Help me pubblicità

di **Marco83** » 12/04/10 22:39

Ciao a tutti, potete aiutaami a risolvere questo problema?
Continuamente mi esce improvvisamente una finestra di explorer con una schermata simile a quella del pannello di controllo di win Vista (sebbene abbia XP) dicendomi che sono infetto da un virus.
Inoltre non reisco a navigare in diversi siti (tipo quelli degli antivirus)...

Allego il log di Hijackthis...
Grazie a tutti
Marco83

Codice: Seleziona tutto: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23.32.39, on 12/04/2010 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16981) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Programmi\Intel\Wireless\Bin\EvtEng.exe C:\Programmi\Intel\Wireless\Bin\S24EvMon.exe C:\Programmi\AVG\AVG9\avgchsvx.exe C:\Programmi\AVG\AVG9\avgrsx.exe C:\WINDOWS\system32\spoolsv.exe C:\Programmi\AVG\AVG9\avgcsrvx.exe C:\Programmi\AVG\AVG9\avgwdsvc.exe C:\Acer\Empowering Technology\admServ.exe C:\Programmi\AVG\AVG9\avgnsx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Programmi\Java\jre6\bin\jqs.exe C:\Programmi\File comuni\LightScribe\LSSrvc.exe C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Programmi\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\Programmi\webserver\webserver.exe C:\Programmi\AVG\AVG9\avgemc.exe C:\Programmi\AVG\AVG9\avgcsrvx.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\ehome\ehtray.exe C:\WINDOWS\eHome\ehmsas.exe C:\Acer\Empowering Technology\eRecovery\Monitor.exe C:\WINDOWS\RTHDCPL.EXE C:\Programmi\Synaptics\SynTP\SynTPEnh.exe C:\Acer\Empowering Technology\admtray.exe C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe C:\Acer\Empowering Technology\ePower\ePower_DMC.exe C:\WINDOWS\system32\wbem\unsecapp.exe C:\DOCUME~1\PORTAT~1\IMPOST~1\Temp\RtkBtMnt.exe C:\PROGRA~1\LAUNCH~1\LManager.exe C:\Programmi\File comuni\Java\Java Update\jusched.exe C:\PROGRA~1\AVG\AVG9\avgtray.exe C:\WINDOWS\system32\ctfmon.exe C:\windows\bill106.exe C:\WINDOWS\system32\igfxext.exe C:\WINDOWS\system32\igfxsrvc.exe C:\WINDOWS\System32\svchost.exe C:\Programmi\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://it.rd.yahoo.com/customize/ycomp/defaults/sp/*http://it.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://it.intl.acer.yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://it.rd.yahoo.com/customize/ycomp/defaults/su/*http://it.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti R3 - URLSearchHook: Yahoo! Toolbar con blocco Pop-Up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programmi\AVG\AVG9\avgssie.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmi\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [LaunchApp] Alaunch O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [AzMixerSel] C:\Programmi\Realtek\InstallShield\AzMixerSel.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [ntiMUI] C:\Programmi\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe O4 - HKLM\..\Run: [ADMTray.exe] "C:\Acer\Empowering Technology\admtray.exe" O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe O4 - HKLM\..\Run: [Acer ePower Management] C:\Acer\Empowering Technology\ePower\Acer ePower Management.exe boot O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\File comuni\Java\Java Update\jusched.exe" O4 - HKLM\..\Run: [sysfbtray] C:\windows\bill106.exe O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Mobile Partner] C:\Programmi\3 Internet\3 Internet.exe O4 - HKCU\..\Run: [VMCL] F:\\VMC_PBStarter.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe (file missing) O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programmi\AVG\AVG9\avgpp.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Programmi\AVG\AVG9\avgemc.exe O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Programmi\AVG\AVG9\avgwdsvc.exe O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\EvtEng.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmi\Java\jre6\bin\jqs.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Programmi\WinPcap\rpcapd.exe O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: webserver - Unknown owner - C:\Programmi\webserver\webserver.exe -- End of file - 9257 bytes

di **shel** » 13/04/10 08:07

ciao

il log e' a posto

controlla se riesci a collegarti qui

di **-> EleKtrA <-** » 13/04/10 08:22

Ciao Marco83, ciao shel, il log non è proprio "a posto", oltre alle tante voci inutili, al sistema non aggiornato, c'è una voce riferita all'infezione
O4 - HKLM\..\Run: [sysfbtray] C:\windows\bill106.exe

