DIALER LOCAL INTERNET che non riesco ad eliminare

[Luke57]

Ciao, lo script è andato a buon fine, che cosa significa ie che non funziona?
Comunque inserisci tutti il file di testo con il report di ssytemscan qui
http://www.easy-share.com/
poi indica in un successivo post il link che ti sarà fornito per scaricarlo (il primo).

[aquilanera73]

ciao;
vuol dire che internet explorer non funziona, si blocca all'apertura e talvolta o ci sta una vita ad aprirsi oppure rimane bloccate e quindi devo utilizzare mozilla firefox.

Di seguito il primo link del file report, vediamo se riusciamo ad estirpare questi problemi

http://w13.easy-share.com/4530971.html

[Luke57]

Il report è tutto alla rinfusa, quindi illeggibile. Inserisci nel sto di easyshare la cartella .zip ( al cui interno c'è il file report.txt) che trovi in C:\suspectfile.

[jaky10]

ciau a tutti,

ho ank'io un problema col dialer local internet, riuscite a darmi una mano? vi posto il logfile di hijackthis

Logfile of HijackThis v1.99.1
Scan saved at 19.51.19, on 02/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\a-squared Anti-Malware\a2service.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\OCSCryptolib_Server.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\Java\jre1.5.0_03\bin\jusched.exe
C:\Programmi\Trend Micro\Internet Security 2007\pccguide.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
C:\Programmi\MSN Messenger\msnmsgr.exe
C:\Programmi\MSN Messenger\usnsvc.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Programmi\WinRAR\WinRAR.exe
C:\DOCUME~1\jacopin\IMPOST~1\Temp\Rar$EX00.286\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AuthentIC Manager] C:\WINDOWS\AuthManagerV3.exe
O4 - HKLM\..\Run: [Certificate Synchronizer] C:\WINDOWS\OcsCertSynchronizer.exe
O4 - HKLM\..\Run: [crtfmon] C:\DOCUME~1\jacopin\IMPOST~1\Temp\1188405691.dat.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Programmi\Trend Micro\Internet Security 2007\pccguide.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Programmi\IncrediMail\bin\IncMail.exe /c
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O15 - Trusted Zone: *.whataboutadog.com
O15 - Trusted Zone: *.whataboutarabit.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partne ... nicode.cab
O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework/co ... mHcmsX.CAB
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/ms ... b56986.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/share ... insctl.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/IT-IT/a-U ... E_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftup ... 7151570847
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 7151554674
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/A ... tPkMSN.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan ... asinst.cab
O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.com/A ... gWXMSN.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O16 - DPF: {EFD3EA56-234D-4240-90EA-CC9FA3AF5A01} (ConnectivityTester Class) - http://aiuto.alice.it/ata/static/instal ... _4-1-4.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{19A3F0D5-02C9-4D7A-A31B-C81C3448A0A5}: NameServer = 85.37.17.14 85.38.28.78
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Programmi\a-squared Anti-Malware\a2service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Oberthur Cryptolib Service (OCSCryptolibService) - Oberthur Card Systems - C:\WINDOWS\OCSCryptolib_Server.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Protezione anti-spyware Trend Micro (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

grazie mille

[aquilanera73]

ecco il link ..
http://w13.easy-share.com/4541961.html

[sofiaalb]

CIao a tutti riposto la mia richiesta d'aiuto (prima non ho ottenuto risposta),il dialer "Internet" o "Local Internet" è ricomparso,ma stavolta mi stacca il la connessione sempre dopo max 10 minuti..vi prego aiutatemi perchè ho estremo bisogno di stare collegato e con questo problem nn posso..
Vi posto il log di hijackthis...grazie...conto sul vostro aiuto ..ciao

