|
|||||||
|
|
|
 |
|
|
Strumenti |
22-11-2006, 19:15
|
#1 |
|
Junior Member
Iscritto dal: Nov 2006
Città: roma
Messaggi: 4
|
problema
Iscritto dal: Nov 2006
Città: roma Messaggi: 1 problema salve raga'. scusate l'intrusione e vengo arsodo,ultimamente cio avuto a che fare con sto' gromozon/linkoptimizer/ecc... ecc... che prtcmnt mi "sequestrava"il pc.provando e tribolando con vari av,as,aaw,ecc..., facendo scansioni online (che fatica), sono riuscito(forse)a riprenderlo. spiego il "forse": quando schiaccio il pulsante start compare la lista,niente dinovo direte, se non fosse che mi manca la scritta"esegui"e il pulsante"spegni computer". dimenticavo, mi aveva disabilitato anche il task manager. vi rammento che uso solo io ilpc, sull account mi dice che ho tutti i privilegi, ecc...ecc... .sepuo' servire allego hijackthis e gmier. grazie10000 e apresto! Logfile of HijackThis v1.99.1 Scan saved at 18.23.37, on 22/11/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe C:\Programmi\Alwil Software\Avast4\ashServ.exe C:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Programmi\Prevx1\PXAgent.exe C:\WINDOWS\system32\RunDll32.exe C:\Programmi\digicomt\Michelangelo USB ADSL\CnxDslTb.exe C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Programmi\Prevx1\PXConsole.exe C:\WINDOWS\system32\ctfmon.exe C:\Programmi\SlySoft\AnyDVD\AnyDVD.exe C:\Programmi\Steganos Internet Anonym 5\sia5.exe C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe C:\VEXPLITE\viritsvc.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Programmi\Steganos Internet Anonym 5\sseagent.exe C:\Programmi\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\svchost.exe C:\Programmi\Mozilla Firefox\firefox.exe C:\Documents and Settings\paolo\Desktop\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tgsoft.it/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Dati applicazioni\Prevx\pxbho.dll O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Programmi\digicomt\Michelangelo USB ADSL\CnxDslTb.exe" O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [PrevxOne] "C:\Programmi\Prevx1\PXConsole.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [AnyDVD] C:\Programmi\SlySoft\AnyDVD\AnyDVD.exe O4 - HKCU\..\Run: [SIA5] "C:\Programmi\Steganos Internet Anonym 5\sia5.exe" /booting O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [updateMgr] "C:\Programmi\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1 O8 - Extra context menu item: Invia a &Bluetooth - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie_ctx.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll (file missing) O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll (file missing) O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie.htm O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windows...b?1130689910682 O17 - HKLM\System\CCS\Services\Tcpip\..\{065BC80D-CE6C-4272-BEF8-B50854D9AD21}: NameServer = 213.205.36.70 213.205.32.70 O17 - HKLM\System\CS7\Services\Tcpip\..\{065BC80D-CE6C-4272-BEF8-B50854D9AD21}: NameServer = 213.205.36.70 213.205.32.70 O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\system32\btxppanel.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation - C:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Programmi\Prevx1\PXAgent.exe" -f (file missing) O23 - Service: Virit eXplorer Lite (viritsvclite) - TG Soft Sas www.tgsoft.it - C:\VEXPLITE\viritsvc.