HiJackThis - Analisi Log - leggere Regole di Sezione - Pagina 100

Stev-O · 08-04-2006, 13:56

prova ad avviare WWDC da modalità provvisoria e vedi cosa ti dice: potrebbe essere un semplice warning innocuo

daddo87 · 08-04-2006, 15:11

Salve a tutti,
volevo porvi il mio problema. Molto furbescamente ho scaricato un .exe da emule e l'ho lanciato...ovviamente mi ha messo su un cacchio di virus, il quale molto probabilmente ha 1 chiave in registro che ad ogni avvio crea e lancia un file *exmodulgb.exe, dove * sta per un numero a 1 o 2 cifre sempre diverso. Facendo la scansione con AVG rileva l'exe come virus e lo rimuove, ma la chiave nel registro rimane.
Questo e' il mio log, come potete vedere il file incriminato e' "99exmodulbg.exe".

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\WINDOWS\system32\gsicon.exe
C:\WINDOWS\system32\dslagent.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\MSN Messenger\MsnMsgr.Exe
C:\Programmi\YzShadow\YzShadow.exe
C:\Programmi\Radeon Omega Drivers\v3.8.205\ATI Tray Tools\atitray.exe
C:\WINDOWS\Alt+Q Hotkey.exe
C:\Programmi\UberIcon\UberIcon Manager.exe
C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\System32\svchost.exe
C:\DOCUME~1\Daddo\IMPOST~1\Temp\99exmodulbg.exe
C:\Documents and Settings\Daddo\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] C:\Programmi\Creative\SBLive\PROGRAM\ADGJDet.exe
O4 - HKLM\..\Run: [GSICONEXE] gsicon.exe
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [System Files Updater] C:\WINDOWS\FlyakiteOSX\Tools\System Files Updater.exe /S
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Programmi\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [.nvsvc] C:\WINDOWS\system\smss.exe /w
O4 - HKLM\..\Run: [CloneCDTray] "C:\Programmi\CloneCD\CloneCDTray.exe" /s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SearchSpyIndexer] C:\Programmi\SearchSpy\SearchSpy Server\SearchSpyIndex.exe
O4 - HKCU\..\Run: [Yz Shadow] C:\Programmi\YzShadow\YzShadow.exe
O4 - HKCU\..\Run: [AtiTrayTools] "C:\Programmi\Radeon Omega Drivers\v3.8.205\ATI Tray Tools\atitray.exe"
O4 - HKCU\..\Run: [Alt+Q Hotkey Tool] C:\WINDOWS\Alt+Q Hotkey.exe
O4 - HKCU\..\Run: [UberIcon] "C:\Programmi\UberIcon\UberIcon Manager.exe"
O4 - HKCU\..\Run: [updateMgr] C:\Programmi\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8AEF186C-0255-47F8-B819-4220D8561527}: NameServer = 85.37.17.5 85.38.28.77
O17 - HKLM\System\CCS\Services\Tcpip\..\{AB007341-15BE-4A88-BDFA-D44B75C13EDE}: NameServer = 192.168.0.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: InstallDriver Table Manager - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: StarWind iSCSI Service - Rocket Division Software - C:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: SecuROM User Access Service (V7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
O23 - Service: TrueVector Internet Monitor - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Windows Log - Unknown - C:\WINDOWS\system32\nvsvcd.exe

Ho provato a darci 1 occhio per bene, e per il poco che ci capisco non mi sembra di aver trovato nessuna corrispondenza sul registro...Confido nel vostro aiuto e vi ringrazio in anticipo

ciao
Riccardo

juninho85 · 08-04-2006, 15:19

Quote:

Originariamente inviato da daddo87

C:\DOCUME~1\Daddo\IMPOST~1\Temp\99exmodulbg.exe
O4 - HKLM\..\Run: [.nvsvc] C:\WINDOWS\system\smss.exe /w
O4 - HKCU\..\Run: [SearchSpyIndexer] C:\Programmi\SearchSpy\SearchSpy Server\SearchSpyIndex.exe
O23 - Service: Windows Log - Unknown - C:\WINDOWS\system32\nvsvcd.exe

elimina

hrxn · 08-04-2006, 16:32

Ciao qualcuno potrebbe darci una occhiata.
Logfile of HijackThis v1.99.1
Scan saved at 12.28.50, on 08/04/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5335.0005)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Intel\Wireless\Bin\EvtEng.exe
C:\Programmi\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Programmi\AntiVir PersonalEdition Classic\sched.exe
C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\ATKKBService.exe
C:\Programmi\ewido anti-malware\ewidoctrl.exe
C:\Programmi\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
C:\Programmi\Intel\Wireless\Bin\OProtSvc.exe
C:\Programmi\Intel\Wireless\Bin\RegSrvc.exe
C:\Programmi\Spyware Doctor\sdhelp.exe
C:\Programmi\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\Programmi\ASUS\NB Probe\SPM\spmgr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\wwSecure.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programmi\ASUS\Power4 Gear\BatteryLife.exe
C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
C:\Programmi\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Programmi\Intel\Wireless\Bin\EOUWiz.exe
C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\System32\alg.exe
C:\Programmi\SuperRam\SuperRam.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Documents and Settings\papera\Desktop\controllo pc\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.asus.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=54729
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.asus.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\TOOLS\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\TOOLS\iesdpb.dll
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Power_Gear] C:\Programmi\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [IntelZeroConfig] C:\Programmi\Intel\Wireless\bin\ZCfgSvc.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Programmi\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [EOUApp] C:\Programmi\Intel\Wireless\Bin\EOUWiz.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SuperRam] "C:\Programmi\SuperRam\SuperRam.exe" /start
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Programmi\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Programmi\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download web site with Free Download Manager - file://C:\Programmi\Free Download Manager\dlpage.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Programmi\Free Download Manager\dllink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\TOOLS\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra button: My IP Suite - {FB5F1910-F110-11d2-BB9E-80C04F795683} - C:\Programmi\My IP Suite\MyIPSuite.exe
O9 - Extra 'Tools' menuitem: My IP Suite - {FB5F1910-F110-11d2-BB9E-80C04F795683} - C:\Programmi\My IP Suite\MyIPSuite.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com
O20 - Winlogon Notify: IntelWireless - C:\Programmi\Intel\Wireless\Bin\LgNotify.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmi\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: EvtEng - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programmi\ewido anti-malware\ewidoctrl.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Programmi\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
O23 - Service: NetEagle - Effective Systems Ltd. - C:\Programmi\Network Eagle\NeaglSrv.exe
O23 - Service: OwnershipProtocol - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\OProtSvc.exe
O23 - Service: PRTG Service - Paessler Router Traffic Grapher (PRTGService) - Unknown owner - C:\Programmi\PRTG Traffic Grapher\PRTG Traffic Grapher.exe (file missing)
O23 - Service: RegSrvc - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Programmi\SiSoftware\SiSoftware Sandra Lite 2005.SR3\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Programmi\SiSoftware\SiSoftware Sandra Lite 2005.SR3\RpcSandraSrv.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Programmi\Spyware Doctor\sdhelp.exe
O23 - Service: spmgr - Unknown owner - C:\Programmi\ASUS\NB Probe\SPM\spmgr.exe
O23 - Service: Washer Security Access (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe

andorra24 · 08-04-2006, 16:44

Il log e' pulito. Ci sono solo un paio di voci di file missing:

O23 - Service: PRTG Service - Paessler Router Traffic Grapher (PRTGService) - Unknown owner - C:\Programmi\PRTG Traffic Grapher\PRTG Traffic Grapher.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

hrxn · 08-04-2006, 17:13

Ciao Andorra ho provato a fixare quelli che mi hai detto,ma non me lo fa fare neanche in modalita provvisoria.

daddo87 · 08-04-2006, 17:20

Quote:

Originariamente inviato da juninho85

elimina

Ho eliminato le voci riguardo il "nvsvc" e stavolta nn s'e' piu' aperto il virus. Verifichero' al prossimo riavvio poi. Cmq vi ringrazio molto gia' da ora

ciao
Riccardo

andorra24 · 08-04-2006, 17:29

Quote:

Originariamente inviato da hrxn

Ciao Andorra ho provato a fixare quelli che mi hai detto,ma non me lo fa fare neanche in modalita provvisoria.

Si tratta comunque di 2 voci innocue di file missing, il log e' pulito.

juninho85 · 08-04-2006, 18:16

Quote:

Originariamente inviato da daddo87

Ho eliminato le voci riguardo il "nvsvc" e stavolta nn s'e' piu' aperto il virus. Verifichero' al prossimo riavvio poi. Cmq vi ringrazio molto gia' da ora

ciao
Riccardo

ok....magari per metterti al sicuro controlla dalla modalità provvisoria che sia tutto apposto

daddo87 · 09-04-2006, 17:54

Tranquillo tutto apposto, grazie ancora!!!!

ciao
Riccardo

alessandroemme · 12-04-2006, 14:01

chi mi aiuta??

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
F2 - REG:system.ini: Shell=explorer.exe C:\WINDOWS\SERVICES.EXE
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,,C:\WINDOWS\SERVICES.EXE
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [dflnl.exe] C:\WINDOWS\System32\dflnl.exe
O4 - HKLM\..\Run: [SERVICES.EXE] C:\WINDOWS\SERVICES.EXE
O4 - HKLM\..\Run: [yaemu.exe] C:\WINDOWS\System32\yaemu.exe
O4 - HKLM\..\Run: [Systems] C:\WINDOWS\System32\sysmon.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O15 - Trusted Zone: www.archiviosex.net
O15 - Trusted Zone: www.linkautomatici.com
O15 - Trusted Zone: www.redfunny.com
O15 - Trusted Zone: www.skymasters.biz
O16 - DPF: {FBFF6F10-A2FC-9544-745F-A1F75A0501AE} - http://www.italian-toplist.com/cart/gs/gsa_00122.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{C98E9253-B5A4-4C6A-897A-37C310BBC345}: NameServer = 85.255.114.75,85.255.112.71
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmi\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

Stev-O · 12-04-2006, 14:30

elimina le seguenti:

F2 - REG:system.ini: Shell=explorer.exe C:\WINDOWS\SERVICES.EXE
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,,C:\WINDOWS\SERVICES.EXE
O4 - HKLM\..\Run: [dflnl.exe] C:\WINDOWS\System32\dflnl.exe
O4 - HKLM\..\Run: [yaemu.exe] C:\WINDOWS\System32\yaemu.exe
O4 - HKLM\..\Run: [Systems] C:\WINDOWS\System32\sysmon.exe
O15 - Trusted Zone: www.archiviosex.net
O15 - Trusted Zone: www.linkautomatici.com
O15 - Trusted Zone: www.redfunny.com
O15 - Trusted Zone: www.skymasters.biz
O16 - DPF: {FBFF6F10-A2FC-9544-745F-A1F75A0501AE} - http://www.italian-toplist.com/cart/gs/gsa_00122.exe

e volendo, per ottimizzare le risorse e basta (per nv SE NON utilizzi il tool di nvidia per overclock software e settaggi vari) anche:
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe

non hai postato l'inizio del log... hai già sp2 vero?
suggerimento: naviga con firefox

gio88 · 13-04-2006, 13:53

potreste gentilmente indicarmi quali sono i file da fixare? grazie...

