Aiutamici Forum
Benvenuto Ospite Cerca | Topic Attivi | Utenti | | Log In | Registra

Aiutamici Forum » FORUM - Istruzioni e Guide » Sicurezza VIRUS » SPYBOT-COME ELIMINARE FILE IN MEMORIA?

SPYBOT-COME ELIMINARE FILE IN MEMORIA? Opzioni
Topic Precedente · Topic Sucessivo
bagiuli
Inviato: Monday, January 10, 2005 9:59:00 AM
Rank: Member

Iscritto dal : 1/7/2005
Posts: 0
SCUSATE SE RISCRIVO MA DOPO AVER FATTO PARTIRE IL PROGRAMMA ALLA FINE MI VIENE DATO IL SEGUENTE MESSAGGIO:
ALCUNI PROBLEMI NON POSSONO ESSERE CORRETTI.
IL MOTIVO POTREBBE RISIEDERE NEL FATTO CHE I FILE INTERESSATI SONO ANCORA CARICATI IN MEMORIA.
CIO POTREBBE ESSERE CORRETTO CON UN RIAVVIO.
DICENDO SI PER ESEGUIRE AUTOMATICAMENTE SPYBOT AL RIAVVIO IL PROBLEMA PERSISTE.
QUALCUNO MI PUò AIUTARE?
GRAZIE!!
Torna in alto
 
Sponsor
Inviato: Monday, January 10, 2005 9:59:00 AM

 
Torna in alto
 
alfonso
Inviato: Monday, January 10, 2005 10:51:22 AM

Rank: AiutAmico

Iscritto dal : 10/5/2000
Posts: 19,132
Riavvia il sistema in Modalità provvisoria, leggi qui come fare
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=344&SH=N
e lancia Spybot, ti consiglio di usare anche Ad-aware, i problemi che non vede uno lo vede l'altro
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=878

Edited by - alfonso on 01/10/2005 10:52:00
Collaboratore Aiutamici
Torna in alto
 
bagiuli
Inviato: Monday, January 10, 2005 11:10:44 AM
Rank: Member

Iscritto dal : 1/7/2005
Posts: 0
Grazie alfonso, ma lo avevo già fatto; ma il messaggio continua a persistere.
Torna in alto
 
alfonso
Inviato: Monday, January 10, 2005 2:15:41 PM

Rank: AiutAmico

Iscritto dal : 10/5/2000
Posts: 19,132
Scarica questo programma e leggi l'articolo
http://www.aiutamici.com/software/descrizione.asp?CodSw=1175

inoltre, oltre al log, specifica il file o la voce che compare in spybot.
Collaboratore Aiutamici
Torna in alto
 
