|
|||||||
|
|
|
 |
|
|
Strumenti |
23-09-2004, 02:08
|
#1 |
|
Member
Iscritto dal: Apr 2004
Città: Bari - Foggia
Messaggi: 114
|
www.casinopalazzo.com ed errori in librerie dinamiche
Ciaoa tutti, vengo subito al dunque: il mio problema è dovuto alla ripetizione continua di errori causati dalle più diverse applicazioni : spesso non riesco a chiudere correttamente windows e al riavvio persino scandisk causa errori in "sconosciuto" o in qualche libreria dinamica...ho effettuato la scansione col norton security, con adaware,spybot e cws shredder,ma dopo una sommaria pulizia il problema ritorna e persiste... dirò di più: durante la normale navigazione in internet capita ogni volta che venga reindirizzato senza la mia volontà verso siti di gambling on line o pubblicitari che comunque sono sempre gli stessi.Inoltre ad ogni avvio di internet explorer mi si ricrea il virus mfplay.exe e sul desktop appare una icona con una grossa "x" gialla in campo blu che connette a casinopalazzo.com. L'antivirus vede il virus ed ogni volta mi comunica la sua corretta eliminazione, ma ogni volta il problema si ripete. Mi rivolgo a chi ne sa più di me (e siete tanti!)
 er favore date uno sguardo e ditemi cosa ne pensate: allego il log di HJT ... Ogni consiglio è il benvenuto!Grazie in anticipo dal Buon Vecchio Zio Nick Logfile of HijackThis v1.98.0 Scan saved at 1.45.50, on 23/09/2004 Platform: Windows ME (Win9x 4.90.3000) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\STIMON.EXE C:\PROGRAMMI\FILE COMUNI\SYMANTEC SHARED\SYMTRAY.EXE C:\WINDOWS\SYSTEM\MSTASK.EXE C:\PROGRAMMI\NORTON SYSTEMWORKS\NORTON UTILITIES\NPROTECT.EXE C:\PROGRAMMI\NORTON SYSTEMWORKS\NORTON CLEANSWEEP\CSINJECT.EXE C:\PROGRAMMI\FILE COMUNI\SYMANTEC SHARED\CCSETMGR.EXE C:\PROGRAMMI\FILE COMUNI\SYMANTEC SHARED\CCEVTMGR.EXE C:\PROGRAMMI\FILE COMUNI\SYMANTEC SHARED\CCPROXY.EXE C:\PROGRAMMI\FILE COMUNI\SYMANTEC SHARED\SNDSRVC.EXE C:\PROGRAMMI\NORTON SYSTEMWORKS\NORTON GHOST\GHOSTSTARTSERVICE.EXE C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\TASKMON.EXE C:\PROGRAMMI\ADAPTEC\EASY CD CREATOR 5\DIRECTCD\DIRECTCD.EXE C:\PROGRAMMI\PESTPATROL\COOKIEPATROL.EXE C:\PROGRAMMI\PESTPATROL\PPMEMCHECK.EXE C:\PROGRAMMI\PESTPATROL\PPCONTROL.EXE C:\WINDOWS\SYSTEM\SPOOL32.EXE C:\PROGRAMMI\FILE COMUNI\SYMANTEC SHARED\CCAPP.EXE C:\WINDOWS\SYSTEM\MSCONFIG.EXE C:\PROGRAMMI\NORTON SYSTEMWORKS\NORTON CLEANSWEEP\CSINSM32.EXE C:\PROGRAMMI\NORTON SYSTEMWORKS\NORTON CLEANSWEEP\Monwow.exe C:\PROGRAMMI\INTERNET EXPLORER\IEXPLORE.EXE C:\WINDOWS\SYSTEM\RNAAPP.EXE C:\WINDOWS\SYSTEM\TAPISRV.EXE C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\WINDOWS\SYSTEM\TASKMGN.EXE C:\WINDOWS\SYSTEM\DDHELP.EXE C:\PROGRAMMI\INTERNET EXPLORER\IEXPLORE.EXE C:\WINDOWS\SYSTEM\PSTORES.EXE C:\PROGRAMMI\OUTLOOK EXPRESS\MSIMN.EXE C:\PROGRAMMI\WINZIP\WINZIP32.EXE C:\WINDOWS\TEMP\HIJACKTHIS.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.qinetiq.com/home_etps.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.libero.it:8080 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMMI\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL O2 - BHO: (no name) - {85CBFDE0-B26B-4EE5-BD3C-4DE111DE763E} - C:\WINDOWS\SYSTEM\WINNET.DLL O2 - BHO: - {ADDB1117-BA0B-4D12-AE6C-B3F0D57CC49B} - C:\WINDOWS\SYSTEM\L.DLL O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Programmi\File comuni\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmi\Norton Internet Security Professional\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Programmi\File comuni\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmi\Norton Internet Security Professional\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Programmi\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Programmi\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRAMMI\PESTPATROL\CookiePatrol.exe O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRAMMI\PESTPATROL\PPMemCheck.exe O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRAMMI\PESTPATROL\PPControl.exe O4 - HKLM\..\Run: [EPSON Stylus Photo RX (copia 1)] C:\WINDOWS\SYSTEM\E_S4I0M2.EXE /P31 "EPSON Stylus Photo RX (copia 1)" /O7 "EPUSB1:" /M "Stylus Photo RX600" O4 - HKLM\..