Virus

di **kennymanson** » 11/02/04 09:43

Da qualche giorno il mio pc mi da questo segnale

Virus Trojan horse PSW.Hatkey.A
found in C:/sistem volume information/eccc eccc

Il virus è segnalato dal mio antivirus AVG
ke mi dice di fare una scansione per rimuovere il virus

ma io faccio la scansione e AVG non mi trova nulla. Mi dice che non ho virus.
Inoltre la cartella sopra citata non esiste sul mio pc, l'ho provata a cercare e non la trovo

Che posso fare?

di **ezechiel2517** » 11/02/04 10:06

La prima cosa da fare e' cliccare su IE, andare su GOOGLE, e inserire nella casellina delle ricerche il nome del Virus. Avvii la ricerca e trovi 1 solo risultato :eeh:

! QUESTO! Ma e' sufficiente!

Li consigliano di usare questo programma freeware.
Se non ti va di sporcarti le mani con registri e altri file "importanti" forse conviene ce te lo scarichi e lasci che sia lui a risolverti il problema.

di **kennymanson** » 11/02/04 11:41

quindi se ho capito bene

scarico il programma freeware
lancio uno scan
e poi?

devo cancellarlo io il file?
oggi provo a modo a casa poi vi so dire

ke palle sti trojan xo!!!

di **Triumph Of Steel** » 11/02/04 12:04

La cartella non la trovi xchè è SuperNascosta, ovvero devi abilitare la visualizzazione dei files nascosti e la visualizzazione dei files nascosti di Sistema

di **kennymanson** » 11/02/04 12:24

quindi mi consigliate di usare il programmino di cui sopra o di abilitare la visualizzazione dei file nascosti e cancellarla a mano?

di **Dylan666** » 11/02/04 13:17

In questi casi fai fare sempre prima al programmino che fa tutto in automatico e a differenza di te già sa cosa, dove e come cercare

di **kennymanson** » 11/02/04 15:01

Ho fatto la scansione con il programmino e mi da questo risultato ma il file che dice che è infetto ke è un .dll non c'è...

Logfile of HijackThis v1.97.7
Scan saved at 14.55.23, on 11/02/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\SCANJET\PrecisionScanLT\hppwrsav.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Programmi\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Programmi\Logitech\iTouch\iTouch.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Programmi\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Programmi\IPM\Adsl\DataWay\dslstat.exe
C:\WINDOWS\System32\dslagent.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmi\Logitech\MouseWare\system\em_exec.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\LightSurf\Common\IconMgr.exe
C:\Programmi\LightSurf\Colorific\hgcctl95.exe
C:\Programmi\File comuni\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Programmi\LightSurf\Color Indicator\TICIcon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Programmi\WinMX\WinMX.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\Zone Labs\ZoneAlarm\zapro.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Documents and Settings\Andrea\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://gw.aliceadsl.it/home
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - {000006B1-19B5-414A-849F-2A3C64AE6939} - C:\WINDOWS\bi.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [hppwrsav] C:\SCANJET\PrecisionScanLT\hppwrsav.exe
O4 - HKLM\..\Run: [59852236.exe] C:\WINDOWS\System32\59852236.exe
O4 - HKLM\..\Run: [Belt] C:\WINDOWS\Belt.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /startup
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Programmi\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmi\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Programmi\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Programmi\IPM\Adsl\DataWay\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [sws.exe] c:\\GlobalDialer\chost00000\gd-chost00000_it.exe -remove
O4 - Global Startup: LightSurf.lnk = C:\Programmi\LightSurf\Common\IconMgr.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programmi\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Promemoria del Calendario di Microsoft Works.lnk = ?
O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Programmi\Zone Labs\ZoneAlarm\zapro.exe
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .spop: C:\Programmi\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/C ... 3697685185
O16 - DPF: {F5192746-22D6-41BD-9D2D-1E75D14FBD3C} (ddm_download.ddm_control) - http://216.65.38.226/crack.CAB
O17 - HKLM\System\CCS\Services\Tcpip\..\{9AE0FD5E-D3F8-40FE-8A2F-C77221F51936}: NameServer = 151.99.125.1 151.99.0.100

di **Dylan666** » 11/02/04 15:12

Ho visto il tuo resoconto e ti sagnalo i file che mi "puzzano un po'":

Codice: Seleziona tutto: O4 - HKCU\..\Run: [sws.exe] c:\\GlobalDialer\chost00000\gd-chost00000_it.exe -remove O16 - DPF: {F5192746-22D6-41BD-9D2D-1E75D14FBD3C} (ddm_download.ddm_control) - http://216.65.38.226/crack.CAB

Magari mi sbaglio e i file sono molti di più, oppure questi 2 sono processi lecitissimi...

