www.MegaLab.it

da **primoair** » dom ago 15, 2004 11:10 am

Cosa dovrei eliminare?
Grazie

Logfile of HijackThis v1.98.2
Scan saved at 12.08.09, on 15/08/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSSystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:ProgrammiFile comuniSymantec SharedccEvtMgr.exe
C:WINDOWSSystem32CTsvcCDA.exe
C:ProgrammiNorton AntiVirus
avapsvc.exe
C:WINDOWSSystem32
vsvc32.exe
C:WINDOWSExplorer.EXE
C:WINDOWSSystem32svchost.exe
C:WINDOWSSystem32MsPMSPSv.exe
C:ProgrammiFile comuniSymantec SharedccApp.exe
C:WINDOWSSystem32dslagent.exe
C:ProgrammiFree Surferfs20.exe
C:ProgrammiMicrosoft HardwareKeyboard ype32.exe
C:ProgrammiLogitechMouseWaresystemem_exec.exe
C:PROGRA~1DATACA~1FLashKsk.exe
C:ProgrammiScanSoftPaperPortpptd40nt.exe
C:ProgrammiCreativeSBAudigy2Surround MixerCTSysVol.exe
C:ProgrammiCreativeSBAudigy2DVDAudioCTDVDDet.EXE
C:WINDOWSSystem32CTHELPER.EXE
C:WINDOWSSystem32GSICON.EXE
C:WINDOWSSystem32ctfmon.exe
C:WINDOWSSystem32RunDLL32.exe
C:ProgrammiInternet Exploreriexplore.exe
C:ProgrammiOutlook Expressmsimn.exe
C:ProgrammiMessengermsmsgs.exe
C:ProgrammieMuleemule.exe
C:HijackThisHijackThis.exe

