computer lentissimo

[yuman]

Salve a tutti, ho il mio computer che da qualche giorno è diventato lentissimo in tutte le operazioni.
Ho fatto un log con HijackThis, qualcuno mi puo dire quale può essere il problema?
Grazie a tutti.

Logfile of HijackThis v1.99.1
Scan saved at 9.48.18, on 24/07/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINNT\System32\svchost.exe
C:\PROGRA~1\Alice\ALICEE~1\app\pppoeservice.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\Explorer.EXE
C:\WINNT\Mixer.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\kybrddd_6.exe
C:\dfndrdd_6.exe
C:\Programmi\webHancer\Programs\whagent.exe
C:\Programmi\webHancer\Programs\whsurvey.exe
C:\nwnmdd_6.exe
C:\WINNT\system32\UpMsnGraonders.exe
C:\Programmi\Java\jre1.5.0_03\bin\jusched.exe
C:\Programmi\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRA~1\FILECO~1\ADAPTE~1\CreateCD\CREATE~1.EXE
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\RUNDLL32.EXE
C:\WINNT\system32\internat.exe
C:\DOCUME~1\SISSY1\DATIAP~1\MCROSO~1\winlogon.exe
C:\WINNT\system32\?racle\l?gonui.exe
C:\Programmi\Outlook Express\csapi3t1.exe
C:\Programmi\DNA Digital Media Group\Nestle Fitness Virtual Coach\dcu.exe
C:\Programmi\DNA Digital Media Group\Nestle Fitness Virtual Coach\Reminder.exe
C:\Programmi\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://gw.aliceadsl.it/home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fornito da Alice
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://www.lacasadialice.it
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: (no name) - {B7065845-9CDC-A373-F7BD-942C846A0FCB} - C:\WINNT\system32\kbicb.dll
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - {B7065845-9CDC-A373-F7BD-942C846A0FCB} - C:\WINNT\system32\kbicb.dll
O2 - BHO: WhIeHelperObj Class - {c900b400-cdfe-11d3-976a-00e02913a9e0} - C:\Programmi\webHancer\programs\whiehlpr.dll
O2 - BHO: (no name) - {F2FA09FB-EE7A-46d8-9145-A1EEF7850052} - C:\WINNT\system32\awvst.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Microsoft (R) Windows Update Manager Tool] C:\sck32.exe
O4 - HKLM\..\Run: [keyboard] C:\\kybrddd_6.exe
O4 - HKLM\..\Run: [defender] C:\\dfndrdd_6.exe
O4 - HKLM\..\Run: [webHancer Agent] C:\Programmi\webHancer\Programs\whagent.exe
O4 - HKLM\..\Run: [webHancer Survey Companion] C:\Programmi\webHancer\Programs\whsurvey.exe
O4 - HKLM\..\Run: [newname] C:\\nwnmdd_6.exe
O4 - HKLM\..\Run: [FiresWallservices] UpMsnGraonders.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Programmi\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [CreateCD50] C:\PROGRA~1\FILECO~1\ADAPTE~1\CreateCD\CREATE~1.EXE -r
O4 - HKLM\..\Run: [implib] rundll32.exe C:\WINNT\system32\implib.dll,start
O4 - HKLM\..\Run: [pohc8f0a] RUNDLL32.EXE w00e9112.dll,n 001c8f090000000a00e9112
