problema

[scannerus]

salve raga'. scusate l'intrusione e vengo arsodo,ultimamente cio avuto a che fare
con sto' gromozon/linkoptimizer/ecc... ecc... che prtcmnt mi "sequestrava"il pc.provando e tribolando con vari av,as,aaw,ecc..., facendo scansioni online (che fatica), sono riuscito(forse)a riprenderlo. spiego il "forse": quando schiaccio
il pulsante start compare la lista,niente dinovo direte, se non fosse che mi manca
la scritta"esegui"e il pulsante"spegni computer". dimenticavo, mi aveva disabilitato anche il task manager. vi rammento che uso solo io ilpc, sull account
mi dice che ho tutti i privilegi, ecc...ecc... .sepuo' servire allego hijackthis e gmier.

grazie10000 e apresto! Logfile of HijackThis v1.99.1
Scan saved at 18.23.37, on 22/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmi\Prevx1\PXAgent.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Programmi\digicomt\Michelangelo USB ADSL\CnxDslTb.exe
C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programmi\Prevx1\PXConsole.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\SlySoft\AnyDVD\AnyDVD.exe
C:\Programmi\Steganos Internet Anonym 5\sia5.exe
C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe
C:\VEXPLITE\viritsvc.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Programmi\Steganos Internet Anonym 5\sseagent.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Documents and Settings\paolo\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tgsoft.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Dati applicazioni\Prevx\pxbho.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Programmi\digicomt\Michelangelo USB ADSL\CnxDslTb.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [PrevxOne] "C:\Programmi\Prevx1\PXConsole.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AnyDVD] C:\Programmi\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKCU\..\Run: [SIA5] "C:\Programmi\Steganos Internet Anonym 5\sia5.exe" /booting
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Programmi\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O8 - Extra context menu item: Invia a &Bluetooth - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll (file missing)
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie.htm
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1130689910682
O17 - HKLM\System\CCS\Services\Tcpip\..\{065BC80D-CE6C-4272-BEF8-B50854D9AD21}: NameServer = 213.205.36.70 213.205.32.70
O17 - HKLM\System\CS7\Services\Tcpip\..\{065BC80D-CE6C-4272-BEF8-B50854D9AD21}: NameServer = 213.205.36.70 213.205.32.70
O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\system32\btxppanel.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation - C:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Programmi\Prevx1\PXAgent.exe" -f (file missing)
O23 - Service: Virit eXplorer Lite (viritsvclite) - TG Soft Sas www.tgsoft.it - C:\VEXPLITE\viritsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

GMER 1.0.11.11390 - http://www.gmer.net
Rootkit 2006-11-22 18:27:07
Windows 5.1.2600 Service Pack 2


---- System - GMER 1.0.11 ----

SSDT pxfsf.sys ZwEnumerateKey
SSDT pxfsf.sys ZwEnumerateValueKey

---- Devices - GMER 1.0.11 ----

Device \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE 82EA5E30
Device \FileSystem\Ntfs \Ntfs IRP_MJ_CLOSE 82EA5E30
Device \FileSystem\Ntfs \Ntfs IRP_MJ_READ 82EA5E30
Device \FileSystem\Ntfs \Ntfs IRP_MJ_WRITE 82EA5E30
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_INFORMATION 82EA5E30
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_INFORMATION 82EA5E30
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_EA 82EA5E30
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_EA 82EA5E30
Device \FileSystem\Ntfs \Ntfs IRP_MJ_FLUSH_BUFFERS 82EA5E30
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_VOLUME_INFORMATION 82EA5E30
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_VOLUME_INFORMATION 82EA5E30
Device \FileSystem\Ntfs \Ntfs IRP_MJ_DIRECTORY_CONTROL 82EA5E30
Device \FileSystem\Ntfs \Ntfs IRP_MJ_FILE_SYSTEM_CONTROL 82EA5E30
Device \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CONTROL 82EA5E30
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SHUTDOWN 82EA5E30
Device \FileSystem\Ntfs \Ntfs IRP_MJ_LOCK_CONTROL 82EA5E30
Device \FileSystem\Ntfs \Ntfs IRP_MJ_CLEANUP 82EA5E30
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_SECURITY 82EA5E30
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_SECURITY 82EA5E30
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_QUOTA 82EA5E30
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_QUOTA 82EA5E30
Device \FileSystem\Ntfs \Ntfs IRP_MJ_PNP 82EA5E30
Device \Driver\Tcpip \Device\Ip IRP_MJ_CREATE [BA6C92A0] vsdatant.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_CLOSE [BA6C92A0] vsdatant.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_DEVICE_CONTROL [BA6C92A0] vsdatant.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_INTERNAL_DEVICE_CONTROL [BA6C92A0] vsdatant.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_CLEANUP [BA6C92A0] vsdatant.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE [BA6C92A0] vsdatant.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CLOSE [BA6C92A0] vsdatant.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_DEVICE_CONTROL [BA6C92A0] vsdatant.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_INTERNAL_DEVICE_CONTROL [BA6C92A0] vsdatant.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CLEANUP [BA6C92A0] vsdatant.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_CREATE [BA6C92A0] vsdatant.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_CLOSE [BA6C92A0] vsdatant.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_DEVICE_CONTROL [BA6C92A0] vsdatant.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_INTERNAL_DEVICE_CONTROL [BA6C92A0] vsdatant.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_CLEANUP [BA6C92A0] vsdatant.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE [BA6C92A0] vsdatant.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CLOSE [BA6C92A0] vsdatant.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_DEVICE_CONTROL [BA6C92A0] vsdatant.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_INTERNAL_DEVICE_CONTROL [BA6C92A0] vsdatant.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CLEANUP [BA6C92A0] vsdatant.sys

---- EOF - GMER 1.0.11 ----

[black92]

posta il log nella sezione adatta

[stesio54]

Originariamente inviato da black92

posta il log nella sezione adatta