Logfile of HijackThis v1.99.1
Scan saved at 11.05.23, on 03/09/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\windows\system32\winlogon.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\CTSvcCDA.exe
C:\Programmi\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Creative\News\NewsUpd.EXE
C:\Programmi\Creative\ShareDLL\CtNotify.exe
C:\Programmi\QuickTime\qttask.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\Programmi\Java\j2re1.4.2_06\bin\jusched.exe
C:\PROGRA~1\DAP\DAP.EXE
C:\Programmi\Creative\Shared Files\CamTray.exe
C:\Programmi\Creative\ShareDLL\MediaDet.Exe
C:\Programmi\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmi\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\PROGRA~1\WinZip\winzip32.exe
C:\unzipped\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.forumfree.net/?c=75878
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: WebAssist - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\WebAssist.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Programmi\DAP\DAPIEBar.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programmi\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [NewsUpd] C:\Programmi\Creative\News\NewsUpd.EXE /q
O4 - HKLM\..\Run: [Disc Detector] C:\Programmi\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [DownloadAccelerator] C:\PROGRA~1\DAP\DAP.EXE /STARTUP
O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Programmi\Creative\Shared Files\CamTray.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Programmi\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [OM_Monitor] C:\Programmi\OLYMPUS\OLYMPUS Master\FirstStart.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [OM_Monitor] C:\Programmi\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Programmi\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Programmi\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Aggiungi all'elenco di stampa Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Anteprima Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: Stampa ad alta velocità Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Stampa Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\MSMSGS.EXE
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b31267.cab
O16 - DPF: {2057E707-FA09-451B-972F-9CFBA9F2423C} (Tiscali702) - http://www.tiscali.it/cabs/Tiscali702.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://thewallofrekiankit.spaces.live.c ... nPUpld.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnme ... loader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZI ... b32846.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9BD2FA50-463B-4223-B75F-DB9896431733}: NameServer = 193.70.152.15 193.70.152.25
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs:
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Programmi\ewido anti-spyware 4.0\guard.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\SNDSrvc.exe

[Luke57]

@sofiaalb
Ciao, con tutti questi messaggi di seguito da utenti diversi non è possibile andare avanti, per cui riutilizza systemscan, spunta solo la casella "duplicates in bak folders", fai lo scan.
Poi apri una nuova discussione inserendo un post in cui incollerai il report dello scan.

[Luke57]

@aquilanera73
Ciao, utilizza avenger inserendo questo script:

registry values to delete:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run | crtfmon

files to move:
C:\Programmi\Alwil Software\Avast4\bak\ashDisp.exe | C:\Programmi\Alwil Software\Avast4\ashDisp.exe
C:\Programmi\Creative\SBLive\Program\bak\ADGJDet.exe |C:\Programmi\Creative\SBLive\Program\ADGJDet.exe
C:\Programmi\CyberLink\PowerDVD\bak\PDVDServ.exe | C:\Programmi\CyberLink\PowerDVD\PDVDServ.exe
C:\Programmi\File comuni\Ahead\Lib\bak\NeroCheck.exe | C:\Programmi\File comuni\Ahead\Lib\NeroCheck.exe
C:\Programmi\File comuni\Ahead\Lib\bak\NMBgMonitor.exe
| C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe
C:\Programmi\Google\GoogleToolbarNotifier\1.2.1128.5462\bak\GoogleToolbarNotifier.exe | C:\Programmi\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Programmi\iTunes\bak\iTunesHelper.exe | C:\Programmi\iTunes\iTunesHelper.exe
C:\Programmi\QuickTime\bak\qttask.exe | C:\Programmi\QuickTime\qttask.exe
C:\Programmi\ScanSoft\OmniPagePro12.0\bak\Opware12.exe | C:\Programmi\ScanSoft\OmniPagePro12.0\Opware12.exe
C:\WINDOWS\bak\UpdReg.EXE | C:\WINDOWS\UpdReg.EXE
C:\WINDOWS\system32\bak\ctfmon.exe | C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\bak\UpdReg.EXE | C:\WINDOWS\UpdReg.EXE
C:\WINDOWS\system32\bak\ctfmon.exe | C:\WINDOWS\system32\ctfmon.exe


Folders to delete:
C:\DOCUME~1\me\IMPOST~1\Temp


Poi scarica deldomains da qui:
http://www.mvps.org/winhelp2002/DelDomains.inf
click tasto dx sul file .inf e scegli Installa (fa tutto da sé)

[sofiaalb]

@sofiaalb
Ciao, con tutti questi messaggi di seguito da utenti diversi non è possibile andare avanti, per cui riutilizza systemscan, spunta solo la casella "duplicates in bak folders", fai lo scan.
Poi apri una nuova discussione inserendo un post in cui incollerai il report dello scan.

