Super Help Me! Questo è Il Mio Log File...

[temerario]

Mi si sconnette Alice, mi ha messo fuori gioco il router, mi comparivano i pop-up di regfixit.com ora bloccati, tenta di connettersi a qualche dealers.. Insomma una tragedia... Chiedo aiuto...

Logfile of HijackThis v1.99.1

Scan saved at 19.17.30, on 30/10/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\Windows\System32\smss.exe

C:\Windows\system32\winlogon.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\system32\spoolsv.exe

C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe

C:\Windows\System32\Ati2evxx.exe

C:\Programmi\Alwil Software\Avast4\ashServ.exe

C:\Windows\Explorer.EXE

C:\Programmi\Comodo\Firewall\cmdagent.exe

C:\Programmi\iTunes\iTunesHelper.exe

C:\Windows\system32\atiptaxx.exe

C:\Programmi\Spyware Terminator\SpywareTerminatorShield.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Windows\Temp\umdn1.exe

C:\Programmi\Comodo\Firewall\CPF.exe

C:\Programmi\Iomega\Automatic Backup Pro\LiveSystem.exe

C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe

C:\Windows\System32\svchost.exe

C:\Programmi\iPod\bin\iPodService.exe

C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe

C:\Programmi\Alwil Software\Avast4\ashWebSv.exe

C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe

C:\Programmi\Sicurezza\Hijack\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://hb.bam.it/bamonline

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.bam.it/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti

R3 - Default URLSearchHook is missing

O2 - BHO: Class - {034B27CC-1B3A-217C-8D5F-24740DB81DCF} - C:\Windows\djtnk1.dll (file missing)

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Windows\System32\NeroCheck.exe

O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [CloneCDTray] "C:\Programmi\SlySoft\CloneCD\CloneCDTray.exe" /s

O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe

O4 - HKLM\..\Run: [spywareTerminator] "C:\Programmi\Spyware Terminator\SpywareTerminatorShield.exe"

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [umdn1.exe] C:\Windows\Temp\umdn1.exe

O4 - HKLM\..\Run: [Comodo Firewall] "C:\Programmi\Comodo\Firewall\CPF.exe" /background

O4 - HKCU\..\Run: [iomega Automatic Backup Pro] "C:\Programmi\Iomega\Automatic Backup Pro\LiveSystem.exe" -s

O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?

O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - (no file)

O15 - Trusted Zone: www.archiviosex.net

O15 - Trusted Zone: www.skymasters.biz

O17 - HKLM\System\CCS\Services\Tcpip\..\{6B78D47F-5900-48D0-8852-997ADC9D7BDA}: NameServer = 212.216.112.112

O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: Ati HotKey Poller - Unknown owner - C:\Windows\System32\Ati2evxx.exe

O23 - Service: avast! Antivirus - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Programmi\Comodo\Firewall\cmdagent.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPodService - Apple Computer, Inc. - C:\Programmi\iPod\bin\iPodService.exe

[$angelique!?]

[ben]temerario[/ben]

ciao temerario,

iniziamo con questi passaggi:

usa questi tools contro LinkOptimizer

http://www.mytempdir.com/988986

A fine scansione posta il log che si trova in c:\gromozon_removal.log

Poi usa anche questo Tool Symantec (Sito alternativo http://www.mytempdir.com/1003691)

Posta il log che si trova in FixLinkopt.log

Scarica installa ed aggiorna il http://www.tgsoft.it/italy/download.htm

poi riavvia in modalità provvisoria e fai una scansione completa del sistema. (salva il log)

Se i tools non dovessero avviarsi prova a rinominali es FixGrom.exe -> ciao.exe. (le ultime versioni del virus controllano se viene eseguito un programma con nome FixGrom.exe).

per ultima cosa, posta un log aggiornato di Hijackthis, cosi vedremo gli ultimi passaggi da effettuare.

[temerario]

Grazie Angelique,

Ora provo..

[temerario]

Eseguito passo a passo quanto detto da Angelique:

1) tool FixGrom, ecco il risultato:

Removal tool loaded into memory

------------------------------------

Executing rootkit removal engine....

------------------------------------

Disabling rootkit file: \\?\C:\Windows\lpt1.owx

\\?\C:\Windows\lpt1.owx

Resetting file permissions...

Clearing attributes...

Accesso negato - C:\_cleaned.tmp

Removing file...

Rootkit removed! Cleaning up...

Removing temp files...

