|
|||||||
|
|
|
 |
|
|
Strumenti |
30-07-2004, 23:27
|
#41 |
|
Senior Member
Iscritto dal: May 2001
Messaggi: 1740
|
nessuno a detto che lo sei...
io mi riferivo alla tua situazione che è complicata... sono qui per darti una mano... e anche wgator...
__________________
www.tweakness.net - Trucchi per il PC DECALOGO ANTISPY - GUIDA A HIJACKTHIS - GUIDA AI SERVIZI DI WIN XP - CONSIGLI ANTIVIRUS PER BART'S PE - SP2 SLIPSTREAMING - FAQ WINDOWS XPSP2 - I SERVIZI DOPO SP2 - XP SP2 UNATTENDED - GUIDA A nLite |
|
|
|
30-07-2004, 23:30
|
#42 |
|
Member
Iscritto dal: Jul 2004
Messaggi: 203
|
lo so stavo solo scherzando
 cmq ho rifatto tutto Logfile of HijackThis v1.98.0 Scan saved at 23.27.44, on 30/07/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\RunDll32.exe C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\System32\wuam.exe C:\WINDOWS\System32\demm3861.exe C:\WINDOWS\System32\ntsystem.exe C:\WINDOWS\System32\xjzurd.exe C:\Programmi\CashBack\bin\cashback.exe C:\Programmi\NaviSearch\bin\nls.exe C:\Programmi\LG PC Suite\LG PC Sync\LGSyncManager.exe C:\Programmi\Microsoft Office\Office10\msoffice.exe C:\WINDOWS\System32\rfrr.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\WindUpdates\WinKA.exe c:\mot.exe c:\mot.exe C:\WINDOWS\ysxou.exe c:\ovr.exe C:\Program Files\WindUpdates\WinUpdt.exe C:\Documents and Settings\med\Impostazioni locali\Temp\Directory temporanea 1 per hijackthis.zip\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.myfunstart.com/index.cfm?pc=bdhp R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti R3 - Default URLSearchHook is missing O2 - BHO: (no name) - {00041A26-7033-432C-94C7-6371DE343822} - (no file) O2 - BHO: Recommended Hotfix - {0421701D-CF13-4E70-ADF0-45A953E7CB8B} - C:\Programmi\Recommended Hotfix - 421701D\v15\RH.DLL O2 - BHO: (no name) - {18DF445C-B161-51E4-8406-655579A02B4B} - C:\WINDOWS\System32\gbkkxwtp.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [Microsoft Update Time] wuam.exe O4 - HKLM\..\Run: [demm3861.exe] demm3861.exe O4 - HKLM\..\Run: [Windows System Manager Loader] smsls.exe O4 - HKLM\..\Run: [Microsoft Update Machine] ntsystem.exe O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\Downloaded Program Files\bridge.dll",Load O4 - HKLM\..\Run: [wybxity] C:\WINDOWS\System32\xjzurd.exe O4 - HKLM\..\Run: [CashBack] C:\Programmi\CashBack\bin\cashback.exe O4 - HKLM\..\Run: [NaviSearch] C:\Programmi\NaviSearch\bin\nls.exe O4 - HKLM\..\Run: [Windows SA] C:\Program Files\WindowsSA\omniscient.exe O4 - HKLM\..\Run: [ngvkhaj] C:\WINDOWS\ngvkhaj.exe O4 - HKLM\..\Run: [vspru] C:\WINDOWS\ysxou.exe O4 - HKLM\..\Run: [WindUpdates] C:\Program Files\WindUpdates\WinUpdt.exe O4 - HKLM\..\RunServices: [Microsoft Update Time] wuam.exe O4 - HKLM\..\RunServices: [demm3861.exe] demm3861.exe O4 - HKLM\..\RunServices: [Windows System Manager Loader] smsls.exe O4 - HKLM\..\RunServices: [Microsoft Update Machine] ntsystem.exe O4 - HKLM\..