si aprono pagine pubblicitarie su Internet Risolto/Chiuso

Question

Ciao, 

ciao a tutti e complimenti per il forum!

sto usando firefox per internet... mi spiegate perchè ogni 2 minuti mi si aprono pagine publicitarie?? come posso fermarle? grazie!!!

Configurazione: Windows 7 / Firefox 10.0.2

Entass · Accepted Answer

Grazie, ho risolto! Mi è bastato eliminare power offer (che non mi ero accorto di avere) dall'elenco programmi.

klingon666 · Answer

Ciao, 
quasi sicuramente si tratta di un'infezione. 

Scarica Hijack: http://www.trendmicro.com/ftp/products/hijackthis/HiJackThis.msi 
installalo... Avvia Hijack con tutte le applicazioni chiuse (sopratutto i browser)  
clicca su "Do a System Scan and save log file" 

Al termine, si aprirà il blocco note; 
Seleziona TUTTO il testo, ed incollalo qui che vediamo cosa c'è da rimuovere...

gattomania · Answer

se reistallo firefox non faccio prima?

klingon666 · Answer

che c'entra Firefox?
Probabilmente ti si è installato qualcosa a tua insaputa...
Se vuoi prima provare a disinstallare FF, puoi farlo, ma dovrai eliminare manualmente le varie cartelle che piazza in giro (non solo quella in programmi) ...
Dubito comunque che così la risolvi...

Al limite puoi provare a vedere se questa estensione ti blocca qualcosa:
https://addons.mozilla.org/it/firefox/addon/adblock-plus/

se non la risolve ti conviene fare una pulizia più profonda (se mi alleghi il log ti dico io come procedere)

gattomania · Answer

l'estenzsione non mi risolve niente... cosa ti devo allegare  kli?

klingon666 · Answer

Il log di Hijack che si apre nel blocco note (incollalo)
leggi il messaggio più sopra

gattomania · Answer

dopo che fa la scansione mi dice impossibile trovare il file!! e il blocco note è vuoto!!!

klingon666 · Answer

Questo è un chiaro segno di qualche infezione... 
Senti per il momento,  se vuoi segui queste istruzioni: 


Scarica Kaspersky Virus Removal Tool: (anche se hai installato un altro antivirus) 
http://devbuilds.kas...vbuilds/AVPTool 
Note : 
---- Il file richiede una registrazione, puoi usare nomi di fantasia, ma una email valida (il programma è FREE)
---- l'installer di Kaspersky Virus Removal Tool è costituito da un file di dimensioni maggiori di 100 mb: per cui, se hai una connessione lenta, armati di pazienza 
|-------------------|
Una volta scaricato ed installato il software: 
? verrà creata una cartella sul Desktop, chiamata Virus Removal Tool 
? verrà mostrata la schermata principale del tool: metti la spunta su tutte le voci disponibili
? clicca, in basso a destra, sul bottone Avvia scansione 
? terminata la scansione, in caso di rilevazione di infezioni, clicca su Neutralizza tutto 
? si apriranno delle finestre: potrai scegliere se Cancellare o Disinfettare 
? metti la spunta su Applica a tutti e clicca su Quarantena 
? clicca sul tasto Reports: salva il file di log sul Desktop, e allegalo
? alla chiusura del programma, Kaspersky Virus Removal Tool chiederà di essere rimosso: acconsenti

gattomania · Answer

il link non è valido!!!! kli...

l'embrouille 75 · Answer

Ciao  
La prima cOsa da fare e di togliere i tools bar che sono inutile (Yahoo,Google,ask...° Che non serve a niente e che ralenta il PC  
Dopo tu scarica MBAM ANTI MALWARES  BYTES;  
http://www.malwarebytes.org/mbam/program/mbam-setup.exe  
oppure si problemi:  
malwarebytes 

Non installare la toolbar proposta (Google toolbar),registra l'icona sulldesktop  
Fai gli aggiornamenti ( normalmente quando fa l'installazione si fanno automaticamente) chiudi tutte le applcazione,disconnetti internet,e lancia un esame completo,senza tocare al PC durante il lavoro del programma   
Quando l'esame e finito una finestra si apri,e tu visualizza i malwares che ilprogramma ha trovato,verificare che tutte les caselles sono  con la croche e dopo tu clica su eliminare.   
Posta mi il raporto qui per vedere cose comme infezione.  
Si il problema persiste,allora scarica TDSSkiller e segui le instuzioni !!!  
E per fare un po di pulizia scarica CCleaner e usa lo una volta a la settimana!  

L'esame completo dura un ora circa,pazienza !!!  
buona sera  
Toujours bien réfléchir avant d'agir

gattomania · Answer

fatto e risolto grazie mille!!!!!


Tipo di scansione: Scansione veloce
Opzioni di scansione attive: Memoria | Esecuzione automatica | Registro | File system | Euristica/Extra | Euristica/Shuriken | PUP | PUM
Opzioni di scansione disattivate: P2P
Elementi esaminati: 201207
Tempo impiegato: 4 minuti, 40 secondi

Processi rilevati in memoria: 2
C:\Users\Ivan\AppData\Roaming\Tuto4pc\Tuto4pc IT\UpdatetutorialsHP.exe (PUP.Tuto4PC) -> 2836 -> Verrà eliminato al riavvio.
C:\Program Files\Tuto4pc	utorials.exe (PUP.Tuto4PC) -> 2912 -> Verrà eliminato al riavvio.

