ciao a tutti,
mi sono iscritto per utilizzare il vostro aiuto nell'interpretare il risultato dopo lo scan con hijackthis.
Premesso che sono un newbie e di sicurezza so molto poco, riuscireste a commentare quanto segue dicendomi se ho un pc che è una schifezza oppure è tutto in ordine?
Grazie in anticipo!
--
Logfile of HijackThis v1.98.2
Scan saved at 14.53.45, on 24/12/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Sygate\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\crypserv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Apoint\Apoint.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\Programmi\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Programmi\Apoint\Apntex.exe
C:\Programmi\Java\j2re1.4.2_02\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Documents and Settings\ste\Dati applicazioni\siso.exe
C:\Programmi\Mysql\bin\winmysqladmin.exe
C:\Programmi\OpenOffice.org1.1.0\program\soffice.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmi\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://test/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://test/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 1.33.77.157:6588
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O1 - Hosts: 127.0.0.2 staging
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: Zend Studio - {95188727-288F-4581-A48D-EAB3BD027314} - C:\Programmi\Zend\bin\ZendIEToolbar.dll
O4 - HKLM\..\Run: [Apoint] C:\Programmi\Apoint\Apoint.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [TkBellExe] C:\Programmi\File comuni\Real\Update_OB\realsched.exe -osboot
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Programmi\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\j2re1.4.2_02\bin\jusched.exe
O4 - HKLM\..\Run: [Microsoft Update Machine] taskmngrs.exe
O4 - HKLM\..\Run: [WindowsRegKey update] wdnupdate.exe
O4 - HKLM\..\Run: [Microsoft Windows Update] winupdate.exe
O4 - HKLM\..\Run: [WIND0WS] WIND0WS.exe
O4 - HKLM\..\Run: [Microsoft Macro Protection Subsystem] msmac32.exe
O4 - HKLM\..\Run: [norton32] norton32.exe
O4 - HKLM\..\Run: [windows system service] winsock.exe
O4 - HKLM\..\Run: [Windows SyncroAd] C:\Program Files\Windows SyncroAd\SyncroAd.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\smc.exe -startgui
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\RunServices: [Microsoft Update Machine] taskmngrs.exe
O4 - HKLM\..\RunServices: [WindowsRegKey update] wdnupdate.exe
O4 - HKLM\..\RunServices: [Microsoft Windows Update] winupdate.exe
O4 - HKLM\..\RunServices: [WIND0WS] WIND0WS.exe
O4 - HKLM\..\RunServices: [Microsoft Macro Protection Subsystem] msmac32.exe
O4 - HKLM\..\RunServices: [norton32] norton32.exe
O4 - HKLM\..\RunServices: [windows system service] winsock.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Microsoft Update Machine] taskmngrs.exe
O4 - HKCU\..\Run: [WindowsRegKey update] wdnupdate.exe
O4 - HKCU\..\Run: [Microsoft Windows Update] winupdate.exe
O4 - HKCU\..\Run: [norton32] norton32.exe
O4 - HKCU\..\Run: [Bsol] C:\Documents and Settings\ste\Dati applicazioni\siso.exe
O4 - Startup: OpenOffice.org 1.1.0.lnk = C:\Programmi\OpenOffice.org1.1.0\program\quickstart.exe
O4 - Startup: WinMySQLadmin.lnk = C:\Programmi\Mysql\bin\winmysqladmin.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Edit with X&ML Spy - C:\Programmi\Altova\XMLSPY2004\spy.htm
O8 - Extra context menu item: Zend Studio - Debug current page - res://C:\Programmi\Zend\bin\ZendIEToolbar.dll/DebugCurrent.html
O8 - Extra context menu item: Zend Studio - Debug next page - res://C:\Programmi\Zend\bin\ZendIEToolbar.dll/DebugNext.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Edit with XML Spy - {2222EF56-F49E-4d07-A14E-8D2B08766958} - C:\Programmi\Altova\XMLSPY2004\spy.htm
O9 - Extra 'Tools' menuitem: Edit with XML Spy - {2222EF56-F49E-4d07-A14E-8D2B08766958} - C:\Programmi\Altova\XMLSPY2004\spy.htm
O9 - Extra button: Zend Studio Toolbar - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - C:\Programmi\Zend\bin\ZendIEToolbar.dll
O9 - Extra 'Tools' menuitem: Zend Studio - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - C:\Programmi\Zend\bin\ZendIEToolbar.dll
O9 - Extra button: ICQ 4.0 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programmi\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programmi\ICQLite\ICQLite.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php?bt=ie&p=457b56f779e063507365c97bc865335af6d6c9b219120c4cc62d4e5cb8c7fc2394dbd6d1bafc0fbe13f3850c9bdce745da5aae5026f2d41ad30e9d0563d93b:7474eccd86e50efc462a9b58d1ec914f
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {8B936702-C234-40D0-B69C-A2F669A33978} - http://akamai.downloadv3.com/binaries/LiveService/LiveService_7_EN_XP.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_02) -
O16 - DPF: {DB893839-10F0-4AF9-92FA-B23528F530AF} - http://deposito.hostance.net/dialer/1044238.exe