Disattiva momentaneamente l'antivirus
Scarica Combofix | Tutorial
Non installare la recovery console
Lascia lavorare il programma senza interferire
Allega il rapporto C:\ComboFix.txt nella tua risposta.

di **shel** » 13/04/10 08:39

ciao Elektra felice di rivederti

hai ragione, mi e' sfuggita quella voce...per il resto credo che il problema sia abbastanza piu' serio tenuto conto che non accede ai siti antivirus, e tu sai cosa vuol dire

di **Marco83** » 13/04/10 19:06

Fatto tutto... il problema sembra essere risolto... ora posso accedere anche alle pagine degli antivirus...
Vi ringrazio molto per l'aiuto e Vi allego il log..
fatemi sapere se devo fare qalche altra operazione
Grazie nuovamente

Codice: Seleziona tutto: ComboFix 10-04-13.02 - portatile 13/04/2010 19.01.27.1.2 - FAT32x86 Microsoft Windows XP Professional 5.1.2600.2.1252.39.1040.18.1014.512 [GMT 2:00] Eseguito da: c:\documents and settings\portatile\Desktop\ComboFix.exe AV: AVG Anti-Virus Free *On-access scanning disabled* (Outdated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !! . ((((((((((((((((((((((((((((((((((((( Altre eliminazioni ))))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\portatile\Impostazioni locali\Dati applicazioni\010112010146100109.xxe c:\documents and settings\portatile\Impostazioni locali\Dati applicazioni\010112010146115119.xxe c:\documents and settings\portatile\Impostazioni locali\Dati applicazioni\0101120101465198.xxe c:\documents and settings\portatile\Impostazioni locali\Dati applicazioni\rdr_1268933387.exe c:\documents and settings\portatile\Impostazioni locali\Dati applicazioni\rdr_1270662075.exe c:\documents and settings\portatile\Impostazioni locali\Dati applicazioni\rdr_1270662389.exe c:\documents and settings\portatile\Impostazioni locali\Dati applicazioni\rdr_1270851342.exe c:\documents and settings\portatile\Impostazioni locali\Dati applicazioni\rdr_1270851644.exe c:\documents and settings\portatile\Impostazioni locali\Dati applicazioni\rdr_1270852930.exe c:\documents and settings\portatile\Impostazioni locali\Dati applicazioni\rdr_1270853233.exe c:\documents and settings\portatile\Impostazioni locali\Dati applicazioni\rdr_1271010698.exe c:\documents and settings\portatile\Impostazioni locali\Dati applicazioni\rdr_1271011003.exe c:\documents and settings\portatile\Impostazioni locali\Dati applicazioni\rdr_1271020751.exe c:\documents and settings\portatile\Impostazioni locali\Dati applicazioni\rdr_1271021054.exe c:\documents and settings\portatile\Impostazioni locali\Dati applicazioni\rdr_1271027526.exe c:\documents and settings\portatile\Impostazioni locali\Dati applicazioni\rdr_1271107298.exe c:\documents and settings\portatile\Impostazioni locali\Dati applicazioni\rdr_1271107602.exe c:\documents and settings\portatile\Impostazioni locali\Dati applicazioni\rdr_1271177343.exe c:\documents and settings\portatile\Impostazioni locali\Dati applicazioni\rdr_1271177345.exe c:\documents and settings\portatile\Menu Avvio\Programmi\Videos.url c:\documents and settings\portatile\Preferiti\Videos.url c:\programmi\webserver c:\programmi\webserver\webserver.exe c:\programmi\WinPCap c:\programmi\WinPCap\daemon_mgm.exe c:\programmi\WinPCap\npf_mgm.exe c:\programmi\WinPCap\rpcapd.exe c:\windows\bill104.exe c:\windows\bill106.exe c:\windows\bk23567.dat c:\windows\fdgg34353edfgdfdf c:\windows\lgo c:\windows\system32\{a61c88a7-a482-c745-ef7c-c314895727d9}.dll-uninst.exe c:\windows\system32\captcha.dll c:\windows\system32\drivers\imapioko.sys c:\windows\system32\drivers\npf.sys c:\windows\system32\erokosvc.dll c:\windows\system32\gckairrfunuhjnjmn.dll-uninst.exe c:\windows\system32\mysidesearch_sidebar_uninstall.exe c:\windows\system32\myss_sb_uninstall.exe c:\windows\system32\Packet.dll c:\windows\system32\pthreadVC.dll c:\windows\system32\superiorads-uninst.exe c:\windows\system32\WanPacket.dll c:\windows\system32\wpcap.dll D:\Autorun.inf . ((((((((((((((((((((((((((((((((((((((( Driver/Servizi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_APTO6KO -------\Legacy_CAPTCHA -------\Legacy_CPQOKO6 -------\Legacy_NPF -------\Legacy_WEBSERVER -------\Service_apto6ko -------\Service_captcha -------\Service_cpqoko6 -------\Service_NPF -------\Service_webserver ((((((((((((((((((((((((( Files Creati Da 2010-03-13 al 2010-04-13 ))))))))))))))))))))))))))))))))))) . 2010-04-11 21:24 . 2010-04-11 21:24 -------- d-----w- c:\programmi\Trend Micro 2010-04-11 21:13 . 2010-04-11 21:13 503808 ----a-w- c:\documents and settings\portatile\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-16c7a469-n\msvcp71.dll 2010-04-11 21:13 . 2010-04-11 21:13 499712 ----a-w- c:\documents and settings\portatile\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-16c7a469-n\jmc.dll 2010-04-11 21:13 . 