Punto informatico Network
Login Esegui login | Non sei registrato? Iscriviti ora (è gratuito!)
Username: Password:
  • Annuncio Pubblicitario

Hijackthis e gmer

Un virus si è intromesso nel tuo computer? Vuoi navigare in tutta sicurezza? Sono sicure le transazione online? Come impedire a malintenzionati di intromettersi nel tuo pc? Come proteggere i tuoi dati? Qui trovi le risposte a queste ed altre domande

Hijackthis e gmer

Messaggioda francescosurya » mar gen 01, 2008 10:21 pm

Posto hijackthis e gmer, perché ritengo che il mio portatile sia un po' "sporco", l'ho comprato il 26, e qualche volta, per sbaglio navigavo senza firewall.
Con Antivir, ho trovato 2 virus, e con hijackthis, ci sono due voci con la X nel sito del log.

Hijackthis:
Logfile of HijackThis v1.99.1
Scan saved at 20.42.27, on 01/01/2008
Platform: Unknown Windows (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16386)

Running processes:
C:\Windows\system32\Dwm.exe
c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Avira antivir\Avira\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Windows\system32\wuauclt.exe
C:\Users\Francesco\Desktop\SICUREZZA\hijacker\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE= ... &pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE= ... &pf=laptop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~3\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: VeriSoft Access Manager - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - c:\Program Files\Bioscrypt\VeriSoft\Bin\ItIEAddIn.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe c:\PROGRA~1\BIOSCR~1\VeriSoft\Bin\ASTSVCC.dll,RegisterModule
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira antivir\Avira\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe"
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: I&nvia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~3\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~3\SPYBOT~1\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{13A9A695-552C-4497-B5BF-0564C8363537}: NameServer = 212.216.112.112,212.216.172.62
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - AppInit_DLLs: APSHook.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira antivir\Avira\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira antivir\Avira\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @gpapi.dll,-112 (gpsvc) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Programmi\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)
W ANNASOPHIA ROBB
Avatar utente
francescosurya
Senior Member
Senior Member
 
Messaggi: 180
Iscritto il: mer lug 25, 2007 1:15 pm
Località: Vicenza

Messaggioda crazy.cat » mer gen 02, 2008 3:20 pm

Ho accorciato il log chilometrico, tanto non c'era niente di pericoloso.

Quali voci ti verrebbero segnate come "cattive"?
L'analisi automatica dei log è spesso molto fantasiosa.
Quando i molti governano, pensano solo a contentar sé stessi, si ha allora la tirannia più balorda e più odiosa: la tirannia mascherata da libertà.
Avatar utente
crazy.cat
MLI Hero
MLI Hero
 
Messaggi: 30959
Iscritto il: lun gen 12, 2004 1:38 pm
Località: Mestre

Voci "cattive"

Messaggioda francescosurya » mer gen 02, 2008 8:50 pm

quste sono le voci "cattive":


1) O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
mi dice anche su questa voce: Da eliminare! Spyware component related to DownloadWare and found in Program FilesKFH
Il voto dei visitatori è : Neutral


2) O23 - Service: @gpapi.dll,-112 (gpsvc) - Unknown owner - %windir%\system32\svchost.exe (file missing)
di questa mi dice: Fuzzy Algorithmcheck (2.85 / 5.00), Forse sospetto
Il voto dei visitatori è: Davvero SIcuro
W ANNASOPHIA ROBB
Avatar utente
francescosurya
Senior Member
Senior Member
 
Messaggi: 180
Iscritto il: mer lug 25, 2007 1:15 pm
Località: Vicenza


Messaggioda BilloKenobi » gio gen 03, 2008 12:23 am

il primo ha un nome troppo generico per controllarlo sui database. fai così, caricalo su www.virustotal.com per vedere cosa dicono i trenta e passa antivirus disponibili

per quanto riguarda la seconda voce, è pulita. suppongo che il tuo pc sia un vista, che hijackthis 1.99.1 non supporta. se farai lo scan con la 2.0.2 vedrai che probabilmente non comparirà nemmeno quella voce

[:)]
Begun the Clone War has
Avatar utente
BilloKenobi
Senior Member
Senior Member
 