bagiuli
Inviato: Tuesday, January 11, 2005 8:02:44 AM
Rank: Member

Iscritto dal : 1/7/2005
Posts: 0
In spybot compare ISearch Tech.Side Find
il report che mi hai richiesto è:
Logfile of HijackThis v1.99.0
Scan saved at 21.01.16, on 10/01/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\AVPersonal\AVGUARD.EXE
C:\Programmi\AVPersonal\AVWUPSRV.EXE
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\rsvp.exe
C:\WINDOWS\System32\mpsvc.exe
C:\WINDOWS\System32\msc32.exe
C:\WINDOWS\System32\wuaurlt.exe
C:\WINDOWS\System32\carpserv.exe
C:\Programmi\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Programmi\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Programmi\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Programmi\QuickTime\qttask.exe
C:\WINDOWS\System32\wupdmgr32.exe
C:\WINDOWS\System32\msrpc32.exe
C:\Program Files\Windows AdService\WinAdServ.exe
C:\WINDOWS\eaqaf.exe
C:\WINDOWS\System32\rundll32.exe
C:\vixen.exe
C:\WINDOWS\System32\tasksys.exe
C:\Programmi\AVPersonal\AVGNT.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\winmedplay.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmi\Messenger\msmsgs.exe
C:\WINDOWS\System32\msrpc32.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Documents and Settings\utente\Impostazioni locali\Temp\Directory temporanea 1 per hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.virgilio.it/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.rossoalice.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - Default URLSearchHook is missing
O2 - BHO: Search Relevancy - {1D7E3B41-23CE-469B-BE1B-A64B877923E1} - C:\PROGRA~1\SEARCH~1\SEARCH~1.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Programmi\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Programmi\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Programmi\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Programmi\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Windows Update Manager for NT] wupdmgr32.exe
O4 - HKLM\..\Run: [Cryptographic Service] C:\WINDOWS\System32\xhjiuf.exe
O4 - HKLM\..\Run: [Windows media service] crsss.exe
O4 - HKLM\..\Run: [MS Remote Procedure Call] msrpc32.exe
O4 - HKLM\..\Run: [Windows AdService] C:\Program Files\Windows AdService\WinAdServ.exe
O4 - HKLM\..\Run: [XtoAPxk] C:\WINDOWS\eaqaf.exe
O4 - HKLM\..\Run: [*windows update] wuaurlt.exe
O4 - HKLM\..\Run: [Internet Explorer] rsvp.exe
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [Services] C:\vixen.exe
O4 - HKLM\..\Run: [MP Services] mpsvc.exe
O4 - HKLM\..\Run: [System Update] C:\WINDOWS\System32\idpeu.exe
O4 - HKLM\..\Run: [start uploading] smsss.exe
O4 - HKLM\..\Run: [Windows Taskbar System] tasksys.exe
O4 - HKLM\..\Run: [AVGCtrl] "C:\Programmi\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [Starting up] wvsvc.exe
O4 - HKLM\..\Run: [System Failure Statistic] cnstat.exe
O4 - HKLM\..\Run: [OEM32 Tools] sres32.exe
O4 - HKLM\..\Run: [NvCplScan] msc32.exe
O4 - HKLM\..\Run: [¢‰¸#44‘ÙX.¦Á „î' UC:\Programmi\ISTsvc\istsvc.exe] C:\WINDOWS\eaqaf.exe
O4 - HKLM\..\Run: [Microsofts MediaScope] winmedplay.exe
O4 - HKLM\..\RunServices: [Windows Update Manager for NT] wupdmgr32.exe
O4 - HKLM\..\RunServices: [Windows media service] crsss.exe
O4 - HKLM\..\RunServices: [MS Remote Procedure Call] msrpc32.exe
O4 - HKLM\..\RunServices: [*windows update] wuaurlt.exe
O4 - HKLM\..\RunServices: [Internet Explorer] rsvp.exe
O4 - HKLM\..\RunServices: [MP Services] mpsvc.exe
O4 - HKLM\..\RunServices: [Windows Taskbar System] tasksys.exe
O4 - HKLM\..\RunServices: [Starting up] wvsvc.exe
O4 - HKLM\..\RunServices: [start uploading] smsss.exe
O4 - HKLM\..\RunServices: [System Failure Statistic] cnstat.exe
O4 - HKLM\..\RunServices: [OEM32 Tools] sres32.exe
O4 - HKLM\..\RunServices: [NvCplScan] msc32.exe
O4 - HKLM\..\RunServices: [Microsofts MediaScope] winmedplay.exe
O4 - HKLM\..\RunOnce: [Internet Explorer] rsvp.exe
O4 - HKLM\..\RunOnce: [MP Services] mpsvc.exe
O4 - HKLM\..\RunOnce: [NvCplScan] msc32.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msdev] msdev.exe
O4 - HKCU\..\Run: [MS Remote Procedure Call] msrpc32.exe
O4 - HKCU\..\Run: [Internet Explorer] rsvp.exe
O4 - HKCU\..\Run: [*windows update] wuaurlt.exe
O4 - HKCU\..\Run: [MP Services] mpsvc.exe
O4 - HKCU\..\Run: [Starting up] wvsvc.exe
O4 - HKCU\..\Run: [System Failure Statistic] cnstat.exe
O4 - HKCU\..\Run: [OEM32 Tools] sres32.exe
O4 - HKCU\..\Run: [NvCplScan] msc32.exe
O4 - HKCU\..\RunOnce: [NvCplScan] msc32.exe
O4 - HKCU\..\RunOnce: [MP Services] mpsvc.exe
O4 - HKCU\..\RunOnce: [Internet Explorer] rsvp.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Exif Launcher.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php?bt=ie&p=cd2fbe64bf91b4428c08390455b592e94f7eec43abbf0b8d6f2ce3602feaed959657b3f15b6842e0c23d92d15a71da3103fcbc411a1345372ee2843e8165b44272:1cd0efda5339ac97bbda8f616b0d1788
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1097405378249
O23 - Service: Adobe LM Service - Unknown - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir Service - H+BEDV Datentechnik GmbH - C:\Programmi\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany - C:\Programmi\AVPersonal\AVWUPSRV.EXE
O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SmartLinkService - Unknown - slserv.exe (file missing)

