system alert

[susana77]

ho scaricato smitfraudfix ma l'icon ce ancora come la rimovo???











SmitFraudFix v2.166

Scan done at 23:50:44.93, 12.04.2007
Run from C:\Documents and Settings\HP_Proprietario\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Versione 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\SharedTaskScheduler]
"{abef791f-947e-4cdf-83c3-e72a240afb67}"="frisbee"

[HKEY_CLASSES_ROOT\CLSID\{abef791f-947e-4cdf-83c3-e72a240afb67}\InProcServer32]
@="C:\WINDOWS\system32\ygjun.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{abef791 f-947e-4cdf-83c3-e72a240afb67}\InProcServer32]
@="C:\WINDOWS\system32\ygjun.dll"


»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{28EB877C-E010-4474-84E7-A20445FB0841}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{6610B93B-FABA-4E4D-830B-73E41592D355}: DhcpNameServer=16.92.3.242 16.92.3.243 16.81.3.243 16.114.3.243
HKLM\SYSTEM\CS1\Services\Tcpip\..\{28EB877C-E010-4474-84E7-A20445FB0841}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{6610B93B-FABA-4E4D-830B-73E41592D355}: DhcpNameServer=16.92.3.242 16.92.3.243 16.81.3.243 16.114.3.243
HKLM\SYSTEM\CS3\Services\Tcpip\..\{28EB877C-E010-4474-84E7-A20445FB0841}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{6610B93B-FABA-4E4D-830B-73E41592D355}: DhcpNameServer=16.92.3.242 16.92.3.243 16.81.3.243 16.114.3.243
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\SharedTaskScheduler]
"{abef791f-947e-4cdf-83c3-e72a240afb67}"="frisbee"

[HKEY_CLASSES_ROOT\CLSID\{abef791f-947e-4cdf-83c3-e72a240afb67}\InProcServer32]
@="C:\WINDOWS\system32\ygjun.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{abef791 f-947e-4cdf-83c3-e72a240afb67}\InProcServer32]
@="C:\WINDOWS\system32\ygjun.dll"



»»»»»»»»»»»»»»»»»»»»»»»» End

[amvinfe]

ciao,
quando devi rispondere all'interno di una discussione non cliccare su "nuovo" ma su "rispondi".


Se speighi meglio il problema...

Nel frattempo leggiti per favore i suggerimenti presenti all'URL
http://forum.html.it/forum/showthrea...hreadid=811189

[tognazzi]

uppete!


ciao susana.
posta log di hijackthis (v. punto 4 guida antimalware tra i thread in rilievo).