Messaggi: 453
Iscritto il: gio ago 10, 2006 11:06 am

Messaggioda francescosurya » lun gen 07, 2008 7:38 pm

BilloKenobi ha scritto:il primo ha un nome troppo generico per controllarlo sui database. fai così, caricalo su www.virustotal.com per vedere cosa dicono i trenta e passa antivirus disponibili

per quanto riguarda la seconda voce, è pulita. suppongo che il tuo pc sia un vista, che hijackthis 1.99.1 non supporta. se farai lo scan con la 2.0.2 vedrai che probabilmente non comparirà nemmeno quella voce

[:)]


Su virus total ci mette molto tempo ad uploadarmelo, e poi nn mi da risultati.....

Si il mio PC è un VIsta!!!!





Ora, siccome col fisso ho qualche problemuccio posto hijackthis e gmer del fisso!!!!!!!!!
Praticamente, ho un dual boot (XP e Vista) e quando apro Xp, viene fuori la finestra di caricamento di Xp, poi diventa nero (questo succede sempre) e a volte:
(1 mi carica tutto alla perfezione,
2) ed altre volte rimane la schermata nera(senza caricare nulla) ...... io devo resettare...... dopo il reset, di solito carica normalmente ma alcune volte mi rissuccede la schermata nera con il blocco e mi tocca riresettare, e alla terza volta va!
(molto + spesso mi succede la seconda opzione)

Posto hijackthis e gmer in un altro post, se no questo diviene kilometrico
W ANNASOPHIA ROBB
Avatar utente
francescosurya
Senior Member
Senior Member
 
Messaggi: 180
Iscritto il: mer lug 25, 2007 1:15 pm
Località: Vicenza

hijackthis

Messaggioda francescosurya » lun gen 07, 2008 7:47 pm

SE QUALCUNO VUOLE ACCORCIARE IL LOG FACCIA PURE!!!

Logfile of HijackThis v1.99.1

Scan saved at 19.48.49, on 07/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\File comuni\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\RunDLL32.exe
D:\Programmi\Nero 8\InCD\NBHGui.exe
D:\Programmi\Nero 8\InCD\InCD.exe
D:\Programmi\Norton Ghost\Agent\VProTray.exe
C:\Programmi\File comuni\LogiShrd\LComMgr\Communications_Helper.exe
D:\Programmi\Logitech\QuickCam\Quickcam.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\File comuni\Nokia\Tools\NclTray.exe
C:\Programmi\File comuni\PCSuite\DataLayer\DataLayer.exe
D:\Programmi\iTunes\iTunesHelper.exe
C:\PROGRA~1\FILECO~1\PCSuite\Services\SERVIC~1.EXE
D:\Programmi\avira premium\Avira\AntiVir PersonalEdition Premium\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
C:\Programmi\File comuni\Nero\Lib\NMBgMonitor.exe
D:\Programmi\Nokia\PC Suite for N-Gage QD\connmngmntbox.exe
D:\Programmi\Nokia\PC Suite for N-Gage QD\ectaskscheduler.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
D:\Programmi\Nero 8\InCD\InCDsrv.exe
D:\PROGRA~1\Nokia\PCSUIT~1\Elogerr.exe
C:\Programmi\File comuni\LogiShrd\LVCOMSER\LVComSer.exe
C:\Programmi\Intuwave\Shared\mRouterRunTime\mRouterRuntime.exe
D:\Programmi\Nero 8\Nero BackItUp\NBService.exe
D:\PROGRA~1\Nokia\PCSUIT~1\BROADC~1.EXE
D:\PROGRA~1\Nokia\PCSUIT~1\SCRFS.exe
D:\Programmi\Norton Ghost\Agent\VProSvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\File comuni\Nero\Lib\NMIndexingService.exe
C:\Programmi\File comuni\LogiShrd\LVCOMSER\LVComSer.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\Programmi\File comuni\Nero\Lib\NMIndexStoreSvr.exe
C:\Programmi\File comuni\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Francesco\Desktop\SICUREZZA\AntirootKit Gmer\gmer.exe
D:\Programmi\Spybot - Search & Destroy\SpybotSD.exe
C:\Documents and Settings\Francesco\Desktop\SICUREZZA\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PD0620 STISvc] RunDLL32.exe P0620Pin.dll,RunDLL32EP 513
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmi\File comuni\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SecurDisc] D:\Programmi\Nero 8\InCD\NBHGui.exe
O4 - HKLM\..\Run: [InCD] D:\Programmi\Nero 8\InCD\InCD.exe
O4 - HKLM\..\Run: [NBKeyScan] "D:\Programmi\Nero 8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Norton Ghost 12.0] "D:\Programmi\Norton Ghost\Agent\VProTray.exe"
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Programmi\File comuni\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "D:\Programmi\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Nokia Tray Application] C:\Programmi\File comuni\Nokia\Tools\NclTray.exe
O4 - HKLM\..\Run: [DataLayer] C:\Programmi\File comuni\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [iTunesHelper] "D:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [avgnt] "D:\Programmi\avira premium\Avira\AntiVir PersonalEdition Premium\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - Startup: The Matrix_ Path of Neo Registration.lnk = C:\Documents and Settings\Francesco\Impostazioni locali\Temp\{EDECCB44-8E5F-4FCC-B3B4-8600D22D33C3}\{E571E8B1-9771-465D-9DE0-3BA2D1BDAE99}\ATR1.exe
O4 - Global Startup: PCSuiteperNokiaN-Gage QD Detect.lnk = ?
O4 - Global Startup: PCSuiteperNokiaN-Gage QD TS.lnk = ?
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - D:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 5637493000
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 8851728828
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} -
O17 - HKLM\System\CCS\Services\Tcpip\..\{664AA16B-B344-4405-8C1B-AA86DB40A243}: NameServer = 212.216.112.112,212.216.172.62
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - D:\Programmi\Nero 8\InCD\InCDsrv.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Programmi\File comuni\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Programmi\File comuni\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Programmi\File comuni\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - D:\Programmi\Nero 8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programmi\File comuni\Nero\Lib\NMIndexingService.exe
O23 - Service: Norton Ghost - Symantec Corporation - D:\Programmi\Norton Ghost\Agent\VProSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe






GMER
GMER 1.0.13.12551 - http://www.gmer.net
Rootkit scan 2008-01-07 19:53:57
Windows 5.1.2600 Service Pack 2


---- System - GMER 1.0.13 ----

SSDT sptd.sys ZwCreateKey
SSDT sptd.sys ZwEnumerateKey
SSDT sptd.sys ZwEnumerateValueKey
SSDT sptd.sys ZwOpenKey
SSDT sptd.sys ZwQueryKey
SSDT sptd.sys ZwQueryValueKey
SSDT sptd.sys ZwSetValueKey

---- Kernel code sections - GMER 1.0.13 ----

? C:\WINDOWS\system32\drivers\sptd.sys Impossibile accedere al file. Il file è utilizzato da un altro processo.
? C:\WINDOWS\System32\Drivers\SPTD0749.SYS Impossibile accedere al file. Il file è utilizzato da un altro processo.
? C:\WINDOWS\System32\Drivers\dtscsi.sys Impossibile accedere al file. Il file è utilizzato da un altro processo.

---- User code sections - GMER 1.0.13 ----

.text C:\Programmi\Internet Explorer\iexplore.exe[2644] USER32.dll!DialogBoxParamW 7E3A555F 5 Bytes JMP 435FF2C1 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Programmi\Internet Explorer\iexplore.exe[2644] USER32.dll!DialogBoxIndirectParamW 7E3B2032 5 Bytes JMP 4379166F C:\WINDOWS\system32\IEFRAME.dll
.text C:\Programmi\Internet Explorer\iexplore.exe[2644] USER32.dll!MessageBoxIndirectA 7E3BA04A 5 Bytes JMP 437915F0 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Programmi\Internet Explorer\iexplore.exe[2644] USER32.dll!DialogBoxParamA 7E3BB10C 5 Bytes JMP 43791634 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Programmi\Internet Explorer\iexplore.exe[2644] USER32.dll!MessageBoxExW 7E3D05D8 5 Bytes JMP 4379157C C:\WINDOWS\system32\IEFRAME.dll
.text C:\Programmi\Internet Explorer\iexplore.exe[2644] USER32.dll!MessageBoxExA 7E3D05FC 5 Bytes JMP 437915B6 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Programmi\Internet Explorer\iexplore.exe[2644] USER32.dll!DialogBoxIndirectParamA 7E3D6B50 5 Bytes JMP 437916AA C:\WINDOWS\system32\IEFRAME.dll
.text C:\Programmi\Internet Explorer\iexplore.exe[2644] USER32.dll!MessageBoxIndirectW 7E3E62AB 5 Bytes JMP 43621676 C:\WINDOWS\system32\IEFRAME.dll

