|
|||||||
|
|
|
 |
|
|
Strumenti |
25-06-2006, 14:09
|
#2621 | |
|
Bannato
Iscritto dal: Mar 2004
Città: Galapagos Attenzione:utente flautolente,tienilo a mente
Messaggi: 28978
|
Quote:
|
|
|
|
|
25-06-2006, 14:58
|
#2622 |
|
Senior Member
Iscritto dal: Jul 2005
Città: Firenze
Messaggi: 3598
|
fatto grazie.
|
|
|
|
|
26-06-2006, 09:45
|
#2623 |
|
Member
Iscritto dal: Oct 2003
Messaggi: 251
|
Mi ridate un occhio qui grazie :
ogfile of HijackThis v1.99.1 Scan saved at 10.40.17, on 26/06/2006 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\System32\RUNDLL32.EXE C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE C:\Programmi\Internet Explorer\iexplore.exe C:\Programmi\Internet Explorer\iexplore.exe C:\Documents and Settings\Utente\Impostazioni locali\Temp\Directory temporanea 1 per hijackthis_199.zip\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.it/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar2.dll O2 - BHO: (no name) - {DA39029C-D291-A968-3FF4-D0990D5CB5FC} - (no file) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar2.dll O4 - HKLM\..\Run: [SchedulingAgent] mstinit.exe /firstlogon O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O4 - HKLM\..\Run: [EPSON Stylus DX3800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE /P26 "EPSON Stylus DX3800 Series" /O6 "USB002" /M "Stylus DX3800" O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Programmi\Unlocker\UnlockerAssistant.exe" O8 - Extra context menu item: &Cerca con Google - res://c:\programmi\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Traduci parola in italiano - res://c:\programmi\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Link a ritroso - res://c:\programmi\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Pagine simili - res://c:\programmi\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Versione cache della pagina - res://c:\programmi\google\GoogleToolbar2.dll/cmcache.html O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O14 - IERESET.INF: START_PAGE_URL=http://www.google.it/ O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://eu-housecall.trendmicro-europ...vex/hcImpl.cab O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Programmi\TuneUp Utilities 2006\WinStylerThemeSvc.exe |
|
|
|
|
26-06-2006, 09:55
|
#2624 | |
|
Member
Iscritto dal: Dec 2005
Città: Verona
Messaggi: 266
|
Quote:
O2 - BHO: (no name) - {DA39029C-D291-A968-3FF4-D0990D5CB5FC} - (no file) per il resto mi sembra pulito. Ti consiglio di aggiornare IE oppure usare un altro browser, perchè non hai installata l'ultima versione di IE
__________________
"La teoria è quando si sa tutto ma non funziona niente. La pratica è quando funziona tutto ma non si sa il perché. In ogni caso si finisce sempre con il coniugare la teoria con la pratica: non funziona niente e non si sa il perché". Albert Einstein |
|
|
|
|
|
26-06-2006, 10:03
|
#2625 |
|
Senior Member
Iscritto dal: Apr 2006
Città: Milano
Messaggi: 12425
|
E metti pure il Sp2
|
|
|
|
|
26-06-2006, 10:12
|
#2626 |
|
Senior Member
Iscritto dal: Jan 2003
Città: Roma
Messaggi: 371
|
il mio log
cortesemente qualcuno può dare un'occhiata al mio log?