Nel dubbio, scaricati AD-aware o Spybot dalla sezione download del sito e (dopo averne aggiornate le difinizioni) con quelli scommetto che risolvi

di **ezechiel2517** » 11/02/04 15:17

Nel link che ti ho dato parla di questi:

O2 - BHO: (no name) - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - C:\WINDOWS\DOWNLOADED PROGRAM FILES\BRIDGE.DLL

O16 - DPF: {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} (brdg Class) - http://www2.flingstone.com/cab/98ME/bridge.cab

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.pogo.com/

R3 - Default URLSearchHook is missing

di **ezechiel2517** » 11/02/04 15:22

che pero' sembra non siano presenti nel tuo log! :-?

a me puzza anche questo:
O4 - HKLM\..\Run: [59852236.exe] C:\WINDOWS\System32\59852236.exe

(con google non ho risultati su questo exe :-?

)

di **Dylan666** » 11/02/04 15:24

Esatto, lo avevo notato pure io!
Direi che la passata di AD-aware diventa obbligatoria...

di **kennymanson** » 11/02/04 16:16

ma come farei senza questo forum...mah...non lo so proprio

siete grandi comunque!

Ecco il log file del ad-aware scusate se è lunghissimo

Lavasoft Ad-aware Personal Build 6.181
Logfile creato :mercoledì 11 febbraio 2004 16.08.03
Created with Ad-aware Personal, free for private use.
Reference file in uso:01R254 01.02.2004
______________________________________________________

Ad-aware Settings
=========================
Set : Attiva controllo approfondito
Set : Modo sicuro (richiedere sempre conferma)
Set : Controlla i processi attivi
Set : Controlla il registro
Set : Controllo dettagliato del registro

11-02-2004 16.08.03 - Scan started. (Custom mode)

Lista processi attivi
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

#:1 [smss.exe]
FilePath : \SystemRoot\System32\
ThreadCreationTime : 10-02-2004 16.11.16
BasePriority : Normal

#:2 [winlogon.exe]
FilePath : \??\C:\WINDOWS\system32\
ThreadCreationTime : 10-02-2004 16.11.22
BasePriority : High

#:3 [services.exe]
FilePath : C:\WINDOWS\system32\
ThreadCreationTime : 10-02-2004 16.11.22
BasePriority : Normal
FileSize : 99 KB
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
CompanyName : Microsoft Corporation
FileDescription : Applicazione Servizi e Controller
InternalName : services.exe
OriginalFilename : services.exe
ProductName : Sistema operativo Microsoft
Created on : 31/08/2001 11.00.00
Last accessed : 11/02/2004 15.08.03
Last modified : 31/08/2001 11.00.00

#:4 [lsass.exe]
FilePath : C:\WINDOWS\system32\
ThreadCreationTime : 10-02-2004 16.11.22
BasePriority : Normal
FileSize : 11 KB
FileVersion : 5.1.2600.1106 (xpsp1.020828-1920)
ProductVersion : 5.1.2600.1106
CompanyName : Microsoft Corporation
FileDescription : LSA Shell (Export Version)
InternalName : lsass.exe
OriginalFilename : lsass.exe
ProductName : Microsoft
Created on : 31/08/2001 11.00.00
Last accessed : 11/02/2004 14.31.33
Last modified : 09/09/2002 12.51.32

#:5 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ThreadCreationTime : 10-02-2004 16.11.23
BasePriority : Normal
FileSize : 12 KB
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
OriginalFilename : svchost.exe
ProductName : Microsoft
Created on : 31/08/2001 11.00.00
Last accessed : 11/02/2004 15.08.03
Last modified : 31/08/2001 11.00.00

#:6 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ThreadCreationTime : 10-02-2004 16.11.23
BasePriority : Normal
FileSize : 12 KB
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
OriginalFilename : svchost.exe
ProductName : Microsoft
Created on : 31/08/2001 11.00.00
Last accessed : 11/02/2004 15.08.03
Last modified : 31/08/2001 11.00.00

#:7 [spoolsv.exe]
FilePath : C:\WINDOWS\system32\
ThreadCreationTime : 10-02-2004 16.11.24
BasePriority : Normal
FileSize : 50 KB
FileVersion : 5.1.2600.0 (XPClient.010817-1148)
ProductVersion : 5.1.2600.0
CompanyName : Microsoft Corporation
FileDescription : Spooler SubSystem App
InternalName : spoolsv.exe
OriginalFilename : spoolsv.exe
ProductName : Microsoft
Created on : 31/08/2001 11.00.00
Last accessed : 11/02/2004 14.32.00
Last modified : 31/08/2001 11.00.00

#:8 [avgserv.exe]
FilePath : C:\PROGRA~1\Grisoft\AVG6\
ThreadCreationTime : 10-02-2004 16.11.25
BasePriority : Normal
FileSize : 20 KB
FileVersion : 6.0.1.9
ProductVersion : 6.0.1.9
Copyright : Copyright (c) GRISOFT(c) SOFTWARE 1998-2001
CompanyName : GRISOFT(c) SOFTWARE s.r.o
FileDescription : AvgServ - displays notification message
InternalName : AvgServ
OriginalFilename : AvgServ
ProductName : AVG6
Created on : 02/12/2003 21.44.18
Last accessed : 11/02/2004 14.25.40
Last modified : 21/11/2003 5.00.00