Grazie in anticipo.
Torna in alto
 
bagiuli
Inviato: Tuesday, January 11, 2005 8:04:27 AM
Rank: Member

Iscritto dal : 1/7/2005
Posts: 0
In spybot compare ISearch Tech.Side Find
il report che mi hai richiesto è:
Logfile of HijackThis v1.99.0
Scan saved at 21.01.16, on 10/01/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\AVPersonal\AVGUARD.EXE
C:\Programmi\AVPersonal\AVWUPSRV.EXE
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\rsvp.exe
C:\WINDOWS\System32\mpsvc.exe
C:\WINDOWS\System32\msc32.exe
C:\WINDOWS\System32\wuaurlt.exe
C:\WINDOWS\System32\carpserv.exe
C:\Programmi\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Programmi\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Programmi\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Programmi\QuickTime\qttask.exe
C:\WINDOWS\System32\wupdmgr32.exe
C:\WINDOWS\System32\msrpc32.exe
C:\Program Files\Windows AdService\WinAdServ.exe
C:\WINDOWS\eaqaf.exe
C:\WINDOWS\System32\rundll32.exe
C:\vixen.exe
C:\WINDOWS\System32\tasksys.exe
C:\Programmi\AVPersonal\AVGNT.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\winmedplay.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmi\Messenger\msmsgs.exe
C:\WINDOWS\System32\msrpc32.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Documents and Settings\utente\Impostazioni locali\Temp\Directory temporanea 1 per hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.virgilio.it/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.rossoalice.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - Default URLSearchHook is missing
O2 - BHO: Search Relevancy - {1D7E3B41-23CE-469B-BE1B-A64B877923E1} - C:\PROGRA~1\SEARCH~1\SEARCH~1.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Programmi\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Programmi\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Programmi\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Programmi\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Windows Update Manager for NT] wupdmgr32.exe
O4 - HKLM\..\Run: [Cryptographic Service] C:\WINDOWS\System32\xhjiuf.exe
O4 - HKLM\..\Run: [Windows media service] crsss.exe
O4 - HKLM\..\Run: [MS Remote Procedure Call] msrpc32.exe
O4 - HKLM\..\Run: [Windows AdService] C:\Program Files\Windows AdService\WinAdServ.exe
O4 - HKLM\..\Run: [XtoAPxk] C:\WINDOWS\eaqaf.exe
O4 - HKLM\..\Run: [*windows update] wuaurlt.exe
O4 - HKLM\..\Run: [Internet Explorer] rsvp.exe
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [Services] C:\vixen.exe
O4 - HKLM\..\Run: [MP Services] mpsvc.exe
O4 - HKLM\..\Run: [System Update] C:\WINDOWS\System32\idpeu.exe
O4 - HKLM\..\Run: [start uploading] smsss.exe
O4 - HKLM\..\Run: [Windows Taskbar System] tasksys.exe
O4 - HKLM\..\Run: [AVGCtrl] "C:\Programmi\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [Starting up] wvsvc.exe
O4 - HKLM\..\Run: [System Failure Statistic] cnstat.exe
O4 - HKLM\..\Run: [OEM32 Tools] sres32.exe
O4 - HKLM\..\Run: [NvCplScan] msc32.exe
O4 - HKLM\..\Run: [¢‰¸#44‘ÙX.¦Á „î' UC:\Programmi\ISTsvc\istsvc.exe] C:\WINDOWS\eaqaf.exe
O4 - HKLM\..\Run: [Microsofts MediaScope] winmedplay.exe
O4 - HKLM\..\RunServices: [Windows Update Manager for NT] wupdmgr32.exe
O4 - HKLM\..\RunServices: [Windows media service] crsss.exe
O4 - HKLM\..\RunServices: [MS Remote Procedure Call] msrpc32.exe
O4 - HKLM\..\RunServices: [*windows update] wuaurlt.exe
O4 - HKLM\..\RunServices: [Internet Explorer] rsvp.exe
O4 - HKLM\..\RunServices: [MP Services] mpsvc.exe
O4 - HKLM\..\RunServices: [Windows Taskbar System] tasksys.exe
O4 - HKLM\..\RunServices: [Starting up] wvsvc.exe
O4 - HKLM\..\RunServices: [start uploading] smsss.exe
O4 - HKLM\..\RunServices: [System Failure Statistic] cnstat.exe
O4 - HKLM\..\RunServices: [OEM32 Tools] sres32.exe
O4 - HKLM\..\RunServices: [NvCplScan] msc32.exe
O4 - HKLM\..\RunServices: [Microsofts MediaScope] winmedplay.exe
O4 - HKLM\..\RunOnce: [Internet Explorer] rsvp.exe
O4 - HKLM\..\RunOnce: [MP Services] mpsvc.exe
O4 - HKLM\..\RunOnce: [NvCplScan] msc32.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msdev] msdev.exe
O4 - HKCU\..\Run: [MS Remote Procedure Call] msrpc32.exe
O4 - HKCU\..\Run: [Internet Explorer] rsvp.exe
O4 - HKCU\..\Run: [*windows update] wuaurlt.exe
O4 - HKCU\..\Run: [MP Services] mpsvc.exe
O4 - HKCU\..\Run: [Starting up] wvsvc.exe
O4 - HKCU\..\Run: [System Failure Statistic] cnstat.exe
O4 - HKCU\..\Run: [OEM32 Tools] sres32.exe
O4 - HKCU\..\Run: [NvCplScan] msc32.exe
O4 - HKCU\..\RunOnce: [NvCplScan] msc32.exe
O4 - HKCU\..\RunOnce: [MP Services] mpsvc.exe
O4 - HKCU\..\RunOnce: [Internet Explorer] rsvp.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Exif Launcher.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php?bt=ie&p=cd2fbe64bf91b4428c08390455b592e94f7eec43abbf0b8d6f2ce3602feaed959657b3f15b6842e0c23d92d15a71da3103fcbc411a1345372ee2843e8165b44272:1cd0efda5339ac97bbda8f616b0d1788
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1097405378249
O23 - Service: Adobe LM Service - Unknown - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir Service - H+BEDV Datentechnik GmbH - C:\Programmi\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany - C:\Programmi\AVPersonal\AVWUPSRV.EXE
O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SmartLinkService - Unknown - slserv.exe (file missing)

