Scusate l' intrusione

[mako]

Scusate se mi intrometto.
Ho fatto la scansione tanto tempo fa con Ad-Aware 4.0 (credo) e mi ha trovato un po' di sospetti spyware
alcuni dei quali riportavano il nome netscape che io non ho mai installato.
Non mi sono fidato di cancellare alla cieca ed ora che ho scoperto il forum vorrei informazioni

Mako
??

[NightMan]

Se non hai installato netscape,penso che puoi cancellare quei file con relativa sicurezza,cmq non credo che ti possano dare molto fastidio

[bodyzen]

Scaricati la nuova versione di AdAware:
http://www.lavasoftusa.com/aaw/downloads.html

[mako]

cosa sono gli altri file tipo
Ad-aware signature file (013-31-05)
che ci sono al link che mi hai dato?

Ci sono casi di persone che dopo aver usato ad-aware hanno avuto problemi con SO o programmi vari?

Mako

Guarda, Ad-Aware è uno di quei programmi che fanno quasi solo del bene, o almeno io non ho mai sentito nessuno lamentarsi dopo una scansione di Ad-Aware

Quel file Ad-aware signature file (013-31-05) è una specie di aggiornamento di Ad-Aware, un pò come gli antivirus aggiornano alcuni file con i dati sui virus nuovi; va scaricato e decompresso nella cartella del programma, sostituendo il file esistente

[bodyzen]

Ti ha gia' risposto Bios.

[mako]

Ri-grazie
e Ad-search Database (02-2001) a cosa serve?

ssj, come si fa lo smile col mitra?

[mako]

Ho usato Ad-aware 5, ho fatto la scansione e mi ha trovato 43 sospetti.
tra questi ci sono eseguibili di norton e anche dello stesso ad-aware.
Per sicurezza sono uscito senza canc nulla ma se qualcuno di voi volesse dare un' occhiata a quello che mi ha trovato...
Come devo settare il programma?
Ecco qui il log

Scan initialized on 06/06/01 12.32.13.
(AAW build 5.01, referencefile 023-05.06.01)
=============================================


Started memory scan
====================
Running processes:

#:1 Name: C:\WINDOWS\SYSTEM\KERNEL32.DLL
----------------------------
Threads:4
ProcID:4279214757
ParentProcID:2122858685
BasePriority:High


#:2 Name: C:\WINDOWS\SYSTEM\MSGSRV32.EXE
----------------------------
Threads:1
ProcID:4293940533
ParentProcID:4279214757
BasePriority:Normal


#:3 Name: C:\WINDOWS\SYSTEM\mmtask.tsk
----------------------------
Threads:1
ProcID:4293942313
ParentProcID:4293940533
BasePriority:Normal


#:4 Name: C:\WINDOWS\SYSTEM\MPREXE.EXE
----------------------------
Threads:1
ProcID:4293945285
ParentProcID:4293940533
BasePriority:Normal


#:5 Name: C:\WINDOWS\SYSTEM\MSTASK.EXE
----------------------------
Threads:2
ProcID:4293980689
ParentProcID:4293945285
BasePriority:Normal


#:6 Name: C:\PROGRAMMI\NORTON UTILITIES\NPROTECT.EXE
----------------------------
Threads:3
ProcID:4293978269
ParentProcID:4293945285
BasePriority:Normal


#:7 Name: C:\WINDOWS\SYSTEM\MDM.EXE
----------------------------
Threads:2
ProcID:4293961297
ParentProcID:4293945285
BasePriority:Normal


#:8 Name: C:\PROGRAMMI\NORTON ANTIVIRUS\NAVAPW32.EXE
----------------------------
Threads:6
ProcID:4294007477
ParentProcID:4293940533
BasePriority:Normal


#:9 Name: C:\WINDOWS\EXPLORER.EXE
----------------------------
Threads:12
ProcID:4293999041
ParentProcID:4293940533
BasePriority:Normal