\RunOnce: [Ad-aware] "C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-aware.exe" "+b1" O4 - HKCU\..\Run: [Microsoft Update Time] wuam.exe O4 - HKCU\..\Run: [Microsoft Update Machine] ntsystem.exe O4 - HKCU\..\Run: [demm3861.exe] demm3861.exe O4 - Global Startup: LG Sync Manager.lnk = ? O4 - Global Startup: LG SyncManager.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_fi...1a0351cafa03db O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} - http://cabs.media-motor.net/cabs/mmed.cab O16 - DPF: {F57D17AE-CE37-4BC8-B232-EA57747BE5E7} - http://66.230.146.53/EPlugin_IT.cab O20 - AppInit_DLLs: C:\WINDOWS\System32\wmpui482e.dll ps non mi prendere mai sul serio ok? cmq riguardo l'uso di questi programi hj........ ecct deficente un po lo sono |
|
|
|
|
30-07-2004, 23:32
|
#43 |
|
Senior Member
Iscritto dal: May 2001
Messaggi: 1740
|
purtroppo ancora non siamo riusciti a pulirlo
ti consiglio di riavviare in provvisoria e fare da lì la pulizia di: R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.myfunstart.com/index.cfm?pc=bdhp R3 - Default URLSearchHook is missing O2 - BHO: (no name) - {00041A26-7033-432C-94C7-6371DE343822} - (no file) O2 - BHO: Recommended Hotfix - {0421701D-CF13-4E70-ADF0-45A953E7CB8B} - C:\Programmi\Recommended Hotfix - 421701D\v15\RH.DLL O2 - BHO: (no name) - {18DF445C-B161-51E4-8406-655579A02B4B} - C:\WINDOWS\System32\gbkkxwtp.dll O4 - HKLM\..\Run: [Microsoft Update Time] wuam.exe O4 - HKLM\..\Run: [demm3861.exe] demm3861.exe O4 - HKLM\..\Run: [Windows System Manager Loader] smsls.exe O4 - HKLM\..\Run: [Microsoft Update Machine] ntsystem.exe O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\Downloaded Program Files\bridge.dll",Load O4 - HKLM\..\Run: [wybxity] C:\WINDOWS\System32\xjzurd.exe O4 - HKLM\..\Run: [CashBack] C:\Programmi\CashBack\bin\cashback.exe O4 - HKLM\..\Run: [NaviSearch] C:\Programmi\NaviSearch\bin\nls.exe O4 - HKLM\..\Run: [BullsEye Network] C:\Programmi\BullsEye Network\bin\bargains.exe O4 - HKLM\..\Run: [Windows SA] C:\Program Files\WindowsSA\omniscient.exe O4 - HKLM\..\Run: [WindUpdates] C:\Program Files\WindUpdates\WinUpdt.exe O4 - HKLM\..\Run: [ngvkhaj] C:\WINDOWS\ngvkhaj.exe O4 - HKLM\..\Run: [vspru] C:\WINDOWS\ysxou.exe O4 - HKLM\..\RunServices: [Microsoft Update Time] wuam.exe O4 - HKLM\..\RunServices: [demm3861.exe] demm3861.exe O4 - HKLM\..\RunServices: [Windows System Manager Loader] smsls.exe O4 - HKLM\..\RunServices: [Microsoft Update Machine] ntsystem.exe O4 - HKCU\..\Run: [Microsoft Update Time] wuam.exe O4 - HKCU\..\Run: [Microsoft Update Machine] ntsystem.exe O4 - HKCU\..\Run: [demm3861.exe] demm3861.exe O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} (IObjSafety.DemoCtl) - http://cabs.media-motor.net/cabs/mmed.cab O16 - DPF: {F57D17AE-CE37-4BC8-B232-EA57747BE5E7} - http://66.230.146.53/EPlugin_IT.cab O20 - AppInit_DLLs: C:\WINDOWS\System32\wmpui482e.dll ma questo è il log dopo la pulizia con ad-aware?