Grazie in anticipo.
Torna in alto
 
bagiuli
Inviato: Tuesday, January 11, 2005 8:05:24 AM
Rank: Member

Iscritto dal : 1/7/2005
Posts: 0
In spybot compare ISearch Tech.Side Find
il report che mi hai richiesto è:
Logfile of HijackThis v1.99.0
Scan saved at 21.01.16, on 10/01/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\AVPersonal\AVGUARD.EXE
C:\Programmi\AVPersonal\AVWUPSRV.EXE
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\rsvp.exe
C:\WINDOWS\System32\mpsvc.exe
C:\WINDOWS\System32\msc32.exe
C:\WINDOWS\System32\wuaurlt.exe
C:\WINDOWS\System32\carpserv.exe
C:\Programmi\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Programmi\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Programmi\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Programmi\QuickTime\qttask.exe
C:\WINDOWS\System32\wupdmgr32.exe
C:\WINDOWS\System32\msrpc32.exe
C:\Program Files\Windows AdService\WinAdServ.exe
C:\WINDOWS\eaqaf.exe
C:\WINDOWS\System32\rundll32.exe
C:\vixen.exe
C:\WINDOWS\System32\tasksys.exe
C:\Programmi\AVPersonal\AVGNT.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\winmedplay.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmi\Messenger\msmsgs.exe
C:\WINDOWS\System32\msrpc32.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Documents and Settings\utente\Impostazioni locali\Temp\Directory temporanea 1 per hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.virgilio.it/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.rossoalice.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - Default URLSearchHook is missing
O2 - BHO: Search Relevancy - {1D7E3B41-23CE-469B-BE1B-A64B877923E1} - C:\PROGRA~1\SEARCH~1\SEARCH~1.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Programmi\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Programmi\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Programmi\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Programmi\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Windows Update Manager for NT] wupdmgr32.exe
O4 - HKLM\..\Run: [Cryptographic Service] C:\WINDOWS\System32\xhjiuf.exe
O4 - HKLM\..\Run: [Windows media service] crsss.exe
O4 - HKLM\..\Run: [MS Remote Procedure Call] msrpc32.exe
Torna in alto
 
