Reindirizzamento su Chrome Outlook e Explorer

[davide87]

Ciao a tutti..
oggi ho installato un programma che mi ha installato insieme questo " http://search.certified-toolbar.com/"
apro sia chrome, outlook e explorer e mi reindirizzano su questo motore di ricerca, ho fatto il suo uninstaller seguito da una pulizia dei registri con ccleaner ma niente... provato anche combofix, AdwCleaner e HijackThis ma non trovano niente...
mi potete dare qualche dritta!
Grazie!!

[ercolino]

Con HijackThis verifica se per caso gli 017 hanno questi DNS

176.31.229.24
176.31.229.25

Vanno subito eliminati ,sono Virus DNS Charger

[davide87]

no ci sono i miei 151.99.125.1

[davide87]

consigli?

[davide87]

all'avvio mi aggiunge anche un preferito nel lettore RSSOwl, è come se ci fosse un file che ad ogni avvio reimposta le home page

[davide87]

Penso di aver Risolto! quando cliccavo per aprire il blocco note mi dava un errore, quindi ho fatto tasto destro proprietà sul exe del blocco note è sulla stringa destinazione c'era l'indirizzo del motore di ricerca ostile!!! infatti poi ho controllato l'exe di Explorer e c'era anche li uguale per chrome e per outlook! bastard*!!! adesso spero solo che ravviando non si rimodifica la stringa!!

[camios]

Credo di avere lo stesso problema, se faccio una ricerca su google e poi clicco su uno dei risultati. poi vengo reindirizzato su pagine tipo
tlbsearch

non ho capito bene da questo thread cosa fare per rislvere- Ho provato TDSS killer ma non va

[camios]

Copio ed incollo il log di Combo fix, il problema c'è ancora, dopo una ricerca su google se clicco sui risultati il browser viene indirizzato su tlbsearch

