Logfile of HijackThis v1.99.1
Scan saved at 14.08.35, on 01/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe
C:\WINDOWS\bWF1cmEgcG9ycnU\command.exe
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\Programmi\Network Monitor\netmon.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Programmi\Hp\HP Software Update\HPWuSchd2.exe
C:\Programmi\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\nwnmff_e26.exe
C:\dfndrff_e26.exe
C:\kybrdff_e26.exe
C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programmi\File comuni\{244812D8-06FE-1040-1107-050509260027}\Update.exe
C:\WINDOWS\system32\ctfmon.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\WINDOWS\system32\WNSXS~1\mshta.exe
C:\Documents and Settings\Maura\Documenti\F?nts\w?auclt.exe
C:\Programmi\WIDCOMM\Software Bluetooth\BTTray.exe
C:\PROGRA~1\WIDCOMM\SOFTWA~1\BTSTAC~1.EXE
C:\Programmi\HPQ\SHARED\HPQWMI.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\macromed\flash\GetFlash.exe
C:\Documents and Settings\Maura\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://giurisprudenza.unica.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.hp.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - C:\Programmi\DeluxeCommunications\DxcBho.dll
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: UCmore XP - The Search Accelerator - {44BE0690-5429-47f0-85BB-3FFD8020233E} - C:\Programmi\TheSearchAccelerator\UCMTSAIE.dll
O3 - Toolbar: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Programmi\ToolBar888\MyToolBar.dll
O4 - HKLM\..\Run: [HP Software Update] C:\Programmi\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Programmi\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [McRegWiz] C:\PROGRA~1\mcafee.com\agent\mcregwiz.exe /autorun
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [lxr0b742] RUNDLL32.EXE w0181548.dll,n 0050b73d0000000a0181548
O4 - HKLM\..\Run: [newname] C:\\nwnmff_e26.exe
O4 - HKLM\..\Run: [defender] C:\\dfndrff_e26.exe
O4 - HKLM\..\Run: [keyboard] C:\\kybrdff_e26.exe
O4 - HKLM\..\Run: [DeluxeCommunications] C:\Programmi\DeluxeCommunications\Dxc.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DeluxeCommunications] C:\Programmi\DeluxeCommunications\Dxc.exe
O4 - HKCU\..\Run: [Amcd] "C:\WINDOWS\system32\WNSXS~1\mshta.exe" -vt yazr
O4 - HKCU\..\Run: [Eivcffhr] C:\Documents and Settings\Maura\Documenti\F?nts\w?auclt.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Invia a &Bluetooth - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4FEEFA35-8927-422F-B8D1-303C112429A1}: NameServer = 212.216.172.62,212.216.112.112
O17 - HKLM\System\CS1\Services\Tcpip\..\{4FEEFA35-8927-422F-B8D1-303C112429A1}: NameServer = 212.216.172.62,212.216.112.112
O17 - HKLM\System\CS2\Services\Tcpip\..\{4FEEFA35-8927-422F-B8D1-303C112429A1}: NameServer = 212.216.172.62,212.216.112.112
O20 - AppInit_DLLs: dxclib303562752.dll
O20 - Winlogon Notify: Setup - C:\WINDOWS\system32\dnjo0113e.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\bWF1cmEgcG9ycnU\command.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Programmi\HPQ\SHARED\HPQWMI.exe
O23 - Service: Servizio iPod (iPodService) - Apple Computer, Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Networks Associates Technology, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: Network Monitor - Unknown owner - C:\Programmi\Network Monitor\netmon.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Programmi\TuneUp Utilities 2006\WinStylerThemeSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Ciao, il tuo computer sembra devastato dalle cavallette.
Fai cosi :
1. Assicurati che che tutte le cartelle siano visibili:

Da Risorse del computer >> Strumenti >> Opzioni cartella >> visualizzazione >> metti la spunta su:
"Visualizza file e cartelle nascoste";
togli la spunta da "Nascondi file protetti del sistema (consigliato)"

2. da Start >> esegui >> digita <b>cmd</b> e nella finestra dos che si apre copia e incolla questa stringa: <b>sc delete command.exe</b>, poi dai l'invio:

rifai la stessa procedura per:<b>netmon.exe</b>

3. Disattiva il Ripristino configurazione di sistema e avvia in modalità provvisoria.

4. cerca ed elimina i seguenti file in grassetto di cui di do il percorso.

---

C:\<b>nwnmff_e26.exe</b>
C:\<b>dfndrff_e26.exe</b>
C:\<b>kybrdff_e26.exe</b>
C:\Documents and Settings\Maura\Documenti\F?nts\<b>w?auclt.exe</b>. <b>In questo caso elimina anche la cartella che contiene il file</b>.

---

5. Poi con hiijackthis (in modalità provvisoria) fixa queste voci :
------------------------------------
<font color=red>R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - C:\Programmi\DeluxeCommunications\DxcBho.dll
O4 - HKLM\..\Run: [lxr0b742] RUNDLL32.EXE w0181548.dll,n 0050b73d0000000a0181548
O4 - HKLM\..\Run: [newname] C:\\nwnmff_e26.exe
O4 - HKLM\..\Run: [defender] C:\\dfndrff_e26.exe
O4 - HKLM\..\Run: [keyboard] C:\\kybrdff_e26.exe
O4 - HKCU\..\Run: [Amcd] "C:\WINDOWS\system32\WNSXS~1\mshta.exe" -vt yazr
O4 - HKCU\..\Run: [Eivcffhr] C:\Documents and Settings\Maura\Documenti\F?nts\w?auclt.exe
O20 - AppInit_DLLs: dxclib303562752.dll
O20 - Winlogon Notify: Setup - C:\WINDOWS\system32\dnjo0113e.dll
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\bWF1cmEgcG9ycnU\command.exe
O23 - Service: Network Monitor - Unknown owner - C:\Programmi\Network Monitor\netmon.exe
</font id=red>

---

6. Pulisci la cronologia, i file temporanei internet e i cookies.
7. Per pulire tutti i file temp fai cosi:

Start >> esegui >> digita <b>temp</b> e cancella tutti file che trovi all'apertura della finestra.
Esegui la stessa procedura, scrivendo questa volta <b>%temp%</b>

8. Fai una scansione on line con BitDefender
http://www.bitdefender.com

Rinascondi le cartelle e riattiva il ripristino.
Riposta un log.

