W32, pagina iniziale del browser modificata, log prodotto da HJT

[c_m]

Premetto che sono una "principiante" nell'uso del pc perciò se scrivo qualche cavolata abbiate comprensione. Il problema è questo: la pagina iniziale del browser è redirezionata e si aprono delle pop-up indesiderate. Ho seguito alla lettera la procedura che avete indicato nei thread in rilievo.

1) ho fatto una scansione con Avast aggiornato ad oggi sia in modalità normale che provvisoria. Avast rileva che in C:\WINDOWS\SYSTEM\winnl.exe e C:\WINDOWS\zdjlnn.dat è presente Win 32: Trojano - 1311 [Troj] che non riesce a togliere

2) ho attivato Ad-aware (sia in modalità normale che provvisoria) facendo pulizia di una serie di malware

3) stessa cosa per SpyBot. Dice che non sono state riscontrate minacce immediate però scrive anche questo: Xuron 55 (Datei: C:\WINDOWS\win.ini kann nicht geöffnet werden. Impossibile accedere al file. Il file è utilizzato da un altro processo)

4) con CWShredder tutto bene

Dopo aver fatto tutta questa procedura il problema rimane. Inoltre ad ogni avvio di explorer Avast mi avvisa di W32 in azione (tipo: C:\WINDOWS\APPY W32.exe oppure C:\WINDOWS\SYSTEM\MFCEJ.EXE - ma l'avviso cambia ogni volta).


Il mio sistema operativo è Windows 98.

Posto il log prodotto da HijackThis in modalità normale:

Logfile of HijackThis v1.99.1
Scan saved at 18.32.16, on 29/05/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAMMI\NORTON PERSONAL FIREWALL\NISUM.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAMMI\NORTON PERSONAL FIREWALL\CCPXYSVC.EXE
C:\PROGRAMMI\FILE COMUNI\SYMANTEC SHARED\CCEVTMGR.EXE
C:\WINDOWS\SYSTEM\MDM.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAMMI\NORTON UTILITIES\NPROTECT.EXE
C:\PROGRAMMI\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
C:\WINDOWS\SYSTEM\IPGS32.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SAMSUNG\LASERSMMGR\SSMMGR.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAMMI\FILE COMUNI\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAMMI\ALWIL SOFTWARE\AVAST4\ASHWEBSV.EXE
C:\PROGRAMMI\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAMMI\SYMANTEC\LIVEUPDATE\LUCOMSERVER_2_5.E XE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAMMI\HJTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\vnjsk.dll/sp.html#83556
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\vnjsk.dll/sp.html#83556
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system\vnjsk.dll/sp.html#83556
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\vnjsk.dll/sp.html#83556
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\vnjsk.dll/sp.html#83556
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\vnjsk.dll/sp.html#83556
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\vnjsk.dll/sp.html#83556
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fornito da Alice
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - Default URLSearchHook is missing
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAMMI%5CNETSCAPE%5CNETSCAPE%5Csearchplu gins%5CSBWeb_01.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\f1ys317q.slt\prefs.j s)
O2 - BHO: Class - {B8F28A6B-4308-8C8B-4DAA-1D2763F029F9} - C:\WINDOWS\IPCY.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [Samsung LBP SM] "C:\WINDOWS\Samsung\LaserSMMgr\ssmmgr.exe" /autorun
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [iamapp] C:\Programmi\Norton Personal Firewall\IAMAPP.EXE
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [NPROTECT] C:\Programmi\Norton Utilities\NPROTECT.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Programmi\File comuni\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMON.EXE
O4 - HKLM\..\Run: [IEXPLORE.EXE] C:\PROGRAMMI\INTERNET EXPLORER\IEXPLORE.EXE
O4 - HKLM\..\Run: [avast! Web Scanner] C:\PROGRA~1\ALWILS~1\AVAST4\ASHWEBSV.EXE
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\AVAST4\ashmaisv.exe
O4 - HKLM\..\RunServices: [nisserv] C:\Programmi\Norton Personal Firewall\NISSERV.EXE
O4 - HKLM\..\RunServices: [Nisum] C:\Programmi\Norton Personal Firewall\NISUM.EXE
O4 - HKLM\..\RunServices: [ccPxySvc] C:\PROGRA~1\NORTON~2\CCPXYSVC.EXE
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [Machine Debug Manager] C:\WINDOWS\SYSTEM\MDM.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKLM\..\RunServices: [NPROTECT] C:\Programmi\Norton Utilities\NPROTECT.EXE
O4 - HKLM\..\RunServices: [WINPM.EXE] C:\WINDOWS\WINPM.EXE /s
O4 - HKLM\..\RunServices: [avast!] C:\Programmi\Alwil Software\Avast4\ashServ.exe
O4 - HKLM\..\RunServices: [IPGS32.EXE] C:\WINDOWS\SYSTEM\IPGS32.EXE /s
O4 - Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAMMI\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAMMI\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra button: Alice - {4039CC80-03C5-11D8-9E35-8BCC4B6CCF35} - http://gw.aliceadsl.it/alice (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://gw.aliceadsl.it/home
O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (WebHandler Class) - http://activex.microgaming.com/dlhel...7/dlhelper.cab
O16 - DPF: {DB893839-10F0-4AF9-92FA-B23528F530AF} - http://deposito.hostance.net/dialer/605687.exe
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/ms...downloader.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/026e925e...dxIE601_it.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 151.99.125.1


Grazie per gli eventuali suggerimenti.

[c_m]

ps: non riesco a fare la scansione on line con nessun antivirus da voi indicato. Esce un messaggio di errore da parte di microsoft che chiude e riavvia il browser.

[amvinfe]

Scaricati la nuova versione di AdAware, all'URL trovi l'indirizzo per scaricarlo e settarlo in maniera corretta
http://forum.html.it/forum/showthrea...hreadid=235578

crea una nuova cartella sul desktop e chiamala TDM (ad es.) e metti al suo interno questi due file
http://www.trendmicro.com/ftp/products/tsc/sysclean.com
http://www.trendmicro.com/ftp/produc...ern/lpt649.zip
dezippa, sempre all'interno della stessa cartella il file lpt649.zip;


seguendo le procedure descritte all'interno del tutorial di HijackThis, elimina:
N.B.
il nome della libreria (.dll) presente in questo valore (evidenziata in grassetto) potrebbe essere diversa ad ogni riavvio
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\vnjsk.dll /sp.html#83556



elimina:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\vnjsk.dll/sp.html#83556
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\vnjsk.dll/sp.html#83556
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about :blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system\vnjsk.dll/sp.html#83556
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\vnjsk.dll/sp.html#83556
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\vnjsk.dll/sp.html#83556
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\vnjsk.dll/sp.html#83556
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\vnjsk.dll/sp.html#83556
R3 - Default URLSearchHook is missing
O4 - HKLM\..\RunServices: [WINPM.EXE] C:\WINDOWS\WINPM.EXE /s
O4 - HKLM\..\RunServices: [IPGS32.EXE]C:\WINDOWS\SYSTEM\IPGS32.EXE /s
O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (WebHandler Class) - http://activex.microgaming.com/dlhe...n7/dlhelper.cab
O16 - DPF: {DB893839-10F0-4AF9-92FA-B23528F530AF} - http://deposito.hostance.net/dialer/605687.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/026e925...RdxIE601_it.cab

Riavvia in modalità provvisoria
http://sicurezza.html.it/articoli/ar...i=23&npagina=2

ed elimina:
C:\WINDOWS\system\vnjsk.dll
C:\WINDOWS\WINPM.EXE
C:\WINDOWS\SYSTEM\IPGS32.EXE

sempre dalla modalità provvisoria apri Adaware e fai una scansione, elimina i valori infetti.
Sempre dalla modalità provvisoria apri la cartella che avevi creato TDM e lancia il file sysclean finita la scansione, riavvia e posta un nuovo log di HJT (stampati se puoi queste procedure, lavorerai meglio )

[c_m]

Ho fatto esattamente come mi hai scritto.
Il problema non è risolto ed è rimasta la pagina redirezionata.

Non sono riuscita ad eliminare C:\WINDOWS\WINPM.EXE perchè non l'ho trovato (guardato bene più volte).

