Olimpo Informatico

[barbez]

ho il computer che si blocca ho fatto una scansione con hi questo è il risultato... per qualsiasi parere ringrazio:-)

Logfile of HijackThis v1.99.1
Scan saved at 11.52.29, on 24/07/06
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:/WINDOWS/SYSTEM/KERNEL32.DLL
C:/WINDOWS/SYSTEM/MSGSRV32.EXE
C:/WINDOWS/SYSTEM/MPREXE.EXE
C:/PROGRAMMI/CA/ETRUST ANTIVIRUS/INOTASK.EXE
C:/PROGRAMMI/CA/ETRUST ANTIVIRUS/INORT9X.EXE
C:/PROGRAMMI/CA/ETRUST ANTIVIRUS/INORPC.EXE
C:/PROGRAMMI/REALVNC/VNC4/WINVNC4.EXE
C:/WINDOWS/EXPLORER.EXE
C:/WINDOWS/TASKMON.EXE
C:/PROGRAMMI/CA/ETRUST ANTIVIRUS/REALMON.EXE
C:/WINDOWS/LOADQM.EXE
C:/WINDOWS/SYSTEM/QTTASK.EXE
C:/PROGRAMMI/FILE COMUNI/REAL/UPDATE_OB/REALSCHED.EXE
C:/PROGRAMMI/MICROSOFT OFFICE/OFFICE/OSA.EXE
C:/PROGRAMMI/MICROSOFT OFFICE/OFFICE/FINDFAST.EXE
C:/WINDOWS/SYSTEM/SPOOL32.EXE
C:/WINDOWS/SYSTEM/PSTORES.EXE
C:/WINDOWS/SYSTEM/DDHELP.EXE
C:/PROGRAMMI/INTERNET EXPLORER/IEXPLORE.EXE
C:/WINDOWS/DESKTOP/VARIE ED EVENTUALI/HIJACKTHIS.EXE

