salve, purtroppo ogni volta che mi collego a intenet mi appare sotto una barra toolbar credo, molto ma molto molesta, e di conseguenza mi porta migliaia di spam...cio mi akkadde gia una volta, ma un bravissimo amico venne ad aiutarmi risolvendo il problema eliminando uno spyware molto molesto...adesso il problema è che io so praticamente zero di queste cose, e dato che questo mio carissimo amico è fuori per lavoro, me sa che me tocca appellarmi a voi =P pero ora vi invio il log hijack sperando di risolvere il problema, anche se nn credo sara facile...
vi ringrazio anticipatamente
Andrea





Logfile of HijackThis v1.99.1
Scan saved at 9.26.24, on 07/04/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe
C:\Programmi\File comuni\Symantec Shared\SNDSrvc.exe
C:\Programmi\File comuni\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Java\jre1.5.0_02\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hphmon05.exe
C:\HP\KBD\KBD.EXE
C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Programmi\File comuni\Symantec Shared\ccApp.exe
C:\Programmi\Microsoft AntiSpyware\gcasServ.exe
C:\Programmi\Messenger Plus! beta by SIMOBYTE\MsgPlus.exe
C:\Programmi\The Cleaner\tca.exe
C:\Programmi\The Cleaner\tcm.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBP4\plugin\bin\pchbutton.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\Microsoft AntiSpyware\gcasDtServ.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\progra~1\intern~1\iexplore.exe
C:\Programmi\Norton AntiVirus2005\navapsvc.exe
C:\Programmi\Norton AntiVirus2005\IWP\NPFMntor.exe
C:\Programmi\Serv-U\ServUDaemon.exe
C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Programmi\Spyware Doctor\swdoctor.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\ROBBA MJ\Programmi per windows xp home edition\Antivirus

anticaduta e anti Spam_pulizia dell hard disk\STOP virus HIJACK

!!!!\HijackThis_antivirus_by_aiuamici\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =

http://www.qkvnouonwggotpusvbraskaiu.com///9FsuKauBfKRnKhOKFiU0W5g_nP

79sAuTFiSqfLyYfMl37190iyhBafqjK8mdKz.jpg
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet

Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class -

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat

6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: iMeshBar BHO - {5345A7A1-805A-4923-B505-86B2FEBA3FE0} -

C:\Programmi\iMeshBar\bar\1.bin\IMESHBAR.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -

C:\Programmi\Search & Destroy\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB}

- C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor -

{B56A7D7D-6927-48C8-A975-17DF180C71AC} -

C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} -

C:\Programmi\Norton AntiVirus2005\NavShExt.dll
O2 - BHO: (no name) - {DACEEDE6-A74A-2A20-215D-281492B51B08} -

C:\DOCUME~1\PROPRI~1\DATIAP~1\MEETDA~1\Deaf Defy.exe
O2 - BHO: FlashFXP Helper for Internet Explorer -

{E5A1691B-D188-4419-AD02-90002030B8EE} -

C:\Programmi\FlashFXP\IEFlash.dll
O3 - Toolbar: Vista HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} -

c:\Programmi\HP\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Norton AntiVirus -

{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmi\Norton

AntiVirus2005\NavShExt.dll
O3 - Toolbar: iMeshBar - {5345A7A9-805A-4923-B505-86B2FEBA3FE0} -

C:\Programmi\iMeshBar\bar\1.bin\IMESHBAR.DLL
O4 - HKLM\..\Run: [SunJavaUpdateSched]

C:\Programmi\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD05]

c:\Programmi\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control

Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec

Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor]

C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Programmi\Microsoft

AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programmi\Messenger Plus! beta

by SIMOBYTE\MsgPlus.exe"
O4 - HKLM\..\Run: [tcactive] C:\Programmi\The Cleaner\tca.exe
O4 - HKLM\..\Run: [tcmonitor] C:\Programmi\The Cleaner\tcm.exe
O4 - HKLM\..\Run: [htmstartgrambin] C:\Documents and Settings\All

Users\Dati applicazioni\Bend Warn Htm Start\CoalSoft.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition]

C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
O4 - HKCU\..\Run: [Acme.PCHButton]

C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBP4\plugin\bin\pchbutton.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe"

/background
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Programmi\Spyware

Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [BackupNotify] c:\Programmi\HP\Digital

Imaging\bin\backupnotify.exe
O4 - HKCU\..\Run: [Enc poll]

C:\DOCUME~1\PROPRI~1\DATIAP~1\KNOBTO~1\Pile Does Settings.exe
O4 - Startup: Copia di AuDaX.006.lnk = C:\All AuDaX\Copia di

mIRC.BoT.AuDaX.IrOfFeR #AuDaX#\mirc.exe
O4 - Startup: Proxy.lnk = C:\Programmi\AnalogX\Proxy\proxy.exe
O4 - Startup: WinMx3.54 B [ZG]NiCkNaMe (2).lnk = C:\Programmi\Win

