TR/Dldr.ConHook.Gen incancellabile

[lo_straniero]

dopo vari tentativi grazie alla pazienza di 2 utenti non sono riuscito ancora a togliere questo maledetto TR/Dldr.ConHook.Gen


http://www.hwupgrade.it/forum/showpo...postcount=6964

e

http://www.hwupgrade.it/forum/showpo...postcount=6735


ho provato i piu blastonati antivirus ma nulla....

ora ho avira che li vede ma non riesce a toglierli ...................



aiutoooooooooooooooooooooooooooo

[wizard1993]

log di hiajctkhis ( www.trendsecure.com )
e possibilmente scansione co a-sqared ( www.emsisoft.com )

[lo_straniero]

Originariamente inviato da wizard1993

log di hiajctkhis ( www.trendsecure.com )
e possibilmente scansione co a-sqared ( www.emsisoft.com )

hihihihihi magari fossi cosi una cagata


leggi bene i 2 link che ho messo apposta

[wizard1993]

fai te; ma vorrei vederlo anche io; possibilmente nuovo ì, per lo meno vediamo se è cambiato qualcosa e già che ci sei fai una anche una scan con gmer

[Riverside]

Originariamente inviato da lo_straniero

dopo vari tentativi grazie alla pazienza di 2 utenti non sono riuscito ancora a togliere questo maledettoTR/Dldr.ConHook.Gen

Scarica e lancia Avenger, seleziona input script manually
ed inserisci questo script:

Files to delete:
C:\WINDOWS\system32\pmnnn.dll
c:\WINDOWS\system32\ntesybyt.dll

Ti avevo detto di fixare queste voci:
O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "C:\WINDOWS\system32\yqkjfhoi.dll",sitypnow

questa, la fixi dopo aver killato quel servizio e dopo aver fatto analizzare atsymtdo.exe su VirusTotal:
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\atsymtdo.exe (file missing)

[lo_straniero]

Originariamente inviato da wizard1993

fai te; ma vorrei vederlo anche io; possibilmente nuovo ì, per lo meno vediamo se è cambiato qualcosa e già che ci sei fai una anche una scan con gmer

ho messo gmer che devo fare ora?

Originariamente inviato da Riverside

Scarica e lancia Avenger, seleziona input script manually
ed inserisci questo script:

Files to delete:
C:\WINDOWS\system32\pmnnn.dll
c:\WINDOWS\system32\ntesybyt.dll

Ti avevo detto di fixare queste voci:
O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "C:\WINDOWS\system32\yqkjfhoi.dll",sitypnow

questa, la fixi dopo aver killato quel servizio e dopo aver fatto analizzare atsymtdo.exe su VirusTotal:
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\atsymtdo.exe (file missing)

grazie per la pazienza i hijackThins li ho fixati

con the avenger mi da errore appena li seleziono e clicco il semaforino

[Riverside]

Originariamente inviato da lo_straniero

con the avenger mi da errore appena li seleziono e clicco il semaforino

Non lo posizionare sul desktop, ma in C:/Avenger

[juninho85]

è virtumonde,hai voglia a fare scansioni con HJT,se solo avessi letto qualche post prima del tuo sul thread di hijactkhis....
prova con questo tool.

[lo_straniero]

Originariamente inviato da Riverside

Non lo posizionare sul desktop, ma in C:/Avenger

fatto ma niente mi da errore

ho provato anche con AGVPFIX.exe mi riavvia e i 2 file sono sempre li li odio


sei un santo ad avere pazienza

[lo_straniero]

Originariamente inviato da juninho85

è virtumonde,hai voglia a fare scansioni con HJT,se solo avessi letto qualche post prima del tuo sul thread di hijactkhis....
prova con questo tool.

