OHPE ver 4.12_23

[toni84]

Non mi pare assolutamente che il log di VirIt dimostri che ci fossero chiavi di avvio di mssearchnet.exe, anzi domostra che è stato kiamato da un DLL (kernel32).

Un po' di obbiettività per favore.

VirIt fa schifo ma pare non capirlo!!

[Tiseria]

Non mi pare assolutamente che il log di VirIt dimostri che ci fossero chiavi di avvio di mssearchnet.exe, anzi domostra che è stato kiamato da un DLL (kernel32).

Un po' di obbiettività per favore.

Ti consiglio di leggere questo messaggio attentamente riga per riga.

Si vede che tu sie proprio IGNORANTE all'ennesima potenza.

Virit ha dimostrato chiaramente che c'erano 2 programmi in esecuzione alla key 13: mssearchnet.exe e mscornet.exe


adesso ti spiego caro dylan come si legge il log in formato testo dei programmi in esecuzione automatica (e' piu' chiaro quello dal programma), quindi installati virit.

23 - 18/11/2005 - 12:11:55
13
kernel32.dll
C:\WINDOWS\System32\mssearchnet.exe
Stato: File NON trovato

Nella prima riga c'e' la data: 18/11/2005 - 12:11:55
Nella seconda la key: 13
Nella terza il valore stringa: kernel32.dll
Nella quarta il dato, cioè file che viene eseguito: C:\WINDOWS\System32\mssearchnet.exe
Nella quinta lo stato di presenza del file.

in poche parole equivale al formato di HJT

[kernel32.dll] C:\WINDOWS\System32\mssearchnet.exe

in poche parole tu hai confuso il valore stringa con il dato.

La key 13 di virit corrisponde a:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run

che puoi controllare anche da questo forum messaggio di Kata10 #236198 - Sat Nov 05 2005 23:23 , cerca nella pagina kernel32.dll e mssearchnet.exe

spero che ti ABBIA ILLUMINATO!!!!


Mamma mia che toppata che hai preso..
e hai la presunzione anche di scriverla...

Se tu non sai usare virit.. fai a meno di scrivere certe cazzate... perche' sei ridicolo... penso dovuto ad una tua certa arroganza e presunzione in materia di sicurezza.

A questo punto se sei una persona SERIA... aspetto le tue scuse.

Per quanto riguarda il sig. Tony84... si vede che la mamma degli ignoranti è sempre incinta.

E chiedo ai moderatori dei forum di PC Facile kadosh, piercing di prendere una posizione sul sig. Tony84 e anche sul comportamento poco serio di Dylan666.

Questo mio sfogo mi sembra piu' che dovuto.

[toni84]

Ma dai smettila io esprimo le mie opinioni,tu le puoi condividere come non le puoi condividere,ma questo non ti da il diritto di offendere,pare che io e dylan ci siamo scontrati + volte ma mai offessi,prendi esempio!!

Per quanto riguarda il sig. Tony84... si vede che la mamma degli ignoranti è sempre incinta.

E meglio che non ti risponda sarei troppo offensivo e ti farei piangere!!

[Tiseria]

Ma dai smettila io esprimo le mie opinioni,tu le puoi condividere come non le puoi condividere,ma questo non ti da il diritto di offendere,pare che io e dylan ci siamo scontrati + volte ma mai offessi,prendi esempio!!

E meglio che non ti risponda sarei troppo offensivo e ti farei piangere!!

Posso condividere quando una persona è nel giusto, ma non in questo caso.

Dylan666 ha SBAGLIATO, perche' ha espresso un concetto ERRATO!!!

Per quanto riguarda le offese... io non ho offeso nessuno...

Infatti la parola IGNORANTE non è un'offesa...

[toni84]

Io mi riferisco a me,non a dylan,io non ho detto niente solo che fa schifo VirIt semplice opinione personale che tu non condividi ed io non condivido la tua,già te l'avevo detto,è inutile che fai scaricare sempre quel programma che alla fine ha SOLO il 28% nella rilevazione dei malware,un pò poco non credi?ma da qui a dire che si devono prendere provvedimenti è esagerato,il forum non serve solo per risolvere i problemi,ma anche per confrontarsi scambiarsi le propio opinioni(anche contrastanti)ma senza arrivare a tutto a ciò!!da come capisco sei una donna,questo mi fa capire tutto ciao ciao

[Tiseria]

forum non serve solo per risolvere i problemi,ma anche per confrontarsi scambiarsi le propio opinioni(anche contrastanti)ma senza arrivare a tutto a ciò!!da come capisco sei una donna,questo mi fa capire tutto ciao ciao

Mi sa tanto che tu capisci poco....

infatti grazie a Virit che si è scoperto il file mscornet.exe e non a HJT.

Quindi di grande UTILITA'.... se uno lo sa usare...

[toni84]

si ok resta della tua opionione ed io resto della mia!!ciao alla prossima!!

