Olimpo Informatico

[bdoriano]

Buone notizie, virtumundobegone ha fatto un bel repulisti.
Mancano ancora alcune cosette...

Avvia AVENGER
Clicca su input script manually
Clicca sulla lente d'ingrandimento
Inserisci queste righe:

[lua]

ecco ciò che mi avevi detto di fare :

log avenger :
Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\jaodcflh

*******************

Script file located at: \??\C:\Program Files\wogfuikp.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



File c:\windows\himem.exe not found!
Deletion of file c:\windows\himem.exe failed!

Could not process line:
c:\windows\himem.exe
Status: 0xc0000034

File C:\windows\SC26BAA1F.tmp deleted successfully.


Could not open file C:\Documents and Settings\Luana\Dati applicazioni\option base keep\proxy great.exe for deletion
Deletion of file C:\Documents and Settings\Luana\Dati applicazioni\option base keep\proxy great.exe failed!

Could not process line:
C:\Documents and Settings\Luana\Dati applicazioni\option base keep\proxy great.exe
Status: 0xc000003a



Could not open file C:\Documents and Settings\Rossan\Dati applicazioni\option base keep\fvralbgx.exe for deletion
Deletion of file C:\Documents and Settings\Rossan\Dati applicazioni\option base keep\fvralbgx.exe failed!

Could not process line:
C:\Documents and Settings\Rossan\Dati applicazioni\option base keep\fvralbgx.exe
Status: 0xc000003a



Could not open file C:\Documents and Settings\Rossan\Dati applicazioni\option base keep\Memo sixth bat for.exe for deletion
Deletion of file C:\Documents and Settings\Rossan\Dati applicazioni\option base keep\Memo sixth bat for.exe failed!

Could not process line:
C:\Documents and Settings\Rossan\Dati applicazioni\option base keep\Memo sixth bat for.exe
Status: 0xc000003a



Could not open file C:\Documents and Settings\Rossan\Dati applicazioni\option base keep\proxy great.exe for deletion
Deletion of file C:\Documents and Settings\Rossan\Dati applicazioni\option base keep\proxy great.exe failed!

Could not process line:
C:\Documents and Settings\Rossan\Dati applicazioni\option base keep\proxy great.exe
Status: 0xc000003a



Could not open file C:\Documents and Settings\Rossan\Dati applicazioni\option base keep\tons hide knob.exe for deletion
Deletion of file C:\Documents and Settings\Rossan\Dati applicazioni\option base keep\tons hide knob.exe failed!

Could not process line:
C:\Documents and Settings\Rossan\Dati applicazioni\option base keep\tons hide knob.exe
Status: 0xc000003a



File C:\WINDOWS\2kadiras.EXE not found!
Deletion of file C:\WINDOWS\2kadiras.EXE failed!

Could not process line:
C:\WINDOWS\2kadiras.EXE
Status: 0xc0000034



File C:\WINDOWS\system32\datsobex.wwr not found!
Deletion of file C:\WINDOWS\system32\datsobex.wwr failed!

Could not process line:
C:\WINDOWS\system32\datsobex.wwr
Status: 0xc0000034



File C:\WINDOWS\system32\dqpqdpz.dll not found!
Deletion of file C:\WINDOWS\system32\dqpqdpz.dll failed!

Could not process line:
C:\WINDOWS\system32\dqpqdpz.dll
Status: 0xc0000034



File C:\WINDOWS\system32\winccjyh.exe not found!
Deletion of file C:\WINDOWS\system32\winccjyh.exe failed!

Could not process line:
C:\WINDOWS\system32\winccjyh.exe
Status: 0xc0000034



File C:\WINDOWS\system32\xqhqxh.dll not found!
Deletion of file C:\WINDOWS\system32\xqhqxh.dll failed!

Could not process line:
C:\WINDOWS\system32\xqhqxh.dll
Status: 0xc0000034



File C:\WINDOWS\Tasks\mwkvqck.job not found!
Deletion of file C:\WINDOWS\Tasks\mwkvqck.job failed!

Could not process line:
C:\WINDOWS\Tasks\mwkvqck.job
Status: 0xc0000034



File C:\WINDOWS\system32\opnmlji.dll not found!
Deletion of file C:\WINDOWS\system32\opnmlji.dll failed!

