|
|||||||
|
|
|
 |
|
|
Strumenti |
14-11-2005, 20:37
|
#1 |
|
Member
Iscritto dal: Oct 2005
Messaggi: 84
|
...problemi con secure32.html !!!
salve a tutti!
il mio problema è che al posto della pagina iniziale di internet che avevo impostato precedentemente(ovvero quella di google),adesso esce una schermata blu con scritto in bianco il seguente messaggio: Detected SPYware! System error #384 __________________________________________________________________________ Your IP address is 84.221.0.215. Using this address a remote computer has gained anaccess to your computer and probably is collecting the information about the sites you've visited and the files contained in the folder Temporary Internet Files. Attention! Ask for help or install the software for deleting secret information about the sites you visited. __________________________________________________________________________ Your computer is full of evidences! ISP of transmission: TISCALI Your IP address: 84.221.0.215 They know you're using: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322) Your computer is: Windows XP Risk status for further investigation: VERY HIGH RISK To protect from the Spyware - click here To prevent information transmission - click here To delete the history of your activity, click here ..ho gia provato a fare uno scan con ad-aware e avg, a reimpostare la pagina precedente, a eliminare file temporanei etc etc...ma niente!!..il problema persiste!!! sarei veramente moooolto grato a chiunque mi aiutasse a risolvere questo problema! grazie! 
|
|
|
|
14-11-2005, 20:42
|
#2 |
|
Senior Member
Iscritto dal: Sep 2004
Messaggi: 6387
|
|
|
|
|
|
14-11-2005, 20:45
|
#3 |
|
Senior Member
Iscritto dal: Aug 2005
Città: quella di Dante
Messaggi: 841
|
se usi solo ad aware come antispy non eliminerai granchè..
abbinaci spybot ed ewido |
|
|
|
|
14-11-2005, 22:06
|
#4 |
|
Member
Iscritto dal: Oct 2005
Messaggi: 84
|
ciao sono ancora io...
innanzitutto grazie per avermi risposto subito! comunque..ho fatto lo scan con ewido ed i risultati sono: C:\WINDOWS\hosts infetto da trojan.Qhosts.el C:\WINDOWS\loadnew.exe infetto da trojanDownloader.small.bfy C:\WINDOWS\qifsl438.exe infetto da trojanDownloader.small.bfy ...indicati tutti come ad "alto rischio". una volta eliminati(ora sono in quarantena di ewido),ho riavviato anche il pc, ma il problema persiste..la pagina iniziale di internet è sempre quella...secure32.html !!! ..cosa posso fare ancora!?! grazie ancora per la pazienza! P.S.= se mi consigliate qualche altro programma di pulizia, mi potete dire anche il sito dove scaricarlo..nn sono proprio un esperto!
|
|
|
|
|
14-11-2005, 22:10
|
#5 |
|
Senior Member
Iscritto dal: May 2005
Città: Palermo
Messaggi: 6390
|
Posta un log di hijackthis nell'apposito thread in rilievo.
|
|
|
|
|
14-11-2005, 22:32
|
#6 |
|
Member
Iscritto dal: Oct 2005
Messaggi: 84
|
ciao!