R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = about:blank
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.excite.it/
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www
R1 - HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = about:blank
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page_bak = http://www.excite.it/
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:ProgrammiAdobeAcrobat 6.0AcrobatActiveXAcroIEHelper.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:PROGRA~1FlashGetjccatch.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:programmigooglegoogletoolbar1.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:ProgrammiAdobeAcrobat 6.0AcrobatAcroIEFavClient.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:ProgrammiNorton AntiVirusNavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINDOWSSystem32msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:ProgrammiNorton AntiVirusNavShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:ProgrammiAdobeAcrobat 6.0AcrobatAcroIEFavClient.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:PROGRA~1FlashGetfgiebar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:programmigooglegoogletoolbar1.dll
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSSystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [nwiz] nwiz.exe /install
O4 - HKLM..Run: [ccApp] "C:ProgrammiFile comuniSymantec SharedccApp.exe"
O4 - HKLM..Run: [ccRegVfy] "C:ProgrammiFile comuniSymantec SharedccRegVfy.exe"
O4 - HKLM..Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM..Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
O4 - HKLM..Run: [freesurfer] C:ProgrammiFree Surferfs20.exe
O4 - HKLM..Run: [IntelliType] "C:ProgrammiMicrosoft HardwareKeyboard ype32.exe"
O4 - HKLM..Run: [DataCaching] C:PROGRA~1DATACA~1FLashKsk.exe
O4 - HKLM..Run: [CloneCDElbyCDFL] "C:ProgrammiElaborate BytesCloneCDElbyCheck.exe" /L ElbyCDFL
O4 - HKLM..Run: [zSPGuard] c:programmipjwspguardspguard.exe /s
O4 - HKLM..Run: [PaperPort PTD] C:ProgrammiScanSoftPaperPortpptd40nt.exe
O4 - HKLM..Run: [IndexSearch] C:ProgrammiScanSoftPaperPortIndexSearch.exe
O4 - HKLM..Run: [CTSysVol] C:ProgrammiCreativeSBAudigy2Surround MixerCTSysVol.exe
O4 - HKLM..Run: [CTDVDDet] C:ProgrammiCreativeSBAudigy2DVDAudioCTDVDDet.EXE
O4 - HKLM..Run: [CTHelper] CTHELPER.EXE
O4 - HKLM..Run: [UpdReg] C:WINDOWSUpdReg.EXE
O4 - HKLM..Run: [CTStartup] "C:ProgrammiCreativeSplash ScreenCTEaxSpl.EXE" /run
O4 - HKLM..Run: [QuickTime Task] "C:ProgrammiQuickTimeqttask.exe" -atboottime
O4 - HKLM..Run: [GSICONEXE] GSICON.EXE
O4 - HKCU..Run: [CTFMON.EXE] C:WINDOWSSystem32ctfmon.exe
O4 - HKCU..Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKCU..RunOnce: [CTStartup] "C:ProgrammiCreativeSplash ScreenCTEaxSpl.EXE" /play
O6 - HKCUSoftwarePoliciesMicrosoftInternet ExplorerControl Panel present
O8 - Extra context menu item: &Google Search - res://c:programmigoogleGoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Collegamenti a ritroso - res://c:programmigoogleGoogleToolbar1.d ... links.html
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O8 - Extra context menu item: Pagine simili - res://c:programmigoogleGoogleToolbar1.d ... milar.html
O8 - Extra context menu item: Scarica con FlashGet - C:ProgrammiFlashGetjc_link.htm
O8 - Extra context menu item: Scarica tutto con FlashGet - C:ProgrammiFlashGetjc_all.htm
O8 - Extra context menu item: Versione cache della pagina - res://c:programmigoogleGoogleToolbar1.dll/cmcache.html
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 - Extra button: Free Surfer - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - C:ProgrammiFree SurferFS20.exe
O9 - Extra 'Tools' menuitem: Free Surfer - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - C:ProgrammiFree SurferFS20.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSweb elated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSweb elated.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:PROGRA~1FlashGetflashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:PROGRA~1FlashGetflashget.exe
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {D9FC8C5D-B5CB-4351-AFE9-417409FEEA01} (GC1 Control) - http://www.abbeynet.it/gc/GC1-1.0.1.64_light.cab
O17 - HKLMSystemCCSServicesTcpip..{37D266C4-418B-4879-A673-2B9C3A5EA5F3}: NameServer = 217.141.105.205 151.99.125.1
O17 - HKLMSystemCS1ServicesTcpip..{37D266C4-418B-4879-A673-2B9C3A5EA5F3}: NameServer = 217.141.105.205 151.99.125.1

<font color="red">spostato nella categoria corretta!</font id="red">

da **crazy.cat** » dom ago 15, 2004 11:55 am

Hai dei problemi particolari, o volevi solo un controllo?

Queste voci sono da eliminare
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = about:blank
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www
R1 - HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = about:blank

e queste perché inutili
O4 - HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
O4 - HKLM..Run: [CloneCDElbyCDFL] "C:ProgrammiElaborate BytesCloneCDElbyCheck.exe" /L ElbyCDFL
O4 - HKLM..Run: [UpdReg] C:WINDOWSUpdReg.EXE
O4 - HKLM..Run: [QuickTime Task] "C:ProgrammiQuickTimeqttask.exe" -atboottime

da **primoair** » dom ago 15, 2004 1:08 pm

Per prima cosa grazie per la risposta.
No, non ho problemi.
Se quello che tu mi dice di levare li lascio possono combinare qualcosa?
Grazie ancora
P.S.= A proposito di quelli inutili, sono tutti programmi che ho installato nel PC (perché dici inutili?)

da **Ices_Eyes** » dom ago 15, 2004 1:37 pm

Per quell inutili puoi levarli per velocizzare un po' l'avvio...Sono solo dei test fatti da alcuni programmi in fase di avvio del pc, che non servono a ulla...

