esxplorer

[psabato]

Ciao Ragazzi!!
Mi sono beccato exsplorer e ho letto un po le vs discussioni.
Ho scaricato hijackthis ed ho salvato il log che vi allego.
Scan saved at 10:45:55, on 21/01/2006
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
D:\WINNT\System32\smss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\System32\svchost.exe
D:\WINNT\system32\spoolsv.exe
D:\WINNT\System32\msdtc.exe
D:\WINNT\System32\Ati2evxx.exe
D:\Programmi\OMRON\FinsServerNT\bin\NsServer.exe
D:\WINNT\Explorer.EXE
D:\WINNT\system32\regsvc.exe
D:\WINNT\system32\MSTask.exe
D:\WINNT\System32\tcpsvcs.exe
D:\WINNT\System32\snmp.exe
D:\Programmi\Trend Micro\PC-cillin 2000\Tmntsrv.exe
D:\WINNT\System32\WBEM\WinMgmt.exe
D:\WINNT\System32\mspmspsv.exe
D:\WINNT\System32\inetsrv\inetinfo.exe
D:\Programmi\Trend Micro\PC-cillin 2000\pccntupd.exe
D:\WINNT\System32\mqsvc.exe
D:\WINNT\Hcontrol.exe
D:\WINNT\System32\atiptaxx.exe
D:\Synaptics\SynTP\SynTPLpr.exe
D:\Synaptics\SynTP\SynTPEnh.exe
D:\WINNT\ATKOSD.exe
D:\Programmi\Trend Micro\PC-cillin 2000\Pop3trap.exe
D:\Programmi\Trend Micro\PC-cillin 2000\WebTrapNT.exe
D:\WINNT\System32\qttask.exe
C:\Program Files\Internet Optimizer\optimize.exe
C:\Program Files\Mxhwx\Uzsudd.exe
D:\Siemens\Common\S7ubtoox\s7ubtstx.exe
D:\WINNT\System32\sysmon.exe
D:\Documents and Settings\administrator.NEWBENSO\Dati applicazioni\sgrunt\IE4321.exe
D:\WINNT\System32\internat.exe
D:\WINNT\System32\mntcgf032.exe
D:\Programmi\Microsoft Office\Office\OSA.EXE
D:\Programmi\Trend Micro\PC-cillin 2000\PNTIOMON.exe
C:\Program Files\Internet Optimizer\actalert.exe
C:\Program Files\Internet Optimizer\actalert.exe
C:\Program Files\Internet Optimizer\actalert.exe
D:\Programmi\Microsoft Office\Office\FINDFAST.EXE
D:\Siemens\Common\Sqlany\dbsrv7.exe
D:\Programmi\Internet Explorer\iexplore.exe
D:\Documents and Settings\administrator.NEWBENSO\Desktop\PASQUI\esxp\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.couldnotfind.com/search_page ... id=1000420
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.biniec.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://www.search-2003.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: BHObj Class - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - D:\WINNT\wsem303.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Hcontrol] D:\WINNT\Hcontrol.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] D:\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] D:\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Pop3trap.exe] "D:\Programmi\Trend Micro\PC-cillin 2000\Pop3trap.exe"
O4 - HKLM\..\Run: [WebTrapNT.exe] "D:\Programmi\Trend Micro\PC-cillin 2000\WebTrapNT.exe"
O4 - HKLM\..\Run: [QuickTime Task] D:\WINNT\System32\qttask.exe
O4 - HKLM\..\Run: [Italia2] c:\program files\dialers\italia2\italia2.exe /noconnect
O4 - HKLM\..\Run: [ItalyVideo2] c:\program files\dialers\italyvideo2\italyvideo2.exe /noconnect
O4 - HKLM\..\Run: [00SyncNet-superweb] D:\DOCUME~1\ADMINI~1.NEW\DATIAP~1\superweb.exe /nostart
O4 - HKLM\..\Run: [!!!AAA-aaaasexhotmira14] D:\DOCUME~1\ADMINI~1.NEW\DATIAP~1\EROS-M~1.EXE /ns
O4 - HKLM\..\Run: [!!!AAAA-aaaasfondimot] D:\DOCUME~1\ADMINI~1.NEW\DATIAP~1\SFONDI~1.EXE /ns
O4 - HKLM\..\Run: [HornyCam_it] c:\program files\comsoft\dialers\hornycam_it\hornycam_it.exe /noconnect
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [WebRebates0] "D:\Programmi\Web_Rebates\WebRebates0.exe"
