|
|||||||
|
|
|
 |
|
|
Strumenti |
18-06-2007, 19:58
|
#1 |
|
Junior Member
Iscritto dal: Jun 2007
Messaggi: 5
|
HELP!!!problema ram allocata
Ho il seguente problema,
quando avvio windows xp e apro il task manager noto che la ram allocata è perennemente sui 1400Mb (ho 1gb di ram) ora ho provato a fare una scansione con avast e ha trovato uno worm che era stato messo in quarantena da prevx2, l ho eliminato ma il problema persiste. Ho effettuato lo scan con hjackthis e gmer eccone i log: Codice:
Logfile of HijackThis v1.99.1
Scan saved at 17.07.26, on 18/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Prevx2\PXConsole.exe
C:\Programmi\WinRAR\WinRAR.exe
C:\DOCUME~1\BARTOL~1\IMPOST~1\Temp\Rar$EX00.266\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mystart.incredimail.com/italian
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Dati applicazioni\Prevx\pxbho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [BDOESRV] "C:\Programmi\Softwin\BitDefender9\bdoesrv.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "C:\progra~1\softwin\bitdef~1\bdnagent.exe"
O4 - HKLM\..\Run: [BDSwitchAgent] "C:\progra~1\softwin\bitdef~1\bdswitch.exe"
O4 - HKLM\..\Run: [BDMCon] c:\progra~1\softwin\bitdef~1\bdmcon.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ISS_SIP] C:\Programmi\Anti Keylogger Elite\AKE.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Programmi\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PrevxOne] "C:\Programmi\Prevx2\PXConsole.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Programmi\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [AdobeUpdater] C:\Programmi\File comuni\Adobe\Updater5\AdobeUpdater.exe
O4 - Startup: Adobe Gamma.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmi\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe
O4 - Global Startup: Avvio veloce di Adobe Acrobat.lnk = ?
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Aggiungi a PDF esistente - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Converti destinazione link in Adobe PDF - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Converti destinazione link in file PDF esistente - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Converti i link selezionati in Adobe PDF - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Converti i link selezionati in file PDF esistente - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Converti in Adobe PDF - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Converti selezione in Adobe PDF - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Converti selezione in file PDF esistente - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/IT-IT/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Programmi\File comuni\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programmi\File comuni\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Programmi\File comuni\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Programmi\Prevx2\PXAgent.exe" -f (file missing)
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Programmi\SiSoftware\SiSoftware Sandra Lite XI.SP1a\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Programmi\SiSoftware\SiSoftware Sandra Lite XI.SP1a\RpcSandraSrv.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Programmi\Softwin\BitDefender9\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Programmi\File comuni\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)
Codice:
Gmer log GMER 1.0.12.12244 - http://www.gmer.net Rootkit scan 2007-06-18 20:23:53 Windows 5.1.2600 Service Pack 2 ---- System - GMER 1.0.12 ---- SSDT pxfsf.sys ZwAlertResumeThread SSDT pxfsf.sys ZwAllocateUserPhysicalPages SSDT pxfsf.sys ZwAllocateVirtualMemory SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwClose SSDT pxfsf.sys ZwCompactKeys SSDT pxfsf.sys ZwCompressKey SSDT pxfsf.sys ZwCreateDirectoryObject SSDT pxfsf.sys ZwCreateEvent SSDT pxfsf.sys ZwCreateEventPair SSDT pxfsf.sys ZwCreateFile SSDT pxfsf.sys ZwCreateIoCompletion SSDT pxfsf.sys ZwCreateJobObject SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwCreateKey SSDT pxfsf.sys ZwCreateMailslotFile SSDT pxfsf.sys ZwCreateMutant SSDT pxfsf.sys ZwCreateNamedPipeFile SSDT pxfsf.sys ZwCreatePort SSDT pxfsf.sys ZwCreateProcess SSDT pxfsf.sys ZwCreateProcessEx SSDT pxfsf.sys ZwCreateSection SSDT pxfsf.sys ZwCreateSemaphore SSDT pxfsf.sys ZwCreateSymbolicLinkObject SSDT pxfsf.sys ZwCreateThread SSDT pxfsf.sys ZwCreateTimer SSDT pxfsf.sys ZwCreateToken SSDT pxfsf.sys ZwDeleteFile SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwDeleteKey SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwDeleteValueKey SSDT pxfsf.sys ZwDeviceIoControlFile SSDT pxfsf.sys ZwDuplicateObject SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwEnumerateKey SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwEnumerateValueKey SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwFlushKey SSDT pxfsf.sys ZwFreeUserPhysicalPages SSDT pxfsf.sys ZwFreeVirtualMemory SSDT pxfsf.sys ZwImpersonateAnonymousToken SSDT pxfsf.sys ZwImpersonateThread SSDT pxfsf.sys ZwLoadDriver SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwLoadKey SSDT pxfsf.sys ZwLoadKey2 SSDT pxfsf.sys ZwLockRegistryKey SSDT pxfsf.sys ZwLockVirtualMemory SSDT pxfsf.sys ZwMapViewOfSection SSDT \??\C:\Programmi\Softwin\BitDefender9\bdfsdrv.sys ZwOpenFile SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwOpenKey SSDT pxfsf.sys ZwOpenProcess SSDT pxfsf.sys ZwOpenProcessToken SSDT pxfsf.sys ZwOpenSection SSDT pxfsf.sys ZwOpenThread SSDT pxfsf.sys ZwOpenThreadToken SSDT pxfsf.sys ZwProtectVirtualMemory SSDT pxfsf.sys ZwQueryInformationProcess SSDT pxfsf.sys ZwQueryInformationThread SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwQueryKey SSDT pxfsf.sys ZwQueryMultipleValueKey SSDT pxfsf.sys ZwQueryOpenSubKeys SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwQueryValueKey SSDT pxfsf.sys ZwQueueApcThread SSDT pxfsf.sys ZwReadFile SSDT pxfsf.sys ZwReadVirtualMemory SSDT pxfsf.sys ZwRenameKey SSDT pxfsf.sys ZwReplaceKey SSDT pxfsf.sys ZwRestoreKey SSDT pxfsf.sys ZwResumeProcess SSDT pxfsf.sys ZwResumeThread SSDT pxfsf.sys ZwSaveKey SSDT pxfsf.sys ZwSaveKeyEx SSDT pxfsf.sys ZwSaveMergedKeys SSDT pxfsf.sys ZwSetContextThread SSDT pxfsf.sys ZwSetInformationKey SSDT pxfsf.sys ZwSetInformationProcess SSDT pxfsf.sys ZwSetInformationThread SSDT pxfsf.sys ZwSetSystemInformation SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwSetValueKey SSDT pxfsf.sys ZwSuspendProcess SSDT pxfsf.sys ZwSuspendThread SSDT pxfsf.sys ZwSystemDebugControl SSDT pxfsf.sys ZwTerminateJobObject SSDT pxfsf.sys ZwTerminateProcess SSDT pxfsf.sys ZwTerminateThread SSDT pxfsf.sys ZwUnloadDriver SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwUnloadKey SSDT pxfsf.sys ZwUnloadKeyEx SSDT pxfsf.sys ZwUnlockVirtualMemory SSDT pxfsf.sys ZwUnmapViewOfSection SSDT pxfsf.sys ZwWriteFile SSDT pxfsf.sys ZwWriteVirtualMemory ---- Kernel code sections - GMER 1.0.12 ---- .text ntkrnlpa.exe!ZwCallbackReturn + 23B4 805010B8 24 Bytes [ 79, 68, 3C, F7, 83, 68, 3C, ... ] .text ntkrnlpa.exe!ZwCallbackReturn + 23D0 805010D4 16 Bytes [ 5E, 69, 52, B9, BF, 68, 3C, ... ] .text ntkrnlpa.exe!ZwCallbackReturn + 23E4 805010E8 12 Bytes [ DD, 68, 3C, F7, E7, 68, 3C, ... ] .text ntkrnlpa.exe!ZwCallbackReturn + 23F4 805010F8 24 Bytes [ FB, 68, 3C, F7, 05, 69, 3C, ... ] .text ntkrnlpa.exe!ZwCallbackReturn + 24B0 805011B4 12 Bytes [ A5, 69, 3C, F7, 58, 6F, 52, ... ] .text ... ? C:\WINDOWS\system32\DRIVERS\update.sys ---- User code sections - GMER 1.0.12 ---- .text C:\Programmi\File comuni\Softwin\BitDefender Scan Server\bdss.exe[468] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 003C3090 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\explorer.exe[504] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\explorer.exe[504] WS2_32.dll!sendto 71A32C69 5 Bytes JMP 10002D10 