#:9 [nvsvc32.exe]
FilePath : C:\WINDOWS\System32\
ThreadCreationTime : 10-02-2004 16.11.25
BasePriority : Normal
FileSize : 80 KB
FileVersion : 6.14.10.5216
ProductVersion : 6.14.10.5216
Copyright : (C) NVIDIA Corporation. All rights reserved.
CompanyName : NVIDIA Corporation
FileDescription : NVIDIA Driver Helper Service, Version 52.16
InternalName : NVSVC
OriginalFilename : nvsvc32.exe
ProductName : NVIDIA Driver Helper Service, Version 52.16
Created on : 06/10/2003 13.16.00
Last accessed : 11/02/2004 14.31.48
Last modified : 06/10/2003 13.16.00

#:10 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ThreadCreationTime : 10-02-2004 16.11.27
BasePriority : Normal
FileSize : 12 KB
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
OriginalFilename : svchost.exe
ProductName : Microsoft
Created on : 31/08/2001 11.00.00
Last accessed : 11/02/2004 15.08.03
Last modified : 31/08/2001 11.00.00

#:11 [soundman.exe]
FilePath : C:\WINDOWS\
ThreadCreationTime : 10-02-2004 16.11.29
BasePriority : Normal
FileSize : 45 KB
FileVersion : 5.0.02
ProductVersion : 5.0.02
Copyright : Copyright (c) 2001-2002 Avance Logic, Inc.
CompanyName : Avance Logic, Inc.
FileDescription : Avance Sound Manager
InternalName : ALSMTray
OriginalFilename : ALSMTray.exe
ProductName : Avance Sound Manager
Created on : 19/11/2003 17.05.26
Last accessed : 11/02/2004 14.29.04
Last modified : 18/06/2002 10.44.20

#:12 [hppwrsav.exe]
FilePath : C:\SCANJET\PrecisionScanLT\
ThreadCreationTime : 10-02-2004 16.11.29
BasePriority : Normal
FileSize : 23 KB
Created on : 19/11/2003 17.16.35
Last accessed : 11/02/2004 14.28.59
Last modified : 07/06/1999 11.27.10

#:13 [avgcc32.exe]
FilePath : C:\PROGRA~1\Grisoft\AVG6\
ThreadCreationTime : 10-02-2004 16.11.29
BasePriority : Normal
FileSize : 337 KB
FileVersion : 6, 0, 0, 515
ProductVersion : 6, 0, 0, 0
Copyright : Copyright
CompanyName : GRISOFT s.r.o.
FileDescription : AVG Control Center
InternalName : AvgCC32
OriginalFilename : AvgCC32.EXE
ProductName : AVG Anti-Virus System
Created on : 02/12/2003 21.44.18
Last accessed : 11/02/2004 14.23.16
Last modified : 21/11/2003 5.00.00

#:14 [hpotdd01.exe]
FilePath : C:\Programmi\Hewlett-Packard\Digital Imaging\bin\
ThreadCreationTime : 10-02-2004 16.11.29
BasePriority : Normal
FileSize : 40 KB
FileVersion : 1, 0, 0, 1
ProductVersion : 1, 0, 0, 1
Copyright : Copyright
CompanyName : Hewlett-Packard
FileDescription : hpotdd01
InternalName : hpotdd01
OriginalFilename : hpotdd01.exe
ProductName : Hewlett-Packard hpotdd01
Created on : 02/12/2002 19.56.10
Last accessed : 11/02/2004 14.25.50
Last modified : 02/12/2002 19.56.10

#:15 [itouch.exe]
FilePath : C:\Programmi\Logitech\iTouch\
ThreadCreationTime : 10-02-2004 16.11.30
BasePriority : Normal
FileSize : 616 KB
FileVersion : 2.15.264
ProductVersion : 2.15.264
Copyright : (C) 1998-2002 Logitech. All rights reserved.
CompanyName : Logitech Inc.
FileDescription : iTouch Application
InternalName : iTouch
OriginalFilename : iTouch.exe
ProductName : iTouch
Created on : 25/12/2003 0.09.03
Last accessed : 11/02/2004 14.26.31
Last modified : 23/11/2002 1.15.00

#:16 [hpztsb08.exe]
FilePath : C:\WINDOWS\System32\spool\drivers\w32x86\3\
ThreadCreationTime : 10-02-2004 16.11.30
BasePriority : Normal
FileSize : 168 KB
FileVersion : 2,223,0,0
ProductVersion : 2,223,0,0
Copyright : Copyright (c) Hewlett-Packard Company 1999-2003
CompanyName : HP
ProductName : HP DeskJet
Created on : 09/12/2003 17.40.08
Last accessed : 11/02/2004 14.33.17
Last modified : 11/03/2003 10.08.52

#:17 [hpwuschd.exe]
FilePath : C:\Programmi\Hewlett-Packard\HP Software Update\
ThreadCreationTime : 10-02-2004 16.11.30
BasePriority : Normal
FileSize : 48 KB
Created on : 17/12/2002 10.40.22
Last accessed : 11/02/2004 14.26.03
Last modified : 17/12/2002 10.40.22

