|
|||||||
|
|
|
 |
|
|
Strumenti |
04-04-2005, 21:33
|
#1 |
|
Member
Iscritto dal: Nov 2003
Messaggi: 33
|
log file....problema barra IE
Ciao ragazzi ho un grossissimo problema con IE...ogni volta che navigo compare una fastidiosissima barra in basso sopra la barra di stato e in + da quando è comparsa questa barra mi sono comparse un sacco di voci nuove in preferiti tipo: cool stuff, travel, shopping gifts, online gaming ecc...il problema è che nn riesco ad eliminarla in nessun modo...ne con Ad-aware pro SE ne con microsoft antispyware entrambi aggiorantissimi...tutti e 2 me la trovano dicono che è stata eliminata ma puntualmente ritorna e si riforma...c'è qualcuno gentilmente può darmi una mano? nn so + dove sbattere la testa per eliminarla....ho seguito il vs. consiglio lanciando hijackthis e ho salvato il file log....cosa devo fare adesso? Ringrazio anticipatamente colui che vorrà darmi una mano. Aspetto vs risp. Grazie ciao
QUANDO LANCIO ADAWARE MI TROVA UN CERTO LOP CATEGORIA MALWARE nei FILE TEMP che ogni volta si riforma in un exe che cambia nome PS: Non riesco a capire come ho fatto a prendere questa schifezza visto che ho norton antivirus 2005 e internet security aggiornatissimi, adaware pro se e microsoft antispy aggiorantissimi....ho appena formattato...avitatemi un altro lavoraccio del genere  Il log file è questo: Logfile of HijackThis v1.99.1 Scan saved at 22.23.32, on 04/04/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Programmi\File comuni\Symantec Shared\ccProxy.exe C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe C:\Programmi\Norton Internet Security\ISSVC.exe C:\Programmi\File comuni\Symantec Shared\SNDSrvc.exe C:\Programmi\File comuni\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Programmi\Norton SystemWorks\Norton AntiVirus\navapsvc.exe C:\Programmi\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE C:\WINDOWS\system32\nvsvc32.exe C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Programmi\File comuni\Symantec Shared\ccApp.exe C:\WINDOWS\system32\devldr32.exe C:\Programmi\MSN Apps\Updater\01.02.3000.1001\it\msnappau.exe C:\Programmi\Java\jre1.5.0_02\bin\jusched.exe C:\Programmi\Pinnacle\Pinnacle PCTV\Remote\Remoterm.exe C:\Programmi\D-Tools\daemon.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe C:\WINDOWS\system32\hphmon04.exe C:\Programmi\ICQLite\ICQLite.exe C:\Programmi\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe C:\Programmi\Microsoft AntiSpyware\gcasServ.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\HPHipm11.exe C:\Programmi\Pinnacle\Shared Files\Programs\Scheduler\PCLEScheduler.exe C:\Programmi\Alice ti aiuta\bin\mpbtn.exe C:\Programmi\Microsoft AntiSpyware\gcasDtServ.exe c:\progra~1\intern~1\iexplore.exe c:\progra~1\intern~1\iexplore.exe C:\Programmi\Messenger\msmsgs.exe D:\eMule\emule.exe C:\Programmi\Microsoft Office\OFFICE11\OUTLOOK.EXE C:\Programmi\Microsoft Office\OFFICE11\WINWORD.EXE C:\Programmi\Norton SystemWorks\Norton AntiVirus\OPScan.exe C:\Programmi\Internet Explorer\iexplore.exe C:\Programmi\File comuni\Symantec Shared\AdBlocking\NSMdtr.exe C:\Download\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.mzyufdwzbg.com/g6RJryVRig...NzYhm/yBKk.htm R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.vmziwsrhqkrr.biz/g6RJryVR...zYhm/yBKk.html R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programmi\ICQToolbar\toolbaru.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Programmi\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Programmi\File comuni\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar1.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\MSN Apps\MSN Toolbar\01.02.4000.1001\it\msntb.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmi\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Programmi\File comuni\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\MSN Apps\MSN Toolbar\01.02.4000.1001\it\msntb.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmi\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar1.dll O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programmi\ICQToolbar\toolbaru.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe O4 - HKLM\..\Run: [msnappau] "C:\Programmi\MSN Apps\Updater\01.02.3000.1001\it\msnappau.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_02\bin\jusched.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [PCTVRemote] C:\Programmi\Pinnacle\Pinnacle PCTV\Remote\Remoterm.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programmi\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe O4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\system32\hphmon04.exe O4 - HKLM\..\Run: [ICQ Lite] C:\Programmi\ICQLite\ICQLite.exe -minimize O4 - HKLM\..\Run: [DENTONLINEMFCDBLUE] C:\Documents and Settings\All Users\Dati applicazioni\glue trust dent online\16gram.exe O4 - HKLM\..\Run: [AWMON] "C:\Programmi\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe" O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programmi\MessengerPlus! 3\MsgPlus.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Programmi\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz O4 - HKCU\..\Run: [CAKE META] C:\DOCUME~1\NICOLA~1\DATIAP~1\BLUECA~1\BOLT BITS ROAM.exe O4 - HKCU\..\Run: [MessengerPlus3] "C:\Programmi\MessengerPlus! 3\MsgPlus.exe" /WinStart O4 - HKCU\..\Run: [msnmsgr] "C:\Programmi\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programmi\ICQLite\ICQLite.exe -trayboot O4 - Global Startup: Alice ti aiuta.lnk = C:\Programmi\Alice ti aiuta\bin\matcli.exe O4 - Global Startup: Pinnacle Scheduler.lnk = ? O8 - Extra context menu item: &Google Search - res://C:\Programmi\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programmi\ICQToolbar\toolbaru.dll/SEARCH.HTML O8 - Extra context menu item: Collegamenti a ritroso - res://C:\Programmi\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Pagine simili - res://C:\Programmi\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Versione cache della pagina - res://C:\Programmi\Google\GoogleToolbar1.dll/cmcache.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_02\bin\npjpi150_02.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_02\bin\npjpi150_02.dll O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programmi\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programmi\ICQLite\ICQLite.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/ms...downloader.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{FC53209B-2D4D-4329-941B-CDC511F17A23}: NameServer = 217.141.106.203 151.99.125.1 O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccProxy.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Programmi\Norton Internet Security\ISSVC.exe O23 - Service: Servizio Auto-Protect di Norton AntiVirus (navapsvc) - Symantec Corporation - C:\Programmi\Norton SystemWorks\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Programmi\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\system32\HPHipm11.exe O23 - Service: SAVScan - Symantec Corporation - C:\Programmi\Norton SystemWorks\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FILECO~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe Ultima modifica di Viper1980 : 04-04-2005 alle 22:03. |
|
|
|
04-04-2005, 22:27
|
#2 |
|
Senior Member
Iscritto dal: Dec 2004
Città: Magenta(MI)
Messaggi: 1513
|
Io fixerei
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.mzyufdwzbg.com/g6RJryVRi...ENzYhm/yBKk.htm R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.vmziwsrhqkrr.biz/g6RJryV...NzYhm/yBKk.html O4 - HKLM\..\Run: [DENTONLINEMFCDBLUE] C:\Documents and Settings\All Users\Dati applicazioni\glue trust dent online\16gram.exe O4 - HKCU\..\Run: [CAKE META] C:\DOCUME~1\NICOLA~1\DATIAP~1\BLUECA~1\BOLT BITS ROAM.exe da eliminare IMHO le directory glue trust dent online e BLUECA~1 ciao Ultima modifica di bluepix : 04-04-2005 alle 22:31. |
|
|
|
|
05-04-2005, 09:14
|
#3 |
|
Bannato
Iscritto dal: Mar 2004
Città: Galapagos Attenzione:utente flautolente,tienilo a mente
Messaggi: 29028
|
Re: log file....problema barra IE
c://Programmi\Java\jre1.5.0_02\bin\jusched.exe
puoi tranquillamente rimuvoerlo da msconfig(tranquo,non si tratta di malware  )C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe che puzza C:\WINDOWS\system32\hphmon04.exe stampante HP? C:\WINDOWS\system32\ctfmon.exe rimuovilo da msconfig C:\WINDOWS\system32\HPHipm11.exe allora hai una HP si o no? R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.mzyufdwzbg.com/g6RJryVRig...NzYhm/yBKk.htm R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.vmziwsrhqkrr.biz/g6RJryVR...zYhm/yBKk.html cestina tutto O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar1.dll chi e d'accordo con me se dico che la google toolbar e completamente inutile?! O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544- FADC6B084872} - C:\Programmi\Norton SystemWorks\Norton AntiVirus\NavShExt.dll fai ben attenzione a questo file:se ti compare anche su Opzioni internet/componenti aggiuntivi è sicuramente uno spyware O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar1.dll anche qui O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_02\bin\jusched.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe rimuovi da msconfig O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe O4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\system32\hphmon04.exe  O4 - HKLM\..\Run: [DENTONLINEMFCDBLUE] C:\Documents and Settings\All Users\Dati applicazioni\glue trust dent online\16gram.exe oci opure a questo 4 - HKCU\..\Run: [CAKE META] C:\DOCUME~1\NICOLA~1\DATIAP~1\BLUECA~1\BOLT BITS ROAM.exe cetina O4 - HKCU\..\Run: O8 - Extra context menu item: &Google Search - res://C:\Programmi\Google\GoogleToolbar1.dll/cmsearch.html ahò e buttalo stò google  O8 - Extra context menu item: Collegamenti a ritroso - res://C:\Programmi\Google\GoogleToolbar1.dll/cmbacklinks.html  res://C:\Programmi\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Versione cache della pagina - res://C:\Programmi\Google\GoogleToolbar1.dll/cmcache.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_02\bin\npjpi150_02.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_02\bin\npjpi150_02.dll |
|
|
|
|
06-04-2005, 06:47
|
#4 |
|
Member
Iscritto dal: Nov 2003
Messaggi: 33
|
Grazie a tutti per i consigli sono riuscito ad eliminare la barra fastidiosissima però il prob nn è del tutto risolto...lo spyware bastardo rimane e nn riesco a toglierlo...Ad-watch me lo blocca quando vuole modificare il registro quindi in teoria nn fa + danni però rimane nel PC...antyspyware di microsoft me lo trova ma cancellandolo me lo continua a riformare....mi dice che trova:
POSSIBLE BROWSER HIJACK (BROWSER MODIFIER) Aiutatemi ad eliminarlo senza formattare. Grazie |
|
|
|
|
|
| Strumenti | |
|
|
Tutti gli orari sono GMT +1. Ora sono le: 17:19.
