58-B10AB1FD035A} - D:\WINDOWS\system32\geebb.dll O2 - BHO: (no name) - {E7C6D560-347D-498D-A0A9-06D55E61EC81} - D:\WINDOWS\system32\uklothsd.dll O3 - Toolbar: Encarta Web Companion - {147D6308-0614-4112-89B1-31402F9B82C4} - D:\Programmi\File comuni\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\programmi\google\googletoolbar3.dll O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O3 - Toolbar: Coolstreaming Tool-Bar v1.0 Toolbar - {bd0e4d83-654e-4213-965b-fcbe887061f4} - D:\Programmi\Coolstreaming_Tool-Bar_v1.0\tbCoo1.dll O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - D:\Programmi\eBay\eBay Toolbar2\eBayTB.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [CnxDslTaskBar] "D:\Programmi\Trust\Trust MD3100 USB ADSL MODEM\CnxDslTb.exe" O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [TkBellExe] "D:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Adobe Photo Downloader] "D:\Programmi\Adobe\Photoshop Elements 4.0\apdproxy.exe" O4 - HKLM\..\Run: [QuickTime Task] "D:\Programmi\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [eBayToolbar] D:\Programmi\eBay\eBay Toolbar2\eBayTBDaemon.exe O4 - HKLM\..\Run: [PinnacleDriverCheck] D:\WINDOWS\system32\PSDrvCheck.exe -CheckReg O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [LWBMOUSE] D:\Programmi\Browser Mouse\mouse32a.exe O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] D:\Programmi\Browser Mouse\moffice.exe O4 - HKLM\..\Run: [RemoteControl] D:\Programmi\CyberLink\PowerDVD\PDVDServ.exe O4 - HKLM\..\Run: [LanguageShortcut] D:\Programmi\CyberLink\PowerDVD\Language\Language.exe O4 - HKLM\..\Run: [TopDesk] D:\Programmi\TopDesk\topdesk.exe O4 - HKLM\..\Run: [.nvsvc] D:\WINDOWS\system\smss.exe /w O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "D:\Programmi\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [VisualTaskTips] D:\Programmi\VisualTaskTips\VisualTaskTips.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: thoosje's sidebar.lnk = D:\Programmi\Thoosje Vista Sidebar v1.7.8\thoosje's sidebar.exe O4 - Global Startup: Service Manager.lnk = D:\Programmi\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe O8 - Extra context menu item: &eBay Search - res://D:\Programmi\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html O8 - Extra context menu item: E&sporta in Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programmi\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programmi\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: I&nvia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Barra di ricerca di Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - D:\Programmi\File comuni\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/...x/qtplugin.cab O16 - DPF: {1230CB21-C88D-11CF-0000-000000000000} - http://www.browserupdate.net/cabs/cu...oader-3832.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://www.visualbasicpoint.net/stre...ript/TVUAx.cab O16 - DPF: {49A3DCEE-FC3C-11D4-83E5-0050DA33C619} (BVXPlayer Class) - http://digilander.libero.it/face4us/xplayer/xplayer.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://mic1992italy.spaces.live.com/...d/MsnPUpld.cab O16 - DPF: {5CD4310E-88FB-43C1-BE24-5F3FA9C5C9D1} (KooPlayer Control) - http://www.coolstreaming.us/consolle.../KooPlayer.ocx O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/IT-IT/.../GAME_UNO1.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...scbase8300.cab O16 - DPF: {639658F3-B141-4D6B-B936-226F75A5EAC3} (CPlayFirstDinerDash2Control Object) - http://www.shockwave.com/content/din...2.1.0.0.67.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.shockwave.com/content/bon...loader_v10.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{EAEDCAE5-A6B4-48CD-8073-604F250CB50A}: NameServer = 193.70.152.15 193.70.152.25 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O20 - Winlogon Notify: geebb - D:\WINDOWS\system32\geebb.dll O20 - Winlogon Notify: urqpqqq - D:\WINDOWS\SYSTEM32\urqpqqq.dll O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - D:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\WINDOWS\system32\browseui.dll O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - D:\Programmi\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Programmi\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - D:\Programmi\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Programmi\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - D:\Programmi\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - D:\Programmi\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe O23 - Service: Google Updater Service (gusvc) - Google - D:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NBService - Nero AG - D:\Programmi\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - D:\Programmi\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - D:\Programmi\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - D:\WINDOWS\system32\HPZipm12.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - D:\Programmi\CyberLink\Shared files\RichVideo.exe O23 - Service: Roxio UPnP Renderer 9 - Unknown owner - D:\Programmi\File comuni\Sonic Shared\RoxioUPnPRenderer9.exe (file missing) O23 - Service: Roxio Upnp Server 9 - Unknown owner - D:\Programmi\File comuni\Sonic Shared\RoxioUpnpService9.exe (file missing) O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - D:\Programmi\File comuni\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing) O23 - Service: SQLAgent$PINNACLESYS - Unknown owner - D:\Programmi\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlagent.EXE (file missing) O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: stllssvr - Unknown owner - D:\Programmi\File comuni\SureThing Shared\stllssvr.exe (file missing) O23 - Service: Washer Security Access (wwSecSvc) - Webroot Software, Inc. - D:\WINDOWS\system32\wwSecure.exe -- End of file - 14771 bytes Cosa devo eliminare?Rispondetemi al + presto.Grazie |
|
|
|
20-04-2007, 22:13
|
#2 |
|
Senior Member
Iscritto dal: Oct 2004
Città: Milano
Messaggi: 2641
|
Ciao,
per questo tipo di problemi c'è una sezione apposita del forum, Aiuto sono infetto cosa faccio http://www.hwupgrade.it/forum/forumd...ysprune=&f=125 comunque, in attesa che la discussione venga spostata, incomincia a fare queste operazioni: apri hijackthis e vai in Open the misc tool section>open process manager, seleziona se presente questa voce: D:\DOCUME~1\Nino\IMPOST~1\Temp\62exinjs.a6.exe e premi il pulsante kill process poi clicca su back e su scan, spunta la casellina a fianco a queste voci e premi il pulsante fixchecked: O2 - BHO: (no name) - {1557B435-8242-4686-9AA3-9265BF7525A4} - D:\WINDOWS\system32\iuamqdnf.dll O2 - BHO: (no name) - {2EDB63B7-7432-42B8-B484-B7DE2779F848} - D:\WINDOWS\system32\urqpqqq.dll O2 - BHO: (no name) - {CAC5F578-24AF-47D0-8B58-B10AB1FD035A} - D:\WINDOWS\system32\geebb.dll O2 - BHO: (no name) - {E7C6D560-347D-498D-A0A9-06D55E61EC81} - D:\WINDOWS\system32\uklothsd.dll O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [.nvsvc] D:\WINDOWS\system\smss.exe /w O16 - DPF: {1230CB21-C88D-11CF-0000-000000000000} - http://www.browserupdate.net/cabs/cu...oader-3832.cab O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://www.visualbasicpoint.net/stre...ript/TVUAx.cab O16 - DPF: {639658F3-B141-4D6B-B936-226F75A5EAC3} (CPlayFirstDinerDash2Control Object) - http://www.shockwave.com/content/din...2.1.0.0.67.cab O20 - Winlogon Notify: geebb - D:\WINDOWS\system32\geebb.dll Scarica killbox http://www.wintricks.it/news2/article.php?ID=12000 e vundofix http://www.atribune.org/ccount/click.php?id=4 Apri killbox inserisci all'interno della stringa bianca questo percorso D:\DOCUME~1\Nino\IMPOST~1\Temp\62exinjs.a6.exe metti la spunta alla voce "Delete on Reboot", clicca sul bottone con una X bianca a sfondo rosso. Ripeti la stessa operazione, inserendo uno alla volta questi percorsi: D:\WINDOWS\system32\iuamqdnf.dll D:\WINDOWS\system32\urqpqqq.dll D:\WINDOWS\system32\geebb.dll D:\WINDOWS\system32\uklothsd.dll Poi apri VundoFix.exe Metti una spunta su Run VundoFix as a task. Quando appare nuovamente VundoFix, fai click su OK Clicca sul bottone Scan for Vundo. Quando la scansione è terminata, fai click su Remove Vundo. Una finestra ti chiederà se vuoi rimuovere i file, clicca su YES. A rimozione completata, VundoFix ti chiederà di spegnere il PC. clicca su OK. Riavviato il PC fai un paio di scansioni con questi software http://www.ewido.net/en/download/ http://www.superantispyware.com/download.html (di superantispyware scarica la versione free edition). Alla fine del tutto facci sapere i risultati ed eventualmente posta un nuovo log di hijackthis.
