altra Variante di linkOptimizer questo è Tosto da togliere.

[tinos]

come da oggetto mi sono beccato su un' altro pc, di nuovo linkOptimizer.

a settembre del 2006 ero stato infettato da questo virus, ma dopo diversi giorni grazie ai vari tool RootkitRevealer, Avenger,hijackthis e agendo sul file di registro cancellando
i vari file ero riuscito a liberamene.

Durante questo ultimo mese, mi sono accorto che c'era qualcosa che non andava, avevo qualche programma che tentava di attivare la connessione internet almeno dieci volte al giorno , questo mentre giocavo oppure mentre ero già su internet. ho pensato che fosse Comodo firewall o Avast che cercava di aggiornarsi, però poi Avast mi diceva che c'era un errore di connessione e non era possibile l' aggiornamento. A quel punto ho pensato ad una possibile infezione. Nei servizi non compariva nessun nome a random o strano.

Vado in modalità provvisoria e .... sorpresa, non riesco ad entrare perchè c'è un AMMINISTRATORE CON PASSWORD e poi ci sono io come utente..porc.. e mo come faccio?

ho provato a cancellare tutti i file temporanei ed ecco che a quel punto nei Servizi mi compaiono i nomi a Random,
prendo nota dei nomi,
vado sul file di registro,
li cerco e mettendo il segno di spunta sulle autorizzazioni li cancello.

Prevx1 ha trovato un programma dannoso e così gli e lo fatto cancellare .

adesso sono Quasi sicuro che non ho più l'infezione, ma non RIESCO a Cancellare una connessione remota a Banda Larga, che avevo creato per connettermi con Alice e se tento di rinominarla, la ricrea con il nome di Alice cancellando quella rinominata.
questa connessione è Alice Miniport WAN (PPPOE).



Ho provato di tutto, non vorrei andare sul file di registro per cancallare anche questa!!!

Qualcuno ha dei suggerimenti su come procedere?

grazie.

[giannola]

io vorrei capire una cosa.
premesso che errare è umano e perseverare diabolico.

Ma perchè dopo la prima volta non ti sei fatto un account limitato per navigare ?

[tinos]

Originariamente inviato da giannola

io vorrei capire una cosa.
premesso che errare è umano e perseverare diabolico.

Ma perchè dopo la prima volta non ti sei fatto un account limitato per navigare ?

hai perfettamente ragione. me ne sono completamente dimenticato ed in parte, mi sentivo al sicuro con firewall ,antivirus, windows Defender... comunque è la prima cosa che ho fatto, appena sono riuscito a bloccarlo.
grazie per avermelo Impresso nella testa.

approfitto per postare il log di hijackthis, ci sono le prime 7 voci che non so se fixare o meno ( R0-R1 )

Logfile of HijackThis v1.99.1
Scan saved at 18.30.15, on 23/02/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\WINDOWS\CTHELPER.EXE
C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
E:\programmi installati\Overclock\Overclock utilità\right mark cpu clock\rmclock_22_bin\RMClock.exe
C:\Programmi\Logitech\SetPoint\SetPoint.exe
C:\Programmi\File comuni\Logitech\khalshared\KHALMNPR.EXE
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wscntfy.exe
E:\programmi installati\sicurezza\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/advanced?hl=it
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/?LinkId=79113
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=32561
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=75632
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=81633
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Dati applicazioni\Prevx\pxbho.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programmi\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmi\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Windows Defender] "C:\Programmi\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Programmi\File comuni\Logitech\khalshared\KHALMNPR.EXE"
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [PrevxOne] "C:\Programmi\Prevx1\PXConsole.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RMClock] "E:\programmi installati\Overclock\Overclock utilità\right mark cpu clock\rmclock_22_bin\RMClock.exe"
O4 - Global Startup: Logitech SetPoint.lnk = ?
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/IT-IT/.../GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1162723994156
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab55579.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Programmi\Prevx1\PXAgent.exe" -f (file missing)
O23 - Service: SRS Labs License Service - SRS Labs - C:\Programmi\File comuni\SRS Labs Shared\Service\srslabslicenseservice.exe

in ogni caso postandole sul sito di hijackthis mi danno ok su tutto.

adesso non ho più tutte le anomalie precedentemente menzionate, l'unica anomalia è che non c'è modo di cancellare la connessione di ALICE !

suggerimenti?

[FOXYLADY]

Il log di hijackthis è pulito, dovresti postare un log di gmer (rootkit e autostart).
Io sono poco pratico dei log di gmer, ma qualcun'altro saprà sicuramente darti una mano

[giannola]

Originariamente inviato da FOXYLADY

Il log di hijackthis è pulito, dovresti postare un log di gmer (rootkit e autostart).
Io sono poco pratico dei log di gmer, ma qualcun'altro saprà sicuramente darti una mano

posta pure il log

[tinos]

Originariamente inviato da giannola

posta pure il log

interessante programmino gmer... grazie raga.

il file a347bus.sys, sono i driver scsi?

