Pc estremamente lento [era:Mi serve aiuto grazie]

[d9t71]

Salve a tutti , mi serve il vostro aiuto, ho il pc con l'influenza.
Il mio sistema opertivo e'w.xp
i sintomi sono : allungamento tempi di caricamento, una volta caricato , l'apertura di qualsiasi programma e' lentissima.
il mio ant.vir e' avg sempre aggiornato, e non ha rilevato niente

ho utilizzato HijackThis ed ecco che cosa e' uscito

Logfile of HijackThis v1.99.1
Scan saved at 17.32.26, on 29/01/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\SERVICES.EXE
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\SERVICES.EXE
E:\Documents and Settings\Administrator\Desktop\StartupCPL.exe
E:\Documents and Settings\Administrator\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tiscali.it
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.tiscali.it
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
F2 - REG:system.ini: UserInit=E:\WINDOWS\system32\userinit.exe,E:\WINDO WS\SERVICES.EXE
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SunJavaUpdateSched] E:\Programmi\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [NeroCheck] E:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] "E:\Programmi\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "E:\Programmi\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [AVG7_CC] E:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [MSMSGS] "E:\Programmi\Messenger\msmsgs.exe" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = E:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = E:\Programmi\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://E:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Programmi\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Programmi\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Programmi\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Programmi\Messenger\MSMSGS.EXE
O12 - Plugin for .mov: E:\Programmi\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .png: E:\Programmi\Internet Explorer\PLUGINS\npqtplugin5.dll
O12 - Plugin for .tif: E:\Programmi\Internet Explorer\PLUGINS\npqtplugin6.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{EAFF67B6-2CF3-484C-9BF9-444C882FBBB9}: NameServer = 195.130.224.18 195.130.225.129
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "E:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - E:\WINDOWS\System32\HPZipm12.exe



Poi ho utilizzato xsoft spy
e dopo aver eliminato tutto il malus che c'era, e' rimasto un trojan di nome prorat presente in windos col nome di SERVICE.EXE e non sono riuscito ad eliminarlo
Il pc e sempre lentissimo
Grazie

[thomas_anderson]

C:\WINDOWS\services.exe infected by "Backdoor.Win32.Prorat.19.k" Virus.

Parti dalla provvisoria. Apri il task manager e cerca il processo e:\windows\serices.exe e terminalo(i). metti hijackthis in una cartella in c: lancia la scansione ed elimina tutte le voci relative solo a e:\windows\services.exe. Svuota i file temporanei, il cestino, i cookie, ed i file temporanei di internet.

http://www.sophos.com/virusinfo/anal...ojproratp.html

[Matteo982]

Visto che più o meno siamo in tema, il processo services.exe a cosa serve?? :master:

Ciao.

[LUCASS]

Originariamente inviato da Matteo982
il processo services.exe a cosa serve?? :master:

Process File: services or services.exe
Process Name: Windows Service Controller

Description:
services.exe is a part of the Microsoft Windows Operating System and manages the operation of starting and stopping services. This process also deals with the automatic starting of services during the computers boot-up and the stopping of servicse during shut-down. This program is important for the stable and secure running of your computer and should not be terminated.

Note: services.exe is also a process which is registered as the W32.Randex.R (stored in %systemroot%\system32\ directory) and Sober.P (stored in %systemroot%\Connection Wizard\Status\ directory) and Sober.S/V (Executed from the %Windir%\ConnectionStatus\Microsoft\services.exe directory) Trojans. These Trojans allow attackers to access your computer, stealing passwords and personal data. It is a registered security risk and should be removed immediately.

www.google.it

[Matteo982]

Grazie!

Ciao.

[d9t71]

Ho fatto tutto quello che mi hai consigliato thomas_anderson ma non e' cambiato nulla, il pc e' sempre molto lento.
Ho riaviato HijackThis e SERVICE.exe non c'e' piu'
Logfile of HijackThis v1.99.1
Scan saved at 12.41.13, on 30/01/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\Explorer.EXE
E:\Programmi\Grisoft\AVG Free\avgcc.exe
E:\Programmi\Grisoft\AVG Free\avgwb.dat
E:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tiscali.it
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.tiscali.it
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SunJavaUpdateSched] E:\Programmi\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [NeroCheck] E:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] "E:\Programmi\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "E:\Programmi\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [AVG7_CC] E:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [MSMSGS] "E:\Programmi\Messenger\msmsgs.exe" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = E:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = E:\Programmi\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://E:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Programmi\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Programmi\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Programmi\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Programmi\Messenger\MSMSGS.EXE
O12 - Plugin for .mov: E:\Programmi\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .png: E:\Programmi\Internet Explorer\PLUGINS\npqtplugin5.dll
O12 - Plugin for .tif: E:\Programmi\Internet Explorer\PLUGINS\npqtplugin6.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{EAFF67B6-2CF3-484C-9BF9-444C882FBBB9}: NameServer = 195.130.224.18 195.130.225.129
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "E:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - E:\WINDOWS\System32\HPZipm12.exe

[thomas_anderson]

Svuota i file temporanei, il cestino, ed i cookies. Digita msconfig su Esegui e poi vai su Avvio. controlla se ci sono programmi di cui puoi fare a meno all'avvio e togli la spunta dalle loro voci. Scarica Regseeker e fai una pulizia completa del registro (lo trovi con Google. prima però fai sempre il backup del registro come consigliato da Regseeker). Poi deframmenta il disco tramite l'apposita utilità di sistema. fammi sapere.

[d9t71]

Ho fatto tutto (in mod. prov.), ma non ho risolto nulla
Mi e' capitato altrevolte ed avevo risolto con una ptch o con un tool.
Ma non capisco neanche quale' il virus.

e ora che faccio

[thomas_anderson]

Il log è pulito. Non è più una questione di malware. Quali sono le specifiche tecniche del tuo pc? (memoria, processore, spazio su disco ecc)

[Habanero]

in ogni caso un bel windowsupdate non farebbe male visto che il tuo IE non è aggiornato.