AIUTO! Ho W32.Myzor.FK@yfi

[Michael.Micheletti]

AIUTATEMI!!!!!

PRESENZA DI: W32.Myzor.FK@yfi

Ho un problema sul mio pc!
Infatti quando cerco di accedere a internet, mi si apre una finesta di microsoft internet explorer che dice:
warning
W32.Myzor.FK@yf is a virus that infects files with.exe extension in attemps to steal password and private informations from the computer...........
............
e
infine
recomandation
click ok to download officially approved security software

che faccio?
inoltre anzichè la pagina iniziale di fastweb mi si apre la pagina
http://www.safetyhomepage.com
con questo contenuto

System Security Status: Warning
Attention! Your system is currently vulnerable to computer attacks. Remote intruders can gain access to following files and folders on your PC:
- \Windows\System32
- \Program Files\Internet Explorer
- \My Documents
- Drive C:\ files
To enhance the security on your PC Download and run Intrusion Detection System (IDS software)


Investigation Report: Summary
Your IP address: 87.3.81.8

Your Country: IT, Italy

Your Browser: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; InfoPath.1)

Your Operation System: Windows XP SP2 VULNERABLE

System Security Status: CAUTION

Time of investigation: Sat Aug 5 14:29:49 PDT 2006

NN SO COSA FARE!DATEMI UNA MANO!
GRAZIE!!!

[andorra24]

Ciao, scarica SmitFraudfix e decomprimilo in una cartella a tua scelta estraendo tutti i file:
http://siri.urz.free.fr/Fix/SmitfraudFix.zip

Riavvia in modalità provvisoria (se non sai andare in modalita' provvisoria segui il link: http://service1.symantec.com/SUPPORT/IN ... 2090503924 )

Apri la cartella che contiene SmitfraudFix, avvia smitfraudfix.cmd
Seleziona opzione #2 - Clean cliccando sul 2 e premi Invio.
Riceverai questo messaggio: Registry cleaning - Do you want to clean the registry ?
Rispondi Sì cliccando Y e premi invio.
Rispondi Sì (Y ) ad eventuali altre domande

eseguita tutta la scansione riavvia il pc normalmente. Posta il log della scansione sul forum.

[pneumatici invernali]

Ho fatto quanto detto e il risultato della scansione è questo:


SmitFraudFix v2.117

Scan done at 11.40.23,57, 31/10/2006
Run from C:\Documents and Settings\F.lia Lucchese\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Versione 5.1.2600] - Windows_NT
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{27321538-5739-4aa1-b84c-7d18e4383f1f}"="ferrateen"

[HKEY_CLASSES_ROOT\CLSID\{27321538-5739-4aa1-b84c-7d18e4383f1f}\InProcServer32]
@="C:\WINDOWS\system32\rrtcany.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{27321538-5739-4aa1-b84c-7d18e4383f1f}\InProcServer32]
@="C:\WINDOWS\system32\rrtcany.dll"


»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\WINDOWS\system32\rrtcany.dll Deleted
C:\DOCUME~1\ALLUSE~1\MENUAV~1\Online Security Guide.url Deleted
C:\DOCUME~1\ALLUSE~1\MENUAV~1\Security Troubleshooting.url Deleted
C:\Programmi\VideoKeyCodec\ Deleted

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End


E' tutto OK o c'è ancora qualcosa che non va?
GRAZIE!