vi posto anche un'immagine di rootkitlrrevealers


report generale di gmer

2007-02-24 19:32:44 gmer.sys System [4]: CreateProcess C:\WINDOWS\system32\smss.exe
2007-02-24 19:32:44 gmer.sys smss.exe [436]: CreateProcess C:\WINDOWS\system32\autochk.exe
2007-02-24 19:32:45 gmer.sys smss.exe [436]: CreateProcess C:\WINDOWS\system32\csrss.exe
2007-02-24 19:32:46 gmer.sys smss.exe [436]: CreateProcess C:\WINDOWS\system32\winlogon.exe
2007-02-24 19:33:02 gmer.sys winlogon.exe [508]: CreateProcess C:\WINDOWS\system32\services.exe
2007-02-24 19:33:03 gmer.sys winlogon.exe [508]: CreateProcess C:\WINDOWS\system32\lsass.exe
2007-02-24 19:33:05 gmer.sys services.exe [556]: CreateProcess C:\WINDOWS\system32\svchost.exe
2007-02-24 19:33:06 gmer.sys services.exe [556]: CreateProcess C:\WINDOWS\system32\svchost.exe
2007-02-24 19:33:10 gmer.sys services.exe [556]: CreateProcess C:\Programmi\Windows Defender\MsMpEng.exe
2007-02-24 19:33:11 gmer.sys services.exe [556]: CreateProcess C:\WINDOWS\system32\svchost.exe
2007-02-24 19:33:15 gmer.sys services.exe [556]: CreateProcess C:\WINDOWS\system32\svchost.exe
2007-02-24 19:33:22 gmer.sys services.exe [556]: CreateProcess C:\WINDOWS\system32\spoolsv.exe
2007-02-24 19:33:34 gmer.sys services.exe [556]: CreateProcess C:\WINDOWS\system32\svchost.exe
2007-02-24 19:33:34 gmer.sys services.exe [556]: CreateProcess C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
2007-02-24 19:33:34 gmer.sys services.exe [556]: CreateProcess C:\Programmi\Alwil Software\Avast4\ashServ.exe
2007-02-24 19:33:34 gmer.sys services.exe [556]: CreateProcess C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
2007-02-24 19:33:35 gmer.sys services.exe [556]: CreateProcess C:\WINDOWS\system32\nvsvc32.exe
2007-02-24 19:33:35 gmer.sys services.exe [556]: CreateProcess C:\Programmi\Prevx1\PXAgent.exe
2007-02-24 19:33:36 gmer.sys services.exe [556]: CreateProcess C:\WINDOWS\system32\svchost.exe
2007-02-24 19:33:37 gmer.sys services.exe [556]: CreateProcess C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
2007-02-24 19:33:37 gmer.sys services.exe [556]: CreateProcess C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
2007-02-24 19:33:38 gmer.sys services.exe [556]: CreateProcess C:\WINDOWS\system32\alg.exe
2007-02-24 19:33:49 gmer.sys winlogon.exe [508]: CreateProcess C:\WINDOWS\system32\userinit.exe
2007-02-24 19:33:49 gmer.sys winlogon.exe [508]: CreateProcess C:\WINDOWS\system32\WgaTray.exe
2007-02-24 19:33:57 gmer.sys userinit.exe [1280]: CreateProcess C:\WINDOWS\explorer.exe
2007-02-24 19:33:57 gmer.sys svchost.exe [732]: CreateProcess C:\WINDOWS\system32\wbem\wmiprvse.exe
2007-02-24 19:33:58 EXPLORER.EXE[1464]: C:\WINDOWS\system32\SHELL32.dll -> CreateProcessW ( C:\WINDOWS\system32\verclsid.exe )
2007-02-24 19:34:00 gmer.sys explorer.exe [1464]: CreateProcess C:\WINDOWS\system32\verclsid.exe
2007-02-24 19:34:01 EXPLORER.EXE[1464]: C:\WINDOWS\system32\SHELL32.dll -> CreateProcessW ( C:\WINDOWS\system32\verclsid.exe )
2007-02-24 19:34:01 gmer.sys explorer.exe [1464]: CreateProcess C:\WINDOWS\system32\verclsid.exe
2007-02-24 19:34:01 EXPLORER.EXE[1464]: C:\WINDOWS\system32\SHELL32.dll -> CreateProcessW ( C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe )
2007-02-24 19:34:01 gmer.sys explorer.exe [1464]: CreateProcess C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
2007-02-24 19:34:01 EXPLORER.EXE[1464]: C:\WINDOWS\system32\SHELL32.dll -> CreateProcessW ( C:\WINDOWS\system32\NeroCheck.exe )
2007-02-24 19:34:01 gmer.sys explorer.exe [1464]: CreateProcess C:\WINDOWS\system32\NeroCheck.exe
2007-02-24 19:34:01 EXPLORER.EXE[1464]: C:\WINDOWS\system32\SHELL32.dll -> CreateProcessW ( C:\WINDOWS\KHALMNPR.Exe )
2007-02-24 19:34:01 gmer.sys explorer.exe [1464]: CreateProcess C:\WINDOWS\KHALMNPR.Exe
2007-02-24 19:34:01 EXPLORER.EXE[1464]: C:\WINDOWS\system32\SHELL32.dll -> CreateProcessW ( C:\Programmi\Windows Defender\MSASCui.exe )
2007-02-24 19:34:01 gmer.sys explorer.exe [1464]: CreateProcess C:\Programmi\Windows Defender\MSASCui.exe
2007-02-24 19:34:01 EXPLORER.EXE[1464]: C:\WINDOWS\system32\SHELL32.dll -> CreateProcessW ( C:\Programmi\File comuni\Logitech\khalshared\KHALMNPR.exe )
2007-02-24 19:34:01 gmer.sys explorer.exe [1464]: CreateProcess C:\Programmi\File comuni\Logitech\khalshared\KHALMNPR.exe
2007-02-24 19:34:01 EXPLORER.EXE[1464]: C:\WINDOWS\system32\SHELL32.dll -> CreateProcessW ( C:\Program Files\ASUS\Probe\AsusProb.exe )
2007-02-24 19:34:01 gmer.sys explorer.exe [1464]: CreateProcess C:\Program Files\ASUS\Probe\AsusProb.exe
2007-02-24 19:34:01 EXPLORER.EXE[1464]: C:\WINDOWS\system32\SHELL32.dll -> CreateProcessW ( C:\WINDOWS\system32\rundll32.exe )
2007-02-24 19:34:01 gmer.sys explorer.exe [1464]: CreateProcess C:\WINDOWS\system32\rundll32.exe
2007-02-24 19:34:02 EXPLORER.EXE[1464]: C:\WINDOWS\system32\SHELL32.dll -> CreateProcessW ( C:\WINDOWS\system32\nwiz.exe )
2007-02-24 19:34:02 gmer.sys explorer.exe [1464]: CreateProcess C:\WINDOWS\system32\nwiz.exe