grazie mille... all'avvio una finestra dos con svchost.exe resta aperta finchè non la chiudo io... qualche suggerimento? grazie mille... sempre Logfile of HijackThis v1.99.1 Scan saved at 10.46.22, on 26/06/2006 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) (Unable to list running processes) R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mbe.it/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://goto.energy-factor.com//link....id_profilo=993 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=200.30.45.8:8002;https=200.30.45.8:8002;ftp=200.30.45.8:8002 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,,C:\WINNT\SERVICES.EXE O1 - Hosts: 127.0.0.3 www.onedayoffer.biz O1 - Hosts: 127.0.0.3 onedayoffer.biz O1 - Hosts: 127.0.0.3 callmachine.net O1 - Hosts: 127.0.0.3 www.callmachine.net O1 - Hosts: 127.0.0.3 reportbucks.com O1 - Hosts: 127.0.0.3 www.reportbucks.com O1 - Hosts: 127.0.0.3 isuckall.com O1 - Hosts: 127.0.0.3 www.isuckall.com O1 - Hosts: 127.0.0.3 wbdialer.biz O1 - Hosts: 127.0.0.3 www.wbdialer.biz O1 - Hosts: 127.0.0.3 alphadialer.com O1 - Hosts: 127.0.0.3 www.alphadialer.com O1 - Hosts: 127.0.0.3 it.online-more.com O1 - Hosts: 127.0.0.3 www.it.online-more.com O1 - Hosts: 127.0.0.3 statscash.net O1 - Hosts: 127.0.0.3 www.statscash.net O1 - Hosts: 127.0.0.3 85.255.113.242 O1 - Hosts: 127.0.0.3 takeyourbucks.com O1 - Hosts: 127.0.0.3 www.takeyourbucks.com O1 - Hosts: 127.0.0.3 195.225.176.25 O1 - Hosts: 127.0.0.3 iframebiz.biz O1 - Hosts: 127.0.0.3 iframeurl.biz O1 - Hosts: 127.0.0.3 iframesite.biz O1 - Hosts: 127.0.0.3 toolbarbiz.biz O1 - Hosts: 127.0.0.3 toolbarsite.biz O1 - Hosts: 127.0.0.3 toolbarurl.biz O1 - Hosts: 127.0.0.3 toolbartraff.biz O1 - Hosts: 127.0.0.3 buytoolbar.biz O1 - Hosts: 127.0.0.3 www.iframebiz.biz O1 - Hosts: 127.0.0.3 www.iframeurl.biz O1 - Hosts: 127.0.0.3 www.iframesite.biz O1 - Hosts: 127.0.0.3 www.toolbarbiz.biz O1 - Hosts: 127.0.0.3 www.toolbarsite.biz O1 - Hosts: 127.0.0.3 www.toolbarurl.biz O1 - Hosts: 127.0.0.3 www.toolbartraff.biz O1 - Hosts: 127.0.0.3 www.buytoolbar.biz O1 - Hosts: 127.0.0.3 81.9.5.9 O1 - Hosts: 127.0.0.3 n-glx.s-redirect.com O1 - Hosts: 127.0.0.3 www.sexfiles.nu O1 - Hosts: 127.0.0.3 awmdabest.com O1 - Hosts: 127.0.0.3 sexfiles.nu O1 - Hosts: 127.0.0.3 allforadult.com O1 - Hosts: 127.0.0.3 www.allforadult.com O1 - Hosts: 127.0.0.3 www.iframe.biz O1 - Hosts: 127.0.0.3 iframe.biz O1 - Hosts: 127.0.0.3 procounter.biz O1 - Hosts: 127.0.0.3 www.procounter.biz O1 - Hosts: 127.0.0.3 advadmin.biz O1 - Hosts: 127.0.0.3 www.advadmin.biz O1 - Hosts: 127.0.0.3 trafficbest.net O1 - Hosts: 127.0.0.3 www.trafficbest.net O1 - Hosts: 127.0.0.3 www.newiframe.biz O1 - Hosts: 127.0.0.3 newiframe.biz O1 - Hosts: 127.0.0.3 www.vesbiz.biz O1 - Hosts: 127.0.0.3 vesbiz.biz O1 - Hosts: 127.0.0.3 www.pizdato.biz O1 - Hosts: 127.0.0.3 pizdato.biz O1 - Hosts: 127.0.0.3 www.aaasexypics.com O1 - Hosts: 127.0.0.3 aaasexypics.com O1 - Hosts: 127.0.0.3 www.virgin-tgp.net O1 - Hosts: 127.0.0.3 vparivalka.com O1 - Hosts: 127.0.0.3 www.vparivalka.com O1 - Hosts: 127.0.0.3 iframeprofit.com O1 - Hosts: 127.0.0.3 www.iframeprofit.com O1 - Hosts: 127.0.0.3 virgin-tgp.net O1 - Hosts: 127.0.0.3 www.awmcash.biz O1 - Hosts: 127.0.0.3 awmcash.biz O1 - Hosts: 127.0.0.3 buldog-stats.com O1 - Hosts: 127.0.0.3 www.buldog-stats.com O1 - Hosts: 127.0.0.3 fregat.drocherway.com O1 - Hosts: 127.0.0.3 slutmania.biz O1 - Hosts: 127.0.0.3 www.slutmania.biz O1 - Hosts: 127.0.0.3 toolbarpartner.com O1 - Hosts: 127.0.0.3 www.toolbarpartner.com O1 - Hosts: 127.0.0.3 www.megapornix.com O1 - Hosts: 127.0.0.3 megapornix.com O1 - Hosts: 127.0.0.3 www.sp2fucked.biz O1 - Hosts: 127.0.0.3 sp2fucked.biz O1 - Hosts: 127.0.0.3 greg-tut.com O1 - Hosts: 127.0.0.3 www.greg-tut.com O1 - Hosts: 127.0.0.3 nylonsexy.com O1 - Hosts: 127.0.0.3 www.nylonsexy.com O1 - Hosts: 127.0.0.3 topsearch10.com O1 - Hosts: 127.0.0.3 www.topsearch10.com O1 - Hosts: 127.0.0.3 statscash.biz O1 - Hosts: 127.0.0.3 www.statscash.biz O1 - Hosts: 127.0.0.3 vxiframe.biz O1 - Hosts: 127.0.0.3 www.vxiframe.biz O1 - Hosts: 127.0.0.3 crazy-toolbar.com O1 - Hosts: 127.0.0.3 www.crazy-toolbar.com O1 - Hosts: 127.0.0.3 topcash.biz O1 - Hosts: 127.0.0.3 www.topcash.biz O1 - Hosts: 127.0.0.3 loadcash.biz O1 - Hosts: 127.0.0.3 www.loadcash.biz O1 - Hosts: 127.0.0.3 txiframe.biz O1 - Hosts: 127.0.0.3 www.txiframe.biz O1 - Hosts: 127.0.0.3 besthvac.com O1 - Hosts: 127.0.0.3 www.besthvac.com O1 - Hosts: 127.0.0.3 traff4.com O1 - Hosts: 127.0.0.3 www.traff4.com O1 - Hosts: 127.0.0.3 porn-host.org O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Programmi\Norton AntiVirus\NavShExt.