Mx 3.54 beta\WinMX.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel -

res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501}

- C:\Programmi\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

C:\Programmi\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Spyware Doctor -

{2D663D1A-8670-49D9-A1A5-4C56B4E14E84} -

C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263}

- C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683}

- C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) -

http://messenger.zone.msn.com/binary/msgrchkr.cab30149.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC}

(MessengerStatsClient Class) -

http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab30149.

cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine

Advantage Validation Tool) -

http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags

Class) -

http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl

Class) -

http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/cl

ient/wuweb_site.cab?1094225075218
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D}

(MessengerStatsClient Class) -

http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.ca

b
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) -

http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Ati HotKey Poller - Unknown owner -

C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec

Corporation - C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec

Corporation - C:\Programmi\File comuni\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec

Corporation - C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe
O23 - Service: Servizio Auto-Protect di Norton AntiVirus (navapsvc) -

Symantec Corporation - C:\Programmi\Norton AntiVirus2005\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) -

Symantec Corporation - C:\Programmi\Norton

AntiVirus2005\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Programmi\Norton

AntiVirus2005\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec

Corporation - C:\PROGRA~1\FILECO~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Serv-U FTP Server (Serv-U) - Cat Soft -

C:\Programmi\Serv-U\ServUDaemon.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec

Corporation - C:\Programmi\File comuni\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation -

C:\Programmi\File comuni\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation -

C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe

Ciao ,
esegui queste operazioni

1) Disattiva il ripristino di configurazione, leggi qui come fare
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=257&SH=N

2) riavvia in modalità provvisoria, leggi qui come fare
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=344&SH=N

apri HIJAC THIS ed elimina come indicato in questo articolo
http://www.aiutamici.com/software/descrizione.asp?CodSw=1175
le righe che seguono, (nel caso le righe da eliminare non compaiono in modalità provvisoria, eliminale dalla modalità normale e riavvia il computer).

==================================
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://www.qkvnouonwggotpusvbraskaiu.com///9FsuKauBfKRnKhOKFiU0W5g_nP
79sAuTFiSqfLyYfMl37190iyhBafqjK8mdKz.jpg
-
O2 - BHO: iMeshBar BHO - {5345A7A1-805A-4923-B505-86B2FEBA3FE0} -
C:\Programmi\iMeshBar\bar\1.bin\IMESHBAR.DLL
-
O2 - BHO: (no name) - {DACEEDE6-A74A-2A20-215D-281492B51B08} -
C:\DOCUME~1\PROPRI~1\DATIAP~1\MEETDA~1\Deaf Defy.exe
-
O3 - Toolbar: iMeshBar - {5345A7A9-805A-4923-B505-86B2FEBA3FE0} -
C:\Programmi\iMeshBar\bar\1.bin\IMESHBAR.DLL
-
O4 - HKLM\..\Run: [htmstartgrambin] C:\Documents and Settings\All
Users\Dati applicazioni\Bend Warn Htm Start\CoalSoft.exe
-
O4 - HKCU\..\Run: [Enc poll]
C:\DOCUME~1\PROPRI~1\DATIAP~1\KNOBTO~1\Pile Does Settings.exe
==================================

Con la funzione TROVA di Windows, cerca ed elimina questi file,

==================================
IMESHBAR.DLL
Deaf Defy.exe
CoalSoft.exe
Pile Does Settings.exe
==================================

ELIMINA LA CARTELLA IN ROSSO
C:\Programmi\<font color=red><b>iMeshBar</font id=red></b>
C:\Documents and Settings\All Users\Dati applicazioni\<font color=red><b>Bend Warn Htm Start</font id=red></b>
C:\DOCUME~1\PROPRI~1\DATIAP~1\<font color=red><b>KNOBTO~1</font id=red></b>

Vai nella cartella PANNELLO DI CONTROLLO e clicca su OPZIONI INTERNET qui clicca sui tre pulsanti
ELIMINA COOKIE - ELIMINA FILE - CANCELLA CRONOLOGIA
poi clicca sul pulsante PAGINA PREDEFINITA e poi su OK per uscire

al termine utilizza i programmi AD-AWARE e SPYBOT indicati in questo articolo
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=388&SH=N

sempre in modalità provvisoria fai una scansione Antivirus

quindi riavvia il computer e controlla se il problema e risolto, se e tutto OK riattiva il ripristino configurazione disattivato all'inizio di questa procedura.

---

Collaboratore Aiutamici