Logfile of HijackThis v1.99.1
Scan saved at 14.48.26, on 13/04/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Nhksrv.exe
C:\PROGRA~1\INTERN~2\backweb\1655489\Program\SERVIC~1.EXE
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Programmi\Internet Security\backweb\1655489\Program\fspex.exe
C:\Programmi\Internet Security\Anti-Virus\fsgk32st.exe
C:\Programmi\Internet Security\Anti-Virus\FSGK32.EXE
C:\Programmi\Internet Security\backweb\1655489\program\fsbwsys.exe
C:\Programmi\Internet Security\Anti-Virus\fssm32.exe
C:\Programmi\Internet Security\Common\FSMA32.EXE
C:\Programmi\Internet Security\Common\FSMB32.EXE
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Programmi\Internet Security\Common\FCH32.EXE
C:\WINDOWS\Explorer.EXE
C:\Programmi\Internet Security\Common\FAMEH32.EXE
C:\Programmi\Internet Security\Anti-Virus\fsrw.exe
C:\Programmi\Internet Security\FSPC\fspc.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Programmi\Internet Security\Anti-Virus\fsav32.exe
C:\Programmi\Internet Security\FWES\Program\fsdfwd.exe
C:\Programmi\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\DELLMMKB.EXE
C:\Programmi\Microsoft Hardware\Mouse\point32.exe
C:\Programmi\ScanSoft\PaperPort\pptd40nt.exe
C:\Programmi\QuickTime\qttask.exe
C:\Programmi\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Programmi\Internet Security\Common\FSM32.EXE
C:\Programmi\Netropa\OSD.exe
C:\Programmi\Internet Security\FSGUI\ispnews.exe
C:\PROGRA~1\INTERN~2\ANTI-S~1\fsaw.exe
C:\Programmi\MessengerPlus! 3\MsgPlus.exe
C:\Programmi\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Internet Security\FSGUI\fsguidll.exe
c:\progra~1\intern~1\iexplore.exe
c:\progra~1\intern~1\iexplore.exe
C:\Documents and Settings\angelo ferraro\Desktop\mIRC\mirc.exe
C:\Documents and Settings\angelo ferraro\Desktop\mIRC\mirc.exe
C:\Programmi\AIM\aim.exe
C:\Programmi\VideoLAN\VLC\vlc.exe
C:\Programmi\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir...ie&ar=iesearch
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.libero.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir...r=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir...ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir...ie&ar=iesearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/keyword/%s
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = iexplore
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O1 - Hosts: 205.214.67.211 auto.search.msn.com
O2 - BHO: MySearch Search Assistant BHO - {04079851-5845-4dea-848C-3ECD647AA554} - C:\Programmi\MySearch\SrchAstt\1.bin\MYSRCHAS.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: URLLink Class - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Programmi\NewDotNet\newdotnet6_38.dll (file missing)
O2 - BHO: (no name) - {6A7C2B1C-DD8C-DCC6-A956-B64ED359E04F} - C:\DOCUME~1\ANGELO~1\DATIAP~1\INTRAP~1\File beep.exe (file missing)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [AHQInit] C:\Programmi\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Programmi\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\DELLMMKB.EXE
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [00SyncNet-giochi] C:\DOCUME~1\ANGELO~1\DATIAP~1\giochi.exe /nostart
O4 - HKLM\..\Run: [PaperPort] C:\Programmi\ScanSoft\PaperPort\runppdrv.exe
O4 - HKLM\..\Run: [PaperPort PTD] C:\Programmi\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Programmi\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NI.UWFX5T] "C:\Documents and Settings\angelo ferraro\Impostazioni locali\Temporary Internet Files\Content.IE5\GLMZS5Q3\WinFixerScannerInstallITA[1].exe"
O4 - HKLM\..\Run: [OpwareSE2] "C:\Programmi\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Programmi\Internet Security\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Programmi\Internet Security\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Programmi\Internet Security\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Programmi\Internet Security\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programmi\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [Bat bib option dent] C:\Documents and Settings\All Users\Dati applicazioni\RuleDupeBatBib\EqHide.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Programmi\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup -s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmi\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [AIM] C:\Programmi\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Idle okay] C:\DOCUME~1\ANGELO~1\DATIAP~1\TITLEE~1\Aimstyle.exe
O4 - Startup: A Smaller Note 99.lnk = C:\Documents and Settings\angelo ferraro\Documenti\download\smaller note\note.exe
O4 - Global Startup: Internet Security.lnk = C:\Programmi\Internet Security\backweb\1655489\Program\fspex.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Blocca questo popup - C:\Programmi\Internet Security\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Filtro pagine Web - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Programmi\Internet Security\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Programmi\Internet Security\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: Filtro pagine Web - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Programmi\Internet Security\FSPC\fspcmsie.dll
O9 - Extra button: Protezione IE - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Programmi\Internet Security\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: Protezione IE... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Programmi\Internet Security\Anti-Spyware\ieshield.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Programmi\AIM\aim.exe
O9 - Extra button: Dictionary - {b3d50f24-9482-4391-8c6a-976e8e3ec08d} - c:\pomidor\pomidor.exe (file missing)
O9 - Extra 'Tools' menuitem: &Dictionary - {b3d50f24-9482-4391-8c6a-976e8e3ec08d} - c:\pomidor\pomidor.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'c:\programmi\newdotnet\newdotnet6_38.dll' missing
O12 - Plugin for .spop: C:\Programmi\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {53D602E4-66ED-4B03-A5B8-19E4F4F6F18F} (Tiphone Control) - http://netphone.tiscali.it/netphone/ocx/tiphone.cab
O16 - DPF: {7A32634B-029C-4836-A023-528983982A49} (MSN Chat Control 4.2) - http://fdl.msn.com/public/chat/msnchat42.cab
O16 - DPF: {8EC18CE2-D7B4-11D2-88C8-006008A717FD} (NCSView Class) - http://ww3.atlanteitaliano.it/ecwplugins/ncs.cab
O16 - DPF: {99D8AF4F-307A-461C-A404-BFA33D502B31} (APStartX Control) - http://217.169.119.216/resources/APStart.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...06/mcfscan.cab
O23 - Service: Internet Security (BackWeb Plug-in - 1655489) - Wind - C:\PROGRA~1\INTERN~2\backweb\1655489\Program\SERVIC~1.EXE
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Programmi\Internet Security\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Programmi\Internet Security\backweb\1655489\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Programmi\Internet Security\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure HTTP Server (fshttps) - F-Secure Corporation - C:\Programmi\Internet Security\FSPC\fshttps\fshttps.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Programmi\Internet Security\Common\FSMA32.EXE
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

