Aiutamici Forum
Benvenuto Ospite Cerca | Topic Attivi | Utenti | | Log In | Registra

Aiutamici Forum » FORUM - Istruzioni e Guide » Sicurezza VIRUS » mi controllate il log di HijackThis

mi controllate il log di HijackThis Opzioni
Topic Precedente · Topic Sucessivo
andrea72
Inviato: Tuesday, July 16, 2013 7:24:17 AM
Rank: Member

Iscritto dal : 3/4/2006
Posts: 27
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 07:22:06, on 16/07/13
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v9.00 (9.00.8112.16476)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Windows\System32\igfxtray.exe
C:\Program Files\REALTEK\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Users\ANDREA\AppData\Local\Temp\Rar$EXa0.371\PortableApps\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://home.microsoft.com/search/search.asp
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.searchplusnetwork.com/?q={searchTerms}&sp=faddr&t=a0801
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchplusnetwork.com/?q={searchTerms}&sp=faddr&t=a0801
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = localhost:21320
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: I&nvia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O17 - HKLM\System\CCS\Services\Tcpip\..\{1CC3DE9B-EA60-4CB0-84F3-73412361F1B3}: NameServer = 8.8.8.8,8.8.4.4
O17 - HKLM\System\CCS\Services\Tcpip\..\{4BAFAA81-BED3-416D-8A5F-F333315E386B}: NameServer = 8.8.8.8,8.8.4.4
O17 - HKLM\System\CCS\Services\Tcpip\..\{92563E58-AC0F-447A-A8B0-FDF5E04EAB11}: NameServer = 8.8.8.8,8.8.4.4
O17 - HKLM\System\CCS\Services\Tcpip\..\{D1065E26-6754-4D16-BAE5-5E3B6D7D54E7}: NameServer = 8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{e29ac6c2-7037-11de-816d-806e6f6e6963}: NameServer = 8.8.8.8,8.8.4.4
O17 - HKLM\System\CS1\Services\Tcpip\..\{1CC3DE9B-EA60-4CB0-84F3-73412361F1B3}: NameServer = 8.8.8.8,8.8.4.4
O17 - HKLM\System\CS2\Services\Tcpip\..\{1CC3DE9B-EA60-4CB0-84F3-73412361F1B3}: NameServer = 8.8.8.8,8.8.4.4
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~1\Office12\GRA32A~1.DLL
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: SDWinLogon - SDWinLogon.dll (file missing)
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Servizio Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Servizio Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: Spybot-S&D 2 Scanner Service (SDScannerService) - Safer-Networking Ltd. - C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe
O23 - Service: Spybot-S&D 2 Updating Service (SDUpdateService) - Safer-Networking Ltd. - C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe
O23 - Service: Spybot-S&D 2 Security Center Service (SDWSCService) - Safer-Networking Ltd. - C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe

--
End of file - 6619 bytes
Torna in alto
 
Sponsor
Inviato: Tuesday, July 16, 2013 7:24:17 AM

 
Torna in alto
 
cbbusto
Inviato: Tuesday, July 16, 2013 10:55:41 AM

Rank: AiutAmico

Iscritto dal : 11/8/2008
Posts: 13,964
Chiudi tutti i programmi e disconnesso lanci HJT e clicca sul secondo pulsante: Do a system scan only poi metti la spunta alle voci che ti indico e alla fine clic su Fix checked:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://home.microsoft.com/search/search.asp

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.searchplusnetwork.com/?q={searchTerms}&sp=faddr&t=a0801

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchplusnetwork.com/?q={searchTerms}&sp=faddr&t=a0801

O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun

O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE

O17 - HKLM\System\CCS\Services\Tcpip\..\{D1065E26-6754-4D16-BAE5-5E3B6D7D54E7}: NameServer = 8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.24 7.20,156.154.70.1,156.154.71.1

Poi fai questa scansione:
Scarica Adwcleaner sul desktop:
http://general-changelog-team.fr/en/downloads/finish/20-outils-de-xplode/2-adwcleaner
Avvialo e clicca sul pulsante "Elimina", non cliccare su Cerca.
Conferma con OK le varie finestre che ti compariranno.
Il pc si riavvierà, e uscirà il log con le eliminazioni.
Postalo qui.

In Firefox controlla nei componenti aggiuntivi, plugin se trovi qualche riferimento a hola search e lo rimuovi, controlla anche nei motori di ricerca elimina quelli che non conosci e lascia quello preferito.
Fai sapere, ciao.
Torna in alto
 
andrea72
Inviato: Tuesday, July 16, 2013 9:58:36 PM
Rank: Member

Iscritto dal : 3/4/2006
Posts: 27
ciao cbbusto ho fatto tutto quanto quello che mi hai detto solo che quando lancio adwcleaner non finisce la scansione e si spegne il pc.
cosa devo fare adesso? grazie
Torna in alto
 
cbbusto
Inviato: Wednesday, July 17, 2013 1:28:29 AM

Rank: AiutAmico

Iscritto dal : 11/8/2008
Posts: 13,964
andrea72 ha scritto:
ciao cbbusto ho fatto tutto quanto quello che mi hai detto solo che quando lancio adwcleaner non finisce la scansione e si spegne il pc.
cosa devo fare adesso? grazie