O4 - HKLM\..\Run: [Microsoft WinUpdate] mntcgf032.exe
O4 - HKLM\..\Run: [Nfaiwa] C:\Program Files\Mxhwx\Uzsudd.exe
O4 - HKLM\..\Run: [S7UB Start] "D:\Siemens\Common\S7ubtoox\s7ubtstx.exe" -StartDB
O4 - HKLM\..\Run: [Systems] D:\WINNT\System32\sysmon.exe
O4 - HKLM\..\Run: [Olympic] D:\Documents and Settings\administrator.NEWBENSO\Dati applicazioni\sgrunt\IE4321.exe
O4 - HKLM\..\RunServices: [Microsoft WinUpdate] mntcgf032.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [Microsoft WinUpdate] mntcgf032.exe
O4 - Global Startup: Avvio Office.lnk = D:\Programmi\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Real-time Monitor.lnk = D:\Programmi\Trend Micro\PC-cillin 2000\PNTIOMON.exe
O4 - Global Startup: Ricerca rapida.lnk = D:\Programmi\Microsoft Office\Office\FINDFAST.EXE
O8 - Extra context menu item: Web Rebates - file://D:\Programmi\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINNT\web\related.htm
O9 - Extra button: (no name) - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://D:\Programmi\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O15 - Trusted Zone: http://www.archiviosex.net
O15 - Trusted Zone: http://www.linkautomatici.com
O15 - Trusted Zone: http://www.redfunny.com
O15 - Trusted Zone: http://www.sgrunt.biz
O15 - Trusted Zone: http://www.skymasters.biz
O16 - DPF: {1F831FA9-42FC-11D4-95A6-0080AD30DCE1} (InstaFred) - http://pointa.autodesk.com/portal/lang/ita/InstFred.Ocx
O16 - DPF: {AE563729-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - http://pointa.autodesk.com/portal/lang/ita/InstBanr.Ocx
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (Controllo AcPreview) - file://D:\Programmi\AutoCAD LT 97\AcPreview.ocx
O16 - DPF: {FFFF0003-0001-101A-A3C9-08002B2F49FB} - http://stat.trafficadvance.net/dialer/304409.exe
O16 - DPF: {FFFF003C-0001-101A-A3C9-08002B2F49FB} - http://www.download-italia.com/60B003.exe
O16 - DPF: {FFFF0068-0001-101A-A3C9-08002B2F49FB} - http://www.video-foto-porno.com/104AC001.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{A89A74EA-40ED-49D9-99F7-86FDED423F88}: NameServer = 151.99.250.2,194.243.154.62
O23 - Service: Ati HotKey Poller - Unknown owner - D:\WINNT\System32\Ati2evxx.exe
O23 - Service: CLKPCI_UNIT0 - Unknown owner - %FinsServer%\bin\clkpciunit00.exe (file missing)
O23 - Service: CLK_UNIT0 - Unknown owner - %FinsServer%\bin\clkunit.exe (file missing)
O23 - Service: CPU_UNIT - Unknown owner - %FinsServer%\bin\CpuUnit.exe (file missing)
O23 - Service: Servizio amministrativo di Gestione disco logico (dmadmin) - VERITAS Software Corp. - D:\WINNT\System32\dmadmin.exe
O23 - Service: ETN_UNIT - Unknown owner - %FinsServer%\bin\EthernetUnit.exe (file missing)
O23 - Service: FgwSocketProxy - Unknown owner - %FinsServer%\bin\FgwSocketProxy.exe (file missing)
O23 - Service: MapAgent - Unknown owner - %FinsServer%\bin\MapAgent.exe (file missing)
O23 - Service: NameSpaceServer - Unknown owner - %FinsServer%\bin\NsServer.exe (file missing)
O23 - Service: SerialUnit - Unknown owner - %FinsServer%\bin\SeriUnit.exe (file missing)
O23 - Service: SLKPCI_UNIT0 - Unknown owner - %FinsServer%\bin\slkpciunit00.exe (file missing)
O23 - Service: SysmacBoard Unit - Unknown owner - %FinsServer%\bin\SmapUnit.exe (file missing)
O23 - Service: SysmacLink Unit - Unknown owner - %FinsServer%\bin\slkcons.exe (file missing)
O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Inc. - D:\Programmi\Trend Micro\PC-cillin 2000\Tmntsrv.exe