\Run: [EPSON Stylus Photo RX600] C:\WINDOWS\SYSTEM\E_S4I0M2.EXE /P24 "EPSON Stylus Photo RX600" /O7 "EPUSB1:" /M "Stylus Photo RX600" O4 - HKLM\..\Run: [NPROTECT] C:\Programmi\Norton SystemWorks\Norton Utilities\Nprotect.exe O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Programmi\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe O4 - HKLM\..\Run: [AcctMgr] C:\Programmi\Norton SystemWorks\Password Manager\AcctMgr.exe /startup O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Programmi\Norton Internet Security Professional\UrlLstCk.exe O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~5\NORTON~1\ADVTOOLS\ADVCHK.EXE O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMON.EXE O4 - HKLM\..\Run: [MSConfigReminder] C:\WINDOWS\SYSTEM\msconfig.exe /reminder O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE O4 - HKLM\..\RunServices: [SymTray - Norton SystemWorks] C:\Programmi\File comuni\Symantec Shared\SymTray.exe "Norton SystemWorks" O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [NPROTECT] C:\Programmi\Norton SystemWorks\Norton Utilities\Nprotect.exe O4 - HKLM\..\RunServices: [CSINJECT.EXE] C:\Programmi\Norton SystemWorks\Norton CleanSweep\csinject.exe O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe" O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe" O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Programmi\File comuni\Symantec Shared\Script Blocking\SBServ.exe" -reg O4 - HKLM\..\RunServices: [ccProxy] C:\PROGRA~1\FILECO~1\SYMANT~1\CCPROXY.EXE O4 - HKLM\..\RunServices: [SndSrvc] C:\PROGRA~1\FILECO~1\SYMANT~1\SNDSRVC.EXE O4 - HKLM\..\RunServices: [GhostStartService] C:\PROGRAMMI\NORTON SYSTEMWORKS\NORTON GHOST\GHOSTSTARTSERVICE.EXE O4 - HKCU\..\Run: [SpySweeper] "C:\Programmi\Webroot\Spy Sweeper\SPYSWEEPER.EXE" /0 O4 - HKCU\..\RunServices: [SpySweeper] "C:\Programmi\Webroot\Spy Sweeper\SPYSWEEPER.EXE" /0 O4 - Startup: CleanSweep Smart Sweep-Internet Sweep.lnk = C:\Programmi\Norton SystemWorks\Norton CleanSweep\csinsm32.exe O4 - Startup: Webshots.lnk = C:\Programmi\Webshots\WebshotsTray.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O12 - Plugin for .3dml: C:\Programmi\Flatland\NProver.dll O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://212.141.212.204/activex/AxisCamControl.ocx O16 - DPF: {7A32634B-029C-4836-A023-528983982A49} (MSN Chat Control 4.2) - http://fdl.msn.com/public/chat/msnchat42.cab O16 - DPF: {00000000-d9e3-4bc6-a0bd-3d0ca4be5271} - O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...64/mcfscan.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://housecall.trendmicro-europe.c...ll/Xscan53.cab O20 - AppInit_DLLs: apitrap.dll; O21 - SSODL: AUHook - {BCBCD383-3E06-11D3-91A9-00C04F68105C} - C:\WINDOWS\SYSTEM\AUHOOK.DLL |
|
|
|
23-09-2004, 02:16
|
#2 |
|
Member
Iscritto dal: Apr 2004
Città: Bari - Foggia
Messaggi: 114
|
(seguito)
...ed ecco qua il fault log di windows. Ragazzi aspetto consigli!
Data 09/12/2004 Ora 22:52 EXPLORER ha provocato un errore di pagina non valida nel modulo <sconosciuto> in dbb7:06dd4c1a. Registri: EAX=8177932c CS=0177 EIP=06dd4c1a EFLGS=00210246 EBX=00000000 SS=017f ESP=0175fa68 EBP=06dd4c1a ECX=00000001 DS=017f ESI=7ffd2f18 FS=2747 EDX=004932b0 ES=017f EDI=000005dc GS=0000 Byte all'indirizzo CS:EIP: Immagine dello stack: 7ff58610 0175fa9c 000005dc 7ffd2f18 00000018 7ff5ac19 00000019 00000001 0175fac0 817cfa90 00000000 fff7c951 00000019 0175fac4 7ff5ab64 7ff5a430 ********************************************************************** Data 09/13/2004 Ora 14:24 WEBSHOTS ha provocato un errore di pagina non valida nel modulo WEBSHOTS.SCR in 0177:00427461. Registri: EAX=011d1600 CS=0177 EIP=00427461 EFLGS=00010286 EBX=011d0900 SS=017f ESP=01defd48 EBP=011d2880 ECX=00000000 DS=017f ESI=011d24c0 FS=270f EDX=800093f0 ES=017f EDI=000000ed GS=0000 Byte all'indirizzo CS:EIP: 8b 51 04 52 ff 15 d4 50 47 00 85 ff 7e 48 8b 5c Immagine dello stack: 00000000 000000ed 011d24c0 011d0900 011d2c30 0000ec13 00000000 011d2c40 000000ed 011d0900 011d24c0 004275ce 01defd8c 000000b3 011d0b08 00000001 ********************************************************************** Data 09/13/2004 Ora 14:39 WEBSHOTS ha provocato un errore di pagina non valida nel modulo WEBSHOTS.SCR in 0177:00427461. Registri: EAX=011d13f0 CS=0177 EIP=00427461 