#:10 Name: C:\WINDOWS\SYSTEM\RNAAPP.EXE
----------------------------
Threads:2
ProcID:4294099709
ParentProcID:4293999041
BasePriority:Normal


#:11 Name: C:\WINDOWS\SYSTEM\TAPISRV.EXE
----------------------------
Threads:5
ProcID:4294099437
ParentProcID:4294099709
BasePriority:Normal


#:12 Name: C:\WINDOWS\TASKMON.EXE
----------------------------
Threads:1
ProcID:4294021673
ParentProcID:4293999041
BasePriority:Normal


#:13 Name: C:\WINDOWS\SYSTEM\PDESK.EXE
----------------------------
Threads:3
ProcID:4294025205
ParentProcID:4293999041
BasePriority:Normal


#:14 Name: C:\WINDOWS\SYSTEM\SYSTRAY.EXE
----------------------------
Threads:2
ProcID:4294096285
ParentProcID:4293999041
BasePriority:Normal


#:15 Name: C:\WINDOWS\SYSTEM\STIMON.EXE
----------------------------
Threads:3
ProcID:4294147621
ParentProcID:4293999041
BasePriority:Normal


#:16 Name: C:\PROGRAMMI\TEXTBRIDGE CLASSIC 2.0\BIN\INSTANTACCESS.EXE
----------------------------
Threads:1
ProcID:4294121617
ParentProcID:4293999041
BasePriority:Normal


#:17 Name: C:\PROGRAMMI\NORTON CRASHGUARD\CGMENU.EXE
----------------------------
Threads:1
ProcID:4294028589
ParentProcID:4293999041
BasePriority:Normal


#:18 Name: C:\KMAESTRO\KMAESTRO.EXE
----------------------------
Threads:1
ProcID:4294122053
ParentProcID:4293999041
BasePriority:Normal


#:19 Name: C:\PROGRAMMI\INTEL\INTEL PSNCU\CPUNUMBER.EXE
----------------------------
Threads:1
ProcID:4294175137
ParentProcID:4293999041
BasePriority:Normal


#:20 Name: C:\PROGRAMMI\NORTON ANTIVIRUS\NSCHED32.EXE
----------------------------
Threads:2
ProcID:4294199429
ParentProcID:4293999041
BasePriority:Normal


#:21 Name: C:\PROGRAMMI\NORTON CRASHGUARD\CG16EH.EXE
----------------------------
Threads:1
ProcID:4294192021
ParentProcID:4294028589
BasePriority:Normal


#:22 Name: C:\WINDOWS\SYSTEM\WMIEXE.EXE
----------------------------
Threads:3
ProcID:4294197417
ParentProcID:4294096285
BasePriority:Normal


#:23 Name: C:\PROGRAMMI\LAVASOFT AD-AWARE\AD-AWARE.EXE
----------------------------
Threads:1
ProcID:4294234593
ParentProcID:4293999041
BasePriority:Normal


