ciao e grazie per la pazienza,
ho scaricato il programma, di sotto ti incollo il log. non sono riuscito a fare lo scan perché mi riporta questo errore:
"an unexpected error has occurred at procedure: modMain_FixUNIXHostsFile()
Error #28 - Application-defined or object-defined error"
comunque il cerchio si stringe. dopo tutte le prove comincio a pensare che il problema sia winmx, specialmente con xp sp2. infatti oggi il pc ha retto tutto il giorno non avendo mai lanciato winmx. eppure ho il firewall configurato bene... mah!
ecco il log:
StartupList report, 08/10/2004, 23.25.44
StartupList version: 1.52.2
Started from : C:\Documents and Settings\Giuseppe Contento\Desktop\HijackThis.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
==================================================
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\AVPersonal\AVWUPSRV.EXE
C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\cisvc.exe
C:\Programmi\Ahead\InCD\InCDsrv.exe
C:\Programmi\Norton SystemWorks\Norton Antivirus\navapsvc.exe
C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
C:\Programmi\Norton SystemWorks\Norton Antivirus\SAVScan.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe
C:\Programmi\File comuni\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ATK0100\Hcontrol.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Progra~1\ASUS\Power4 Gear\BatteryLife.exe
C:\WINDOWS\system32\sistray.EXE
C:\WINDOWS\system32\khooker.exe
C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\Ahead\InCD\InCD.exe
C:\Programmi\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Programmi\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Programmi\File comuni\Symantec Shared\ccApp.exe
C:\Programmi\File comuni\Symantec Shared\ccApp.exe
C:\Programmi\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Asus\Asus ChkMail\ChkMail.exe
C:\Programmi\Asus\ASUS Hotkey\Hotkey.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\System32\msiexec.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\PROGRA~1\DAP\DAP.EXE
C:\Documents and Settings\Giuseppe Contento\Desktop\HijackThis.exe
Listing of startup folders:
Shell folders Common Startup:
[C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica]
ASUS ChkMail.lnk = C:\Programmi\Asus\Asus ChkMail\ChkMail.exe
Hotkey.lnk = C:\Programmi\Asus\ASUS Hotkey\Hotkey.exe
Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
Checking Windows NT UserInit:
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Hcontrol = C:\WINDOWS\ATK0100\Hcontrol.exe
AGRSMMSG = AGRSMMSG.exe
Power_Gear = C:\Progra~1\ASUS\Power4 Gear\BatteryLife.exe 1
SiS Tray = C:\WINDOWS\system32\sistray.EXE
SiS KHooker = C:\WINDOWS\system32\khooker.exe
SynTPLpr = C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
SynTPEnh = C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
NeroCheck = C:\WINDOWS\System32\\NeroCheck.exe
InCD = C:\Programmi\Ahead\InCD\InCD.exe
DeviceDiscovery = C:\Programmi\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
TkBellExe = "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
HPDJ Taskbar Utility = C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
HP Software Update = C:\Programmi\Hewlett-Packard\HP Software Update\HPWuSchd.exe
ccApp = "C:\Programmi\File comuni\Symantec Shared\ccApp.exe"
QD FastAndSafe =
iTunesHelper = C:\Programmi\iTunes\iTunesHelper.exe
QuickTime Task = "C:\Programmi\QuickTime\qttask.exe" -atboottime
AdslTaskBar = rundll32.exe stmctrl.dll,TaskBar
ASUS Live Update = C:\Programmi\ASUS\ASUS Live Update\ALU.exe
SoundMan = SOUNDMAN.EXE
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
CTFMON.EXE = C:\WINDOWS\system32\ctfmon.exe
Load/Run keys from C:\WINDOWS\WIN.INI:
load=*INI file not found*
run=*INI file not found*
Load/Run keys from Registry:
HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\Windows: load=
HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=apitrap.dll
Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*
Shell & screensaver key from Registry:
Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr
drivers=*Registry value not found*
Policies Shell key:
HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*
Enumerating Browser Helper Objects:
(no name) - C:\PROGRA~1\DAP\dapbho.dll - {0000CC75-ACF3-4cac-A0A9-DD3868E06852}
(no name) - (no file) - {00320615-B6C2-40A6-8F99-F1C52D674FAD}
myBar BHO - (no file) - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC}
(no name) - C:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
Popup Manager - (no file) - {08E74C67-99A6-45C7-94DA-A397A8FD8082}
NAV Helper - C:\Programmi\Norton SystemWorks\Norton Antivirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872}
Enumerating Task Scheduler jobs:
Symantec NetDetect.job
Symantec Drmc.job
Norton AntiVirus - Scansione del computer.job
Norton AntiVirus - Scansione del computer - Giuseppe Contento.job
Enumerating Download Program Files:
[QuickTime Object]
InProcServer32 = C:\Programmi\QuickTime\QTPlugin.ocx
CODEBASE =
http://www.apple.com/qtactivex/qtplugin.cab[Symantec AntiVirus scanner]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\avsniff.dll
CODEBASE =
http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab[Office Update Installation Engine]
InProcServer32 = C:\WINDOWS\opuc.dll
CODEBASE =
http://office.microsoft.com/officeupdate/content/opuc.cab[EPUImageControl Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\EPUWALcontrol.dll
CODEBASE =
http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-12.cab[Symantec RuFSI Utility Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\rufsi.dll
CODEBASE =
http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab[{9F1C11AA-197B-4942-BA54-47A8489BB47F}]
CODEBASE =
http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38009.1618171296[GDIChk Object]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\GDIChk.dll
CODEBASE =
http://www.microsoft.com/security/controls/GDI/0/GDIChk.CAB[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\System32\macromed\flash\Flash.ocx
CODEBASE =
http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Enumerating Winsock LSP files:
NameSpace #4: C:\WINDOWS\system32\pnrpnsp.dll
NameSpace #5: C:\WINDOWS\system32\pnrpnsp.dll
Enumerating ShellServiceObjectDelayLoad items:
PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll
UPnPMonitor: C:\WINDOWS\system32\upnpui.dll
End of report, 9.431 bytes
Report generated in 0,250 seconds
Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