---- Kernel IAT/EAT - GMER 1.0.13 ----

IAT pci.sys[ntoskrnl.exe!IoDetachDevice] [F751189E] sptd.sys
IAT pci.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F7527D86] sptd.sys
IAT ftdisk.sys[ntoskrnl.exe!IoGetAttachedDeviceReference] [F7511E24] sptd.sys
IAT ftdisk.sys[ntoskrnl.exe!IoGetDeviceObjectPointer] [F7511D28] sptd.sys
IAT ftdisk.sys[ntoskrnl.exe!IofCallDriver] [F7511EF4] sptd.sys
IAT dmio.sys[ntoskrnl.exe!IofCallDriver] [F7511EF4] sptd.sys
IAT dmio.sys[ntoskrnl.exe!IoGetAttachedDeviceReference] [F7511E24] sptd.sys
IAT dmio.sys[ntoskrnl.exe!IoGetDeviceObjectPointer] [F7511D28] sptd.sys
IAT PartMgr.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F75271AE] sptd.sys
IAT PartMgr.sys[ntoskrnl.exe!IoDetachDevice] [F7511A5A] sptd.sys
IAT atapi.sys[ntoskrnl.exe!IofCompleteRequest] [F752704A] sptd.sys
IAT atapi.sys[ntoskrnl.exe!IoConnectInterrupt] [F75118F2] sptd.sys
IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [F7504AD2] sptd.sys
IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [F7504C0E] sptd.sys
IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [F7504B96] sptd.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [F750576C] sptd.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [F7505642] sptd.sys
IAT disk.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F7527E4A] sptd.sys
IAT \WINDOWS\System32\DRIVERS\CLASSPNP.SYS[ntoskrnl.exe!IoDetachDevice] [F75168C6] sptd.sys
IAT \SystemRoot\System32\DRIVERS\USBPORT.SYS[ntoskrnl.exe!IofCompleteRequest] [F752704A] sptd.sys
IAT \SystemRoot\System32\DRIVERS\cdrom.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F7527E4A] sptd.sys
IAT \SystemRoot\System32\DRIVERS\rdbss.sys[ntoskrnl.exe!IofCallDriver] [F7511CC6] sptd.sys
IAT \SystemRoot\System32\DRIVERS\mrxsmb.sys[ntoskrnl.exe!IofCallDriver] [F7511CC6] sptd.sys

