www.MegaLab.it

da **Cassius83** » sab dic 02, 2006 4:45 pm

Ciao a tutti..ho un problema con win 98..

quando pigio il tasto riduci ad icona..la pagina si riduce ma appena va sotto sparisce tutto nn riuscendo piu a prenderla...cosa mi consigliate?!
Grazie

da **Cassius83** » sab dic 02, 2006 5:01 pm

Vi mando i Log...gia li ho analizzati di mio e ne ho visti moooooltiii che nn vanno,vorrei che ci daste un'occhiata voi... graziee..

Logfile of HijackThis v1.99.1
Scan saved at 15.53.02, on 02/12/06
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
D:\PROGRAMMI\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\PROGRAMMI\PADSYSASSISTANT\PADSYSASSISTANT.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\MIXER.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAMMI\MOBILE DISK O21\MDTOOLS.EXE
C:\WINDOWS\SYSTEM\LVCOMS.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\PROGRAMMI\FILE COMUNI\KODAK\KODAK_DR\KODAKCCS.EXE
C:\PROGRAMMI\MYWEBSEARCH\BAR\6.BIN\MWSOEMON.EXE
C:\PROGRAMMI\WEBHANCER\PROGRAMS\WHAGENT.EXE
D:\PROGRAMMI\ALWIL SOFTWARE\AVAST4\ASHWEBSV.EXE
D:\PROGRAMMI\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE
C:\PROGRAMMI\HBTOOLS\BIN\4.8.2.0\HBTOEADDON.EXE
C:\PROGRAMMI\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAMMI\IVT CORPORATION\BLUESOLEIL\BLUESOLEIL.EXE
C:\PROGRAMMI\KODAK\KODAK SOFTWARE UPDATER\7288971\PROGRAM\KODAK SOFTWARE UPDATER.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAMMI\HBTOOLS\HBTV\HBTV.EXE
D:\PROGRAMMI\ALWIL SOFTWARE\AVAST4\ASHSIMPL.EXE
D:\PROGRAMMI\WINRAR\WINRAR.EXE
C:\WINDOWS\TEMP\RAR$EX06.354\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro-download.com/mp3/index.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.fastweb.it
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://it.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://as.starware.com/dopo/search?x=w
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by FastWeb
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\PROGRAMMI\MYWEBSEARCH\SRCHASTT\6.BIN\MWSSRCAS.DLL
F1 - win.ini: load=C:\TBridge\Flatbed.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMMI\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar1.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Programmi\NewDotNet\newdotnet7_22.dll
O2 - BHO: (no name) - {6001CDF7-6F45-471b-A203-0225615E35A7} - C:\WINDOWS\DH.dll (file missing)
O2 - BHO: PrintMe - {97387E2B-B2FA-4E4A-A607-F3B5C134F71C} - C:\PROGRAMMI\EFI\PRINTMETOOLBAR\HTPMCAP.DLL
O2 - BHO: WhIeHelperObj Class - {c900b400-cdfe-11d3-976a-00e02913a9e0} - C:\PROGRAMMI\WEBHANCER\PROGRAMS\WHIEHLPR.DLL
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\PROGRAMMI\MYWEBSEARCH\BAR\6.BIN\MWSBAR.DLL
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\PROGRAMMI\MYWEBSEARCH\SRCHASTT\6.BIN\MWSSRCAS.DLL
O2 - BHO: BandBHO Class - {6CA1C00B-90FC-4F3E-911F-95306ABA43AA} - C:\PROGRAMMI\ADSPONSOR\ADSPONSOR.DLL
O2 - BHO: AssistantLibrary - {04CDB16C-AB38-43CD-A86A-6FEB90290939} - C:\Programmi\PadsysAssistant\AssistantLibrary.dll
O2 - BHO: HbTools - {74CC49F7-EB32-4A08-B204-948962A6E3DB} - C:\PROGRAMMI\HBTOOLS\BIN\4.8.2.0\HBTHOSTIE.DLL
O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\BXXS5.DLL
O2 - BHO: TVEngine Helper /fleok=1D8A83A5C2E6107C91A475760EA83FA5EF80752B94E2DE7B547C4F2936C7 - {4B18DD50-C996-44fc-AC52-0FECFF82ED58} - C:\PROGRAMMI\HBTOOLS\HBTV\HBTVHELPER.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: PrintMe - {97387E2B-B2FA-4E4A-A607-F3B5C134F71C} - C:\PROGRAMMI\EFI\PRINTMETOOLBAR\HTPMCAP.DLL
O3 - Toolbar: H&otbar - {74CC49F7-EB32-4A08-B204-948962A6E3DB} - C:\PROGRAMMI\HBTOOLS\BIN\4.8.2.0\HBTHOSTIE.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [MDTOOL] c:\programmi\mobile disk o21\mdtools.exe sys_auto_run C:\PROGRAMMI\MOBILE DISK O21
O4 - HKLM\..\Run: [RealTray] C:\Programmi\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
O4 - HKLM\..\Run: [LVComs] C:\WINDOWS\SYSTEM\LVComS.exe
O4 - HKLM\..\Run: [PC_LOCK] c:\PC_LOCK.exe
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,ClientStartup -s
O4 - HKLM\..\Run: [KodakCCS] C:\Programmi\File comuni\KODAK\KODAK_DR\KodakCCS.exe --pdr: "C:\Programmi\File comuni\KODAK\KODAK_DR\dcmnter.pdr"