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\explorer.exe[504] WS2_32.dll!recvfrom 71A32D0F 5 Bytes JMP 10002CA0 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\explorer.exe[504] WS2_32.dll!bind 71A33E00 5 Bytes JMP 10003020 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\explorer.exe[504] WS2_32.dll!connect 71A3406A 5 Bytes JMP 10002DA0 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\explorer.exe[504] WS2_32.dll!send 71A3428A 5 Bytes JMP 10002AA0 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\explorer.exe[504] WS2_32.dll!gethostbyname 71A34FD4 5 Bytes JMP 10002D70 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\explorer.exe[504] WS2_32.dll!listen 71A388D3 5 Bytes JMP 10002A60 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\explorer.exe[504] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 10003060 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\explorer.exe[504] WS2_32.dll!accept 71A41028 5 Bytes JMP 10002F30 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\system32\winlogon.exe[568] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\system32\winlogon.exe[568] WS2_32.dll!sendto 71A32C69 5 Bytes JMP 10002D10 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\system32\winlogon.exe[568] WS2_32.dll!recvfrom 71A32D0F 5 Bytes JMP 10002CA0 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\system32\winlogon.exe[568] WS2_32.dll!bind 71A33E00 5 Bytes JMP 10003020 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\system32\winlogon.exe[568] WS2_32.dll!connect 71A3406A 5 Bytes JMP 10002DA0 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\system32\winlogon.exe[568] WS2_32.dll!send 71A3428A 5 Bytes JMP 10002AA0 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\system32\winlogon.exe[568] WS2_32.dll!gethostbyname 71A34FD4 5 Bytes JMP 10002D70 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\system32\winlogon.exe[568] WS2_32.dll!listen 71A388D3 5 Bytes JMP 10002A60 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\system32\winlogon.exe[568] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 10003060 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\system32\winlogon.exe[568] WS2_32.dll!accept 71A41028 5 Bytes JMP 10002F30 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\system32\services.exe[612] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\system32\wbem\wmiprvse.exe[1012] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\system32\wbem\wmiprvse.exe[1012] WS2_32.dll!sendto 71A32C69 5 Bytes JMP 10002D10 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\system32\wbem\wmiprvse.exe[1012] WS2_32.dll!recvfrom 71A32D0F 5 Bytes JMP 10002CA0 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\system32\wbem\wmiprvse.exe[1012] WS2_32.dll!bind 71A33E00 5 Bytes JMP 10003020 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\system32\wbem\wmiprvse.exe[1012] WS2_32.dll!connect 71A3406A 5 Bytes JMP 10002DA0 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\system32\wbem\wmiprvse.exe[1012] WS2_32.dll!send 71A3428A 5 Bytes JMP 10002AA0 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\system32\wbem\wmiprvse.exe[1012] WS2_32.dll!gethostbyname 71A34FD4 5 Bytes JMP 10002D70 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\system32\wbem\wmiprvse.exe[1012] WS2_32.dll!listen 71A388D3 5 Bytes JMP 10002A60 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\system32\wbem\wmiprvse.exe[1012] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 10003060 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\system32\wbem\wmiprvse.exe[1012] WS2_32.dll!accept 71A41028 5 Bytes JMP 10002F30 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe[1048] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe[1048] WS2_32.dll!sendto 71A32C69 5 Bytes JMP 10002D10 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe[1048] WS2_32.dll!recvfrom 71A32D0F 5 Bytes JMP 10002CA0 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe[1048] WS2_32.dll!bind 71A33E00 5 Bytes JMP 10003020 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe[1048] WS2_32.dll!connect 71A3406A 5 Bytes JMP 10002DA0 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe[1048] WS2_32.dll!send 71A3428A 5 Bytes JMP 10002AA0 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe[1048] WS2_32.dll!gethostbyname 71A34FD4 5 Bytes JMP 10002D70 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe[1048] WS2_32.dll!listen 71A388D3 5 Bytes JMP 10002A60 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe[1048] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 10003060 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe[1048] WS2_32.dll!accept 71A41028 5 Bytes JMP 10002F30 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe[1172] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe[1172] WS2_32.dll!sendto 71A32C69 5 Bytes JMP 10002D10 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe[1172] WS2_32.dll!recvfrom 71A32D0F 5 Bytes JMP 10002CA0 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe[1172] WS2_32.dll!bind 71A33E00 5 Bytes JMP 10003020 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe[1172] WS2_32.dll!connect 71A3406A 5 Bytes JMP 10002DA0 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe[1172] WS2_32.dll!send 71A3428A 5 Bytes JMP 10002AA0 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe[1172] WS2_32.dll!gethostbyname 71A34FD4 5 Bytes JMP 10002D70 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe[1172] WS2_32.dll!listen 71A388D3 5 Bytes JMP 10002A60 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe[1172] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 10003060 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe[1172] WS2_32.dll!accept 71A41028 5 Bytes JMP 10002F30 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashServ.exe[1220] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashServ.exe[1220] WS2_32.dll!sendto 71A32C69 5 Bytes JMP 10002D10 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashServ.exe[1220] WS2_32.dll!recvfrom 71A32D0F 5 Bytes JMP 10002CA0 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashServ.exe[1220] WS2_32.dll!bind 71A33E00 5 Bytes JMP 10003020 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashServ.exe[1220] WS2_32.dll!connect 71A3406A 5 Bytes JMP 10002DA0 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashServ.exe[1220] WS2_32.dll!send 71A3428A 5 Bytes JMP 10002AA0 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashServ.exe[1220] WS2_32.dll!gethostbyname 71A34FD4 5 Bytes JMP 10002D70 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashServ.exe[1220] WS2_32.dll!listen 71A388D3 5 Bytes JMP 10002A60 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashServ.exe[1220] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 10003060 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashServ.exe[1220] WS2_32.dll!accept 71A41028 5 Bytes JMP 10002F30 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Softwin\BitDefender9\bdoesrv.exe[1484] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashWebSv.exe[1580] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashWebSv.exe[1580] WS2_32.dll!sendto 71A32C69 5 Bytes JMP 10002D10 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashWebSv.exe[1580] WS2_32.dll!recvfrom 71A32D0F 5 Bytes JMP 10002CA0 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashWebSv.exe[1580] WS2_32.dll!bind 71A33E00 5 Bytes JMP 10003020 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashWebSv.exe[1580] WS2_32.dll!connect 71A3406A 5 Bytes JMP 10002DA0 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashWebSv.exe[1580] WS2_32.dll!send 71A3428A 5 Bytes JMP 10002AA0 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashWebSv.exe[1580] WS2_32.dll!gethostbyname 71A34FD4 5 Bytes JMP 10002D70 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashWebSv.exe[1580] WS2_32.dll!listen 71A388D3 5 