Spyware / Malware / Virus Removal

it_0107.exe

4 min read

Looking for the outcome? Ask AI

gino Topic Starter

Post #1January 15, 2007, 12:04 PM UTC

I have discovered to have a dialer (?) known as it_0107.exe on my home computer. I have not retried many informations on the web, about this dialer. However, I used Spyware Doctor 4.0 and Kasperky AV , but it is always in my active tasks. It takes the control of the modem and I cannot use it ! Please, help me !

LDTate

Post #2January 15, 2007, 2:06 PM UTC

Hello and Welcome to the Forum.

you can get a complete installer that installs HijackThis to C:\Program Files\HijackThis, making an entry in the start menu and also providing a desktop shortcut from http://downloads.malwareremoval.com/HJTsetup.exe.

Click on the link and select Save, save it to your desktop and double click HJTsetup.exe.

Open HijackThis and select: Do a system scan and save a log file.

When the scan is finished, Click Edit> Select All> Edit> Copy> and paste its contents here please use the [Add Reply] button below.

Please use the [external image: Posted Image] Button below to reply.

gino

Post #3January 15, 2007, 2:17 PM UTC

Many thanks LDTate: I just prepare the log as you said ! and tomorrow I will post it

LDTate

Post #4January 15, 2007, 2:17 PM UTC

gino

Post #5January 15, 2007, 10:37 PM UTC

Logfile of HijackThis v1.99.1
Scan saved at 9:41:32 , on 15/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\Programmi\Spyware Doctor\sdhelp.exe
C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\taskmgr.exe
C:\DOCUME~1\Utente\IMPOST~1\Temp\it_0107.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Programmi\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://arianna.libero.it
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.libero.it
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: edit_html Class - {14D1A72D-8705-11D8-B120-0040F46CB696} - C:\Documents and Settings\Utente\113011428.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Programmi\Spyware Doctor\swdoctor.exe" /Q
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Programmi\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.libero.it
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1098440899465
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = uniroma3.it,caspur.it
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = uniroma3.it,caspur.it
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = uniroma3.it,caspur.it
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Programmi\Spyware Doctor\sdhelp.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe

Then I performed an AVG scanner with these results:

———————————————————
AVG Anti-Spyware - Rapporto scansione
———————————————————

+ Creato alle: 10:38:58 15/01/2007

+ Risultato scansione:

C:\Documents and Settings\Utente\Impostazioni locali\Temporary Internet Files\Content.IE5\M76DUJ2L\VMessageEn2[2].htm -> Not-A-Virus.Exploit.HTML.Mht : Nessuna operazione eseguita.
:mozilla.258:C:\Documents and Settings\Utente\Dati applicazioni\Mozilla\Firefox\Profiles\c4fnfg3a.default\cookies.txt -> TrackingCookie.Casinotropez : Nessuna operazione eseguita.
C:\Documents and Settings\Antonella\Cookies\antonella@findwhat[1].txt -> TrackingCookie.Findwhat : Nessuna operazione eseguita.
C:\Documents and Settings\Utente\Cookies\utente@ivwbox[2].txt -> TrackingCookie.Ivwbox : Nessuna operazione eseguita.
:mozilla.201:C:\Documents and Settings\Utente\Dati applicazioni\Mozilla\Firefox\Profiles\c4fnfg3a.default\cookies.txt -> TrackingCookie.Weborama : Nessuna operazione eseguita.
:mozilla.202:C:\Documents and Settings\Utente\Dati applicazioni\Mozilla\Firefox\Profiles\c4fnfg3a.default\cookies.txt -> TrackingCookie.Weborama : Nessuna operazione eseguita.

::Fine rapporto

The dialer is always present (dialer.agent.k) !

LDTate help me !

LDTate

Post #6January 15, 2007, 10:41 PM UTC

Nessuna operazione eseguita.

In english, what does this mean?

You don't have a anti-virus program. Lets get a free one.

Click the HERE and Save, Install, Update and run a full scan.

Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment

gino

Post #7January 15, 2007, 10:52 PM UTC

It's AVG Anti-Spyware 7.5 in Italian version. The phrase "Nessuna operazione eseguita" is translate in "No operation".

LDTate

Post #8January 15, 2007, 10:58 PM UTC

OK. Get that anti-virus program.

gino

Post #9January 16, 2007, 9:07 AM UTC

Hi LDTate,
I start with XP(home) in SAFEMODE and run AVG Anti-Spyware. After about 1 hour, this is the report:

———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 1:16:56 16/01/2007

+ Scan result:

C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP175\A0034366.exe -> Downloader.Zlob.anj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP175\A0034367.exe -> Downloader.Zlob.anj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP175\A0034368.exe -> Downloader.Zlob.anj : Cleaned with backup (quarantined).
C:\Documents and Settings\Utente\113011428.dll -> Hijacker.Agent.hz : Cleaned with backup (quarantined).
C:\WINDOWS\system32\lzx32.sys -> Hijacker.Costrat.y : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP166\A0032938.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP166\A0032944.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP166\A0032956.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP166\A0032965.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP166\A0032971.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP166\A0032991.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP166\A0033003.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP166\A0033011.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP168\A0033088.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP168\A0033094.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP168\A0033101.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP175\A0034351.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP175\A0034357.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP175\A0034463.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP175\A0034470.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP175\A0034476.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP175\A0034482.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP175\A0034488.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP175\A0034507.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP175\A0034514.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP175\A0034539.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP176\A0034547.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP176\A0034553.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP176\A0034559.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP176\A0034565.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP176\A0035565.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP176\A0035574.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP176\A0035580.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP176\A0035586.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP176\A0035592.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP176\A0035601.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP176\A0035609.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP177\A0035650.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP177\A0035657.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP177\A0035663.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP182\A0035993.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP183\A0036004.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP183\A0036018.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP183\A0036025.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP183\A0036040.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP183\A0036047.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP183\A0036054.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP183\A0036061.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP183\A0036068.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP183\A0036075.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP183\A0036082.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP183\A0037082.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP183\A0037091.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP183\A0038091.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP183\A0038098.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP183\A0038107.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP183\A0039107.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP183\A0039122.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP183\A0039132.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP183\A0039155.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP183\A0039288.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP183\A0039741.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{5F4EA7AC-E415-4AD2-8D9F-C59E378A4F64}\RP183\A0039748.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\WINDOWS\62117167225.exe -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\WINDOWS\service32.exe -> Hijacker.Small.kj : Cleaned with backup (quarantined).
C:\WINDOWS\sys32exploer.dll -> Hijacker.Small.kj : Cleaned with backup (quarantined).

::Report end

then, I start XP in normal mode, and run Hijackthis and this is the report:

Logfile of HijackThis v1.99.1
Scan saved at 1:21:30 , on 16/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Programmi\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://arianna.libero.it
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.libero.it
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: edit_html Class - {14D1A72D-8705-11D8-B120-0040F46CB696} - C:\Documents and Settings\Utente\113011428.dll (file missing)
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Programmi\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.libero.it
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1098440899465
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = uniroma3.it,caspur.it
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = uniroma3.it,caspur.it
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = uniroma3.it,caspur.it
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe

The computer seems free but I must test it in depth !

Thanks for your pretious help!

LDTate

Post #10January 16, 2007, 9:57 PM UTC

You still have a virus onboard. You need to do this please.

Click the HERE and Save, Install, Update and run a full scan.

Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment

gino

Post #11January 17, 2007, 10:31 AM UTC

gino

Post #12January 18, 2007, 8:54 AM UTC

Hi LDTate,
I run a full scan as you told me, and this is the result:

AVG Free Edition
Program version 7.5.432
Virus base 268.16.13/634 Realese date 17/01/2007 4:45

General properties
Complete Test
No threats found
Scanning completed successfully

Object summary
Scanned 44740
Threats Found 0
Cleaned 0
Moved to vault 0
Deleted 0
Errors 0

The PC is OK and not exhibits strange behaviours. Do you think that it's all right ?
Let me know.

Bye

LDTate

Post #13January 19, 2007, 12:47 AM UTC

Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

O2 - BHO: edit_html Class - {14D1A72D-8705-11D8-B120-0040F46CB696} - C:\Documents and Settings\Utente\113011428.dll (file missing)

Close ALL windows and browsers except HijackThis and click "Fix checked"

Delete this File if listed:
C:\Documents and Settings\Utente\113011428.dll

Delete this Folder if listed:
C:\Documents and Settings\Utente

Empty Recycle Bin

Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

Please use the [external image: Posted Image] Button below to reply.

gino

Post #14January 20, 2007, 7:53 AM UTC

Ok, I run Hijackthis and this is the log

Logfile of HijackThis v1.99.1
Scan saved at 6:53:04 , on 19/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Programmi\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://arianna.libero.it
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.libero.it
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Programmi\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.libero.it
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1098440899465
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = uniroma3.it,caspur.it
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = uniroma3.it,caspur.it
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = uniroma3.it,caspur.it
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe

The file C:\Documents and Settings\Utente\113011428.dll is not present

It is not possible remove C:\Documents and Settings\Utente.

The Account windows (under Control Panel) is empty ! In my computer there are two account (Gino and Antonella), but I see in C:\Documents and Settings only Antonella and Utente. I never created the account Utente, while is missing my personal account Gino. When I start XP, there are both Gino and Antonella as login account, not Utente.
I don't understand !

Also the "search" window is completely empty !

LDTate, do you understand anything ?

Hope us ……

LDTate

Post #15January 20, 2007, 12:12 PM UTC

In the Control Panel, Open Administrative Tools> Computer Management. Under System Tools, Open Local Users and Groups> Open Users and see if Utente is listed. If so, Right Click Utente and select delete.

Open C:\Documents and Settings\Utente <–Delete Folder

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

it_0107.exe

✨ Ask AI

Ask AI