potreste controllarmi gentilmente il LOG di Hijack - Sicurezza VIRUS

Benvenuto Ospite

Aiutamici Forum » FORUM - Istruzioni e Guide » Sicurezza VIRUS » potreste controllarmi gentilmente il LOG di Hijack

potreste controllarmi gentilmente il LOG di Hijack

Opzioni

Topic Precedente · Topic Sucessivo

farenzi

Inviato: Monday, January 10, 2005 10:00:00 PM

Rank: Member

Iscritto dal : 10/31/2004
Posts: 13

facendo la scansione con spybot rilevo continuamente questi due problemi:

Data Source object exploit
HKEY_USERS\S-1-5-21-329068152-1580436667-854245398-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\0\1004!=W=3

Data Source Object exploit
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

Spybot non riesce a risolvere questi due problemi,apparentemente non noto niente di strano nel funzionamento del PC,però non vorrei che ci fosse comunque qualcosa che non và...di seguito allego il LOG di Hijack

Logfile of HijackThis v1.99.0
Scan saved at 21.45.21, on 10/01/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe
C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\Programmi\Netropa\Multimedia Keyboard\nhksrv.exe
C:\WINNT\system32\LEXPPS.EXE
C:\WINNT\System32\svchost.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\Programmi\Norton AntiVirus\navapsvc.exe
C:\WINNT\system32\nvsvc32.exe
C:\PROGRA~1\Alice\ALICEE~1\app\pppoeservice.exe
C:\WINNT\system32\regsvc.exe
C:\Programmi\Norton AntiVirus\SAVScan.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\Mixer.exe
C:\Programmi\Netropa\Multimedia Keyboard\MMKeybd.exe
C:\Programmi\Netropa\Onscreen Display\OSD.exe
C:\WINNT\system32\mIRC.exe
C:\WINNT\system32\msnmsgr.exe
C:\Programmi\File comuni\Symantec Shared\ccApp.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\WINNT\system32\ctfmon.exe
C:\PROGRA~1\Alice\ALICEE~1\app\EnterNet.exe
C:\Programmi\MSN Messenger\msnmsgr.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\PROGRA~1\WinZip\winzip32.exe
C:\DOCUME~1\ADMINI~1\IMPOST~1\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tiscali.it/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmi\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmi\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Programmi\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\NeroCheck.exe
O4 - HKLM\..\Run: [Start aThe Roll] enotxa2.exe
O4 - HKLM\..\Run: [Windows Compliant] oysknw.exe
O4 - HKLM\..\Run: [Start Upping] mediaplayer32.exe
O4 - HKLM\..\Run: [Go And Start] svdll32.exe
O4 - HKLM\..\Run: [mIRC Script Client] mIRC.exe
O4 - HKLM\..\Run: [Windows SDK] msnmsgr.exe
O4 - HKLM\..\Run: [Sygate Personal Firewall] Sysgates.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Programmi\File comuni\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [navapp] C:\Programmi\NavExcel\NavHelper\v2.0.4d\navapp.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\RunServices: [Start aThe Roll] enotxa2.exe
O4 - HKLM\..\RunServices: [Windows Compliant] oysknw.exe
O4 - HKLM\..\RunServices: [Start Upping] mediaplayer32.exe
O4 - HKLM\..\RunServices: [Go And Start] svdll32.exe
O4 - HKLM\..\RunServices: [mIRC Script Client] mIRC.exe
O4 - HKLM\..\RunServices: [Windows SDK] msnmsgr.exe
O4 - HKLM\..\RunServices: [Sygate Personal Firewall] Sysgates.exe
O4 - HKCU\..\Run: [Start aThe Roll] enotxa2.exe
O4 - HKCU\..\Run: [Windows Compliant] oysknw.exe
O4 - HKCU\..\Run: [Go And Start] svdll32.exe
O4 - HKCU\..\Run: [Start Upping] mediaplayer32.exe
O4 - HKCU\..\Run: [mIRC Script Client] mIRC.exe
O4 - HKCU\..\Run: [Windows SDK] msnmsgr.exe
O4 - HKCU\..\Run: [Sygate Personal Firewall] Sysgates.exe
O4 - HKCU\..\Run: [Cuckoo Clock] "C:\PROGRA~1\WARCRA~1\Cuckoo.exe"
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet
O8 - Extra context menu item: &Google Search - res://c:\programmi\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Collegamenti a ritroso - res://c:\programmi\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Pagine simili - res://c:\programmi\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Versione cache della pagina - res://c:\programmi\google\GoogleToolbar1.dll/cmcache.html
O12 - Plugin for .spop: C:\Programmi\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/SymAData.cab
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe
O23 - Service: Servizio amministrativo di Gestione disco logico - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: LexBce Server - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE
O23 - Service: Servizio Norton AntiVirus Auto-Protect - Symantec Corporation - C:\Programmi\Norton AntiVirus\navapsvc.exe
O23 - Service: Netropa NHK Server - Unknown - C:\Programmi\Netropa\Multimedia Keyboard\nhksrv.exe
O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: PPPoE Service - Unknown - C:\PROGRA~1\Alice\ALICEE~1\app\pppoeservice.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Programmi\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\FILECO~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SymWMI Service - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\Security Center\SymWSC.exe