__________________
FOXYLADY è un MASCHIO!! Un amico è una persona che sa tutto di te e nonostante questo gli piaci |
|
|
|
|
21-04-2007, 12:39
|
#3 |
|
Senior Member
Iscritto dal: Feb 2007
Città: Spira, Zanarkand
Messaggi: 394
|
Questo:
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE fa parte dei driver audio Realtek. E' comunque uno spyware ma non pericoloso. Sta a te decidere se cancellarlo o no. |
|
|
|
|
21-04-2007, 13:31
|
#4 |
|
Member
Iscritto dal: Apr 2007
Città: Bari
Messaggi: 31
|
Ho fatto tt qll ke mi avevate kiesto.Ora perfavora controllate il log di hijackthis dopo le operazioni:Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 14.30.54, on 21/04/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\Programmi\Alwil Software\Avast4\aswUpdSv.exe D:\Programmi\Alwil Software\Avast4\ashServ.exe D:\WINDOWS\system32\spoolsv.exe D:\Programmi\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe D:\Programmi\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe D:\Programmi\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe D:\WINDOWS\system32\nvsvc32.exe D:\Programmi\CyberLink\Shared files\RichVideo.exe D:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe D:\WINDOWS\system32\svchost.exe D:\Programmi\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe D:\WINDOWS\system32\wwSecure.exe D:\Programmi\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe D:\Programmi\Alwil Software\Avast4\ashMaiSv.exe D:\Programmi\Alwil Software\Avast4\ashWebSv.exe D:\PROGRA~1\FILECO~1\Stardock\SDMCP.exe D:\WINDOWS\system32\wscntfy.exe D:\WINDOWS\Explorer.EXE D:\WINDOWS\RTHDCPL.EXE D:\Programmi\Trust\Trust MD3100 USB ADSL MODEM\CnxDslTb.exe D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe D:\Programmi\File comuni\Real\Update_OB\realsched.exe D:\Programmi\Adobe\Photoshop Elements 4.0\apdproxy.exe D:\Programmi\eBay\eBay Toolbar2\eBayTBDaemon.exe D:\WINDOWS\system32\rundll32.exe D:\Programmi\CyberLink\PowerDVD\PDVDServ.exe D:\Programmi\TopDesk\topdesk.exe D:\WINDOWS\system32\ctfmon.exe D:\Programmi\Messenger\msmsgs.exe D:\Programmi\VisualTaskTips\VisualTaskTips.exe D:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe D:\Programmi\Thoosje Vista Sidebar v1.7.8\thoosje's sidebar.exe D:\Programmi\Mozilla Firefox\firefox.exe D:\Documents and Settings\Nino\Desktop\HiJackThis_v2.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.libero.it/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti R3 - URLSearchHook: Coolstreaming Tool-Bar v1.0 Toolbar - {bd0e4d83-654e-4213-965b-fcbe887061f4} - D:\Programmi\Coolstreaming_Tool-Bar_v1.0\tbCoo1.dll O2 - BHO: (no name) - {2EDB63B7-7432-42B8-B484-B7DE2779F848} - D:\WINDOWS\system32\urqpqqq.dll O3 - Toolbar: Encarta Web Companion - {147D6308-0614-4112-89B1-31402F9B82C4} - D:\Programmi\File comuni\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\programmi\google\googletoolbar3.dll O3 - Toolbar: Coolstreaming Tool-Bar v1.0 Toolbar - {bd0e4d83-654e-4213-965b-fcbe887061f4} - D:\Programmi\Coolstreaming_Tool-Bar_v1.0\tbCoo1.dll O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - D:\Programmi\eBay\eBay Toolbar2\eBayTB.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [CnxDslTaskBar] "D:\Programmi\Trust\Trust MD3100 USB ADSL MODEM\CnxDslTb.exe" O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [TkBellExe] "D:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Adobe Photo Downloader] "D:\Programmi\Adobe\Photoshop Elements 4.0\apdproxy.exe" O4 - HKLM\..\Run: [QuickTime Task] "D:\Programmi\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [eBayToolbar] D:\Programmi\eBay\eBay Toolbar2\eBayTBDaemon.exe O4 - HKLM\..\Run: [PinnacleDriverCheck] D:\WINDOWS\system32\PSDrvCheck.exe -CheckReg O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [LWBMOUSE] D:\Programmi\Browser Mouse\mouse32a.exe O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] D:\Programmi\Browser Mouse\moffice.exe O4 - HKLM\..\Run: [RemoteControl] D:\Programmi\CyberLink\PowerDVD\PDVDServ.exe O4 - HKLM\..