cambio homepage e pc lento

[danyela]

Ho un problema con il mio computer, ultimamente mi capita che quando accedo ad internet cerca di cambiare la pagina iniziale con una (di cui il nome cambia di volta in volta) e che io blocco in quanto ho installato SuperAntispyware che mi avvisa che sta per essere cambiata, inoltra il computer è molto molto lento.Bene, ora ho letto le istruzioni prima di postare...ma non saprei quali tentativi fare per risolvere il problema, ho fatto la scansione con hijackthis è questo è il log....potreste indirizzarmi anche se non sono stata superprecisa?thank you


Logfile of HijackThis v1.99.1
Scan saved at 21.53.20, on 15/06/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\Programmi\AntiVir PersonalEdition Classic\sched.exe
E:\Programmi\AntiVir PersonalEdition Classic\avguard.exe
E:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe
E:\Programmi\Spyware Terminator\sp_rsser.exe
E:\WINDOWS\System32\svchost.exe
C:\VEXPLITE\viritsvc.exe
E:\WINDOWS\Explorer.EXE
E:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe
E:\Programmi\QuickTime\qttask.exe
D:\iTunesHelper.exe
E:\Programmi\Spyware Terminator\SpywareTerminatorShield.exe
E:\Programmi\iPod\bin\iPodService.exe
E:\Programmi\File comuni\Real\Update_OB\realsched.exe
E:\WINDOWS\System32\ctfmon.exe
E:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe
E:\Programmi\WIDCOMM\Software Bluetooth\BTTray.exe
C:\Programmi\Adobe\Reader 8.0\Reader\AcroRd32.exe
E:\Programmi\MSN Messenger\usnsvc.exe
E:\WINDOWS\SYSTEM32\CLEANMGR.EXE
E:\Programmi\Spyware Terminator\SpywareTerminator.exe
D:\desktop\Tools_antivirus\_a_i_g_i_a_c_k_t_h_i_s.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.libero.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://it.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://it.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.it/0SEITIT/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - E:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [avgnt] "E:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "E:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [idmsnn] Wscript E:\WINDOWS\PROGRAMMMSE.VBS /B
O4 - HKLM\..\Run: [iTunesHelper] "D:\iTunesHelper.exe"
O4 - HKLM\..\Run: [SpywareTerminator] "E:\Programmi\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [LaunchList] D:\LaunchList.exe
O4 - HKLM\..\Run: [TkBellExe] "E:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] E:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] E:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Programmi\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = E:\Programmi\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: PI Monitor.lnk = ?
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie.htm
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partne ... nicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/ms ... b56986.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - E:\Programmi\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/IT-IT/a-U ... E_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resourc ... oscan8.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan ... asinst.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMe ... loader.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O16 - DPF: {CC32D4D8-2A0B-4CEB-B105-C9B968379105} (CGameManagerCtrl Object) - https://disney.go.com/games/downloads/g ... anager.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - E:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - E:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: !SASWinLogon - E:\Programmi\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - E:\Programmi\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - E:\Programmi\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - E:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - E:\Programmi\iPod\bin\iPodService.exe
O23 - Service: ProgramCheckerPro (sassvc) - Unknown owner - C:\Programmi\Zenturi\ProgramChecker\sassvc.exe (file missing)
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - E:\Programmi\Spyware Terminator\sp_rsser.exe
O23 - Service: Virit eXplorer Lite (viritsvclite) - TG Soft Sas www.tgsoft.it - C:\VEXPLITE\viritsvc.exe

[crazy.cat]

Tre nomi strani, il secondo sopratutto.
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [idmsnn] Wscript E:\WINDOWS\PROGRAMMMSE.VBS /B
O4 - HKLM\..\Run: [LaunchList] D:\LaunchList.exe

Fai analizzare i file sul sito www.virustotal.com e vedi cosa sono.

[danyela]

Ok, ho fatto ciò che mi hai suggerito con il secondo file, ed ecco la risposta che ho ricevuto:


Complete scanning result of "=?iso-8859-1?Q?PROGRAMMMSE.VBS?=", processed in VirusTotal at 06/16/2007 10:45:53 (CET).

[ file data ]
* name: =?iso-8859-1?Q?PROGRAMMMSE.VBS?=
* size: 171
* md5.: 99552b79c30ed0cb8b00404017ffd937
* sha1: f971df407de0bc973c49ced81ca78d7974237c18