2007-02-24 19:34:02 EXPLORER.EXE[1464]: C:\WINDOWS\system32\SHELL32.dll -> CreateProcessW ( C:\WINDOWS\system32\rundll32.exe )
2007-02-24 19:34:02 gmer.sys explorer.exe [1464]: CreateProcess C:\WINDOWS\system32\rundll32.exe
2007-02-24 19:34:02 EXPLORER.EXE[1464]: C:\WINDOWS\system32\SHELL32.dll -> CreateProcessW ( C:\WINDOWS\CTHELPER.EXE )
2007-02-24 19:34:02 gmer.sys explorer.exe [1464]: CreateProcess C:\WINDOWS\CTHELPER.EXE
2007-02-24 19:34:02 EXPLORER.EXE[1464]: C:\WINDOWS\system32\SHELL32.dll -> CreateProcessW ( C:\WINDOWS\system32\CTXFIHLP.EXE )
2007-02-24 19:34:02 gmer.sys explorer.exe [1464]: CreateProcess C:\WINDOWS\system32\CTXFIHLP.EXE
2007-02-24 19:34:02 EXPLORER.EXE[1464]: C:\WINDOWS\system32\SHELL32.dll -> CreateProcessW ( C:\Programmi\Prevx1\PXConsole.exe )
2007-02-24 19:34:02 gmer.sys explorer.exe [1464]: CreateProcess C:\Programmi\Prevx1\PXConsole.exe
2007-02-24 19:34:03 EXPLORER.EXE[1464]: C:\WINDOWS\system32\SHELL32.dll -> CreateProcessW ( C:\Programmi\Java\jre1.5.0_11\bin\jusched.exe )
2007-02-24 19:34:03 gmer.sys explorer.exe [1464]: CreateProcess C:\Programmi\Java\jre1.5.0_11\bin\jusched.exe
2007-02-24 19:34:04 gmer.sys services.exe [556]: CreateProcess C:\WINDOWS\system32\imapi.exe
2007-02-24 19:34:05 EXPLORER.EXE[1464]: C:\WINDOWS\system32\SHELL32.dll -> CreateProcessW ( C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe )
2007-02-24 19:34:05 gmer.sys explorer.exe [1464]: CreateProcess C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe
2007-02-24 19:34:05 EXPLORER.EXE[1464]: C:\WINDOWS\system32\SHELL32.dll -> CreateProcessW ( C:\WINDOWS\system32\ctfmon.exe )
2007-02-24 19:34:05 gmer.sys explorer.exe [1464]: CreateProcess C:\WINDOWS\system32\ctfmon.exe
2007-02-24 19:34:06 EXPLORER.EXE[1464]: C:\WINDOWS\system32\SHELL32.dll -> CreateProcessW ( E:\programmi installati\Overclock\Overclock utilità\right mark cpu clock\rmclock_22_bin\RMClock.exe )
2007-02-24 19:34:06 gmer.sys explorer.exe [1464]: CreateProcess E:\programmi installati\Overclock\Overclock utilità\right mark cpu clock\rmclock_22_bin\RMClock.exe
2007-02-24 19:34:07 EXPLORER.EXE[1464]: C:\WINDOWS\system32\SHELL32.dll -> CreateProcessW ( C:\Programmi\Logitech\SetPoint\SetPoint.exe )
2007-02-24 19:34:07 gmer.sys explorer.exe [1464]: CreateProcess C:\Programmi\Logitech\SetPoint\SetPoint.exe
2007-02-24 19:34:08 gmer.sys svchost.exe [732]: CreateProcess C:\WINDOWS\system32\CTXFISPI.EXE
2007-02-24 19:34:11 gmer.sys ashServ.exe [1248]: CreateProcess C:\Programmi\Alwil Software\Avast4\Setup\avast.setup
2007-02-24 19:34:20 gmer.sys SetPoint.exe [2644]: CreateProcess C:\Programmi\File comuni\Logitech\khalshared\KHALMNPR.exe
2007-02-24 19:34:25 gmer.sys svchost.exe [732]: CreateProcess C:\Programmi\File comuni\Ahead\Lib\NMIndexStoreSvr.exe
2007-02-24 19:34:28 gmer.sys SetPoint.exe [2644]: CreateProcess C:\Programmi\Logitech\SetPoint\LULnchr.exe
2007-02-24 19:34:28 gmer.sys SetPoint.exe [2644]: CreateProcess C:\WINDOWS\system32\regsvr32.exe
2007-02-24 19:34:29 gmer.sys SetPoint.exe [2644]: CreateProcess C:\WINDOWS\system32\regsvr32.exe
2007-02-24 19:34:29 gmer.sys SetPoint.exe [2644]: CreateProcess C:\Programmi\Logitech\SetPoint\LULnchr.exe
2007-02-24 19:34:29 gmer.sys SetPoint.exe [2644]: CreateProcess C:\Programmi\Logitech\SetPoint\LULnchr.exe
2007-02-24 19:34:35 gmer.sys svchost.exe [888]: CreateProcess C:\WINDOWS\system32\wuauclt.exe
2007-02-24 19:34:40 gmer.sys LULnchr.exe [3140]: CreateProcess C:\Programmi\Logitech\SetPoint\LogitechUpdate.exe
2007-02-24 19:34:48 gmer.sys LULnchr.exe [3192]: CreateProcess C:\Programmi\Logitech\SetPoint\LogitechUpdate.exe
2007-02-24 19:34:51 gmer.sys LULnchr.exe [3184]: CreateProcess C:\Programmi\Logitech\SetPoint\LogitechUpdate.exe
2007-02-24 19:35:20 EXPLORER.EXE[1464]: C:\WINDOWS\system32\SHELL32.dll -> CreateProcessW ( C:\WINDOWS\system32\verclsid.exe )
2007-02-24 19:35:20 gmer.sys explorer.exe [1464]: CreateProcess C:\WINDOWS\system32\verclsid.exe
2007-02-24 19:35:20 gmer.sys explorer.exe [1464]: CreateProcess C:\WINDOWS\system32\verclsid.exe
2007-02-24 19:36:03 EXPLORER.EXE[1464]: C:\WINDOWS\system32\SHELL32.dll -> CreateProcessW ( C:\WINDOWS\system32\notepad.exe )
2007-02-24 19:36:03 gmer.sys explorer.exe [1464]: CreateProcess C:\WINDOWS\system32\notepad.exe
2007-02-24 19:36:23 EXPLORER.EXE[1464]: C:\WINDOWS\system32\SHELL32.dll -> CreateProcessW ( E:\programmi installati\sicurezza\utilità\gmer\gmer.exe )
2007-02-24 19:36:23 gmer.sys explorer.exe [1464]: CreateProcess E:\programmi installati\sicurezza\utilità\gmer\gmer.exe
2007-02-24 19:40:53 gmer.sys ashServ.exe [1248]: CreateProcess C:\Programmi\Alwil Software\Avast4\Setup\setup.ovr
2007-02-24 19:41:59 gmer.sys ashDisp.exe [2168]: CreateProcess C:\Programmi\Alwil Software\Avast4\Setup\setup.ovr
2007-02-24 19:44:50 EXPLORER.EXE[1464]: C:\WINDOWS\system32\SHELL32.dll -> CreateProcessW ( E:\programmi installati\sicurezza\utilità\gmer\gmer.exe )
2007-02-24 19:44:50 gmer.sys explorer.exe [1464]: CreateProcess E:\programmi installati\sicurezza\utilità\gmer\gmer.exe

report rootkit di gmer

GMER 1.0.12.12027 - http://www.gmer.net
Rootkit scan 2007-02-24 20:04:03
Windows 5.1.2600 Service Pack 2


---- System - GMER 1.0.12 ----

SSDT pxfsf.sys ZwAlertResumeThread
SSDT pxfsf.sys ZwAllocateUserPhysicalPages
SSDT pxfsf.sys ZwAllocateVirtualMemory
SSDT pxfsf.sys ZwClose
SSDT pxfsf.sys ZwCompactKeys
SSDT pxfsf.sys ZwCompressKey
SSDT pxfsf.sys ZwCreateDirectoryObject
SSDT pxfsf.sys ZwCreateEvent
SSDT pxfsf.sys ZwCreateEventPair
SSDT pxfsf.sys ZwCreateFile
SSDT pxfsf.sys ZwCreateIoCompletion
SSDT pxfsf.sys ZwCreateJobObject
SSDT pxfsf.sys ZwCreateKey
SSDT pxfsf.sys ZwCreateMailslotFile
SSDT pxfsf.sys ZwCreateMutant
SSDT pxfsf.sys ZwCreateNamedPipeFile
SSDT a347bus.sys ZwCreatePagingFile
SSDT pxfsf.sys ZwCreatePort
SSDT pxfsf.sys ZwCreateProcess
SSDT pxfsf.sys ZwCreateProcessEx
SSDT pxfsf.sys ZwCreateSection
SSDT pxfsf.sys ZwCreateSemaphore
SSDT pxfsf.sys ZwCreateSymbolicLinkObject
SSDT pxfsf.sys ZwCreateThread
SSDT pxfsf.sys ZwCreateTimer
SSDT pxfsf.sys ZwCreateToken
SSDT pxfsf.sys ZwDeleteFile
SSDT pxfsf.sys ZwDeleteKey
SSDT pxfsf.sys ZwDeleteValueKey
SSDT pxfsf.sys ZwDeviceIoControlFile
SSDT pxfsf.sys ZwDuplicateObject
SSDT pxfsf.sys ZwEnumerateKey
SSDT pxfsf.sys ZwEnumerateValueKey
SSDT pxfsf.sys ZwFreeUserPhysicalPages
SSDT pxfsf.sys ZwFreeVirtualMemory
SSDT pxfsf.sys ZwImpersonateAnonymousToken
SSDT pxfsf.sys ZwImpersonateThread
SSDT pxfsf.sys ZwLoadDriver
SSDT pxfsf.sys ZwLoadKey
SSDT pxfsf.sys ZwLoadKey2
SSDT pxfsf.sys ZwLockRegistryKey
SSDT pxfsf.sys ZwLockVirtualMemory
SSDT pxfsf.sys ZwMapViewOfSection
SSDT pxfsf.sys ZwOpenFile
SSDT pxfsf.sys ZwOpenKey
SSDT pxfsf.sys ZwOpenProcess
SSDT pxfsf.sys ZwOpenProcessToken
SSDT pxfsf.sys ZwOpenSection
SSDT pxfsf.sys ZwOpenThread
SSDT pxfsf.sys ZwOpenThreadToken
SSDT pxfsf.sys ZwProtectVirtualMemory
SSDT pxfsf.sys ZwQueryInformationProcess
SSDT pxfsf.sys ZwQueryInformationThread
SSDT pxfsf.sys ZwQueryKey
SSDT pxfsf.sys ZwQueryMultipleValueKey
SSDT pxfsf.sys ZwQueryOpenSubKeys
SSDT pxfsf.sys ZwQueryValueKey
SSDT pxfsf.sys ZwQueueApcThread
SSDT pxfsf.sys ZwReadFile
SSDT pxfsf.sys ZwReadVirtualMemory
SSDT pxfsf.sys ZwRenameKey
SSDT pxfsf.sys ZwReplaceKey
SSDT pxfsf.sys ZwRestoreKey
SSDT pxfsf.sys ZwResumeProcess
SSDT pxfsf.sys ZwResumeThread
SSDT pxfsf.sys ZwSaveKey
SSDT pxfsf.sys ZwSaveKeyEx
SSDT pxfsf.sys ZwSaveMergedKeys
SSDT pxfsf.sys ZwSetContextThread
SSDT pxfsf.sys ZwSetInformationKey
SSDT pxfsf.sys ZwSetInformationProcess
SSDT pxfsf.sys ZwSetInformationThread
SSDT pxfsf.sys ZwSetSystemInformation
SSDT a347bus.sys ZwSetSystemPowerState
SSDT pxfsf.sys ZwSetValueKey
SSDT pxfsf.sys ZwSuspendProcess
SSDT pxfsf.sys ZwSuspendThread
SSDT pxfsf.sys ZwSystemDebugControl
SSDT pxfsf.sys ZwTerminateJobObject
SSDT pxfsf.sys ZwTerminateProcess
SSDT pxfsf.sys ZwTerminateThread
SSDT pxfsf.sys ZwUnloadDriver
SSDT pxfsf.sys ZwUnloadKey
SSDT pxfsf.sys ZwUnloadKeyEx
SSDT pxfsf.sys ZwUnlockVirtualMemory
SSDT pxfsf.sys ZwUnmapViewOfSection
SSDT pxfsf.sys ZwWriteFile
SSDT pxfsf.sys ZwWriteVirtualMemory

