hijackthis log

[Nobless]

Qualcuno può dare un'occhiata a questo log visto che ogni volta che apro Internet explorer mi si apre anche un universo di altri siti?

Se no almeno per favore datemi qualche link di siti che fanno questi controlli così smetto di rompere...

Grazie

Nobless

Logfile of HijackThis v1.98.2
Scan saved at 17.20.34, on 22/09/2004
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\Explorer.EXE
C:\WINNT\Mixer.exe
C:\CA\eTrust\ANTIVI~1\realmon.exe
C:\WINNT\system32\internat.exe
C:\Programmi\Iomega\Tools\IMGICON.EXE
C:\Programmi\Microsoft Office\Office\1040\OLFSNT40.EXE
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe
C:\DOCUME~1\Blanka\IMPOST~1\Temp\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.begin2search.com/googlesidesearch.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.begin2search.com/googlesidesearch.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.begin2search.com/googlesidesearch.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dds.unibo.it/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.begin2search.com/googlesidesearch.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.begin2search.com/googlesidesearch.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://www.dds.unibo.it/"); (C:\Programmi\Netscape\Users\a\prefs.js)
O2 - BHO: (no name) - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: ohb - {4D568F0F-8AC9-40AB-88B7-415134C78777} - C:\WINNT\SYSTEM32\winb2s32.dll
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [Realtime Monitor] c:\CA\eTrust\ANTIVI~1\realmon.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [WebRebates0] "C:\Programmi\Web_Rebates\WebRebates0.exe"
O4 - HKLM\..\Run: [TV Media] C:\Programmi\TV Media\Tvm.exe
O4 - HKLM\..\Run: [ejggxc] C:\WINNT\system32\jkllvk.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - Global Startup: Iomega Backup Scheduler.lnk = C:\Programmi\Iomega\Iomega Backup\dtiom98.exe
O4 - Global Startup: Iomega Icons.lnk = C:\Programmi\Iomega\Tools\IMGICON.EXE
O4 - Global Startup: Iomega Startup Options.lnk = C:\Programmi\Iomega\Tools\IMGSTART.EXE
O4 - Global Startup: IomegaWare.lnk = C:\Programmi\Iomega\Iomegaware\COMMANDER.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Porta Symantec Fax Starter Edition.lnk = C:\Programmi\Microsoft Office\Office\1040\OLFSNT40.EXE
O9 - Extra button: Connector - {FFB51760-344E-4FFB-BFFF-4B18C7AC1D63} - C:\WINNT\System32\ShellExt\SYSCNTR.EXE (file missing)
O16 - DPF: {15320607-1001-1831-1000-118599957123} - ms-its:C:\arct.chm::/painter.exe
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security2.norton.com/SSC/Shar.../bin/cabsa.cab

[amvinfe]

Metti HijackThis all'interno di una nuova cartella.
Riavvia in mod. provvisoria, apri HJT fai lo scan e metti la spunta al fianco dei valori, clicca su Fix checked

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.begin2search.com/googlesidesearch.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.begin2search.com/googlesidesearch.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.begin2search.com/googlesidesearch.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.begin2search.com/googlesidesearch.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.begin2search.com/googlesidesearch.html
O2 - BHO: (no name) - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - (no file)
O4 - HKLM\..\Run: [ejggxc] C:\WINNT\system32\jkllvk.exe
O16 - DPF: {15320607-1001-1831-1000-118599957123} - ms-its:C:\arct.chm::/painter.exe

sempre dalla provvisoria elimina se presente:
C:\WINNT\system32\jkllvk.exe

Installa ed aggiorna AdAware SE Personal 1.05 (lo trovi in Rilievo -links utili-) lancialo dalla provvisoria ed elimina tutto quello che d'infetto trova.

Riavvia e posta un nuovo log di HJT

O4 - HKLM\..\Run[WebRebates0] "C:\Programmi\Web_Rebates\WebRebates0.exe"

O4 - HKLM\..\Run: [TV Media] C:\Programmi\TV Media\Tvm.exe

Nota: i programmi Web_Rebates e TV Media contengono spyware, inoltre cambiano le impostazioni di IE, vedi tu cosa fare. Se decidi di eliminare i due programmi devi disinstallarli dal Pannello di controllo/Installazione Applicazioni ed andare a rimuovere i valori che lascerà sul pc (ad es. le cartelle in C:\Programmi e le chiavi del registro)

[Nobless]

Grazie per l'aiuto

Avrò accesso a quel pc solo domani pomeriggio poi posterò il nuovo log

Nobless

[Nobless]

Mi scuso per il ritardo ma non ho avuto accesso al pc fino ad oggi:

Logfile of HijackThis v1.98.2
Scan saved at 15.07.35, on 30/09/2004
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.EXE
C:\Programmi\Internet Explorer\iexplore.exe
C:\PROGRA~1\WinZip\winzip32.exe
C:\DOCUME~1\ADMINI~1.FON\IMPOST~1\Temp\HijackThis. exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dds.unibo.it/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [Realtime Monitor] c:\CA\eTrust\ANTIVI~1\realmon.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [MyDailyHoroscope] C:\PROGRA~1\MYDAIL~1\MYDAIL~1.EXE
O4 - Global Startup: Iomega Backup Scheduler.lnk = C:\Programmi\Iomega\Iomega Backup\dtiom98.exe
O4 - Global Startup: Iomega Icons.lnk = C:\Programmi\Iomega\Tools\IMGICON.EXE
O4 - Global Startup: Iomega Startup Options.lnk = C:\Programmi\Iomega\Tools\IMGSTART.EXE
O4 - Global Startup: IomegaWare.lnk = C:\Programmi\Iomega\Iomegaware\COMMANDER.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Porta Symantec Fax Starter Edition.lnk = C:\Programmi\Microsoft Office\Office\1040\OLFSNT40.EXE
O9 - Extra button: Connector - {FFB51760-344E-4FFB-BFFF-4B18C7AC1D63} - C:\WINNT\System32\ShellExt\SYSCNTR.EXE (file missing)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security2.norton.com/SSC/Shar.../bin/cabsa.cab

[amvinfe]

dalla provvisoria elimina

O4 - HKCU\..\Run: [MyDailyHoroscope] C:\PROGRA~1\MYDAIL~1\MYDAIL~1.EXE
O9 - Extra button: Connector - {FFB51760-344E-4FFB-BFFF-4B18C7AC1D63} - C:\WINNT\System32\ShellExt\SYSCNTR.EXE (file missing)


riavvia, posta un nuovo log

[Nobless]

eccolo:

Logfile of HijackThis v1.98.2
Scan saved at 15.01.49, on 01/10/2004
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\WinZip\winzip32.exe
C:\DOCUME~1\ADMINI~1.FON\IMPOST~1\Temp\HijackThis. exe
C:\Programmi\Internet Explorer\IEXPLORE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dds.unibo.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir...r=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir...ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir...ie&ar=iesearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=hom e
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [Realtime Monitor] c:\CA\eTrust\ANTIVI~1\realmon.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - Global Startup: Iomega Backup Scheduler.lnk = C:\Programmi\Iomega\Iomega Backup\dtiom98.exe
O4 - Global Startup: Iomega Icons.lnk = C:\Programmi\Iomega\Tools\IMGICON.EXE
O4 - Global Startup: Iomega Startup Options.lnk = C:\Programmi\Iomega\Tools\IMGSTART.EXE
O4 - Global Startup: IomegaWare.lnk = C:\Programmi\Iomega\Iomegaware\COMMANDER.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Porta Symantec Fax Starter Edition.lnk = C:\Programmi\Microsoft Office\Office\1040\OLFSNT40.EXE
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security2.norton.com/SSC/Shar.../bin/cabsa.cab

[amvinfe]

dalla provvisoria elimina

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redi...er=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redi...=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redi...=ie&ar=iesearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=hom e


installa ADAware e fai una scansione dalla modalità provvisoria.

[Nobless]

Ora sembra tutto a posto, grazie.

Siccome ho spesso problemi di questo genere su vari pc e non vorrei disturbarti ogni volta conosci qualche sito AFFIDABILE che controlla on-line questi logs?

[amvinfe]

Originariamente inviato da Nobless
Ora sembra tutto a posto, grazie.

Siccome ho spesso problemi di questo genere su vari pc e non vorrei disturbarti ogni volta conosci qualche sito AFFIDABILE che controlla on-line questi logs?

c'è un sito che controlla i log, ma a mio modestissimo parere lascia il tempo che trova, non lo ritengo affidabile. Io te lo posto poi vedi tu

http://hijackthis.de/index.php?langselect=italian