Newsgroup: it.comp.sicurezza.varie
Titolo: Problema per un Trojan credo

Ciao, mi chiamo Luca, non sono molto esperto di pc....anzi...ho 
visto ke un pò di gente ha il mio stesso problema: 
all'accensione del pc c'è una finestra di Internet Personal Zone 
che si apre e mi connette sia che schiaccio Si sia che schiaccio 
No, sea che faccio ALT+F4....
Poi 
REDFUNNY.COM
 si è impostata come pagina iniziale e se la 
tolgo si ri-imposta e ho un sacco di collegamenti a EXSPLORER 
(scritto proprio così) x tutto il pc...
ho eseguito hijackthis come ho visto fare agli altri ed ecco 
cosa  è uscito..mi sapete aiutare???e come si fa a fixare???
grazie mille x l'attenzione... ciao ciao!!!
Logfile of HijackThis v1.99.1
Scan saved at 23.17.01, on 22/08/05
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAMMI\GRISOFT\AVG6\AVGSERV9.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\ASP4TRAY.EXE
C:\MEDIASCAPE\MULTIMEDIA KEYBOARD\MMKEYBD.EXE
C:\Mediascape\OnScreen Display\OSD.exe
C:\MOUSE\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAMMI\FILE COMUNI\CMEII\CMESYS.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\SYSFIND.EXE
C:\PROGRAMMI\MICROSOFT OFFICE\OFFICE\MSOFFICE.EXE
C:\PROGRAMMI\PRECISIONTIME\PRECISIONTIME.EXE
C:\PROGRAMMI\DATE MANAGER\DATEMANAGER.EXE
C:\PROGRAMMI\WINDOWS MEDIA COMPONENTS\ENCODER\WMENCAGT.EXE
C:\PROGRAMMI\FILE COMUNI\GMT\GMT.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\DOCUMENTI\MARCO\EU VS ITALY\HIJACKTHIS\HIJACKTHIS.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page 
= 
http://www.searchgateway.net/search/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = 
www.redfunny.com?3615
R0 - HKLM\Software\Microsoft\Internet 
Explorer\Search,SearchAssistant = 
http://www.searchgateway.net/search/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,
(Default) = 
http://www.searchgateway.net/search/%s
R0 - HKCU\Software\Microsoft\Internet 
Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-
784B7D6BE0B3} - C:\PROGRAMMI\ADOBE\ACROBAT 5.0
\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-
64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN 
TOOLBAR\01.02.4000.1001\IT\MSNTB.DLL
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - 
C:\PROGRAM FILES\MSN APPS\ST\01.03.0000.1005\EN-XU\STMAIN.DLL
O2 - BHO: CDllBho Object - {5A5B6916-ED71-4531-8018-
E792DD44156E} - C:\WINDOWS\SVCHOST.DLL (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - 
C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - 
C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.4000.1001
\IT\MSNTB.DLL
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [VortexTray] ASP4TRAY.EXE
O4 - HKLM\..\Run: [Multimedia Keyboard] C:\Mediascape\Multimedia 
Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [OnScreen Display] C:\Mediascape\OnScreen 
Display\OSD.exe
O4 - HKLM\..\Run: [EM_EXEC] c:\mouse\system\em_exec.exe
O4 - HKLM\..\Run: [StillImageMonitor] 
C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [CMESys] "C:\PROGRAMMI\FILE 
COMUNI\CMEII\CMESYS.EXE"
O4 - HKLM\..\Run: [OEMCleanup] C:\WINDOWS\OPTIONS\OEMRESET.EXE
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe 
powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [AVGCtrl] 
C:\PROGRAMMI\AVPERSONAL\AVGCTRL.EXE /min
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [msnappau] "c:\program files\MSN 
Apps\Updater\01.03.0000.1005\it\msnappau.exe"
O4 - HKLM\..\Run: [JVM0.14] C:\WINAMP.EXE
O4 - HKLM\..\Run: [HDAudio Driver] C:\WINAMP.EXE
O4 - HKLM\..\Run: [HDAudio Driver 1.0] C:\WINDOWS\SYSTEM\KOOE.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe 
powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6
\Avgserv9.exe
O4 - HKCU\..\Run: [Mirabilis ICQ] C:\Programmi\ICQ\NDetect.exe
O4 - Startup: Barra degli strumenti Microsoft Office.Lnk = 
C:\Programmi\Microsoft Office\OFFICE\MSOFFICE.EXE
O4 - Startup: Ricerca rapida.lnk = C:\Programmi\Microsoft 
Office\OFFICE\FINDFAST.EXE
O4 - Startup: Adobe Gamma Loader.exe.lnk = C:\Programmi\File 
comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: GStartup.lnk = C:\Programmi\File comuni\GMT\GMT.exe
O4 - Startup: PrecisionTime.lnk = 
C:\Programmi\PrecisionTime\PrecisionTime.exe
O4 - Startup: Date Manager.lnk = C:\Programmi\Date 
Manager\DateManager.exe
O4 - Startup: Encoder Agent.lnk = C:\Programmi\Windows Media 
Components\Encoder\WMENCAGT.EXE
O4 - Startup: Trust 735S POWERC@M ZOOM Monitor.lnk = 
C:\Programmi\Trust\Trust 735S POWERC@M ZOOM\ICON.EXE
O4 - Startup: Trojan Guarder Gold Version.lnk = 
C:\Programmi\Trojan Guarder Gold Version\Trojan Guarder.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-
00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-
8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Alice - {D1FA6FC0-DC89-11D7-9776-
AFC299C7CD1F} - 
http://gw.aliceadsl.it/alice
 (file missing) 
(HKCU)
O12 - Plugin for .bmp: C:\PROGRA~1\INTERN~1
\PLUGINS\npqtplugin.dll
O12 - Plugin for .pdf: 
C:\Programmi\Netscape\Communicator\Program\PLUGINS\nppdf32.dll
O12 - Plugin for .: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O12 - Plugin for .swf: 
C:\Programmi\Netscape\Communicator\Program\PLUGINS\NPSWF32.dll
O12 - Plugin for .mov: C:\PROGRA~1\INTERN~1
\PLUGINS\npqtplugin.dll
O15 - Trusted Zone: 
www.redfunny.com
O15 - Trusted Zone: 
www.skymasters.biz
O15 - Trusted Zone: 
www.archiviosex.net
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} 
(MsnMessengerSetupDownloadControl Class) - 
http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {64311111-1111-1121-1111-111191113457} - 
file://c:\eied_s7.cab
--  
Postato da Virgilio Newsgroup: scopri i nuovi gruppi 
Eros, foto e video a 
http://newsgroup.eros.virgilio.it

 Scan saved at 23.17.01, on 22/08/05
[...]
Il risultato dell'analisi del tuo file di .log è qui:
http://www.hijackthis.de/logfiles/78d9b4f64dca9f45c3d9b62d66b8b8a7.html
Leggi e segui attentamente questo editoriale:
http://www.microsoft.com/italy/technet/community/mvp/editoriali/spyquick.mspx
"Spyware e Malware: chi ci spia? - "Fix Rapido".
Se al termine delle procedure non hai risolto il problema vai qui:
http://www.microsoft.com/italy/technet/community/mvp/editoriali/spyware.mspx
"Spyware e Malware: chi ci spia?"
... e procedi con *tutti* i passi indicati.
-- 
Vincenzo Di Russo
Microsoft® MVP - Most Valuable Professional
Windows - Internet Explorer/OE 2003/2004/2005
http://mvp.support.microsoft.com/