about blank con w98!

04-08-2004, 15:04

scusate con w98 che faccio?

il log di hijackthis è

Logfile of HijackThis v1.98.1
Scan saved at 11.02.57, on 04/08/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SDMAN.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\HKCMD.EXE
C:\SABRE\APPS\ATS\SSSCLNT.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAMMI\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\SYSTEM\E_S10IC2.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SABSERV.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\SABRE\APPS\OADP\OADP.EXE
C:\WFXCTL32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\DOCUMENTI\HTML2POP3117BETAWIN32\HTML2POP3.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAMMI\MSN MESSENGER\MSNMSGR.EXE
C:\WFXMOD32.EXE
C:\PROGRAMMI\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE
C:\PROGRAMMI\OUTLOOK EXPRESS\MSIMN.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\TEMP\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\WINDOWS\TEMP\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\TEMP\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\WINDOWS\TEMP\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\WINDOWS\TEMP\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\WINDOWS\TEMP\sp.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fornito da ICL Italia S.p.A.
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=ita0711:80;gopher=ita0711:80;http=ita0711:80;https=ita0711:80;socks=ita0711:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.icl.co.uk;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMMI\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar2.dll
O2 - BHO: (no name) - {76147640-E487-11D8-92E7-000B4A60CEBC} - C:\WINDOWS\SYSTEM\EPGNJ.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\SYSTEM\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\SYSTEM\hkcmd.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Sabre Site Services] C:\SABRE\Apps\ATS\SSSClnt.EXE
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [EPSON Stylus C44 Series] C:\WINDOWS\SYSTEM\E_S10IC2.EXE /P23 "EPSON Stylus C44 Series" /O7 "EPUSB1:" /M "Stylus C44"
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SDApp] C:\WINDOWS\SDMan.EXE
O4 - HKCU\..\Run: [IEengine] C:\Program Files\Internet Explorer\IEengine.exe
O4 - Startup: Server Sabre.lnk = C:\WINDOWS\sabserv.exe
O4 - Startup: Sabre Printing Module.lnk = C:\SABRE\Apps\OADP\Oadp.exe
O4 - Startup: Controller.LNK = ?
O4 - Startup: Microsoft Office.lnk = C:\WINDOWS\Application Data\Microsoft\Installer\{00000410-78E1-11D2-B60F-006097C998E7}\misc.exe
O8 - Extra context menu item: &Google Search - res://C:\PROGRAMMI\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\PROGRAMMI\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\PROGRAMMI\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: Backward &Links - res://C:\PROGRAMMI\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programmi\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programmi\ICQLite\ICQLite.exe
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O16 - DPF: {9b935470-ad4a-11d5-b63e-00c04faedb18} (Oracle JInitiator 1.1.8.16) -
O16 - DPF: {1CC506A7-1B8D-11D4-BDD5-0060977007E0} (CrazyTalk Player) - http://plug-in.reallusion.com/CrazyTalk.cab
O16 - DPF: {8EC18CE2-D7B4-11D2-88C8-006008A717FD} (NCSView Class) - http://ww3.atlanteitaliano.it/ecwplugins/ncs.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = dns2.interbusiness.it
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 151.99.125.2,151.99.250.2
O18 - Filter: text/html - {6486A942-E52F-11D8-92E7-000B0627E554} - C:\WINDOWS\SYSTEM\EPGNJ.DLL
O18 - Filter: text/plain - {6486A942-E52F-11D8-92E7-000B0627E554} - C:\WINDOWS\SYSTEM\EPGNJ.DLL

04-08-2004, 15:06

Quote:

Originariamente inviato da netquik
prova innanzi tutto con CWshredder e about:blank

e ovviamente adaware

se non risolvi fixiamo il log e cerchiamo le dll nascoste (non con FINDnFIX che è solo per 2K/XP)
ti consiglio di aprire un nuovo thread

ho provato a scaricarmi il about blank ma mi da

"the database is either corrupted or missing. please download a new one"

netquik · 04-08-2004, 15:09

lo hai aggiornato?

