Aiuto Dialer - Page 2

Arthur85 · 08-09-2006, 18.35.09

Ho notato una cosa a cui prima non avevo dato peso (in particola mi rivolgo ad altri utenti "esperti"), la voce:

C:\DOCUME~1\GIANNI~1\IMPOST~1\Temp\Rar$EXak.710\Hi jackThis.exe

mi sembra sospetta! Non l'avevo notata perchè il log mandava a capo proprio dopo la "i" di "Hi"...poi: quanti processi svchost.exe ci sono? E' fisiologico?

---

Come consigliato da crazy.cat usa ccleaner per pulire in profondità i file temporanei, poi prova con Spybot - Search & Destroy (http://www.safer-networking.org/it/m....html)...forse risolve il problema...prova a fare una scansione con a2free (occorre una regiostrazione....ma è free)...

Ma hai provato a fare la scansione in mod provvisoria con sysclean?

Il log di HiJackThis sembra pulito, non so da cosa possa dipendere la persistenza del problema.

Spero che tu riesca a risolvere, fammi sapere.

Ciao

ivana · 08-09-2006, 19.13.58

arthur85 e crazy. cat GRAZIE GRAZIE GRAZIE GRAZIE GRAZIE immenso. sembra che è sparito proprio tutto, non ci posso credere. siete MITICI. grazie ancora. un grosso bacio....cmuk

Arthur85 · 08-09-2006, 19.58.08

Sono contento che tu abbia risolto...

Ciao

Faffo · 15-09-2006, 00.55.17

Scusatemi sono nuovo, non ho ben capito come funziona il sito.
Comunque proviamo. Ho bisogno di aiuto
Problema con e1xplorer(icona in ogni posto) e adult Kei( compare automaticamente).Non mi dilungo sulle conseguenze che già conoscete.
Ho scaricato hijackthis ed ho eliminato qualcosa tipo trusted .... www.1987324......e Aflashcounter
Non sono molto pratico quindi qualsiasi spiegazione per favore terra terra ......
E rimasto quanto segue e non so se devo eliminare altro e in ogni caso come vado avanti, emerge qualche altro problema?
Logfile of HijackThis v1.99.0
Logfile of HijackThis v1.99.0
Scan saved at 21.33.41, on 14/08/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\System32\RunDll32.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\spoolsvc.exe
C:\Programmi\Messenger\msmsgs.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\WPSC3PS W.EXE
C:\WINDOWS\system32\spoolsvc.exe
C:\WINDOWS\explorer.exe
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\Programmi\ZipGenius 5\zipgenius.exe
C:\DOCUME~1\Docente\IMPOST~1\Temp\ZGTemp\HijackThi s.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O1 - Hosts: 200.73.174.154 STORAGE.HOSTANCE.NET
O1 - Hosts: 200.73.174.154 STORAGE-TASP.COM
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Duplex - {4D8603D1-E19F-4DB9-B841-CF0B3AECF967} - C:\WINDOWS\System32\apparat.dll
O2 - BHO: FastRX - {E09962E7-A39E-4F60-8003-66D57BED27B7} - C:\WINDOWS\System32\fastRX.dll
O2 - BHO: ComCap - {E1B2E864-8BFC-4072-AE11-924E0F8BBA96} - C:\WINDOWS\System32\comcap16.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [WpsRePsw] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\WpsRePs w.EXE
O4 - HKLM\..\Run: [kpx] C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\fastRX.dll DllInitApp
O4 - HKLM\..\Run: [Systems] C:\WINDOWS\System32\spoolsvc.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O17 - HKLM\System\CCS\Services\Tcpip\..\{9657801F-608F-4239-AE50-427F67A5DD39}: NameServer = 213.205.36.70 213.205.32.70
O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown - C:\WINDOWS\system32\ati2sgag.exe

Tecno214 · 15-09-2006, 09.21.52

Queste sono voci sospette....

C:\WINDOWS\System32\spoolsvc.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\WPSC3PS W.EXE
C:\DOCUME~1\Docente\IMPOST~1\Temp\ZGTemp\HijackThi s.exe

Prova a fixare queste di seguito e posta un nuovo log

O1 - Hosts: 200.73.174.154 STORAGE.HOSTANCE.NET
O1 - Hosts: 200.73.174.154 STORAGE-TASP.COM
O2 - BHO: Duplex - {4D8603D1-E19F-4DB9-B841-CF0B3AECF967} - C:\WINDOWS\System32\apparat.dll
O2 - BHO: FastRX - {E09962E7-A39E-4F60-8003-66D57BED27B7} - C:\WINDOWS\System32\fastRX.dll
O2 - BHO: ComCap - {E1B2E864-8BFC-4072-AE11-924E0F8BBA96} - C:\WINDOWS\System32\comcap16.dll
O4 - HKLM\..\Run: [WpsRePsw] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\WpsRePs w.EXE
O4 - HKLM\..\Run: [kpx] C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\fastRX.dll DllInitApp
O4 - HKLM\..\Run: [Systems] C:\WINDOWS\System32\spoolsvc.exe

Faffo · 15-09-2006, 18.10.46

grazie per la risposta, ho fatto come hai detto, poi come letto su precedenti casi sono andato su system 32 ed ho eliminato le voci simili a quelle che mi hai indicato, sembra tutto a posto, devo fare altro?
Tuttavia in system 32 permane una voce: bixini. exe quando provo a elminarla il quadro scompare per qualche secondo, mi rimanda l'immagine al descktop. come fare.
Ti mando il Nuovo log
Logfile of HijackThis v1.99.0
Scan saved at 10.48.35, on 15/08/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\ZipGenius 5\zipgenius.exe
C:\DOCUME~1\Docente\IMPOST~1\Temp\ZGTemp\HijackThi s.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown - C:\WINDOWS\system32\ati2sgag.exe

aspide · 30-09-2006, 18.18.47

Domande per Arthur85:
1) il file host da sostituire deve essere sostituito una volta per sempre oppure bisogna aggiornarlo di tanto in tanto?
2) A scanso di equivoci bisogna andare a sostituire soltanto il file host presente nel file .zip scaricato e basta, vero?
3) che cosa puoi dirmi su quanto riportato nel file readme (all'interno del file .zip scaricato) in cui si avverte di un possibile rallentamento in possessori di S.O.XP? (testuale:[Important Notice - 2K/XP Users]
In most cases a large HOSTS file (over 135 kb) tends to slow down the machine. This only occurs
in W2000 and XP. Windows 98 and Windows ME are not affected.)
Grazie per le tue eventuali risposte.