Scanning: C:\Windows

Scanning: C:\Programmi\File comuni

Removing protected file: C:\Programmi\File comuni\System\ajPAh.exe

Removing protected file: C:\Programmi\File comuni\System\AZa.exe

Removing protected file: C:\Programmi\File comuni\System\BOy.exe

Removing protected file: C:\Programmi\File comuni\System\BPEna.exe

Removing protected file: C:\Programmi\File comuni\System\Btt.exe

Removing protected file: C:\Programmi\File comuni\System\cnL.exe

Removing protected file: C:\Programmi\File comuni\System\CslFJY.exe

Removing protected file: C:\Programmi\File comuni\System\daAfok.exe

Removing protected file: C:\Programmi\File comuni\System\DEvXq.exe

Removing protected file: C:\Programmi\File comuni\System\DFS.exe

Removing protected file: C:\Programmi\File comuni\System\DtR.exe

Removing protected file: C:\Programmi\File comuni\System\DunWfS.exe

Removing protected file: C:\Programmi\File comuni\System\DxA.exe

Removing protected file: C:\Programmi\File comuni\System\dXe.exe

Removing protected file: C:\Programmi\File comuni\System\dYSOgq.exe

Removing protected file: C:\Programmi\File comuni\System\DZApCS.exe

Removing protected file: C:\Programmi\File comuni\System\eOX.exe

Removing protected file: C:\Programmi\File comuni\System\EWi.exe

Removing protected file: C:\Programmi\File comuni\System\exs.exe

Removing protected file: C:\Programmi\File comuni\System\FCx.exe

Removing protected file: C:\Programmi\File comuni\System\FNX.exe

Removing protected file: C:\Programmi\File comuni\System\FVy.exe

Removing protected file: C:\Programmi\File comuni\System\gdEl.exe

Removing protected file: C:\Programmi\File comuni\System\goRS.exe

Removing protected file: C:\Programmi\File comuni\System\gWrxH.exe

Removing protected file: C:\Programmi\File comuni\System\hDDRHq.exe

Removing protected file: C:\Programmi\File comuni\System\HEm.exe

Removing protected file: C:\Programmi\File comuni\System\HmBEm.exe

Removing protected file: C:\Programmi\File comuni\System\HQdtD.exe

Removing protected file: C:\Programmi\File comuni\System\HWt.exe

Removing protected file: C:\Programmi\File comuni\System\IeW.exe

Removing protected file: C:\Programmi\File comuni\System\Imt.exe

Removing protected file: C:\Programmi\File comuni\System\iWVNUa.exe

Removing protected file: C:\Programmi\File comuni\System\jBf.exe

Removing protected file: C:\Programmi\File comuni\System\JCNzMG.exe

Removing protected file: C:\Programmi\File comuni\System\JeW.exe

Removing protected file: C:\Programmi\File comuni\System\jgI.exe

Removing protected file: C:\Programmi\File comuni\System\jilR.exe

Removing protected file: C:\Programmi\File comuni\System\jSc.exe

Removing protected file: C:\Programmi\File comuni\System\JwYuZ.exe

Removing protected file: C:\Programmi\File comuni\System\Kbz.exe

Removing protected file: C:\Programmi\File comuni\System\kQBws.exe

Removing protected file: C:\Programmi\File comuni\System\LDE.exe

Removing protected file: C:\Programmi\File comuni\System\lef.exe

Removing protected file: C:\Programmi\File comuni\System\lfzSP.exe

Removing protected file: C:\Programmi\File comuni\System\LTE.exe

Removing protected file: C:\Programmi\File comuni\System\LTM.exe

Removing protected file: C:\Programmi\File comuni\System\LZQ.exe

Removing protected file: C:\Programmi\File comuni\System\MfKkv.exe

Removing protected file: C:\Programmi\File comuni\System\MVCyP.exe

Removing protected file: C:\Programmi\File comuni\System\naG.exe

Removing protected file: C:\Programmi\File comuni\System\nEN.exe

Removing protected file: C:\Programmi\File comuni\System\nOJ.exe

Removing protected file: C:\Programmi\File comuni\System\nwnW.exe

Removing protected file: C:\Programmi\File comuni\System\NXuOM.exe

Removing protected file: C:\Programmi\File comuni\System\OeS.exe

Removing protected file: C:\Programmi\File comuni\System\org.exe

Removing protected file: C:\Programmi\File comuni\System\OwpKHa.exe

Removing protected file: C:\Programmi\File comuni\System\pmB.exe

Removing protected file: C:\Programmi\File comuni\System\Pusp.exe

Removing protected file: C:\Programmi\File comuni\System\PvVoOJ.exe

Removing protected file: C:\Programmi\File comuni\System\QBJ.exe

Removing protected file: C:\Programmi\File comuni\System\qcqCq.exe

Removing protected file: C:\Programmi\File comuni\System\QLG.exe

Removing protected file: C:\Programmi\File comuni\System\qru.exe

Removing protected file: C:\Programmi\File comuni\System\qZDwpK.exe

Removing protected file: C:\Programmi\File comuni\System\rclRk.exe

Removing protected file: C:\Programmi\File comuni\System\RhRY.exe

Removing protected file: C:\Programmi\File comuni\System\rNu.exe

Removing protected file: C:\Programmi\File comuni\System\RWmSK.exe

Removing protected file: C:\Programmi\File comuni\System\sCGnr.exe

Removing protected file: C:\Programmi\File comuni\System\sCP.exe

Removing protected file: C:\Programmi\File comuni\System\sek.exe

Removing protected file: C:\Programmi\File comuni\System\Sla.exe

Removing protected file: C:\Programmi\File comuni\System\STjbFw.exe

Removing protected file: C:\Programmi\File comuni\System\TAzk.exe

Removing protected file: C:\Programmi\File comuni\System\UWPBzl.exe

Removing protected file: C:\Programmi\File comuni\System\vLx.exe

Removing protected file: C:\Programmi\File comuni\System\vnZ.exe

Removing protected file: C:\Programmi\File comuni\System\vrrwi.exe

Removing protected file: C:\Programmi\File comuni\System\vSN.exe

Removing protected file: C:\Programmi\File comuni\System\vtS.exe

Removing protected file: C:\Programmi\File comuni\System\VWd.exe

Removing protected file: C:\Programmi\File comuni\System\VyW.exe

Removing protected file: C:\Programmi\File comuni\System\WaD.exe

Removing protected file: C:\Programmi\File comuni\System\wqbX.exe

Removing protected file: C:\Programmi\File comuni\System\XaA.exe

Removing protected file: C:\Programmi\File comuni\System\xCKp.exe

Removing protected file: C:\Programmi\File comuni\System\xlp.exe

Removing protected file: C:\Programmi\File comuni\System\yBa.exe

Removing protected file: C:\Programmi\File comuni\System\YRO.exe

Removing protected file: C:\Programmi\File comuni\System\ywA.exe

Removing protected file: C:\Programmi\File comuni\System\ZntqK.exe

Removing protected file: C:\Programmi\File comuni\System\ZUPm.exe

Removing protected file: C:\Programmi\File comuni\System\ZZum.exe

Trojan.Gromozon Removed!

2) tool Symantec, ecco il risultato:

Symantec Trojan.Linkoptimizer Removal Tool 1.0.8

Restored SeDebugPrivilege to Administrators group

registry: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run: umdn1.exe (value deleted)

C:\WINDOWS\Temp\umdn1.exe: (deleted)

Trojan.Linkoptimizer has been successfully removed from your computer!

Here is the report:

The total number of the scanned files: 49934

The number of deleted threat files: 1

The number of threat processes terminated: 0

The number of threat threads terminated: 0

The number of registry entries fixed: 1

The tool initiated a system reboot.

registry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (cleared)

3) Scansione tgsoft:

VirIT eXplorer Lite Log

[sCANSIONE DELLA MEMORIA]

OK

[sCANSIONE DELLA MEMORIA]

OK

[sCANSIONE DELLA MEMORIA]

OK

--------------------------------------------------------

30/10/2006 - 21:01:38

[sCANSIONE DEL REGISTRO]

{03F998B2-0E00-11D3-A498-00104B6EB52E} Infetto da Spyware.ViewPoint.A

* * * RIMOSSO * * *

{f250d521-225d-4d6b-8829-e064f944e180} Infetto da BHO.Agent.BM

* * * RIMOSSO * * *

[C:]

MASTER BOOT RECORD: OK

BOOT SECTOR: OK

C:\Programmi\Viewpoint\Viewpoint Media Player\AxMetaStream.dll Infetto da Spyware.ViewPoint.A

* * * RIMOSSO * * *

C:\WINDOWS\system32\bqaa.dll Infetto da BHO.Agent.BM

* * * RIMOSSO * * *

[D:]

Chiavi Registro infette: 2.

Files Infetti: 2.

Files Sospetti: 0.

Files Analizzati: 49799.

Files Totali: 49799.

Chiavi Registro rimosse: 2.

Virus Rimossi: 2.

Per ultimo, ecco il nuovo log aggiornato di Hijackthis:

Logfile of HijackThis v1.99.1

Scan saved at 21.59.16, on 30/10/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\Windows\System32\smss.exe

C:\Windows\system32\csrss.exe

C:\Windows\system32\winlogon.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\system32\spoolsv.exe

C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe

C:\Windows\System32\Ati2evxx.exe

C:\Programmi\Alwil Software\Avast4\ashServ.exe

C:\Programmi\Comodo\Firewall\cmdagent.exe

C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe

C:\Windows\System32\svchost.exe

C:\VEXPLITE\viritsvc.exe

C:\Windows\Explorer.EXE

C:\Programmi\iTunes\iTunesHelper.exe

C:\Windows\system32\atiptaxx.exe

C:\Programmi\Spyware Terminator\SpywareTerminatorShield.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Programmi\Comodo\Firewall\CPF.exe

C:\VEXPLITE\MONLITE.EXE

C:\Programmi\Iomega\Automatic Backup Pro\LiveSystem.exe

C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe

C:\Programmi\Alwil Software\Avast4\ashWebSv.exe

C:\Programmi\iPod\bin\iPodService.exe

C:\Windows\System32\alg.exe

C:\Programmi\Internet Explorer\iexplore.exe

C:\Programmi\Sicurezza\Hijack\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://hb.bam.it/bamonline

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.bam.it/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti

R3 - Default URLSearchHook is missing

O2 - BHO: Class - {034B27CC-1B3A-217C-8D5F-24740DB81DCF} - C:\Windows\djtnk1.dll (file missing)

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Windows\System32\NeroCheck.exe

O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [CloneCDTray] "C:\Programmi\SlySoft\CloneCD\CloneCDTray.exe" /s

O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe

O4 - HKLM\..\Run: [spywareTerminator] "C:\Programmi\Spyware Terminator\SpywareTerminatorShield.exe"

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [Comodo Firewall] "C:\Programmi\Comodo\Firewall\CPF.exe" /background

O4 - HKLM\..\Run: [VIRIT LITE MONITOR] C:\VEXPLITE\MONLITE.EXE

O4 - HKCU\..\Run: [iomega Automatic Backup Pro] "C:\Programmi\Iomega\Automatic Backup Pro\LiveSystem.exe" -s

O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?

O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - (no file)

O15 - Trusted Zone: www.archiviosex.net

O15 - Trusted Zone: www.skymasters.biz

O17 - HKLM\System\CCS\Services\Tcpip\..\{6B78D47F-5900-48D0-8852-997ADC9D7BDA}: NameServer = 212.216.112.112

O17 - HKLM\System\CCS\Services\Tcpip\..\{CD03FFC4-8B3D-44EE-A495-3A54BEE2E3E6}: NameServer = 85.37.17.6 85.38.28.89

O20 - AppInit_DLLs:

O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: Ati HotKey Poller - Unknown owner - C:\Windows\System32\Ati2evxx.exe

O23 - Service: avast! Antivirus - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Programmi\Comodo\Firewall\cmdagent.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPodService - Apple Computer, Inc. - C:\Programmi\iPod\bin\iPodService.exe

O23 - Service: SysAee - Unknown owner - C:\Programmi\File comuni\System\AZa.exe (file missing)

O23 - Service: Virit eXplorer Lite (viritsvclite) - TG Soft Sas www.tgsoft.it - C:\VEXPLITE\viritsvc.exe

Ancora grazie anticipatamente per l'aiuto...