Stev-O · 13-04-2006, 14:24

togli

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local>
O2 - BHO: URLLink Class - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Programmi\NewDotNet\newdotnet6_38.dll (file missing)
O2 - BHO: (no name) - {6A7C2B1C-DD8C-DCC6-A956-B64ED359E04F} - C:\DOCUME~1\ANGELO~1\DATIAP~1\INTRAP~1\File beep.exe (file missing)
O4 - HKLM\..\Run: [Bat bib option dent] C:\Documents and Settings\All Users\Dati applicazioni\RuleDupeBatBib\EqHide.exe costui scansionalo va su www.virustotal.com e se risulta infetto fixalo a meno tu non conosca cosa sia
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup -s
O4 - HKCU\..\Run: [Idle okay] C:\DOCUME~1\ANGELO~1\DATIAP~1\TITLEE~1\Aimstyle.exe anche questo sarebbe da scansionare
O4 - Startup: A Smaller Note 99.lnk = C:\Documents and Settings\angelo ferraro\Documenti\download\smaller note\note.exe
O9 - Extra button: Dictionary - {b3d50f24-9482-4391-8c6a-976e8e3ec08d} - c:\pomidor\pomidor.exe (file missing)
O9 - Extra 'Tools' menuitem: &Dictionary - {b3d50f24-9482-4391-8c6a-976e8e3ec08d} - c:\pomidor\pomidor.exe (file missing)
O10 - Broken Internet access because of LSP provider 'c:\programmi\newdotnet\newdotnet6_38.dll' missing
O16 - DPF: {99D8AF4F-307A-461C-A404-BFA33D502B31} (APStartX Control) - http://217.169.119.216/resources/APStart.ocx

ho visto che hai msn plus... sicuro di non aver "anche" installato il "suo" adware?

al termine cmq per sicurezza fai anche una scansione con ewido www.ewido.net e immunizza il browser con spywareblaster

nessunopiu · 13-04-2006, 14:36

Ciao Stiv, permettimi una nota alla quale chiedo anche un tuo parere,
a riguardo del log di HijackThis io adotto un metodo molto banale.
Archivio i log che sò sicuri e ogni tanto li confronto con i nuovi.
Escluse situazioni particolari non è un metodo che può andare ?
Ovviamente è sottointeso che occore conoscere cosa si ha nel PC.
Ciao

Stev-O · 13-04-2006, 14:41

ma quanto tempo impieghi???

nessunopiu · 13-04-2006, 14:53

Guarda ormai conosco talmente bene le mie " voci " che appena vedo uno
015, 02, o altro "fuori posto" salta agli occhi.

Colgo l'occasio per fare gli auguri di una buona Pasqua a te e a chi passa
da queste parti..........

Auguroni

Stev-O · 13-04-2006, 15:11

ah ma se ci sono opinioni con il log sopra di' pure...
solo non si riesce sempre a generalizzare la cosa

Non è che sia un "cultore" specifico dei logs ne ho una conoscenza archivistica mnemonica dei processi per cui mi può tranquillamente scappare fuori qualcosa

Buona Pasqua !!!

nessunopiu · 13-04-2006, 15:21

Quote:

Originariamente inviato da Stev-O

ah ma se ci sono opinioni con il log sopra di' pure...
solo non si riesce sempre a generalizzare la cosa

Non è che sia un "cultore" specifico dei logs ne ho una conoscenza archivistica mnemonica dei processi per cui mi può tranquillamente scappare fuori qualcosa

Buona Pasqua !!!

No Stiv, mi hai del tutto frainteso, non ho nulla da eccepire; se fossi
capace come te avrei molti meno problemi.
Da solo non combinerei molto, fortunatamente mi affido alle analisi log
sul sito.Qui cerco di rompere le scatole il meno possibile.
La mia nota intendeva solo esprimere l'arte di arrangiarsi e arrivare alle
soluzioni anche con altri metodi.

Stev-O · 13-04-2006, 15:29

non era assolutamente polemico il mio post

invitavo anche altri a dire la loro...
ben lungi dall'avere atteggiamenti diprotagonismo che odio tra l'altro

08-04-2006, 13:56	#1981
Stev-O Senior Member Iscritto dal: Sep 2005 Città: Opinions are like assholes: anybody has one... Messaggi: 34290	prova ad avviare WWDC da modalità provvisoria e vedi cosa ti dice: potrebbe essere un semplice warning innocuo __________________ Ну давай !! . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Cina, bugiardo - stolen conto: non paghi . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . *NON CERCO PIU' UN ALIMENTATORE DECENTE ----------------> LINK*

12-04-2006, 14:30	#1992
Stev-O Senior Member Iscritto dal: Sep 2005 Città: Opinions are like assholes: anybody has one... Messaggi: 34290	elimina le seguenti: F2 - REG:system.ini: Shell=explorer.exe C:\WINDOWS\SERVICES.EXE F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,,C:\WINDOWS\SERVICES.EXE O4 - HKLM\..\Run: [dflnl.exe] C:\WINDOWS\System32\dflnl.exe O4 - HKLM\..\Run: [yaemu.exe] C:\WINDOWS\System32\yaemu.exe O4 - HKLM\..\Run: [Systems] C:\WINDOWS\System32\sysmon.exe O15 - Trusted Zone: www.archiviosex.net O15 - Trusted Zone: www.linkautomatici.com O15 - Trusted Zone: www.redfunny.com O15 - Trusted Zone: www.skymasters.biz O16 - DPF: {FBFF6F10-A2FC-9544-745F-A1F75A0501AE} - http://www.italian-toplist.com/cart/gs/gsa_00122.exe e volendo, per ottimizzare le risorse e basta (per nv SE NON utilizzi il tool di nvidia per overclock software e settaggi vari) anche: O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe non hai postato l'inizio del log... hai già sp2 vero? suggerimento: naviga con firefox __________________ Ну давай !! . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Cina, bugiardo - stolen conto: non paghi . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . *NON CERCO PIU' UN ALIMENTATORE DECENTE ----------------> LINK* Ultima modifica di Stev-O : 12-04-2006 alle 14:37.

