Cambio pagina iniziale -non trovo la dll

[andreino]

Salve ragazzi non sono nuovissimo ma vi leggo da un po' e mi siete sempre utili......seguendo i vs consigli ho capito e superato problemi......
Ora ne ho uno che non riesco proprio a risolvere il cambio pagina iniziale di...."http://thenewsearch.com/thenewsearch.html"
Ho provato tutto riesco a togliere tutte le cose ma quando riaccendo come al solito ritorna tutto come prima ........credo che non riesco a trovare la dll giusta........o quello che sia ....per cui vi chiedo un aiuto xche sono 2 giorni che sto uscendo pazzo
questo e' il log di Hijack
------------------------------------

Logfile of HijackThis v1.97.7
Scan saved at 15.32.44, on 08/09/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSExplorer.EXE
C:WINDOWSSystem32ctfmon.exe
C:ProgrammiWinZipWZQKPICK.EXE
C:Programmione LabsoneAlarmzapro.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32oneLabsvsmon.exe
E:soulseekHijackThisHijackThis.exe
C:ProgrammiInternet Exploreriexplore.exe
C:WINDOWSsystem32NOTEPAD.EXE

R1 - HKCUSoftwareMicrosoftInternet Explorer,SearchURL = http://thenewsearch.com/search.html
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://thenewsearch.com/search.html
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://thenewsearch.com/search.html
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://thenewsearch.com/thenewsearch.html
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://thenewsearch.com/search.html
R1 - HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://thenewsearch.com/search.html
R1 - HKCUSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch = http://thenewsearch.com/search.html
R1 - HKLMSoftwareMicrosoftInternet Explorer,SearchURL = http://thenewsearch.com/search.html
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://thenewsearch.com/thenewsearch.html
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://thenewsearch.com/search.html
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://thenewsearch.com/search.html
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://thenewsearch.com/search.html
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch = http://thenewsearch.com/search.html
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://thenewsearch.com/search.html
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Collegamenti
R1 - HKCUSoftwareMicrosoftInternet Explorer,Search = http://thenewsearch.com/search.html
R1 - HKLMSoftwareMicrosoftInternet Explorer,Search = http://thenewsearch.com/search.html
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:ProgrammiAdobeAcrobat 6.0ReaderActiveXAcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:PROGRA~1SPYBOT~1SDHelper.dll
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:ProgrammiIpswitchWS_FTP Prowsbho2k0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINDOWSSystem32msdxm.ocx
O4 - HKLM..Run: [NeroCheck] C:WINDOWSsystem32NeroCheck.exe
O4 - HKLM..Run: [winupd] C:WINDOWSSystem32winupd.exe
O4 - HKCU..Run: [CTFMON.EXE] C:WINDOWSSystem32ctfmon.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:ProgrammiWinZipWZQKPICK.EXE
O4 - Global Startup: ZoneAlarm Pro.lnk = C:Programmione LabsoneAlarmzapro.exe
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/ms ... b28578.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/Mi ... b28578.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004 ... scan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b28578.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shoc ... wflash.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/So ... b28578.cab
O17 - HKLMSystemCCSServicesTcpip..{EE07811F-9EE3-4E80-8ACB-AB3DF588A236}: NameServer = 81.74.225.227 151.99.125.1

-------------------------------------------------------
Un ringraziamento anticipato
ciao Andreino

[dano]

Elimina questo processo che è inutile
C:ProgrammiWinZipWZQKPICK.EXE

C:WINDOWSsystem32oneLabsvsmon.exe
Elimin anche queste chiavi:
R1 - HKCUSoftwareMicrosoftInternet Explorer,SearchURL = http://thenewsearch.com/search.html
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://thenewsearch.com/search.html
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://thenewsearch.com/search.html
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://thenewsearch.com/thenewsearch.html
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://thenewsearch.com/search.html
R1 - HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://thenewsearch.com/search.html
R1 - HKCUSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch = http://thenewsearch.com/search.html
R1 - HKLMSoftwareMicrosoftInternet Explorer,SearchURL = http://thenewsearch.com/search.html
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://thenewsearch.com/thenewsearch.html
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://thenewsearch.com/search.html
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://thenewsearch.com/search.html
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://thenewsearch.com/search.html
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch = http://thenewsearch.com/search.html
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://thenewsearch.com/search.html
R1 - HKCUSoftwareMicrosoftInternet Explorer,Search = http://thenewsearch.com/search.html
R1 - HKLMSoftwareMicrosoftInternet Explorer,Search = http://thenewsearch.com/search.html
O4 - HKLM..Run: [NeroCheck] C:WINDOWSsystem32NeroCheck.exe
O4 - HKLM..Run: [winupd] C:WINDOWSSystem32winupd.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:ProgrammiWinZipWZQKPICK.EXE

