barra non voluta in IE

**fragar** · 24-04-2004, 18:32

Salve amici, ho un problemino, quando apro l'explorer mi si inserisce sempre una barra ebatesmoemoneymaker, che oltre a dare fastidio mi apre in modo automatico nuove pagine internet, bloccando tutto:
- come posso disinstallarla
- esistono dei programmi che bloccano tali installazioni
grazie mille e abuon rendere.
Ho provatocon Spybot Search & Destroy suggeritomi da trinityck nella sezione software ma nulla di fatto, aiutatemi

**Cinder** · 24-04-2004, 20:50

Hai aggiornato spybot tramite l'apposita funzione di aggiornamento prima di lanciare la scansione? Puoi aggiornarlo anche scaricando ed eseguendo il file di aggiornamento da qui:

http://spybot.eon.net.au/files/spybotsd_includes.exe

Se non risolvi così vai in link utili:

http://forum.html.it/forum/showthrea...hreadid=235578

Scarica HijackThis, leggiti il relativo tutorial e incolla qui il contentuo del log, vedrai che riceverai senz'altro un aiuto.....

**fragar** · 26-04-2004, 17:10

OK, adesso provo, grazie mille

**fragar** · 27-04-2004, 18:12

Ecco il log, grazie mille:
Logfile of HijackThis v1.97.7
Scan saved at 18.09.11, on 27/04/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS.000\SYSTEM\KERNEL32.DLL
C:\WINDOWS.000\SYSTEM\MSGSRV32.EXE
C:\WINDOWS.000\SYSTEM\SPOOL32.EXE
C:\WINDOWS.000\SYSTEM\MPREXE.EXE
C:\WINDOWS.000\SYSTEM\MSTASK.EXE
C:\WINDOWS.000\SYSTEM\ATI2EVXX.EXE
C:\WINDOWS.000\SYSTEM\STIMON.EXE
C:\PROGRAMMI\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
C:\WINDOWS.000\SYSTEM\mmtask.tsk
C:\WINDOWS.000\SYSTEM\RPCSS.EXE
C:\WINDOWS.000\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS.000\EXPLORER.EXE
C:\WINDOWS.000\RUNDLL32.EXE
C:\WINDOWS.000\TASKMON.EXE
C:\WINDOWS.000\SYSTEM\SYSTRAY.EXE
C:\WINDOWS.000\SYSTEM\ATIPTAXX.EXE
C:\PROGRAMMI\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE
C:\WINDOWS.000\SYSTEM\WMIEXE.EXE
C:\WINDOWS.000\SYSTEM\QTTASK.EXE
C:\PROGRAMMI\THIS PLAY\HOLDPARTPILE.EXE
C:\WINDOWS.000\SYSUPD.EXE
C:\PROGRAMMI\WINZIP\WZQKPICK.EXE
C:\WINDOWS.000\NOTEPAD.EXE
C:\WINDOWS.000\DESKTOP\SPY_\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://allaboutsearching.com/passthr...www.vipnet.it/
O1 - Hosts: 207.36.196.189 ieautosearch
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS.000\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS.000\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS.000\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [AtiCwd32] Aticwd32.exe
O4 - HKLM\..\Run: [AtiQiPcl] AtiQiPcl.exe
O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe
O4 - HKLM\..\Run: [zzzHPSETUP] D:\Setup.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\PROGRAMMI\AVPERSONAL\AVGCTRL.EXE /min
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\AVAST4\ashmaisv.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS.000\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [SOFTWAREBOWS] C:\PROGRA~1\this play\HoldPartPile.exe
O4 - HKLM\..\Run: [SysUpd] C:\WINDOWS.000\SYSUPD.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS.000\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [ATIPOLAB] ati2evxx.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS.000\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [avast!] C:\Programmi\Alwil Software\Avast4\ashserv.exe
O4 - HKCU\..\Run: [ATI Launchpad] "C:\PROGRAMMI\ATI MULTIMEDIA\MAIN\LAUNCHPD.EXE"
O4 - Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O4 - Startup: WinZip Quick Pick.lnk = C:\Programmi\WinZip\WZQKPICK.EXE
O4 - Startup: WinPopup.lnk = C:\WINDOWS.000\WINPOPUP.EXE
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE10\EXCEL.EXE/3000
O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = vipnet.it
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 151.8.197.227

