SALVE RAGAZZI
HO UN PICCOLO PROLEMA!
PREMETTO CHE HO DUE PC (WIN XP) COLLEGATI IN RETE TRAMITE CAVO CROSS E DI CONSEGUENZA UNA CONDIVISIONE ADSL TIN.IT.
HO SETTATO LA CONNESSIONE IN MODO TALE DA AVVISARMI OGNI QUALVOLTA QUALCUNO TENTA L'ACCESSO.
BENE DA IERI OGNI QUALVOLTA AVVIO IL SISTEMA UNA FINESTRA MI RICHIEDE LA CONNESSIONE PER UN FANTOMATICO
INDIAPOOP.CO <b></b>
HO FATTO SCANSIONI CON AVAST, AD-AWARE, SPYBOT SEARCH AND DESTROY E MICROSOFT ANTISPYWARE. NESSUNO DI QUESTI RILEVA PRESENZE ESTRANEE (ANCHE NELLE CHIAVI DI REGISTRO DEL SISTEMA). TRA L'ALTRO HO CERCATO QUESTO INDIAPOOP.COM SU INTERNET CON MOTORI DI RICERCA E NON VIENE VISUALIZZATO NESSUN RISULTATO O RELATIVI ARGOMENTI.
HO FATTO UNA SCANSIONE CON HIJACK THIS (VERSIONE CHE HO SCARICATO DA AIUTAMICI)
INCOLLO IL FILE LOG CONFIDANDO NEL VOSTRO.
AIUTO . GRAZIE IN ANTICIPO
DAVIDE
P.S.
E' GRADITO ANCHE QUALCHE SUGGERIMENTO SULLE RIGHE POTENZIALMENTE NOCIVE DA ELIMINARE
Logfile of HijackThis v1.99.1
Scan saved at 21.31.15, on 11/07/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\GSICON.EXE
C:\WINDOWS\System32\dslagent.exe
C:\Programmi\Lavasoft\Ad-aware 6\Ad-watch.exe
C:\Programmi\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\System32\notes.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmi\Microsoft AntiSpyware\gcasDtServ.exe
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://gw.virgilio.it/adsl/01.minisearchR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.google.it/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://gw.virgilio.it/adsl/01.adslR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://www.ocqcflesnnojvuquhcdktq.com/HJylbPTF8n7NEW4MgbO8tJDPvM47A9IjbOEcjzIBSQt/WFPxALlFJKYOl7YXgkuz.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fornito da Tin.it
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [GSICONEXE] GSICON.EXE
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Ad-watch] "C:\Programmi\Lavasoft\Ad-aware 6\Ad-watch.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Programmi\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [notes] notes.exe
O4 - HKLM\..\Run: [RemoteControl] C:\Programmi\ASUSTek\ASUSDVD\PDVDServ.exe
O4 - HKLM\..\RunServices: [notes] notes.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Umail - {66FFEE91-78C7-446C-9DB7-61409F50BD0F} -
http://www.umail.it (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://gw.virgilio.it/adsl/01.adsl
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) -
http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cabO16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
http://spaces.msn.com/PhotoUpload/MsnPUpld.cab?10,0,910,0O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) -
http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) -
http://messenger.msn.com/download/msnmessengersetupdownloader.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{9355835E-7A7B-43F2-983B-34B0E7A604CF}: NameServer = 62.211.69.150 212.48.4.15
O17 - HKLM\System\CCS\Services\Tcpip\..\{95351AE5-A55F-41F5-927D-A049DAE2069F}: NameServer = 212.216.112.112,212.216.172.62
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe