Si aprono pagine indesiderate

**btegt** · 01-04-2009, 23:53

Mi date un'occhiata al log di Hjackthis se c'è qualcosa da eliminare, visto che mi si aprono pagine pubblicitarie non richieste?

Logfile of HijackThis v1.99.1
Scan saved at 23.33.42, on 01/04/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programmi\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Programmi\Creative\Shared Files\CAMTRAY.EXE
C:\Programmi\File comuni\Symantec Shared\ccApp.exe
C:\Programmi\Logitech\iTouch\iTouch.exe
C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb0 4.exe
C:\WINDOWS\system32\taskswitch.exe
C:\Programmi\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
C:\Programmi\Unlocker\UnlockerAssistant.exe
C:\Programmi\Winamp\winampa.exe
C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programmi\QuickTime\QTTask.exe
C:\Programmi\iTunes\iTunesHelper.exe
C:\PROGRA~1\ALICET~1\SMARTB~1\MotiveSB.exe
C:\PROGRA~1\ALICET~1\vendors\AliceRE\content\templ ate\driven~1\syncer\MCCITR~1.EXE
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\Programmi\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Programmi\Java\jre6\bin\jusched.exe
C:\Programmi\MSN Messenger\MsnMsgr.Exe
C:\Programmi\Babylon\Babylon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\ATnotes\ATnotes.exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleTo olbarNotifier.exe
C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
C:\Documents and Settings\BRUNO\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe
C:\documents and settings\bruno\impostazioni locali\dati applicazioni\wsimu.exe
C:\Programmi\FreePOPs\freepopsd.exe
C:\Programmi\AVerTV 6.1\AVerQT.exe
C:\Programmi\Logitech\MouseWare\system\em_exec.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\Programmi\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Programmi\Alice ti aiuta\bin\mad.exe
C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe
C:\Programmi\Google\Update\GoogleUpdate.exe
C:\Programmi\Java\jre6\bin\jqs.exe
C:\Programmi\Alice ti aiuta\bin\mpbtn.exe
C:\PROGRA~1\Motive\ASSTCO~1\MOTIVE~1.EXE
C:\Programmi\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Programmi\Norton AntiVirus\navapsvc.exe
C:\Programmi\Telecom Italia\WanMiniport1st\srvany.exe
C:\Programmi\Norton AntiVirus\SAVScan.exe
C:\Programmi\Telecom Italia\WanMiniport1st\WanMiniport1st_srv.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\ssoftsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.e xe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe
C:\Programmi\File comuni\Symantec Shared\Security Center\SymWSC.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Documents and Settings\BRUNO\Desktop\PROTEZIONI PC\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/webhp?rls=ig
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = 127.0.0.1;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\5.1.1309 .3572\swg.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmi\Norton AntiVirus\NavShExt.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Programmi\Free Download Manager\iefdm2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmi\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugi n.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmi\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Programmi\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Programmi\Creative\Shared Files\CAMTRAY.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmi\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb0 4.exe
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Programmi\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Programmi\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmi\File comuni\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Programmi\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Programmi\Winamp\winampa.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\ALICET~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [AliceRE_McciTrayApp] C:\PROGRA~1\ALICET~1\vendors\AliceRE\content\templ ate\driven~1\syncer\MCCITR~1.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Babylon Translator] C:\Programmi\Babylon\Babylon.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ATnotes.exe] C:\Programmi\ATnotes\ATnotes.exe
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleTo olbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\BRUNO\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [wsimu] "c:\documents and settings\bruno\impostazioni locali\dati applicazioni\wsimu.exe" wsimu
O4 - Global Startup: Alice ti aiuta.lnk = C:\Programmi\Alice ti aiuta\bin\matcli.exe
O4 - Global Startup: FreePOPs.lnk = C:\Programmi\FreePOPs\freepopsd.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: QuickTV6.lnk = C:\Programmi\AVerTV 6.1\AVerQT.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Scarica con Free Download Manager - file://C:\Programmi\Free Download Manager\dllink.htm
O8 - Extra context menu item: Scarica i video con Free Download Manager - file://C:\Programmi\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Scarica selezionati con Free Download Manager - file://C:\Programmi\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Scarica tutto con Free Download Manager - file://C:\Programmi\Free Download Manager\dlall.htm
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesit.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesit.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Programmi\PPLive\PPLive.exe
O9 - Extra 'Tools' menuitem: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Programmi\PPLive\PPLive.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\programmi\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O17 - HKLM\System\CCS\Services\Tcpip\..\{43C06316-EA81-4988-AA60-47C624F470C7}: NameServer = 212.216.112.112
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