EFLGS=00010282 EBX=011d0900 SS=017f ESP=01defd48 EBP=011d2880 ECX=00000000 DS=017f ESI=011d24c0 FS=1437 EDX=800066e0 ES=017f EDI=000000ed GS=0000 Byte all'indirizzo CS:EIP: 8b 51 04 52 ff 15 d4 50 47 00 85 ff 7e 48 8b 5c Immagine dello stack: 00000000 000000ed 011d24c0 011d0900 011d2c30 0000ec13 00000000 011d2c40 000000ed 011d0900 011d24c0 004275ce 01defd8c 000000b3 011d0b08 00000001 ********************************************************************** Data 09/13/2004 Ora 15:11 EXPLORER ha provocato un errore di pagina non valida nel modulo KERNEL32.DLL in 0197:bff8e1ad. Registri: EAX=c002fa54 CS=0197 EIP=bff8e1ad EFLGS=00010216 EBX=0188ff88 SS=019f ESP=0184ff44 EBP=018501e0 ECX=00000000 DS=019f ESI=01850330 FS=1d0f EDX=bff6682d ES=019f EDI=0188ff74 GS=0000 Byte all'indirizzo CS:EIP: 53 8b 15 f4 bc fb bf 56 89 4d e4 57 89 4d dc 89 Immagine dello stack: ********************************************************************** Data 09/13/2004 Ora 22:16 MSIMN ha provocato un errore di pagina non valida nel modulo KERNEL32.DLL in 0197:bff6bb07. Registri: EAX=00000000 CS=0197 EIP=bff6bb07 EFLGS=00200246 EBX=01d5aeb8 SS=019f ESP=076cf8e8 EBP=076cfc34 ECX=01d5aeb0 DS=019f ESI=01d5aeb8 FS=6847 EDX=076cf92c ES=019f EDI=076cfc2c GS=0000 Byte all'indirizzo CS:EIP: ff 76 04 e8 8a 87 ff ff 5e c2 04 00 56 8b 74 24 Immagine dello stack: 01d5aeb0 100139d9 01d5aeb8 00fc2af4 1000e7d0 1000e8e5 01d5aeb0 1001b7f8 63000000 00000000 fa3a12d3 076cf92c 076cfa2c 00000000 01d5aeb0 076cfc38 ********************************************************************** Data 09/14/2004 Ora 00:19 IEXPLORE ha provocato un errore di stack nel modulo KERNEL32.DLL in 0197:bff624a5. Registri: EAX=002a0037 CS=0197 EIP=bff624a5 EFLGS=00000202 EBX=f928d000 SS=019f ESP=0815cca4 EBP=0815ccb8 ECX=0000007b DS=019f ESI=0815ccc8 FS=9e2f EDX=84b4d098 ES=019f EDI=84b4d098 GS=0000 Byte all'indirizzo CS:EIP: 6a ff e8 a8 b1 01 00 eb e7 55 8b ec 56 57 53 8b Immagine dello stack: f928d000 84b4d0a0 0815ccc8 0815cce4 81744050 0815cd24 bff62830 84b4d098 0815ccc8 096f00c1 01cf0028 00000000 000000ff 000007d0 ac3f0000 00000002 ********************************************************************** Data 09/14/2004 Ora 14:08 MSIMN ha provocato un errore di pagina non valida nel modulo MSHTMLED.DLL in 0197:70f72931. Registri: EAX=03ce0144 CS=0197 EIP=70f72931 EFLGS=00010206 EBX=028d3ab0 SS=019f ESP=00565648 EBP=00565658 ECX=00000000 DS=019f ESI=00000000 FS=2337 EDX=00565720 ES=019f EDI=00565720 GS=0000 Byte all'indirizzo CS:EIP: f6 46 04 02 74 75 8d 45 08 50 ff 75 0c e8 f0 fc Immagine dello stack: 028cd910 00000000 03ce0144 00000000 005656b4 70f398ff 028d3ab0 004b79c0 00565720 70f424bd 03ce0144 028d3ab0 004b79c0 00565720 00000000 637dc535 ********************************************************************** Data 09/14/2004 Ora 14:08 MSIMN ha provocato un errore di pagina non valida nel modulo SHLWAPI.DLL in 0197:70a95a5a. Registri: EAX=00000065 CS=0197 EIP=70a95a5a EFLGS=00210212 EBX=00000001 SS=019f ESP=0056f8f4 EBP=0056f964 ECX=00000000 DS=019f ESI=635c67a6 FS=2337 EDX=00000001 ES=019f EDI=00000000 GS=0000 Byte all'indirizzo CS:EIP: 0f b7 0a 42 42 83 f9 41 7c 08 83 f9 5a 7f 03 83 Immagine dello stack: 00568e58 635c695c 635c67a4 00000001 00000000 029054b0 0047e498 00000000 00000000 0000000e 00000045 637ec0d8 0056f950 6358e482 02905046 000000b7 ********************************************************************** Data 09/14/2004 Ora 14:09 MSIMN ha provocato un errore di pagina non valida nel modulo MSHTMLED.DLL in 0197:70f72931. Registri: EAX=03c50144 CS=0197 EIP=70f72931 EFLGS=00210206 EBX=028d0a30 SS=019f ESP=00565648 EBP=00565658 ECX=00000000 DS=019f ESI=00000000 FS=1677 EDX=00565720 ES=019f EDI=00565720 GS=0000 Byte all'indirizzo CS:EIP: f6 46 04 02 74 75 8d 45 08 50 ff 75 0c e8 f0 fc Immagine dello stack: 028cd910 00000000 03c50144 00000000 005656b4 70f398ff 028d0a30 004e3b5c 00565720 70f424bd 03c50144 028d0a30 004e3b5c 00565720 00000000 637dc535 ********************************************************************** Data 09/14/2004 Ora 14:09 MSIMN ha provocato un errore di pagina non valida nel modulo <sconosciuto> in cc88:00000003. Registri: EAX=005656b4 CS=0197 EIP=00000003 EFLGS=00010206 EBX=00000000 SS=019f ESP=0056eb54 