O4 - HKLM\..\RunServices: [FiresWallservices] UpMsnGraonders.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [Auab] "C:\DOCUME~1\SISSY1\DATIAP~1\MCROSO~1\winlogon.exe" -vt yazr
O4 - HKCU\..\Run: [Imvt] C:\WINNT\system32\?racle\l?gonui.exe
O4 - Startup: DCU.lnk = C:\Programmi\DNA Digital Media Group\Nestle Fitness Virtual Coach\dcu.exe
O4 - Startup: reminder.lnk = C:\Programmi\DNA Digital Media Group\Nestle Fitness Virtual Coach\Reminder.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: Alice - {B1B895CE-73ED-4C5D-B4E8-E14826EFA8CE} - http://gw.aliceadsl.it/alice (file missing) (HKCU)
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O14 - IERESET.INF: START_PAGE_URL=http://gw.aliceadsl.it/home
O20 - AppInit_DLLs: C:\WINNT\system32\msiexec.dll
O20 - Winlogon Notify: awvst - C:\WINNT\SYSTEM32\awvst.dll
O20 - Winlogon Notify: Explorer - C:\WINNT\system32\dcvoice.dll
O20 - Winlogon Notify: Installer - C:\WINNT\system32\vrajet32.dll
O20 - Winlogon Notify: IPConfTSP - C:\WINNT\system32\dcvoice.dll
O20 - Winlogon Notify: ModuleUsage - C:\WINNT\system32\dcvoice.dll
O20 - Winlogon Notify: MS-DOS Emulation - C:\WINNT\system32\dacprop.dll
O20 - Winlogon Notify: NetCache - C:\WINNT\system32\dcvoice.dll
O20 - Winlogon Notify: Nls - C:\WINNT\system32\dacprop.dll
O20 - Winlogon Notify: Reliability - C:\WINNT\system32\dacprop.dll
O20 - Winlogon Notify: Run - C:\WINNT\system32\vrajet32.dll
O20 - Winlogon Notify: RunOnce - C:\WINNT\system32\vrajet32.dll
O20 - Winlogon Notify: RunOnceEx - C:\WINNT\system32\dcvoice.dll
O20 - Winlogon Notify: Setup - C:\WINNT\system32\dcvoice.dll
O20 - Winlogon Notify: SharedDLLs - C:\WINNT\system32\dacprop.dll
O20 - Winlogon Notify: Shell Extensions - C:\WINNT\system32\dacprop.dll
O20 - Winlogon Notify: ShellCompatibility - C:\WINNT\system32\q4860elsehq60.dll (file missing)
O20 - Winlogon Notify: ShellScrap - C:\WINNT\system32\dmcapi.dll
O20 - Winlogon Notify: ShellServiceObjectDelayLoad - C:\WINNT\system32\dacprop.dll
O20 - Winlogon Notify: StillImage - C:\WINNT\system32\dmcapi.dll
O20 - Winlogon Notify: Syncmgr - C:\WINNT\system32\vrajet32.dll
O20 - Winlogon Notify: Telephony - C:\WINNT\system32\dmcapi.dll
O20 - Winlogon Notify: Unimodem - C:\WINNT\system32\dmcapi.dll
O20 - Winlogon Notify: Uninstall - C:\WINNT\system32\dacprop.dll
O20 - Winlogon Notify: URL - C:\WINNT\system32\vrajet32.dll
O20 - Winlogon Notify: WebCheck - C:\WINNT\system32\dacprop.dll
O20 - Winlogon Notify: Welcome - C:\WINNT\system32\dmcapi.dll
O20 - Winlogon Notify: WindowsUpdate - C:\WINNT\system32\vrajet32.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Servizio amministrativo di Gestione disco logico (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: PPPoE Service (PPPoEService) - Unknown owner - C:\PROGRA~1\Alice\ALICEE~1\app\pppoeservice.exe
O23 - Service: Windows Update Manager Tool (UpdateManagerTool) - Unknown owner - C:\sck32.exe (file missing)

[Luke57]

Ciao, hai nel computer anche una variante del Look2me oltre a numerose altre cose ( è un miracolo che si accenda)

Scarica questo tool:
http://www.atribune.org/ccount/click.php?id=7

CITAZIONE
* Chiudere tutti i programmi prima di continuare.
* Cliccare su Look2Me-Destroyer.exe per eseguirlo.
* Mettere la spunta a "next to Run this program as a task"
* Riceverete un messaggio messaggio che Look2Me-Destroyer si chiuderà e riaprirà in 1 minuto. CliccateOK
* Quando Look2Me-Destroyer si riapre, Clicca sul bottone "Scan for L2M " , le icone del desktop scompariranno, questo è normale.
* Una volta fatta la scansione, cliccare su "Remove L2M".
* Riceverete il messaggio scansione effettuata, cliccare OK.
* Quando completato, vedrete messaggio: " Done removing infected files! Look2Me-Destroyer will now shutdown your computer", cliccare OK.

Scarica questo tool:
http://securityresponse.symantec.com/av ... Hancer.exe
ed eseguilo sul computer

Scarica stinger da qui:
http://vil.nai.com/vil/stinger/

esegui una scansione su tutte le unità fisse

Dopo aver eseguito queste operazioni, collegati qui:
http://www.bitdefender.com/scan8/ie.html
fai una scansione on line

Riallega poi un post di hijackthis

[yuman]

non posso collegarmi ad internet.
c'è un'altra procedura senza dovermi collegare alla rete?
Grazie, ciao.

[Luke57]

Ciao, io non vedo soluzione alternativa.....

[yuman]

Sono riuscito a trovare il software per Look2Me e dovrei essere riuscito ad eliminare il virus.
Ti posto comunque il log, se puoi dargli un'occhiata.
Grazie mille.

Logfile of HijackThis v1.99.1
Scan saved at 16.27.44, on 24/07/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Programmi\AntiVir PersonalEdition Classic\sched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINNT\System32\svchost.exe
C:\PROGRA~1\Alice\ALICEE~1\app\pppoeservice.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\Mixer.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\kybrddd_6.exe
C:\dfndrdd_6.exe
C:\Programmi\webHancer\Programs\whagent.exe
C:\Programmi\webHancer\Programs\whsurvey.exe
C:\WINNT\system32\UpMsnGraonders.exe
C:\Programmi\Java\jre1.5.0_03\bin\jusched.exe
C:\Programmi\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\RUNDLL32.EXE
C:\PROGRA~1\FILECO~1\ADAPTE~1\CreateCD\CREATE~1.EXE
C:\WINNT\system32\internat.exe
C:\DOCUME~1\SISSY1\DATIAP~1\MCROSO~1\winlogon.exe
C:\WINNT\system32\?racle\l?gonui.exe
C:\Programmi\Autoruns\wautoruns.exe
C:\Programmi\DNA Digital Media Group\Nestle Fitness Virtual Coach\dcu.exe
C:\Programmi\DNA Digital Media Group\Nestle Fitness Virtual Coach\Reminder.exe
C:\Programmi\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://gw.aliceadsl.it/home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fornito da Alice
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://www.lacasadialice.it
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: (no name) - {B7065845-9CDC-A373-F7BD-942C846A0FCB} - C:\WINNT\system32\kbicb.dll
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - {B7065845-9CDC-A373-F7BD-942C846A0FCB} - C:\WINNT\system32\kbicb.dll
O2 - BHO: WhIeHelperObj Class - {c900b400-cdfe-11d3-976a-00e02913a9e0} - C:\Programmi\webHancer\programs\whiehlpr.dll
O2 - BHO: (no name) - {F2FA09FB-EE7A-46d8-9145-A1EEF7850052} - C:\WINNT\system32\awvst.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Microsoft (R) Windows Update Manager Tool] C:\sck32.exe
O4 - HKLM\..\Run: [keyboard] C:\\kybrddd_6.exe
O4 - HKLM\..\Run: [defender] C:\\dfndrdd_6.exe
O4 - HKLM\..\Run: [webHancer Agent] C:\Programmi\webHancer\Programs\whagent.exe
O4 - HKLM\..\Run: [webHancer Survey Companion] C:\Programmi\webHancer\Programs\whsurvey.exe
O4 - HKLM\..\Run: [newname] C:\\kybrdac_6.exe
O4 - HKLM\..\Run: [FiresWallservices] UpMsnGraonders.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Programmi\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [implib] rundll32.exe C:\WINNT\system32\implib.dll,start
O4 - HKLM\..\Run: [pohc8f0a] RUNDLL32.EXE w00e9112.dll,n 001c8f090000000a00e9112
O4 - HKLM\..\Run: [avgnt] "C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [CreateCD50] C:\PROGRA~1\FILECO~1\ADAPTE~1\CreateCD\CREATE~1.EXE -r
O4 - HKLM\..\RunServices: [FiresWallservices] UpMsnGraonders.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [Auab] "C:\DOCUME~1\SISSY1\DATIAP~1\MCROSO~1\winlogon.exe" -vt yazr
O4 - HKCU\..\Run: [Imvt] C:\WINNT\system32\?racle\l?gonui.exe
O4 - Startup: DCU.lnk = C:\Programmi\DNA Digital Media Group\Nestle Fitness Virtual Coach\dcu.exe
O4 - Startup: reminder.lnk = C:\Programmi\DNA Digital Media Group\Nestle Fitness Virtual Coach\Reminder.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: Alice - {B1B895CE-73ED-4C5D-B4E8-E14826EFA8CE} - http://gw.aliceadsl.it/alice (file missing) (HKCU)
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O14 - IERESET.INF: START_PAGE_URL=http://gw.aliceadsl.it/home
O20 - AppInit_DLLs: C:\WINNT\system32\msiexec.dll
O20 - Winlogon Notify: awvst - C:\WINNT\SYSTEM32\awvst.dll
O20 - Winlogon Notify: ExtShellViews - C:\WINNT\system32\fp8403lqe.dll (file missing)
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmi\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Servizio amministrativo di Gestione disco logico (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: PPPoE Service (PPPoEService) - Unknown owner - C:\PROGRA~1\Alice\ALICEE~1\app\pppoeservice.exe
O23 - Service: Windows Update Manager Tool (UpdateManagerTool) - Unknown owner - C:\sck32.exe (file missing)