**amvinfe** · 27-04-2004, 18:59

Chiudi tutte le applicazioni, broswer compreso. Apri HJT fai lo Scan, e metti la spunta al fianco delle seguenti voci, dopodichè clicca su Fix checked.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://allaboutsearching.com/passth.../www.vipnet.it/

O1 - Hosts: 207.36.196.189 ieautosearch

O4 - HKLM\..\Run: [zzzHPSETUP] D:\Setup.exe

O4 - HKLM\..\Run: [SysUpd] C:\WINDOWS.000\SYSUPD.EXE

Riavvia in modalità provvisoria (è importante), premi il tasto F8 prima che il sistema operativo venga caricato.

Vai in:

C:\WINDOWS.000\SYSUPD.EXE <=== elimina il file

Riavvia e fai un nuovo Log, postalo qui.

**fragar** · 28-04-2004, 17:15

Fatto ecco il nuovo log, grazie mille

:

Logfile of HijackThis v1.97.7
Scan saved at 17.10.49, on 28/04/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS.000\SYSTEM\KERNEL32.DLL
C:\WINDOWS.000\SYSTEM\MSGSRV32.EXE
C:\WINDOWS.000\SYSTEM\SPOOL32.EXE
C:\WINDOWS.000\SYSTEM\MPREXE.EXE
C:\WINDOWS.000\SYSTEM\MSTASK.EXE
C:\WINDOWS.000\SYSTEM\ATI2EVXX.EXE
C:\WINDOWS.000\SYSTEM\STIMON.EXE
C:\PROGRAMMI\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
C:\WINDOWS.000\SYSTEM\mmtask.tsk
C:\WINDOWS.000\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS.000\EXPLORER.EXE
C:\WINDOWS.000\RUNDLL32.EXE
C:\WINDOWS.000\SYSTEM\RPCSS.EXE
C:\WINDOWS.000\TASKMON.EXE
C:\WINDOWS.000\SYSTEM\SYSTRAY.EXE
C:\WINDOWS.000\SYSTEM\WMIEXE.EXE
C:\WINDOWS.000\SYSTEM\ATIPTAXX.EXE
C:\PROGRAMMI\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE
C:\WINDOWS.000\SYSTEM\QTTASK.EXE
C:\PROGRAMMI\THIS PLAY\HOLDPARTPILE.EXE
C:\PROGRAMMI\WINZIP\WZQKPICK.EXE
C:\WINDOWS.000\DESKTOP\SPY_\HIJACKTHIS.EXE

O1 - Hosts: 207.36.196.189 auto.search.msn.com
O1 - Hosts: 207.36.196.189 search.netscape.com
O1 - Hosts: 207.36.196.189 ieautosearch
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS.000\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS.000\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS.000\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [AtiCwd32] Aticwd32.exe
O4 - HKLM\..\Run: [AtiQiPcl] AtiQiPcl.exe
O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\PROGRAMMI\AVPERSONAL\AVGCTRL.EXE /min
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\AVAST4\ashmaisv.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS.000\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [SOFTWAREBOWS] C:\PROGRA~1\this play\HoldPartPile.exe
O4 - HKLM\..\Run: [SysUpd] C:\WINDOWS.000\SYSUPD.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS.000\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [ATIPOLAB] ati2evxx.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS.000\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [avast!] C:\Programmi\Alwil Software\Avast4\ashserv.exe
O4 - HKCU\..\Run: [ATI Launchpad] "C:\PROGRAMMI\ATI MULTIMEDIA\MAIN\LAUNCHPD.EXE"
O4 - Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O4 - Startup: WinZip Quick Pick.lnk = C:\Programmi\WinZip\WZQKPICK.EXE
O4 - Startup: WinPopup.lnk = C:\WINDOWS.000\WINPOPUP.EXE
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE10\EXCEL.EXE/3000
O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = vipnet.it
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 151.8.197.227

**amvinfe** · 29-04-2004, 08:02

Chiudi tutte le applicazioni, broswer compreso. Apri HJT fai lo Scan, e metti la spunta al fianco delle seguenti voci, dopodichè clicca su Fix checked.

