|
|||||||
|
|
|
 |
|
|
Strumenti |
08-08-2005, 22:27
|
#1 |
|
Senior Member
Iscritto dal: Mar 2004
Messaggi: 581
|
Controllatina HijackThis log
Ciao ragazzi gentilmente potete controllare se ho qlc di strano:
Logfile of HijackThis v1.99.1 Scan saved at 23.25.07, on 08/08/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Programmi\Software Bluetooth\bin\btwdins.exe C:\PROGRA~1\CACHEM~1\CachemanXP.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\Programmi\IPM\Adsl\DataWay\dslstat.exe C:\WINDOWS\system32\dslagent.exe C:\WINDOWS\system32\CTHELPER.EXE C:\PROGRA~1\FILECO~1\PCSuite\DATALA~1\DATALA~1.EXE C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE C:\Programmi\Logitech\MouseWare\system\em_exec.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe C:\Programmi\HP\HP Software Update\HPWuSchd2.exe C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Programmi\HP\hpcoretech\hpcmpmgr.exe C:\WINDOWS\system32\hphmon06.exe C:\WINDOWS\system32\carpserv.exe C:\Programmi\CyberLink\PowerDVD\PDVDServ.exe C:\PROGRA~1\Agnitum\OUTPOS~1\outpost.exe C:\WINDOWS\system32\svchost.exe C:\Programmi\Software Bluetooth\BTTray.exe C:\PROGRA~1\FILECO~1\PCSuite\Services\SERVIC~1.EXE C:\Programmi\Microtek\ScanWizard 5\ScannerFinder.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\Programmi\Raxco\PerfectDisk\PDSched.exe C:\Programmi\SpeedFan\speedfan.exe G:\eMule\emule.exe C:\Programmi\MSN Messenger\msnmsgr.exe C:\Programmi\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe C:\WINDOWS\system32\rsvp.exe C:\WINDOWS\system32\HPZipm12.exe C:\Programmi\Acronis\TrueImage\TrueImageMonitor.exe C:\Programmi\File comuni\Acronis\Schedule2\schedul2.exe C:\Programmi\Mozilla Firefox\firefox.exe G:\File Scaricati Internet\Programmi\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O4 - HKLM\..\Run: [DSLSTATEXE] C:\Programmi\IPM\Adsl\DataWay\dslstat.exe icon O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Programmi\File comuni\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\FILECO~1\PCSuite\DATALA~1\DATALA~1.EXE O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe O4 - HKLM\..\Run: [HPHUPD06] C:\Programmi\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe O4 - HKLM\..\Run: [HP Software Update] "C:\Programmi\HP\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [HP Component Manager] "C:\Programmi\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe O4 - HKLM\..\Run: [CARPService] carpserv.exe O4 - HKLM\..\Run: [Outpost Firewall] C:\Programmi\Agnitum\Outpost Firewall\outpost.exe /waitservice O4 - HKLM\..\Run: [RemoteControl] C:\Programmi\CyberLink\PowerDVD\PDVDServ.exe O4 - HKLM\..\Run: [KAV50] "C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro 5\kav.exe" -run -n PersonalPro -v 5.0.0.0 -chkss O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background O4 - Startup: SpeedFan.lnk = C:\Programmi\SpeedFan\speedfan.exe O4 - Startup: Y'z Toolbar.lnk = ? O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: BTTray.lnk = ? O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programmi\HP\digital imaging\bin\hpqtra08.exe O4 - Global Startup: Microtek Scanner Finder.lnk = C:\Programmi\Microtek\ScanWizard 5\ScannerFinder.exe O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Invia a &Bluetooth - C:\Programmi\Software Bluetooth\btsendto_ie_ctx.htm O8 - Extra context menu item: Save Flash - res://C:\Programmi\UnH Solutions\Flash Saving Plugin\FlashSButton.dll/210 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\j2re1.4.2_04\bin\npjpi142_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\j2re1.4.2_04\bin\npjpi142_04.dll O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\Software Bluetooth\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\Software Bluetooth\btsendto_ie.