Bargains e BullsEye

[angelodieci]

Mi aiutate ad eliminare questo maledetto spyware!!!

ecco il mio log

Logfile of HijackThis v1.99.1
Scan saved at 16.34.33, on 19/05/2005
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\drivers\CDAC11BA.EXE
C:\WINNT\System32\cisvc.exe
C:\WINNT\System32\svchost.exe
c:\programmi\webserver\bin\matlabserver.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Programmi\Photodex\ProShowGold\ScsiAccess.exe
C:\WINNT\system32\stisvc.exe
C:\Programmi\Trend Micro\PC-cillin 2002\Tmntsrv.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\Programmi\Trend Micro\PC-cillin 2002\PCCPFW.exe
C:\WINNT\SOUNDMAN.EXE
C:\Programmi\File comuni\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Programmi\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Programmi\I-Storm USB ADSL Modem\CnxDslTb.exe
C:\Programmi\mobile PhoneTools\WatchDog.exe
C:\Programmi\Trend Micro\PC-cillin 2002\pccguide.exe
C:\Programmi\Trend Micro\PC-cillin 2002\PCCClient.exe
C:\Programmi\Trend Micro\PC-cillin 2002\Pop3trap.exe
C:\Programmi\QuickTime\qttask.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\WINNT\wavdriver.exe
C:\Programmi\Sonique\sqstart.exe
C:\WINNT\system32\ctfmon.exe
C:\Programmi\MSN Messenger\msnmsgr.exe
C:\WINNT\System32\cdplayer.exe
C:\WINNT\System32\cidaemon.exe
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\ENERGY1\Documenti\ANGELO\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://213.159.117.132/index.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINNT\nem220.dll (file missing)
O2 - BHO: (no name) - {021BB032-80A8-4FB6-B3D5-CF27B1553B95} - C:\WINNT\mslagent\4b_1,0,1,0_mslagent.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINNT\system32\msbe.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CreateCD50] "C:\Programmi\File comuni\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Programmi\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [LanGuard] "C:\WINNT\languard.exe"
O4 - HKLM\..\Run: [CnxDslTaskBar] C:\Programmi\I-Storm USB ADSL Modem\CnxDslTb.exe
O4 - HKLM\..\Run: [WatchDog] C:\Programmi\mobile PhoneTools\WatchDog.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Programmi\Trend Micro\PC-cillin 2002\pccguide.exe"
O4 - HKLM\..\Run: [PCCClient.exe] "C:\Programmi\Trend Micro\PC-cillin 2002\PCCClient.exe"
O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Programmi\Trend Micro\PC-cillin 2002\Pop3trap.exe"
O4 - HKLM\..\Run: [glv] C:\WINNT\glv.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [avirex] "C:\WINNT\avirex.exe"
O4 - HKLM\..\Run: [wavdriver] "C:\WINNT\wavdriver.exe"
O4 - HKCU\..\Run: [SoniqueQuickStart] C:\Programmi\Sonique\sqstart.exe -nostick
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmi\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O16 - DPF: {33288993-5664-11D4-8B5B-00D0B73B3518} (ell Class) - http://www.easports.com/downloads/games ... /ieell.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/12e061f56ca ... 601_it.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMe ... loader.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{ED49258E-ECA6-4B5F-B66F-723596EC83E5}: NameServer = 85.37.17.11 151.99.125.1
O21 - SSODL: System - {07DE949F-2681-4DDF-A6FB-DDE2EB46F851} - C:\WINNT\system32\system32.dll (file missing)
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINNT\system32\drivers\CDAC11BA.EXE
O23 - Service: Servizio amministrativo di Gestione disco logico (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Programmi\File comuni\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - c:\programmi\webserver\bin\matlabserver.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
O23 - Service: PC-cillin PersonalFirewall (PCCPFW) - Trend Micro Inc. - C:\Programmi\Trend Micro\PC-cillin 2002\PCCPFW.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Programmi\Photodex\ProShowGold\ScsiAccess.exe
O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Inc. - C:\Programmi\Trend Micro\PC-cillin 2002\Tmntsrv.exe


vi prego sono nelle vostre mani e scusate se ho aperto una discussione che già c'era (ma credo di no)

grazie

[crazy.cat]

Togli prima le righe che ti ho indicato sotto, fai poi una scansione dei virus con questo sw http://www.MegaLab.it/2333 dalla modalità provvisoria.
Il Bargains buddy dovrsti trovarlo nella lista delle applicazioni installate e quindi potresti disinstallarlo da lì.
Oppure segui le istruzioni
http://www.spyany.com/program/article_s ... Buddy.html
http://www.iamnotageek.com/a/431-p1.php
L'altro BullsEye è collegato sempre a bargains.

Avevi fatto scansioni con Adware e Spybot?

Queste sono sicuramente da togliere con hijackthis
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://213.159.117.132/index.php
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497}
- (no file)
O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINNT\nem220.dll
(file missing)
O2 - BHO: (no name) - {021BB032-80A8-4FB6-B3D5-CF27B1553B95} - C:\WINNT\mslagent\4b_1,0,1,0_mslagent.dll
(file missing)
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA}
- C:\WINNT\system32\msbe.dll
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O21 - SSODL: System - {07DE949F-2681-4DDF-A6FB-DDE2EB46F851} - C:\WINNT\system32\system32.dll
(file missing)
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O21 - SSODL: System - {07DE949F-2681-4DDF-A6FB-DDE2EB46F851} - C:\WINNT\system32\system32.dll
(file missing)
O4 - HKLM\..\Run: [avirex] "C:\WINNT\avirex.exe"
O4 - HKLM\..\Run: [wavdriver] "C:\WINNT\wavdriver.exe"

Hai almeno questo virus
http://www.trendmicro.com/vinfo/virusen ... NP&VSect=T
O4 - HKLM\..\Run: [LanGuard] "C:\WINNT\languard.exe"
O4 - HKLM\..\Run: [glv] C:\WINNT\glv.exe

Controlla quanti file ctfmon.exe hai nel tuo pc, questo sembra essere in
una posizione sbagliata
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe

Benvenuto nel forum e facci sapere.

[angelodieci]

Credo che adesso sia tutto ok!!! Nel caso il problema mi si dovesse ripresentare spero di poter contare nuovamente sulle tue competenze crazy.cat

Grazie ancora!!!

[crazy.cat]

Sono quasi sempre qui.

Non mi hai detto di questo file....
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe

[angelodieci]

ah scusa...


ho controllato e ne ho uno solo in C:\WINNT|System32