Memory scan result:
Total modules found:23
Suspicious modules found:0


Started registry scan
======================
Aureate key:HKEY_USERS\.default\software\aureate\
Aureate key:HKEY_CLASSES_ROOT\clsid\{ebbfe27c-bdf0-11d2-bbe5-00609419f467}\
Aureate key:HKEY_CLASSES_ROOT\clsid\{ebbfe288-bdf0-11d2-bbe5-00609419f467}\
Aureate key:HKEY_CLASSES_ROOT\clsid\{ebbfe28a-bdf0-11d2-bbe5-00609419f467}\
Aureate key:HKEY_CLASSES_ROOT\interface\{ebbfe27b-bdf0-11d2-bbe5-00609419f467}\
Aureate key:HKEY_CLASSES_ROOT\interface\{ebbfe27b-bdf0-11d2-bbe5-00609419f467}\
Aureate key:HKEY_CLASSES_ROOT\interface\{ebbfe287-bdf0-11d2-bbe5-00609419f467}\
Aureate key:HKEY_CLASSES_ROOT\interface\{ebbfe289-bdf0-11d2-bbe5-00609419f467}\
Aureate key:HKEY_CLASSES_ROOT\software\aureate\
Aureate key:HKEY_CURRENT_USER\software\aureate\
Aureate key:HKEY_LOCAL_MACHINE\software\aureate\
Aureate key:HKEY_LOCAL_MACHINE\software\microsoft\windows\ currentversion\explorer\browser helper objects\{ebbfe27c-bdf0-11d2-bbe5-00609419f467}\
Aureate key:HKEY_CLASSES_ROOT\stub.ciestub\
Aureate key:HKEY_CLASSES_ROOT\stub.ciestub.1\
Aureate key:HKEY_CLASSES_ROOT\stub.netscapestop\
Aureate key:HKEY_CLASSES_ROOT\stub.netscapestop.1\
Aureate key:HKEY_CLASSES_ROOT\typelib\{ebbfe26d-bdf0-11d2-bbe5-00609419f467}\
Aureate key:HKEY_CLASSES_ROOT\typelib\{ebbfe26d-bdf0-11d2-bbe5-00609419f467}\
Aureate key:HKEY_USERS\.default\software\netscape\netscape navigator\automation shutdown\stub.netscapestop.1
Aureate key:HKEY_USERS\.default\software\netscape\netscape navigator\automation startup\netscape starting
Aureate key:Netscape starting\CLSID\{EBBFE288-BDF0-11D2-BBE5-00609419F467}


Started extended registry scan
===============================
Aureate key:CLSID\{EBBFE27C-BDF0-11D2-BBE5-00609419F467}
Aureate key:CLSID\{EBBFE288-BDF0-11D2-BBE5-00609419F467}
Aureate key:CLSID\{EBBFE28A-BDF0-11D2-BBE5-00609419F467}


Registry scan result:
Suspicious keys found :24


Started folder scan
====================
Now processing drive (C), 0 remaining.
Aureate folder:C:\WINDOWS\amcdl\adcache
Aureate folder:C:\WINDOWS\amcdl
Finished processing Drive(C:\WINDOWS), 1439 folders total.

Aureate folder:C:\WINDOWS\amcdl\adcache
Aureate folder:C:\WINDOWS\amcdl
Finished processing Drive(C), 3778 folders total.

Folder scan result:
Folders processed:3778
Suspicious folders found:4


Started file scan
==================
Aureate file:C:\WINDOWS\SYSTEM\ADVERT.DLL
FileSize : 523 kb
FileCreation time : 16/11/99 22.26.00
Last accessed : 06/06/01
Build : 1.5.1.18
OS : No executable
Description:In-Software Advertising Plug-In
Version:1.51 (build 18)


Aureate file:C:\WINDOWS\SYSTEM\Amcis2.dll
FileSize : 40 kb
FileCreation time : 23/11/99 9.23.08
Last accessed : 06/06/01
Build : 2.0.1.0
OS : No executable
Comments:
Description:Stub Loader Module
Version:2, 0, 1, 0
ProductName:Stub Module

Aureate file:C:\WINDOWS\SYSTEM\IPCClient.dll
FileSize : 36 kb
FileCreation time : 23/11/99 9.21.44
Last accessed : 06/06/01
Build : 1.0.1.0
OS : No executable
Comments:
Description:IPC Client
Version:1, 0, 1, 0
ProductName:IPC Client

Doubleclick file:C:\WINDOWS\Cookies\standard@doubleclick[1].txt
FileSize : 0 kb
FileCreation time : 24/05/01 23.05.26
Last accessed : 06/06/01
Build :
OS : No executable

Other file:C:\WINDOWS\Cookies\standard@admonitor[2].txt
FileSize : 0 kb
FileCreation time : 31/05/01 23.25.23
Last accessed : 06/06/01
Build :
OS : No executable

