dopo varie scansioni con i programmi antispia la scritta altnetBDE non si cancella . Logfile of

HijackThis v1.99.1
Scan saved at

22.41.10, on

30/12/2005
Platform: Windows XP

SP2 (WinNT

5.01.2600)
MSIE: Internet

Explorer v6.00 SP2

(6.00.2900.2180)

Running processes:
C:\WINDOWS\System32
smss.exe
C:\WINDOWS\system32
winlogon.exe
C:\WINDOWS\system32
services.exe
C:\WINDOWS\system32
lsass.exe
C:\WINDOWS\system32
svchost.exe
C:\WINDOWS\System32
svchost.exe
C:\WINDOWS\system32
spoolsv.exe
C:\Programmi\File

comuni\Microsoft

Shared\VS7DEBUG\MDM.

EXE
C:\Programmi\Eset\no

d32krn.exe
C:\WINDOWS\Explorer.

EXE
C:\Programmi\Eset\no

d32kui.exe
C:\Programmi\Java\jr

e1.5.0_03\bin\jusche

d.exe
C:\WINDOWS\system32
ctfmon.exe
C:\Programmi\Messeng

er\msmsgs.exe
C:\Programmi\iISyste

m

Wiper\SystemWiper.ex

e
C:\WINDOWS\System32
svchost.exe
C:\Documents and

Settings\sa\Document

i\Edo\HijackThis.exe

R1 -

HKCU\Software\Micros

oft\Internet

Explorer\Main,Defaul

t_Page_URL =

about:blank
R0 -

HKCU\Software\Micros

oft\Internet

Explorer\Main,Start

Page =

http://www.google.it

/
R1 -

HKLM\Software\Micros

oft\Internet

Explorer\Main,Defaul

t_Page_URL =

http://www.libero.it
R0 -

HKCU\Software\Micros

oft\Internet

Explorer\Main,Local

Page = \blank.htm
R0 -

HKLM\Software\Micros

oft\Internet

Explorer\Main,Local

Page =
R1 -

HKCU\Software\Micros

oft\Internet

Explorer\Main,Window

Title = Microsoft

Internet Explorer
R0 -

HKCU\Software\Micros

oft\Internet

Explorer\Toolbar,Lin

ksFolderName =

Collegamenti
F2 - REG:system.ini:

UserInit=C:\WINDOWS
system32\Userinit.ex

e
O2 - BHO:

AcroIEHlprObj Class

-

{06849E9F-C8D7-4D59-

B87D-784B7D6BE0B3} -

C:\Programmi\Adobe\A

crobat

6.0\Reader\ActiveX\A

croIEHelper.dll
O2 - BHO: (no name)

-

{53707962-6F74-2D53-

2644-206D7942484F} -

C:\Programmi\Spybot

- Search &

Destroy\SDHelper.dll
O2 - BHO: Google

Toolbar Helper -

{AA58ED58-01DD-4d91-

8333-CF10577473F7} -

c:\programmi\google
googletoolbar1.dll
O3 - Toolbar:

&Google -

{2318C2B1-4965-11d4-

9B18-009027A5CD4F} -

c:\programmi\google
googletoolbar1.dll
O4 - HKLM\..\Run:

[nod32kui]

"C:\Programmi\Eset\n

od32kui.exe"

/WAITSERVICE
O4 - HKLM\..\Run:

[SunJavaUpdateSched]

C:\Programmi\Java\jr

e1.5.0_03\bin\jusche

d.exe
O4 - HKCU\..\Run:

[ctfmon.exe]

C:\WINDOWS\system32
ctfmon.exe
O4 - HKCU\..\Run:

[MSMSGS]

"C:\Programmi\Messen

ger\msmsgs.exe"

/background
O4 - HKCU\..\Run:

[iIWiper]

C:\Programmi\iISyste

m

Wiper\SystemWiper.ex

e m
O8 - Extra context

menu item: &Google

Search -

res://C:\Programmi\G

oogle\GoogleToolbar1

.dll/cmsearch.html
O8 - Extra context

menu item:

&Translate English

Word -

res://C:\Programmi\G

oogle\GoogleToolbar1

.dll/cmwordtrans.htm

l
O8 - Extra context

menu item: Backward

Links -

res://C:\Programmi\G

oogle\GoogleToolbar1

.dll/cmbacklinks.htm

l
O8 - Extra context

menu item: Cached

Snapshot of Page -

res://C:\Programmi\G

oogle\GoogleToolbar1

.dll/cmcache.html
O8 - Extra context

menu item: E&sporta

in Microsoft Excel -

res://C:\PROGRA~1\MI

CROS~3\OFFICE11\EXCE

L.EXE/3000
O8 - Extra context

menu item: Similar

Pages -

res://C:\Programmi\G

oogle\GoogleToolbar1

.dll/cmsimilar.html
O8 - Extra context

menu item: Translate

Page into English -

res://C:\Programmi\G

oogle\GoogleToolbar1

.dll/cmtrans.html
O9 - Extra button:

Ricerche -

{92780B25-18CC-41C8-

B9BE-3C9C571A8263} -

C:\PROGRA~1\MICROS~3

\OFFICE11\REFIEBAR.D

LL
O9 - Extra button:

Messenger -

{FB5F1910-F110-11d2-

BB9E-00C04F795683} -

C:\Programmi\Messeng

er\msmsgs.exe
O9 - Extra 'Tools'

menuitem: Windows

Messenger -

{FB5F1910-F110-11d2-

BB9E-00C04F795683} -

C:\Programmi\Messeng

er\msmsgs.exe
O14 - IERESET.INF:

START_PAGE_URL=http:

//www.libero.it
O16 - DPF:

{17492023-C23A-453E-

A040-C7C580BBF700}

(Windows Genuine

Advantage Validation

Tool) -

http://go.microsoft.

com/fwlink/?linkid=3

9204
O20 - Winlogon

Notify: WRNotifier -

WRLogonNTF.dll (file

missing)
O23 - Service: NOD32

Kernel Service

(NOD32krn) - Eset -

C:\Programmi\Eset\no

d32krn.exe

<font color=red></font id=red>

Devi inserire nuovamente il log, quello inserito é incomprensibile

se non hai il Blocco Note di windows impostato come programma predefinito, apri il file <font color=red>hijackthis.log</font id=red> generato da Hijack con il Blocco Note, seleziona il testo e inseriscilo nel forum, forse usando altri programmi la formattazione spezzetta il file in un modo indecifrabile.

---

Collaboratore Aiutamici