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar2.dll O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar2.dll O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Programmi\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe O4 - HKLM\..\Run: [3c1807pd] C:\WINNT\SYSTEM32\3cmlink.exe RunServices \Device\3cpipe-3c1807pd O4 - HKLM\..\Run: [StatusClient] C:\Programmi\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto O4 - HKLM\..\Run: [TomcatStartup] C:\Programmi\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe O4 - HKLM\..\Run: [CDWCheckRubrica] C:\SEAT\CDItalia\Chkrub_cdi O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Programmi\File comuni\Symantec Shared\Security Center\UsrPrmpt.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe O4 - HKLM\..\Run: [E-nrgyPlus] C:\Programmi\E-nrgyPlus\E-nrgyPlus.exe O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec Shared\ccApp.exe" O4 - HKCU\..\Run: [NCLaunch] C:\WINNT\NCLAUNCH.EXe O4 - HKCU\..\Run: [NBJ] "C:\Programmi\Ahead\Nero BackItUp\NBJ.exe" O4 - Startup: MbeS@m.lnk = C:\Programmi\MbeS@m\StartS@m.exe O4 - Startup: WinDrv.lnk = C:\Super-90\windrv.exe O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Google Search - res://c:\programmi\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\programmi\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\programmi\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\programmi\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://c:\programmi\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\programmi\google\GoogleToolbar2.dll/cmtrans.html O15 - Trusted Zone: www.1987324.com O17 - HKLM\System\CCS\Services\Tcpip\..\{164CF12A-BB2C-4FFD-B9B7-ED948C64AED8}: NameServer = 212.17.192.49,212.17.192.216 O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: PCANotify - C:\WINNT\SYSTEM32\PCANotify.dll O23 - Service: Servizio host di pcAnywhere (awhost32) - Symantec Corporation - C:\Programmi\Symantec\pcAnywhere\awhost32.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Programmi\Executive Software\Diskeeper\DkService.exe O23 - Service: Servizio amministrativo di Gestione disco logico (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Servizio Auto-Protect di Norton AntiVirus (navapsvc) - Symantec Corporation - C:\Programmi\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Programmi\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\Security Console\NSCSRVCE.EXE O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Programmi\Norton AntiVirus\SAVScan.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\SNDSrvc.exe O23 - Service: SPBBCSvc - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\Security Center\SymWSC.exe O23 - Service: Utilità di pianificazione di LiveUpdate automatico - Symantec Corporation - C:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: WShipServiceCom - Unknown owner - C:\UPS\WorldShip\Wshipservicecom.exe
__________________
uno, nessuno e centomila |
|
|
|
|
26-06-2006, 10:45
|
#2627 | |
|
Bannato
Iscritto dal: Mar 2004
Città: Galapagos Attenzione:utente flautolente,tienilo a mente
Messaggi: 28978
|
Quote:
|
|
|
|
|
|
26-06-2006, 10:52
|
#2628 |
|
Senior Member
Iscritto dal: Jan 2003
Città: Roma
Messaggi: 371
|
cioè? il programma per la posta elettronica? outlook
__________________
uno, nessuno e centomila |
|
|
|
|
26-06-2006, 10:54
|
#2629 |
|
Senior Member
Iscritto dal: Apr 2003
Messaggi: 1571
|
Chiavi sospette...