Could not process line:
C:\WINDOWS\system32\opnmlji.dll
Status: 0xc0000034



File C:\WINDOWS\system32\winlvi32.dll not found!
Deletion of file C:\WINDOWS\system32\winlvi32.dll failed!

Could not process line:
C:\WINDOWS\system32\winlvi32.dll
Status: 0xc0000034



Registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\opnmlji not found!
Deletion of registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\opnmlji failed!
Status: 0xc0000034



Registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\winlvi32 not found!
Deletion of registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\winlvi32 failed!
Status: 0xc0000034

Registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{100EB1FD-D03E-47FD-81F3-EE91287F9465} deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

log hij..:
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 8.55.18, on 26/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\windows\Explorer.EXE
C:\Programmi\iTunes\iTunesHelper.exe
C:\Programmi\Eset\nod32kui.exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmi\Eset\nod32krn.exe
C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
C:\windows\system32\svchost.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\windows\system32\wuauclt.exe
C:\Documents and Settings\Utente\Desktop\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.libero.it/
R3 - URLSearchHook: Share_Accelerator_MM toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Programmi\Share_Accelerator_MM\tbShar.dll
R3 - URLSearchHook: Online_TV toolbar - {40d1c3a7-4ffb-4443-b3a0-a64b2df7fc3b} - C:\Programmi\Online_TV\tbOnli.dll
R3 - URLSearchHook: RadioItalia Toolbar - {0aaeaede-aefd-4672-a764-5c5c037612a2} - C:\Programmi\RadioItalia\tbRadi.dll
O2 - BHO: Online_TV toolbar - {40d1c3a7-4ffb-4443-b3a0-a64b2df7fc3b} - C:\Programmi\Online_TV\tbOnli.dll
O2 - BHO: Share_Accelerator_MM toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Programmi\Share_Accelerator_MM\tbShar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar2.dll
O3 - Toolbar: Share_Accelerator_MM toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Programmi\Share_Accelerator_MM\tbShar.dll
O3 - Toolbar: Online_TV toolbar - {40d1c3a7-4ffb-4443-b3a0-a64b2df7fc3b} - C:\Programmi\Online_TV\tbOnli.dll
O3 - Toolbar: RadioItalia Toolbar - {0aaeaede-aefd-4672-a764-5c5c037612a2} - C:\Programmi\RadioItalia\tbRadi.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Programmi\Unlocker\UnlockerAssistant.exe"
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [himem] "c:\windows\himem.exe" 3fff 8ffff
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O20 - Winlogon Notify: opnmlji - opnmlji.dll (file missing)
O20 - Winlogon Notify: winlvi32 - winlvi32.dll (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmi\Eset\nod32krn.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 3834 bytes


ora faccio scansione online ...

ciao grazie ancora aspetto direttive grazie..

[lua]

ecco finalmente dopo 2 ore di san il lik della scansione di kaspersk on line ,aspetto direttive speriamo di poterla eliminare questa icona(Apwin32 firewall prototype raygold sexo sex drogas drugs pedo qwert lolita collection casero novia hermana ilegal_ ) dal desktop GRAZIEEEEEE

Forum link: kaspesy.html

ciao grazie

[ste_95]

kaspersky non rileva nulla, un adware in un'installazione...

seleziona queste voci e premif fix checked:

O4 - HKCU\..\Run: [himem] "c:\windows\himem.exe" 3fff 8ffff
O20 - Winlogon Notify: opnmlji - opnmlji.dll (file missing)
O20 - Winlogon Notify: winlvi32 - winlvi32.dll (file missing)

[lua]

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 14.12.09, on 26/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmi\Eset\nod32krn.exe
C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
C:\windows\system32\svchost.exe
C:\windows\Explorer.EXE
C:\Programmi\iTunes\iTunesHelper.exe
C:\Programmi\Eset\nod32kui.exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\windows\system32\wuauclt.exe
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\Utente\Desktop\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.libero.it/
R3 - URLSearchHook: Share_Accelerator_MM toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Programmi\Share_Accelerator_MM\tbShar.dll
R3 - URLSearchHook: Online_TV toolbar - {40d1c3a7-4ffb-4443-b3a0-a64b2df7fc3b} - C:\Programmi\Online_TV\tbOnli.dll
R3 - URLSearchHook: RadioItalia Toolbar - {0aaeaede-aefd-4672-a764-5c5c037612a2} - C:\Programmi\RadioItalia\tbRadi.dll
O2 - BHO: Online_TV toolbar - {40d1c3a7-4ffb-4443-b3a0-a64b2df7fc3b} - C:\Programmi\Online_TV\tbOnli.dll
O2 - BHO: Share_Accelerator_MM toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Programmi\Share_Accelerator_MM\tbShar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar2.dll
O3 - Toolbar: Share_Accelerator_MM toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Programmi\Share_Accelerator_MM\tbShar.dll
O3 - Toolbar: Online_TV toolbar - {40d1c3a7-4ffb-4443-b3a0-a64b2df7fc3b} - C:\Programmi\Online_TV\tbOnli.dll
O3 - Toolbar: RadioItalia Toolbar - {0aaeaede-aefd-4672-a764-5c5c037612a2} - C:\Programmi\RadioItalia\tbRadi.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Programmi\Unlocker\UnlockerAssistant.exe"
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmi\Eset\nod32krn.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 3829 bytes

fatto man elimina ancora il file del desktop come devo fare aiutatemi grazie mille

[ste_95]

prova a cancellarlo semplicemente...vedi se torna...

[lua]

ciao ho provato in mille modi a cancelarlo ma non riesco come devo fare???

[ste_95]

prova ad eliminarlo con killbox, altrimenti, dacci il pecrorso esatto

[lua]

ciao sei un fenomeno killbox ha fatto il miracolo ELIMINATO finalmente

senti ora ti mando un altro log lo vedi e mi dici se il pc è ok va bene grazie della pazienza...

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 10.02.51, on 27/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmi\Eset\nod32krn.exe
C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
C:\windows\system32\svchost.exe
C:\windows\Explorer.EXE
C:\Programmi\iTunes\iTunesHelper.exe
C:\Programmi\Eset\nod32kui.exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\windows\system32\ctfmon.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\windows\system32\wuauclt.exe
C:\Documents and Settings\Utente\Desktop\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.libero.it/
R3 - URLSearchHook: Share_Accelerator_MM toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Programmi\Share_Accelerator_MM\tbShar.dll
R3 - URLSearchHook: Online_TV toolbar - {40d1c3a7-4ffb-4443-b3a0-a64b2df7fc3b} - C:\Programmi\Online_TV\tbOnli.dll
R3 - URLSearchHook: RadioItalia Toolbar - {0aaeaede-aefd-4672-a764-5c5c037612a2} - C:\Programmi\RadioItalia\tbRadi.dll
O2 - BHO: Online_TV toolbar - {40d1c3a7-4ffb-4443-b3a0-a64b2df7fc3b} - C:\Programmi\Online_TV\tbOnli.dll
O2 - BHO: Share_Accelerator_MM toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Programmi\Share_Accelerator_MM\tbShar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar2.dll
O3 - Toolbar: Share_Accelerator_MM toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Programmi\Share_Accelerator_MM\tbShar.dll
O3 - Toolbar: Online_TV toolbar - {40d1c3a7-4ffb-4443-b3a0-a64b2df7fc3b} - C:\Programmi\Online_TV\tbOnli.dll
O3 - Toolbar: RadioItalia Toolbar - {0aaeaede-aefd-4672-a764-5c5c037612a2} - C:\Programmi\RadioItalia\tbRadi.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Programmi\Unlocker\UnlockerAssistant.exe"
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmi\Eset\nod32krn.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 3891 bytes

GRAZIE ANCORA

[ste_95]

questo log è pulito

[lua]

ok grazie mille una domanda un pò cosi come si fa a capire se un log è pulito o meno??

[ste_95]

se fai una ricerca con google trovi valanghe di guide...

eccone un paio:

http://www.google.it/search?q=hijackthis+guida&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:it:official&client=firefox-a

[Orange]

[bdoriano]

Senza andare a scomodare Google, queste sono le pagine dedicate alla fantastica guida scritta dalla mitica Holifay:
HijackThis pagina 1
HijackThis pagina 2
HijackThis pagina 3
HijackThis pagina 4
HijackThis pagina 5
HijackThis pagina 6
HijackThis pagina 7
HijackThis pagina 8