Newsgroup: it.comp.sicurezza.windows
Titolo: Maleware

Non riesco ad eliminare un maleware che dirotta periodicamente 
explorer su siti indesiderati. Ho usato spyware Doctor che ha 
rilevatol'esistenza di un "possible hijack website" che non 
riesce ad eliminare.
Potete aiutarmi?
Logfile of HijackThis v1.99.0
Scan saved at 10.39.44, on 24/06/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\wltrysvc.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Network Associates\VirusScan\VsStat.exe
C:\Program Files\Network Associates\VirusScan\Vshwin32.exe
C:\Program Files\Network Associates\VirusScan\Avconsol.exe
C:\Program Files\Network Associates\VirusScan\Webscanx.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\bcmwltry.exe
C:\Programmi\File comuni\Network Associates\McShield\Mcshield.exe
C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINNT\system32\carpserv.exe
C:\Programmi\QuickTime\qttask.exe
C:\Programmi\iTunes\iTunesHelper.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\Programmi\Nikon\PictureProject\NkbMonitor.exe
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\WINZIP\wzqkpick.exe
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\VANNIU\Documenti\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = 
http://sm26ris
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Internet Connection 
Wizard,ShellNext = "C:\Programmi\Outlook Express\msimn.exe"
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet 
Settings,ProxyServer = sm24ris
R0 - HKCU\Software\Microsoft\Internet 
Explorer\Toolbar,LinksFolderName = Collegamenti
O1 - Hosts: 66.250.57.252 
yahoo.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-
784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0
\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - 
C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-
D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-
17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: (no name) - {F45EC624-DD80-4CA1-8A50-6A362C107C40} - 
C:\WINNT\system32\ppbb.dll (file missing)
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI 
Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [LidPolicy] c:\Programmi\Hewlett-
Packard\LidSwitch Policy\pwrschem.exe
O4 - HKLM\..\Run: [HPWireless] 
C:\Programmi\HP\Wireless\Utility\WlanUtil.exe
O4 - HKLM\..\Run: [QuickTime 
Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] 
C:\Programmi\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - Global Startup: Microsoft Office.lnk = 
C:\Programmi\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: NkbMonitor.exe.lnk = 
C:\Programmi\Nikon\PictureProject\NkbMonitor.exe
O4 - Global Startup: WinZip Quick Pick.lnk = 
C:\Programmi\WinZip\WZQKPICK.EXE
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-
4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O15 - Trusted Zone: http://*.
iframeprofit.com/
O15 - Trusted Zone: http://*.
mycounter.biz/
O15 - Trusted Zone: http://*.
our-counter.com/
O15 - Trusted Zone: http://*.
porno-search.biz/porn/
O15 - Trusted Zone: 
http://awbeta.net-nucleus.com
 (HKLM)
O16 - DPF: {24311111-1111-1121-1111-111191113457} - 
file://c:\eied_s7.cab
O16 - DPF: {33331111-1111-1111-1111-611111193457} - 
file://c:\ex.cab
O16 - DPF: {33331111-1111-1111-1111-611111193458} - 
file://c:\ex.cab
O16 - DPF: {43331111-1111-1111-1111-611111195622} - 
file://c:\ex.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan 
Installer Class) - 
http://www.pandasoftware.com/activescan/as5/asinst.cab
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-
9F4543D34545} - C:\WINNT\system32\vbsys2.dll
O23 - Service: AVSync Manager - Unknown - C:\Program 
Files\Network Associates\VirusScan\Avsynmgr.exe
O23 - Service: Servizio amministrativo di Gestione disco logico -
 VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Servizio iPod - Apple Computer, Inc. - 
C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: McShield - Unknown - C:\Programmi\File 
comuni\Network Associates\McShield\Mcshield.exe
O23 - Service: WLTRYSVC - Unknown - C:\WINNT\System32
\wltrysvc.exe C:\WINNT\System32\bcmwltry.exe (file missing)
--  
Postato da Virgilio Newsgroup 
http://newsgroup.virgilio.it
Completo come il newsreader, ma senza il newsreader

 Potete aiutarmi?
11 passi @ 
http://www.romanelmondo.com/sugg/spy.htm
-- 
Andrea
« - » « - » « - » « - » « - »
 
www.amicideltibet.it
« - » « - » « - » « - » « - » 

 Logfile of HijackThis v1.99.0
[...]
Scarica l'ultima versione di Hijackthis, la 1.99.1:
http://www.merijn.org/files/hijackthis.zip
http://www.spywareinfo.com/~merijn/files/hijackthis.zip
Crea una nuova cartella in Documenti, che chiamerai come ti pare, scarica il
file zip lì dentro e scompattalo nella cartella stessa.
Poi lancia HJT.
Prima però ti consiglio di leggere e seguire qui:
http://www.microsoft.com/italy/technet/community/mvp/editoriali/spyware.mspx
... il computer va preparato come si deve all'esecuzione degli strumenti
antispy/malware e gli stessi vanno eseguiti nei modi descritti
nell'articolo.
--
Vincenzo Di Russo
Microsoft® MVP - Most Valuable Professional
Windows - Internet Explorer/OE 2003/2004/2005
http://mvp.support.microsoft.com/