Salve,
che ne dite di queste voci, mi sembrano alquanto sospette: R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;127.0.0.1;<local> R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti E poi, qualcuno conosce MOTIVE~1.EXE e FINDFAST.EXE??? C:\PROGRA~1\Motive\ASSTCO~1\MOTIVE~1.EXE O4 - HKLM\..\Run: [CnxTrApp] rundll32.exe "C:\Programmi\Aethra\ADSL EB1070 USB\CnxTrApp.dll",AppEntry -REG "Aethra\ADSL EB1070 USB" O4 - Global Startup: Alice ti aiuta.lnk = C:\Programmi\Alice ti aiuta\bin\matcli.exe O4 - Global Startup: Ricerca rapida.lnk = C:\Programmi\Microsoft Office\Office\FINDFAST.EXE Grazie, SK |
|
|
|
|
26-06-2006, 10:57
|
#2630 | |
|
Bannato
Iscritto dal: Mar 2004
Città: Galapagos Attenzione:utente flautolente,tienilo a mente
Messaggi: 28978
|
Quote:
|
|
|
|
|
|
26-06-2006, 11:38
|
#2631 |
|
Senior Member
Iscritto dal: Jan 2003
Città: Roma
Messaggi: 371
|
ho ancora il problema:
 e qui il nuovo log... potete darmi una mano? Logfile of HijackThis v1.99.1 Scan saved at 12.34.34, on 26/06/2006 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe C:\Programmi\File comuni\Symantec Shared\SNDSrvc.exe C:\Programmi\File comuni\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINNT\system32\spoolsv.exe C:\Programmi\Executive Software\Diskeeper\DkService.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\hidserv.exe C:\Programmi\Norton AntiVirus\navapsvc.exe C:\Programmi\Norton AntiVirus\IWP\NPFMntor.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\UPS\WorldShip\Wshipservicecom.exe C:\WINNT\system32\svchost.exe C:\WINNT\Explorer.EXE C:\WINNT\SOUNDMAN.EXE C:\WINNT\System32\igfxtray.exe C:\WINNT\System32\hkcmd.exe C:\WINNT\SYSTEM32\3cmlink.exe C:\WINNT\SYSTEM32\3cshtdwn.exe C:\Programmi\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe C:\WINNT\SYSTEM32\3cmlink.exe C:\Programmi\File comuni\Symantec Shared\ccApp.exe C:\WINNT\NCLAUNCH.EXe C:\Programmi\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe C:\Super-90\windrv.exe C:\Programmi\MbeS@m\MbeS@m.mbe C:\Programmi\File comuni\Symantec Shared\Security Console\NSCSRVCE.EXE C:\Programmi\Internet Explorer\IEXPLORE.EXE C:\WINNT\System32\svchost.exe C:\Programmi\Internet Explorer\IEXPLORE.EXE C:\PROGRA~1\WINZIP\winzip32.exe C:\Documents and Settings\Administrator\Impostazioni locali\Temp\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mbe.it/home.php?lang=3 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://goto.energy-factor.com//link....id_profilo=993 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=200.30.45.8:8002;https=200.30.45.8:8002;ftp=200.30.45.8:8002 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,,C:\WINNT\SERVICES.EXE O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Programmi\Norton AntiVirus\NavShExt.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar2.dll O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar2.dll O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Programmi\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe O4 - HKLM\..\Run: [3c1807pd] C:\WINNT\SYSTEM32\3cmlink.exe RunServices \Device\3cpipe-3c1807pd O4 - HKLM\..\Run: [StatusClient] C:\Programmi\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto O4 - HKLM\..\Run: [TomcatStartup] C:\Programmi\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe O4 - HKLM\..\Run: [CDWCheckRubrica] C:\SEAT\CDItalia\Chkrub_cdi O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Programmi\File comuni\Symantec Shared\Security Center\UsrPrmpt.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe O4 - HKLM\..\Run: [E-nrgyPlus] C:\Programmi\E-nrgyPlus\E-nrgyPlus.exe O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec Shared\ccApp.exe" O4 - HKCU\..\Run: [NCLaunch] C:\WINNT\NCLAUNCH.EXe O4 - HKCU\..