Post successivo per la 2° parte

**btegt** · 01-04-2009, 23:55

2° parte del log

O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Programmi\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Unknown owner - C:\Programmi\Bonjour\mDNSResponder.exe (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe
O23 - Service: getPlus(R) Helper - GEAR Software Inc. - (no file)
O23 - Service: Google Update Service (gupdate1c98ae610648d8a) (gupdate1c98ae610648d8a) - Unknown owner - C:\Programmi\Google\Update\GoogleUpdate.exe" /svc (file missing)
O23 - Service: Google Software Updater (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Programmi\Java\jre6\bin\jqs.exe" -service -config "C:\Programmi\Java\jre6\lib\deploy\jqs\jqs.con f (file missing)
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Servizio Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Programmi\Norton AntiVirus\navapsvc.exe
O23 - Service: Network WanMiniport First Position - Unknown owner - C:\Programmi\Telecom Italia\WanMiniport1st\srvany.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Programmi\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FILECO~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Programmi\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Programmi\Spyware Doctor\pctsSvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\SNDSrvc.exe
O23 - Service: Cryptainer service (ssoftservice) - Cypherix - C:\WINDOWS\SYSTEM32\ssoftsrv.exe
O23 - Service: Symantec RemoteAssist - Symantec, Inc. - C:\Programmi\File comuni\Symantec Shared\Support Controls\ssrc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Utilità di pianificazione di LiveUpdate automatico - Symantec Corporation - C:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.e xe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

**SkinBonno** · 02-04-2009, 01:02

Scarica Navilog1.exe_Il.Mafioso. Eseguilo, ti chiederà che lingua scegliere, scrivi E e dai invio, poi premi un tasto qualsiasi fino a che non arrivi alla schermata di selezione sul tipo di scansione da fare. Scrivi 1 e dai l'invio. A fine scansione ti si genererà un file di log. Copialo e incollalo sul forum.
N.B. Utilizzatori Windows Vista: Eseguite Navilog come Amministratore (click destro sull'icona di Navilog----> esegui come amministratore).

Riavvia il pc in modalità provvisoria: dopo la schermata di boot (3 secondi circa dopo l'accensione) premi ripetutamente F8, ti si aprirà una schermata in cui scegliere in che modalità avviare. Muovendoti con la freccia ^ seleziona "Avvia in modalità provvisoria" e dai l'invio.
Esegui Navilog, stessa procedura di prima, però questa volta seleziona l'opzione 2. Aspetta che finisca la scansione, riavvia il pc in modalità normale e rifai la scansione con l'opzione 1. Posta sul forum il log ottenuto.

N.B. Utilizzatori Windows Vista: Prima di riavviare in provvisoria, disabilitate l'UAC (user account control): Da Avvio--> Esegui--> Scrivete msconfig-->Scheda strumenti--> Selezionate "Disabilita controllo account utente"-->premete esegui (o avvia)-->riavviate il pc in modalità provvisoria. Alla fine delle operazioni ricordatevi di riattivarlo: Stessa procedura, nella scheda strumenti seleziona Abilita controllo dell'account utente.

