|
| HOMEPAGE | INDICE FORUM | REGOLAMENTO | ::. | NEI PREFERITI | .:: | RSS Forum | RSS News | NEWS web | NEWS software | |
| PUBBLICITA' | | | ARTICOLI | WIN XP | VISTA | WIN 7 | REGISTRI | SOFTWARE | MANUALI | RECENSIONI | LINUX | HUMOR | HARDWARE | DOWNLOAD | | | CERCA nel FORUM » | |
05-04-2013, 14.49.31 | #16 |
Gold Member
Top Poster
Registrato: 06-07-2006
Loc.: Brindisi
Messaggi: 10.111
|
Rif: virus da messaggio fb
___________________________________
Dove l'ho sentita ? www.plagimusicali.net English Amiga Board Amiganews.it AfA One AROS x86 AROS 68k |
05-04-2013, 18.17.40 | #17 |
Senior Member
Registrato: 04-12-2008
Messaggi: 394
|
Rif: virus da messaggio fb
no con il tasto destro non appare l'opzione "esegui come amministratore" per altri programmi si per hjt no! non si apre come amministratore percio' niente fix!
|
05-04-2013, 19.37.45 | #18 |
Gold Member
Top Poster
Registrato: 06-07-2006
Loc.: Brindisi
Messaggi: 10.111
|
Rif: virus da messaggio fb
Non è possibile ! lo fai sul suo eseguibile ? che sistema operativo hai ?
___________________________________
Dove l'ho sentita ? www.plagimusicali.net English Amiga Board Amiganews.it AfA One AROS x86 AROS 68k Ultima modifica di AMIGA : 05-04-2013 alle ore 19.41.10 |
05-04-2013, 19.56.23 | #19 |
Senior Member
Registrato: 04-12-2008
Messaggi: 394
|
Rif: virus da messaggio fb
ook grazie fatto ecco il log che devo fixare?
Codice:
Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 18:54:24, on 05/04/2013 Platform: Windows 7 SP1 (WinNT 6.00.3505) MSIE: Internet Explorer v9.00 (9.00.8112.16470) Boot mode: Normal Running processes: C:\Program Files (x86)\Skype\Phone\Skype.exe C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Users\aristide\AppData\Roaming\Dropbox\bin\Dropbox.exe C:\Users\Public\Documents\AppData\PoApp\PService.exe C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_6_602_180_ActiveX.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_6_602_180.exe C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_6_602_180.exe C:\Users\aristide\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\aristide\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\aristide\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\aristide\AppData\Local\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe C:\Windows\SysWOW64\DllHost.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.findeer.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: (no name) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - (no file) F2 - REG:system.ini: UserInit=userinit.exe, O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe O4 - HKLM\..\Run: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe O4 - HKLM\..\Run: [SAFE2012 HotKeys] "C:\Program Files (x86)\Steganos Safe 2012\SteganosHotKeyService.exe" O4 - HKLM\..\Run: [SAFE2012 File Redirection Starter] "C:\Program Files (x86)\Steganos Safe 2012\fredirstarter.exe" O4 - HKLM\..\Run: [NBAgent] "C:\Program Files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe" /WinStart O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" O4 - HKLM\..\Run: [PosService] C:\Users\Public\Documents\AppData\PoApp\PLauncher.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [Xvid] C:\Program Files (x86)\Xvid\CheckUpdate.exe O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden O4 - HKCU\..\Run: [Desura] C:\Program Files (x86)\Desura\desura.exe -autostart O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun O4 - HKCU\..\Run: [HControlUser] C:\Users\aristide\AppData\Roaming\Microsoft\taskeng.exe O4 - HKCU\..\Run: [WindowsRestore] C:\Users\aristide\AppData\Roaming\Microsoft\alg.exe O4 - HKCU\..\Run: [FacebookUpdate] C:\Users\aristide\AppData\Roaming\Microsoft\EvtEng.exe O4 - HKCU\..\Run: [Windows Live Family] C:\Users\aristide\AppData\Roaming\Microsoft\SEPWDN.EXE O4 - HKCU\..\Run: [MicrosftOfficeUpdate] C:\Users\aristide\AppData\Roaming\Microsoft\lsass.exe O4 - HKCU\..\Run: [MicrosoftActivex] C:\Users\aristide\AppData\Roaming\Microsoft\audiodg.exe O4 - HKCU\..\Run: [ATK Media] C:\Users\aristide\AppData\Roaming\Microsoft\DMedia.exe O4 - HKCU\..\Run: [AdobeArm Update] C:\Users\aristide\AppData\Roaming\Microsoft\bds.exe O4 - HKCU\..