alfonso
Inviato: Tuesday, January 11, 2005 4:08:43 PM

Rank: AiutAmico

Iscritto dal : 10/5/2000
Posts: 19,132
Ciao ,
esegui queste operazioni

1) Disattiva il ripristino di configurazione, leggi qui come fare
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=257&SH=N

2) riavvia in modalità provvisoria, leggi qui come fare
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=344&SH=N

apri HIJAC THIS ed elimina come indicato in questo articolo
http://www.aiutamici.com/software/descrizione.asp?CodSw=1175
le righe che seguono, (nel caso le righe da eliminare non compaiono in modalità provvisoria, eliminale dalla modalità normale e riavvia il computer).

==================================
O2 - BHO: Search Relevancy - {1D7E3B41-23CE-469B-BE1B-A64B877923E1} - C:\PROGRA~1\SEARCH~1\SEARCH~1.DLL
-
O4 - HKLM\..\Run: [Windows Update Manager for NT] wupdmgr32.exe
O4 - HKLM\..\Run: [Cryptographic Service] C:\WINDOWS\System32\xhjiuf.exe
O4 - HKLM\..\Run: [Windows media service] crsss.exe
O4 - HKLM\..\Run: [MS Remote Procedure Call] msrpc32.exe
O4 - HKLM\..\Run: [Windows AdService] C:\Program Files\Windows AdService\WinAdServ.exe
O4 - HKLM\..\Run: [XtoAPxk] C:\WINDOWS\eaqaf.exe
O4 - HKLM\..\Run: [*windows update] wuaurlt.exe
-
O4 - HKLM\..\Run: [Services] C:\vixen.exe
O4 - HKLM\..\Run: [MP Services] mpsvc.exe
O4 - HKLM\..\Run: [System Update] C:\WINDOWS\System32\idpeu.exe
O4 - HKLM\..\Run: [start uploading] smsss.exe
O4 - HKLM\..\Run: [Windows Taskbar System] tasksys.exe
-
O4 - HKLM\..\Run: [Starting up] wvsvc.exe
O4 - HKLM\..\Run: [System Failure Statistic] cnstat.exe
O4 - HKLM\..\Run: [OEM32 Tools] sres32.exe
O4 - HKLM\..\Run: [NvCplScan] msc32.exe
O4 - HKLM\..\Run: [¢‰¸#44‘ÙX.¦Á „î' UC:\Programmi\ISTsvc\istsvc.exe] C:\WINDOWS\eaqaf.exe
O4 - HKLM\..\Run: [Microsofts MediaScope] winmedplay.exe
O4 - HKLM\..\RunServices: [Windows Update Manager for NT] wupdmgr32.exe
O4 - HKLM\..\RunServices: [Windows media service] crsss.exe
O4 - HKLM\..\RunServices: [MS Remote Procedure Call] msrpc32.exe
O4 - HKLM\..\RunServices: [*windows update] wuaurlt.e-
O4 - HKLM\..\RunServices: [MP Services] mpsvc.exe
O4 - HKLM\..\RunServices: [Windows Taskbar System] tasksys.exe
O4 - HKLM\..\RunServices: [Starting up] wvsvc.exe
O4 - HKLM\..\RunServices: [start uploading] smsss.exe
O4 - HKLM\..\RunServices: [System Failure Statistic] cnstat.exe
O4 - HKLM\..\RunServices: [OEM32 Tools] sres32.exe
O4 - HKLM\..\RunServices: [NvCplScan] msc32.exe
O4 - HKLM\..\RunServices: [Microsofts MediaScope] winmedplay.exe
-
O4 - HKLM\..\RunOnce: [MP Services] mpsvc.exe
O4 - HKLM\..\RunOnce: [NvCplScan] msc32.exe
-
O4 - HKCU\..\Run: [msdev] msdev.exe
O4 - HKCU\..\Run: [MS Remote Procedure Call] msrpc32.exe
-
O4 - HKCU\..\Run: [*windows update] wuaurlt.exe
O4 - HKCU\..\Run: [MP Services] mpsvc.exe
O4 - HKCU\..\Run: [Starting up] wvsvc.exe
O4 - HKCU\..\Run: [System Failure Statistic] cnstat.exe
O4 - HKCU\..\Run: [OEM32 Tools] sres32.exe
O4 - HKCU\..\Run: [NvCplScan] msc32.exe
O4 - HKCU\..\RunOnce: [NvCplScan] msc32.exe
O4 - HKCU\..\RunOnce: [MP Services] mpsvc.exe
==================================