**Deifobe** · 02-04-2009, 01:03

ciai, scarica navilog1.exe_il mafioso sul desktop e installalo.
Eseguilo, scegli la lingua e, al menù di scelta, seleziona l'opzione 1 (non scegliere le altre). Ad un certo punto uscirà una scritta "Analysis ... Terminate", premi un tasto come richiesto e si aprirà un file di testo (il rapporto della scansione che dovrai postare).

**btegt** · 02-04-2009, 10:05

Ho seguito le istruzioni datemi da Deifobe relativamente all'analogo post di ieri.
Ho scaricato Navilog, l'ho fatto partire ed aggiungo qui sotto il log ottenuto.

Non ho eseguito le istruzioni di SkinBonno perchè erano un po' più complicate e non velevo sovrapporre i log.
Se non rileverete nulla dal log qui sotto, eseguirò quanto dettato da SkinBonno
Per ora, grazie e attendo Vs notizie
N.B. per Vostra informazione, comunico che le pagine indesiderate sono pagine pubblicitarie(Tiscali, Alice, Ditte di materiale tecnico, ecc il cui tito è preceduto da un segno grafico che qui non so riprodurre, simile ad una s coricata, è il simbolo che gli spagnoli mettono sopra la enne di "senor" per in dicare il ditongo gn)

Search Navipromo version 3.7.6 began on 02/04/2009 at 9.48.31,96

!!! Warning, this report may include legitimate files/programs !!!
!!! Post this report on the forum you are being helped !!!
!!! Don't continue with removal unless instructed by an authorized helper !!!

Fix running from C:\Programmi\navilog1

Updated on 14.03.2009 at 18h00 by IL-MAFIOSO

Search done in normal mode

*** Search folders in "C:\WINDOWS" ***

*** Search folders in "C:\Programmi" ***

...\Live-Player found !

*** Search folders in "C:\Documents and Settings\All Users\menuav~1\progra~1" ***

...\Live-Player found !

*** Search folders in "C:\Documents and Settings\All Users\menuav~1" ***

*** Search folders in "c:\docume~1\alluse~1\datiap~1" ***

*** Search folders in "C:\Documents and Settings\BRUNO\datiap~1" ***

...\Live-Player found !

*** Search folders in "C:\DOCUME~1\ADMINI~1\datiap~1" ***

*** Search folders in "C:\Documents and Settings\BRUNO\impost~1\datiap~1" ***

*** Search folders in "C:\DOCUME~1\ADMINI~1\impost~1\datiap~1" ***

*** Search folders in "C:\Documents and Settings\BRUNO\menuav~1\progra~1" ***

*** Search folders in "C:\DOCUME~1\ADMINI~1\menuav~1\progra~1" ***

*** Search with Catchme-rootkit/stealth malware detector by gmer ***
for more info : http://www.gmer.net

*** Search with GenericNaviSearch ***
!!! Possibility of legitimate files in the result !!!
!!! Must always be checked before manually deleting !!!

* Scan in "C:\WINDOWS\system32" *

* Scan in "C:\Documents and Settings\BRUNO\impost~1\datiap~1" *

* Scan in "C:\DOCUME~1\ADMINI~1\impost~1\datiap~1" *

*** Search files ***

*** Search specific Registry keys ***
!! Following keys are not certainly all infected !!

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"wsimu"="\"c:\\documents and settings\\bruno\\impostazioni locali\\dati applicazioni\\wsimu.exe\" wsimu"

*** Complementary Search ***
(Search specific files)

1)Search new Instant Access files :

2)Heuristic Search :

* In "C:\WINDOWS\system32" :

* In "C:\Documents and Settings\BRUNO\impost~1\datiap~1" :

wsimu.exe found !
wsimu.dat found !
wsimu_nav.dat found !
wsimu_navps.dat found !