AJleTipine · 07-10-2006, 14.51.10

AIUTOOOOOOOO...ankio m sn incappata sto coso adult key e sono impedita col pc ma nn so cm eliminarlo...aiutatemiii!!ho fatto cio k avete detto d fare a ivana...v lascio il mio copia e incolla ma v prego d togliermi sto coso!!
Logfile of HijackThis v1.99.1
Scan saved at 14.46.38, on 07/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\Programmi\Java\j2re1.4.2_03\bin\jusched.exe
C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\HP\HP Software Update\HPWuSchd.exe
C:\Programmi\HP\hpcoretech\hpcmpmgr.exe
C:\Programmi\iTunes\iTunesHelper.exe
C:\Programmi\File comuni\Microsoft Shared\Works Shared\WkUFind.exe
C:\Programmi\QuickTime\qttask.exe
C:\Programmi\trybar\537_0_2_0_976_systray.exe
C:\PROGRA~1\P2PNET~1\P2PNET~1.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programmi\MessengerPlus! 3\MsgPlus.exe
C:\WINDOWS\system32\spoolsvc.exe
C:\WINDOWS\system32\sescmgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\MSN Messenger\msnmsgr.exe
C:\Programmi\Alice ti aiuta\bin\mpbtn.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\DOCUME~1\JEYEAL~1\IMPOST~1\Temp\Rar$EX01.805\Hi jackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.it/0SEITIT/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.libero.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.hp.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://goto.energy-factor.com//link....id_profilo=979
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {14D1A72D-8705-11D8-B120-0040F46CB696} - (no file)
O2 - BHO: (no name) - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - (no file)
O2 - BHO: m1a2 - {81566074-267F-41e3-A51B-2599A3AC9EC3} - C:\WINDOWS\system32\msx.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Programmi\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\MSN Apps\MSN Toolbar\01.02.5000.1021\it\msntb.dll
O2 - BHO: ComCap - {E1B2E864-8BFC-4072-AE11-924E0F8BBA96} - C:\WINDOWS\system32\comcap16.dll
O3 - Toolbar: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\MSN Apps\MSN Toolbar\01.02.5000.1021\it\msntb.dll
O3 - Toolbar: (no name) - {53E0B6E8-A51D-448B-B692-40B67B285543} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Programmi\File comuni\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Programmi\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Programmi\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [Cpqset] C:\Programmi\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Programmi\File comuni\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [MediaPipe P2P Loader] "C:\Programmi\p2pnetworks\mpp2pl.exe" /H
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [trybar] C:\Programmi\trybar\537_0_2_0_976_systray.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programmi\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [Systems] C:\WINDOWS\system32\\spoolsvc.exe
O4 - HKLM\..\Run: [sctrlmgr] C:\WINDOWS\system32\sescmgr.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Programmi\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmi\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Alice ti aiuta.lnk = C:\Programmi\Alice ti aiuta\bin\matcli.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O15 - Trusted Zone: www.1987324.com
O15 - Trusted Zone: *.3
O15 - Trusted Zone: www.adslconnection.name
O15 - Trusted Zone: *.aflashcounter.com
O15 - Trusted Zone: www.archivio.name
O15 - Trusted Zone: www.archiviosex.net
O15 - Trusted Zone: www.contentdiscount.info
O15 - Trusted Zone: www.extremeaccess.info
O15 - Trusted Zone: www.hastalavista.it
O15 - Trusted Zone: www.otherchance.com
O15 - Trusted Zone: www.playitalia.com
O15 - Trusted Zone: www.redfunny.com
O15 - Trusted Zone: www.sgrunt.biz
O15 - Trusted Zone: www.skymasters.biz
O15 - Trusted Zone: www.softlab.name
O15 - Trusted Zone: www.superspots.biz
O15 - Trusted Zone: www.xbeta69.com
O15 - Trusted Zone: www.xxx-content.name
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary...o.cab47946.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{18F0ED45-8660-44A7-BD00-BAC1BB962B68}: NameServer = 85.37.17.4 85.38.28.70
O17 - HKLM\System\CS1\Services\Tcpip\..\{18F0ED45-8660-44A7-BD00-BAC1BB962B68}: NameServer = 85.37.17.4 85.38.28.70
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: NetOal - Unknown owner - \\?\C:\Programmi\File comuni\System\com6.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SrvWfo - Unknown owner - \\?\C:\Programmi\Windows NT\lpt3.exe (file missing)

crazy.cat · 07-10-2006, 18.20.35

Pensavi di avere un solo problema....sono molti di più purtroppo...

Rifai la scansione con hijackthis, selezioni le caselle di queste righe e poi premi fix
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://goto.energy-factor.com//link...&id_profilo=979
R3 - URLSearchHook: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
O2 - BHO: (no name) - {14D1A72D-8705-11D8-B120-0040F46CB696} - (no file)
O2 - BHO: (no name) - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - (no file)
O2 - BHO: m1a2 - {81566074-267F-41e3-A51B-2599A3AC9EC3} - C:\WINDOWS\system32\msx.dll
O2 - BHO: ComCap - {E1B2E864-8BFC-4072-AE11-924E0F8BBA96} - C:\WINDOWS\system32\comcap16.dll
O3 - Toolbar: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
O3 - Toolbar: (no name) - {53E0B6E8-A51D-448B-B692-40B67B285543} - (no file)
O4 - HKLM\..\Run: [MediaPipe P2P Loader] "C:\Programmi\p2pnetworks\mpp2pl.exe" /H
O4 - HKLM\..\Run: [trybar] C:\Programmi\trybar\537_0_2_0_976_systray.exe
O4 - HKLM\..\Run: [Systems] C:\WINDOWS\system32\\spoolsvc.exe
O4 - HKLM\..\Run: [sctrlmgr] C:\WINDOWS\system32\sescmgr.exe
O15 - Trusted Zone: www.1987324.com
O15 - Trusted Zone: *.3
O15 - Trusted Zone: www.adslconnection.name
O15 - Trusted Zone: *.aflashcounter.com
O15 - Trusted Zone: www.archivio.name
O15 - Trusted Zone: www.archiviosex.net
O15 - Trusted Zone: www.contentdiscount.info
O15 - Trusted Zone: www.extremeaccess.info
O15 - Trusted Zone: www.hastalavista.it
O15 - Trusted Zone: www.otherchance.com
O15 - Trusted Zone: www.playitalia.com
O15 - Trusted Zone: www.redfunny.com
O15 - Trusted Zone: www.sgrunt.biz
O15 - Trusted Zone: www.skymasters.biz
O15 - Trusted Zone: www.softlab.name
O15 - Trusted Zone: www.superspots.biz
O15 - Trusted Zone: www.xbeta69.com
O15 - Trusted Zone: www.xxx-content.name
O23 - Service: NetOal - Unknown owner - \\?\C:\Programmi\File comuni\System\com6.exe (file missing)
O23 - Service: SrvWfo - Unknown owner - \\?\C:\Programmi\Windows NT\lpt3.exe (file missing)

Con questo sistema elimini uno dei virus
http://www.greatis.com/security/ICQC...%20remover.htm

Qui ci sono due tools e un antivirus per cercare di eliminare il LinkOptimizer
http://www.prevx.com/gromozon.asp
http://smallbiz.symantec.com/securit...092316-4153-99
http://www.tgsoft.it/italy/index_ita.html

Usa unlocker per eliminare i fil exe che trovi ancora delle righe indicate più sopra.
http://ccollomb.free.fr/unlocker/

Cerca di seguire l'ordine che ti ho dato perchè alcuni file sono piuttosto rognosi da eliminare.

Le pulizie ed eliminazioni dei files sarebbe meglio farle dalla modalità provvisoria e con il ripristino della configurazione disattivato.

Alla fine rifai la scansione con hijackthis e riposti il log per vedere se è avanzato qualcosa.

Lionsquid · 07-10-2006, 20.02.27

oltre ai suggerimenti di crazy.cat aggiungerei che è necessario disinstallare programmi come il P2Pnetworks, VERO MALWARE....

se rimuovi tutto con successo e ti arrischi ad avviare nuovamente quel programma ti ritrovi infettato in meno di 10 secondi!

AJleTipine · 07-10-2006, 20.36.19

hey grazieeeee!!!!nn ho ancora finito il lavoro k m avete dato da fare...continuo doma xk adesso m devo preparare x uscire!
quindi vi faccio saxe nn appena possibile...
grazie ancora
j

AJleTipine · 12-10-2006, 19.02.19

ciaooo!!scusate s nn m sn fatta sentire ma fino a stanotte[x tta la notte]ero in delirio cn 40 d febbre..><...nn so s sn riuscita a eliminare tutto...v rido' la mia scansione,voi d certo ne capite piuì d me!!^^!!ma tti i programmi k ho scaricato,adesso li devo togliere??
grazie!!
JEY
Logfile of HijackThis v1.99.1
Scan saved at 19.02.41, on 12/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\Programmi\Java\j2re1.4.2_03\bin\jusched.exe
C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\HP\hpcoretech\hpcmpmgr.exe
C:\Programmi\iTunes\iTunesHelper.exe
C:\Programmi\File comuni\Microsoft Shared\Works Shared\WkUFind.exe
C:\Programmi\QuickTime\qttask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programmi\MessengerPlus! 3\MsgPlus.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Greatis\REGRUN~1\WatchDog.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\MSN Messenger\msnmsgr.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\Documents and Settings\Jey e Ale Bonito\Desktop\Unlocker\UnlockerAssistant.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\DOCUME~1\JEYEAL~1\IMPOST~1\Temp\Rar$EX00.598\Hi jackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.it/0SEITIT/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.libero.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.hp.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Programmi\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\MSN Apps\MSN Toolbar\01.02.5000.1021\it\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\MSN Apps\MSN Toolbar\01.02.5000.1021\it\msntb.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Programmi\File comuni\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Programmi\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [Cpqset] C:\Programmi\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Programmi\File comuni\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programmi\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [VIRIT LITE MONITOR] C:\VEXPLITE\MONLITE.EXE
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Documents and Settings\Jey e Ale Bonito\Desktop\Unlocker\UnlockerAssistant.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Programmi\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [Regrun2] C:\PROGRA~1\Greatis\REGRUN~1\WatchDog.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmi\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary...o.cab47946.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{18F0ED45-8660-44A7-BD00-BAC1BB962B68}: NameServer = 85.37.17.4 85.38.28.70
O17 - HKLM\System\CS1\Services\Tcpip\..\{18F0ED45-8660-44A7-BD00-BAC1BB962B68}: NameServer = 85.37.17.4 85.38.28.70
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Virit eXplorer Lite (viritsvclite) - TG Soft Sas www.tgsoft.it - C:\VEXPLITE\viritsvc.exe

crazy.cat · 12-10-2006, 19.12.15

Quota:

Inviato da AJleTipine

v rido' la mia scansione,voi d certo ne capite piuì d me!!^^!!ma tti i programmi k ho scaricato,adesso li devo togliere??

