aocj1.exe

[tessy]

ciao da qualche giorno zonealarm mi chiede se voglio far connettere qst exe. facendo la ricerca risulta che si trova nella cartella windows\prefech. ho notato anche che l'antivus antivir non mi compare più nelle applicazzioni vicino l'orologio...
in definitiva c'è una connessione tra qst 2 programmi?
è attivo il mio antivirus o no?
grazie 1000!

[Dylan666]

se aocj1.exe non lo conosci direi che è sospetto. Se l'icona dell'antivirus non compare sicuramente il programma ha qualcosa che non va. Posta un log di HijackThsi:

http://www.pc-facile.com/guida_hijackthis_t148946/

[tessy]

ecco a te....

Logfile of HijackThis v1.99.1
Scan saved at 10.54.39, on 29/07/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\AGRSMMSG.exe
D:\PROGRA~1\LAUNCH~1\CPLBY27.EXE
D:\Programmi\Musicmatch\Musicmatch Jukebox\mmtask.exe
D:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe
D:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe
D:\WINDOWS\system32\igfxtray.exe
D:\WINDOWS\system32\hkcmd.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\WINDOWS\Temp\aocj1.exe
D:\Programmi\Java\jre1.5.0_07\bin\jusched.exe
D:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe
D:\Programmi\AntiVir PersonalEdition Classic\sched.exe
D:\Programmi\AntiVir PersonalEdition Classic\avguard.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\ZoneLabs\vsmon.exe
D:\WINDOWS\system32\wscntfy.exe
D:\WINDOWS\system32\wuauclt.exe
D:\Programmi\Internet Explorer\IEXPLORE.EXE
D:\Programmi\Adobe\Acrobat 7.0\Reader\AcroRd32Info.exe
D:\Documents and Settings\teresa\Documenti\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.libero.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=D:\WINDOWS\system32\userinit.exe,,
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Class - {72753616-FD28-277B-D335-F518608DBAE4} - D:\WINDOWS\akftr1.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\programmi\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Programmi\Yahoo!\Companion\Installs\cpn0\yt.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\programmi\google\googletoolbar2.dll
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LManager] D:\PROGRA~1\LAUNCH~1\CPLBY27.EXE
O4 - HKLM\..\Run: [mmtask] D:\Programmi\Musicmatch\Musicmatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [avgnt] "D:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Zone Labs Client] D:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [IgfxTray] D:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] D:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] D:\Programmi\File comuni\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [aocj1.exe] D:\WINDOWS\Temp\aocj1.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Programmi\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "D:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe"
O8 - Extra context menu item: &Cerca con Google - res://d:\programmi\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Traduci parola in italiano - res://d:\programmi\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Link a ritroso - res://d:\programmi\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Pagine simili - res://d:\programmi\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Versione cache della pagina - res://d:\programmi\google\GoogleToolbar2.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programmi\Java\jre1.5.0_07\bin\npjpi150_07.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programmi\Java\jre1.5.0_07\bin\npjpi150_07.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.1987324.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -

http://messenger.zone.msn.com/binary/Me ... b31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - D:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - D:\Programmi\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - D:\Programmi\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - D:\WINDOWS\system32\ZoneLabs\vsmon.exe


GRAZIE, ora?

[quizface]

Copia il tuo report qui' vedrai da solo i risultati

[BilloKenobi]

ciao teresa! ti sei beccato il linkoptimizer.

segui questaguida
nel log sono presenti delle voci infette dal worm, ossia
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {72753616-FD28-277B-D335-F518608DBAE4} - D:\WINDOWS\akftr1.dll (file missing)
O4 - HKLM\..\Run: [aocj1.exe] D:\WINDOWS\Temp\aocj1.exe

per rimuoverle segui quanto detto in quella guida

per quanto riguarda altre voci hijackthis infette, fai così. aprì in provvisoria, disabilitando il ripristino configurazione di sistema.
poi fixa
O15 - Trusted Zone: http://www.1987324.com

[BilloKenobi]

chiedo scusa se uso due post di fila. non incollare il log nella pagina indicata da quizface (quizface, sorry, non me ne volere). è molto imprecisa come soluzione.

comunque il linkoptimizer è in rapida diffusione

[Dylan666]

Dalla finestra del Ctrl+Alt+Canc termina questi processi:

D:\WINDOWS\Temp\aocj1.exe
D:\PROGRA~1\LAUNCH~1\CPLBY27.EXE (solo se non lo conosci)

Poi apri HijackThis, premi il secondo bottone dall'altoe clicca nel quadratino vicino a queste voci:

O2 - BHO: Class - {72753616-FD28-277B-D335-F518608DBAE4} - D:\WINDOWS\akftr1.dll (file missing)

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Programmi\Yahoo!\Companion\Installs\cpn0\yt.dll (file missing)

O4 - HKLM\..\Run: [LManager] D:\PROGRA~1\LAUNCH~1\CPLBY27.EXE (solo se non lo conosci)