\Run: [NBJ] "C:\Programmi\Ahead\Nero BackItUp\NBJ.exe" O4 - Startup: MbeS@m.lnk = C:\Programmi\MbeS@m\StartS@m.exe O4 - Startup: WinDrv.lnk = C:\Super-90\windrv.exe O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Google Search - res://c:\programmi\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\programmi\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\programmi\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\programmi\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://c:\programmi\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\programmi\google\GoogleToolbar2.dll/cmtrans.html O17 - HKLM\System\CCS\Services\Tcpip\..\{164CF12A-BB2C-4FFD-B9B7-ED948C64AED8}: NameServer = 212.17.192.49,212.17.192.216 O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll O23 - Service: Servizio host di pcAnywhere (awhost32) - Symantec Corporation - C:\Programmi\Symantec\pcAnywhere\awhost32.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Programmi\Executive Software\Diskeeper\DkService.exe O23 - Service: Servizio amministrativo di Gestione disco logico (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Servizio Auto-Protect di Norton AntiVirus (navapsvc) - Symantec Corporation - C:\Programmi\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Programmi\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\Security Console\NSCSRVCE.EXE O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Programmi\Norton AntiVirus\SAVScan.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\SNDSrvc.exe O23 - Service: SPBBCSvc - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\Security Center\SymWSC.exe O23 - Service: Utilità di pianificazione di LiveUpdate automatico - Symantec Corporation - C:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: WShipServiceCom - Unknown owner - C:\UPS\WorldShip\Wshipservicecom.exe
__________________
uno, nessuno e centomila |
|
|
|
|
26-06-2006, 11:57
|
#2632 |
|
Bannato
Iscritto dal: Mar 2004
Città: Galapagos Attenzione:utente flautolente,tienilo a mente
Messaggi: 28978
|
1)disabilita il ripristino di configurazione sistema
2)accedi in modalità provvisoria(F8 all'avvio) 3)riesegui HJT e fixa le voci che ti ho indicato prima 4)riavvia e rifai lo scan |
|
|
|
|
26-06-2006, 12:00
|
#2633 |
|
Bannato
Iscritto dal: Mar 2004
Città: Galapagos Attenzione:utente flautolente,tienilo a mente
Messaggi: 28978
|
controlla su arin.net chi risulta proprietario di quei numeri IP
|
|
|
|
|
26-06-2006, 12:18
|
#2634 | |
|
Senior Member
Iscritto dal: Apr 2003
Messaggi: 1571
|
Quote:
|
|
|
|
|
|
01-07-2006, 14:05
|
#2635 |
|
Senior Member
Iscritto dal: Jan 2002
Messaggi: 1574
|
mi date un'occhiata,io continuo a cancellare le tre righe (015) ma continuano ad apparire.Grazie ciao.
Logfile of HijackThis v1.98.0 Scan saved at 14.59.18, on 01/07/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) (Unable to list running processes) R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,,C:\WINDOWS\SERVICES.EXE O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_07\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar1.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar1.dll O4 - HKLM\..\Run: [ATICCC] "C:\Programmi\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programmi\MessengerPlus! 3\MsgPlus.exe" O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [oeuai] C:\Documents and Settings\Liuk\Dati applicazioni\tofareraci\systvmrs.exe O4 - HKLM\..\Run: [Internet Check] c:\activech.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_07\bin\jusched.exe O4 - HKCU\..\Run: [Spamihilator] "C:\Programmi\Spamihilator\spamihilator.exe" O4 - HKCU\..\Run: [VoipStunt] "C:\programmi\voipstunt.com\voipstunt\voipstunt.exe" -nosplash -minimized O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [updateMgr] C:\Programmi\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1 O4 - HKCU\..