Ciao luke scusa ma nn ho capito cosa fare,systemscan sarebbe da hijackthis? dove la trovo la casella "duplicates in bak folders"? appena mi fai sapere faccio tutto e apro una nuova discussione...

p.s. cmq ho passato ccleaner e fixato questa stringa sospetta
O2 - BHO: WebAssist - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\WebAssist.dll

[edo_aol]

per jaky10.

avvia hijackthis,spunta a sinistra su queste voci:

O23 - Service: Oberthur Cryptolib Service (OCSCryptolibService) - Oberthur Card Systems - C:\WINDOWS\OCSCryptolib_Server.exe
O15 - Trusted Zone: *.whataboutarabit.com
O15 - Trusted Zone: *.whataboutadog.com
O4 - HKLM\..\Run: [crtfmon] C:\DOCUME~1\jacopin\IMPOST~1\Temp\1188405691.dat.exe
O4 - HKLM\..\Run: [Certificate Synchronizer] C:\WINDOWS\OcsCertSynchronizer.exe
O4 - HKLM\..\Run: [AuthentIC Manager] C:\WINDOWS\AuthManagerV3.exe
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)


poi CLICCA SOTTO SU FIX CHECKED.

poi Scarica The Avenger
http://swandog46.geekstogo.com/avenger.zip

estrai l’archivio nel desktop.

Poi avvia il file Avenger.exe.
Seleziona l'opzione Input Script Manually, clicca sulla lente di ingrandimento e all'interno dello spazio bianco copia ed incolla questo script:


files to delete:
C:\WINDOWS\OcsCertSynchronizer.exe




Poi clicca su DONE,poi sul semaforo,due volte si,riavvia il pc e postami qui il log(si trova in c:/avenger.txt)

[sofiaalb]

..sorry ho capito qual era systemscan,lo avevo già scaricato,,scusa ancora..tra un pò posto..ciao

[sofiaalb]

posto qui per nn aprire una discussione che potrebbbe essere inutile dato il responso..ecco il report di systemscan

SystemScan - http://www.suspectfile.com - ver. 3.2.0

Running on: Windows XP PROFESSIONAL Edition (2600.5.1)
System directory: C:\WINDOWS

Date: 03/09/2007
Time: 13.28.23

Output limited to:
-Duplicates in BAK folders

===================== Duplicates in BAK folders =====================

No BAK folders found

==========================================
Scan completed in 1,3 minutes
End of report

Mi sembra che non ci sia..può dipendere dalla stringa che ho eliminato,magari era quella giusta (me l'hanno suggerita altrove..)ciao e grazie

[aquilanera73]

io postato il link...ed ora? Cosa devo fare?

[Luke57]

io postato il link...ed ora? Cosa devo fare?

Ciao, te l'ho scritto sopra, questa discussione è un caos indescrivibile. In non sono il mod della sezione e non posso spostare messaggi.
Per piacere, posta il report di avenger, ma apri una nuova discussione.

[jaky10]

per edo_aol

intanto grazie per la risposta, il log di avenger è questo:

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\irwdcjpt

*******************

Script file located at: \??\C:\WINDOWS\umybatpt.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\OcsCertSynchronizer.exe deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

ho notato che finalmente al riavvio del pc nn ho + come processo attivo in automatico il dialer, solo che se guardo sulle risorse di rete le connessioni disponibili, c'è ancora local internet, la cancello manualmente e basta? penso basti questo

[Luke57]

per edo_aol


ho notato che finalmente al riavvio del pc nn ho + come processo attivo in automatico il dialer, solo che se guardo sulle risorse di rete le connessioni disponibili, c'è ancora local internet, la cancello manualmente e basta? penso basti questo

Ciao, non basta perchè il dialer sostituisce tutti i file legittimi dei processi d'avvio con proprie copie infette, per rilevare le copie infette scarica findawf da qui:
http://noahdfear.geekstogo.com/FindAWF.exe
lo metti sul desktop, poi lo avvii, si apre una finestra dos, scegli 1 e premi invio.
Al termine della scansione copi e incolli in un post il contenuto del report rilasciato dal programma.

