malware?!?

[Kreatore]

ciao
seguendo le indicazioni di alcune discussioni o eseguito ad-aware sul mio pc su cui è presente qualcosa(pagina iniziale about:blank--> mi fa vedere un sito tipo "search for"). Ad-aware ha trovato diverse chiavi nel registrocatalogate come spyware, e quando chiedo di rimuoverle cancella tutto, salvo riapparire subito dopo.
Allora ho usato cwshredder, che ha trovato un qualcosa relativo al sito web, e gli ho detto di cancellarlo. Poi ho eseguito in mod. provvisorio hijack, e questo è il log ricavato.
La pagina iniziale di internet sembra essere andata a posto, in compenso il pc e rimasto enormemente lento.
Altre idee. Vi ringrazio tutti!!!
---------------------------------
Logfile of HijackThis v1.97.7
Scan saved at 18.18.58, on 10/06/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Principale\Documenti\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programmi\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [CnxTrApp] rundll32.exe "C:\Programmi\StarModem\StarModem USB Network\CnxTrApp.dll",AppEntry -REG "Conexant\Conexant USB Network"
O4 - HKLM\..\Run: [SiS Tray] C:\WINDOWS\System32\sistray.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Scarica con il Wizard di LeechGet - file://C:\Programmi\LeechGet 2002\\Wizard.html
O8 - Extra context menu item: Scarica con LeechGet - file://C:\Programmi\LeechGet 2002\\AddUrl.html
O8 - Extra context menu item: Scarica pagina con LeechGet - file://C:\Programmi\LeechGet 2002\\Parser.html
O16 - DPF: {53D602E4-66ED-4B03-A5B8-19E4F4F6F18F} (Tiphone Control) - http://fax.tiscali.it/netphone/ocx/tiphone.cab
O16 - DPF: {7F8B2500-3B5D-474C-B828-C766ECE3AB3C} (ATLmosquito1 Class) - http://netphone.tiscali.it/netphone/ocx/mosquito.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab

[Arks]

gia' si vede qualcosa ,p.e. R1,che sembra da eliminare,ma mi sembra che sia meglio, in attesa del parere di amvinfe, che tu faccia di nuovo un post con il Log di HijackThis non da modalita' provvisoria,ma semplicemente da windows,senza nessuna applicazione aperta,non connesso, e possibilmente dopo aver fatto una scansione con AdAware e SpyBot.

[amvinfe]

Segui le indicazioni che ti ha fornito Arks, finite le varie scansioni, riavvia e posta un Log di HJT

N.B.
Ricordati d'inserire HJT all'interno di una nuova cartella.

[Kreatore]

Ok ho eseguito ad-aware e ho messo i risultati prima in quarantena e poi quando mi ha chiesto di eliminarli ho eseguito.
Comunque... questo il log di ad-aware:


11-06-2004 7.52.04 - Scan started. (Smart mode)

Lista processi attivi
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

#:1 [smss.exe]
FilePath : \SystemRoot\System32\
ThreadCreationTime : 11-06-2004 5.43.28
BasePriority : Normal


#:2 [winlogon.exe]
FilePath : \??\C:\WINDOWS\system32\
ThreadCreationTime : 11-06-2004 5.43.43
BasePriority : High


#:3 [services.exe]
FilePath : C:\WINDOWS\system32\
ThreadCreationTime : 11-06-2004 5.43.44
BasePriority : Normal
FileSize : 99 KB
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
CompanyName : Microsoft Corporation
FileDescription : Applicazione Servizi e Controller
InternalName : services.exe
OriginalFilename : services.exe
ProductName : Sistema operativo Microsoft
Created on : 31/08/2001 12.00.00
Last accessed : 11/06/2004 5.43.28
Last modified : 31/08/2001 12.00.00

#:4 [lsass.exe]
FilePath : C:\WINDOWS\system32\
ThreadCreationTime : 11-06-2004 5.43.44
BasePriority : Normal
FileSize : 11 KB
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
CompanyName : Microsoft Corporation
FileDescription : LSA Shell (Export Version)
InternalName : lsass.exe
OriginalFilename : lsass.exe
ProductName : Microsoft
Created on : 31/08/2001 12.00.00
Last accessed : 11/06/2004 5.43.28
Last modified : 31/08/2001 12.00.00