O4 - HKLM\..\Run: [aocj1.exe] D:\WINDOWS\Temp\aocj1.exe

O15 - Trusted Zone: http://www.1987324.com

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -

Poi premi Fix Checked. Resetta, fai un nuovo log e vedi se si è ricreato qualcosa

[quizface]

chiedo scusa se uso due post di fila. non incollare il log nella pagina indicata da quizface (quizface, sorry, non me ne volere). è molto imprecisa come soluzione.

comunque il linkoptimizer è in rapida diffusione

Benvenga chi ne sa di piu'

[tessy]

Dalla finestra del Ctrl+Alt+Canc termina questi processi:

D:\WINDOWS\Temp\aocj1.exe
D:\PROGRA~1\LAUNCH~1\CPLBY27.EXE (solo se non lo conosci)

Poi apri HijackThis, premi il secondo bottone dall'altoe clicca nel quadratino vicino a queste voci:

O2 - BHO: Class - {72753616-FD28-277B-D335-F518608DBAE4} - D:\WINDOWS\akftr1.dll (file missing)

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Programmi\Yahoo!\Companion\Installs\cpn0\yt.dll (file missing)

O4 - HKLM\..\Run: [LManager] D:\PROGRA~1\LAUNCH~1\CPLBY27.EXE (solo se non lo conosci)

O4 - HKLM\..\Run: [aocj1.exe] D:\WINDOWS\Temp\aocj1.exe

O15 - Trusted Zone: http://www.1987324.com

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -

Poi premi Fix Checked. Resetta, fai un nuovo log e vedi se si è ricreato qualcosa

da ctrl alt canc nn compaiono le voci che m hai elencato.
ho usato poi HijackThis ma al riavvio tutto quello che avevo cancellato si è ricreato. Cmq prima del riavvio l'antivirus era ricomparso nella barra vicino l'orologio mentre l'icona del volume no! (ed è impostata la spunta...)
prima di leggere ipost, inoltre ero andata in applicazioni installazioni e avevo "disinstallato! linkoptimazer (nn sapendo cos'era) e boungiour.
grazie

[tessy]

chiedo scusa se uso due post di fila. non incollare il log nella pagina indicata da quizface (quizface, sorry, non me ne volere). è molto imprecisa come soluzione.

comunque il linkoptimizer è in rapida diffusione

mi consigli di mettere la directory del log?

[Dylan666]

In Ctrl+Alt+Canc non dovevi cercare D:\WINDOWS\Temp\aocj1.exe ma solo aocj1.exe ovviamente. Mi pare strano che non comparisse.

Vai in modalità provvisoria, ri-leva le voci che ti avevo detto prima con HijackThis e in più cestina a mano D:\WINDOWS\Temp\aocj1.exe e D:\PROGRA~1\LAUNCH~1\CPLBY27.EXE attivando la visualizzazione dei file nascosti se necessario

[tessy]

In Ctrl+Alt+Canc non dovevi cercare D:\WINDOWS\Temp\aocj1.exe ma solo aocj1.exe ovviamente. Mi pare strano che non comparisse.

Vai in modalità provvisoria, ri-leva le voci che ti avevo detto prima con HijackThis e in più cestina a mano D:\WINDOWS\Temp\aocj1.exe e D:\PROGRA~1\LAUNCH~1\CPLBY27.EXE attivando la visualizzazione dei file nascosti se necessario

come faccio ad entrare in provvisoria?
ho xp

[Dylan666]

riavvia il PC e premi F8 prima della prima schermata di windows

[tessy]

guarda....

Logfile of HijackThis v1.99.1
Scan saved at 3.31.54, on 31/07/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\AGRSMMSG.exe
D:\Programmi\Musicmatch\Musicmatch Jukebox\mmtask.exe
D:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe
D:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe
D:\WINDOWS\system32\igfxtray.exe
D:\WINDOWS\system32\hkcmd.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\Programmi\Java\jre1.5.0_07\bin\jusched.exe
D:\Programmi\Kodak\Kodak EasyShare software\bin\EasyShare.exe
D:\Programmi\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
D:\Programmi\AntiVir PersonalEdition Classic\sched.exe
D:\Programmi\AntiVir PersonalEdition Classic\avguard.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\ZoneLabs\vsmon.exe
D:\WINDOWS\system32\wscntfy.exe
D:\WINDOWS\system32\wuauclt.exe
D:\Documents and Settings\teresa\Documenti\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.libero.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=D:\WINDOWS\system32\userinit.exe,,
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [mmtask] D:\Programmi\Musicmatch\Musicmatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [avgnt] "D:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Zone Labs Client] D:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [IgfxTray] D:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] D:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] D:\Programmi\File comuni\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Programmi\Java\jre1.5.0_07\bin\jusched.exe
O4 - Global Startup: Kodak EasyShare software.lnk = D:\Programmi\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: KODAK Software Updater.lnk = D:\Programmi\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programmi\Java\jre1.5.0_07\bin\npjpi150_07.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programmi\Java\jre1.5.0_07\bin\npjpi150_07.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - D:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - D:\Programmi\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - D:\Programmi\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - D:\WINDOWS\system32\ZoneLabs\vsmon.exe