04-08-2004, 15:13

Quote:

Originariamente inviato da netquik
lo hai aggiornato?

comer?

netquik · 04-08-2004, 15:20

quando fai partire about c'è il tasto update...

prova prima ad aggiornarlo

04-08-2004, 15:22

Quote:

Originariamente inviato da netquik
quando fai partire about c'è il tasto update...

prova prima ad aggiornarlo

a me non parte proprio!

netquik · 04-08-2004, 15:24

se ti va apri icq... così mi rispondi più velocemente

netquik · 04-08-2004, 15:25

hai estratto tutti i file s dell'archivio in una cartella?

04-08-2004, 15:31

Quote:

Originariamente inviato da netquik
hai estratto tutti i file s dell'archivio in una cartella?

NO!
ORA APRO ICQ! FINISCO CON UNA CLIENTE E SONO CON TE!

netquik · 04-08-2004, 16:50

Download: "StartDreck", da qui:

http://www.niksoft.at/download/startdreck.htm

Unzippalo in una sua cartella e fai partire il programma

Premi 'Config'
Premi 'Unmark All'

Check solo su queste box:
Registry -> Run Keys
System/drivers> Running processes
Premi 'OK'

Premi 'Save' e seleziona dove vuoi salvare il log
(di default sarà nella stessa dir del programma)

posta il log

04-08-2004, 16:56

eccolo

StartDreck (build 2.1.5 public BETA) - 2004-08-04 @ 16.51.07
Platform: Windows 98 SE (Win 4.10.2222 A)

»Registry
»Run Keys
»Current User
»Run
*IEengine=C:\Program Files\Internet Explorer\IEengine.exe
»RunOnce
»Default User
»Run
*IEengine=C:\Program Files\Internet Explorer\IEengine.exe
»RunOnce
»Local Machine
»Run
*ScanRegistry=C:\WINDOWS\scanregw.exe /autorun
*TaskMonitor=C:\WINDOWS\taskmon.exe
*SystemTray=SysTray.Exe
*IgfxTray=C:\WINDOWS\SYSTEM\igfxtray.exe
*HotKeysCmds=C:\WINDOWS\SYSTEM\hkcmd.exe
*LoadPowerProfile=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
*Sabre Site Services=C:\SABRE\Apps\ATS\SSSClnt.EXE
*LoadQM=loadqm.exe
*Norton Auto-Protect=C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
*EPSON Stylus C44 Series=C:\WINDOWS\SYSTEM\E_S10IC2.EXE /P23 "EPSON Stylus C44 Series" /O7 "EPUSB1:" /M "Stylus C44"
*StillImageMonitor=C:\WINDOWS\SYSTEM\STIMON.EXE
*Installed=1
*NoChange=1
*Installed=1
*Installed=1
»RunOnce
»RunServices
*LoadPowerProfile=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
*SchedulingAgent=mstask.exe
*SDApp=C:\WINDOWS\SDMan.EXE
»RunServicesOnce
**tcfs=rundll32 C:\WINDOWS\SYSTEM\HLP.DLL,StreamingDeviceSetup
»RunOnceEx
»RunServicesOnceEx
»Files
»System/Drivers
»Running Processes
*FFEFC501=C:\WINDOWS\SYSTEM\KERNEL32.DLL
*FFFC01A5=C:\WINDOWS\SYSTEM\MSGSRV32.EXE
*FFFC098D=C:\WINDOWS\SYSTEM\SPOOL32.EXE
*FFFC665D=C:\WINDOWS\SYSTEM\MPREXE.EXE
*FFFCCBE1=C:\WINDOWS\SDMAN.EXE
*FFFD1281=C:\WINDOWS\RUNDLL32.EXE
*FFE1CEA1=C:\WINDOWS\SYSTEM\mmtask.tsk
*FFE62AFD=C:\WINDOWS\EXPLORER.EXE
*FFE68B35=C:\WINDOWS\TASKMON.EXE
*FFE6F7FD=C:\WINDOWS\SYSTEM\SYSTRAY.EXE
*FFE77BC5=C:\WINDOWS\SYSTEM\HKCMD.EXE
*FFE4147D=C:\SABRE\APPS\ATS\SSSCLNT.EXE
*FFE440A9=C:\WINDOWS\LOADQM.EXE
*FFE70559=C:\PROGRAMMI\NORTON ANTIVIRUS\NAVAPW32.EXE
*FFE4AE41=C:\WINDOWS\SYSTEM\E_S10IC2.EXE
*FFE48395=C:\WINDOWS\SYSTEM\STIMON.EXE
*FFE57C15=C:\WINDOWS\SYSTEM\DDHELP.EXE
*FFE40E81=C:\WINDOWS\SABSERV.EXE
*FFE5E761=C:\SABRE\APPS\OADP\OADP.EXE
*FFE6EFA5=C:\WFXCTL32.EXE
*FFEE6045=C:\WINDOWS\SYSTEM\WMIEXE.EXE
*FFEF7A15=C:\WINDOWS\SYSTEM\TAPISRV.EXE
*FABAD9F9=C:\WFXMOD32.EXE
*FABEAA6D=C:\WINDOWS\SYSTEM\PSTORES.EXE
*FABF2A29=C:\SABRE\SV.EXE
*FABF2945=C:\WINDOWS\MDBCSAPI.EXE
*FABEDF09=C:\WINDOWS\SYSTEM\WSASRV.EXE
*FABF1F25=C:\SABRE\SBTIMER.EXE
*FABC0AC9=C:\DOCUMENTI\HTML2POP3117BETAWIN32\HTML2POP3.EXE
*FABC64B1=C:\PROGRAMMI\OUTLOOK EXPRESS\MSIMN.EXE
*FABD4EF5=C:\PROGRAMMI\MSN MESSENGER\MSNMSGR.EXE
*FABE7475=C:\PROGRAMMI\INTERNET EXPLORER\IEXPLORE.EXE
*FAA4B535=C:\PROGRAMMI\MIRANDA IM\MIRANDA32.EXE
*FAA28D49=C:\DOCUMENTI\COMPUTER\STARTDRECK\STARTDRECK.EXE
»Application specific