ecco lo scan con hijackthis: Logfile of HijackThis v1.99.0 Scan saved at 22.29.38, on 14/11/2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Programmi\Ahead\InCD\InCDsrv.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\Programmi\Dassault Systemes\B11\intel_a\code\bin\CATSysDemon.exe C:\WINDOWS\System32\CTsvcCDA.EXE C:\Programmi\ewido\security suite\ewidoctrl.exe C:\ESM2\SAgentNT.exe C:\ESM2\EBRR.EXE C:\Programmi\UGS\License Servers\UGNXFLEXlm\lmgrd.exe C:\Programmi\UGS\License Servers\UGNXFLEXlm\uglmd.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\RunDll32.exe C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Programmi\Ahead\InCD\InCD.exe C:\Programmi\File comuni\Real\Update_OB\realsched.exe C:\Programmi\CyberLink\PowerDVD\PDVDServ.exe C:\Programmi\QuickTime\qttask.exe C:\Programmi\ZyXEL\ADSL USB Modem\CnxDslTb.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\Programmi\Microsoft AntiSpyware\gcasServ.exe C:\WINDOWS\System32\paytime.exe C:\WINDOWS\System32\ctfmon.exe C:\Programmi\Microsoft AntiSpyware\gcasDtServ.exe C:\WINDOWS\System32\paytime.exe C:\Programmi\Trend Micro\Tmas\Tmas.exe C:\WINDOWS\System32\wuauclt.exe C:\Programmi\Internet Explorer\iexplore.exe C:\Documents and Settings\IVAN\Impostazioni locali\Temp\Directory temporanea 1 per hijackthis.zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar2.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\MSN Apps\MSN Toolbar\01.02.4000.1001\it\msntb.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar2.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\MSN Apps\MSN Toolbar\01.02.4000.1001\it\msntb.dll O4 - HKLM\..\Run: [Collegamento alla pagina delle proprietà di High Definition Audio] HDAudPropShortcut.exe O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [InCD] C:\Programmi\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [RemoteControl] C:\Programmi\CyberLink\PowerDVD\PDVDServ.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Programmi\ZyXEL\ADSL USB Modem\CnxDslTb.exe" O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O4 - HKLM\..\Run: [gcasServ] "C:\Programmi\Microsoft AntiSpyware\gcasServ.exe" O4 - HKLM\..\Run: [PayTime] C:\WINDOWS\System32\paytime.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [PayTime] C:\WINDOWS\System32\paytime.exe O4 - Global Startup: Trend Micro Anti-Spyware.lnk = C:\Programmi\Trend Micro\Tmas\Tmas.exe O8 - Extra context menu item: &Google Search - res://C:\Programmi\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: Backward &Links - res://C:\Programmi\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Programmi\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Si&milar Pages - res://C:\Programmi\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Programmi\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: Organizzatore ricerche - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Programmi\File comuni\Microsoft Shared\Encarta Researcher\EROPROJ.DLL O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programmi\File comuni\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL O12 - Plugin for .spop: C:\Programmi\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary...o.cab32846.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{2E7E73AB-AEA2-4523-9B7A-58C8957D95B0}: NameServer = 213.205.36.70 213.205.32.70 O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Programmi\File comuni\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: Backbone Service - Dassault Systemes - C:\Programmi\Dassault Systemes\B11\intel_a\code\bin\CATSysDemon.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE O23 - Service: ewido security suite control - ewido networks - C:\Programmi\ewido\security suite\ewidoctrl.exe O23 - Service: InCD Helper - Ahead Software AG - C:\Programmi\Ahead\InCD\InCDsrv.exe O23 - Service: Epson Printer Status Agent - SEIKO EPSON CORPORATION - C:\ESM2\SAgentNT.exe O23 - Service: Unigraphics License Server (uglmd) - Macrovision Corporation - C:\Programmi\UGS\License Servers\UGNXFLEXlm\lmgrd.exe aspetto ulteriori informazioni...grazie!
|
|
|
|
|
14-11-2005, 23:01
|
#7 |
|
Senior Member
Iscritto dal: May 2005
Città: Palermo
Messaggi: 6390
|
Fixa:
C:\WINDOWS\System32\paytime.exe C:\WINDOWS\System32\paytime.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html O4 - HKLM\..\Run: [PayTime] C:\WINDOWS\System32\paytime.exe O4 - HKCU\..\Run: [PayTime] C:\WINDOWS\System32\paytime.exe |
|
|
|
|
14-11-2005, 23:43
|
#8 |
|
Member
Iscritto dal: Oct 2005
Messaggi: 84
|
grande andorra24!!!
hai risolto il mio problema! ho fixato quello che mi hai detto...ho riavviato il pc e nuovamente settato la pagina iniziale di internet mettendo quella di google e...sembra mantenerla..insomma tuttok! Ancora grazie mille!!! senza il tuo aiuto e quello di altri membri non avrei saputo a chi rivolgermi...ciao a tutti!
|
|
|
|
|
15-11-2005, 00:12
|
#9 | |
|
Senior Member
Iscritto dal: May 2005
Città: Palermo
Messaggi: 6390
|
Quote:
|
|
|
|
|
|
15-11-2005, 07:41
|
#10 | |
|
Senior Member
Iscritto dal: Sep 2004
Messaggi: 6387
|
Quote:
|
|
|
|
|
|
|
| Strumenti | |
|
|
Tutti gli orari sono GMT +1. Ora sono le: 07:18.