[$angelique!?]

temerario, facciamo ancora qualche passaggio, questo file "AppInit_DLLs:" segnala la presenza di rootkit. :giu:

scarica sul desktop GMER: http://www.gmer.net/gmer.zip

scopatta, sempre sul desktop il file gmer.zip.

Esegui gmer.exe

Clicca sul Tab "Rootkit"

Clicca su "Scan"

finita la scansione clicca su "Copy"

Apri il Blocco Note salva il file ed allegalo qui

Esegui gmer.exe

Clicca sul Tab "Autostart"

Clicca su "Scan"

finita la scansione clicca su "Copy"

Apri il Blocco Note salva il file ed allegalo qui

[LiquiD]

Amgelique, non andrebbero fixate queste voci:

O15 - Trusted Zone: ww w.archiviosex.net

O15 - Trusted Zone: ww w.skymasters.biz

R3 - Default URLSearchHook is missing

O2 - BHO: Class - {034B27CC-1B3A-217C-8D5F-24740DB81DCF} - C:\Windows\djtnk1.dll (file missing)

O20 - AppInit_DLLs:

sono alle prime armi con il lgo di HJT qundi lo chiedo solo xcapire

il file dll con l'1 alla fine non è traccia del luridissimo linkoptimizer? se si visto che è stato già passato il FIX della symantec questo file persiste e non si dorvebbe fixare?

Modificato October 31, 2006 da Kuma

[temerario]

Ecco i risultati di GMER...

Devo fixare allora???

Grazie

GMER 1.0.12.11865 - http://www.gmer.net

Rootkit scan 2006-10-30 23:05:27

Windows 5.1.2600 Service Pack 2

---- System - GMER 1.0.12 ----

SSDT ZwClose \??\C:\Documents and Settings\All Users\Dati applicazioni\Spyware Terminator\sp_rsdrv2.sys

SSDT ZwConnectPort \SystemRoot\System32\DRIVERS\cmdmon.sys

SSDT ZwCreateFile \??\C:\Documents and Settings\All Users\Dati applicazioni\Spyware Terminator\sp_rsdrv2.sys

SSDT ZwCreateKey \??\C:\Documents and Settings\All Users\Dati applicazioni\Spyware Terminator\sp_rsdrv2.sys

SSDT ZwCreatePort \SystemRoot\System32\DRIVERS\cmdmon.sys

SSDT ZwCreateSection \??\C:\Documents and Settings\All Users\Dati applicazioni\Spyware Terminator\sp_rsdrv2.sys

SSDT ZwCreateThread \SystemRoot\System32\DRIVERS\cmdmon.sys

SSDT ZwDeleteKey \??\C:\Documents and Settings\All Users\Dati applicazioni\Spyware Terminator\sp_rsdrv2.sys

SSDT ZwDeleteValueKey \??\C:\Documents and Settings\All Users\Dati applicazioni\Spyware Terminator\sp_rsdrv2.sys

SSDT ZwEnumerateKey sptd.sys

SSDT ZwEnumerateValueKey sptd.sys

SSDT ZwLoadDriver \??\C:\Documents and Settings\All Users\Dati applicazioni\Spyware Terminator\sp_rsdrv2.sys

SSDT ZwOpenFile \??\C:\Documents and Settings\All Users\Dati applicazioni\Spyware Terminator\sp_rsdrv2.sys

SSDT ZwOpenKey sptd.sys

SSDT ZwOpenProcess \SystemRoot\System32\DRIVERS\cmdmon.sys

SSDT ZwOpenSection \SystemRoot\System32\DRIVERS\cmdmon.sys

SSDT ZwOpenThread \SystemRoot\System32\DRIVERS\cmdmon.sys

SSDT ZwQueryKey sptd.sys

SSDT ZwQueryValueKey sptd.sys

SSDT ZwSetContextThread \SystemRoot\System32\DRIVERS\cmdmon.sys

SSDT ZwSetValueKey \??\C:\Documents and Settings\All Users\Dati applicazioni\Spyware Terminator\sp_rsdrv2.sys

SSDT ZwTerminateProcess \??\C:\Documents and Settings\All Users\Dati applicazioni\Spyware Terminator\sp_rsdrv2.sys

SSDT ZwWriteFile \??\C:\Documents and Settings\All Users\Dati applicazioni\Spyware Terminator\sp_rsdrv2.sys

---- Kernel code sections - GMER 1.0.12 ----

.text ntoskrnl.exe!_abnormal_termination + 179 804E2D84 4 Bytes

.text ntoskrnl.exe!_abnormal_termination + 203 804E2D9C 4 Bytes

.text ntoskrnl.exe!_abnormal_termination + 227 804E2DB4 4 Bytes

.text ntoskrnl.exe!_abnormal_termination + 243 804E2DC4 4 Bytes

.text ntoskrnl.exe!_abnormal_termination + 263 804E2DD8 4 Bytes

.text ...

---- User code sections - GMER 1.0.12 ----

.text C:\WINDOWS\system32\svchost.exe[448] kernel32.dll!FreeLibrary + 21 7C80AA7B 4 Bytes

.text C:\VEXPLITE\VIRITSVC.EXE[500] kernel32.dll!FreeLibrary + 21 7C80AA7B 4 Bytes

.text C:\WINDOWS\explorer.exe[984] ntdll.dll!LdrUnloadDll 7C92718B 3 Bytes

.text C:\WINDOWS\explorer.exe[984] ntdll.dll!LdrUnloadDll + 4 7C92718F 2 Bytes

.text C:\WINDOWS\explorer.exe[984] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes

.text C:\WINDOWS\explorer.exe[984] kernel32.dll!FreeLibrary + 21 7C80AA7B 4 Bytes

.text C:\Programmi\Spyware Terminator\Spywareterminatorshield.Exe[1096] ntdll.dll!LdrUnloadDll 7C92718B 3 Bytes

.text C:\Programmi\Spyware Terminator\Spywareterminatorshield.Exe[1096] ntdll.dll!LdrUnloadDll + 4 7C92718F 2 Bytes

.text C:\Programmi\Spyware Terminator\Spywareterminatorshield.Exe[1096] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes

.text C:\Programmi\Spyware Terminator\Spywareterminatorshield.Exe[1096] kernel32.dll!FreeLibrary + 21 7C80AA7B 4 Bytes

.text C:\Programmi\Microsoft Office\OFFICE11\WINWORD.EXE[1272] ntdll.dll!LdrUnloadDll 7C92718B 3 Bytes

.text C:\Programmi\Microsoft Office\OFFICE11\WINWORD.EXE[1272] ntdll.dll!LdrUnloadDll + 4 7C92718F 2 Bytes

.text C:\Programmi\Microsoft Office\OFFICE11\WINWORD.EXE[1272] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes

.text C:\Programmi\Microsoft Office\OFFICE11\WINWORD.EXE[1272] kernel32.dll!FreeLibrary + 21 7C80AA7B 4 Bytes

.text C:\Programmi\iTunes\iTunesHelper.exe[1440] ntdll.dll!LdrUnloadDll 7C92718B 3 Bytes

.text C:\Programmi\iTunes\iTunesHelper.exe[1440] ntdll.dll!LdrUnloadDll + 4 7C92718F 2 Bytes

.text C:\Programmi\iTunes\iTunesHelper.exe[1440] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes

.text C:\Programmi\iTunes\iTunesHelper.exe[1440] kernel32.dll!FreeLibrary + 21 7C80AA7B 4 Bytes

.text C:\WINDOWS\system32\atiptaxx.exe[1468] ntdll.dll!LdrUnloadDll 7C92718B 3 Bytes

.text C:\WINDOWS\system32\atiptaxx.exe[1468] ntdll.dll!LdrUnloadDll + 4 7C92718F 2 Bytes

