ricerche facili

[diabolik]

purtroppo mi si aprono finestre "strane", Explorer mi mette in predefifinito www.ricerchefacili.com, non riesco a toglierli ne con Ad-aware e spy-bot, come faccio ???????????

[amvinfe]

in Rilievo -links utili- scaricati HijackThis, segui le istruzioni presenti nel tutorial, posta un suo log.

[diabolik]

Di seguito il log:
------------------------------------


Logfile of HijackThis v1.98.2
Scan saved at ....., on 09/12/2004
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\drivers\trcboot.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\LogWatNT.exe
C:\Programmi\Network Associates\Common Framework\FrameworkService.exe
C:\Programmi\Network Associates\VirusScan\Mcshield.exe
C:\Programmi\Network Associates\VirusScan\VsTskMgr.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\TNGRCO\RCOService.exe
C:\TNGRCO\rp32u.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\TNGSD\BIN\SDSERV.EXE
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\TNGSD\BIN\TRIGGAG.EXE
C:\WINNT\system32\pcssfrrx.exe
C:\SxpInst\sxplog32.exe
C:\WINNT\Explorer.EXE
C:\Programmi\Personal Communications\PCS_AGNT.EXE
C:\WINNT\system32\RunDll32.exe
C:\Programmi\FileNET\IDM\fnsysmgr.exe
C:\WINNT\system32\ShellExt\ATX5.EXE
C:\Programmi\Network Associates\Common Framework\UpdaterUI.exe
C:\Programmi\Network Associates\VirusScan\SHSTAT.EXE
C:\TNGSD\BIN\triggusr.exe
C:\WINNT\system32\ctfmon.exe
C:\Programmi\Okidata\OKI LPR Utility\okilpr.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\WINNT\system32\svchost.exe
C:\Documents and Settings\Administrator\Desktop\aurelio\HijackThis. exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://intranet....
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyServer = pro60016:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = 10.1*;10.2*;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,,pcssfrrx. exe,C:\SxpInst\sxplog32.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [0FileNET System Manager] C:\Programmi\FileNET\IDM\fnsysmgr.exe
O4 - HKLM\..\Run: [Connector] C:\WINNT\system32\ShellExt\ATX5.EXE -n
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Programmi\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [ShStatEXE] "C:\Programmi\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [SDJobCheck] triggusr.exe
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: OKI LPR Utility.lnk = C:\Programmi\Okidata\OKI LPR Utility\okilpr.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Connector - {FFB51760-344E-4FFB-BFFF-4B18C7AC1D63} - C:\WINNT\system32\ShellExt\ATX5.EXE
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = inail.it
O17 - HKLM\System\CCS\Services\Tcpip\..\{1F06C921-3154-48C3-A3A1-1475C52CDE55}: NameServer = 10.2.22.22,10.1.50.61
O17 - HKLM\System\CCS\Services\Tcpip\..\{310DDD50-D67F-4FEC-AA1F-6299E35F32A6}: NameServer = 10.1.50.61,10.2.22.22
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = inail.it
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = dg.inail.it,inail.it
O17 - HKLM\System\CS1\Services\Tcpip\..\{1F06C921-3154-48C3-A3A1-1475C52CDE55}: NameServer = 10.2.22.22,10.1.50.61
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = inail.it
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = dg.inail.it,inail.it
O17 - HKLM\System\CS2\Services\Tcpip\..\{1F06C921-3154-48C3-A3A1-1475C52CDE55}: NameServer = 10.2.22.22,10.1.50.61
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = ..
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: SearchList = ...
O17 - HKLM\System\CS3\Services\Tcpip\..\{1F06C921-3154-48C3-A3A1-1475C52CDE55}: NameServer = 10.2.22.22,10.1.50.61
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = ...

[amvinfe]

fai una scansione online, gli URLs li trovi in Rilievo -links utili-
Finita la scansione riavvia e posta un nuovo log di HJT