Qualcuno mi puo aiutare con urgenza.

Grazie mille

[Luke57]

Ciao, mi sembra un log piuttosto incasinato, per prima cosa una scansione on line:
http://www.kaspersky.com/downloads/kws/kavwebscan.html
poi:
Scarica Killsgrunt da qui: http://www.francydelorenzi.it/Sicurezza ... illsgrunt/ ci sono anche le istruzioni d’uso
Scarica deldomains da qui
http://www.mvps.org/winhelp2002/restricted.htm
Dopo averlo compattato, con tutte le applicazioni chiuse, clicchi con il tasto destro sul file.inf e scegli installa.
Scarica cwshreddder
http://www.ilsoftware.it/querydl.asp?ID=750
Esegui cwshredder, con tutte le applicazioni chiuse, basta avviarlo facendo doppio clic sull’eseguibile e premere il tasto Fix.
Esegui kill sgrunt.
Poi metti l’eseguibile (.exe) di hijackthis in una cartella permanente del disco fisso, tipo C\HJT, né temporanea né desktop come hai fatto tu, in modo da fare il backup in caso di errori. Posta nuovo log.

[Merys]

Ciao!
Anch'io ho beccato questo odioso trojan, e sono ancora in parte incasinata, ma penso di averlo rimosso! (almeno spero!)
(se vuoi guarda qua: http://www.pc-facile.com/forum/viewtopi ... c&start=40 )

Per controllare il log io mi sono trovata molto bene con questo sito:
http://www.hijackthis.de/it
praticamente ti crei il log, lo copi e lo incolli nella finestra che appare; dopo di che ti viene fuori il risultato (tra l'altro è anche in italiano!!!)

Spero che anche tu riesca a risolvere questo casino!
Ciao

[psabato]

Grazie x l'aiuto provo a fare quello che mi avete suggerito.
Buona domenica

[psabato]

Ciao Luke57,spero di aver fatto bene quello che mi hai suggerito. non sono molto pratico con queste cose.
ti allego nuovo log.
Spero di riuscire a risolvere presto perchè con questo pc ci lavoro e non vorrei reinstallare tutto.

Ciao aspetto tue news.

[psabato]

Scusa luke57 non ho inserito il log.....eccolo:

Logfile of HijackThis v1.99.1
Scan saved at 12:58:58, on 22/01/2006
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
D:\WINNT\System32\smss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\System32\svchost.exe
D:\WINNT\system32\spoolsv.exe
D:\WINNT\System32\msdtc.exe
D:\WINNT\System32\Ati2evxx.exe
D:\Programmi\OMRON\FinsServerNT\bin\NsServer.exe
D:\WINNT\system32\regsvc.exe
D:\WINNT\system32\MSTask.exe
D:\WINNT\Explorer.EXE
D:\WINNT\System32\tcpsvcs.exe
D:\WINNT\System32\snmp.exe
D:\Programmi\Trend Micro\PC-cillin 2000\Tmntsrv.exe
D:\WINNT\System32\WBEM\WinMgmt.exe
D:\WINNT\System32\mspmspsv.exe
D:\WINNT\System32\inetsrv\inetinfo.exe
D:\Programmi\Trend Micro\PC-cillin 2000\pccntupd.exe
D:\WINNT\System32\mqsvc.exe
D:\WINNT\Hcontrol.exe
D:\WINNT\System32\atiptaxx.exe
D:\Synaptics\SynTP\SynTPLpr.exe
D:\Synaptics\SynTP\SynTPEnh.exe
D:\WINNT\ATKOSD.exe
D:\Programmi\Trend Micro\PC-cillin 2000\Pop3trap.exe
D:\Programmi\Trend Micro\PC-cillin 2000\WebTrapNT.exe
D:\WINNT\System32\qttask.exe
C:\Program Files\Internet Optimizer\optimize.exe
D:\WINNT\System32\mntcgf032.exe
C:\Program Files\Mxhwx\Uzsudd.exe
D:\Siemens\Common\S7ubtoox\s7ubtstx.exe
D:\WINNT\System32\internat.exe
D:\Programmi\Microsoft Office\Office\OSA.EXE
C:\Program Files\Internet Optimizer\actalert.exe
C:\Program Files\Internet Optimizer\actalert.exe
C:\Program Files\Internet Optimizer\actalert.exe
D:\Programmi\Trend Micro\PC-cillin 2000\PNTIOMON.exe
D:\Programmi\Microsoft Office\Office\FINDFAST.EXE
D:\Siemens\Common\Sqlany\dbsrv7.exe
D:\Documents and Settings\administrator.NEWBENSO\Desktop\PASQUI\esxp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.redfunny.com?496
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.biniec.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: BHObj Class - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - D:\WINNT\wsem303.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Hcontrol] D:\WINNT\Hcontrol.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] D:\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] D:\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Pop3trap.exe] "D:\Programmi\Trend Micro\PC-cillin 2000\Pop3trap.exe"
O4 - HKLM\..\Run: [WebTrapNT.exe] "D:\Programmi\Trend Micro\PC-cillin 2000\WebTrapNT.exe"
O4 - HKLM\..\Run: [QuickTime Task] D:\WINNT\System32\qttask.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [WebRebates0] "D:\Programmi\Web_Rebates\WebRebates0.exe"
O4 - HKLM\..\Run: [Microsoft WinUpdate] mntcgf032.exe
O4 - HKLM\..\Run: [Nfaiwa] C:\Program Files\Mxhwx\Uzsudd.exe
O4 - HKLM\..\Run: [S7UB Start] "D:\Siemens\Common\S7ubtoox\s7ubtstx.exe" -StartDB
O4 - HKLM\..\RunServices: [Microsoft WinUpdate] mntcgf032.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [Microsoft WinUpdate] mntcgf032.exe
O4 - Global Startup: Avvio Office.lnk = D:\Programmi\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Real-time Monitor.lnk = D:\Programmi\Trend Micro\PC-cillin 2000\PNTIOMON.exe
O4 - Global Startup: Ricerca rapida.lnk = D:\Programmi\Microsoft Office\Office\FINDFAST.EXE
O8 - Extra context menu item: Web Rebates - file://D:\Programmi\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINNT\web\related.htm
O9 - Extra button: (no name) - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://D:\Programmi\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O16 - DPF: {1F831FA9-42FC-11D4-95A6-0080AD30DCE1} (InstaFred) - http://pointa.autodesk.com/portal/lang/ita/InstFred.Ocx
O16 - DPF: {AE563729-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - http://pointa.autodesk.com/portal/lang/ita/InstBanr.Ocx
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (Controllo AcPreview) - file://D:\Programmi\AutoCAD LT 97\AcPreview.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{A89A74EA-40ED-49D9-99F7-86FDED423F88}: NameServer = 151.99.250.2,194.243.154.62
O23 - Service: Ati HotKey Poller - Unknown owner - D:\WINNT\System32\Ati2evxx.exe
O23 - Service: CLKPCI_UNIT0 - Unknown owner - %FinsServer%\bin\clkpciunit00.exe (file missing)
O23 - Service: CLK_UNIT0 - Unknown owner - %FinsServer%\bin\clkunit.exe (file missing)
O23 - Service: CPU_UNIT - Unknown owner - %FinsServer%\bin\CpuUnit.exe (file missing)
O23 - Service: Servizio amministrativo di Gestione disco logico (dmadmin) - VERITAS Software Corp. - D:\WINNT\System32\dmadmin.exe
O23 - Service: ETN_UNIT - Unknown owner - %FinsServer%\bin\EthernetUnit.exe (file missing)
O23 - Service: FgwSocketProxy - Unknown owner - %FinsServer%\bin\FgwSocketProxy.exe (file missing)
O23 - Service: MapAgent - Unknown owner - %FinsServer%\bin\MapAgent.exe (file missing)
O23 - Service: NameSpaceServer - Unknown owner - %FinsServer%\bin\NsServer.exe (file missing)
O23 - Service: SerialUnit - Unknown owner - %FinsServer%\bin\SeriUnit.exe (file missing)
O23 - Service: SLKPCI_UNIT0 - Unknown owner - %FinsServer%\bin\slkpciunit00.exe (file missing)
O23 - Service: SysmacBoard Unit - Unknown owner - %FinsServer%\bin\SmapUnit.exe (file missing)
O23 - Service: SysmacLink Unit - Unknown owner - %FinsServer%\bin\slkcons.exe (file missing)
O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Inc. - D:\Programmi\Trend Micro\PC-cillin 2000\Tmntsrv.exe