Ciao [^]

da **crazy.cat** » dom ago 15, 2004 1:38 pm

Questa è la Q di quicktime nella systray
O4 - HKLM..Run: [QuickTime Task] "C:ProgrammiQuickTimeqttask.exe"
Questo serve per ricordarti di registrare i prodotti creative
O4 - HKLM..Run: [UpdReg] C:WINDOWSUpdReg.EXE
Gli altri due sono due controlli di nero e clone che di solito elimino e funziona tutto lo stesso.
Nessuno ti obbliga a toglierli, ma servono a poco o niente.
Le altre voci le puoi anche lasciare non sono pericolose.

da **primoair** » dom ago 15, 2004 3:06 pm

OK. Grazie a tutti

da **primoair** » lun ago 16, 2004 4:53 pm

Qualcuno conosce questi?:

- O4 - HKLM..Run: [zSPGuard] c:programmipjwspguardspguard.exe /s
- O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
- O16 - DPF: {D9FC8C5D-B5CB-4351-AFE9-417409FEEA01} (GC1 Control) - http://www.abbeynet.it/gc/GC1-1.0.1.64_light.cab

da **crazy.cat** » lun ago 16, 2004 5:14 pm

Sono tutti e tre puliti o almeno nno pericolosi

"StartPage Guard (SPG) protects your PC from cyberscam, by detecting and preventing any unauthorized changes to your internet browser's Start and Search pages. It is also capable of removing automatically most of known 'invaders'."
- O4 - HKLM..Run: [zSPGuard] c:programmipjwspguardspguard.exe /s

Questo è un visualizzatore di immagini (credo)
http://www.cult3d.com/download/download.asp
- O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab

http://www.abbeynet.it/ questa è una compagnia di telefonia via internet se non ho capito male
- O16 - DPF: {D9FC8C5D-B5CB-4351-AFE9-417409FEEA01} (GC1 Control) - http://www.abbeynet.it/gc/GC1-1.0.1.64_light.cab

da **primoair** » mar ago 17, 2004 6:08 pm

Grazie mille.

da **Amon** » dom set 05, 2004 12:53 pm

Salve a tutti,allora il prob è sempre il solito,pagina iniziale cambiata,comparsa nei preferiti e sul desktop d collegamenti a casinò online ecc,in più si genera una cartella C:Documents and SettingsAll Users.WINDOWSDati applicazioniNEWREMOTEAIMTICK con dentro gli exe a sua volta generati da non so cosa che creano questi collegamenti,inutile dire che i vari prog come spy bot ecc riescono solo a levare la parte visibile di questo problema ossia i links