Ecco il nuovo log di HJT (modalità normale):

Logfile of HijackThis v1.99.1
Scan saved at 12.54.57, on 31/05/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAMMI\NORTON PERSONAL FIREWALL\NISUM.EXE
C:\PROGRAMMI\NORTON PERSONAL FIREWALL\CCPXYSVC.EXE
C:\PROGRAMMI\FILE COMUNI\SYMANTEC SHARED\CCEVTMGR.EXE
C:\WINDOWS\SYSTEM\MDM.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAMMI\NORTON UTILITIES\NPROTECT.EXE
C:\PROGRAMMI\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SAMSUNG\LASERSMMGR\SSMMGR.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAMMI\FILE COMUNI\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAMMI\ALWIL SOFTWARE\AVAST4\ASHWEBSV.EXE
C:\WINDOWS\MSEP.EXE
C:\PROGRAMMI\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAMMI\HJTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\fjhat.dll/sp.html#83556
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\fjhat.dll/sp.html#83556
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\fjhat.dll/sp.html#83556
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\fjhat.dll/sp.html#83556
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\fjhat.dll/sp.html#83556
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\fjhat.dll/sp.html#83556
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\fjhat.dll/sp.html#83556
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fornito da Alice
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - Default URLSearchHook is missing
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAMMI%5CNETSCAPE%5CNETSCAPE%5Csearchplu gins%5CSBWeb_01.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\f1ys317q.slt\prefs.j s)
O2 - BHO: Class - {B8F28A6B-4308-8C8B-4DAA-1D2763F029F9} - C:\WINDOWS\IPCY.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [Samsung LBP SM] "C:\WINDOWS\Samsung\LaserSMMgr\ssmmgr.exe" /autorun
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [iamapp] C:\Programmi\Norton Personal Firewall\IAMAPP.EXE
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [NPROTECT] C:\Programmi\Norton Utilities\NPROTECT.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Programmi\File comuni\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMON.EXE
O4 - HKLM\..\Run: [IEXPLORE.EXE] C:\PROGRAMMI\INTERNET EXPLORER\IEXPLORE.EXE
O4 - HKLM\..\Run: [avast! Web Scanner] C:\PROGRA~1\ALWILS~1\AVAST4\ASHWEBSV.EXE
O4 - HKLM\..\Run: [MSEP.EXE] C:\WINDOWS\MSEP.EXE
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\AVAST4\ashmaisv.exe
O4 - HKLM\..\RunServices: [nisserv] C:\Programmi\Norton Personal Firewall\NISSERV.EXE
O4 - HKLM\..\RunServices: [Nisum] C:\Programmi\Norton Personal Firewall\NISUM.EXE
O4 - HKLM\..\RunServices: [ccPxySvc] C:\PROGRA~1\NORTON~2\CCPXYSVC.EXE
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [Machine Debug Manager] C:\WINDOWS\SYSTEM\MDM.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKLM\..\RunServices: [NPROTECT] C:\Programmi\Norton Utilities\NPROTECT.EXE
O4 - HKLM\..\RunServices: [avast!] C:\Programmi\Alwil Software\Avast4\ashServ.exe
O4 - Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAMMI\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAMMI\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra button: Alice - {4039CC80-03C5-11D8-9E35-8BCC4B6CCF35} - http://gw.aliceadsl.it/alice (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://gw.aliceadsl.it/home
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/ms...downloader.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 151.99.125.1


*****

Grazie infinite per la disponibilità

[Cinder]

Se dopo la rimozione consigliata da Amvinfe, non hai più effettuato tentativi di rimozione ulteriori e la situazione attuale del tuo pc è quella che si vede nel secondo log, riapri HijackThis ed elimina le seguenti voci:


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\fjhat.dll/sp.html#83556

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\fjhat.dll/sp.html#83556

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about :blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\fjhat.dll/sp.html#83556

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\fjhat.dll/sp.html#83556

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\fjhat.dll/sp.html#83556

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\fjhat.dll/sp.html#83556

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\fjhat.dll/sp.html#83556

R3 - Default URLSearchHook is missing

O2 - BHO: Class - {B8F28A6B-4308-8C8B-4DAA-1D2763F029F9} -C:\WINDOWS\IPCY.DLL

O4 - HKLM\..\Run: [IEXPLORE.EXE] C:\PROGRAMMI\INTERNET EXPLORER\IEXPLORE.EXE

O4 - HKLM\..\Run: [MSEP.EXE] C:\WINDOWS\MSEP.EXE


Riavvia subito in mod. provvisoria vai su start - impostazioni -pannello di controllo- opzioni cartella, clicca sulla scheda visualizzazione- metti la spunta alla voce visualizza cartelle e file nascosti e conferma con OK.