[Dylan666]

Tutto pulito, devi solo levare questo
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)

Mentre lo fai però devi tenere chiuse TUTTE le finestre di Internet Explorer

[tessy]

ho usato haj.. varie volte e il file ricompare sempre.
ora però sembra tutto ok...
guarda...
Logfile of HijackThis v1.99.1
Scan saved at 4.18.22, on 31/07/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\AGRSMMSG.exe
D:\Programmi\Musicmatch\Musicmatch Jukebox\mmtask.exe
D:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe
D:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe
D:\WINDOWS\system32\igfxtray.exe
D:\WINDOWS\system32\hkcmd.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\Programmi\Java\jre1.5.0_07\bin\jusched.exe
D:\Programmi\Kodak\Kodak EasyShare software\bin\EasyShare.exe
D:\Programmi\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
D:\Programmi\AntiVir PersonalEdition Classic\sched.exe
D:\Programmi\AntiVir PersonalEdition Classic\avguard.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\ZoneLabs\vsmon.exe
D:\WINDOWS\system32\wscntfy.exe
D:\Programmi\MSN Messenger\msnmsgr.exe
D:\Programmi\AntiVir PersonalEdition Classic\avcenter.exe
D:\Programmi\AntiVir PersonalEdition Classic\avscan.exe
D:\Programmi\Internet Explorer\IEXPLORE.EXE
D:\Documents and Settings\teresa\Documenti\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.libero.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=D:\WINDOWS\system32\userinit.exe,,
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [mmtask] D:\Programmi\Musicmatch\Musicmatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [avgnt] "D:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Zone Labs Client] D:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [IgfxTray] D:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] D:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] D:\Programmi\File comuni\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Programmi\Java\jre1.5.0_07\bin\jusched.exe
O4 - Global Startup: Kodak EasyShare software.lnk = D:\Programmi\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: KODAK Software Updater.lnk = D:\Programmi\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programmi\Java\jre1.5.0_07\bin\npjpi150_07.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programmi\Java\jre1.5.0_07\bin\npjpi150_07.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - D:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - D:\Programmi\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - D:\Programmi\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - D:\WINDOWS\system32\ZoneLabs\vsmon.exe

[Dylan666]

Perfetto

[tessy]

credo che non sia stato tolto il virus...l'antivirus e il comando del volume continuano a non avviarsi....

Logfile of HijackThis v1.99.1
Scan saved at 21.08.49, on 30/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\AGRSMMSG.exe
D:\Programmi\Musicmatch\Musicmatch Jukebox\mmtask.exe
D:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe
D:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe
D:\WINDOWS\system32\igfxtray.exe
D:\WINDOWS\system32\hkcmd.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\Programmi\Java\jre1.5.0_07\bin\jusched.exe
D:\WINDOWS\Temp\aocj1.exe
D:\Programmi\Kodak\Kodak EasyShare software\bin\EasyShare.exe
D:\Programmi\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
D:\Programmi\AntiVir PersonalEdition Classic\sched.exe
D:\Programmi\AntiVir PersonalEdition Classic\avguard.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\ZoneLabs\vsmon.exe
D:\WINDOWS\system32\wscntfy.exe
D:\Programmi\MSN Messenger\msnmsgr.exe
D:\WINDOWS\system32\svchost.exe
D:\Programmi\Internet Explorer\IEXPLORE.EXE
D:\WINDOWS\system32\SNDVOL32.EXE
D:\Programmi\Microsoft Office\OFFICE11\WINWORD.EXE
D:\Documents and Settings\teresa\Documenti\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.libero.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=D:\WINDOWS\system32\userinit.exe,,
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Class - {72753616-FD28-277B-D335-F518608DBAE4} - D:\WINDOWS\akftr1.dll (file missing)
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [mmtask] D:\Programmi\Musicmatch\Musicmatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [avgnt] "D:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Zone Labs Client] D:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [IgfxTray] D:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] D:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] D:\Programmi\File comuni\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Programmi\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [aocj1.exe] D:\WINDOWS\Temp\aocj1.exe
O4 - Global Startup: Kodak EasyShare software.lnk = D:\Programmi\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: KODAK Software Updater.lnk = D:\Programmi\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programmi\Java\jre1.5.0_07\bin\npjpi150_07.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programmi\Java\jre1.5.0_07\bin\npjpi150_07.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - D:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - D:\Programmi\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - D:\Programmi\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - D:\WINDOWS\system32\ZoneLabs\vsmon.exe

[Dylan666]

Sono ricomparsi questi da togliere...

O4 - HKLM\..\Run: [aocj1.exe] D:\WINDOWS\Temp\aocj1.exe D:\WINDOWS\Temp\aocj1.exe

Fai come prima da modalità provvisoria. Disinstalla, resetta e reinstalla l'antivirus.

[tessy]

ciao mi puoi consigliare un antivirus, che sia in grado di riconoscere e bloccare qst virus.... antivir nn l'ha mai visto....