Bytes JMP 10002A60 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashWebSv.exe[1580] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 10003060 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashWebSv.exe[1580] WS2_32.dll!accept 71A41028 5 Bytes JMP 10002F30 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\system32\nvsvc32.exe[1640] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Prevx2\PXAgent.exe[1680] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00613090 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Prevx2\PXAgent.exe[1680] WS2_32.DLL!sendto 71A32C69 5 Bytes JMP 00612D10 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Prevx2\PXAgent.exe[1680] WS2_32.DLL!recvfrom 71A32D0F 5 Bytes JMP 00612CA0 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Prevx2\PXAgent.exe[1680] WS2_32.DLL!bind 71A33E00 5 Bytes JMP 00613020 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Prevx2\PXAgent.exe[1680] WS2_32.DLL!connect 71A3406A 5 Bytes JMP 00612DA0 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Prevx2\PXAgent.exe[1680] WS2_32.DLL!send 71A3428A 5 Bytes JMP 00612AA0 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Prevx2\PXAgent.exe[1680] WS2_32.DLL!gethostbyname 71A34FD4 5 Bytes JMP 00612D70 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Prevx2\PXAgent.exe[1680] WS2_32.DLL!listen 71A388D3 5 Bytes JMP 00612A60 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Prevx2\PXAgent.exe[1680] WS2_32.DLL!closesocket 71A39639 5 Bytes JMP 00613060 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Prevx2\PXAgent.exe[1680] WS2_32.DLL!accept 71A41028 5 Bytes JMP 00612F30 C:\WINDOWS\system32\sockspy.dll .text C:\PROGRA~1\Softwin\BITDEF~1\bdswitch.exe[1684] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\soundman.exe[1792] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Java\jre1.6.0_01\bin\jusched.exe[1824] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashDisp.exe[1848] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashDisp.exe[1848] WS2_32.dll!sendto 71A32C69 5 Bytes JMP 10002D10 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashDisp.exe[1848] WS2_32.dll!recvfrom 71A32D0F 5 Bytes JMP 10002CA0 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashDisp.exe[1848] WS2_32.dll!bind 71A33E00 5 Bytes JMP 10003020 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashDisp.exe[1848] WS2_32.dll!connect 71A3406A 5 Bytes JMP 10002DA0 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashDisp.exe[1848] WS2_32.dll!send 71A3428A 5 Bytes JMP 10002AA0 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashDisp.exe[1848] WS2_32.dll!gethostbyname 71A34FD4 5 Bytes JMP 10002D70 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashDisp.exe[1848] WS2_32.dll!listen 71A388D3 5 Bytes JMP 10002A60 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashDisp.exe[1848] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 10003060 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Alwil Software\Avast4\ashDisp.exe[1848] WS2_32.dll!accept 71A41028 5 Bytes JMP 10002F30 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\system32\rundll32.exe[2288] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Adobe\Acrobat 8.0\Acrobat\acrotray.exe[2388] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Adobe\Acrobat 8.0\Acrobat\acrotray.exe[2388] WS2_32.dll!sendto 71A32C69 5 Bytes JMP 10002D10 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Adobe\Acrobat 8.0\Acrobat\acrotray.exe[2388] WS2_32.dll!recvfrom 71A32D0F 5 Bytes JMP 10002CA0 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Adobe\Acrobat 8.0\Acrobat\acrotray.exe[2388] WS2_32.dll!bind 71A33E00 5 Bytes JMP 10003020 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Adobe\Acrobat 8.0\Acrobat\acrotray.exe[2388] WS2_32.dll!connect 71A3406A 5 Bytes JMP 10002DA0 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Adobe\Acrobat 8.0\Acrobat\acrotray.exe[2388] WS2_32.dll!send 