\Run: [LanguageShortcut] D:\Programmi\CyberLink\PowerDVD\Language\Language.exe O4 - HKLM\..\Run: [TopDesk] D:\Programmi\TopDesk\topdesk.exe O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "D:\Programmi\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [VisualTaskTips] D:\Programmi\VisualTaskTips\VisualTaskTips.exe O4 - HKCU\..\Run: [SUPERAntiSpyware] D:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: thoosje's sidebar.lnk = D:\Programmi\Thoosje Vista Sidebar v1.7.8\thoosje's sidebar.exe O8 - Extra context menu item: &eBay Search - res://D:\Programmi\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html O8 - Extra context menu item: E&sporta in Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programmi\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programmi\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: I&nvia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Barra di ricerca di Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - D:\Programmi\File comuni\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/...x/qtplugin.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {49A3DCEE-FC3C-11D4-83E5-0050DA33C619} (BVXPlayer Class) - http://digilander.libero.it/face4us/xplayer/xplayer.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://mic1992italy.spaces.live.com/...d/MsnPUpld.cab O16 - DPF: {5CD4310E-88FB-43C1-BE24-5F3FA9C5C9D1} (KooPlayer Control) - http://www.coolstreaming.us/consolle.../KooPlayer.ocx O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/IT-IT/.../GAME_UNO1.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...scbase8300.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.shockwave.com/content/bon...loader_v10.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{EAEDCAE5-A6B4-48CD-8073-604F250CB50A}: NameServer = 193.70.152.15 193.70.152.25 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O20 - Winlogon Notify: !SASWinLogon - D:\Programmi\SUPERAntiSpyware\SASWINLO.dll O20 - Winlogon Notify: urqpqqq - D:\WINDOWS\SYSTEM32\urqpqqq.dll O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - D:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\WINDOWS\system32\browseui.dll O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - D:\Programmi\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Programmi\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - D:\Programmi\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Programmi\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - D:\Programmi\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - D:\Programmi\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe O23 - Service: Google Updater Service (gusvc) - Google - D:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NBService - Nero AG - D:\Programmi\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - D:\Programmi\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - D:\Programmi\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - D:\WINDOWS\system32\HPZipm12.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - D:\Programmi\CyberLink\Shared files\RichVideo.exe O23 - Service: Roxio UPnP Renderer 9 - Unknown owner - D:\Programmi\File comuni\Sonic Shared\RoxioUPnPRenderer9.exe (file missing) O23 - Service: Roxio Upnp Server 9 - Unknown owner - D:\Programmi\File comuni\Sonic Shared\RoxioUpnpService9.exe (file missing) O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - D:\Programmi\File comuni\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing) O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: stllssvr - Unknown owner - D:\Programmi\File comuni\SureThing Shared\stllssvr.exe (file missing) O23 - Service: Washer Security Access (wwSecSvc) - Webroot Software, Inc. - D:\WINDOWS\system32\wwSecure.exe -- End of file - 11984 bytes |
|
|
|
|
21-04-2007, 15:44
|
#5 |
|
Senior Member
Iscritto dal: Feb 2007
Città: Spira, Zanarkand
Messaggi: 394
|
Questi però mi puzzano ancora...