EBP=028c4e10 ECX=00565830 DS=019f ESI=028c4df0 FS=1677 EDX=00404021 ES=019f EDI=028dc910 GS=0000 Byte all'indirizzo CS:EIP: 12 2b 04 70 00 c3 e2 00 f0 2b 04 70 00 2b 04 70 Immagine dello stack: 636fac43 005656b4 028dc910 028c4e10 0056ec38 00000000 00000000 00000001 028c4df0 00000000 00000000 028c4e10 bff6bb26 00000018 00000000 00000000 ********************************************************************** Data 09/15/2004 Ora 15:58 MSIMN ha provocato un errore di pagina non valida nel modulo MSHTMLED.DLL in 018f:70f72931. Registri: EAX=04ff0144 CS=018f EIP=70f72931 EFLGS=00010206 EBX=03560e00 SS=0197 ESP=00565648 EBP=00565658 ECX=00000000 DS=0197 ESI=00000000 FS=1c1f EDX=00565720 ES=0197 EDI=00565720 GS=0000 Byte all'indirizzo CS:EIP: f6 46 04 02 74 75 8d 45 08 50 ff 75 0c e8 f0 fc Immagine dello stack: 0353d910 00000000 04ff0144 00000000 005656b4 70f398ff 03560e00 004543ac 00565720 70f424bd 04ff0144 03560e00 004543ac 00565720 00000000 637dc535 ********************************************************************** Data 09/15/2004 Ora 16:13 MSIMN ha provocato un errore di pagina non valida nel modulo MSI.DLL in 018f:05a5bb04. Registri: EAX=00000000 CS=018f EIP=05a5bb04 EFLGS=00010a07 EBX=03534e10 SS=0197 ESP=0056e6a8 EBP=51abea00 ECX=00000000 DS=0197 ESI=636fac47 FS=1c1f EDX=0056e770 ES=0197 EDI=0354f5b0 GS=0000 Byte all'indirizzo CS:EIP: 20 20 20 00 55 6e 6b 6e 6f 77 6e 00 25 73 20 28 Immagine dello stack: 00000001 03534df0 00000000 00000000 03534e10 bff6bb26 00000018 00000000 00000000 00000000 03534e34 637ec0d8 03534000 0056e770 00404021 00000000 ********************************************************************** Data 09/15/2004 Ora 16:34 EXPLORER ha provocato un errore di pagina non valida nel modulo <sconosciuto> in dd6c:02f57450. Registri: EAX=06e1f698 CS=018f EIP=02f57450 EFLGS=00010202 EBX=00000001 SS=0197 ESP=06e1f678 EBP=06e1f69c ECX=00000007 DS=0197 ESI=00000744 FS=3c57 EDX=868d9c54 ES=0197 EDI=7ffd2f18 GS=3116 Byte all'indirizzo CS:EIP: Immagine dello stack: 7ff501ac 06e1fb0c 7ff225d0 06e1f698 06e1fb28 7ffd2f18 0000001f 02f57450 00000000 06e1f6d8 7ff52a0a 0000001f 00000000 06e1fb0c 7ff225d0 06e1fb28 ********************************************************************** Data 09/15/2004 Ora 16:35 EXPLORER ha provocato un errore di pagina non valida nel modulo SHLWAPI.DLL in 018f:70aa8c9e. Registri: EAX=829a9a00 CS=018f EIP=70aa8c9e EFLGS=00010202 EBX=70aa8c8c SS=0197 ESP=03c8e574 EBP=03c8e580 ECX=829a96a8 DS=0197 ESI=06030a70 FS=63ef EDX=00000006 ES=0197 EDI=80004005 GS=0000 Byte all'indirizzo CS:EIP: 8b 06 8d 4d 08 51 68 a0 da a8 70 56 ff 10 85 c0 Immagine dello stack: 00000006 0049a850 829a96a8 00000000 7fbd1520 06030a70 00000000 80004005 0049a84c 03c8e5b8 00477404 70aa8cbc 0049a850 00000000 03c8ed68 bff4595a ********************************************************************** Data 09/15/2004 Ora 16:35 EXPLORER ha provocato un errore di pagina non valida nel modulo <sconosciuto> in dd6c:03d21cc0. Registri: EAX=81781ab0 CS=018f EIP=03d21cc0 EFLGS=00010246 EBX=00000000 SS=0197 ESP=03c8fa68 EBP=03d21cc0 ECX=00000001 DS=0197 ESI=7ffd2f18 FS=63ef EDX=00483448 ES=0197 EDI=00000744 GS=0000 Byte all'indirizzo CS:EIP: Immagine dello stack: 7ff58610 03c8fa9c 00000744 7ffd2f18 0000001e 7ff5ac19 0000001f 00000001 03c8fac0 817b8aa0 00000000 fff0ec93 0000001f 03c8fac4 7ff5ab64 7ff5a430 ********************************************************************** Data 09/15/2004 Ora 16:38 EXPLORER ha provocato un errore di pagina non valida nel modulo <sconosciuto> in dd6c:03d21cd0. Registri: EAX=0198d4a8 CS=018f EIP=03d21cd0 EFLGS=00210202 EBX=00000001 SS=0197 ESP=0198d488 EBP=0198d4ac ECX=00000000 DS=0197 ESI=00000744 FS=334f EDX=81760ff0 ES=0197 EDI=7ffd2f18 GS=13ce Byte all'indirizzo CS:EIP: Immagine dello stack: 7ff501ac 0198d91c 7ff225d0 0198d4a8 0198d938 7ffd2f18 0000001f 03d21cd0 00000000 0198d4e8 7ff52a0a 0000001f 00000000 0198d91c 7ff225d0 0198d938 ********************************************************************** Data 09/15/2004 Ora 16:39 EXPLORER ha provocato un errore di pagina non valida nel modulo COMCTL32.DLL in 018f:bfbd08c8. Registri: EAX=00dbfdc4 CS=018f EIP=bfbd08c8 EFLGS=00010297 EBX=005aedd4 SS=0197 ESP=005aec78 EBP=005aec80 