* In "C:\DOCUME~1\ADMINI~1\impost~1\datiap~1" :

3)Certificates Search :

Egroup certificate not found !
Electronic-Group certificate found !
Montorgueil certificate not found !
OOO-Favorit certificate found !
Sunny-Day-Design-Ltd certificate not found !

4)Search others known folders and files :

*** Search completed on 02/04/2009 at 9.53.29,01 ***

**Deifobe** · 02-04-2009, 10:40

Ciao,

per inserire un post nella tua discussione, devi cliccare su... "rispondi"
Comunque ho unito i due thread...

Non avevo visto la risposta di skin.. cmq le indicazioni sono le stesse...

Riavvia il computer in modalità provvisoria: all'avvio del pc, prima che inizi a caricare Windows, premi ripetutamente F8. Uscirà la finestra del menu Opzioni avanzate di Windows => scegli modalità provvisoria (usa il tasto freccia ^).
Esegui Navilog1 e scegli l'opzione 2 (Automatic Cleaning) e dai l'ok (eseguirà la pulizia dei files infetti trovati)
Quando finisce, riavvia il pc in modalità normale

Ripulisci con CCleaner i file temporanei e cookie

vedi il pc come va

ciao

**SkinBonno** · 02-04-2009, 14:09

Originariamente inviato da Deifobe
....Non avevo visto la risposta di skin...

Tranquilla Dei, siamo stati contemporanei =) finisci pure tu

**btegt** · 02-04-2009, 19:51

Ho seguito le Vostre istruzioni.
Allego copia del log eseguito dopo la pulizia e del log frutto della pulizia in modalità provvisoria.
Provo il pc e vi saprò dire se ci sono novità

Search Navipromo version 3.7.6 began on 02/04/2009 at 19.40.35,43

!!! Warning, this report may include legitimate files/programs !!!
!!! Post this report on the forum you are being helped !!!
!!! Don't continue with removal unless instructed by an authorized helper !!!

Fix running from C:\Programmi\navilog1

Updated on 14.03.2009 at 18h00 by IL-MAFIOSO

Search done in normal mode

*** Search folders in "C:\WINDOWS" ***

*** Search folders in "C:\Programmi" ***

*** Search folders in "C:\Documents and Settings\All Users\menuav~1\progra~1" ***

*** Search folders in "C:\Documents and Settings\All Users\menuav~1" ***

*** Search folders in "c:\docume~1\alluse~1\datiap~1" ***

*** Search folders in "C:\Documents and Settings\BRUNO\datiap~1" ***

*** Search folders in "C:\DOCUME~1\ADMINI~1\datiap~1" ***

*** Search folders in "C:\Documents and Settings\BRUNO\impost~1\datiap~1" ***

*** Search folders in "C:\DOCUME~1\ADMINI~1\impost~1\datiap~1" ***

*** Search folders in "C:\Documents and Settings\BRUNO\menuav~1\progra~1" ***

*** Search folders in "C:\DOCUME~1\ADMINI~1\menuav~1\progra~1" ***

*** Search with Catchme-rootkit/stealth malware detector by gmer ***
for more info : http://www.gmer.net

*** Search with GenericNaviSearch ***
!!! Possibility of legitimate files in the result !!!
!!! Must always be checked before manually deleting !!!

* Scan in "C:\WINDOWS\system32" *

* Scan in "C:\Documents and Settings\BRUNO\impost~1\datiap~1" *

* Scan in "C:\DOCUME~1\ADMINI~1\impost~1\datiap~1" *

*** Search files ***

*** Search specific Registry keys ***
!! Following keys are not certainly all infected !!

*** Complementary Search ***
(Search specific files)

1)Search new Instant Access files :

2)Heuristic Search :

* In "C:\WINDOWS\system32" :

* In "C:\Documents and Settings\BRUNO\impost~1\datiap~1" :

* In "C:\DOCUME~1\ADMINI~1\impost~1\datiap~1" :

3)Certificates Search :

Egroup certificate not found !
Electronic-Group certificate not found !
Montorgueil certificate not found !
OOO-Favorit certificate not found !
Sunny-Day-Design-Ltd certificate not found !

