|
|||||||
|
|
|
 |
|
|
Strumenti |
15-04-2005, 20:31
|
#1 |
|
Member
Iscritto dal: Jan 2004
Messaggi: 126
|
Eliminate toolbar
Navigando in siti mio fratello ha installato involontariamente una fastidiosa toolbar che nn riesco ad eliminare:
ho provato con lavasoft adware aggiornato niente ho fatto scansione antivirus ma nn rileva niente (AVG free) che cosa devo fare? |
|
|
|
15-04-2005, 20:35
|
#2 |
|
Senior Member
Iscritto dal: Dec 2004
Città: Magenta(MI)
Messaggi: 1513
|
Devi mettere il log di Hijthis per capire se hai EliteToolBar o qualcosa d'altro.
|
|
|
|
|
15-04-2005, 20:36
|
#3 |
|
Member
Iscritto dal: Jan 2004
Messaggi: 126
|
come faccio avere il log, che programma devo eseguire?
|
|
|
|
|
15-04-2005, 20:46
|
#4 |
|
Senior Member
Iscritto dal: Dec 2004
Città: Magenta(MI)
Messaggi: 1513
|
Ops..........
Scaricati il Hijackthis 1.99 da qui
http://www.spywareinfo.com/~merijn/ crea una directory e unzippa il programma nella nuova directory creata. -chiudi TUTTE le finestre aperte -lancia Hijackthis e clikka to "Do a system scan and save logfile" verrà creato un file di testo leggibile con il blocco note. Copia e incolla il contenuto nel post ciao |
|
|
|
|
15-04-2005, 21:24
|
#5 |
|
Member
Iscritto dal: Jan 2004
Messaggi: 126
|
IL pc ha subito un rallentamento cion questa toolbar
 questo è il log. Logfile of HijackThis v1.99.1 Scan saved at 22.23.12, on 15/04/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Programmi\Sygate\SPF\smc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\system32\UAService7.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Programmi\Hewlett-Packard\HP Software Update\HPWuSchd2.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe C:\Programmi\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Programmi\Microsoft IntelliType Pro\type32.exe C:\Programmi\Microsoft IntelliPoint\point32.exe C:\Programmi\QuickTime\qttask.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\PROGRA~1\DAP\DAP.EXE C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\Systran\4_0\Premium\SYSTRA~1.EXE C:\Documents and Settings\Carlo\Desktop\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programmi\ICQToolbar\toolbaru.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {0F6747BF-F86E-7A56-C85F-07FBC61FDA84} - (no file) O2 - BHO: IE SP2 AddOn - {1F03A078-28B9-47BB-B4B1-983E79526F2E} - C:\WINDOWS\system32\spfjp.dll O2 - BHO: ActiveX Control - {7C86B676-2776-46CD-AA11-48ED51BE2899} - C:\WINDOWS\system32\msyrp.dll (file missing) O3 - Toolbar: Systran40premi.IEPlugIn - {D3919E1A-D6A5-11D6-AC3E-00B0D094B576} - C:\Programmi\Systran\4_0\Premium\IEPlugIn.dll O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Programmi\DAP\DAPIEBar.dll O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\MSN Toolbar\01.01.1601.0\it\msntb.dll O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programmi\ICQToolbar\toolbaru.dll O3 - Toolbar: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\system32\ie2cltr.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [HP Software Update] "C:\Programmi\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe O4 - HKLM\..\Run: [DeviceDiscovery] C:\Programmi\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [MessengerPlus2] "C:\Programmi\Messenger Plus! 2\MsgPlus.exe" O4 - HKLM\..\Run: [UsrManagmentConf] umcss.exe O4 - HKLM\..\Run: [type32] "C:\Programmi\Microsoft IntelliType Pro\type32.exe" O4 - HKLM\..\Run: [IntelliPoint] "C:\Programmi\Microsoft IntelliPoint\point32.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O4 - HKLM\..\Run: [DownloadAccelerator] C:\PROGRA~1\DAP\DAP.EXE /STARTUP O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [ICQ Lite] C:\Programmi\ICQLite\ICQLite.exe -minimize O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Programmi\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [Windows Registry Repair Pro] C:\Programmi\3B Software\Windows Registry Repair Pro\RegistryRepairPro.exe 4 O4 - HKCU\..\Run: [Spamihilator] "C:\Programmi\Spamihilator\spamihilator.exe" O4 - HKCU\..