|
|||||||
|
|
|
 |
|
|
Strumenti |
05-05-2005, 11:30
|
#1 |
|
Member
Iscritto dal: May 2004
Messaggi: 139
|
la connessione sparisce
Ciao a tutti ho questo problema. Quando navigo con internet explorer utilizzando la mia connessione alice adsl flat ogni tanto cade la linea, ma la cosa ancor piu' sconvolgente e' che mi sparisce anche la connessione, non riesco piu' a ritrovarla nemmeno in accesso remoto. C'e' qualcuno che puo' aiutarmi?
|
|
|
|
05-05-2005, 11:36
|
#2 |
|
Member
Iscritto dal: May 2004
Messaggi: 139
|
scusate per maggiori info vi invio il file di log di HijackThis
Logfile of HijackThis v1.99.1
Scan saved at 11.33.52, on 05/05/05 Platform: Windows 98 Gold (Win9x 4.10.1998) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\MSTASK.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\SYSTEM\RPCSS.EXE C:\WINDOWS\TASKMON.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\WINDOWS\SYSTEM\PDESK.EXE C:\PROGRAMMI\CREATIVE\SHAREDLL\CTNOTIFY.EXE C:\PROGRAMMI\CREATIVE\SBLIVE\AUDIOHQ\AHQTB.EXE C:\PROGRAMMI\FILE COMUNI\REAL\UPDATE_OB\REALSCHED.EXE C:\WINDOWS\SYSTEM\INTERNAT.EXE C:\PROGRAMMI\WINZIP\WZQKPICK.EXE C:\PROGRAMMI\GETRIGHT\GETRIGHT.EXE C:\PROGRAMMI\GETRIGHT\GETRIGHT.EXE C:\PROGRAMMI\CREATIVE\SHAREDLL\MEDIADET.EXE C:\WINDOWS\SYSTEM\TAPISRV.EXE C:\WINDOWS\SYSTEM\DDHELP.EXE C:\WINDOWS\RUNDLL32.EXE C:\WINDOWS\SYSTEM\RNAAPP.EXE C:\PROGRAMMI\LAVASOFT\AD-AWARE 6\AD-WATCH.EXE C:\WINDOWS\SYSTEM\PSTORES.EXE C:\PROGRAMMI\INTERNET EXPLORER\IEXPLORE.EXE C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = nov R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fornito da Alice R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti O2 - BHO: CDllBho Object - {5A5B6916-ED71-4531-8018-E792DD44156E} - C:\WINDOWS\SVCHOST.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [Matrox PowerDesk] C:\WINDOWS\SYSTEM\PDesk.exe /Autolaunch O4 - HKLM\..\Run: [Disc Detector] C:\Programmi\Creative\ShareDLL\CtNotify.exe O4 - HKLM\..\Run: [AudioHQ] C:\Programmi\Creative\SBLive\AudioHQ\AHQTB.EXE O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [internat.exe] internat.exe O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar O4 - HKLM\..\Run: [SurfSideKick 2] C:\PROGRAM FILES\SURFSIDEKICK 2\Ssk.exe O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKCU\..\Run: [SurfSideKick 2] C:\PROGRAM FILES\SURFSIDEKICK 2\Ssk.exe O4 - HKCU\..\RunServices: [SurfSideKick 2] C:\PROGRAM FILES\SURFSIDEKICK 2\Ssk.exe O4 - Startup: EPSON Controllo in background.lnk = C:\ESM2\STMS.exe O4 - Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE O4 - Startup: WinZip Quick Pick.lnk = C:\Programmi\WinZip\WZQKPICK.EXE O4 - Startup: getright.exe.lnk = C:\Programmi\GetRight\getright.exe O8 - Extra context menu item: Download with GetRight - C:\Programmi\GetRight\GRdownload.htm O8 - Extra context menu item: Open with GetRight Browser - C:\Programmi\GetRight\GRbrowse.htm O14 - IERESET.INF: START_PAGE_URL=http://gw.aliceadsl.it/home O15 - Trusted Zone: *.windupdates.com O15 - Trusted Zone: *.searchmiracle.com O15 - Trusted Zone: *.searchbarcash.com O15 - Trusted Zone: *.skoobidoo.com O15 - Trusted Zone: *.my-internet.info O15 - Trusted Zone: *.flingstone.com O15 - Trusted Zone: *.mt-download.com O15 - Trusted Zone: *.clickspring.net O15 - Trusted Zone: *.ysbweb.com O15 - Trusted Zone: *.slotchbar.com O15 - Trusted Zone: *.iframedollars.biz O15 - Trusted Zone: *.windupdates.com (HKLM) O15 - Trusted Zone: *.searchbarcash.com (HKLM) O15 - Trusted Zone: *.searchmiracle.com (HKLM) O15 - Trusted Zone: *.skoobidoo.com (HKLM) O15 - Trusted Zone: *.my-internet.info (HKLM) O15 - Trusted Zone: *.xxxtoolbar.com (HKLM) O15 - Trusted Zone: *.slotch.com (HKLM) O15 - Trusted Zone: *.flingstone.com (HKLM) O15 - Trusted Zone: *.mt-download.com (HKLM) O15 - Trusted Zone: *.blazefind.com (HKLM) O15 - Trusted Zone: *.clickspring.net (HKLM) O15 - Trusted Zone: *.ysbweb.com (HKLM) O15 - Trusted Zone: *.slotchbar.com (HKLM) O15 - Trusted Zone: *.iframedollars.biz (HKLM) O15 - Trusted IP range: 213.159.117.202 O15 - Trusted IP range: 213.159.117.202 (HKLM) |
|
|
|
|
05-05-2005, 11:46
|
#3 | |
|
Senior Member
Iscritto dal: Feb 2002
Città: Discovery
Messaggi: 34710
|
Quote:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = nov O2 - BHO: CDllBho Object - {5A5B6916-ED71-4531-8018-E792DD44156E} - C:\WINDOWS\SVCHOST.DLL O4 - HKLM\..\Run: [SurfSideKick 2] C:\PROGRAM FILES\SURFSIDEKICK 2\Ssk.exe O4 - HKCU\..\Run: [SurfSideKick 2] C:\PROGRAM FILES\SURFSIDEKICK 2\Ssk.exe O4 - HKCU\..\RunServices: [SurfSideKick 2] C:\PROGRAM FILES\SURFSIDEKICK 2\Ssk.exe e butta tutti i 015 ciao. 
__________________
Good afternoon, gentlemen, I'm a H.A.L. computer. |
|
|
|
|
|
05-05-2005, 11:54
|
#4 |
|
Member
Iscritto dal: May 2004
Messaggi: 139
|
scusami ma sono un po' duro e non riesco a capire cosa fare. Potresti spiegarti meglio.
Ciao e grazie |
|
|
|
|
05-05-2005, 11:59
|
#5 |
|
Member
Iscritto dal: May 2004
Messaggi: 139
|
scusami ma ho usato spybot e ora il file di hijack e' cambiato in questo:
Logfile of HijackThis v1.99.1 Scan saved at 11.54.50, on 05/05/05 Platform: Windows 98 Gold (Win9x 4.10.1998) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\MSTASK.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\SYSTEM\RPCSS.EXE C:\WINDOWS\TASKMON.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\WINDOWS\SYSTEM\PDESK.EXE C:\PROGRAMMI\CREATIVE\SHAREDLL\CTNOTIFY.EXE C:\PROGRAMMI\CREATIVE\SBLIVE\AUDIOHQ\AHQTB.EXE C:\PROGRAMMI\FILE COMUNI\REAL\UPDATE_OB\REALSCHED.EXE C:\WINDOWS\SYSTEM\INTERNAT.EXE C:\PROGRAMMI\WINZIP\WZQKPICK.EXE C:\PROGRAMMI\GETRIGHT\GETRIGHT.EXE C:\PROGRAMMI\GETRIGHT\GETRIGHT.EXE C:\PROGRAMMI\CREATIVE\SHAREDLL\MEDIADET.EXE C:\WINDOWS\SYSTEM\TAPISRV.EXE C:\WINDOWS\SYSTEM\DDHELP.EXE C:\WINDOWS\RUNDLL32.EXE C:\WINDOWS\SYSTEM\RNAAPP.EXE C:\WINDOWS\SYSTEM\PSTORES.EXE C:\PROGRAMMI\INTERNET EXPLORER\IEXPLORE.EXE C:\PROGRAMMI\INTERNET EXPLORER\IEXPLORE.EXE C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = nov R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fornito da Alice R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti O2 - BHO: CDllBho Object - {5A5B6916-ED71-4531-8018-E792DD44156E} - C:\WINDOWS\SVCHOST.