|
|||||||
|
|
|
 |
|
|
Strumenti |
19-06-2007, 17:27
|
#1 |
|
Junior Member
Iscritto dal: Jul 2005
Messaggi: 9
|
Aiuto rimozione yazzle
ciao a tutti ho un problema, panda non riesce a togliermi questo adware: yazzle, qualcuno sa aiutarmi? non so più cosa fare vi posto il mio log
Logfile of HijackThis v1.99.1 Scan saved at 9.21.24, on 19/06/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\Programmi\Panda Software\Panda Internet Security 2007\pavsrv51.exe C:\Programmi\Panda Software\Panda Internet Security 2007\AVENGINE.EXE C:\WINDOWS\system32\svchost.exe C:\Programmi\Panda Software\Panda Internet Security 2007\TPSrv.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Programmi\Panda Software\Panda Internet Security 2007\PsCtrlS.exe C:\Programmi\Panda Software\Panda Internet Security 2007\PavFnSvr.exe C:\Programmi\File comuni\Panda Software\PavShld\pavprsrv.exe C:\Programmi\Panda Software\Panda Internet Security 2007\AntiSpam\pskmssvc.exe c:\programmi\panda software\panda internet security 2007\firewall\PSHOST.EXE C:\Programmi\Panda Software\Panda Internet Security 2007\PsImSvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\WFXSVC.EXE C:\Programmi\Symantec\WinFax\WFXMOD32.EXE C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\AGRSMMSG.exe C:\Programmi\Synaptics\SynTP\SynTPLpr.exe C:\Programmi\Synaptics\SynTP\SynTPEnh.exe C:\PROGRA~1\LAUNCH~1\CPLFL32.EXE C:\Programmi\CRW\shwicon.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Programmi\Panda Software\Panda Internet Security 2007\APVXDWIN.EXE C:\WINDOWS\system32\ctfmon.exe C:\Programmi\MSN Messenger\msnmsgr.exe C:\Programmi\Microsoft ActiveSync\wcescomm.exe C:\PROGRA~1\MICROS~3\rapimgr.exe C:\Programmi\Microsoft Office\OFFICE11\OUTLOOK.EXE C:\WINDOWS\system32\wuauclt.exe C:\Programmi\Panda Software\Panda Internet Security 2007\SRVLOAD.EXE C:\Programmi\Panda Software\Panda Internet Security 2007\WebProxy.exe C:\Programmi\Sony Ericsson\Mobile4\Sync Manager\syncindicator.exe C:\Programmi\Microsoft Office\OFFICE11\WINWORD.EXE C:\Programmi\Symantec\WinFax\wfxctl32.exe C:\Programmi\eMule\emule.exe C:\PROGRA~1\MACROM~1\FLASH8~2\flash.exe C:\Programmi\Macromedia\Dreamweaver 8\Dreamweaver.exe C:\WINDOWS\SYSTEM32\taskmgr.exe C:\Programmi\File comuni\Real\Update_OB\realsched.exe C:\Programmi\Internet Explorer\iexplore.exe C:\Programmi\FlashGet\flashget.exe C:\Documents and Settings\Junior\Desktop\hijackthis\HijackThis.exe C:\Programmi\Panda Software\Panda Internet Security 2007\psimreal.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Programmi\FlashGet\jccatch.dll O2 - BHO: (no name) - {5ADF3862-9E2E-4ad3-86F7-4510E6550CD0} - C:\WINDOWS\system32\serwivfq.dll (file missing) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: (no name) - {E41AB587-52A8-4364-96E1-A967C8F713DB} - C:\WINDOWS\system32\awtsr.dll (file missing) O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Programmi\FlashGet\getflash.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Programmi\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\CPLFL32.EXE O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [ShowIcon_Chander_CRW Series Driver v1.17r019] C:\Programmi\CRW\shwicon.exe -t"Chander\CRW Series Driver v1.17r019" O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [APVXDWIN] "C:\Programmi\Panda Software\Panda Internet Security 2007\APVXDWIN.EXE" /s O4 - HKLM\..\Run: [SCANINICIO] "C:\Programmi\Panda Software\Panda Internet Security 2007\Inicio.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Programmi\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programmi\Microsoft ActiveSync\wcescomm.exe" O4 - Startup: .lnk = ? O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: &Scarica con FlashGet - C:\Programmi\FlashGet\jc_link.htm O8 - Extra context menu item: &Scarica tutto con FlashGet - C:\Programmi\FlashGet\jc_all.htm O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Sothink SWF Catcher - C:\Programmi\File comuni\SourceTec\SWF Catcher\InternetExplorer.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra 'Tools' menuitem: Crea preferiti portatile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Programmi\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Programmi\FlashGet\FlashGet.exe O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Programmi\File comuni\SourceTec\SWF Catcher\InternetExplorer.htm O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Programmi\File comuni\SourceTec\SWF Catcher\InternetExplorer.