www.MegaLab.it

da **liverani_99** » lun lug 25, 2005 11:03 am

Vi posto qui il mio ultimo log. I problemi sono che non funzionano alcuni programmi, come i giochi e quasi tutti i programmi di office sono impazziti. Vedete qualcosa di strano?

Codice: Seleziona tutto: Logfile of HijackThis v1.99.1 Scan saved at 11.53.30, on 25/07/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Programmi\AVPersonal\AVGUARD.EXE C:\Programmi\AVPersonal\AVWUPSRV.EXE c:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe C:\Programmi\File comuni\Symantec Shared\Security Center\SymWSC.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Programmi\File comuni\Symantec Shared\Security Center\SymSCUI.exe C:\Programmi\Java\jre1.5.0\bin\jusched.exe C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Programmi\Synaptics\SynTP\SynTPLpr.exe C:\Programmi\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\System32\svchost.exe C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe C:\Programmi\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe C:\Programmi\AVPersonal\AVGNT.EXE C:\WINDOWS\system32\ctfmon.exe C:\Programmi\WIDCOMM\Software Bluetooth\BTTray.exe c:\PROGRA~1\WIDCOMM\SOFTWA~1\BTSTAC~1.EXE C:\Programmi\Pixoria\Konfabulator\Konfabulator.exe C:\WINDOWS\BricoPacks\Longhorn Inspirat\YzToolBar\YzToolBar.exe C:\Programmi\HPQ\SHARED\HPQWMI.exe C:\Programmi\Pixoria\Konfabulator\Konfabulator.exe C:\Programmi\Pixoria\Konfabulator\Konfabulator.exe C:\WINDOWS\system32\taskmgr.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\vsnpstd.exe C:\Programmi\Microsoft Office\Office\WINWORD.EXE C:\WINDOWS\msagent\AgentSvr.exe C:\Programmi\Mozilla Firefox\firefox.exe C:\Programmi\WinRAR\WinRAR.exe C:\DOCUME~1\CARLOA~1\IMPOST~1\Temp\Rar$EX00.000\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=IT_IT&c=Q105&bd=pavilion&pf=laptop R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=IT_IT&c=Q105&bd=pavilion&pf=laptop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=IT_IT&c=Q105&bd=pavilion&pf=laptop R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=IT_IT&c=Q105&bd=pavilion&pf=laptop R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0\bin\jusched.exe O4 - HKLM\..\Run: [UpdateManager] "C:\Programmi\File comuni\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Programmi\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Cpqset] C:\Programmi\HPQ\Default Settings\cpqset.exe O4 - HKLM\..\Run: [eabconfg.cpl] C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe /Start O4 - HKLM\..\Run: [hpWirelessAssistant] "%ProgramFiles%\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [AVGCtrl] "C:\Programmi\AVPersonal\AVGNT.EXE" /min O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe O4 - HKLM\..\RunOnce: [GrpConv] grpconv.exe -o O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe O4 - Startup: Konfabulator.lnk = C:\Programmi\Pixoria\Konfabulator\Konfabulator.exe O4 - Startup: Y'z Toolbar.lnk = C:\WINDOWS\BricoPacks\Longhorn Inspirat\YzToolBar\YzToolBar.exe O4 - Global Startup: BTTray.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Porta Symantec Fax Starter Edition.lnk = C:\Programmi\Microsoft Office\Office\1040\OLFSNT40.EXE O8 - Extra context menu item: Invia a &Bluetooth - c:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie_ctx.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0\bin\npjpi150.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0\bin\npjpi150.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe O12 - Plugin for .htm: C:\Programmi\Netscape\Netscape Browser\PLUGINS\npTrident.dll O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=IT_IT&c=Q105&bd=pavilion&pf=laptop O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1120475891046 O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\system32\btxppanel.dll O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programmi\AVPersonal\AVGUARD.EXE O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programmi\AVPersonal\AVWUPSRV.EXE O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - c:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Programmi\HPQ\SHARED\HPQWMI.exe O23 - Service: Servizio iPod (iPodService) - Apple Computer, Inc. - C:\Programmi\iPod\bin\iPodService.exe O23 - Service: OpenVPN Service (OpenVPNService) - Unknown owner - C:\Programmi\OpenVPN\bin\openvpnserv.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\Security Center\SymWSC.exe

da **crazy.cat** » lun lug 25, 2005 11:16 am

Prima di eliminare il file
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
prova a caricarlo su questo sito e vedi cosa ti risponde
http://www.virustotal.com/flash/index_en.html
se è un virus posta il risultato delle scansioni.

E' la terza volta in pochi giorni che arriva quel file a persone qui del forum e vorrei sapere di che virus si tratta.

da **liverani_99** » lun lug 25, 2005 12:00 pm

Codice: Seleziona tutto: AntiVir 6.31.1.0 07.25.2005 no virus found AVG 718 07.22.2005 no virus found Avira 6.31.1.0 07.25.2005 no virus found BitDefender 7.0 07.25.2005 no virus found CAT-QuickHeal 7.03 07.23.2005 no virus found ClamAV devel-20050712 07.25.2005 no virus found DrWeb 4.32b 07.25.2005 no virus found eTrust-Iris 7.1.194.0 07.23.2005 no virus found eTrust-Vet 11.9.1.0 07.25.2005 no virus found Fortinet 2.36.0.0 07.23.2005 no virus found F-Prot 3.16c 07.25.2005 no virus found Ikarus 2.32 07.22.2005 no virus found Kaspersky 4.0.2.24 07.25.2005 no virus found McAfee 4541 07.22.2005 no virus found NOD32v2 1.1176 07.22.2005 no virus found Norman 5.70.10 07.21.2005 no virus found Panda 8.02.00 07.24.2005 no virus found Sybari 7.5.1314 07.25.2005 no virus found TheHacker 5.8.2.076 07.25.2005 no virus found VBA32 3.10.4 07.24.2005 no virus found

da **crazy.cat** » lun lug 25, 2005 1:24 pm

Tasto dx sul file e cerca di capire se appartiene a qualche programma particolare.
Viene dato come processo sconosciuto in giro per google.
Decidi poi tu se eliminarlo.
Non si vedono altri problemi nel tuo log.

www.MegaLab.it

Ennesimo log di hijackthis

Ennesimo log di hijackthis

Chi c’è in linea