__________________
www.tweakness.net - Trucchi per il PC DECALOGO ANTISPY - GUIDA A HIJACKTHIS - GUIDA AI SERVIZI DI WIN XP - CONSIGLI ANTIVIRUS PER BART'S PE - SP2 SLIPSTREAMING - FAQ WINDOWS XPSP2 - I SERVIZI DOPO SP2 - XP SP2 UNATTENDED - GUIDA A nLite |
|
|
|
|
30-07-2004, 23:35
|
#44 |
|
Member
Iscritto dal: Jul 2004
Messaggi: 203
|
guarda non lo so neanche ora prova ad avviare ad aware in modalità provvisoria ok?
|
|
|
|
|
30-07-2004, 23:39
|
#45 |
|
Senior Member
Iscritto dal: May 2001
Messaggi: 1740
|
inoltre da provvisoria dovresti almeno provare a eliminare quei files
C:\Programmi\Recommended Hotfix - 421701D\v15 C:\WINDOWS\System32\gbkkxwtp.dll wuam.exe C:\WINDOWS\Downloaded Program Files\bridge.dll (di quest'ultimo proverei anche prima a fare regsvr32 /U bridge.dll da esegui) C:\WINDOWS\System32\xjzurd.exe C:\Programmi\CashBack\ C:\Programmi\NaviSearch\ C:\Programmi\BullsEye Network\ C:\Program Files\WindowsSA\omniscient.exe C:\Program Files\WindUpdates\ (forse è anche presente in installa applicazioni) C:\WINDOWS\ngvkhaj.exe C:\WINDOWS\ysxou.exe demm3861.exe smsls.exe ntsystem.exe C:\WINDOWS\System32\wmpui482e.dll
__________________
www.tweakness.net - Trucchi per il PC DECALOGO ANTISPY - GUIDA A HIJACKTHIS - GUIDA AI SERVIZI DI WIN XP - CONSIGLI ANTIVIRUS PER BART'S PE - SP2 SLIPSTREAMING - FAQ WINDOWS XPSP2 - I SERVIZI DOPO SP2 - XP SP2 UNATTENDED - GUIDA A nLite |
|
|
|
|
30-07-2004, 23:41
|
#46 |
|
Senior Member
Iscritto dal: May 2001
Messaggi: 1740
|
sì certo prova prima adaware in provvisoria...
poi riposta l'ultimo log... comunque la situazione penso ti sia più chiara dopo il mio ultimo post... bisogna eliminare quei files...
__________________
www.tweakness.net - Trucchi per il PC DECALOGO ANTISPY - GUIDA A HIJACKTHIS - GUIDA AI SERVIZI DI WIN XP - CONSIGLI ANTIVIRUS PER BART'S PE - SP2 SLIPSTREAMING - FAQ WINDOWS XPSP2 - I SERVIZI DOPO SP2 - XP SP2 UNATTENDED - GUIDA A nLite |
|
|
|
|
30-07-2004, 23:47
|
#47 | |
|
Member
Iscritto dal: Jul 2004
Messaggi: 203
|
Quote:
Logfile of HijackThis v1.98.0 Scan saved at 23.46.15, on 30/07/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\userinit.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\RunDll32.exe C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\System32\wuam.exe C:\WINDOWS\System32\demm3861.exe C:\WINDOWS\System32\ntsystem.exe C:\WINDOWS\System32\xjzurd.exe C:\Programmi\CashBack\bin\cashback.exe C:\Programmi\NaviSearch\bin\nls.exe C:\WINDOWS\ysxou.exe C:\WINDOWS\System32\wuam.exe C:\WINDOWS\System32\ntsystem.exe C:\WINDOWS\System32\demm3861.exe C:\Programmi\LG PC Suite\LG PC Sync\LGSyncManager.exe C:\Programmi\Microsoft Office\Office10\msoffice.exe C:\Documents and Settings\med\Impostazioni locali\Temp\Directory temporanea 2 per hijackthis.zip\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.myfunstart.com/index.cfm?pc=bdhp R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti R3 - Default URLSearchHook is missing O2 - BHO: twaintecObj Class - {000020DD-C72E-4113-AF77-DD56626C6C42} - C:\WINDOWS\twaintec.dll O2 - BHO: (no name) - {00041A26-7033-432C-94C7-6371DE343822} - (no file) O2 - BHO: Recommended Hotfix - {0421701D-CF13-4E70-ADF0-45A953E7CB8B} - C:\Programmi\Recommended Hotfix - 421701D\v15\RH.DLL O2 - BHO: (no name) - {18DF445C-B161-51E4-8406-655579A02B4B} - C:\WINDOWS\System32\gbkkxwtp.