Logfile of HijackThis v1.98.2
Scan saved at 13.46.17, on 05/09/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:ProgrammiAheadInCDInCDsrv.exe
C:ProgrammiFile comuniSymantec SharedccSetMgr.exe
C:ProgrammiNorton Personal FirewallNISUM.EXE
C:ProgrammiFile comuniSymantec SharedccEvtMgr.exe
C:WINDOWSsystem32LEXBCES.EXE
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSsystem32LEXPPS.EXE
C:WINDOWSSystem32DRIVERSCDANTSRV.EXE
C:ProgrammiNorton Personal FirewallccPxySvc.exe
C:WINDOWSsystem32crypserv.exe
C:ProgrammiFile comuniMicrosoft SharedVS7DEBUGMDM.EXE
C:ProgrammiNorton AntiVirus
avapsvc.exe
C:ProgrammiNorton AntiVirusAdvToolsNPROTECT.EXE
C:WINDOWSSystem32
vsvc32.exe
C:WINDOWSSystem32svchost.exe
C:ProgrammiFile comuniSymantec SharedCCPD-LCsymlcsvc.exe
C:WINDOWSSystem32MsPMSPSv.exe
C:ProgrammiNorton AntiVirusSAVScan.exe
C:WINDOWSExplorer.EXE
C:WINDOWShtpatch.exe
C:WINDOWSSystem32RunDll32.exe
C:ProgrammiFile comuniSymantec SharedccApp.exe
C:ProgrammiJavaj2re1.4.2_03injusched.exe
C:ProgrammiMessenger Plus! 3MsgPlus.exe
C:ProgrammiAheadInCDInCD.exe
C:WINDOWSSystem32RUNDLL32.EXE
C:ProgrammiTweak-XP Pro 3AdBlocker.exe
C:ProgrammiMSN Messengermsnmsgr.exe
C:ProgrammiTrustEasy WebscanScnPanel.exe
C:ProgrammiARESCOMModem Telindus Arescom ND220dslmon.exe
C:ProgrammiDC++zDCPlusPlus.exe
c:progra~1intern~1iexplore.exe
C:ProgrammiInternet Exploreriexplore.exe
C:Programmimozilla.orgMozillamozilla.exe
C:Documents and Settingsfabi0DesktopHijackThis.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.diwhapydpgrkah.net/a29f75fxN ... kFgNE.html
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://www.google.it
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://www.google.it
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://www.hnqorpeimxqdjmshuivpkv.uk/a2 ... ugttmb.htm
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Local Page =
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Local Page =
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Collegamenti
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {636FB65B-9059-BAB7-0A67-B3EE59659E15} - C:PROGRA~1BIKEAD~1Bolddead.exe
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:ProgrammiNorton AntiVirusNavShExt.dll
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSSystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [nwiz] nwiz.exe /install
O4 - HKLM..Run: [HTpatch] C:WINDOWShtpatch.exe
O4 - HKLM..Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM..Run: [ccRegVfy] C:ProgrammiFile comuniSymantec SharedccRegVfy.exe
O4 - HKLM..Run: [ccApp] C:ProgrammiFile comuniSymantec SharedccApp.exe
O4 - HKLM..Run: [Advanced Tools Check] C:PROGRA~1NORTON~1AdvToolsADVCHK.EXE
O4 - HKLM..Run: [IMJPMIG8.1] C:WINDOWSIMEimjp8_1IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM..Run: [IMEKRMIG6.1] C:WINDOWSimeimkr6_1IMEKRMIG.EXE
O4 - HKLM..Run: [MSPY2002] C:WINDOWSSystem32IMEPINTLGNTImScInst.exe /SYNC
O4 - HKLM..Run: [PHIME2002ASync] C:WINDOWSSystem32IMETINTLGNTTINTSETP.EXE /SYNC
O4 - HKLM..Run: [PHIME2002A] C:WINDOWSSystem32IMETINTLGNTTINTSETP.EXE /IMEName
O4 - HKLM..Run: [SunJavaUpdateSched] C:ProgrammiJavaj2re1.4.2_03injusched.exe
O4 - HKLM..Run: [CM-SmWizard] C:WINDOWSSystemSmWizard.exe
O4 - HKLM..Run: [SendWma] C:PROGRA~1NOUNMA~1Vcpolleggs.exe
O4 - HKLM..Run: [MessengerPlus3] "C:ProgrammiMessenger Plus! 3MsgPlus.exe"
O4 - HKLM..Run: [InCD] C:ProgrammiAheadInCDInCD.exe
O4 - HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
O4 - HKLM..Run: [SSC_UserPrompt] C:ProgrammiFile comuniSymantec SharedSecurity CenterUsrPrmpt.exe
O4 - HKLM..Run: [aim tick book bold] C:Documents and SettingsAll Users.WINDOWSDati applicazioniNEWREMOTEAIMTICKdash 1.exe
O4 - HKCU..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSSystem32NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU..Run: [Symantec NetDriver Monitor] C:PROGRA~1SYMNET~1SNDMon.exe
O4 - HKCU..Run: [MessengerPlus3] "C:ProgrammiMessenger Plus! 3MsgPlus.exe" /WinStart
O4 - HKCU..Run: [BlockAds] "C:ProgrammiTweak-XP Pro 3AdBlocker.exe"
O4 - HKCU..Run: [msnmsgr] "C:ProgrammiMSN Messengermsnmsgr.exe" /background
O4 - Global Startup: ScanPanel.lnk = C:ProgrammiTrustEasy WebscanScnPanel.exe
O4 - Global Startup: DSLMON.lnk = ?
O6 - HKCUSoftwarePoliciesMicrosoftInternet ExplorerRestrictions present
O6 - HKCUSoftwarePoliciesMicrosoftInternet ExplorerControl Panel present
O6 - HKCUSoftwarePoliciesMicrosoftInternet ExplorerToolbarsRestrictions present
O8 - Extra context menu item: &Download with &DAP - C:PROGRA~1DAPdapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:PROGRA~1DAPdapextie2.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b30149.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/share ... insctl.cab
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/Shar ... /cabsa.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... Client.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZI ... b30149.cab
O17 - HKLMSystemCCSServicesTcpip..{4351240A-F55C-49C6-948A-F4BEA169F75C}: NameServer = 217.141.250.206 151.99.125.1