Moduli di memoria rilevati: 0
(non sono stati rilevati elementi nocivi)

Chiavi di registro rilevate: 9
HKCR\CLSID\{17F433B7-24B2-4ede-A94C-9AD242CBEFFC} (PUP.Tuto4PC) -> Spostato in quarantena ed eliminato con successo.
HKCR\TutorialsBHO.TutoBHO.1 (PUP.Tuto4PC) -> Spostato in quarantena ed eliminato con successo.
HKCR\TutorialsBHO.TutoBHO (PUP.Tuto4PC) -> Spostato in quarantena ed eliminato con successo.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{17F433B7-24B2-4EDE-A94C-9AD242CBEFFC} (PUP.Tuto4PC) -> Spostato in quarantena ed eliminato con successo.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{17F433B7-24B2-4EDE-A94C-9AD242CBEFFC} (PUP.Tuto4PC) -> Spostato in quarantena ed eliminato con successo.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{17F433B7-24B2-4EDE-A94C-9AD242CBEFFC} (PUP.Tuto4PC) -> Spostato in quarantena ed eliminato con successo.
HKCR\TypeLib\{557828D1-663E-4CB4-A718-EFD2E4DADC90} (PUP.Tuto4PC) -> Spostato in quarantena ed eliminato con successo.
HKCR\Interface\{415F429B-6797-4F38-B673-D53B3D0E6C14} (PUP.Tuto4PC) -> Spostato in quarantena ed eliminato con successo.
HKLM\SOFTWARE\Tuto4pc (PUP.Tuto4PC) -> Spostato in quarantena ed eliminato con successo.

Valori di registro rilevati: 2
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce|Modulo Update (PUP.Tuto4PC) -> Dati: C:\Users\Ivan\AppData\Roaming\Tuto4pc\Tuto4pc IT\UpdateTutorialsHP.exe -runonce -> Spostato in quarantena ed eliminato con successo.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Tuto4pc (PUP.Tuto4PC) -> Dati: C:\Program Files\Tuto4pc	utorials.exe -> Spostato in quarantena ed eliminato con successo.

Voci rilevate nei dati di registro: 0
(non sono stati rilevati elementi nocivi)

Cartelle rilevate: 0
(non sono stati rilevati elementi nocivi)

File rilevati: 6
C:\Users\Ivan\AppData\Roaming\Tuto4pc\Tuto4pc IT\UpdatetutorialsHP.exe (PUP.Tuto4PC) -> Verrà eliminato al riavvio.
C:\Program Files\Tuto4pc	utorials.exe (PUP.Tuto4PC) -> Verrà eliminato al riavvio.
C:\Program Files\Tuto4pc\TutorialsBHO.dll (PUP.Tuto4PC) -> Spostato in quarantena ed eliminato con successo.
C:\Users\Ivan\AppData\Roaming\Tuto4pc\Tuto4pc IT\Updatetutorials.exe (PUP.Tuto4PC) -> Spostato in quarantena ed eliminato con successo.
C:\Users\Ivan\AppData\Local\Temp\Rar$EX00.931\Windows Loader\Windows Loader.exe (RiskWare.Tool.CK) -> Spostato in quarantena ed eliminato con successo.
C:\$Recycle.Bin\S-1-5-21-3221608747-3977969505-1130138005-1000\$RFI3ODY\KeyGen.exe (Trojan.Agent) -> Spostato in quarantena ed eliminato con successo.

(fine)

l'embrouille 75 · Answer

Ciao;
Fare come ho spiegato,nel mio post precedente : scarica MALWARE BYTES !!!
E dopo posta il raporto qui !!!
Mandi

Entass · Answer

Ciao a tutti, ho lo stesso problema delle pagine web che si aprono automaticamente. Ho fatto lo scan con HJT ed ecco il risultato. Cosa dovrei rimuovere? Grazie!

Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 19:12:25, on 20/06/2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v10.0 (10.00.9200.16611)
CHROME: 27.0.1453.110
FIREFOX: 21.0 (it)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
C:\Windows\vVX1000.exe
C:\Program Files (x86)\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Users\Enrico\AppData\Local\Sky Italia\Sky Go Player\PCShowServerPMWrapper.exe
C:\Users\Enrico\AppData\Local\Sky Italia\Sky Go Player\NDSPCShowServer.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe
C:\Program Files (x86)\AVG\AVG2012\avgtray.exe
C:\Users\Enrico\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Users\Public\Documents\Application\CurrentFile\ssadp.exe
C:\Users\Enrico\Downloads\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.uk.msn.com/HPCON/6
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Bubble Dock SurfMatch - {23AF19F7-1D5B-442c-B14C-3D1081953C94} - C:\Program Files (x86)\Nosibay\Bubble Dock\extensions\axSurfMatch.dll
O2 - BHO: AVG Do Not Track - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files (x86)\AVG\AVG2012\avgdtiex.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: Guida per l'accesso a Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O2 - BHO: DVDVideoSoft.WebPageAdjuster - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
O4 - HKLM\..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
O4 - HKLM\..\Run: [HP Software Update] c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Easybits Recovery] C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
O4 - HKLM\..\Run: [AVG_TRAY] "C:\Program Files (x86)\AVG\AVG2012\avgtray.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [NSU_agent] "C:\Program Files (x86)\Nokia\Nokia Software Updater
su3ui_agent.exe"
O4 - HKLM\..\Run: [SsroService] C:\Users\Public\Documents\Application\CurrentFile\ssadl.exe
O4 - HKLM\..\Run: [SDTray] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\Enrico\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files (x86)\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [PCShowServer] "C:\Users\Enrico\AppData\Local\Sky Italia\Sky Go Player\PCShowServerPMWrapper.exe"
O4 - HKCU\..\Run: [Bubble Dock] "C:\Users\Enrico\AppData\Roaming\Nosibay\Bubble Dock\LBubble Dock.exe" /winstartup
O4 - HKCU\..\Run: [Spybot-S&D Cleaning] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe" /autoclean
O4 - Startup: Dropbox.lnk = Enrico\AppData\Roaming\Dropbox\bin\Dropbox.exe
O4 - Startup: MagicDisc.lnk = C:\Program Files (x86)\MagicDisc\MagicDisc.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Free YouTube Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\freeytvdownloader.htm
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files (x86)\AVG\AVG2012\avgdtiex.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: ShopperReports - Compare product prices - {DB38E21A-0133-419d-92AD-ECDFD5244D6D} - C:\Program Files (x86)\ShoppingReport2\Bin\2.7.37\ShoppingReport.dll (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll
O9 - Extra button: ShopperReports - Compare travel rates - {EB620C54-E229-4942-87CE-E717109FC8C6} - C:\Program Files (x86)\ShoppingReport2\Bin\2.7.37\ShoppingReport.dll (file missing)
O9 - Extra button: Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
O9 - Extra 'Tools' menuitem: Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - Winlogon Notify: SDWinLogon - SDWinLogon.dll (file missing)
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
O23 - Service: Easybits Services for Windows (ezSharedSvc) - EasyBits Software AS - C:\Windows\System32\ezSharedSvcHost.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: HP Health Check Service - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpSC - SoftwareUpdService - C:\Users\Enrico\AppData\Local\SoftwareUpdater\SoftwareUpdService.exe
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32
etlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32
vvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Spybot-S&D 2 Scanner Service (SDScannerService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
O23 - Service: Spybot-S&D 2 Updating Service (SDUpdateService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
O23 - Service: Spybot-S&D 2 Security Center Service (SDWSCService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Ssro Service (SsroService) - SsroService - C:\Users\Enrico\AppData\Local\ServiceManager\ssro.exe
O23 - Service: Ssupd Service (SsupdService) - SsupdService - C:\Users\Enrico\AppData\Local\ssupd\ssupd.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management & Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

l'embrouille 75 · Answer

Ciao,
1: Desinstalla Spy bot che e inutile.
2: Esegui questa procedura =>https://it.ccm.net/forum/affich-62284-apertura-pagine-pubblicitarie-su-pc#1
A+ 
 
Ubuntu 13.04 Firefox 21/ Magela 3 Opera 12.15 
Toujours bien reflechir avant d'agir

Entass · Answer

Grazie per le dritte. Ho seguito tutta la procedura, di seguito c'è la scansione con adwcleaner. Quella successiva con malwarebytes non ha trovato alcun file da eliminare. Tuttavia continuano ad aprirsi pagine web pubblicitarie...

# AdwCleaner v2.303 - Logfile creato il 21/06/2013 alle 11:13:30
# Aggiornamento 08/06/2013 by Xplode
# Sistema Operativo : Windows 7 Home Premium Service Pack 1 (64 bits)
# Utente : Enrico - ENRICO-HP
# Modalità Avvio : Modalità Normale
# Eseguito da : C:\Users\Enrico\Downloads\adwcleaner.exe
# Opzioni [Elimina]


***** [Servizi] *****


***** [File / Cartelle] *****

Cartella Eliminato : C:\Program Files (x86)\Nosibay
Cartella Eliminato : C:\Program Files (x86)\TornTV.com
Cartella Eliminato : C:\ProgramData\Tarma Installer
Cartella Eliminato : C:\Users\Enrico\AppData\Local\Google\Chrome\User Data\Default\Extensions
dibdjnfmopecpmkdieinmbadjfpblof
Cartella Eliminato : C:\Users\Enrico\AppData\LocalLow\ShoppingReport2
Cartella Eliminato : C:\Users\Enrico\AppData\Roaming\dvdvideosoftiehelpers
Cartella Eliminato : C:\Users\Enrico\AppData\Roaming\Mozilla\Firefox\Profiles\qtqus7n5.default\jetpack
Cartella Eliminato : C:\Users\Enrico\AppData\Roaming\Nosibay
File Eliminato : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml
File Eliminato : C:\Users\Enrico\AppData\Roaming\Mozilla\Firefox\Profiles\qtqus7n5.default\bProtector_extensions.rdf
File Eliminato : C:\Users\Enrico\AppData\Roaming\Mozilla\Firefox\Profiles\qtqus7n5.default\searchplugins\Babylon.xml
File Eliminato : C:\Users\Enrico\AppData\Roaming\Mozilla\Firefox\Profiles\qtqus7n5.default\searchplugins\BrowserProtect.xml
File Eliminato : C:\Users\Enrico\AppData\Roaming\Mozilla\Firefox\Profiles\qtqus7n5.default\searchplugins\delta.xml
File Eliminato : C:\Users\Santa\AppData\Local\Mozilla Firefox\.autoreg