\Run: [Skype] "C:\Programmi\Skype\Phone\Skype.exe" /nosplash /minimized O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_07\bin\ssv.dll O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O15 - Trusted Zone: www.adslconnection.name O15 - Trusted Zone: www.softlab.name O15 - Trusted Zone: www.xxx-content.name O17 - HKLM\System\CCS\Services\Tcpip\..\{3DCD82B3-CECF-4EE0-82CB-E0D4AAFE5968}: NameServer = 192.168.0.1,192.168.0.3 O17 - HKLM\System\CS1\Services\Tcpip\..\{3DCD82B3-CECF-4EE0-82CB-E0D4AAFE5968}: NameServer = 192.168.0.1,192.168.0.3 O17 - HKLM\System\CS2\Services\Tcpip\..\{3DCD82B3-CECF-4EE0-82CB-E0D4AAFE5968}: NameServer = 192.168.0.1,192.168.0.3 O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll"
__________________
Corsair RM650 - Asus Prime B550 plus - AMD Ryzen 5 5600X - Corsair Vengeance RGB PRO 16 GB - GeForce2070 RTX ROg Strix - Crucial Mx300 525 GB SATA 3 - LiteOn LH-20A1H - Pioneer 212D -ASUS TUF Gaming VG27AQ1A (2560x1440)- - Win 11 - LG OLED 65CX - Audio analogue maestro - Snell Tower - ---> Half-Life Club <--- |
|
|
|
|
01-07-2006, 14:20
|
#2636 |
|
Senior Member
Iscritto dal: May 2005
Città: Palermo
Messaggi: 6390
|
Metti la spunta nella casellina accanto alle seguenti voci e premi fix checked:
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,,C:\WINDOWS\SERVICES.EXE O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [oeuai] C:\Documents and Settings\Liuk\Dati applicazioni\tofareraci\systvmrs.exe O4 - HKLM\..\Run: [Internet Check] c:\activech.exe O15 - Trusted Zone: www.adslconnection.name O15 - Trusted Zone: www.softlab.name O15 - Trusted Zone: www.xxx-content.name Scarica killbox da qui: http://www.bleepingcomputer.com/files/killbox.php Vai su start/risorse del computer/strumenti/opzioni cartella/visualizzazione e visualizza cartelle e file nascosti e togli la spunta da ''nascondi i file protetti di sistema''. Con killbox elimina i seguenti files exe: C:\WINDOWS\SERVICES.EXE C:\Documents and Settings\Liuk\Dati applicazioni\tofareraci\systvmrs.exe (dopo aver eliminato il file systvmrs.exe elimina anche la cartella tofareraci ). Fai una scansione con ewido: http://www.ewido.net/en/onlinescan/ |
|
|
|
|
01-07-2006, 14:46
|
#2637 |
|
Member
Iscritto dal: Dec 2003
Messaggi: 217
|
raga vi andrebbe se controllare anche il mio?
Logfile of HijackThis v1.99.1 Scan saved at 15.38.15, on 01/07/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Programmi\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Programmi\AntiVir PersonalEdition Classic\sched.exe C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe C:\Programmi\ewido anti-spyware 4.0\guard.exe C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Programmi\File comuni\Softwin\BitDefender Communicator\xcommsvr.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RunDLL32.exe C:\Programmi\Softwin\BitDefender8\bdnagent.exe C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe C:\Programmi\ewido anti-spyware 4.0\ewido.exe C:\Programmi\Windows Defender\MSASCui.exe C:\WINDOWS\system32\ctfmon.exe C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\system32\svchost.exe C:\Programmi\Teamspeak2_RC2\TeamSpeak.exe C:\Programmi\Mozilla Firefox\firefox.exe C:\Programmi\File comuni\Softwin\BitDefender Scan Server\bdss.exe c:\programmi\softwin\bitdefender8\bdlite.exe C:\Alpha\programmi e utility\Ad-Aware SE Personal\Ad-Aware.exe C:\Alpha\hijackthis_199\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.otherchance.com/?rid=[WM] R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti R3 - Default URLSearchHook is missing O1 - Hosts: ip.icehosting.com L2authd.lineage2.com O1 - Hosts: ip.icehosting.com L2testauthd.lineage2.com O1 - Hosts: ip.icehosting.com nprotect.lineage2.com O1 - Hosts: 2.com O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {96C82C87-3778-54D9-8E08-4A5C47AB9D53} - C:\DOCUME~1\giovanni\DATIAP~1\USERMU~1\BuildBase.exe (file missing) O2 - BHO: VCS3IESupport Class - {B9D6B3C2-09AD-464A-8162-8C55114C808A} - C:\Alpha\programmi e utility\AV VCS 3.0 Gold\Vcs3RT.dll O2 - BHO: Class - {DA39029C-D291-A968-3FF4-D0990D5CB5FC} - C:\Programmi\LinkOptimizer\LinkOptimizer.dll (file missing) O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [Olympic] C:\Documents and Settings\giovanni\Dati applicazioni\sgrunt\IE4321.