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [Matrox PowerDesk] C:\WINDOWS\SYSTEM\PDesk.exe /Autolaunch O4 - HKLM\..\Run: [Disc Detector] C:\Programmi\Creative\ShareDLL\CtNotify.exe O4 - HKLM\..\Run: [AudioHQ] C:\Programmi\Creative\SBLive\AudioHQ\AHQTB.EXE O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [internat.exe] internat.exe O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar O4 - HKLM\..\Run: [SurfSideKick 2] C:\PROGRAM FILES\SURFSIDEKICK 2\Ssk.exe O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKCU\..\Run: [SurfSideKick 2] C:\PROGRAM FILES\SURFSIDEKICK 2\Ssk.exe O4 - HKCU\..\RunServices: [SurfSideKick 2] C:\PROGRAM FILES\SURFSIDEKICK 2\Ssk.exe O4 - Startup: EPSON Controllo in background.lnk = C:\ESM2\STMS.exe O4 - Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE O4 - Startup: WinZip Quick Pick.lnk = C:\Programmi\WinZip\WZQKPICK.EXE O4 - Startup: getright.exe.lnk = C:\Programmi\GetRight\getright.exe O8 - Extra context menu item: Download with GetRight - C:\Programmi\GetRight\GRdownload.htm O8 - Extra context menu item: Open with GetRight Browser - C:\Programmi\GetRight\GRbrowse.htm O14 - IERESET.INF: START_PAGE_URL=http://gw.aliceadsl.it/home O15 - Trusted Zone: *.windupdates.com O15 - Trusted Zone: *.searchmiracle.com O15 - Trusted Zone: *.searchbarcash.com O15 - Trusted Zone: *.skoobidoo.com O15 - Trusted Zone: *.my-internet.info O15 - Trusted Zone: *.flingstone.com O15 - Trusted Zone: *.mt-download.com O15 - Trusted Zone: *.clickspring.net O15 - Trusted Zone: *.ysbweb.com O15 - Trusted Zone: *.slotchbar.com O15 - Trusted Zone: *.iframedollars.biz O15 - Trusted Zone: *.windupdates.com (HKLM) O15 - Trusted Zone: *.searchbarcash.com (HKLM) O15 - Trusted Zone: *.searchmiracle.com (HKLM) O15 - Trusted Zone: *.skoobidoo.com (HKLM) O15 - Trusted Zone: *.my-internet.info (HKLM) O15 - Trusted Zone: *.xxxtoolbar.com (HKLM) O15 - Trusted Zone: *.slotch.com (HKLM) O15 - Trusted Zone: *.flingstone.com (HKLM) O15 - Trusted Zone: *.mt-download.com (HKLM) O15 - Trusted Zone: *.blazefind.com (HKLM) O15 - Trusted Zone: *.clickspring.net (HKLM) O15 - Trusted Zone: *.ysbweb.com (HKLM) O15 - Trusted Zone: *.slotchbar.com (HKLM) O15 - Trusted Zone: *.iframedollars.biz (HKLM) O15 - Trusted IP range: 213.159.117.202 O15 - Trusted IP range: 213.159.117.202 (HKLM) |
|
|
|
|
05-05-2005, 12:08
|
#6 | |
|
Senior Member
Iscritto dal: Feb 2002
Città: Discovery
Messaggi: 34710
|
Quote:
__________________
Good afternoon, gentlemen, I'm a H.A.L. computer. |
|
|
|
|
|
05-05-2005, 12:12
|
#7 |
|
Member
Iscritto dal: May 2004
Messaggi: 139
|
non capisco come eliminarle e forse dopo l'uso di spybot sono state ricreate. Un'ultima cosa ma non devo eliminare altro dopo aver eliminato quelle voci?