[jaky10]

ecco il report di findawf:


Find AWF report by noahdfear ©2006
Version 1.40



bak folders found
~~~~~~~~~~~

Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 908E-6F15

Directory di C:\WINDOWS\BAK

16/06/2006 17.24 1.069.056 AuthManagerV3.exe
07/06/2006 18.03 24.576 OcsCertSynchronizer.exe
2 File 1.093.632 byte
2 Directory 27.589.677.056 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 908E-6F15

Directory di C:\PROGRA~1\ITUNES\BAK

25/09/2006 14.54 229.952 iTunesHelper.exe
1 File 229.952 byte
2 Directory 27.589.677.056 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 908E-6F15

Directory di C:\PROGRA~1\QUICKT~1\BAK

24/09/2006 03.24 282.624 qttask.exe
1 File 282.624 byte
2 Directory 27.589.672.960 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 908E-6F15

Directory di C:\WINDOWS\SYSTEM32\BAK

19/08/2004 15.39 15.360 ctfmon.exe
09/07/2001 11.50 155.648 NeroCheck.exe
2 File 171.008 byte
2 Directory 27.589.672.960 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 908E-6F15

Directory di C:\PROGRA~1\GOOGLE\GOOGLE~2\BAK

01/01/2007 23.22 3.739.648 googletalk.exe
1 File 3.739.648 byte
2 Directory 27.589.672.960 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 908E-6F15

Directory di C:\PROGRA~1\INCRED~1\BIN\BAK

31/10/2006 15.06 204.843 IncMail.exe
1 File 204.843 byte
2 Directory 27.589.672.960 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 908E-6F15

Directory di C:\PROGRA~1\FILECO~1\REAL\UPDATE~1\BAK

17/08/2006 22.43 180.269 realsched.exe
1 File 180.269 byte
2 Directory 27.589.672.960 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 908E-6F15

Directory di C:\PROGRA~1\JAVA\JRE15~1.0_0\BIN\BAK

13/04/2005 03.48 36.975 jusched.exe
1 File 36.975 byte
2 Directory 27.589.672.960 byte disponibili


Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~

24080 19 Jul 2007 "C:\WINDOWS\AuthManagerV3.exe"
1069056 16 Jun 2006 "C:\WINDOWS\bak\AuthManagerV3.exe"
24576 7 Jun 2006 "C:\WINDOWS\bak\OcsCertSynchronizer.exe"
24080 19 Jul 2007 "C:\Programmi\iTunes\iTunesHelper.exe"
229952 25 Sep 2006 "C:\Programmi\iTunes\bak\iTunesHelper.exe"
102400 1 Oct 2006 "C:\WINDOWS\Installer\{5878FF02-3B8F-4309-B4E5-0D3DB6F2E8E6}\iTunesIco.exe"
108096 25 Sep 2006 "C:\Documents and Settings\All Users\Dati applicazioni\Apple Computer\Installer Cache\iTunes 7.0.1.8\iTunesSetupAdmin.exe"
24080 19 Jul 2007 "C:\Programmi\QuickTime\qttask.exe"
282624 24 Sep 2006 "C:\Programmi\QuickTime\bak\qttask.exe"
15360 19 Aug 2004 "C:\WINDOWS\system32\ctfmon.exe"
15360 19 Aug 2004 "C:\WINDOWS\system32\bak\ctfmon.exe"
24080 19 Jul 2007 "C:\WINDOWS\system32\NeroCheck.exe"
155648 9 Jul 2001 "C:\WINDOWS\system32\bak\NeroCheck.exe"
69632 20 Aug 2007 "C:\Programmi\Google\Google Earth\googleearth.exe"
1507328 17 Aug 2006 "C:\Programmi\Real\RealArcade\GoogleInstApp.exe"
26694 23 Aug 2007 "C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\googleearth.exe_407B9B5CDAC54F44A756B57CAB4E6A8B.exe"
608936 17 Aug 2006 "C:\Programmi\File comuni\Real\GToolbar\GoogleToolbarInstaller.exe"
3739648 1 Jan 2007 "C:\Programmi\Google\Google Talk\bak\googletalk.exe"
208946 15 Jul 2007 "C:\Programmi\IncrediMail\bin\IncMail.exe"
204843 31 Oct 2006 "C:\Programmi\IncrediMail\bin\bak\IncMail.exe"
208946 15 Jul 2007 "C:\Documents and Settings\jacopin\Impostazioni locali\Temp\IncrediMail\IMInstall\binaries\IncMail.exe"
