Newsgroup: it.comp.sicurezza.varie
Titolo: ntnut.exe

qualcuno mi sa dire se questo ntnut è parte di windows o se è qualcosa
che mi son beccato? tre giorni fa mi son trovato a "combattere" con
una marea di ad-aware (e non capisco a cosa mi servano antivirus,
firewall, ad-aware e tanta tanta cautela!) e da allora windows si apre
dicendo che questo ntnut.exe non trova rtl70.bpl.  suggerimenti?
oltretutto ora explorer si apre su
"res://C:\WINDOWS\system32\shdocpe.dll/security.htm#subID=BSW;677"
(cioè su un file che sul computer NON C'E') e non c'è verso di fargli
cambiare idea. ho analizzato tutto con ad-aware, norton antivirus, tau
scan e spybot S&D. non so più cosa fare!!!!
M2

intanto mi rispondo da solo perchè subito dopo avervi scritto ho
trovato questo:
"Description:
This memory-resident Trojan adds several adult-related sites to the
favorites folder of the Web browser. It also adds a folder called
ADULT STORE, which contains its dropped sites or URLs, to the
favorites folder.
In addition, it changes the home page of the Web browser into a
particular site. It also deletes specific files, such as 
NOTEPAD.COM
and SYSTIME.EXE, if they exist on a system.
An indication that the machine has been affected by this Trojan is the
presence of the following files in the Windows system folder:
NTNUT.EXE – an exact copy of itself 
SHDOCPE.DLL - contains the .HTML file, which is the assigned home page
of the browser 
It runs on Windows 95, 98, ME, NT, 2000, and XP.
Solution:
Terminating the Malware Program 
This procedure terminates the running malware process. 
Open Windows Task Manager.
» On Windows 95, 98, and ME, press
CTRL+ALT+DELETE
» On Windows NT, 2000, and XP, press
CTRL+SHIFT+ESC, then click the Processes tab. 
In the list of running programs*, locate the process:
NTNUT.EXE 
Select the malware process, then press either the End Task or the End
Process button, depending on the version of Windows on your system. 
To check if the malware process has been terminated, close Task
Manager, and then open it again. 
Close Task Manager. 
--------------------------------------------------------------------------------
*NOTE: On systems running Windows 95, 98, and ME, Windows Task Manager
may not show certain processes. You can use a third party process
viewer such as Process Explorer to terminate the malware process.
Otherwise, continue with the next procedure, noting additional
instructions. 
Removing Autostart Entries from the Registry 
Removing autostart entries from the registry prevents the malware from
executing at startup. 
Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>
Windows>CurrentVersion>Run 
In the right panel, locate and delete the entry:
Fast start = "C:\WINNT\system32\ntnut.exe home" 
Close Registry Editor.
--------------------------------------------------------------------------------
NOTE: If you were not able to terminate the malware process as
described in the previous procedure, restart your system. 
Additional Windows ME/XP Cleaning Instructions 
Users running Windows ME and XP must disable System Restore to allow
full scanning of infected systems. 
Users running other Windows versions can proceed with the succeeding
procedure set(s). "
explorer ancora fa i capricci, ma qualcosa si farà.
accetto comunque suggerimenti!
Grazie
M2

explorer ha cambiato pagina, ora mi da un motore di ricerca, ma nella
barra non compare alcun nome;  penso sia 
oz.msie.tv
 e poi
vattelappesca, almeno i collegamenti finiscono tutti in quella zona
lě! boh?
M2

 lì! boh?
Ti consiglio di non 'giocare a mosca cieca' con questa robaccia ;-)
http://www.microsoft.com/italy/technet/community/mvp/editoriali/spyware.mspx
Fai le cose per bene, con metodo ed utilizzando gli strumenti appropriati.
Scarica ed usa anche CWShredder Version 2.1 di Intermute:
http://www.intermute.com/spysubtract/cwshredder_download.html
(non è indicato nell'articolo di cui sopra).
--
Vincenzo Di Russo
Microsoft® MVP - Windows - Internet Explorer/OE
http://support.microsoft.com/newsgroups
http://mvp.support.microsoft.com/


http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_STARTPAG.C