O1 - Hosts: 207.36.196.189 auto.search.msn.com

O1 - Hosts: 207.36.196.189 search.netscape.com

O1 - Hosts: 207.36.196.189 ieautosearch

O4 - HKLM\..\Run: [SysUpd] C:\WINDOWS.000\SYSUPD.EXE

Riavvia in modalità provvisoria (è importante), premi il tasto F8 prima che il sistema operativo venga caricato.

Vai in:

C:\WINDOWS.000\SYSUPD.EXE <=== elimina il file

Riavvia e fai un nuovo Log, postalo qui.

**fragar** · 29-04-2004, 15:59

nuovo log, grazie per la tua attenzione

:
Logfile of HijackThis v1.97.7
Scan saved at 15.57.37, on 29/04/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS.000\SYSTEM\KERNEL32.DLL
C:\WINDOWS.000\SYSTEM\MSGSRV32.EXE
C:\WINDOWS.000\SYSTEM\mmtask.tsk
C:\WINDOWS.000\SYSTEM\MPREXE.EXE
C:\WINDOWS.000\SYSTEM\MSTASK.EXE
C:\WINDOWS.000\SYSTEM\ATI2EVXX.EXE
C:\WINDOWS.000\SYSTEM\STIMON.EXE
C:\PROGRAMMI\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
C:\WINDOWS.000\EXPLORER.EXE
C:\WINDOWS.000\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS.000\SYSTEM\RPCSS.EXE
C:\WINDOWS.000\TASKMON.EXE
C:\WINDOWS.000\SYSTEM\SYSTRAY.EXE
C:\WINDOWS.000\SYSTEM\ATIPTAXX.EXE
C:\PROGRAMMI\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE
C:\WINDOWS.000\SYSTEM\QTTASK.EXE
C:\PROGRAMMI\THIS PLAY\HOLDPARTPILE.EXE
C:\PROGRAMMI\WINZIP\WZQKPICK.EXE
C:\WINDOWS.000\SYSTEM\WMIEXE.EXE
C:\WINDOWS.000\SYSTEM\DDHELP.EXE
C:\WINDOWS.000\DESKTOP\SPY_\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://allaboutsearching.com/passthr...www.vipnet.it/
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS.000\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS.000\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS.000\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [AtiCwd32] Aticwd32.exe
O4 - HKLM\..\Run: [AtiQiPcl] AtiQiPcl.exe
O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\PROGRAMMI\AVPERSONAL\AVGCTRL.EXE /min
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\AVAST4\ashmaisv.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS.000\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [SOFTWAREBOWS] C:\PROGRA~1\this play\HoldPartPile.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS.000\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [ATIPOLAB] ati2evxx.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS.000\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [avast!] C:\Programmi\Alwil Software\Avast4\ashserv.exe
O4 - HKCU\..\Run: [ATI Launchpad] "C:\PROGRAMMI\ATI MULTIMEDIA\MAIN\LAUNCHPD.EXE"
O4 - Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O4 - Startup: WinZip Quick Pick.lnk = C:\Programmi\WinZip\WZQKPICK.EXE
O4 - Startup: WinPopup.lnk = C:\WINDOWS.000\WINPOPUP.EXE
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE10\EXCEL.EXE/3000
O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = vipnet.it
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 151.8.197.227

**amvinfe** · 30-04-2004, 01:03

mi sembra tutto a posto, una cosa solo volevo chiederti. La home page che hai di default
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://allaboutsearching.com/passth.../www.vipnet.it/
la imposti tu?
questo indirizzo allaboutsearching.com corrisponde ad uno spyware

**fragar** · 30-04-2004, 17:30

Salve e grazie tante, la pagina:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://allaboutsearching.com/passth.../www.vipnet.it/
non la imposto, mi compare,e ognivolta che la cancello mi ricompare.
Grazie di nuovo tante

Discussione: barra non voluta in IE

Strumenti discussione

Ricerca discussione

Visualizza

barra non voluta in IE

barra

ie

IE

IE

Permessi di invio