#:18 [dslstat.exe]
FilePath : C:\Programmi\IPM\Adsl\DataWay\
ThreadCreationTime : 10-02-2004 16.11.31
BasePriority : Normal
FileSize : 292 KB
FileVersion : 4.0.3
ProductVersion : 4.0.3
Copyright : Copyright (C) 2002
CompanyName : GlobespanVirata, Inc.
FileDescription : DSL Status Executable
InternalName : DslStatus
OriginalFilename : dslstatus.exe
ProductName : DSL Status
Created on : 30/01/2004 17.52.24
Last accessed : 11/02/2004 14.26.21
Last modified : 01/04/2003 10.32.08

#:19 [dslagent.exe]
FilePath : C:\WINDOWS\System32\
ThreadCreationTime : 10-02-2004 16.11.31
BasePriority : Normal
FileSize : 16 KB
Created on : 30/01/2004 17.52.25
Last accessed : 11/02/2004 14.31.19
Last modified : 01/04/2003 9.53.08

#:20 [ctfmon.exe]
FilePath : C:\WINDOWS\System32\
ThreadCreationTime : 10-02-2004 16.11.32
BasePriority : Normal
FileSize : 13 KB
FileVersion : 5.1.2600.1106 (xpsp1.020828-1920)
ProductVersion : 5.1.2600.1106
CompanyName : Microsoft Corporation
FileDescription : CTF Loader
InternalName : CTFMON
OriginalFilename : CTFMON.EXE
ProductName : Microsoft
Created on : 19/11/2003 16.13.06
Last accessed : 11/02/2004 14.31.13
Last modified : 09/09/2002 12.51.28

#:21 [em_exec.exe]
FilePath : C:\Programmi\Logitech\MouseWare\system\
ThreadCreationTime : 10-02-2004 16.11.32
BasePriority : Normal
FileSize : 37 KB
FileVersion : 9.75.302
ProductVersion : 9.75.302
Copyright : (C) 1987-2002 Logitech. All rights reserved.
CompanyName : Logitech Inc.
FileDescription : Logitech Events Handler Application
InternalName : Em_Exec
OriginalFilename : Em_Exec.exe
ProductName : MouseWare
Created on : 25/12/2003 0.09.29
Last accessed : 11/02/2004 14.26.33
Last modified : 21/11/2002 8.50.00

#:22 [msmsgs.exe]
FilePath : C:\Programmi\Messenger\
ThreadCreationTime : 10-02-2004 16.11.32
BasePriority : Normal
FileSize : 1462 KB
FileVersion : 4.7.2009
ProductVersion : Version 4.7
Copyright : Copyright (c) Microsoft Corporation 1997-2003
CompanyName : Microsoft Corporation
FileDescription : Messenger
InternalName : msmsgs
OriginalFilename : msmsgs.exe
ProductName : Messenger
Created on : 09/09/2002 12.51.34
Last accessed : 11/02/2004 14.21.58
Last modified : 14/04/2003 19.06.20

#:23 [iconmgr.exe]
FilePath : C:\Programmi\LightSurf\Common\
ThreadCreationTime : 10-02-2004 16.11.33
BasePriority : Normal
FileSize : 96 KB
FileVersion : 1, 0, 0, 1
ProductVersion : 1, 0, 0, 1
Copyright : Copyright
CompanyName : LightSurf Technologies, Inc.
FileDescription : IconMgr
InternalName : IconMgr
OriginalFilename : IconMgr.exe
ProductName : IconMgr
Created on : 12/12/2003 17.24.52
Last accessed : 11/02/2004 14.26.28
Last modified : 18/02/2003 7.41.56

#:24 [hgcctl95.exe]
FilePath : C:\Programmi\LightSurf\Colorific\
ThreadCreationTime : 10-02-2004 16.11.33
BasePriority : Normal
FileSize : 100 KB
FileVersion : 99, 50, 0, 3
ProductVersion : 99.50
Copyright : Copyright
CompanyName : LightSurf Technologies, Inc.
FileDescription : Colorific Control Panel
InternalName : HGCCTL95
OriginalFilename : HGCCTL95.EXE
ProductName : Colorific
Created on : 12/12/2003 17.24.51
Last accessed : 11/02/2004 14.26.28
Last modified : 18/02/2003 7.40.34

#:25 [wkcalrem.exe]
FilePath : C:\Programmi\File comuni\Microsoft Shared\Works Shared\
ThreadCreationTime : 10-02-2004 16.11.34
BasePriority : Normal
FileSize : 52 KB
FileVersion : 5.00.2004.0
ProductVersion : 5.00.2004.0
CompanyName : Microsoft
FileDescription : Microsoft
InternalName : WkCalRem
OriginalFilename : WKCALREM.EXE
ProductName : Microsoft
Created on : 06/08/1999 7.53.00
Last accessed : 11/02/2004 14.25.34
Last modified : 06/08/1999 7.53.00

#:26 [ticicon.exe]
FilePath : C:\Programmi\LightSurf\Color Indicator\
ThreadCreationTime : 10-02-2004 16.11.35
BasePriority : Normal
FileSize : 264 KB
FileVersion : 2, 2, 0, 3
ProductVersion : 2, 2, 0, 0
Copyright : Copyright
CompanyName : LightSurf Technologies, Inc.
FileDescription : TICIcon.exe
InternalName : TICIcon.exe
OriginalFilename : TICIcon.exe
ProductName : Color Indicator system tray application
Created on : 12/12/2003 17.30.04
Last accessed : 11/02/2004 14.26.26
Last modified : 18/02/2003 7.43.22