netquik · 04-08-2004, 17:06

allora scarica questo e eseguilo

http://www.tweakness.net/files/Win98fix/RunFix.reg

riavvia il pc...

appena riavviato

cancella questo file C:\WINDOWS\SYSTEM\HLP.DLL
mi raccomando...

ora fai ripartire about:blank
magari anche cwshredder... e pulisci...

fai uno scan con hijackthis così finiamo la pulizia

04-08-2004, 17:17

Quote:

Originariamente inviato da netquik
allora scarica questo e eseguilo

http://www.tweakness.net/files/Win98fix/RunFix.reg

riavvia il pc...

appena riavviato

cancella questo file C:\WINDOWS\SYSTEM\HLP.DLL
mi raccomando...

ora fai ripartire about:blank
magari anche cwshredder... e pulisci...

fai uno scan con hijackthis così finiamo la pulizia

provo

04-08-2004, 17:53

PARE CHE ABBIA FUNZIONATO!

GRAZIEM ILLE!

netquik · 04-08-2004, 23:55

dovrebbe essere rimasta roba da togliere con hijackthis...

quando vuoi

05-08-2004, 12:45

Quote:

Originariamente inviato da netquik
dovrebbe essere rimasta roba da togliere con hijackthis...

quando vuoi

dici?

questo è il log di hijackthis

Logfile of HijackThis v1.98.1
Scan saved at 12.39.54, on 05/08/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SDMAN.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\HKCMD.EXE
C:\SABRE\APPS\ATS\SSSCLNT.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAMMI\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\E_S10IC2.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SABSERV.EXE
C:\SABRE\APPS\OADP\OADP.EXE
C:\WFXCTL32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WFXMOD32.EXE
C:\FAXMNG32.EXE
C:\DOCUMENTI\HTML2POP3117BETAWIN32\HTML2POP3.EXE
C:\PROGRAMMI\OUTLOOK EXPRESS\MSIMN.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAMMI\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAMMI\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAMMI\MIRANDA IM\MIRANDA32.EXE
C:\SABRE\SV.EXE
C:\WINDOWS\MDBCSAPI.EXE
C:\WINDOWS\SYSTEM\WSASRV.EXE
C:\SABRE\SBTIMER.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://evoya.sabre.com/login/index.jsp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fornito da ICL Italia S.p.A.
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=ita0711:80;gopher=ita0711:80;http=ita0711:80;https=ita0711:80;socks=ita0711:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.icl.co.uk;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMMI\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar2.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\SYSTEM\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\SYSTEM\hkcmd.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Sabre Site Services] C:\SABRE\Apps\ATS\SSSClnt.EXE
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [EPSON Stylus C44 Series] C:\WINDOWS\SYSTEM\E_S10IC2.EXE /P23 "EPSON Stylus C44 Series" /O7 "EPUSB1:" /M "Stylus C44"
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SDApp] C:\WINDOWS\SDMan.EXE
O4 - Startup: Server Sabre.lnk = C:\WINDOWS\sabserv.exe
O4 - Startup: Sabre Printing Module.lnk = C:\SABRE\Apps\OADP\Oadp.exe
O4 - Startup: Controller.LNK = ?
O4 - Startup: Microsoft Office.lnk = C:\WINDOWS\Application Data\Microsoft\Installer\{00000410-78E1-11D2-B60F-006097C998E7}\misc.exe
O8 - Extra context menu item: &Google Search - res://C:\PROGRAMMI\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\PROGRAMMI\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\PROGRAMMI\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: Backward &Links - res://C:\PROGRAMMI\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programmi\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programmi\ICQLite\ICQLite.exe
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O16 - DPF: {9b935470-ad4a-11d5-b63e-00c04faedb18} (Oracle JInitiator 1.1.8.16) -
O16 - DPF: {1CC506A7-1B8D-11D4-BDD5-0060977007E0} (CrazyTalk Player) - http://plug-in.reallusion.com/CrazyTalk.cab
O16 - DPF: {8EC18CE2-D7B4-11D2-88C8-006008A717FD} (NCSView Class) - http://ww3.atlanteitaliano.it/ecwplugins/ncs.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = dns2.interbusiness.it
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 151.99.125.2,151.99.250.2