Other file:C:\WINDOWS\APPLOG\NETSONIC.LGC
FileSize : 2 kb
FileCreation time : 25/03/01 19.26.06
Last accessed : 06/06/01
Build :
OS : No executable

Other file:C:\WINDOWS\APPLOG\NETSONIC.LGC
FileSize : 2 kb
FileCreation time : 25/03/01 19.26.06
Last accessed : 06/06/01
Build :
OS : No executable

Aureate file:C:\WINDOWS\SYSTEM\ADVERT.DLL
FileSize : 523 kb
FileCreation time : 16/11/99 22.26.00
Last accessed : 06/06/01
Build : 1.5.1.18
OS : No executable
Description:In-Software Advertising Plug-In
Version:1.51 (build 18)


Aureate file:C:\WINDOWS\SYSTEM\Amcis2.dll
FileSize : 40 kb
FileCreation time : 23/11/99 9.23.08
Last accessed : 06/06/01
Build : 2.0.1.0
OS : No executable
Comments:
Description:Stub Loader Module
Version:2, 0, 1, 0
ProductName:Stub Module

Aureate file:C:\WINDOWS\SYSTEM\IPCClient.dll
FileSize : 36 kb
FileCreation time : 23/11/99 9.21.44
Last accessed : 06/06/01
Build : 1.0.1.0
OS : No executable
Comments:
Description:IPC Client
Version:1, 0, 1, 0
ProductName:IPC Client

Doubleclick file:C:\WINDOWS\Cookies\standard@doubleclick[1].txt
FileSize : 0 kb
FileCreation time : 24/05/01 23.05.26
Last accessed : 06/06/01
Build :
OS : No executable

Other file:C:\WINDOWS\Cookies\standard@admonitor[2].txt
FileSize : 0 kb
FileCreation time : 31/05/01 23.25.23
Last accessed : 06/06/01
Build :
OS : No executable

Other file:C:\WINDOWS\APPLOG\NETSONIC.LGC
FileSize : 2 kb
FileCreation time : 25/03/01 19.26.06
Last accessed : 06/06/01
Build :
OS : No executable

Other file:C:\WINDOWS\APPLOG\NETSONIC.LGC
FileSize : 2 kb
FileCreation time : 25/03/01 19.26.06
Last accessed : 06/06/01
Build :
OS : No executable

Other file:C:\Programmi\ACDSee32\NetSonic.exe
FileSize : 45 kb
FileCreation time : 19/06/00 11.13.16
Last accessed : 06/06/01
Build :
OS : No executable


File scan result:
Suspicious files found:15



Scanning finished
==================
Suspicious modules found:0
Suspicious keys found :24
Suspicious folders found:4
Suspicious files found:15
==========================
Spyware components ignored:0
Total spyware components found:43

Scanning finished
==================
Suspicious modules found:0
Suspicious keys found :24
Suspicious folders found:4
Suspicious files found:15
==========================
Spyware components ignored:0
Total spyware components found:43

Gli eseguibili, fra cui compaiono anche Norton e Ad-Aware, sono i file che erano in memoria quando hai eseguito la scansione, e al termine di quell'elenco ti dice che nessuno di quei file è considerato sospetto.

Hai invece un considerevole numero di chiavi di registro e di file da cancellare, la maggior parte dovuti allo spyware Aureate.

In definitiva cancella tutto quello che ti viene segnalato, forse l'unico programma che potrebbe risentire di questa pulizia potrebbe essere ACDsee, ma non è detto che ripulendolo debba necessariamente smettere di funzionare

[Freeze]

Beh...tutte le risposte ke ti ha dato Bios sono pienamente soddisfacenti (come sempre )

Per quanto riguarda la faccina guarda clicca sul link smiles (in alto) quando scrivi un nuovo messaggio

[mako]

Ragazzi
grazie.
Ho rifatto la scansione e cancellato gli spyware senza nessun problema