---- Kernel code sections - GMER 1.0.12 ----

.text ntkrnlpa.exe!ZwCallbackReturn + 23B4 805010B8 24 Bytes [ 79, 78, 1E, F7, 83, 78, 1E, ... ]
.text ntkrnlpa.exe!ZwCallbackReturn + 23D0 805010D4 32 Bytes [ B5, 78, 1E, F7, BF, 78, 1E, ... ]
.text ntkrnlpa.exe!ZwCallbackReturn + 23F4 805010F8 24 Bytes [ FB, 78, 1E, F7, 05, 79, 1E, ... ]
.text ntkrnlpa.exe!ZwCallbackReturn + 24B0 805011B4 12 Bytes [ A5, 79, 1E, F7, AF, 79, 1E, ... ]
.text ntkrnlpa.exe!ZwCallbackReturn + 265C 80501360 24 Bytes [ 9F, 7A, 1E, F7, A9, 7A, 1E, ... ]
.text ...

---- User code sections - GMER 1.0.12 ----

.text C:\WINDOWS\system32\winlogon.exe[508] kernel32.dll!CreateProcessA + 3 7C80236A 2 Bytes [ 83, F5 ]
.text C:\WINDOWS\system32\services.exe[556] kernel32.dll!CreateProcessA + 3 7C80236A 2 Bytes [ 83, F5 ]
.text C:\WINDOWS\system32\lsass.exe[584] kernel32.dll!CreateProcessA + 3 7C80236A 2 Bytes [ 83, F5 ]
.text C:\WINDOWS\system32\svchost.exe[732] kernel32.dll!CreateProcessA + 3 7C80236A 2 Bytes [ 83, F5 ]
.text C:\WINDOWS\system32\svchost.exe[796] kernel32.dll!CreateProcessA + 3 7C80236A 2 Bytes [ 83, F5 ]
.text C:\Programmi\Windows Defender\MsMpEng.exe[836] kernel32.dll!CreateProcessA + 3 7C80236A 2 Bytes [ 83, F5 ]
.text C:\WINDOWS\system32\svchost.exe[888] kernel32.dll!CreateProcessA + 3 7C80236A 2 Bytes [ 83, F5 ]
.text C:\WINDOWS\system32\svchost.exe[1008] kernel32.dll!CreateProcessA + 3 7C80236A 2 Bytes [ 83, F5 ]
.text C:\WINDOWS\system32\spoolsv.exe[1108] kernel32.dll!CreateProcessA + 3 7C80236A 2 Bytes [ 83, F5 ]
.text C:\WINDOWS\system32\svchost.exe[1172] kernel32.dll!CreateProcessA + 3 7C80236A 2 Bytes [ 83, F5 ]
.text C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe[1232] kernel32.dll!CreateProcessA + 3 7C80236A 2 Bytes [ 83, F5 ]
.text C:\Programmi\Alwil Software\Avast4\ashServ.exe[1248] kernel32.dll!CreateProcessA + 3 7C80236A 2 Bytes [ 83, F5 ]
.text C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe[1312] kernel32.dll!CreateProcessA + 3 7C80236A 2 Bytes [ 83, F5 ]
.text C:\Programmi\Prevx1\PXAgent.exe[1404] kernel32.dll!CreateProcessA + 3 7C80236A 2 Bytes [ 83, F5 ]
.text C:\WINDOWS\explorer.exe[1464] kernel32.dll!CreateProcessA + 3 7C80236A 2 Bytes [ 83, F5 ]
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!CreateProcessA + 3 7C80236A 2 Bytes [ 83, F5 ]
.text C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe[1756] kernel32.dll!CreateProcessA + 3 7C80236A 2 Bytes [ 83, F5 ]
.text C:\Programmi\Alwil Software\Avast4\ashWebSv.exe[1868] kernel32.dll!CreateProcessA + 3 7C80236A 2 Bytes [ 83, F5 ]
.text C:\WINDOWS\system32\alg.exe[1904] kernel32.dll!CreateProcessA + 3 7C80236A 2 Bytes [ 83, F5 ]
.text C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe[2168] kernel32.dll!CreateProcessA + 3 7C80236A 2 Bytes [ 83, F5 ]
.text C:\Programmi\Windows Defender\MSASCui.exe[2192] kernel32.dll!CreateProcessA + 3 7C80236A 2 Bytes [ 83, F5 ]
.text C:\Program Files\ASUS\Probe\AsusProb.exe[2208] kernel32.dll!CreateProcessA + 3 7C80236A 2 Bytes [ 83, F5 ]
.text C:\WINDOWS\CTHELPER.EXE[2260] kernel32.dll!CreateProcessA + 3 7C80236A 2 Bytes [ 83, F5 ]
.text C:\Programmi\Prevx1\PXConsole.exe[2288] kernel32.dll!CreateProcessA + 3 7C80236A 2 Bytes [ 83, F5 ]
.text C:\Programmi\Java\jre1.5.0_11\bin\jusched.exe[2376] kernel32.dll!CreateProcessA + 3 7C80236A 2 Bytes [ 83, F5 ]
.text C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe[2524] kernel32.dll!CreateProcessA + 3 7C80236A 2 Bytes [ 83, F5 ]
.text C:\WINDOWS\system32\ctfmon.exe[2560] kernel32.dll!CreateProcessA + 3 7C80236A 2 Bytes [ 83, F5 ]
.text E:\programmi installati\Overclock\Overclock utilità\right mark cpu clock\rmclock_22_bin\RMClock.exe[2580] kernel32.dll!CreateProcessA + 3 7C80236A 2 Bytes [ 83, F5 ]
.text C:\Programmi\Logitech\SetPoint\SetPoint.exe[2644] kernel32.dll!CreateProcessA + 3 7C80236A 2 Bytes [ 83, F5 ]
.text C:\Programmi\File comuni\Logitech\khalshared\KHALMNPR.exe[2996] kernel32.dll!CreateProcessA + 3 7C80236A 2 Bytes [ 83, F5 ]
.text E:\programmi installati\sicurezza\utilità\gmer\gmer.exe[3716] kernel32.dll!CreateProcessA + 3 7C80236A 2 Bytes [ 83, F5 ]

