Newsgroup: it.comp.sicurezza.windows
Titolo: IE che vuole accedere continuamente2°

Salve faccio un nuovo post per vedere se finiscono le polemiche sulle 
sensorialità---
Dunque come detto ho eliminato manualmente i 2 file incriminati ma c'è 
ancora qualcosa che non va , posto il nuovo file dei log di hijack 
....individuate qualcosa??
------------------------------------------------------------------------------------
Logfile of HijackThis v1.99.1
Scan saved at 23.35.08, on 16/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\crypserv.exe
C:\WINDOWS\system32\lkcitdl.exe
C:\WINDOWS\system32\lkads.exe
C:\WINDOWS\system32\lktsrv.exe
C:\Program Files\National Instruments\MAX\nimxs.exe
C:\Program Files\National Instruments\Shared\Security\nidmsrv.exe
C:\WINDOWS\system32\nisvcloc.exe
C:\Program Files\National Instruments\Shared\Tagger\tagsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~2\MOZILL~1\FIREFOX.EXE
C:\unzipped\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = 
http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Adobe PDF Reader Link Helper - 
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 
7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - 
C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {73564B28-68BB-477A-8951-B9481500ABCD} - 
C:\WINDOWS\system32\cmpbk32d.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - 
C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program 
Files\Java\jre1.5.0_10\bin\jusched.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~2\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone 
Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [hldrrr] C:\WINDOWS\system32\hldrrr.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [hldrrr] C:\WINDOWS\system32\hldrrr.exe
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Program 
Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - 
C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - 
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program 
Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - 
C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - 
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program 
Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - 
http://by104fd.bay104.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - 
http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1164333656183
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - 
http://download.zonelabs.com/bin/promotions/spywaredetector/ICSScanner371270.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - 
http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - 
C:\PROGRA~2\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - 
C:\PROGRA~2\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - 
C:\PROGRA~2\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - 
C:\PROGRA~2\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - 
C:\PROGRA~2\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - 
C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: FreeSCADA: Archiver - FreeSCADA project 
(
http://sourceforge.net/projects/free-scada
) - C:\Program Files\Free 
SCADA\ArchiverService.exe
O23 - Service: FreeSCADA: Database Accessor - FreeSCADA project 
(
http://sourceforge.net/projects/free-scada
) - C:\Program Files\Free 
SCADA\DBAccessor.exe
O23 - Service: Lookout Citadel Server (LkCitadelServer) - National 
Instruments, Inc. - C:\WINDOWS\system32\lkcitdl.exe
O23 - Service: National Instruments PSP Server Locator (lkClassAds) - 
National Instruments, Inc. - C:\WINDOWS\system32\lkads.exe
O23 - Service: National Instruments Time Synchronization (lkTimeSync) - 
National Instruments, Inc. - C:\WINDOWS\system32\lktsrv.exe
O23 - Service: NI Configuration Manager (mxssvr) - National Instruments 
Corporation - C:\Program Files\National Instruments\MAX\nimxs.exe
O23 - Service: National Instruments Domain Service (NIDomainService) - 
National Instruments, Inc. - C:\Program Files\National 
Instruments\Shared\Security\nidmsrv.exe
O23 - Service: NILM License Manager - Macrovision Corporation - C:\Program 
Files\National Instruments\Shared\License Manager\Bin\lmgrd.exe
O23 - Service: NI Service Locator (niSvcLoc) - National Instruments Corp. - 
C:\WINDOWS\system32\nisvcloc.exe
O23 - Service: National Instruments Variable Engine (NITaggerService) - 
National Instruments, Inc. - C:\Program Files\National 
Instruments\Shared\Tagger\tagsrv.exe
O23 - Service: OpcEnum - OPC Foundation - C:\WINDOWS\system32\OpcEnum.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - 
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe

 C:\WINDOWS\SYSTEM32\crypserv.exe
Vedi qui: 
http://www.auditmypc.com/process/crypserv.asp
*Istruzioni*
- Stampa questo post e tienilo pronto affianco alla tastiera.
- Lancia di nuovo Hijackthis e seleziona con attenzione solo le caselle di
controllo a lato di ogni singola voce che ti ho indicato sopra, quindi premi
il pulsante *Fix checked*.
- Lascia che HJT esegua la pulizia, se non riesce del tutto, riavvia il
computer, lancia ancora una volta HJT, seleziona le stesse caselle di
controllo o quelle rimanenti rispetto alla precedente scansione e premi di
nuovo il pulsante *Fix checked*.
- Una volta terminata l'operazione di disinfezione di Hijackthis, apri
Pannello di controllo -> Opzioni internet -> Programmi -> premi il pulsante
"Ripristina impostazioni web" -> OK.
Poi... Opzioni internet -> Avanzate -> premi il pulsante "Ripristina
predefinite" -> OK.
- Start -> Esegui -> digita %temp% -> OK.
Elimina tutto il contenuto della cartella Temp.
Svuota il Cestino.
Riavvia il computer.
-- 
Vincenzo Di Russo
Microsoft® MVP - Most Valuable Professional
Windows - Internet Explorer since 2003
My home: 
http://mvp.support.microsoft.com/
My Blog:  
http://blogs.dotnethell.it/vincent/