Torna in alto

Sponsor

Inviato: Monday, January 10, 2005 10:00:00 PM

Torna in alto

alfonso

Inviato: Monday, January 10, 2005 11:33:28 PM

Rank: AiutAmico

Iscritto dal : 10/5/2000
Posts: 19,132

Ciao ,
esegui queste operazioni

riavvia in modalità provvisoria, leggi qui come fare
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=344&SH=N

apri HIJAC THIS ed elimina come indicato in questo articolo
http://www.aiutamici.com/software/descrizione.asp?CodSw=1175
le righe che seguono, (nel caso le righe da eliminare non compaiono in modalità provvisoria, eliminale dalla modalità normale e riavvia il computer).

==================================
O4 - HKLM\..\Run: [Start aThe Roll] enotxa2.exe
O4 - HKLM\..\Run: [Windows Compliant] oysknw.exe
O4 - HKLM\..\Run: [Start Upping] mediaplayer32.exe
O4 - HKLM\..\Run: [Go And Start] svdll32.exe
-
O4 - HKLM\..\Run: [Sygate Personal Firewall] Sysgates.exe
-
O4 - HKLM\..\RunServices: [Start aThe Roll] enotxa2.exe
O4 - HKLM\..\RunServices: [Windows Compliant] oysknw.exe
O4 - HKLM\..\RunServices: [Start Upping] mediaplayer32.exe
O4 - HKLM\..\RunServices: [Go And Start] svdll32.exe
-
O4 - HKLM\..\RunServices: [Sygate Personal Firewall] Sysgates.exe
O4 - HKCU\..\Run: [Start aThe Roll] enotxa2.exe
O4 - HKCU\..\Run: [Windows Compliant] oysknw.exe
O4 - HKCU\..\Run: [Go And Start] svdll32.exe
O4 - HKCU\..\Run: [Start Upping] mediaplayer32.exe
-
O4 - HKCU\..\Run: [Sygate Personal Firewall] Sysgates.exe
==================================

Con la funzione TROVA di Windows, cerca ed elimina questi file,

==================================
enotxa2.exe
oysknw.exe
mediaplayer32.exe
svdll32.exe
Sysgates.exe
==================================

al termine utilizza i programma AD-AWARE e SPYBOT indicati in questo articolo
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=388&SH=N

sempre in modalità provvisoria fai una scansione Antivirus

Per quanto riguarda Spybot, scarica questo programma per risolvere quel problema
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=1159

Edited by - alfonso on 01/10/2005 23:34:17

Collaboratore Aiutamici

Torna in alto

farenzi

Inviato: Wednesday, January 12, 2005 4:56:33 PM

Rank: Member

Iscritto dal : 10/31/2004
Posts: 13

Grazie...ho seguito i tuoi consigli...dei file da eliminare però,sono riuscito a trovare solo "oysknw.exe" degli altri non c'è traccia,è possibile una cosa del genere?<BLOCKQUOTE id=quote>quote:<hr height=1 noshade id=quote>
Ciao ,
esegui queste operazioni

riavvia in modalità provvisoria, leggi qui come fare
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=344&SH=N

apri HIJAC THIS ed elimina come indicato in questo articolo
http://www.aiutamici.com/software/descrizione.asp?CodSw=1175
le righe che seguono, (nel caso le righe da eliminare non compaiono in modalità provvisoria, eliminale dalla modalità normale e riavvia il computer).