O4 - HKLM\..\Run: [bxxs5] RunDLL32.EXE C:\WINDOWS\BXXS5.DLL,DllRun
O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\BAR\6.BIN\MWSBAR.DLL,S
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\BAR\6.BIN\MWSOEMON.EXE
O4 - HKLM\..\Run: [webHancer Agent] C:\Programmi\webHancer\Programs\whagent.exe
O4 - HKLM\..\Run: [avast! Web Scanner] D:\PROGRA~1\ALWILS~1\AVAST4\ASHWEBSV.EXE
O4 - HKLM\..\Run: [ashMaiSv] D:\PROGRA~1\ALWILS~1\AVAST4\ashmaisv.exe
O4 - HKLM\..\Run: [HbTools] C:\Programmi\HbTools\Bin\4.8.2.0\HbtOEAddOn.exe
O4 - HKLM\..\Run: [cxfbpxkp] C:\WINDOWS\SYSTEM\xsaocnyn.exe
O4 - HKLM\..\Run: [WeatherOnTray] C:\PROGRAMMI\HBTOOLS\BIN\4.8.2.0\HBTWEATHERONTRAY.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [avast!] D:\Programmi\Alwil Software\Avast4\ashServ.exe
O4 - HKCU\..\Run: [Gadwin PrintScreen 3.0] C:\PROGRAMMI\GADWIN SYSTEMS\PRINTSCREEN\PRINTSCREEN.EXE /nosplash
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAMMI\MSN MESSENGER\MSNMSGR.EXE" /background
O4 - HKCU\..\Run: [WebCamRT.exe] C:\PROGRAMMI\LOGITECH\QUICKCAM\WebCamRT.exe /WinStart /regkey=Software\Logitech\QuickCam.5\WebCamSettings
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\BAR\6.BIN\MWSOEMON.EXE
O4 - HKCU\..\Run: [ScaricaMP3] C:\WINDOWS\Application Data\SCARICAMP3.EXE t
O4 - HKCU\..\Run: [CMIntex] "C:\Programmi\CMIntex\CMIntex.exe"
O4 - Startup: BlueSoleil.lnk = C:\Programmi\IVT Corporation\BlueSoleil\BlueSoleil.exe
O4 - Startup: Picture Package VCD Maker.lnk = C:\Programmi\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
O4 - Startup: Picture Package Menu.lnk = C:\Programmi\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
O4 - Startup: Adobe Gamma Loader.exe.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Kodak software updater.lnk = C:\Programmi\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Startup: C'è Posta.lnk = ?
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredi ... xdm089YYIT
O8 - Extra context menu item: &Cerca con Google - res://C:\PROGRAMMI\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html
O8 - Extra context menu item: &Traduci parola in italiano - res://C:\PROGRAMMI\GOOGLE\GOOGLETOOLBAR1.DLL/cmwordtrans.html
O8 - Extra context menu item: Versione cache della pagina - res://C:\PROGRAMMI\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html
O8 - Extra context menu item: Pagine simili - res://C:\PROGRAMMI\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html
O8 - Extra context menu item: Link a ritroso - res://C:\PROGRAMMI\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRAMMI\JAVA\JRE1.5.0_06\BIN\SSV.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRAMMI\JAVA\JRE1.5.0_06\BIN\SSV.DLL
O9 - Extra button: ScaricaMP3 - {EF6D6AE3-2625-40D6-A5AB-920DFD2DAF8C} - C:\WINDOWS\Application Data\SCARICAMP3.EXE (file missing)
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by WebHancer
O14 - IERESET.INF: START_PAGE_URL=http://www.fastweb.it
O16 - DPF: {C1B7E532-3ECB-4E9E-BB3A-2951FFE67C61} (DownloaderActiveX Control) - http://c6.community.virgilio.it/downloa ... ctiveX.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/fu ... 0.0.15.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnme ... loader.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {DB893839-10F0-4AF9-92FA-B23528F530AF} - http://deposito.hostance.net/dialer/1112900.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com/PhotoUpload/MsnPU ... 10,0,911,0
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programmi\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/ms ... b31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b31267.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/So ... b31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/Mi ... b31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZI ... b32846.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b31267.cab
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/A ... tPkMSN.cab
O18 - Filter: text/html - {994D478A-45D0-4DB4-AE27-738B1E346F99} - C:\PROGRAMMI\BATTY2\BATTY2.DLL

