|
|||||||
|
|
|
 |
|
|
Strumenti |
12-10-2010, 19:43
|
#1 |
|
Junior Member
Iscritto dal: Oct 2010
Messaggi: 1
|
Spyware insistente
Salve,
vorrei porre alla vostra attenzione il seguente log emesso da hijack: Codice:
Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 17.58.01, on 12/10/2010 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0013) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe E:\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti F2 - REG:system.ini: Shell=Explorer.exe csrcs.exe O1 - Hosts: 89.149.249.196 www.google.com O1 - Hosts: 89.149.249.196 www.google.de O1 - Hosts: 89.149.249.196 www.google.fr O1 - Hosts: 89.149.249.196 www.google.co.uk O1 - Hosts: 89.149.249.196 www.google.com.br O1 - Hosts: 89.149.249.196 www.google.it O1 - Hosts: 89.149.249.196 www.google.es O1 - Hosts: 89.149.249.196 www.google.co.jp O1 - Hosts: 89.149.249.196 www.google.com.mx O1 - Hosts: 89.149.249.196 www.google.ca O1 - Hosts: 89.149.249.196 www.google.com.au O1 - Hosts: 89.149.249.196 www.google.nl O1 - Hosts: 89.149.249.196 www.google.co.za O1 - Hosts: 89.149.249.196 www.google.be O1 - Hosts: 89.149.249.196 www.google.gr O1 - Hosts: 89.149.249.196 www.google.at O1 - Hosts: 89.149.249.196 www.google.se O1 - Hosts: 89.149.249.196 www.google.ch O1 - Hosts: 89.149.249.196 www.google.pt O1 - Hosts: 89.149.249.196 www.google.dk O1 - Hosts: 89.149.249.196 www.google.fi O1 - Hosts: 89.149.249.196 www.google.ie O1 - Hosts: 89.149.249.196 www.google.no O1 - Hosts: 89.149.249.196 search.yahoo.com O1 - Hosts: 89.149.249.196 us.search.yahoo.com O1 - Hosts: 89.149.249.196 uk.search.yahoo.com O1 - Hosts: 89.149.249.196 www.google.com O1 - Hosts: 89.149.249.196 www.google.de O1 - Hosts: 89.149.249.196 www.google.fr O1 - Hosts: 89.149.249.196 www.google.co.uk O1 - Hosts: 89.149.249.196 www.google.com.br O1 - Hosts: 89.149.249.196 www.google.it O1 - Hosts: 89.149.249.196 www.google.es O1 - Hosts: 89.149.249.196 www.google.co.jp O1 - Hosts: 89.149.249.196 www.google.com.mx O1 - Hosts: 89.149.249.196 www.google.ca O1 - Hosts: 89.149.249.196 www.google.com.au O1 - Hosts: 89.149.249.196 www.google.nl O1 - Hosts: 89.149.249.196 www.google.co.za O1 - Hosts: 89.149.249.196 www.google.be O1 - Hosts: 89.149.249.196 www.google.gr O1 - Hosts: 89.149.249.196 www.google.at O1 - Hosts: 89.149.249.196 www.google.se O1 - Hosts: 89.149.249.196 www.google.ch O1 - Hosts: 89.149.249.196 www.google.pt O1 - Hosts: 89.149.249.196 www.google.dk O1 - Hosts: 89.149.249.196 www.google.fi O1 - Hosts: 89.149.249.196 www.google.ie O1 - Hosts: 89.149.249.196 www.google.no O1 - Hosts: 89.149.249.196 search.yahoo.com O1 - Hosts: 89.149.249.196 us.search.yahoo.com O1 - Hosts: 89.149.249.196 uk.search.yahoo.com O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmi\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [Adobe ARM] "C:\Programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKLM\..\Policies\Explorer\Run: [ahb9z] C:\DOCUME~1\REGION~1\IMPOST~1\Temp\zfd3mig.exe O4 - HKLM\..\Policies\Explorer\Run: [zhswcl] C:\DOCUME~1\REGION~1\IMPOST~1\Temp\rcx7tc.exe O4 - HKLM\..\Policies\Explorer\Run: [mslivemsn] C:\Program Files\Windows NT\Accessories\svchost.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O16 - DPF: {0a454840-7232-11d5-b63d-00c04faedb18} - O17 - HKLM\System\CCS\Services\Tcpip\..\{164044BA-31D0-43CF-9E21-435DFC51C010}: NameServer = 10.160.7.253,10.160.16.200 O17 - HKLM\System\CCS\Services\Tcpip\..\{D6F9E730-6D6F-4811-AEBF-E886AD8D7C66}: NameServer = 85.37.17.11 85.38.28.69 O20 - AppInit_DLLs: C:\DOCUME~1\REGION~1\DATIAP~1\Opera\UPLCRT~1\msftldr.dll O20 - Winlogon Notify: !SASWinLogon - C:\Programmi\SUPERAntiSpyware\SASWINLO.dll O20 - Winlogon Notify: CAF - C:\Programmi\CA\DSM\Bin\cfwlogon.dll O20 - Winlogon Notify: rcHostExt - C:\Programmi\CA\DSM\Bin\rcLoginExt.dll O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll -- End of file - 6329 bytes I sintomi sono: pagina google "fake", programmi antivirus e antispyware non attivabili, regedit non disponibile, programmi ad esecuzione automatica che si ricreano ad ogni avvio nonostante levi la spunta, etc... Ho già provato con l'antivirus, con superantispyware (modalità normale e provvisoria), ma nulla... Cosa mi consigliate di fare? Grazie! Ultima modifica di ferrari599gtb : 12-10-2010 alle 19:46. |
|
|
|
13-10-2010, 11:04
|
#2 |
|
Moderatore
Iscritto dal: Jun 2007
Città: 127.0.0.1
Messaggi: 25885
|
Ciao ! Segui la Guida alla disinfezione allegando tutti i log prodotti in un'unico post secondo le sottoindicate modalità, grazie per la collaborazione.
Modalità di pubblicazione dei log: Ogni singolo log, esclusivamente in formato .txt a parte SynInspector .xml, deve essere hostato nell'ordine indicato in Guida su uno dei server remoti elencati nelle Regole di sezione.
__________________
Try again and you will be luckier.
|
|
|
|
|
|
| Strumenti | |
|
|
Tutti gli orari sono GMT +1. Ora sono le: 06:16.