==================================
O4 - HKLM\..\Run: [Start aThe Roll] enotxa2.exe
O4 - HKLM\..\Run: [Windows Compliant] oysknw.exe
O4 - HKLM\..\Run: [Start Upping] mediaplayer32.exe
O4 - HKLM\..\Run: [Go And Start] svdll32.exe
-
O4 - HKLM\..\Run: [Sygate Personal Firewall] Sysgates.exe
-
O4 - HKLM\..\RunServices: [Start aThe Roll] enotxa2.exe
O4 - HKLM\..\RunServices: [Windows Compliant] oysknw.exe
O4 - HKLM\..\RunServices: [Start Upping] mediaplayer32.exe
O4 - HKLM\..\RunServices: [Go And Start] svdll32.exe
-
O4 - HKLM\..\RunServices: [Sygate Personal Firewall] Sysgates.exe
O4 - HKCU\..\Run: [Start aThe Roll] enotxa2.exe
O4 - HKCU\..\Run: [Windows Compliant] oysknw.exe
O4 - HKCU\..\Run: [Go And Start] svdll32.exe
O4 - HKCU\..\Run: [Start Upping] mediaplayer32.exe
-
O4 - HKCU\..\Run: [Sygate Personal Firewall] Sysgates.exe
==================================

Con la funzione TROVA di Windows, cerca ed elimina questi file,

==================================
enotxa2.exe
oysknw.exe
mediaplayer32.exe
svdll32.exe
Sysgates.exe
==================================

al termine utilizza i programma AD-AWARE e SPYBOT indicati in questo articolo
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=388&SH=N

sempre in modalità provvisoria fai una scansione Antivirus

Per quanto riguarda Spybot, scarica questo programma per risolvere quel problema
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=1159

Edited by - alfonso on 01/10/2005 23:34:17
<hr height=1 noshade id=quote></BLOCKQUOTE id=quote>

Torna in alto

farenzi

Inviato: Wednesday, January 12, 2005 4:57:02 PM

Rank: Member

Iscritto dal : 10/31/2004
Posts: 13

Torna in alto

farenzi

Inviato: Wednesday, January 12, 2005 4:58:36 PM

Rank: Member

Iscritto dal : 10/31/2004
Posts: 13

<BLOCKQUOTE id=quote>quote:<hr height=1 noshade id=quote>
facendo la scansione con spybot rilevo continuamente questi due problemi:

Data Source object exploit
HKEY_USERS\S-1-5-21-329068152-1580436667-854245398-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\0\1004!=W=3

Data Source Object exploit
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

Spybot non riesce a risolvere questi due problemi,apparentemente non noto niente di strano nel funzionamento del PC,però non vorrei che ci fosse comunque qualcosa che non và...di seguito allego il LOG di Hijack