Con la funzione TROVA di Windows, cerca ed elimina questi file,

==================================
mpsvc.exe
msc32.exe
wuaurlt.exe
wupdmgr32.exe
msrpc32.exe
WinAdServ.exe
eaqaf.exe
vixen.exe
tasksys.exe
winmedplay.exe
SEARCH~1.DLL
xhjiuf.exe
crsss.exe
msrpc32.exe
wuaurlt.exe
idpeu.exe
smsss.exe
wvsvc.exe
cnstat.exe
sres32.exe
msc32.exe
istsvc.exe
msdev.exe
==================================

al termine utilizza i programma AD-AWARE e SPYBOT indicati in questo articolo
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=388&SH=N

sempre in modalità provvisoria fai una scansione Antivirus

quindi riavvia il computer e controlla se il problema e risolto, se e tutto OK riattiva il ripristino configurazione disattivato all'inizio di questa procedura.
Collaboratore Aiutamici
Torna in alto
 
bagiuli
Inviato: Wednesday, January 12, 2005 8:09:28 AM
Rank: Member

Iscritto dal : 1/7/2005
Posts: 0
<BLOCKQUOTE id=quote><font size=1 face="Sans Serif, Arial, Helvetica" id=quote>quote:<hr height=1 noshade id=quote>
Ciao ,
esegui queste operazioni

1) Disattiva il ripristino di configurazione, leggi qui come fare
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=257&SH=N

2) riavvia in modalità provvisoria, leggi qui come fare
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=344&SH=N

apri HIJAC THIS ed elimina come indicato in questo articolo
http://www.aiutamici.com/software/descrizione.asp?CodSw=1175
le righe che seguono, (nel caso le righe da eliminare non compaiono in modalità provvisoria, eliminale dalla modalità normale e riavvia il computer).