O2 - BHO: (no name) - {2EDB63B7-7432-42B8-B484-B7DE2779F848} - D:\WINDOWS\system32\urqpqqq.dll O20 - Winlogon Notify: urqpqqq - D:\WINDOWS\SYSTEM32\urqpqqq.dll Su google non trovo niente..... penso che sia qualche malware... |
|
|
|
|
21-04-2007, 15:52
|
#6 |
|
Senior Member
Iscritto dal: Feb 2006
Città: Perugia
Messaggi: 1340
|
io farei qualche bella scansione con antirootkit, antispyware. prova a-squared free e bitdefender 8 free edition
|
|
|
|
|
21-04-2007, 16:28
|
#7 | |
|
Senior Member
Iscritto dal: Aug 2005
Città: Genova
Messaggi: 3397
|
Quote:
__________________
Rimozione Worm/Rootkit Bagle - Rimozione Trojan Vundo - Rimozione virus MSN Messenger -Rimozione virus su chiavetta o errori di file mancante all'apertura del disco fisso - NT AUTHORITY SYSTEM spegne il pc ad ogni avvio. Cosa fare?(worm sasser/blaster/rustock) - Thread Ufficiale firewall software |
|
|
|
|
|
21-04-2007, 21:02
|
#8 |
|
Senior Member
Iscritto dal: Dec 2006
Città: Barletta (BA)
Messaggi: 579
|
mi insospettisce anke SkyTel.exe
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
__________________
Non permettere MAI a nessuno di dirti che non sai fare nulla....se hai un sogno, uno scopo, un obiettivo, devi inseguirlo; solo così potrai ottenere la felicità (dal film "alla ricerca della felicità) |
|
|
|
|
22-04-2007, 09:13
|
#9 | |
|
Senior Member
Iscritto dal: Feb 2007
Città: Spira, Zanarkand
Messaggi: 394
|
Quote:
|
|
|
|
|
|
22-04-2007, 09:47
|
#10 |
|
Senior Member
Iscritto dal: Jul 2005
Città: Sardigna
Messaggi: 11505
|
D:\DOCUME~1\Nino\IMPOST~1\Temp\62exinjs.a6.exe
a me non convince questo già il fatto che stia in una cartella temporanea e il nome fanno pensare che si tratti di uno spyware o di un dialer comunque, per i popup verifica che su explorer e firefox sia attivo il blocco popup |
|
|
|
|
22-04-2007, 11:58
|
#11 | |
|
Senior Member
Iscritto dal: Feb 2007
Città: Spira, Zanarkand
Messaggi: 394
|
Quote:
|
|
|
|
|
|
22-04-2007, 12:00
|
#12 | ||
|
Senior Member
Iscritto dal: Nov 2006
Messaggi: 1886
|
Quote:
Quote:
Se presti attenzione allo storico dei logfile, ti accorgerai che il file : D:\DOCUME~1\Nino\IMPOST~1\Temp\62exinjs.a6.exe che non ti convince, era presente solo nel primo logfile di HJT, ma che già nel secondo logfile, quell'exe non compare più, perchè giustamente FOXYLADY -che sa perfettamente quello che fà, ed è uno dei pochi - aveva suggerito all'utente come eliminare con efficacia quell'exe, con un approccio integrato tra la funzione "Process manager di HJT", e l'uso di Killbox. ciao!!! Ultima modifica di ania : 22-04-2007 alle 12:04. |
||
|
|
|
|
22-04-2007, 14:50
|
#13 | |
|
Senior Member
Iscritto dal: Oct 2004
Città: Milano
Messaggi: 2641
|
Quote:
D:\WINDOWS\system32\urqpqqq.dll prova usando avenger http://swandog46.geekstogo.com/avenger.zip dopo averlo decompresso, avvia il file avenger.exe Seleziona l'opzione Input Script Manually e clicca sulla lente d'ingrandimento Ti si apre una finestra "View/edit script" All'interno del box bianco, copi e incolli Files to delete: D:\WINDOWS\system32\urqpqqq.dll clicca sul pulsante Done Clicca sull'icona del semaforo verde Rispondi Yes Il pc dovrebbe riavviarsi da solo,se così non fosse riavvialo manualmente Poi ti consiglio anch'io di fare un controllo antirootkit, con gmer o altro programma. Ciao
__________________
FOXYLADY è un MASCHIO!! Un amico è una persona che sa tutto di te e nonostante questo gli piaci |
|
|
|
|
|
22-04-2007, 22:25
|
#14 |
|
Member
Iscritto dal: Apr 2007
Città: Bari
Messaggi: 31
|
