quella bestia del w32.myzor.fk@yf

di **fuga** » 01/02/07 16:14

ciao a tutti sono circa 4 ore che navigo e navigo tra forum e forum...hijackthis super anti spyware, avg , adaware, adwatch, systemscan...ma niente da fare!

ogni volta che acdedo ad internet explorer mi viene fuori una pagina strana di un strano antivirus...con un avviso dove c'è scritto che ho questo virus! w32.myzor.fk@yf

ho già fatto tutti i passi che ci sono qui sul forum, ma niente di fatto :-(

AIUTATEMI!!

grazie 1000!!!

speriamo di risolvere!!

intanto nel prossimo post vi incollo il log di hijackthis!!

ciao

Ale

di **fuga** » 01/02/07 16:15

Logfile of HijackThis v1.99.1
Scan saved at 16.14.26, on 01/02/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Programmi\Grisoft\AVG Anti-Spyware 7.5\guard.exe
D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
D:\PROGRA~1\Grisoft\AVG7\avgemc.exe
D:\WINDOWS\system32\svchost.exe
D:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\igfxpers.exe
D:\PROGRA~1\Grisoft\AVG7\avgcc.exe
D:\Programmi\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
D:\WINDOWS\system32\LVCOMSX.EXE
D:\Programmi\Logitech\Video\LogiTray.exe
D:\WINDOWS\system32\hkcmd.exe
D:\Programmi\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
D:\Programmi\Kodak\Kodak EasyShare software\bin\EasyShare.exe
D:\Programmi\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
D:\Programmi\Logitech\Video\FxSvr2.exe
D:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe
D:\Programmi\Internet Explorer\IEXPLORE.EXE
D:\Programmi\Adobe\Reader 8.0\Reader\AcroRd32.exe
D:\Documents and Settings\Alessandro\Desktop\Nuova cartella\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Programmi\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: (no name) - {f4d74aaa-a178-4463-846b-b4bc87a024e0} - D:\WINDOWS\system32\ixt0.dll
O4 - HKLM\..\Run: [Persistence] D:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Programmi\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [LVCOMSX] D:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoTray] D:\Programmi\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] D:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB001" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "D:\Programmi\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [HotKeysCmds] D:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [IgfxTray] D:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] D:\Programmi\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] D:\Programmi\Logitech\Video\ManifestEngine.exe boot
O4 - HKCU\..\Run: [AWMON] "D:\Programmi\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe"
O4 - Global Startup: Adobe Gamma.lnk = D:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Programmi\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = D:\Programmi\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Kodak EasyShare software.lnk = D:\Programmi\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: KODAK Software Updater.lnk = D:\Programmi\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programmi\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programmi\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe (file missing)
O10 - Unknown file in Winsock LSP: d:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: d:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: d:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: d:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: d:\windows\system32\avgfwafu.dll
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://212.98.46.120/activex/AxisCamControl.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{31D9B9F1-045E-45D5-9F43-D8C45C85DCA9}: NameServer = 193.12.150.2 212.247.152.2
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - D:\Programmi\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: igfxcui - D:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: Adobe LM Service - Adobe Systems - D:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:\Programmi\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - D:\WINDOWS\system32\drivers\KodakCCS.exe

di **fuga** » 01/02/07 16:18

ah..aggiungo anche che..questa voce:
O2 - BHO: (no name) - {f4d74aaa-a178-4463-846b-b4bc87a024e0} - D:\WINDOWS\system32\ixt0.dll

il sito di hijackthis me la segnala nociva...quindi ho provato a "FIXARLA"..ma niente , si ripresenta sempre!

di **andorra24** » 01/02/07 16:54

Ciao, scarica SmitFraudfix e decomprimilo in una cartella a tua scelta estraendo tutti i file:
http://siri.urz.free.fr/Fix/SmitfraudFix.zip

Riavvia in modalità provvisoria

Apri la cartella che contiene SmitfraudFix, avvia smitfraudfix.cmd
Seleziona opzione #2 - Clean cliccando sul 2 e premi Invio.
Riceverai questo messaggio: Registry cleaning - Do you want to clean the registry ?
Rispondi Sì cliccando Y e premi invio.
Rispondi Sì ( Y) ad eventuali altre domande

eseguita tutta la scansione riavvia il pc normalmente. Posta il log della scansione nel forum.

di **fuga** » 01/02/07 17:39

SmitFraudFix v2.137

Scan done at 17.31.06,53, 01/02/2007
Run from D:\Documents and Settings\Alessandro\Desktop\Nuova cartella\SmitfraudFix
OS: Microsoft Windows XP [Versione 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

D:\WINDOWS\system32\ixt?.dll Deleted

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» End

di **fuga** » 01/02/07 18:41

vi prego rispondetemi sto impazzendo!! :cry:

di **andorra24** » 01/02/07 20:35

L'unica infezione presente nel tuo log di hijackthis ti è stata eliminata da smitfraudfix come si evince dal log che hai postato. Hai ancora problemi?

