<font color=red>Ciao Alfonso, sempre io, il tuo incubo. Puoi controllare se tutto ok, per cortesia? Ho problemi, inoltre, dall'installazione di Outpost. Sto cercando di rimuoverlo, ma mi viene impedito.. Che fare? GRAZIE per la tua gentilezza e..pazienza
Logfile of HijackThis v1.98.2
Scan saved at 18.11.37, on 13/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe
C:\Programmi\File comuni\Symantec Shared\SNDSrvc.exe
C:\Programmi\File comuni\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTSvcCDA.EXE
C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmi\Norton AntiVirus\navapsvc.exe
C:\Programmi\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\Agnitum\OUTPOS~1.0\outpost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\File comuni\Symantec

Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\sstray.exe
C:\Programmi\Symantec\Norton Ghost

2003\GhostStartTrayApp.exe
C:\Programmi\Microsoft IntelliType Pro\type32.exe
C:\Programmi\File comuni\Symantec Shared\ccApp.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\Programmi\Babylon\Babylon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\SysShield Tools\Internet Eraser\cseraser.exe
C:\Programmi\Sicurezza\freepopsd.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Messenger\msmsgs.exe
C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE
C:\Programmi\LimeWire\LimeWire.exe
C:\Programmi\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\Internet Explorer\iexplore.exe
D:\ARCHIVIO\Programmi

scaricati\Sicurezza\ETRemover\ETRemover_v201.exe
D:\ARCHIVIO\Programmi scaricati\Sicurezza\Hijack

This\HijackThis.exe
D:\ARCHIVIO\Programmi scaricati\Sicurezza\Reg

clean\RegClean.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search

Bar = http://g.msn.it/0SEITIT/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start

Page = http://parole.virgilio.it/parole/?pmk=HPfind2
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local

Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local

Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window

Title = Microsoft Internet Explorer
R0 - HKCU\Software\Microsoft\Internet

Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class -

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -

C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) -

{53707962-6F74-2D53-2644-206D7942484F} -

C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SysShield IE Popup Blocker -

{9A23B8A4-C6C9-4A68-8FA6-5F905DC8FF80} -

C:\Programmi\SysShield Tools\Internet Eraser\pkext.dll
O2 - BHO: AcroIEToolbarHelper Class -

{AE7CD045-E861-484f-8273-0445EE161910} -

C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: NAV Helper -

{BDF3E430-B101-42AD-A544-FADC6B084872} -

C:\Programmi\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Adobe PDF -

{47833539-D0C5-4125-9FA8-0819E2EAAC93} -

C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Norton AntiVirus -

{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} -

C:\Programmi\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: AbsoluteShield -

{EE9DD090-902D-4623-9360-FB7D8666202B} -

C:\Programmi\SysShield Tools\Internet

Eraser\AbsoluteBar.dll
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [GhostStartTrayApp]

C:\Programmi\Symantec\Norton Ghost

2003\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [type32] "C:\Programmi\Microsoft

IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File

comuni\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor]

C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File

comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Babylon Translator]

C:\Programmi\Babylon\Babylon.exe
O4 - HKCU\..\Run: [ctfmon.exe]

C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ccleaner]

"C:\Programmi\CCleaner\ccleaner.exe" /AUTO
O4 - Startup: AbsoluteShield Internet Eraser.lnk =

C:\Programmi\SysShield Tools\Internet Eraser\cseraser.exe
O4 - Startup: Adobe Gamma.lnk = C:\Programmi\File

comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: FreePOPs.lnk =

C:\Programmi\Sicurezza\freepopsd.exe
O4 - Global Startup: Adobe Gamma Loader.lnk =

C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma

Loader.exe
O8 - Extra context menu item: Aiutamici -

c:\windows\web\aiuta.htm
O8 - Extra context menu item: Converti destinazione link in

Adobe PDF - res://C:\Programmi\Adobe\Acrobat

7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Converti destinazione link in

file PDF esistente - res://C:\Programmi\Adobe\Acrobat

7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Converti i link selezionati

in Adobe PDF - res://C:\Programmi\Adobe\Acrobat

7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Converti i link selezionati

in file PDF esistente - res://C:\Programmi\Adobe\Acrobat

7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Converti in Adobe PDF -

res://C:\Programmi\Adobe\Acrobat

7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Converti nel file PDF

esistente - res://C:\Programmi\Adobe\Acrobat

7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Converti selezione in Adobe

PDF - res://C:\Programmi\Adobe\Acrobat

7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Converti selezione in file

PDF esistente - res://C:\Programmi\Adobe\Acrobat

7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&sporta in Microsoft Excel -

res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

C:\Programmi\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

C:\Programmi\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Browser Adjustment -

{44627E97-789B-40d4-B5C2-58BD171129A1} -

C:\PROGRA~1\Agnitum\OUTPOS~1.0\Plugins\BrowserBar\ie_bar.dl

l
O9 - Extra button: Ricerche -

{92780B25-18CC-41C8-B9BE-3C9C571A8263} -

C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows

Genuine Advantage Validation Tool) -

http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec

AntiVirus scanner) -

http://security.symantec.com/sscv6/SharedContent/vc/bin/AvS

niff.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} -

http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec

RuFSI Utility Class) -

http://security.symantec.com/sscv6/SharedContent/common/bin

/cabsa.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} -

http://www.notrace.it/scan/Msie/bitdefender.cab
O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure

Online Scanner) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1}

(ActiveScan Installer Class) -

http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF}

(MsnMessengerSetupDownloadControl Class) -

http://messenger.msn.com/download/MsnMessengerSetupDownload

er.cab
O16 - DPF: {C1B7E532-3ECB-4E9E-BB3A-2951FFE67C61}

(DownloaderActiveX Control) -

http://c6.community.virgilio.it/download/DownloaderActiveX.

cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6}

(McFreeScan Class) -

http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/m

cfscan/2,0,0,4603/mcfscan.cab
O17 -

HKLM\System\CCS\Services\Tcpip\..\{AF6C6EAC-E29E-4E8A-AED6-

63A25A0FA73C}: NameServer = 85.37.17.4 151.99.125.1
O18 - Protocol: msnim -

{828030A1-22C1-4009-854F-8E305202313F} -

"C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs:

C:\PROGRA~1\Agnitum\OUTPOS~1.0\wl_hook.dll

</font id=red>

---

Fai nuovamente il log e inseriscilo nel forum Sicurezza virus cosi posso risponderti prima

Copia il log dal BloccoNote senza apportare nessuna modifica

se non si apre il blocco note, per copiare il testo, apri il file hijackthis.log che viene salvato da Hijack, con il blocco note

se copi il testo da altri editor viene tutto spezzettato come in questo caso.

---

Collaboratore Aiutamici