Ho cancellato anke quell'ultimo file citato da foxylady e grazie mille x i consigli.Ecco il mio ultimo log di hijackthis:Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 23.25.23, on 22/04/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\Programmi\Alwil Software\Avast4\aswUpdSv.exe D:\Programmi\Alwil Software\Avast4\ashServ.exe D:\WINDOWS\system32\spoolsv.exe D:\Programmi\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe D:\Programmi\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe D:\Programmi\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe D:\WINDOWS\system32\nvsvc32.exe D:\Programmi\CyberLink\Shared files\RichVideo.exe D:\Programmi\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe D:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\system32\wwSecure.exe D:\Programmi\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe D:\Programmi\Alwil Software\Avast4\ashMaiSv.exe D:\Programmi\Alwil Software\Avast4\ashWebSv.exe D:\PROGRA~1\FILECO~1\Stardock\SDMCP.exe D:\WINDOWS\system32\wscntfy.exe D:\WINDOWS\Explorer.EXE D:\WINDOWS\RTHDCPL.EXE D:\Programmi\Trust\Trust MD3100 USB ADSL MODEM\CnxDslTb.exe D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe D:\Programmi\File comuni\Real\Update_OB\realsched.exe D:\Programmi\eBay\eBay Toolbar2\eBayTBDaemon.exe D:\WINDOWS\system32\rundll32.exe D:\Programmi\CyberLink\PowerDVD\PDVDServ.exe D:\Programmi\TopDesk\topdesk.exe D:\WINDOWS\system32\ctfmon.exe D:\Programmi\Messenger\msmsgs.exe D:\Programmi\VisualTaskTips\VisualTaskTips.exe D:\Programmi\Mozilla Firefox\firefox.exe D:\Documents and Settings\Nino\Desktop\HiJackThis_v2.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.libero.it/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti R3 - URLSearchHook: Coolstreaming Tool-Bar v1.0 Toolbar - {bd0e4d83-654e-4213-965b-fcbe887061f4} - D:\Programmi\Coolstreaming_Tool-Bar_v1.0\tbCoo1.dll O2 - BHO: (no name) - {2EDB63B7-7432-42B8-B484-B7DE2779F848} - D:\WINDOWS\system32\urqpqqq.dll (file missing) O3 - Toolbar: Encarta Web Companion - {147D6308-0614-4112-89B1-31402F9B82C4} - D:\Programmi\File comuni\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\programmi\google\googletoolbar3.dll O3 - Toolbar: Coolstreaming Tool-Bar v1.0 Toolbar - {bd0e4d83-654e-4213-965b-fcbe887061f4} - D:\Programmi\Coolstreaming_Tool-Bar_v1.0\tbCoo1.dll O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - D:\Programmi\eBay\eBay Toolbar2\eBayTB.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [CnxDslTaskBar] "D:\Programmi\Trust\Trust MD3100 USB ADSL MODEM\CnxDslTb.exe" O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [TkBellExe] "D:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Adobe Photo Downloader] "D:\Programmi\Adobe\Photoshop Elements 4.0\apdproxy.exe" O4 - HKLM\..\Run: [QuickTime Task] "D:\Programmi\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [eBayToolbar] D:\Programmi\eBay\eBay Toolbar2\eBayTBDaemon.exe O4 - HKLM\..\Run: [PinnacleDriverCheck] D:\WINDOWS\system32\PSDrvCheck.exe -CheckReg O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [LWBMOUSE] D:\Programmi\Browser Mouse\mouse32a.exe O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] D:\Programmi\Browser Mouse\moffice.exe O4 - HKLM\..\Run: [RemoteControl] D:\Programmi\CyberLink\PowerDVD\PDVDServ.exe O4 - HKLM\..\Run: [LanguageShortcut] D:\Programmi\CyberLink\PowerDVD\Language\Language.exe O4 - HKLM\..\Run: [TopDesk] D:\Programmi\TopDesk\topdesk.exe O4 - HKLM\..\Run: [UnlockerAssistant] "D:\Programmi\Unlocker\UnlockerAssistant.exe" O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "D:\Programmi\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [VisualTaskTips] D:\Programmi\VisualTaskTips\VisualTaskTips.exe O4 - HKCU\..\Run: [SUPERAntiSpyware] D:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &eBay Search - res://D:\Programmi\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html O8 - Extra context menu item: E&sporta in Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programmi\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programmi\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: I&nvia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Barra di ricerca di Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - D:\Programmi\File comuni\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/...x/qtplugin.