|
|||||||
|
|
|
 |
|
|
Strumenti |
21-02-2005, 18:25
|
#1 |
|
Member
Iscritto dal: Apr 2004
Messaggi: 252
|
istsvc.exe
Oggi sono andato da una mia amica per un problema di spyware sul suo pc. In pratica dopo 10 minuti (o poco +) ke è in internet gli appare la finestra ke un processo Generic Host Win32 è andato in crash (con conseguente possibilità di inviare l'errore a microsoft) ..dopodichè pochi minuti dopo l'apparizione di questa finestra la connessione e tutto il pc s'impallano tanto da dover riavviare il tutto.
Ho fatto una scansione con adware e mi ha trovato questo malware istsvc con le relative kiavi di registro, ovviamente in esecuzione e quindi ineliminabile anke se termino fisicamente tale processo dal taskmanager mi dice ke il file nn puo' essere cancellato poichè in esecuzione. Allora disattivo il ripristino di sistema, vado in modalità provvisoria e da lì riesco a cancellarlo (faccio due passate per sicurezza sia di adware ke di spybot e il problema sembra risolto) Riavvio normalmente il pc e faccio una nuova scansione con adware e tutto è regolare... appena accedo a internet xo' il file si ricrea e torna in esecuzione rendendo inutile tutto quello ke ho fatto. Ki mi sa dare una mano?? qcuno ha avuto un problema simile?? grazie per eventuali risposte |
|
|
|
21-02-2005, 20:41
|
#2 |
|
Senior Member
Iscritto dal: Dec 2004
Città: Magenta(MI)
Messaggi: 1513
|
posta il log di hijackthis che si da un'occhiata ...
|
|
|
|
|
22-02-2005, 17:15
|
#3 |
|
Member
Iscritto dal: Apr 2004
Messaggi: 252
|
Questo è il log del pc col problema
Logfile of HijackThis v1.99.1 Scan saved at 17.09.59, on 22/02/2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\System32\Ati2evxx.exe C:\Programmi\Norton AntiVirus\navapsvc.exe C:\Programmi\Norton AntiVirus\SAVScan.exe C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Programmi\File comuni\Symantec Shared\ccApp.exe C:\WINDOWS\System32\rundll32.exe C:\Programmi\File comuni\Symantec Shared\Security Center\UsrPrmpt.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE C:\WINDOWS\System32\explorer.exe C:\WINDOWS\pgtxmhp.exe C:\top.exe C:\WINDOWS\System32\dnsrslve.exe C:\Documents and Settings\User\winworks.exe C:\WINDOWS\System32\vrsprtc.exe C:\WINDOWS\System32\ctfmon.exe C:\WINDOWS\System32\cap3d1ag.exe C:\Programmi\Messenger\msmsgs.exe C:\Programmi\WinRAR\WinRAR.exe C:\DOCUME~1\User\IMPOST~1\Temp\Rar$EX00.482\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.virgilio.it/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://trento.freeinternet.it R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti R3 - URLSearchHook: (no name) - _{CA0E28FA-1AFD-4C21-A8DC-70EB5BE2F076} - (no file) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmi\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Programmi\File comuni\Symantec Shared\Security Center\UsrPrmpt.exe O4 - HKLM\..\Run: [EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE /P30 "EPSON Stylus Photo R300 Series" /O6 "USB002" /M "Stylus Photo R300" O4 - HKLM\..\Run: [Internet Content Publisher] icp.exe O4 - HKLM\..\Run: [Microsoft Update] explorer.exe O4 - HKLM\..\Run: [OZu1nGao] C:\WINDOWS\pgtxmhp.exe O4 - HKLM\..\Run: [¢‰¸u0–4C }ïÁzî [8C:\Programmi\ISTsvc\istsvc.exe] C:\WINDOWS\pgtxmhp.exe O4 - HKLM\..\Run: [¢‰¸u0–4C }ïÁzîžigÝC:\Programmi\ISTsvc\istsvc.exe] C:\WINDOWS\pgtxmhp.exe O4 - HKLM\..\Run: [¢‰¸u0Ô@ÔÁß]_ú"ü‰üžiC:\Programmi\ISTsvc\istsvc.exe] C:\WINDOWS\pgtxmhp.exe O4 - HKLM\..\Run: [¢‰¸u0Ô@ÔÁß]_ú"ü‰¸u0C:\Programmi\ISTsvc\istsvc.exe] C:\WINDOWS\pgtxmhp.exe O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe O4 - HKLM\..\Run: [MS Updating Utility] msupdater.exe O4 - HKLM\..\Run: [REGRUN_5] C:\top.exe O4 - HKLM\..\Run: [¢‰¸u0ÔÁß]_ú"ü‰üžigÝC:\Programmi\ISTsvc\istsvc.exe] C:\WINDOWS\pgtxmhp.exe O4 - HKLM\..\Run: [hjohkj] c:\windows\system32\hjohkj.exe O4 - HKLM\..\Run: [farmmext] C:\WINDOWS\farmmext.exe O4 - HKLM\..\Run: [Dns Resolver] dnsrslve.exe O4 - HKLM\..\Run: [AutoLoader4xp61LJLUaKN] "C:\WINDOWS\System32\spmhept.exe" /HideDir /HideUninstall /PC="CP.AMS" /ShowLegalNote="nonbranded" O4 - HKLM\..\Run: [426g39U] spmhept.exe O4 - HKLM\..\Run: [Windows Service Pack Auto Update] C:\Documents and Settings\User\winworks.exe O4 - HKLM\..