Direi che hai eliminato tutto per bene.
Si, i programmi che hai installato li puoi anche eliminare.

AJleTipine · 12-10-2006, 19.16.26

ok...t ringrazio!!!!
meno male k ho trovato voi!!!..a presto..
Jey

AJleTipine · 16-10-2006, 10.03.08

regaz ho altri problemi??devo eliminare qualcos'altro??xk qnd cn virit m analizza vengono fuori 3 virus k nn m elimina...v rifaccio la scansione col solito programma...
Logfile of HijackThis v1.99.1
Scan saved at 10.07.13, on 16/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\svchost.exe
C:\VEXPLITE\viritsvc.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\igfxtray.exe
C:\Programmi\Java\j2re1.4.2_03\bin\jusched.exe
C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\HP\hpcoretech\hpcmpmgr.exe
C:\Programmi\iTunes\iTunesHelper.exe
C:\Programmi\File comuni\Microsoft Shared\Works Shared\WkUFind.exe
C:\Programmi\QuickTime\qttask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programmi\MessengerPlus! 3\MsgPlus.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\VEXPLITE\MONLITE.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\MSN Messenger\msnmsgr.exe
C:\VEXPLITE\VIRITEXP.EXE
C:\Programmi\Internet Explorer\iexplore.exe
C:\DOCUME~1\JEYEAL~1\IMPOST~1\Temp\Rar$EX00.576\Hi jackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tgsoft.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Programmi\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\MSN Apps\MSN Toolbar\01.02.5000.1021\it\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\MSN Apps\MSN Toolbar\01.02.5000.1021\it\msntb.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Programmi\File comuni\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Programmi\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [Cpqset] C:\Programmi\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Programmi\File comuni\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programmi\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [VIRIT LITE MONITOR] C:\VEXPLITE\MONLITE.EXE
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Documents and Settings\Jey e Ale Bonito\Desktop\Unlocker\UnlockerAssistant.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Programmi\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmi\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary...o.cab47946.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{18F0ED45-8660-44A7-BD00-BAC1BB962B68}: NameServer = 85.37.17.4 85.38.28.70
O17 - HKLM\System\CS1\Services\Tcpip\..\{18F0ED45-8660-44A7-BD00-BAC1BB962B68}: NameServer = 85.37.17.4 85.38.28.70
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Virit eXplorer Lite (viritsvclite) - TG Soft Sas www.tgsoft.it - C:\VEXPLITE\viritsvc.exe
grazie 1000
la JEY

08-09-2006, 18.35.09	#16
Arthur85 Hero Member Registrato: 12-11-2004 Messaggi: 639	Ho notato una cosa a cui prima non avevo dato peso (in particola mi rivolgo ad altri utenti "esperti"), la voce: C:\DOCUME~1\GIANNI~1\IMPOST~1\Temp\Rar$EXak.710\Hi jackThis.exe mi sembra sospetta! Non l'avevo notata perchè il log mandava a capo proprio dopo la "i" di "Hi"...poi: quanti processi svchost.exe ci sono? E' fisiologico? --- Come consigliato da crazy.cat usa ccleaner per pulire in profondità i file temporanei, poi prova con Spybot - Search & Destroy (http://www.safer-networking.org/it/m....html)...forse risolve il problema...prova a fare una scansione con a2free (occorre una regiostrazione....ma è free)... Ma hai provato a fare la scansione in mod provvisoria con sysclean? Il log di HiJackThis sembra pulito, non so da cosa possa dipendere la persistenza del problema. Spero che tu riesca a risolvere, fammi sapere. Ciao ___________________________________ "Nel migliore dei casi la vita, comunque la si consideri, è un affare che non copre le spese"(Arthur Schopenhauer)

08-09-2006, 19.58.08	#18
Arthur85 Hero Member Registrato: 12-11-2004 Messaggi: 639	Sono contento che tu abbia risolto... Ciao ___________________________________ "Nel migliore dei casi la vita, comunque la si consideri, è un affare che non copre le spese"(Arthur Schopenhauer)

15-09-2006, 09.21.52	#20
Tecno214 Hero Member Registrato: 26-06-2006 Loc.: Empoli (FI) Messaggi: 968	** Queste sono voci sospette.... C:\WINDOWS\System32\spoolsvc.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\WPSC3PS W.EXE C:\DOCUME~1\Docente\IMPOST~1\Temp\ZGTemp\HijackThi s.exe Prova a fixare queste di seguito e posta un nuovo log O1 - Hosts: 200.73.174.154 STORAGE.HOSTANCE.NET O1 - Hosts: 200.73.174.154 STORAGE-TASP.COM O2 - BHO: Duplex - {4D8603D1-E19F-4DB9-B841-CF0B3AECF967} - C:\WINDOWS\System32\apparat.dll O2 - BHO: FastRX - {E09962E7-A39E-4F60-8003-66D57BED27B7} - C:\WINDOWS\System32\fastRX.dll O2 - BHO: ComCap - {E1B2E864-8BFC-4072-AE11-924E0F8BBA96} - C:\WINDOWS\System32\comcap16.dll O4 - HKLM\..\Run: [WpsRePsw] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\WpsRePs w.EXE O4 - HKLM\..\Run: [kpx] C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\fastRX.dll DllInitApp O4 - HKLM\..\Run: [Systems] C:\WINDOWS\System32\spoolsvc.exe

07-10-2006, 18.20.35	#24
crazy.cat Gold Member Top Poster Registrato: 20-08-2002 Loc.: Mestre Messaggi: 3.563	Pensavi di avere un solo problema....sono molti di più purtroppo... Rifai la scansione con hijackthis, selezioni le caselle di queste righe e poi premi fix R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://goto.energy-factor.com//link...&id_profilo=979 R3 - URLSearchHook: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file) O2 - BHO: (no name) - {14D1A72D-8705-11D8-B120-0040F46CB696} - (no file) O2 - BHO: (no name) - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - (no file) O2 - BHO: m1a2 - {81566074-267F-41e3-A51B-2599A3AC9EC3} - C:\WINDOWS\system32\msx.dll O2 - BHO: ComCap - {E1B2E864-8BFC-4072-AE11-924E0F8BBA96} - C:\WINDOWS\system32\comcap16.dll O3 - Toolbar: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file) O3 - Toolbar: (no name) - {53E0B6E8-A51D-448B-B692-40B67B285543} - (no file) O4 - HKLM\..\Run: [MediaPipe P2P Loader] "C:\Programmi\p2pnetworks\mpp2pl.exe" /H O4 - HKLM\..\Run: [trybar] C:\Programmi\trybar\537_0_2_0_976_systray.exe O4 - HKLM\..\Run: [Systems] C:\WINDOWS\system32\\spoolsvc.exe O4 - HKLM\..\Run: [sctrlmgr] C:\WINDOWS\system32\sescmgr.exe O15 - Trusted Zone: www.1987324.com O15 - Trusted Zone: .3 O15 - Trusted Zone: www.adslconnection.name O15 - Trusted Zone: .aflashcounter.com O15 - Trusted Zone: www.archivio.name O15 - Trusted Zone: www.archiviosex.net O15 - Trusted Zone: www.contentdiscount.info O15 - Trusted Zone: www.extremeaccess.info O15 - Trusted Zone: www.hastalavista.it O15 - Trusted Zone: www.otherchance.com O15 - Trusted Zone: www.playitalia.com O15 - Trusted Zone: www.redfunny.com O15 - Trusted Zone: www.sgrunt.biz O15 - Trusted Zone: www.skymasters.biz O15 - Trusted Zone: www.softlab.name O15 - Trusted Zone: www.superspots.biz O15 - Trusted Zone: www.xbeta69.com O15 - Trusted Zone: www.xxx-content.name O23 - Service: NetOal - Unknown owner - \\?\C:\Programmi\File comuni\System\com6.exe (file missing) O23 - Service: SrvWfo - Unknown owner - \\?\C:\Programmi\Windows NT\lpt3.exe (file missing) Con questo sistema elimini uno dei virus http://www.greatis.com/security/ICQC...%20remover.htm Qui ci sono due tools e un antivirus per cercare di eliminare il LinkOptimizer http://www.prevx.com/gromozon.asp http://smallbiz.symantec.com/securit...092316-4153-99 http://www.tgsoft.it/italy/index_ita.html Usa unlocker per eliminare i fil exe che trovi ancora delle righe indicate più sopra. http://ccollomb.free.fr/unlocker/ Cerca di seguire l'ordine che ti ho dato perchè alcuni file sono piuttosto rognosi da eliminare. Le pulizie ed eliminazioni dei files sarebbe meglio farle dalla modalità provvisoria e con il ripristino della configurazione disattivato. Alla fine rifai la scansione con hijackthis e riposti il log per vedere se è avanzato qualcosa. ___________________________________ Solo gli operai sanno quanto vale il tempo; se lo fanno sempre pagare.

07-10-2006, 20.02.27	#25
Lionsquid Gold Member Top Poster Registrato: 03-05-2001 Loc.: Trapani Messaggi: 11.639	oltre ai suggerimenti di crazy.cat aggiungerei che è necessario disinstallare programmi come il P2Pnetworks, VERO MALWARE.... se rimuovi tutto con successo e ti arrischi ad avviare nuovamente quel programma ti ritrovi infettato in meno di 10 secondi! ___________________________________ ... questi politicanti, ex fascisti, ex leghisti, piduisti a tempo pieno usano la crisi per rafforzare il loro potere ed eliminare gli altri, dalla magistratura, al Parlamento, alla Corte dei conti, alla presidenza della Repubblica.... Beppe Grillo

08-09-2006, 19.13.58	#17
ivana Newbie Registrato: 07-09-2006 Messaggi: 6	arthur85 e crazy. cat GRAZIE GRAZIE GRAZIE GRAZIE GRAZIE immenso. sembra che è sparito proprio tutto, non ci posso credere. siete MITICI. grazie ancora. un grosso bacio....cmuk

15-09-2006, 00.55.17	#19
Faffo Newbie Registrato: 15-09-2006 Messaggi: 2	Scusatemi sono nuovo, non ho ben capito come funziona il sito. Comunque proviamo. Ho bisogno di aiuto Problema con e1xplorer(icona in ogni posto) e adult Kei( compare automaticamente).Non mi dilungo sulle conseguenze che già conoscete. Ho scaricato hijackthis ed ho eliminato qualcosa tipo trusted .... www.1987324......e Aflashcounter Non sono molto pratico quindi qualsiasi spiegazione per favore terra terra ...... E rimasto quanto segue e non so se devo eliminare altro e in ogni caso come vado avanti, emerge qualche altro problema? Logfile of HijackThis v1.99.0 Logfile of HijackThis v1.99.0 Scan saved at 21.33.41, on 14/08/2006 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\System32\RunDll32.exe C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\spoolsvc.exe C:\Programmi\Messenger\msmsgs.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\WPSC3PS W.EXE C:\WINDOWS\system32\spoolsvc.exe C:\WINDOWS\explorer.exe C:\Programmi\Internet Explorer\IEXPLORE.EXE C:\Programmi\ZipGenius 5\zipgenius.exe C:\DOCUME~1\Docente\IMPOST~1\Temp\ZGTemp\HijackThi s.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti O1 - Hosts: 200.73.174.154 STORAGE.HOSTANCE.NET O1 - Hosts: 200.73.174.154 STORAGE-TASP.COM O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Duplex - {4D8603D1-E19F-4DB9-B841-CF0B3AECF967} - C:\WINDOWS\System32\apparat.dll O2 - BHO: FastRX - {E09962E7-A39E-4F60-8003-66D57BED27B7} - C:\WINDOWS\System32\fastRX.dll O2 - BHO: ComCap - {E1B2E864-8BFC-4072-AE11-924E0F8BBA96} - C:\WINDOWS\System32\comcap16.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp O4 - HKLM\..\Run: [WpsRePsw] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\WpsRePs w.EXE O4 - HKLM\..\Run: [kpx] C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\fastRX.dll DllInitApp O4 - HKLM\..\Run: [Systems] C:\WINDOWS\System32\spoolsvc.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O17 - HKLM\System\CCS\Services\Tcpip\..\{9657801F-608F-4239-AE50-427F67A5DD39}: NameServer = 213.205.36.70 213.205.32.70 O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown - C:\WINDOWS\system32\ati2sgag.exe

15-09-2006, 18.10.46	#21
Faffo Newbie Registrato: 15-09-2006 Messaggi: 2	grazie per la risposta, ho fatto come hai detto, poi come letto su precedenti casi sono andato su system 32 ed ho eliminato le voci simili a quelle che mi hai indicato, sembra tutto a posto, devo fare altro? Tuttavia in system 32 permane una voce: bixini. exe quando provo a elminarla il quadro scompare per qualche secondo, mi rimanda l'immagine al descktop. come fare. Ti mando il Nuovo log Logfile of HijackThis v1.99.0 Scan saved at 10.48.35, on 15/08/2006 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Programmi\ZipGenius 5\zipgenius.exe C:\DOCUME~1\Docente\IMPOST~1\Temp\ZGTemp\HijackThi s.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown - C:\WINDOWS\system32\ati2sgag.exe

30-09-2006, 18.18.47	#22
aspide Senior Member Registrato: 17-03-2001 Loc.: Provincia di Roma Messaggi: 335	Domande per Arthur85: 1) il file host da sostituire deve essere sostituito una volta per sempre oppure bisogna aggiornarlo di tanto in tanto? 2) A scanso di equivoci bisogna andare a sostituire soltanto il file host presente nel file .zip scaricato e basta, vero? 3) che cosa puoi dirmi su quanto riportato nel file readme (all'interno del file .zip scaricato) in cui si avverte di un possibile rallentamento in possessori di S.O.XP? (testuale:[Important Notice - 2K/XP Users] In most cases a large HOSTS file (over 135 kb) tends to slow down the machine. This only occurs in W2000 and XP. Windows 98 and Windows ME are not affected.) Grazie per le tue eventuali risposte.

