problema con impostazioni dell'explorer

[mciasco]

Scusa ho inserito la risposta senza il log!!!
Eccolo qui...

Logfile of HijackThis v1.98.0
Scan saved at 4.31.24, on 10/07/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:windowsSystem32smss.exe
C:windowssystem32winlogon.exe
C:windowssystem32services.exe
C:windowssystem32lsass.exe
C:windowssystem32svchost.exe
C:windowsSystem32svchost.exe
C:windowssystem32spoolsv.exe
C:ProgrammiAVPersonalAVGUARD.EXE
C:ProgrammiApache GroupApache2inApache.exe
C:ProgrammiAVPersonalAVWUPSRV.EXE
C:ProgrammiFile comuniMicrosoft SharedVS7DEBUGMDM.EXE
C:windowsSystem32
vsvc32.exe
C:ProgrammiAnalog DevicesSoundMAXSMAgent.exe
C:windowsSystem32svchost.exe
C:ProgrammiApache GroupApache2inApache.exe
C:windowsExplorer.EXE
C:windowsSystem32carpserv.exe
C:windowsSOUNDMAN.EXE
C:PROGRA~1OPTICA~1KeyboardIkeymain.exe
C:PROGRA~1OPTICA~1MouseAmoumain.exe
C:ProgrammiHewlett-PackardHP Software UpdateHPWuSchd.exe
C:WINDOWSSystem32spooldriversw32x863hpztsb09.exe
C:ProgrammiHewlett-PackardDigital Imaginginhpotdd01.exe
C:ProgrammiThomsonSpeedTouch USBDragdiag.exe
C:ProgrammiAVPersonalAVGNT.EXE
C:ProgrammiFile comuniRealUpdate_OB ealsched.exe
C:ProgrammiAnalog DevicesSoundMAXSMTray.exe
C:windowsSystem32RUNDLL32.EXE
C:windowsSystem32ctfmon.exe
C:ProgrammiMessengermsmsgs.exe
C:ProgrammiApache GroupApache2inApacheMonitor.exe
C:ProgrammiPeerGuardianPeerGuardian.exe
C:ProgrammiInternet Exploreriexplore.exe
C:Documents and SettingsOscuroDesktopHijackThis.exe

R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = file://C:WINDOWSSystem32/left.html
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.google.it/
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://www.olidata.it
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: (no name) - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - (no file)
O1 - Hosts: 12.129.205.209 search.netscape.com12.129.205.209 sitefinder.verisign.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:ProgrammiAdobeAcrobat 6.0AcrobatActiveXAcroIEHelper.dll
O2 - BHO: (no name) - {206E52E0-D52E-11D4-AD54-0000E86C26F6} - C:ProgrammiFreshDevicesFreshDownloadfdcatch.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:ProgrammiAdobeAcrobat 6.0AcrobatAcroIEFavClient.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINDOWSSystem32msdxm.ocx
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:ProgrammiAdobeAcrobat 6.0AcrobatAcroIEFavClient.dll
O4 - HKLM..Run: [CARPService] carpserv.exe
O4 - HKLM..Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM..Run: [iKeyWorks] C:PROGRA~1OPTICA~1KeyboardIkeymain.exe
O4 - HKLM..Run: [WheelMouse] C:PROGRA~1OPTICA~1MouseAmoumain.exe
O4 - HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
O4 - HKLM..Run: [HP Software Update] "C:ProgrammiHewlett-PackardHP Software UpdateHPWuSchd.exe"
O4 - HKLM..Run: [HPDJ Taskbar Utility] C:WINDOWSSystem32spooldriversw32x863hpztsb09.exe
O4 - HKLM..Run: [DeviceDiscovery] C:ProgrammiHewlett-PackardDigital Imaginginhpotdd01.exe
O4 - HKLM..Run: [ElbyCheckElbyCDFL] "C:ProgrammiElaborate BytesCloneCDElbyCheck.exe" /L ElbyCDFL
O4 - HKLM..Run: [SpeedTouch USB Diagnostics] "C:ProgrammiThomsonSpeedTouch USBDragdiag.exe" /icon
O4 - HKLM..Run: [AVGCtrl] C:ProgrammiAVPersonalAVGNT.EXE /min
O4 - HKLM..Run: [TkBellExe] "C:ProgrammiFile comuniRealUpdate_OB ealsched.exe" -osboot
O4 - HKLM..Run: [smapp] C:ProgrammiAnalog DevicesSoundMAXSMTray.exe
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:windowsSystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [nwiz] nwiz.exe /install
O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:windowsSystem32NvMcTray.dll,NvTaskbarInit
O4 - HKLM..Run: [Openwares LiveUpdate] C:Program FilesLiveUpdateLiveUpdate.exe
O4 - HKCU..Run: [CTFMON.EXE] C:windowsSystem32ctfmon.exe
O4 - HKCU..Run: [MSMSGS] "C:ProgrammiMessengermsmsgs.exe" /background
O4 - Global Startup: Monitor Apache Servers.lnk = C:ProgrammiApache GroupApache2inApacheMonitor.exe
O8 - Extra context menu item: &Download with &DAP - C:DOCUME~1ALESSA~1DOCUME~1DAPdapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:DOCUME~1ALESSA~1DOCUME~1DAPdapextie2.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O8 - Extra context menu item: Edit with X&ML Spy - C:ProgrammiAltovaXMLSPY2004spy.htm
O9 - Extra button: Edit with XML Spy - {2222EF56-F49E-4d07-A14E-8D2B08766958} - C:ProgrammiAltovaXMLSPY2004spy.htm
O9 - Extra 'Tools' menuitem: Edit with XML Spy - {2222EF56-F49E-4d07-A14E-8D2B08766958} - C:ProgrammiAltovaXMLSPY2004spy.htm
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:ProgrammiWinHTTrackWinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:ProgrammiWinHTTrackWinHTTrackIEBar.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:PROGRA~1ICQICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:PROGRA~1ICQICQ.exe
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O14 - IERESET.INF: START_PAGE_URL=http://www.olidata.it
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/04ab775128c ... 601_it.cab
O16 - DPF: {DB893839-10F0-4AF9-92FA-B23528F530AF} - http://deposito.hostance.net/dialer/1014061.exe
O17 - HKLMSystemCCSServicesTcpip..{F7ECD393-737B-4484-8C64-6BFFD1586DAC}: NameServer = 80.17.212.208 151.99.125.1

