Visualizzazione dei risultati da 1 a 2 su 2
  1. #1

    [interpretare il log di hijackthis]

    lo posto così magari mi date una mano:

    Logfile of HijackThis v1.99.0
    Scan saved at 11.02.59, on gg/01/aa
    Platform: Windows 2000 SP4 (WinNT 5.00.2195)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINNT\System32\smss.exe
    C:\WINNT\system32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\WINNT\System32\CTSvcCDA.exe
    C:\WINNT\System32\svchost.exe
    C:\WINNT\System32\nvsvc32.exe
    C:\WINNT\system32\regsvc.exe
    C:\WINNT\system32\MSTask.exe
    C:\Programmi\Photodex\ProShowGold\ScsiAccess.exe
    C:\WINNT\system32\stisvc.exe
    C:\WINNT\system32\ZoneLabs\vsmon.exe
    C:\WINNT\System32\WBEM\WinMgmt.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\Explorer.EXE
    C:\Programmi\Creative\ShareDLL\CtNotify.exe
    C:\WINNT\system32\rundll32.exe
    C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    C:\Programmi\File comuni\Adaptec Shared\CreateCD\CreateCD50.exe
    C:\Programmi\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
    C:\Programmi\Creative\ShareDLL\MediaDet.Exe
    C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_S4I0T1. EXE
    C:\PROGRA~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE
    C:\Programmi\QuickTime\qttask.exe
    C:\WINNT\system32\internat.exe
    C:\Programmi\EPSON\EPSON SMART PANEL for Scanner\EspMain.exe
    C:\Programmi\Internet Explorer\IEXPLORE.EXE
    C:\Programmi\Internet Explorer\IEXPLORE.EXE
    C:\Programmi\WinRAR\WinRAR.exe
    C:\DOCUME~1\ADMINI~1\IMPOST~1\Temp\Rar$EX00.743\Hi jackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.pcw.it
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
    O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\System32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [Rilevatore di dischi] C:\Programmi\Creative\ShareDLL\CtNotify.exe
    O4 - HKLM\..\Run: [Disc Detector] C:\Programmi\Creative\ShareDLL\CtNotify.exe
    O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
    O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [Windows Compliant] cvqwgb.exe
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    O4 - HKLM\..\Run: [CreateCD50] "C:\Programmi\File comuni\Adaptec Shared\CreateCD\CreateCD50.exe" -r
    O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Programmi\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
    O4 - HKLM\..\Run: [EPSON Stylus C46 Series] C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_S4I0T1. EXE /P23 "EPSON Stylus C46 Series" /O6 "USB001" /M "Stylus C46"
    O4 - HKLM\..\Run: [EPSON Stylus C46 Series (Copia 2)] C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_S4I0T1. EXE /P33 "EPSON Stylus C46 Series (Copia 2)" /O6 "USB001" /M "Stylus C46"
    O4 - HKLM\..\Run: [Camera Detector] C:\PROGRA~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE -autorun
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [sais] c:\programmi\180solutions\sais.exe
    O4 - HKLM\..\RunServices: [Windows Compliant] cvqwgb.exe
    O4 - HKCU\..\Run: [internat.exe] internat.exe
    O4 - HKCU\..\Run: [Windows Compliant] cvqwgb.exe
    O4 - HKCU\..\Run: [Cobian Backup 6] "C:\Programmi\Cobian Backup 6\CobBU.exe"
    O4 - Startup: dBpowerAMP.lnk = C:\Programmi\Illustrate\dBpowerAMP\Amp.exe
    O4 - Global Startup: EPSON SMART PANEL for Scanner.lnk = C:\Programmi\EPSON\EPSON SMART PANEL for Scanner\EspMain.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE
    O14 - IERESET.INF: START_PAGE_URL=http://www.pcw.it
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by21fd.bay21.hotmail.msn.com/...s/MsnPUpld.cab
    O16 - DPF: {DB893839-10F0-4AF9-92FA-B23528F530AF} - http://deposito.hostance.net/dialer/1080209.exe
    O17 - HKLM\System\CCS\Services\Tcpip\..\{536FB261-5A82-4BE3-95AA-7F07C9ABA55E}: NameServer = 80.17.212.208 151.99.125.1
    O17 - HKLM\System\CS1\Services\Tcpip\..\{536FB261-5A82-4BE3-95AA-7F07C9ABA55E}: NameServer = 80.17.212.208 151.99.125.1
    O17 - HKLM\System\CS2\Services\Tcpip\..\{536FB261-5A82-4BE3-95AA-7F07C9ABA55E}: NameServer = 151.99.0.100 212.216.172.62
    O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\System32\CTSvcCDA.exe
    O23 - Service: Servizio amministrativo di Gestione disco logico - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
    O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
    O23 - Service: ScsiAccess - Unknown - C:\Programmi\Photodex\ProShowGold\ScsiAccess.exe
    O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINNT\system32\ZoneLabs\vsmon.exe
    O23 - Service: ZESOFT - Unknown - C:\WINNT\zeta.exe (file missing)





    VaneX

  2. #2
    Moderatore di Sicurezza informatica e virus L'avatar di amvinfe
    Registrato dal
    May 2002
    Messaggi
    6,739
    http://forum.html.it/forum/showthrea...hreadid=769694

    beh, mi sembra che due 3d aperti nel giro di alcuni minuti dove le informazioni utili per cercare di capire almeno il problema non ci sono, sia un po' troppo.
    Chiudo questo 3d, fai le dovute operazioni descritte all'URL che ho postato in entrambi i tuoi 3d, poi solo dopo posta un log di HijackThis.
    Grazie
    ==
    Visita il mio blog SuspectFile.com
    ==

Permessi di invio

  • Non puoi inserire discussioni
  • Non puoi inserire repliche
  • Non puoi inserire allegati
  • Non puoi modificare i tuoi messaggi
  •  
Powered by vBulletin® Version 4.2.1
Copyright © 2025 vBulletin Solutions, Inc. All rights reserved.