ariciao

[psabato]

Ciao luke57.
Ho provato a riavviare dopo le ultime operazioni ed il problema sembra essere risolto!Non compare + il collegamento a exsplorer sul desktop e non mi si cambia la pagina predefinita di internet.


Cmq controlla il log che ti ho allegato.
Ancora grazie.

[Luke57]

Ciao, buona domenica, ci sono ancora processi malevoli.
Non ti spaventare dalla lunghezza del post, sono solo le istruzioni per l'uso del programma:
Scarica Ewido Security Suite http://www.ewido.net/en/download/
Installa ewido security suite
Lancia ewido, doppio click sull'icona con una grande E sul desktop.
Il programma chiederà di fare l'update, click su OK
Apparirà la schermata principale del programma dove è necessario
aggiornare ewido alle ultime definizioni delle firme dei virus.
Sulla parte sinistra della schermata principale click su update
Click su Start
L' update partirà ed una barra mostrerà la progressione dell'aggiornamento.
Una volta che l'aggiornamento sarà completato :
Riavvia in modalità provvisoria
( Avviare il computer.Subito dopo il calcolo della RAM e prima che inizi a caricarsi Windows, iniziare a premere ripetutamente il tasto F8 sulla tastiera. Continuare a farlo fino a visualizzare il menu Opzioni avanzate di Windows. Usando i tasti freccia sulla tastiera, scorrere le opzioni e selezionare il menu Modalità Provvisoria, quindi premere Invio
Su alcuni Pc il tasto potrebbe essere diverso da F8 (F4; F10 ecc... controllare in questo caso sul libretto della scheda madre)
Click su scanner
Assicurati che le seguenti caselle siano spuntate:
Binder
Crypter
Archives
Click su Start Scan
Attendi la conclusione della scansione
Mentre la scansione è attiva può presentarsi la richiesta di fare il clean del primo file infetto che trova. Scegli "clean"
e spunta la casella "Perform action on all infections" nell'angolo a sinistra della finestra in modo da far effettuare da Ewido
automaticamente l'operazione ad ogni file infetto, Click su ok.
Una volta terminata la scansione click sul pulsante in basso sulla finestra "Save report"
Salva il report sul desktop. Posta nuovo log di hijackthis