[Luke57]

Ciao, devi utilizzare anche le altre utility;

Scarica sempre Fixwebhancer e Stinger nei link di cui sopra

Procedi così (magari stampa la pagina):

Disistallala webhancer dal pannello di controllo

esegui fixwebhancer

scarica Lspfix:
http://www.xdownload.it/go.asp?idl=2273
e lo tieni da parte.

Scarica Cwshrwdder e lo tieni da parte
http://cwshredder.net/bin/CWShredder.exe

Apri hijackthis, con tutte le applicazioni chiuse e disconnesso da internet, premi ““open the misc tools section”, poi “open process manger”, individua ed evidenzia i processi (se ci sono sempre tutti):
C:\kybrddd_6.exe
C:\dfndrdd_6.exe
C:\Programmi\webHancer\Programs\whagent.exe
C:\Programmi\webHancer\Programs\whsurvey.exe
C:\nwnmdd_6.exe
C:\WINNT\system32\UpMsnGraonders.exe
C:\DOCUME~1\SISSY1\DATIAP~1\MCROSO~1\winlogon.exe
C:\WINNT\system32\?racle\l?gonui.exe3
Premi kill process.

Torni alla pagina principale con back, premi “scan”, cerchi e spunti le seguenti voci (se ci sono tutte):
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - {B7065845-9CDC-A373-F7BD-942C846A0FCB} - C:\WINNT\system32\kbicb.dll
O2 - BHO: WhIeHelperObj Class - {c900b400-cdfe-11d3-976a-00e02913a9e0} - C:\Programmi\webHancer\programs\whiehlpr.dll
O2 - BHO: (no name) - {F2FA09FB-EE7A-46d8-9145-A1EEF7850052} - C:\WINNT\system32\awvst.dll
O4 - HKLM\..\Run: [Microsoft (R) Windows Update Manager Tool] C:\sck32.exe
O4 - HKLM\..\Run: [keyboard] C:\\kybrddd_6.exe
O4 - HKLM\..\Run: [defender] C:\\dfndrdd_6.exe
O4 - HKLM\..\Run: [webHancer Agent] C:\Programmi\webHancer\Programs\whagent.exe
O4 - HKLM\..\Run: [webHancer Survey Companion] C:\Programmi\webHancer\Programs\whsurvey.exe
O4 - HKLM\..\Run: [newname] C:\\nwnmdd_6.exe
O4 - HKLM\..\Run: [FiresWallservices] UpMsnGraonders.exe
O4 - HKLM\..\Run: [implib] rundll32.exe C:\WINNT\system32\implib.dll,start
O4 - HKLM\..\Run: [pohc8f0a] RUNDLL32.EXE w00e9112.dll,n 001c8f090000000a00e9112
O4 - HKLM\..\RunServices: [FiresWallservices] UpMsnGraonders.exe
O4 - HKCU\..\Run: [Auab] "C:\DOCUME~1\SISSY1\DATIAP~1\MCROSO~1\winlogon.exe" -vt yazr
O4 - HKCU\..\Run: [Imvt] C:\WINNT\system32\?racle\l?gonui.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O20 - Winlogon Notify: awvst - C:\WINNT\SYSTEM32\awvst.dll
O20 - Winlogon Notify: ExtShellViews - C:\WINNT\system32\fp8403lqe.dll (file missing)
O23 - Service: Windows Update Manager Tool (UpdateManagerTool) - Unknown owner - C:\sck32.exe (file missing)

Premi fix checked

Lanci Lspfix:
se sulla sinistra, insieme ad altre voci, ti appare la seguente:
webhancer***.dll
la sposti sulla parte destra del programma e la rimuovi, premendo finish
Non fare altre manovre con le altre voci.

Riavvia in modalità provvisoria
(Avviare il computer.Subito dopo il calcolo della RAM e prima che inizi a caricarsi Windows, iniziare a premere ripetutamente il tasto F8 sulla tastiera. Continuare a farlo fino a visualizzare il menu Opzioni avanzate di Windows. Usando i tasti freccia sulla tastiera, scorrere le opzioni e selezionare il menu Modalità Provvisoria, quindi premere Invio)

Rendi visibili file e cartelle nascosti:
da gestione del computer>strumenti>Opzioni Cartella
Seleziona Visualizza
Spunta "mostra file e cartelle nascoste"
Togli la spunta da "nascondi file protetti di sistema (consigliato)
Premi OK

Esegui una scansione con stinger 2.6.0

Esegui Cshredder.exe premendo fix e non scan only

Cerca ed elimina i seguenti file e cartelle ( se ci sono tutti):
C:\kybrddd_6.exe
C:\dfndrdd_6.exe
C:\Programmi\webHancer---- > la cartella
C:\nwnmdd_6.exe
C:\WINNT\system32\UpMsnGraonders.exe
C:\DOCUME~1\SISSY1\DATIAP~1\MCROSO~1\winlogon.exe
C:\WINNT\system32\?racle\l?gonui.exe
C:\WINNT\system32\kbicb.dll
C:\WINNT\system32\awvst.dll
C:\sck32.exe
C:\DOCUME~1\SISSY1\DATIAP~1\MCROSO~1\winlogon.exe" -vt yazr


Elimina poi tutti i file temporanei di windows temp e tmp (da start>cerca>tutti i file e cartelle, copi e incolli: *.temp;*.tmp, ed elimini tutti quelli trovati)

sulle opzioni Internet cancella la cache di IE ( sull’opzione elimina file temporanei spunta anche “elimina il contenuto non in linea”, i cookies, cronologia)

Da pannello di controllo disistalla programmi sospetti non installati da te (Sidefind)

Svuota il cestino

Comunica eventuali problemi riscontrati nell’esecuzione delle operazioni

Disattiva uno dei due antivirus che hai (tieni Antivir)

Fai una scansione on line qui:
http://www.bitdefender.com/scan8/ie.html
(è lunga ma efficace)

Posta nuovo log

[yuman]

Accidenti! è veramente lunga.
Ci proverò.
Per ora ti ringrazio molto e ti farò sapere mercoledi (domani non ci sono)
Grazie, ciao

[yuman]

Ho seguito le tue istruzioni, spero di averle fatte giuste.
Questo è il nuovo log.
Grazie, ciao.

