|
|||||||
|
|
|
 |
|
|
Strumenti |
10-12-2006, 10:18
|
#1 |
|
Senior Member
Iscritto dal: Feb 2003
Città: Verona
Messaggi: 305
|
Eliminazione trojan e log Hijackthis - help
Ciao
L'antivirus mi ha trovato nella cartella Temporary Internet Files un tale Bomka-M (trojan) che ho porntamente cancellato Ma la cosa mi puzza ancora perkè non è proprio la prima volta che navigando mi capita (notare che stavo visitando un sito di WoW di tutto rispetto. Ho pensato di scansionare con Hijackthis vi posto il log Mi appare quel WebMons.dll sospetto che roba è? C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe C:\Programmi\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe C:\Programmi\Alwil Software\Avast4\ashWebSv.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\Linksts.exe C:\Programmi\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE C:\Programmi\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe C:\WINDOWS\CTHELPER.EXE C:\WINDOWS\system32\CTXFIHLP.EXE C:\Program Files\ASUS\Asus Probe\AsusProb.exe C:\WINDOWS\SYSTEM32\CTXFISPI.EXE F:\Programmi\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe C:\Programmi\Logitech\MouseWare\system\em_exec.exe C:\WINDOWS\system32\RunDLL32.exe F:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE C:\WINDOWS\system32\ctfmon.exe C:\Programmi\Creative\MediaSource\Detector\CTDetect.exe C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe F:\Programmi\Nokia\Nokia PC Suite 6\PcSync2.exe C:\WINDOWS\system32\mapiicon.exe F:\Programmi\Nikon\NkView6\NkvMon.exe C:\Programmi\File comuni\PCSuite\Services\ServiceLayer.exe C:\PROGRA~1\FILECO~1\Nokia\MPAPI\MPAPI3s.exe C:\Programmi\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe C:\WINDOWS\explorer.exe C:\Programmi\Internet Explorer\iexplore.exe C:\Programmi\Internet Explorer\iexplore.exe C:\Documents and Settings\Blue\Desktop\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.google.it R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Programmi\AcrobatReader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Web Mon - {878E4122-A213-98AC-355B-3C723F572BA5} - C:\WINDOWS\system32\WebMons.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar3.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar3.dll O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [ISDN Monitor] Linksts.exe W 1024 O4 - HKLM\..\Run: [ADSL_A2] A2Installed O4 - HKLM\..\Run: [CTDVDDET] "C:\Programmi\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE" O4 - HKLM\..\Run: [VolPanel] "C:\Programmi\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" /r O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Asus Probe\AsusProb.exe O4 - HKLM\..\Run: [Adobe Photo Downloader] "F:\Programmi\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [PCSuiteTrayApplication] F:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup O4 - HKLM\..\Run: [Soundlibs] C:\WINDOWS\soundlib.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Creative Detector] C:\Programmi\Creative\MediaSource\Detector\CTDetect.exe /R O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [PcSync] F:\Programmi\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog O4 - Global Startup: ADSL Diagnostic Tools.LNK = C:\WINDOWS\system32\mapiicon.exe O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = F:\Programmi\AcrobatReader\Reader\reader_sl.exe O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: NkvMon.exe.lnk = F:\Programmi\Nikon\NkView6\NkvMon.exe O8 - Extra context menu item: &ICQ Toolbar Search - res://F:\Programmi\ICQToolbar\toolbaru.dll/SEARCH.HTML O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - F:\Programmi\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - F:\Programmi\ICQLite\ICQLite.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{D2DA169D-E498-47A3-AD06-CFB00CA15BD0}: NameServer = 88.149.128.12 88.149.128.22 O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia. - C:\Programmi\File comuni\PCSuite\Services\ServiceLayer.exe ciao e grazie per i suggerimenti |
|
|
|
10-12-2006, 11:12
|
#2 |
|
Senior Member
Iscritto dal: Jun 2003
Città: ..By The Sea..
Messaggi: 564
|
webmons è probabile che vada rimosso. Per sicurezza analizzalo su www.virustotal.com e poi comportati di conseguenza.