.text C:\WINDOWS\system32\atiptaxx.exe[1468] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes

.text C:\WINDOWS\system32\atiptaxx.exe[1468] kernel32.dll!FreeLibrary + 21 7C80AA7B 4 Bytes

.text C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe[1500] ntdll.dll!LdrUnloadDll 7C92718B 3 Bytes

.text C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe[1500] ntdll.dll!LdrUnloadDll + 4 7C92718F 2 Bytes

.text C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe[1500] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes

.text C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe[1500] kernel32.dll!FreeLibrary + 21 7C80AA7B 4 Bytes

.text C:\Programmi\Comodo\Firewall\cpf.exe[1768] ntdll.dll!LdrLoadDll 7C9261CA 3 Bytes

.text C:\Programmi\Comodo\Firewall\cpf.exe[1768] ntdll.dll!LdrLoadDll + 4 7C9261CE 2 Bytes

.text C:\Programmi\Comodo\Firewall\cpf.exe[1768] ntdll.dll!LdrUnloadDll 7C92718B 3 Bytes

.text C:\Programmi\Comodo\Firewall\cpf.exe[1768] ntdll.dll!LdrUnloadDll + 4 7C92718F 2 Bytes

.text C:\Programmi\Comodo\Firewall\cpf.exe[1768] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes

.text C:\Programmi\Comodo\Firewall\cpf.exe[1768] kernel32.dll!FreeLibrary + 21 7C80AA7B 4 Bytes

.text C:\VEXPLITE\MONLITE.EXE[1804] ntdll.dll!LdrUnloadDll 7C92718B 3 Bytes

.text C:\VEXPLITE\MONLITE.EXE[1804] ntdll.dll!LdrUnloadDll + 4 7C92718F 2 Bytes

.text C:\VEXPLITE\MONLITE.EXE[1804] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes

.text C:\VEXPLITE\MONLITE.EXE[1804] kernel32.dll!FreeLibrary + 21 7C80AA7B 4 Bytes

.text C:\Programmi\Iomega\Automatic Backup Pro\LiveSystem.exe[1824] ntdll.dll!LdrUnloadDll 7C92718B 3 Bytes

.text C:\Programmi\Iomega\Automatic Backup Pro\LiveSystem.exe[1824] ntdll.dll!LdrUnloadDll + 4 7C92718F 2 Bytes

.text C:\Programmi\Iomega\Automatic Backup Pro\LiveSystem.exe[1824] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes

.text C:\Programmi\Iomega\Automatic Backup Pro\LiveSystem.exe[1824] kernel32.dll!FreeLibrary + 21 7C80AA7B 4 Bytes

.text C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe[2084] kernel32.dll!FreeLibrary + 21 7C80AA7B 4 Bytes

.text C:\Programmi\Alwil Software\Avast4\ashWebSv.exe[2108] kernel32.dll!FreeLibrary + 21 7C80AA7B 4 Bytes

.text C:\Programmi\iPod\bin\iPodService.exe[2148] kernel32.dll!FreeLibrary + 21 7C80AA7B 4 Bytes

.text C:\Programmi\Internet Explorer\iexplore.exe[2200] ntdll.dll!LdrUnloadDll 7C92718B 3 Bytes

.text C:\Programmi\Internet Explorer\iexplore.exe[2200] ntdll.dll!LdrUnloadDll + 4 7C92718F 2 Bytes

.text C:\Programmi\Internet Explorer\iexplore.exe[2200] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes

.text C:\Programmi\Internet Explorer\iexplore.exe[2200] kernel32.dll!FreeLibrary + 21 7C80AA7B 4 Bytes

.text C:\WINDOWS\system32\alg.exe[2412] kernel32.dll!FreeLibrary + 21 7C80AA7B 4 Bytes

.text C:\Documents and Settings\Administrator\Desktop\gmer.exe[2856] ntdll.dll!LdrUnloadDll 7C92718B 3 Bytes

.text C:\Documents and Settings\Administrator\Desktop\gmer.exe[2856] ntdll.dll!LdrUnloadDll + 4 7C92718F 2 Bytes

.text C:\Documents and Settings\Administrator\Desktop\gmer.exe[2856] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes

.text C:\Documents and Settings\Administrator\Desktop\gmer.exe[2856] kernel32.dll!FreeLibrary + 21 7C80AA7B 4 Bytes

.text C:\Programmi\Microsoft Office\OFFICE11\OUTLOOK.EXE[3964] ntdll.dll!LdrUnloadDll 7C92718B 3 Bytes

.text C:\Programmi\Microsoft Office\OFFICE11\OUTLOOK.EXE[3964] ntdll.dll!LdrUnloadDll + 4 7C92718F 2 Bytes

.text C:\Programmi\Microsoft Office\OFFICE11\OUTLOOK.EXE[3964] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes

.text C:\Programmi\Microsoft Office\OFFICE11\OUTLOOK.EXE[3964] kernel32.dll!FreeLibrary + 21 7C80AA7B 4 Bytes

---- Devices - GMER 1.0.12 ----

Device \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE 83B8AE30

Device \FileSystem\Ntfs \Ntfs IRP_MJ_CLOSE 83B8AE30

Device \FileSystem\Ntfs \Ntfs IRP_MJ_READ 83B8AE30

Device \FileSystem\Ntfs \Ntfs IRP_MJ_WRITE 83B8AE30

Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_INFORMATION 83B8AE30

Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_INFORMATION 83B8AE30

Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_EA 83B8AE30

Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_EA 83B8AE30

Device \FileSystem\Ntfs \Ntfs IRP_MJ_FLUSH_BUFFERS 83B8AE30

Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_VOLUME_INFORMATION 83B8AE30

Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_VOLUME_INFORMATION 83B8AE30

Device \FileSystem\Ntfs \Ntfs IRP_MJ_DIRECTORY_CONTROL 83B8AE30

Device \FileSystem\Ntfs \Ntfs IRP_MJ_FILE_SYSTEM_CONTROL 83B8AE30

Device \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CONTROL 83B8AE30

Device \FileSystem\Ntfs \Ntfs IRP_MJ_SHUTDOWN 83B8AE30

Device \FileSystem\Ntfs \Ntfs IRP_MJ_LOCK_CONTROL 83B8AE30

Device \FileSystem\Ntfs \Ntfs IRP_MJ_CLEANUP 83B8AE30

Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_SECURITY 83B8AE30

Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_SECURITY 83B8AE30

Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_QUOTA 83B8AE30

Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_QUOTA 83B8AE30

Device \FileSystem\Ntfs \Ntfs IRP_MJ_PNP 83B8AE30

Device \Driver\NetBT \Device\NetBT_Tcpip_{591F0050-0595-444A-BABE-3671A38C98AC} IRP_MJ_CREATE 835C7EB0

Device \Driver\NetBT \Device\NetBT_Tcpip_{591F0050-0595-444A-BABE-3671A38C98AC} IRP_MJ_CLOSE 835C7EB0

Device \Driver\NetBT \Device\NetBT_Tcpip_{591F0050-0595-444A-BABE-3671A38C98AC} IRP_MJ_DEVICE_CONTROL 835C7EB0

Device \Driver\NetBT \Device\NetBT_Tcpip_{591F0050-0595-444A-BABE-3671A38C98AC} IRP_MJ_INTERNAL_DEVICE_CONTROL 835C7EB0

Device \Driver\NetBT \Device\NetBT_Tcpip_{591F0050-0595-444A-BABE-3671A38C98AC} IRP_MJ_CLEANUP 835C7EB0

Device \Driver\NetBT \Device\NetBT_Tcpip_{591F0050-0595-444A-BABE-3671A38C98AC} IRP_MJ_PNP 835C7EB0

Device \Driver\NetBT \Device\NetBT_Tcpip_{CD03FFC4-8B3D-44EE-A495-3A54BEE2E3E6} IRP_MJ_CREATE 835C7EB0

Device \Driver\NetBT \Device\NetBT_Tcpip_{CD03FFC4-8B3D-44EE-A495-3A54BEE2E3E6} IRP_MJ_CLOSE 835C7EB0

Device \Driver\NetBT \Device\NetBT_Tcpip_{CD03FFC4-8B3D-44EE-A495-3A54BEE2E3E6} IRP_MJ_DEVICE_CONTROL 835C7EB0