ECX=00000004 DS=0197 ESI=005aed30 FS=13bf EDX=00000000 ES=0197 EDI=ac3b5bcc GS=0000 Byte all'indirizzo CS:EIP: 89 44 8f f0 8b 44 8e f4 89 44 8f f4 8b 44 8e f8 Immagine dello stack: 829aaf2c 829a0dd8 005aed70 bfb798f1 ac3b5bcc 005aed30 00000010 00000001 00000001 7fbd12d8 829aaf2c 7fffffff 005aed30 00000000 0729f808 00000400 ********************************************************************** Data 09/15/2004 Ora 16:39 EXPLORER ha provocato un errore di pagina non valida nel modulo KERNEL32.DLL in 018f:bff6a4e9. Registri: EAX=829a7e4c CS=018f EIP=bff6a4e9 EFLGS=00210216 EBX=00000018 SS=0197 ESP=005afcd8 EBP=005afcfc ECX=28829a47 DS=0197 ESI=829a0dd9 FS=13bf EDX=82999000 ES=0197 EDI=009fffe8 GS=0000 Byte all'indirizzo CS:EIP: 89 41 08 8b 56 04 8b 46 08 89 50 04 8d 04 1e 50 Immagine dello stack: 009fffe8 00000000 8299900c 82999000 829a0dd9 00000040 00000000 000833a0 000829a1 005afd24 bff6a6b1 82999000 829a0dd9 00000018 00000040 7170923c ********************************************************************** Data 09/15/2004 Ora 16:41 SCANDSKW ha provocato un errore di segmento non presente nel modulo DSKMAINT.DLL in 0004:00001d8c. Registri: EAX=005c8d20 CS=1727 EIP=00001d8c EFLGS=00000206 EBX=170f1000 SS=16b7 ESP=00002590 EBP=0000259a ECX=00001000 DS=1767 ESI=000209e0 FS=16bf EDX=cc66000c ES=1767 EDI=000207a0 GS=0000 Byte all'indirizzo CS:EIP: 9a 52 07 2f 17 0b c0 74 05 80 8c 90 02 10 9a 14 Immagine dello stack: 009c09e0 00000000 25f80000 0a5224c8 8d2015b7 07a0000c 09e015bf 07a015bf 1ca0009c 2beb0770 333e07a0 07a01ca0 260215bf 15af4282 07a01ca0 1029009c ********************************************************************** Data 09/15/2004 Ora 17:01 SCANDSKW ha provocato un errore di segmento non presente nel modulo DSKMAINT.DLL in 0004:00001d9f. Registri: EAX=005c0000 CS=173f EIP=00001d9f EFLGS=00000246 EBX=17270010 SS=16df ESP=00002590 EBP=0000259a ECX=00001000 DS=177f ESI=000209e0 FS=16e7 EDX=cc66000c ES=003b EDI=000207a0 GS=0000 Byte all'indirizzo CS:EIP: 9a 96 3a 5f 17 9a 10 82 4f 17 9a 68 42 57 17 eb Immagine dello stack: 009c09e0 00000000 25f80000 0a5224c8 8d2015bf 07a0000c 09e015c7 07a015c7 1ca0009c 2beb0770 333e07a0 07a01ca0 260215c7 15b74282 07a01ca0 1101009c ********************************************************************** Data 09/15/2004 Ora 17:04 SCANDSKW ha provocato un errore di segmento non presente nel modulo DSKMAINT.DLL in 0004:00001d9f. Registri: EAX=005c0000 CS=1707 EIP=00001d9f EFLGS=00000246 EBX=16ef0010 SS=16b7 ESP=00002590 EBP=0000259a ECX=00001000 DS=1747 ESI=000209e0 FS=16bf EDX=cc66000c ES=003b EDI=000207a0 GS=0000 Byte all'indirizzo CS:EIP: 9a 96 3a 27 17 9a 10 82 17 17 9a 68 42 1f 17 eb Immagine dello stack: 009809e0 00000000 25f80000 0a5224c8 8d2015b7 07a0000c 09e015bf 07a015bf 1ca00098 2beb0770 333e07a0 07a01ca0 260215bf 15af4282 07a01ca0 11040098 ********************************************************************** Data 09/15/2004 Ora 17:08 MSIMN ha provocato un errore di pagina non valida nel modulo MSHTMLED.DLL in 018f:70f72931. Registri: EAX=05030144 CS=018f EIP=70f72931 EFLGS=00010206 EBX=0344b850 SS=0197 ESP=00565648 EBP=00565658 ECX=00000000 DS=0197 ESI=00000000 FS=68ff EDX=00565720 ES=0197 EDI=00565720 GS=0000 Byte all'indirizzo CS:EIP: f6 46 04 02 74 75 8d 45 08 50 ff 75 0c e8 f0 fc Immagine dello stack: 0342d910 00000000 05030144 00000000 005656b4 70f398ff 0344b850 004e7bc0 00565720 70f424bd 05030144 0344b850 004e7bc0 00565720 00000000 637dc535 ********************************************************************** Data 09/15/2004 Ora 17:08 MSIMN ha provocato un errore di protezione generale nel modulo <sconosciuto> in cc7b:0000000c. Registri: EAX=005656b4 CS=018f EIP=0000000c EFLGS=00210206 EBX=00000000 SS=0197 ESP=00000000 EBP=03424e11 ECX=0056582f DS=0197 ESI=03424def FS=68ff EDX=00404021 ES=0197 EDI=0343e90f GS=0000 Byte all'indirizzo CS:EIP: 58 50 4c 4f 52 45 52 2e 45 58 45 00 77 a5 00 f0 Immagine dello stack: 575c3a43 4f444e49 455c5357 4f4c5058 2e524552 00455845 f000a577 f000ff53 cc000000 061f0842 f000ff33 f000ff33 f000ff33 f000ff33 f000ef57 f000f67b ********************************************************************** Data 09/17/2004 Ora 19:37 SCANDSKW ha provocato un errore di segmento non presente nel modulo