13-04-2006, 14:24	#1994
Stev-O Senior Member Iscritto dal: Sep 2005 Città: Opinions are like assholes: anybody has one... Messaggi: 34290	togli R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local> O2 - BHO: URLLink Class - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Programmi\NewDotNet\newdotnet6_38.dll (file missing) O2 - BHO: (no name) - {6A7C2B1C-DD8C-DCC6-A956-B64ED359E04F} - C:\DOCUME~1\ANGELO~1\DATIAP~1\INTRAP~1\File beep.exe (file missing) O4 - HKLM\..\Run: [Bat bib option dent] C:\Documents and Settings\All Users\Dati applicazioni\RuleDupeBatBib\EqHide.exe costui scansionalo va su www.virustotal.com e se risulta infetto fixalo a meno tu non conosca cosa sia O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup -s O4 - HKCU\..\Run: [Idle okay] C:\DOCUME~1\ANGELO~1\DATIAP~1\TITLEE~1\Aimstyle.exe anche questo sarebbe da scansionare O4 - Startup: A Smaller Note 99.lnk = C:\Documents and Settings\angelo ferraro\Documenti\download\smaller note\note.exe O9 - Extra button: Dictionary - {b3d50f24-9482-4391-8c6a-976e8e3ec08d} - c:\pomidor\pomidor.exe (file missing) O9 - Extra 'Tools' menuitem: &Dictionary - {b3d50f24-9482-4391-8c6a-976e8e3ec08d} - c:\pomidor\pomidor.exe (file missing) O10 - Broken Internet access because of LSP provider 'c:\programmi\newdotnet\newdotnet6_38.dll' missing O16 - DPF: {99D8AF4F-307A-461C-A404-BFA33D502B31} (APStartX Control) - http://217.169.119.216/resources/APStart.ocx ho visto che hai msn plus... sicuro di non aver "anche" installato il "suo" adware? al termine cmq per sicurezza fai anche una scansione con ewido www.ewido.net e immunizza il browser con spywareblaster __________________ Ну давай !! . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Cina, bugiardo - stolen conto: non paghi . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . *NON CERCO PIU' UN ALIMENTATORE DECENTE ----------------> LINK* Ultima modifica di Stev-O : 13-04-2006 alle 14:29.

13-04-2006, 14:36	#1995
nessunopiu Member Iscritto dal: Jul 2005 Messaggi: 277	Ciao Stiv, permettimi una nota alla quale chiedo anche un tuo parere, a riguardo del log di HijackThis io adotto un metodo molto banale. Archivio i log che sò sicuri e ogni tanto li confronto con i nuovi. Escluse situazioni particolari non è un metodo che può andare ? Ovviamente è sottointeso che occore conoscere cosa si ha nel PC. Ciao __________________ Se le cose le sai , sembrano facili !!

13-04-2006, 14:41	#1996
Stev-O Senior Member Iscritto dal: Sep 2005 Città: Opinions are like assholes: anybody has one... Messaggi: 34290	ma quanto tempo impieghi??? __________________ Ну давай !! . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Cina, bugiardo - stolen conto: non paghi . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . *NON CERCO PIU' UN ALIMENTATORE DECENTE ----------------> LINK*

08-04-2006, 15:11	#1982
daddo87 Member Iscritto dal: Sep 2003 Città: Siena Messaggi: 208	Salve a tutti, volevo porvi il mio problema. Molto furbescamente ho scaricato un .exe da emule e l'ho lanciato...ovviamente mi ha messo su un cacchio di virus, il quale molto probabilmente ha 1 chiave in registro che ad ogni avvio crea e lancia un file exmodulgb.exe, dove sta per un numero a 1 o 2 cifre sempre diverso. Facendo la scansione con AVG rileva l'exe come virus e lo rimuove, ma la chiave nel registro rimane. Questo e' il mio log, come potete vedere il file incriminato e' "99exmodulbg.exe". Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\UAService7.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\CTHELPER.EXE C:\WINDOWS\system32\gsicon.exe C:\WINDOWS\system32\dslagent.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\svchost.exe C:\Programmi\MSN Messenger\MsnMsgr.Exe C:\Programmi\YzShadow\YzShadow.exe C:\Programmi\Radeon Omega Drivers\v3.8.205\ATI Tray Tools\atitray.exe C:\WINDOWS\Alt+Q Hotkey.exe C:\Programmi\UberIcon\UberIcon Manager.exe C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\WINDOWS\System32\svchost.exe C:\DOCUME~1\Daddo\IMPOST~1\Temp\99exmodulbg.exe C:\Documents and Settings\Daddo\Desktop\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [Jet Detection] C:\Programmi\Creative\SBLive\PROGRAM\ADGJDet.exe O4 - HKLM\..\Run: [GSICONEXE] gsicon.exe O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [Zone Labs Client] C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [System Files Updater] C:\WINDOWS\FlyakiteOSX\Tools\System Files Updater.exe /S O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Programmi\Lexmark X1100 Series\lxbkbmgr.exe" O4 - HKLM\..\Run: [.nvsvc] C:\WINDOWS\system\smss.exe /w O4 - HKLM\..\Run: [CloneCDTray] "C:\Programmi\CloneCD\CloneCDTray.exe" /s O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [SearchSpyIndexer] C:\Programmi\SearchSpy\SearchSpy Server\SearchSpyIndex.exe O4 - HKCU\..\Run: [Yz Shadow] C:\Programmi\YzShadow\YzShadow.exe O4 - HKCU\..\Run: [AtiTrayTools] "C:\Programmi\Radeon Omega Drivers\v3.8.205\ATI Tray Tools\atitray.exe" O4 - HKCU\..\Run: [Alt+Q Hotkey Tool] C:\WINDOWS\Alt+Q Hotkey.exe O4 - HKCU\..\Run: [UberIcon] "C:\Programmi\UberIcon\UberIcon Manager.exe" O4 - HKCU\..\Run: [updateMgr] C:\Programmi\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1 O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{8AEF186C-0255-47F8-B819-4220D8561527}: NameServer = 85.37.17.5 85.38.28.77 O17 - HKLM\System\CCS\Services\Tcpip\..\{AB007341-15BE-4A88-BDFA-D44B75C13EDE}: NameServer = 192.168.0.1 O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: AVG E-mail Scanner - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O23 - Service: InstallDriver Table Manager - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LexBce Server - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: StarWind iSCSI Service - Rocket Division Software - C:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: SecuROM User Access Service (V7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe O23 - Service: TrueVector Internet Monitor - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe O23 - Service: Windows Log - Unknown - C:\WINDOWS\system32\nvsvcd.exe Ho provato a darci 1 occhio per bene, e per il poco che ci capisco non mi sembra di aver trovato nessuna corrispondenza sul registro...Confido nel vostro aiuto e vi ringrazio in anticipo ciao Riccardo