Cerca ed elimina i seguenti file, tutti presenti nella cartella Windows e segnati la loro data di creazione

IPCY.DLL ( da eliminare assolutamente )
fjhat.dll
MSEP.EXE

Elimina i file temporanei, vai nella cartella TEMP che si trova in C:\WINDOWS ed elimina eventuali file che hanno la stessa data di creazione di IPCY.DLL ecc.

Riavvia in modalità normale, prova a reimpostare la home di explorer e posta un altro log.

[amvinfe]

[OT]ti si vede di rado ormai Cinder, ma leggerti è sempre un piacere [/OT]


segui i consigli di Cinder, esegui per favore un'ulteriore scansione con Sysclean e copia qui il log

[Habanero]

Originariamente inviato da amvinfe
[OT]ti si vede di rado ormai Cinder, ma leggerti è sempre un piacere [/OT]

[OT]
Decisamente mi associo.
Ciao Cinder.
[/OT]

[Cinder]

[ot] era un pò di tempo che non mi cimentavo coi log . Spiace solo vedere che gli utenti che vengono quì ancora non hanno capito quanto sia fondamentale per loro stessi ed i loro pc leggersi sto benedetto primo link in rilievo

Chi viene su questo forum può davvero ritenersi fortunato che ci siano due persone come voi, qualificate e sempre disponibili, ma sono davvero pochissimi quelli che vi permettono di operare al meglio soprattutto per quanto riguarda l'uso di HijackThis.

Un salutone a te e al grande Haba
[/ot]

[c_m]

Purtroppo il problema rimane.
Non ho potuto eliminare dalla cartella Windows il file IPCY.DLL (messaggio di errore: impossibile eliminarlo perchè usato da Windows).

Ecco il nuovo log di HJT:

Logfile of HijackThis v1.99.1
Scan saved at 23.47.04, on 01/06/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAMMI\NORTON PERSONAL FIREWALL\NISUM.EXE
C:\PROGRAMMI\NORTON PERSONAL FIREWALL\CCPXYSVC.EXE
C:\PROGRAMMI\FILE COMUNI\SYMANTEC SHARED\CCEVTMGR.EXE
C:\WINDOWS\SYSTEM\MDM.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAMMI\NORTON UTILITIES\NPROTECT.EXE
C:\PROGRAMMI\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
C:\WINDOWS\APIAL.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SAMSUNG\LASERSMMGR\SSMMGR.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAMMI\FILE COMUNI\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAMMI\ALWIL SOFTWARE\AVAST4\ASHWEBSV.EXE
C:\PROGRAMMI\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAMMI\HJTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\xzdgt.dll/sp.html#83556
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\xzdgt.dll/sp.html#83556
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\xzdgt.dll/sp.html#83556
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\xzdgt.dll/sp.html#83556
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\xzdgt.dll/sp.html#83556
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\xzdgt.dll/sp.html#83556
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\xzdgt.dll/sp.html#83556
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fornito da Alice
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - Default URLSearchHook is missing
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAMMI%5CNETSCAPE%5CNETSCAPE%5Csearchplu gins%5CSBWeb_01.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\f1ys317q.slt\prefs.j s)
O2 - BHO: Class - {B8F28A6B-4308-8C8B-4DAA-1D2763F029F9} - C:\WINDOWS\IPCY.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [Samsung LBP SM] "C:\WINDOWS\Samsung\LaserSMMgr\ssmmgr.exe" /autorun
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [iamapp] C:\Programmi\Norton Personal Firewall\IAMAPP.EXE
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [NPROTECT] C:\Programmi\Norton Utilities\NPROTECT.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Programmi\File comuni\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMON.EXE
O4 - HKLM\..\Run: [avast! Web Scanner] C:\PROGRA~1\ALWILS~1\AVAST4\ASHWEBSV.EXE
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\AVAST4\ashmaisv.exe
O4 - HKLM\..\RunServices: [nisserv] C:\Programmi\Norton Personal Firewall\NISSERV.EXE
O4 - HKLM\..\RunServices: [Nisum] C:\Programmi\Norton Personal Firewall\NISUM.EXE
O4 - HKLM\..\RunServices: [ccPxySvc] C:\PROGRA~1\NORTON~2\CCPXYSVC.EXE
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [Machine Debug Manager] C:\WINDOWS\SYSTEM\MDM.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKLM\..\RunServices: [NPROTECT] C:\Programmi\Norton Utilities\NPROTECT.EXE
O4 - HKLM\..\RunServices: [avast!] C:\Programmi\Alwil Software\Avast4\ashServ.exe
O4 - HKLM\..\RunServices: [APIAL.EXE] C:\WINDOWS\APIAL.EXE /s
O4 - Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAMMI\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAMMI\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra button: Alice - {4039CC80-03C5-11D8-9E35-8BCC4B6CCF35} - http://gw.aliceadsl.it/alice (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://gw.aliceadsl.it/home
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/ms...downloader.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 151.99.125.1