---- User IAT/EAT - GMER 1.0.13 ----

IAT D:\Programmi\Logitech\QuickCam\Quickcam.exe[344] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [01DA2F30] C:\Programmi\File comuni\Logishrd\LVMVFM\LVPrcInj.dll
IAT D:\Programmi\Logitech\QuickCam\Quickcam.exe[344] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [01DA2CA0] C:\Programmi\File comuni\Logishrd\LVMVFM\LVPrcInj.dll
IAT D:\Programmi\Logitech\QuickCam\Quickcam.exe[344] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [01DA2D00] C:\Programmi\File comuni\Logishrd\LVMVFM\LVPrcInj.dll
IAT D:\Programmi\Logitech\QuickCam\Quickcam.exe[344] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [01DA2CD0] C:\Programmi\File comuni\Logishrd\LVMVFM\LVPrcInj.dll
IAT C:\Documents and Settings\Francesco\Desktop\SICUREZZA\AntirootKit Gmer\gmer.exe[1776] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [009F2F30] C:\Programmi\File comuni\Logishrd\LVMVFM\LVPrcInj.dll
IAT C:\Documents and Settings\Francesco\Desktop\SICUREZZA\AntirootKit Gmer\gmer.exe[1776] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [009F2CA0] C:\Programmi\File comuni\Logishrd\LVMVFM\LVPrcInj.dll
IAT C:\Documents and Settings\Francesco\Desktop\SICUREZZA\AntirootKit Gmer\gmer.exe[1776] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [009F2D00] C:\Programmi\File comuni\Logishrd\LVMVFM\LVPrcInj.dll
IAT C:\Documents and Settings\Francesco\Desktop\SICUREZZA\AntirootKit Gmer\gmer.exe[1776] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [009F2CD0] C:\Programmi\File comuni\Logishrd\LVMVFM\LVPrcInj.dll
IAT C:\WINDOWS\Explorer.EXE[1832] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00D42F30] C:\Programmi\File comuni\Logishrd\LVMVFM\LVPrcInj.dll
IAT C:\WINDOWS\Explorer.EXE[1832] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00D42CA0] C:\Programmi\File comuni\Logishrd\LVMVFM\LVPrcInj.dll
IAT C:\WINDOWS\Explorer.EXE[1832] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00D42D00] C:\Programmi\File comuni\Logishrd\LVMVFM\LVPrcInj.dll
IAT C:\WINDOWS\Explorer.EXE[1832] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00D42CD0] C:\Programmi\File comuni\Logishrd\LVMVFM\LVPrcInj.dll
IAT C:\Programmi\Internet Explorer\iexplore.exe[2644] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00A22F30] C:\Programmi\File comuni\Logishrd\LVMVFM\LVPrcInj.dll
IAT C:\Programmi\Internet Explorer\iexplore.exe[2644] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00A22CA0] C:\Programmi\File comuni\Logishrd\LVMVFM\LVPrcInj.dll
IAT C:\Programmi\Internet Explorer\iexplore.exe[2644] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00A22D00] C:\Programmi\File comuni\Logishrd\LVMVFM\LVPrcInj.dll
IAT C:\Programmi\Internet Explorer\iexplore.exe[2644] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00A22CD0] C:\Programmi\File comuni\Logishrd\LVMVFM\LVPrcInj.dll
IAT C:\WINDOWS\system32\wuauclt.exe[2688] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [009B2F30] C:\Programmi\File comuni\Logishrd\LVMVFM\LVPrcInj.dll
IAT C:\WINDOWS\system32\wuauclt.exe[2688] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [009B2CA0] C:\Programmi\File comuni\Logishrd\LVMVFM\LVPrcInj.dll
IAT C:\WINDOWS\system32\wuauclt.exe[2688] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [009B2D00] C:\Programmi\File comuni\Logishrd\LVMVFM\LVPrcInj.dll
IAT C:\WINDOWS\system32\wuauclt.exe[2688] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [009B2CD0] C:\Programmi\File comuni\Logishrd\LVMVFM\LVPrcInj.dll
IAT C:\Programmi\File comuni\LogiShrd\LVCOMSER\LVComSer.exe[2924] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [003E2F30] C:\Programmi\File comuni\Logishrd\LVMVFM\LVPrcInj.dll
IAT C:\Programmi\File comuni\LogiShrd\LVCOMSER\LVComSer.exe[2924] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [003E2CA0] C:\Programmi\File comuni\Logishrd\LVMVFM\LVPrcInj.dll
IAT C:\Programmi\File comuni\LogiShrd\LVCOMSER\LVComSer.exe[2924] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [003E2D00] C:\Programmi\File comuni\Logishrd\LVMVFM\LVPrcInj.dll
IAT C:\Programmi\File comuni\LogiShrd\LVCOMSER\LVComSer.exe[2924] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [003E2CD0] C:\Programmi\File comuni\Logishrd\LVMVFM\LVPrcInj.dll
IAT C:\Programmi\File comuni\Nero\Lib\NMIndexStoreSvr.exe[3084] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [003E2F30] C:\Programmi\File comuni\Logishrd\LVMVFM\LVPrcInj.dll
IAT C:\Programmi\File comuni\Nero\Lib\NMIndexStoreSvr.exe[3084] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [003E2CA0] C:\Programmi\File comuni\Logishrd\LVMVFM\LVPrcInj.dll
IAT C:\Programmi\File comuni\Nero\Lib\NMIndexStoreSvr.exe[3084] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [003E2D00] C:\Programmi\File comuni\Logishrd\LVMVFM\LVPrcInj.dll
IAT C:\Programmi\File comuni\Nero\Lib\NMIndexStoreSvr.exe[3084] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [003E2CD0] C:\Programmi\File comuni\Logishrd\LVMVFM\LVPrcInj.dll
IAT C:\Programmi\File comuni\Logishrd\LQCVFX\COCIManager.exe[3752] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00A92F30] C:\Programmi\File comuni\Logishrd\LVMVFM\LVPrcInj.dll
IAT C:\Programmi\File comuni\Logishrd\LQCVFX\COCIManager.exe[3752] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00A92CA0] C:\Programmi\File comuni\Logishrd\LVMVFM\LVPrcInj.dll
IAT C:\Programmi\File comuni\Logishrd\LQCVFX\COCIManager.exe[3752] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00A92D00] C:\Programmi\File comuni\Logishrd\LVMVFM\LVPrcInj.dll
IAT C:\Programmi\File comuni\Logishrd\LQCVFX\COCIManager.exe[3752] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00A92CD0] C:\Programmi\File comuni\Logishrd\LVMVFM\LVPrcInj.dll
W ANNASOPHIA ROBB
Avatar utente
francescosurya
Senior Member
Senior Member
 
Messaggi: 180
Iscritto il: mer lug 25, 2007 1:15 pm
Località: Vicenza

Messaggioda francescosurya » lun gen 14, 2008 1:14 pm

Almeno una risposta, un cenno con la testa, un rutto, un segno di vita.....




(mi scuso con king of gng per avergli copiato la frase)
W ANNASOPHIA ROBB
Avatar utente
francescosurya
Senior Member
Senior Member
 
Messaggi: 180
Iscritto il: mer lug 25, 2007 1:15 pm
Località: Vicenza

Messaggioda ste_95 » lun gen 14, 2008 1:56 pm

Tutto pulito.

Hai fatto controllare il file su VirusTotal?
«A volte è meglio tacere e sembrare stupidi che aprir bocca e togliere ogni dubbio.» Oscar Wilde
Avatar utente
ste_95
Membro Ufficiale (Gold)
Membro Ufficiale (Gold)
 
Messaggi: 17271
Iscritto il: lun ago 06, 2007 11:19 am

Messaggioda francescosurya » mer gen 16, 2008 9:51 pm

BilloKenobi ha scritto:il primo ha un nome troppo generico per controllarlo sui database. fai così, caricalo su www.virustotal.com per vedere cosa dicono i trenta e passa antivirus disponibili

per quanto riguarda la seconda voce, è pulita. suppongo che il tuo pc sia un vista, che hijackthis 1.99.1 non supporta. se farai lo scan con la 2.0.2 vedrai che probabilmente non comparirà nemmeno quella voce

[:)]



su virus total, cosa uppo:
il log di hijackthis;

questo: O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe in 1 file di testo.

o cos'altro???? il file laucher exe non riesco a trovarlo....
W ANNASOPHIA ROBB
Avatar utente
francescosurya
Senior Member
Senior Member
 
Messaggi: 180
Iscritto il: mer lug 25, 2007 1:15 pm
Località: Vicenza

Messaggioda ste_95 » gio gen 17, 2008 8:10 am

Il percorso effettivo è:

C:\WINDOWS\SMINST\launcher.exe

Non lo trovi nemmeno ora?
«A volte è meglio tacere e sembrare stupidi che aprir bocca e togliere ogni dubbio.» Oscar Wilde
Avatar utente
ste_95
Membro Ufficiale (Gold)
Membro Ufficiale (Gold)
 
Messaggi: 17271
Iscritto il: lun ago 06, 2007 11:19 am

niente

Messaggioda francescosurya » gio gen 17, 2008 2:07 pm

non c'è la cartella SMINST in window..............
forse è perché ho 3 hdd con:
il primo hdd da 40 gb nn ha partizioni e lo uso come cassaforte.
il secondo è da 250 gb, ed ha 2 partizioni: 1)OS di vista 2)programmi e altre cose.
il terzo è da 80 gb, ed ha le seguenti partizioni: 1)XP OS 2)programmi e robe varie..

Può essere questo?????

Su virus total devo uploadare il file???????????????????
W ANNASOPHIA ROBB
Avatar utente
francescosurya
Senior Member
Senior Member
 
Messaggi: 180
Iscritto il: mer lug 25, 2007 1:15 pm
Località: Vicenza

Messaggioda ste_95 » gio gen 17, 2008 2:31 pm

Dovresti uploadare su il file, ma se non è presente...

Consideriamo che WinDir corrisponde alla lettera dell'hd da cui è stata effettuata la scansione.
«A volte è meglio tacere e sembrare stupidi che aprir bocca e togliere ogni dubbio.» Oscar Wilde
Avatar utente
ste_95
Membro Ufficiale (Gold)
Membro Ufficiale (Gold)
 
Messaggi: 17271
Iscritto il: lun ago 06, 2007 11:19 am

Messaggioda francescosurya » gio gen 17, 2008 2:49 pm

ste_95 ha scritto:Dovresti uploadare su il file, ma se non è presente...

Consideriamo che WinDir corrisponde alla lettera dell'hd da cui è stata effettuata la scansione.



l'ho effettuata dal desktop che quindi è xp os..............

Posto il log di hijackthis nuovo che forse è meglio (la nuova versione)...............
W ANNASOPHIA ROBB
Avatar utente
francescosurya
Senior Member
Senior Member
 
Messaggi: 180
Iscritto il: mer lug 25, 2007 1:15 pm
Località: Vicenza

Messaggioda francescosurya » gio gen 17, 2008 2:51 pm

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14.54.18, on 17/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
D:\Programmi\Nero 8\InCD\NBHGui.exe
D:\Programmi\Nero 8\InCD\InCD.exe
D:\Programmi\Norton Ghost\Agent\VProTray.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\File comuni\Nokia\Tools\NclTray.exe
C:\Programmi\File comuni\PCSuite\DataLayer\DataLayer.exe
D:\Programmi\iTunes\iTunesHelper.exe
C:\Programmi\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\PROGRA~1\FILECO~1\PCSuite\Services\SERVIC~1.EXE
C:\Programmi\File comuni\LogiShrd\LComMgr\Communications_Helper.exe
C:\Programmi\Logitech\QuickCam\Quickcam.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\File comuni\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Programmi\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
C:\Programmi\File comuni\Nero\Lib\NMBgMonitor.exe
D:\Programmi\Nokia\PC Suite for N-Gage QD\connmngmntbox.exe
D:\Programmi\Nokia\PC Suite for N-Gage QD\ectaskscheduler.exe
D:\PROGRA~1\Nokia\PCSUIT~1\Elogerr.exe
C:\Programmi\Intuwave\Shared\mRouterRunTime\mRouterRuntime.exe
C:\Programmi\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
D:\PROGRA~1\Nokia\PCSUIT~1\BROADC~1.EXE
D:\Programmi\Nero 8\InCD\InCDsrv.exe
D:\PROGRA~1\Nokia\PCSUIT~1\SCRFS.exe
C:\Programmi\File comuni\LogiShrd\LVCOMSER\LVComSer.exe
D:\Programmi\Nero 8\Nero BackItUp\NBService.exe
D:\Programmi\Norton Ghost\Agent\VProSvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\File comuni\Nero\Lib\NMIndexingService.exe
C:\Programmi\File comuni\LogiShrd\LVCOMSER\LVComSer.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\Programmi\File comuni\Nero\Lib\NMIndexStoreSvr.exe
C:\Programmi\File comuni\Logishrd\LQCVFX\COCIManager.exe
D:\Programmi\EA GAMES\Need for Speed Most Wanted\speed.exe
C:\DOCUME~1\FRANCE~1\IMPOST~1\Temp\~e5.0001
C:\WINDOWS\system32\wuauclt.exe
D:\Programmi\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe
D:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmi\File comuni\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SecurDisc] D:\Programmi\Nero 8\InCD\NBHGui.exe
O4 - HKLM\..\Run: [InCD] D:\Programmi\Nero 8\InCD\InCD.exe
O4 - HKLM\..\Run: [NBKeyScan] "D:\Programmi\Nero 8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Norton Ghost 12.0] "D:\Programmi\Norton Ghost\Agent\VProTray.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Nokia Tray Application] C:\Programmi\File comuni\Nokia\Tools\NclTray.exe
O4 - HKLM\..\Run: [DataLayer] C:\Programmi\File comuni\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [iTunesHelper] "D:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avgnt] "C:\Programmi\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Programmi\File comuni\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Programmi\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [Ad-Watch] D:\Programmi\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-18 Startup: The Matrix_ Path of Neo Registration.lnk = C:\Documents and Settings\Francesco\Impostazioni locali\Temp\{EDECCB44-8E5F-4FCC-B3B4-8600D22D33C3}\{E571E8B1-9771-465D-9DE0-3BA2D1BDAE99}\ATR1.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: The Matrix_ Path of Neo Registration.lnk = C:\Documents and Settings\Francesco\Impostazioni locali\Temp\{EDECCB44-8E5F-4FCC-B3B4-8600D22D33C3}\{E571E8B1-9771-465D-9DE0-3BA2D1BDAE99}\ATR1.exe (User 'Default user')
O4 - Startup: The Matrix_ Path of Neo Registration.lnk = C:\Documents and Settings\Francesco\Impostazioni locali\Temp\{EDECCB44-8E5F-4FCC-B3B4-8600D22D33C3}\{E571E8B1-9771-465D-9DE0-3BA2D1BDAE99}\ATR1.exe
O4 - Global Startup: PCSuiteperNokiaN-Gage QD Detect.lnk = ?
O4 - Global Startup: PCSuiteperNokiaN-Gage QD TS.lnk = ?
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - D:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 5637493000
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 8851728828
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} -
O17 - HKLM\System\CCS\Services\Tcpip\..\{664AA16B-B344-4405-8C1B-AA86DB40A243}: NameServer = 212.216.112.112,212.216.172.62
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - D:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmi\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programmi\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - D:\Programmi\Nero 8\InCD\InCDsrv.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Programmi\File comuni\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Programmi\File comuni\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Programmi\File comuni\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - D:\Programmi\Nero 8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programmi\File comuni\Nero\Lib\NMIndexingService.exe
O23 - Service: Norton Ghost - Symantec Corporation - D:\Programmi\Norton Ghost\Agent\VProSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 10302 bytes
W ANNASOPHIA ROBB
Avatar utente
francescosurya
Senior Member
Senior Member
 