08-04-2006, 16:32	#1984
hrxn Member Iscritto dal: Aug 2005 Messaggi: 233	Ciao qualcuno potrebbe darci una occhiata. Logfile of HijackThis v1.99.1 Scan saved at 12.28.50, on 08/04/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5335.0005) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Programmi\Intel\Wireless\Bin\EvtEng.exe C:\Programmi\Intel\Wireless\Bin\S24EvMon.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Programmi\Intel\Wireless\Bin\ZcfgSvc.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe C:\Programmi\AntiVir PersonalEdition Classic\sched.exe C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe C:\WINDOWS\ATKKBService.exe C:\Programmi\ewido anti-malware\ewidoctrl.exe C:\Programmi\Sunbelt Software\Personal Firewall 4\kpf4ss.exe C:\Programmi\Intel\Wireless\Bin\OProtSvc.exe C:\Programmi\Intel\Wireless\Bin\RegSrvc.exe C:\Programmi\Spyware Doctor\sdhelp.exe C:\Programmi\Sunbelt Software\Personal Firewall 4\kpf4gui.exe C:\Programmi\ASUS\NB Probe\SPM\spmgr.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\system32\wwSecure.exe C:\WINDOWS\ATK0100\HControl.exe C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Programmi\ASUS\Power4 Gear\BatteryLife.exe C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe C:\Programmi\Intel\Wireless\Bin\ifrmewrk.exe C:\WINDOWS\ATK0100\ATKOSD.exe C:\Programmi\Intel\Wireless\Bin\EOUWiz.exe C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe C:\WINDOWS\System32\alg.exe C:\Programmi\SuperRam\SuperRam.exe C:\WINDOWS\system32\ctfmon.exe C:\Programmi\Sunbelt Software\Personal Firewall 4\kpf4gui.exe C:\Programmi\Mozilla Firefox\firefox.exe C:\Documents and Settings\papera\Desktop\controllo pc\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.asus.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=54729 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.asus.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\TOOLS\iesdsg.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\TOOLS\iesdpb.dll O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [Power_Gear] C:\Programmi\ASUS\Power4 Gear\BatteryLife.exe 1 O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [IntelZeroConfig] C:\Programmi\Intel\Wireless\bin\ZCfgSvc.exe O4 - HKLM\..\Run: [IntelWireless] C:\Programmi\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [EOUApp] C:\Programmi\Intel\Wireless\Bin\EOUWiz.exe O4 - HKLM\..\Run: [avgnt] "C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [SuperRam] "C:\Programmi\SuperRam\SuperRam.exe" /start O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Programmi\Free Download Manager\dlall.htm O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Programmi\Free Download Manager\dlselected.htm O8 - Extra context menu item: Download web site with Free Download Manager - file://C:\Programmi\Free Download Manager\dlpage.htm O8 - Extra context menu item: Download with Free Download Manager - file://C:\Programmi\Free Download Manager\dllink.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\TOOLS\iesdpb.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O9 - Extra button: My IP Suite - {FB5F1910-F110-11d2-BB9E-80C04F795683} - C:\Programmi\My IP Suite\MyIPSuite.exe O9 - Extra 'Tools' menuitem: My IP Suite - {FB5F1910-F110-11d2-BB9E-80C04F795683} - C:\Programmi\My IP Suite\MyIPSuite.exe O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com O20 - Winlogon Notify: IntelWireless - C:\Programmi\Intel\Wireless\Bin\LgNotify.dll O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmi\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe O23 - Service: EvtEng - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\EvtEng.exe O23 - Service: ewido security suite control - ewido networks - C:\Programmi\ewido anti-malware\ewidoctrl.exe O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Programmi\Sunbelt Software\Personal Firewall 4\kpf4ss.exe O23 - Service: NetEagle - Effective Systems Ltd. - C:\Programmi\Network Eagle\NeaglSrv.exe O23 - Service: OwnershipProtocol - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\OProtSvc.exe O23 - Service: PRTG Service - Paessler Router Traffic Grapher (PRTGService) - Unknown owner - C:\Programmi\PRTG Traffic Grapher\PRTG Traffic Grapher.exe (file missing) O23 - Service: RegSrvc - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing) O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Programmi\SiSoftware\SiSoftware Sandra Lite 2005.SR3\RpcDataSrv.exe O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Programmi\SiSoftware\SiSoftware Sandra Lite 2005.SR3\RpcSandraSrv.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Programmi\Spyware Doctor\sdhelp.exe O23 - Service: spmgr - Unknown owner - C:\Programmi\ASUS\NB Probe\SPM\spmgr.exe O23 - Service: Washer Security Access (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe

08-04-2006, 16:44	#1985
andorra24 Senior Member Iscritto dal: May 2005 Città: Palermo Messaggi: 6390	Il log e' pulito. Ci sono solo un paio di voci di file missing: O23 - Service: PRTG Service - Paessler Router Traffic Grapher (PRTGService) - Unknown owner - C:\Programmi\PRTG Traffic Grapher\PRTG Traffic Grapher.exe (file missing) O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

08-04-2006, 17:13	#1986
hrxn Member Iscritto dal: Aug 2005 Messaggi: 233	Ciao Andorra ho provato a fixare quelli che mi hai detto,ma non me lo fa fare neanche in modalita provvisoria.