DSKMAINT.DLL in 0004:00001d8c. Registri: EAX=005c8d20 CS=1727 EIP=00001d8c EFLGS=00000206 EBX=170f1000 SS=16b7 ESP=00002590 EBP=0000259a ECX=00001000 DS=1767 ESI=000209e0 FS=16bf EDX=cc62000c ES=1767 EDI=000207a0 GS=0000 Byte all'indirizzo CS:EIP: 9a 52 07 2f 17 0b c0 74 05 80 8c 90 02 10 9a 14 Immagine dello stack: 009c09e0 00000000 25f80000 0a5224c8 8d2015b7 07a0000c 09e015bf 07a015bf 1ca0009c 2beb0770 333e07a0 07a01ca0 260215bf 15af4282 07a01ca0 1325009c ********************************************************************** Data 09/19/2004 Ora 10:55 SPOOL32 ha provocato un errore di pagina non valida nel modulo SPOOL32.EXE in 018f:00402075. Registri: EAX=00000004 CS=018f EIP=00402075 EFLGS=00010283 EBX=00000000 SS=0197 ESP=00d7ff84 EBP=00000000 ECX=cc76fe00 DS=0197 ESI=bff6ca1e FS=3d7f EDX=bffbb490 ES=0197 EDI=bff8306c GS=0000 Byte all'indirizzo CS:EIP: ff 33 55 e8 73 f0 ff ff 89 03 e8 e4 0c 00 00 89 Immagine dello stack: 00000000 00000004 00d7ffcc 817c4530 00000008 817c25a0 bff79391 00000000 817c4530 00000008 817c25a0 00000007 00d7ffa4 00d7fdb4 ffffffff bffb1b20 ********************************************************************** Data 09/19/2004 Ora 11:09 EXPLORER ha provocato un errore di pagina non valida nel modulo SHLWAPI.DLL in 018f:70aa8c9e. Registri: EAX=8289fc4c CS=018f EIP=70aa8c9e EFLGS=00010202 EBX=70aa8c8c SS=0197 ESP=03e8e574 EBP=03e8e580 ECX=828a1dc8 DS=0197 ESI=08800a70 FS=45f7 EDX=00000005 ES=0197 EDI=80004005 GS=0000 Byte all'indirizzo CS:EIP: 8b 06 8d 4d 08 51 68 a0 da a8 70 56 ff 10 85 c0 Immagine dello stack: 00000005 004c4c98 828a1dc8 00000000 7fbd1520 08800a70 00000000 80004005 004c4c94 03e8e5b8 004e7440 70aa8cbc 004c4c98 00000000 03e8ed68 bff4595a ********************************************************************** Data 09/19/2004 Ora 11:09 EXPLORER ha provocato un errore di pagina non valida nel modulo <sconosciuto> in cc7b:01f91cc0. Registri: EAX=817945ec CS=018f EIP=01f91cc0 EFLGS=00010246 EBX=00000000 SS=0197 ESP=03e8fa68 EBP=01f91cc0 ECX=00000001 DS=0197 ESI=7ffd2f18 FS=45f7 EDX=0052a078 ES=0197 EDI=00000708 GS=0000 Byte all'indirizzo CS:EIP: Immagine dello stack: 7ff58610 03e8fa9c 00000708 7ffd2f18 0000001b 7ff5ac19 0000001e 00000001 03e8fac0 8181fc6c 00000000 ff0a9eb3 0000001e 03e8fac4 7ff5ab64 7ff5a430 ********************************************************************** Data 09/19/2004 Ora 11:09 EXPLORER ha provocato un errore di pagina non valida nel modulo <sconosciuto> in cc7b:01f91cd0. Registri: EAX=03e8e550 CS=018f EIP=01f91cd0 EFLGS=00210202 EBX=00000001 SS=0197 ESP=03e8e530 EBP=03e8e554 ECX=00000007 DS=0197 ESI=00000708 FS=618f EDX=817cfb04 ES=0197 EDI=7ffd2f18 GS=309e Byte all'indirizzo CS:EIP: Immagine dello stack: 7ff501ac 03e8e9c4 7ff225d0 03e8e550 03e8e9e0 7ffd2f18 0000001e 01f91cd0 00000000 03e8e590 7ff52a0a 0000001e 00000000 03e8e9c4 7ff225d0 03e8e9e0 ********************************************************************** Data 09/21/2004 Ora 19:22 SCANDSKW ha provocato un errore di segmento non presente nel modulo DSKMAINT.DLL in 0004:00001d8c. Registri: EAX=005c8d20 CS=1677 EIP=00001d8c EFLGS=00000206 EBX=165f1000 SS=162f ESP=00002590 EBP=0000259a ECX=00001000 DS=16b7 ESI=000209e0 FS=1637 EDX=cc66000c ES=16b7 EDI=000207a0 GS=0000 Byte all'indirizzo CS:EIP: 9a 52 07 7f 16 0b c0 74 05 80 8c 90 02 10 9a 14 Immagine dello stack: 009809e0 00000000 25f80000 0a5224c8 8d201537 07a0000c 09e0153f 07a0153f 1ca00098 2beb0770 333e07a0 |
|
|
|
|
23-09-2004, 21:55
|
#3 |
|
Senior Member
Iscritto dal: Apr 2002
Messaggi: 23793
|
per me il tuo antivirus non pulisce bene
prova a usarene uno on line tipo: http://housecall.trendmicro.com/ ciaooo
__________________
....... ___ [Thread Ufficiale] --- VENDO:__COVER + VETRO BQ Aquaris X/X PRO__HW VARIO, ali, mobo, ram, cpu, ventole, etc.__ _CLICCA QUI PER VEDERE LE TRATTATIVE CONCLUSE e LE REGOLE DELLE MIE INSERZIONI__ |
|
|
|
|
24-09-2004, 18:41
|
#4 |
|
Senior Member
Iscritto dal: May 2001
Messaggi: 1740
|
hai usato una versione vecchia di hijackthis
ti consiglio di scaricare la nuova e chiudere più programmi possibili prima di generare un nuovo log