Device \Driver\NetBT \Device\NetBT_Tcpip_{CD03FFC4-8B3D-44EE-A495-3A54BEE2E3E6} IRP_MJ_INTERNAL_DEVICE_CONTROL 835C7EB0

Device \Driver\NetBT \Device\NetBT_Tcpip_{CD03FFC4-8B3D-44EE-A495-3A54BEE2E3E6} IRP_MJ_CLEANUP 835C7EB0

Device \Driver\NetBT \Device\NetBT_Tcpip_{CD03FFC4-8B3D-44EE-A495-3A54BEE2E3E6} IRP_MJ_PNP 835C7EB0

Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_CREATE 83BD74F0

Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_READ 83BD74F0

Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_WRITE 83BD74F0

Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_FLUSH_BUFFERS 83BD74F0

Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_DEVICE_CONTROL 83BD74F0

Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_INTERNAL_DEVICE_CONTROL 83BD74F0

Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_SHUTDOWN 83BD74F0

Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_CLEANUP 83BD74F0

Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_POWER 83BD74F0

Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_SYSTEM_CONTROL 83BD74F0

Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_PNP 83BD74F0

Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE 838AD0E8

Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CLOSE 838AD0E8

Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_READ 838AD0E8

Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_WRITE 838AD0E8

Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_FLUSH_BUFFERS 838AD0E8

Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DEVICE_CONTROL

[temerario]

GMER 1.0.12.11865 - http://www.gmer.net

Autostart scan 2006-10-30 23:19:04

Windows 5.1.2600 Service Pack 2

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems@Windows = %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

HKLM\Software\Microsoft\Windows NT\CurrentVersion\ >>>

Winlogon@Userinit = C:\WINDOWS\system32\userinit.exe,

Windows@AppInit_DLLs =

HKLM\SYSTEM\CurrentControlSet\Services\ >>>

aswUpdSv /*avast! iAVS4 Control Service*/@ = "C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe"

Ati HotKey Poller@ = %SystemRoot%\System32\Ati2evxx.exe

avast! Antivirus /*avast! Antivirus*/@ = "C:\Programmi\Alwil Software\Avast4\ashServ.exe"

CmdAgent /*Comodo Application Agent*/@ = C:\Programmi\Comodo\Firewall\cmdagent.exe

MDM /*Machine Debug Manager*/@ = "C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe"

ScsiPort@ = %SystemRoot%\system32\drivers\scsiport.sys

Spooler /*Spooler di stampa*/@ = %SystemRoot%\system32\spoolsv.exe

SysAee /*SysAee*/@ = "C:\Programmi\File comuni\System\AZa.exe" /*file not found*/

viritsvclite /*Virit eXplorer Lite*/@ = C:\VEXPLITE\viritsvc.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\Run >>>

@NeroFilterCheckC:\Windows\System32\NeroCheck.exe = C:\Windows\System32\NeroCheck.exe

@iTunesHelper"C:\Programmi\iTunes\iTunesHelper.exe" = "C:\Programmi\iTunes\iTunesHelper.exe"

@QuickTime Task"C:\Programmi\QuickTime\qttask.exe" -atboottime = "C:\Programmi\QuickTime\qttask.exe" -atboottime

@CloneCDTray"C:\Programmi\SlySoft\CloneCD\CloneCDTray.exe" /s = "C:\Programmi\SlySoft\CloneCD\CloneCDTray.exe" /s

@ATIPTAatiptaxx.exe = atiptaxx.exe

@SpywareTerminator"C:\Programmi\Spyware Terminator\SpywareTerminatorShield.exe" = "C:\Programmi\Spyware Terminator\SpywareTerminatorShield.exe"

@avast!C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe = C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

@Comodo Firewall"C:\Programmi\Comodo\Firewall\CPF.exe" /background = "C:\Programmi\Comodo\Firewall\CPF.exe" /background

@VIRIT LITE MONITORC:\VEXPLITE\MONLITE.EXE = C:\VEXPLITE\MONLITE.EXE

HKCU\Software\Microsoft\Windows\CurrentVersion\Run@Iomega Automatic Backup Pro = "C:\Programmi\Iomega\Automatic Backup Pro\LiveSystem.exe" -s

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved >>>

@{42071714-76d4-11d1-8b24-00a0c9068ff3} /*Estensione panoramica video del Pannello di controllo*/deskpan.dll /*file not found*/ = deskpan.dll /*file not found*/

@{32683183-48a0-441b-a342-7c2a440a9478} /*Media Band*/(null) =

@{BDEADF00-C265-11D0-BCED-00A0C90AB50F} /*Cartelle Web*/C:\PROGRA~1\FILECO~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL = C:\PROGRA~1\FILECO~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL

@{2F25CF20-C569-11D1-B94C-00608CB45480} /*TextPad*/C:\Programmi\TextPad 4\System\shellext.dll = C:\Programmi\TextPad 4\System\shellext.dll

@{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} /*Adobe.Acrobat.ContextMenu*/C:\Programmi\Adobe\Acrobat 7.0\Acrobat Elements\ContextMenu.dll = C:\Programmi\Adobe\Acrobat 7.0\Acrobat Elements\ContextMenu.dll

@{B41DB860-8EE4-11D2-9906-E49FADC173CA} /*WinRAR shell extension*/C:\Programmi\WinRAR\rarext.dll = C:\Programmi\WinRAR\rarext.dll

@{00020D75-0000-0000-C000-000000000046} /*Microsoft Office Outlook Desktop Icon Handler*/C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL = C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL

@{0006F045-0000-0000-C000-000000000046} /*Microsoft Office Outlook Custom Icon Handler*/C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL = C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL

@{42042206-2D85-11D3-8CFF-005004838597} /*Microsoft Office HTML Icon Handler*/C:\Programmi\Microsoft Office\OFFICE11\msohev.dll = C:\Programmi\Microsoft Office\OFFICE11\msohev.dll

@{B327765E-D724-4347-8B16-78AE18552FC3} /*NeroDigitalIconHandler*/C:\Programmi\File comuni\Ahead\lib\NeroDigitalExt.dll = C:\Programmi\File comuni\Ahead\lib\NeroDigitalExt.dll

@{7F1CF152-04F8-453A-B34C-E609530A9DC8} /*NeroDigitalPropSheetHandler*/C:\Programmi\File comuni\Ahead\lib\NeroDigitalExt.dll = C:\Programmi\File comuni\Ahead\lib\NeroDigitalExt.dll

@{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} /*iTunes*/C:\Programmi\iTunes\iTunesMiniPlayer.dll = C:\Programmi\iTunes\iTunesMiniPlayer.dll

@{32020A01-506E-484D-A2A8-BE3CF17601C3} /*AlcoholShellEx*/(null) =

@{596AB062-B4D2-4215-9F74-E9109B0A8153} /*Previous Versions Property Page*/C:\Windows\System32\twext.dll = C:\Windows\System32\twext.dll

@{9DB7A13C-F208-4981-8353-73CC61AE2783} /*Previous Versions*/C:\Windows\System32\twext.dll = C:\Windows\System32\twext.dll

@{692F0339-CBAA-47e6-B5B5-3B84DB604E87} /*Extensions Manager Folder*/C:\Windows\System32\extmgr.dll = C:\Windows\System32\extmgr.dll

@{472083B0-C522-11CF-8763-00608CC02F24} /*avast*/C:\Programmi\Alwil Software\Avast4\ashShell.dll = C:\Programmi\Alwil Software\Avast4\ashShell.dll

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ >>>

Adobe.Acrobat.ContextMenu@{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} = C:\Programmi\Adobe\Acrobat 7.0\Acrobat Elements\ContextMenu.dll

avast@{472083B0-C522-11CF-8763-00608CC02F24} = C:\Programmi\Alwil Software\Avast4\ashShell.dll

TextPad@{2F25CF20-C569-11D1-B94C-00608CB45480} = C:\Programmi\TextPad 4\System\shellext.dll

WinRAR@{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Programmi\WinRAR\rarext.dll

HKLM\Software\Classes\*\shellex\ContextMenuHandlers@{EB4D3CFE-E2AA-4C6E-B2FE-2A749F95D208} = C:\Programmi\Nero\Nero 7\Nero BackItUp\NBShell.dll