#:27 [wuauclt.exe]
FilePath : C:\WINDOWS\System32\
ThreadCreationTime : 10-02-2004 16.12.39
BasePriority : Normal
FileSize : 147 KB
FileVersion : 5.4.3790.20 built by: lab04_n
ProductVersion : 5.4.3790.20
CompanyName : Microsoft Corporation
FileDescription : Client dell'aggiornamento automatico di Windows Update
InternalName : wuauclt.exe
OriginalFilename : wuauclt.exe
ProductName : Sistema operativo Microsoft
Created on : 19/11/2003 16.12.16
Last accessed : 11/02/2004 14.32.14
Last modified : 30/01/2004 23.40.26

#:28 [winmx.exe]
FilePath : C:\Programmi\WinMX\
ThreadCreationTime : 10-02-2004 16.12.41
BasePriority : Normal
FileSize : 732 KB
FileVersion : 3.31
ProductVersion : 3.31
Copyright : Copyright (C) 2002 Frontcode Technologies, ALL RIGHTS RESERVED.
CompanyName : Frontcode Technologies
FileDescription : WinMX Application
InternalName : WinMX
OriginalFilename : winmx.exe
ProductName : WinMX
Created on : 03/02/2004 19.23.47
Last accessed : 11/02/2004 14.55.36
Last modified : 03/02/2004 19.23.47

#:29 [iexplore.exe]
FilePath : C:\Programmi\Internet Explorer\
ThreadCreationTime : 11-02-2004 12.58.50
BasePriority : Normal
FileSize : 89 KB
FileVersion : 6.00.2800.1106 (xpsp1.020828-1920)
ProductVersion : 6.00.2800.1106
CompanyName : Microsoft Corporation
FileDescription : Internet Explorer
InternalName : iexplore
OriginalFilename : IEXPLORE.EXE
ProductName : Sistema operativo Microsoft
Created on : 19/11/2003 16.13.34
Last accessed : 11/02/2004 15.04.32
Last modified : 09/09/2002 12.51.32

#:30 [zapro.exe]
FilePath : C:\Programmi\Zone Labs\ZoneAlarm\
ThreadCreationTime : 11-02-2004 14.17.10
BasePriority : Normal
FileSize : 413 KB
FileVersion : 4.0.123.012
ProductVersion : 4.0.123.012
Copyright : Copyright
CompanyName : Zone Labs Inc.
FileDescription : ZoneAlarm Pro
InternalName : zapro
OriginalFilename : zapro.exe
ProductName : ZoneAlarm Pro
Created on : 23/11/2003 19.45.00
Last accessed : 11/02/2004 14.28.57
Last modified : 09/06/2003 23.02.44

#:31 [vsmon.exe]
FilePath : C:\WINDOWS\system32\ZoneLabs\
ThreadCreationTime : 11-02-2004 14.17.11
BasePriority : Normal
FileSize : 873 KB
FileVersion : 4.0.123.012
ProductVersion : 4.0.123.012
Copyright : Copyright
CompanyName : Zone Labs Inc.
FileDescription : TrueVector Service
InternalName : vsmon
OriginalFilename : vsmon.exe
ProductName : TrueVector Service
Created on : 23/11/2003 19.44.58
Last accessed : 11/02/2004 14.17.11
Last modified : 09/06/2003 23.02.12

#:32 [explorer.exe]
FilePath : C:\WINDOWS\
ThreadCreationTime : 11-02-2004 14.23.13
BasePriority : Normal
FileSize : 983 KB
FileVersion : 6.00.2800.1106 (xpsp1.020828-1920)
ProductVersion : 6.00.2800.1106
CompanyName : Microsoft Corporation
FileDescription : Esplora risorse
InternalName : explorer
OriginalFilename : EXPLORER.EXE
ProductName : Sistema operativo Microsoft
Created on : 19/11/2003 16.13.14
Last accessed : 11/02/2004 14.29.02
Last modified : 09/09/2002 12.51.30

#:33 [wmplayer.exe]
FilePath : C:\Programmi\Windows Media Player\
ThreadCreationTime : 11-02-2004 14.23.57
BasePriority : Normal
FileSize : 72 KB
FileVersion : 9.00.00.2980
ProductVersion : 9.00.00.2980
Copyright : (C) Microsoft Corporation. Tutti i diritti riservati.
CompanyName : Microsoft Corporation
FileDescription : Windows Media Player
InternalName : WMPLAYER.EXE
OriginalFilename : WMPLAYER.EXE
ProductName : Microsoft(R) Windows Media Player
Created on : 19/11/2003 16.37.22
Last accessed : 11/02/2004 14.45.59
Last modified : 13/12/2002 14.57.28