[Dylan666]

Tiseria disco solo UNA cosa e poi la pianto, tanto tu continuerai a indicare VirIt come soluzione e tutti i mali del mondo semplicemente perché ti pesa usare HijackThis. Ricordo che continui a sponsorizzare un programma shareware e se l'utente si re-infetta dopo che è scaduto non può fare nulla a parte comprarlo (o cercare altre soluzioni), mentre HijackThis lo puoi usare all'infinito. Magari sarebbe bene farlo presente.

Ho letto troppo di fretta la riga della DLL (ho fatto confusione cone un'altro topic e a mia discolpa posso solo dire che mi si è rotto il monitor, come ho scritto pure in un topic, e ora come ora leggo queste pagine da una piccola TV da 15 pollici con risoluzione 640x480 e non è difficile sbagliare riga) e non ho paura (dovrei?) ad ammettere il grossolano errore.
Mi pare strano che HijackThis si sia perso una chiave così, senza un motivo e non è scluso che l'infezione possa essersi ripetuta succesivamente al log (quando l'ha postato lo aveva appena rimosso il file e poi sarebbe apparso almeno nei processi attivi, no?)

Ora, io non ho nulla contro VirIt ma se Tiseria stesso trovasse ad esempio un equivalente freeware per la rimozione delle DLL eseguite con "020 - Winlogon Notify" (con QUEL topic mi sono confiso ) sarebbe più utile (credo) per tutti.
Io sto cercando e spero di avere presto una risposta (almeno sul winlogon) per dare una risorsa in più GRATUITA e ILLIMITATA nel tempo per la rimozione dei malware. Intanto mi leggo e analizzo per gli utenti decine di log cercando di far capire come si distingue un processo "intruso" da uno che non lo è.
Credo sia più costruttivo che sponsorizzare uno shareware a ogni post.

allora virit non vedeva mscornet.exe

I limiti evidentemente ce li hanno TUTTI i programmi...

Chiedo scusa per aver postato senza leggere ettentamente il topic e avendolo confuso con un altro. Poi mi sono fatto prendere la mano dopo aver letto per l'ennesima volta il nome VirIt...

[luna11]

Per quanto riguarda il sig. Tony84... si vede che la mamma degli ignoranti è sempre incinta.

Veramente il detto dice che è quella degli imbecilli ad essere sempre incinta.
Forse nella foga hai confuso il proverbio.

[toni84]

Per quanto riguarda il sig. Tony84... si vede che la mamma degli ignoranti è sempre incinta.

Veramente il detto dice che è quella degli imbecilli ad essere sempre incinta.
Forse nella foga hai confuso il proverbio.

Quindi sarei imbecille?

[luna11]

Quindi sarei imbecille?

Certo che no !
Volevo solo difendere queste mamme

... si vede che la mamma degli ignoranti è sempre incinta.

Che male fanno ad esserlo ?
Siamo tutti figli di queste mamme e per ovviare a quest'altro " peccato originale " cerchiamo di migliorarci confrontando le nostre opinioni con quelle degli altri.
Almeno con chiunque voglia farlo in maniera civile .

Quella che invece combina danni è la mamma degli imbecilli.
E purtoppo è sempre incinta anche lei.

[toni84]

Si ma stavo scherzando,grazie per avermi confermato che non lo sono ciao ciao

[iko75]

a parte le polemiche innescatesi in questo topic che mi sembrano un po'sterili vi chiedo ancora un parere ringraziandovi anticipatamente.

Facendo scansioni con asquared non ho trovato niente, spybot mi ha trovato doubleclick e glielo fatto correggere, Ad-Aware ha trovato 3 critical objects (tracking cookie) e 7 negligible objects e anche questi li ho fatti eliminare.
Vi posto il log di Ad-Aware:

Ad-Aware SE Build 1.05
Logfile Created on:lunedì 21 novembre 2005 9.15.04
Using definitions file:SE1R75 15.11.2005
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

References detected during the scan:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
MRU List(TAC index:0):7 total references
Tracking Cookie(TAC index:3):3 total references
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Ad-Aware SE Settings
===========================
Set : Search for negligible risk entries
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep-scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan my Hosts file

Extended Ad-Aware SE Settings
===========================
Set : Unload recognized processes & modules during scan
Set : Ignore spanned files when scanning cab archives
Set : Scan registry for all users instead of current user only
Set : Always try to unload modules before deletion
Set : During removal, unload Explorer and IE if necessary
Set : Let Windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Block pop-ups aggressively
Set : Automatically select problematic objects in results lists
Set : Include basic Ad-Aware settings in log file
Set : Include additional Ad-Aware settings in log file
Set : Include reference summary in log file
Set : Include alternate data stream details in log file
Set : Show splash screen
Set : Backup current definitions file before updating
Set : Play sound at scan completion if scan locates critical objects


21-11-2005 9.15.04 - Scan started. (Full System Scan)