__________________
Without Contraries is no Progression... |
|
|
|
|
10-12-2006, 15:21
|
#3 | |
|
Senior Member
Iscritto dal: Apr 2006
Messaggi: 22462
|
Quote:
__________________
amd a64x2 4400+ sk939;asus a8n-sli; 2x1gb ddr400; x850 crossfire; 2 x western digital abys 320gb|| asus g1
Se striscia fulmina, se svolazza l'ammazza |
|
|
|
|
|
11-12-2006, 12:06
|
#4 | |
|
Senior Member
Iscritto dal: Feb 2003
Città: Verona
Messaggi: 305
|
Quote:
sono cosi tonta non riesco a capire come funziona quel sito ^^ |
|
|
|
|
|
11-12-2006, 14:02
|
#5 | |
|
Senior Member
Iscritto dal: Jun 2003
Città: ..By The Sea..
Messaggi: 564
|
Quote:
 Allora.. quando sei sul sito clicchi su browse e vai a cercare quel file nella finestra che si aprirà, seguendo il suo percorso. C:\WINDOWS\system32\WebMons.dllQuindi, in quella finestra, partirai da c: (o da risorse del computer -> c: ) -> windows -> system32 e selezionerai il file nella lista, poi premi apri, la finestra si chiuderà e a quel punto puoi premere il pulsante send del sito. Se vieni messa in coda aspetti il tuo turno e alla fine guardi i risultati dei vari antivirus. Se rilevano qualcosa di dannoso riapri hijackthis, fai lo scan, selezioni la voce corrispondente a webmon e premi fix. Poi riavii il computer, rifai una scansione e controlli che quella linea non ci sia più. Se vuoi puoi anche ripostare il log qua. ciao!
__________________
Without Contraries is no Progression... |
|
|
|
|
|
11-12-2006, 18:53
|
#6 |
|
Senior Member
Iscritto dal: Feb 2003
Città: Verona
Messaggi: 305
|
ho messo webmons.dll nel browser e mi hanno riportato una marea di porcherie :
AntiVir 7.2.0.49 12.11.2006 TR/Dldr.Agent.bcr Authentium 4.93.8 12.08.2006 no virus found Avast 4.7.892.0 12.11.2006 no virus found AVG 386 12.11.2006 no virus found BitDefender 7.2 12.11.2006 no virus found CAT-QuickHeal 8.00 12.11.2006 no virus found ClamAV devel-20060426 12.11.2006 no virus found DrWeb 4.33 12.11.2006 no virus found eSafe 7.0.14.0 12.11.2006 no virus found eTrust-InoculateIT 23.73.81 12.09.2006 no virus found eTrust-Vet 30.3.3244 12.11.2006 no virus found Ewido 4.0 12.10.2006 Downloader.Agent.bcr Fortinet 2.82.0.0 12.11.2006 W32/Agent.BCR!tr.dldr F-Prot 3.16f 12.08.2006 no virus found F-Prot4 4.2.1.29 12.08.2006 no virus found Ikarus T3.1.0.26 12.11.2006 Backdoor.Win32.Bifrose.Pac Kaspersky 4.0.2.24 12.11.2006 Trojan-Downloader.Win32.Agent.bcr McAfee 4916 12.11.2006 no virus found Microsoft 1.1804 12.11.2006 no virus found NOD32v2 1914 12.11.2006 no virus found Norman 5.80.02 12.11.2006 no virus found Panda 9.0.0.4 12.11.2006 no virus found Prevx1 V2 12.11.2006 no virus found Sophos 4.12.0 12.10.2006 no virus found Sunbelt 2.2.907.0 11.30.2006 VIPRE.Suspicious TheHacker 6.0.3.131 12.10.2006 Trojan/Downloader.Agent.bcr UNA 1.83 12.11.2006 TrojanDownloader.Win32.Agent.724C VBA32 3.11.1 12.10.2006 Trojan-Downloader.Win32.Agent.bcr VirusBuster 4.3.15:9 12.11.2006 novirus:Packed/Exe32Pack Cosa faccio??? |
|
|
|
|
11-12-2006, 19:00
|
#7 | |
|
Senior Member
Iscritto dal: Feb 2003
Città: Verona
Messaggi: 305
|
Quote:
ho fatto come mi hai detto ho cancellato il webmons tramite hijack this e ho riavviato e rifatto hijack ecco qua : Logfile of HijackThis v1.99.1 Scan saved at 18.58.39, on 11/12/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe C:\Programmi\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe C:\Programmi\Alwil Software\Avast4\ashWebSv.