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\WinRAR@{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Programmi\WinRAR\rarext.dll

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ >>>

avast@{472083B0-C522-11CF-8763-00608CC02F24} = C:\Programmi\Alwil Software\Avast4\ashShell.dll

WinRAR@{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Programmi\WinRAR\rarext.dll

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers@{EB4D3CFE-E2AA-4C6E-B2FE-2A749F95D208} = C:\Programmi\Nero\Nero 7\Nero BackItUp\NBShell.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects >>>

@{034B27CC-1B3A-217C-8D5F-24740DB81DCF}C:\Windows\djtnk1.dll /*file not found*/ = C:\Windows\djtnk1.dll /*file not found*/

@{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll = C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

@{AE7CD045-E861-484f-8273-0445EE161910}C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll = C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

HKCU\Control Panel\Desktop@SCRNSAVE.EXE = C:\Windows\System32\scrnsave.scr

HKLM\Software\Microsoft\Internet Explorer\Main >>>

@Default_Page_URLhttp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome = http://www.microsoft.com/isapi/redir.dll?p...&ar=msnhome

@Start Pagehttp://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home = http://www.microsoft.com/isapi/redir.dll?p...ER}&ar=home

HKCU\Software\Microsoft\Internet Explorer\Main >>>

@Start Pagehttps://hb.bam.it/bamonline = https://hb.bam.it/bamonline

@Local PageC:\Windows\system32\blank.htm = C:\Windows\system32\blank.htm

HKLM\Software\Classes\PROTOCOLS\Filter\text/xml@CLSID = C:\Programmi\File comuni\Microsoft Shared\OFFICE11\MSOXMLMF.DLL

HKLM\Software\Classes\PROTOCOLS\Handler\ >>>

dvd@CLSID = C:\Windows\system32\msvidctl.dll

its@CLSID = C:\WINDOWS\System32\itss.dll

lid@CLSID = C:\WINDOWS\System32\msvidctl.dll

mhtml@CLSID = %SystemRoot%\System32\inetcomm.dll

ms-its@CLSID = C:\WINDOWS\System32\itss.dll

ms-itss@CLSID = C:\Programmi\File comuni\Microsoft Shared\Information Retrieval\MSITSS.DLL

mso-offdap@CLSID = C:\PROGRA~1\FILECO~1\MICROS~1\WEBCOM~1\10\OWC10.DLL

mso-offdap11@CLSID = C:\PROGRA~1\FILECO~1\MICROS~1\WEBCOM~1\11\OWC11.DLL

tv@CLSID = C:\Windows\system32\msvidctl.dll

wia@CLSID = C:\WINDOWS\System32\wiascr.dll

HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{6B78D47F-5900-48D0-8852-997ADC9D7BDA} /*WI-FI*/ >>>

@IPAddress10.0.0.10 = 10.0.0.10

@NameServer212.216.112.112 = 212.216.112.112

@DefaultGateway10.0.0.200 = 10.0.0.200

@Domain =

C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica = Adobe Acrobat Speed Launcher.lnk

---- EOF - GMER 1.0.12 ----

[Kuma]

Please help me too..!!! :sigh:

Ginkhy, apri un nuovo post, elenca i problemi che hai e riallega i log...

se li accodate ad un post aperto da un altro utente si crea solo una gran confusione

____________________

@LiquiD...

giusta osservazione, ma fai attenzione a non inserire link a siti infetti

(basta inserire uno spazio dopo www o http) ;-)

-----------------------------------

Temerario, fissa le voci indicate da LiquiD e per i log di Gmer pazienta un attimo (per me dovrebbero essere OK)

[$angelique!?]

Ciao temerario, gmer per fortuna non ha rivelato nulla di pericoloso...

Scarica questi programmi che ti serviranno anche per una futura manutenzione:

Ccleaner (pulizia generale) + Eusing Free Registry Cleaner 1.0 (Pulizia del Registro)

Ricordati di mettere HIJACK in una cartella a lui dedicata (in Programmi o Documenti), l'importante è che non si trovi sul desktop o in cartelle temporanee.... è importante se vuoi salvare i backup

Esegui queste operazioni essendo disconnesso e con tutte le applicazioni chiuse ------ > (salva in un file queste istruzioni )

Assicurati che l'opzione "Visualizza cartelle e file nascosti" sia attivata.

(Pannello di controllo > Opzioni Cartella > Visualizzazione)

Disabilita il Ripristino di configurazione su tutte le unità

(nota che questo ELIMINERà TUTTI i punti di ripristino, quindi se non riscontri più problemi, crea almeno un nuovo punto di ripristino dopo questa procedura)

Avvia il sistema in Modalità Provvisoria

CON TUTTE LE APPLICAZIONI CHIUSE....

.Avvia Hijack e clicca su "do a system scan only"

Metti la spunta a queste voci e clicca su "fix checked"

R3 - Default URLSearchHook is missing

O2 - BHO: Class - {034B27CC-1B3A-217C-8D5F-24740DB81DCF} - C:\Windows\djtnk1.dll (file missing)

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)

O9 - Extra button: (no name) - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - (no file)

O20 - AppInit_DLLs:

O23 - Service: SysAee - Unknown owner - C:\Programmi\File comuni\System\AZa.exe (file missing)

per riparare la trusted zone Scarica Del Domains ed eseguilo Se l'antivirus ti segnala che è un file pericoloso... digli di ignorarlo)

(dopo averlo decompresso, click con il tasto destro sul file e seleziona >> INSTALLA)

Ripulisci il sistema con Ccleaner

ma prima di effettuare la pulizia, vai in Opzioni\Avanzate e togli la spunta a :

(in seguito... Ccleaner usalo una volta al mese... se lo usi più spesso NON svuotare la cartella prefetch... se svuoti questa cartella troppo spesso potresti rallentare il sistema)

Pulisci il registro con Eusing Free Registry Cleaner 1.0 (Pulizia del Registro)

Ricordati di creare un nuovo punto di RIPRISTINO al termine di questa procedura.

[temerario]

Eccomi...

Intanto, grazie a tutti...

Angelique, ho eseguito punto per punto le tue istruzioni ad eccezione della trusted zone che avevo già fixato su consiglio di kuma...

Ecco il risultato:

Logfile of HijackThis v1.99.1

Scan saved at 19.38.10, on 31/10/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\Windows\System32\smss.exe

C:\Windows\system32\csrss.exe

C:\Windows\system32\winlogon.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\system32\spoolsv.exe

C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe

C:\Windows\System32\Ati2evxx.exe

C:\Programmi\Alwil Software\Avast4\ashServ.exe

C:\Programmi\Comodo\Firewall\cmdagent.exe

C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe

C:\Windows\System32\svchost.exe

C:\VEXPLITE\viritsvc.exe

C:\Windows\Explorer.EXE

C:\Programmi\iTunes\iTunesHelper.exe

C:\Windows\system32\atiptaxx.exe

C:\Programmi\Spyware Terminator\SpywareTerminatorShield.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Programmi\Comodo\Firewall\CPF.exe

C:\VEXPLITE\MONLITE.EXE

C:\Programmi\Iomega\Automatic Backup Pro\LiveSystem.exe

C:\Programmi\Adobe\Acrobat 7.0\Acrobat\acrobat_sl.exe

C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe

C:\Programmi\Alwil Software\Avast4\ashWebSv.exe

C:\Programmi\iPod\bin\iPodService.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\wuauclt.exe

C:\Programmi\Sicurezza\Hijack\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://hb.bam.it/bamonline

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.bam.it/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Windows\System32\NeroCheck.exe

O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [CloneCDTray] "C:\Programmi\SlySoft\CloneCD\CloneCDTray.exe" /s

O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe

O4 - HKLM\..\Run: [spywareTerminator] "C:\Programmi\Spyware Terminator\SpywareTerminatorShield.exe"

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [Comodo Firewall] "C:\Programmi\Comodo\Firewall\CPF.exe" /background

O4 - HKLM\..\Run: [VIRIT LITE MONITOR] C:\VEXPLITE\MONLITE.EXE

O4 - HKCU\..\Run: [iomega Automatic Backup Pro] "C:\Programmi\Iomega\Automatic Backup Pro\LiveSystem.exe" -s

O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?

