Newsgroup: it.comp.sicurezza.windows
Titolo: Grazie per ogni aiuto

Grzie che posso fare. Si blocca, spariti i preferiti, l'antivir mi dice
che sono cambiati kernek32.dll e altri ...32.dll in system32.grazie
Questo il log che per farlo McAfee da errore di virus Exploit-MhtRedir.gen
, che ииииии? grazie a tutti
Logfile of HijackThis v1.99.0
Scan saved at 2.30.44, on 11/02/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
D:\Programmi\AVPersonal\AVGUARD.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Programmi\McAfee\McAfee VirusScan\Avsynmgr.exe
D:\Programmi\AVPersonal\AVWUPSRV.EXE
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\slserv.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Programmi\McAfee\McAfee VirusScan\VsStat.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\ZoneLabs\minilog.exe
C:\Programmi\McAfee\McAfee VirusScan\Vshwin32.exe
C:\Programmi\McAfee\McAfee VirusScan\Avconsol.exe
C:\Programmi\File comuni\Network Associates\McShield\Mcshield.exe
C:\Programmi\McAfee\McAfee VirusScan\Webscanx.exe
C:\WINNT\Explorer.EXE
D:\Programmi\Winamp\winampa.exe
C:\Programmi\McAfee\McAfee VirusScan\alogserv.exe
C:\Programmi\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
D:\Programmi\AVPersonal\AVSched32.EXE
D:\Programmi\AVPersonal\AVGNT.EXE
C:\WINNT\system32\internat.exe
C:\Programmi\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
D:\Programmi\Spyware Doctor\spydoctor.exe
D:\Programmi\BulletProofSoft.com\SpywareRemover\popup-watch\PopUpWatch.exe
C:\Program Files\InterMute\SpySubtract\SpySub.exe
C:\Programmi\Zone Labs\ZoneAlarm\zonealarm.exe
D:\Programmi\BulletProofSoft.com\SpywareRemover\popup-watch\CE97C17A.DLL
C:\WINNT\system32\wuauclt.exe
C:\WINNT\slrundll.exe
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\WINNT\system32\taskmgr.exe
D:\HiJackThis\HijackThis.exe
C:\Programmi\Internet Explorer\IEXPLORE.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.libero.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://www.libero.it
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
Collegamenti
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {1D7E3B41-23CE-469B-BE1B-A64B877923E1} -
C:\PROGRA~1\SEARCH~2\SEARCH~1.DLL
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio -
{8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
C:\WINNT\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinampAgent] D:\Programmi\Winamp\winampa.exe
O4 - HKLM\..\Run: [Alogserv] C:\Programmi\McAfee\McAfee
VirusScan\alogserv.exe
O4 - HKLM\..\Run: [McAfee Guardian] "C:\Programmi\McAfee\McAfee Shared
Components\Guardian\CMGrdian.exe" /SU
O4 - HKLM\..\Run: [Windows TaskAd] C:\Program Files\Windows
TaskAd\WinTaskAd.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [AVSCHED32] D:\Programmi\AVPersonal\AVSched32.EXE /min
O4 - HKLM\..\Run: [AVGCtrl] D:\Programmi\AVPersonal\AVGNT.EXE /min
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor]
"C:\Programmi\McAfee\McAfee Shared Components\Instant
Updater\RuLaunch.exe" /startmonitor
O4 - HKCU\..\Run: [Spyware Doctor] "D:\Programmi\Spyware
Doctor\spydoctor.exe" /Q
O4 - HKCU\..\Run: [POPUPWATCH]
D:\Programmi\BulletProofSoft.com\SpywareRemover\popup-watch\PopUpWatch.exe
/STARTUP
O4 - Global Startup: Microsoft Office.lnk = D:\Programmi\Microsoft
Office\Office\OSA9.EXE
O4 - Global Startup: SpySubtract.lnk = C:\Program
Files\InterMute\SpySubtract\SpySub.exe
O4 - Global Startup: ZoneAlarm.lnk = C:\Programmi\Zone
Labs\ZoneAlarm\zonealarm.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\WINNT\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O16 - DPF: {10003000-1000-0000-1000-000000000000} -
ms-its:mhtml:file://C:\\MAIN.MHT!
http://207.44.186.186/b/online.chm::/on-line.exe
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab
O16 - DPF: {469C7080-8EC8-43A6-AD97-45848113743C} -
http://akamai.downloadv3.com/binaries/IA/nethv32_EN.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -
http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {BB1B5064-1496-4E40-A80D-EFF7C5A953A6} (VacPro.italy_vdem) -
http://207.234.185.217/italy_vdem.CAB
O17 -
HKLM\System\CCS\Services\Tcpip\..\{BCCEC569-363E-4F6B-8D41-9243528A7954}:
NameServer = 213.92.5.54 194.20.8.1
O23 - Service: AntiVir Service - H+BEDV Datentechnik GmbH -
D:\Programmi\AVPersonal\AVGUARD.EXE
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVSync Manager - Networks Associates Technologies, Inc. -
C:\Programmi\McAfee\McAfee VirusScan\Avsynmgr.exe
O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany -
D:\Programmi\AVPersonal\AVWUPSRV.EXE
O23 - Service: Servizio amministrativo di Gestione disco logico - VERITAS
Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: McShield - Unknown - C:\Programmi\File comuni\Network
Associates\McShield\Mcshield.exe
O23 - Service: TrueVector Basic Logging Client - Zone Labs Inc. -
C:\WINNT\system32\ZoneLabs\minilog.exe
O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation -
C:\WINNT\System32\nvsvc32.exe
O23 - Service: SmartLinkService - Unknown - slserv.exe (file missing)
O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. -
C:\WINNT\system32\ZoneLabs\vsmon.exe
-- 
questo articolo e` stato inviato via web dal servizio gratuito 
http://www.newsland.it/news
 segnala gli abusi ad 
ab...@newsland.it


Curioso... ecco che succede quando clicco sul tuo post :
======================================================
Tipo scansione:  Auto-Protect Scansione
Evento:  Minaccia trovata.
Minaccia: MHTMLRedir.Exploit
File:  C:\Documents and Settings\Danny\Local Settings\Temporary Internet
Files\Content.IE5\MH3WDWZI\wbk7FC.tmp
Posizione:  C:\Documents and Settings\Danny\Local Settings\Temporary
Internet Files\Content.IE5\MH3WDWZI
Computer:  Danny
Utente:  Danny
Azione intrapresa:  Ripulisci non riuscito : Quarantena non riuscito :
Elimina riuscito : Accesso negato
Data rilevazione: Friday, February 11, 2005  7:27:14 PM
========================================================
Com'e' possibile che mi si attivi l'auto protect...?

 Com'e' possibile che mi si attivi l'auto protect...?
Proviamone uno a caso:
O16 - DPF: {10003000-1000-0000-1000-000000000000} -
ms-its:mhtml:file://C:\\MAIN.MHT!
http://207.44.186.186/b/online.chm::/on-
line.exe
-- 
Bye by V.

 
http://207.234.185.217/italy_vdem.CAB
Disinstalla tutte le scemate che ti vengono in mente, e dopo riprova.
Prima di rifare i controlli chiudi *tutti* i programmi che conosci, e
di cui ti fidi, gli antivirus e i programmi di controllo devono poter
lavorare in ambiente pulito senza interferenze, in modo da non creare
conflitti o falsi positivi (un av che se la prende con le firme di un
altro, per esempio).
-- 
Bye by V.