è ripartito... non si sa come ...dopo 10 min si sono caricate le icone e ora sto scrivendo da il pc incriminato
vi posto il nuovo log del hijack cosi ke anke voi possiate darmi un consiglio ed eventualmente capire il motivo di tutto sto tempo di "carica" insipiegabile...anke perke il disco cd è praticamente vuoto..
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Programmi\AntiVir PersonalEdition Classic\sched.exe
C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe
C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\hkcmd.exe
C:\Programmi\Analog Devices\SoundMAX\Smtray.exe
C:\Programmi\COMPAQ\Easy Access Button Support\StartEAK.exe
C:\WINNT\System32\PROMon.exe
C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINNT\System32\internat.exe
C:\WINNT\system32\ntvdm.exe
C:\Programmi\Compaq\Easy Access Button Support\CPQEAKSYSTEMTRAY.EXE
C:\Programmi\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\WINNT\System32\NMSSvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Programmi\ORL\VNC\WinVNC.exe
C:\WINNT\explorer.exe
C:\Hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://intouch.int.rit.gm.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://go.compaq.com/1Q00CDT/0410/bl8.asp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fornito da EDS
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL =
http://apc.channel21.eds.com/single.pac
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O1 - Hosts: 192.109.189.254 bmw_dns
O1 - Hosts: 192.109.189.125 bmw_notes1
O1 - Hosts: 192.109.189.160 bmw_notes2
O1 - Hosts: 192.109.189.100 bmw_os2
O1 - Hosts: 192.109.189.120 bmw_ntserv
O1 - Hosts: 193.42.235.200 bmw_email
O1 - Hosts: 192.109.189.252 ftp.conc.zi
O1 - Hosts: 194.10.153.1 motor1
O1 - Hosts: 194.10.153.2 motor2
O2 - BHO: Class - {E6203CE9-F85B-39ED-2664-E4F01572CCAF} - C:\WINNT\wjpwm1.dll (file missing)
O2 - BHO: Class - {F8E2757D-BCD5-F781-1CEA-48444F6DA913} - C:\WINNT\wjpwm1.dll (file missing)
O3 - Toolbar: @msdxmLC.dll,-1@1040,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [Smapp] C:\Programmi\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [CPQEASYACC] C:\Programmi\COMPAQ\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [PROMon.exe] PROMon.exe
O4 - HKLM\..\Run: [EPSON Stylus C62 Series] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C62 Series" /O5 "LPT1:" /M "Stylus C62"
O4 - HKLM\..\Run: [WinVNC] "C:\Programmi\ORL\VNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [avgnt] "C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [lrnp1.exe] C:\WINNT\TEMP\lrnp1.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [EPSON Stylus C62 Series] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /A "C:\WINNT\System32\E_S15.tmp"
O4 - Global Startup: lpdserver.lnk = C:\lpdserv\CTLAPP.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&sporta in Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O12 - Plugin for .mov: C:\Programmi\Netscape\Communicator\Program\PLUGINS\NPQTW32.DLL
O17 - HKLM\System\CCS\Services\Tcpip\..\{C41E7E5B-2544-4FCB-8E38-C8669B026038}: NameServer = 10.50.43.1
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmi\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - AVIRA GmbH - C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Servizio amministrativo di Gestione disco logico (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
O23 - Service: Help Menager (hlpmngc) - Unknown owner - C:\WINNT\downlo~1\wja869\g72dres.exe (file missing)
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Programmi\ORL\VNC\WinVNC.exe" -service (file missing)
) ....sono nel pc infetto...finalmente è partito...ora prima di riavviarlo sto attento....