E questo è il log di Sysclean:

2005-05-31, 11:26:34, Auto-clean mode specified.
2005-05-31, 11:26:34, Running scanner "C:\WINDOWS\DESKTOP\TDM\TSC.BIN"...
2005-05-31, 11:27:23, Scanner "C:\WINDOWS\DESKTOP\TDM\TSC.BIN" has finished running.
2005-05-31, 11:27:23, TSC Log:

Damage Cleanup Engine (DCE) 3.9(Build 1020)
Windows 98

Start time : mar mag 31 2005 11:26:40

Load Damage Cleanup Template (DCT) "C:\WINDOWS\DESKTOP\TDM\tsc.ptn" (version 602) [success]

Complete time : mar mag 31 2005 11:27:23
Execute pattern count(3669), Virus found count(0), Virus clean count(0), Clean failed count(0)

2005-05-31, 11:27:44, An error occurred while scanning file "C:\WINDOWS\WIN386.SWP": Accesso negato.
2005-05-31, 12:03:44, Running scanner "C:\WINDOWS\DESKTOP\TDM\VSCANTM.BIN"...
2005-05-31, 12:39:20, Files Detected:
Copyright (c) 1990 - 2004 Trend Micro Inc.
Report Date : 5/31/2005 12:05:03
VSAPI Engine Version : 7.000-1004
VSCANTM Version : 1.1-1001
Virus Pattern Version : 649 (102549 Patterns) (2005/05/29) (264900)
Command Line: C:\WINDOWS\DESKTOP\TDM\VSCANTM.BIN /NBPM /S /CLEANALL /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.* /P=C:\WINDOWS\DESKTOP\TDM

84055 files have been read.
84055 files have been checked.
49124 files have been scanned.
141153 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At : 5/31/2005 12:39:19
---------*---------*---------*---------*---------*---------*---------*---------*
2005-05-31, 12:39:20, Files Clean:
Copyright (c) 1990 - 2004 Trend Micro Inc.
Report Date : 5/31/2005 12:05:03
VSAPI Engine Version : 7.000-1004
VSCANTM Version : 1.1-1001
Virus Pattern Version : 649 (102549 Patterns) (2005/05/29) (264900)
Command Line: C:\WINDOWS\DESKTOP\TDM\VSCANTM.BIN /NBPM /S /CLEANALL /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.* /P=C:\WINDOWS\DESKTOP\TDM

84055 files have been read.
84055 files have been checked.
49124 files have been scanned.
141153 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At : 5/31/2005 12:39:19 34 minutes 8 seconds (2047.35 seconds) has elapsed.

---------*---------*---------*---------*---------*---------*---------*---------*
2005-05-31, 12:39:20, Clean Fail:
Copyright (c) 1990 - 2004 Trend Micro Inc.
Report Date : 5/31/2005 12:05:03
VSAPI Engine Version : 7.000-1004
VSCANTM Version : 1.1-1001
Virus Pattern Version : 649 (102549 Patterns) (2005/05/29) (264900)
Command Line: C:\WINDOWS\DESKTOP\TDM\VSCANTM.BIN /NBPM /S /CLEANALL /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.* /P=C:\WINDOWS\DESKTOP\TDM

84055 files have been read.
84055 files have been checked.
49124 files have been scanned.
141153 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At : 5/31/2005 12:39:19 34 minutes 8 seconds (2047.35 seconds) has elapsed.