2010-04-11 21:13 348160 ----a-w- c:\documents and settings\portatile\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-16c7a469-n\msvcr71.dll 2010-04-11 21:13 . 2010-04-11 21:13 61440 ----a-w- c:\documents and settings\portatile\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-1bfc529f-n\decora-sse.dll 2010-04-11 21:13 . 2010-04-11 21:13 12800 ----a-w- c:\documents and settings\portatile\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-1bfc529f-n\decora-d3d.dll 2010-04-11 21:12 . 2010-04-11 21:12 411368 ----a-w- c:\windows\system32\deploytk.dll 2010-04-11 21:05 . 2010-04-11 21:05 0 ----a-w- c:\windows\nsreg.dat 2010-04-11 21:05 . 2010-04-11 21:05 -------- d-----w- c:\documents and settings\portatile\Impostazioni locali\Dati applicazioni\Mozilla 2010-04-11 18:54 . 2010-04-11 18:54 -------- d-----w- C:\$AVG 2010-04-11 18:46 . 2010-04-11 18:46 -------- d-----w- c:\programmi\CCleaner 2010-04-11 18:43 . 2010-04-11 18:43 12464 ----a-w- c:\windows\system32\avgrsstx.dll 2010-04-11 18:43 . 2010-04-11 18:43 242696 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2010-04-11 18:42 . 2010-04-11 18:42 216200 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2010-04-11 18:42 . 2010-04-11 18:42 29512 ----a-w- c:\windows\system32\drivers\avgmfx86.sys 2010-04-11 18:42 . 2010-04-11 18:42 -------- d-----w- c:\windows\system32\drivers\Avg 2010-04-11 18:42 . 2010-04-11 18:42 -------- d-----w- c:\programmi\AVG 2010-04-11 18:42 . 2010-04-11 18:42 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\avg9 2010-04-07 17:37 . 2010-04-07 17:37 -------- d-----w- C:\FOUND.001 . (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-04-13 17:05 . 2006-08-30 22:34 12 ----a-w- c:\windows\bthservsdp.dat 2010-01-25 18:12 . 2006-08-30 22:13 85070 ----a-w- c:\windows\system32\perfc010.dat 2010-01-25 18:12 . 2006-08-30 22:13 490898 ----a-w- c:\windows\system32\perfh010.dat 2007-08-20 23:51 . 2007-08-05 14:02 3962192 ----a-w- c:\programmi\MsgPlusLive-423.exe 2007-05-27 07:36 . 2007-06-02 13:22 17938288 ----a-w- c:\programmi\Install_Messenger.exe . ((((((((((((((((((((((((((((((((((((( Punti Reg Caricati )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* i valori vuoti & legittimi/default non sono visualizzati. REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Mobile Partner"="c:\programmi\3 Internet\3 Internet.exe" [2008-12-05 110592] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LaunchApp"="Alaunch" [X] "igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 94208] "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 77824] "igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 118784] "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-03 110592] "ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-17 64512] "RTHDCPL"="RTHDCPL.EXE" [2006-06-28 16248320] "SkyTel"="SkyTel.EXE" [2006-05-16 2879488] "AzMixerSel"="c:\programmi\Realtek\InstallShield\AzMixerSel.exe" [2005-12-21 53248] "SynTPEnh"="c:\programmi\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 761946] "ntiMUI"="c:\programmi\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2006-05-15 45056] "ADMTray.exe"="c:\acer\Empowering Technology\admtray.exe" [2005-10-24 2462208] "eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2005-12-27 69632] "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-09-07 208952] "MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-09-07 59392] "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-09-07 455168] "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-09-07 455168] "ePower_DMC"="c:\acer\Empowering Technology\ePower\ePower_DMC.exe" [2006-08-10 352256] "Acer ePower Management"="c:\acer\Empowering Technology\ePower\Acer ePower Management.exe" [2006-05-22 3080704] "LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2006-07-20 593920] "eRecoveryService"="c:\acer\Empowering Technology\eRecovery\Monitor.exe" [2006-01-24 397312] "SunJavaUpdateSched"="c:\programmi\File comuni\Java\Java Update\jusched.exe" [2010-02-18 248040] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-09-07 15360] c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\ Adobe Reader Speed Launch.lnk - c:\programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2010-04-11 18:43 12464 ----a-w- c:\windows\system32\avgrsstx.