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [Microsoft Update Time] wuam.exe O4 - HKLM\..\Run: [demm3861.exe] demm3861.exe O4 - HKLM\..\Run: [Windows System Manager Loader] smsls.exe O4 - HKLM\..\Run: [Microsoft Update Machine] ntsystem.exe O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\Downloaded Program Files\bridge.dll",Load O4 - HKLM\..\Run: [wybxity] C:\WINDOWS\System32\xjzurd.exe O4 - HKLM\..\Run: [CashBack] C:\Programmi\CashBack\bin\cashback.exe O4 - HKLM\..\Run: [NaviSearch] C:\Programmi\NaviSearch\bin\nls.exe O4 - HKLM\..\Run: [Windows SA] C:\Program Files\WindowsSA\omniscient.exe O4 - HKLM\..\Run: [ngvkhaj] C:\WINDOWS\ngvkhaj.exe O4 - HKLM\..\Run: [vspru] C:\WINDOWS\ysxou.exe O4 - HKLM\..\Run: [WindUpdates] C:\Program Files\WindUpdates\WinUpdt.exe O4 - HKLM\..\RunServices: [Microsoft Update Time] wuam.exe O4 - HKLM\..\RunServices: [demm3861.exe] demm3861.exe O4 - HKLM\..\RunServices: [Windows System Manager Loader] smsls.exe O4 - HKLM\..\RunServices: [Microsoft Update Machine] ntsystem.exe O4 - HKCU\..\Run: [Microsoft Update Time] wuam.exe O4 - HKCU\..\Run: [Microsoft Update Machine] ntsystem.exe O4 - HKCU\..\Run: [demm3861.exe] demm3861.exe O4 - Global Startup: LG Sync Manager.lnk = ? O4 - Global Startup: LG SyncManager.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_fi...1a0351cafa03db O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} - http://cabs.media-motor.net/cabs/mmed.cab O16 - DPF: {F57D17AE-CE37-4BC8-B232-EA57747BE5E7} - http://66.230.146.53/EPlugin_IT.cab O20 - AppInit_DLLs: C:\WINDOWS\System32\wmpui482e.dll |
|
|
|
|
|
30-07-2004, 23:47
|
#48 | |
|
Member
Iscritto dal: Jul 2004
Messaggi: 203
|
Quote:
Logfile of HijackThis v1.98.0 Scan saved at 23.46.15, on 30/07/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\userinit.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\RunDll32.exe C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\System32\wuam.exe C:\WINDOWS\System32\demm3861.exe C:\WINDOWS\System32\ntsystem.exe C:\WINDOWS\System32\xjzurd.exe C:\Programmi\CashBack\bin\cashback.exe C:\Programmi\NaviSearch\bin\nls.exe C:\WINDOWS\ysxou.exe C:\WINDOWS\System32\wuam.exe C:\WINDOWS\System32\ntsystem.exe C:\WINDOWS\System32\demm3861.exe C:\Programmi\LG PC Suite\LG PC Sync\LGSyncManager.exe C:\Programmi\Microsoft Office\Office10\msoffice.exe C:\Documents and Settings\med\Impostazioni locali\Temp\Directory temporanea 2 per hijackthis.zip\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.myfunstart.com/index.cfm?pc=bdhp R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti R3 - Default URLSearchHook is missing O2 - BHO: twaintecObj Class - {000020DD-C72E-4113-AF77-DD56626C6C42} - C:\WINDOWS\twaintec.dll O2 - BHO: (no name) - {00041A26-7033-432C-94C7-6371DE343822} - (no file) O2 - BHO: Recommended Hotfix - {0421701D-CF13-4E70-ADF0-45A953E7CB8B} - C:\Programmi\Recommended Hotfix - 421701D\v15\RH.DLL O2 - BHO: (no name) - {18DF445C-B161-51E4-8406-655579A02B4B} - C:\WINDOWS\System32\gbkkxwtp.