MRU List Object Recognized!
Location: : C:\Documents and Settings\Administrator\recent
Description : list of recently opened documents


MRU List Object Recognized!
Location: : software\microsoft\direct3d\mostrecentapplication
Description : most recent application to use microsoft direct3d


MRU List Object Recognized!
Location: : software\microsoft\direct3d\mostrecentapplication
Description : most recent application to use microsoft direct X


MRU List Object Recognized!
Location: : software\microsoft\directdraw\mostrecentapplication
Description : most recent application to use microsoft directdraw


MRU List Object Recognized!
Location: : S-1-5-21-3293823761-2915903831-1203752577-500\software\microsoft\directinput\mostrecentapplication
Description : most recent application to use microsoft directinput


MRU List Object Recognized!
Location: : S-1-5-21-3293823761-2915903831-1203752577-500\software\microsoft\directinput\mostrecentapplication
Description : most recent application to use microsoft directinput


MRU List Object Recognized!
Location: : S-1-5-21-3293823761-2915903831-1203752577-500\software\microsoft\windows\currentversion\explorer\recentdocs
Description : list of recent documents opened


Listing running processes
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

#:1 [smss.exe]
FilePath : \SystemRoot\System32\
ProcessID : 640
ThreadCreationTime : 21-11-2005 8.03.24
BasePriority : Normal


#:2 [csrss.exe]
FilePath : \??\C:\WINDOWS\system32\
ProcessID : 704
ThreadCreationTime : 21-11-2005 8.03.25
BasePriority : Normal


#:3 [winlogon.exe]
FilePath : \??\C:\WINDOWS\SYSTEM32\
ProcessID : 736
ThreadCreationTime : 21-11-2005 8.03.26
BasePriority : High


#:4 [services.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 780
ThreadCreationTime : 21-11-2005 8.03.27
BasePriority : Normal
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
ProductName : Sistema operativo Microsoft® Windows®
CompanyName : Microsoft Corporation
FileDescription : Applicazione Servizi e Controller
InternalName : services.exe
LegalCopyright : © Microsoft Corporation. Tutti i diritti riservati.
OriginalFilename : services.exe

#:5 [lsass.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 792
ThreadCreationTime : 21-11-2005 8.03.27
BasePriority : Normal
FileVersion : 5.1.2600.1106 (xpsp1.020828-1920)
ProductVersion : 5.1.2600.1106
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : LSA Shell (Export Version)
InternalName : lsass.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : lsass.exe

#:6 [ati2evxx.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 960
ThreadCreationTime : 21-11-2005 8.03.28
BasePriority : Normal


#:7 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 988
ThreadCreationTime : 21-11-2005 8.03.28
BasePriority : Normal
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:8 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 1088
ThreadCreationTime : 21-11-2005 8.03.28
BasePriority : Normal
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:9 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 1264
ThreadCreationTime : 21-11-2005 8.03.29
BasePriority : Normal
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:10 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 1296
ThreadCreationTime : 21-11-2005 8.03.29
BasePriority : Normal
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:11 [ccsetmgr.exe]
FilePath : C:\Programmi\File comuni\Symantec Shared\
ProcessID : 1384
ThreadCreationTime : 21-11-2005 8.03.29
BasePriority : Normal
FileVersion : 104.0.1.17
ProductVersion : 104.0.1.17
ProductName : Client and Host Security Platform
CompanyName : Symantec Corporation
FileDescription : Symantec Settings Manager Service
InternalName : ccSetMgr
LegalCopyright : Copyright (c) 2000-2005 Symantec Corporation. All rights reserved.
OriginalFilename : ccSetMgr.exe

#:12 [ccevtmgr.exe]
FilePath : C:\Programmi\File comuni\Symantec Shared\
ProcessID : 1408
ThreadCreationTime : 21-11-2005 8.03.30
BasePriority : Normal
FileVersion : 104.0.1.17
ProductVersion : 104.0.1.17
ProductName : Client and Host Security Platform
CompanyName : Symantec Corporation
FileDescription : Symantec Event Manager Service
InternalName : ccEvtMgr
LegalCopyright : Copyright (c) 2000-2005 Symantec Corporation. All rights reserved.
OriginalFilename : ccEvtMgr.exe

#:13 [sndsrvc.exe]
FilePath : C:\Programmi\File comuni\Symantec Shared\
ProcessID : 1480
ThreadCreationTime : 21-11-2005 8.03.30
BasePriority : Normal
FileVersion : 6.0.0.99
ProductVersion : 6.0
ProductName : Symantec Security Drivers
CompanyName : Symantec Corporation
FileDescription : Network Driver Service
InternalName : SndSrvc
LegalCopyright : Copyright 2002 - 2005 Symantec Corporation
OriginalFilename : SndSrvc.exe