---- Devices - GMER 1.0.12 ----

Device \FileSystem\Ntfs \Ntfs IRP_MJ_READ 86D47C78
Device \FileSystem\Udfs \UdfsCdRom IRP_MJ_READ 866C99D0
Device \FileSystem\Udfs \UdfsDisk IRP_MJ_READ 866C99D0
Device \Driver\prodrv06 \Device\ProDrv06 IRP_MJ_CREATE E1F50828
Device \Driver\prodrv06 \Device\ProDrv06 IRP_MJ_CLOSE E1F50828
Device \Driver\prodrv06 \Device\ProDrv06 IRP_MJ_DEVICE_CONTROL E1F50828
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_READ 866C4578
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE 867E3758
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE_NAMED_PIPE 867E3758
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CLOSE 867E3758
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_READ 867E3758
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_WRITE 867E3758
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_INFORMATION 867E3758
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_INFORMATION 867E3758
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_EA 867E3758
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_EA 867E3758
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_FLUSH_BUFFERS 867E3758
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_VOLUME_INFORMATION 867E3758
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_VOLUME_INFORMATION 867E3758
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DIRECTORY_CONTROL 867E3758
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_FILE_SYSTEM_CONTROL 867E3758
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DEVICE_CONTROL 867E3758
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_INTERNAL_DEVICE_CONTROL 867E3758
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SHUTDOWN 867E3758
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_LOCK_CONTROL 867E3758
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CLEANUP 867E3758
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE_MAILSLOT 867E3758
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_SECURITY 867E3758
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_SECURITY 867E3758
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_POWER 867E3758
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SYSTEM_CONTROL 867E3758
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DEVICE_CHANGE 867E3758
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_QUOTA 867E3758
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_QUOTA 867E3758
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_PNP 867E3758
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CREATE 867E3B38
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CREATE_NAMED_PIPE 867E3B38
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CLOSE 867E3B38
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_READ 867E3B38
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_WRITE 867E3B38
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_INFORMATION 867E3B38
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_INFORMATION 867E3B38
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_EA 867E3B38
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_EA 867E3B38
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_FLUSH_BUFFERS 867E3B38
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_VOLUME_INFORMATION 867E3B38
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_VOLUME_INFORMATION 867E3B38
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_DIRECTORY_CONTROL 867E3B38
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_FILE_SYSTEM_CONTROL 867E3B38
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_DEVICE_CONTROL 867E3B38
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_INTERNAL_DEVICE_CONTROL 867E3B38
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SHUTDOWN 867E3B38
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_LOCK_CONTROL 867E3B38
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CLEANUP 867E3B38
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CREATE_MAILSLOT 867E3B38
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_SECURITY 867E3B38
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_SECURITY 867E3B38
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_POWER 867E3B38
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SYSTEM_CONTROL 867E3B38
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_DEVICE_CHANGE 867E3B38
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_QUOTA 867E3B38
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_QUOTA 867E3B38
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_PNP 867E3B38
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CREATE 867E3B38
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CREATE_NAMED_PIPE 867E3B38
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CLOSE 867E3B38
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_READ 867E3B38
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_WRITE 867E3B38
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_INFORMATION 867E3B38
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_INFORMATION 867E3B38
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_EA 867E3B38
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_EA 867E3B38
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_FLUSH_BUFFERS 867E3B38
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_VOLUME_INFORMATION 867E3B38
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_VOLUME_INFORMATION 867E3B38
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_DIRECTORY_CONTROL 867E3B38
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_FILE_SYSTEM_CONTROL 867E3B38
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_DEVICE_CONTROL 867E3B38
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_INTERNAL_DEVICE_CONTROL 867E3B38
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SHUTDOWN 867E3B38
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_LOCK_CONTROL 867E3B38
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CLEANUP 867E3B38
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CREATE_MAILSLOT 867E3B38
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_SECURITY 867E3B38
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_SECURITY 867E3B38
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_POWER 867E3B38
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SYSTEM_CONTROL 867E3B38
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_DEVICE_CHANGE 867E3B38
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_QUOTA 867E3B38
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_QUOTA 867E3B38
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_PNP 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_CREATE 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_CREATE_NAMED_PIPE 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_CLOSE 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_READ 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_WRITE 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_QUERY_INFORMATION 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_SET_INFORMATION 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_QUERY_EA 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_SET_EA 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_FLUSH_BUFFERS 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_QUERY_VOLUME_INFORMATION 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_SET_VOLUME_INFORMATION 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_DIRECTORY_CONTROL 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_FILE_SYSTEM_CONTROL 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_DEVICE_CONTROL 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_INTERNAL_DEVICE_CONTROL 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_SHUTDOWN 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_LOCK_CONTROL 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_CLEANUP 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_CREATE_MAILSLOT 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_QUERY_SECURITY 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_SET_SECURITY 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_POWER 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_SYSTEM_CONTROL 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_DEVICE_CHANGE 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_QUERY_QUOTA 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_SET_QUOTA 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_PNP 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_CREATE 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_CREATE_NAMED_PIPE 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_CLOSE 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_READ 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_WRITE 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_QUERY_INFORMATION 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_SET_INFORMATION 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_QUERY_EA 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_SET_EA 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_FLUSH_BUFFERS 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_QUERY_VOLUME_INFORMATION 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_SET_VOLUME_INFORMATION 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_DIRECTORY_CONTROL 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_FILE_SYSTEM_CONTROL 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_DEVICE_CONTROL 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_INTERNAL_DEVICE_CONTROL 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_SHUTDOWN 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_LOCK_CONTROL 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_CLEANUP 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_CREATE_MAILSLOT 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_QUERY_SECURITY 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_SET_SECURITY 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_POWER 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_SYSTEM_CONTROL 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_DEVICE_CHANGE 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_QUERY_QUOTA 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_SET_QUOTA 867E3B38
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_PNP 867E3B38
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE 867E3758
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE_NAMED_PIPE 867E3758
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CLOSE 867E3758
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_READ 867E3758
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_WRITE 867E3758
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_INFORMATION 867E3758
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_INFORMATION 867E3758
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_EA 867E3758
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_EA 867E3758
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_FLUSH_BUFFERS 867E3758
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_VOLUME_INFORMATION 867E3758
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_VOLUME_INFORMATION 867E3758
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DIRECTORY_CONTROL 867E3758
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_FILE_SYSTEM_CONTROL 867E3758
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DEVICE_CONTROL 867E3758
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_INTERNAL_DEVICE_CONTROL 867E3758
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SHUTDOWN 867E3758
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_LOCK_CONTROL 867E3758
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CLEANUP 867E3758
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE_MAILSLOT 867E3758
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_SECURITY 867E3758
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_SECURITY 867E3758
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_POWER 867E3758
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SYSTEM_CONTROL 867E3758
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DEVICE_CHANGE 867E3758
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_QUOTA 867E3758
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_QUOTA 867E3758
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_PNP 867E3758
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CREATE 867E3758
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CREATE_NAMED_PIPE 867E3758
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CLOSE 867E3758
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_READ 867E3758
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_WRITE 867E3758
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_QUERY_INFORMATION 867E3758
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SET_INFORMATION 867E3758
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_QUERY_EA 867E3758
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SET_EA 867E3758
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_FLUSH_BUFFERS 867E3758
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_QUERY_VOLUME_INFORMATION 867E3758
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SET_VOLUME_INFORMATION 867E3758
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_DIRECTORY_CONTROL 867E3758
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_FILE_SYSTEM_CONTROL 867E3758
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_DEVICE_CONTROL 867E3758
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_INTERNAL_DEVICE_CONTROL 867E3758
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SHUTDOWN 867E3758
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_LOCK_CONTROL 867E3758
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CLEANUP 867E3758
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CREATE_MAILSLOT 867E3758
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_QUERY_SECURITY 867E3758
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SET_SECURITY 867E3758
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_POWER 867E3758
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SYSTEM_CONTROL 867E3758
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_DEVICE_CHANGE 867E3758
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_QUERY_QUOTA 867E3758
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SET_QUOTA 867E3758
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_PNP 867E3758
Device \Driver\prohlp02 \Device\ProHlp02 IRP_MJ_CREATE E162D9A0
Device \Driver\prohlp02 \Device\ProHlp02 IRP_MJ_CLOSE E162D9A0
Device \Driver\prohlp02 \Device\ProHlp02 IRP_MJ_DEVICE_CONTROL E162D9A0
Device \FileSystem\Srv \Device\LanmanServer IRP_MJ_READ 85196720
Device \Driver\nvata \Device\NvAta0 IRP_MJ_INTERNAL_DEVICE_CONTROL [F79956C1] prosync1.sys
Device \Driver\nvata \Device\NvAta1 IRP_MJ_INTERNAL_DEVICE_CONTROL [F79956C1] prosync1.sys
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_READ 866C7410
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_READ 866C7410
Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_READ 866B1508
Device \FileSystem\Msfs \Device\Mailslot IRP_MJ_READ 866930A0
Device \Driver\nvata \Device\0000007e IRP_MJ_INTERNAL_DEVICE_CONTROL [F79956C1] prosync1.sys
Device \Driver\nvata \Device\0000007f IRP_MJ_INTERNAL_DEVICE_CONTROL [F79956C1] prosync1.sys
Device \Driver\Si3114r5 \Device\Scsi\Si3114r51Port2Path3Target1fLun0 IRP_MJ_INTERNAL_DEVICE_CONTROL [F79956C1] prosync1.sys
Device \Driver\Si3114r5 \Device\Scsi\Si3114r51 IRP_MJ_INTERNAL_DEVICE_CONTROL [F79956C1] prosync1.sys
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port5Path0Target0Lun0 IRP_MJ_CREATE 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port5Path0Target0Lun0 IRP_MJ_CREATE_NAMED_PIPE 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port5Path0Target0Lun0 IRP_MJ_CLOSE 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port5Path0Target0Lun0 IRP_MJ_READ 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port5Path0Target0Lun0 IRP_MJ_WRITE 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port5Path0Target0Lun0 IRP_MJ_QUERY_INFORMATION 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port5Path0Target0Lun0 IRP_MJ_SET_INFORMATION 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port5Path0Target0Lun0 IRP_MJ_QUERY_EA 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port5Path0Target0Lun0 IRP_MJ_SET_EA 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port5Path0Target0Lun0 IRP_MJ_FLUSH_BUFFERS 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port5Path0Target0Lun0 IRP_MJ_QUERY_VOLUME_INFORMATION 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port5Path0Target0Lun0 IRP_MJ_SET_VOLUME_INFORMATION 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port5Path0Target0Lun0 IRP_MJ_DIRECTORY_CONTROL 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port5Path0Target0Lun0 IRP_MJ_FILE_SYSTEM_CONTROL 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port5Path0Target0Lun0 IRP_MJ_DEVICE_CONTROL 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port5Path0Target0Lun0 IRP_MJ_INTERNAL_DEVICE_CONTROL 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port5Path0Target0Lun0 IRP_MJ_SHUTDOWN 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port5Path0Target0Lun0 IRP_MJ_LOCK_CONTROL 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port5Path0Target0Lun0 IRP_MJ_CLEANUP 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port5Path0Target0Lun0 IRP_MJ_CREATE_MAILSLOT 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port5Path0Target0Lun0 IRP_MJ_QUERY_SECURITY 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port5Path0Target0Lun0 IRP_MJ_SET_SECURITY 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port5Path0Target0Lun0 IRP_MJ_POWER 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port5Path0Target0Lun0 IRP_MJ_SYSTEM_CONTROL 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port5Path0Target0Lun0 IRP_MJ_DEVICE_CHANGE 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port5Path0Target0Lun0 IRP_MJ_QUERY_QUOTA 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port5Path0Target0Lun0 IRP_MJ_SET_QUOTA 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port5Path0Target0Lun0 IRP_MJ_PNP 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_CREATE 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_CREATE_NAMED_PIPE 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_CLOSE 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_READ 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_WRITE 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_QUERY_INFORMATION 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_SET_INFORMATION 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_QUERY_EA 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_SET_EA 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_FLUSH_BUFFERS 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_QUERY_VOLUME_INFORMATION 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_SET_VOLUME_INFORMATION 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_DIRECTORY_CONTROL 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_FILE_SYSTEM_CONTROL 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_DEVICE_CONTROL 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_INTERNAL_DEVICE_CONTROL 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_SHUTDOWN 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_LOCK_CONTROL 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_CLEANUP 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_CREATE_MAILSLOT 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_QUERY_SECURITY 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_SET_SECURITY 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_POWER 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_SYSTEM_CONTROL 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_DEVICE_CHANGE 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_QUERY_QUOTA 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_SET_QUOTA 86782008
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_PNP 86782008
Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer IRP_MJ_READ 85EFDB88
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer IRP_MJ_READ 85EFDB88
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer IRP_MJ_READ 85EFDB88
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer IRP_MJ_READ 85EFDB88
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer IRP_MJ_READ 85EFDB88
Device \FileSystem\Cdfs \Cdfs IRP_MJ_READ 866C6030