Logfile of HijackThis v1.99.1
Scan saved at 16.25.10, on 26/07/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Programmi\AntiVir PersonalEdition Classic\sched.exe
C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe
C:\WINNT\System32\svchost.exe
C:\PROGRA~1\Alice\ALICEE~1\app\pppoeservice.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\Mixer.exe
C:\Programmi\Java\jre1.5.0_03\bin\jusched.exe
C:\Programmi\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe
C:\PROGRA~1\FILECO~1\ADAPTE~1\CreateCD\CREATE~1.EXE
C:\WINNT\system32\internat.exe
C:\Programmi\DNA Digital Media Group\Nestle Fitness Virtual Coach\dcu.exe
C:\Programmi\DNA Digital Media Group\Nestle Fitness Virtual Coach\Reminder.exe
C:\Programmi\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://gw.aliceadsl.it/home
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fornito da Alice
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://www.lacasadialice.it
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: (no name) - {B7065845-9CDC-A373-F7BD-942C846A0FCB} - (no file)
O2 - BHO: (no name) - {F2FA09FB-EE7A-46d8-9145-A1EEF7850052} - C:\WINNT\system32\awvst.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [newname] C:\\kybrdac_6.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Programmi\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [CreateCD50] C:\PROGRA~1\FILECO~1\ADAPTE~1\CreateCD\CREATE~1.EXE -r
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - Startup: DCU.lnk = C:\Programmi\DNA Digital Media Group\Nestle Fitness Virtual Coach\dcu.exe
O4 - Startup: reminder.lnk = C:\Programmi\DNA Digital Media Group\Nestle Fitness Virtual Coach\Reminder.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE
O14 - IERESET.INF: START_PAGE_URL=http://gw.aliceadsl.it/home
O20 - AppInit_DLLs: C:\WINNT\system32\msiexec.dll
O20 - Winlogon Notify: awvst - C:\WINNT\SYSTEM32\awvst.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmi\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Servizio amministrativo di Gestione disco logico (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: PPPoE Service (PPPoEService) - Unknown owner - C:\PROGRA~1\Alice\ALICEE~1\app\pppoeservice.exe
O23 - Service: Windows Update Manager Tool (UpdateManagerTool) - Unknown owner - C:\sck32.exe (file missing)

[Luke57]

Ciao, mi sembra che hai anche il trojan vundo e/o varianti.

Scarica il tool Vundofix da qui http://www.atribune.org/ccount/click.php?id=4

CITAZIONE
doppio click su VundoFix.exe
Metti la spunta nella casella "Run VundoFix as a task"
Adesso riceverai un messaggio che Vundo Fix si chiuderà e aprirà(da solo)in un minuto o anche meno clicca su OK
Una volta che si è riaperto clicca su "Scan for Vundo".
Finita la scansione clicca su "Remove Vundo"
Riceverai il messaggio se vuoi eliminare i files clicca su Yes
Il desktop scomparirà o diventerà bianco è normale
Finito ti chiederà di riavviare clicca su OK