netquik · 05-08-2004, 13:22

come non detto...

sei PULITO!

per curiosità quale programma ti ha pulito così dopo che abbiamo eliminato la dll nascosta?

ciao

05-08-2004, 13:24

Quote:

Originariamente inviato da netquik
come non detto...

sei PULITO!

per curiosità quale programma ti ha pulito così dopo che abbiamo eliminato la dll nascosta?

ciao

ho fatto come hai detto tu! prima about buster e poi cwshredder

netquik · 05-08-2004, 13:27

ottimo!

04-08-2004, 15:04	#1
fabius00 Messaggi: n/a	about blank con w98! scusate con w98 che faccio? il log di hijackthis è Logfile of HijackThis v1.98.1 Scan saved at 11.02.57, on 04/08/04 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\SPOOL32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SDMAN.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\TASKMON.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\WINDOWS\SYSTEM\HKCMD.EXE C:\SABRE\APPS\ATS\SSSCLNT.EXE C:\WINDOWS\LOADQM.EXE C:\PROGRAMMI\NORTON ANTIVIRUS\NAVAPW32.EXE C:\WINDOWS\SYSTEM\E_S10IC2.EXE C:\WINDOWS\SYSTEM\STIMON.EXE C:\WINDOWS\SABSERV.EXE C:\WINDOWS\SYSTEM\DDHELP.EXE C:\SABRE\APPS\OADP\OADP.EXE C:\WFXCTL32.EXE C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\WINDOWS\SYSTEM\TAPISRV.EXE C:\DOCUMENTI\HTML2POP3117BETAWIN32\HTML2POP3.EXE C:\WINDOWS\SYSTEM\PSTORES.EXE C:\PROGRAMMI\MSN MESSENGER\MSNMSGR.EXE C:\WFXMOD32.EXE C:\PROGRAMMI\INTERNET EXPLORER\IEXPLORE.EXE C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE C:\PROGRAMMI\OUTLOOK EXPRESS\MSIMN.EXE R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\TEMP\sp.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\WINDOWS\TEMP\sp.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\TEMP\sp.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\WINDOWS\TEMP\sp.html R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\WINDOWS\TEMP\sp.html R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\WINDOWS\TEMP\sp.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fornito da ICL Italia S.p.A. R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=ita0711:80;gopher=ita0711:80;http=ita0711:80;https=ita0711:80;socks=ita0711:80 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.icl.co.uk;<local> R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMMI\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar2.dll O2 - BHO: (no name) - {76147640-E487-11D8-92E7-000B4A60CEBC} - C:\WINDOWS\SYSTEM\EPGNJ.DLL O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar2.dll O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\SYSTEM\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\SYSTEM\hkcmd.exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [Sabre Site Services] C:\SABRE\Apps\ATS\SSSClnt.EXE O4 - HKLM\..\Run: [LoadQM] loadqm.exe O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET O4 - HKLM\..\Run: [EPSON Stylus C44 Series] C:\WINDOWS\SYSTEM\E_S10IC2.EXE /P23 "EPSON Stylus C44 Series" /O7 "EPUSB1:" /M "Stylus C44" O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [SDApp] C:\WINDOWS\SDMan.EXE O4 - HKCU\..\Run: [IEengine] C:\Program Files\Internet Explorer\IEengine.exe O4 - Startup: Server Sabre.lnk = C:\WINDOWS\sabserv.exe O4 - Startup: Sabre Printing Module.lnk = C:\SABRE\Apps\OADP\Oadp.exe O4 - Startup: Controller.LNK = ? O4 - Startup: Microsoft Office.lnk = C:\WINDOWS\Application Data\Microsoft\Installer\{00000410-78E1-11D2-B60F-006097C998E7}\misc.exe O8 - Extra context menu item: &Google Search - res://C:\PROGRAMMI\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\PROGRAMMI\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html O8 - Extra context menu item: Si&milar Pages - res://C:\PROGRAMMI\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html O8 - Extra context menu item: Backward &Links - res://C:\PROGRAMMI\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programmi\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programmi\ICQLite\ICQLite.exe O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe O16 - DPF: {9b935470-ad4a-11d5-b63e-00c04faedb18} (Oracle JInitiator 1.1.8.16) - O16 - DPF: {1CC506A7-1B8D-11D4-BDD5-0060977007E0} (CrazyTalk Player) - http://plug-in.reallusion.com/CrazyTalk.cab O16 - DPF: {8EC18CE2-D7B4-11D2-88C8-006008A717FD} (NCSView Class) - http://ww3.atlanteitaliano.it/ecwplugins/ncs.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = dns2.interbusiness.it O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 151.99.125.2,151.99.250.2 O18 - Filter: text/html - {6486A942-E52F-11D8-92E7-000B0627E554} - C:\WINDOWS\SYSTEM\EPGNJ.DLL O18 - Filter: text/plain - {6486A942-E52F-11D8-92E7-000B0627E554} - C:\WINDOWS\SYSTEM\EPGNJ.DLL