Ciao e scusa per la mia ignoranza. |
|
|
|
|
05-05-2005, 12:25
|
#8 | |
|
Senior Member
Iscritto dal: Feb 2002
Città: Discovery
Messaggi: 34710
|
Quote:
fai una scansione con loro aggiornatissimi. ciao.
__________________
Good afternoon, gentlemen, I'm a H.A.L. computer. |
|
|
|
|
|
05-05-2005, 12:38
|
#9 |
|
Member
Iscritto dal: May 2004
Messaggi: 139
|
Ciao ho eliminato le voci che mi hai detto e ho fatto il reboot. Mi sono accorto pero' che alcune entrate eliminate nelle chiavi di registro sono state ricreate infatti il file di log di hijackthis ora e' questo:
Logfile of HijackThis v1.99.1 Scan saved at 12.33.11, on 05/05/05 Platform: Windows 98 Gold (Win9x 4.10.1998) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\MSTASK.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\SYSTEM\RPCSS.EXE C:\WINDOWS\TASKMON.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\WINDOWS\SYSTEM\PDESK.EXE C:\PROGRAMMI\CREATIVE\SHAREDLL\CTNOTIFY.EXE C:\PROGRAMMI\CREATIVE\SBLIVE\AUDIOHQ\AHQTB.EXE C:\PROGRAMMI\FILE COMUNI\REAL\UPDATE_OB\REALSCHED.EXE C:\WINDOWS\SYSTEM\INTERNAT.EXE C:\WINDOWS\RUNDLL32.EXE C:\PROGRAMMI\WINZIP\WZQKPICK.EXE C:\PROGRAMMI\GETRIGHT\GETRIGHT.EXE C:\PROGRAMMI\GETRIGHT\GETRIGHT.EXE C:\PROGRAMMI\CREATIVE\SHAREDLL\MEDIADET.EXE C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = nov R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fornito da Alice R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [Matrox PowerDesk] C:\WINDOWS\SYSTEM\PDesk.exe /Autolaunch O4 - HKLM\..\Run: [Disc Detector] C:\Programmi\Creative\ShareDLL\CtNotify.exe O4 - HKLM\..\Run: [AudioHQ] C:\Programmi\Creative\SBLive\AudioHQ\AHQTB.EXE O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [internat.exe] internat.exe O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar O4 - HKLM\..\Run: [SurfSideKick 2] C:\PROGRAM FILES\SURFSIDEKICK 2\Ssk.exe O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKCU\..\Run: [SurfSideKick 2] C:\PROGRAM FILES\SURFSIDEKICK 2\Ssk.exe O4 - Startup: EPSON Controllo in background.lnk = C:\ESM2\STMS.exe O4 - Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE O4 - Startup: WinZip Quick Pick.lnk = C:\Programmi\WinZip\WZQKPICK.EXE O4 - Startup: getright.exe.lnk = C:\Programmi\GetRight\getright.exe O8 - Extra context menu item: Download with GetRight - C:\Programmi\GetRight\GRdownload.htm O8 - Extra context menu item: Open with GetRight Browser - C:\Programmi\GetRight\GRbrowse.htm O14 - IERESET.INF: START_PAGE_URL=http://gw.aliceadsl.it/home O15 - Trusted IP range: 213.159.117.202 O15 - Trusted IP range: 213.159.117.202 (HKLM) Forse c'e' qualcos'altro che devo eliminare dal mio sistema. |
|
|
|
|
05-05-2005, 12:50
|
#10 | |
|
Senior Member
Iscritto dal: Feb 2002
Città: Discovery
Messaggi: 34710
|
Quote:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = nov O4 - HKLM\..\Run: [SurfSideKick 2] C:\PROGRAM FILES\SURFSIDEKICK 2\Ssk.exe O4 - HKCU\..\Run: [SurfSideKick 2] C:\PROGRAM FILES\SURFSIDEKICK 2\Ssk.exe O15 - Trusted IP range: 213.159.117.202 (HKLM) O14 - IERESET.INF: START_PAGE_URL=http://gw.aliceadsl.it/home O15 - Trusted IP range: 213.159.117.202 ok ora elimini questi. prima disattiva il ripristino conf. di sistema. ciao.