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Programmi\\LimeWire\\LimeWire.exe"= "c:\\Programmi\\BitLord\\BitLord.exe"= "c:\\Programmi\\Skype\\Phone\\Skype.exe"= "c:\\Programmi\\AVG\\AVG9\\avgemc.exe"= "c:\\Programmi\\AVG\\AVG9\\avgupd.exe"= "c:\\Programmi\\AVG\\AVG9\\avgnsx.exe"= "c:\\Programmi\\MSN Messenger\\msnmsgr.exe"= "c:\\Programmi\\MSN Messenger\\livecall.exe"= "c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"= R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [11/04/2010 20.42.57 216200] R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [11/04/2010 20.43.03 242696] R2 avg9emc;AVG Free E-mail Scanner;c:\programmi\AVG\AVG9\avgemc.exe [11/04/2010 20.42.49 916760] R2 avg9wd;AVG Free WatchDog;c:\programmi\AVG\AVG9\avgwdsvc.exe [11/04/2010 20.42.47 308064] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] tapisrvs REG_MULTI_SZ cpqoko6 . . ------- Scansione supplementare ------- . uStart Page = hxxp://www.google.it/ uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7 mStart Page = hxxp://it.intl.acer.yahoo.com uSearchURL,(Default) = hxxp://it.rd.yahoo.com/customize/ycomp/defaults/su/*http://it.yahoo.com IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\portatile\Dati applicazioni\Mozilla\Firefox\Profiles\ta7lm66p.default\ FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- FIREFOX POLICIES ---- c:\programmi\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\programmi\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\programmi\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\programmi\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\programmi\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\programmi\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\programmi\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\programmi\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\programmi\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\programmi\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\programmi\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\programmi\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\programmi\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\programmi\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\programmi\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\programmi\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\programmi\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false); c:\programmi\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true); c:\programmi\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\programmi\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\programmi\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\programmi\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\programmi\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\programmi\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); . - - - - CHIAVI ORFANE RIMOSSE - - - - HKCU-Run-VMCL - f:\\VMC_PBStarter.exe AddRemove-{B8287D11-3CF7-27BC-519B-7A2EC444E3AE} - c:\windows\system32\gckairrfunuhjnjmn.dll-uninst.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-04-13 19:57 Windows 5.1.2600 Service Pack 2 FAT NTAPI scansione processi nascosti ... scansione entrate autostart nascoste ... Scansione files nascosti ... Scansione completata con successo Files nascosti: 0 ************************************************************************** . --------------------- Dlls caricate dai processi in esecuzione --------------------- - - - - - - - > 'explorer.exe'(4076) c:\windows\system32\WININET.dll c:\windows\system32\MSNChatHook.dll c:\windows\system32\sysenv.dll c:\windows\system32\MSVCR71.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Altri processi in esecuzione ------------------------ . c:\programmi\Intel\Wireless\Bin\EvtEng.exe c:\programmi\AVG\AVG9\avgchsvx.exe c:\programmi\AVG\AVG9\avgrsx.exe c:\programmi\Intel\Wireless\Bin\S24EvMon.exe c:\programmi\AVG\AVG9\avgcsrvx.exe c:\acer\Empowering Technology\admServ.exe c:\programmi\AVG\AVG9\avgnsx.exe c:\windows\eHome\ehRecvr.exe c:\windows\eHome\ehSched.exe c:\programmi\Java\jre6\bin\jqs.exe c:\programmi\File comuni\LightScribe\LSSrvc.exe c:\programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE c:\programmi\Intel\Wireless\Bin\RegSrvc.exe c:\windows\ehome\mcrdsvc.exe c:\programmi\AVG\AVG9\avgcsrvx.exe c:\windows\system32\wbem\wmiapsrv.exe c:\windows\system32\dllhost.exe c:\windows\system32\wscntfy.exe c:\windows\system32\rundll32.exe c:\windows\RTHDCPL.EXE c:\windows\eHome\ehmsas.exe c:\windows\system32\wbem\unsecapp.exe c:\windows\system32\igfxext.exe c:\windows\system32\igfxsrvc.exe c:\docume~1\PORTAT~1\IMPOST~1\Temp\RtkBtMnt.exe . ************************************************************************** . Ora fine scansione: 2010-04-13 19:59:42 - Il pc è stato riavviato ComboFix-quarantined-files.txt 2010-04-13 17:59 Pre-Run: 28.525.101.056 byte disponibili Post-Run: 28.433.547.264 byte disponibili - - End Of File - - BA55A380D7AB98056AD499A828B27299

di **-> EleKtrA <-** » 13/04/10 19:16

Scarica ed installa questa Patch
Aggiornamento della protezione per Windows XP (KB958644)

Scarica Malwarebytes, installa il programma ed aggiorna le firme.
Nella scheda scansione, seleziona "scansione completa"
Allega il rapporto.

di **Marco83** » 15/04/10 09:53

Ecco il rapporto:

Codice: Seleziona tutto: Malwarebytes' Anti-Malware 1.45 www.malwarebytes.org Versione database: 3985 Windows 5.1.2600 Service Pack 2 Internet Explorer 7.0.5730.11 15/04/2010 10.49.13 mbam-log-2010-04-15 (10-49-13).txt Tipo di scansione: Scansione completa (C:\|D:\|) Elementi esaminati: 164359 Tempo trascorso: 36 minuti, 8 secondi Processi infetti in memoria: 0 Moduli di memoria infetti: 0 Chiavi di registro infette: 3 Valori di registro infetti: 1 Voci infette nei dati di registro: 0 Cartelle infette: 0 File infetti: 29 Processi infetti in memoria: (Non sono stati rilevati elementi nocivi) Moduli di memoria infetti: (Non sono stati rilevati elementi nocivi) Chiavi di registro infette: HKEY_CLASSES_ROOT\AppID\{8d71eeb8-a1a7-4733-8fa2-1cac015c967d} (Trojan.BHO) -> No action taken. HKEY_CLASSES_ROOT\Typelib\{c3c0ec2c-2c1c-495c-9ad0-1f0ef833d7b5} (Trojan.BHO) -> No action taken. HKEY_CLASSES_ROOT\AppID\Sidebar.dll (Trojan.BHO) -> No action taken. Valori di registro infetti: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\tapisrvs (Worm.KoobFace) -> No action taken. Voci infette nei dati di registro: (Non sono stati rilevati elementi nocivi) Cartelle infette: (Non sono stati rilevati elementi nocivi) File infetti: C:\System Volume Information\_restore{0945435B-1507-4631-B9A9-29A60025D023}\RP178\A0034629.exe (Trojan.BHO) -> No action taken. C:\System Volume Information\_restore{0945435B-1507-4631-B9A9-29A60025D023}\RP178\A0034634.exe (Trojan.Agent) -> No action taken. C:\System Volume Information\_restore{0945435B-1507-4631-B9A9-29A60025D023}\RP178\A0034636.exe (Trojan.BHO) -> No action taken. C:\System Volume Information\_restore{0945435B-1507-4631-B9A9-29A60025D023}\RP178\A0034639.exe (Adware.AdRotator) -> No action taken. C:\Qoobox\Quarantine\C\Documents and Settings\portatile\Impostazioni locali\Dati applicazioni\rdr_1268933387.exe.vir (Worm.KoobFace) -> No action taken. C:\Qoobox\Quarantine\C\Documents and Settings\portatile\Impostazioni locali\Dati applicazioni\rdr_1270662075.exe.vir (Worm.KoobFace) -> No action taken. C:\Qoobox\Quarantine\C\Documents and Settings\portatile\Impostazioni locali\Dati applicazioni\rdr_1270662389.exe.vir (Worm.KoobFace) -> No action taken. C:\Qoobox\Quarantine\C\Documents and Settings\portatile\Impostazioni locali\Dati applicazioni\rdr_1270851342.exe.vir (Worm.KoobFace) -> No action