04-08-2004, 15:09	#3
netquik Senior Member Iscritto dal: May 2001 Messaggi: 1740	lo hai aggiornato? __________________ www.tweakness.net - Trucchi per il PC DECALOGO ANTISPY - GUIDA A HIJACKTHIS - GUIDA AI SERVIZI DI WIN XP - CONSIGLI ANTIVIRUS PER BART'S PE - SP2 SLIPSTREAMING - FAQ WINDOWS XPSP2 - I SERVIZI DOPO SP2 - XP SP2 UNATTENDED - GUIDA A nLite

04-08-2004, 15:20	#5
netquik Senior Member Iscritto dal: May 2001 Messaggi: 1740	quando fai partire about c'è il tasto update... prova prima ad aggiornarlo __________________ www.tweakness.net - Trucchi per il PC DECALOGO ANTISPY - GUIDA A HIJACKTHIS - GUIDA AI SERVIZI DI WIN XP - CONSIGLI ANTIVIRUS PER BART'S PE - SP2 SLIPSTREAMING - FAQ WINDOWS XPSP2 - I SERVIZI DOPO SP2 - XP SP2 UNATTENDED - GUIDA A nLite

04-08-2004, 15:24	#7
netquik Senior Member Iscritto dal: May 2001 Messaggi: 1740	se ti va apri icq... così mi rispondi più velocemente __________________ www.tweakness.net - Trucchi per il PC DECALOGO ANTISPY - GUIDA A HIJACKTHIS - GUIDA AI SERVIZI DI WIN XP - CONSIGLI ANTIVIRUS PER BART'S PE - SP2 SLIPSTREAMING - FAQ WINDOWS XPSP2 - I SERVIZI DOPO SP2 - XP SP2 UNATTENDED - GUIDA A nLite

04-08-2004, 15:25	#8
netquik Senior Member Iscritto dal: May 2001 Messaggi: 1740	hai estratto tutti i file s dell'archivio in una cartella? __________________ www.tweakness.net - Trucchi per il PC DECALOGO ANTISPY - GUIDA A HIJACKTHIS - GUIDA AI SERVIZI DI WIN XP - CONSIGLI ANTIVIRUS PER BART'S PE - SP2 SLIPSTREAMING - FAQ WINDOWS XPSP2 - I SERVIZI DOPO SP2 - XP SP2 UNATTENDED - GUIDA A nLite