==================================
O2 - BHO: Search Relevancy - {1D7E3B41-23CE-469B-BE1B-A64B877923E1} - C:\PROGRA~1\SEARCH~1\SEARCH~1.DLL
-
O4 - HKLM\..\Run: [Windows Update Manager for NT] wupdmgr32.exe
O4 - HKLM\..\Run: [Cryptographic Service] C:\WINDOWS\System32\xhjiuf.exe
O4 - HKLM\..\Run: [Windows media service] crsss.exe
O4 - HKLM\..\Run: [MS Remote Procedure Call] msrpc32.exe
O4 - HKLM\..\Run: [Windows AdService] C:\Program Files\Windows AdService\WinAdServ.exe
O4 - HKLM\..\Run: [XtoAPxk] C:\WINDOWS\eaqaf.exe
O4 - HKLM\..\Run: [*windows update] wuaurlt.exe
-
O4 - HKLM\..\Run: [Services] C:\vixen.exe
O4 - HKLM\..\Run: [MP Services] mpsvc.exe
O4 - HKLM\..\Run: [System Update] C:\WINDOWS\System32\idpeu.exe
O4 - HKLM\..\Run: [start uploading] smsss.exe
O4 - HKLM\..\Run: [Windows Taskbar System] tasksys.exe
-
O4 - HKLM\..\Run: [Starting up] wvsvc.exe
O4 - HKLM\..\Run: [System Failure Statistic] cnstat.exe
O4 - HKLM\..\Run: [OEM32 Tools] sres32.exe
O4 - HKLM\..\Run: [NvCplScan] msc32.exe
O4 - HKLM\..\Run: [¢‰¸#44‘ÙX.¦Á „î' UC:\Programmi\ISTsvc\istsvc.exe] C:\WINDOWS\eaqaf.exe
O4 - HKLM\..\Run: [Microsofts MediaScope] winmedplay.exe
O4 - HKLM\..\RunServices: [Windows Update Manager for NT] wupdmgr32.exe
O4 - HKLM\..\RunServices: [Windows media service] crsss.exe
O4 - HKLM\..\RunServices: [MS Remote Procedure Call] msrpc32.exe
O4 - HKLM\..\RunServices: [*windows update] wuaurlt.e-
O4 - HKLM\..\RunServices: [MP Services] mpsvc.exe
O4 - HKLM\..\RunServices: [Windows Taskbar System] tasksys.exe
O4 - HKLM\..\RunServices: [Starting up] wvsvc.exe
O4 - HKLM\..\RunServices: [start uploading] smsss.exe
O4 - HKLM\..\RunServices: [System Failure Statistic] cnstat.exe
O4 - HKLM\..\RunServices: [OEM32 Tools] sres32.exe
O4 - HKLM\..\RunServices: [NvCplScan] msc32.exe
O4 - HKLM\..\RunServices: [Microsofts MediaScope] winmedplay.exe
-
O4 - HKLM\..\RunOnce: [MP Services] mpsvc.exe
O4 - HKLM\..\RunOnce: [NvCplScan] msc32.exe
-
O4 - HKCU\..\Run: [msdev] msdev.exe
O4 - HKCU\..\Run: [MS Remote Procedure Call] msrpc32.exe
-
O4 - HKCU\..\Run: [*windows update] wuaurlt.exe
O4 - HKCU\..\Run: [MP Services] mpsvc.exe
O4 - HKCU\..\Run: [Starting up] wvsvc.exe
O4 - HKCU\..\Run: [System Failure Statistic] cnstat.exe
O4 - HKCU\..\Run: [OEM32 Tools] sres32.exe
O4 - HKCU\..\Run: [NvCplScan] msc32.exe
O4 - HKCU\..\RunOnce: [NvCplScan] msc32.exe
O4 - HKCU\..\RunOnce: [MP Services] mpsvc.exe
==================================

Con la funzione TROVA di Windows, cerca ed elimina questi file,

==================================
mpsvc.exe
msc32.exe
wuaurlt.exe
wupdmgr32.exe
msrpc32.exe
WinAdServ.exe
eaqaf.exe
vixen.exe
tasksys.exe
winmedplay.exe
SEARCH~1.DLL
xhjiuf.exe
crsss.exe
msrpc32.exe
wuaurlt.exe
idpeu.exe
smsss.exe
wvsvc.exe
cnstat.exe
sres32.exe
msc32.exe
istsvc.exe
msdev.exe
==================================

al termine utilizza i programma AD-AWARE e SPYBOT indicati in questo articolo
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=388&SH=N

sempre in modalità provvisoria fai una scansione Antivirus

quindi riavvia il computer e controlla se il problema e risolto, se e tutto OK riattiva il ripristino configurazione disattivato all'inizio di questa procedura.
<hr height=1 noshade id=quote></BLOCKQUOTE id=quote></font id=quote><font face="Sans Serif, Arial, Helvetica" size=2 id=quote>
Torna in alto
 
bagiuli
Inviato: Wednesday, January 12, 2005 8:10:59 AM
Rank: Member

Iscritto dal : 1/7/2005
Posts: 0
SEI UN MITO !!!
Eliminato definitamente il problema.
Grazie mille ancora.
Ciao.
Torna in alto
 
Utenti presenti in questo topic
Guest

Aiutamici Forum » FORUM - Istruzioni e Guide » Sicurezza VIRUS » SPYBOT-COME ELIMINARE FILE IN MEMORIA?


Salta al Forum
Aggiunta nuovi Topic disabilitata in questo forum.
Risposte disabilitate in questo forum.
Eliminazione tuoi Post disabilitata in questo forum.
Modifica dei tuoi post disabilitata in questo forum.
Creazione Sondaggi disabilitata in questo forum.
Voto ai sondaggi disabilitato in questo forum.

Main Forum RSS : RSS

Aiutamici Theme
Powered by Yet Another Forum.net versione 1.9.1.8 (NET v2.0) - 3/29/2008
Copyright © 2003-2008 Yet Another Forum.net. All rights reserved.