#:14 [spbbcsvc.exe]
FilePath : C:\Programmi\File comuni\Symantec Shared\SPBBC\
ProcessID : 1500
ThreadCreationTime : 21-11-2005 8.03.30
BasePriority : Normal
FileVersion : 2,0,0,73
ProductVersion : 2,0,0,73
ProductName : SPBBC
CompanyName : Symantec Corporation
FileDescription : SPBBC Service
InternalName : SPBBCSvc
LegalCopyright : Copyright (c) 2004, 2005 Symantec Corporation. All rights reserved.
OriginalFilename : SPBBCSvc.exe

#:15 [spoolsv.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 1688
ThreadCreationTime : 21-11-2005 8.03.31
BasePriority : Normal
FileVersion : 5.1.2600.1699 (xpsp2.050610-1533)
ProductVersion : 5.1.2600.1699
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Spooler SubSystem App
InternalName : spoolsv.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : spoolsv.exe

#:16 [explorer.exe]
FilePath : C:\WINDOWS\
ProcessID : 192
ThreadCreationTime : 21-11-2005 8.03.38
BasePriority : Normal
FileVersion : 6.00.2800.1221 (xpsp2.030511-1403)
ProductVersion : 6.00.2800.1221
ProductName : Sistema operativo Microsoft® Windows®
CompanyName : Microsoft Corporation
FileDescription : Esplora risorse
InternalName : explorer
LegalCopyright : © Microsoft Corporation. Tutti i diritti riservati.
OriginalFilename : EXPLORER.EXE

#:17 [atiptaxx.exe]
FilePath : C:\Programmi\ATI Technologies\ATI Control Panel\
ProcessID : 372
ThreadCreationTime : 21-11-2005 8.03.40
BasePriority : Normal
FileVersion : 6.14.10.5029
ProductVersion : 6.14.10.5029
ProductName : ATI Desktop Component
CompanyName : ATI Technologies, Inc.
FileDescription : ATI Desktop Control Panel
InternalName : Atiptaxx.exe
LegalCopyright : Copyright (C) 1998-2002 ATI Technologies Inc.
OriginalFilename : Atiptaxx.exe

#:18 [carpserv.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 380
ThreadCreationTime : 21-11-2005 8.03.40
BasePriority : Normal
FileVersion : 6.01.05
ProductVersion : 6.01.05
ProductName : Conexant carpserv
CompanyName : Conexant Systems
FileDescription : carpserv
InternalName : carpserv
LegalCopyright : Copyright© Conexant Systems, Inc. 2003
OriginalFilename : carpserv.exe

#:19 [hydradm.exe]
FilePath : C:\Programmi\ATI Technologies\ATI HydraVision\
ProcessID : 432
ThreadCreationTime : 21-11-2005 8.03.40
BasePriority : Normal
FileVersion : 3.21.2108
ProductVersion : 3.21.2108
ProductName : ATI Technologies Inc. HydraVision Desktop Manager
CompanyName : ATI Technologies Inc.
FileDescription : HydraDM
InternalName : HydraDM
LegalCopyright : Copyright © ATI Technologies Inc. 1985-2002
OriginalFilename : HydraDM.exe

#:20 [daemon.exe]
FilePath : C:\Programmi\D-Tools\
ProcessID : 460
ThreadCreationTime : 21-11-2005 8.03.40
BasePriority : Normal


#:21 [realsched.exe]
FilePath : C:\Programmi\File comuni\Real\Update_OB\
ProcessID : 468
ThreadCreationTime : 21-11-2005 8.03.40
BasePriority : Normal
FileVersion : 0.1.0.3275
ProductVersion : 0.1.0.3275
ProductName : RealPlayer (32-bit)
CompanyName : RealNetworks, Inc.
FileDescription : RealNetworks Scheduler
InternalName : schedapp
LegalCopyright : Copyright © RealNetworks, Inc. 1995-2004
LegalTrademarks : RealAudio(tm) is a trademark of RealNetworks, Inc.
OriginalFilename : realsched.exe

#:22 [qttask.exe]
FilePath : C:\Programmi\QuickTime\
ProcessID : 508
ThreadCreationTime : 21-11-2005 8.03.40
BasePriority : Normal
FileVersion : 6.4
ProductVersion : QuickTime 6.4
ProductName : QuickTime
CompanyName : Apple Computer, Inc.
InternalName : QuickTime Task
LegalCopyright : © Apple Computer, Inc. 2001-2003
OriginalFilename : QTTask.exe

#:23 [trueimagemonitor.exe]
FilePath : C:\Programmi\Acronis\TrueImage\
ProcessID : 520
ThreadCreationTime : 21-11-2005 8.03.40
BasePriority : Normal
FileVersion : 8,0,0,889
ProductVersion : 8,0,0,889
ProductName : Acronis True Image
CompanyName : Acronis
FileDescription : TrueImage
InternalName : TrueImageMonitor
LegalCopyright : Copyright (C) 2000-2004 Acronis.
LegalTrademarks : Acronis
OriginalFilename : TrueImageMonitor.exe
Comments : Acronis True Image

#:24 [schedhlp.exe]
FilePath : C:\Programmi\File comuni\Acronis\Schedule2\
ProcessID : 532
ThreadCreationTime : 21-11-2005 8.03.40
BasePriority : Normal
FileVersion : 1,0,0,207
ProductVersion : 1,0,0,207
ProductName : Acronis Scheduler Helper
CompanyName : Acronis
FileDescription : Acronis Scheduler Helper
InternalName : Scheduler Helper
LegalCopyright : Copyright (C) 2000-2004 Acronis
LegalTrademarks : Acronis
OriginalFilename : schedhlp.exe
Comments : Acronis Scheduler Helper

#:25 [jusched.exe]
FilePath : C:\Programmi\Java\jre1.5.0_04\bin\
ProcessID : 548
ThreadCreationTime : 21-11-2005 8.03.40
BasePriority : Normal


#:26 [ccapp.exe]
FilePath : C:\Programmi\File comuni\Symantec Shared\
ProcessID : 556
ThreadCreationTime : 21-11-2005 8.03.40
BasePriority : Normal
FileVersion : 104.0.1.17
ProductVersion : 104.0.1.17
ProductName : Client and Host Security Platform
CompanyName : Symantec Corporation
FileDescription : Symantec User Session
InternalName : ccApp
LegalCopyright : Copyright (c) 2000-2005 Symantec Corporation. All rights reserved.
OriginalFilename : ccApp.exe

#:27 [schedul2.exe]
FilePath : C:\Programmi\File comuni\Acronis\Schedule2\
ProcessID : 572
ThreadCreationTime : 21-11-2005 8.03.40
BasePriority : Normal
FileVersion : 1,0,0,207
ProductVersion : 1,0,0,207
ProductName : Acronis Scheduler 2
CompanyName : Acronis
FileDescription : Acronis Scheduler 2
InternalName : Scheduler2
LegalCopyright : Copyright (C) 2000-2004 Acronis
LegalTrademarks : Acronis
OriginalFilename : schedul2.exe
Comments : Acronis Scheduler 2

#:28 [ewidoctrl.exe]
FilePath : C:\Programmi\ewido\security suite\
ProcessID : 720
ThreadCreationTime : 21-11-2005 8.03.41
BasePriority : Normal
FileVersion : 3, 0, 0, 1
ProductVersion : 3, 0, 0, 1
ProductName : ewido control
CompanyName : ewido networks
FileDescription : ewido control
InternalName : ewido control
LegalCopyright : Copyright © 2004
OriginalFilename : ewidoctrl.exe

#:29 [ctfmon.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 420
ThreadCreationTime : 21-11-2005 8.03.41
BasePriority : Normal
FileVersion : 5.1.2600.1106 (xpsp1.020828-1920)
ProductVersion : 5.1.2600.1106
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : CTF Loader
InternalName : CTFMON
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : CTFMON.EXE

#:30 [msmsgs.exe]
FilePath : C:\Programmi\Messenger\
ProcessID : 980
ThreadCreationTime : 21-11-2005 8.03.41
BasePriority : Normal
FileVersion : 4.7.2010
ProductVersion : Version 4.7
ProductName : Messenger
CompanyName : Microsoft Corporation
FileDescription : Messenger
InternalName : msmsgs
LegalCopyright : Copyright (c) Microsoft Corporation 1997-2003
LegalTrademarks : Microsoft(R) is a registered trademark of Microsoft Corporation in the U.S. and/or other countries.
OriginalFilename : msmsgs.exe

#:31 [mdm.exe]
FilePath : C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\
ProcessID : 1004
ThreadCreationTime : 21-11-2005 8.03.41
BasePriority : Normal
FileVersion : 7.00.9466
ProductVersion : 7.00.9466
ProductName : Microsoft® Visual Studio .NET
CompanyName : Microsoft Corporation
FileDescription : Machine Debug Manager
InternalName : mdm.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : mdm.exe

#:32 [navapsvc.exe]
FilePath : C:\Programmi\Norton AntiVirus\
ProcessID : 1072
ThreadCreationTime : 21-11-2005 8.03.43
BasePriority : Normal
FileVersion : 12.0.0.94
ProductVersion : 12.0.0
ProductName : Norton AntiVirus
CompanyName : Symantec Corporation
FileDescription : Norton AntiVirus Auto-Protect Service
InternalName : NAVAPSVC
LegalCopyright : Norton AntiVirus 2006 for Windows 2000/XP Copyright © 2005 Symantec Corporation. All rights reserved.
OriginalFilename : NAVAPSVC.EXE