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\Linksts.exe C:\Programmi\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE C:\Programmi\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe C:\WINDOWS\CTHELPER.EXE C:\WINDOWS\system32\CTXFIHLP.EXE C:\Program Files\ASUS\Asus Probe\AsusProb.exe C:\WINDOWS\SYSTEM32\CTXFISPI.EXE F:\Programmi\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe C:\Programmi\Logitech\MouseWare\system\em_exec.exe C:\WINDOWS\system32\RunDLL32.exe F:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE C:\WINDOWS\system32\ctfmon.exe C:\Programmi\Creative\MediaSource\Detector\CTDetect.exe C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe F:\Programmi\Nokia\Nokia PC Suite 6\PcSync2.exe C:\WINDOWS\system32\mapiicon.exe F:\Programmi\AcrobatReader\Reader\reader_sl.exe C:\Programmi\File comuni\PCSuite\Services\ServiceLayer.exe F:\Programmi\Nikon\NkView6\NkvMon.exe C:\PROGRA~1\FILECO~1\Nokia\MPAPI\MPAPI3s.exe C:\Programmi\Internet Explorer\iexplore.exe C:\Programmi\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Blue\Desktop\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.google.it R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Programmi\AcrobatReader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar3.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar3.dll O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [ISDN Monitor] Linksts.exe W 1024 O4 - HKLM\..\Run: [ADSL_A2] A2Installed O4 - HKLM\..\Run: [CTDVDDET] "C:\Programmi\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE" O4 - HKLM\..\Run: [VolPanel] "C:\Programmi\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" /r O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Asus Probe\AsusProb.exe O4 - HKLM\..\Run: [Adobe Photo Downloader] "F:\Programmi\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [PCSuiteTrayApplication] F:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup O4 - HKLM\..\Run: [Soundlibs] C:\WINDOWS\soundlib.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Creative Detector] C:\Programmi\Creative\MediaSource\Detector\CTDetect.exe /R O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [PcSync] F:\Programmi\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog O4 - Global Startup: ADSL Diagnostic Tools.LNK = C:\WINDOWS\system32\mapiicon.exe O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = F:\Programmi\AcrobatReader\Reader\reader_sl.exe O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: NkvMon.exe.lnk = F:\Programmi\Nikon\NkView6\NkvMon.exe O8 - Extra context menu item: &ICQ Toolbar Search - res://F:\Programmi\ICQToolbar\toolbaru.dll/SEARCH.HTML O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - F:\Programmi\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - F:\Programmi\ICQLite\ICQLite.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{D2DA169D-E498-47A3-AD06-CFB00CA15BD0}: NameServer = 88.149.128.12 88.149.128.22 O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia. - C:\Programmi\File comuni\PCSuite\Services\ServiceLayer.exe sembra sparito ma con lui sarebbero sparite tutte le porcate che aveva con se? |
|
|
|
|
|
11-12-2006, 19:02
|
#8 |
|
Senior Member
Iscritto dal: Feb 2003
Città: Verona
Messaggi: 305
|
edito : se guardo nella cartella system 32 c'è ancora ma hijack nn lo vede ora come mai?
|
|
|
|
|
11-12-2006, 19:03
|
#9 | |
|
Senior Member
Iscritto dal: Apr 2006
Messaggi: 22462
|
Quote:
__________________
amd a64x2 4400+ sk939;asus a8n-sli; 2x1gb ddr400; x850 crossfire; 2 x western digital abys 320gb|| asus g1
Se striscia fulmina, se svolazza l'ammazza |
|
|
|
|
|
11-12-2006, 19:13
|
#10 | |
|
Senior Member
Iscritto dal: Jun 2003
Città: ..By The Sea..
Messaggi: 564
|
Quote:
__________________
Without Contraries is no Progression... |
|
|
|
|
|
11-12-2006, 19:22
|
#11 |
|
Senior Member
Iscritto dal: Jun 2003
Città: ..By The Sea..
Messaggi: 564
|
Ora che hai preso confidenza con virustotal, dovresti fare la stessa procedura anche con questo: C:\WINDOWS\soundlib.exe e poi non è rimasto altro, perlomeno che sia visibile con hijackthis..
