Aiutamici Forum
Benvenuto Ospite Cerca | Topic Attivi | Utenti | | Log In | Registra

alfonso mi controlli log per amica......grazie Opzioni
alexlife
Inviato: Friday, April 15, 2005 1:15:58 AM
Rank: Member

Iscritto dal : 7/1/2004
Posts: 10
Logfile of HijackThis v1.99.1
Scan saved at 0.45.28, on 15/04/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\Sarah\System32\smss.exe
C:\Sarah\SYSTEM32\winlogon.exe
C:\Sarah\system32\services.exe
C:\Sarah\system32\lsass.exe
C:\Sarah\system32\svchost.exe
C:\Sarah\System32\svchost.exe
C:\Sarah\system32\spoolsv.exe
C:\Sarah\Explorer.EXE
C:\Program Files\Media Access\MediaAccK.exe
C:\Sarah\System32\LVCOMSX.EXE
C:\Programmi\Logitech\Video\LogiTray.exe
C:\Programmi\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Media Access\MediaAccess.exe
C:\Sarah\Mixer.exe
C:\Sarah\System32\ctfmon.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\MSN Messenger\MsnMsgr.Exe
C:\Programmi\Logitech\Video\FxSvr2.exe
C:\Sarah\System32\SCardClnt.exe
C:\Sarah\System32\svchost.exe
C:\Programmi\ESET\nod32.exe
C:\Documents and Settings\sarah\Impostazioni locali\Temp\Directory temporanea 1 per hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://wiki.sl.to/?m=abcandt=andu=http::2F:2Fwww.google.it:2Fandx=539E1B04-C77C-488A-B879-9F8BCF0A6C16
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
F3 - REG:win.ini: run=
F2 - REG:system.ini: UserInit=C:\SICI\System32\userinit.exe
O2 - BHO: (no name) - {4D2759DE-D6C9-447D-88A3-145CF0F22FAD} - C:\Sarah\System32\msxmlr32.dll
O3 - Toolbar: andRadio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\Sarah\System32\msdxm.ocx
O3 - Toolbar: (no name) - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - (no file)
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\Sarah\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Programmi\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Programmi\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programmi\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [InstaFinderK] C:\Programmi\INSTAFINK\InstaFinderK_inst.exe
O4 - HKLM\..\Run: [KernelFaultCheck] :systemroot:\system32\dumprep 0 -k
O4 - HKLM\..\Run: [nod32kui] "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\Sarah\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] C:\Programmi\Logitech\Video\ManifestEngine.exe boot
O4 - HKCU\..\RunServices: [CSCRS Value] cscrs.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Sarah\web\related.htm
O9 - Extra 'Tools' menuitem: Show andRelated Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Sarah\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\MSMSGS.EXE
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O16 - DPF: {00000000-7777-0704-0B53-2C8830E9FAEC} - http://20041115.download-1.de/cab/axload.cab
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/6247971CanadaInc/ie/bridge-c267.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {E6A3C1E2-F792-483E-9133-596215172BE9} (AcceptLang Class) - http://runonce.msn.com/setacceptlang.cab
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\Sarah\System32\hwclock.exe (file missing)
O23 - Service: iTunes Music Service (iTunesMusic) - Unknown owner - C:\Sarah\iTunesMusic.exe (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Unknown owner - C:\Programmi\Eset\nod32krn.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Programmi\File comuni\Panda Software\PavShld\pavprsrv.exe (file missing)
O23 - Service: Smart Card Client (SCardClnt) - Unknown owner - C:\Sarah\System32\SCardClnt.exe



Edited by - alexlife on 04/15/2005 01:27:50
Sponsor
Inviato: Friday, April 15, 2005 1:15:58 AM

 
alfonso
Inviato: Friday, April 15, 2005 10:59:13 AM

Rank: AiutAmico

Iscritto dal : 10/5/2000
Posts: 19,132
Ciao ,
esegui queste operazioni

1) Disattiva il ripristino di configurazione, leggi qui come fare
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=257&SH=N

2) riavvia in modalità provvisoria, leggi qui come fare
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=344&SH=N

apri HIJAC THIS ed elimina come indicato in questo articolo
http://www.aiutamici.com/software/descrizione.asp?CodSw=1175
le righe che seguono, (nel caso le righe da eliminare non compaiono in modalità provvisoria, eliminale dalla modalità normale e riavvia il computer).

==================================
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.it:2Fandx=539E1B04-C77C-488A-B879-9F8BCF0A6C16" target="_blank">http://wiki.sl.to/?m=abcandt=andu=http::2F:2Fwww.google.it:2Fandx=539E1B04-C77C-488A-B879-9F8BCF0A6C16
-
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
F3 - REG:win.ini: run=
F2 - REG:system.ini: UserInit=C:\SICI\System32\userinit.exe
O2 - BHO: (no name) - {4D2759DE-D6C9-447D-88A3-145CF0F22FAD} - C:\Sarah\System32\msxmlr32.dll
-
O3 - Toolbar: (no name) - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - (no file)
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
-
O4 - HKLM\..\Run: [InstaFinderK] C:\Programmi\INSTAFINK\InstaFinderK_inst.exe
-
O4 - HKCU\..\RunServices: [CSCRS Value] cscrs.exe
-
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O16 - DPF: {00000000-7777-0704-0B53-2C8830E9FAEC} - http://20041115.download-1.de/cab/axload.cab
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/6247971CanadaInc/ie/bridge-c267.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
-
O16 - DPF: {E6A3C1E2-F792-483E-9133-596215172BE9} (AcceptLang Class) - http://runonce.msn.com/setacceptlang.cab
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\Sarah\System32\hwclock.exe (file missing)
O23 - Service: iTunes Music Service (iTunesMusic) - Unknown owner - C:\Sarah\iTunesMusic.exe (file missing)
-
O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Programmi\File comuni\Panda Software\PavShld\pavprsrv.exe (file missing)
==================================

Con la funzione TROVA di Windows, cerca ed elimina questi file,

==================================
msxmlr32.dll
MediaAccK.exe
InstaFinderK_inst.exe
cscrs.exe
hwclock.exe
==================================

al termine utilizza i programmi AD-AWARE e SPYBOT indicati in questo articolo
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=388&SH=N

sempre in modalità provvisoria fai una scansione Antivirus

quindi riavvia il computer e controlla se il problema e risolto, se e tutto OK riattiva il ripristino configurazione disattivato all'inizio di questa procedura.

Collaboratore Aiutamici
Utenti presenti in questo topic
Guest


Salta al Forum
Aggiunta nuovi Topic disabilitata in questo forum.
Risposte disabilitate in questo forum.
Eliminazione tuoi Post disabilitata in questo forum.
Modifica dei tuoi post disabilitata in questo forum.
Creazione Sondaggi disabilitata in questo forum.
Voto ai sondaggi disabilitato in questo forum.

Main Forum RSS : RSS

Aiutamici Theme
Powered by Yet Another Forum.net versione 1.9.1.8 (NET v2.0) - 3/29/2008
Copyright © 2003-2008 Yet Another Forum.net. All rights reserved.