O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O17 - HKLM\System\CCS\Services\Tcpip\..\{6B78D47F-5900-48D0-8852-997ADC9D7BDA}: NameServer = 212.216.112.112

O17 - HKLM\System\CCS\Services\Tcpip\..\{CD03FFC4-8B3D-44EE-A495-3A54BEE2E3E6}: NameServer = 85.37.17.6 85.38.28.89

O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: Ati HotKey Poller - Unknown owner - C:\Windows\System32\Ati2evxx.exe

O23 - Service: avast! Antivirus - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Programmi\Comodo\Firewall\cmdagent.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPodService - Apple Computer, Inc. - C:\Programmi\iPod\bin\iPodService.exe

O23 - Service: Virit eXplorer Lite (viritsvclite) - TG Soft Sas www.tgsoft.it - C:\VEXPLITE\viritsvc.exe

Che ti sembra?

Migliora un pò la situazione o è ancora critica?

Ciao

[LiquiD]

Ah già hai ragione kuma che tacchino

[$angelique!?]

Bravo temerario, hai fatto un ottimo lavoro, ora il tuo log è pulito, :up1:

Ps.la trusted zone può essere sia fixata che riparata con Del domains, l'importante è che ora sia a posto.

Come va il tuo computer adesso???

[temerario]

Grazie Angelique..

Il PC ora funziona decisamente meglio: più veloce e più performante...

Semmai adesso il problema è ripristinare la rete/internet...ho il router digicom fuori uso, mentre con il modem alice mi da connettività limitata

Sicuramente è un problema di riconfigurazione della rete, ma non capisco se sia dovuto al virus, all'istallazione del Service PAck 2 o a cos'altro...

Comunque magari chiedo aiuto nella sezione adeguata.... (B)

Un'ultimo favore, di tutti i programmi utilizzati io pensavo di tenere:

Avast Antivirus, Comodo Firewall, E free registry cleaning, Ccleaner, mentre come Spyware quali tra questi?

Spywareblaster, SpywareTerminator, Spybot, Ad-Ware???

Manca qualcosa in termini di sicurezza??

Ciao

[$angelique!?]

Ciao temerario,

per riparare la connessione proviamo questo tool:

http://www.iup.edu/house/resnet/WinsockXPFix.exe

come programmi di sicurezza vanno bene quelli elencati da te, ma se vuoi qualcosa in più potresti fare cosi:

Avast Antivirus :disinstalla e, al suo posto mettici AntivirPE

Comodo: Firewall

Eusing Free Registry cleaner: pulizia di registro

Ccleaner: pulizia dei file temporanei

Spywareblaster :fornisce protezione per dei siti maligni per chi utilizza Internet Explorer e Mozilla/Firefox.

come antispyware:

SpywareTerminator

Spybot disinstalla e, al suo posto mettici SuperAntispyware

Ad-Aware

[Kuma]

[ot]

@Angelique:

ciao...

Anche tu usi Zone Alarm

Quando clicchi sui siti (o link) di Webattack (come quello sopra per scaricare il WinsockFix)

non ti dà questo avviso ???

Comunque per sicurezza l'ho corretto ;-)

[temerario]

Niente Angelique,

ho provato il tool ma addirittura mi ha riportato la connettività allo stadio di limitata (che invece impostando manualmente i protocolli tcp/ip come da istruzioni sul sito avevo riparato)..

Quello che mi fa specie è che il router non risponde ad alcuna sollecitazione... Non si connette al pc (da sempre cavo rete sconnesso) e non risponde ad eventuali reset del router stesso!! (Non sarà mica andato a putt...e!?!) Continua solo a lampeggiare...

Per quanto riguarda l'antivirus AntivirPE ho letto essere il migliore, ma non ha la pecca di non controllare gli allegati delle mail???

Ciao

[$angelique!?]

Ciao temerario,

mi dispiace che hai ancora problemi, ma fammi capire bene:

come ti sei collegato adesso, con il pc che ha problemi?

e se la risposta è si, sei in connessione diretta o con il router?

Comunque per questo problema è più facile che ti rispondano in sezione Internet e reti.

http://www.wininizio.it/forum/index.php?showforum=177 ;-)

Mentre per la tua domanda su AntivirPe, è vero che non scansiona la posta, ma se ricevi un allegato, basta che lo salvi sul desktop...se è infetto te lo individua al volo... e in ogni caso , prima di aprirlo puoi sempre farglielo controllare.

[temerario]

Si angelique,

sono connesso col pc che ha problemi...

Per navigare in Internet attacco il modem ADSL di Alice tramite scheda di rete (che mi viene riconosciuto!) se invece attacco il Router Digicom Michelangelo non rileva nulla... (e considera che il router ha 2 mesi di vita!?!)...

Proverò a leggere qualche post della sezione appropriata e poi eventualmente chiederò aiuto...

Intanto ti ringrazio enormemente per l'assistenza!!! :up1: :up1: :up1:

Ciao

[$angelique!?]

Ciao Temerario...

Allora, :leggi: Se per collegarti ad Internet devi scollegare il router e collegare il modem ADSL di Alice direttamente al PC allora adesso sappiamo che il problema non è ne nel PC, ne nel modem di Alice e ne nella connessione...il problema sembra essere proprio il router...

Da quello che mi hai detto, potrebbe sembrare un difetto hardware dello stesso (non riesci nemmeno a resettarlo e continua a lampeggiare giusto?).

Per tagliare la testa al toro, prova a verificare che quando colleghi il tuo PC al router, le impostazioni di rete del PC (le proprietà TCP/IP) siano configurate in modo da avere il PC ed il router appartenenti alla stessa sottorete.

Se, ad esempio, il router ha un indirizzo locale del tipo

192.168.0.1, allora imposta la scheda di rete del tuo PC cosi':

IP : 192.168.0.88

Subnet Mask: 255.255.255.0

Gateway : 192.168.0.1 (lo stesso del router)

Dopodichè prova ad aprire un Browser e digitare:

http://192.168.0.1

Se il router risponde, dovrebbe chiederti l'username e la password d'amministratore dello stesso...

Altrimenti, prova a chiamare il centro assistenza... Tanto dopo 2 mesi è ancora in garanzia

[temerario]

Niente... <_<

Non comunicano...

Mi sa che il prob. sta proprio nel router...

Lunedì lo porto al negozio...

Ancora grazie..

Ciao

[temerario]

Angelique,

ho istallato Avira Antivir al posto di Avast, però non mi riesce a fare gli aggiornamenti...

Ti allego il report che mi da il programma, considera che il pc è regolarmente connesso ad internet quando cerca gli aggiornamenti... Ne sai qualcosa???

Ciao

[04/11/2006 18.32.19] [iNFO] [PLG] C:\Documents and Settings\All Users\Dati applicazioni\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_454ccea3\

[04/11/2006 18.32.19] Command line for update application: "C:\Programmi\AntiVir PersonalEdition Classic\update.exe" --config-file="C:\Documents and Settings\All Users\Dati applicazioni\AntiVir PersonalEdition Classic\update.conf" --install-path="C:\Programmi\AntiVir PersonalEdition Classic"

[04/11/2006 18.32.19] User changed the logfile name to C:\Documents and Settings\All Users\Dati applicazioni\AntiVir PersonalEdition Classic\LOGFILES\Upd-2006-11-4-17-32-19.log

[04/11/2006 18.32.19] Installation Directory: C:\Programmi\AntiVir PersonalEdition Classic\ Backup Dir: C:\Documents and Settings\All Users\Dati applicazioni\AntiVir PersonalEdition Classic\BACKUP\ Temp dir: C:\Documents and Settings\All Users\Dati applicazioni\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_454ccea3\

[04/11/2006 18.32.19] [iNFO] [GUI] Start the Update GUI... Displaymode: 0

[04/11/2006 18.32.20] [iNFO] [PLG] Keyfile: OK [FULL Mode]

[04/11/2006 18.32.20] [iNFO] [PLG] Avira AntiVir PersonalEdition Classic

[04/11/2006 18.32.20] [iNFO] [PLG] Registry entry created successfully: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiVir PersonalEdition Classic |DisplayIcon

[04/11/2006 18.32.21] [iNFO] [PLG] Registry entry created successfully: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiVir PersonalEdition Classic |DisplayName

[04/11/2006 18.32.21] [iNFO] [PLG] Registry entry created successfully: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiVir PersonalEdition Classic |HelpLink

[04/11/2006 18.32.21] [iNFO] [PLG] Registry entry created successfully: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiVir PersonalEdition Classic |Publisher

[04/11/2006 18.32.21] [iNFO] [PLG] Registry entry created successfully: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiVir PersonalEdition Classic |UninstallString

[04/11/2006 18.32.21] [iNFO] [PLG] Registry entry created successfully: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiVir PersonalEdition Classic |URLInfoAbout

[04/11/2006 18.32.21] [iNFO] [PLG] Registry entry created successfully: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiVir PersonalEdition Classic |URLUpdateInfo

[04/11/2006 18.32.21] [iNFO] [PLG] Registry entry created successfully: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiVir PersonalEdition Classic |ModifyPath

[04/11/2006 18.32.24] Connection failed while downloading the file http://dl1.avgate.net/upd/idx/master.idx.

[04/11/2006 18.32.24] Switching to next update server

[04/11/2006 18.32.26] Connection failed while downloading the file http://dl3.avgate.net/upd/idx/master.idx.

[04/11/2006 18.32.26] Switching to next update server

[04/11/2006 18.32.29] Connection failed while downloading the file http://dl5.avgate.net/upd/idx/master.idx.

[04/11/2006 18.32.29] Switching to next update server

[04/11/2006 18.32.31] Connection failed while downloading the file http://dl2.avgate.net/upd/idx/master.idx.

[04/11/2006 18.32.31] Switching to next update server

[04/11/2006 18.32.34] Critical error: Connection failed while downloading the file http://dl6.avgate.net/upd/idx/master.idx.

[Kuma]

Sembrerebbe essere un problema di firewall <_<

Prova a chiudere Comodo e a riaggiornarlo manualmente...

[temerario]

Niente Kuma,

ho provato a fare l'aggiornamento senza Comodo Firewall e senza anatispyware ma nulla... Sembra non connettersi.. Questo è il report:

[07/11/2006 23.54.18] [iNFO] [PLG] C:\Documents and Settings\All Users\Dati applicazioni\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_45510e9a\

[07/11/2006 23.54.18] Command line for update application: "C:\Programmi\AntiVir PersonalEdition Classic\update.exe" --config-file="C:\Documents and Settings\All Users\Dati applicazioni\AntiVir PersonalEdition Classic\update.conf" --install-path="C:\Programmi\AntiVir PersonalEdition Classic"

[07/11/2006 23.54.18] User changed the logfile name to C:\Documents and Settings\All Users\Dati applicazioni\AntiVir PersonalEdition Classic\LOGFILES\Upd-2006-11-7-22-54-18.log

[07/11/2006 23.54.18] Installation Directory: C:\Programmi\AntiVir PersonalEdition Classic\ Backup Dir: C:\Documents and Settings\All Users\Dati applicazioni\AntiVir PersonalEdition Classic\BACKUP\ Temp dir: C:\Documents and Settings\All Users\Dati applicazioni\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_45510e9a\

[07/11/2006 23.54.18] [iNFO] [GUI] Start the Update GUI... Displaymode: 0

[07/11/2006 23.54.19] [iNFO] [PLG] Keyfile: OK [FULL Mode]

[07/11/2006 23.54.19] [iNFO] [PLG] Avira AntiVir PersonalEdition Classic

[07/11/2006 23.54.19] [iNFO] [PLG] Registry entry created successfully: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiVir PersonalEdition Classic |DisplayIcon

[07/11/2006 23.54.19] [iNFO] [PLG] Registry entry created successfully: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiVir PersonalEdition Classic |DisplayName

[07/11/2006 23.54.19] [iNFO] [PLG] Registry entry created successfully: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiVir PersonalEdition Classic |HelpLink

[07/11/2006 23.54.19] [iNFO] [PLG] Registry entry created successfully: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiVir PersonalEdition Classic |Publisher

[07/11/2006 23.54.19] [iNFO] [PLG] Registry entry created successfully: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiVir PersonalEdition Classic |UninstallString

[07/11/2006 23.54.19] [iNFO] [PLG] Registry entry created successfully: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiVir PersonalEdition Classic |URLInfoAbout

[07/11/2006 23.54.19] [iNFO] [PLG] Registry entry created successfully: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiVir PersonalEdition Classic |URLUpdateInfo

[07/11/2006 23.54.19] [iNFO] [PLG] Registry entry created successfully: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiVir PersonalEdition Classic |ModifyPath

[07/11/2006 23.54.22] Connection failed while downloading the file http://dl1.avgate.net/upd/idx/master.idx.

[07/11/2006 23.54.22] Switching to next update server

[07/11/2006 23.54.25] Connection failed while downloading the file http://dl6.avgate.net/upd/idx/master.idx.

[07/11/2006 23.54.25] Switching to next update server

[07/11/2006 23.54.27] Connection failed while downloading the file http://dl5.avgate.net/upd/idx/master.idx.

[07/11/2006 23.54.27] Switching to next update server

[07/11/2006 23.54.30] Connection failed while downloading the file http://dl2.avgate.net/upd/idx/master.idx.

[07/11/2006 23.54.30] Switching to next update server

[07/11/2006 23.54.32] Critical error: Connection failed while downloading the file http://dl3.avgate.net/upd/idx/master.idx.

Mi sa che mi conviene tornare all'Avast!!!

[temerario]

Accidenti!

Ad-Aware SE mi ha rilevato ancora tracce nel PC di Linkoptimizer !!!

Mi ricontrollate il log di hijackthis per favore? Che devo fare?

Logfile of HijackThis v1.99.1

Scan saved at 0.41.26, on 08/11/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\Windows\System32\smss.exe

C:\Windows\system32\csrss.exe

C:\Windows\system32\winlogon.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\system32\spoolsv.exe

C:\Programmi\AntiVir PersonalEdition Classic\sched.exe

C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe

C:\Windows\System32\Ati2evxx.exe

C:\Programmi\Comodo\Firewall\cmdagent.exe

C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\alg.exe

C:\Windows\Explorer.EXE

C:\Programmi\iTunes\iTunesHelper.exe

C:\Windows\system32\atiptaxx.exe

C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe

C:\Programmi\iPod\bin\iPodService.exe

C:\Programmi\Iomega\Automatic Backup Pro\LiveSystem.exe

C:\Programmi\Comodo\Firewall\cpf.exe

C:\Programmi\Sicurezza\Hijack\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://hb.bam.it/bamonline

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.bam.it/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Windows\System32\NeroCheck.exe

O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [CloneCDTray] "C:\Programmi\SlySoft\CloneCD\CloneCDTray.exe" /s

O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe

O4 - HKLM\..\Run: [spywareTerminator] "C:\Programmi\Spyware Terminator\SpywareTerminatorShield.exe"

O4 - HKLM\..\Run: [Comodo Firewall] "C:\Programmi\Comodo\Firewall\CPF.exe" /background

O4 - HKLM\..\Run: [avgnt] "C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKCU\..\Run: [iomega Automatic Backup Pro] "C:\Programmi\Iomega\Automatic Backup Pro\LiveSystem.exe" -s

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe

O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O17 - HKLM\System\CCS\Services\Tcpip\..\{591F0050-0595-444A-BABE-3671A38C98AC}: NameServer = 212.216.112.112,212.216.172.162

O17 - HKLM\System\CCS\Services\Tcpip\..\{CD03FFC4-8B3D-44EE-A495-3A54BEE2E3E6}: NameServer = 151.99.125.1 151.99.0.100

O20 - Winlogon Notify: !SASWinLogon - C:\Programmi\SUPERAntiSpyware\SASWINLO.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmi\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Ati HotKey Poller - Unknown owner - C:\Windows\System32\Ati2evxx.exe

O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Programmi\Comodo\Firewall\cmdagent.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPodService - Apple Computer, Inc. - C:\Programmi\iPod\bin\iPodService.exe

Come mai tutti sti programmi lanciati che io non ho nulla di aperto???

Grazie