__________________
Without Contraries is no Progression... |
|
|
|
|
11-12-2006, 19:58
|
#12 | |
|
Senior Member
Iscritto dal: Feb 2003
Città: Verona
Messaggi: 305
|
Quote:
ma il "fratello" webmon.dll? |
|
|
|
|
|
11-12-2006, 20:00
|
#13 | |
|
Senior Member
Iscritto dal: Jun 2003
Città: ..By The Sea..
Messaggi: 564
|
Quote:
__________________
Without Contraries is no Progression... |
|
|
|
|
|
11-12-2006, 20:10
|
#14 |
|
Senior Member
Iscritto dal: Feb 2003
Città: Verona
Messaggi: 305
|
cavoli grazie dei suggerimenti mi si è aperto un universo sconosciuto
|
|
|
|
|
11-12-2006, 20:11
|
#15 | |
|
Senior Member
Iscritto dal: Feb 2003
Città: Verona
Messaggi: 305
|
Quote:
|
|
|
|
|
|
11-12-2006, 20:20
|
#16 | |
|
Senior Member
Iscritto dal: Feb 2003
Città: Verona
Messaggi: 305
|
Quote:
Logfile of HijackThis v1.99.1 Scan saved at 20.18.51, on 11/12/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe C:\Programmi\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe C:\Programmi\Alwil Software\Avast4\ashWebSv.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\Linksts.exe C:\Programmi\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE C:\Programmi\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe C:\WINDOWS\CTHELPER.EXE C:\WINDOWS\system32\CTXFIHLP.EXE C:\Program Files\ASUS\Asus Probe\AsusProb.exe F:\Programmi\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe C:\WINDOWS\SYSTEM32\CTXFISPI.EXE C:\WINDOWS\system32\RunDLL32.exe C:\Programmi\Logitech\MouseWare\system\em_exec.exe F:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE C:\WINDOWS\system32\ctfmon.exe C:\Programmi\Creative\MediaSource\Detector\CTDetect.exe C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe F:\Programmi\Nokia\Nokia PC Suite 6\PcSync2.exe C:\WINDOWS\system32\mapiicon.exe F:\Programmi\AcrobatReader\Reader\reader_sl.exe F:\Programmi\Nikon\NkView6\NkvMon.exe C:\Programmi\File comuni\PCSuite\Services\ServiceLayer.exe C:\PROGRA~1\FILECO~1\Nokia\MPAPI\MPAPI3s.exe F:\Programmi\HijackThis.exe C:\WINDOWS\system32\wuauclt.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.google.it R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Programmi\AcrobatReader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar3.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar3.dll O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [ISDN Monitor] Linksts.exe W 1024 O4 - HKLM\..\Run: [ADSL_A2] A2Installed O4 - HKLM\..\Run: [CTDVDDET] "C:\Programmi\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE" O4 - HKLM\..\Run: [VolPanel] "C:\Programmi\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" /r O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Asus Probe\AsusProb.exe O4 - HKLM\..\Run: [Adobe Photo Downloader] "F:\Programmi\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [PCSuiteTrayApplication] F:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Creative Detector] C:\Programmi\Creative\MediaSource\Detector\CTDetect.exe /R O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [PcSync] F:\Programmi\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog O4 - Global Startup: ADSL Diagnostic Tools.LNK = C:\WINDOWS\system32\mapiicon.exe O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = F:\Programmi\AcrobatReader\Reader\reader_sl.exe O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: NkvMon.exe.lnk = F:\Programmi\Nikon\NkView6\NkvMon.exe O8 - Extra context menu item: &ICQ Toolbar Search - res://F:\Programmi\ICQToolbar\toolbaru.dll/SEARCH.HTML O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - F:\Programmi\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - F:\Programmi\ICQLite\ICQLite.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{D2DA169D-E498-47A3-AD06-CFB00CA15BD0}: NameServer = 88.149.128.12 88.149.128.22 O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia. - C:\Programmi\File comuni\PCSuite\Services\ServiceLayer.exe |
|
|
|
|
|
|
| Strumenti | |
|
|
Tutti gli orari sono GMT +1. Ora sono le: 11:43.