#:5 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ThreadCreationTime : 11-06-2004 5.43.46
BasePriority : Normal
FileSize : 12 KB
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
OriginalFilename : svchost.exe
ProductName : Microsoft
Created on : 31/08/2001 12.00.00
Last accessed : 11/06/2004 5.43.43
Last modified : 31/08/2001 12.00.00

#:6 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ThreadCreationTime : 11-06-2004 5.43.46
BasePriority : Normal
FileSize : 12 KB
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
OriginalFilename : svchost.exe
ProductName : Microsoft
Created on : 31/08/2001 12.00.00
Last accessed : 11/06/2004 5.43.43
Last modified : 31/08/2001 12.00.00

#:7 [spoolsv.exe]
FilePath : C:\WINDOWS\system32\
ThreadCreationTime : 11-06-2004 5.43.51
BasePriority : Normal
FileSize : 50 KB
FileVersion : 5.1.2600.0 (XPClient.010817-1148)
ProductVersion : 5.1.2600.0
CompanyName : Microsoft Corporation
FileDescription : Spooler SubSystem App
InternalName : spoolsv.exe
OriginalFilename : spoolsv.exe
ProductName : Microsoft
Created on : 31/08/2001 12.00.00
Last accessed : 11/06/2004 5.43.43
Last modified : 31/08/2001 12.00.00

#:8 [explorer.exe]
FilePath : C:\WINDOWS\
ThreadCreationTime : 11-06-2004 5.43.51
BasePriority : Normal
FileSize : 980 KB
FileVersion : 6.00.2600.0000 (xpclient.010817-1148)
ProductVersion : 6.00.2600.0000
CompanyName : Microsoft Corporation
FileDescription : Esplora risorse
InternalName : explorer
OriginalFilename : EXPLORER.EXE
ProductName : Sistema operativo Microsoft
Created on : 31/08/2001 12.00.00
Last accessed : 11/06/2004 5.51.02
Last modified : 31/08/2001 12.00.00

#:9 [slserv.exe]
FilePath : C:\WINDOWS\system32\
ThreadCreationTime : 11-06-2004 5.43.57
BasePriority : Normal
FileSize : 44 KB
FileVersion : 2.80.00(24Apr2000)
ProductVersion : 2.80.00
Copyright : Copyright
FileDescription : User-Level Modem Service
InternalName : slserv
OriginalFilename : slserv.exe
ProductName : Modem
Created on : 29/10/2001 7.22.18
Last accessed : 11/06/2004 5.43.43
Last modified : 29/10/2001 7.22.18

#:10 [daemon.exe]
FilePath : C:\Programmi\D-Tools\
ThreadCreationTime : 11-06-2004 5.44.05
BasePriority : Normal
FileSize : 80 KB
FileVersion : 3.46.0.0
ProductVersion : 3.46.0.0
Copyright : Copyright (C) 2000-2004
CompanyName : DAEMON'S HOME
FileDescription : Virtual DAEMON Manager
InternalName : DAEMON.EXE
OriginalFilename : daemon.exe
ProductName : DAEMON Tools
Created on : 12/03/2004 20.43.18
Last accessed : 11/06/2004 5.43.43
Last modified : 12/03/2004 20.43.18

#:11 [rundll32.exe]
FilePath : C:\WINDOWS\System32\
ThreadCreationTime : 11-06-2004 5.44.05
BasePriority : Normal
FileSize : 31 KB
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
CompanyName : Microsoft Corporation
FileDescription : Modulo di esecuzione DLL come applicazioni
InternalName : rundll
OriginalFilename : RUNDLL.EXE
ProductName : Sistema operativo Microsoft
Created on : 31/08/2001 12.00.00
Last accessed : 11/06/2004 5.43.43
Last modified : 31/08/2001 12.00.00

#:12 [sistray.exe]
FilePath : C:\WINDOWS\System32\
ThreadCreationTime : 11-06-2004 5.44.06
BasePriority : Normal
FileSize : 260 KB
FileVersion : 0.0.0.2030
ProductVersion : 0.0.0.2030
Copyright : Copyright (C) Silicon Integrated Systems Corp. 1998-2000
CompanyName : Silicon Integrated Systems Corporation
FileDescription : SiS 630/730 Super VGA Tray Application
InternalName : SISTRAY 2.03.01
OriginalFilename : SISTRAY.EXE
ProductName : SiS (R) 630/730 SiSTray application for Windows NT4.0/2000/XP
Created on : 04/06/2004 18.48.30
Last accessed : 11/06/2004 5.43.43
Last modified : 13/08/2001 7.56.06