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [Microsoft Update Time] wuam.exe O4 - HKLM\..\Run: [demm3861.exe] demm3861.exe O4 - HKLM\..\Run: [Windows System Manager Loader] smsls.exe O4 - HKLM\..\Run: [Microsoft Update Machine] ntsystem.exe O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\Downloaded Program Files\bridge.dll",Load O4 - HKLM\..\Run: [wybxity] C:\WINDOWS\System32\xjzurd.exe O4 - HKLM\..\Run: [CashBack] C:\Programmi\CashBack\bin\cashback.exe O4 - HKLM\..\Run: [NaviSearch] C:\Programmi\NaviSearch\bin\nls.exe O4 - HKLM\..\Run: [Windows SA] C:\Program Files\WindowsSA\omniscient.exe O4 - HKLM\..\Run: [ngvkhaj] C:\WINDOWS\ngvkhaj.exe O4 - HKLM\..\Run: [vspru] C:\WINDOWS\ysxou.exe O4 - HKLM\..\Run: [WindUpdates] C:\Program Files\WindUpdates\WinUpdt.exe O4 - HKLM\..\RunServices: [Microsoft Update Time] wuam.exe O4 - HKLM\..\RunServices: [demm3861.exe] demm3861.exe O4 - HKLM\..\RunServices: [Windows System Manager Loader] smsls.exe O4 - HKLM\..\RunServices: [Microsoft Update Machine] ntsystem.exe O4 - HKCU\..\Run: [Microsoft Update Time] wuam.exe O4 - HKCU\..\Run: [Microsoft Update Machine] ntsystem.exe O4 - HKCU\..\Run: [demm3861.exe] demm3861.exe O4 - Global Startup: LG Sync Manager.lnk = ? O4 - Global Startup: LG SyncManager.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_fi...1a0351cafa03db O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} - http://cabs.media-motor.net/cabs/mmed.cab O16 - DPF: {F57D17AE-CE37-4BC8-B232-EA57747BE5E7} - http://66.230.146.53/EPlugin_IT.cab O20 - AppInit_DLLs: C:\WINDOWS\System32\wmpui482e.dll |
|
|
|
|
|
30-07-2004, 23:47
|
#49 | |
|
Member
Iscritto dal: Jul 2004
Messaggi: 203
|
Quote:
Logfile of HijackThis v1.98.0 Scan saved at 23.46.15, on 30/07/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\userinit.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\RunDll32.exe C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\System32\wuam.exe C:\WINDOWS\System32\demm3861.exe C:\WINDOWS\System32\ntsystem.exe C:\WINDOWS\System32\xjzurd.exe C:\Programmi\CashBack\bin\cashback.exe C:\Programmi\NaviSearch\bin\nls.exe C:\WINDOWS\ysxou.exe C:\WINDOWS\System32\wuam.exe C:\WINDOWS\System32\ntsystem.exe C:\WINDOWS\System32\demm3861.exe C:\Programmi\LG PC Suite\LG PC Sync\LGSyncManager.exe C:\Programmi\Microsoft Office\Office10\msoffice.exe C:\Documents and Settings\med\Impostazioni locali\Temp\Directory temporanea 2 per hijackthis.zip\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.myfunstart.com/index.cfm?pc=bdhp