[10/11/2007, 21:44:24] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Fatima\Desktop\VirtumundoBeGone.exe" )
[10/11/2007, 21:44:26] - Detected System Information:
[10/11/2007, 21:44:26] - Windows Version: 5.1.2600, Service Pack 2
[10/11/2007, 21:44:26] - Current Username: Fatima (Admin)
[10/11/2007, 21:44:26] - Windows is in NORMAL mode.
[10/11/2007, 21:44:26] - Searching for Browser Helper Objects:
[10/11/2007, 21:44:26] - BHO 1: {048CA0A1-6299-49EC-9778-B4328EA33A34} ()
[10/11/2007, 21:44:26] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/11/2007, 21:44:26] - No filename found. Continuing.
[10/11/2007, 21:44:26] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Supporto di collegamento per Adobe PDF Reader)
[10/11/2007, 21:44:26] - BHO 3: {07C3FDB2-C751-44DC-B7DA-842C771E7980} ()
[10/11/2007, 21:44:26] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/11/2007, 21:44:26] - No filename found. Continuing.
[10/11/2007, 21:44:26] - BHO 4: {0BA06BE8-4873-43E5-AC4B-D89EB94C2DB4} ()
[10/11/2007, 21:44:26] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/11/2007, 21:44:26] - No filename found. Continuing.
[10/11/2007, 21:44:26] - BHO 5: {20D05B9E-F885-446E-A7AC-1B7C43E69343} ()
[10/11/2007, 21:44:26] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/11/2007, 21:44:26] - No filename found. Continuing.
[10/11/2007, 21:44:26] - BHO 6: {23EB30A0-37F8-4F04-B551-38A31B516262} ()
[10/11/2007, 21:44:26] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/11/2007, 21:44:26] - No filename found. Continuing.
[10/11/2007, 21:44:26] - BHO 7: {4224703C-B626-4366-A8B9-0482A33BDF53} ()
[10/11/2007, 21:44:26] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/11/2007, 21:44:26] - No filename found. Continuing.
[10/11/2007, 21:44:26] - BHO 8: {4C77326C-8D27-41D6-851A-14E5A355A9DC} ()
[10/11/2007, 21:44:26] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/11/2007, 21:44:26] - No filename found. Continuing.
[10/11/2007, 21:44:26] - BHO 9: {6506A94B-6278-46F5-B861-8AEE3E09398B} ()
[10/11/2007, 21:44:26] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/11/2007, 21:44:26] - No filename found. Continuing.
[10/11/2007, 21:44:26] - BHO 10: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[10/11/2007, 21:44:26] - BHO 11: {777EA270-3F1F-4101-BE82-D3D45CF9C060} ()
[10/11/2007, 21:44:26] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/11/2007, 21:44:26] - No filename found. Continuing.
[10/11/2007, 21:44:26] - BHO 12: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[10/11/2007, 21:44:26] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/11/2007, 21:44:26] - No filename found. Continuing.
[10/11/2007, 21:44:26] - BHO 13: {89AD4D75-2429-462e-BD4E-443F233F6033} ()
[10/11/2007, 21:44:26] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/11/2007, 21:44:26] - Checking for HKLM\...\Winlogon\Notify\ntesybyt
[10/11/2007, 21:44:26] - Key not found: HKLM\...\Winlogon\Notify\ntesybyt, continuing.
[10/11/2007, 21:44:26] - BHO 14: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[10/11/2007, 21:44:26] - BHO 15: {9B70DD28-3024-4D2E-94E8-1B54442B9A51} ()
[10/11/2007, 21:44:26] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/11/2007, 21:44:26] - No filename found. Continuing.
[10/11/2007, 21:44:26] - BHO 16: {A23AE8EA-D6BA-403A-BFB5-C34FCD43CC1F} ()
[10/11/2007, 21:44:26] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/11/2007, 21:44:26] - No filename found. Continuing.
[10/11/2007, 21:44:26] - BHO 17: {AB638F54-8A87-4EB8-BF4B-9769946ACE8E} ()
[10/11/2007, 21:44:26] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/11/2007, 21:44:26] - No filename found. Continuing.
[10/11/2007, 21:44:26] - BHO 18: {D358182C-4E05-4300-A3CB-BB2FFCA761DC} ()
[10/11/2007, 21:44:26] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/11/2007, 21:44:26] - No filename found. Continuing.
[10/11/2007, 21:44:26] - BHO 19: {DE6FB5C6-97C8-49B7-BCC2-1DA7BB307D2F} ()
[10/11/2007, 21:44:26] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/11/2007, 21:44:26] - No filename found. Continuing.
[10/11/2007, 21:44:26] - BHO 20: {E5A1691B-D188-4419-AD02-90002030B8EE} (FlashFXP Helper for Internet Explorer)
[10/11/2007, 21:44:26] - BHO 21: {E666B026-29F4-41F9-B095-FE0D262CB145} ()
[10/11/2007, 21:44:26] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/11/2007, 21:44:26] - Checking for HKLM\...\Winlogon\Notify\pmnnn
[10/11/2007, 21:44:26] - Key not found: HKLM\...\Winlogon\Notify\pmnnn, continuing.
[10/11/2007, 21:44:26] - Finished Searching Browser Helper Objects
[10/11/2007, 21:44:26] - Finishing up...
[10/11/2007, 21:44:26] - Nothing found! Exiting...