[crazy.cat]

x mciasco
Potrebbe essere una buona idea di mettermi in vendita, potrei farci tanti soldi.
Alcune voci ormai le conosco a memoria per le altre basta andare su google e cercare,una soluzione si trova quasi sempre.
L'unica voce potenzialmente pericolosa è questa
O16 - DPF: {DB893839-10F0-4AF9-92FA-B23528F530AF} - http://deposito.hostance.net/dialer/1014061.exe

Questi sono programmi inutili da far caricare in memoria che si possono eliminare
O4 - HKLM..Run: [TkBellExe] "C:ProgrammiFile comuniRealUpdate_OB ealsched.exe" -osboot
O4 - HKLM..Run: [ElbyCheckElbyCDFL] "C:ProgrammiElaborate BytesCloneCDElbyCheck.exe" /L ElbyCDFL
O4 - HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe

[mciasco]

grazie mille

[connex]

Ciao,
ho anch'io dei problemi con la homepage che cambia in automatico. Ho provato a scaricare HijackThis e a cancellare le voci che mi sembravano sospette...ma non ho risolto nulla...

Questo è il log:

Logfile of HijackThis v1.98.0
Scan saved at 7.03.52, on 26/07/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSSYSTEM32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSSystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:ProgrammiFile comuniEPSONEBAPISAgent2.exe
C:ProgrammiPanda SoftwarePanda Antivirus PlatinumFirewallPavFires.exe
C:ProgrammiPanda SoftwarePanda Antivirus Platinumpavsrv51.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSSystem32MsPMSPSv.exe
C:WINDOWSSYSTEM32Ati2evxx.exe
C:ProgrammiPanda SoftwarePanda Antivirus PlatinumAVENGINE.EXE
C:WINDOWSExplorer.EXE
C:ProgrammiCreativeSBAudigy2ZSSurround MixerCTSysVol.exe
C:WINDOWSSystem32CTHELPER.EXE
C:ProgrammiATI TechnologiesATI Control Panelatiptaxx.exe
C:ProgrammiMotherboard Monitor 5MBM5.EXE
C:ProgrammiPanda SoftwarePanda Antivirus PlatinumAPVXDWIN.EXE
C:ProgrammiMSN MessengerMsnMsgr.Exe
C:ProgrammiLogitechMouseWaresystemem_exec.exe
C:ProgrammiPinnacleShared FilesProgramsSchedulerPCLEScheduler.exe
C:ProgrammiLavasoftAd-aware 6Ad-watch.exe
C:ProgrammiPanda SoftwarePanda Antivirus PlatinumpavProxy.exe
C:ProgrammiInternet Exploreriexplore.exe
C:ProgrammiInternet Exploreriexplore.exe
C:WINDOWSmsalert.exe
C:PROGRA~1WINZIPwinzip32.exe
C:Documents and SettingsDaniloImpostazioni localiTempHijackThis.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.libero.it/
O2 - BHO: DOMPeek Class - {834261E1-DD97-4177-853B-C907E5D5BD6E} - C:WINDOWSdpe.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINDOWSSystem32msdxm.ocx