[ scan result ]
AhnLab-V3 2007.6.16.0/20070615 found nothing
AntiVir 7.4.0.32/20070615 found nothing
Authentium 4.93.8/20070616 found nothing
Avast 4.7.997.0/20070615 found nothing
AVG 7.5.0.467/20070615 found nothing
BitDefender 7.2/20070616 found nothing
CAT-QuickHeal 9.00/20070615 found nothing
ClamAV devel-20070416/20070616 found nothing
DrWeb 4.33/20070615 found nothing
eSafe 7.0.15.0/20070614 found nothing
eTrust-Vet 30.7.3721/20070615 found nothing
Ewido 4.0/20070616 found nothing
F-Prot 4.3.2.48/20070615 found nothing
F-Secure 6.70.13030.0/20070615 found nothing
FileAdvisor 1/20070616 found nothing
Fortinet 2.85.0.0/20070616 found nothing
Ikarus T3.1.1.8/20070616 found nothing
Kaspersky 4.0.2.24/20070616 found nothing
McAfee 5054/20070615 found nothing
Microsoft 1.2607/20070616 found nothing
NOD32v2 2334/20070615 found nothing
Norman 5.80.02/20070615 found nothing
Panda 9.0.0.4/20070616 found nothing
Prevx1 V2/20070616 found nothing
Sophos 4.18.0/20070612 found nothing
Sunbelt 2.2.907.0/20070616 found nothing
Symantec 10/20070616 found nothing
TheHacker 6.1.6.133/20070615 found nothing
VBA32 3.12.0.2/20070615 found nothing
VirusBuster 4.3.23:9/20070615 found nothing
Webwasher-Gateway 6.0.1/20070616 found [VBScript.Vulnerable.gen!High (suspicious)]

[crazy.cat]

Se non hai messo tu lo script vbs in esecuzione ti direi di eliminarlo.
Fai un controllo online sulla presenza di qualche virus
http://www.kaspersky.com/virusscanner
se ci sono salva il log finale della scansione e postalo qui.

[danyela]

Allora ho eliminato il file suddetto e fatto la scansione con kaspersky on line è questo è il log....grazie



Sunday, June 17, 2007 12:52:46 PM
Operating System: Microsoft Windows XP Professional, (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 17/06/2007
Kaspersky Anti-Virus database records: 347657


Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target Critical Areas
E:\WINDOWS
E:\DOCUME~1\fs\IMPOST~1\Temp\

Scan Statistics
Total number of scanned objects 16709
Number of viruses found 0
Number of infected objects 0
Number of suspicious objects 0
Duration of the scan process 00:29:58

Infected Object Name Virus Name Last Action
E:\WINDOWS\Cronologia\History.IE5\index.dat Object is locked skipped

E:\WINDOWS\Cronologia\History.IE5\MSHist012007061720070618\index.dat Object is locked skipped

E:\WINDOWS\Debug\oakley.log Object is locked skipped

E:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

E:\WINDOWS\SchedLog.Txt Object is locked skipped

E:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

E:\WINDOWS\Sti_Trace.log Object is locked skipped

E:\WINDOWS\SYSTEM32\config\AppEvent.Evt Object is locked skipped

E:\WINDOWS\SYSTEM32\config\DEFAULT Object is locked skipped

E:\WINDOWS\SYSTEM32\config\default.LOG Object is locked skipped

E:\WINDOWS\SYSTEM32\config\Paramete.evt Object is locked skipped

E:\WINDOWS\SYSTEM32\config\SAM Object is locked skipped

E:\WINDOWS\SYSTEM32\config\SAM.LOG Object is locked skipped

E:\WINDOWS\SYSTEM32\config\SecEvent.Evt Object is locked skipped

E:\WINDOWS\SYSTEM32\config\SECURITY Object is locked skipped

E:\WINDOWS\SYSTEM32\config\SECURITY.LOG Object is locked skipped

E:\WINDOWS\SYSTEM32\config\SOFTWARE Object is locked skipped

E:\WINDOWS\SYSTEM32\config\software.LOG Object is locked skipped

E:\WINDOWS\SYSTEM32\config\SysEvent.Evt Object is locked skipped

E:\WINDOWS\SYSTEM32\config\SYSTEM Object is locked skipped

E:\WINDOWS\SYSTEM32\config\system.LOG Object is locked skipped

E:\WINDOWS\SYSTEM32\h323log.txt Object is locked skipped

E:\WINDOWS\SYSTEM32\wbem\REPOSITORY\FS\INDEX.BTR Object is locked skipped

E:\WINDOWS\SYSTEM32\wbem\REPOSITORY\FS\OBJECTS.DATA Object is locked skipped

E:\WINDOWS\wiadebug.log Object is locked skipped

E:\WINDOWS\wiaservc.log Object is locked skipped

E:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

[crazy.cat]

Escludiamo i virus.
Scansione con superantispyware non ti trova niente?

[danyela]

Sto facendo la scansione con superantispaware....una domandina da ignorante ma tutte quei file che la scansione precedente con karpesky ha segnalato non sono virus?

[crazy.cat]

Niente virus
Number of viruses found 0
Number of infected objects 0
Number of suspicious objects 0

sono tutti file di sistema, in uso e per quello kaspersk non riesce ad accederci.

[danyela]

Ho fatto la scansione come suggerito ed il risultato è stato :

Adware tracking cookie(24 items)

che ho eliminato.

[crazy.cat]

A questo punto non saprei che dirti.
In apparenza non c'è niente, o hai preso qualcosa di nuovo, o non so.
Hai uno di questi indirizzi in cui viene modificata la pagina?