***** [Registro] *****

Chiave Eliminata : HKCU\Software\1ClickDownload
Chiave Eliminata : HKCU\Software\AppDataLow\Software\ShoppingReport2
Chiave Eliminata : HKCU\Software\BabylonToolbar
Chiave Eliminata : HKCU\Software\BI
Chiave Eliminata : HKCU\Software\DataMngr
Chiave Eliminata : HKCU\Software\DataMngr_Toolbar
Chiave Eliminata : HKCU\Software\Iminent
Chiave Eliminata : HKCU\Software\Microsoft\Internet Explorer\Explorer Bars\{BDEA95CF-F0E6-41E0-BD3D-B00F39A4E939}
Chiave Eliminata : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{23AF19F7-1D5B-442C-B14C-3D1081953C94}
Chiave Eliminata : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Chiave Eliminata : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{DB38E21A-0133-419D-92AD-ECDFD5244D6D}
Chiave Eliminata : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EB620C54-E229-4942-87CE-E717109FC8C6}
Chiave Eliminata : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{23AF19F7-1D5B-442C-B14C-3D1081953C94}
Chiave Eliminata : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Chiave Eliminata : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Chiave Eliminata : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Chiave Eliminata : HKCU\Software\Nosibay
Chiave Eliminata : HKCU\Software\ShoppingReport2
Chiave Eliminata : HKCU\Software\Softonic
Chiave Eliminata : HKCU\Software\YahooPartnerToolbar
Chiave Eliminata : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Chiave Eliminata : HKLM\Software\AVG Secure Search
Chiave Eliminata : HKLM\Software\Babylon
Chiave Eliminata : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Chiave Eliminata : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Prod.cap
Chiave Eliminata : HKLM\SOFTWARE\Classes\ShoppingReport2.IEButton
Chiave Eliminata : HKLM\SOFTWARE\Classes\ShoppingReport2.IEButton.1
Chiave Eliminata : HKLM\SOFTWARE\Classes\ShoppingReport2.IEButtonA
Chiave Eliminata : HKLM\SOFTWARE\Classes\ShoppingReport2.IEButtonA.1
Chiave Eliminata : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}
Chiave Eliminata : HKLM\SOFTWARE\Classes\TypeLib\{B035BA6B-57CD-4F72-B545-65BE465FCAF6}
Chiave Eliminata : HKLM\SOFTWARE\Classes\TypeLib\{D44FD6F0-9746-484E-B5C4-C66688393872}
Chiave Eliminata : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}
Chiave Eliminata : HKLM\SOFTWARE\Classes\TypeLib\{F244A744-534D-4A46-855F-C0C7E9F27DAA}
Chiave Eliminata : HKLM\Software\DataMngr
Chiave Eliminata : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{DB38E21A-0133-419D-92AD-ECDFD5244D6D}
Chiave Eliminata : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EB620C54-E229-4942-87CE-E717109FC8C6}
Chiave Eliminata : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Chiave Eliminata : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32
Chiave Eliminata : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS
Chiave Eliminata : HKLM\SOFTWARE\Microsoft\Tracing\IminentSetup_RASAPI32
Chiave Eliminata : HKLM\SOFTWARE\Microsoft\Tracing\IminentSetup_RASMANCS
Chiave Eliminata : HKLM\Software\ShoppingReport2
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\5908cdfe269bf41
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{23AF19F7-1D5B-442C-B14C-3D1081953C94}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3E2DFD6A-4E20-4D4C-AA8B-E1F9DBEF3C80}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{714E0876-FCEE-49CE-A429-B9AD8AEFCB56}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{030C9927-10FC-4169-97A2-55BECD5D88D8}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{0EB3F101-224A-4B2B-9E5B-DF720857529C}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A1F1ECD3-4806-44C6-A869-F0DADF11C57C}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jbpkiefagocgkmemidfngdkamloieekf
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions
dibdjnfmopecpmkdieinmbadjfpblof
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{23AF19F7-1D5B-442C-B14C-3D1081953C94}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
Chiave Eliminata : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP
Chiave Eliminata : HKLM\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Chiave Eliminata : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{030C9927-10FC-4169-97A2-55BECD5D88D8}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{0EB3F101-224A-4B2B-9E5B-DF720857529C}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{A1F1ECD3-4806-44C6-A869-F0DADF11C57C}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Chiave Eliminata : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Chiave Eliminata : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Chiave Eliminata : HKLM\SOFTWARE\Tarma Installer
Valore Eliminata : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Bubble Dock]
Valore Eliminata : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{acaa314b-eeba-48e4-ad47-84e31c44796c}]

***** [Browser Internet] *****

-\ Internet Explorer v10.0.9200.16611

[OK] Registro Pulito.

-\ Mozilla Firefox v21.0 (it)

File : C:\Users\Enrico\AppData\Roaming\Mozilla\Firefox\Profiles\qtqus7n5.default\prefs.js

C:\Users\Enrico\AppData\Roaming\Mozilla\Firefox\Profiles\qtqus7n5.default\user.js ... Eliminato !

