Newsgroup: it.comp.sicurezza.windows
Titolo: [Explore7] Apertura pagina non attinente e pubblicità

Ciao a tutti, è un pò di tempo che sto "impazzendo" perchè mi succedono due 
cose un pò strane, la prima:
dopo una ricerca in internet (di solito con Google), quando faccio click su 
un risultato mi si apre una pagina in tedesco (
cdrohlinge-24.de
), altre 
volte sembra la pagina di ricerca di google ma sempre in tedesco o giù di li 
(non ho mai controllato con precisione).
La seconda cosa che mi succede è questa:
Possibile che 99 siti su 100 che visito hanno come pubblicità un sito porno? 
Sempre lo stesso? (
enormousdating.com
)
Ho provato oltre con l'antivirus Trend Micro e Windows Defender, ad usare 
Ad-Aware SE Professional, ma alla fine non è cambiato nulla.
Avete qualche suggerimento?
Grazie mille in anticipo 

 wrote in message,
hJXeh.75424$
Fk1.2...@twister2.libero.it

fai una scansione con hijackthis
e posta qui il log.
-- 
Edoardo Benussi - 
e...@mvps.org
Microsoft® MVP - Windows Server
http://mvp.support.microsoft.com
 


Ok grazie mille, ecco qui il file di log:
Logfile of HijackThis v1.99.1
Scan saved at 19.57.12, on 10/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\Trend Micro\OfficeScan Client\pccntmon.exe
C:\Programmi\CyberLink\PowerCinema\PCMService.exe
C:\Programmi\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programmi\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0C2.EXE
C:\Programmi\Java\jre1.5.0_09\bin\jusched.exe
C:\Programmi\Trend Micro\OfficeScan Client\tmlisten.exe
C:\Programmi\iTunes\iTunesHelper.exe
C:\Programmi\Windows Defender\MSASCui.exe
C:\Programmi\FuzLez\WheelsOfVolume\WheelsOfVolume.exe
C:\Programmi\Remote Master\Remote Master.exe
C:\WINDOWS\system32\devldr32.exe
C:\Programmi\ATI Technologies\ATI.ACE\CLI.EXE
C:\Programmi\File comuni\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\LAVASOFT\AD-AWA~2\Ad-Watch.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Microsoft ActiveSync\wcescomm.exe
C:\Programmi\Skype\Phone\Skype.exe
C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe
C:\Programmi\WebWasher\wwasher.exe
C:\WINDOWS\system32\UAService7.exe
C:\Programmi\Logitech\SetPoint\SetPoint.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Programmi\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
C:\Programmi\File comuni\Ahead\Lib\NMIndexStoreSvr.exe
C:\Programmi\File comuni\Logitech\khalshared\KHALMNPR.EXE
C:\WINDOWS\TEMP\RY6973.EXE
C:\Programmi\iPod\bin\iPodService.exe
C:\Programmi\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\Programmi\ATI Technologies\ATI.ACE\cli.exe
C:\Programmi\ATI Technologies\ATI.ACE\cli.exe
D:\eMule\emule.exe
C:\Programmi\Trend Micro\OfficeScan Client\Pop3Trap.exe
C:\Programmi\DAP\DAP.EXE
C:\Programmi\Nero\Nero 7\Core\nero.exe
C:\totalcmd\TOTALCMD.EXE
C:\Programmi\Outlook Express\msimn.exe
C:\Programmi\Internet Explorer\iexplore.exe
G:\Scarica\Ad-Aware\hijackthis_199\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = 
http://www.google.it/ig?hl=it
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = 
http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = 
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet 
Settings,AutoConfigURL = 
http://127.0.0.1:8080/proxyconf
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
Collegamenti
R3 - URLSearchHook: Yahoo! Toolbar - 
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - 
C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - 
C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - 
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 
7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {3AD60099-D92E-4EAB-9D4E-C49A0B505E14} - 
C:\WINDOWS\system32\msjdntld.dll
O2 - BHO: (no name) - {598F4775-6FB6-477B-9842-E0426824E077} - 
C:\DOCUME~1\MARCOS~1\IMPOST~1\Temp\~DPBA.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - 
C:\Programmi\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - 
c:\programmi\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - 
c:\programmi\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - 
C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Programmi\Trend 
Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [PCMService] 
"C:\Programmi\CyberLink\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programmi\Zone 
Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Programmi\DAEMON 
Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe 
bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [QuickTime Task] 
"C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [EPSON Stylus C64 Series] 
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0C2.EXE /P23 "EPSON Stylus 
