|
|||||||
|
|
|
 |
|
|
Strumenti |
21-02-2005, 15:22
|
#1 |
|
Member
Iscritto dal: Jun 2004
Messaggi: 207
|
scansione con hijackthis, cosa non va?
Ciao ho fatto la scansione con hijackthis, a causa di alcuni problemi, ma non so cosa non va...
non è che potete darci un'occhiata? grazie a tutti  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\FABIOC~1\IMPOST~1\Temp\sp.dll/sp.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\FABIOC~1\IMPOST~1\Temp\sp.dll/sp.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Programmi\MyWay\myBar\1.bin\MYBAR.DLL O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: (no name) - {69EA6CDC-0834-419D-B162-2C1362616560} - C:\WINDOWS\System32\jaca.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar1.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar1.dll O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Programmi\MyWay\myBar\1.bin\MYBAR.DLL O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART O4 - HKLM\..\Run: [AltnetPointsManager] C:\Program Files\Altnet\Points Manager\Points Manager.exe -s O4 - HKLM\..\Run: [NPS Event Checker] C:\PROGRA~1\Navnt\npscheck.exe O4 - HKLM\..\Run: [DSB] C:\Programmi\DSB\dsb.exe O4 - HKLM\..\Run: [CnxTrApp] rundll32.exe "C:\Programmi\StarModem\StarModem USB Network\CnxTrApp.dll",AppEntry -REG "Conexant\Conexant USB Network" O4 - HKLM\..\Run: [CreateCD] C:\PROGRA~1\Adaptec\EASYCD~2\CreateCD\CreateCD.exe -r O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\MSN Messenger\MsnMsgr.Exe" /background O4 - Startup: C6 Client.LNK = C:\TinMessenger\TinMessenger.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programmi\WinZip\WZQKPICK.EXE O4 - Global Startup: Autoprotezione Norton AntiVirus.lnk = C:\Programmi\Navnt\navapw32.exe O8 - Extra context menu item: &Google Search - res://C:\Programmi\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: Collegamenti a ritroso - res://C:\Programmi\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Pagine simili - res://C:\Programmi\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Versione cache della pagina - res://C:\Programmi\Google\GoogleToolbar1.dll/cmcache.html O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\MSMSGS.EXE O12 - Plugin for .pdf: C:\Programmi\Internet Explorer\PLUGINS\nppdf32.dll O16 - DPF: {11311111-1111-1111-1111-111111111157} - file://C:\Recycled\Q330995.exe O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) - O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-17.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/ms...downloader.cab O18 - Filter: text/html - {1F14B579-749B-4EC6-8314-C1CC97344032} - C:\WINDOWS\System32\jaca.dll O18 - Filter: text/plain - {1F14B579-749B-4EC6-8314-C1CC97344032} - C:\WINDOWS\System32\jaca.dll O23 - Service: Avviso NAV (NAV Alert) - Symantec Corporation - C:\PROGRA~1\Navnt\alertsvc.exe O23 - Service: Autoprotezione NAV (NAV Auto-Protect) - Symantec Corporation - C:\PROGRA~1\Navnt\navapsvc.exe O23 - Service: Norton Program Scheduler - Symantec Corporation - C:\PROGRA~1\Navnt\npssvc.exe |
|
|
|
21-02-2005, 16:04
|
#2 |
|
Member
Iscritto dal: Jun 2004
Messaggi: 207
|
ma nessuno sa dirmi niente?
 help
|
|
|
|
|
21-02-2005, 16:30
|
#3 |
|
Senior Member
Iscritto dal: Oct 2004
Città: Milano
Messaggi: 2641
|
Prova ad incollare il log qui
http://www.ilsoftware.it/hijackthis.asp e fallo analizzare, tanto per farti un idea su cosa potrebbe esserci che non va. In ogni caso, prima di eliminare a caso qualcosa, aspetta che passi di qui qualcuno più esperto. Ciao
__________________
FOXYLADY è un MASCHIO!! Un amico è una persona che sa tutto di te e nonostante questo gli piaci |
|
|
|
|
21-02-2005, 16:59
|
#4 |
|
Senior Member
Iscritto dal: Dec 2004
Città: Magenta(MI)
Messaggi: 1513
|
Direi che c'è qualche trojan ...... hai provato a far girare un antitrojan e antivirus serio?
Mi è sucecsso una cosa incredibile. Ho incollato la stringa "{11311111-1111-1111-1111-111111111157}" in google e McAfee ha segnalato il virus Exploit-MhtRedir.Gen. Non mi era mai capitato una cosa similare con una ricerca Google. |
|
|
|
|
21-02-2005, 17:38
|
#5 | |
|
Bannato
Iscritto dal: Mar 2004
Città: Galapagos Attenzione:utente flautolente,tienilo a mente
Messaggi: 29033
|
Re: scansione con hijackthis, cosa non va?
Quote:
cmq ottimizzati un po il sistema,almeno che tu non abbia particolari esigenze,puoi disattivare l'autorun di winzip,c6 e msn messenger e sopratutto la google toolbar e COMPLETAMENTE INUTILE  
|
|
|
|
|
|
21-02-2005, 18:32
|
#6 |
|
Senior Member
Iscritto dal: May 2002
Città: Milano
Messaggi: 5152
|
be allora a questo punto ci copio anche il mio:
Logfile of HijackThis v1.97.7 Scan saved at 18.28.28, on 21/02/2005 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe C:\Programmi\File comuni\Symantec Shared\SNDSrvc.exe C:\Programmi\File comuni\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\Ati2evxx.exe C:\Norton AntiVirus05\navapsvc.exe C:\Norton AntiVirus05\IWP\NPFMntor.exe C:\ProShowGold\ScsiAccess.exe C:\WINDOWS\System32\svchost.exe C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\Explorer.EXE C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\RedLine\Taskbar.exe C:\WINDOWS\sm56hlpr.exe C:\WINDOWS\System32\RunDll32.exe C:\Programmi\ATI Technologies\HydraVision\HydraDM.exe C:\Programmi\Java\j2re1.4.2_04\bin\jusched.exe C:\Programmi\ahead\InCD\InCD.exe C:\Programmi\File comuni\Symantec Shared\ccApp.exe C:\ATI Multimedia\RemCtrl\ATIX10.exe C:\program files\redline\gameutil.exe C:\WINDOWS\System32\rundll32.exe C:\Programmi\Internet Explorer\iexplore.exe C:\Microsoft Office\Office10\WINWORD.EXE C:\Programmi\File comuni\Symantec Shared\NMain.exe C:\Programmi\Internet Explorer\IEXPLORE.EXE E:\Anti Virus\Anti Dialer\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://wer-mit-wem.webhop.net/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti R3 - Default URLSearchHook is missing O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\SPYBOT~1\SDHelper.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Norton AntiVirus05\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Norton AntiVirus05\NavShExt.dll O4 - HKLM\..\Run: [AtiPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [RedLine Taskbar] C:\Program Files\RedLine\Taskbar.exe O4 - HKLM\..\Run: [HGTXPEI] C:\WINDOWS\System32\FirstReboot.exe O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe O4 - HKLM\..\Run: [SoundFusion] RunDll32 hercplgs.cpl,BootEntryPoint O4 - HKLM\..\Run: [HydraVisionDesktopManager] C:\Programmi\ATI Technologies\HydraVision\HydraDM.exe O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Programmi\File comuni\Symantec Shared\Security Center\UsrPrmpt.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\j2re1.4.2_04\bin\jusched.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [InCD] C:\Programmi\ahead\InCD\InCD.exe O4 - HKLM\..\Run: [ElbyCheckElbyCDFL] e:\CloneCD\ElbyCheck.exe /L ElbyCDFL O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe O4 - HKCU\..\Run: [ATI Remote Control] C:\ATI Multimedia\RemCtrl\ATIX10.exe O4 - Global Startup: Autoprotezione di Norton AntiVirus.lnk = C:\RECYCLER\NPROTECT\00000998.EXE O4 - Global Startup: Autoprotezione Norton AntiVirus.lnk = C:\Norton SystemWorks\Norton Antivirus NT\navapw32.exe O4 - Global Startup: gameutil.exe.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\MICROS~1\Office10\EXCEL.EXE/3000 O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM) O9 - Extra button: ATI TV (HKLM) O16 - DPF: {A8658086-E6AC-4957-BC8E-8D54A7E8A790} (GDIChk Object) - http://www.microsoft.com/security/co...I/0/GDIChk.CAB O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{FD2D25E9-EAB2-44CC-9FB3-DC5C6B5E06FC}: NameServer = 213.205.32.70 213.205.36.70 inserendo il log nl sito hijackthis, mi dice che non ho un ativirus instalato, ma se ho norton 2005 ad. aware e spybot... che faccio ? cancello qualcosa ? grazie |
|
|
|
|
|
| Strumenti | |
|
|
Tutti gli orari sono GMT +1. Ora sono le: 10:35.