[SensationBlack]

credo anzi ne sono sicuro sono stato colpito anche io cmq questi sono i miei log aspetto vostre notizie ciao

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Programmi\Winamp\winampa.exe
C:\Programmi\MessengerPlus! 3\MsgPlus.exe
C:\Programmi\ATI Technologies\ATI.ACE\cli.exe
C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
C:\Programmi\D-Tools\daemon.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_AICN03.EXE
C:\Programmi\WinZip\WZQKPICK.EXE
C:\Programmi\Alice ti aiuta\bin\mpbtn.exe
C:\Programmi\ATI Technologies\ATI.ACE\cli.exe
C:\Programmi\ATI Technologies\ATI.ACE\cli.exe
C:\Programmi\MSN Messenger\msnmsgr.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Programmi\Windows Media Player\wmplayer.exe
C:\WINDOWS\notepad.exe
C:\Programmi\eMule\emule.exe
C:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: MSN Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\MSN Toolbar Suite\TB\02.05.0000.1082\it-it\msntb.dll
O3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\MSN Toolbar Suite\TB\02.05.0000.1082\it-it\msntb.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CnxTrApp] rundll32.exe "C:\Programmi\Pirelli\Access Gateway USB Network\CnxTrApp.dll",AppEntry -REG "Pirelli\Access Gateway USB"
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Programmi\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [WinampAgent] C:\Programmi\Winamp\winampa.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programmi\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Programmi\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programmi\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [VIRIT LITE MONITOR] C:\VEXPLITE\MONLITE.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [EPSON Stylus COLOR 580] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_AICN03.EXE /P22 "EPSON Stylus COLOR 580" /O6 "USB001" /M "Stylus COLOR 580"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = ?
O4 - Global Startup: Alice ti aiuta.lnk = C:\Programmi\Alice ti aiuta\bin\matcli.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Programmi\MSN Toolbar Suite\DS\02.05.0001.1119\it-it\bin\WindowsSearch.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programmi\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &MSN Search - res://C:\Programmi\MSN Toolbar Suite\TB\02.05.0000.1082\it-it\msntb.dll/search.htm
O8 - Extra context menu item: Apri in nuova scheda in primo piano - res://C:\Programmi\MSN Toolbar Suite\TAB\02.05.0001.1119\it-it\msntabres.dll/230?6168ff8091a42cb8ecb6fc2d381f4dc
O8 - Extra context menu item: Apri in nuova scheda in secondo piano - res://C:\Programmi\MSN Toolbar Suite\TAB\02.05.0001.1119\it-it\msntabres.dll/229?6168ff8091a42cb8ecb6fc2d381f4dc
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.master69.biz
O15 - Trusted Zone: http://www.master70.biz
O15 - Trusted Zone: http://www.master71.biz
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/kws/ ... nicode.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 7243412750
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMe ... loader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{812D474E-1EAA-47B3-9B88-57A8AF83D198}: NameServer = 85.37.17.49 85.38.28.91
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Programmi\File comuni\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe

[Luke57]

Ciao, manca la prima parte del log che permette di verificare il sistema operativo. Scarica DelDomains http://digilander.libero.it/mim/DelDomains.zip
per rimettere a posto la trusted zone ( le voci 015). Scompatta il file zip sul desktop, poi clicchi con il tasto destro sul file .inf e scegli installa. Riposta poi un log completo di hijacktis.

