virus

[salsero]

Ciao a tutti c’è qualcuno che mi può aiutare:
mi si è installato nel pc portatile un programma che non riesco a eliminare
il nome del programma è Downloader.Zlob.bpn
è installato nella seguente posizione: C:\Programmi|internet Security\pmmmnt.exe

[andorra24]

Ciao, scarica SmitFraudfix e decomprimilo in una cartella a tua scelta estraendo tutti i file:
http://siri.urz.free.fr/Fix/SmitfraudFix.zip

Riavvia in modalità provvisoria

Apri la cartella che contiene SmitfraudFix, avvia smitfraudfix.cmd
Seleziona opzione #2 - Clean cliccando sul 2 e premi Invio.
Riceverai questo messaggio: Registry cleaning - Do you want to clean the registry ?
Rispondi Sì cliccando Y e premi invio.
Rispondi Sì ( Y) ad eventuali altre domande

eseguita tutta la scansione riavvia il pc normalmente e posta nel forum il log della scansione.

[salsero]

ok ho fatto quello che mi hai consigliato
questo è il rapporto della scansione:
Ora che cosa devofare?
Grazie
Roberto



SmitFraudFix v2.155

Scan done at 21.01.06,20, 25/03/2007
Run from C:\Documents and Settings\Fugazzi\Documenti\Programmi scaricati\SmitfraudFix
OS: Microsoft Windows XP [Versione 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{ceca6f2b-247b-4ece-9b7a-d0135c8036fc}"="chitosan"

[HKEY_CLASSES_ROOT\CLSID\{ceca6f2b-247b-4ece-9b7a-d0135c8036fc}\InProcServer32]
@="C:\WINDOWS\system32\onwtj.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{ceca6f2b-247b-4ece-9b7a-d0135c8036fc}\InProcServer32]
@="C:\WINDOWS\system32\onwtj.dll"


»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\WINDOWS\system32\onwtj.dll Deleted
C:\DOCUME~1\ALLUSE~1.WIN\MENUAV~1\Online Security Guide.url Deleted
C:\DOCUME~1\ALLUSE~1.WIN\MENUAV~1\Security Troubleshooting.url Deleted
C:\DOCUME~1\Fugazzi\PREFER~1\Online Security Test.url Deleted
C:\Programmi\Internet Security\ Deleted
C:\Programmi\SpyLocked\ Deleted

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

[andorra24]

Ora dovresti essere a posto. Smitfraudfix ha eliminato diverse cose.

[salsero]

Grazie 1000
ora funzona tutto bene.
Ciao
B serata
Roberto