09-04-2006, 17:54	#1990
daddo87 Member Iscritto dal: Sep 2003 Città: Siena Messaggi: 208	Tranquillo tutto apposto, grazie ancora!!!! ciao Riccardo

12-04-2006, 14:01	#1991
alessandroemme Member Iscritto dal: Aug 2005 Messaggi: 82	chi mi aiuta?? R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti F2 - REG:system.ini: Shell=explorer.exe C:\WINDOWS\SERVICES.EXE F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,,C:\WINDOWS\SERVICES.EXE O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [dflnl.exe] C:\WINDOWS\System32\dflnl.exe O4 - HKLM\..\Run: [SERVICES.EXE] C:\WINDOWS\SERVICES.EXE O4 - HKLM\..\Run: [yaemu.exe] C:\WINDOWS\System32\yaemu.exe O4 - HKLM\..\Run: [Systems] C:\WINDOWS\System32\sysmon.exe O4 - HKLM\..\Run: [avgnt] "C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O15 - Trusted Zone: www.archiviosex.net O15 - Trusted Zone: www.linkautomatici.com O15 - Trusted Zone: www.redfunny.com O15 - Trusted Zone: www.skymasters.biz O16 - DPF: {FBFF6F10-A2FC-9544-745F-A1F75A0501AE} - http://www.italian-toplist.com/cart/gs/gsa_00122.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{C98E9253-B5A4-4C6A-897A-37C310BBC345}: NameServer = 85.255.114.75,85.255.112.71 O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmi\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