la stringa R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://www.hnqorpeimxqdjmshuivpkv.uk/a2 ... ugttmb.htm
l'avrò levata 100 volte [nomi]

da **crazy.cat** » dom set 05, 2004 1:18 pm

Ciao Amon e benvenuto nel forum.
Vedo che gli scan online dei virus li hai già passati tutti e quindi ti propongo questa cosa
http://www.zanezane.net/articoli.asp?id=187
ti crea un cd di boot e fai uno scan dal dos dei virus.
Hai troppi exe sconosciuti attivi in memoria che possono essere un qualsiasi virus.
Disattiva il ripristino della configurazione del sistema prima di fare la scansione,e cancella tutti i file temporanei di internet.
Poi butta via Norton antivirus la peggior difesa presente sul pianeta terra.

Queste voci devono sparire
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.diwhapydpgrkah.net/a29f75fxN ... FgNE.htmlt
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://www.hnqorpeimxqdjmshuivpkv.uk/a2 ... ugttmb.htm
O2 - BHO: (no name) - {636FB65B-9059-BAB7-0A67-B3EE59659E15} - C:PROGRA~1BIKEAD~1Bolddead.exe
O4 - HKLM..Run: [IMJPMIG8.1] C:WINDOWSIMEimjp8_1IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM..Run: [IMEKRMIG6.1] C:WINDOWSimeimkr6_1IMEKRMIG.EXE
O4 - HKLM..Run: [MSPY2002] C:WINDOWSSystem32IMEPINTLGNTImScInst.exe /SYNC
O4 - HKLM..Run: [PHIME2002ASync] C:WINDOWSSystem32IMETINTLGNTTINTSETP.EXE /SYNC
O4 - HKLM..Run: [PHIME2002A] C:WINDOWSSystem32IMETINTLGNTTINTSETP.EXE /IMEName
O4 - HKLM..Run: [aim tick book bold] C:Documents and SettingsAll Users.WINDOWSDati applicazioniNEWREMOTEAIMTICKdash 1.exe
O4 - HKLM..Run: [SendWma] C:PROGRA~1NOUNMA~1Vcpolleggs.exe

Fai sapere come và.

da **Amon** » dom set 05, 2004 1:54 pm

cancellate le voci che mi hai indicato riaperto IE puntualmente compare il banner in basso e le pagino modificate nel home