Apri hiajckthsi, premi “do a system scan only”, cerchi e spunti le seguenti voci (se ci sono tutte):
R3 - URLSearchHook: (no name) - {B7065845-9CDC-A373-F7BD-942C846A0FCB} - (no file)
O2 - BHO: (no name) - {F2FA09FB-EE7A-46d8-9145-A1EEF7850052} - C:\WINNT\system32\awvst.dll
O4 - HKLM\..\Run: [newname] C:\\kybrdac_6.exe
O20 - AppInit_DLLs: C:\WINNT\system32\msiexec.dll
O20 - Winlogon Notify: awvst - C:\WINNT\SYSTEM32\awvst.dll
O23 - Service: Windows Update Manager Tool (UpdateManagerTool) - Unknown owner - C:\sck32.exe (file missing)
Premi fix checked

Poi lanci questi tre comandi
Start>esegui>sc stop UpdateManagerTool>OK
Start>esegui>sc disable UpdateManagerTool>OK
Start>esegui>sc delete UpdateManagerTool>OK

Dalla mod.provvisoria, cerchi ed elimini:
C:\WINNT\system32\msiexec.dll
C:\WINNT\SYSTEM32\awvst.dll (dovrebbe averlo eliminato Vundofix)
C:\\kybrdac_6.exe

Solita pulizia file temp e tmp di windows, IE, cookies

Svuota il cestino

Disistalla la java, reinstalla l’ultima versione, scegliendo dal sito la off line.

Posta nuovo (speriamo ultimo ) log di controllo

[yuman]

Ciao,
non so perchè ma quando clicco per "Run VundoFix as a task" mi da errore "9.
Ho cliccato comunque su "Scan for Vundo" e mi dice che non c'e nessun virus.
Come posso fare?
Grazie, ciao.

[Dylan666]

Da modalità provvisoria leva questi:

R3 - URLSearchHook: (no name) - {B7065845-9CDC-A373-F7BD-942C846A0FCB} - (no file)

O2 - BHO: (no name) - {F2FA09FB-EE7A-46d8-9145-A1EEF7850052} - C:\WINNT\system32\awvst.dll

O4 - HKLM\..\Run: [newname] C:\\kybrdac_6.exe

O20 - AppInit_DLLs: C:\WINNT\system32\msiexec.dll

O20 - Winlogon Notify: awvst - C:\WINNT\SYSTEM32\awvst.dll

O23 - Service: Windows Update Manager Tool (UpdateManagerTool) - Unknown owner - C:\sck32.exe (file missing)

Pure questi se non li conosci:
O4 - HKLM\..\Run: [CreateCD50] C:\PROGRA~1\FILECO~1\ADAPTE~1\CreateCD\CREATE~1.EXE -r

O4 - Startup: DCU.lnk = C:\Programmi\DNA Digital Media Group\Nestle Fitness Virtual Coach\dcu.exe

Attenzione: se dopo il Fix delle voci 020 rifacendo un log ricompaiono prova prima a dare questo comando in Start > Esegui:

regsvr32 -u awvst.dll

regsvr32 -u msiexec.dll

[Dylan666]

Sempre per le chiavi 020: se non va il consiglio dato sopra vedi qui dove dice Sezione 20:

http://www.alground.com/sicurezza/articolo.php?page=16

Mi raccomando, prova sempre a cancellare le due DLL a mano

[Luke57]

Ciao, mi sa che quei file con hijackthis non se ne vanno.

Vai qui:
http://collectiontricks.p2pforum.it/mod ... idedito=23
Scarica Virtumomonde Begone.

Scarica la versione trial of Ewido Security Suite da qui -->
http://www.ewido.net/en/download/

Esegui dalla modalità normale le operazioni suggerite con hijackthis.

Riparti in modalità provvisoria

Esegui Virtumonde Begone

Esegui Ewido
Citazione:
Avvia Ewido e Click su scanner
Click su "Complete System Scan" e attendi che lo scan cominci
14.Alla prima infezione trovata ci sarà la richiesta di pulire la prima infezione, rispondi "Perform action on all infections" e prosegui.
Una volta completato lo scan, premi il pulsante basso sullo schermo in basso sullo schermo "Save report...
Salva il file report .txt sul desktop ed allegalo insieme a un altro log di hiajckthis.