R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti R3 - Default URLSearchHook is missing O2 - BHO: twaintecObj Class - {000020DD-C72E-4113-AF77-DD56626C6C42} - C:\WINDOWS\twaintec.dll O2 - BHO: (no name) - {00041A26-7033-432C-94C7-6371DE343822} - (no file) O2 - BHO: Recommended Hotfix - {0421701D-CF13-4E70-ADF0-45A953E7CB8B} - C:\Programmi\Recommended Hotfix - 421701D\v15\RH.DLL O2 - BHO: (no name) - {18DF445C-B161-51E4-8406-655579A02B4B} - C:\WINDOWS\System32\gbkkxwtp.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [Microsoft Update Time] wuam.exe O4 - HKLM\..\Run: [demm3861.exe] demm3861.exe O4 - HKLM\..\Run: [Windows System Manager Loader] smsls.exe O4 - HKLM\..\Run: [Microsoft Update Machine] ntsystem.exe O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\Downloaded Program Files\bridge.dll",Load O4 - HKLM\..\Run: [wybxity] C:\WINDOWS\System32\xjzurd.exe O4 - HKLM\..\Run: [CashBack] C:\Programmi\CashBack\bin\cashback.exe O4 - HKLM\..\Run: [NaviSearch] C:\Programmi\NaviSearch\bin\nls.exe O4 - HKLM\..\Run: [Windows SA] C:\Program Files\WindowsSA\omniscient.exe O4 - HKLM\..\Run: [ngvkhaj] C:\WINDOWS\ngvkhaj.exe O4 - HKLM\..\Run: [vspru] C:\WINDOWS\ysxou.exe O4 - HKLM\..\Run: [WindUpdates] C:\Program Files\WindUpdates\WinUpdt.exe O4 - HKLM\..\RunServices: [Microsoft Update Time] wuam.exe O4 - HKLM\..\RunServices: [demm3861.exe] demm3861.exe O4 - HKLM\..\RunServices: [Windows System Manager Loader] smsls.exe O4 - HKLM\..\RunServices: [Microsoft Update Machine] ntsystem.exe O4 - HKCU\..\Run: [Microsoft Update Time] wuam.exe O4 - HKCU\..\Run: [Microsoft Update Machine] ntsystem.exe O4 - HKCU\..\Run: [demm3861.exe] demm3861.exe O4 - Global Startup: LG Sync Manager.lnk = ? O4 - Global Startup: LG SyncManager.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_fi...1a0351cafa03db O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} - http://cabs.media-motor.net/cabs/mmed.cab O16 - DPF: {F57D17AE-CE37-4BC8-B232-EA57747BE5E7} - http://66.230.146.53/EPlugin_IT.cab O20 - AppInit_DLLs: C:\WINDOWS\System32\wmpui482e.dll |
|
|
|
|
|
30-07-2004, 23:56
|
#50 |
|
Senior Member
Iscritto dal: May 2001
Messaggi: 1740
|
dicci di più questo che log è?
__________________
www.tweakness.net - Trucchi per il PC DECALOGO ANTISPY - GUIDA A HIJACKTHIS - GUIDA AI SERVIZI DI WIN XP - CONSIGLI ANTIVIRUS PER BART'S PE - SP2 SLIPSTREAMING - FAQ WINDOWS XPSP2 - I SERVIZI DOPO SP2 - XP SP2 UNATTENDED - GUIDA A nLite |
|
|
|
|
31-07-2004, 00:01
|
#51 |
|
Member
Iscritto dal: Jul 2004
Messaggi: 203
|
ehm
 io mi aspettavo che voi lo diceste a me cmq vi dico cosa ho fatto: riavviato modalità provvisoria per la 101 volta avviato ad aware e cancellato i file negativo scan e log dei file.. |
|
|
|
|
31-07-2004, 00:07
|
#52 |
|
Senior Member
Iscritto dal: May 2001
Messaggi: 1740
|
ma con hijackthis hai provato?
leggi i miei post sopra nel caso e fixa quelle righe con hijackthis.. lo so.. è un porcedimento penoso...
