Precedente :: Successivo |
Autore |
Messaggio |
f.denart Mortale pio

Registrato: 07/02/08 20:26 Messaggi: 19
|
Inviato: 07 Feb 2008 21:04 Oggetto: virus adware.virtumonde |
|
|
salve a tutti, ho un pc con sistema operativo Windows XP home edition. Un attimo fa si è aperta una finestra di allarme di NOD32 che dice che il seguente file C.\Windows\system32\itggynpg.dll è infetto da Win32/Adware.Virtumonde
Cerco di chiudere la finestra di allarme ed eliminare il file ma riappare continuamente, anche riavviando il pc.
Cosa devo fare?
GRAZIE |
|
Top |
|
 |
bdoriano Amministratore


Registrato: 02/04/07 12:05 Messaggi: 14391 Residenza: 3° pianeta del sistema solare...
|
Inviato: 07 Feb 2008 21:11 Oggetto: |
|
|
Ciao f.denart,
- Scarica VundoFix e VirtumundoBegone e salvali sul desktop.
- Avvia VundoFix
Seleziona Scan for Vundo e a scansione terminata scegli Remove Vundo.
Clicca Yes e alla richiesta di riavviare il Pc rispondi Ok.
Al riavvio dovrebbe comparire il blocco-note con dentro il log, copia e posta sul forum il contenuto.
- Ora avvia in modalità provvisoria
Avvia VirtumundoBeGone e segui le indicazioni a video.
riavvia il Pc in modalità normale e posta il log.
- Segui le istruzioni di questo topic per postare il log di combofix.
- Fai anche un nuovo log di HijackThis e mettilo qui.
PS: se vuoi, puoi presentarti qui |
|
Top |
|
 |
f.denart Mortale pio

Registrato: 07/02/08 20:26 Messaggi: 19
|
Inviato: 07 Feb 2008 21:30 Oggetto: |
|
|
ho avviato VundoFix ma al riavvio compare il blocco note VBG ma è vuoto.
Cmq adesso avvio l'altro
Grazie |
|
Top |
|
 |
f.denart Mortale pio

Registrato: 07/02/08 20:26 Messaggi: 19
|
Inviato: 07 Feb 2008 21:36 Oggetto: |
|
|
[02/07/2008, 20:33:18] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\FEDERICO\Desktop\VirtumundoBeGone.exe" )
[02/07/2008, 20:33:26] - Detected System Information:
[02/07/2008, 20:33:26] - Windows Version: 5.1.2600, Service Pack 2
[02/07/2008, 20:33:26] - Current Username: FEDERICO (Admin)
[02/07/2008, 20:33:26] - Windows is in SAFE mode with Networking.
[02/07/2008, 20:33:26] - Searching for Browser Helper Objects:
[02/07/2008, 20:33:26] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Supporto di collegamento per Adobe PDF Reader)
[02/07/2008, 20:33:26] - BHO 2: {22BF413B-C6D2-4d91-82A9-A0F997BA588C} (Skype add-on (mastermind))
[02/07/2008, 20:33:26] - BHO 3: {5E85C971-F9E7-4F4D-A059-14FA00220C7A} ()
[02/07/2008, 20:33:26] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/07/2008, 20:33:26] - Checking for HKLM\...\Winlogon\Notify\byxwtrs
[02/07/2008, 20:33:26] - Found: HKLM\...\Winlogon\Notify\byxwtrs - This is probably Virtumundo.
[02/07/2008, 20:33:26] - Assigning {5E85C971-F9E7-4F4D-A059-14FA00220C7A} MSEvents Object
[02/07/2008, 20:33:26] - BHO list has been changed! Starting over...
[02/07/2008, 20:33:26] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Supporto di collegamento per Adobe PDF Reader)
[02/07/2008, 20:33:26] - BHO 2: {22BF413B-C6D2-4d91-82A9-A0F997BA588C} (Skype add-on (mastermind))
[02/07/2008, 20:33:26] - BHO 3: {5E85C971-F9E7-4F4D-A059-14FA00220C7A} (MSEvents Object)
[02/07/2008, 20:33:26] - ALERT: Found MSEvents Object!
[02/07/2008, 20:33:26] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[02/07/2008, 20:33:26] - BHO 5: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[02/07/2008, 20:33:26] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/07/2008, 20:33:26] - No filename found. Continuing.
[02/07/2008, 20:33:26] - BHO 6: {838B6A16-8E22-4EFA-82FA-9ED139C3F2C0} ()
[02/07/2008, 20:33:26] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/07/2008, 20:33:26] - Checking for HKLM\...\Winlogon\Notify\jkklk
[02/07/2008, 20:33:26] - Key not found: HKLM\...\Winlogon\Notify\jkklk, continuing.
[02/07/2008, 20:33:26] - BHO 7: {880c501f-3393-4ddd-b6c9-4667e55afb28} ()
[02/07/2008, 20:33:26] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/07/2008, 20:33:26] - Checking for HKLM\...\Winlogon\Notify\itggynpg
[02/07/2008, 20:33:26] - Key not found: HKLM\...\Winlogon\Notify\itggynpg, continuing.
[02/07/2008, 20:33:27] - BHO 8: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[02/07/2008, 20:33:27] - BHO 9: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[02/07/2008, 20:33:27] - Finished Searching Browser Helper Objects
[02/07/2008, 20:33:27] - *** Detected MSEvents Object
[02/07/2008, 20:33:27] - Trying to remove MSEvents Object...
[02/07/2008, 20:33:28] - Terminating Process: IEXPLORE.EXE
[02/07/2008, 20:33:28] - Terminating Process: RUNDLL32.EXE
[02/07/2008, 20:33:28] - Disabling Automatic Shell Restart
[02/07/2008, 20:33:28] - Terminating Process: EXPLORER.EXE
[02/07/2008, 20:33:28] - Suspending the NT Session Manager System Service
[02/07/2008, 20:33:28] - Terminating Windows NT Logon/Logoff Manager
[02/07/2008, 20:33:28] - Re-enabling Automatic Shell Restart
[02/07/2008, 20:33:28] - File to disable: C:\WINDOWS\system32\byxwtrs.dll
[02/07/2008, 20:33:28] - Renaming C:\WINDOWS\system32\byxwtrs.dll -> C:\WINDOWS\system32\byxwtrs.dll.vir
[02/07/2008, 20:33:28] - File successfully renamed!
[02/07/2008, 20:33:28] - Removing HKLM\...\Browser Helper Objects\{5E85C971-F9E7-4F4D-A059-14FA00220C7A}
[02/07/2008, 20:33:28] - Removing HKCR\CLSID\{5E85C971-F9E7-4F4D-A059-14FA00220C7A}
[02/07/2008, 20:33:28] - Adding Kill Bit for ActiveX for GUID: {5E85C971-F9E7-4F4D-A059-14FA00220C7A}
[02/07/2008, 20:33:28] - Deleting ATLEvents/MSEvents Registry entries
[02/07/2008, 20:33:28] - Removing HKLM\...\Winlogon\Notify\byxwtrs
[02/07/2008, 20:33:28] - Searching for Browser Helper Objects:
[02/07/2008, 20:33:28] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Supporto di collegamento per Adobe PDF Reader)
[02/07/2008, 20:33:29] - BHO 2: {22BF413B-C6D2-4d91-82A9-A0F997BA588C} (Skype add-on (mastermind))
[02/07/2008, 20:33:29] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[02/07/2008, 20:33:29] - BHO 4: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[02/07/2008, 20:33:29] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/07/2008, 20:33:29] - No filename found. Continuing.
[02/07/2008, 20:33:29] - BHO 5: {838B6A16-8E22-4EFA-82FA-9ED139C3F2C0} ()
[02/07/2008, 20:33:29] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/07/2008, 20:33:29] - Checking for HKLM\...\Winlogon\Notify\jkklk
[02/07/2008, 20:33:29] - Key not found: HKLM\...\Winlogon\Notify\jkklk, continuing.
[02/07/2008, 20:33:29] - BHO 6: {880c501f-3393-4ddd-b6c9-4667e55afb28} ()
[02/07/2008, 20:33:29] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/07/2008, 20:33:29] - Checking for HKLM\...\Winlogon\Notify\itggynpg
[02/07/2008, 20:33:29] - Key not found: HKLM\...\Winlogon\Notify\itggynpg, continuing.
[02/07/2008, 20:33:29] - BHO 7: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[02/07/2008, 20:33:29] - BHO 8: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[02/07/2008, 20:33:29] - Finished Searching Browser Helper Objects
[02/07/2008, 20:33:29] - Finishing up...
[02/07/2008, 20:33:29] - A restart is needed.
[02/07/2008, 20:33:48] - Attempting to Restart via STOP error (Blue Screen!) |
|
Top |
|
 |
f.denart Mortale pio

