Problema Con W32.neeris E Tr/crypt.ulpm.gen

erfeliciano · September 20, 2007

Ciao a tutti,

ho beccato da messenger i virus sopra citati scaricato (ma non aprendo) un file .zip che teoricamente doveva contenere delle foto (sono un pirla).

Il Norton mi segnala come virus W32.neeris mentre Avira Antivir il TR/Crypt.ULPM.Gen.

Entrambi non riescono ad eliminarli o meglio, il file su cui viene riscontrato il virus cambia continuamente.

------------ Allego hijackthis.log --------------

Logfile of HijackThis v1.99.1

Scan saved at 1.47.13, on 20/09/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

c:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe

c:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe

c:\Programmi\File comuni\Symantec Shared\ccProxy.exe

C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

c:\Programmi\File comuni\Symantec Shared\SNDSrvc.exe

c:\Programmi\File comuni\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\ehome\ehtray.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Programmi\Intel\Intel Matrix Storage Manager\Iaanotif.exe

C:\Programmi\HP DigitalMedia Archive\DMAScheduler.exe

C:\Programmi\File comuni\Symantec Shared\ccApp.exe

C:\Programmi\AntiVir PersonalEdition Classic\sched.exe

C:\Programmi\HP\HP Software Update\HPwuSchd2.exe

C:\WINDOWS\system32\rundll32.exe

C:\Programmi\ScanSoft\PaperPort\pptd40nt.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\Programmi\Brother\Brmfcmon\BrMfcWnd.exe

C:\WINDOWS\sm56hlpr.exe

C:\Programmi\Brother\ControlCenter3\brccMCtl.exe

C:\Programmi\Creative\Creative Live! Cam\VideoFX\StartFX.exe

C:\WINDOWS\eHome\ehSched.exe

C:\WINDOWS\system32\V0230Mon.exe

C:\Programmi\Creative\Shared Files\CTSched.exe

C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe

C:\Programmi\Intel\Intel Matrix Storage Manager\Iaantmon.exe

C:\PROGRA~1\ALICET~1\SMARTB~1\MotiveSB.exe

C:\WINDOWS\system32\inetsrv\inetinfo.exe

C:\Programmi\Borland\InterBase\bin\ibguard.exe

C:\Programmi\Java\jre1.6.0_02\bin\jusched.exe

C:\Programmi\Messenger\msmsgs.exe

C:\Programmi\File comuni\LightScribe\LSSrvc.exe

C:\Programmi\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe

C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

c:\Programmi\Norton Internet Security\Norton AntiVirus\navapsvc.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\Programmi\Alice ti aiuta\bin\mpbtn.exe

C:\Programmi\Intel\IntelDH\Intel® Quick Resume Technology Drivers\Elservice.exe

C:\Programmi\Borland\InterBase\bin\ibserver.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\HP\KBD\KBD.EXE

c:\Programmi\File comuni\Symantec Shared\Security Console\NSCSRVCE.EXE

c:\windows\system\hpsysdrv.exe

C:\DOCUME~1\HP_ADM~1\IMPOST~1\Temp\Directory temporanea 4 per hijackthis_199.zip\HijackThis.exe

C:\Programmi\Mozilla Firefox\firefox.exe

C:\Programmi\Internet Explorer\iexplore.exe

C:\Programmi\AntiVir PersonalEdition Classic\GUARDGUI.EXE

C:\DOCUME~1\HP_ADM~1\IMPOST~1\Temp\Directory temporanea 5 per hijackthis_199.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti

R3 - URLSearchHook: Yahoo! Toolbar con blocco Pop-Up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Need2Find Bar BHO - {4D1C4E81-A32A-416b-BCDB-33B3EF3617D3} - C:\Programmi\Need2Find\bar\1.bin\ND2FNBAR.DLL

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: RXResultTracker Class - {59879FA4-4790-461c-A1CC-4EC4DE4CA483} - C:\Programmi\RXToolBar\sfcont.dll (file missing)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_02\bin\ssv.dll

O2 - BHO: NOW!Imaging - {9AA2F14F-E956-44B8-8694-A5B615CDF341} - C:\Programmi\Web Accelerator\components\NOWImaging.dll (file missing)

O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - c:\Programmi\Norton Internet Security\Norton AntiVirus\NavShExt.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar2.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - c:\Programmi\Norton Internet Security\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar2.dll

O3 - Toolbar: Yahoo! Toolbar con blocco Pop-Up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe

O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [iAAnotif] C:\Programmi\Intel\Intel Matrix Storage Manager\Iaanotif.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect

O4 - HKLM\..\Run: [DMAScheduler] "c:\Programmi\HP DigitalMedia Archive\DMAScheduler.exe"

O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE

O4 - HKLM\..\Run: [ccApp] "c:\Programmi\File comuni\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [HPBootOp] "C:\Programmi\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run

O4 - HKLM\..\Run: [HP Software Update] C:\Programmi\HP\HP Software Update\HPwuSchd2.exe

O4 - HKLM\..\Run: [sSBkgdUpdate] "C:\Programmi\File comuni\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot

O4 - HKLM\..\Run: [PaperPort PTD] C:\Programmi\ScanSoft\PaperPort\pptd40nt.exe

O4 - HKLM\..\Run: [indexSearch] C:\Programmi\ScanSoft\PaperPort\IndexSearch.exe

O4 - HKLM\..\Run: [brMfcWnd] C:\Programmi\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN

O4 - HKLM\..\Run: [setDefPrt] C:\Programmi\Brother\Brmfl06a\BrStDvPt.exe

O4 - HKLM\..\Run: [ControlCenter3] C:\Programmi\Brother\ControlCenter3\brctrcen.exe /autorun

O4 - HKLM\..\Run: [sMSERIAL] sm56hlpr.exe

O4 - HKLM\..\Run: [AVFX Engine] C:\Programmi\Creative\Creative Live! Cam\VideoFX\StartFX.exe

O4 - HKLM\..\Run: [V0230Mon.exe] C:\WINDOWS\system32\V0230Mon.exe

O4 - HKLM\..\Run: [CreativeTaskScheduler] "C:\Programmi\Creative\Shared Files\CTSched.exe" /logon

O4 - HKLM\..\Run: [avgnt] "C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\ALICET~1\SMARTB~1\MotiveSB.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_02\bin\jusched.exe"

O4 - HKLM\..\Run: [symantec PIF AlertEng] "C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"

O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Programmi\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"

O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - Global Startup: Alice ti aiuta.lnk = C:\Programmi\Alice ti aiuta\bin\matcli.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE

O8 - Extra context menu item: &Search - http://kn.bar.need2find.com/KN/menusearch.html?p=KN

O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra button: Guida alla connessione - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

O9 - Extra 'Tools' menuitem: Guida alla connessione - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programmi\Yahoo!\Common\yinsthelper.dll

O17 - HKLM\System\CCS\Services\Tcpip\..\{1DC13B84-EE4B-4914-AAF7-706860A5D96F}: NameServer = 85.37.17.43 85.38.28.96

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - C:\Programmi\RXToolBar\sfcont.dll

O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmi\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Programmi\Ares\chatServer.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - c:\Programmi\Norton Internet Security\ccPwdSvc.exe

O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Programmi\File comuni\Symantec Shared\ccProxy.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe

O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Programmi\Norton Internet Security\comHost.exe

O23 - Service: Intel® Quick Resume technology (ELService) - Intel Corporation - C:\Programmi\Intel\IntelDH\Intel® Quick Resume Technology Drivers\Elservice.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Programmi\Intel\Intel Matrix Storage Manager\Iaantmon.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: InterBase Guardian (InterBaseGuardian) - Borland Software Corporation - C:\Programmi\Borland\InterBase\bin\ibguard.exe

O23 - Service: InterBase Server (InterBaseServer) - Borland Software Corporation - C:\Programmi\Borland\InterBase\bin\ibserver.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)

O23 - Service: Servizio Auto-Protect di Norton AntiVirus (navapsvc) - Symantec Corporation - c:\Programmi\Norton Internet Security\Norton AntiVirus\navapsvc.exe

O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - c:\Programmi\File comuni\Symantec Shared\Security Console\NSCSRVCE.EXE

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - c:\Programmi\Norton Internet Security\Norton AntiVirus\SAVScan.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Programmi\File comuni\Symantec Shared\SNDSrvc.exe

O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Programmi\File comuni\Symantec Shared\SPBBC\SPBBCSvc.exe

O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe

O23 - Service: Utilità di pianificazione di LiveUpdate automatico - Symantec Corporation - C:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe

--------- ALLEGO MSNFIX.TXT ----------

MSNFix 1.511

C:\Documents and Settings\HP_Administrator\Desktop\MSNFix

Fix effettuato il 20/09/2007 - 1.23.00,93 By HP_Administrator

modalità normale

************************ Cercare i files presenti

Nessun files trovato

************************ Ricerca le cartelle presenti

Nessuna cartella trovata

************************ Files sospetti

/!\ questi files necessitano di un parere esperto prima di qualsiasi intervento

[C:\WINDOWS\system32\davinci.scr] 4C319DA8BA79200467957A07FA2A5028

[C:\WINDOWS\system32\logon.scr] DE46456EE9FE4F999F69247DD156E6E8

[C:\WINDOWS\system32\mypixdx.scr] A312A65C6ADFD918497D6A34C00395FE

[C:\WINDOWS\system32\nature.scr] AC9E9C086D62D92F79327B3FD2C45C93

[C:\WINDOWS\system32\scrnsave.scr] F4BDFD6086EE8CF5B662C0873AAE8FDD

[C:\WINDOWS\system32\ss3dfo.scr] DE24F6E94FB3A75E1BB683AB135A3A1D

[C:\WINDOWS\system32\ssbezier.scr] DA10879DD70366E2954D4DDBDE2FF598

[C:\WINDOWS\system32\ssflwbox.scr] E130B5EFA4CC95F4A62A66AD4632EBA3

[C:\WINDOWS\system32\ssmarque.scr] 19BF6C5B985131E8E1AEAD862EAD12EB

[C:\WINDOWS\system32\ssmypics.scr] 04FFDAE249DE01D652F73958139EE1C6

[C:\WINDOWS\system32\ssmyst.scr] 693FC04991600AB381319A5F2611DF38

[C:\WINDOWS\system32\sspipes.scr] BB1EB26FBC55D64DFF0CEF453C2CD395

[C:\WINDOWS\system32\ssstars.scr] A08FBBD19F3B0DEE19F0C3E0F037482D

[C:\WINDOWS\system32\sstext3d.scr] F11CF688C1109B6EC710F0B463E2D323

[C:\WINDOWS\system32\wpgldfsh.scr] E3BB5BDA4ACE41BE6153D7024077EC4E

==> Vi saremo grati se vorrete inviare il file C:\DOCUME~1\HP_ADM~1\Desktop\Upload_Me.zip su http://upload.changelog.fr

------------------------------------------------------------------------

Auteur : !aur3n7 Contact: http://changelog.fr

------------------------------------------------------------------------

--------------------------------------------- END ---------------------------------------------

AIUTATEMI PER FAVORE GRAZIE

Kuma · September 20, 2007

[ben]MirkoB[/ben]

Ciao...

Da questo log non risultano virus (solo un paio di Adware)

Per vedere cosa c'è mi serve sopratutto la scansione che ti segnalo in fondo a questo messaggio....

Forse gli antivirus ti rilevano solo le voci nel registro??? (Info)

comunque...

da INSTALLAZIONE APPLICAZIONI, guarda se hai questa voce e se c'è disinstalla: Need2Find

(se non c'è vai al passo successivo)

__

Scarica questi programmi che ti serviranno anche per una futura manutenzione:

Ccleaner (pulizia generale) +

Vise Registry Cleaner (per pulire il registro)

Quando installi Ccleaner ricordati che se lasci le spunte di default ,verrà installata anche la toolbar yahoo (togli le spunte se non la vuoi)

STAMPA queste istruzioni (oppure salvale in un file sul desktop)

Ricordati di mettere HIJACK in una cartella a lui dedicata (in Programmi o Documenti), l'importante è che non si trovi sul desktop o in cartelle temporanee.... è importante se vuoi salvare i backup

Esegui queste operazioni essendo disconnesso e con tutte le applicazioni chiuse

Assicurati che l'opzione "Visualizza cartelle e file nascosti" sia attivata e disattiva "nascondi file protetti di sistema"

e Togli la spunta da: "Nascondi le estensioni dei file per i tipi di file conosciuti"(Pannello di controllo > Opzioni Cartella > Visualizzazione)

Avvia il sistema in Modalità Provvisoria

CON TUTTE LE APPLICAZIONI CHIUSE....

.Avvia Hijack e clicca su "do a system scan only"

Metti la spunta davanti a queste voci (potrebbero non esserci tutte) e clicca su "fix checked

O2 - BHO: Need2Find Bar BHO - {4D1C4E81-A32A-416b-BCDB-33B3EF3617D3} - C:\Programmi\Need2Find\bar\1.bin\ND2FNBAR.DLL

O2 - BHO: RXResultTracker Class - {59879FA4-4790-461c-A1CC-4EC4DE4CA483} - C:\Programmi\RXToolBar\sfcont.dll (file missing)

O2 - BHO: NOW!Imaging - {9AA2F14F-E956-44B8-8694-A5B615CDF341} - C:\Programmi\Web Accelerator\components\NOWImaging.dll (file missing)

O8 - Extra context menu item: &Search - h.ttp://kn.bar.need2find.com/KN/menusearch.html?p=KN

O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - C:\Programmi\RXToolBar\sfcont.dll

Trova e se ci sono elimina questi files o cartelle usando esplora risorse

C:\Programmi\Need2Find (<- tutta la cartella)

C:\Programmi\RXToolBar (Idem)

C:\Programmi\Web Accelerator (Idem)

Ripulisci il sistema con Ccleaner

ma prima di effettuare la pulizia, vai in Opzioni\Avanzate e togli la spunta a :

Pulisci il registro con Vise registry Cleaner (Pulizia del Registro)

Dal pannello di controllo, clicca sull'icona JAVA e svuota la cache( nella scheda "Generale" clicca su "file temporanei di Internet" --> Impostazioni --> Elimina file)

NB___se le voci non compaiono in modalità provvisoria vanno fissate da quella normale.