da **Amantide** » sab dic 02, 2006 6:13 pm

Il pc di un altro amico? [fischio]

Per iniziare un buon firewall, Zone Alarm e la scansione con A-squared o AVG Anti-Spyware.
Ora devo scappare e non ti posso descrivere cosa deve sparire dal log... una meta delle voci più o meno [:-D]

Quindi ora fai la scansione con questi antispyware e poi vediamo.

da **Cassius83** » sab dic 02, 2006 6:19 pm

si si...lo immaginavo che piu della meta' erano da cancellare...pero.... [:-D]

confidavo in un tuo consiglio..sapevo che avresti risposto tu..dai...faccio una scansione e ti faccio sapere, appena puoi fammi la lista per favore!!!
ciaooo!!!

da **crazy.cat** » sab dic 02, 2006 6:35 pm

Fai la scansione con A2 squared ed elimina tutto quello che trova.
Poi riposta il log così c'è meno roba da riscrivere.

Mica dobbiamo lavorare sempre noi..... [:-D]

da **Amantide** » sab dic 02, 2006 7:48 pm

crazy.cat ha scritto:
Mica dobbiamo lavorare sempre noi.....

da **Cassius83** » sab dic 02, 2006 7:50 pm

Una mente e sicuramente molto piu efficace di un programma... quando questo diventa il contrario...allora e un bel casino...comunque sto provvedendo...appena so qualcosa vi posto nuovamente i log....

ho dato un'okkiata veloce veloce e a parer mio tra Log da fixare e altro ne ho contati una trentina...vediamo se coincidono con quelli che poi mi darete.... [:-D]

diciamo una sfida personale....comunque grazie crazy davvero...sciauuuuu [8D]

da **Amantide** » sab dic 02, 2006 8:24 pm

Già... più o meno sono proprio una trentina [:-D]

quelli visibili nel log.. [fischio]

Non oso ad immaginare di quanti ce ne siano ancora di quelli non visibili [:-D]

Va, fai anche la scansione con AVG Anti-Spyware, che solo A-squared qui non basta, e metti il firewall, sennò è inutile ripulirlo.

da **crazy.cat** » sab dic 02, 2006 8:30 pm

Ti potevo dire di togliere questa riga
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\BAR\6.BIN\MWSOEMON.EXE

Peccato poi che questo adware ne abbia circa altre 280
http://www.MegaLab.it/2602/4
stando a quante ne trova a2 squared

da **Cassius83** » sab dic 02, 2006 8:49 pm

Grazie Crazy!!! [:-D]

amantide...come firewall pensi che zone alarm potrebbe bastare?!

ora scansiono anche con Avg... [applauso]

da **crazy.cat** » sab dic 02, 2006 8:52 pm

Cassius83 ha scritto:.come firewall pensi che zone alarm potrebbe bastare?!

Va più che bene.

Ho accorciato uno degli indirizzi del primo log per restringere la pagina, altrimenti era troppo larga.

da **Cassius83** » sab dic 02, 2006 8:56 pm

Si Grazie Crazy lo avevo capito.... [:-D]

ora appena finira di fare tutte le scansioni...postero di nuovo i log e vederemo un po!!

www.MegaLab.it

Problema con win 98

Problema con win 98

...

....

...

.....

Re: .....

...

Chi c’è in linea