[dilotaiana]

ciao a tutti! anche io sono stata colpita da exsplorer, penso sempre di essere riuscita a toglierlo e invece ogni tanto mi rispunta fuori, inoltre ho fatto anche una scansione on-line con kaspersky che mi trova questi virus che non sono assolutamente riuscita a togliere:

Infected Object Name - Virus Name
C:\WINDOWS\Downloaded Program Files\1004869.exe Infected: Trojan.Win32.Dialer.q
C:\WINDOWS\Downloaded Program Files\1053611.exe Infected: Trojan.Win32.Dialer.q
C:\WINDOWS\Downloaded Program Files\1071208.exe Infected: Trojan.Win32.Dialer.q
C:\WINDOWS\Downloaded Program Files\604998.exe Infected: Trojan.Win32.Dialer.q
C:\WINDOWS\Downloaded Program Files\nd03025.exe Infected: Trojan.Win32.Dialer.cj
C:\WINDOWS\Downloaded Program Files\trucchi.exe Infected: Trojan.Win32.Diamin.gen

chi mi può aiutare?

Se può essere utile, posto anche la scansione che ho appena fatto con hijackthis:

Logfile of HijackThis v1.99.1
Scan saved at 19.33.53, on 27/01/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5299.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Programmi\Eset\nod32krn.exe
C:\WINDOWS\system32\winlogon.exe
C:\Programmi\Stardock\Object Desktop\WindowBlinds\wbload.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Anvshell.exe
C:\Programmi\Eset\nod32kui.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Programmi\TRUST\Software Bluetooth\BTTray.exe
C:\Programmi\Google\Gmail Notifier\gnotify.exe
C:\WINDOWS\System32\WISPTIS.EXE
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\WinRAR\WinRAR.exe
C:\DOCUME~1\Giulia\IMPOST~1\Temp\Rar$EX01.768\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tgcom.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=54729
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=55245&clcid={SUB_CLCID}
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Programmi\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar1.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programmi\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\MSN Apps\MSN Toolbar\01.02.4000.1001\it\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\MSN Apps\MSN Toolbar\01.02.4000.1001\it\msntb.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programmi\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar1.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmi\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Anvshell] C:\WINDOWS\Anvshell.exe
O4 - HKLM\..\Run: [nod32kui] C:\Programmi\Eset\nod32kui.exe /WAITSERVICE
O4 - HKLM\..\Run: [LogonStudio] "C:\Programmi\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Programmi\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Programmi\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DownloadAccelerator] C:\PROGRA~1\DAP\DAP.EXE /STARTUP
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Programmi\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: &Cerca con Google - res://c:\programmi\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Traduci parola in italiano - res://c:\programmi\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Aggiungi all'elenco di stampa Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Anteprima Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Link a ritroso - res://c:\programmi\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Pagine simili - res://c:\programmi\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Stampa ad alta velocità Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Stampa Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Versione cache della pagina - res://c:\programmi\google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 0072631594
O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} - http://static.zangocash.com/cab/Zango/i ... e-c403.cab
O16 - DPF: {92E7E45A-D8C8-480E-AF99-176E43997CAA} (Aurigma Image Uploader 3.5 Combo Control) - http://www.pixdiscount.it/clients/ImageUploader3.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMe ... loader.cab
O16 - DPF: {E61135DF-716D-49A7-B29B-8287A1CD072C} (WidelookX Control) - http://quattroruote.immanens.com/it/wid ... elookX.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{DA33C70B-D813-42A3-949B-12BB5F4D50EA}: NameServer = 85.37.17.57 85.38.28.80
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WB - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NOD32 Kernel Service (NOD32krn) - Unknown owner - C:\Programmi\Eset\nod32krn.exe

[Luke9792005]

Ciao.

Prima cosa: si direbbe che tu sia senza Firewall. Se è così, ti suggerisco di installarne uno il prima possibile.

Fixa questo:
O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file)

Verifica cosa sono questi:
O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} - http://static.zangocash.com/cab/Zango/i ... e-c403.cab

O16 - DPF: {92E7E45A-D8C8-480E-AF99-176E43997CAA} (Aurigma Image Uploader 3.5 Combo Control) - http://www.pixdiscount.it/clients/ImageUploader3.cab

O16 - DPF: {E61135DF-716D-49A7-B29B-8287A1CD072C} (WidelookX Control) - http://quattroruote.immanens.com/it/wid ... elookX.cab

Ciao