\Run: [UsbDeviceManager] C:\Users\aristide\AppData\Roaming\Microsoft\DeviceManager.exe O4 - HKCU\..\Run: [MediaDevice] C:\Users\aristide\AppData\Roaming\Microsoft\windev.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVIZIO LOCALE') O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVIZIO LOCALE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVIZIO DI RETE') O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVIZIO DI RETE') O4 - Startup: Dropbox.lnk = aristide\AppData\Roaming\Dropbox\bin\Dropbox.exe O4 - Startup: Ritaglio schermata e avvio di OneNote 2007.lnk = C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE O4 - Global Startup: 20Dollars2Surf.lnk = C:\Program Files (x86)\20Dollars2Surf\20dollars2surf.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: I&nvia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{0BEB00B9-B39D-4329-9A86-A7D41CBB38C9}: NameServer = 8.8.8.8,8.8.4.4 O17 - HKLM\System\CCS\Services\Tcpip\..\{1746C5FB-3B5C-4DEC-894B-0567489A3DE9}: NameServer = 8.8.8.8,8.8.4.4 O17 - HKLM\System\CCS\Services\Tcpip\..\{79787B42-39DE-477A-AF06-5ED9955E8000}: NameServer = 8.8.8.8,8.8.4.4 O17 - HKLM\System\CCS\Services\Tcpip\..\{846ee342-7039-11de-9d20-806e6f6e6963}: NameServer = 8.8.8.8,8.8.4.4 O17 - HKLM\System\CCS\Services\Tcpip\..\{8CD18FDC-2D3F-40C4-9117-2501B0B47715}: NameServer = 8.8.8.8,8.8.4.4 O17 - HKLM\System\CS1\Services\Tcpip\..\{0BEB00B9-B39D-4329-9A86-A7D41CBB38C9}: NameServer = 8.8.8.8,8.8.4.4 O17 - HKLM\System\CS2\Services\Tcpip\..\{0BEB00B9-B39D-4329-9A86-A7D41CBB38C9}: NameServer = 8.8.8.8,8.8.4.4 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing) O23 - Service: Avira AntiVir MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe O23 - Service: Avira AntiVir WebGuard (AntiVirWebService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe O23 - Service: Servizio Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Chiavetta Internet E353 21.6. OUC (Chiavetta Internet E353 21.6. RunOuc) - Unknown owner - C:\Program Files (x86)\Chiavetta Internet E353 21.6\UpdateDog\ouc.exe (file missing) O23 - Service: CodeMeter Runtime Server (CodeMeter.exe) - WIBU-SYSTEMS AG - C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing) O23 - Service: Servizio Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe O23 - Service: Servizio Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing) O23 - Service: @C:\Program Files (x86)\Nero\Update\NASvc.exe,-200 (NAUpdate) - Nero AG - C:\Program Files (x86)\Nero\Update\NASvc.exe O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing) O23 - Service: Pos Service (PowerOffer Service) - PowerOfferService - C:\Users\aristide\AppData\Local\PosService\Pos.exe O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing) O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: Serv Updater (ServUpdater) - ServiceUpd - C:\Users\aristide\AppData\Local\ServUpdater\ServiceUpd.exe O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing) O23 - Service: Software Upd (SoftwareUpd) - SoftwareUpdService - C:\Users\aristide\AppData\Local\SoftwareUpdater\SoftwareUpdService.exe O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing) O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing) O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing) O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing) O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing) O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing) O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing) O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing) O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing) -- End of file - 15063 bytes Ultima modifica di VincenzoGTA : 05-04-2013 alle ore 20.33.38 |
05-04-2013, 20.43.11 | #20 |
Gold Member
Top Poster
Registrato: 06-07-2006
Loc.: Brindisi
Messaggi: 10.111
|
Rif: virus da messaggio fb
Devi spuntare tutte le voci ad eccezione dell'antivirus e i servizi, vedrai che il tuo sistema tornerà come nuovo. Non ti preoccupare, ciò che tagli e solo l'esecuzione automatica dei programmi, li lancerai normalmente da start quando realmente ti serviranno. Esempio, se vuoi che Skype sia attivo lo esegui quando ti serve, se invece vuoi che sia sempre attivo anche quando non ti serve non fixi la chiave.