taken. C:\Qoobox\Quarantine\C\Documents and Settings\portatile\Impostazioni locali\Dati applicazioni\rdr_1270851644.exe.vir (Worm.KoobFace) -> No action taken. C:\Qoobox\Quarantine\C\Documents and Settings\portatile\Impostazioni locali\Dati applicazioni\rdr_1270852930.exe.vir (Worm.KoobFace) -> No action taken. C:\Qoobox\Quarantine\C\Documents and Settings\portatile\Impostazioni locali\Dati applicazioni\rdr_1270853233.exe.vir (Worm.KoobFace) -> No action taken. C:\Qoobox\Quarantine\C\Documents and Settings\portatile\Impostazioni locali\Dati applicazioni\rdr_1271010698.exe.vir (Worm.KoobFace) -> No action taken. C:\Qoobox\Quarantine\C\Documents and Settings\portatile\Impostazioni locali\Dati applicazioni\rdr_1271011003.exe.vir (Worm.KoobFace) -> No action taken. C:\Qoobox\Quarantine\C\Documents and Settings\portatile\Impostazioni locali\Dati applicazioni\rdr_1271020751.exe.vir (Worm.KoobFace) -> No action taken. C:\Qoobox\Quarantine\C\Documents and Settings\portatile\Impostazioni locali\Dati applicazioni\rdr_1271021054.exe.vir (Worm.KoobFace) -> No action taken. C:\Qoobox\Quarantine\C\Documents and Settings\portatile\Impostazioni locali\Dati applicazioni\rdr_1271107298.exe.vir (Worm.KoobFace) -> No action taken. C:\Qoobox\Quarantine\C\Documents and Settings\portatile\Impostazioni locali\Dati applicazioni\rdr_1271107602.exe.vir (Worm.KoobFace) -> No action taken. C:\Qoobox\Quarantine\C\Documents and Settings\portatile\Impostazioni locali\Dati applicazioni\rdr_1271177343.exe.vir (Worm.KoobFace) -> No action taken. C:\Qoobox\Quarantine\C\Documents and Settings\portatile\Impostazioni locali\Dati applicazioni\rdr_1271177345.exe.vir (Worm.KoobFace) -> No action taken. C:\Qoobox\Quarantine\C\Programmi\webserver\webserver.exe.vir (Worm.KoobFace) -> No action taken. C:\Qoobox\Quarantine\C\WINDOWS\bill104.exe.vir (Worm.KoobFace) -> No action taken. C:\Qoobox\Quarantine\C\WINDOWS\bill106.exe.vir (Worm.KoobFace) -> No action taken. C:\Qoobox\Quarantine\C\WINDOWS\system32\{a61c88a7-a482-c745-ef7c-c314895727d9}.dll-uninst.exe.vir (Trojan.BHO) -> No action taken. C:\Qoobox\Quarantine\C\WINDOWS\system32\captcha.dll.vir (Worm.KoobFace) -> No action taken. C:\Qoobox\Quarantine\C\WINDOWS\system32\erokosvc.dll.vir (Worm.KoobFace) -> No action taken. C:\Qoobox\Quarantine\C\WINDOWS\system32\gckairrfunuhjnjmn.dll-uninst.exe.vir (Trojan.Agent) -> No action taken. C:\Qoobox\Quarantine\C\WINDOWS\system32\myss_sb_uninstall.exe.vir (Trojan.BHO) -> No action taken. C:\Qoobox\Quarantine\C\WINDOWS\system32\superiorads-uninst.exe.vir (Adware.AdRotator) -> No action taken. C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\imapioko.sys.vir (Worm.KoobFace) -> No action taken.