#:33 [wzqkpick.exe]
FilePath : C:\Programmi\WinZip\
ProcessID : 1120
ThreadCreationTime : 21-11-2005 8.03.43
BasePriority : Normal
FileVersion : 1.0 (32-bit)
ProductVersion : 8.1 (4319)
ProductName : WinZip
CompanyName : WinZip Computing, Inc.
FileDescription : WinZip Executable
InternalName : WZQKPICK.EXE
LegalCopyright : Copyright (c) WinZip Computing, Inc. 1991-2001 - All Rights Reserved
LegalTrademarks : WinZip is a registered trademark of WinZip Computing, Inc
OriginalFilename : WZQKPICK.EXE
Comments : StringFileInfo: U.S. English

#:34 [npfmntor.exe]
FilePath : C:\Programmi\Norton AntiVirus\IWP\
ProcessID : 1276
ThreadCreationTime : 21-11-2005 8.03.46
BasePriority : Normal
FileVersion : 12.0.0.94
ProductVersion : 12.0.0
ProductName : Norton AntiVirus
CompanyName : Symantec Corporation
FileDescription : Norton AntiVirus Firewall Install Monitor
InternalName : NPFMonitor
LegalCopyright : Norton AntiVirus 2006 for Windows 2000/XP Copyright © 2005 Symantec Corporation. All rights reserved.
OriginalFilename : NPFMonitor.EXE

#:35 [realplay.exe]
FilePath : C:\Programmi\Real\RealPlayer\
ProcessID : 1336
ThreadCreationTime : 21-11-2005 8.03.46
BasePriority : Idle
FileVersion : 6.0.12.1069
ProductVersion : 6.0.12.1069
ProductName : RealPlayer (32-bit)
CompanyName : RealNetworks, Inc.
FileDescription : RealPlayer
InternalName : REALPLAY
LegalCopyright : Copyright © RealNetworks, Inc. 1995-2004
LegalTrademarks : RealAudio(tm) is a trademark of RealNetworks, Inc.
OriginalFilename : REALPLAY.EXE

#:36 [smagent.exe]
FilePath : C:\Programmi\Analog Devices\SoundMAX\
ProcessID : 1600
ThreadCreationTime : 21-11-2005 8.03.47
BasePriority : Normal
FileVersion : 3, 2, 6, 0
ProductVersion : 3, 2, 6, 0
ProductName : SoundMAX service agent
CompanyName : Analog Devices, Inc.
FileDescription : SoundMAX service agent component
InternalName : SMAgent
LegalCopyright : Copyright © 2002
OriginalFilename : SMAgent.exe

#:37 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 1628
ThreadCreationTime : 21-11-2005 8.03.47
BasePriority : Normal
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:38 [symlcsvc.exe]
FilePath : C:\Programmi\File comuni\Symantec Shared\CCPD-LC\
ProcessID : 1660
ThreadCreationTime : 21-11-2005 8.03.48
BasePriority : Normal
FileVersion : 1.9.1.762
ProductVersion : 1.9.1.762
ProductName : Symantec Core Component
CompanyName : Symantec Corporation
FileDescription : Symantec Core Component
InternalName : symlcsvc
LegalCopyright : Copyright (C) 2003
OriginalFilename : symlcsvc.exe

#:39 [wdfmgr.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 1948
ThreadCreationTime : 21-11-2005 8.03.49
BasePriority : Normal
FileVersion : 5.2.3790.1230 built by: dnsrv(bld4act)
ProductVersion : 5.2.3790.1230
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Windows User Mode Driver Manager
InternalName : WdfMgr
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : WdfMgr.exe

#:40 [nscsrvce.exe]
FilePath : C:\Programmi\File comuni\Symantec Shared\Security Console\
ProcessID : 3436
ThreadCreationTime : 21-11-2005 8.04.39
BasePriority : Normal
FileVersion : 2006.1.0.107
ProductVersion : 2006.1.0
ProductName : Norton Security Console
CompanyName : Symantec Corporation
FileDescription : Norton Security Console Norton Protection Center Service
InternalName : NSCService
LegalCopyright : Norton Security Console 2006 for Windows 2000/XP Copyright © 2005 Symantec Corporation. All rights reserved.
OriginalFilename : NSCSrvce.exe

#:41 [wuauclt.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 3888
ThreadCreationTime : 21-11-2005 8.04.59
BasePriority : Normal
FileVersion : 5.8.0.2469 built by: lab01_n(wmbla)
ProductVersion : 5.8.0.2469
ProductName : Sistema operativo Microsoft® Windows®
CompanyName : Microsoft Corporation
FileDescription : Aggiornamenti automatici
InternalName : wuauclt.exe
LegalCopyright : © Microsoft Corporation. Tutti i diritti riservati.
OriginalFilename : wuauclt.exe

#:42 [firefox.exe]
FilePath : C:\PROGRA~1\MOZILL~1\
ProcessID : 2000
ThreadCreationTime : 21-11-2005 8.05.16
BasePriority : Normal