Logfile of HijackThis v1.98.2
Scan saved at 14.52.49, on 05/09/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:ProgrammiAheadInCDInCDsrv.exe
C:ProgrammiFile comuniSymantec SharedccSetMgr.exe
C:ProgrammiNorton Personal FirewallNISUM.EXE
C:ProgrammiFile comuniSymantec SharedccEvtMgr.exe
C:WINDOWSsystem32LEXBCES.EXE
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSsystem32LEXPPS.EXE
C:WINDOWSSystem32DRIVERSCDANTSRV.EXE
C:ProgrammiNorton Personal FirewallccPxySvc.exe
C:WINDOWSsystem32crypserv.exe
C:ProgrammiFile comuniMicrosoft SharedVS7DEBUGMDM.EXE
C:ProgrammiNorton AntiVirus
avapsvc.exe
C:ProgrammiNorton AntiVirusAdvToolsNPROTECT.EXE
C:WINDOWSSystem32
vsvc32.exe
C:WINDOWSSystem32svchost.exe
C:ProgrammiFile comuniSymantec SharedCCPD-LCsymlcsvc.exe
C:WINDOWSSystem32MsPMSPSv.exe
C:ProgrammiNorton AntiVirusSAVScan.exe
C:WINDOWSExplorer.EXE
C:WINDOWShtpatch.exe
C:WINDOWSSystem32RunDll32.exe
C:ProgrammiFile comuniSymantec SharedccApp.exe
C:ProgrammiJavaj2re1.4.2_03injusched.exe
C:ProgrammiMessenger Plus! 3MsgPlus.exe
C:ProgrammiAheadInCDInCD.exe
C:WINDOWSSystem32RUNDLL32.EXE
C:ProgrammiTweak-XP Pro 3AdBlocker.exe
C:ProgrammiMSN Messengermsnmsgr.exe
C:ProgrammiTrustEasy WebscanScnPanel.exe
C:ProgrammiARESCOMModem Telindus Arescom ND220dslmon.exe
C:ProgrammiDC++zDCPlusPlus.exe
c:progra~1intern~1iexplore.exe
C:ProgrammiInternet Exploreriexplore.exe
C:Programmimozilla.orgMozillamozilla.exe
C:Documents and Settingsfabi0DesktopHijackThis.exe

R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://www.google.it
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://www.google.it
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://www.xkdtzcmlphnxpplrixmriuqjn.co ... ugttmb.cgi
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Local Page =
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Local Page =
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Collegamenti
R3 - Default URLSearchHook is missing
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:ProgrammiNorton AntiVirusNavShExt.dll
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSSystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [nwiz] nwiz.exe /install
O4 - HKLM..Run: [HTpatch] C:WINDOWShtpatch.exe
O4 - HKLM..Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM..Run: [ccRegVfy] C:ProgrammiFile comuniSymantec SharedccRegVfy.exe
O4 - HKLM..Run: [ccApp] C:ProgrammiFile comuniSymantec SharedccApp.exe
O4 - HKLM..Run: [Advanced Tools Check] C:PROGRA~1NORTON~1AdvToolsADVCHK.EXE
O4 - HKLM..Run: [SunJavaUpdateSched] C:ProgrammiJavaj2re1.4.2_03injusched.exe
O4 - HKLM..Run: [CM-SmWizard] C:WINDOWSSystemSmWizard.exe
O4 - HKLM..Run: [MessengerPlus3] "C:ProgrammiMessenger Plus! 3MsgPlus.exe"
O4 - HKLM..Run: [InCD] C:ProgrammiAheadInCDInCD.exe
O4 - HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
O4 - HKLM..Run: [SSC_UserPrompt] C:ProgrammiFile comuniSymantec SharedSecurity CenterUsrPrmpt.exe
O4 - HKCU..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSSystem32NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU..Run: [Symantec NetDriver Monitor] C:PROGRA~1SYMNET~1SNDMon.exe
O4 - HKCU..Run: [MessengerPlus3] "C:ProgrammiMessenger Plus! 3MsgPlus.exe" /WinStart
O4 - HKCU..Run: [BlockAds] "C:ProgrammiTweak-XP Pro 3AdBlocker.exe"
O4 - HKCU..Run: [msnmsgr] "C:ProgrammiMSN Messengermsnmsgr.exe" /background
O4 - Global Startup: ScanPanel.lnk = C:ProgrammiTrustEasy WebscanScnPanel.exe
O4 - Global Startup: DSLMON.lnk = ?
O6 - HKCUSoftwarePoliciesMicrosoftInternet ExplorerRestrictions present
O6 - HKCUSoftwarePoliciesMicrosoftInternet ExplorerControl Panel present
O6 - HKCUSoftwarePoliciesMicrosoftInternet ExplorerToolbarsRestrictions present
O8 - Extra context menu item: &Download with &DAP - C:PROGRA~1DAPdapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:PROGRA~1DAPdapextie2.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b30149.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/share ... insctl.cab
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/Shar ... /cabsa.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... Client.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZI ... b30149.cab
O17 - HKLMSystemCCSServicesTcpip..{4351240A-F55C-49C6-948A-F4BEA169F75C}: NameServer = 217.141.250.206 151.99.125.1