ComboFix 13-04-15.01 - camiolapa 16/04/2013 8.27.49.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.39.1040.18.3070.1691 [GMT 2:00]
Eseguito da: c:\users\camiolapa\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {61CDFD9D-3CAC-9270-C6FC-52325ACB795B}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Esecuzione precedente -------
.
c:\program files\Common Files\ASPG_icon.ico
c:\users\camiolapa\g2mdlhlpx.exe
c:\windows\msvcr71.dll
.
.
((((((((((((((((((((((((( Files Creati Da 2013-03-16 al 2013-04-16 )))))))))))))))))))))))))))))))))))
.
.
2013-04-16 06:39 . 2013-04-16 06:39 -------- d-----w- c:\users\camiolapa\AppData\Local\temp
2013-04-16 06:39 . 2013-04-16 06:39 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-04-15 14:56 . 2013-04-15 14:56 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2013-04-15 14:51 . 2013-04-15 14:51 -------- d-----w- c:\users\camiolapa\AppData\Roaming\HPAppData
2013-04-15 12:23 . 2013-04-15 22:34 308 ----a-w- c:\windows\DeleteOnReboot.bat
2013-04-12 13:21 . 2013-04-12 13:21 98304 --sha-r- c:\windows\system32\fdeploy5.dll
2013-04-12 07:20 . 2013-03-15 07:21 7108640 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{7138C7B4-A261-40CA-AF2C-86F674295D09}\mpengine.dll
2013-04-07 09:12 . 2013-04-07 09:12 -------- d-----w- c:\program files\Common Files\Skype
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-04-15 22:37 . 2009-07-27 10:56 45056 ----a-w- c:\windows\system32\acovcnt.exe
2013-04-04 12:50 . 2011-05-18 07:13 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-03-27 05:31 . 2012-11-30 10:32 33112 ----a-w- c:\windows\system32\drivers\avgtpx86.sys
2013-03-11 23:10 . 2009-10-05 15:57 237088 ------w- c:\windows\system32\MpSigStub.exe
2013-03-04 08:07 . 2013-01-14 20:38 632656 ----a-w- c:\windows\system32\msvcr80.dll
2013-03-04 08:07 . 2013-01-14 20:38 554832 ----a-w- c:\windows\system32\msvcp80.dll
2013-03-04 08:07 . 2013-01-14 20:38 479232 ----a-w- c:\windows\system32\msvcm80.dll
2013-03-04 08:07 . 2013-01-14 20:38 773968 ----a-w- c:\windows\system32\msvcr100.dll
2013-03-04 08:07 . 2013-01-14 20:38 421200 ----a-w- c:\windows\system32\msvcp100.dll
2008-10-14 22:57 . 2008-10-14 22:57 106496 ----a-w- c:\program files\Common Files\CPInstallAction.dll
2013-04-10 06:57 . 2013-04-15 15:04 263064 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2009-11-25 14:35 . 2012-11-30 08:03 119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ADSMOverlayIcon1]
@="{A8D448F4-0431-45AC-9F5E-E1B434AB2249}"
[HKEY_CLASSES_ROOT\CLSID\{A8D448F4-0431-45AC-9F5E-E1B434AB2249}]
2007-06-02 01:08 143360 ----a-w- c:\program files\ASUS\ASUS Data Security Manager\OverlayIconShlExt1.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2013-02-28 18642024]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-03 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe" [2008-07-19 104936]
"P2Go_Menu"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2009-11-25 30192]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-02 13597216]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-02 92704]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2008-11-25 6691360]
"HControlUser"="c:\program files\ASUS\ATK Hotkey\HControlUser.exe" [2008-08-18 98304]
"ATKOSD2"="c:\program files\ASUS\ATKOSD2\ATKOSD2.exe" [2008-09-03 8105984]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-07-31 1348904]
"ADSMTray"="c:\program files\ASUS\ASUS Data Security Manager\ADSMTray.exe" [2009-03-03 272952]
"ATKMEDIA"="c:\program files\ASUS\ATK Media\DMedia.exe" [2008-08-19 159744]
"ACMON"="c:\program files\ASUS\Splendid\ACMON.exe" [2008-10-01 851968]
"ASUS Screen Saver Protector"="c:\windows\AsScrPro.exe" [2009-03-03 3054136]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-03-03 959976]
"fssui"="c:\program files\Windows Live\Family Safety\fsui.exe" [2010-04-28 647528]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2012-11-19 2598520]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2009-11-18 54576]
"ataDaemon"="c:\program files\AliceTiAiuta\McciTrayApp.exe" [2007-10-17 1007504]
"starter4g"="c:\windows\starter4g.exe" [2009-05-14 157456]
"PMBVolumeWatcher"="c:\program files\Sony\PMB\PMBVolumeWatcher.exe" [2010-11-26 648032]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"AutoLaunch"="c:\program files\Lavasoft\Ad-Aware\AutoLaunch.exe" [2011-08-15 669936]
.
c:\users\camiolapa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-7-30 752168]
FancyStart daemon.lnk - c:\windows\Installer\{567C654B-7FE9-4970-8323-56E8191D1941}\_71A97E24F422AA49EDBF39.exe [2009-3-3 12862]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli c:\program files\ASUS\ASUS Data Security Manager\ASPWDFLT
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
.
--- Altri Servizi/Drivers In Memoria ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
getPlusHelper REG_MULTI_SZ getPlusHelper
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 18:14 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-04-15 15:08 1642448 ----a-w- c:\program files\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe
.
Contenuto della cartella 'Scheduled Tasks'
.
2013-04-15 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-07-03 12:33]
.
2013-04-16 c:\windows\Tasks\BTGRG.job
- c:\windows\system32\fdeploy5.dll [2013-04-12 13:21]
.
2013-04-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-11-01 16:40]
.
2013-04-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-11-01 16:40]
.
2013-04-15 c:\windows\Tasks\User_Feed_Synchronization-{458A6A95-9158-4699-8BAA-D66AAB14394D}.job
- c:\windows\system32\msfeedssync.exe [2011-06-17 04:32]
.
.
------- Scansione supplementare -------
.
uStart Page = about:blank
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS
uInternet Settings,ProxyOverride = <local>
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.100.1
FF - ProfilePath - c:\users\camiolapa\AppData\Roaming\Mozilla\Firefox\Profiles\ygjq4522.default\
FF - ExtSQL: 2013-04-05 09:35; {20a82645-c095-46ed-80e3-08825760534b}; c:\users\camiolapa\AppData\Roaming\Mozilla\Firefox\Profiles\ygjq4522.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - ExtSQL: !HIDDEN! 2009-09-03 08:42; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - ExtSQL: !HIDDEN! 2010-12-04 15:11; [email protected]; c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
.
- - - - CHIAVI ORFANE RIMOSSE - - - -
.
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
HKCU-Run-Facebook Update - c:\users\camiolapa\AppData\Local\Facebook\Update\FacebookUpdate.exe
HKCU-Run-GameXN GO - c:\programdata\GameXN\GameXNGO.exe
HKLM-Run-WinampAgent - c:\program files\Winamp\winampa.exe
HKLM-Run-vProt - c:\program files\AVG Secure Search\vprot.exe
SafeBoot-38622600.sys
SafeBoot-49076468.sys
SafeBoot-89050925.sys
AddRemove-Activation Assistant for the 2007 Microsoft Office suites - c:\programdata\{623D32E9-0C62-4453-AD44-98B31F52A5E1}\Microsoft Office Activation Assistant.exe
AddRemove-Ad-Aware - c:\programdata\{EF63305C-BAD7-4144-9208-D65528260864}\Ad-AwareAE.exe
AddRemove-Alice Ti Aiuta - c:\program files\AliceTiAiuta\Disinstalla Alice Ti Aiuta
AddRemove-WinHex - c:\program files\WinHex\WinHex.exe
AddRemove-{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF} - c:\programdata\{EF63305C-BAD7-4144-9208-D65528260864}\Ad-AwareAE.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-04-16 08:39
Windows 6.0.6001 Service Pack 1 NTFS
.
scansione processi nascosti ...
.
scansione entrate autostart nascoste ...
.
Scansione files nascosti ...
.
.
C:\ADSM_PData_0150
.
Scansione completata con successo
Files nascosti: 1
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Norton Internet Security]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Engine\16.0.0.125\diMaster.dll\" /prefetch:1"
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------
.
- - - - - - - > 'lsass.exe'(996)
c:\program files\ASUS\ASUS Data Security Manager\ASPWDFLT.dll
.
Ora fine scansione: 2013-04-16 08:43:16
ComboFix-quarantined-files.txt 2013-04-16 06:43
.
Pre-Run: 47.118.454.784 byte disponibili
Post-Run: 47.046.184.960 byte disponibili
.
- - End Of File - - 01594B24AA094AFA02EB76F452CF44CA

[Chill-Out]

http://www.hwupgrade.it/forum/showthread.php?t=2560524

in particolare il Post #2

PS: cerchiamo di accorpare i Thread, grazie.