04-08-2004, 16:50	#10
netquik Senior Member Iscritto dal: May 2001 Messaggi: 1740	Download: "StartDreck", da qui: http://www.niksoft.at/download/startdreck.htm Unzippalo in una sua cartella e fai partire il programma Premi 'Config' Premi 'Unmark All' Check solo su queste box: Registry -> Run Keys System/drivers> Running processes Premi 'OK' Premi 'Save' e seleziona dove vuoi salvare il log (di default sarà nella stessa dir del programma) posta il log __________________ www.tweakness.net - Trucchi per il PC DECALOGO ANTISPY - GUIDA A HIJACKTHIS - GUIDA AI SERVIZI DI WIN XP - CONSIGLI ANTIVIRUS PER BART'S PE - SP2 SLIPSTREAMING - FAQ WINDOWS XPSP2 - I SERVIZI DOPO SP2 - XP SP2 UNATTENDED - GUIDA A nLite

04-08-2004, 16:56	#11
fabius00 Messaggi: n/a	eccolo StartDreck (build 2.1.5 public BETA) - 2004-08-04 @ 16.51.07 Platform: Windows 98 SE (Win 4.10.2222 A) »Registry »Run Keys »Current User »Run IEengine=C:\Program Files\Internet Explorer\IEengine.exe »RunOnce »Default User »Run IEengine=C:\Program Files\Internet Explorer\IEengine.exe »RunOnce »Local Machine »Run ScanRegistry=C:\WINDOWS\scanregw.exe /autorun TaskMonitor=C:\WINDOWS\taskmon.exe SystemTray=SysTray.Exe IgfxTray=C:\WINDOWS\SYSTEM\igfxtray.exe HotKeysCmds=C:\WINDOWS\SYSTEM\hkcmd.exe LoadPowerProfile=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme Sabre Site Services=C:\SABRE\Apps\ATS\SSSClnt.EXE LoadQM=loadqm.exe Norton Auto-Protect=C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET EPSON Stylus C44 Series=C:\WINDOWS\SYSTEM\E_S10IC2.EXE /P23 "EPSON Stylus C44 Series" /O7 "EPUSB1:" /M "Stylus C44" StillImageMonitor=C:\WINDOWS\SYSTEM\STIMON.EXE Installed=1 NoChange=1 Installed=1 Installed=1 »RunOnce »RunServices LoadPowerProfile=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme SchedulingAgent=mstask.exe SDApp=C:\WINDOWS\SDMan.EXE »RunServicesOnce *tcfs=rundll32 C:\WINDOWS\SYSTEM\HLP.DLL,StreamingDeviceSetup »RunOnceEx »RunServicesOnceEx »Files »System/Drivers »Running Processes FFEFC501=C:\WINDOWS\SYSTEM\KERNEL32.DLL FFFC01A5=C:\WINDOWS\SYSTEM\MSGSRV32.EXE FFFC098D=C:\WINDOWS\SYSTEM\SPOOL32.EXE FFFC665D=C:\WINDOWS\SYSTEM\MPREXE.EXE FFFCCBE1=C:\WINDOWS\SDMAN.EXE FFFD1281=C:\WINDOWS\RUNDLL32.EXE FFE1CEA1=C:\WINDOWS\SYSTEM\mmtask.tsk FFE62AFD=C:\WINDOWS\EXPLORER.EXE FFE68B35=C:\WINDOWS\TASKMON.EXE FFE6F7FD=C:\WINDOWS\SYSTEM\SYSTRAY.EXE FFE77BC5=C:\WINDOWS\SYSTEM\HKCMD.EXE FFE4147D=C:\SABRE\APPS\ATS\SSSCLNT.EXE FFE440A9=C:\WINDOWS\LOADQM.EXE FFE70559=C:\PROGRAMMI\NORTON ANTIVIRUS\NAVAPW32.EXE FFE4AE41=C:\WINDOWS\SYSTEM\E_S10IC2.EXE FFE48395=C:\WINDOWS\SYSTEM\STIMON.EXE FFE57C15=C:\WINDOWS\SYSTEM\DDHELP.EXE FFE40E81=C:\WINDOWS\SABSERV.EXE FFE5E761=C:\SABRE\APPS\OADP\OADP.EXE FFE6EFA5=C:\WFXCTL32.EXE FFEE6045=C:\WINDOWS\SYSTEM\WMIEXE.EXE FFEF7A15=C:\WINDOWS\SYSTEM\TAPISRV.EXE FABAD9F9=C:\WFXMOD32.EXE FABEAA6D=C:\WINDOWS\SYSTEM\PSTORES.EXE FABF2A29=C:\SABRE\SV.EXE FABF2945=C:\WINDOWS\MDBCSAPI.EXE FABEDF09=C:\WINDOWS\SYSTEM\WSASRV.EXE FABF1F25=C:\SABRE\SBTIMER.EXE FABC0AC9=C:\DOCUMENTI\HTML2POP3117BETAWIN32\HTML2POP3.EXE FABC64B1=C:\PROGRAMMI\OUTLOOK EXPRESS\MSIMN.EXE FABD4EF5=C:\PROGRAMMI\MSN MESSENGER\MSNMSGR.EXE FABE7475=C:\PROGRAMMI\INTERNET EXPLORER\IEXPLORE.EXE FAA4B535=C:\PROGRAMMI\MIRANDA IM\MIRANDA32.EXE *FAA28D49=C:\DOCUMENTI\COMPUTER\STARTDRECK\STARTDRECK.EXE »Application specific

