Olimpo Informatico

[Sante62]

Si, il resto dovrebbe essere a posto;
per la posta non so dirti di preciso;
devi vedere se l'account è configurato correttamente...
che problemi hai con Internet Explorer?

[kathy]

il problema con internet non mi si apre normale tutto diverso con delle foto publicitarie e per navigare devo cliccare una scritta (go) non riesco a fare diversamente per la posta invece ti spiego l'ACCOUNT E CORRETTO MI SI APRE UNA FINESTRELLA CON SCRITTO PASSWUOR NON CORRETTA MA E GIUSTA QUANDO CLICCO SETTE OTTO VOLTE PER TOGLIERE LA FINESTRELLA MI SI DISCONNETTE

[Sante62]

Fai una scansione con Systemscan e posta il log generato come
indicato quì.

[kathy]

http://www.freefilehosting.net/download/3cbff

[Sante62]

Ci sono strane aggiunte nel file hosts...e probabilmente qualcos'altro..
Avvia HJT e fixa queste righe:

[kathy]

scusa se ti spavento ma che cose (HJT)

[Sante62]

Hijackthis....

[kathy]

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20.05.13, on 22/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Programmi\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programmi\Softwin\BitDefender8\bdmcon.exe
C:\Programmi\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Programmi\Softwin\BitDefender8\bdnagent.exe
C:\Programmi\COMODO\Firewall\cmdagent.exe
C:\WINDOWS\vsnpstd.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Programmi\Spyware Terminator\sp_rsser.exe
C:\Programmi\COMODO\Firewall\cfp.exe
C:\Programmi\Spyware Terminator\SpywareTerminatorShield.exe
C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\File comuni\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\File comuni\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Programmi\File comuni\Softwin\BitDefender Scan Server\bdss.exe
C:\Programmi\File comuni\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmi\emule 47 c\emule.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Willy\Desktop\Icone di servizio\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.c0m.it?pg=ST
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.alice.it
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Secured_eMule Toolbar - {1d1b60fd-b21f-4b9a-8a5f-64e8544828d7} - C:\Programmi\Secured_eMule\tbSec1.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Secured_eMule Toolbar - {1d1b60fd-b21f-4b9a-8a5f-64e8544828d7} - C:\Programmi\Secured_eMule\tbSec1.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: Secured_eMule Toolbar - {1d1b60fd-b21f-4b9a-8a5f-64e8544828d7} - C:\Programmi\Secured_eMule\tbSec1.dll
O4 - HKLM\..\Run: [avgnt] "C:\Programmi\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [BDMCon] "C:\Programmi\Softwin\BitDefender8\bdmcon.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "C:\Programmi\Softwin\BitDefender8\bdnagent.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Programmi\COMODO\Firewall\cfp.exe" -s
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Programmi\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Inserisci blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programmi\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: Inserisci &blog in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programmi\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: I&nvia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.alice.it
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{80323018-40C0-4563-9A4E-BB2955E8CFCA}: NameServer = 85.37.17.41 85.38.28.83
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmi\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programmi\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Programmi\File comuni\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - C:\Programmi\COMODO\Firewall\cmdagent.exe
O23 - Service: NBService - Nero AG - C:\Programmi\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programmi\File comuni\Ahead\Lib\NMIndexingService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Programmi\Spyware Terminator\sp_rsser.exe
O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Programmi\File comuni\Softwin\BitDefender Communicator\xcommsvr.exe

--
End of file - 7266 bytes

[kathy]

Norman Malware Cleaner
Copyright © 1990 - 2008, Norman ASA. Built 2008/02/13 17:04:03

Norman Scanner Engine Version: 5.91.10
Nvcbin.def Version: 5.90.00, Date: 2008/02/13 17:04:03, Variants: 1304976

Running pre-scan cleanup routine:
Operating System: Microsoft Windows XP Professional 5.1.2600 Service Pack 2
Logged on user: WILLY-4977E31ED\Willy