#:34 [iexplore.exe]
FilePath : C:\Programmi\Internet Explorer\
ThreadCreationTime : 11-02-2004 15.04.31
BasePriority : Normal
FileSize : 89 KB
FileVersion : 6.00.2800.1106 (xpsp1.020828-1920)
ProductVersion : 6.00.2800.1106
CompanyName : Microsoft Corporation
FileDescription : Internet Explorer
InternalName : iexplore
OriginalFilename : IEXPLORE.EXE
ProductName : Sistema operativo Microsoft
Created on : 19/11/2003 16.13.34
Last accessed : 11/02/2004 15.04.32
Last modified : 09/09/2002 12.51.32

#:35 [ad-aware.exe]
FilePath : C:\Programmi\Lavasoft\Ad-aware 6\
ThreadCreationTime : 11-02-2004 15.07.57
BasePriority : Normal
FileSize : 668 KB
FileVersion : 6.0.1.181
ProductVersion : 6.0.0.0
Copyright : Copyright
CompanyName : Lavasoft Sweden
FileDescription : Ad-aware 6 core application
InternalName : Ad-aware.exe
OriginalFilename : Ad-aware.exe
ProductName : Lavasoft Ad-aware Plus
Created on : 08/01/2004 17.43.38
Last accessed : 11/02/2004 14.26.25
Last modified : 12/07/2003 21.00.20

Risultato del controllo della memoria:
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
Nuovi oggetti: 0
Oggetti identificati: 0

Analisi registro avviata
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

180Solutions Oggetto riconosciuto!
Tipo : Chiave di registro
Dato :
Rootkey : HKEY_CURRENT_USER
Oggetto : SOFTWARE\180solutions

180Solutions Oggetto riconosciuto!
Tipo : Chiave di registro
Dato :
Rootkey : HKEY_LOCAL_MACHINE
Oggetto : SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\nCASE

Alexa Oggetto riconosciuto!
Tipo : Chiave di registro
Dato :
Rootkey : HKEY_LOCAL_MACHINE
Oggetto : SOFTWARE\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}

DyFuCA Oggetto riconosciuto!
Tipo : Chiave di registro
Dato :
Rootkey : HKEY_CURRENT_USER
Oggetto : Software\Avenue Media

MSView Oggetto riconosciuto!
Tipo : Chiave di registro
Dato :
Rootkey : HKEY_CLASSES_ROOT
Oggetto : TypeLib\{690BCCB4-6B83-4203-AE77-038C116594EC}

StopPop Oggetto riconosciuto!
Tipo : Chiave di registro
Dato :
Rootkey : HKEY_CLASSES_ROOT
Oggetto : Interface\{4534CD6B-59D6-43FD-864B-06A0D843444A}

VX2.BetterInternet Oggetto riconosciuto!
Tipo : Chiave di registro
Dato :
Rootkey : HKEY_CLASSES_ROOT
Oggetto : bidll.bidllobj.1

VX2.BetterInternet Oggetto riconosciuto!
Tipo : Chiave di registro
Dato :
Rootkey : HKEY_CLASSES_ROOT
Oggetto : CLSID\{000006b1-19b5-414a-849f-2a3c64ae6939}

VX2.BetterInternet Oggetto riconosciuto!
Tipo : Chiave di registro
Dato :
Rootkey : HKEY_LOCAL_MACHINE
Oggetto : SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000006b1-19b5-414a-849f-2a3c64ae6939}

VX2.BetterInternet Oggetto riconosciuto!
Tipo : Chiave di registro
Dato :
Rootkey : HKEY_CLASSES_ROOT
Oggetto : vx2.vx2obj

Winpup32 Oggetto riconosciuto!
Tipo : Chiave di registro
Dato :
Rootkey : HKEY_CLASSES_ROOT
Oggetto : pup.setup

Winpup32 Oggetto riconosciuto!
Tipo : Chiave di registro
Dato :
Rootkey : HKEY_LOCAL_MACHINE
Oggetto : SOFTWARE\pup

Risultato del controllo del registro:
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
Nuovi oggetti: 12
Oggetti identificati: 12

Analisi approfondita registro avviata
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

Risultato del controllo approfondito del registro:
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
Nuovi oggetti: 0
Oggetti identificati: 12

Controllo ed esame approfondito files (C:)
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

Tracking Cookie Oggetto riconosciuto!
Tipo : File
Dato : andrea@sextracker[1].txt
Oggetto : C:\Documents and Settings\Andrea\Cookies\

Created on : 08/01/2004 0.40.52
Last accessed : 11/02/2004 14.20.13
Last modified : 06/01/2004 1.12.36

Tracking Cookie Oggetto riconosciuto!
Tipo : File
Dato : andrea@adtech[2].txt
Oggetto : C:\Documents and Settings\Andrea\Impostazioni locali\Temp\Cookies\

Created on : 26/01/2004 22.32.54
Last accessed : 11/02/2004 14.21.06
Last modified : 26/01/2004 22.32.54

Other Oggetto riconosciuto!
Tipo : File
Dato : andrea@cgi-bin[1].txt
Oggetto : C:\Documents and Settings\Andrea\Impostazioni locali\Temp\Cookies\

Created on : 26/01/2004 22.33.00
Last accessed : 11/02/2004 14.21.06
Last modified : 26/01/2004 22.33.00