Ciao ,
esegui queste operazioni

1) Disattiva il ripristino di configurazione, leggi qui come fare
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=257&SH=N

2) riavvia in modalità provvisoria, leggi qui come fare
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=344&SH=N

apri HIJAC THIS ed elimina come indicato in questo articolo
http://www.aiutamici.com/software/descrizione.asp?CodSw=1175
le righe che seguono, (nel caso le righe da eliminare non compaiono in modalità provvisoria, eliminale dalla modalità normale e riavvia il computer).

==================================
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://test/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://test/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 1.33.77.157:6588
-
O1 - Hosts: 127.0.0.2 staging
-
O4 - HKLM\..\Run: [Microsoft Update Machine] taskmngrs.exe
O4 - HKLM\..\Run: [WindowsRegKey update] wdnupdate.exe
O4 - HKLM\..\Run: [Microsoft Windows Update] winupdate.exe
O4 - HKLM\..\Run: [WIND0WS] WIND0WS.exe
O4 - HKLM\..\Run: [Microsoft Macro Protection Subsystem] msmac32.exe
O4 - HKLM\..\Run: [norton32] norton32.exe
O4 - HKLM\..\Run: [windows system service] winsock.exe
O4 - HKLM\..\Run: [Windows SyncroAd] C:\Program Files\Windows SyncroAd\SyncroAd.exe
-
O4 - HKLM\..\RunServices: [Microsoft Update Machine] taskmngrs.exe
O4 - HKLM\..\RunServices: [WindowsRegKey update] wdnupdate.exe
O4 - HKLM\..\RunServices: [Microsoft Windows Update] winupdate.exe
O4 - HKLM\..\RunServices: [WIND0WS] WIND0WS.exe
O4 - HKLM\..\RunServices: [Microsoft Macro Protection Subsystem] msmac32.exe
O4 - HKLM\..\RunServices: [norton32] norton32.exe
O4 - HKLM\..\RunServices: [windows system service] winsock.exe
-
O4 - HKCU\..\Run: [Microsoft Update Machine] taskmngrs.exe
O4 - HKCU\..\Run: [WindowsRegKey update] wdnupdate.exe
O4 - HKCU\..\Run: [Microsoft Windows Update] winupdate.exe
O4 - HKCU\..\Run: [norton32] norton32.exe
-
O16 - DPF: {DB893839-10F0-4AF9-92FA-B23528F530AF} - http://deposito.hostance.net/dialer/1044238.exe
==================================

Con la funzione TROVA di Windows, cerca ed elimina questi file,

==================================
taskmngrs.exe
wdnupdate.exe
winupdate.exe
WIND0WS.exe
msmac32.exe
norton32.exe
winsock.exe
SyncroAd.exe
==================================

al termine utilizza i programma AD-AWARE e SPYBOT indicati in questo articolo
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=388&SH=N

sempre in modalità provvisoria fai una scansione Antivirus

quindi riavvia il computer e controlla se il problema e risolto, se e tutto OK riattiva il ripristino configurazione disattivato all'inizio di questa procedura.

---

Collaboratore Aiutamici