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1107429676453 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/ms...downloader.cab O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://engine.netanday.it/ajax_webcam/codec/AMC.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll O20 - Winlogon Notify: awtsr - C:\WINDOWS\system32\awtsr.dll (file missing) O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: qomkiii - qomkiii.dll (file missing) O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O20 - Winlogon Notify: winosz32 - winosz32.dll (file missing) O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: Panda Software Controller - Panda Software International - C:\Programmi\Panda Software\Panda Internet Security 2007\PsCtrlS.exe O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Programmi\Panda Software\Panda Internet Security 2007\PavFnSvr.exe O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software International - C:\Programmi\File comuni\Panda Software\PavShld\pavprsrv.exe O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Programmi\Panda Software\Panda Internet Security 2007\pavsrv51.exe O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Programmi\Panda Software\Panda Internet Security 2007\AntiSpam\pskmssvc.exe O23 - Service: Panda Host Service (PSHost) - Panda Software International - c:\programmi\panda software\panda internet security 2007\firewall\PSHOST.EXE O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Programmi\Panda Software\Panda Internet Security 2007\PsImSvc.exe O23 - Service: Panda TPSrv (TPSrv) - Panda Software International - C:\Programmi\Panda Software\Panda Internet Security 2007\TPSrv.exe O23 - Service: WinFax PRO (wfxsvc) - Symantec Corporation - C:\WINDOWS\system32\WFXSVC.EXE |
|
|
|
19-06-2007, 17:39
|
#2 |
|
Senior Member
Iscritto dal: Feb 2007
Città: Spira, Zanarkand
Messaggi: 394
|
Fixa
O2 - BHO: (no name) - {5ADF3862-9E2E-4ad3-86F7-4510E6550CD0} - C:\WINDOWS\system32\serwivfq.dll (file missing) O2 - BHO: (no name) - {E41AB587-52A8-4364-96E1-A967C8F713DB} - C:\WINDOWS\system32\awtsr.dll (file missing) O20 - Winlogon Notify: awtsr - C:\WINDOWS\system32\awtsr.dll (file missing) O20 - Winlogon Notify: qomkiii - qomkiii.dll (file missing) O20 - Winlogon Notify: winosz32 - winosz32.dll (file missing) Sono tutti file missing... ti ho detto di toglierli xke probabilmente sono residui del malware...ma dal log sembra che i file siano già stati rimossi... |
|
|
|
|
19-06-2007, 19:29
|
#3 |
|
Junior Member
Iscritto dal: Jul 2005
Messaggi: 9
|
ho fixato come mi hai consigliato ma da una nuova scansione esce ancora quel bast.....
|
|
|
|
|
19-06-2007, 21:02
|
#4 | |
|
Senior Member
Iscritto dal: Feb 2007
Città: Spira, Zanarkand
Messaggi: 394
|
Quote:
|
|
|
|
|
|
19-06-2007, 21:43
|
#5 |
|
Junior Member
Iscritto dal: Jul 2005
Messaggi: 9
|
ok la stringa è questa:
Rilevato adware: Adware/Yazzle Analisi antivirus immediata 06/16/07 10:56:53 Informato Percorso: C:\Recycled\Dc14711.tmp[¦++\Yazzle116OinAdmin.exe] |
|
|
|
|
19-06-2007, 21:57
|
#6 |
|
Senior Member
Iscritto dal: Feb 2007
Città: Spira, Zanarkand
Messaggi: 394
|
Praticamente è nel cestino?
Prova ad usare avenger (scaricalo da qui: CLICCA) Poi avvialo, clicca Input script manually, poi la lente di ingrandimento, copia questo script: Files to delete: C:\Recycled\Dc14711.tmp Clicca Done, poi sul semaforo e avenger ti chiede di riavviare il pc. Quando si riavvia non ci dovrebbe essere più, quindi rifai la scan e vedi se te lo rileva ancora. |
|
|
|
|
20-06-2007, 07:50
|
#7 |
|
Junior Member
Iscritto dal: Jul 2005
Messaggi: 9
|
niente da fare questa è la risposta
 Error: selected file does not appear to be a valid script. Error code: 0 |
|
|
|
|
20-06-2007, 09:58
|
#8 |
|
Senior Member
Iscritto dal: Apr 2006
Messaggi: 22462
|
scusa un attimo; ma svuotare il cestino in modalità provvisoria con system restore dusabilitato?
__________________
amd a64x2 4400+ sk939;asus a8n-sli; 2x1gb ddr400; x850 crossfire; 2 x western digital abys 320gb|| asus g1
Se striscia fulmina, se svolazza l'ammazza |
|
|
|
|
|
| Strumenti | |
|
|
Tutti gli orari sono GMT +1. Ora sono le: 20:04.
