salve, avrei bisogno di un controllo log di un pc...problematico...

Logfile of HijackThis v1.99.1
Scan saved at 18.05.32, on 27/03/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Programmi\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\Programmi\Java\jre1.5.0_01\bin\jusched.exe
C:\Programmi\Analog Devices\SoundMAX\SMTray.exe
C:\WINNT\system32\RUNDLL32.EXE
C:\WINNT\anvshell.exe
C:\WINNT\system32\GSICON.EXE
C:\WINNT\system32\dslagent.exe
C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_S4I0K2.EXE
C:\WINNT\system32\usb2.exe
C:\WINNT\SYSTEM32\epetypa.exe
C:\WINNT\system32\ucilonyc.exe
C:\WINNT\system32\lMAPl.EXE
C:\WINNT\system32\cpustats.exe
C:\WINNT\SYSTEM32\getikap.exe
C:\WINNT\system32\wscel.exe
C:\WINNT\SYSTEM32\anukem.exe
C:\WINNT\system32\pohapereq.exe
C:\WINNT\system32\usb2.exe
C:\WINNT\system32\ucilonyc.exe
C:\WINNT\system32\cpustats.exe
C:\WINNT\system32\pohapereq.exe
C:\WINNT\system32\wscel.exe
C:\Programmi\EPSON\EPSON CardMonitor\EPSON CardMonitor1.2.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Documents and Settings\Afro Maisto\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,andRadio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [Diagnostica SpeedTouch USB] "C:\Programmi\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [Smapp] C:\Programmi\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [anvshell] anvshell.exe
O4 - HKLM\..\Run: [LiveNote] livenote.exe
O4 - HKLM\..\Run: [GSICONEXE] GSICON.EXE
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [EPSON Stylus Photo RX500] C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_S4I0K2.EXE /P24 "EPSON Stylus Photo RX500" /O6 "USB001" /M "Stylus Photo RX500"
O4 - HKLM\..\Run: [usb win32 2 plugin] usb2.exe
O4 - HKLM\..\Run: [fqfeqajw] C:\WINNT\SYSTEM32\epetypa.exe
O4 - HKLM\..\Run: [birelosit] ucilonyc.exe
O4 - HKLM\..\Run: [Micrsoft Driver] svchosts.exe
O4 - HKLM\..\Run: [lMAPl] lMAPl.EXE
O4 - HKLM\..\Run: [AdTools Service] C:\Program Files\AdTools Service\AdTools.exe
O4 - HKLM\..\Run: [CPU Windows Status] cpustats.exe
O4 - HKLM\..\Run: [Comcast Network] C:\WINNT\SYSTEM32\getikap.exe
O4 - HKLM\..\Run: [Configuration Loading Service] wscel.exe
O4 - HKLM\..\Run: [vdsadasw] C:\WINNT\SYSTEM32\anukem.exe
O4 - HKLM\..\Run: [eEjerik] pohapereq.exe
O4 - HKLM\..\RunServices: [usb win32 2 plugin] usb2.exe
O4 - HKLM\..\RunServices: [birelosit] ucilonyc.exe
O4 - HKLM\..\RunServices: [Micrsoft Driver] svchosts.exe
O4 - HKLM\..\RunServices: [lMAPl] lMAPl.EXE
O4 - HKLM\..\RunServices: [CPU Windows Status] cpustats.exe
O4 - HKLM\..\RunServices: [Configuration Loading Service] wscel.exe
O4 - HKLM\..\RunServices: [eEjerik] pohapereq.exe
O4 - HKCU\..\Run: [vanyzim] axepis.exe
O4 - HKCU\..\Run: [azixegoira] yikylohi.exe
O4 - HKCU\..\Run: [usb win32 2 plugin] usb2.exe
O4 - HKCU\..\Run: [birelosit] ucilonyc.exe
O4 - HKCU\..\Run: [CPU Windows Status] cpustats.exe
O4 - HKCU\..\Run: [eEjerik] pohapereq.exe
O4 - HKCU\..\Run: [Configuration Loading Service] wscel.exe
O4 - Global Startup: EPSON CardMonitor.lnk = C:\Programmi\EPSON\EPSON CardMonitor\EPSON CardMonitor1.2.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_01\bin\npjpi150_01.dll
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E91B2B76-78A3-4092-9E79-2FA5FDE52877}: NameServer = 85.37.17.16 151.99.125.1
O23 - Service: Servizio amministrativo di Gestione disco logico (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: fvljptl - Unknown owner - \\80.182.109.94\D$\lMAPl.EXE" -service (file missing)
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: :NVSVC.name% (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe

grazie
web

Ciao ,
esegui queste operazioni

riavvia in modalità provvisoria, leggi qui come fare
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=344&SH=N

apri HIJAC THIS ed elimina come indicato in questo articolo
http://www.aiutamici.com/software/descrizione.asp?CodSw=1175
le righe che seguono, (nel caso le righe da eliminare non compaiono in modalità provvisoria, eliminale dalla modalità normale e riavvia il computer).

==================================
O4 - HKLM\..\Run: [usb win32 2 plugin] usb2.exe
O4 - HKLM\..\Run: [fqfeqajw] C:\WINNT\SYSTEM32\epetypa.exe
O4 - HKLM\..\Run: [birelosit] ucilonyc.exe
O4 - HKLM\..\Run: [Micrsoft Driver] svchosts.exe
O4 - HKLM\..\Run: [lMAPl] lMAPl.EXE
O4 - HKLM\..\Run: [AdTools Service] C:\Program Files\AdTools Service\AdTools.exe
O4 - HKLM\..\Run: [CPU Windows Status] cpustats.exe
O4 - HKLM\..\Run: [Comcast Network] C:\WINNT\SYSTEM32\getikap.exe
O4 - HKLM\..\Run: [Configuration Loading Service] wscel.exe
O4 - HKLM\..\Run: [vdsadasw] C:\WINNT\SYSTEM32\anukem.exe
O4 - HKLM\..\Run: [eEjerik] pohapereq.exe
O4 - HKLM\..\RunServices: [usb win32 2 plugin] usb2.exe
O4 - HKLM\..\RunServices: [birelosit] ucilonyc.exe
O4 - HKLM\..\RunServices: [Micrsoft Driver] svchosts.exe
O4 - HKLM\..\RunServices: [lMAPl] lMAPl.EXE
O4 - HKLM\..\RunServices: [CPU Windows Status] cpustats.exe
O4 - HKLM\..\RunServices: [Configuration Loading Service] wscel.exe
O4 - HKLM\..\RunServices: [eEjerik] pohapereq.exe
O4 - HKCU\..\Run: [vanyzim] axepis.exe
O4 - HKCU\..\Run: [azixegoira] yikylohi.exe
O4 - HKCU\..\Run: [usb win32 2 plugin] usb2.exe
O4 - HKCU\..\Run: [birelosit] ucilonyc.exe
O4 - HKCU\..\Run: [CPU Windows Status] cpustats.exe
O4 - HKCU\..\Run: [eEjerik] pohapereq.exe
O4 - HKCU\..\Run: [Configuration Loading Service] wscel.exe
-
O23 - Service: fvljptl - Unknown owner - \\80.182.109.94\D$\lMAPl.EXE" -service (file missing)
==================================

Con la funzione TROVA di Windows, cerca ed elimina questi file,

==================================
usb2.exe
epetypa.exe
ucilonyc.exe
svchosts.exe
lMAPl.EXE
AdTools.exe
cpustats.exe
getikap.exe
wscel.exe
anukem.exe
pohapereq.exe
axepis.exe
yikylohi.exe
==================================

al termine utilizza i programmi AD-AWARE e SPYBOT indicati in questo articolo
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=388&SH=N

sempre in modalità provvisoria fai una scansione Antivirus.

---

Collaboratore Aiutamici