#:13 [ctfmon.exe]
FilePath : C:\WINDOWS\System32\
ThreadCreationTime : 11-06-2004 5.44.06
BasePriority : Normal
FileSize : 13 KB
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
CompanyName : Microsoft Corporation
FileDescription : CTF Loader
InternalName : CTFMON
OriginalFilename : CTFMON.EXE
ProductName : Microsoft
Created on : 31/08/2001 12.00.00
Last accessed : 11/06/2004 5.43.43
Last modified : 31/08/2001 12.00.00

#:14 [ad-aware.exe]
FilePath : C:\Programmi\Lavasoft\Ad-aware 6\
ThreadCreationTime : 11-06-2004 5.51.42
BasePriority : Normal
FileSize : 668 KB
FileVersion : 6.0.1.181
ProductVersion : 6.0.0.0
Copyright : Copyright
CompanyName : Lavasoft Sweden
FileDescription : Ad-aware 6 core application
InternalName : Ad-aware.exe
OriginalFilename : Ad-aware.exe
ProductName : Lavasoft Ad-aware Plus
Created on : 09/06/2004 9.40.02
Last accessed : 11/06/2004 5.51.42
Last modified : 12/07/2003 20.00.20

Risultato del controllo della memoria:
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
Nuovi oggetti: 0
Oggetti identificati: 0


Analisi registro avviata
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

CoolWebSearch Oggetto riconosciuto!
Tipo : Valore di registro
Dato :
Rootkey : HKEY_LOCAL_MACHINE
Oggetto : SOFTWARE\Microsoft\Internet Explorer\Main
Valore : HOMEOldSP


Risultato del controllo del registro:
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
Nuovi oggetti: 1
Oggetti identificati: 1


Analisi approfondita registro avviata
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
Possibile attacco incontrollato al browser : Software\Microsoft\Internet Explorer\MainStart Pageabout:blank

Possible Browser Hijack attempt Oggetto riconosciuto!
Tipo : Dato di registro
Dato : "about:blank"
Rootkey : HKEY_CURRENT_USER
Oggetto : Software\Microsoft\Internet Explorer\Main
Valore : Start Page
Dato : "about:blank"

Possibile attacco incontrollato al browser : Software\Microsoft\Internet Explorer\MainStart Pageabout:blank

Possible Browser Hijack attempt Oggetto riconosciuto!
Tipo : Dato di registro
Dato : "about:blank"
Rootkey : HKEY_LOCAL_MACHINE
Oggetto : Software\Microsoft\Internet Explorer\Main
Valore : Start Page
Dato : "about:blank"


Risultato del controllo approfondito del registro:
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
Nuovi oggetti: 2
Oggetti identificati: 3


¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

Tracking Cookie Oggetto riconosciuto!
Tipo : File
Dato : principale@cgi-bin[1].txt
Oggetto : C:\Documents and Settings\Principale\Cookies\

Created on : 10/06/2004 11.37.55
Last accessed : 11/06/2004 5.54.24
Last modified : 10/06/2004 11.37.55



Tracking Cookie Oggetto riconosciuto!
Tipo : File
Dato : principale@counter4.sextracker[1].txt
Oggetto : C:\Documents and Settings\Principale\Cookies\

Created on : 10/06/2004 17.20.44
Last accessed : 11/06/2004 5.54.24
Last modified : 10/06/2004 17.20.44



Tracking Cookie Oggetto riconosciuto!
Tipo : File
Dato : principale@sextracker[1].txt
Oggetto : C:\Documents and Settings\Principale\Cookies\

Created on : 10/06/2004 17.20.44
Last accessed : 11/06/2004 5.54.25
Last modified : 10/06/2004 17.20.44


¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯


Controllo ed esame approfondito files (C
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯


Scanning Hosts file(C:\WINDOWS\System32\drivers\etc\hosts)
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯ ¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

Hosts file scan result:
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
1 entries scanned.
Nuovi oggetti:0
Oggetti identificati: 6