__________________
www.tweakness.net - Trucchi per il PC DECALOGO ANTISPY - GUIDA A HIJACKTHIS - GUIDA AI SERVIZI DI WIN XP - CONSIGLI ANTIVIRUS PER BART'S PE - SP2 SLIPSTREAMING - FAQ WINDOWS XPSP2 - I SERVIZI DOPO SP2 - XP SP2 UNATTENDED - GUIDA A nLite |
|
|
|
|
31-07-2004, 00:11
|
#53 |
|
Member
Iscritto dal: Jul 2004
Messaggi: 203
|
si certo lo ho gia fatto
|
|
|
|
|
31-07-2004, 00:14
|
#54 |
|
Member
Iscritto dal: Jul 2004
Messaggi: 203
|
ora quando faccio lo scan viene questo
ogfile of HijackThis v1.98.0 Scan saved at 0.14.16, on 31/07/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\RunDll32.exe C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\System32\wuam.exe C:\WINDOWS\System32\demm3861.exe C:\WINDOWS\System32\ntsystem.exe C:\WINDOWS\System32\xjzurd.exe C:\Programmi\CashBack\bin\cashback.exe C:\Programmi\NaviSearch\bin\nls.exe C:\WINDOWS\ysxou.exe C:\Programmi\LG PC Suite\LG PC Sync\LGSyncManager.exe C:\Programmi\Microsoft Office\Office10\msoffice.exe C:\WINDOWS\System32\rfrr.exe C:\Documents and Settings\med\Dati applicazioni\twtw.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Xtray\xtray_link.exe C:\WINDOWS\cpezta.exe C:\Program Files\Internet Optimizer\optimize.exe C:\Program Files\Internet Optimizer\actalert.exe C:\WINDOWS\agstjlweo.exe C:\WINDOWS\msbb.exe c:\demtee2.exe C:\Programmi\Internet Explorer\iexplore.exe c:\ovr.exe C:\Documents and Settings\med\Impostazioni locali\Temp\Directory temporanea 3 per hijackthis.zip\HijackThis.exe O4 - HKLM\..\Run: [Microsoft Update Time] wuam.exe O4 - HKLM\..\Run: [Microsoft Update Machine] ntsystem.exe O4 - HKLM\..\RunServices: [Microsoft Update Machine] ntsystem.exe O4 - HKLM\..\RunServices: [Microsoft Update Time] wuam.exe O4 - HKCU\..\Run: [Microsoft Update Machine] ntsystem.exe O4 - HKCU\..\Run: [Microsoft Update Time] wuam.exe O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_fi...1a0351cafa03db |
|
|
|
|
31-07-2004, 00:30
|
#55 |
|
Senior Member
Iscritto dal: May 2001
Messaggi: 1740
|
ma hai tolto tutto praticamente...
 mi sa che ci sei andato con la mano pesante... comunque c'è qualcosa che non mi torna i processi nel task manager sono molti di più rispetto a quelli che partono da iregistri... teoricamente anche O4 - HKLM\..\Run: [Microsoft Update Time] wuam.exe O4 - HKLM\..\Run: [Microsoft Update Machine] ntsystem.exe O4 - HKLM\..\RunServices: [Microsoft Update Machine] ntsystem.exe O4 - HKLM\..\RunServices: [Microsoft Update Time] wuam.exe O4 - HKCU\..\Run: [Microsoft Update Machine] ntsystem.exe O4 - HKCU\..\Run: [Microsoft Update Time] wuam.exe O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_f...11a0351cafa03db sarebbero da fixare... ma penso che se riavvii ti ricomparirà molta roba... ricordati che hai i backups... c'erano dei registri relativi alla schede audio e altro che penso tu abbia erroneamente eleiminato.. cmq... prova a fixare questi assicurandoti prima che i relativi processi sia terminata nel task manager nel task manager seleziona termina apllicazione a quei files
__________________
www.tweakness.net - Trucchi per il PC DECALOGO ANTISPY - GUIDA A HIJACKTHIS - GUIDA AI SERVIZI DI WIN XP - CONSIGLI ANTIVIRUS PER BART'S PE - SP2 SLIPSTREAMING - FAQ WINDOWS XPSP2 - I SERVIZI DOPO SP2 - XP SP2 UNATTENDED - GUIDA A nLite |
|
|
|
|
31-07-2004, 00:36
|
#56 |
|
Senior Member
Iscritto dal: May 2001
Messaggi: 1740
|
il procedimento corretto sarebbe fixare (possibilmente da provvisoria) e riavviare e ricontrollare il log...
