e1xplorer

di **montanaro_paolo** » 16/10/06 19:03

ciao !

anche io ho lo stesso problema e di computer ci capisco poco... chi mi aiuta ???

questo quanto rilevato da gmer110 :

GMER 1.0.10.10122 - http://www.gmer.net
Autostart 2006-10-16 19:52:43
Windows 5.1.2600 Service Pack 1

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems@Windows = %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon@Userinit = C:\WINDOWS\system32\userinit.exe,

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui@DLLName = igfxsrvc.dll

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows@AppInit_DLLs = \\?\C:\WINDOWS\System32\com2.cwy

HKLM\SYSTEM\CurrentControlSet\Services\ >>>
aswUpdSv /*avast! iAVS4 Control Service*/@ = "C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe"
avast! Antivirus /*avast! Antivirus*/@ = "C:\Programmi\Alwil Software\Avast4\ashServ.exe"
Fax /*Fax*/@ = %systemroot%\system32\fxssvc.exe
Oxd /*Oxd*/@ = "\\?\C:\Programmi\lpt9.exe"
Spooler /*Spooler di stampa*/@ = %SystemRoot%\system32\spoolsv.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\Run >>>
@LaunchAppLaunApp = LaunApp
@IgfxTrayC:\WINDOWS\System32\igfxtray.exe = C:\WINDOWS\System32\igfxtray.exe
@HotKeysCmdsC:\WINDOWS\System32\hkcmd.exe = C:\WINDOWS\System32\hkcmd.exe
@SynTPLprC:\Programmi\Synaptics\SynTP\SynTPLpr.exe = C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
@SynTPEnhC:\Programmi\Synaptics\SynTP\SynTPEnh.exe = C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
@AcerNotebookManagerC:\Programmi\Acer\Notebook Manager\almxptray.exe = C:\Programmi\Acer\Notebook Manager\almxptray.exe
@LaunchApC:\Programmi\Launch Manager\LaunchAp.exe = C:\Programmi\Launch Manager\LaunchAp.exe
@PowerKey"C:\Programmi\Launch Manager\PowerKey.exe" = "C:\Programmi\Launch Manager\PowerKey.exe"
@LManagerC:\Programmi\Launch Manager\HotkeyApp.exe = C:\Programmi\Launch Manager\HotkeyApp.exe
@CtrlVolC:\Programmi\Launch Manager\CtrlVol.exe = C:\Programmi\Launch Manager\CtrlVol.exe
@Wbutton"C:\Programmi\Launch Manager\Wbutton.exe" = "C:\Programmi\Launch Manager\Wbutton.exe"
@AGRSMMSGAGRSMMSG.exe = AGRSMMSG.exe
@LtMohC:\Programmi\ltmoh\Ltmoh.exe = C:\Programmi\ltmoh\Ltmoh.exe
@SunJavaUpdateSchedC:\Programmi\Java\jre1.5.0_06\bin\jusched.exe = C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
@SystemsC:\WINDOWS\System32\sysmon.exe = C:\WINDOWS\System32\sysmon.exe
@ioeuaC:\Documents and Settings\Unieuro\Dati applicazioni\citofarera\sysstvmr.exe = C:\Documents and Settings\Unieuro\Dati applicazioni\citofarera\sysstvmr.exe
@brvl2.exeC:\WINDOWS\Temp\brvl2.exe = C:\WINDOWS\Temp\brvl2.exe
@aoueiC:\Documents and Settings\Unieuro\Dati applicazioni\ratorefaci\sysrtmvs.exe = C:\Documents and Settings\Unieuro\Dati applicazioni\ratorefaci\sysrtmvs.exe
@MCAgentExec:\PROGRA~1\mcafee.com\agent\mcagent.exe = c:\PROGRA~1\mcafee.com\agent\mcagent.exe
@MCUpdateExeC:\PROGRA~1\mcafee.com\agent\McUpdate.exe = C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
@avast!C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe = C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run >>>
@CTFMON.EXEC:\WINDOWS\System32\ctfmon.exe = C:\WINDOWS\System32\ctfmon.exe
@ChkMail?<‹ /*file not found*/ = ?<‹ /*file not found*/

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved >>>
@{42071714-76d4-11d1-8b24-00a0c9068ff3} /*Estensione panoramica video del Pannello di controllo*/deskpan.dll /*file not found*/ = deskpan.dll /*file not found*/
@{59850401-6664-101B-B21C-00AA004BA90B} /*Microsoft Office Binder Unbind*/C:\PROGRA~1\MICROS~2\Office\1040\UNBIND.DLL = C:\PROGRA~1\MICROS~2\Office\1040\UNBIND.DLL
@{472083B0-C522-11CF-8763-00608CC02F24} /*avast*/C:\Programmi\Alwil Software\Avast4\ashShell.dll = C:\Programmi\Alwil Software\Avast4\ashShell.dll

HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved@{BDEADF00-C265-11d0-BCED-00A0C90AB50F} /*Cartelle Web*/ = C:\PROGRA~1\FILECO~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\avast@{472083B0-C522-11CF-8763-00608CC02F24} = C:\Programmi\Alwil Software\Avast4\ashShell.dll

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\avast@{472083B0-C522-11CF-8763-00608CC02F24} = C:\Programmi\Alwil Software\Avast4\ashShell.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects >>>
@{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx = C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
@{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll = C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
@{DA39029C-D291-A968-3FF4-D0990D5CB5FC}C:\Programmi\LinkOptimizer\LinkOptimizer.dll /*file not found*/ = C:\Programmi\LinkOptimizer\LinkOptimizer.dll /*file not found*/

HKCU\Control Panel\Desktop@SCRNSAVE.EXE = none /*file not found*/

HKLM\Software\Microsoft\Internet Explorer\Main >>>
@Default_Page_URLhttp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome = http://www.microsoft.com/isapi/redir.dl ... ar=msnhome
@Start Pagehttp://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
@Local PageC:\windows\system32\blank.htm = C:\windows\system32\blank.htm

HKCU\Software\Microsoft\Internet Explorer\Main >>>
@Start Pagehttp://www.microsoft.com/isapi/redi ... ar=msnhome = http://www.microsoft.com/isapi/redir.dl ... ar=msnhome
@Local PageC:\windows\system32\blank.htm = C:\windows\system32\blank.htm

HKLM\Software\Classes\PROTOCOLS\Handler\ >>>
dvd@CLSID = C:\WINDOWS\System32\msvidctl.dll
its@CLSID = C:\WINDOWS\System32\itss.dll
mhtml@CLSID = %SystemRoot%\System32\inetcomm.dll
ms-its@CLSID = C:\WINDOWS\System32\itss.dll
tv@CLSID = C:\WINDOWS\System32\msvidctl.dll
vnd.ms.radio@CLSID = C:\WINDOWS\System32\msdxm.ocx
wia@CLSID = C:\WINDOWS\System32\wiascr.dll

HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{DC0CE7AA-D5CE-4BD3-BFDA-93F92947CCDA} /*Connessione alla rete locale (LAN)*/ >>>
@IPAddress192.168.1.30 = 192.168.1.30
@NameServer212.216.112.222 = 212.216.112.222
@DefaultGateway192.168.1.1 = 192.168.1.1
@Domain =

C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica = Microsoft Office.lnk

---- EOF - GMER 1.0.10 ----

GMER 1.0.10.10122 - http://www.gmer.net
Autostart 2006-10-16 19:53:51
Windows 5.1.2600 Service Pack 1

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems@Windows = %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon@Userinit = C:\WINDOWS\system32\userinit.exe,

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui@DLLName = igfxsrvc.dll

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows@AppInit_DLLs = \\?\C:\WINDOWS\System32\com2.cwy