C64 Series" /O6 "USB001" /M "Stylus C64"
O4 - HKLM\..\Run: [SunJavaUpdateSched] 
"C:\Programmi\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [System Files Updater] C:\WINDOWS\FlyakiteOSX\Tools\System 
Files Updater.exe /S
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Programmi\Windows 
Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [FuzLez WheelsOfVolume] 
"C:\Programmi\FuzLez\WheelsOfVolume\WheelsOfVolume.exe"
O4 - HKLM\..\Run: [Remote Master] C:\Programmi\Remote Master\Remote 
Master.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmi\File 
comuni\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Programmi\ATI 
Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] 
C:\PROGRA~1\FILECO~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Programmi\File 
comuni\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programmi\Adobe\Photoshop 
Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [AWMON] "C:\PROGRA~1\LAVASOFT\AD-AWA~2\Ad-Watch.exe"
O4 - HKLM\..\Run: [I downloaded pirated Software from P2P] Neverwinter 
Nights 2
O4 - HKCU\..\Run: [swg] 
C:\Programmi\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programmi\Microsoft 
ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [Skype] "C:\Programmi\Skype\Phone\Skype.exe" /nosplash 
/minimized
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] 
"C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [WebWasher] C:\Programmi\WebWasher\wwasher.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = 
C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Clean Traces - C:\Programmi\DAP\Privacy 
Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - 
C:\Programmi\DAP\dapextie.htm
O8 - Extra context menu item: Add to filterlist (WebWasher) - 
http://-Web.Washer-/ie_add
O8 - Extra context menu item: Download &all with DAP - 
C:\Programmi\DAP\dapextie2.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - 
res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - 
C:\Programmi\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - 
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - 
C:\Programmi\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - 
{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - 
C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Crea preferito portatile... - 
{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - 
C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - 
%windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - 
{e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network 
Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage 
Validation Tool) - 
http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - 
http://us.dl1.yimg.com/download.yahoo.com/dl/yinst/yinst_current.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - 
http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1164223876859
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 
1.5.0) - 
http://javadl-esd.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586-jc.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - 
C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision 
Corporation - C:\Programmi\File comuni\InstallShield\Driver\1050\Intel 
32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - 
C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service 
(LightScribeService) - Hewlett-Packard Company - C:\Programmi\File 
comuni\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Programmi\Nero\Nero 7\Nero 
BackItUp\NBService.exe
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - 
C:\Programmi\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro 
Inc. - C:\Programmi\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - 
C:\Programmi\Trend Micro\OfficeScan Client\tmlisten.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown 
owner - C:\WINDOWS\system32\UAService7.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - 
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
Lo so che non serve ma volvo mettere anche questa, che mi è successo mentro 
cercavo il programma hijackthis, quando ho cliccato sul link di google mi ha 
aperto questa pagina in tedesco.
http://www.google.com/custom?q=hijackthis&sa=Suche&client=pub-8650468150261464&forid=1&channel=&ie=ISO-8859-1&oe=ISO-8859-1&cof=GALT%3A%23008000%3BGL%3A1%3BDIV%3A%23336699%3BVLC%3A663399%3BAH%3Acenter%3BBGC%3AFFFFFF%3BLBGC%3A336699%3BALC%3A0000FF%3BLC%3A0000FF%3BT%3A000000%3BGFNT%3A0000FF%3BGIMP%3A0000FF%3BFORID%3A1%3B&hl=de
 

 Nights 2
fix
dopo aver fixato questi riavvia il pc
e prova  anavigare.
ciao.


 ciao.
Grazie mille, adesso provo a riavviare, tedendo le dita incrociate.. :)
Ciao e grazie ancora.