Eliminata : user_pref("extensions.delta.admin", false);
Eliminata : user_pref("extensions.delta.aflt", "babsst");
Eliminata : user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
Eliminata : user_pref("extensions.delta.autoRvrt", "false");
Eliminata : user_pref("extensions.delta.dfltLng", "en");
Eliminata : user_pref("extensions.delta.excTlbr", false);
Eliminata : user_pref("extensions.delta.ffxUnstlRst", true);
Eliminata : user_pref("extensions.delta.id", "26b6fec00000000000006c626d720c21");
Eliminata : user_pref("extensions.delta.instlDay", "15828");
Eliminata : user_pref("extensions.delta.instlRef", "sst");
Eliminata : user_pref("extensions.delta.newTab", false);
Eliminata : user_pref("extensions.delta.prdct", "delta");
Eliminata : user_pref("extensions.delta.prtnrId", "delta");
Eliminata : user_pref("extensions.delta.rvrt", "false");
Eliminata : user_pref("extensions.delta.smplGrp", "none");
Eliminata : user_pref("extensions.delta.tlbrId", "base");
Eliminata : user_pref("extensions.delta.tlbrSrchUrl", "");
Eliminata : user_pref("extensions.delta.vrsn", "1.8.16.16");
Eliminata : user_pref("extensions.delta.vrsnTs", "1.8.16.1614:34:35");
Eliminata : user_pref("extensions.delta.vrsni", "1.8.16.16");

File : C:\Users\Santa\AppData\Roaming\Mozilla\Firefox\Profiles\v7lh12nh.default\prefs.js

[OK] File Pulito.

-\ Google Chrome v27.0.1453.110

File : C:\Users\Enrico\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File Pulito.

*************************

AdwCleaner[S1].txt - [19130 octets] - [21/06/2013 11:13:30]

########## EOF - C:\AdwCleaner[S1].txt - [19191 octets] ##########

l'embrouille 75 · Answer

Ciao,
Prova a eliminare delta search comme spiegato qui =>https://it.ccm.net/forum/affich-61300-come-eliminare-delta-sarch#3
La modalita e per Chrome,ma funziona anche per Firefox e IE !!
Cerca di eliminare Delta tramite le estenzione dello tuo browser.
A+

Entass · Answer

Dunque, avevo già eliminato settimane fa delta dalle estensioni del mio browser, e infatti ora non risulta presente. Però il problema delle pagine che si aprono continua, e solamente su chrome. Per esempio a volte con firefox e chrome aperti contemporaneamente, se apro una pagina su firefox, poi si apre automaticamente una pagina pubblicitaria su chrome...

l'embrouille 75 · Answer

Ciao,
prova a eliminare Babylon nell panello di controllo => aggiungi/eliminare .
Sino reset il browser come e spiegato qui =>http://it.ccm.net/faq/1767-resettare-il-browser
A+

Entass · Answer

Ho resettato il browser ma non è cambiato nulla purtroppo. Mentre Babylon non riesco a trovarlo, dove esattamente nel pannello di controllo? Nella lista dei programmi non c'è.

DAVIDE23 · Answer

Salve, anch'io ho il problema delle pagine che si aprono da sole durante la navigazione, ho scaricato il programma Kaspersky Virus Removal Tool, come consigliato e ho salvato il rapporto che vi allego:

Scansione automatica: processo completato 18 minuti fa   (eventi: , oggetti: 1643861, ora: 00:54:59)	
03/10/2013 15:51:33	Attività avviata			
03/10/2013 16:00:13	Rilevato: Trojan.Win32.Staser.rrj	C:\Documents and Settings\All Users\eSafe\eGdpSvc.exe		
03/10/2013 16:00:34	Rilevato: Trojan.Win32.StartPage.cdus	C:\Documents and Settings\All Users\eSafe\_eUpdate_13.3.2.2700.exe/#/PE_Patch		
03/10/2013 16:03:54	Non sottoposto a backup: Trojan.Win32.StartPage.cdus	C:\Documents and Settings\All Users\eSafe\_eUpdate_13.3.2.2700.exe		
03/10/2013 16:03:55	Errore di elaborazione	C:\Documents and Settings\All Users\Apple\Installer Cache\Apple Mobile Device Support 6.0.0.59\AppleMobileDeviceSupport.msi/AppleMobileDeviceSupport.cab/WdfCoInstaller01009.dll/data0001.res/Microsoft Kernel-Mode Driver Framework Install-v1.9-Vista.msu	Errore di lettura	
03/10/2013 16:04:09	Attività interrotta			
03/10/2013 16:33:33	Attività avviata			
03/10/2013 17:20:59	Rilevato: HEUR:Trojan.Win32.Generic	C:\Documents and Settings\___Davide___\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\87D9DZNB\pack[1].7z/bprotect.exe		
03/10/2013 17:22:11	Rilevato: HEUR:Trojan.Win32.Generic	C:\Documents and Settings\___Davide___\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\87D9DZNB\pack[1].7z/kerberos_bho.dll		
03/10/2013 17:22:14	Rilevato: HEUR:Trojan.Win32.Generic	C:\Documents and Settings\___Davide___\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\87D9DZNB\pack[1].7z/protector.dll		
03/10/2013 17:22:14	Eliminato: HEUR:Trojan.Win32.Generic	C:\Documents and Settings\___Davide___\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\87D9DZNB\pack[1].7z		
03/10/2013 17:48:12	Rilevato: Trojan.Win32.Staser.rrj	C:\Documents and Settings\___Davide___\AppData\Local\Temp\eIntaller\37DE0A77D6894ea7B82579C9A4FB73BC\eGdpSvc.exe		
03/10/2013 17:52:31	Rilevato: Trojan.Win32.StartPage.cdus	C:\Documents and Settings\___Davide___\AppData\Roaming\eUpdate\B2F7A928BDAC42c0A561D1DC84B040E7\delta-homes.exe/PE_Patch		
03/10/2013 17:54:29	Rilevato: Trojan.Win32.StartPage.cdus	C:\Documents and Settings\___Davide___\Dati applicazioni\eUpdate\B2F7A928BDAC42c0A561D1DC84B040E7\delta-homes.exe/PE_Patch		
03/10/2013 17:54:51	Eliminato: Trojan.Win32.Staser.rrj	C:\Documents and Settings\___Davide___\AppData\Local\Temp\eIntaller\37DE0A77D6894ea7B82579C9A4FB73BC\eGdpSvc.exe		
03/10/2013 17:54:56	Eliminato: Trojan.Win32.StartPage.cdus	C:\Documents and Settings\___Davide___\Dati applicazioni\eUpdate\B2F7A928BDAC42c0A561D1DC84B040E7\delta-homes.exe		
03/10/2013 17:55:02	Non eliminato: Trojan.Win32.StartPage.cdus	C:\Documents and Settings\___Davide___\AppData\Roaming\eUpdate\B2F7A928BDAC42c0A561D1DC84B040E7\delta-homes.exe	Impossibile trovare l'oggetto	
03/10/2013 18:26:17	Rilevato: Trojan.Win32.StartPage.cdus	C:\ProgramData\eSafe\_eUpdate_13.3.2.2700.exe/#/PE_Patch		
03/10/2013 18:34:27	Rilevato: Trojan.Win32.StartPage.cdus	C:\Users\All Users\eSafe\_eUpdate_13.3.2.2700.exe/#/PE_Patch		
03/10/2013 18:34:43	Eliminato: Trojan.Win32.StartPage.cdus	C:\ProgramData\eSafe\_eUpdate_13.3.2.2700.exe		
03/10/2013 18:34:56	Non eliminato: Trojan.Win32.StartPage.cdus	C:\Users\All Users\eSafe\_eUpdate_13.3.2.2700.exe	Impossibile trovare l'oggetto	
03/10/2013 21:15:10	Rilevato: Hoax.WMA.GetCodec.a	D:\Incoming\Lady Gaga - You And I(2).mp3		
03/10/2013 22:17:39	Eliminato: Hoax.WMA.GetCodec.a	D:\Incoming\Lady Gaga - You And I(2).mp3		
04/10/2013 01:17:21	Attività interrotta			
04/10/2013 12:56:12	Attività avviata			
04/10/2013 13:51:11	Attività completata			
Disinfetta minacce attive: processo completato 21 ore fa   (eventi: , oggetti: 6596, ora: 00:19:07)	
03/10/2013 16:23:01	Attività completata			
03/10/2013 16:07:49	Da eliminare al riavvio del sistema: Trojan.Win32.Staser.rrj	C:\ProgramData\eSafe\eGdpSvc.exe		
03/10/2013 16:07:05	Rilevato: Trojan.Win32.Staser.rrj	C:\ProgramData\eSafe\eGdpSvc.exe		
03/10/2013 16:04:14	Da eliminare al riavvio del sistema: Trojan.Win32.Staser.rrj	C:\Documents and Settings\All Users\eSafe\eGdpSvc.exe		
03/10/2013 16:03:55	Rilevato: Trojan.Win32.Staser.rrj	C:\Documents and Settings\All Users\eSafe\eGdpSvc.exe		
03/10/2013 16:03:54	Attività avviata			


Attendo vostre indicazioni, grazie.

l'embrouille 75 · Answer

Ciao,
Hai riavviato il PC ???
Come va adesso ??,ce ancora pagine publicitare ??
A+

