Logfile of HijackThis v1.99.1
Scan saved at 0.45.28, on 15/04/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\Sarah\System32\smss.exe
C:\Sarah\SYSTEM32\winlogon.exe
C:\Sarah\system32\services.exe
C:\Sarah\system32\lsass.exe
C:\Sarah\system32\svchost.exe
C:\Sarah\System32\svchost.exe
C:\Sarah\system32\spoolsv.exe
C:\Sarah\Explorer.EXE
C:\Program Files\Media Access\MediaAccK.exe
C:\Sarah\System32\LVCOMSX.EXE
C:\Programmi\Logitech\Video\LogiTray.exe
C:\Programmi\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Media Access\MediaAccess.exe
C:\Sarah\Mixer.exe
C:\Sarah\System32\ctfmon.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\MSN Messenger\MsnMsgr.Exe
C:\Programmi\Logitech\Video\FxSvr2.exe
C:\Sarah\System32\SCardClnt.exe
C:\Sarah\System32\svchost.exe
C:\Programmi\ESET\nod32.exe
C:\Documents and Settings\sarah\Impostazioni locali\Temp\Directory temporanea 1 per hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://wiki.sl.to/?m=abcandt=andu=http::2F:2Fwww.google.it:2Fandx=539E1B04-C77C-488A-B879-9F8BCF0A6C16
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
F3 - REG:win.ini: run=
F2 - REG:system.ini: UserInit=C:\SICI\System32\userinit.exe
O2 - BHO: (no name) - {4D2759DE-D6C9-447D-88A3-145CF0F22FAD} - C:\Sarah\System32\msxmlr32.dll
O3 - Toolbar: andRadio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\Sarah\System32\msdxm.ocx
O3 - Toolbar: (no name) - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - (no file)
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\Sarah\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Programmi\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Programmi\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programmi\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [InstaFinderK] C:\Programmi\INSTAFINK\InstaFinderK_inst.exe
O4 - HKLM\..\Run: [KernelFaultCheck] :systemroot:\system32\dumprep 0 -k
O4 - HKLM\..\Run: [nod32kui] "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\Sarah\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] C:\Programmi\Logitech\Video\ManifestEngine.exe boot
O4 - HKCU\..\RunServices: [CSCRS Value] cscrs.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Sarah\web\related.htm
O9 - Extra 'Tools' menuitem: Show andRelated Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Sarah\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\MSMSGS.EXE
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O16 - DPF: {00000000-7777-0704-0B53-2C8830E9FAEC} - http://20041115.download-1.de/cab/axload.cab
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/6247971CanadaInc/ie/bridge-c267.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {E6A3C1E2-F792-483E-9133-596215172BE9} (AcceptLang Class) - http://runonce.msn.com/setacceptlang.cab
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\Sarah\System32\hwclock.exe (file missing)
O23 - Service: iTunes Music Service (iTunesMusic) - Unknown owner - C:\Sarah\iTunesMusic.exe (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Unknown owner - C:\Programmi\Eset\nod32krn.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Programmi\File comuni\Panda Software\PavShld\pavprsrv.exe (file missing)
O23 - Service: Smart Card Client (SCardClnt) - Unknown owner - C:\Sarah\System32\SCardClnt.exe



Edited by - alexlife on 04/15/2005 01:27:50

Ciao ,
esegui queste operazioni

1) Disattiva il ripristino di configurazione, leggi qui come fare
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=257&SH=N

2) riavvia in modalità provvisoria, leggi qui come fare
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=344&SH=N

apri HIJAC THIS ed elimina come indicato in questo articolo
http://www.aiutamici.com/software/descrizione.asp?CodSw=1175
le righe che seguono, (nel caso le righe da eliminare non compaiono in modalità provvisoria, eliminale dalla modalità normale e riavvia il computer).

==================================
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.it:2Fandx=539E1B04-C77C-488A-B879-9F8BCF0A6C16" target="_blank">http://wiki.sl.to/?m=abcandt=andu=http::2F:2Fwww.google.it:2Fandx=539E1B04-C77C-488A-B879-9F8BCF0A6C16
-
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
F3 - REG:win.ini: run=
F2 - REG:system.ini: UserInit=C:\SICI\System32\userinit.exe
O2 - BHO: (no name) - {4D2759DE-D6C9-447D-88A3-145CF0F22FAD} - C:\Sarah\System32\msxmlr32.dll
-
O3 - Toolbar: (no name) - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - (no file)
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
-
O4 - HKLM\..\Run: [InstaFinderK] C:\Programmi\INSTAFINK\InstaFinderK_inst.exe
-
O4 - HKCU\..\RunServices: [CSCRS Value] cscrs.exe
-
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O16 - DPF: {00000000-7777-0704-0B53-2C8830E9FAEC} - http://20041115.download-1.de/cab/axload.cab
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/6247971CanadaInc/ie/bridge-c267.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
-
O16 - DPF: {E6A3C1E2-F792-483E-9133-596215172BE9} (AcceptLang Class) - http://runonce.msn.com/setacceptlang.cab
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\Sarah\System32\hwclock.exe (file missing)
O23 - Service: iTunes Music Service (iTunesMusic) - Unknown owner - C:\Sarah\iTunesMusic.exe (file missing)
-
O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Programmi\File comuni\Panda Software\PavShld\pavprsrv.exe (file missing)
==================================

Con la funzione TROVA di Windows, cerca ed elimina questi file,

==================================
msxmlr32.dll
MediaAccK.exe
InstaFinderK_inst.exe
cscrs.exe
hwclock.exe
==================================

al termine utilizza i programmi AD-AWARE e SPYBOT indicati in questo articolo
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=388&SH=N

sempre in modalità provvisoria fai una scansione Antivirus

quindi riavvia il computer e controlla se il problema e risolto, se e tutto OK riattiva il ripristino configurazione disattivato all'inizio di questa procedura.

---

Collaboratore Aiutamici