\Run: [Skype] "C:\Programmi\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programmi\ICQLite\ICQLite.exe -trayboot O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programmi\ICQToolbar\toolbaru.dll/SEARCH.HTML O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Organizzatore ricerche - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Programmi\File comuni\Microsoft Shared\Encarta Researcher\EROPROJ.DLL O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programmi\File comuni\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programmi\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programmi\ICQLite\ICQLite.exe O9 - Extra button: @C:\Programmi\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: @C:\Programmi\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab30149.cab O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab30149.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab30149.cab O16 - DPF: {99D8AF4F-307A-461C-A404-BFA33D502B31} (APStartX Control) - http://217.169.119.216/resources/APStart.ocx O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary...o.cab30149.cab O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...n.cab31267.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{1E6936C5-A2B8-4C2C-BE25-9FA61640B8F9}: NameServer = 69.50.176.156,195.225.176.31 O17 - HKLM\System\CCS\Services\Tcpip\..\{30A7A01A-2472-4BB2-B772-C36213BDAA3D}: NameServer = 69.50.176.156,195.225.176.31 O17 - HKLM\System\CCS\Services\Tcpip\..\{86F5377F-5F9F-4CAA-865D-7D499C5684A8}: NameServer = 69.50.176.156 195.225.176.31 O17 - HKLM\System\CCS\Services\Tcpip\..\{A5BD3BB0-D491-4709-835A-A992C3C2686A}: NameServer = 69.50.176.156,195.225.176.31 O17 - HKLM\System\CCS\Services\Tcpip\..\{C874779A-9A8C-4073-93D6-3528D47F947D}: NameServer = 69.50.176.156,195.225.176.31 O17 - HKLM\System\CS1\Services\Tcpip\..\{1E6936C5-A2B8-4C2C-BE25-9FA61640B8F9}: NameServer = 69.50.176.156,195.225.176.31 O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: hpdj - HP - C:\DOCUME~1\Carlo\IMPOST~1\Temp\hpdj.exe O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Programmi\File comuni\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Programmi\Sygate\SPF\smc.exe O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe |
|
|
|
|
15-04-2005, 21:29
|
#6 |
|
Senior Member
Iscritto dal: Mar 2005
Città: Cisliano
Messaggi: 606
|
come si fa a capire dal log se c e qlc d strano?cioe voi in base a cs vi regolate?
|
|
|
|
|
15-04-2005, 21:55
|
#7 |
|
Senior Member
Iscritto dal: Dec 2004
Città: Magenta(MI)
Messaggi: 1513
|
Bisogna essere veramente degli esperti per poter controllare un report di Hijackthis perchè occorrerebbe conoscere tutte le combinazioni possibile di installazione.
Allora ci si appoggia ad un analizzatore del report qui http://www.hijackthis.de/index.ph e si interpretano i risultati andando a cercare le incongruenze segnalate dall'analizzatore. Di solito i risultati ottenuti sono buoni, ma altre volte questo tipo di approccio risulta insufficiente. In questo caso .... occorre andare a tentativi (purtroppo), ma io non lo faccio mai perchè potrei mettere in crisi il PC altrui e questa è una responsabilità che non mi voglio prendere. Comunque per predator occorre: 1-disabilitare il ripristino di sistema fixare queste voci di Hijachthis: O2 - BHO: (no name) - {0F6747BF-F86E-7A56-C85F-07FBC61FDA84} - (no file) O2 - BHO: IE SP2 AddOn - {1F03A078-28B9-47BB-B4B1-983E79526F2E} - C:\WINDOWS\system32\spfjp.dll O2 - BHO: ActiveX Control - {7C86B676-2776-46CD-AA11-48ED51BE2899} - C:\WINDOWS\system32\msyrp.dll (file missing) O3 - Toolbar: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\system32\ie2cltr.dll O4 - HKLM\..\Run: [UsrManagmentConf] umcss.exe O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE O16 - DPF: {99D8AF4F-307A-461C-A404-BFA33D502B31} (APStartX Control) - http://217.169.119.216/resources/APStart.ocx è strano anche questo servizio che parte da TEMP  O23 - Service: hpdj - HP - C:\DOCUME~1\Carlo\IMPOST~1\Temp\hpdj.exe |
|
|
|
|
15-04-2005, 23:04
|
#8 |
|
Member
Iscritto dal: Jan 2004
Messaggi: 126
|
mi sembra che ora vada bene il pc ha riacquistato la sua velocità di prima e la toolbar è sparita
Grazie. 
|
|
|
|
|
15-04-2005, 23:44
|
#9 |
|
Senior Member
Iscritto dal: Sep 2004
Messaggi: 6387
|
prox volta passa a firefox ed eviti questi problemi
|
|
|
|
|
|
| Strumenti | |
|
|
Tutti gli orari sono GMT +1. Ora sono le: 11:31.