13-04-2006, 13:53	#1993
gio88 Senior Member Iscritto dal: May 2005 Messaggi: 444	potreste gentilmente indicarmi quali sono i file da fixare? grazie... Logfile of HijackThis v1.99.1 Scan saved at 14.48.26, on 13/04/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Nhksrv.exe C:\PROGRA~1\INTERN~2\backweb\1655489\Program\SERVIC~1.EXE C:\WINDOWS\System32\drivers\CDAC11BA.EXE C:\WINDOWS\System32\CTsvcCDA.EXE C:\Programmi\Internet Security\backweb\1655489\Program\fspex.exe C:\Programmi\Internet Security\Anti-Virus\fsgk32st.exe C:\Programmi\Internet Security\Anti-Virus\FSGK32.EXE C:\Programmi\Internet Security\backweb\1655489\program\fsbwsys.exe C:\Programmi\Internet Security\Anti-Virus\fssm32.exe C:\Programmi\Internet Security\Common\FSMA32.EXE C:\Programmi\Internet Security\Common\FSMB32.EXE C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\Programmi\Internet Security\Common\FCH32.EXE C:\WINDOWS\Explorer.EXE C:\Programmi\Internet Security\Common\FAMEH32.EXE C:\Programmi\Internet Security\Anti-Virus\fsrw.exe C:\Programmi\Internet Security\FSPC\fspc.exe C:\WINDOWS\system32\fxssvc.exe C:\Programmi\Internet Security\Anti-Virus\fsav32.exe C:\Programmi\Internet Security\FWES\Program\fsdfwd.exe C:\Programmi\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe C:\WINDOWS\DELLMMKB.EXE C:\Programmi\Microsoft Hardware\Mouse\point32.exe C:\Programmi\ScanSoft\PaperPort\pptd40nt.exe C:\Programmi\QuickTime\qttask.exe C:\Programmi\ScanSoft\OmniPageSE2.0\OpwareSE2.exe C:\Programmi\Internet Security\Common\FSM32.EXE C:\Programmi\Netropa\OSD.exe C:\Programmi\Internet Security\FSGUI\ispnews.exe C:\PROGRA~1\INTERN~2\ANTI-S~1\fsaw.exe C:\Programmi\MessengerPlus! 3\MsgPlus.exe C:\Programmi\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Programmi\Internet Explorer\iexplore.exe C:\WINDOWS\system32\ctfmon.exe C:\Programmi\Internet Security\FSGUI\fsguidll.exe c:\progra~1\intern~1\iexplore.exe c:\progra~1\intern~1\iexplore.exe C:\Documents and Settings\angelo ferraro\Desktop\mIRC\mirc.exe C:\Documents and Settings\angelo ferraro\Desktop\mIRC\mirc.exe C:\Programmi\AIM\aim.exe C:\Programmi\VideoLAN\VLC\vlc.exe C:\Programmi\Hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir...ie&ar=iesearch R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.libero.it/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir...r=6&ar=msnhome R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir...ie&ar=iesearch R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir...ie&ar=iesearch R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/keyword/%s R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = iexplore R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local> R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti O1 - Hosts: 205.214.67.211 auto.search.msn.com O2 - BHO: MySearch Search Assistant BHO - {04079851-5845-4dea-848C-3ECD647AA554} - C:\Programmi\MySearch\SrchAstt\1.bin\MYSRCHAS.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: URLLink Class - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Programmi\NewDotNet\newdotnet6_38.dll (file missing) O2 - BHO: (no name) - {6A7C2B1C-DD8C-DCC6-A956-B64ED359E04F} - C:\DOCUME~1\ANGELO~1\DATIAP~1\INTRAP~1\File beep.exe (file missing) O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe O4 - HKLM\..\Run: [AHQInit] C:\Programmi\Creative\SBLive\Program\AHQInit.exe O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Programmi\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\DELLMMKB.EXE O4 - HKLM\..\Run: [POINTER] point32.exe O4 - HKLM\..\Run: [00SyncNet-giochi] C:\DOCUME~1\ANGELO~1\DATIAP~1\giochi.exe /nostart O4 - HKLM\..\Run: [PaperPort] C:\Programmi\ScanSoft\PaperPort\runppdrv.exe O4 - HKLM\..\Run: [PaperPort PTD] C:\Programmi\ScanSoft\PaperPort\pptd40nt.exe O4 - HKLM\..\Run: [IndexSearch] C:\Programmi\ScanSoft\PaperPort\IndexSearch.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [NI.UWFX5T] "C:\Documents and Settings\angelo ferraro\Impostazioni locali\Temporary Internet Files\Content.IE5\GLMZS5Q3\WinFixerScannerInstallITA[1].exe" O4 - HKLM\..\Run: [OpwareSE2] "C:\Programmi\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" O4 - HKLM\..\Run: [F-Secure Manager] "C:\Programmi\Internet Security\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Programmi\Internet Security\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Programmi\Internet Security\FSGUI\FSSW.EXE" /reboot O4 - HKLM\..\Run: [News Service] "C:\Programmi\Internet Security\FSGUI\ispnews.exe" O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programmi\MessengerPlus! 3\MsgPlus.exe" O4 - HKLM\..\Run: [Bat bib option dent] C:\Documents and Settings\All Users\Dati applicazioni\RuleDupeBatBib\EqHide.exe O4 - HKLM\..\Run: [ViewMgr] C:\Programmi\Viewpoint\Viewpoint Manager\ViewMgr.exe O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup -s O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Programmi\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [AIM] C:\Programmi\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [Idle okay] C:\DOCUME~1\ANGELO~1\DATIAP~1\TITLEE~1\Aimstyle.exe O4 - Startup: A Smaller Note 99.lnk = C:\Documents and Settings\angelo ferraro\Documenti\download\smaller note\note.exe O4 - Global Startup: Internet Security.lnk = C:\Programmi\Internet Security\backweb\1655489\Program\fspex.exe O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: &Blocca questo popup - C:\Programmi\Internet Security\Anti-Spyware\blockpopups.htm O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Filtro pagine Web - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Programmi\Internet Security\FSPC\fspcmsie.dll O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Programmi\Internet Security\FSPC\fspcmsie.dll O9 - Extra 'Tools' menuitem: Filtro pagine Web - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Programmi\Internet Security\FSPC\fspcmsie.dll O9 - Extra button: Protezione IE - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Programmi\Internet Security\Anti-Spyware\ieshield.dll O9 - Extra 'Tools' menuitem: Protezione IE... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Programmi\Internet Security\Anti-Spyware\ieshield.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Programmi\AIM\aim.exe O9 - Extra button: Dictionary - {b3d50f24-9482-4391-8c6a-976e8e3ec08d} - c:\pomidor\pomidor.exe (file missing) O9 - Extra 'Tools' menuitem: &Dictionary - {b3d50f24-9482-4391-8c6a-976e8e3ec08d} - c:\pomidor\pomidor.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O10 - Broken Internet access because of LSP provider 'c:\programmi\newdotnet\newdotnet6_38.dll' missing O12 - Plugin for .spop: C:\Programmi\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {53D602E4-66ED-4B03-A5B8-19E4F4F6F18F} (Tiphone Control) - http://netphone.tiscali.it/netphone/ocx/tiphone.cab O16 - DPF: {7A32634B-029C-4836-A023-528983982A49} (MSN Chat Control 4.2) - http://fdl.msn.com/public/chat/msnchat42.cab O16 - DPF: {8EC18CE2-D7B4-11D2-88C8-006008A717FD} (NCSView Class) - http://ww3.atlanteitaliano.it/ecwplugins/ncs.cab O16 - DPF: {99D8AF4F-307A-461C-A404-BFA33D502B31} (APStartX Control) - http://217.169.119.216/resources/APStart.ocx O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...06/mcfscan.cab O23 - Service: Internet Security (BackWeb Plug-in - 1655489) - Wind - C:\PROGRA~1\INTERN~2\backweb\1655489\Program\SERVIC~1.EXE O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Programmi\Internet Security\Anti-Virus\fsgk32st.exe O23 - Service: fsbwsys - F-Secure Corp. - C:\Programmi\Internet Security\backweb\1655489\program\fsbwsys.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Programmi\Internet Security\FWES\Program\fsdfwd.exe O23 - Service: F-Secure HTTP Server (fshttps) - F-Secure Corporation - C:\Programmi\Internet Security\FSPC\fshttps\fshttps.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Programmi\Internet Security\Common\FSMA32.EXE O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

13-04-2006, 14:53	#1997
nessunopiu Member Iscritto dal: Jul 2005 Messaggi: 277	Guarda ormai conosco talmente bene le mie " voci " che appena vedo uno 015, 02, o altro "fuori posto" salta agli occhi. Colgo l'occasio per fare gli auguri di una buona Pasqua a te e a chi passa da queste parti.......... Auguroni __________________ Se le cose le sai , sembrano facili !!

13-04-2006, 15:11	#1998
Stev-O Senior Member Iscritto dal: Sep 2005 Città: Opinions are like assholes: anybody has one... Messaggi: 34290	ah ma se ci sono opinioni con il log sopra di' pure... solo non si riesce sempre a generalizzare la cosa Non è che sia un "cultore" specifico dei logs ne ho una conoscenza archivistica mnemonica dei processi per cui mi può tranquillamente scappare fuori qualcosa Buona Pasqua !!! __________________ Ну давай !! . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Cina, bugiardo - stolen conto: non paghi . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . *NON CERCO PIU' UN ALIMENTATORE DECENTE ----------------> LINK*

13-04-2006, 15:29	#2000
Stev-O Senior Member Iscritto dal: Sep 2005 Città: Opinions are like assholes: anybody has one... Messaggi: 34290	non era assolutamente polemico il mio post invitavo anche altri a dire la loro... ben lungi dall'avere atteggiamenti diprotagonismo che odio tra l'altro __________________ Ну давай !! . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Cina, bugiardo - stolen conto: non paghi . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . *NON CERCO PIU' UN ALIMENTATORE DECENTE ----------------> LINK*

Strumenti
Mostra una versione stampabile Invia questa pagina per email