Performing conditional scans..
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

CoolWebSearch Oggetto riconosciuto!
Tipo : Chiave di registro
Dato :
Rootkey : HKEY_CLASSES_ROOT
Oggetto : PROTOCOLS\Filter\text/html


CoolWebSearch Oggetto riconosciuto!
Tipo : Chiave di registro
Dato :
Rootkey : HKEY_CLASSES_ROOT
Oggetto : PROTOCOLS\Filter\text/plain


CoolWebSearch Oggetto riconosciuto!
Tipo : Valore di registro
Dato :
Rootkey : HKEY_CURRENT_USER
Oggetto : Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
Valore : ITBarLayout


Conditional scan result:
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
Nuovi oggetti: 3
Oggetti identificati: 9


7.55.56 Controllo completato

Sommario di questo controllo
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
Tempo totale di controllo:00.03.42.921
Elementi controllati:40753
Elementi identificati:9
Elementi ignorati:0
Nuovi oggetti:9

[Kreatore]

ok e poi ho eseguito hjt da una nuova cartella, e questo è il log ottenuto.

Logfile of HijackThis v1.97.7
Scan saved at 7.59.49, on 11/06/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\slserv.exe
C:\Programmi\D-Tools\daemon.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\sistray.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Principale\Documenti\Nuova cartella\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\gkkfeaa.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\gkkfeaa.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\gkkfeaa.dll/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\gkkfeaa.dll/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\gkkfeaa.dll/sp.html (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\gkkfeaa.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: (no name) - {0229B326-F73B-48D8-9B18-D4F61DAFB99C} - C:\WINDOWS\System32\gkkfeaa.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programmi\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [CnxTrApp] rundll32.exe "C:\Programmi\StarModem\StarModem USB Network\CnxTrApp.dll",AppEntry -REG "Conexant\Conexant USB Network"
O4 - HKLM\..\Run: [SiS Tray] C:\WINDOWS\System32\sistray.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Scarica con il Wizard di LeechGet - file://C:\Programmi\LeechGet 2002\\Wizard.html
O8 - Extra context menu item: Scarica con LeechGet - file://C:\Programmi\LeechGet 2002\\AddUrl.html
O8 - Extra context menu item: Scarica pagina con LeechGet - file://C:\Programmi\LeechGet 2002\\Parser.html
O16 - DPF: {53D602E4-66ED-4B03-A5B8-19E4F4F6F18F} (Tiphone Control) - http://fax.tiscali.it/netphone/ocx/tiphone.cab
O16 - DPF: {7F8B2500-3B5D-474C-B828-C766ECE3AB3C} (ATLmosquito1 Class) - http://netphone.tiscali.it/netphone/ocx/mosquito.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab


Grazie ancora per il vostro aiuto.

[amvinfe]

Adesso scaricati questi due programmi

SP.html - Hijack Fixer
CWShredder

Chiudi tutte le applicazioni, browser e connessione compresi.

Metti all'interno di una nuova cartella il programma SP.html - Hijack Fixer, aprilo e clicca su "start disinfection".
Riavvia il computer.
Apri CWShredder e clicca su Fix.
Riavvia il computer.
Posta un nuovo Log di HJT.

Altre informazioni su questo trojan/hijacker le trovi in questa scheda.

http://www.alground.com/virus/scheda...p?cod_virus=87


IMPORTANTE!
Finite tutte le rimozioni devi aggiornare il sistema operativo scaricando tutte gli aggiornamenti importanti servendoti del WindowsUpdate.

[Kreatore]

Ciao amvinfe e grazie.

Allora ho fatto quanto mi hai detto, ho anche letto la pagina che mi hai consigliato e sembra che la pagina iniziale sia ora finalmente corretta. Il problema è che comunque il computer rimane lento rispetto a prima. Sono sempre infetto? questo il log di hjt:

Logfile of HijackThis v1.97.7
Scan saved at 13.49.32, on 11/06/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\slserv.exe
C:\Programmi\D-Tools\daemon.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\sistray.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Documents and Settings\Principale\Documenti\Nuova cartella\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programmi\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [CnxTrApp] rundll32.exe "C:\Programmi\StarModem\StarModem USB Network\CnxTrApp.dll",AppEntry -REG "Conexant\Conexant USB Network"
O4 - HKLM\..\Run: [SiS Tray] C:\WINDOWS\System32\sistray.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Scarica con il Wizard di LeechGet - file://C:\Programmi\LeechGet 2002\\Wizard.html
O8 - Extra context menu item: Scarica con LeechGet - file://C:\Programmi\LeechGet 2002\\AddUrl.html
O8 - Extra context menu item: Scarica pagina con LeechGet - file://C:\Programmi\LeechGet 2002\\Parser.html
O16 - DPF: {53D602E4-66ED-4B03-A5B8-19E4F4F6F18F} (Tiphone Control) - http://fax.tiscali.it/netphone/ocx/tiphone.cab
O16 - DPF: {7F8B2500-3B5D-474C-B828-C766ECE3AB3C} (ATLmosquito1 Class) - http://netphone.tiscali.it/netphone/ocx/mosquito.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab


Cosa devo fare ora. Grazie e ancora grazie.

[amvinfe]

Apri HJT metti la spunta al fianco di

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about :blank

chiudi tutte le applicazioni browser compreso, clicca su Fix checked.
Riavvia.
Fai un nuovo scan con AdAware, non cancellare nulla e posta il suo Log


Ti ricordo ancora che hai un sistema potenzialmente attaccabile visto che non hai ancora fatto gli Update della Microsoft.

[Kreatore]

questo è il log di ad-aware.
Lista processi attivi
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

#:1 [smss.exe]
FilePath : \SystemRoot\System32\
ThreadCreationTime : 14-06-2004 9.56.46
BasePriority : Normal


#:2 [winlogon.exe]
FilePath : \??\C:\WINDOWS\system32\
ThreadCreationTime : 14-06-2004 9.56.57
BasePriority : High


#:3 [services.exe]
FilePath : C:\WINDOWS\system32\
ThreadCreationTime : 14-06-2004 9.56.59
BasePriority : Normal
FileSize : 99 KB
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
CompanyName : Microsoft Corporation
FileDescription : Applicazione Servizi e Controller
InternalName : services.exe
OriginalFilename : services.exe
ProductName : Sistema operativo Microsoft
Created on : 31/08/2001 12.00.00
Last accessed : 14/06/2004 9.56.44
Last modified : 31/08/2001 12.00.00

#:4 [lsass.exe]
FilePath : C:\WINDOWS\system32\
ThreadCreationTime : 14-06-2004 9.56.59
BasePriority : Normal
FileSize : 11 KB
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
CompanyName : Microsoft Corporation
FileDescription : LSA Shell (Export Version)
InternalName : lsass.exe
OriginalFilename : lsass.exe
ProductName : Microsoft
Created on : 31/08/2001 12.00.00
Last accessed : 14/06/2004 9.56.44
Last modified : 31/08/2001 12.00.00

#:5 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ThreadCreationTime : 14-06-2004 9.57.00
BasePriority : Normal
FileSize : 12 KB
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
OriginalFilename : svchost.exe
ProductName : Microsoft
Created on : 31/08/2001 12.00.00
Last accessed : 14/06/2004 9.56.44
Last modified : 31/08/2001 12.00.00

#:6 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ThreadCreationTime : 14-06-2004 9.57.00
BasePriority : Normal
FileSize : 12 KB
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
OriginalFilename : svchost.exe
ProductName : Microsoft
Created on : 31/08/2001 12.00.00
Last accessed : 14/06/2004 9.56.44
Last modified : 31/08/2001 12.00.00

#:7 [spoolsv.exe]
FilePath : C:\WINDOWS\system32\
ThreadCreationTime : 14-06-2004 9.57.04
BasePriority : Normal
FileSize : 50 KB
FileVersion : 5.1.2600.0 (XPClient.010817-1148)
ProductVersion : 5.1.2600.0
CompanyName : Microsoft Corporation
FileDescription : Spooler SubSystem App
InternalName : spoolsv.exe
OriginalFilename : spoolsv.exe
ProductName : Microsoft
Created on : 31/08/2001 12.00.00
Last accessed : 14/06/2004 9.56.44
Last modified : 31/08/2001 12.00.00