Logfile of HijackThis v1.99.0
Scan saved at 21.45.21, on 10/01/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe
C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\Programmi\Netropa\Multimedia Keyboard\nhksrv.exe
C:\WINNT\system32\LEXPPS.EXE
C:\WINNT\System32\svchost.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\Programmi\Norton AntiVirus\navapsvc.exe
C:\WINNT\system32\nvsvc32.exe
C:\PROGRA~1\Alice\ALICEE~1\app\pppoeservice.exe
C:\WINNT\system32\regsvc.exe
C:\Programmi\Norton AntiVirus\SAVScan.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\Mixer.exe
C:\Programmi\Netropa\Multimedia Keyboard\MMKeybd.exe
C:\Programmi\Netropa\Onscreen Display\OSD.exe
C:\WINNT\system32\mIRC.exe
C:\WINNT\system32\msnmsgr.exe
C:\Programmi\File comuni\Symantec Shared\ccApp.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\WINNT\system32\ctfmon.exe
C:\PROGRA~1\Alice\ALICEE~1\app\EnterNet.exe
C:\Programmi\MSN Messenger\msnmsgr.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\PROGRA~1\WinZip\winzip32.exe
C:\DOCUME~1\ADMINI~1\IMPOST~1\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tiscali.it/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmi\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmi\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Programmi\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\NeroCheck.exe
O4 - HKLM\..\Run: [Start aThe Roll] enotxa2.exe
O4 - HKLM\..\Run: [Windows Compliant] oysknw.exe
O4 - HKLM\..\Run: [Start Upping] mediaplayer32.exe
O4 - HKLM\..\Run: [Go And Start] svdll32.exe
O4 - HKLM\..\Run: [mIRC Script Client] mIRC.exe
O4 - HKLM\..\Run: [Windows SDK] msnmsgr.exe
O4 - HKLM\..\Run: [Sygate Personal Firewall] Sysgates.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Programmi\File comuni\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [navapp] C:\Programmi\NavExcel\NavHelper\v2.0.4d\navapp.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\RunServices: [Start aThe Roll] enotxa2.exe
O4 - HKLM\..\RunServices: [Windows Compliant] oysknw.exe
O4 - HKLM\..\RunServices: [Start Upping] mediaplayer32.exe
O4 - HKLM\..\RunServices: [Go And Start] svdll32.exe
O4 - HKLM\..\RunServices: [mIRC Script Client] mIRC.exe
O4 - HKLM\..\RunServices: [Windows SDK] msnmsgr.exe
O4 - HKLM\..\RunServices: [Sygate Personal Firewall] Sysgates.exe
O4 - HKCU\..\Run: [Start aThe Roll] enotxa2.exe
O4 - HKCU\..\Run: [Windows Compliant] oysknw.exe
O4 - HKCU\..\Run: [Go And Start] svdll32.exe
O4 - HKCU\..\Run: [Start Upping] mediaplayer32.exe
O4 - HKCU\..\Run: [mIRC Script Client] mIRC.exe
O4 - HKCU\..\Run: [Windows SDK] msnmsgr.exe
O4 - HKCU\..\Run: [Sygate Personal Firewall] Sysgates.exe
O4 - HKCU\..\Run: [Cuckoo Clock] "C:\PROGRA~1\WARCRA~1\Cuckoo.exe"
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet
O8 - Extra context menu item: &Google Search - res://c:\programmi\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Collegamenti a ritroso - res://c:\programmi\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Pagine simili - res://c:\programmi\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Versione cache della pagina - res://c:\programmi\google\GoogleToolbar1.dll/cmcache.html
O12 - Plugin for .spop: C:\Programmi\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/SymAData.cab
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe
O23 - Service: Servizio amministrativo di Gestione disco logico - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: LexBce Server - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE
O23 - Service: Servizio Norton AntiVirus Auto-Protect - Symantec Corporation - C:\Programmi\Norton AntiVirus\navapsvc.exe
O23 - Service: Netropa NHK Server - Unknown - C:\Programmi\Netropa\Multimedia Keyboard\nhksrv.exe
O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: PPPoE Service - Unknown - C:\PROGRA~1\Alice\ALICEE~1\app\pppoeservice.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Programmi\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\FILECO~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SymWMI Service - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\Security Center\SymWSC.exe

<hr height=1 noshade id=quote></BLOCKQUOTE id=quote>

Torna in alto

alfonso

Inviato: Wednesday, January 12, 2005 10:42:50 PM

Rank: AiutAmico

Iscritto dal : 10/5/2000
Posts: 19,132

Se non hai trovato i file da eliminare non e un problema.

Se non hai risolto il problema inserisci un nuovo log.

Collaboratore Aiutamici

Torna in alto

Utenti presenti in questo topic

Guest

Aiutamici Forum » FORUM - Istruzioni e Guide » Sicurezza VIRUS » potreste controllarmi gentilmente il LOG di Hijack

Salta al Forum

Aggiunta nuovi Topic disabilitata in questo forum.
Risposte disabilitate in questo forum.
Eliminazione tuoi Post disabilitata in questo forum.
Modifica dei tuoi post disabilitata in questo forum.
Creazione Sondaggi disabilitata in questo forum.
Voto ai sondaggi disabilitato in questo forum.

Invia topic via Email

RSS Feed

Watch this topic

Stampa topic

Normale

Threaded