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe GMER 1.0.11.11390 - http://www.gmer.net Rootkit 2006-11-22 18:27:07 Windows 5.1.2600 Service Pack 2 ---- System - GMER 1.0.11 ---- SSDT pxfsf.sys ZwEnumerateKey SSDT pxfsf.sys ZwEnumerateValueKey ---- Devices - GMER 1.0.11 ---- Device \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE 82EA5E30 Device \FileSystem\Ntfs \Ntfs IRP_MJ_CLOSE 82EA5E30 Device \FileSystem\Ntfs \Ntfs IRP_MJ_READ 82EA5E30 Device \FileSystem\Ntfs \Ntfs IRP_MJ_WRITE 82EA5E30 Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_INFORMATION 82EA5E30 Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_INFORMATION 82EA5E30 Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_EA 82EA5E30 Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_EA 82EA5E30 Device \FileSystem\Ntfs \Ntfs IRP_MJ_FLUSH_BUFFERS 82EA5E30 Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_VOLUME_INFORMATION 82EA5E30 Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_VOLUME_INFORMATION 82EA5E30 Device \FileSystem\Ntfs \Ntfs IRP_MJ_DIRECTORY_CONTROL 82EA5E30 Device \FileSystem\Ntfs \Ntfs IRP_MJ_FILE_SYSTEM_CONTROL 82EA5E30 Device \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CONTROL 82EA5E30 Device \FileSystem\Ntfs \Ntfs IRP_MJ_SHUTDOWN 82EA5E30 Device \FileSystem\Ntfs \Ntfs IRP_MJ_LOCK_CONTROL 82EA5E30 Device \FileSystem\Ntfs \Ntfs IRP_MJ_CLEANUP 82EA5E30 Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_SECURITY 82EA5E30 Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_SECURITY 82EA5E30 Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_QUOTA 82EA5E30 Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_QUOTA 82EA5E30 Device \FileSystem\Ntfs \Ntfs IRP_MJ_PNP 82EA5E30 Device \Driver\Tcpip \Device\Ip IRP_MJ_CREATE [BA6C92A0] vsdatant.sys Device \Driver\Tcpip \Device\Ip IRP_MJ_CLOSE [BA6C92A0] vsdatant.sys Device \Driver\Tcpip \Device\Ip IRP_MJ_DEVICE_CONTROL [BA6C92A0] vsdatant.sys Device \Driver\Tcpip \Device\Ip IRP_MJ_INTERNAL_DEVICE_CONTROL [BA6C92A0] vsdatant.sys Device \Driver\Tcpip \Device\Ip IRP_MJ_CLEANUP [BA6C92A0] vsdatant.sys Device \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE [BA6C92A0] vsdatant.sys Device \Driver\Tcpip \Device\Tcp IRP_MJ_CLOSE [BA6C92A0] vsdatant.sys Device \Driver\Tcpip \Device\Tcp IRP_MJ_DEVICE_CONTROL [BA6C92A0] vsdatant.sys Device \Driver\Tcpip \Device\Tcp IRP_MJ_INTERNAL_DEVICE_CONTROL [BA6C92A0] vsdatant.sys Device \Driver\Tcpip \Device\Tcp IRP_MJ_CLEANUP [BA6C92A0] vsdatant.sys Device \Driver\Tcpip \Device\Udp IRP_MJ_CREATE [BA6C92A0] vsdatant.sys Device \Driver\Tcpip \Device\Udp IRP_MJ_CLOSE [BA6C92A0] vsdatant.sys Device \Driver\Tcpip \Device\Udp IRP_MJ_DEVICE_CONTROL [BA6C92A0] vsdatant.sys Device \Driver\Tcpip \Device\Udp IRP_MJ_INTERNAL_DEVICE_CONTROL [BA6C92A0] vsdatant.sys Device \Driver\Tcpip \Device\Udp IRP_MJ_CLEANUP [BA6C92A0] vsdatant.sys Device \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE [BA6C92A0] vsdatant.sys Device \Driver\Tcpip \Device\RawIp IRP_MJ_CLOSE [BA6C92A0] vsdatant.sys Device \Driver\Tcpip \Device\RawIp IRP_MJ_DEVICE_CONTROL [BA6C92A0] vsdatant.sys Device \Driver\Tcpip \Device\RawIp IRP_MJ_INTERNAL_DEVICE_CONTROL [BA6C92A0] vsdatant.sys Device \Driver\Tcpip \Device\RawIp IRP_MJ_CLEANUP [BA6C92A0] vsdatant.sys ---- EOF - GMER 1.0.11 ---- scannerus ora è online Segnala messaggio |
|
|
|
|
| Strumenti | |
|
|
Tutti gli orari sono GMT +1. Ora sono le: 06:23.