\Run: [Virus Protect] vrsprtc.exe O4 - HKLM\..\RunServices: [Microsoft Update] explorer.exe O4 - HKLM\..\RunServices: [MS Updating Utility] msupdater.exe O4 - HKLM\..\RunServices: [Dns Resolver] dnsrslve.exe O4 - HKLM\..\RunServices: [Virus Protect] vrsprtc.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Microsoft Update] explorer.exe O4 - HKCU\..\Run: [MS Updating Utility] msupdater.exe O4 - HKCU\..\Run: [L1pmRVYFP] cap3d1ag.exe O4 - HKCU\..\Run: [Dns Resolver] dnsrslve.exe O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\MSMSGS.EXE O14 - IERESET.INF: START_PAGE_URL=http://trento.freeinternet.it O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti...l_v1-0-3-9.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab O18 - Filter: text/html - {4CF279DD-3D71-4A8E-9B74-B93C9E758E43} - C:\Documents and Settings\User\Impostazioni locali\Dati applicazioni\microsoft\internet explorer\V0.26.dat O20 - Winlogon Notify: MediaContentIndex - C:\WINDOWS\system32\enj6l11s1.dll O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: zfriisrqxnwb (atmaxnbm5) - Unknown owner - C:\WINDOWS\System32\lauwvswu5.exe (file missing) O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Servizio Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Programmi\Norton AntiVirus\navapsvc.exe O23 - Service: SAVScan - Symantec Corporation - C:\Programmi\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FILECO~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\SNDSrvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\Security Center\SymWSC.exe |
|
|
|
|
22-02-2005, 17:59
|
#4 |
|
Senior Member
Iscritto dal: Dec 2004
Città: Magenta(MI)
Messaggi: 1513
|
Senza responsabilità .... ci sono un po' di cosw da eliminare:
C:\WINDOWS\pgtxmhp.exe C:\top.exe C:\WINDOWS\System32\dnsrslve.exe C:\Documents and Settings\User\winworks.exe C:\WINDOWS\System32\vrsprtc.exe C:\WINDOWS\System32\cap3d1ag.exe R3 - URLSearchHook: (no name) - _{CA0E28FA-1AFD-4C21-A8DC-70EB5BE2F076} - (no file) O4 - HKLM\..\Run: [Internet Content Publisher] icp.exe O4 - HKLM\..\Run: [Microsoft Update] explorer.exe O4 - HKLM\..\Run: [OZu1nGao] C:\WINDOWS\pgtxmhp.exe O4 - HKLM\..\Run: [¢‰¸u0–4C }ïÁzî [8C:\Programmi\ISTsvc\istsvc.exe] C:\WINDOWS\pgtxmhp.exe O4 - HKLM\..\Run: [¢‰¸u0–4C }ïÁzîžigÝC:\Programmi\ISTsvc\istsvc.exe] C:\WINDOWS\pgtxmhp.exe O4 - HKLM\..\Run: [¢‰¸u0Ô@ÔÁß]_ú"ü‰üžiC:\Programmi\ISTsvc\istsvc.exe] C:\WINDOWS\pgtxmhp.exe O4 - HKLM\..\Run: [¢‰¸u0Ô@ÔÁß]_ú"ü‰¸u0C:\Programmi\ISTsvc\istsvc.exe] C:\WINDOWS\pgtxmhp.exe O4 - HKLM\..\Run: [MS Updating Utility] msupdater.exe O4 - HKLM\..\Run: [REGRUN_5] C:\top.exe O4 - HKLM\..\Run: [¢‰¸u0ÔÁß]_ú"ü‰üžigÝC:\Programmi\ISTsvc\istsvc.exe] C:\WINDOWS\pgtxmhp.exe O4 - HKLM\..\Run: [hjohkj] c:\windows\system32\hjohkj.exe O4 - HKLM\..\Run: [farmmext] C:\WINDOWS\farmmext.exe O4 - HKLM\..\Run: [Dns Resolver] dnsrslve.exe O4 - HKLM\..\Run: [AutoLoader4xp61LJLUaKN] "C:\WINDOWS\System32\spmhept.exe" /HideDir /HideUninstall /PC="CP.AMS" /ShowLegalNote="nonbranded" O4 - HKLM\..\Run: [426g39U] spmhept.exe O4 - HKLM\..\Run: [Windows Service Pack Auto Update] C:\Documents and Settings\User\winworks.exe O4 - HKLM\..\Run: [Virus Protect] vrsprtc.exe O4 - HKLM\..\RunServices: [Microsoft Update] explorer.exe O4 - HKLM\..\RunServices: [MS Updating Utility] msupdater.exe O4 - HKLM\..\RunServices: [Dns Resolver] dnsrslve.exe O4 - HKLM\..\RunServices: [Virus Protect] vrsprtc.exe O4 - HKCU\..\Run: [Microsoft Update] explorer.exe O4 - HKCU\..\Run: [MS Updating Utility] msupdater.exe O4 - HKCU\..\Run: [L1pmRVYFP] cap3d1ag.exe O4 - HKCU\..\Run: [Dns Resolver] dnsrslve.exe O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/...all/xscan53.cab O18 - Filter: text/html - {4CF279DD-3D71-4A8E-9B74-B93C9E758E43} - C:\Documents and Settings\User\Impostazioni locali\Dati applicazioni\microsoft\internet explorer\V0.26.dat O20 - Winlogon Notify: MediaContentIndex - C:\WINDOWS\system32\enj6l11s1.dll O23 - Service: zfriisrqxnwb (atmaxnbm5) - Unknown owner - C:\WINDOWS\System32\lauwvswu5.exe (file missing) ciao |
|
|
|
|
22-02-2005, 19:11
|
#5 |
|
Member
Iscritto dal: Apr 2004
Messaggi: 252
|
grazie per aiuto..ti faro' sapere come è andata
ciao |
|
|
|
|
|
| Strumenti | |
|
|
Tutti gli orari sono GMT +1. Ora sono le: 04:24.