__________________
www.tweakness.net - Trucchi per il PC DECALOGO ANTISPY - GUIDA A HIJACKTHIS - GUIDA AI SERVIZI DI WIN XP - CONSIGLI ANTIVIRUS PER BART'S PE - SP2 SLIPSTREAMING - FAQ WINDOWS XPSP2 - I SERVIZI DOPO SP2 - XP SP2 UNATTENDED - GUIDA A nLite |
|
|
|
|
29-09-2004, 21:44
|
#5 |
|
Member
Iscritto dal: Apr 2004
Città: Bari - Foggia
Messaggi: 114
|
allora... ho scaricato ieri la versione 1.98.1 di hjt e posto qui il nuovo log:
Logfile of HijackThis v1.98.1 Scan saved at 21.35.19, on 29/09/2004 Platform: Windows ME (Win9x 4.90.3000) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\STIMON.EXE C:\PROGRAMMI\FILE COMUNI\SYMANTEC SHARED\SYMTRAY.EXE C:\WINDOWS\SYSTEM\MSTASK.EXE C:\PROGRAMMI\FILE COMUNI\SYMANTEC SHARED\CCSETMGR.EXE C:\PROGRAMMI\FILE COMUNI\SYMANTEC SHARED\CCEVTMGR.EXE C:\PROGRAMMI\FILE COMUNI\SYMANTEC SHARED\CCPROXY.EXE C:\PROGRAMMI\FILE COMUNI\SYMANTEC SHARED\SNDSRVC.EXE C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\TASKMON.EXE C:\PROGRAMMI\THOMSON\SPEEDTOUCH USB\DRAGDIAG.EXE C:\PROGRAMMI\PESTPATROL\COOKIEPATROL.EXE C:\PROGRAMMI\PESTPATROL\PPMEMCHECK.EXE C:\PROGRAMMI\PESTPATROL\PPCONTROL.EXE C:\PROGRAMMI\FILE COMUNI\SYMANTEC SHARED\CCAPP.EXE C:\PROGRAMMI\NORTON SYSTEMWORKS\NORTON CLEANSWEEP\CSINSM32.EXE C:\PROGRAMMI\NORTON SYSTEMWORKS\NORTON CLEANSWEEP\Monwow.exe C:\PROGRAMMI\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE C:\PROGRAMMI\WINZIP\WINZIP32.EXE C:\WINDOWS\TEMP\HIJACKTHIS.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.qinetiq.com/home_etps.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMMI\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL O2 - BHO: - {ADDB1117-BA0B-4D12-AE6C-B3F0D57CC49B} - C:\WINDOWS\SYSTEM\L.DLL O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Programmi\File comuni\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmi\Norton Internet Security Professional\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Programmi\File comuni\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmi\Norton Internet Security Professional\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Programmi\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRAMMI\PESTPATROL\CookiePatrol.exe O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRAMMI\PESTPATROL\PPMemCheck.exe O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRAMMI\PESTPATROL\PPControl.exe O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMON.EXE O4 - HKLM\..\Run: [MSConfigReminder] C:\WINDOWS\SYSTEM\msconfig.exe /reminder O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE O4 - HKLM\..\RunServices: [SymTray - Norton SystemWorks] C:\Programmi\File comuni\Symantec Shared\SymTray.exe "Norton SystemWorks" O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe" O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe" O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Programmi\File comuni\Symantec Shared\Script Blocking\SBServ.exe" -reg O4 - HKLM\..\RunServices: [ccProxy] C:\PROGRA~1\FILECO~1\SYMANT~1\CCPROXY.EXE O4 - HKLM\..\RunServices: [SndSrvc] C:\PROGRA~1\FILECO~1\SYMANT~1\SNDSRVC.EXE O4 - Startup: CleanSweep Smart Sweep-Internet Sweep.lnk = C:\Programmi\Norton SystemWorks\Norton CleanSweep\csinsm32.exe O4 - Startup: Webshots.lnk = C:\Programmi\Webshots\WebshotsTray.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL O12 - Plugin for .3dml: C:\Programmi\Flatland\NProver.dll O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://212.141.212.204/activex/AxisCamControl.ocx O16 - DPF: {7A32634B-029C-4836-A023-528983982A49} (MSN Chat Control 4.2) - http://fdl.msn.com/public/chat/msnchat42.cab O16 - DPF: {00000000-d9e3-4bc6-a0bd-3d0ca4be5271} - O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...64/mcfscan.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://housecall.trendmicro-europe.c...ll/Xscan53.cab O20 - AppInit_DLLs: apitrap.dll; Aspetto consigli, ciao! 
|
|
|
|
|
29-09-2004, 22:17
|
#6 |
|
Senior Member
Iscritto dal: May 2001
Messaggi: 1740
|
__________________
www.tweakness.net - Trucchi per il PC DECALOGO ANTISPY - GUIDA A HIJACKTHIS - GUIDA AI SERVIZI DI WIN XP - CONSIGLI ANTIVIRUS PER BART'S PE - SP2 SLIPSTREAMING - FAQ WINDOWS XPSP2 - I SERVIZI DOPO SP2 - XP SP2 UNATTENDED - GUIDA A nLite |
|
|
|
|
29-09-2004, 23:13
|
#7 |
|
Member
Iscritto dal: Apr 2004
Città: Bari - Foggia
Messaggi: 114
|
grrr....