anthonywandji · Answer

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:48:54, on 07/10/2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.16384)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\lsm\lsm.exe
C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files (x86)\Microsoft Encarta\Microsoft Encarta 2007 - Premium DVD\EDICT.EXE
C:\Users\wandji\Desktop\uTorrent.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Users\wandji\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
C:\Users\wandji\AppData\Local\Akamai
etsession_win.exe
C:\Users\wandji\AppData\Local\Akamai
etsession_win.exe
C:\Users\wandji\AppData\Roaming\BrowserCompanion	cbhn.exe
C:\Program Files (x86)\Iminent\Iminent.exe
C:\Program Files (x86)\Iminent\Iminent.Messengers.exe
C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files (x86)\Internet Explorer\IELowutil.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Users\wandji\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.isearch123.com/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=hp&from=newgdp&uid=ST3320418AS_9VMM8EY1XXXX9VMM8EY1&ts=1380369413
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?scope=web&mkt=fr-FR{searchTerms}
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?scope=web&mkt=fr-FR{searchTerms}
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0410&m=imedia_s3810&r=17360212n306pe4d5v145y67k2270q
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.isearch123.com/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=hp&from=newgdp&uid=ST3320418AS_9VMM8EY1XXXX9VMM8EY1&ts=1380369413
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr/?gws_rd=ssl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.sweetim.com/?st=5&barid={698F6EC0-6595-4753-9503-ED4E6F8C5A5C}
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = https://www.bing.com/?scope=web&mkt=fr-FR{searchTerms}
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://www.bing.com/?scope=web&mkt=fr-FR{searchTerms}
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.22find.com/web/?utm_source=b&utm_medium=mlv&from=mlv&uid=ST3320418AS_9VMM8EY1XXXX9VMM8EY1&ts=1361550412
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://search.22find.com/web/?utm_source=b&utm_medium=mlv&from=mlv&uid=ST3320418AS_9VMM8EY1XXXX9VMM8EY1&ts=1361550412
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:56847
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
F2 - REG:system.ini: UserInit=userinit.exe
O1 - Hosts: 95.131.232.195 www.goldwinpoker.com
O1 - Hosts: 95.131.232.195 goldwinpoker.com
O1 - Hosts: 195.149.220.212 live.goldbet.com
O1 - Hosts: 95.131.232.195 goldbet.com
O1 - Hosts: 195.149.220.210 secure.goldbet.com
O1 - Hosts: 91.213.212.163 livecasino.goldbet.com
O1 - Hosts: 195.149.220.209 gbservice.goldbet.com
O1 - Hosts: 195.149.220.99 mail.goldbetmail.com
O1 - Hosts: 195.149.220.99 mail.goldbet.com
O1 - Hosts: 195.149.220.209 affiliates.goldbet.com
O1 - Hosts: 195.149.220.209 old.goldbet.com
O1 - Hosts: 66.212.226.169 partners.goldbet.com
O1 - Hosts: 195.149.220.209 ced.goldbet.com
O1 - Hosts: 195.149.220.210 marketing.goldbet.com
O1 - Hosts: 195.149.220.209 goldwinportal.com
O1 - Hosts: 195.149.220.209 www.goldwinportal.com
O1 - Hosts: 195.149.220.209 www.betxpro.com
O1 - Hosts: 95.131.232.195 www25.goldbet.com
O1 - Hosts: 95.131.232.195 www35.goldbet.com
O1 - Hosts: 195.149.220.210 content.goldbet.com
O1 - Hosts: 195.149.220.209 www.goalsmania.com
O1 - Hosts: 195.149.220.94 agentclient2.ntdll.net
O1 - Hosts: 195.149.220.94 agentclient.ntdll.net
O1 - Hosts: 95.131.232.195 www.goldbet.com
O1 - Hosts: 195.149.220.212 www.goldbetsports.com
O1 - Hosts: 95.131.232.195 casino.goldbet.com
O1 - Hosts: 95.131.232.195 www.casino.goldbet.com
O1 - Hosts: 95.131.232.195 poker.goldbet.com
O1 - Hosts: 95.131.232.195 www.poker.goldbet.com
O1 - Hosts: 195.149.220.210 ssh.goldbet.com
O1 - Hosts: 195.149.220.94 gbagentclient.selfip.com
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: PriceGong - {1631550F-191D-4826-B069-D9439253D926} - (no file)
O2 - BHO: Ask Toolbar BHO - {41545534-2D56-3700-76A7-7A786E7484D7} - "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ATU4-V7\Passport.dll" (file missing)
O2 - BHO: (no name) - {5d79f641-c168-40df-a32f-bacea7509e75} - (no file)
O2 - BHO: Adblock IE - {667BEE43-20BD-4CE3-94AC-E63E04D4B191} - C:\Program Files (x86)\MGTEK\Adblock IE\adblockie.dll
O2 - BHO: Incredibar.com Helper Object - {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} - C:\Program Files (x86)\Incredibar.com\incredibar\1.5.11.14\bh\incredibar.dll (file missing)
O2 - BHO: Funmoods Helper Object - {75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Guida per l'accesso a Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - (no file)
O2 - BHO: Video Clip Grab - {9b53772a-8259-495d-a6b2-fa5966fe52e1} - (no file)
O2 - BHO: DataMngr - {9D717F81-9148-4f12-8568-69135F087DB0} - (no file)
O2 - BHO: IMinent WebBooster - {A09AB6EB-31B5-454C-97EC-9B294D92EE2A} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (file missing)
O2 - BHO: Norton Identity Protection - {AB4C7833-A6EC-433f-B9FE-6B14B1A2F836} - C:\Program Files (x86)\Norton Identity Safe\Engine\2013.1.0.32\coIEPlg.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: (no name) - {cb41fc95-f1b3-4797-8bb6-1012ff62abba} - (no file)
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {99079a25-328f-4bd4-be04-00955acaa0a7} - (no file)
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
O3 - Toolbar: (no name) - !{98889811-442D-49dd-99D7-DC866BE87DBC} - (no file)
O3 - Toolbar: Norton Identity Safe Toolbar - {A13C2648-91D4-4bf3-BC6D-0079707C4389} - C:\Program Files (x86)\Norton Identity Safe\Engine\2013.1.0.32\coIEPlg.dll
O3 - Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - (no file)
O3 - Toolbar: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O3 - Toolbar: Ask Toolbar - {41545534-2D56-3700-76A7-7A786E7484D7} - "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ATU4-V7\Passport.dll" (file missing)