07-10-2006, 14.51.10	#23
AJleTipine Newbie Registrato: 07-10-2006 Messaggi: 7	AIUTOOOOOOOO...ankio m sn incappata sto coso adult key e sono impedita col pc ma nn so cm eliminarlo...aiutatemiii!!ho fatto cio k avete detto d fare a ivana...v lascio il mio copia e incolla ma v prego d togliermi sto coso!! Logfile of HijackThis v1.99.1 Scan saved at 14.46.38, on 07/10/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe C:\Programmi\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\igfxtray.exe C:\Programmi\Java\j2re1.4.2_03\bin\jusched.exe C:\Programmi\Synaptics\SynTP\SynTPLpr.exe C:\Programmi\Synaptics\SynTP\SynTPEnh.exe C:\Programmi\HP\HP Software Update\HPWuSchd.exe C:\Programmi\HP\hpcoretech\hpcmpmgr.exe C:\Programmi\iTunes\iTunesHelper.exe C:\Programmi\File comuni\Microsoft Shared\Works Shared\WkUFind.exe C:\Programmi\QuickTime\qttask.exe C:\Programmi\trybar\537_0_2_0_976_systray.exe C:\PROGRA~1\P2PNET~1\P2PNET~1.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Programmi\MessengerPlus! 3\MsgPlus.exe C:\WINDOWS\system32\spoolsvc.exe C:\WINDOWS\system32\sescmgr.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\svchost.exe C:\Programmi\MSN Messenger\msnmsgr.exe C:\Programmi\Alice ti aiuta\bin\mpbtn.exe C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe C:\Programmi\Alwil Software\Avast4\ashWebSv.exe C:\Programmi\iPod\bin\iPodService.exe C:\Programmi\Internet Explorer\iexplore.exe C:\DOCUME~1\JEYEAL~1\IMPOST~1\Temp\Rar$EX01.805\Hi jackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.it/0SEITIT/SAOS01 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.libero.it/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.hp.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://goto.energy-factor.com//link....id_profilo=979 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti R3 - URLSearchHook: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {14D1A72D-8705-11D8-B120-0040F46CB696} - (no file) O2 - BHO: (no name) - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - (no file) O2 - BHO: m1a2 - {81566074-267F-41e3-A51B-2599A3AC9EC3} - C:\WINDOWS\system32\msx.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Programmi\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\MSN Apps\MSN Toolbar\01.02.5000.1021\it\msntb.dll O2 - BHO: ComCap - {E1B2E864-8BFC-4072-AE11-924E0F8BBA96} - C:\WINDOWS\system32\comcap16.dll O3 - Toolbar: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file) O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\MSN Apps\MSN Toolbar\01.02.5000.1021\it\msntb.dll O3 - Toolbar: (no name) - {53E0B6E8-A51D-448B-B692-40B67B285543} - (no file) O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [UpdateManager] "C:\Programmi\File comuni\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [SynTPLpr] C:\Programmi\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [HP Software Update] "C:\Programmi\HP\HP Software Update\HPWuSchd.exe" O4 - HKLM\..\Run: [HP Component Manager] "C:\Programmi\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe O4 - HKLM\..\Run: [Cpqset] C:\Programmi\HPQ\Default Settings\cpqset.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Programmi\File comuni\Microsoft Shared\Works Shared\WkUFind.exe O4 - HKLM\..\Run: [MediaPipe P2P Loader] "C:\Programmi\p2pnetworks\mpp2pl.exe" /H O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [trybar] C:\Programmi\trybar\537_0_2_0_976_systray.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programmi\MessengerPlus! 3\MsgPlus.exe" O4 - HKLM\..\Run: [Systems] C:\WINDOWS\system32\\spoolsvc.exe O4 - HKLM\..\Run: [sctrlmgr] C:\WINDOWS\system32\sescmgr.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MessengerPlus3] "C:\Programmi\MessengerPlus! 3\MsgPlus.exe" /WinStart O4 - HKCU\..\Run: [msnmsgr] "C:\Programmi\MSN Messenger\msnmsgr.exe" /background O4 - Global Startup: Alice ti aiuta.lnk = C:\Programmi\Alice ti aiuta\bin\matcli.exe O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com O15 - Trusted Zone: www.1987324.com O15 - Trusted Zone: .3 O15 - Trusted Zone: www.adslconnection.name O15 - Trusted Zone: .aflashcounter.com O15 - Trusted Zone: www.archivio.name O15 - Trusted Zone: www.archiviosex.net O15 - Trusted Zone: www.contentdiscount.info O15 - Trusted Zone: www.extremeaccess.info O15 - Trusted Zone: www.hastalavista.it O15 - Trusted Zone: www.otherchance.com O15 - Trusted Zone: www.playitalia.com O15 - Trusted Zone: www.redfunny.com O15 - Trusted Zone: www.sgrunt.biz O15 - Trusted Zone: www.skymasters.biz O15 - Trusted Zone: www.softlab.name O15 - Trusted Zone: www.superspots.biz O15 - Trusted Zone: www.xbeta69.com O15 - Trusted Zone: www.xxx-content.name O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary...o.cab47946.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{18F0ED45-8660-44A7-BD00-BAC1BB962B68}: NameServer = 85.37.17.4 85.38.28.70 O17 - HKLM\System\CS1\Services\Tcpip\..\{18F0ED45-8660-44A7-BD00-BAC1BB962B68}: NameServer = 85.37.17.4 85.38.28.70 O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Programmi\iPod\bin\iPodService.exe O23 - Service: NetOal - Unknown owner - \\?\C:\Programmi\File comuni\System\com6.exe (file missing) O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SrvWfo - Unknown owner - \\?\C:\Programmi\Windows NT\lpt3.exe (file missing)

07-10-2006, 20.36.19	#26
AJleTipine Newbie Registrato: 07-10-2006 Messaggi: 7	^^ hey grazieeeee!!!!nn ho ancora finito il lavoro k m avete dato da fare...continuo doma xk adesso m devo preparare x uscire! quindi vi faccio saxe nn appena possibile... grazie ancora j

12-10-2006, 19.02.19	#27
AJleTipine Newbie Registrato: 07-10-2006 Messaggi: 7	ciaooo!!scusate s nn m sn fatta sentire ma fino a stanotte[x tta la notte]ero in delirio cn 40 d febbre..><...nn so s sn riuscita a eliminare tutto...v rido' la mia scansione,voi d certo ne capite piuì d me!!^^!!ma tti i programmi k ho scaricato,adesso li devo togliere?? grazie!! JEY Logfile of HijackThis v1.99.1 Scan saved at 19.02.41, on 12/10/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\igfxtray.exe C:\Programmi\Java\j2re1.4.2_03\bin\jusched.exe C:\Programmi\Synaptics\SynTP\SynTPLpr.exe C:\Programmi\Synaptics\SynTP\SynTPEnh.exe C:\Programmi\HP\hpcoretech\hpcmpmgr.exe C:\Programmi\iTunes\iTunesHelper.exe C:\Programmi\File comuni\Microsoft Shared\Works Shared\WkUFind.exe C:\Programmi\QuickTime\qttask.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Programmi\MessengerPlus! 3\MsgPlus.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\Greatis\REGRUN~1\WatchDog.exe C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe C:\Programmi\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\svchost.exe C:\Programmi\MSN Messenger\msnmsgr.exe C:\Programmi\iPod\bin\iPodService.exe C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe C:\Programmi\Alwil Software\Avast4\ashWebSv.exe C:\Documents and Settings\Jey e Ale Bonito\Desktop\Unlocker\UnlockerAssistant.exe C:\Programmi\Internet Explorer\iexplore.exe C:\DOCUME~1\JEYEAL~1\IMPOST~1\Temp\Rar$EX00.598\Hi jackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.it/0SEITIT/SAOS01 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.libero.it/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.hp.com R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Programmi\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\MSN Apps\MSN Toolbar\01.02.5000.1021\it\msntb.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\MSN Apps\MSN Toolbar\01.02.5000.1021\it\msntb.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [UpdateManager] "C:\Programmi\File comuni\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [SynTPLpr] C:\Programmi\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [HP Component Manager] "C:\Programmi\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe O4 - HKLM\..\Run: [Cpqset] C:\Programmi\HPQ\Default Settings\cpqset.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Programmi\File comuni\Microsoft Shared\Works Shared\WkUFind.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programmi\MessengerPlus! 3\MsgPlus.exe" O4 - HKLM\..\Run: [VIRIT LITE MONITOR] C:\VEXPLITE\MONLITE.EXE O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Documents and Settings\Jey e Ale Bonito\Desktop\Unlocker\UnlockerAssistant.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MessengerPlus3] "C:\Programmi\MessengerPlus! 3\MsgPlus.exe" /WinStart O4 - HKCU\..\Run: [Regrun2] C:\PROGRA~1\Greatis\REGRUN~1\WatchDog.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Programmi\MSN Messenger\msnmsgr.exe" /background O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary...o.cab47946.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{18F0ED45-8660-44A7-BD00-BAC1BB962B68}: NameServer = 85.37.17.4 85.38.28.70 O17 - HKLM\System\CS1\Services\Tcpip\..\{18F0ED45-8660-44A7-BD00-BAC1BB962B68}: NameServer = 85.37.17.4 85.38.28.70 O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Programmi\iPod\bin\iPodService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Virit eXplorer Lite (viritsvclite) - TG Soft Sas www.tgsoft.it - C:\VEXPLITE\viritsvc.exe