4)Search others known folders and files :

*** Search completed on 02/04/2009 at 19.44.42,03 ***

================================================== =============

Navipromo Removal version 3.7.6 started on 02/04/2009 at 19.17.34,42

Fix running from C:\Programmi\navilog1

Updated on 14.03.2009 at 18h00 by IL-MAFIOSO

Automatic removal
with Catchme and GNS results

Cleanning stage done in safe mode

*** fsbl1.txt not found ***
(Check that Catchme found nothing in Search Mode)

*** Deleting with Backups GenericNaviSearch results ***

* Deletion in "C:\WINDOWS\System32" *

* Deletion in "C:\Documents and Settings\BRUNO\impost~1\datiap~1" *

* Deletion in "C:\DOCUME~1\ADMINI~1\impost~1\datiap~1" *

*** Deleting folders in "C:\WINDOWS" ***

*** Deleting folders in "C:\Programmi" ***

...\Live-Player ...deleting...
...\Live-Player deleted !

*** Deleting folders in "C:\Documents and Settings\All Users\menuav~1\progra~1" ***

...\Live-Player ...deleting...
...\Live-Player deleted !

*** Deleting folders in "C:\Documents and Settings\All Users\menuav~1" ***

*** Deleting folders in "c:\docume~1\alluse~1\datiap~1" ***

*** Deleting folders in "C:\Documents and Settings\BRUNO\datiap~1" ***

...\Live-Player ...deleting...
...\Live-Player deleted !

*** Deleting folders in "C:\DOCUME~1\ADMINI~1\datiap~1" ***

*** Deleting folders in "C:\Documents and Settings\BRUNO\impost~1\datiap~1" ***

*** Deleting folders in "C:\DOCUME~1\ADMINI~1\impost~1\datiap~1" ***

*** Deleting folders in "C:\Documents and Settings\BRUNO\menuav~1\progra~1" ***

*** Deleting folders in "C:\DOCUME~1\ADMINI~1\menuav~1\progra~1" ***

*** Deleting files ***

*** Deleting temporary files ***

Cleaning of C:\WINDOWS\Temp done !
Cleaning of C:\Documents and Settings\BRUNO\impost~1\Temp done !

*** Complementary Search ***
(Search specific files)

1)Deletion with backups new Instant Access files:

2)Heuristic search and deletion with backups :

* In "C:\WINDOWS\system32" *

* In "C:\Documents and Settings\BRUNO\impost~1\datiap~1" *

wsimu.exe found !
Copy wsimu.exe done !
wsimu.exe deleted !

wsimu.dat found !
Copy wsimu.dat done !
wsimu.dat deleted !

wsimu_nav.dat found !
Copy wsimu_nav.dat done !
wsimu_nav.dat deleted !

wsimu_navps.dat found !
Copy wsimu_navps.dat done !
wsimu_navps.dat deleted !

* In "C:\DOCUME~1\ADMINI~1\impost~1\datiap~1" *

*** Copy Registry to Safebackup folder ***

Backing up Registry done !

*** Cleaning Registry ***

Registry cleaned

*** Certificates ***

Egroup Certificate not found !
Electronic-Group Certificate deleted !
Montorgueil Certificate not found !
OOO-Favorit Certificate deleted !
Sunny-Day-Design-Ltd Certificate not found !

*** Search others known folders and files ***

*** Cleaning stage complete on 02/04/2009 at 19.19.02,35 ***

**Deifobe** · 03-04-2009, 07:36

ok. dovrebbe essere tuttto a posto..
in caso contrario, stiamo qui..

ciao

Discussione: Si aprono pagine indesiderate

Strumenti discussione

Ricerca discussione

Visualizza

Si aprono pagine indesiderate

2° parte

Si aprono pagine indesiderate

Permessi di invio