| Autore |
 Discussione  |
|
Worf
Senior Member
Cittą: Roma
140 Messaggi |
Inserito il - 17/11/2005 : 13:46:36
|
Ciao potete dare anche una controllata al mio logfile
Logfile of HijackThis v1.99.1
Scan saved at 13.40.41, on 17/11/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\AVPersonal\AVWUPSRV.EXE
C:\Programmi\ewido\security suite\ewidoctrl.exe
C:\PROGRA~1\Agnitum\OUTPOS~1.0\outpost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\File comuni\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Programmi\AVPersonal\AVSched32.EXE
C:\Programmi\Java\jre1.5.0\bin\jusched.exe
C:\Programmi\AVPersonal\AVGNT.EXE
C:\Programmi\MessengerPlus! 3\MsgPlus.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
C:\Programmi\ADSL\StarModem ADSL USB MODEM\dslmon.exe
C:\Programmi\FotoStation Easy\FotoStation Easy AutoLaunch.exe
C:\Programmi\Nikon\NkView5\NkvMon.exe
C:\PROGRAMMI\AVPERSONAL\AVGUARD.EXE
C:\Programmi\File comuni\Softwin\BitDefender Scan Server\bdss.exe
c:\progra~1\softwin\bitdef~1\bdmcon.exe
C:\Programmi\MSN Messenger\msnmsgr.exe
C:\Programmi\PeerGuardian2\pg2.exe
C:\Programmi\eMule\emule.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrator\Documenti\programmi importanti\Nuova cartella\HijackThis.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [AVSCHED32] C:\Programmi\AVPersonal\AVSched32.EXE /min
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [AVGCtrl] "C:\Programmi\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Programmi\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [Outpost Firewall] C:\PROGRA~1\Agnitum\OUTPOS~1.0\outpost.exe /waitservice
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programmi\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
O4 - HKLM\..\Run: [BDNewsAgent] C:\PROGRA~1\Softwin\BITDEF~1\bdnagent.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: DSLMON.lnk = ?
O4 - Global Startup: FotoStation Easy AutoLaunch.lnk = ?
O4 - Global Startup: LG SyncManager.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programmi\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NkvMon.exe.lnk = C:\Programmi\Nikon\NkView5\NkvMon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_02\bin\npjpi150_02.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - htt*://messenger.zone.msn[.com]/binary/msgrchkr .cab31267 .cab
O16 - DPF: {1EDF25DE-DFB2-40CA-AA83-30AE7DA8C203} (FileSharingCtrl Class) - htt*://appdirectory.messenger.msn[.com]/AppDirectory/P4Apps/FileSharing/it/filesharingctrl .cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - htt*://messenger.zone.msn[.com]/binary/MessengerStatsClient .cab31267 .cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - htt*://messenger.zone.msn[.com]/binary/SolitaireShowdown .cab31267 .cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{185E5DF8-B541-4A35-8484-45D468BF9DC9}: NameServer = 193.70.152.15 193.70.152.25
O17 - HKLM\System\CS1\Services\Tcpip\..\{185E5DF8-B541-4A35-8484-45D468BF9DC9}: NameServer = 193.70.152.15 193.70.152.25
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\PROGRAMMI\AVPERSONAL\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programmi\AVPersonal\AVWUPSRV.EXE
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Programmi\File comuni\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programmi\ewido\security suite\ewidoctrl.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum - C:\PROGRA~1\Agnitum\OUTPOS~1.0\outpost.exe
O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Programmi\File comuni\Softwin\BitDefender Communicator\xcommsvr.exe
|
 |
|
|
n/a
deleted
Cittą: eh eh ti piacerebbe saperlo
2419 Messaggi |
Inserito il - 17/11/2005 : 13:56:02
|
fixa dalla provvisoria...:
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - htt*://messenger.zone.msn[.com]/binary/msgrchkr .cab31267 .cab
O16 - DPF: {1EDF25DE-DFB2-40CA-AA83-30AE7DA8C203} (FileSharingCtrl Class) - htt*://appdirectory.messenger.msn[.com]/AppDirectory/P4Apps/FileSharing/it/filesharingctrl .cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - htt*://messenger.zone.msn[.com]/binary/MessengerStatsClient .cab31267 .cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - htt*://messenger.zone.msn[.com]/binary/SolitaireShowdown .cab31267 .cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
togli dall'avvio automatico con reg cleaner o ccleaner o in ms config avvio:
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: DSLMON.lnk = ?
O4 - Global Startup: FotoStation Easy AutoLaunch.lnk = ?
