virus che mi apre le pagine internet

[sandruzza82]

ciao raga
credo...aanzi sono sicura di avere quel noioso vairus che mi apre da solo le pagine internet.
ho fatto la scansione cn navilog :
ho fatto la scansione con navilog, come suggerito da hell's bell ad ub altro utente, ma non mi fa andare avanti con la pulizia, suggerendomi di rivolgermi ad esperti, e così sono venuta da voi
purtroppo nn riesco a caricare su savefile il file di testo col rapporto della scansione ; sono due giorni che ci provo, ma mi si impalla . Accetto suggerimenti anche per questo.
vi prego aiutatemi! vi voglio bene!

[Deifobe]

posti il rapporto di navilog? (direttamente sul forum..)

buondì

[sandruzza82]

grazie...
non ero sicura di poterlo postare per regolamento (chiedo venia, ma non l'ho letto con attenzione), visto che tutti suggerivano di rivolgersi ai servizi di filehosting.
Questo è il rapporto di navilog , bello no?:
Search Navipromo version 3.6.9 began on 05/12/2008 at 12.30.34,64

!!! Warning, this report may include legitimate files/programs !!!
!!! Post this report on the forum you are being helped !!!
!!! Don't continue with removal unless instructed by an authorized helper !!!
Fix running from C:\Program Files\navilog1
Actual User Account : "casssone"

Updated on 05.11.2008 at 21h00 by IL-MAFIOSO

Microsoft Windows Vista 6.0.6001
Version Internet Explorer : 7.0.6001.18000
Filesystem type : NTFS

Search done in normal mode

*** Searching for installed Software ***


*** Search folders in "C:\Windows" ***


*** Search folders in "C:\Program Files" ***

...\WebMediaPlayer found !

*** Search folders in "c:\progra~2\micros~1\windows\startm~1\program s" ***

...\WebMediaPlayer found !

*** Search folders in "c:\progra~2\micros~1\windows\startm~1" ***


*** Search folders in "C:\ProgramData" ***


*** Search folders in "c:\users\casssone\appdata\roaming\micros~1\window s\startm~1\programs" ***


*** Search folders in "C:\Users\casssone\AppData\Local\virtualstore\Prog ram Files" ***


*** Search folders in "C:\Users\giuseppe\AppData\Local\virtualstore\Prog ram Files" ***


*** Search folders in "C:\Users\casssone\AppData\Roaming" ***


*** Search folders in "C:\Users\giuseppe\appdata\roaming" ***


*** Search with Catchme-rootkit/stealth malware detector by gmer ***
for more info : http://www.gmer.net



*** Search with GenericNaviSearch ***
!!! Possibility of legitimate files in the result !!!
!!! Must always be checked before manually deleting !!!

* Scan in "C:\Windows\system32" *

* Scan in "C:\Users\casssone\AppData\Local\Microsoft" *

* Scan in "C:\Users\casssone\AppData\Local\virtualstore\wind ows\system32" *

* Scan in "C:\Users\casssone\AppData\Local" *

* Scan in "C:\Users\giuseppe\AppData\Local" *



*** Search files ***


c:\users\public\desktop\WebMediaPlayer.lnk found !

*** Search specific Registry keys ***


*** Complementary Search ***
(Search specific files)

1)Search new Instant Access files :


2)Heuristic Search :

* In "C:\Windows\system32" :


* In "C:\Users\casssone\AppData\Local\Microsoft" :


* In "C:\Users\casssone\AppData\Local\virtualstore\wind ows\system32" :


* In "C:\Users\casssone\AppData\Local" :

eyyyw.exe found !
eyyyw.dat found !
eyyyw_nav.dat found !
eyyyw_navps.dat found !

* In "C:\Users\giuseppe\AppData\Local" :


3)Certificates Search :

Egroup certificate not found !
Electronic-Group certificate found !
Montorgueil certificate not found !
OOO-Favorit certificate found !
Sunny-Day-Design-Ltd certificate not found !

4)Search known files :



*** Search completed on 05/12/2008 at 13.00.00,29 ***
grazie in anticipo a chiunque mi saprà dare uan mano

[Deifobe]

visualizza i file nascosti
elimina i 4 file eyyyw che trovi in:

"C:\Users\casssone\AppData\Local" :

eyyyw.exe
eyyyw.dat
eyyyw_nav.dat
eyyyw_navps.dat

[sandruzza82]

grazie per il tuo prezioso aiuto anke nei giorni festivi. il problema dell'apertura delle pagine sembra risolto anche se la connessione va molto lenta. provo un'altra scansione con navilog e poi magari faccio un apulizia con ccleaner. ti faccio sapere. ancora grazie

[Deifobe]

se l'hai rimosso non serve rieseguire navolog1

piuttosto, fai una scansione on-line con Kaspersky:
clicca su Kaspersky Online Scanner => Accept => (partirà l'update)
=> seleziona "my computer" (a sinistra) e da questo momento in poi puoi anche disconnettere il pc da internet
=> al termine della scansione clicca su "View Scan Report"
=> "Save Report As" => salva e posta il rapporto.