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O9 - Extra button: Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\PROGRA~1\Agnitum\OUTPOS~1\TRASH.EXE (HKCU) O9 - Extra 'Tools' menuitem: Show Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\PROGRA~1\Agnitum\OUTPOS~1\TRASH.EXE (HKCU) O9 - Extra button: Flash - {43CF38F3-5AEC-45a3-AD31-04EB06E9C6CA} - C:\Programmi\UnH Solutions\Flash Saving Plugin\FlashSButton.dll (HKCU) O17 - HKLM\System\CCS\Services\Tcpip\..\{621E9303-AF2D-48A1-8D1D-7B7971975BD0}: NameServer = 85.37.17.11 151.99.125.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{621E9303-AF2D-48A1-8D1D-7B7971975BD0}: NameServer = 85.37.17.11 151.99.125.1 O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Programmi\File comuni\Acronis\Schedule2\schedul2.exe O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Programmi\Software Bluetooth\bin\btwdins.exe O23 - Service: CachemanXP (CachemanXPService) - OuterTechnologies - C:\PROGRA~1\CACHEM~1\CachemanXP.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: kavsvc - Kaspersky Lab - C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum - C:\PROGRA~1\Agnitum\OUTPOS~1\outpost.exe O23 - Service: PDEngine - Raxco Software, Inc. - C:\Programmi\Raxco\PerfectDisk\PDEngine.exe O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Programmi\Raxco\PerfectDisk\PDSched.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Apache Tomcat (Tomcat5) - Unknown owner - C:\Programmi\Apache Software Foundation\Tomcat 5.5\bin\tomcat5.exe" //RS//Tomcat5 (file missing) Grazie mille 
|
|
|
|
08-08-2005, 22:39
|
#2 |
|
Senior Member
Iscritto dal: Jun 2005
Città: in lombardia
Messaggi: 8414
|
da una rapida occhiata tutto ok.
Come mai pensi di essere "infetto"?Se usi il kaspersky con aggiornamenti estesi sei molto meno esposto. |
|
|
|
|
08-08-2005, 22:55
|
#3 |
|
Senior Member
Iscritto dal: Mar 2004
Messaggi: 581
|
ogni tanto mi cadeva la connessione, allora pensavo a qualche intruso e il mio primo pensiero è stato postare qui. probabilmente solo problemi di linea
 .grazie per l'info ciao ciao 
|
|
|
|
|
08-08-2005, 23:09
|
#4 |
|
Bannato
Iscritto dal: Mar 2004
Città: Galapagos Attenzione:utente flautolente,tienilo a mente
Messaggi: 28978
|
O4 - HKLM\..\Run: [CARPService] carpserv.exe
C:\WINDOWS\system32\carpserv.exe questi mi è sconosciuto O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE se NON hai una scheda audio creative cancella questa voce e il file incriminato O23 - Service: Apache Tomcat (Tomcat5) - Unknown owner - C:\Programmi\Apache Software Foundation\Tomcat 5.5\bin\tomcat5.exe" //RS//Tomcat5 (file missing) file cancellato,cancella anche questa voce
|
|
|
|
|
08-08-2005, 23:17
|
#5 | |
|
Senior Member
Iscritto dal: Jun 2005
Città: in lombardia
Messaggi: 8414
|
Quote:
|
|
|
|
|
|
09-08-2005, 08:48
|
#6 |
|
Senior Member
Iscritto dal: Mar 2004
Messaggi: 581
|
la prima voce è il modem 56k interno, la 2 fa parte della scheda audio e la 3 l'ho cancellata, grazie mille
|
|
|
|
|
|
| Strumenti | |
|
|
Tutti gli orari sono GMT +1. Ora sono le: 15:48.