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [HP Software Update] C:\Programmi\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [BDMCon] "C:\Programmi\Softwin\BitDefender8\bdmcon.exe" O4 - HKLM\..\Run: [BDNewsAgent] "c:\programmi\softwin\bitdefender8\bdnagent.exe" O4 - HKLM\..\Run: [avgnt] "C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [xjvl2.exe] C:\WINDOWS\Temp\xjvl2.exe O4 - HKLM\..\Run: [xjvl3.exe] C:\WINDOWS\Temp\xjvl3.exe O4 - HKLM\..\Run: [xjvl4.exe] C:\WINDOWS\Temp\xjvl4.exe O4 - HKLM\..\Run: [xjvl5.exe] C:\WINDOWS\Temp\xjvl5.exe O4 - HKLM\..\Run: [xjvl7.exe] C:\WINDOWS\Temp\xjvl7.exe O4 - HKLM\..\Run: [xjvl8.exe] C:\WINDOWS\Temp\xjvl8.exe O4 - HKLM\..\Run: [xjvl9.exe] C:\WINDOWS\Temp\xjvl9.exe O4 - HKLM\..\Run: [xjvl10.exe] C:\WINDOWS\Temp\xjvl10.exe O4 - HKLM\..\Run: [xjvl11.exe] C:\WINDOWS\Temp\xjvl11.exe O4 - HKLM\..\Run: [xjvl12.exe] C:\WINDOWS\Temp\xjvl12.exe O4 - HKLM\..\Run: [xjvl13.exe] C:\WINDOWS\Temp\xjvl13.exe O4 - HKLM\..\Run: [xjvl14.exe] C:\WINDOWS\Temp\xjvl14.exe O4 - HKLM\..\Run: [xjvl15.exe] C:\WINDOWS\Temp\xjvl15.exe O4 - HKLM\..\Run: [xjvl16.exe] C:\WINDOWS\Temp\xjvl16.exe O4 - HKLM\..\Run: [xjvl17.exe] C:\WINDOWS\Temp\xjvl17.exe O4 - HKLM\..\Run: [xjvl18.exe] C:\WINDOWS\Temp\xjvl18.exe O4 - HKLM\..\Run: [xjvl19.exe] C:\WINDOWS\Temp\xjvl19.exe O4 - HKLM\..\Run: [xjvl20.exe] C:\WINDOWS\Temp\xjvl20.exe O4 - HKLM\..\Run: [xjvl21.exe] C:\WINDOWS\Temp\xjvl21.exe O4 - HKLM\..\Run: [!ewido] "C:\Programmi\ewido anti-spyware 4.0\ewido.exe" /minimized O4 - HKLM\..\Run: [Windows Defender] "C:\Programmi\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [kis] "C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Programmi\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_04\bin\jusched.exe O4 - HKLM\..\Run: [MultiRes] C:\Programmi\MultiRes\MultiRes.exe O4 - HKLM\..\Run: [WireLessMouse] C:\Programmi\Nortek Mouse Application\MouseDrv.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [xjvl22.exe] C:\WINDOWS\Temp\xjvl22.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Programmi\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [VoipStunt] "C:\Programmi\VoipStunt.com\VoipStunt\VoipStunt.exe" -nosplash -minimized O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [Update Service] C:\PROGRA~1\FILECO~1\TEKNUM~1\update.exe /startup O8 - Extra context menu item: &Download with &DAP - C:\Programmi\DAP\dapextie.htm O8 - Extra context menu item: Download &all with DAP - C:\Programmi\DAP\dapextie2.htm O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\MSMSGS.EXE O12 - Plugin for .spop: C:\Programmi\Internet Explorer\Plugins\NPDocBox.dll O15 - Trusted Zone: www.otherchance.com O15 - Trusted Zone: www.powersoft.name O15 - Trusted Zone: www.superspots.biz O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary...o.cab32846.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{986AB37A-0E9D-445A-8A02-CB23FEF3876F}: NameServer = 213.205.32.70 213.205.36.70 O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll O23 - Service: Adobe LM Service - Unknown owner - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmi\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: ATK Keyboard Service (ATKKeyboardService) - Unknown owner - C:\WINDOWS\ATKKBService.exe (file missing) O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing) O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Programmi\File comuni\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing) O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Programmi\ewido anti-spyware 4.0\guard.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - Unknown owner - C:\WINDOWS\system32\HPZipm12.exe (file missing) O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Programmi\File comuni\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing) |