ora provo il prog della mc afee

da **Amon** » dom set 05, 2004 2:57 pm

niente quel prog non mi si aggiorna e mi crea l'iso o il floppy disk solo del primo disk

da **crazy.cat** » dom set 05, 2004 3:19 pm

Scompatta questo in una cartella
http://a64.g.akamai.net/7/64/2015/2004- ... t-4389.zip
e X l'update gli fai puntare a quella cartella.
Ho appena riprovato e funziona.
Che messaggio di errore hai?

da **Amon** » dom set 05, 2004 3:27 pm

quello che segnalano anche loro nelle istruzioni,che nn ho nessun software istallato o na cosa simile

da **Amon** » dom set 05, 2004 3:32 pm

comunque con il tuo file ha aggiornato i dat ora provo a rifare l'iso

da **Amon** » dom set 05, 2004 3:46 pm

ci sta anche questo
http://www.zanezane.net/public/upload/adware.gif

da **crazy.cat** » dom set 05, 2004 3:52 pm

Quello è l'avviso che hai la pagina principale reindirizzata in posti strani, bisogna trovare ed eliminare chi lo provoca.

da **Amon** » dom set 05, 2004 5:15 pm

intanto grazie per la disponibilità
allora;fatta la scansione ho ripaerto IE e pare essere pulito,ma nn mi illudo,altra cosa,io qui ho più account e le impostazioni di IE sono separate nn dovrò mica andare a ripulire anche dall'altra parte?