[10/11/2007, 21:45:18] - VirtumundoBeGone v1.5 ( "C:\VirtumundoBeGone.exe" )
[10/11/2007, 21:45:20] - Detected System Information:
[10/11/2007, 21:45:20] - Windows Version: 5.1.2600, Service Pack 2
[10/11/2007, 21:45:20] - Current Username: Fatima (Admin)
[10/11/2007, 21:45:20] - Windows is in NORMAL mode.
[10/11/2007, 21:45:20] - Searching for Browser Helper Objects:
[10/11/2007, 21:45:20] - BHO 1: {048CA0A1-6299-49EC-9778-B4328EA33A34} ()
[10/11/2007, 21:45:20] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/11/2007, 21:45:20] - No filename found. Continuing.
[10/11/2007, 21:45:20] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Supporto di collegamento per Adobe PDF Reader)
[10/11/2007, 21:45:20] - BHO 3: {07C3FDB2-C751-44DC-B7DA-842C771E7980} ()
[10/11/2007, 21:45:20] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/11/2007, 21:45:20] - No filename found. Continuing.
[10/11/2007, 21:45:20] - BHO 4: {0BA06BE8-4873-43E5-AC4B-D89EB94C2DB4} ()
[10/11/2007, 21:45:20] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/11/2007, 21:45:20] - No filename found. Continuing.
[10/11/2007, 21:45:20] - BHO 5: {20D05B9E-F885-446E-A7AC-1B7C43E69343} ()
[10/11/2007, 21:45:20] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/11/2007, 21:45:20] - No filename found. Continuing.
[10/11/2007, 21:45:20] - BHO 6: {23EB30A0-37F8-4F04-B551-38A31B516262} ()
[10/11/2007, 21:45:20] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/11/2007, 21:45:20] - No filename found. Continuing.
[10/11/2007, 21:45:20] - BHO 7: {4224703C-B626-4366-A8B9-0482A33BDF53} ()
[10/11/2007, 21:45:20] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/11/2007, 21:45:20] - No filename found. Continuing.
[10/11/2007, 21:45:20] - BHO 8: {4C77326C-8D27-41D6-851A-14E5A355A9DC} ()
[10/11/2007, 21:45:20] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/11/2007, 21:45:20] - No filename found. Continuing.
[10/11/2007, 21:45:20] - BHO 9: {6506A94B-6278-46F5-B861-8AEE3E09398B} ()
[10/11/2007, 21:45:20] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/11/2007, 21:45:20] - No filename found. Continuing.
[10/11/2007, 21:45:20] - BHO 10: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[10/11/2007, 21:45:20] - BHO 11: {777EA270-3F1F-4101-BE82-D3D45CF9C060} ()
[10/11/2007, 21:45:20] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/11/2007, 21:45:20] - No filename found. Continuing.
[10/11/2007, 21:45:20] - BHO 12: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[10/11/2007, 21:45:20] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/11/2007, 21:45:20] - No filename found. Continuing.
[10/11/2007, 21:45:20] - BHO 13: {89AD4D75-2429-462e-BD4E-443F233F6033} ()
[10/11/2007, 21:45:20] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/11/2007, 21:45:20] - Checking for HKLM\...\Winlogon\Notify\ntesybyt
[10/11/2007, 21:45:20] - Key not found: HKLM\...\Winlogon\Notify\ntesybyt, continuing.
[10/11/2007, 21:45:20] - BHO 14: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[10/11/2007, 21:45:20] - BHO 15: {9B70DD28-3024-4D2E-94E8-1B54442B9A51} ()
[10/11/2007, 21:45:20] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/11/2007, 21:45:20] - No filename found. Continuing.
[10/11/2007, 21:45:20] - BHO 16: {A23AE8EA-D6BA-403A-BFB5-C34FCD43CC1F} ()
[10/11/2007, 21:45:20] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/11/2007, 21:45:20] - No filename found. Continuing.
[10/11/2007, 21:45:20] - BHO 17: {AB638F54-8A87-4EB8-BF4B-9769946ACE8E} ()
[10/11/2007, 21:45:20] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/11/2007, 21:45:20] - No filename found. Continuing.
[10/11/2007, 21:45:20] - BHO 18: {D358182C-4E05-4300-A3CB-BB2FFCA761DC} ()
[10/11/2007, 21:45:20] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/11/2007, 21:45:20] - No filename found. Continuing.
[10/11/2007, 21:45:20] - BHO 19: {DE6FB5C6-97C8-49B7-BCC2-1DA7BB307D2F} ()
[10/11/2007, 21:45:20] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/11/2007, 21:45:20] - No filename found. Continuing.
[10/11/2007, 21:45:20] - BHO 20: {E5A1691B-D188-4419-AD02-90002030B8EE} (FlashFXP Helper for Internet Explorer)
[10/11/2007, 21:45:20] - BHO 21: {E666B026-29F4-41F9-B095-FE0D262CB145} ()
[10/11/2007, 21:45:20] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/11/2007, 21:45:20] - Checking for HKLM\...\Winlogon\Notify\pmnnn
[10/11/2007, 21:45:20] - Key not found: HKLM\...\Winlogon\Notify\pmnnn, continuing.
[10/11/2007, 21:45:20] - Finished Searching Browser Helper Objects
[10/11/2007, 21:45:20] - Finishing up...
[10/11/2007, 21:45:20] - Nothing found! Exiting...