HKLM\SYSTEM\CurrentControlSet\Services\ >>>
aswUpdSv /*avast! iAVS4 Control Service*/@ = "C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe"
avast! Antivirus /*avast! Antivirus*/@ = "C:\Programmi\Alwil Software\Avast4\ashServ.exe"
Fax /*Fax*/@ = %systemroot%\system32\fxssvc.exe
Oxd /*Oxd*/@ = "\\?\C:\Programmi\lpt9.exe"
Spooler /*Spooler di stampa*/@ = %SystemRoot%\system32\spoolsv.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\Run >>>
@LaunchAppLaunApp = LaunApp
@IgfxTrayC:\WINDOWS\System32\igfxtray.exe = C:\WINDOWS\System32\igfxtray.exe
@HotKeysCmdsC:\WINDOWS\System32\hkcmd.exe = C:\WINDOWS\System32\hkcmd.exe
@SynTPLprC:\Programmi\Synaptics\SynTP\SynTPLpr.exe = C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
@SynTPEnhC:\Programmi\Synaptics\SynTP\SynTPEnh.exe = C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
@AcerNotebookManagerC:\Programmi\Acer\Notebook Manager\almxptray.exe = C:\Programmi\Acer\Notebook Manager\almxptray.exe
@LaunchApC:\Programmi\Launch Manager\LaunchAp.exe = C:\Programmi\Launch Manager\LaunchAp.exe
@PowerKey"C:\Programmi\Launch Manager\PowerKey.exe" = "C:\Programmi\Launch Manager\PowerKey.exe"
@LManagerC:\Programmi\Launch Manager\HotkeyApp.exe = C:\Programmi\Launch Manager\HotkeyApp.exe
@CtrlVolC:\Programmi\Launch Manager\CtrlVol.exe = C:\Programmi\Launch Manager\CtrlVol.exe
@Wbutton"C:\Programmi\Launch Manager\Wbutton.exe" = "C:\Programmi\Launch Manager\Wbutton.exe"
@AGRSMMSGAGRSMMSG.exe = AGRSMMSG.exe
@LtMohC:\Programmi\ltmoh\Ltmoh.exe = C:\Programmi\ltmoh\Ltmoh.exe
@SunJavaUpdateSchedC:\Programmi\Java\jre1.5.0_06\bin\jusched.exe = C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
@SystemsC:\WINDOWS\System32\sysmon.exe = C:\WINDOWS\System32\sysmon.exe
@ioeuaC:\Documents and Settings\Unieuro\Dati applicazioni\citofarera\sysstvmr.exe = C:\Documents and Settings\Unieuro\Dati applicazioni\citofarera\sysstvmr.exe
@brvl2.exeC:\WINDOWS\Temp\brvl2.exe = C:\WINDOWS\Temp\brvl2.exe
@aoueiC:\Documents and Settings\Unieuro\Dati applicazioni\ratorefaci\sysrtmvs.exe = C:\Documents and Settings\Unieuro\Dati applicazioni\ratorefaci\sysrtmvs.exe
@MCAgentExec:\PROGRA~1\mcafee.com\agent\mcagent.exe = c:\PROGRA~1\mcafee.com\agent\mcagent.exe
@MCUpdateExeC:\PROGRA~1\mcafee.com\agent\McUpdate.exe = C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
@avast!C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe = C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run >>>
@CTFMON.EXEC:\WINDOWS\System32\ctfmon.exe = C:\WINDOWS\System32\ctfmon.exe
@ChkMail?<‹ /*file not found*/ = ?<‹ /*file not found*/

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved >>>
@{42071714-76d4-11d1-8b24-00a0c9068ff3} /*Estensione panoramica video del Pannello di controllo*/deskpan.dll /*file not found*/ = deskpan.dll /*file not found*/
@{59850401-6664-101B-B21C-00AA004BA90B} /*Microsoft Office Binder Unbind*/C:\PROGRA~1\MICROS~2\Office\1040\UNBIND.DLL = C:\PROGRA~1\MICROS~2\Office\1040\UNBIND.DLL
@{472083B0-C522-11CF-8763-00608CC02F24} /*avast*/C:\Programmi\Alwil Software\Avast4\ashShell.dll = C:\Programmi\Alwil Software\Avast4\ashShell.dll

HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved@{BDEADF00-C265-11d0-BCED-00A0C90AB50F} /*Cartelle Web*/ = C:\PROGRA~1\FILECO~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\avast@{472083B0-C522-11CF-8763-00608CC02F24} = C:\Programmi\Alwil Software\Avast4\ashShell.dll

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\avast@{472083B0-C522-11CF-8763-00608CC02F24} = C:\Programmi\Alwil Software\Avast4\ashShell.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects >>>
@{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx = C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
@{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll = C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
@{DA39029C-D291-A968-3FF4-D0990D5CB5FC}C:\Programmi\LinkOptimizer\LinkOptimizer.dll /*file not found*/ = C:\Programmi\LinkOptimizer\LinkOptimizer.dll /*file not found*/

HKCU\Control Panel\Desktop@SCRNSAVE.EXE = none /*file not found*/

HKLM\Software\Microsoft\Internet Explorer\Main >>>
@Default_Page_URLhttp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome = http://www.microsoft.com/isapi/redir.dl ... ar=msnhome
@Start Pagehttp://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
@Local PageC:\windows\system32\blank.htm = C:\windows\system32\blank.htm

HKCU\Software\Microsoft\Internet Explorer\Main >>>
@Start Pagehttp://www.microsoft.com/isapi/redi ... ar=msnhome = http://www.microsoft.com/isapi/redir.dl ... ar=msnhome
@Local PageC:\windows\system32\blank.htm = C:\windows\system32\blank.htm

HKLM\Software\Classes\PROTOCOLS\Handler\ >>>
dvd@CLSID = C:\WINDOWS\System32\msvidctl.dll
its@CLSID = C:\WINDOWS\System32\itss.dll
mhtml@CLSID = %SystemRoot%\System32\inetcomm.dll
ms-its@CLSID = C:\WINDOWS\System32\itss.dll
tv@CLSID = C:\WINDOWS\System32\msvidctl.dll
vnd.ms.radio@CLSID = C:\WINDOWS\System32\msdxm.ocx
wia@CLSID = C:\WINDOWS\System32\wiascr.dll

HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{DC0CE7AA-D5CE-4BD3-BFDA-93F92947CCDA} /*Connessione alla rete locale (LAN)*/ >>>
@IPAddress192.168.1.30 = 192.168.1.30
@NameServer212.216.112.222 = 212.216.112.222
@DefaultGateway192.168.1.1 = 192.168.1.1
@Domain =

C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica = Microsoft Office.lnk

---- EOF - GMER 1.0.10 ----

GRAZIE 1000 se potete salvarmi indicandomi cosa sipuo' fare passo dopo passo

Paolo

di **Luke57** » 16/10/06 19:24

Ciao, scarica avenger sul desktop
http://swandog46.geekstogo.com/avenger.zip
scompatta il file.zip
Avvia il file avenger.exe
Seleziona l'opzione "Input Script Manually"
Clicca sulla lente di ingrandimento

Ti si apre una finestra "View/edit script"
All'interno del box bianco,copia e incolla le scritte in neretto:

Registry values to replace with dummy:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows | AppInit_DLLs

registry values to delete:
HKLM\SYSTEM\CurrentControlSet\Services|Oxd
HKLM\Software\Microsoft\Windows\CurrentVersion\Run|Systems
HKLM\Software\Microsoft\Windows\CurrentVersion\Run|ioeua
HKLM\Software\Microsoft\Windows\CurrentVersion\Run|brvl2.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Run|aouei
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects|{DA39029C-D291-A968-3FF4-D0990D5CB5FC}

Files to delete:
C:\WINDOWS\System32\com2.cwy
C:\Programmi\lpt9.exe
C:\WINDOWS\System32\sysmon.exe
C:\WINDOWS\Temp\brvl2.exe

Folders to delete:
C:\Documents and Settings\Unieuro\Dati applicazioni\citofarera
C:\Documents and Settings\Unieuro\Dati applicazioni\ratorefaci

Clicca sul pulsante Done
Clicca sull'icona del semaforo verde
Rispondi due volte Yes
Il pc dovrebbe riavviarsi da solo,se così non fosse riavvialo manualmente

Posta il log di Avenger (C:/avenger.txt) con l´esito dello script

di **montanaro_paolo** » 17/10/06 17:37

Grazie 1000,
questo cio che c'era nel block notes.

*******************

Script file located at: \??\C:\gbibpdce.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Could not delete registry value HKLM\SYSTEM\CurrentControlSet\Services|Oxd
Deletion of registry value HKLM\SYSTEM\CurrentControlSet\Services|Oxd failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Services|Oxd
Status: 0xc0000034

File C:\WINDOWS\System32\com2.cwy deleted successfully.
File C:\Programmi\lpt9.exe deleted successfully.
File C:\WINDOWS\System32\sysmon.exe deleted successfully.
File C:\WINDOWS\Temp\brvl2.exe deleted successfully.
Folder C:\Documents and Settings\Unieuro\Dati applicazioni\citofarera deleted successfully.
Folder C:\Documents and Settings\Unieuro\Dati applicazioni\ratorefaci deleted successfully.
Registry value HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows|AppInit_DLLs replaced with dummy successfully.
Registry value HKLM\Software\Microsoft\Windows\CurrentVersion\Run|Systems deleted successfully.
Registry value HKLM\Software\Microsoft\Windows\CurrentVersion\Run|ioeua deleted successfully.
Registry value HKLM\Software\Microsoft\Windows\CurrentVersion\Run|brvl2.exe deleted successfully.
Registry value HKLM\Software\Microsoft\Windows\CurrentVersion\Run|aouei deleted successfully.

Could not delete registry value HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects|{DA39029C-D291-A968-3FF4-D0990D5CB5FC}
Deletion of registry value HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects|{DA39029C-D291-A968-3FF4-D0990D5CB5FC} failed!
Status: 0xc0000034

Completed script processing.

*******************

Finished! Terminate.

di **Luke57** » 17/10/06 17:47

Ciao, puoi postare un log di hijackthis?

di **Luke57** » 17/10/06 17:49

Ciao, prima fai girare questo:
http://pcalsicuro.phpsoft.it/FixGrom.exe
eseguilo con l'antivirus disattivato. Al riavviod del computer, sarà terminata la scansione. Allega in un post il repor dello scan che trovi in C:\Gromozon_Removal.log

e1xplorer

e1xplorer

grazie 1000. POST AVENGER

Topic correlati a "e1xplorer":

Chi c’è in linea