Olimpo Informatico

[sandrino]

Ciao a tutti...
In questi giorni il mio portatile ha preso la strada per un centro di assistenza e ho rispolverato il mio vecchio pc su cui è presente un fastidioso problema:
durante la navigazione compaiono delle finestre di servizio messenger davvero fastidiose per la loro frequenza...qualcuno potrebbe suggerire una strada da percorrere per risolvere il problema?
Grazie

[sandrino]

Aggiungo il log di hijackthis.


Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 14.31.03, on 08/06/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
c:\winnt\system32\services.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE
C:\WINNT\TEMP\hlmdba.exe
C:\Programmi\IPM\Adsl\DataWay\dslstat.exe
C:\WINNT\system32\dslagent.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINNT\system32\internat.exe
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Administrator\Desktop\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus C46 Series] C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE /P23 "EPSON Stylus C46 Series" /O6 "USB001" /M "Stylus C46"
O4 - HKLM\..\Run: [Windows Runtime Fix] mswinsfixerss.exe
O4 - HKLM\..\Run: [gzfeba.exe] C:\DOCUME~1\ADMINI~1\IMPOST~1\Temp\bak\gzfeba.exe
O4 - HKLM\..\Run: [hlmdba.exe] C:\WINNT\TEMP\hlmdba.exe
O4 - HKLM\..\Run: [aufuaa.exe] C:\WINNT\TEMP\aufuaa.exe
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Programmi\IPM\Adsl\DataWay\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [lzziaa.exe] C:\WINNT\TEMP\lzziaa.exe
O4 - HKLM\..\RunServices: [Windows Runtime Fix] mswinsfixerss.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [updateMgr] C:\Programmi\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKUS\.DEFAULT\..\Run: [internat.exe] internat.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Programmi\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Corel Family & Friends Reminders.LNK = C:\Programmi\Corel\Print House Magic\cffrem.exe
O16 - DPF: {37D29DDC-4754-B54D-BB04-5D865235BF21} - http://www.storage-tasp.com/gs/gsa_01607.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1152194329873
O17 - HKLM\System\CCS\Services\Tcpip\..\{EF85C971-6B3E-4AD8-ACF7-51D089EE150B}: NameServer = 85.37.17.49 85.38.28.91
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINNT\System32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINNT\System32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Servizio amministrativo di Gestione disco logico (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe

--
End of file - 4351 bytes

[tecnico24]

O4 - HKLM\..\Run: [gzfeba.exe] C:\DOCUME~1\ADMINI~1\IMPOST~1\Temp\bak\gzfeba.exe
O4 - HKLM\..\Run: [hlmdba.exe] C:\WINNT\TEMP\hlmdba.exe
O4 - HKLM\..\Run: [aufuaa.exe] C:\WINNT\TEMP\aufuaa.exe
solo queste tre sospettose.
la prima puo essere fixata ma per le altra farei qualche ricerca.

[bdoriano]

Ciao sandrino,
Scarica anche ATF-Cleaner
Avvia il pc in modalità provvisoria
Esegui ATF-Cleaner
metti il segno di spunta a Select All
(se non vuoi pulire anche il cestino togli il segno di spunta a Recycle bin)
Clicca su Empty Selected
chiudi il programma

Esegui hijackthis
clicca su do a system scan only
metti il segno di spunta a queste voci: