Condividi:        

problemi con probabile virus

Come rimuovere virus e spyware? Le carte di credito sono davvero sicure in rete? È possibile navigare anonimi? Con quali programmi tutelare la propria privacy? Come proteggere i file importanti? Se volete una risposta a queste e altre domande questo è il luogo giusto!

Moderatori: m.paolo, kadosh, Luke57

problemi con probabile virus

Postdi gianq2001 » 14/03/06 23:20

ciao a tutti

ho bisogno di una mano...credo ke nel mio pc ci siano un po di problemi

mi date un okkio? grazie mille



Logfile of HijackThis v1.99.1
Scan saved at 23.18.19, on 14/03/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
D:\WINDOWS\system32\drivers\KodakCCS.exe
D:\Programmi\HP\hpcoretech\hpcmpmgr.exe
D:\Program Files\Preview AdService\PrevAdServ.exe
D:\Programmi\IPM\Adsl\DataWay\dslstat.exe
D:\WINDOWS\system32\dslagent.exe
D:\WINDOWS\system32\elf2k823.exe
D:\Programmi\QuickTime\qttask.exe
D:\Programmi\HP\HP Software Update\HPWuSchd2.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Preview AdService\PrevAdKeep.exe
D:\Programmi\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
D:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
D:\Programmi\InterVideo\Common\Bin\WinCinemaMgr.exe
D:\Programmi\Kodak\Kodak EasyShare software\bin\EasyShare.exe
D:\Programmi\Logitech\MouseWare\system\em_exec.exe
D:\Programmi\HP\Digital Imaging\bin\hpqgalry.exe
D:\Programmi\Internet Explorer\iexplore.exe
D:\Programmi\MSN\MSNCoreFiles\msn6.exe
D:\Programmi\Messenger\msmsgs.exe
D:\Documents and Settings\gian\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - D:\WINDOWS\nem220.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: BHObj Class - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - D:\WINDOWS\wsem303.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\programmi\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\programmi\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [HP Component Manager] "D:\Programmi\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Preview AdService] D:\Program Files\Preview AdService\PrevAdServ.exe
O4 - HKLM\..\Run: [[01]##############################################################################################################################] D:\Program Files\Internet Optimizer\update\rogue.exe
O4 - HKLM\..\Run: [DSLSTATEXE] D:\Programmi\IPM\Adsl\DataWay\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [elf2k823] D:\WINDOWS\system32\elf2k823.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Software Update] D:\Programmi\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKCU\..\Run: [MsnMsgr] "D:\Programmi\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Avvio rapido di HP Image Zone.lnk = D:\Programmi\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Controllo del Calendario di Ulead Photo Express.lnk = D:\Programmi\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = D:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = D:\Programmi\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Kodak EasyShare software.lnk = D:\Programmi\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O8 - Extra context menu item: &Cerca con Google - res://d:\programmi\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Traduci parola in italiano - res://d:\programmi\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Link a ritroso - res://d:\programmi\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Pagine simili - res://d:\programmi\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Versione cache della pagina - res://d:\programmi\google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/Downl ... e-c283.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 1708669063
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnme ... loader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6337BFA3-B261-410F-B694-1F711EDCCF95}: NameServer = 85.37.17.44 151.99.125.1
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - D:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Pml Driver HPZ12 - HP - D:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - D:\Programmi\File comuni\Symantec Shared\Security Center\SymWSC.exe
gianq2001
Newbie
 
Post: 1
Iscritto il: 14/03/06 23:15

Sponsor
 

Postdi fabrizius » 15/03/06 00:04

Ciao,
per il log:
Vai nel task manager e se ci sono termina questi processi:
PrevAdServ.exe
PrevAdKeep.exe
elf2k823.exe
--->>sconosciuto
Ora chiudi tutti i programmi,vai in installazioni applicazioni del pannello di controllo e se c'é elimina Preview AdService.
Poi con hijackthis fixa questi voci:(se qualcuna la conosci trascurala)
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - D:\WINDOWS\nem220.dll (file missing)
O2 - BHO: BHObj Class - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - D:\WINDOWS\wsem303.dll (file missing)
O4 - HKLM\..\Run: [Preview AdService] D:\Program Files\Preview AdService\PrevAdServ.exe
O4 - HKLM\..\Run: [[01]########################################################################### ###################################################] D:\Program Files\Internet Optimizer\update\rogue.exe
O4 - HKLM\..\Run: [elf2k823] D:\WINDOWS\system32\elf2k823.exe
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/Downl ... e-c283.cab

Adesso Assciurati di avere accesso a cartelle e file nascosti
(Pannello di controllo---> Opzioni Cartella ---> Visualizzazione--->metti la spunta su"visualizza file e cartelle nascoste"--->disattiva nascondi file e cartelle di sistema)
Cerca ed elimina:(se ci sono)
D:\Program Files\Preview AdService\PrevAdServ.exe--->>tutta la cartella
D:\WINDOWS\system32\elf2k823.exe
D:\Program Files\Internet Optimizer\update\rogue.exe--->>tutta la cartella

Dai una ripulita ai files inutili,temp etc...con Ccleanerper eliminare i files inutili
PS:prima di usarlo vai in opzioni--->avanzate e togli la spunta da:(elimina file solo se piu vecchi di 48 ore)
fabrizius
Utente Senior
 
Post: 1220
Iscritto il: 20/05/05 13:55

Postdi fabrizius » 15/03/06 00:10

PS:Ricordati di mettere hijackthis in una cartella a lui dedicata e non sul desktop come hai fatto tu,altrimenti non sarà in grado di fare il back up delle voci rimosse,e sarà impossibile ripristinare una voce eliminata per errore

PS1:Dovresti installare un firewall per aumentare il tuo livello di sicurezza:
ZoneAlarm
Free e in italiano--->Guida all'uso
Kerio
Free e in italiano--->Guida all'uso
fabrizius
Utente Senior
 
Post: 1220
Iscritto il: 20/05/05 13:55


Torna a Sicurezza e Privacy


Topic correlati a "problemi con probabile virus":


Chi c’è in linea

Visitano il forum: Nessuno e 45 ospiti