 ok,ecco il log con il .2 ... ora mi dai qualche dritta?  Logfile of HijackThis v1.98.2 Scan saved at 23.01.45, on 29/09/2004 Platform: Windows ME (Win9x 4.90.3000) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\STIMON.EXE C:\PROGRAMMI\FILE COMUNI\SYMANTEC SHARED\SYMTRAY.EXE C:\WINDOWS\SYSTEM\MSTASK.EXE C:\PROGRAMMI\FILE COMUNI\SYMANTEC SHARED\CCSETMGR.EXE C:\PROGRAMMI\FILE COMUNI\SYMANTEC SHARED\CCEVTMGR.EXE C:\PROGRAMMI\FILE COMUNI\SYMANTEC SHARED\CCPROXY.EXE C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\TASKMON.EXE C:\PROGRAMMI\THOMSON\SPEEDTOUCH USB\DRAGDIAG.EXE C:\PROGRAMMI\PESTPATROL\COOKIEPATROL.EXE C:\PROGRAMMI\PESTPATROL\PPMEMCHECK.EXE C:\PROGRAMMI\PESTPATROL\PPCONTROL.EXE C:\PROGRAMMI\FILE COMUNI\SYMANTEC SHARED\CCAPP.EXE C:\PROGRAMMI\NORTON SYSTEMWORKS\NORTON CLEANSWEEP\CSINSM32.EXE C:\PROGRAMMI\NORTON SYSTEMWORKS\NORTON CLEANSWEEP\Monwow.exe C:\PROGRAMMI\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE C:\WINDOWS\SYSTEM\SPOOL32.EXE C:\WINDOWS\SYSTEM\RNAAPP.EXE C:\WINDOWS\SYSTEM\TAPISRV.EXE C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE C:\WINDOWS\SYSTEM\DDHELP.EXE C:\PROGRAMMI\ICQ\ICQ.EXE C:\PROGRAMMI\INTERNET EXPLORER\IEXPLORE.EXE C:\PROGRAMMI\WINZIP\WINZIP32.EXE C:\WINDOWS\TEMP\HIJACKTHIS.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.qinetiq.com/home_etps.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMMI\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL O2 - BHO: - {ADDB1117-BA0B-4D12-AE6C-B3F0D57CC49B} - C:\WINDOWS\SYSTEM\L.DLL O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Programmi\File comuni\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmi\Norton Internet Security Professional\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Programmi\File comuni\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmi\Norton Internet Security Professional\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Programmi\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRAMMI\PESTPATROL\CookiePatrol.exe O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRAMMI\PESTPATROL\PPMemCheck.exe O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRAMMI\PESTPATROL\PPControl.exe O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMON.EXE O4 - HKLM\..\Run: [MSConfigReminder] C:\WINDOWS\SYSTEM\msconfig.exe /reminder O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE O4 - HKLM\..\RunServices: [SymTray - Norton SystemWorks] C:\Programmi\File comuni\Symantec Shared\SymTray.exe "Norton SystemWorks" O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe" O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe" O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Programmi\File comuni\Symantec Shared\Script Blocking\SBServ.exe" -reg O4 - HKLM\..\RunServices: [ccProxy] C:\PROGRA~1\FILECO~1\SYMANT~1\CCPROXY.EXE O4 - HKLM\..\RunServices: [SndSrvc] C:\PROGRA~1\FILECO~1\SYMANT~1\SNDSRVC.EXE O4 - Startup: CleanSweep Smart Sweep-Internet Sweep.lnk = C:\Programmi\Norton SystemWorks\Norton CleanSweep\csinsm32.exe O4 - Startup: Webshots.lnk = C:\Programmi\Webshots\WebshotsTray.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL O12 - Plugin for .3dml: C:\Programmi\Flatland\NProver.dll O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://212.141.212.204/activex/AxisCamControl.ocx O16 - DPF: {7A32634B-029C-4836-A023-528983982A49} (MSN Chat Control 4.2) - http://fdl.msn.com/public/chat/msnchat42.cab O16 - DPF: {00000000-d9e3-4bc6-a0bd-3d0ca4be5271} - O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...64/mcfscan.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://housecall.trendmicro-europe.c...ll/Xscan53.cab O20 - AppInit_DLLs: apitrap.dll; |
|
|
|
|
30-09-2004, 02:35
|
#8 |
|
Senior Member
Iscritto dal: May 2001
Messaggi: 1740
|
allora
queste restrizioni le hai messe tu? O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present se no fixa queste righe poi fixa R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.qinetiq.com/home_etps.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer O2 - BHO: - {ADDB1117-BA0B-4D12-AE6C-B3F0D57CC49B} - C:\WINDOWS\SYSTEM\L.DLL O16 - DPF: {00000000-d9e3-4bc6-a0bd-3d0ca4be5271} - e O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://212.141.212.204/activex/AxisCamControl.ocx se non la riconosci
__________________
www.tweakness.net - Trucchi per il PC DECALOGO ANTISPY - GUIDA A HIJACKTHIS - GUIDA AI SERVIZI DI WIN XP - CONSIGLI ANTIVIRUS PER BART'S PE - SP2 SLIPSTREAMING - FAQ WINDOWS XPSP2 - I SERVIZI DOPO SP2 - XP SP2 UNATTENDED - GUIDA A nLite |
|
|
|
|
|
| Strumenti | |
|
|
Tutti gli orari sono GMT +1. Ora sono le: 04:18.
