Olimpo Informatico

[wilson80]

Ciao a tutti!
Ho un problema che si potrebbe rivelare anche grave!
Firefox non mi blocca più le finestre di popup.
La casella (strumenti-->opzioni-->blocca le finestre di pouup) è spuntata, ma quando cliccko su "eccezioni mi trovo centinaia e centinaia di siti caricati.
Ho provato più volte a fare "rimuovi", ma tutte le volte che riapro firefox, mi ricarica centinaia e centinaia di siti.
Vi lascio qui di seguito anche il log di hijackthis

Logfile of HijackThis v1.99.1
Scan saved at 20.10.08, on 14/04/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\COMODO\Firewall\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programmi\COMODO\Firewall\cfp.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Vidalia Bundle\Vidalia\vidalia.exe
C:\Programmi\Logitech\MouseWare\system\em_exec.exe
C:\Programmi\NETGEAR\WPN111\wpn111.exe
C:\Programmi\Vidalia Bundle\Privoxy\privoxy.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ATKKBService.exe
C:\Programmi\Executive Software\Diskeeper\DkService.exe
C:\Programmi\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Vidalia Bundle\Tor\tor.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Programmi\Lavasoft\Ad-Aware\aawservice.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Robertino\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.it/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre6\bin\ssv.dll
O2 - BHO: PPVADownloader - {A986E409-30CC-4185-89BB-AB212C104524} - C:\Programmi\PPLiveVA\DownloaderManager.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmi\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Programmi\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Programmi\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\RunOnce: [SpybotDeletingA7757] command /c del "C:\Documents and Settings\All Users\Menu Avvio\Programmi\Live-Player\Condizioni generali.url"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9667] cmd /c del "C:\Documents and Settings\All Users\Menu Avvio\Programmi\Live-Player\Condizioni generali.url"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1461] command /c del "C:\Documents and Settings\All Users\Menu Avvio\Programmi\Live-Player\Riservatezza.url"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8543] cmd /c del "C:\Documents and Settings\All Users\Menu Avvio\Programmi\Live-Player\Riservatezza.url"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3006] command /c del "C:\Documents and Settings\All Users\Menu Avvio\Programmi\Live-Player\Website.url"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7902] cmd /c del "C:\Documents and Settings\All Users\Menu Avvio\Programmi\Live-Player\Website.url"
O4 - HKLM\..\RunOnce: [SpybotDeletingA6627] command /c del "C:\Documents and Settings\All Users\Menu Avvio\Programmi\Live-Player\Disinstalla.lnk"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1672] cmd /c del "C:\Documents and Settings\All Users\Menu Avvio\Programmi\Live-Player\Disinstalla.lnk"
O4 - HKLM\..\RunOnce: [SpybotDeletingA8580] command /c del "C:\Documents and Settings\All Users\Menu Avvio\Programmi\Live-Player\Live-Player.lnk"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2581] cmd /c del "C:\Documents and Settings\All Users\Menu Avvio\Programmi\Live-Player\Live-Player.lnk"
O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Programmi\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Vidalia] "C:\Programmi\Vidalia Bundle\Vidalia\vidalia.exe"
O4 - HKCU\..\RunOnce: [SpybotDeletingB6593] command /c del "C:\Documents and Settings\All Users\Menu Avvio\Programmi\Live-Player\Condizioni generali.url"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9047] cmd /c del "C:\Documents and Settings\All Users\Menu Avvio\Programmi\Live-Player\Condizioni generali.url"
O4 - HKCU\..\RunOnce: [SpybotDeletingB6051] command /c del "C:\Documents and Settings\All Users\Menu Avvio\Programmi\Live-Player\Riservatezza.url"
O4 - HKCU\..\RunOnce: [SpybotDeletingD8451] cmd /c del "C:\Documents and Settings\All Users\Menu Avvio\Programmi\Live-Player\Riservatezza.url"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8745] command /c del "C:\Documents and Settings\All Users\Menu Avvio\Programmi\Live-Player\Website.url"
O4 - HKCU\..\RunOnce: [SpybotDeletingD2371] cmd /c del "C:\Documents and Settings\All Users\Menu Avvio\Programmi\Live-Player\Website.url"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7111] command /c del "C:\Documents and Settings\All Users\Menu Avvio\Programmi\Live-Player\Disinstalla.lnk"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1521] cmd /c del "C:\Documents and Settings\All Users\Menu Avvio\Programmi\Live-Player\Disinstalla.lnk"
O4 - HKCU\..\RunOnce: [SpybotDeletingB5945] command /c del "C:\Documents and Settings\All Users\Menu Avvio\Programmi\Live-Player\Live-Player.lnk"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9221] cmd /c del "C:\Documents and Settings\All Users\Menu Avvio\Programmi\Live-Player\Live-Player.lnk"
O4 - Global Startup: NETGEAR WPN111 Smart Wizard.lnk = ?
O4 - Global Startup: Privoxy.lnk = C:\Programmi\Vidalia Bundle\Privoxy\privoxy.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Programmi\PPLive\PPLive.exe
O9 - Extra 'Tools' menuitem: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Programmi\PPLive\PPLive.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Programmi\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - C:\Programmi\COMODO\Firewall\cmdagent.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Programmi\Executive Software\Diskeeper\DkService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Programmi\Java\jre6\bin\jqs.exe" -service -config "C:\Programmi\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Programmi\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programmi\PC Connectivity Solution\ServiceLayer.exe

Avevo sentito parlare di un virus che può dare questi problemi, ma ho fatto sia clo scan con Avast che con Panda activescan, ma niente...
Il problema si verifica da circa una settimana e crddo che non c'entri la recente installazione di "PPLive" e di "Live player".

C'è qualcuno che sa come aiutarmi?

GRAZIE!

[wilson80]

Nessuno sa aiutarmi?

[zeross]

[bdoriano]

@wilson80:

Stai usando una versione vecchia di hijackthis, scarica la versione aggiornata e salvala in una sua cartella non temporanea e non sul desktop.

Per i controlli approfonditi, sposto la discussione in PSV.

[Riverside]