Sul programma ADW clic col destro e esegui come amministratore, dovrebbe funzionare.
Torna in alto
 
andrea72
Inviato: Wednesday, July 17, 2013 7:12:26 PM
Rank: Member

Iscritto dal : 3/4/2006
Posts: 27
# AdwCleaner v2.305 - Logfile creato il 17/07/2013 alle 18:55:49
# Aggiornamento 11/07/2013 by Xplode
# Sistema Operativo : Windows 7 Professional (32 bits)
# Utente : ANDREA - ANDREA
# Modalità Avvio : Modalità Normale
# Eseguito da : C:\Users\ANDREA\Desktop\adwcleaner.exe
# Opzioni [Elimina]


***** [Servizi] *****


***** [File / Cartelle] *****


***** [Registro] *****

Chiave Eliminata : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Valore Eliminata : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]

***** [Browser Internet] *****

-\\ Internet Explorer v9.0.8112.16476

Sostituito : [HKCU\Software\Microsoft\Internet Explorer\SearchUrl - Default] = hxxp://www.searchplusnetwork.com/?q={searchTerms}&sp=faddr&t=a0801 --> hxxp://www.google.com
Sostituito : [HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl - Default] = hxxp://www.searchplusnetwork.com/?q={searchTerms}&sp=faddr&t=a0801 --> hxxp://www.google.com

-\\ Mozilla Firefox v22.0 (it)

File : C:\Users\ANDREA\AppData\Roaming\Mozilla\Firefox\Profiles\ribezvhm.default\prefs.js

C:\Users\ANDREA\AppData\Roaming\Mozilla\Firefox\Profiles\ribezvhm.default\user.js ... Eliminato !

Eliminata : user_pref("browser.newtab.url", "hxxp://www.holasearch.com/?babsrc=NT_ss&mntrId=702200252294BED7&aff[...]
Eliminata : user_pref("extensions.adblockplus.whitelist", "{\"isearch.avg\":true}");
Eliminata : user_pref("extensions.holasearch.admin", false);
Eliminata : user_pref("extensions.holasearch.aflt", "babsst");
Eliminata : user_pref("extensions.holasearch.appId", "{8D5CFE57-B0FD-4396-97A2-DFD0B7DA935B}");
Eliminata : user_pref("extensions.holasearch.autoRvrt", "false");
Eliminata : user_pref("extensions.holasearch.dfltLng", "it");
Eliminata : user_pref("extensions.holasearch.excTlbr", false);
Eliminata : user_pref("extensions.holasearch.ffxUnstlRst", false);
Eliminata : user_pref("extensions.holasearch.id", "7022c3ec00000000000000252294bed7");
Eliminata : user_pref("extensions.holasearch.instlDay", "15900");
Eliminata : user_pref("extensions.holasearch.instlRef", "sst");
Eliminata : user_pref("extensions.holasearch.newTab", false);
Eliminata : user_pref("extensions.holasearch.prdct", "holasearch");
Eliminata : user_pref("extensions.holasearch.prtnrId", "holasearch");
Eliminata : user_pref("extensions.holasearch.rvrt", "false");
Eliminata : user_pref("extensions.holasearch.smplGrp", "none");
Eliminata : user_pref("extensions.holasearch.tlbrId", "base");
Eliminata : user_pref("extensions.holasearch.tlbrSrchUrl", "");
Eliminata : user_pref("extensions.holasearch.vrsn", "1.8.16.16");
Eliminata : user_pref("extensions.holasearch.vrsnTs", "1.8.16.168:29:53");
Eliminata : user_pref("extensions.holasearch.vrsni", "1.8.16.16");

-\\ Google Chrome v28.0.1500.72

File : C:\Users\ANDREA\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File Pulito.

*************************

AdwCleaner[S1].txt - [701 octets] - [16/07/2013 19:25:03]
AdwCleaner[S2].txt - [3119 octets] - [17/07/2013 18:55:49]

########## EOF - C:\AdwCleaner[S2].txt - [3179 octets] ##########
Torna in alto
 
andrea72
Inviato: Wednesday, July 17, 2013 7:14:14 PM
Rank: Member

Iscritto dal : 3/4/2006
Posts: 27
cbbusto ti ho postato il log di adwcleaner, solo che ho dovuto farlo in modalità provvisoria con rete perchè il pc in modalità normale si spegne subito.
Torna in alto
 
cbbusto
Inviato: Thursday, July 18, 2013 11:40:53 AM

Rank: AiutAmico

Iscritto dal : 11/8/2008
Posts: 13,964
Va bene ADW ha fatto un po' di pulizia, hai eliminato le voci che ti ho indicato in HJT ?
Fai sapere. Ciao
Torna in alto
 
Utenti presenti in questo topic
Guest

Aiutamici Forum » FORUM - Istruzioni e Guide » Sicurezza VIRUS » mi controllate il log di HijackThis


Salta al Forum
Aggiunta nuovi Topic disabilitata in questo forum.
Risposte disabilitate in questo forum.
Eliminazione tuoi Post disabilitata in questo forum.
Modifica dei tuoi post disabilitata in questo forum.
Creazione Sondaggi disabilitata in questo forum.
Voto ai sondaggi disabilitato in questo forum.

Main Forum RSS : RSS

Aiutamici Theme
Powered by Yet Another Forum.net versione 1.9.1.8 (NET v2.0) - 3/29/2008
Copyright © 2003-2008 Yet Another Forum.net. All rights reserved.