O4 - Global Startup: LG SyncManager.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programmi\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NkvMon.exe.lnk = C:\Programmi\Nikon\NkView5\NkvMon.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
poi ti sconsiglio di usare messenger...mettere l'sp2...e cambiare browser..scarica mozilla firefox htt*://[www].pianetapc.it/downloads.php?id=66
e togli qualsiasi toolbar tu abbia installato..
ciaoooo
|
|
|
|
Worf
Senior Member
Cittą: Roma
140 Messaggi |
Inserito il - 17/11/2005 : 14:06:57
|
Grazie per la risposta, gia'uso firefox da molto tempo  |
|
|
|
n/a
deleted
Cittą: eh eh ti piacerebbe saperlo
2419 Messaggi |
 Inserito il - 17/11/2005 : 14:08:16
|
C:\Programmi\Mozilla Firefox\firefox.exe
hai ragione non me nero accorto..
ciaooo |
|
|
|
n/a
deleted
1470 Messaggi |
 Inserito il - 17/11/2005 : 15:12:03
|
| Mi sbaglio o stai navigando come Amministrator??? non č una bella cosa |
|
|
|
Er-Gladiatore
Advanced Member
Cittą: Roma
2540 Messaggi |
Inserito il - 17/11/2005 : 16:40:56
|
| Al posto di aprire sempre gli stessi topic i log di Hijackthis metteteli in questo topic tanto vi rispondiamo lo stesso.... |
|
|
|
n/a
deleted
1470 Messaggi |
Inserito il - 17/11/2005 : 17:49:03
|
Citazione:
Messaggio inserito da Vanx
HKLM\System\CCS\Services\Tcpip\..\{4D82A85B-31A6-4195-B1F9-D859DC82B3B9}: NameServer = 193.70.152.15 193.70.152.25
figo e....
Volpone..... non mi passi davanti a casa per andare da Glad.
Edita il tuo log e metti xxxxxxx
Volpone |
|
|
|
n/a
deleted
Cittą: eh eh ti piacerebbe saperlo
2419 Messaggi |
Inserito il - 17/11/2005 : 17:52:19
|
ah ah ah ah ah ah ah ah ah ah ah ah ah ah ah ah ...io non ho mai detto che ti passo davanti a casa.....o almeno non mi ricordo di averlo detto.....
ciaooooooooooooooooooooo |
|
|
|
n/a
deleted
1470 Messaggi |
Inserito il - 17/11/2005 : 17:53:45
|
| Edita il post.... |
|
|
|
n/a
deleted
Cittą: eh eh ti piacerebbe saperlo
2419 Messaggi |
Inserito il - 17/11/2005 : 17:55:45
|
cosa cosa? |
|
|
|
n/a
deleted
Cittą: eh eh ti piacerebbe saperlo
2419 Messaggi |
Inserito il - 20/11/2005 : 11:11:09
|
ragassi che ne pensate di questo..ale vediamo se arrivi alla conclusione che sono arrivato io
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Programmi\File comuni\Symantec Shared\ccProxy.exe
c:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe
c:\Programmi\Norton AntiVirus\navapsvc.exe
C:\Programmi\File comuni\Symantec Shared\SNDSrvc.exe
c:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
c:\Programmi\Norton AntiVirus\SAVScan.exe
c:\Programmi\File comuni\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Java\j2re1.4.2_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\system32\keyhook.exe
C:\Programmi\File comuni\Symantec Shared\ccApp.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\Programmi\Thomson\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\system32\29uidd8m.exe
C:\Programmi\winupdates\winupdates.exe
C:\Programmi\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE
C:\Programmi\Microsoft Office\OFFICE11\WINWORD.EXE
C:\WINDOWS\msagent\AgentSvr.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Compaq_Proprietario\Desktop\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = htt*://ie.redirect.hp[.com]/svs/rdr?TYPE=3&tp=iehome&locale=IT_IT&c=Q404&bd=presario&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = htt*://ie.redirect.hp[.com]/svs/rdr?TYPE=3&tp=iesearch&locale=IT_IT&c=Q404&bd=presario&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = htt*://[www].tele2.it/redirect/startpage/dial_up/ita
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = htt*://[www].tele2.it/redirect/startpage/dial_up/ita
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = htt*://ie.redirect.hp[.com]/svs/rdr?TYPE=3&tp=iesearch&locale=IT_IT&c=Q404&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = htt*://ie.redirect.hp[.com]/svs/rdr?TYPE=3&tp=iesearch&locale=IT_IT&c=Q404&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = htt*://ie.redirect.hp[.com]/svs/rdr?TYPE=3&tp=iesearch&locale=IT_IT&c=Q404&bd=presario&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = htt*://ie.redirect.hp[.com]/svs/rdr?TYPE=3&tp=iehome&locale=IT_IT&c=Q404&bd=presario&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - TELE2Internet
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: ohb - {4D568F0F-8AC9-40AB-88B7-415134C78777} - C:\WINDOWS\system32\winb2s32.dll (file missing)
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - c:\Programmi\File comuni\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Programmi\Norton AntiVirus\NavShExt.dll
