MegaLab.it

<font color="navy"></font id="navy">Nonostante abbia letto bene le clausole di iscrizione al forum mi trovo a dover chiedere "AIUTOOOOOO" su un argomento da voi discusso.
IL fatto è che io nn sono affatto esperta di pc ed ho bisogno di un'accurato monitoraggio nelle mie azioni[cry+]...
ho installato hijackthis e dalla scansione emerge:

Logfile of HijackThis v1.98.2
Scan saved at 11.18.23, on 14/09/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:ProgrammiFile comuniSymantec SharedccEvtMgr.exe
C:WINDOWSExplorer.EXE
C:WINDOWSdownlo~18y1k9aoat0fgy7.exe
C:ProgrammiNorton SystemWorksNorton AntiVirus
avapsvc.exe
C:ProgrammiNorton SystemWorksNorton UtilitiesNPROTECT.EXE
C:WINDOWSSystem32
vsvc32.exe
C:ProgrammiFile comuniSymantec SharedccApp.exe
C:PROGRA~1NORTON~1SPEEDD~1
opdb.exe
C:ProgrammiHewlett-PackardHP Share-to-Webhpgs2wnd.exe
C:ProgrammiMouseAmoumain.exe
C:ProgrammiMouseAmoumain.exe
C:WINDOWSSystem32 undll32.exe
C:WINDOWSSystem32ctfmon.exe
C:ProgrammiMessengermsmsgs.exe
C:Documents and SettingsGiampaoloDati applicazioni wap.exe
C:WINDOWSSystem32svchost.exe
C:ProgrammiYahoo!Messengerymsgr_tray.exe
C:ProgrammiHewlett-PackardHP Share-to-Webhpgs2wnf.exe
C:WINDOWSsystem32atlfi.exe
C:WINDOWSsystem32appis.exe
C:Documents and SettingsGiampaoloDesktopHijackThis.exe
C:ProgrammiInternet Exploreriexplore.exe
C:WINDOWSSystem32 askmgr.exe

R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = res://C:WINDOWSsystem32dopvv.dll/sp.html#29126
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = res://C:WINDOWSsystem32dopvv.dll/sp.html#29126
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = about:blank
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = res://C:WINDOWSsystem32dopvv.dll/sp.html#29126
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = res://C:WINDOWSsystem32dopvv.dll/sp.html#29126
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = res://C:WINDOWSsystem32dopvv.dll/sp.html#29126
R1 - HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = res://C:WINDOWSsystem32dopvv.dll/sp.html#29126
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = res://C:WINDOWSsystem32dopvv.dll/sp.html#29126
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Collegamenti
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {D4B0AF48-35C4-E717-AE73-79D57465592B} - C:WINDOWSwinrc32.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:ProgrammiNorton SystemWorksNorton AntiVirusNavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINDOWSSystem32msdxm.ocx
O4 - HKLM..Run: [ccApp] "C:ProgrammiFile comuniSymantec SharedccApp.exe"
O4 - HKLM..Run: [ccRegVfy] "C:ProgrammiFile comuniSymantec SharedccRegVfy.exe"
O4 - HKLM..Run: [Share-to-Web Namespace Daemon] C:ProgrammiHewlett-PackardHP Share-to-Webhpgs2wnd.exe
O4 - HKLM..Run: [WheelMouse] C:ProgrammiMouseAmoumain.exe
O4 - HKLM..Run: [CnxTrApp] rundll32.exe "C:ProgrammiStarModemStarModem USB NetworkCnxTrApp.dll",AppEntry -REG "ConexantConexant USB Network"
O4 - HKLM..Run: [atlfi.exe] C:WINDOWSsystem32atlfi.exe
O4 - HKLM..RunOnce: [appis.exe] C:WINDOWSsystem32appis.exe
O4 - HKCU..Run: [CTFMON.EXE] C:WINDOWSSystem32ctfmon.exe
O4 - HKCU..Run: [MSMSGS] "C:ProgrammiMessengermsmsgs.exe" /background
O4 - HKCU..Run: [Yahoo! Pager] C:ProgrammiYahoo!Messengerypager.exe -quiet
O4 - HKCU..Run: [Asss] C:Documents and SettingsGiampaoloDati applicazioni wap.exe
O8 - Extra context menu item: Download with GetRight - C:ProgrammiGetRightGRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:ProgrammiGetRightGRbrowse.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:ProgrammiMessengerMSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:ProgrammiMessengerMSMSGS.EXE
O9 - Extra button: Connector - {FFB51760-344E-4FFB-BFFF-4B18C7AC1D63} - C:WINDOWSSystem32ShellExtSSDB.EXE (file missing)
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/ ... 1/chat.cab
O16 - DPF: Yahoo! Fleet - http://download.games.yahoo.com/games/c ... ltt3_x.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b30149.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/Mi ... b30149.cab
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b30149.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZI ... b30149.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Ba ... b30149.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.com/download.compani ... _1_6_0.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/So ... b28578.cab

<font color="orange">dopvv.dll</font id="orange">è il file che cambia nome ogni volta che cerco e credo di aver risolto il problema,
ma in fin dei conti qual è il file .dll da rinominare per procedere come "MAXJOL"?

Abbiate pietà di me!!
GRazieeeeeee

Tranquilla, per i log di HijackThis ci pensa Crazy cat, abbi pazienza e tutto andrà a posto![^]

Trova questi due file sul tuo pc e li sposti sul desktop e li rinomini
winrc32.dll,dopvv.dll riavvii il pc e parti in modalità provvisoria (premi F8 all'avvio del pc), da li elimini i due file che hai rinominato e fai una scansione e pulizia di quello che trova usando il programma e seguendo le istruzioni che trovi qui http://www.zanezane.net/articoli.asp?id=427
Sempre dalla modalità provvisoria cancelli con hijackthis queste voci qui sotto
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = res://C:WINDOWSsystem32dopvv.dll/sp.html#29126
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = res://C:WINDOWSsystem32dopvv.dll/sp.html#29126
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = about:blank
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = res://C:WINDOWSsystem32dopvv.dll/sp.html#29126
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = res://C:WINDOWSsystem32dopvv.dll/sp.html#29126
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = res://C:WINDOWSsystem32dopvv.dll/sp.html#29126
R1 - HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = res://C:WINDOWSsystem32dopvv.dll/sp.html#29126
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = res://C:WINDOWSsystem32dopvv.dll/sp.html#29126
O2 - BHO: (no name) - {D4B0AF48-35C4-E717-AE73-79D57465592B} - C:WINDOWSwinrc32.dll

Questi tre file sono sconosciuti e molto sospetti,è meglio se fai uno scan online dei virus a questo indirizzo
http://www.pandasoftware.com/activescan ... ncipal.htm
C:Documents and SettingsGiampaoloDati applicazioni wap.exe
C:WINDOWSdownlo~18y1k9aoat0fgy7.exe
O4 - HKLM..Run: [atlfi.exe] C:WINDOWSsystem32atlfi.exe

Per questo devi seguire le istruzioni che leggi qui
http://www.pestpatrol.com/pestinfo/t/tr ... ent_bc.asp
O4 - HKLM..RunOnce: [appis.exe] C:WINDOWSsystem32appis.exe

L'ennesima vittima dell'inefficenza di norton,il peggior antivirus sul pianeta.
Dimenticavo,benvenuta nel forum.

Grande come sempre crazy![^]