R0 - HKCU/Software/Microsoft/Internet Explorer/Main,Start Page = http://www.supereva.it/
R1 - HKCU/Software/Microsoft/Windows/CurrentVersion/Internet Settings,ProxyServer = proxyc:3128
R1 - HKCU/Software/Microsoft/Windows/CurrentVersion/Internet Settings,ProxyOverride = gastserv*;<local>
R0 - HKCU/Software/Microsoft/Internet Explorer/Toolbar,LinksFolderName = Collegamenti
N3 - Netscape 7: user_pref(browser.startup.homepage, http://gastservc/index2.htm); (C:/WINDOWS/Application Data/Mozilla/Profiles/default/1v8812cu.slt/prefs.js)
N3 - Netscape 7: user_pref(browser.search.defaultengine, engine://C%3A%5CPROGRAMMI%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_01.src); (C:/WINDOWS/Application Data/Mozilla/Profiles/default/1v8812cu.slt/prefs.js)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:/PROGRAMMI/YAHOO!/COMPANION/INSTALLS/CPN/YT.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:/programmi/google/googletoolbar1.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:/PROGRA~1/SPYBOT~1/SDHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:/WINDOWS/SYSTEM/MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:/programmi/google/googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:/PROGRAMMI/YAHOO!/COMPANION/INSTALLS/CPN/YT.DLL
O4 - HKLM/../Run: [TaskMonitor] C:/Windows/taskmon.exe
O4 - HKLM/../Run: [Realtime Monitor] C:/PROGRA~1/CA/ETRUST~1/REALMON.EXE -s
O4 - HKLM/../Run: [LanguageMonitor] Oplmsb00.exe %Printer%
O4 - HKLM/../Run: [PicasaNet] C:/_ad awere/Hello/Hello.exe -b
O4 - HKLM/../Run: [LoadQM] loadqm.exe
O4 - HKLM/../Run: [QuickTime Task] C:/WINDOWS/SYSTEM/QTTASK.EXE -atboottime
O4 - HKLM/../Run: [TkBellExe] C:/Programmi/File comuni/Real/Update_OB/realsched.exe -osboot
O4 - HKLM/../Run: [OBHF1.EXE] C:/WINDOWS/TEMP/OBHF1.EXE
O4 - HKLM/../RunServices: [InoTask] C:/Programmi/CA/eTrust Antivirus/InoTask.exe
O4 - HKLM/../RunServices: [InoRT] C:/Programmi/CA/eTrust Antivirus/InoRT9x.exe
O4 - HKLM/../RunServices: [InoRPC] C:/Programmi/CA/eTrust Antivirus/InoRpc.exe
O4 - HKLM/../RunServices: [WinVNC4] C:/PROGRAMMI/REALVNC/VNC4/WINVNC4.EXE -noconsole -service
O4 - HKCU/../Run: [Malware Sweeper] C:/PROGRAMMI/MALWARESWEEPER.COM/MALWARE SWEEPER/MALSWEP.exe /STARTUP
O4 - Startup: Avvio Office.lnk = C:/Programmi/Microsoft Office/Office/OSA.EXE
O4 - Startup: Ricerca rapida.lnk = C:/Programmi/Microsoft Office/Office/FINDFAST.EXE
O8 - Extra context menu item: &Cerca con Google - res://C:/PROGRAMMI/GOOGLE/GOOGLETOOLBAR1.DLL/cmsearch.html
O8 - Extra context menu item: &Traduci parola in italiano - res://C:/PROGRAMMI/GOOGLE/GOOGLETOOLBAR1.DLL/cmwordtrans.html
O8 - Extra context menu item: Versione cache della pagina - res://C:/PROGRAMMI/GOOGLE/GOOGLETOOLBAR1.DLL/cmcache.html
O8 - Extra context menu item: Pagine simili - res://C:/PROGRAMMI/GOOGLE/GOOGLETOOLBAR1.DLL/cmsimilar.html
O8 - Extra context menu item: Link a ritroso - res://C:/PROGRAMMI/GOOGLE/GOOGLETOOLBAR1.DLL/cmbacklinks.html
O16 - DPF: {31DDC1FD-CEA3-4837-A6DC-87E67015ADC9} - http://akamai.downloadv3.com/binaries/IA/svcsysnet32_EN.cab
O16 - DPF: {6BEA1C48-1850-486C-8F58-C7354BA3165E} (Install Class) - http://updates.lifescapeinc.com/installers/pinstall/pinstall.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/225100afde2c79bf9b05/netzip/RdxIE601_it.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_ansi.cab
O17 - HKLM/System/CCS/Services/VxD/MSTCP: Domain = gastaldi.it
O17 - HKLM/System/CCS/Services/VxD/MSTCP: NameServer = 192.168.40.12,192.168.40.9

[holifay]

Ciao e benvenuto

scarica questo programma
http://www.merijn.org/files/bfu.zip
Decomprimi l´archivio in C (Creati una nuova cartella)

Avvia il programma e clicca su questa icona
Nella casella che si apre,copia e incolla questo link
Clicca su OK e poi sul pulsante Execute
Attendi la finestra Completed script execution e clicca OK

Riavvia il pc e posta un nuovo log di HijackThis

[barbez]

grazie della tua celere risposta

ecco quello che mi risulta dopo che ho fatto ciò che mi hai detto:

Logfile of HijackThis v1.99.1
Scan saved at 16.55.02, on 24/07/06
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAMMI\CA\ETRUST ANTIVIRUS\INOTASK.EXE
C:\PROGRAMMI\CA\ETRUST ANTIVIRUS\INORT9X.EXE
C:\PROGRAMMI\CA\ETRUST ANTIVIRUS\INORPC.EXE
C:\PROGRAMMI\REALVNC\VNC4\WINVNC4.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\PROGRAMMI\CA\ETRUST ANTIVIRUS\REALMON.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAMMI\FILE COMUNI\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAMMI\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\PROGRAMMI\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE
C:\WINDOWS\DESKTOP\VARIE ED EVENTUALI\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.supereva.it/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxyc:3128
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = gastserv*;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://gastservc/index2.htm"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\1v8812cu.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAMMI%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_01.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\1v8812cu.slt\prefs.js)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRAMMI\YAHOO!\COMPANION\INSTALLS\CPN\YT.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar1.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAMMI\YAHOO!\COMPANION\INSTALLS\CPN\YT.DLL
O4 - HKLM\..\Run: [TaskMonitor] C:\Windows\taskmon.exe
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\REALMON.EXE -s
O4 - HKLM\..\Run: [LanguageMonitor] Oplmsb00.exe %Printer%
O4 - HKLM\..\Run: [PicasaNet] "C:\_ad awere\Hello\Hello.exe" -b
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [OBHF1.EXE] C:\WINDOWS\TEMP\OBHF1.EXE
O4 - HKLM\..\RunServices: [InoTask] C:\Programmi\CA\eTrust Antivirus\InoTask.exe
O4 - HKLM\..\RunServices: [InoRT] C:\Programmi\CA\eTrust Antivirus\InoRT9x.exe
O4 - HKLM\..\RunServices: [InoRPC] C:\Programmi\CA\eTrust Antivirus\InoRpc.exe
O4 - HKLM\..\RunServices: [WinVNC4] "C:\PROGRAMMI\REALVNC\VNC4\WINVNC4.EXE" -noconsole -service
O4 - HKCU\..\Run: [Malware Sweeper] C:\PROGRAMMI\MALWARESWEEPER.COM\MALWARE SWEEPER\MALSWEP.exe /STARTUP
O4 - Startup: Avvio Office.lnk = C:\Programmi\Microsoft Office\Office\OSA.EXE
O4 - Startup: Ricerca rapida.lnk = C:\Programmi\Microsoft Office\Office\FINDFAST.EXE
O8 - Extra context menu item: &Cerca con Google - res://C:\PROGRAMMI\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html
O8 - Extra context menu item: &Traduci parola in italiano - res://C:\PROGRAMMI\GOOGLE\GOOGLETOOLBAR1.DLL/cmwordtrans.html
O8 - Extra context menu item: Versione cache della pagina - res://C:\PROGRAMMI\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html
O8 - Extra context menu item: Pagine simili - res://C:\PROGRAMMI\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html
O8 - Extra context menu item: Link a ritroso - res://C:\PROGRAMMI\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html
O16 - DPF: {6BEA1C48-1850-486C-8F58-C7354BA3165E} (Install Class) - http://updates.lifescapeinc.com/installers/pinstall/pinstall.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/225100afde2c79bf9b05/netzip/RdxIE601_it.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_ansi.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = gastaldi.it
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 192.168.40.12,192.168.40.9

[holifay]

Elimina con HijackThis questa voce:

[barbez]

allora ho fatto come mi hai detto ma quel file non l'ho trovato anche rendendo fisibili tutti i file
panda ha trovato:

Incidente Stato Percorso

Virus:W32/Zafi.B.worm Disinfettato C:\WINDOWS\SYSTEM\ibsfhfzk.exe
Virus:W32/Zafi.B.worm Disinfettato C:\WINDOWS\SYSTEM\dpgcskgy.dll
Adware:Adware/IST.ISTBar Non Disinfettato C:\WINDOWS\SYSTEM\aqaa.dll
Virus:Trj/Mitglieder.FK Disinfettato C:\WINDOWS\Application Data\Mozilla\Profiles\default\1v8812cu.slt\Mail\mboxnord\Inbox[sms_text.zip][t_535475.exe]
Virus:Trj/Mitglieder.GB Disinfettato C:\WINDOWS\Application Data\Mozilla\Profiles\default\1v8812cu.slt\Mail\mboxnord\Inbox[James.zip][12.exe]
Virus:Trj/Mitglieder.GK Disinfettato C:\WINDOWS\Application Data\Mozilla\Profiles\default\1v8812cu.slt\Mail\mboxnord\Inbox[Edward.zip][S3700020.exe]
Virus:W32/Tearec.A.worm!CME-24 Disinfettato C:\WINDOWS\Application Data\Mozilla\Profiles\default\1v8812cu.slt\Mail\mboxnord\Inbox[Attachments001.BHX][Atta[001],zip .SCR]
Virus:W32/Tearec.A.worm!CME-24 Disinfettato C:\WINDOWS\Application Data\Mozilla\Profiles\default\1v8812cu.slt\Mail\mboxnord\Inbox[Original Message.B64][ATT01.zip .sCR]
Virus:W32/Tearec.A.worm!CME-24 Disinfettato C:\WINDOWS\Application Data\Mozilla\Profiles\default\1v8812cu.slt\Mail\mboxnord\Inbox[Video_part.mim][New Video,zip .sCr]
Virus:Trj/Mitglieder.FK Disinfettato C:\WINDOWS\Application Data\Mozilla\Profiles\default\1v8812cu.slt\Mail\mboxnord\Trash[sms_text.zip][t_535475.exe]
Virus:Trj/Mitglieder.GB Disinfettato C:\WINDOWS\Application Data\Mozilla\Profiles\default\1v8812cu.slt\Mail\mboxnord\Trash[James.zip][12.exe]
Virus:Trj/Mitglieder.GK Disinfettato C:\WINDOWS\Application Data\Mozilla\Profiles\default\1v8812cu.slt\Mail\mboxnord\Trash[Edward.zip][S3700020.exe]
Virus:W32/Tearec.A.worm!CME-24 Disinfettato C:\WINDOWS\Application Data\Mozilla\Profiles\default\1v8812cu.slt\Mail\mboxnord\Trash[Attachments001.BHX][Atta[001],zip .SCR]
Virus:W32/Tearec.A.worm!CME-24 Disinfettato C:\WINDOWS\Application Data\Mozilla\Profiles\default\1v8812cu.slt\Mail\mboxnord\Trash[Original Message.B64][ATT01.zip .sCR]
Virus:W32/Tearec.A.worm!CME-24 Disinfettato C:\WINDOWS\Application Data\Mozilla\Profiles\default\1v8812cu.slt\Mail\mboxnord\Trash[Video_part.mim][New Video,zip .sCr]
Virus:Trj/Lowzones.BV Disinfettato C:\WINDOWS\Application Data\sgrunt\disinstalla.htm
Dialer:Dialer.Gen Non Disinfettato C:\WINDOWS\Downloaded Program Files\CONFLICT.1\605691.exe
Dialer:Dialer.ANA Non Disinfettato C:\WINDOWS\Downloaded Program Files\CONFLICT.1\wlatip4x.exe
Dialer:Dialer.AON Non Disinfettato C:\WINDOWS\Downloaded Program Files\CONFLICT.1\gsa0956.exe
Dialer:Dialer.ECU Non Disinfettato C:\WINDOWS\Downloaded Program Files\CONFLICT.1\video.exe
Dialer:Dialer.BKV Non Disinfettato C:\WINDOWS\Downloaded Program Files\CONFLICT.1\emoticon2.exe
Dialer:Dialer.BNC Non Disinfettato C:\WINDOWS\Downloaded Program Files\CONFLICT.1\myhomepage.exe
Dialer:Dialer.MIN Non Disinfettato C:\WINDOWS\Downloaded Program Files\CONFLICT.1\1004966.exe
Dialer:Dialer.Gen Non Disinfettato C:\WINDOWS\Downloaded Program Files\605691.exe
Dialer:Dialer.Gen Non Disinfettato C:\WINDOWS\Downloaded Program Files\CONFLICT.2\605691.exe
Dialer:Dialer.BKV Non Disinfettato C:\WINDOWS\Downloaded Program Files\CONFLICT.2\emoticon2.exe
Dialer:Dialer.ECA Non Disinfettato C:\WINDOWS\Downloaded Program Files\CONFLICT.2\video.exe
