PcPrimiPassi.it FORUM: SICUREZZA INFORMATICA: Infezioni informatiche e Sicurezza informatica in generale
Topic: Post n° 67.129 - Postato: 19/Marzo/2007 alle 12:32 Topic: Post n° 67.133 - Postato: 19/Marzo/2007 alle 13:03ho cancellato tutti winmx ora provo a vedere se spybot riesce a cancellare quei due virus
Logfile of HijackThis v1.99.1
Scan saved at 13.01.37, on 19/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\ZoneLabs\isafe.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Programmi\QuickTime\qttask.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\Ahead\InCD\InCD.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\Programmi\Zone Labs\ZoneAlarm\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe
C:\Programmi\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\WINDOWS\Integrator.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Programmi\Hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.virgilio.it/oggi/index.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = www.virgilio.it
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar1.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [InCD] C:\Programmi\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programmi\Zone Labs\ZoneAlarm\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ccleaner] "C:\Programmi\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - Startup: AntiCrash.lnk = C:\Programmi\Dachshund Software\AntiCrash\AntiCrash.exe
O4 - Global Startup: BlueSoleil.lnk = ?
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Programmi\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Programmi\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download web site with Free Download Manager - file://C:\Programmi\Free Download Manager\dlpage.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Programmi\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Salva oggetto con Star Downloader - C:\Programmi\Star Downloader\sdie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Programmi\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {8EC18CE2-D7B4-11D2-88C8-006008A717FD} (NCSView Class) - http://ww3.atlanteitaliano.it/ecwplugins/ncs.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{01363ED1-51BB-4CA4-87E0-C 2C56866B050}: NameServer = 212.216.172.62,212.216.112.112
O17 - HKLM\System\CS1\Services\Tcpip\..\{01363ED1-51BB-4CA4-87E0-C 2C56866B050}: NameServer = 212.216.172.62,212.216.112.112
O17 - HKLM\System\CS2\Services\Tcpip\..\{01363ED1-51BB-4CA4-87E0-C 2C56866B050}: NameServer = 212.216.172.62,212.216.112.112
O17 - HKLM\System\CS3\Services\Tcpip\..\{01363ED1-51BB-4CA4-87E0-C 2C56866B050}: NameServer = 212.216.172.62,212.216.112.112
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Programmi\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Programmi\Ahead\InCD\InCDsrv.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Topic: Post n° 67.134 - Postato: 19/Marzo/2007 alle 13:30ancora niente , mi dice nuovamente che non può eliminarli inquanto in memoria
**************************
Topic: Post n° 67.135 - Postato: 19/Marzo/2007 alle 13:39 Topic: Post n° 67.138 - Postato: 19/Marzo/2007 alle 14:03non ci sono,credo questi siano tutti i processi in avvio automatico e non ci sono
--- Spybot - Search & Destroy version: 1.4 (build: 20050523) ---
2005-05-31 blindman.exe (1.0.0.1)
2005-05-31 SpybotSD.exe (1.4.0.3)
2005-05-31 TeaTimer.exe (1.4.0.2)
2007-02-21 unins000.exe (51.41.0.0)
2005-05-31 Update.exe (1.4.0.0)
2007-01-15 advcheck.dll (1.2.1.0)
2005-05-31 aports.dll (2.1.0.0)
2005-05-31 borlndmm.dll (7.0.4.453)
2005-05-31 delphimm.dll (7.0.4.453)
2005-05-31 SDHelper.dll (1.4.0.0)
2007-01-02 Tools.dll (2.0.1.0)
2005-05-31 UnzDll.dll (1.73.1.1)
2005-05-31 ZipDll.dll (1.73.2.0)
2007-02-28 Includes\Cookies.sbi
2006-12-08 Includes\Dialer.sbi
2007-02-28 Includes\DialerC.sbi
2007-02-07 Includes\Hijackers.sbi
2007-02-28 Includes\HijackersC.sbi
2006-10-27 Includes\Keyloggers.sbi
2007-02-28 Includes\KeyloggersC.sbi
2007-02-14 Includes\Malware.sbi
2007-02-28 Includes\MalwareC.sbi
2007-01-19 Includes\PUPS.sbi
2007-02-28 Includes\PUPSC.sbi
2007-02-28 Includes\Revision.sbi
2006-12-08 Includes\Security.sbi
2007-02-28 Includes\SecurityC.sbi
2007-02-02 Includes\Spybots.sbi
2007-02-28 Includes\SpybotsC.sbi
2005-02-17 Includes\Tracks.uti
2007-02-14 Includes\Trojans.sbi
2007-02-28 Includes\TrojansC.sbi
Located: HK_LM:Run, BluetoothAuthenticationAgent
command: rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
file: C:\WINDOWS\system32\rundll32.exe
size: 33280
MD5: f88cdb0ccc416b3778736be74cdebb94
Located: HK_LM:Run, InCD
command: C:\Programmi\Ahead\InCD\InCD.exe
file: C:\Programmi\Ahead\InCD\InCD.exe
size: 1397760
MD5: 36cf1f48f89a977a4be7c68508b5ed27
Located: HK_LM:Run, NeroFilterCheck
command: C:\WINDOWS\system32\NeroCheck.exe
file: C:\WINDOWS\system32\NeroCheck.exe
size: 155648
MD5: 3e4c03cefad8de135263236b61a49c90
Located: HK_LM:Run, QuickTime Task
command: "C:\Programmi\QuickTime\qttask.exe" -atboottime
file: C:\Programmi\QuickTime\qttask.exe
size: 98304
MD5: 76a3a30b58405c2c6d833895253a51a9
Located: HK_LM:Run, SunJavaUpdateSched
command: C:\Programmi\Java\jre1.5.0_04\bin\jusched.exe
file: C:\Programmi\Java\jre1.5.0_04\bin\jusched.exe
size: 36975
MD5: d3e445a99a1142c35d8d3100b5564591
Located: HK_LM:Run, TkBellExe
command: "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
file: C:\Programmi\File comuni\Real\Update_OB\realsched.exe
size: 180269
MD5: 1ac2c58b587c70de64582ad41ee79fba
Located: HK_LM:Run, Zone Labs Client
command: "C:\Programmi\Zone Labs\ZoneAlarm\ZoneAlarm\zlclient.exe"
file: C:\Programmi\Zone Labs\ZoneAlarm\ZoneAlarm\zlclient.exe
size: 968696
MD5: 71514e2c74d554f5902dc184046eca3b
Located: HK_CU:Run, BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}
command: "C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe"
file: C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe
size: 94208
MD5: 15a1a88d97d440c735058ccf3f74a6ee
Located: HK_CU:Run, ccleaner
command: "C:\Programmi\CCleaner\ccleaner.exe" /AUTO
file: C:\Programmi\CCleaner\ccleaner.exe
size: 499712
MD5: 184cab8026413a561a695c6f7e457bf0
Located: HK_CU:Run, ctfmon.exe
command: C:\WINDOWS\system32\ctfmon.exe
file: C:\WINDOWS\system32\ctfmon.exe
size: 15360
MD5: 5b33b4265966ee063c7fbea28958d9c2
Located: HK_CU:Run, MSMSGS
command: "C:\Programmi\Messenger\msmsgs.exe" /background
file: C:\Programmi\Messenger\msmsgs.exe
size: 1694208
MD5: 74e6e96c6f0e2eca4edbb7f7a468f259
Located: Esecuzione automatica (comune), BlueSoleil.lnk
command: C:\Programmi\IVT Corporation\BlueSoleil\BlueSoleil.exe
file: C:\Programmi\IVT Corporation\BlueSoleil\BlueSoleil.exe
size: 1048576
MD5: cfccfae6fe71ffd0380a4090a754ed93
Located: Esecuzione automatica (utente), AntiCrash.lnk
command: C:\Programmi\Dachshund Software\AntiCrash\AntiCrash.exe
file: C:\Programmi\Dachshund Software\AntiCrash\AntiCrash.exe
size: 2301798
MD5: d650e0bb24c1c4d796fd2e88e8fdfeff
Located: WinLogon, crypt32chain
command: crypt32.dll
file: crypt32.dll
Located: WinLogon, cryptnet
command: cryptnet.dll
file: cryptnet.dll
Located: WinLogon, cscdll
command: cscdll.dll
file: cscdll.dll
Located: WinLogon, ScCertProp
command: wlnotify.dll
file: wlnotify.dll
Located: WinLogon, Schedule
command: wlnotify.dll
file: wlnotify.dll
Located: WinLogon, sclgntfy
command: sclgntfy.dll
file: sclgntfy.dll
Located: WinLogon, SensLogn
command: WlNotify.dll
file: WlNotify.dll
Located: WinLogon, termsrv
command: wlnotify.dll
file: wlnotify.dll
Located: WinLogon, WgaLogon
command: WgaLogon.dll
file: WgaLogon.dll
Located: WinLogon, wlballoon
command: wlnotify.dll
file: wlnotify.dll
Topic: Post n° 67.142 - Postato: 19/Marzo/2007 alle 15:20 Topic: Post n° 67.159 - Postato: 19/Marzo/2007 alle 18:50
Topic Attivi
Lista Membri
Calendario
Cerca
Aiuto
Registrati
Login