---------*---------*---------*---------*---------*---------*---------*---------*
2005-05-31, 12:39:20, Scanner "C:\WINDOWS\DESKTOP\TDM\VSCANTM.BIN" has finished running.


/--------------------------------------------------------------\
| Trend Micro Sysclean Package |
| Copyright 2002, Trend Micro, Inc. |
| http://www.trendmicro.com |
\--------------------------------------------------------------/


2005-06-01, 22:23:50, Auto-clean mode specified.
2005-06-01, 22:23:50, Running scanner "C:\WINDOWS\DESKTOP\TDM\TSC.BIN"...
2005-06-01, 22:24:39, Scanner "C:\WINDOWS\DESKTOP\TDM\TSC.BIN" has finished running.
2005-06-01, 22:24:39, TSC Log:

Damage Cleanup Engine (DCE) 3.9(Build 1020)
Windows 98

Start time : mer giu 01 2005 22:23:54

Load Damage Cleanup Template (DCT) "C:\WINDOWS\DESKTOP\TDM\tsc.ptn" (version 602) [success]

Complete time : mer giu 01 2005 22:24:39
Execute pattern count(3669), Virus found count(0), Virus clean count(0), Clean failed count(0)

2005-06-01, 22:24:59, An error occurred while scanning file "C:\WINDOWS\WIN386.SWP": Accesso negato.
2005-06-01, 23:02:00, Running scanner "C:\WINDOWS\DESKTOP\TDM\VSCANTM.BIN"...
2005-06-01, 23:36:16, Files Detected:
Copyright (c) 1990 - 2004 Trend Micro Inc.
Report Date : 6/1/2005 23:02:11
VSAPI Engine Version : 7.000-1004
VSCANTM Version : 1.1-1001
Virus Pattern Version : 649 (102549 Patterns) (2005/05/29) (264900)
Command Line: C:\WINDOWS\DESKTOP\TDM\VSCANTM.BIN /NBPM /S /CLEANALL /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.* /P=C:\WINDOWS\DESKTOP\TDM

84141 files have been read.
84141 files have been checked.
49137 files have been scanned.
141166 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At : 6/1/2005 23:36:14
---------*---------*---------*---------*---------*---------*---------*---------*
2005-06-01, 23:36:16, Files Clean:
Copyright (c) 1990 - 2004 Trend Micro Inc.
Report Date : 6/1/2005 23:02:10
VSAPI Engine Version : 7.000-1004
VSCANTM Version : 1.1-1001
Virus Pattern Version : 649 (102549 Patterns) (2005/05/29) (264900)
Command Line: C:\WINDOWS\DESKTOP\TDM\VSCANTM.BIN /NBPM /S /CLEANALL /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.* /P=C:\WINDOWS\DESKTOP\TDM

84141 files have been read.
84141 files have been checked.
49137 files have been scanned.
141166 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At : 6/1/2005 23:36:14 33 minutes 56 seconds (2035.54 seconds) has elapsed.

---------*---------*---------*---------*---------*---------*---------*---------*
2005-06-01, 23:36:16, Clean Fail:
Copyright (c) 1990 - 2004 Trend Micro Inc.
Report Date : 6/1/2005 23:02:10
VSAPI Engine Version : 7.000-1004
VSCANTM Version : 1.1-1001
Virus Pattern Version : 649 (102549 Patterns) (2005/05/29) (264900)
Command Line: C:\WINDOWS\DESKTOP\TDM\VSCANTM.BIN /NBPM /S /CLEANALL /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.* /P=C:\WINDOWS\DESKTOP\TDM

84141 files have been read.
84141 files have been checked.
49137 files have been scanned.
141166 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At : 6/1/2005 23:36:14 33 minutes 56 seconds (2035.54 seconds) has elapsed.