di **fuga** » 01/02/07 20:47

si, è sempre lo stesso problema!
non so...boh!!

di **andorra24** » 01/02/07 20:58

Posta un nuovo log di hijackthis per un ulteriore controllo.

di **fuga** » 01/02/07 21:05

Logfile of HijackThis v1.99.1
Scan saved at 21.04.41, on 01/02/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Programmi\Grisoft\AVG Anti-Spyware 7.5\guard.exe
D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
D:\PROGRA~1\Grisoft\AVG7\avgemc.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\navapsvc.exe
D:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\issrch.exe
D:\Programmi\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
D:\WINDOWS\system32\igfxpers.exe
D:\WINDOWS\system32\LVCOMSX.EXE
D:\Programmi\Logitech\Video\LogiTray.exe
D:\WINDOWS\system32\hkcmd.exe
D:\PROGRA~1\Grisoft\AVG7\avgcc.exe
D:\Programmi\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
D:\Programmi\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
D:\Programmi\Logitech\Video\FxSvr2.exe
D:\Programmi\Internet Explorer\IEXPLORE.EXE
D:\Programmi\MSN Messenger\msnmsgr.exe
D:\WINDOWS\system32\svchost.exe
D:\Programmi\Internet Explorer\IEXPLORE.EXE
D:\Programmi\eMule\emule.exe
D:\Programmi\Adobe\Reader 8.0\Reader\AcroRd32.exe
D:\Documents and Settings\Alessandro\Desktop\Nuova cartella\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Programmi\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: (no name) - {f4d74aaa-a178-4463-846b-b4bc87a024e0} - D:\WINDOWS\system32\ixt0.dll
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] D:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB001" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Programmi\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "D:\Programmi\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [QuickTime Task] "D:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Persistence] D:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LVCOMSX] D:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoTray] D:\Programmi\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] D:\Programmi\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [IgfxTray] D:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] D:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] D:\Programmi\Logitech\Video\ManifestEngine.exe boot
O4 - HKCU\..\Run: [AWMON] "D:\Programmi\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe"
O4 - Global Startup: Adobe Gamma.lnk = D:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Programmi\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = D:\Programmi\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Kodak EasyShare software.lnk = D:\Programmi\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: KODAK Software Updater.lnk = D:\Programmi\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programmi\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programmi\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe (file missing)
O10 - Unknown file in Winsock LSP: d:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: d:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: d:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: d:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: d:\windows\system32\avgfwafu.dll
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://212.98.46.120/activex/AxisCamControl.ocx
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan ... asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{31D9B9F1-045E-45D5-9F43-D8C45C85DCA9}: NameServer = 193.12.150.2 212.247.152.2
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - D:\Programmi\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: igfxcui - D:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: Adobe LM Service - Adobe Systems - D:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:\Programmi\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - D:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Windows Server Management Services (WSMSPSVC) - Unknown owner - D:\WINDOWS\navapsvc.exe

di **andorra24** » 01/02/07 21:28

In questo nuovo log sono emersi degli elementi che vanno eliminati.

Apri hijackthis e clicca su ''open the misc tools section'', dopo premi il tasto ''open process manager'' e individua ed evidenzia la seguente voce:
D:\WINDOWS\system32\issrch.exe
e premi ''kill process''.

Dopo premi il tasto ''back'', premi ''scan'' e metti il segno di spunta alle seguenti voci:
O2 - BHO: (no name) - {f4d74aaa-a178-4463-846b-b4bc87a024e0} - D:\WINDOWS\system32\ixt0.dll
O23 - Service: Windows Server Management Services (WSMSPSVC) - Unknown owner - D:\WINDOWS\navapsvc.exe
e premi ''fix checked''.

Vai su start/risorse del computer/strumenti/opzioni cartella/visualizzazione e metti la spunta su visualizza cartelle file nascosti e togli la spunta da ''nascondi i file protetti di sistema (consigliato)''.

Scarica killbox da qui: http://www.killbox.net/downloads/KillBox.exe
con killbox elimina i seguenti files:
D:\WINDOWS\system32\issrch.exe
D:\WINDOWS\system32\ixt0.dll
D:\WINDOWS\navapsvc.exe

di **fuga** » 19/02/07 12:55

scusa il ritardo ma son stato via per lavoro!

ho appena eseguito il procedimento ed è tutto risolto!!

grazie 1000!!! sei un mago del pc!!!

grazie!!

quella bestia del w32.myzor.fk@yf

quella bestia del w32.myzor.fk@yf

ecco il LOG hijackthis

ah..aggiungo anche che..

ecco il log..il virus c'è ancora :-(

risolto

Topic correlati a "quella bestia del w32.myzor.fk@yf":

Chi c’è in linea