__________________
Good afternoon, gentlemen, I'm a H.A.L. computer. |
|
|
|
|
|
05-05-2005, 12:53
|
#11 | |
|
Member
Iscritto dal: May 2004
Messaggi: 139
|
Quote:
|
|
|
|
|
|
05-05-2005, 12:59
|
#12 | |
|
Senior Member
Iscritto dal: Feb 2002
Città: Discovery
Messaggi: 34710
|
Quote:
ciao.
__________________
Good afternoon, gentlemen, I'm a H.A.L. computer. |
|
|
|
|
|
05-05-2005, 13:01
|
#13 |
|
Member
Iscritto dal: May 2004
Messaggi: 139
|
quindi non c'e' speranza di non far ricreare quelle voci nel registro?
|
|
|
|
|
05-05-2005, 13:06
|
#14 | |
|
Senior Member
Iscritto dal: Feb 2002
Città: Discovery
Messaggi: 34710
|
Quote:
ciao.
__________________
Good afternoon, gentlemen, I'm a H.A.L. computer. |
|
|
|
|
|
05-05-2005, 14:04
|
#15 |
|
Member
Iscritto dal: May 2004
Messaggi: 139
|
non esiste una versione gratuita di questo:
spysweeper |
|
|
|
|
05-05-2005, 14:32
|
#16 | |
|
Senior Member
Iscritto dal: Feb 2002
Città: Discovery
Messaggi: 34710
|
Quote:
__________________
Good afternoon, gentlemen, I'm a H.A.L. computer. |
|
|
|
|
|
05-05-2005, 14:48
|
#17 | |
|
Senior Member
Iscritto dal: Dec 2004
Città: Magenta(MI)
Messaggi: 1513
|
Quote:
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun NB: il nome del file è corretto, ma la posizione è sbagliata. Il vero file si deve trovare in C:\windows\system. Prima di fare qualsiasi modifica prova a fare una search di scanregw.exe e controlla dove sono/è posizionati/o cancella in modalità provvisoria : tutta la directory C:\PROGRAM FILES\SURFSIDEKICK 2 e il file C:\WINDOWS\scanregw.exe (se trovi l'altro in c:\windows\system) ciao |
|
|
|
|
|
05-05-2005, 15:12
|
#18 |
|
Member
Iscritto dal: May 2004
Messaggi: 139
|
ciao anche a te bluepix, con le modifiche indicatemi da halduemilauno le cose sono migliorate perche'pare che la connessione non sparisca piu', pero' non riesco ad eliminare le entry relative a surfsidekick neanche con spysweeper. Oltretutto non riesco a trovare la directory c:\program files\surfsidekick 2\ sembra non esistere. E perche' dovrei cancellarle in modalita' provvisoria...non so neanche come si fa.
Per quanto riguarda scanregw.exe ne trovo solo uno in c:\windows. Cmq vi riposto il file di log che ottengo con hijackthis Logfile of HijackThis v1.99.1 Scan saved at 15.11.28, on 05/05/05 Platform: Windows 98 Gold (Win9x 4.10.1998) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\MSTASK.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\SYSTEM\RPCSS.EXE C:\WINDOWS\TASKMON.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\WINDOWS\SYSTEM\PDESK.EXE C:\PROGRAMMI\CREATIVE\SHAREDLL\CTNOTIFY.EXE C:\PROGRAMMI\CREATIVE\SBLIVE\AUDIOHQ\AHQTB.EXE C:\PROGRAMMI\FILE COMUNI\REAL\UPDATE_OB\REALSCHED.EXE C:\WINDOWS\SYSTEM\INTERNAT.EXE C:\WINDOWS\RUNDLL32.EXE C:\PROGRAMMI\WINZIP\WZQKPICK.EXE C:\PROGRAMMI\GETRIGHT\GETRIGHT.EXE C:\PROGRAMMI\GETRIGHT\GETRIGHT.EXE C:\PROGRAMMI\CREATIVE\SHAREDLL\MEDIADET.EXE C:\WINDOWS\SYSTEM\RNAAPP.EXE C:\WINDOWS\SYSTEM\TAPISRV.EXE C:\WINDOWS\SYSTEM\PSTORES.EXE C:\PROGRAMMI\BITCOMET\BITCOMET.EXE