[juninho85]

brutto recchione
prova con questo,in alternativa ci sarebbe quest'altro

[Mazda RX8]

dimmi se su C:/Programmi/File Comuni/system ci sono file strani...

[lo_straniero]

problema risolto ragazzi...dopo 1mese e mezzo





ho usato VundoFix.exe e mi li ha tolti(non capisco perche l'altra volta non ci è riuscito )


grazie a tutti quelli che mi hanno suportato ....sopratutto a juninho85 Riverside Mazda RX8


una volta rimosso i vundo ho riavviato .....il bello che il pc si è avviato subito senza troppi minuti seccanti...ho messo la password all'avvio e ci ha messo un minuto scarso.


x juninho85

________________________________________________________________________


ragazzi queste sono i software per gli antivirus/ecc che ho installati nel pc

ccleaner/a-squared/spybot/avira personaledition classic/comodo firewall pro/vundo

bastano o aggiungo qualche altro soft utile ?


________________________________________________________________

ecco spero sia pulito

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22.19.54, on 11/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Programmi\a-squared Free\a2service.exe
C:\Programmi\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Programmi\Bonjour\mDNSResponder.exe
C:\Programmi\Comodo\Firewall\cmdagent.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\__GameS__\medal airborne\UnrealEngine3\MOHAGame\pb\PnkBstrA.exe
C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\Programmi\Comodo\Firewall\CPF.exe
C:\Programmi\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programmi\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe
C:\Programmi\File comuni\Ahead\Lib\NMIndexingService.exe
C:\Programmi\File comuni\Ahead\Lib\NMIndexStoreSvr.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://pack.google.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: (no name) - {048CA0A1-6299-49EC-9778-B4328EA33A34} - (no file)
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {07C3FDB2-C751-44DC-B7DA-842C771E7980} - (no file)
O2 - BHO: (no name) - {0BA06BE8-4873-43E5-AC4B-D89EB94C2DB4} - (no file)
O2 - BHO: (no name) - {20D05B9E-F885-446E-A7AC-1B7C43E69343} - (no file)
O2 - BHO: (no name) - {23EB30A0-37F8-4F04-B551-38A31B516262} - (no file)
O2 - BHO: (no name) - {4224703C-B626-4366-A8B9-0482A33BDF53} - (no file)
O2 - BHO: (no name) - {4C77326C-8D27-41D6-851A-14E5A355A9DC} - (no file)
O2 - BHO: (no name) - {6506A94B-6278-46F5-B861-8AEE3E09398B} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {777EA270-3F1F-4101-BE82-D3D45CF9C060} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8B7C8F78-4470-4AED-89EA-6A5C2A518CEF} - C:\WINDOWS\system32\pmnnn.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9B70DD28-3024-4D2E-94E8-1B54442B9A51} - (no file)
O2 - BHO: (no name) - {A23AE8EA-D6BA-403A-BFB5-C34FCD43CC1F} - (no file)
O2 - BHO: (no name) - {AB638F54-8A87-4EB8-BF4B-9769946ACE8E} - (no file)