#:8 [explorer.exe]
FilePath : C:\WINDOWS\
ThreadCreationTime : 14-06-2004 9.57.05
BasePriority : Normal
FileSize : 980 KB
FileVersion : 6.00.2600.0000 (xpclient.010817-1148)
ProductVersion : 6.00.2600.0000
CompanyName : Microsoft Corporation
FileDescription : Esplora risorse
InternalName : explorer
OriginalFilename : EXPLORER.EXE
ProductName : Sistema operativo Microsoft
Created on : 31/08/2001 12.00.00
Last accessed : 14/06/2004 9.56.44
Last modified : 31/08/2001 12.00.00

#:9 [slserv.exe]
FilePath : C:\WINDOWS\system32\
ThreadCreationTime : 14-06-2004 9.57.06
BasePriority : Normal
FileSize : 44 KB
FileVersion : 2.80.00(24Apr2000)
ProductVersion : 2.80.00
Copyright : Copyright
FileDescription : User-Level Modem Service
InternalName : slserv
OriginalFilename : slserv.exe
ProductName : Modem
Created on : 29/10/2001 7.22.18
Last accessed : 14/06/2004 9.56.44
Last modified : 29/10/2001 7.22.18

#:10 [daemon.exe]
FilePath : C:\Programmi\D-Tools\
ThreadCreationTime : 14-06-2004 9.57.09
BasePriority : Normal
FileSize : 80 KB
FileVersion : 3.46.0.0
ProductVersion : 3.46.0.0
Copyright : Copyright (C) 2000-2004
CompanyName : DAEMON'S HOME
FileDescription : Virtual DAEMON Manager
InternalName : DAEMON.EXE
OriginalFilename : daemon.exe
ProductName : DAEMON Tools
Created on : 12/03/2004 20.43.18
Last accessed : 14/06/2004 9.56.44
Last modified : 12/03/2004 20.43.18

#:11 [rundll32.exe]
FilePath : C:\WINDOWS\System32\
ThreadCreationTime : 14-06-2004 9.57.10
BasePriority : Normal
FileSize : 31 KB
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
CompanyName : Microsoft Corporation
FileDescription : Modulo di esecuzione DLL come applicazioni
InternalName : rundll
OriginalFilename : RUNDLL.EXE
ProductName : Sistema operativo Microsoft
Created on : 31/08/2001 12.00.00
Last accessed : 14/06/2004 9.56.44
Last modified : 31/08/2001 12.00.00

#:12 [sistray.exe]
FilePath : C:\WINDOWS\System32\
ThreadCreationTime : 14-06-2004 9.57.10
BasePriority : Normal
FileSize : 260 KB
FileVersion : 0.0.0.2030
ProductVersion : 0.0.0.2030
Copyright : Copyright (C) Silicon Integrated Systems Corp. 1998-2000
CompanyName : Silicon Integrated Systems Corporation
FileDescription : SiS 630/730 Super VGA Tray Application
InternalName : SISTRAY 2.03.01
OriginalFilename : SISTRAY.EXE
ProductName : SiS (R) 630/730 SiSTray application for Windows NT4.0/2000/XP
Created on : 04/06/2004 18.48.30
Last accessed : 14/06/2004 9.56.44
Last modified : 13/08/2001 7.56.06

#:13 [ctfmon.exe]
FilePath : C:\WINDOWS\System32\
ThreadCreationTime : 14-06-2004 9.57.10
BasePriority : Normal
FileSize : 13 KB
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
CompanyName : Microsoft Corporation
FileDescription : CTF Loader
InternalName : CTFMON
OriginalFilename : CTFMON.EXE
ProductName : Microsoft
Created on : 31/08/2001 12.00.00
Last accessed : 14/06/2004 9.56.44
Last modified : 31/08/2001 12.00.00

#:14 [ad-aware.exe]
FilePath : C:\Programmi\Lavasoft\Ad-aware 6\
ThreadCreationTime : 14-06-2004 9.57.40
BasePriority : Normal
FileSize : 668 KB
FileVersion : 6.0.1.181
ProductVersion : 6.0.0.0
Copyright : Copyright
CompanyName : Lavasoft Sweden
FileDescription : Ad-aware 6 core application
InternalName : Ad-aware.exe
OriginalFilename : Ad-aware.exe
ProductName : Lavasoft Ad-aware Plus
Created on : 09/06/2004 9.40.02
Last accessed : 14/06/2004 9.57.40
Last modified : 12/07/2003 20.00.20

