computer malfunzionante

[lollo40]

salve a tutti, ogni tanto mi faccio viva per qualche problemino, sperando in un vostro aiuto. da un po di tempoil pc mi combina qualche guaio, mi è sparito l'audio, non funziona più bene outlook ed anche msn non mi riconosce più. non so da cosa dipende. posso inviarvi un rapporto per vedere se ho preso qualche virus? vi ringrazio

[kap]

beh, puoi postare un log di hijackthis

scaricalo da qui http://www.trendsecure.com/portal/en-US ... hijackthis

una volta avviato premi premi scan and save logfile;
copia il log qui

ciao

[lollo40]

ciao e grazie per laLogfile of Trend Micro HijackThis v2.0.2
Scan saved at 17.35.32, on 24/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
D:\archivio antivirus\aswUpdSv.exe
D:\archivio antivirus\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Spyware Doctor\svcntaux.exe
C:\Programmi\Spyware Doctor\swdsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
D:\archivio antivirus\ashMaiSv.exe
D:\archivio antivirus\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\system32\wscntfy.exe
D:\ARCHIV~1\ashDisp.exe
C:\Programmi\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\WINDOWS\VM_STI.EXE
G:\archivio\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Skype\Phone\Skype.exe
C:\Programmi\MSN Messenger\MsnMsgr.Exe
C:\Programmi\WinZip\WZQKPICK.EXE
C:\Programmi\SAGEM\SAGEM F@st 800-840\dslmon.exe
G:\archivio\Digital Imaging\bin\hpqtra08.exe
G:\archivio\Digital Imaging\bin\hpqSTE08.exe
C:\Programmi\Skype\Plugin Manager\SkypePM.exe
C:\Programmi\Mozilla Firefox\firefox.exe
G:\Programmi\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.imesh.com/search/index.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://it.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://it.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://it.rd.yahoo.com/customize/ie/def ... .yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://it.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fornito da Alice
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Yahoo! Toolbar con blocco Pop-Up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - (no file)
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar con blocco Pop-Up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [avast!] D:\ARCHIV~1\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programmi\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Vimicro USB PC Camera (ZC0301PL)
O4 - HKLM\..\Run: [HP Software Update] G:\archivio\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SDTray] "C:\Programmi\Spyware Doctor\SDTrayApp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Programmi\Nero\Nero 7\Nero BackItUp\nbj.exe"
O4 - HKCU\..\Run: [updateMgr] "D:\ARCHIVIO\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKCU\..\Run: [Shareaza] "G:\Programmi\Shareaza\Shareaza.exe" -tray
O4 - HKCU\..\Run: [Skype] "C:\Programmi\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: PartMetBackup.lnk = C:\Programmi\Java\jre1.5.0_11\bin\javaw.exe
O4 - Global Startup: Avvio Veloce di WinZip.lnk = C:\Programmi\WinZip\WZQKPICK.EXE
O4 - Global Startup: DSLMON.lnk = C:\Programmi\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = G:\archivio\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Alice - {E4992714-2B91-4AA4-B09F-24C80EB77EC6} - http://gw.aliceadsl.it/alice (file missing) (HKCU)
O15 - Trusted Zone: www.698698698.info
O15 - Trusted Zone: www.sgnappo.com
O15 - Trusted Zone: www.whatsnew.name
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programmi\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{2C439C4C-36B0-4D5D-A41E-4E4906B19259}: NameServer = 85.255.116.103,85.255.112.214
O17 - HKLM\System\CCS\Services\Tcpip\..\{D2790D79-EF41-4364-BB29-86749CFF5E39}: NameServer = 85.255.116.103 85.255.112.214
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.103 85.255.112.214
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.103 85.255.112.214
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.103 85.255.112.214
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/html - (no CLSID) - (no file)
O20 - Winlogon Notify: !SASWinLogon - H:\archivio\SASWINLO.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\archivio antivirus\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\archivio antivirus\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - D:\archivio antivirus\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - D:\archivio antivirus\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Programmi\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Programmi\Spyware Doctor\swdsvc.exe

--
End of file - 7426 bytes
risposta. allego il risultato di hijacktis , inoltre avast mi comunica che c'è stato un errore nel rpogramma, ma non so come rimediarlo

[ste_95]

seleziona queste voci e premi fix checked:

O3 - Toolbar: (no name) - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - (no file)
O15 - Trusted Zone: www.698698698.info
O17 - HKLM\System\CCS\Services\Tcpip\..\{2C439C4C-36B0-4D5D-A41E-4E4906B19259}: NameServer = 85.255.116.103,85.255.112.214
O17 - HKLM\System\CCS\Services\Tcpip\..\{D2790D79-EF41-4364-BB29-86749CFF5E39}: NameServer = 85.255.116.103 85.255.112.214
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.103 85.255.112.214
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.103 85.255.112.214
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.103 85.255.112.214
O18 - Filter hijack: text/html - (no CLSID) - (no file)

[lollo40]

scusa la mia estrema ignoranza, ma se premo col tasto dx non mi esce fix cecked, cosa devo fare? mille grazie

[tecnico24]

non devi fare cosi'.
avvia hijackthis,seleziona l'opzione Do a system scan only,poi seleziona a sinistra sulle voci suggerite da ste e poi sotto trovi il comando fix checked.

[lollo40]

fatto, grazie e adesso? quando ho premuto è sparito tutto ho combinato un guaio?

[tecnico24]

dovresti essere a posto,sono sparite le voci del malware.

[lollo40]

vi ringrazio, spero ora vada tutto bene ciao