71A3428A 5 Bytes JMP 10002AA0 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Adobe\Acrobat 8.0\Acrobat\acrotray.exe[2388] WS2_32.dll!gethostbyname 71A34FD4 5 Bytes JMP 10002D70 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Adobe\Acrobat 8.0\Acrobat\acrotray.exe[2388] WS2_32.dll!listen 71A388D3 5 Bytes JMP 10002A60 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Adobe\Acrobat 8.0\Acrobat\acrotray.exe[2388] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 10003060 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Adobe\Acrobat 8.0\Acrobat\acrotray.exe[2388] WS2_32.dll!accept 71A41028 5 Bytes JMP 10002F30 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\QuickTime\qttask.exe[2412] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Prevx2\PXConsole.exe[2428] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 003C3090 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Prevx2\PXConsole.exe[2428] WS2_32.DLL!sendto 71A32C69 5 Bytes JMP 003C2D10 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Prevx2\PXConsole.exe[2428] WS2_32.DLL!recvfrom 71A32D0F 5 Bytes JMP 003C2CA0 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Prevx2\PXConsole.exe[2428] WS2_32.DLL!bind 71A33E00 5 Bytes JMP 003C3020 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Prevx2\PXConsole.exe[2428] WS2_32.DLL!connect 71A3406A 5 Bytes JMP 003C2DA0 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Prevx2\PXConsole.exe[2428] WS2_32.DLL!send 71A3428A 5 Bytes JMP 003C2AA0 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Prevx2\PXConsole.exe[2428] WS2_32.DLL!gethostbyname 71A34FD4 5 Bytes JMP 003C2D70 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Prevx2\PXConsole.exe[2428] WS2_32.DLL!listen 71A388D3 5 Bytes JMP 003C2A60 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Prevx2\PXConsole.exe[2428] WS2_32.DLL!closesocket 71A39639 5 Bytes JMP 003C3060 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Prevx2\PXConsole.exe[2428] WS2_32.DLL!accept 71A41028 5 Bytes JMP 003C2F30 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\system32\ctfmon.exe[2476] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\File comuni\Adobe\Updater5\AdobeUpdater.exe[2540] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\File comuni\Adobe\Updater5\AdobeUpdater.exe[2540] WS2_32.dll!sendto 71A32C69 5 Bytes JMP 10002D10 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\File comuni\Adobe\Updater5\AdobeUpdater.exe[2540] WS2_32.dll!recvfrom 71A32D0F 5 Bytes JMP 10002CA0 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\File comuni\Adobe\Updater5\AdobeUpdater.exe[2540] WS2_32.dll!bind 71A33E00 5 Bytes JMP 10003020 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\File comuni\Adobe\Updater5\AdobeUpdater.exe[2540] WS2_32.dll!connect 71A3406A 5 Bytes JMP 10002DA0 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\File comuni\Adobe\Updater5\AdobeUpdater.exe[2540] WS2_32.dll!send 71A3428A 5 Bytes JMP 10002AA0 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\File comuni\Adobe\Updater5\AdobeUpdater.exe[2540] WS2_32.dll!gethostbyname 71A34FD4 5 Bytes JMP 10002D70 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\File comuni\Adobe\Updater5\AdobeUpdater.exe[2540] WS2_32.dll!listen 71A388D3 5 Bytes JMP 10002A60 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\File comuni\Adobe\Updater5\AdobeUpdater.exe[2540] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 10003060 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\File comuni\Adobe\Updater5\AdobeUpdater.exe[2540] WS2_32.dll!accept 71A41028 5 Bytes JMP 10002F30 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\system32\alg.exe[2584] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\System32\sockspy.dll .text C:\WINDOWS\system32\alg.exe[2584] WS2_32.dll!sendto 71A32C69 5 Bytes JMP 10002D10 C:\WINDOWS\System32\sockspy.dll .text C:\WINDOWS\system32\alg.exe[2584] WS2_32.dll!recvfrom 71A32D0F 5 Bytes JMP 