___________________________________
Dove l'ho sentita ? www.plagimusicali.net English Amiga Board Amiganews.it AfA One AROS x86 AROS 68k |
05-04-2013, 23.00.42 | #21 |
Senior Member
Registrato: 04-12-2008
Messaggi: 394
|
Rif: virus da messaggio fb
ok ho capito grazie domani a mente lucida ci provo
|
06-04-2013, 06.35.35 | #22 |
Forum supporter
Global Moderator
Registrato: 23-08-2007
Messaggi: 2.704
|
Rif: virus da messaggio fb
La pagina iniziale di internet explorer va cambiata, anche se pare che tu usi chrome:
Codice:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.findeer.com Codice:
C:\Users\Public\Documents\AppData\PoApp\PService.exe Codice:
O23 - Service: Serv Updater (ServUpdater) - ServiceUpd - C:\Users\aristide\AppData\Local\ServUpdater\ServiceUpd.exe O23 - Service: Pos Service (PowerOffer Service) - PowerOfferService - C:\Users\aristide\AppData\Local\PosService\Pos.exe O23 - Service: Software Upd (SoftwareUpd) - SoftwareUpdService - C:\Users\aristide\AppData\Local\SoftwareUpdater\SoftwareUpdService.exe Se La cartella PoApp rimane dopo la disinstallazione precedente, va eliminata con tutto il suo contenuto: Codice:
O4 - HKLM\..\Run: [PosService] C:\Users\Public\Documents\AppData\PoApp\PLauncher.exe |
06-04-2013, 09.56.58 | #23 | |||
Gold Member
Top Poster
Registrato: 06-07-2006
Loc.: Brindisi
Messaggi: 10.111
|
Rif: virus da messaggio fb
Quota:
Quota:
Quota:
___________________________________
Dove l'ho sentita ? www.plagimusicali.net English Amiga Board Amiganews.it AfA One AROS x86 AROS 68k Ultima modifica di AMIGA : 06-04-2013 alle ore 10.08.43 |
|||
06-04-2013, 15.16.52 | #24 |
Senior Member
Registrato: 04-12-2008
Messaggi: 394
|
Rif: virus da messaggio fb
grazie stampo tutto e mi metto a fare....
|
06-04-2013, 15.46.01 | #25 |
Senior Member
Registrato: 04-12-2008
Messaggi: 394
|
Rif: virus da messaggio fb
fixo tutte le voci tranne quelle dell' antivirus ok?
|
06-04-2013, 15.55.56 | #26 |
Senior Member
Registrato: 04-12-2008
Messaggi: 394
|
Rif: virus da messaggio fb
questo e' il nuovo scan dopo la pulizia
Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 14:55:01, on 06/04/2013 Platform: Windows 7 SP1 (WinNT 6.00.3505) MSIE: Internet Explorer v9.00 (9.00.8112.16470) Boot mode: Normal Running processes: C:\Program Files (x86)\Skype\Phone\Skype.exe C:\Users\aristide\AppData\Roaming\Dropbox\bin\Drop box.exe C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE C:\Program Files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Users\Public\Documents\AppData\PoApp\PService.e xe C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_ 6_602_180_ActiveX.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IELowutil.exe C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe C:\Windows\SysWOW64\DllHost.exe R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R3 - URLSearchHook: (no name) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - (no file) F2 - REG:system.ini: UserInit=userinit.exe, O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe O4 - HKLM\..\Run: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe O4 - HKLM\..\Run: [SAFE2012 HotKeys] "C:\Program Files (x86)\Steganos Safe 2012\SteganosHotKeyService.exe" O4 - HKLM\..\Run: [SAFE2012 File Redirection Starter] "C:\Program Files (x86)\Steganos Safe 2012\fredirstarter.exe" O4 - HKLM\..\Run: [NBAgent] "C:\Program Files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe" /WinStart O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" O4 - HKCU\..\Run: [Xvid] C:\Program Files (x86)\Xvid\CheckUpdate.exe O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun O4 - HKCU\..\Run: [WindowsRestore] C:\Users\aristide\AppData\Roaming\Microsoft\alg.ex e O4 - HKCU\..\Run: [MicrosoftActivex] C:\Users\aristide\AppData\Roaming\Microsoft\audiod g.exe O4 - HKCU\..\Run: [AdobeArm Update] C:\Users\aristide\AppData\Roaming\Microsoft\bds.ex e O4 - HKCU\..\Run: [UsbDeviceManager] C:\Users\aristide\AppData\Roaming\Microsoft\Device Manager.exe O4 - HKCU\..\Run: [MediaDevice] C:\Users\aristide\AppData\Roaming\Microsoft\windev .exe O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVIZIO LOCALE') O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVIZIO DI RETE') O4 - Startup: Dropbox.lnk = aristide\AppData\Roaming\Dropbox\bin\Dropbox.exe O4 - Startup: Ritaglio schermata e avvio di OneNote 2007.lnk = C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE O4 - Global Startup: 20Dollars2Surf.lnk = C:\Program Files (x86)\20Dollars2Surf\20dollars2surf.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: I&nvia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{0BEB00B9-B39D-4329-9A86-A7D41CBB38C9}: NameServer = 8.8.8.8,8.8.4.4 O17 - HKLM\System\CCS\Services\Tcpip\..\{1746C5FB-3B5C-4DEC-894B-0567489A3DE9}: NameServer = 8.8.8.8,8.8.4.4 O17 - HKLM\System\CCS\Services\Tcpip\..\{79787B42-39DE-477A-AF06-5ED9955E8000}: NameServer = 8.8.8.8,8.8.4.4 O17 - HKLM\System\CCS\Services\Tcpip\..\{846ee342-7039-11de-9d20-806e6f6e6963}: NameServer = 8.8.8.8,8.8.4.4 O17 - HKLM\System\CCS\Services\Tcpip\..\{8CD18FDC-2D3F-40C4-9117-2501B0B47715}: NameServer = 8.8.8.8,8.8.4.4 O17 - HKLM\System\CS1\Services\Tcpip\..\{0BEB00B9-B39D-4329-9A86-A7D41CBB38C9}: NameServer = 8.8.8.8,8.8.4.4 O17 - HKLM\System\CS2\Services\Tcpip\..\{0BEB00B9-B39D-4329-9A86-A7D41CBB38C9}: NameServer = 8.8.8.8,8.8.4.4 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpda teService.exe O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing) O23 - Service: Avira AntiVir MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe O23 - Service: Avira AntiVir WebGuard (AntiVirWebService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe O23 - Service: Servizio Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Chiavetta Internet E353 21.6. OUC (Chiavetta Internet E353 21.6. RunOuc) - Unknown owner - C:\Program Files (x86)\Chiavetta Internet E353 21.6\UpdateDog\ouc.exe (file missing) O23 - Service: CodeMeter Runtime Server (CodeMeter.exe) - WIBU-SYSTEMS AG - C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing) O23 - Service: Servizio Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe O23 - Service: Servizio Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing) O23 - Service: @C:\Program Files (x86)\Nero\Update\NASvc.exe,-200 (NAUpdate) - Nero AG - C:\Program Files (x86)\Nero\Update\NASvc.exe O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing) O23 - Service: Pos Service (PowerOffer Service) - PowerOfferService - C:\Users\aristide\AppData\Local\PosService\Pos.exe O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing) O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: Serv Updater (ServUpdater) - ServiceUpd - C:\Users\aristide\AppData\Local\ServUpdater\Servic eUpd.exe O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing) O23 - Service: Software Upd (SoftwareUpd) - SoftwareUpdService - C:\Users\aristide\AppData\Local\SoftwareUpdater\So ftwareUpdService.exe O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing) O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing) O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing) O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing) O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing) O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing) O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing) O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing) O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing) -- End of file - 12156 bytes |
06-04-2013, 16.04.09 | #27 |
Gold Member
Top Poster
Registrato: 06-07-2006
Loc.: Brindisi
Messaggi: 10.111
|
Rif: virus da messaggio fb
Non hai fixato nulla, hai spuntato tutto aggiungendo il baffo sulle caselle intressate, hai poi cliccato prima su Fix Cheched, e poi dato conferma scegliendo Si, ti sei ricordato di eseguirlo come Amministratore, la mancanza di uno di questi Step non permettono di eliminare le stringhe.
___________________________________
Dove l'ho sentita ? www.plagimusicali.net English Amiga Board Amiganews.it AfA One AROS x86 AROS 68k |
06-04-2013, 18.12.05 | #28 |
Senior Member
Registrato: 04-12-2008
Messaggi: 394
|
Rif: virus da messaggio fb
le stringhe sono state eliminate infatti siamo passati da 15000 byte a 12000 byte e il pc va meglio ora ma probabilmente ne devo eliminare altre ma ce ne sono tante che non capisco che cosa sono ed ho un po' di paura
|
06-04-2013, 18.19.29 | #29 |
Forum supporter
Global Moderator
Registrato: 23-08-2007
Messaggi: 2.704
|
Rif: virus da messaggio fb
Appunto... Se hai paura (se fai il backup comunque puoi ripristinare le voci eliminate), elimina almeno quelle che creano il problema, ovvero quelle indicate prima.
Non mi dirai che power offer lo hai installato volutamente? |
06-04-2013, 18.32.07 | #30 |
Gold Member
Top Poster
Registrato: 06-07-2006
Loc.: Brindisi
Messaggi: 10.111
|
Rif: virus da messaggio fb
No ti preoccupare anche se elimini tutte le chiavi, fai solo del bene, l'avvio del sistema non è legato a quelle chiavi, sono solo un plus, meglio dire una zavorra, come ti dicevo, lascia solo l'antivirus, perchè altrimenti non sarà attivo sotto nella barra. Come detto sopra, se vuoi con un click HiJackThis ti ripiazza tutta la "mundezza" che hai eliminato.
___________________________________
Dove l'ho sentita ? www.plagimusicali.net English Amiga Board Amiganews.it AfA One AROS x86 AROS 68k |
Utenti attualmente attivi che stanno leggendo questa discussione: 1 (0 utenti e 1 ospiti) | |
Strumenti discussione | |
|
|
Discussioni simili | ||||
Discussione | Autore discussione | Forum | Risposte | Ultimo messaggio |
errore quando apro Facebook von IE8 | peppecol | Windows 8/ 8.1/ 10 | 7 | 06-11-2012 20.25.34 |
Virus polli: 1° contagio da uomo a uomo (Update) | Gigi75 | Chiacchiere in libertà | 76 | 23-04-2006 14.38.10 |
CCleaner RiskWare? | AndyWarrior | Sicurezza&Privacy | 7 | 10-04-2006 16.38.58 |
MESSAGGIO DI VIRUS | pikagi | Sicurezza&Privacy | 1 | 02-02-2005 20.22.01 |
Virus: Panda Segnala Messaggio Spam Con Trojan Trj/small.b | Giorgius | Sicurezza&Privacy | 0 | 23-04-2004 18.43.50 |