di **Marco83** » 17/04/10 11:04

Ragazzi scusatemi, come devo procedere ora? DEvo eliminare le infezioni trovate da malwarebytes?
Grazie ancora

di **-> EleKtrA <-** » 17/04/10 11:40

Si, rimuovi i file infetti trovati da Malwarebytes ed allega un nuovo log di hijackthis.

di **Marco83** » 17/04/10 13:56

Eccolo:

Codice: Seleziona tutto: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14.54.32, on 17/04/2010 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.17023) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Programmi\Intel\Wireless\Bin\EvtEng.exe C:\Programmi\Intel\Wireless\Bin\S24EvMon.exe C:\Programmi\AVG\AVG9\avgchsvx.exe C:\Programmi\AVG\AVG9\avgrsx.exe C:\Programmi\AVG\AVG9\avgcsrvx.exe C:\WINDOWS\system32\spoolsv.exe C:\Programmi\AVG\AVG9\avgwdsvc.exe C:\Acer\Empowering Technology\admServ.exe C:\Programmi\AVG\AVG9\avgnsx.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Programmi\Java\jre6\bin\jqs.exe C:\Programmi\File comuni\LightScribe\LSSrvc.exe C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Programmi\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\Programmi\AVG\AVG9\avgemc.exe C:\Programmi\AVG\AVG9\avgcsrvx.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\ehome\ehtray.exe C:\WINDOWS\eHome\ehmsas.exe C:\WINDOWS\RTHDCPL.EXE C:\Acer\Empowering Technology\eRecovery\Monitor.exe C:\WINDOWS\system32\wuauclt.exe C:\Programmi\Synaptics\SynTP\SynTPEnh.exe C:\Acer\Empowering Technology\admtray.exe C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe C:\Acer\Empowering Technology\ePower\ePower_DMC.exe C:\WINDOWS\system32\wbem\unsecapp.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\LAUNCH~1\LManager.exe C:\Programmi\File comuni\Java\Java Update\jusched.exe C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\WINDOWS\system32\igfxext.exe C:\WINDOWS\system32\igfxsrvc.exe C:\DOCUME~1\PORTAT~1\IMPOST~1\Temp\RtkBtMnt.exe C:\Programmi\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://it.intl.acer.yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://it.rd.yahoo.com/customize/ycomp/defaults/su/*http://it.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti R3 - URLSearchHook: Yahoo! Toolbar con blocco Pop-Up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programmi\AVG\AVG9\avgssie.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmi\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [LaunchApp] Alaunch O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [AzMixerSel] C:\Programmi\Realtek\InstallShield\AzMixerSel.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [ntiMUI] C:\Programmi\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe O4 - HKLM\..\Run: [ADMTray.exe] "C:\Acer\Empowering Technology\admtray.exe" O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe O4 - HKLM\..\Run: [Acer ePower Management] C:\Acer\Empowering Technology\ePower\Acer ePower Management.exe boot O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\File comuni\Java\Java Update\jusched.exe" O4 - HKCU\..\Run: [Mobile Partner] C:\Programmi\3 Internet\3 Internet.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe (file missing) O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programmi\AVG\AVG9\avgpp.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Programmi\AVG\AVG9\avgemc.exe O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Programmi\AVG\AVG9\avgwdsvc.exe O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\EvtEng.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmi\Java\jre6\bin\jqs.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - C:\Programmi\WinPcap\rpcapd.exe (file missing) O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\S24EvMon.exe -- End of file - 8510 bytes