__________________
www.tweakness.net - Trucchi per il PC DECALOGO ANTISPY - GUIDA A HIJACKTHIS - GUIDA AI SERVIZI DI WIN XP - CONSIGLI ANTIVIRUS PER BART'S PE - SP2 SLIPSTREAMING - FAQ WINDOWS XPSP2 - I SERVIZI DOPO SP2 - XP SP2 UNATTENDED - GUIDA A nLite |
|
|
|
|
31-07-2004, 00:53
|
#57 |
|
Member
Iscritto dal: Jul 2004
Messaggi: 203
|
fra un pochito ti devo salutare cmq ho fatto tutto quello che mi hai detto ed ora quando faccio lo scan con hj....... non viene più niente.............. spero di aver risolto .... ultime 2 domande
perche venivano quei siti? ora sto a posto o devo continuare a fixare i file? grazie di tutto  e grazie a tutti
|
|
|
|
|
31-07-2004, 01:00
|
#58 |
|
Senior Member
Iscritto dal: May 2001
Messaggi: 1740
|
avevi molti spyware e forse trojan nel sistema...
quei file ancora nel pc sono pericolosi perchè forse hanno ancora dei collegamenti ai registri... dovresti cancellarti... certo che la tua era una situzaione limite... eri davvero pieno... ti consiglio di installare spywareblaster per protegger il pc... non p improbabile che quella roba ricompaia di nuovo se non siamo riusciti a pulire tutto... affidati ad ad-aware (aggiorn sempre le definizioni prima) e spybot ... facci sapere come va... ah ricorda.. che forse hai eliminato anche voci utili da iregistri... ciao
__________________
www.tweakness.net - Trucchi per il PC DECALOGO ANTISPY - GUIDA A HIJACKTHIS - GUIDA AI SERVIZI DI WIN XP - CONSIGLI ANTIVIRUS PER BART'S PE - SP2 SLIPSTREAMING - FAQ WINDOWS XPSP2 - I SERVIZI DOPO SP2 - XP SP2 UNATTENDED - GUIDA A nLite |
|
|
|
|
31-07-2004, 01:01
|
#59 |
|
Senior Member
Iscritto dal: May 2001
Messaggi: 1740
|
se vuoi tentare di eliminare quei files ...
assicurati che la visualizzazone dei file nascosti e di sistama sia possiblie... poi basta che ne cerchi il nome...
__________________
www.tweakness.net - Trucchi per il PC DECALOGO ANTISPY - GUIDA A HIJACKTHIS - GUIDA AI SERVIZI DI WIN XP - CONSIGLI ANTIVIRUS PER BART'S PE - SP2 SLIPSTREAMING - FAQ WINDOWS XPSP2 - I SERVIZI DOPO SP2 - XP SP2 UNATTENDED - GUIDA A nLite |
|
|
|
|
31-07-2004, 01:12
|
#60 |
|
Member
Iscritto dal: Jul 2004
Messaggi: 203
|
ciao lascio questo messaggio così domani quando potra netquik mi dara un aiuto:
ciao sono sempre io il tuo rompi ***** senti mi potresti lasciare un mess su come amministrare spy........... perchè lo installato ma ho paura di fare casini........ un grazie megagalttico a tutti forse un po eccessivo ehh???????? vebbe uguale ciao |
|
|
|
|
|
| Strumenti | |
|
|
Tutti gli orari sono GMT +1. Ora sono le: 00:08.