Risultato del controllo della memoria:
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
Nuovi oggetti: 0
Oggetti identificati: 0


Analisi registro avviata
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

CoolWebSearch Oggetto riconosciuto!
Tipo : Valore di registro
Dato :
Rootkey : HKEY_LOCAL_MACHINE
Oggetto : SOFTWARE\Microsoft\Internet Explorer\Main
Valore : HOMEOldSP


Risultato del controllo del registro:
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
Nuovi oggetti: 1
Oggetti identificati: 1


Analisi approfondita registro avviata
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
Possibile attacco incontrollato al browser : Software\Microsoft\Internet Explorer\MainStart Pageabout:blank

Possible Browser Hijack attempt Oggetto riconosciuto!
Tipo : Dato di registro
Dato : "about:blank"
Rootkey : HKEY_LOCAL_MACHINE
Oggetto : Software\Microsoft\Internet Explorer\Main
Valore : Start Page
Dato : "about:blank"


Risultato del controllo approfondito del registro:
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
Nuovi oggetti: 1
Oggetti identificati: 2


¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

Tracking Cookie Oggetto riconosciuto!
Tipo : File
Dato : principale@as1.falkag[2].txt
Oggetto : C:\Documents and Settings\Principale\Cookies\

Created on : 11/06/2004 16.30.35
Last accessed : 14/06/2004 10.00.22
Last modified : 11/06/2004 16.34.32



Tracking Cookie Oggetto riconosciuto!
Tipo : File
Dato : principale@bravenet[1].txt
Oggetto : C:\Documents and Settings\Principale\Cookies\

Created on : 11/06/2004 16.47.50
Last accessed : 14/06/2004 10.00.22
Last modified : 11/06/2004 16.47.50



Tracking Cookie Oggetto riconosciuto!
Tipo : File
Dato : principale@cgi-bin[1].txt
Oggetto : C:\Documents and Settings\Principale\Cookies\

Created on : 11/06/2004 11.58.53
Last accessed : 14/06/2004 10.00.22
Last modified : 11/06/2004 11.58.53



Tracking Cookie Oggetto riconosciuto!
Tipo : File
Dato : principale@cgi-bin[2].txt
Oggetto : C:\Documents and Settings\Principale\Cookies\

Created on : 11/06/2004 15.57.00
Last accessed : 14/06/2004 10.00.22
Last modified : 11/06/2004 15.57.00



Tracking Cookie Oggetto riconosciuto!
Tipo : File
Dato : principale@cgi-bin[3].txt
Oggetto : C:\Documents and Settings\Principale\Cookies\

Created on : 11/06/2004 16.00.20
Last accessed : 14/06/2004 10.00.22
Last modified : 11/06/2004 16.00.20



Tracking Cookie Oggetto riconosciuto!
Tipo : File
Dato : principale@counter4.sextracker[1].txt
Oggetto : C:\Documents and Settings\Principale\Cookies\

Created on : 11/06/2004 17.37.05
Last accessed : 14/06/2004 10.00.22
Last modified : 11/06/2004 17.37.05



Tracking Cookie Oggetto riconosciuto!
Tipo : File
Dato : principale@doubleclick[1].txt
Oggetto : C:\Documents and Settings\Principale\Cookies\

Created on : 11/06/2004 16.33.58
Last accessed : 14/06/2004 10.00.22
Last modified : 11/06/2004 16.34.07



Tracking Cookie Oggetto riconosciuto!
Tipo : File
Dato : principale@sexlist[1].txt
Oggetto : C:\Documents and Settings\Principale\Cookies\

Created on : 11/06/2004 17.43.11
Last accessed : 14/06/2004 10.00.22
Last modified : 11/06/2004 17.43.11



Tracking Cookie Oggetto riconosciuto!
Tipo : File
Dato : principale@sextracker[1].txt
Oggetto : C:\Documents and Settings\Principale\Cookies\

Created on : 11/06/2004 17.37.05
Last accessed : 14/06/2004 10.00.22
Last modified : 11/06/2004 17.37.05

Scanning Hosts file(C:\WINDOWS\System32\drivers\etc\hosts)
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯ ¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

Hosts file scan result:
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
1 entries scanned.
Nuovi oggetti:0
Oggetti identificati: 11