Toglierei anche il messenger:
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/ms ... b28578.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/Mi ... b28578.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b28578.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/So ... b28578.cab

Questi mi risultano abbastanza strani...
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-
0050DA59922B} - C:ProgrammiIpswitchWS_FTP Prowsbho2k0.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004 ... scan53.cab
O17 - HKLMSystemCCSServicesTcpip..{EE07811F-9EE3-4E80-8ACB-AB3DF588A236}: NameServer = 81.74.225.227 151.99.125.1

Fai anche una scansione dalla provvisoria con CWS e elimina i file temporanei di internet (sempre dalla provvisoria)

[andreino]

<blockquote id="quote"><font size="1" face="Verdana, Arial, Helvetica" id="quote">citazione:<hr height="1" noshade id="quote">
Questi mi risultano abbastanza strani...
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-
0050DA59922B} - C:ProgrammiIpswitchWS_FTP Prowsbho2k0.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004 ... scan53.cab
O17 - HKLMSystemCCSServicesTcpip..{EE07811F-9EE3-4E80-8ACB-AB3DF588A236}: NameServer = 81.74.225.227 151.99.125.1<hr height="1" noshade id="quote"></blockquote id="quote"></font id="quote">
il primo si riferisce al programma "ws_ftp_pro"
il secondo alla scansione antivirus on line di "trendmicro"
il terzo (17) in effett si presenta, nel log, solo dopo che sono entrato in internet e mi si presenta la prima pagina in questione....consigli di toglierli ugualmente?
<blockquote id="quote"><font size="1" face="Verdana, Arial, Helvetica" id="quote">citazione:<hr height="1" noshade id="quote">Fai anche una scansione dalla provvisoria con CWS e elimina i file temporanei di internet (sempre dalla provvisoria)
<hr height="1" noshade id="quote"></blockquote id="quote"></font id="quote">
faro' la scansione in provvisoria ...ma non ho mai tolto i file temporanei ....come si fa?
1 domada idiota[V]... ma se levo tutto il messanger ...quando lo richiamo si ricarica o devo installarlo di nuovo?
Grazie di tutto e vi faro' sapere .........anche xche' non mi sembra di facile soluzione sta' cosa......

[dano]

Elimina solo il terzo allora visto che cli altri 2 sono sicuri!
Per i file temporanei: Tasto dx su Internet Explorer-->Proprietà dalla schermata generale fai click su Elimina file (metti il flag anche su "elimina file non in linea")
Dipende: se lo disinstalli si, ma se elimini l'avvio automatico all'accesso di windows no
Ciao fammi sapere

[andreino]

Ti ringrazio immensamente, grazie al tuo aiuto e di tutto il forum penso di aver risolto i problemi( almeno x oggi ).......riporto di seguito il mio attuale log....bello pulito
-------------------------------------------------
Logfile of HijackThis v1.97.7
Scan saved at 2.47.05, on 09/09/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSExplorer.EXE
C:WINDOWSSystem32ctfmon.exe
C:Programmione LabsoneAlarmzapro.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32oneLabsvsmon.exe
C:ProgrammiInternet Exploreriexplore.exe
E:soulseekHijackThisHijackThis.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.virgilio.it/
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Collegamenti
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:ProgrammiAdobeAcrobat 6.0ReaderActiveXAcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:PROGRA~1SPYBOT~1SDHelper.dll
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:ProgrammiIpswitchWS_FTP Prowsbho2k0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINDOWSSystem32msdxm.ocx
O4 - HKCU..Run: [CTFMON.EXE] C:WINDOWSSystem32ctfmon.exe
O4 - Global Startup: ZoneAlarm Pro.lnk = C:Programmione LabsoneAlarmzapro.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004 ... scan53.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shoc ... wflash.cab
O17 - HKLMSystemCCSServicesTcpip..{EE07811F-9EE3-4E80-8ACB-AB3DF588A236}: NameServer = 81.74.225.227 151.99.125.1
------------------------------------------------------

Ancora grazie

[dano]

Bene bene!!!!!!!!!!