ciao a tutti
come tutti anch'io ho problemi con questo _p9hEPQkbj.exe ed exsporer
questi file li ho prima cancellati manualmente ma quando mi collego a internet mi ricompaiono (oggi stranamente no!)
ho scaricato HijackThis, tutto bene, ho fatto la scansione con questo risultato:
Logfile of HijackThis v1.99.1
Scan saved at 20.02.11, on 09/01/06
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.00 (5.00.2614.3500)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAMMI\FILE COMUNI\SYMANTEC SHARED\CCEVTMGR.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAMMI\FILE COMUNI\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAMMI\CREATIVE\SBLIVE\AUDIOHQ\AHQTB.EXE
C:\PROGRAMMI\HEWLETT-PACKARD\HP PRECISIONSCAN\PRECISIONSCAN\HPPPTA.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\LOGITECH\MOUSE\SYSTEM\EM_EXEC.EXE
D:\PROGRAMMI\WINAMP\WINAMP5\WINAMPA.EXE
D:\PROGRAMMI\ULEAD SYSTEMS\ULEAD PHOTO EXPLORER 8.0 SE BASIC\MONITOR.EXE
C:\WINDOWS\SLA.EXE
D:\PROGRAMMI\COMPUTER IDEA\SPAM\SPAMIHILATOR\SPAMIHILATOR.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAMMI\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\NOTEPAD.EXE
D:\PROGRAMMI\HIJACKTHIS\HIJACKTHIS.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://g.msn.it/0SEITIT/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.tiscalinet.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://www.tiscalinet.it
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmi\Norton AntiVirus\NavShExt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\PROGRAMMI\ACROBAT\ACROBAT 5.0.5\READER\ACTIVEX\ACROIEHELPER.OCX
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmi\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [LaunchAttuneSetup] C:\WINDOWS\SYSTEM\msiexec.exe /i "D:\COREL 10\Corel\Graphics10\Aveo\09\01\attune.msi" /q
O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AudioHQ] C:\Programmi\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [hpppta] C:\Programmi\Hewlett-Packard\HP PrecisionScan\PrecisionScan\hpppta.exe /ICON
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [EM_EXEC] c:\logitech\mouse\system\em_exec.exe
O4 - HKLM\..\Run: [Norton Antivirus AV] C:\WINDOWS\FVProtect.exe
O4 - HKLM\..\Run: [WinampAgent] D:\programmi\winamp\winamp5\winampa.exe
O4 - HKLM\..\Run: [Ulead AutoDetector] D:\Programmi\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
O4 - HKLM\..\Run: [sla] C:\WINDOWS\sla.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Programmi\File comuni\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [Spamihilator] "D:\programmi\computer idea\spam\Spamihilator\spamihilator.exe"
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
O9 - Extra button: PhoenixNet - {f2fd56e0-3dd0-11d7-84bc-c6069ff58346} -
http://www.seqdl.com/servlets/Redir?BID=65457&CID=9875 (file missing)
O12 - Plugin for .EXE: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin2.dll
O12 - Plugin for .mid: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin2.dll
O12 - Plugin for .mp3: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin3.dll
O12 - Plugin for .mov: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O12 - Plugin for .mpg: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin3.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.tiscalinet.it
O14 - IERESET.INF: MS_START_PAGE_URL=http://www.microsoft.com/italy/start
O15 - Trusted Zone:
http://www.redfunny.com
O15 - Trusted Zone:
http://www.skymasters.biz
O15 - Trusted Zone:
http://www.archiviosex.net
O16 - DPF: {48C20DEE-B00A-11D4-9B2F-0060975D990E} (Hi2Lobby Class) -
http://62.27.8.33/lobby/atlclient.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) -
http://fdl.msn.com/public/chat/msnchat45.cab
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) -
http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {00000000-0000-0000-0000-000020030000} -
http://www.accessoveloce.com/mar/x/igmp1f.exe
il problema è che quando cerco di fixare le voci O15 mi si blocca il programma e quindi non risolvo niente!!!
io non ci capisco tantissimo di queste voci, ma se vedete qualcosa che non va dite pure.
non so quindi come eliminare il blocco di HijackThis per poter eliminare quindi i file "sospetti"
in alternativa: esiste un modo non troppo complicato per eliminare _p9hEPQkbj.exe?
male che vada mi toccherà portare il computer dal tecnico!!! ^_^
p.s. quando mi collego a internet mi chiede 2 volte "Verifying user name and password..." cosa che prima dell'"infezione" non succedeva e inoltre ci mette molto di più a connettersi, e inoltre crea una nuova connessione chiamata "connessione predefinita", qualcun altro ha lo stesso problema?
Grazie a chi mi risponderà!!!
Registrazione
di Luke57 » 07/01/06 19:38 