---- Modules - GMER 1.0.12 ----

Module _________ F72C2000

---- EOF - GMER 1.0.12 ----

un po lunghetto...
grazie

[giannola]

Originariamente inviato da tinos

interessante programmino gmer... grazie raga.

il file a347bus.sys, sono i driver scsi?

un po lunghetto...
grazie

sembra pulito.


la lunghezza nn è indice di inquinamento.

[lucas84]

Apri il file rasphone.pbk con il block notes e posta il contentuto
Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Connections\Pbk

Ciao

[tinos]

Originariamente inviato da lucas84

Apri il file rasphone.pbk con il block notes e posta il contentuto
Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Connections\Pbk

Ciao

ciao,
sapevo che c'era qualcosa in quel file, ma non sapevo come fare x aprirlo,
grazie.

rasphone

[ALICE]
Encoding=1
Type=5
AutoLogon=0
UseRasCredentials=0
DialParamsUID=590359
Guid=B2136656EDD61E44A4E388753A6BDEA4
BaseProtocol=1
VpnStrategy=0
ExcludedProtocols=3
LcpExtensions=1
DataEncryption=8
SwCompression=1
NegotiateMultilinkAlways=0
SkipNwcWarning=0
SkipDownLevelDialog=0
SkipDoubleDialDialog=0
DialMode=1
DialPercent=75
DialSeconds=120
HangUpPercent=10
HangUpSeconds=120
OverridePref=15
RedialAttempts=3
RedialSeconds=60
IdleDisconnectSeconds=0
RedialOnLinkFailure=1
CallbackMode=0
CustomDialDll=
CustomDialFunc=
CustomRasDialDll=
AuthenticateServer=0
ShareMsFilePrint=0
BindMsNetClient=0
SharedPhoneNumbers=0
GlobalDeviceSettings=0
PrerequisiteEntry=
PrerequisitePbk=
PreferredPort=
PreferredDevice=
PreferredBps=0
PreferredHwFlow=0
PreferredProtocol=0
PreferredCompression=0
PreferredSpeaker=0
PreferredMdmProtocol=0
PreviewUserPw=1
PreviewDomain=0
PreviewPhoneNumber=0
ShowDialingProgress=1
ShowMonitorIconInTaskBar=1
CustomAuthKey=-1
AuthRestrictions=632
TypicalAuth=1
IpPrioritizeRemote=1
IpHeaderCompression=0
IpAddress=0.0.0.0
IpDnsAddress=0.0.0.0
IpDns2Address=0.0.0.0
IpWinsAddress=0.0.0.0
IpWins2Address=0.0.0.0
IpAssign=1
IpNameAssign=1
IpFrameSize=0
IpDnsFlags=0
IpNBTFlags=0
TcpWindowSize=0
UseFlags=1
IpSecFlags=0
IpDnsSuffix=

NETCOMPONENTS=
ms_server=0
ms_msclient=0
ms_psched=1

MEDIA=rastapi
Port=PPPoE6-0
Device=Miniport WAN (PPPOE)

DEVICE=PPPoE
PhoneNumber=
AreaCode=
CountryCode=1
CountryID=1
UseDialingRules=0
Comment=
LastSelectedPhone=0
PromoteAlternates=0
TryNextAlternateOnFail=1

per la connessione remota che ho creato ALICE , vale sempre quello che ho scritto nel mio primo post, cioè che non mi permette di cancellare tale connessione, senza darmi nessun messaggio di errore, diversamente, se tento di rinominarla me la
ricrea con lo stesso nome ALICE, cancellandomi quella che precedentemente avevo rinominato.
se invece tento una modifica delle impostazioni sulla connessione ALICE, ( tasto dex \ proprietà ) le modifiche non le prende
e mi da sempre lo stesso messaggio di errore:
IMPOSSIBILE SCRIVERE SULLA RUBRICA ERRORE 624: IMPOSSIBILE AGGIORNARE IL FILE DELLA RUBRICA TELEFONICA

grazie x la pazienza.

[tinos]

Originariamente inviato da giannola

sembra pulito.


la lunghezza nn è indice di inquinamento.

intendevo dire che poteva essere un po noioso x te da leggere....
mi sono espresso male...ho un po di difficoltà ad esprimere esattamente quello che penso in un forum

giannola, ho trovato in rete questo aggiornamento di gmer, è affidabile?

http://www.suspectfile.com/blog/?postid=7

ciao

[lucas84]

eheh quell'aggiornamento è vecchio,il post sul blog l'ho scritto io
Il file rasphone è pulito,mica per caso il file ha come attributo la sola lettura?,se, vai su opzioni internet e selezioni la connessione aggiunta e clicchi su elimina,la connessione viene eliminata?,disconetti quando fai queste operazioni,se anche questo va male,avvia il file rasphone.exe,(system32) clicchi sulla frecciettina,selezioni la connessione aggiunta e clicchi su rimuovi,se va male resettiamo i parametri nel registro,ciao

[tinos]

[quote]

Originariamente inviato da lucas84

eheh quell'aggiornamento è vecchio,il post sul blog l'ho scritto io

allora c'è da fidarsi sicuramente....

Il file rasphone è pulito,mica per caso il file ha come attributo la sola lettura?

,
allora il problema è altrove.
no non ha l' attributo di sola lettura.

se, vai su opzioni internet e selezioni la connessione aggiunta e clicchi su elimina,la connessione viene eliminata?,disconetti quando fai queste operazioni,

avevo tentato anche questa strada, diverse volte.

se anche questo va male,avvia il file rasphone.exe,(system32) clicchi sulla frecciettina,selezioni la connessione aggiunta e clicchi su rimuovi

già fatto anche questo ( c'era solo ALICE come connessione).

se va male resettiamo i parametri nel registro,ciao

durante questo pomeriggio, ho proseguito così:
regedit, cancello tutte le voci ALICE
riavvio,
la connessione ALICE non esiste più.

ricreo una nuova connessione con il disco di installazione di alice.


faccio una ricerca della voce RASPHONE sul pc, ne risultano 4:


cancello le prime 3 e lascio solo quella in system32
la terza Rasphone.EXE è alquanto sospetta, facendo una ricerca in rete, non sono stato l'unico ad essere colpito http://www.swzone.it/forum/showthread.php?t=48449

dopo un riavvio le tre voci che avevo precedentemente cancellato si sono ricreate.

stando a quello che dicono sul forum di swzone, dovrei disattivare il ripristino di configurazione di sistema prima di procedere con la cancellazione dei 3 file in questione. oppure questi file devono esserci?

ciao

[lucas84]

Io non intendevo così
Disconettiti e spegni il modem
Apri il prompt dos(start>esegui e digita cmd nella casella,clicca su ok)
Ti si apre il prompt dos,adesso digita:
netsh int ip reset
Dai l'invio,attendi un pochino.
Riavvia il pc
Accendi il modem e vedi come va

Ciao

[tinos]

Originariamente inviato da lucas84

Io non intendevo così
Disconettiti e spegni il modem
Apri il prompt dos(start>esegui e digita cmd nella casella,clicca su ok)
Ti si apre il prompt dos,adesso digita:
netsh int ip reset
Dai l'invio,attendi un pochino.
Riavvia il pc
Accendi il modem e vedi come va

Ciao

lo so che non intendevi così, ma purtroppo ho letto il tuo messaggio dopo aver cancellato le voci Alice dal registro.

ho fatto come mi hai detto, faccio prima a postare l'immaggine del risultato.

ho fatto un riavvio, ma non ho notato nessun cambiamento.

adesso il mio dubbio è : avrò ancora qulche trojan all'interno?
quel file Rasphone.EXE deve esserci? oppure devo procedere come ho scritto sopra?

grazie

[lucas84]

Scusa ho sbagliato io
digita dal prompt:
cd desktop <--------invio
netsh int ip reset reset.txt <--------invio

Riavvia il pc e vedi come va

Ciao

[sampei.nihira]

Una curiosità, hai beccato linkoptimizer navigando con I.E.7 ?

Eppure vedo che hai installato Opera nel tuo pc.
Perchè non navighi con quest'ultimo browser ?