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {49A3DCEE-FC3C-11D4-83E5-0050DA33C619} (BVXPlayer Class) - http://digilander.libero.it/face4us/xplayer/xplayer.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://mic1992italy.spaces.live.com/...d/MsnPUpld.cab O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (Installer Class) - http://www.nanoscan.com/as/v1/cabs/ascinstie.cab O16 - DPF: {5CD4310E-88FB-43C1-BE24-5F3FA9C5C9D1} (KooPlayer Control) - http://www.coolstreaming.us/consolle.../KooPlayer.ocx O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/IT-IT/.../GAME_UNO1.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...scbase8300.cab O16 - DPF: {8436FE12-31DB-48BF-83BF-FE682F9160B4} (NanoInstaller Class) - http://www.nanoscan.com/cabs/nanoinst.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.shockwave.com/content/bon...loader_v10.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{EAEDCAE5-A6B4-48CD-8073-604F250CB50A}: NameServer = 193.70.152.15 193.70.152.25 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O20 - Winlogon Notify: !SASWinLogon - D:\Programmi\SUPERAntiSpyware\SASWINLO.dll O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - D:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\WINDOWS\system32\browseui.dll O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - D:\Programmi\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Programmi\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - D:\Programmi\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Programmi\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - D:\Programmi\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - D:\Programmi\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe O23 - Service: Google Updater Service (gusvc) - Google - D:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NBService - Nero AG - D:\Programmi\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - D:\Programmi\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - D:\Programmi\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - D:\WINDOWS\system32\HPZipm12.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - D:\Programmi\CyberLink\Shared files\RichVideo.exe O23 - Service: Roxio UPnP Renderer 9 - Unknown owner - D:\Programmi\File comuni\Sonic Shared\RoxioUPnPRenderer9.exe (file missing) O23 - Service: Roxio Upnp Server 9 - Unknown owner - D:\Programmi\File comuni\Sonic Shared\RoxioUpnpService9.exe (file missing) O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - D:\Programmi\File comuni\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing) O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: stllssvr - Unknown owner - D:\Programmi\File comuni\SureThing Shared\stllssvr.exe (file missing) O23 - Service: Washer Security Access (wwSecSvc) - Webroot Software, Inc. - D:\WINDOWS\system32\wwSecure.exe -- End of file - 11940 bytes |
|
|
|
|
22-04-2007, 22:34
|
#15 |
|
Senior Member
Iscritto dal: Oct 2004
Città: Milano
Messaggi: 2641
|
Fixa questa, poi dovresti essere a posto
O2 - BHO: (no name) - {2EDB63B7-7432-42B8-B484-B7DE2779F848} - D:\WINDOWS\system32\urqpqqq.dll (file missing)
__________________
FOXYLADY è un MASCHIO!! Un amico è una persona che sa tutto di te e nonostante questo gli piaci |
|
|
|
|
22-04-2007, 22:39
|
#16 |
|
Member
Iscritto dal: Apr 2007
Città: Bari
Messaggi: 31
|
Ok.Grazie di tutto.
|
|
|
|
|
23-04-2007, 19:20
|
#17 |
|
Member
Iscritto dal: Sep 2005
Città: Cagliari
Messaggi: 104
|
Anche io ho lo stesso problema di finestre che siaprono da sole, drivecleaner malefici e roba del genere. Posto il mo log, potete per favore aiutarmi a capire cosa devo eliminare?