da **Amon** » dom set 05, 2004 5:30 pm

dunque anche dall'altro account IE apparentemente è pulito, tuttavia hijack segnala ancora delle stringhe anomale
18.26 05/09/2004Logfile of HijackThis v1.98.2
Scan saved at 18.24.59, on 05/09/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:ProgrammiAheadInCDInCDsrv.exe
C:ProgrammiFile comuniSymantec SharedccSetMgr.exe
C:ProgrammiNorton Personal FirewallNISUM.EXE
C:ProgrammiFile comuniSymantec SharedccEvtMgr.exe
C:WINDOWSsystem32LEXBCES.EXE
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSsystem32LEXPPS.EXE
C:WINDOWSSystem32DRIVERSCDANTSRV.EXE
C:ProgrammiNorton Personal FirewallccPxySvc.exe
C:WINDOWSsystem32crypserv.exe
C:ProgrammiFile comuniMicrosoft SharedVS7DEBUGMDM.EXE
C:ProgrammiNorton AntiVirus
avapsvc.exe
C:ProgrammiNorton AntiVirusAdvToolsNPROTECT.EXE
C:WINDOWSSystem32
vsvc32.exe
C:WINDOWSSystem32svchost.exe
C:ProgrammiFile comuniSymantec SharedCCPD-LCsymlcsvc.exe
C:WINDOWSSystem32MsPMSPSv.exe
C:ProgrammiNorton AntiVirusSAVScan.exe
C:WINDOWSExplorer.EXE
C:WINDOWShtpatch.exe
C:WINDOWSSystem32RunDll32.exe
C:ProgrammiFile comuniSymantec SharedccApp.exe
C:ProgrammiJavaj2re1.4.2_03injusched.exe
C:ProgrammiMessenger Plus! 3MsgPlus.exe
C:ProgrammiAheadInCDInCD.exe
C:WINDOWSSystem32RUNDLL32.EXE
C:ProgrammiTweak-XP Pro 3AdBlocker.exe
c:progra~1intern~1iexplore.exe
C:ProgrammiTrustEasy WebscanScnPanel.exe
C:ProgrammiARESCOMModem Telindus Arescom ND220dslmon.exe
C:ProgrammiInternet Exploreriexplore.exe
C:ProgrammiMSN Messengermsnmsgr.exe
C:Programmimozilla.orgMozillamozilla.exe
C:WINDOWSsystem32winlogon.exe
C:Documents and Settingsfabi0DesktopHijackThis.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.google.it
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://www.google.it
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://www.google.it
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://web.rygzekonja.com/Reb7NtKuOFVWA ... gelHj.html
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Local Page =
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Local Page =
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Collegamenti
R3 - Default URLSearchHook is missing
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:ProgrammiNorton AntiVirusNavShExt.dll
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSSystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [nwiz] nwiz.exe /install
O4 - HKLM..Run: [HTpatch] C:WINDOWShtpatch.exe
O4 - HKLM..Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM..Run: [ccRegVfy] C:ProgrammiFile comuniSymantec SharedccRegVfy.exe
O4 - HKLM..Run: [ccApp] C:ProgrammiFile comuniSymantec SharedccApp.exe
O4 - HKLM..Run: [Advanced Tools Check] C:PROGRA~1NORTON~1AdvToolsADVCHK.EXE
O4 - HKLM..Run: [SunJavaUpdateSched] C:ProgrammiJavaj2re1.4.2_03injusched.exe
O4 - HKLM..Run: [CM-SmWizard] C:WINDOWSSystemSmWizard.exe
O4 - HKLM..Run: [MessengerPlus3] "C:ProgrammiMessenger Plus! 3MsgPlus.exe"
O4 - HKLM..Run: [InCD] C:ProgrammiAheadInCDInCD.exe
O4 - HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
O4 - HKLM..Run: [SSC_UserPrompt] C:ProgrammiFile comuniSymantec SharedSecurity CenterUsrPrmpt.exe
O4 - HKLM..Run: [SendWma] C:PROGRA~1NOUNMA~1Vcpolleggs.exe
O4 - HKCU..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSSystem32NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU..Run: [Symantec NetDriver Monitor] C:PROGRA~1SYMNET~1SNDMon.exe
O4 - HKCU..Run: [MessengerPlus3] "C:ProgrammiMessenger Plus! 3MsgPlus.exe" /WinStart
O4 - HKCU..Run: [BlockAds] "C:ProgrammiTweak-XP Pro 3AdBlocker.exe"
O4 - HKCU..Run: [msnmsgr] "C:ProgrammiMSN Messengermsnmsgr.exe" /background
O4 - Global Startup: ScanPanel.lnk = C:ProgrammiTrustEasy WebscanScnPanel.exe
O4 - Global Startup: DSLMON.lnk = ?
O6 - HKCUSoftwarePoliciesMicrosoftInternet ExplorerRestrictions present
O6 - HKCUSoftwarePoliciesMicrosoftInternet ExplorerControl Panel present
O6 - HKCUSoftwarePoliciesMicrosoftInternet ExplorerToolbarsRestrictions present
O8 - Extra context menu item: &Download with &DAP - C:PROGRA~1DAPdapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:PROGRA~1DAPdapextie2.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b30149.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/share ... insctl.cab
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/Shar ... /cabsa.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... Client.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZI ... b30149.cab
O17 - HKLMSystemCCSServicesTcpip..{4351240A-F55C-49C6-948A-F4BEA169F75C}: NameServer = 217.141.250.206 151.99.125.1

altra cosa,non è che mi sapresti dire come togliere questa stramaledetta tool bar? http://www.zanezane.net/public/upload/nuovo-2.jpg

www.MegaLab.it

HijackThis aiuto

HijackThis aiuto

Chi c’è in linea