log HijackThis

[thomas]

Come odio i pc con windows... come odio chi mi chiama quando c'è qualcosa che non va...

Ho già tirato via l'evidente, ma controllatemi per favore se manca qualcosa

Logfile of HijackThis v1.99.1
Scan saved at 12.32.57, on 06/03/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\llssrv.exe
C:\WINNT\system32\ntfrs.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\snmp.exe
C:\WINNT\system32\stisvc.exe
C:\Programmi\TapeWare\TWWINSDR.EXE
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\wins.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\tcpsvcs.exe
C:\WINNT\System32\dns.exe
C:\WINNT\system32\msdtc.exe
C:\WINNT\system32\Dfssvc.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Programmi\Java\jre1.5.0_10\bin\jusched.exe
C:\Programmi\QuickTime\qttask.exe
C:\Programmi\Google\Google Desktop Search\GoogleDesktop.exe
C:\Programmi\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Programmi\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Programmi\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Programmi\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Exif Launcher\QuickDCF.exe
C:\Programmi\CASIO\Photo Loader\Plauto.exe
C:\Programmi\PC Connectivity Solution\ServiceLayer.exe
C:\Programmi\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\WINNT\system32\wuauclt.exe
C:\Programmi\File comuni\Nokia\MPAPI\MPAPI3s.exe
C:\Programmi\Java\jre1.5.0_10\bin\jucheck.exe
C:\WINNT\system32\svchost.exe
C:\Documents and Settings\prova\Impostazioni locali\Temp\IOControl.exe
C:\Documents and Settings\prova\Impostazioni locali\Temporary Internet Files\Content.IE5\ATA5UTG7\porno[1].exe
C:\PROGRA~1\MICROS~3\OFFICE11\OUTLOOK.EXE
C:\ACUCBL31\bin\wrun32.exe
C:\Documents and Settings\prova\Dati applicazioni\faretoraci\sysvmtrs.exe
C:\Documents and Settings\prova\Desktop\Thomas\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Programmi\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar4.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar4.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [REGSHAVE] C:\Progra~1\REGSHAVE\REGSHAVE.EXE /autorun
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Programmi\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Programmi\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [Systems] C:\WINNT\system32\sysmon.exe
O4 - HKLM\..\Run: [euoai] C:\Documents and Settings\prova\Dati applicazioni\faretoraci\sysvmtrs.exe
O4 - HKCU\..\Run: [PcSync] C:\Programmi\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\Exif Launcher\QuickDCF.exe
O4 - Global Startup: Photo Loader residente.lnk = C:\Programmi\CASIO\Photo Loader\Plauto.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O15 - Trusted Zone: www.adslconnection.name
O15 - Trusted Zone: www.archiviosex.net
O15 - Trusted Zone: www.contentdiscount.info
O15 - Trusted Zone: www.extremeaccess.info
O15 - Trusted Zone: www.softlab.name
O15 - Trusted Zone: www.xxx-content.name
O15 - Trusted Zone: *.“›‚Ÿ”‚ÿÕ‹÷“‰„‚¢ó◊‘’À”ÓÓÙ
O15 - Trusted Zone: *.›ÏÊ◊““∆ƒ∆»ÿÊ°ó◊‘’À”ÓÓÙ
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 8245052468
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\TempEI4\EI40_\msxml4.cab
O16 - DPF: {8C875948-9C60-4381-9248-0DF180542D53} - http://installs.hotbar.com/installs/hbt ... btools.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game04.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {CEF3AA94-1B8A-4FDC-91A6-77CBE2981BD2} (diAuthClientWC.AuthClient) - http://www.servizi.comune.parma.it/sso/ ... ientWC.CAB
O16 - DPF: {FFFF0003-0001-101A-A3C9-08002B2F49FB} - http://www.softlab.name/rnd_soft.php
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = pifonet.local
O17 - HKLM\System\CCS\Services\Tcpip\..\{268CEC31-5518-445C-B20A-2AB7B336C9D2}: NameServer = 212.216.112.112
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = pifonet.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = pifonet.local
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: Commander Service - Seagull Scientific, Inc - C:\Programmi\Seagull\BarTender\7.72\CmdrSrv.exe
O23 - Service: Servizio amministrativo di Gestione disco logico (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programmi\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TapeWare - Unknown owner - C:\Programmi\TapeWare\TWWINSDR.EXE

[crazy.cat]

Questo lo conosci?
C:\ACUCBL31\bin\wrun32.exe

Da quanto non vedevo il winmovie plugin dialer.
Cancella righe e file indicati.
Vedo anche un Hotbar, se in Ie ha barre e icone strane lo puoi ripulire con una scansione di A2 squared, che è meglio se la fai perché ha scaricato anche vari dialer.
Pulisci i temp e i temporanei di internet con ccleaner

C:\Documents and Settings\prova\Impostazioni locali\Temp\IOControl.exe
C:\Documents and Settings\prova\Impostazioni locali\Temporary Internet Files\Content.IE5\ATA5UTG7\porno[1].exe
C:\Documents and Settings\prova\Dati applicazioni\faretoraci\sysvmtrs.exe
O4 - HKLM\..\Run: [Systems] C:\WINNT\system32\sysmon.exe
O4 - HKLM\..\Run: [euoai] C:\Documents and Settings\prova\Dati applicazioni\faretoraci\sysvmtrs.exe
O15 - Trusted Zone: www.adslconnection.name
O15 - Trusted Zone: www.archiviosex.net
O15 - Trusted Zone: www.contentdiscount.info
O15 - Trusted Zone: www.extremeaccess.info
O15 - Trusted Zone: www.softlab.name
O15 - Trusted Zone: www.xxx-content.name
O15 - Trusted Zone: *.“›‚Ÿ”‚ÿÕ‹÷“‰„‚¢ó◊‘’À”ÓÓÙ
O15 - Trusted Zone: *.›ÏÊ◊““∆ƒ∆»ÿÊ°ó◊‘’À”ÓÓÙ
O16 - DPF: {8C875948-9C60-4381-9248-0DF180542D53} - http://installs.hotbar.com/installs/hbt ... btools.cab
O16 - DPF: {FFFF0003-0001-101A-A3C9-08002B2F49FB} - http://www.softlab.name/rnd_soft.php

[thomas]

Questo lo conosci?
C:\ACUCBL31\bin\wrun32.exe

si si

Cancella righe e file indicati.

ok, me ne erano scappate solo due.

grazie mille marco