[tinos]

Originariamente inviato da lucas84

Scusa ho sbagliato io
digita dal prompt:
cd desktop <--------invio
netsh int ip reset reset.txt <--------invio

Riavvia il pc e vedi come va

Ciao

perfetto, ho eseguito, ti passo il risultato txt.

reset SYSTEM\CurrentControlSet\Services\Dhcp\Parameters\Options\15\RegLocation
old REG_MULTI_SZ =
SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\?\DhcpDomain
SYSTEM\CurrentControlSet\Services\TcpIp\Parameters\DhcpDomain

reset SYSTEM\CurrentControlSet\Services\Netbt\Parameters\Interfaces\Tcpip_{17E34540-F239-4782-B5DC-BD605622270B}\NetbiosOptions
old REG_DWORD = 2

reset SYSTEM\CurrentControlSet\Services\Netbt\Parameters\Interfaces\Tcpip_{248E9785-FA7A-40F5-AE83-6784BAE44E8B}\NetbiosOptions
old REG_DWORD = 2

added SYSTEM\CurrentControlSet\Services\Netbt\Parameters\Interfaces\Tcpip_{275BC2CB-534A-4397-A216-A3D2C13BB692}\NetbiosOptions
reset SYSTEM\CurrentControlSet\Services\Netbt\Parameters\Interfaces\Tcpip_{31F64F21-C33C-4AEB-8CEA-CA9E092355E5}\NetbiosOptions
old REG_DWORD = 2

reset SYSTEM\CurrentControlSet\Services\Netbt\Parameters\Interfaces\Tcpip_{76E28736-85ED-436E-A8D8-356C552718B0}\NameServerList
old REG_MULTI_SZ =
<empty>

added SYSTEM\CurrentControlSet\Services\Netbt\Parameters\Interfaces\Tcpip_{76E28736-85ED-436E-A8D8-356C552718B0}\NetbiosOptions
added SYSTEM\CurrentControlSet\Services\Netbt\Parameters\Interfaces\Tcpip_{86EE7B3E-C4BC-4E75-9671-B05DC35F93F0}\NetbiosOptions
reset SYSTEM\CurrentControlSet\Services\Netbt\Parameters\Interfaces\Tcpip_{EF29FECF-53FC-409F-8D0A-B8CA6A8F215E}\NameServerList
old REG_MULTI_SZ =
<empty>

added SYSTEM\CurrentControlSet\Services\Netbt\Parameters\Interfaces\Tcpip_{EF29FECF-53FC-409F-8D0A-B8CA6A8F215E}\NetbiosOptions
deleted SYSTEM\CurrentControlSet\Services\Netbt\Parameters\EnableLmhosts
added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{17E34540-F239-4782-B5DC-BD605622270B}\DisableDynamicUpdate
deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{17E34540-F239-4782-B5DC-BD605622270B}\IpAutoconfigurationAddress
deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{17E34540-F239-4782-B5DC-BD605622270B}\IpAutoconfigurationMask
deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{17E34540-F239-4782-B5DC-BD605622270B}\IpAutoconfigurationSeed
reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{17E34540-F239-4782-B5DC-BD605622270B}\RawIpAllowedProtocols
old REG_MULTI_SZ =
0

reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{17E34540-F239-4782-B5DC-BD605622270B}\TcpAllowedPorts
old REG_MULTI_SZ =
0

reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{17E34540-F239-4782-B5DC-BD605622270B}\UdpAllowedPorts
old REG_MULTI_SZ =
0

added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{248E9785-FA7A-40F5-AE83-6784BAE44E8B}\AddressType
added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{248E9785-FA7A-40F5-AE83-6784BAE44E8B}\DisableDynamicUpdate
reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{248E9785-FA7A-40F5-AE83-6784BAE44E8B}\RawIpAllowedProtocols
old REG_MULTI_SZ =
0

reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{248E9785-FA7A-40F5-AE83-6784BAE44E8B}\TcpAllowedPorts
old REG_MULTI_SZ =
0

reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{248E9785-FA7A-40F5-AE83-6784BAE44E8B}\UdpAllowedPorts
old REG_MULTI_SZ =
0

added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{6A27A7DF-4440-46E1-AFE8-28F311DA4EEF}\AddressType
added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{6A27A7DF-4440-46E1-AFE8-28F311DA4EEF}\DisableDynamicUpdate
reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{6A27A7DF-4440-46E1-AFE8-28F311DA4EEF}\RawIpAllowedProtocols
old REG_MULTI_SZ =
0

reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{6A27A7DF-4440-46E1-AFE8-28F311DA4EEF}\TcpAllowedPorts
old REG_MULTI_SZ =
0

reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{6A27A7DF-4440-46E1-AFE8-28F311DA4EEF}\UdpAllowedPorts
old REG_MULTI_SZ =
0

deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{76E28736-85ED-436E-A8D8-356C552718B0}\NameServer
added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{7F3B4305-569E-4F49-8C9E-31545368EACD}\AddressType
added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{7F3B4305-569E-4F49-8C9E-31545368EACD}\DisableDynamicUpdate
reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{7F3B4305-569E-4F49-8C9E-31545368EACD}\RawIpAllowedProtocols
old REG_MULTI_SZ =
0

reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{7F3B4305-569E-4F49-8C9E-31545368EACD}\TcpAllowedPorts
old REG_MULTI_SZ =
0

reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{7F3B4305-569E-4F49-8C9E-31545368EACD}\UdpAllowedPorts
old REG_MULTI_SZ =
0

added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BF74531A-EC19-4F7C-8711-D1E26E3BAD51}\AddressType
added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BF74531A-EC19-4F7C-8711-D1E26E3BAD51}\DisableDynamicUpdate
reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BF74531A-EC19-4F7C-8711-D1E26E3BAD51}\RawIpAllowedProtocols
old REG_MULTI_SZ =
0

reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BF74531A-EC19-4F7C-8711-D1E26E3BAD51}\TcpAllowedPorts
old REG_MULTI_SZ =
0

reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BF74531A-EC19-4F7C-8711-D1E26E3BAD51}\UdpAllowedPorts
old REG_MULTI_SZ =
0

deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{EF29FECF-53FC-409F-8D0A-B8CA6A8F215E}\NameServer
deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DontAddDefaultGatewayDefault
deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\EnableIcmpRedirect
deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\EnableSecurityFilters
deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\SearchList
deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\UseDomainNameDevolution
<completed>

ciao

per sampei.nihira:
a dire il vero non so come l'ho beccato, uso tutti e due, alcune pagine OPERA, non riesce ad aprirle oppure le apre codificate con caratteri strani, così ultimamente usavo per lo più IE7

ciao

[lucas84]

Grazie,ma il problema si è risolto?penso di no altrimenti l'avresti scritto.

Ciao

[sampei.nihira]

per sampei.nihira:
a dire il vero non so come l'ho beccato, uso tutti e due, alcune pagine OPERA, non riesce ad aprirle oppure le apre codificate con caratteri strani, così ultimamente usavo per lo più IE7

Si succede spesso,occorre provare ad identificare il browser mascherandolo o identificandolo come I.E. oppure Firefox.
Se ciò non funziona,a mali estremi, anche io uso I.E.7.
Ma io uso aprire I.E.7 ovviamente sempre aggiornato lanciandolo con privilegi limitati (cioè come se fosse lanciato da account limitato).

[tinos]

Originariamente inviato da lucas84

Grazie,ma il problema si è risolto?penso di no altrimenti l'avresti scritto.

Ciao

si il problema lo avevo risolto come ho postato sopra, cancellando dal file di registro la voce ALICE e ricreando una nuova connessione.

l'unico dubbio che mi rimane è se quel file RASPHONE.EXE-11B59....deve esserci, oppure mi conviene cancellarlo, disattivando anche il ripristino di configurazione di sistema, poichè come ho già detto prima, lo avevo cancellato, ma al riavvio si è ricreato.

ciao