----------------

Se dopo la pulizia, (dopo il riavvio) il sistema ti sembra che funzioni correttamente, Disabilita il Ripristino di configurazione su tutte le unità;

(nota che questo ELIMINERà TUTTI i punti di ripristino, ed eventuali virus in esso contenuti..)

Quindi riabilitalo almeno sull'unità dove hai installato il sistema operativo (solitamente il disco C:\) e crea un nuovo punto di ripristino pulito

--

Elimina tutti i files (se ce ne sono) che trovi all'interno della cartella

[Operazioni pianificate - Shared task scheduler]

Da: Pannello di Controllo e doppio click su "Operazioni Pianificate"

(premere il tab Avanzate> metti la spunta a visualizza operazioni nascoste)

(l'unico file legittimo è "Aggiungi Operazione Pianificata)

__________________

NON TENERE due antivirus con protezione in tempo reale che interferisonotra loro e possono crearti conflitti....

Al termine...

rifai il log di Hijack e mettilo qui per un ulteriore controllo (il log va fatto in modalità normale)

specificando se il problema ti pare che si sia risolto e le cose che non sei riuscito a fare

Fai una scansione Avanzata come descritto qui ed allega il log in formato HTML

http://forum.wininizio.it/index.php?showtopic=36981&hl=

erfeliciano · September 20, 2007

Ho fatto tutto quello che mi è stato detto e mi sembra che il problema sia stato risolto.

ALLEGO:

Logfile of HijackThis v1.99.1

Scan saved at 19.28.17, on 20/09/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Programmi\PC Tools Firewall Plus\FWService.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe

C:\Programmi\AntiVir PersonalEdition Classic\sched.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Programmi\Intel\Intel Matrix Storage Manager\Iaantmon.exe

C:\WINDOWS\system32\inetsrv\inetinfo.exe

C:\Programmi\Borland\InterBase\bin\ibguard.exe

C:\WINDOWS\Explorer.EXE

C:\Programmi\File comuni\LightScribe\LSSrvc.exe

C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\WINDOWS\ehome\ehtray.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Programmi\Intel\Intel Matrix Storage Manager\Iaanotif.exe

C:\Programmi\Intel\IntelDH\Intel® Quick Resume Technology Drivers\Elservice.exe

C:\Programmi\HP DigitalMedia Archive\DMAScheduler.exe

C:\Programmi\HP\HP Software Update\HPwuSchd2.exe

C:\Programmi\ScanSoft\PaperPort\pptd40nt.exe

C:\WINDOWS\system32\rundll32.exe

C:\Programmi\Brother\Brmfcmon\BrMfcWnd.exe

C:\WINDOWS\sm56hlpr.exe

C:\Programmi\Brother\ControlCenter3\brccMCtl.exe

C:\Programmi\Creative\Creative Live! Cam\VideoFX\StartFX.exe

C:\WINDOWS\system32\V0230Mon.exe

C:\Programmi\Creative\Shared Files\CTSched.exe

C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe

C:\PROGRA~1\ALICET~1\SMARTB~1\MotiveSB.exe

C:\Programmi\Java\jre1.6.0_02\bin\jusched.exe

C:\Programmi\Borland\InterBase\bin\ibserver.exe

C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\Programmi\PC Tools Firewall Plus\FirewallGUI.exe

C:\Programmi\Messenger\msmsgs.exe

C:\Programmi\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe

C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Programmi\Alice ti aiuta\bin\mpbtn.exe

C:\HP\KBD\KBD.EXE

c:\windows\system\hpsysdrv.exe

C:\Programmi\Mozilla Firefox\firefox.exe

C:\Programmi\Spyware Terminator\SpywareTerminatorShield.exe

C:\Programmi\MSN Messenger\msnmsgr.exe

C:\Programmi\MSN Messenger\usnsvc.exe

C:\Programmi\HIJACKTHIS\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti

R3 - URLSearchHook: Yahoo! Toolbar con blocco Pop-Up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_02\bin\ssv.dll

O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - c:\Programmi\Norton Internet Security\Norton AntiVirus\NavShExt.dll (file missing)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar2.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - c:\Programmi\Norton Internet Security\Norton AntiVirus\NavShExt.dll (file missing)