Dialer:Dialer.Gen Non Disinfettato C:\WINDOWS\Downloaded Program Files\CONFLICT.3\605691.exe
Dialer:Dialer.BKV Non Disinfettato C:\WINDOWS\Downloaded Program Files\CONFLICT.3\emoticon2.exe
Dialer:Dialer.Gen Non Disinfettato C:\WINDOWS\Downloaded Program Files\CONFLICT.4\605691.exe
Dialer:Dialer.BKV Non Disinfettato C:\WINDOWS\Downloaded Program Files\CONFLICT.4\emoticon2.exe
Dialer:Dialer.BKV Non Disinfettato C:\WINDOWS\Downloaded Program Files\CONFLICT.5\emoticon2.exe
Dialer:Dialer.BKV Non Disinfettato C:\WINDOWS\Downloaded Program Files\CONFLICT.6\emoticon2.exe
Dialer:Dialer.FTH Non Disinfettato C:\WINDOWS\Downloaded Program Files\video.exe
Dialer:Dialer.Gen Non Disinfettato C:\WINDOWS\Downloaded Program Files\606969.exe
Dialer:dialer.min Non Disinfettato C:\WINDOWS\Downloaded Program Files\61AE500.exe
Dialer:Dialer.ANA Non Disinfettato C:\WINDOWS\Downloaded Program Files\wlatip4x.exe
Dialer:dialer.fgv Non Disinfettato C:\WINDOWS\Downloaded Program Files\nd03049.exe
Dialer:Dialer.CDI Non Disinfettato C:\WINDOWS\Downloaded Program Files\e-eros.exe
Dialer:Dialer.BNC Non Disinfettato C:\WINDOWS\Downloaded Program Files\ssessoit.exe
Dialer:Dialer.AON Non Disinfettato C:\WINDOWS\Downloaded Program Files\gsa0956.exe
Adware:Adware/Look2Me Non Disinfettato C:\WINDOWS\Downloaded Program Files\pinstall.dll
Dialer:Dialer.BLX Non Disinfettato C:\WINDOWS\Downloaded Program Files\gsa0122.exe
Dialer:Dialer.FLX Non Disinfettato C:\WINDOWS\Downloaded Program Files\se001.exe
Dialer:Dialer.BKV Non Disinfettato C:\WINDOWS\Downloaded Program Files\CONFLICT.7\emoticon2.exe
Dialer:Dialer.AON Non Disinfettato C:\WINDOWS\Downloaded Program Files\gsa1221.exe
Dialer:Dialer.BKV Non Disinfettato C:\WINDOWS\Downloaded Program Files\emoticon2.exe
Dialer:Dialer.BKV Non Disinfettato C:\WINDOWS\Downloaded Program Files\CONFLICT.8\emoticon2.exe
Dialer:Dialer.BNC Non Disinfettato C:\WINDOWS\Downloaded Program Files\myhomepage.exe
Dialer:Dialer.Gen Non Disinfettato C:\WINDOWS\Downloaded Program Files\607193.exe
Dialer:Dialer.MIN Non Disinfettato C:\WINDOWS\Downloaded Program Files\604485.exe
Dialer:Dialer.GXD Non Disinfettato C:\WINDOWS\Downloaded Program Files\1059849.exe
Dialer:dialer.dyn Non Disinfettato C:\WINDOWS\Downloaded Program Files\dai.exe
Dialer:Dialer.HIP Non Disinfettato C:\WINDOWS\Downloaded Program Files\10305-23.exe
Dialer:Dialer.FHP Non Disinfettato C:\WINDOWS\Downloaded Program Files\gsa_00967.exe
Virus:Exploit/ByteVerify Disinfettato C:\WINDOWS\.jpi_cache\jar\1.0\UVZwCyE.jar-48f25245-7ffe3510.zip[BlackBox.class]
Virus:Exploit/ByteVerify Disinfettato C:\WINDOWS\.jpi_cache\jar\1.0\UVZwCyE.jar-48f25245-7ffe3510.zip[VerifierBug.class]
Virus:Exploit/ByteVerify Disinfettato C:\WINDOWS\.jpi_cache\jar\1.0\UVZwCyE.jar-48f25245-7ffe3510.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfettato C:\WINDOWS\.jpi_cache\jar\1.0\UVZwCyE.jar-48f25245-7ffe3510.zip[Beyond.class]
Virus:W32/Zafi.B.worm Disinfettato C:\Programmi\File comuni\Microsoft Shared\winamp 7.0 full_install.exe
Strumenti indesiderati:Application/Processor Non Disinfettato C:\_ad awere\spyware malware and co\l2mfix\Process.exe
Strumenti indesiderati:Application/Processor Non Disinfettato C:\_ad awere\spyware malware and co\l2mfix.exe[l2mfix/Process.exe]
hijack ha trovato:

Logfile of HijackThis v1.99.1
Scan saved at 14.31.44, on 25/07/06
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAMMI\CA\ETRUST ANTIVIRUS\INOTASK.EXE
C:\PROGRAMMI\CA\ETRUST ANTIVIRUS\INORT9X.EXE
C:\PROGRAMMI\CA\ETRUST ANTIVIRUS\INORPC.EXE
C:\PROGRAMMI\REALVNC\VNC4\WINVNC4.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\PROGRAMMI\CA\ETRUST ANTIVIRUS\REALMON.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAMMI\FILE COMUNI\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAMMI\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\PROGRAMMI\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE
C:\PROGRAMMI\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\DESKTOP\VARIE ED EVENTUALI\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.supereva.it/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxyc:3128
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = gastserv*;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://gastservc/index2.htm"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\1v8812cu.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAMMI%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_01.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\1v8812cu.slt\prefs.js)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRAMMI\YAHOO!\COMPANION\INSTALLS\CPN\YT.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar1.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAMMI\YAHOO!\COMPANION\INSTALLS\CPN\YT.DLL
O4 - HKLM\..\Run: [TaskMonitor] C:\Windows\taskmon.exe
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\REALMON.EXE -s
O4 - HKLM\..\Run: [LanguageMonitor] Oplmsb00.exe %Printer%
O4 - HKLM\..\Run: [PicasaNet] "C:\_ad awere\Hello\Hello.exe" -b
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SpySweeper] "C:\PROGRAMMI\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE" /startintray
O4 - HKLM\..\RunServices: [InoTask] C:\Programmi\CA\eTrust Antivirus\InoTask.exe
O4 - HKLM\..\RunServices: [InoRT] C:\Programmi\CA\eTrust Antivirus\InoRT9x.exe
O4 - HKLM\..\RunServices: [InoRPC] C:\Programmi\CA\eTrust Antivirus\InoRpc.exe
O4 - HKLM\..\RunServices: [WinVNC4] "C:\PROGRAMMI\REALVNC\VNC4\WINVNC4.EXE" -noconsole -service
O4 - HKCU\..\Run: [Malware Sweeper] C:\PROGRAMMI\MALWARESWEEPER.COM\MALWARE SWEEPER\MALSWEP.exe /STARTUP
O4 - Startup: Avvio Office.lnk = C:\Programmi\Microsoft Office\Office\OSA.EXE
O4 - Startup: Ricerca rapida.lnk = C:\Programmi\Microsoft Office\Office\FINDFAST.EXE
O8 - Extra context menu item: &Cerca con Google - res://C:\PROGRAMMI\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html
O8 - Extra context menu item: &Traduci parola in italiano - res://C:\PROGRAMMI\GOOGLE\GOOGLETOOLBAR1.DLL/cmwordtrans.html
O8 - Extra context menu item: Versione cache della pagina - res://C:\PROGRAMMI\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html
O8 - Extra context menu item: Pagine simili - res://C:\PROGRAMMI\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html
O8 - Extra context menu item: Link a ritroso - res://C:\PROGRAMMI\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html
O16 - DPF: {6BEA1C48-1850-486C-8F58-C7354BA3165E} (Install Class) - http://updates.lifescapeinc.com/installers/pinstall/pinstall.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/225100afde2c79bf9b05/netzip/RdxIE601_it.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_ansi.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = gastaldi.it
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 192.168.40.12,192.168.40.9

mi sono anche scaricato spy sweeper

e ha trovato:
carima dialer
energy plugin
istant acces
ricerche facili
sgrunt
teleas dialer
toplist coockie

a sdire il vero tutti questi dialer non so come ha fatto a trovarli perchè li avevo rimossi con spy bot

comunque non so se è un fenomeno momentaneo ma per ora non si blocca più

[holifay]

OK, bene, basta poco

Cancella questo file:
C:/WINDOWS/SYSTEM/aqaa.dll

Svuota questa cartella:
C:/WINDOWS/Downloaded Program Files/

Cancella queste cartelle (# è un numero)
C:/WINDOWS/Downloaded Program Files/CONFLICT.#


Ciao

[barbez]

perfetto ho fatto tutto ciò.. ma non ho trovato cartelle in dowloaded program files solo file che ho cancellato tutto..
grazie mille:-)