#:43 [spybotsd.exe]
FilePath : C:\Programmi\Spybot - Search & Destroy\
ProcessID : 1144
ThreadCreationTime : 21-11-2005 8.11.05
BasePriority : Normal
FileVersion : 1, 3, 0, 12
ProductVersion : 1, 3, 0, 12
ProductName : SpyBot-S&D
CompanyName : Safer Networking Limited
FileDescription : Spybot - Search & Destroy
InternalName : SpybotSD
LegalCopyright : © 2000-2004 Patrick M. Kolla / Safer Networking Limited. Alle Rechte vorbehalten.
LegalTrademarks : "Spybot" und "Spybot - Search & Destroy" sind registrierte Warenzeichen.
OriginalFilename : SpyBotSD.exe
Comments : Software zum Entfernen von Spyware und ähnlichen Bedrohungen.

#:44 [a2start.exe]
FilePath : C:\Programmi\a2 Free\
ProcessID : 1556
ThreadCreationTime : 21-11-2005 8.11.08
BasePriority : Normal


#:45 [ad-aware.exe]
FilePath : C:\Programmi\Lavasoft\Ad-Aware SE Professional\
ProcessID : 1868
ThreadCreationTime : 21-11-2005 8.11.09
BasePriority : Normal
FileVersion : 6.2.0.208
ProductVersion : VI.Second Edition
ProductName : Lavasoft Ad-Aware SE
CompanyName : Lavasoft Sweden
FileDescription : Ad-Aware SE Core application
InternalName : Ad-Aware.exe
LegalCopyright : Copyright © Lavasoft Sweden
OriginalFilename : Ad-Aware.exe
Comments : All Rights Reserved

#:46 [a2scan.exe]
FilePath : C:\Programmi\a2 Free\
ProcessID : 3500
ThreadCreationTime : 21-11-2005 8.13.11
BasePriority : Normal


#:47 [iexplore.exe]
FilePath : C:\Programmi\Internet Explorer\
ProcessID : 860
ThreadCreationTime : 21-11-2005 8.14.13
BasePriority : Normal
FileVersion : 6.00.2800.1106 (xpsp1.020828-1920)
ProductVersion : 6.00.2800.1106
ProductName : Sistema operativo Microsoft® Windows®
CompanyName : Microsoft Corporation
FileDescription : Internet Explorer
InternalName : iexplore
LegalCopyright : © Microsoft Corporation. Tutti i diritti riservati.
OriginalFilename : IEXPLORE.EXE

Memory scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 7


Started registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Registry Scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 7


Started deep registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Deep registry scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 7


Started Tracking Cookie scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


Tracking Cookie Object Recognized!
Type : IECache Entry
Data : administrator@cgi-bin[1].txt
Category : Data Miner
Comment : Hits:1
Value : Cookie:administrator@imrworldwide.com/cgi-bin
Expires : 19-01-2009
LastSync : Hits:1
UseCount : 0
Hits : 1

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : administrator@doubleclick[1].txt
Category : Data Miner
Comment : Hits:1
Value : Cookie:administrator@doubleclick.net/
Expires : 21-11-2005 9.29.50
LastSync : Hits:1
UseCount : 0
Hits : 1

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : administrator@serving-sys[1].txt
Category : Data Miner
Comment : Hits:5
Value : Cookie:administrator@serving-sys.com/
Expires : 31-12-2037 23.00.00
LastSync : Hits:5
UseCount : 0
Hits : 5

Tracking cookie scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 3
Objects found so far: 10



Deep scanning and examining files (C:)
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Disk Scan Result for C:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 10


Scanning Hosts file......
Hosts file location:"C:\WINDOWS\system32\drivers\etc\hosts".
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Hosts file scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
1 entries scanned.
New critical objects:0
Objects found so far: 10




Performing conditional scans...
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Conditional scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 10

9.39.51 Scan Complete

Summary Of This Scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Total scanning time:00.24.47.379
Objects scanned:104508
Objects identified:3
Objects ignored:0
New critical objects:3

[iko75]

Vi posto anche il log di HijackThis..