O2 - BHO: (no name) - {D358182C-4E05-4300-A3CB-BB2FFCA761DC} - (no file)
O2 - BHO: (no name) - {DE6FB5C6-97C8-49B7-BCC2-1DA7BB307D2F} - (no file)
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\Programmi\FlashFXP\IEFlash.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Diagnostica SpeedTouch USB] "C:\Programmi\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmi\File comuni\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Programmi\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [avgnt] "C:\Programmi\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{57F6F824-557B-480D-900B-60C81D672323}: NameServer = 193.70.152.15 193.70.152.25
O17 - HKLM\System\CS1\Services\Tcpip\..\{57F6F824-557B-480D-900B-60C81D672323}: NameServer = 193.70.152.15 193.70.152.25
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: rqrppmm - C:\WINDOWS\
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Programmi\a-squared Free\a2service.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmi\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programmi\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Programmi\Bonjour\mDNSResponder.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Programmi\Comodo\Firewall\cmdagent.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programmi\File comuni\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NBService - Nero AG - C:\Programmi\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programmi\File comuni\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PunkBuster (PnkBstrA) - Unknown owner - C:\__GameS__\medal airborne\UnrealEngine3\MOHAGame\pb\PnkBstrA.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 7573 bytes

[Mazda RX8]

fixa:

O20 - Winlogon Notify: rqrppmm - C:\WINDOWS\
O2 - BHO: (no name) - {8B7C8F78-4470-4AED-89EA-6A5C2A518CEF} - C:\WINDOWS\system32\pmnnn.dll (file missing)

xké qsti xké sono tanti??

O2 - BHO: (no name) - {9B70DD28-3024-4D2E-94E8-1B54442B9A51} - (no file)
O2 - BHO: (no name) - {A23AE8EA-D6BA-403A-BFB5-C34FCD43CC1F} - (no file)
O2 - BHO: (no name) - {AB638F54-8A87-4EB8-BF4B-9769946ACE8E} - (no file)
O2 - BHO: (no name) - {D358182C-4E05-4300-A3CB-BB2FFCA761DC} - (no file)
O2 - BHO: (no name) - {DE6FB5C6-97C8-49B7-BCC2-1DA7BB307D2F} - (no file)
O2 - BHO: (no name) - {07C3FDB2-C751-44DC-B7DA-842C771E7980} - (no file)
O2 - BHO: (no name) - {0BA06BE8-4873-43E5-AC4B-D89EB94C2DB4} - (no file)
O2 - BHO: (no name) - {048CA0A1-6299-49EC-9778-B4328EA33A34} - (no file)
O2 - BHO: (no name) - {20D05B9E-F885-446E-A7AC-1B7C43E69343} - (no file)
O2 - BHO: (no name) - {23EB30A0-37F8-4F04-B551-38A31B516262} - (no file)
O2 - BHO: (no name) - {4224703C-B626-4366-A8B9-0482A33BDF53} - (no file)
O2 - BHO: (no name) - {4C77326C-8D27-41D6-851A-14E5A355A9DC} - (no file)
O2 - BHO: (no name) - {6506A94B-6278-46F5-B861-8AEE3E09398B} - (no file)
O2 - BHO: (no name) - {777EA270-3F1F-4101-BE82-D3D45CF9C060} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

[Gle89]

straniero

puoi anche fixiare(disabilitato prima il ripristinio di config di sistema) alcuni voci dell'avvio che sono superlfue come:

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmi\File comuni\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

cosi il pc si avvierà ancora più veloce

[Mazda RX8]

Originariamente inviato da Gle89

straniero

puoi anche fixiare(disabilitato prima il ripristinio di config di sistema) alcuni voci dell'avvio che sono superlfue come:


cosi il pc si avvierà ancora più veloce

qsti no!!!

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

[Riverside]

Originariamente inviato da lo_straniero

problema risolto ragazzi...dopo 1 mese e mezzo ...... ho usato VundoFix.exe e mi li ha tolti

Era ora

Originariamente inviato da lo_straniero

grazie a tutti quelli che mi hanno suportato ....sopratutto a juninho85 Riverside Mazda RX8

Riverside porcaccia miseria il mio primo script per Avenger e non ci ho preso

[Gle89]

Originariamente inviato da Mazda RX8

qsti no!!!

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

pardon

[juninho85]

Originariamente inviato da Mazda RX8

qsti no!!!

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

son comunque superflui,nel senso che son tutte impostazione facilmente raggiungibili con un tasto destro sul desktop/impostazioni/avanzate e sopratutto non compromettono il corretto funzionamento della scheda video

[lo_straniero]

Originariamente inviato da Mazda RX8

fixa:

O20 - Winlogon Notify: rqrppmm - C:\WINDOWS\
O2 - BHO: (no name) - {8B7C8F78-4470-4AED-89EA-6A5C2A518CEF} - C:\WINDOWS\system32\pmnnn.dll (file missing)

xké qsti xké sono tanti??

O2 - BHO: (no name) - {9B70DD28-3024-4D2E-94E8-1B54442B9A51} - (no file)
O2 - BHO: (no name) - {A23AE8EA-D6BA-403A-BFB5-C34FCD43CC1F} - (no file)
O2 - BHO: (no name) - {AB638F54-8A87-4EB8-BF4B-9769946ACE8E} - (no file)
O2 - BHO: (no name) - {D358182C-4E05-4300-A3CB-BB2FFCA761DC} - (nofile)
O2 - BHO: (no name) - {DE6FB5C6-97C8-49B7-BCC2-1DA7BB307D2F} - (no file)
O2 - BHO: (no name) - {07C3FDB2-C751-44DC-B7DA-842C771E7980} - (no file)
O2 - BHO: (no name) - {0BA06BE8-4873-43E5-AC4B-D89EB94C2DB4} - (no file)
O2 - BHO: (no name) - {048CA0A1-6299-49EC-9778-B4328EA33A34} - (no file)
O2 - BHO: (no name) - {20D05B9E-F885-446E-A7AC-1B7C43E69343} - (no file)
O2 - BHO: (no name) - {23EB30A0-37F8-4F04-B551-38A31B516262} - (no file)
O2 - BHO: (no name) - {4224703C-B626-4366-A8B9-0482A33BDF53} - (no file)
O2 - BHO: (no name) - {4C77326C-8D27-41D6-851A-14E5A355A9DC} - (no file)
O2 - BHO: (no name) - {6506A94B-6278-46F5-B861-8AEE3E09398B} - (no file)
O2 - BHO: (no name) - {777EA270-3F1F-4101-BE82-D3D45CF9C060} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

Originariamente inviato da Gle89

straniero

puoi anche fixiare(disabilitato prima il ripristinio di config di sistema) alcuni voci dell'avvio che sono superlfue come:


cosi il pc si avvierà ancora più veloce

Originariamente inviato da Mazda RX8

qsti no!!!

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

decidetevi

Originariamente inviato da Riverside

Era ora

Riverside porcaccia miseria il mio primo script per Avenger e non ci ho preso

grazie Riverside