O2 - BHO: Starware - {CA356D79-679B-4b4c-8E49-5AF97014F4C1} - C:\Programmi\Starware\bin\Starware.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Programmi\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Begin2Search[.com] Bar - {52FE5233-367C-4EFB-BDD7-0BE4D212C107} - C:\WINDOWS\system32\winb2s32.dll (file missing)
O3 - Toolbar: Starware - {D49E9D35-254C-4c6a-9D17-95018D228FF5} - C:\Programmi\Starware\bin\Starware.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Programmi\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Programmi\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [29uidd8m] C:\WINDOWS\system32\29uidd8m.exe
O4 - HKLM\..\Run: [winupdates] C:\Programmi\winupdates\winupdates.exe /auto
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpySweeper] "C:\Programmi\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Avvio veloce di Microsoft Office OneNote 2003.lnk = C:\Programmi\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: Exif Launcher.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:\programmi\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\programmi\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\programmi\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\programmi\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\programmi\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\programmi\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=htt*://[www].tele2.it/redirect/startpage/dial_up/ita
O17 - HKLM\System\CCS\Services\Tcpip\..\{6448BA11-4654-456E-BDF7-33E5A5752896}: NameServer = 212.247.156.66 212.247.156.70
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Programmi\File comuni\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Programmi\File comuni\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Programmi\File comuni\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Servizio Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - c:\Programmi\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - c:\Programmi\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Programmi\File comuni\Symantec Shared\Security Center\SymWSC.exe
ciaooooo(questo log č carinissimo perchč ci sono cose che adddirittura non esistono..) |
Modificato da - n/a in data 20/11/2005 11:12:16 |
|
|
|
Er-Gladiatore
Advanced Member
Cittą: Roma
2540 Messaggi |
Inserito il - 20/11/2005 : 12:42:44
|
Alexsandra, Vanx al posto di postare log fasulli date un'occhiata al mio (Altro computer).
fatto. |
Modificato da - Er-Gladiatore in data 20/11/2005 13:58:50 |
|
|
|
n/a
deleted
Cittą: eh eh ti piacerebbe saperlo
2419 Messaggi |
Inserito il - 20/11/2005 : 13:53:39
|
alex..questo "Explorer.EXE" non dovrebbe essere in system32?
per il resto sembra ok...glad
cmq il log che ho postato io non č fasullo..anzi č quello di un mio amico...dategli un'occhiata..č veramente figo...
dai ale..c'č una cosa che scommetto non hai mai visto dentro sto log....
pensa che il tipo aveva norton e pure scaduto da due mesi
e non aveva nessun antispyware..niente...
ciaoooooooo |
Modificato da - n/a in data 20/11/2005 15:01:56 |
|
|
|
n/a
deleted
1470 Messaggi |
Inserito il - 20/11/2005 : 15:04:28
|
Citazione:
Messaggio inserito da Vanx
alex..questo "Explorer.EXE" non dovrebbe essere in system32?
per il resto sembra ok...glad
cmq il log che ho postato io non č fasullo..anzi č quello di un mio amico...dategli un'occhiata..č veramente figo...
dai ale..c'č una cosa che scommetto non hai mai visto dentro sto log....
pensa che il tipo aveva norton e pure scaduto da due mesi
e non aveva nessun antispyware..niente...
ciaoooooooo
Explorer č legittimo in quella dir.
Le voci infette da fixare immediatamente sarebbero queste
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\system32\29uidd8m.exe
C:\Programmi\winupdates\winupdates.exe
R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [winupdates] C:\Programmi\winupdates\winupdates.exe /auto
O4 - Global Startup: Exif Launcher.lnk = ?
O14 - IERESET.INF: START_PAGE_URL=htt*://[www].tele2.it/redirect/startpage/dial_up/ita
se vuoi ti posto anche tutte le altre inutili (ovvio il Norton) |
|
|
|
n/a
deleted
Cittą: eh eh ti piacerebbe saperlo
2419 Messaggi |
Inserito il - 20/11/2005 : 15:09:07
|
e di questo cosa ne pensi.. C:\WINDOWS\system32\keyhook.exe
ma a me quello che interessa č questo.... C:\WINDOWS\system32\29uidd8m.exe....vorrei sapere cosč...(c'č un modo per studiarlo..metterlo sotto osservazione per vedere ogni suo minimo movimento...?)
ciaooooooo |
|
|
|
Discussione |
|
Log Hijackthis ! ! !
Forum Bloccato