Una domanda: Malwarebytes è un buon software per rimuovere infezioni?
Non l'ho mai usato e ne ho sentito parlare poco...
Thanks

di **-> EleKtrA <-** » 18/04/10 08:47

Buongiorno Marco83.

Malwarebytes è un ottimo software antimalware, puoi tenerlo per future scansioni ricordandoti di aggiornarlo prima.

Ora ti guiderò in una serie di Step per cercare di ottimizzare il computer.

Step 1: Pulizia dei file temporanei
Scarica TFC by OldTimer sul desktop
chiudi tutti i programmi
avvia TFC, clicca su "star"
al termine della scansione ti chiederà il riavvio, dai ok.

Step 2: Pulizia e disinstallazione dei tool usati
Scarica OTC by OldTimer sul desktop
doppio clic per eseguirlo
clicca su "CleanUP" > "Yes" > "Yes"
riavvia.

Step 4: aggiornamento dei software
- Scarica e installa l'ultima versione di Adobe Reader
- Scarica e installa l'ultima versione di Java Sun
- Aggiorna Adobe FlashPlayer:
1. Scarica il programma di disinstallazione di FlashPlayer
2. Scarica l'ultima versione di FlashPlayer per IE
3. Scarica l'ultima versione di FlashPlayer per FF
4. Chiudi tutti i browser (IE, Opera, Firefox, Chrome, etc)
5. Esegui il programma di disinstallazione scaricato al punto 1.
6. Esegui il programma di installazione scaricato al punto 2.
7. Esegui il programma di installazione scaricato al punto 3.

Step 5: Correzione piccoli errori e velocizzazione del Sistema

- Esegui una deframmentazione degli hardisk, puoi usare IObit SmartDefrag.
Oppure con l' utility interna di windows:
Start / Programmi / Accessori / Utilità di sistema / Utilità di deframmentazione dischi.

- Esegui uno Scandisk:
Apri Risorse del computer / Tasto destro sul disco fisso / proprietà / Strumenti / Esegui Scandisk
Seleziona entrambe le opzioni:
correggi automaticamente gli errori del File system,
cerca i settori danneggiati e tenta il ripristino.
Si aprirà una finestra di avvertimento:
Impossibile ottenere accesso esclusivo ad alcuni file di Windows...
Clicca su "SI" per pianificare l'operazione al prossimo avvio.

Step 6: Fixiamo le voci superflue con Hijackthis
Con tutte le applicazioni chiuse e disconnesso da internet
Avvia Hijackthis e clicca su "do a system scan only"
Metti la spunta a queste voci e clicca su "fix checked"

Codice: Seleziona tutto: O4 - HKLM\..\Run: [LaunchApp] Alaunch O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [AzMixerSel] C:\Programmi\Realtek\InstallShield\AzMixerSel.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

Step 7: Aggiornamento Windows
Download: Pacchetto di installazione di rete di Windows XP Service Pack 3

Nota: Dall'ultimo log AVG non risulta in avvio automatico. Sicuro che sia attivo?

di **Marco83** » 18/04/10 13:11

Perfetto, ho seguito tutti tuoi consigli..
Grazie mille per l'aiuto, sei un grande

Help me pubblicità

Help me pubblicità

Re: Help me pubblicità

Re: Help me pubblicità

Re: Help me pubblicità

Re: Help me pubblicità

Re: Help me pubblicità

Re: Help me pubblicità

Re: Help me pubblicità

Re: Help me pubblicità

Re: Help me pubblicità

Re: Help me pubblicità

Re: Help me pubblicità

Topic correlati a "Help me pubblicità":

Chi c’è in linea