04-08-2004, 17:06	#12
netquik Senior Member Iscritto dal: May 2001 Messaggi: 1740	allora scarica questo e eseguilo http://www.tweakness.net/files/Win98fix/RunFix.reg riavvia il pc... appena riavviato cancella questo file C:\WINDOWS\SYSTEM\HLP.DLL mi raccomando... ora fai ripartire about:blank magari anche cwshredder... e pulisci... fai uno scan con hijackthis così finiamo la pulizia __________________ www.tweakness.net - Trucchi per il PC DECALOGO ANTISPY - GUIDA A HIJACKTHIS - GUIDA AI SERVIZI DI WIN XP - CONSIGLI ANTIVIRUS PER BART'S PE - SP2 SLIPSTREAMING - FAQ WINDOWS XPSP2 - I SERVIZI DOPO SP2 - XP SP2 UNATTENDED - GUIDA A nLite

04-08-2004, 17:53	#14
fabius00 Messaggi: n/a	PARE CHE ABBIA FUNZIONATO! GRAZIEM ILLE!

04-08-2004, 23:55	#15
netquik Senior Member Iscritto dal: May 2001 Messaggi: 1740	dovrebbe essere rimasta roba da togliere con hijackthis... quando vuoi __________________ www.tweakness.net - Trucchi per il PC DECALOGO ANTISPY - GUIDA A HIJACKTHIS - GUIDA AI SERVIZI DI WIN XP - CONSIGLI ANTIVIRUS PER BART'S PE - SP2 SLIPSTREAMING - FAQ WINDOWS XPSP2 - I SERVIZI DOPO SP2 - XP SP2 UNATTENDED - GUIDA A nLite

05-08-2004, 13:22	#17
netquik Senior Member Iscritto dal: May 2001 Messaggi: 1740	come non detto... sei PULITO! per curiosità quale programma ti ha pulito così dopo che abbiamo eliminato la dll nascosta? ciao __________________ www.tweakness.net - Trucchi per il PC DECALOGO ANTISPY - GUIDA A HIJACKTHIS - GUIDA AI SERVIZI DI WIN XP - CONSIGLI ANTIVIRUS PER BART'S PE - SP2 SLIPSTREAMING - FAQ WINDOWS XPSP2 - I SERVIZI DOPO SP2 - XP SP2 UNATTENDED - GUIDA A nLite

05-08-2004, 13:27	#19
netquik Senior Member Iscritto dal: May 2001 Messaggi: 1740	ottimo! __________________ www.tweakness.net - Trucchi per il PC DECALOGO ANTISPY - GUIDA A HIJACKTHIS - GUIDA AI SERVIZI DI WIN XP - CONSIGLI ANTIVIRUS PER BART'S PE - SP2 SLIPSTREAMING - FAQ WINDOWS XPSP2 - I SERVIZI DOPO SP2 - XP SP2 UNATTENDED - GUIDA A nLite

Strumenti
Mostra una versione stampabile Invia questa pagina per email