24080 19 Jul 2007 "C:\Programmi\File comuni\Real\Update_OB\realsched.exe"
180269 17 Aug 2006 "C:\Programmi\File comuni\Real\Update_OB\bak\realsched.exe"
24080 19 Jul 2007 "C:\Programmi\Java\jre1.5.0_03\bin\jusched.exe"
36975 13 Apr 2005 "C:\Programmi\Java\jre1.5.0_03\bin\bak\jusched.exe"


end of report

[Luke57]

@jaky10
Ciao, riutilizza avenger e inserisci questo script:

folders to delete:
C:\DOCUME~1\jacopin\IMPOST~1\Temp

files to move:
C:\WINDOWS\bak\AuthManagerV3.exe | C:\WINDOWS\AuthManagerV3.exe
C:\Programmi\iTunes\bak\iTunesHelper.exe | C:\Programmi\iTunes\iTunesHelper.exe
C:\Programmi\QuickTime\bak\qttask.exe | C:\Programmi\QuickTime\qttask.exe
C:\WINDOWS\system32\bak\ctfmon.exe | C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\bak\NeroCheck.exe | C:\WINDOWS\system32\NeroCheck.exe
C:\Programmi\IncrediMail\bin\bak\IncMail.exe | C:\Programmi\IncrediMail\bin\IncMail.exe
C:\Programmi\File comuni\Real\Update_OB\bak\realsched.exe | C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\Programmi\Google\Google Talk\bak\googletalk.exe | C:\Programmi\Google\Google Talk\googletalk.exe



Poi disistalla la java (hai una versione dell'...800) ed eventualmente installa la nuova.

[jaky10]

ok, fatto tutto

grazie mille

ciao

[andreino]

ciao a tutti.... anche io ho problemi con questo local internet...
leggendo le numerose risposte non riesco a trovare una soluzione.... bè non sono uno forte al pc ....

comunque ho eseguito hijackthis.... e mi dà come risultato questo:

Logfile of HijackThis v1.99.1
Scan saved at 14.03.15, on 10/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\windows\Explorer.EXE
C:\windows\system32\spoolsv.exe
C:\windows\RTHDCPL.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programmi\IPM\Adsl\DataWay\dslstat.exe
C:\windows\system32\dslagent.exe
C:\DOCUME~1\xxx\IMPOST~1\Temp\1186993029.dat.exe
C:\Programmi\D-Tools\daemon.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\windows\system32\ctfmon.exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\Programmi\File comuni\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Programmi\WinRAR\WinRAR.exe
C:\DOCUME~1\xxx\IMPOST~1\Temp\Rar$EX00.953\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.libero.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Programmi\IPM\Adsl\DataWay\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [crtfmon] C:\DOCUME~1\xxx\IMPOST~1\Temp\1186993029.dat.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programmi\D-Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV03.EXE
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: I&nvia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/IT-IT/a-U ... E_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/Mi ... b56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2584C7A3-9284-42D1-AF75-7D0E6172A773}: NameServer = 85.37.17.17 85.38.28.72
O17 - HKLM\System\CS1\Services\Tcpip\..\{2584C7A3-9284-42D1-AF75-7D0E6172A773}: NameServer = 85.37.17.17 85.38.28.72
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Programmi\File comuni\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FILECO~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: igfxcui - C:\windows\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\windows\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe

l'ho copiato su http://www.hijackthis.de/it
però non ci capisco niente....
potreste darmi una mano??? grazie