Ciao,
per la prima volta sono io a chiedere consulenza <img src=icon_smile_tongue.gif border=0 align=middle>
ecco qua il log di una mia amica che si lamenta che continua a disconnettersi l'ADSL

Logfile of HijackThis v1.98.2
Scan saved at 16.33.59, on 11/10/2004
Platform: Windows 2000 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\Programmi\Sygate\SPF\smc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.exe
C:\Programmi\Alcatel One Touch 535-735\DesktopTool\DesktopTool.exe
<b><font color=red>C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE</font id=red></b>
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Programmi\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Programmi\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exe
C:\Programmi\ACDSee32\ACDSee32.exe
C:\Programmi\ACDSee32\ACDSee32.exe
C:\Programmi\ACDSee32\ACDSee32.exe
C:\Programmi\ACDSee32\ACDSee32.exe
E:\visualizza-prog-e-process-avvio-automatico-HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://gw.aliceadsl.it/minisearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://gw.aliceadsl.it/home
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fornito da Alice
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Desktop Tool] "C:\Programmi\Alcatel One Touch 535-735\DesktopTool\DesktopTool.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\winnt\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PE2CKFNT SE] C:\Programmi\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe
<b><font color=red>O4 - HKLM\..\Run: [InstantAccess] C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE /h</b></font id=red>
<b><font color=red>O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE</b></font id=red>
<b>O4 - HKLM\..\Run: [Windows Media Player Update] Packard.exe</b>
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
<b><font color=red>O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE</font id=red></b>
<b>O4 - HKLM\..\RunServices: [Windows Media Player Update] Packard.exe</b>
<b>O4 - HKCU\..\Run: [Windows Media Player Update] Packard.exe</b>
<b>O4 - HKCU\..\RunServices: [Windows Media Player Update] Packard.exe</b>
O4 - Startup: Photo Express Calendar Checker SE.lnk = C:\Programmi\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: DSLMON.lnk = C:\Programmi\SAGEM\SAGEM F@st 800-840\dslmon.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: Alice - {448F8392-3368-4504-BD91-AF00EDFDEEEE} - http://gw.aliceadsl.it/alice (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://gw.aliceadsl.it/home


*****************************************************************************
ECCO LA MIA ANALISI
*****************************************************************************
Le righe nere in grassetto sono un trojan "W32/rbot-et"
http://www.sophos.com/virusinfo/analyses/w32rbotet.html

mentre quelle evidenziate in rosso sono uno spyware

Se trovate qualche altra cosa di anomalo fatemi sapere.
GRAZIE

ciauz <img src=icon_smile_big.gif border=0 align=middle>

Altre righe da eliminare sono queste

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm

dovrebbero essere dello spyware Alexa

strano anche il fatto che ADCSee venga ripetuto tante volte, controlla con l'antivirus in modalità provvisoria, se i file sono stati infettati, si accodano al programma e vanno in esecuzione al lancio del programma.

C:\Programmi\ACDSee32\ACDSee32.exe
C:\Programmi\ACDSee32\ACDSee32.exe
C:\Programmi\ACDSee32\ACDSee32.exe
C:\Programmi\ACDSee32\ACDSee32.exe

---

Collaboratore Aiutamici

XP per me é arabo <img src=icon_smile_big.gif border=0 align=middle>

ne riparliamo quando mi posso ACCATTA' il PC nuovo <img src=icon_smile_tongue.gif border=0 align=middle>

---

Collaboratore Aiutamici