---

Ciao , ti converrebbe formattare il disco fisso e reinstallare tutto, comunque se vuoi provare esegui queste operazioni

Disattiva il ripristino di configurazione, leggi qui come fare
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=257&SH=N

Riavvia in modalità provvisoria, leggi qui come fare
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=344&SH=N

apri HIJAC THIS ed elimina come indicato in questo articolo
http://www.aiutamici.com/software/descrizione.asp?CodSw=1175
le righe che seguono.

==================================
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
-
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
-
R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - C:\Programmi\DeluxeCommunications\DxcBho.dll
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
-
O3 - Toolbar: UCmore XP - The Search Accelerator - {44BE0690-5429-47f0-85BB-3FFD8020233E} - C:\Programmi\TheSearchAccelerator\UCMTSAIE.dll
O3 - Toolbar: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Programmi\ToolBar888\MyToolBar.dll
-
O4 - HKLM\..\Run: [lxr0b742] RUNDLL32.EXE w0181548.dll,n 0050b73d0000000a0181548
O4 - HKLM\..\Run: [newname] C:\\nwnmff_e26.exe
O4 - HKLM\..\Run: [defender] C:\\dfndrff_e26.exe
O4 - HKLM\..\Run: [keyboard] C:\\kybrdff_e26.exe
O4 - HKLM\..\Run: [DeluxeCommunications] C:\Programmi\DeluxeCommunications\Dxc.exe
-
O4 - HKCU\..\Run: [DeluxeCommunications] C:\Programmi\DeluxeCommunications\Dxc.exe
O4 - HKCU\..\Run: [Amcd] "C:\WINDOWS\system32\WNSXS~1\mshta.exe" -vt yazr
O4 - HKCU\..\Run: [Eivcffhr] C:\Documents and Settings\Maura\Documenti\F?nts\w?auclt.exe
-
O20 - AppInit_DLLs: dxclib303562752.dll
O20 - Winlogon Notify: Setup - C:\WINDOWS\system32\dnjo0113e.dll
-
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\bWF1cmEgcG9ycnU\command.exe
-
O23 - Service: Network Monitor - Unknown owner - C:\Programmi\Network Monitor\netmon.exe
==================================


Elimina le cartelle in rosso nei percorsi indicati
==================================
C:\Programmi\<font color=red><b>DeluxeCommunications</font id=red></b>
C:\Programmi\<font color=red><b>TheSearchAccelerator</font id=red></b>
C:\Programmi\<font color=red><b>ToolBar888</font id=red></b>
C:\WINDOWS\system32\<font color=red><b>WNSXS~1</font id=red></b>
C:\Documents and Settings\Maura\Documenti\<font color=red><b>F?nts</font id=red></b>
C:\WINDOWS\<font color=red><b>bWF1cmEgcG9ycnU</font id=red></b>
C:\Programmi\<font color=red><b>Network Monitor</font id=red></b>
==================================


Con la funzione Cerca di Windows, cerca ed elimina i seguenti file
==================================
w0181548.dll
nwnmff_e26.exe
dfndrff_e26.exe
kybrdff_e26.exe
dxclib303562752.dll
dnjo0113e.dll
==================================


Vai a PANNELLO DI CONTROLLO e clicca su OPZIONI INTERNET
nella finestra che si apre clicca i tre pulsanti
ELIMINA COOKIES - ELIMINA FILE - CANCELLA CRONOOLOGIA
poi clicca il pulsante PAGINA PREDEFINITA e su OK

al termine utilizza i programmi AD-AWARE e SPYBOT indicati in questo articolo
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=388&SH=N

sempre in modalità provvisoria fai una scansione Antivirus

quindi riavvia il computer e controlla se il problema e risolto, se e tutto OK riattiva il ripristino configurazione disattivato all'inizio di questa procedura e crea un nuovo punto di ripristino, leggi qui alla voce 8
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=170&SH=N

Fai una scansione antivirus on line da questo indirizzo
http://security.symantec.com/sscv6/default.asp?productid=globalsites&langid=it&venid=sym

Se la scansione antivirus on line rileva dei virus, non ti resta che formattare e reinstallare tutto

Utilizza questo programma
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=1041

---

Collaboratore Aiutamici

<BLOCKQUOTE id=quote><font size=1 face="Sans Serif, Arial, Helvetica" id=quote>quote:<hr height=1 noshade id=quote>
...non sono riuscito ad eliminare "023-Service:Command Service (cmdService)" nemmeno con Spybot Search,
<hr height=1 noshade id=quote></BLOCKQUOTE id=quote></font id=quote><font face="Sans Serif, Arial, Helvetica" size=2 id=quote>

Ciao, quel servizio lo puoi eliminare solo coi comandi DOS. Se ti dà errore quando digiti cmd, fai così:

Start >> Esegui, incolla la stringa <b>sc delete command.exe</b> e dai l'OK.
Fammi sapere, ciao.

---