12-10-2006, 19.16.26	#29
AJleTipine Newbie Registrato: 07-10-2006 Messaggi: 7	ok...t ringrazio!!!! meno male k ho trovato voi!!!..a presto.. Jey

16-10-2006, 10.03.08	#30
AJleTipine Newbie Registrato: 07-10-2006 Messaggi: 7	regaz ho altri problemi??devo eliminare qualcos'altro??xk qnd cn virit m analizza vengono fuori 3 virus k nn m elimina...v rifaccio la scansione col solito programma... Logfile of HijackThis v1.99.1 Scan saved at 10.07.13, on 16/10/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe C:\Programmi\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\svchost.exe C:\VEXPLITE\viritsvc.exe C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe C:\WINDOWS\Explorer.EXE C:\Programmi\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\igfxtray.exe C:\Programmi\Java\j2re1.4.2_03\bin\jusched.exe C:\Programmi\Synaptics\SynTP\SynTPLpr.exe C:\Programmi\Synaptics\SynTP\SynTPEnh.exe C:\Programmi\HP\hpcoretech\hpcmpmgr.exe C:\Programmi\iTunes\iTunesHelper.exe C:\Programmi\File comuni\Microsoft Shared\Works Shared\WkUFind.exe C:\Programmi\QuickTime\qttask.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Programmi\MessengerPlus! 3\MsgPlus.exe C:\Programmi\iPod\bin\iPodService.exe C:\VEXPLITE\MONLITE.EXE C:\WINDOWS\system32\ctfmon.exe C:\Programmi\MSN Messenger\msnmsgr.exe C:\VEXPLITE\VIRITEXP.EXE C:\Programmi\Internet Explorer\iexplore.exe C:\DOCUME~1\JEYEAL~1\IMPOST~1\Temp\Rar$EX00.576\Hi jackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tgsoft.it/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Programmi\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\MSN Apps\MSN Toolbar\01.02.5000.1021\it\msntb.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\MSN Apps\MSN Toolbar\01.02.5000.1021\it\msntb.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [UpdateManager] "C:\Programmi\File comuni\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [SynTPLpr] C:\Programmi\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [HP Component Manager] "C:\Programmi\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe O4 - HKLM\..\Run: [Cpqset] C:\Programmi\HPQ\Default Settings\cpqset.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Programmi\File comuni\Microsoft Shared\Works Shared\WkUFind.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programmi\MessengerPlus! 3\MsgPlus.exe" O4 - HKLM\..\Run: [VIRIT LITE MONITOR] C:\VEXPLITE\MONLITE.EXE O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Documents and Settings\Jey e Ale Bonito\Desktop\Unlocker\UnlockerAssistant.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MessengerPlus3] "C:\Programmi\MessengerPlus! 3\MsgPlus.exe" /WinStart O4 - HKCU\..\Run: [msnmsgr] "C:\Programmi\MSN Messenger\msnmsgr.exe" /background O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary...o.cab47946.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{18F0ED45-8660-44A7-BD00-BAC1BB962B68}: NameServer = 85.37.17.4 85.38.28.70 O17 - HKLM\System\CS1\Services\Tcpip\..\{18F0ED45-8660-44A7-BD00-BAC1BB962B68}: NameServer = 85.37.17.4 85.38.28.70 O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Programmi\iPod\bin\iPodService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Virit eXplorer Lite (viritsvclite) - TG Soft Sas www.tgsoft.it - C:\VEXPLITE\viritsvc.exe grazie 1000 la JEY

Utenti attualmente attivi che stanno leggendo questa discussione: 1 (0 utenti e 1 ospiti)

Strumenti discussione
Visualizza versione stampabile Invia questa pagina via e-mail

Discussioni simili
Discussione	Autore discussione	Forum	Risposte	Ultimo messaggio
connessione internet con sim dati e dialer	maxence	Sicurezza&Privacy	9	21-08-2008 17.25.20
AIUTO Dialer	francescojay	Sicurezza&Privacy	2	27-03-2008 11.37.05
Aiuto per programma dialer	MEGS	Sicurezza&Privacy	3	05-09-2005 20.42.46
Aiuto con sto dialer che mi sta attenagliando le palle!!!!	torakiki78	Sicurezza&Privacy	2	21-04-2005 15.31.25
aiuto dialer?	peppecol	Sicurezza&Privacy	1	19-12-2004 15.15.41