Set registry value: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLS = " C:\WINDOWS\system32\guard32.dll" -> ""
Removed hosts entry: 127.0.0.1 bin.errorprotector.com
Removed hosts entry: 127.0.0.1 br.errorsafe.com
Removed hosts entry: 127.0.0.1 br.winantivirus.com
Removed hosts entry: 127.0.0.1 br.winfixer.com
Removed hosts entry: 127.0.0.1 cdn.drivecleaner.com
Removed hosts entry: 127.0.0.1 cdn.errorsafe.com
Removed hosts entry: 127.0.0.1 cdn.winsoftware.com
Removed hosts entry: 127.0.0.1 de.errorsafe.com
Removed hosts entry: 127.0.0.1 de.winantivirus.com
Removed hosts entry: 127.0.0.1 download.cdn.drivecleaner.com
Removed hosts entry: 127.0.0.1 download.cdn.errorsafe.com
Removed hosts entry: 127.0.0.1 download.cdn.winsoftware.com
Removed hosts entry: 127.0.0.1 download.errorsafe.com
Removed hosts entry: 127.0.0.1 download.systemdoctor.com
Removed hosts entry: 127.0.0.1 download.winantispyware.com
Removed hosts entry: 127.0.0.1 download.windrivecleaner.com
Removed hosts entry: 127.0.0.1 download.winfixer.com
Removed hosts entry: 127.0.0.1 drivecleaner.com
Removed hosts entry: 127.0.0.1 dynamique.drivecleaner.com
Removed hosts entry: 127.0.0.1 errorprotector.com
Removed hosts entry: 127.0.0.1 errorsafe.com
Removed hosts entry: 127.0.0.1 es.winantivirus.com
Removed hosts entry: 127.0.0.1 fr.winantivirus.com
Removed hosts entry: 127.0.0.1 fr.winfixer.com
Removed hosts entry: 127.0.0.1 go.drivecleaner.com
Removed hosts entry: 127.0.0.1 go.errorsafe.com
Removed hosts entry: 127.0.0.1 go.winantispyware.com
Removed hosts entry: 127.0.0.1 go.winantivirus.com
Removed hosts entry: 127.0.0.1 hk.winantivirus.com
Removed hosts entry: 127.0.0.1 instlog.errorsafe.com
Removed hosts entry: 127.0.0.1 instlog.winantivirus.com
Removed hosts entry: 127.0.0.1 instlog.winfixer.com
Removed hosts entry: 127.0.0.1 jsp.drivecleaner.com
Removed hosts entry: 127.0.0.1 kb.errorsafe.com
Removed hosts entry: 127.0.0.1 kb.winantivirus.com
Removed hosts entry: 127.0.0.1 nl.errorsafe.com
Removed hosts entry: 127.0.0.1 se.errorsafe.com
Removed hosts entry: 127.0.0.1 secure.drivecleaner.com
Removed hosts entry: 127.0.0.1 secure.errorsafe.com
Removed hosts entry: 127.0.0.1 secure.winantispam.com
Removed hosts entry: 127.0.0.1 secure.winantispy.com
Removed hosts entry: 127.0.0.1 secure.winantivirus.com
Removed hosts entry: 127.0.0.1 support.winantivirus.com
Removed hosts entry: 127.0.0.1 trial.updates.winsoftware.com
Removed hosts entry: 127.0.0.1 ulog.winantivirus.com
Removed hosts entry: 127.0.0.1 utils.errorsafe.com
Removed hosts entry: 127.0.0.1 utils.winantivirus.com
Removed hosts entry: 127.0.0.1 utils.winfixer.com
Removed hosts entry: 127.0.0.1 winantispyware.com
Removed hosts entry: 127.0.0.1 winantivirus.com
Removed hosts entry: 127.0.0.1 winfixer.com
Removed hosts entry: 127.0.0.1 winfixer2006.com
Removed hosts entry: 127.0.0.1 winsoftware.com
Removed hosts entry: 127.0.0.1 www.drivecleaner.com
Removed hosts entry: 127.0.0.1 www.errorprotector.com
Removed hosts entry: 127.0.0.1 www.errorsafe.com
Removed hosts entry: 127.0.0.1 www.systemdoctor.com
Removed hosts entry: 127.0.0.1 www.utils.winfixer.com
Removed hosts entry: 127.0.0.1 www.win-anti-virus-pro.com
Removed hosts entry: 127.0.0.1 www.win-virus-pro.com
Removed hosts entry: 127.0.0.1 www.winantispam.com
Removed hosts entry: 127.0.0.1 www.winantispy.com
Removed hosts entry: 127.0.0.1 www.winantispyware.com
Removed hosts entry: 127.0.0.1 www.winantivirus.com
Removed hosts entry: 127.0.0.1 www.winantiviruspro.com
Removed hosts entry: 127.0.0.1 www.windrivecleaner.com
Removed hosts entry: 127.0.0.1 www.windrivesafe.com
Removed hosts entry: 127.0.0.1 www.winfixer.com
Removed hosts entry: 127.0.0.1 www.winfixer2006.com
Removed hosts entry: 127.0.0.1 www.winsoftware.com

Scan started: 22/02/2008 20:36:19


Scanning running processes and process memory...

Number of processes/threads found: 1907
Number of processes/threads scanned: 1907
Number of processes/threads not scanned: 0
Number of infected processes/threads terminated: 0
Total scanning time: 1m 33s


Scanning file system...

Scanning: C:\*.*

C:\Documents and Settings\Willy\Dati applicazioni\Antilogo\ewnjbrko.exe (Infected with W32/Lop.GFR)
Deleted file

Scanning: D:\*.*

Scanning: c:\System Volume Information\*.*


Running post-scan cleanup routine:

Number of files found: 48233
Number of archives unpacked: 872
Number of files scanned: 48206
Number of files not scanned: 27
Number of files skipped due to exclude list: 0
Number of infected files found: 1
Number of infected files repaired/deleted: 1
Number of infections removed: 1
Total scanning time: 31m 36s
mi sembra di essere riuscito a fare tutti i passi come mi ai detto se non dovrebbe essere cosi mi scuso riprovero

[Sante62]

OK, hai fatto tutto bene....
Norman ha eliminato voci aggiunte al file hosts;
Avvia Hijackthis e fixa queste altre righe:

[kathy]

molte grazie mi sembra che va tutto alla perfezzione comunque martedi mi mettono( fasteb)spero che non ci siano dei problemi seno

[kathy]

Impossibile collegarsi al server della posta. La password non è stata accettata. Account: 'in.alice.it (1) (5)', Server: 'in.alice.it', Protocollo: POP3, Risposta del server: '-ERR The specified directory service attribute or value does not exist.', Porta: 110, Protezione (SSL): No, Errore del server: 0x800CCC90, Numero di errore: 0x800CCC92( questo e quello che mi dice la posta tutto il resto e a posto)

[Sante62]

Ma è configurato correttamente il client della posta?

[kathy]

si e tutto giusto

[Sante62]

Sinceramente non so dirti....
quando una cosa del genere è capitata anche a me, c'era un errore nella configurazione del client (Outlook); tu quale stai usando?...

[kathy]

la configurazione del cliente e giusta adesso aspetto martedi che cambio il contratto poi vedremo

[kathy]

mi anno messo fas tueb ma sto diventando matto per adesso non va molto bene da qua a domenica spero che si metta tutto a posto seno ci sentiremo

[T.K.]

[kevin]

[T.K.]