Tracking Cookie Oggetto riconosciuto!
Tipo : File
Dato : andrea@doubleclick[1].txt
Oggetto : C:\Documents and Settings\Andrea\Impostazioni locali\Temp\Cookies\

Created on : 26/01/2004 22.35.05
Last accessed : 11/02/2004 14.21.06
Last modified : 26/01/2004 22.35.24

180Solutions Oggetto riconosciuto!
Tipo : File
Dato : del2.tmp
Oggetto : C:\Documents and Settings\Andrea\Impostazioni locali\Temp\
FileSize : 92 KB
Created on : 24/11/2003 17.00.12
Last accessed : 11/02/2004 14.21.06
Last modified : 23/11/2003 1.24.30

Winpup32 Oggetto riconosciuto!
Tipo : File
Dato : 50861757.exe
Oggetto : C:\WINDOWS\system32\
FileSize : 36 KB
FileVersion : 1.00
ProductVersion : 1.00
CompanyName : x
InternalName : winpup
OriginalFilename : winpup.exe
ProductName : pup
Created on : 23/11/2003 11.34.08
Last accessed : 11/02/2004 14.31.05
Last modified : 23/11/2003 1.18.34

Winpup32 Oggetto riconosciuto!
Tipo : File
Dato : 6983584.exe
Oggetto : C:\WINDOWS\system32\
FileSize : 36 KB
FileVersion : 1.00
ProductVersion : 1.00
CompanyName : x
InternalName : winpup
OriginalFilename : winpup.exe
ProductName : pup
Created on : 23/11/2003 1.18.34
Last accessed : 11/02/2004 14.31.05
Last modified : 23/11/2003 1.18.34

Winpup32 Oggetto riconosciuto!
Tipo : File
Dato : winpup.exe
Oggetto : C:\WINDOWS\system32\
FileSize : 36 KB
FileVersion : 1.00
ProductVersion : 1.00
CompanyName : x
InternalName : winpup
OriginalFilename : winpup.exe
ProductName : pup
Created on : 23/11/2003 16.53.58
Last accessed : 11/02/2004 14.32.08
Last modified : 23/11/2003 16.53.58

VX2.BetterInternet Oggetto riconosciuto!
Tipo : File
Dato : bi.dll
Oggetto : C:\WINDOWS\
FileSize : 148 KB
FileVersion : 0, 0, 4, 19
ProductVersion : 0, 0, 4, 19
Copyright : Copyright
CompanyName : Better Internet, Inc.
FileDescription : http://www.abetterinternet.com
InternalName : Win32 Bi Application
OriginalFilename : BI.DLL
ProductName : Win32 BI Application
Created on : 23/11/2003 1.21.47
Last accessed : 11/02/2004 14.23.08
Last modified : 16/09/2003 12.05.40

VX2.BetterInternet Oggetto riconosciuto!
Tipo : File
Dato : biprep.exe
Oggetto : C:\WINDOWS\
FileSize : 44 KB
Created on : 23/11/2003 1.21.47
Last accessed : 11/02/2004 14.29.01
Last modified : 04/07/2003 6.51.14

Risultato del controllo del disco C:\
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
Nuovi oggetti: 0
Oggetti identificati: 22

Performing conditional scans..
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

VX2.BetterInternet Oggetto riconosciuto!
Tipo : Chiave di registro
Dato :
Rootkey : HKEY_LOCAL_MACHINE
Oggetto : Software\Dbi

VX2.BetterInternet Oggetto riconosciuto!
Tipo : Chiave di registro
Dato :
Rootkey : HKEY_LOCAL_MACHINE
Oggetto : Software\Microsoft\Windows\CurrentVersion\Uninstall\Dbi

VX2.BetterInternet Oggetto riconosciuto!
Tipo : Valore di registro
Dato :
Rootkey : HKEY_LOCAL_MACHINE
Oggetto : SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Valore : Belt

VX2.BetterInternet Oggetto riconosciuto!
Tipo : Valore di registro
Dato :
Rootkey : HKEY_LOCAL_MACHINE
Oggetto : SYSTEM\LastKnownGoodRecovery\LastGood
Valore : INF/oem14.inf

VX2.BetterInternet Oggetto riconosciuto!
Tipo : File
Dato : bi.ini
Oggetto : c:\windows\
FileSize : 233 KB
Created on : 23/11/2003 13.32.02
Last accessed : 11/02/2004 15.09.31
Last modified : 06/02/2004 16.42.32

VX2.BetterInternet Oggetto riconosciuto!
Tipo : File
Dato : bi.inf
Oggetto : c:\windows\inf\
FileSize : 1 KB
Created on : 23/11/2003 1.21.47
Last accessed : 11/02/2004 14.29.34
Last modified : 25/09/2003 16.40.20

VX2.BetterInternet Oggetto riconosciuto!
Tipo : File
Dato : oem14.inf
Oggetto : c:\windows\lastgood\inf\

Created on : 14/01/2004 20.16.50
Last accessed : 11/02/2004 15.14.31
Last modified : 14/01/2004 20.16.50

VX2.BetterInternet Oggetto riconosciuto!
Tipo : File
Dato : oem14.pnf
Oggetto : c:\windows\lastgood\inf\

