Benvenuto Ospite Cerca | Topic Attivi | Utenti | | Log In | Registra

log di hijack this Opzioni
Rayo25
Inviato: Monday, December 20, 2004 6:12:10 PM
Rank: Member

Iscritto dal : 10/12/2004
Posts: 0
Ciao,
Potete controllare questo log di hijack relativo al pc di un mio amigo?
Grazie

Logfile of HijackThis v1.97.7
Scan saved at 17:51:29, on 20/12/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Archivos de programa\Panda Software\Panda Titanium Antivirus 2005\PavProt.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\RunDll32.exe
C:\Archivos de programa\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
D:\Archivos de programa\daemon.exe
C:\Archivos de programa\Messenger Plus! 3\MsgPlus.exe
C:\Archivos de programa\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE
C:\WINDOWS\System32\RUNDLL32.EXE
D:\Archivos de programa\eMule\emule.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Archivos de programa\Panda Software\Panda Titanium Antivirus 2005\Firewall\PavFires.exe
C:\Archivos de programa\Panda Software\Panda Titanium Antivirus 2005\PavFnSvr.exe
C:\Archivos de programa\Panda Software\Panda Titanium Antivirus 2005\Pavkre.exe
C:\Archivos de programa\Archivos comunes\Panda Software\PavShld\pavprsrv.exe
C:\Archivos de programa\Panda Software\Panda Titanium Antivirus 2005\pavsrv51.exe
C:\Archivos de programa\Panda Software\Panda Titanium Antivirus 2005\prevsrv.exe
C:\Archivos de programa\Panda Software\Panda Titanium Antivirus 2005\AVENGINE.EXE
C:\Archivos de programa\Panda Software\Panda Titanium Antivirus 2005\PsImSvc.exe
C:\Archivos de programa\Panda Software\Panda Titanium Antivirus 2005\WebProxy.exe
C:\WINDOWS\System32\svchost.exe
C:\Archivos de programa\MSN Messenger\msnmsgr.exe
C:\Archivos de programa\Windows Media Player\wmplayer.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Archivos de programa\Windows NT\Accesorios\WORDPAD.EXE
C:\WINDOWS\explorer.exe
C:\Archivos de programa\Trojan Remover\TRUPD.EXE
C:\Documents and Settings\JAVIER\Mis documentos\Mis archivos recibidos\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://euqbdignailxenfulmvpm.com/K3aQkhW75lApRklBuEeuXiPM5FRxYcGPgrE/8v/j6rz7A2fig9lTJ2UAmixhYWl9.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {ADD31406-F516-16C6-188B-8D3BBAC6D7CF} - C:\DOCUME~1\JAVIER\DATOSD~1\SAVEPO~1\Multi Drv.exe (file missing)
O3 - Toolbar: andRadio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [OemReset] :systemroot:\OPTIONS\OEMRESET.EXE /AUDIT
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [IW ControlCenter] C:\Archivos de programa\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe
O4 - HKLM\..\Run: [System Firewall] sysfirewall.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Archivos de programa\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Archivos de programa\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [glue jugs rdr flag] C:\Documents and Settings\All Users\Datos de programa\Phone okay glue jugs\up second.exe
O4 - HKLM\..\Run: [APVXDWIN] "C:\Archivos de programa\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [TrojanScanner] C:\Archivos de programa\Trojan Remover\Trjscan.exe
O4 - HKLM\..\RunServices: [System Firewall] sysfirewall.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [MSMSGS] "C:\Archivos de programa\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [eMuleAutoStart] D:\Archivos de programa\eMule\emule.exe -AutoStart
O4 - Global Startup: Microsoft Office.lnk = C:\Archivos de programa\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show andRelated Links (HKLM)
O10 - Unknown file in Winsock LSP: c:\archivos de programa\panda software\panda titanium antivirus 2005\pavlsp.dll
O10 - Unknown file in Winsock LSP: c:\archivos de programa\panda software\panda titanium antivirus 2005\pavlsp.dll
O10 - Unknown file in Winsock LSP: c:\archivos de programa\panda software\panda titanium antivirus 2005\pavlsp.dll
O10 - Unknown file in Winsock LSP: c:\archivos de programa\panda software\panda titanium antivirus 2005\pavlsp.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1103374490296
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Sponsor
Inviato: Monday, December 20, 2004 6:12:10 PM

 
alfonso
Inviato: Monday, December 20, 2004 8:52:15 PM

Rank: AiutAmico

Iscritto dal : 10/5/2000
Posts: 19,132
Ciao ,
esegui queste operazioni

1) Disattiva il ripristino di configurazione, leggi qui come fare
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=257&SH=N

2) riavvia in modalità provvisoria, leggi qui come fare
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=344&SH=N

apri HIJAC THIS ed elimina come indicato in questo articolo
http://www.aiutamici.com/software/descrizione.asp?CodSw=1175
le righe che seguono, (nel caso le righe da eliminare non compaiono in modalità provvisoria, eliminale dalla modalità normale e riavvia il computer).

==================================
C:\Archivos de programa\Messenger Plus! 3\MsgPlus.exe
-
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://euqbdignailxenfulmvpm.com/K3aQkhW75lApRklBuEeuXiPM5FRxYcGPgrE/8v/j6rz7A2fig9lTJ2UAmixhYWl9.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
-
O2 - BHO: (no name) - {ADD31406-F516-16C6-188B-8D3BBAC6D7CF} - C:\DOCUME~1\JAVIER\DATOSD~1\SAVEPO~1\Multi Drv.exe (file missing)
-
O4 - HKLM\..\Run: [System Firewall] sysfirewall.exe
-
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Archivos de programa\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [glue jugs rdr flag] C:\Documents and Settings\All Users\Datos de programa\Phone okay glue jugs\up second.exe
-
O4 - HKLM\..\RunServices: [System Firewall] sysfirewall.exe
==================================

Con la funzione TROVA di Windows, cerca ed elimina questi file,

==================================
MsgPlus.exe
Multi Drv.exe
sysfirewall.exe
up second.exe
==================================

al termine utilizza i programma AD-AWARE e SPYBOT indicati in questo articolo
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=388&SH=N

sempre in modalità provvisoria fai una scansione Antivirus

quindi riavvia il computer e controlla se il problema e risolto, se e tutto OK riattiva il ripristino configurazione disattivato all'inizio di questa procedura.

Collaboratore Aiutamici
Utenti presenti in questo topic
Guest


Salta al Forum
Aggiunta nuovi Topic disabilitata in questo forum.
Risposte disabilitate in questo forum.
Eliminazione tuoi Post disabilitata in questo forum.
Modifica dei tuoi post disabilitata in questo forum.
Creazione Sondaggi disabilitata in questo forum.
Voto ai sondaggi disabilitato in questo forum.

Main Forum RSS : RSS

Aiutamici Theme
Powered by Yet Another Forum.net versione 1.9.1.8 (NET v2.0) - 3/29/2008
Copyright © 2003-2008 Yet Another Forum.net. All rights reserved.