---------*---------*---------*---------*---------*---------*---------*---------*
2005-06-01, 23:36:16, Scanner "C:\WINDOWS\DESKTOP\TDM\VSCANTM.BIN" has finished running.


***************

Davvero grazie per il vostro aiuto

[amvinfe]

Se la .dll non riesci ad eliminarla neanche dalla modalità provvisoria, allora scarica questo programma e dezippa il file all'interno di una nuova cartella
http://www.downloads.subratam.org/KillBox.zip


crea una seconda cartella sempre sul desktop e metti al suo interno questo file
http://www.trojaner-info.de/cgi-bin/...ile=sphjfix109

ora scaricati la nuova versione di AdAware e la nuova di SpyBot, ricordati di disinstallare prima le vecchie versioni, elimina anche le cartelle a loro associate in C:\Programmi
http://forum.html.it/forum/showthrea...hreadid=235578

aggiorna entrambi i programmi (!!!)


ora alcuni consigli:
- ricordati di effettuare TUTTE le procedure di rimozione (scansione e rimozione) non connessa (!!!) e con il browser chiuso
- ti consiglio, per lavorare meglio, di stamparti, se puoi, le procedure di rimozione
- prima di effettuare ogni tipo di rimozione devi rendere i file nascosti visibili, procedi come segue:
-.- apri una qualsiasi cartella, clicca in alto su Visualizza>Opzioni cartella>Visualizza>>>metti la spunta su "Mostra tutti i file">>>clicca in basso su "Applica">>>OK.
- ora il problema è quello di individuare il nome esatto della .dll collegata ai valori R1 e R0 di HijackThis, nel tuo ultimo log la .dll da eliminare è
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\xzdgt.dll /sp.html#83556
il problema è che ad ogni riavvio o ad ogni tentativo di rimozione il nome cambia se la stessa rimozione non ha avuto esito positivo.
Quindi fai il log con HijackThis, segnati il nome della .dll (!!!) e procedi come segue:


-1
finita la scansione con HijackThis e dopo esserti scritta il nome della .dll metti la spunta al fianco dei valori, assicurati che HijackThis sia l'unico programma aperto, anche il browser dev'essere chiuso, clicca su "Fix checked"

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\xzdgt.dll/sp.html#83556
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\xzdgt.dll/sp.html#83556
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about :blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\xzdgt.dll/sp.html#83556
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\xzdgt.dll/sp.html#83556
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\xzdgt.dll/sp.html#83556
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\xzdgt.dll/sp.html#83556
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\xzdgt.dll/sp.html#83556
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {B8F28A6B-4308-8C8B-4DAA-1D2763F029F9} - C:\WINDOWS\IPCY.DLL
O4 - HKLM\..\RunServices: [APIAL.EXE] C:\WINDOWS\APIAL.EXE /s

-2
apri la cartella con all'interno il file KillBox ed apri il programma
metti la spunta al fianco della voce "Delete on Reboot"
clicca sulla cartellina gialla e cerca uno alla volta e seguendo il proprio percorso i file che elencherò più sotto.
Dopo ogni ricerca clicca su OK, alfianco della cartellina gialla verrà visualizzato il percorso del file, appena più sotto il nome del file verrà visualizzato con una scritta blu, dopo ogni ricerca devi cliccare sul bottone con sfondo rosso e X bianca, verifica che vi sia SEMPRE spuntata l'opzione "Delete on Reboot"

C:\WINDOWS\xzdgt.dll >>ricordati che il nome di questa .dll potrebbe non essere uguale
C:\WINDOWS\IPCY.DLL
C:\WINDOWS\APIAL.EXE >>anche questo potrebbe non essere uguale

-3
Riavvia in modalità provvisoria è importante che tu lo faccia fin dal primo tentativo, diversamente i valori appena eliminati verrebbero ricreati

-4
dalla modalità provvisoria apri il file presente nell'altra cartella apri il file e clicca su "Desinfektion starten"

-5
apri AdAware ed effettua una scansione del disco, rimuovi i valori infetti

-6
apri SpyBot ed effettua una scansione del disco, rimuovi i valori infetti

-7
riavvia in modalità normale, effettua una nuova scansione con HJT e posta il log

-8
rendi nuovamente i file nascosti, "Applica">>>OK