C:\WINDOWS\system32\jkklkjj.dll Questo l'ho già riconosciuto essere un file da eliminare, ma non riesco a rimuoverlo in nessun modo!! Ho già scaricato tutti i programmi elencati sopra. Grazie  Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 20.15.30, on 23/04/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Programmi\Comodo\Firewall\CPF.exe C:\PROGRA~1\AVG\avgcc.exe C:\WINDOWS\system32\ctfmon.exe C:\Programmi\RocketDock\RocketDock.exe C:\PROGRA~1\AVG\avgamsvr.exe C:\PROGRA~1\AVG\avgupsvc.exe C:\PROGRA~1\AVG\avgemc.exe C:\Programmi\Comodo\Firewall\cmdagent.exe C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe C:\Programmi\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe C:\WINDOWS\system32\svchost.exe C:\Programmi\Mozilla Firefox\firefox.exe C:\Programmi\MSN Messenger\msnmsgr.exe C:\Programmi\MSN Messenger\usnsvc.exe C:\Programmi\eMule\emule.exe C:\Documents and Settings\Alex\Desktop\HiJackThis_v2.exe C:\Programmi\Prevx1\PXConsole.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.virgilio.it/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1557B435-8242-4686-9AA3-9265BF7525A4} - (no file) O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Programmi\BitComet\tools\BitCometBHO_1.1.2.7.dll O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Dati applicazioni\Prevx\pxbho.dll O2 - BHO: (no name) - {719A5B25-863B-4FF1-8F0B-5758BF885DDF} - C:\WINDOWS\system32\ssttu.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_11\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: (no name) - {9D7EF71F-92F4-4E1E-93DE-E21436E4C815} - C:\WINDOWS\system32\jkklkjj.dll O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Programmi\Comodo\Firewall\CPF.exe" /background O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\AVG\avgcc.exe /STARTUP O4 - HKLM\..\Run: [PrevxOne] "C:\Programmi\Prevx1\PXConsole.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Rocket Dock] C:\\Programmi\\RocketDock\\RocketDock.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE') O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\AVG\avgw.exe /RUNONCE (User 'SERVIZIO LOCALE') O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVIZIO LOCALE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVIZIO DI RETE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user') O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...n.cab56986.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{157F5741-4EF7-4269-B58E-D29D9D991CE8}: NameServer = 151.99.125.1,151.99.0.100 O17 - HKLM\System\CS1\Services\Tcpip\..\{157F5741-4EF7-4269-B58E-D29D9D991CE8}: NameServer = 151.99.125.1,151.99.0.100 O17 - HKLM\System\CS2\Services\Tcpip\..\{157F5741-4EF7-4269-B58E-D29D9D991CE8}: NameServer = 151.99.125.1,151.99.0.100 O20 - Winlogon Notify: jkklkjj - C:\WINDOWS\SYSTEM32\jkklkjj.dll O20 - Winlogon Notify: ssttu - C:\WINDOWS\system32\ssttu.dll O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\AVG\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\AVG\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\AVG\avgemc.exe O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Programmi\Comodo\Firewall\cmdagent.exe O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - Unknown owner - C:\MAGIX\Common\Database\bin\fbserver.exe (file missing) O23 - Service: Prevx Agent (PREVXAgent) - Prevx - C:\Programmi\Prevx1\PXAgent.exe O23 - Service: ServiceLayer - Nokia. - C:\Programmi\PC Connectivity Solution\ServiceLayer.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Programmi\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe -- End of file - 7545 bytes |
|
|
|
|
23-04-2007, 22:30
|
#18 | ||
|
Senior Member
Iscritto dal: Nov 2001
Città: Fidenza(pr) da Trento
Messaggi: 27479
|
Quote:
esisteva anche un tool creato da symantec per fare piazza pulita se non erro.. poi con l'auto di www.virustotal.com scansiona i seguenti file: Quote:
__________________
"Visti da vicino siamo tutti strani..." ~|~ What Defines a Community? ~|~ Thread eMule Ufficiale ~|~ Online Armor in Italiano ~|~ Regole di Sezione ~|► Guida a PrivateFirewall
|
||
|
|
|
|
23-04-2007, 22:37
|
#19 |
|
Senior Member
Iscritto dal: Oct 2004
Città: Milano
Messaggi: 2641
|
Fixa queste
O2 - BHO: (no name) - {1557B435-8242-4686-9AA3-9265BF7525A4} - (no file) O2 - BHO: (no name) - {719A5B25-863B-4FF1-8F0B-5758BF885DDF} - C:\WINDOWS\system32\ssttu.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: (no name) - {9D7EF71F-92F4-4E1E-93DE-E21436E4C815} - C:\WINDOWS\system32\jkklkjj.dll O20 - Winlogon Notify: jkklkjj - C:\WINDOWS\SYSTEM32\jkklkjj.dll O20 - Winlogon Notify: ssttu - C:\WINDOWS\system32\ssttu.dll ed esegui vundofix seguendo le istruzioni che ho dato sopra.
__________________
FOXYLADY è un MASCHIO!! Un amico è una persona che sa tutto di te e nonostante questo gli piaci |
|
|
|
|
23-04-2007, 22:39
|
#20 | |
|
Senior Member
Iscritto dal: Nov 2006
Messaggi: 1886
|
Quote:
NON vanno cancellati perchè è soltanto a causa di un bug di Hijack This che vengono segnalati come file missing ciao!!!
|
|
|
|
|
|
|
| Strumenti | |
|
|
Tutti gli orari sono GMT +1. Ora sono le: 20:27.