Messaggi: 180
Iscritto il: mer lug 25, 2007 1:15 pm
Località: Vicenza

Messaggioda ste_95 » gio gen 17, 2008 2:55 pm

Esegui una semplice pulizia con CCleaner
«A volte è meglio tacere e sembrare stupidi che aprir bocca e togliere ogni dubbio.» Oscar Wilde
Avatar utente
ste_95
Membro Ufficiale (Gold)
Membro Ufficiale (Gold)
 
Messaggi: 17271
Iscritto il: lun ago 06, 2007 11:19 am

Messaggioda francescosurya » gio gen 17, 2008 3:42 pm

Fatto, e io ho risolt. il problema dell' avvio che non si accende:

Era la webcam che andava in conflitto.......o meglio, il driver della web!!!
Sono andato sul sito ed ho scaricato il driver proprio per xp e funziona perfettamente............penso che quello nel cd era per Vista



Grazie, ciao
W ANNASOPHIA ROBB
Avatar utente
francescosurya
Senior Member
Senior Member
 
Messaggi: 180
Iscritto il: mer lug 25, 2007 1:15 pm
Località: Vicenza


Torna a Sicurezza

Chi c’è in linea

Visitano il forum: Yahoo [Bot] e 1 ospite

Powered by phpBB © 2002, 2005, 2007, 2008 phpBB Group
Traduzione Italiana phpBB.it

megalab.it: testata telematica quotidiana registrata al Tribunale di Cosenza n. 22/09 del 13.08.2009, editore Master New Media S.r.l.; © Copyright 2008 Master New Media S.r.l. a socio unico - P.I. 02947530784. GRUPPO EDIZIONI MASTER Spa Tutti i diritti sono riservati. Per la pubblicità: Master Advertising