[sandruzza82]

ecco qui il rapporto di kaspersky. come vedi è in html. mi segnala qualke virus di troppo. mannaggia. spero si possa rimediare.
grazie ancora x il tuo interssamento

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">

<html>
<head>
<title>KASPERSKY ONLINE SCANNER 7 REPORT</title>
<meta http-equiv='Content-Type' content='text/html; charset=utf-8'>
<style type='text/css'>
.pagetitle { font-size:20px; color:#FFFFFF; font-family: Arial, Geneva, sans-serif; }
.text { font-size:11px; font-family: Arial, Geneva, sans-serif; }
TD { font-size:11px; font-family: Arial, Geneva, sans-serif; }
</style>

</head>

<body>
<table width='100%' border='0'>
<tr align='center' bgcolor='#005447'>
<td colspan='2' height='30px' class='pagetitle'>
KASPERSKY ONLINE SCANNER 7 REPORT
</td>
</tr>
<tr>
<td colspan='2' height='70px'>
Wednesday, December 10, 2008

Operating System: Microsoft Windows Vista Home Premium Edition, 32-bit Service Pack 1 (build 6001)

Kaspersky Online Scanner 7 version: 7.0.25.0

Program database last update: Wednesday, December 10, 2008 09:05:56

Records in database: 1449457

</td>
</tr>
<tr>
<td colspan='2' height='10px'>
</td>
</tr>
</table>
<table width='100%' border='0'>
<tr bgcolor='#EFEBDE'>
<td colspan='2' height='20px'>Scan settings</td>
</tr>
<tr>
<td height='15px' width='250px'>Scan using the following database</td>
<td>extended</td>
</tr>
<tr>
<td height='15px'>Scan archives</td>
<td>yes</td>
</tr>
<tr>
<td height='15px'>Scan mail databases</td>
<td>yes</td>
</tr>
<tr>
<td colspan='2' height='10px'>
</td>
</tr>
<tr bgcolor='#EFEBDE'>
<td height='20px'>Scan area</td>
<td>My Computer</td>
</tr>
<tr>
<td colspan='2' height='20px'>
C:\

D:\

E:\

F:\
</td>
</tr>
<tr>
<td colspan='2' height='10px'>
</td>
</tr>
<tr bgcolor='#EFEBDE'>
<td colspan='2' height='20px'>Scan statistics</td>
</tr>
<tr>
<td height='15px'>Files scanned</td>
<td>340247</td>
</tr>
<tr>
<td height='15px'>Threat name</td>
<td>4</td>
</tr>
<tr>
<td height='15px'>Infected objects</td>
<td>6</td>
</tr>
<tr>
<td height='15px'>Suspicious objects</td>
<td>0</td>
</tr>
<tr>
<td height='15px'>Duration of the scan</td>
<td>05:35:27</td>
</tr>
</table>


<table width='100%%' border="0">

<tr bgcolor='#EFEBDE'><td height='20px'>File name</td>
<td width='200px'>Threat name</td>
<td width='100px'>Threats count</td>
</tr>
<tr><td height='20px'>C:\Program Files\Acrobat Pro 9.0.exe</td><td>Infected: Trojan.Win32.Agent.yxd</td><td>1</td><td></tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr><td height='20px'>C:\Program Files\ESET\infected\3ZGLQJAA.NQF</td><td>Infected: Trojan.Win32.Agent.yxd</td><td>1</td><td></tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr><td height='20px'>C:\Program Files\ESET\infected\4Q3S3CBA.NQF</td><td>Infected: not-a-virus:AdWare.Win32.FakeInstaller.a</td><td>1</td><td></tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr><td height='20px'>C:\Program Files\ESET\infected\Y2QRW2AA.NQF</td><td>Infected: not-a-virus:AdWare.Win32.FakeInstaller.a</td><td>1</td><td></tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr><td height='20px'>C:\Users\casssone\AppData\LocalLow\S un\Java\Deployment\cache\6.0\6\7757bb86-7cf573c0</td><td>Infected: Trojan-Downloader.Java.OpenConnection.aq</td><td>1</td><td></tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr><td height='20px'>C:\Users\casssone\Desktop\scarico\in stall_Windows Media Player_.exe</td><td>Infected: not-a-virus:FraudTool.Win32.CCleaner.i</td><td>1</td><td></tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr><td colspan='3' height='20px'>[b]
The selected area was scanned.</td></tr></table>
</body>
</html>

[Deifobe]

quelli in C:\Program Files\ESET\infected sono i file in quarantena, ok..

gli altri eliminali pure e svuota la cache di Java (istruzioni)