O4 - HKLM..Run: [CTSysVol] C:ProgrammiCreativeSBAudigy2ZSSurround MixerCTSysVol.exe /r
O4 - HKLM..Run: [CTHelper] CTHELPER.EXE
O4 - HKLM..Run: [SBDrvDet] C:ProgrammiCreativeSB Drive DetSBDrvDet.exe /r
O4 - HKLM..Run: [UpdReg] C:WINDOWSUpdReg.EXE
O4 - HKLM..Run: [ATIPTA] C:ProgrammiATI TechnologiesATI Control Panelatiptaxx.exe
O4 - HKLM..Run: [MBM 5] "C:ProgrammiMotherboard Monitor 5MBM5.EXE"
O4 - HKLM..Run: [SCANINICIO] "C:ProgrammiPanda SoftwarePanda Antivirus PlatinumInicio.exe"
O4 - HKLM..Run: [APVXDWIN] "C:ProgrammiPanda SoftwarePanda Antivirus PlatinumAPVXDWIN.EXE" /s
O4 - HKLM..Run: [QuickTime Task] "C:ProgrammiQuickTimeqttask.exe" -atboottime
O4 - HKLM..Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM..Run: [nod32kui] "C:ProgrammiEset
od32kui.exe" /WAITSERVICE
O4 - HKLM..Run: [Ad-aware] "C:ProgrammiLavasoftAd-aware 6Ad-aware.exe" +c
O4 - HKLM..Run: [Ad-watch] "C:ProgrammiLavasoftAd-aware 6Ad-watch.exe"
O4 - HKCU..Run: [MsnMsgr] "C:ProgrammiMSN MessengerMsnMsgr.Exe" /background
O4 - Global Startup: Adobe Gamma Loader.lnk = C:ProgrammiFile comuniAdobeCalibrationAdobe Gamma Loader.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:WINDOWSsystem32spooldriversw32x863E_SRCV02.EXE
O4 - Global Startup: Microsoft Office.lnk = C:ProgrammiMicrosoft OfficeOffice10OSA.EXE
O4 - Global Startup: Pinnacle Scheduler.lnk = ?
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:PROGRA~1MICROS~2Office10EXCEL.EXE/3000
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex ... -0-3-9.cab
O17 - HKLMSystemCCSServicesTcpip..{D3AA9926-0F83-4078-A887-682AB079E694}: NameServer = 193.70.152.25 193.70.192.25

Ciao e grazie
connex

[crazy.cat]

X connex
Ciao e benvenuto nel forum

Il colpevole è questo
O2 - BHO: DOMPeek Class - {834261E1-DD97-4177-853B-C907E5D5BD6E} - C:WINDOWSdpe.dll
Prova a seguire le istruzioni che trovi qui
http://vil.nai.com/vil/content/v_101828.htm

Altrimenti con questo lo dovresti pulire di sicuro
http://www.zanezane.net/articoli.asp?id=187

Dopo ricontrolla con Hijackthis e fai sapere

[connex]

Ciao crazy.cat,
grazie per la tempestiva risposta! comunque siccome non avevo molto tempo di scaricarmi il prog di McAffee (56k!), ho provato ad eliminare quella linea identificata come la colpevole con Hijackthis, e ora Ad-watch non mi rileva più il tentativo di cambiare il contenuto della chave di registro. Non so se ho risolto definitivamente il problema, però al momento sembra a posto. Più tardi con calma leggerò la guida che mi hai consigliato.

Grazie per l'aiuto

Ciao
connex