Logfile of HijackThis v1.99.1
Scan saved at 10.28.01, on 21/11/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe
C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe
C:\Programmi\File comuni\Symantec Shared\SNDSrvc.exe
C:\Programmi\File comuni\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\carpserv.exe
C:\Programmi\ATI Technologies\ATI HydraVision\HydraDM.exe
C:\Programmi\D-Tools\daemon.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\Programmi\QuickTime\qttask.exe
C:\Programmi\Acronis\TrueImage\TrueImageMonitor.exe
C:\Programmi\File comuni\Acronis\Schedule2\schedhlp.exe
C:\Programmi\Java\jre1.5.0_04\bin\jusched.exe
C:\Programmi\File comuni\Symantec Shared\ccApp.exe
C:\Programmi\File comuni\Acronis\Schedule2\schedul2.exe
C:\Programmi\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmi\Norton AntiVirus\navapsvc.exe
C:\Programmi\WinZip\WZQKPICK.EXE
C:\Programmi\Norton AntiVirus\IWP\NPFMntor.exe
C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Programmi\File comuni\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\Outlook Express\MSIMN.EXE
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Programmi\AdunanzA Fastweb\eMule_AdnzA.exe
C:\Documents and Settings\Administrator\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.corriere.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Programmi\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Programmi\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HydraVisionDesktopManager] C:\Programmi\ATI Technologies\ATI HydraVision\HydraDM.exe
O4 - HKLM\..\Run: [CloneDVDElbyDelay] "C:\Programmi\Elaborate Bytes\CloneDVD\ElbyCheck.exe" /L ElbyDelay
O4 - HKLM\..\Run: [ElbyCheckAnyDVD] "C:\Programmi\SlySoft\AnyDVD\ElbyCheck.exe" /L AnyDVD
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programmi\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Acronis True Image Monitor] "C:\Programmi\Acronis\TrueImage\TrueImageMonitor.exe"
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Programmi\File comuni\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] "C:\Programmi\File comuni\Symantec Shared\Security Center\UsrPrmpt.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programmi\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Cerca con Google - res://c:\programmi\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Traduci parola in italiano - res://c:\programmi\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Link a ritroso - res://c:\programmi\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Pagine simili - res://c:\programmi\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Versione cache della pagina - res://c:\programmi\google\GoogleToolbar2.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\MSMSGS.EXE
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/qtinstall.info. ... taller.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/2408bcdb985 ... 601_it.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Programmi\File comuni\Acronis\Schedule2\schedul2.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programmi\ewido\security suite\ewidoctrl.exe
O23 - Service: Servizio Auto-Protect di Norton AntiVirus (navapsvc) - Symantec Corporation - C:\Programmi\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Programmi\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Programmi\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe

[Dylan666]

Scusandomi per il tempo e le righe che non sono state impiegate da parte mia alla soluzione del problema discusso ecco la mia analisi del log: aiutandomi con l'analizzatore on-line non mi pare di aver individuato componenti sospette.
Ti manca solo l'ultima versione di Internet Explorer

[iko75]

grazie ancora arrivederci da Carlo

[zico]

ciao a tutti!!!
ho anchio lo stesso problema e ho trovato questo forum facendo una ricerca...

che dire? fortuna che esistete ragazzi!!!


io mi son beccato stà cosa sul pc di mio fratello e voi avate evitato che diventassi un zico morto...

cmq io come primo step ho cancellato mscornet. exe e mssearchnet.exe
in modalità provvisoria e per adesso sembra tutto ok...prima però avevo fatto "girare" spybot e ad-aware che avevo trovato qualcosa ma non tutto.

poi ho trovato voi e anche il messaggio che diceva di fare prima una ricerca all'interno del forum onde evitare doppi topic.

vi ringrazio! avete fatto in modo che mio fratello non arrivasse a tagliarmi la gola!!!

vorrei chiedere se posso eventualmente postare(magari un log) in questo topic, se per caso avessi bisogno d'aiuto.

grazie ancora,

zico

[Dylan666]

Posta pure o utilizza l'analizzatore di log citato prima

[darschie]

Ciao a tutti continuo ad avere il problema nonostante abbia seguito e fatto (credo) tutto quello postato da Luke57.

Subito dopo aver seguito i consigli di Luke57 andava tutto bene, oggi (48 ore dopo) escono ancora queste odiate finestre.

di seguito il log

Logfile of HijackThis v1.99.1
Scan saved at 14.23.29, on 19/01/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programmi\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
C:\Programmi\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programmi\QuickTime\qttask.exe
C:\VEXPLITE\MONLITE.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Messenger\msmsgs.exe
C:\FRAPS\FRAPS.EXE
C:\WINDOWS\ATKKBService.exe
C:\Programmi\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Programmi\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Programmi\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programmi\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Programmi\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\mssearchnet.exe <---- l'odiato ce ankora
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\Outlook Express\msimn.exe
C:\Documents and Settings\dars\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wow-europe.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [nTrayFw] C:\Programmi\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [NVMixerTray] "C:\Programmi\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programmi\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [VIRIT LITE MONITOR] C:\VEXPLITE\MONLITE.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Fraps] C:\FRAPS\FRAPS.EXE
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O23 - Service: app_filter - Unknown owner - C:\Programmi\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Programmi\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Programmi\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - Unknown owner - C:\Programmi\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe


avete qualche consiglio ?

[Dylan666]

Termina il processo da Ctrl+Alt+Canc e leva a mano il file.
Se non riesci così vai da modalità provvisoria.

Ho letto il log di fretta ma non ho trovato chiavi che lo avviassero... strano! Ma potrebbe essere lanciato anche dal programma col quale lo hai installato quando lo usi, tipo un giochino freeware o un programma p2p con spyware