Created on : 14/01/2004 20.16.50
Last accessed : 11/02/2004 15.14.31
Last modified : 14/01/2004 20.16.50

Winpup32 Oggetto riconosciuto!
Tipo : Chiave di registro
Dato :
Rootkey : HKEY_CLASSES_ROOT
Oggetto : Interface\{EBD68E09-2966-44E4-B9B9-652F0B027BA4}

Conditional scan result:
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
Nuovi oggetti: 9
Oggetti identificati: 31

16.14.45 Controllo completato

Sommario di questo controllo
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
Tempo totale di controllo:00.06.41.719
Elementi controllati:116019
Elementi identificati:31
Elementi ignorati:0
Nuovi oggetti:31

di **Dylan666** » 11/02/04 17:19

Ci fa piacere che sia andato tutto per il meglio, ma la prossima volta taglia le parti non necessarie per rendere più facile la lettura...
Scansiona con una certa sistematicità il sistema: non ti preoccupare se spesso troverai qualche cookie "cattivo", l'importante è che nel tuo sistema non ci siano altri tipi di file (specialmente EXE), cartelle o chiavi nel registro segnalati come intrusi

di **kennymanson** » 11/02/04 17:35

no dylan non è andato tutto bene

ce l'ho ancora il virus e non so come toglierlo!!!

di **kennymanson** » 11/02/04 17:37

ho fatto solo la scansione ma non ho cancellato nulla

che devo fare?

di **Dylan666** » 11/02/04 17:41

Prima di fare la scansione controlla che questa opzione sia attiva: poi terminata la scansione, premi il tasto destro e scegli "Seleziona tutti". Infine premi "avanti" e assisterai alla copia di backup e rimozione di tutti i tuoi guai

di **kennymanson** » 11/02/04 18:07

ok era spuntata
ora rifaccio la scansione poi ti dico

grazie dylan davvero,
siete molto pazienti con me ke non ne so

ora vado a farla poi ti dico se ho risolto

di **kennymanson** » 11/02/04 21:41

niente da fare.
ho fatto la scansione con ad-aware ma non ha risolto nulla

ho rifatto la scansione con il programma freeware segnalatomi sopra
ora mi da questi risultati

Logfile of HijackThis v1.97.7
Scan saved at 21.39.57, on 11/02/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\SCANJET\PrecisionScanLT\hppwrsav.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Programmi\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Programmi\Logitech\iTouch\iTouch.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Programmi\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Programmi\IPM\Adsl\DataWay\dslstat.exe
C:\WINDOWS\System32\dslagent.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\Logitech\MouseWare\system\em_exec.exe
C:\Programmi\LightSurf\Common\IconMgr.exe
C:\Programmi\LightSurf\Colorific\hgcctl95.exe
C:\Programmi\File comuni\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Programmi\Zone Labs\ZoneAlarm\zapro.exe
C:\Programmi\LightSurf\Color Indicator\TICIcon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Programmi\WinMX\WinMX.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\eMule\emule.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Documents and Settings\Andrea\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://gw.aliceadsl.it/home
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [hppwrsav] C:\SCANJET\PrecisionScanLT\hppwrsav.exe
O4 - HKLM\..\Run: [59852236.exe] C:\WINDOWS\System32\59852236.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /startup
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Programmi\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmi\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Programmi\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Programmi\IPM\Adsl\DataWay\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [sws.exe] c:\\GlobalDialer\chost00000\gd-chost00000_it.exe -remove
O4 - Global Startup: LightSurf.lnk = C:\Programmi\LightSurf\Common\IconMgr.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programmi\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Promemoria del Calendario di Microsoft Works.lnk = ?
O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Programmi\Zone Labs\ZoneAlarm\zapro.exe
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .spop: C:\Programmi\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/C ... 3697685185
O16 - DPF: {F5192746-22D6-41BD-9D2D-1E75D14FBD3C} (ddm_download.ddm_control) - http://216.65.38.226/crack.CAB
O17 - HKLM\System\CCS\Services\Tcpip\..\{9AE0FD5E-D3F8-40FE-8A2F-C77221F51936}: NameServer = 151.99.125.1 151.99.0.100

devo cancellare qualcuno di questi?
ke posso fare di altro?

di **Dylan666** » 11/02/04 22:10

kennymanson ha scritto:niente da fare.
ho fatto la scansione con ad-aware ma non ha risolto nulla

ho rifatto la scansione con il programma freeware segnalatomi sopra
ora mi da questi risultati

Ninete da fare cosa? Premettendo che AD-aware è molto meglio di HijackThis una volta che hai eliminato il tutto con il primo software, che è successo? Hai rifatto una scansione? E l'antivirus segnala ancora l'infezione?

PS. per favore, se proprio dev postare i resoconti almeno dagli una bella pulita... per esempio i "running process" tagliali

di **Dylan666** » 11/02/04 22:14

Prova a leggere anche i molti topic sull'argomento qui:

http://www.cybertechhelp.com/forums/for ... y.php?f=25

Virus

Virus

Topic correlati a "Virus":

Chi c’è in linea