C:\WINDOWS\SYSTEM\DDHELP.EXE C:\PROGRAMMI\LAVASOFT\AD-AWARE 6\AD-WATCH.EXE C:\PROGRAMMI\WINDOWS MEDIA PLAYER\WMPLAYER.EXE C:\PROGRAMMI\ADOBE\ACROBAT 5.0\READER\ACRORD32.EXE C:\PROGRAMMI\ADOBE\ACROBAT 5.0\READER\ACRORD32.EXE C:\PROGRAMMI\ADOBE\ACROBAT 5.0\READER\ACRORD32.EXE C:\PROGRAMMI\INTERNET EXPLORER\IEXPLORE.EXE C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = nov R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fornito da Alice R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [Matrox PowerDesk] C:\WINDOWS\SYSTEM\PDesk.exe /Autolaunch O4 - HKLM\..\Run: [Disc Detector] C:\Programmi\Creative\ShareDLL\CtNotify.exe O4 - HKLM\..\Run: [AudioHQ] C:\Programmi\Creative\SBLive\AudioHQ\AHQTB.EXE O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [internat.exe] internat.exe O4 - HKLM\..\Run: [SurfSideKick 2] C:\PROGRAM FILES\SURFSIDEKICK 2\Ssk.exe O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKCU\..\Run: [SurfSideKick 2] C:\PROGRAM FILES\SURFSIDEKICK 2\Ssk.exe O4 - HKCU\..\Run: [SpySweeper] C:\Programmi\Webroot\Spy Sweeper\SpySweeper.exe /0 O4 - HKCU\..\RunServices: [SurfSideKick 2] C:\PROGRAM FILES\SURFSIDEKICK 2\Ssk.exe O4 - HKCU\..\RunServices: [SpySweeper] C:\Programmi\Webroot\Spy Sweeper\SpySweeper.exe /0 O4 - Startup: EPSON Controllo in background.lnk = C:\ESM2\STMS.exe O4 - Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE O4 - Startup: WinZip Quick Pick.lnk = C:\Programmi\WinZip\WZQKPICK.EXE O4 - Startup: getright.exe.lnk = C:\Programmi\GetRight\getright.exe O8 - Extra context menu item: Download with GetRight - C:\Programmi\GetRight\GRdownload.htm O8 - Extra context menu item: Open with GetRight Browser - C:\Programmi\GetRight\GRbrowse.htm O14 - IERESET.INF: START_PAGE_URL=http://gw.aliceadsl.it/home O15 - Trusted IP range: 213.159.117.202 O15 - Trusted IP range: 213.159.117.202 (HKLM) |
|
|
|
|
05-05-2005, 15:51
|
#19 |
|
Senior Member
Iscritto dal: Dec 2004
Città: Magenta(MI)
Messaggi: 1513
|
Scanregw.exe sembra OK
Purtroppo non ho più molta esperienza con W98 e non so se esiste la possibilita di visualizzare le cartelle e i file nascosti. Prova con: Visualizza-Opzioni Cartella - Visualizzazione e selezionare -in File Nascosti- Mostra tutti i file ricontrolla dopo la modifica se trovi la cartella: C:\PROGRAM FILES\SURFSIDEKICK 2 però non si riesce a trovare l'agente che le ricrea. (azzzzz) |
|
|
|
|
05-05-2005, 16:48
|
#20 |
|
Senior Member
Iscritto dal: Dec 2004
Città: Magenta(MI)
Messaggi: 1513
|
Ricapitoliamo.
Da fixare (cioè lancciare Hijackthis, mettere il segno di spunta sulle voci sotto elencate e clikkare FIX) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = nov R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" O4 - HKLM\..\Run: [SurfSideKick 2] C:\PROGRAM FILES\SURFSIDEKICK 2\Ssk.exe O4 - HKCU\..\Run: [SurfSideKick 2] C:\PROGRAM FILES\SURFSIDEKICK 2\Ssk.exe O4 - HKCU\..\RunServices: [SurfSideKick 2] C:\PROGRAM FILES\SURFSIDEKICK 2\Ssk.exe ciao |
|
|
|
|
|
| Strumenti | |
|
|
Tutti gli orari sono GMT +1. Ora sono le: 21:59.