10002CA0 C:\WINDOWS\System32\sockspy.dll .text C:\WINDOWS\system32\alg.exe[2584] WS2_32.dll!bind 71A33E00 5 Bytes JMP 10003020 C:\WINDOWS\System32\sockspy.dll .text C:\WINDOWS\system32\alg.exe[2584] WS2_32.dll!connect 71A3406A 5 Bytes JMP 10002DA0 C:\WINDOWS\System32\sockspy.dll .text C:\WINDOWS\system32\alg.exe[2584] WS2_32.dll!send 71A3428A 5 Bytes JMP 10002AA0 C:\WINDOWS\System32\sockspy.dll .text C:\WINDOWS\system32\alg.exe[2584] WS2_32.dll!gethostbyname 71A34FD4 5 Bytes JMP 10002D70 C:\WINDOWS\System32\sockspy.dll .text C:\WINDOWS\system32\alg.exe[2584] WS2_32.dll!listen 71A388D3 5 Bytes JMP 10002A60 C:\WINDOWS\System32\sockspy.dll .text C:\WINDOWS\system32\alg.exe[2584] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 10003060 C:\WINDOWS\System32\sockspy.dll .text C:\WINDOWS\system32\alg.exe[2584] WS2_32.dll!accept 71A41028 5 Bytes JMP 10002F30 C:\WINDOWS\System32\sockspy.dll .text C:\Programmi\Adobe\Reader 8.0\Reader\reader_sl.exe[2780] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\Adobe\Acrobat 8.0\Acrobat\acrobat_sl.exe[2980] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\File comuni\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe[3076] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\system32\wuauclt.exe[3108] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\system32\wuauclt.exe[3108] WS2_32.dll!sendto 71A32C69 5 Bytes JMP 10002D10 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\system32\wuauclt.exe[3108] WS2_32.dll!recvfrom 71A32D0F 5 Bytes JMP 10002CA0 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\system32\wuauclt.exe[3108] WS2_32.dll!bind 71A33E00 5 Bytes JMP 10003020 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\system32\wuauclt.exe[3108] WS2_32.dll!connect 71A3406A 5 Bytes JMP 10002DA0 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\system32\wuauclt.exe[3108] WS2_32.dll!send 71A3428A 5 Bytes JMP 10002AA0 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\system32\wuauclt.exe[3108] WS2_32.dll!gethostbyname 71A34FD4 5 Bytes JMP 10002D70 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\system32\wuauclt.exe[3108] WS2_32.dll!listen 71A388D3 5 Bytes JMP 10002A60 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\system32\wuauclt.exe[3108] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 10003060 C:\WINDOWS\system32\sockspy.dll .text C:\WINDOWS\system32\wuauclt.exe[3108] WS2_32.dll!accept 71A41028 5 Bytes JMP 10002F30 C:\WINDOWS\system32\sockspy.dll .text C:\Programmi\WinRAR\WinRAR.exe[3476] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll .text C:\DOCUME~1\BARTOL~1\IMPOST~1\Temp\Rar$EX00.344\gmer.exe[3504] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll ---- EOF - GMER 1.0.12 ---- |
|
|
|
18-06-2007, 20:20
|
#2 |
|
Member
Iscritto dal: Jun 2007
Messaggi: 90
|
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
lunika kosa ke ho trovatto kn hijackthis e x di + la da kme inutile |
|
|
|
|
18-06-2007, 21:07
|
#3 |
|
Junior Member
Iscritto dal: Jun 2007
Messaggi: 5
|
Non riesco neanche a fare la scansione con prevx2 perché si blocca -.-
e non me lo fa eseguire in modalità provvisoria  Non voglio formattare di nuovo  , anche perché suppongo chemi si blocchi facendo il backup 
|
|
|
|
|
19-06-2007, 10:10
|
#4 |
|
Senior Member
Iscritto dal: Apr 2006
Messaggi: 22462
|
che ci fai con de antivirus?
__________________
amd a64x2 4400+ sk939;asus a8n-sli; 2x1gb ddr400; x850 crossfire; 2 x western digital abys 320gb|| asus g1
Se striscia fulmina, se svolazza l'ammazza |
|
|
|
|
19-06-2007, 16:16
|
#5 |
|
Junior Member
Iscritto dal: Jun 2007
Messaggi: 5
|
l'antivirus di bitdefender è disabilitato, perché mi sa che fa un pò pena xD
comunque avast trova win32 Trojan-gen e lo rimuove, se rifaccio un altra scansione lo trova ancora... c'è qualche kit di rimozione?? Ultima modifica di Kinth : 19-06-2007 alle 16:20. |
|
|
|
|
|
| Strumenti | |
|
|
Tutti gli orari sono GMT +1. Ora sono le: 00:09.