|
|
|
|
01-07-2006, 15:01
|
#2638 | |
|
Senior Member
Iscritto dal: Jan 2002
Messaggi: 1574
|
Quote:
__________________
Corsair RM650 - Asus Prime B550 plus - AMD Ryzen 5 5600X - Corsair Vengeance RGB PRO 16 GB - GeForce2070 RTX ROg Strix - Crucial Mx300 525 GB SATA 3 - LiteOn LH-20A1H - Pioneer 212D -ASUS TUF Gaming VG27AQ1A (2560x1440)- - Win 11 - LG OLED 65CX - Audio analogue maestro - Snell Tower - ---> Half-Life Club <--- |
|
|
|
|
|
01-07-2006, 15:06
|
#2639 | |
|
Senior Member
Iscritto dal: May 2005
Città: Palermo
Messaggi: 6390
|
Quote:
http://img434.imageshack.us/img434/8...shot0018xo.jpg |
|
|
|
|
|
01-07-2006, 15:17
|
#2640 |
|
Senior Member
Iscritto dal: May 2005
Città: Palermo
Messaggi: 6390
|
gardos metti la spunta nella casellina accanto alle seguenti voci e premi fix checked:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.otherchance.com/?rid=[WM] R3 - Default URLSearchHook is missing O1 - Hosts: ip.icehosting.com L2authd.lineage2.com O1 - Hosts: ip.icehosting.com L2testauthd.lineage2.com O1 - Hosts: ip.icehosting.com nprotect.lineage2.com O1 - Hosts: 2.com O2 - BHO: (no name) - {96C82C87-3778-54D9-8E08-4A5C47AB9D53} - C:\DOCUME~1\giovanni\DATIAP~1\USERMU~1\BuildBase.exe (file missing) O2 - BHO: Class - {DA39029C-D291-A968-3FF4-D0990D5CB5FC} - C:\Programmi\LinkOptimizer\LinkOptimizer.dll (file missing) O4 - HKLM\..\Run: [Olympic] C:\Documents and Settings\giovanni\Dati applicazioni\sgrunt\IE4321.exe O4 - HKLM\..\Run: [xjvl2.exe] C:\WINDOWS\Temp\xjvl2.exe O4 - HKLM\..\Run: [xjvl3.exe] C:\WINDOWS\Temp\xjvl3.exe O4 - HKLM\..\Run: [xjvl4.exe] C:\WINDOWS\Temp\xjvl4.exe O4 - HKLM\..\Run: [xjvl5.exe] C:\WINDOWS\Temp\xjvl5.exe O4 - HKLM\..\Run: [xjvl7.exe] C:\WINDOWS\Temp\xjvl7.exe O4 - HKLM\..\Run: [xjvl8.exe] C:\WINDOWS\Temp\xjvl8.exe O4 - HKLM\..\Run: [xjvl9.exe] C:\WINDOWS\Temp\xjvl9.exe O4 - HKLM\..\Run: [xjvl10.exe] C:\WINDOWS\Temp\xjvl10.exe O4 - HKLM\..\Run: [xjvl11.exe] C:\WINDOWS\Temp\xjvl11.exe O4 - HKLM\..\Run: [xjvl12.exe] C:\WINDOWS\Temp\xjvl12.exe O4 - HKLM\..\Run: [xjvl13.exe] C:\WINDOWS\Temp\xjvl13.exe O4 - HKLM\..\Run: [xjvl14.exe] C:\WINDOWS\Temp\xjvl14.exe O4 - HKLM\..\Run: [xjvl15.exe] C:\WINDOWS\Temp\xjvl15.exe O4 - HKLM\..\Run: [xjvl16.exe] C:\WINDOWS\Temp\xjvl16.exe O4 - HKLM\..\Run: [xjvl17.exe] C:\WINDOWS\Temp\xjvl17.exe O4 - HKLM\..\Run: [xjvl18.exe] C:\WINDOWS\Temp\xjvl18.exe O4 - HKLM\..\Run: [xjvl19.exe] C:\WINDOWS\Temp\xjvl19.exe O4 - HKLM\..\Run: [xjvl20.exe] C:\WINDOWS\Temp\xjvl20.exe O4 - HKLM\..\Run: [xjvl21.exe] C:\WINDOWS\Temp\xjvl21.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [xjvl22.exe] C:\WINDOWS\Temp\xjvl22.exe O15 - Trusted Zone: www.otherchance.com O15 - Trusted Zone: www.powersoft.name O15 - Trusted Zone: www.superspots.biz O23 - Service: ATK Keyboard Service (ATKKeyboardService) - Unknown owner - C:\WINDOWS\ATKKBService.exe (file missing) O23 - Service: Pml Driver HPZ12 - Unknown owner - C:\WINDOWS\system32\HPZipm12.exe (file missing) scarica ATF cleaner da qui: http://www.atribune.org/ccount/click.php?id=1 Avvialo. Clicca sul menu main e poi seleziona la casella Select All. Adesso clicca sul pulsante Empty selected e aspetta il messaggio Done Cleaning!. Fai una scansione con Killsgrunt: http://www.francydelorenzi.it/compon.../filecatid,105 |
|
|
|
|
|
| Strumenti | |
|
|
Tutti gli orari sono GMT +1. Ora sono le: 14:36.