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (file missing)
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [Iminent] C:\Program Files (x86)\Iminent\Iminent.exe /warmup "F77F87E5-A6BD-4922-A530-EDF63D7E9F8C"
O4 - HKLM\..\Run: [IminentMessenger] C:\Program Files (x86)\Iminent\Iminent.Messengers.exe /startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files (x86)\Real\RealPlayer\updateealsched.exe"  -osboot
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [ApnTBMon] "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [E07IXLRD_10131703] "C:\Program Files (x86)\Microsoft Encarta\Microsoft Encarta 2007 - Premium DVD\EDICT.EXE" -m
O4 - HKCU\..\Run: [uTorrent] "C:\Users\wandji\Desktop\uTorrent.exe"  /MINIMIZED
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\PROGRA~2\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [SSync] "C:\Users\wandji\AppData\Roaming\SSync\SSync.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [DataMgr] "C:\Users\wandji\AppData\Roaming\DataMgr\DataMgr.exe"
O4 - HKCU\..\Run: [Bubble Dock] "C:\Users\wandji\AppData\Roaming\Nosibay\Bubble Dock\LBubble Dock.exe" /winstartup
O4 - HKCU\..\Run: [Facebook Update] "C:\Users\wandji\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
O4 - HKCU\..\Run: [SCheck] "C:\Users\wandji\AppData\Roaming\SCheck\SCheck.exe" check 
O4 - HKCU\..\Run: [Snoozer] "C:\Users\wandji\AppData\Roaming\Snz\Snz.exe"
O4 - HKCU\..\Run: [Intermediate] "C:\Users\wandji\AppData\Roaming\Intermediate\Intermediate.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [Spotify] "C:\Users\wandji\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart
O4 - HKCU\..\Run: [Spotify Web Helper] "C:\Users\wandji\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
O4 - HKCU\..\Run: [Akamai NetSession Interface] "C:\Users\wandji\AppData\Local\Akamai
etsession_win.exe"
O4 - Startup: Monitora avvisi inchiostro - HP Deskjet 3050A J611 series.lnk = ?
O4 - Startup: tcbhn.lnk = C:\Users\wandji\AppData\Roaming\BrowserCompanion	cbhn.exe
O8 - Extra context menu item: Cerca nel web - C:\Program Files (x86)\SweetIM\Toolbars\Internet Exploreresources\menuext.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Translate this web page with Babylon - res://C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm
O8 - Extra context menu item: Translate with Babylon - res://C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Barra di ricerca di Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files (x86)\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O17 - HKLM\System\CCS\Services\Tcpip\..\{3EB164DD-D2EE-426A-8B21-C27CEC2FAC39}: NameServer = 8.8.8.8,8.8.4.4
O17 - HKLM\System\CS1\Services\Tcpip\..\{3EB164DD-D2EE-426A-8B21-C27CEC2FAC39}: NameServer = 8.8.8.8,8.8.4.4
O17 - HKLM\System\CS2\Services\Tcpip\..\{3EB164DD-D2EE-426A-8B21-C27CEC2FAC39}: NameServer = 8.8.8.8,8.8.4.4
O17 - HKLM\System\CS3\Services\Tcpip\..\{3EB164DD-D2EE-426A-8B21-C27CEC2FAC39}: NameServer = 8.8.8.8,8.8.4.4
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Active File Monitor V8 (AdobeActiveFileMonitor8.0) - Adobe Systems Incorporated - c:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Servizio di aggiornamento Ask (APNMCP) - APN LLC. - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
O23 - Service: Auto Update Service (AUS) - MS - C:\Program Files (x86)\lsm\aus.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: avast! Firewall - AVAST Software - C:\Program Files\AVAST Software\Avast\afwServ.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GRegService (Greg_Service) - Acer Incorporated - C:\Program Files (x86)\Packard Bell\Registration\GregHSRW.exe
O23 - Service: Servizio Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Servizio Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Unknown owner - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: IB Updater - Unknown owner - C:\Program Files\IB Updater\ExtensionUpdaterService.exe
O23 - Service: IBUpdaterService - Unknown owner - C:\Windows\system32\dmwu.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Login Session Manager (LSM) - MS - C:\Program Files (x86)\lsm\lsm.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Norton Identity Safe (NCO) - Symantec Corporation - C:\Program Files (x86)\Norton Identity Safe\Engine\2013.1.0.32\ccSvcHst.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: @%SystemRoot%\System32
etlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32
vvsvc.exe (file missing)
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype C2C Service - Skype Technologies S.A. - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: Software Upd (SoftwareUpd) - SoftwareUpdService - C:\Users\wandji\AppData\Local\SoftwareUpdater\SoftwareUpdService.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision
vSCPAPISvr.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Updater Service - Acer Group - C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe
O23 - Service: USBS3S4Detection - Unknown owner - C:\OEM\USBDECTION\USBS3S4Detection.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: WinZiper service (winzipersvc) - Taiwan Shui Mu Chih Ching Technology Limited. - C:\Program Files (x86)\WinZipper\winzipersvc.exe
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: Wsys Service (WsysSvc) - Wsys Co., Ltd. - C:\ProgramData\eSafe\eGdpSvc.exe

l'embrouille 75 · Answer

Ciao,
quale antivirus usi ?? Si e Avast tu devi togliere tutti componenti di Norton.
Start=>panello di controllo=>aggiungi/cancella programi=>cancellare tutti i componenti di Norton che trovi nell elenco .
Dopo fare come spiegato qui=>https://it.ccm.net/forum/affich-62284-apertura-pagine-pubblicitarie-su-pc#1
Posta i report qui .
A+

n00r · Answer

Il thread è stato chiuso dato che diventa quasi illeggibile con tutti questi report Hijackthis

Si prega di iniziare il suo proprio thread cliccando QUI

Si aprono pagine pubblicitarie su Internet

24 risposte

Discussioni simili