Registrato: 07/02/08 20:26 Messaggi: 19
|
Inviato: 07 Feb 2008 21:49 Oggetto: log di combofix |
|
|
ComboFix 08-02.05.3 - FEDERICO 2008-02-07 20.41.06.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1040.18.642 [GMT 1:00]
Eseguito da: C:\Documents and Settings\FEDERICO\Desktop\ComboFix.exe
* Creato nuovo punto di ripristino
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr1.dat
C:\WINDOWS\system32\crscxxjv.ini
C:\WINDOWS\system32\fnjgvkpq.dll
C:\WINDOWS\system32\fqylvwqx.dll
C:\WINDOWS\system32\lkwdvemw.ini
C:\WINDOWS\system32\tqoctqdh.ini
D:\Autorun.inf
----- BITS: Possible infected sites -----
hxxp://www.download.windowsupdate.com
.
((((((((((((((((((((((((( Files Creati Da 2008-01-07 al 2008-02-07 )))))))))))))))))))))))))))))))))))
.
2008-02-07 20:43 . 2008-02-07 20:43 268 --ah----- C:\sqmdata11.sqm
2008-02-07 20:43 . 2008-02-07 20:43 244 --ah----- C:\sqmnoopt11.sqm
2008-02-07 20:31 . 2008-02-07 20:31 268 --ah----- C:\sqmdata10.sqm
2008-02-07 20:31 . 2008-02-07 20:31 244 --ah----- C:\sqmnoopt10.sqm
2008-02-07 20:22 . 2008-02-07 20:22 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2008-02-07 20:15 . 2008-02-07 20:15 <DIR> d-------- C:\VundoFix Backups
2008-02-07 19:55 . 2008-02-07 19:55 36,864 --a------ C:\WINDOWS\system32\byxwtrs.V00dll
2008-02-07 19:27 . 2008-02-07 19:27 268 --ah----- C:\sqmdata09.sqm
2008-02-07 19:27 . 2008-02-07 19:27 244 --ah----- C:\sqmnoopt09.sqm
2008-02-07 19:13 . 2008-02-07 19:13 36,864 --a------ C:\WINDOWS\system32\byxwtrs.Vdll
2008-02-07 19:13 . 2008-02-07 19:13 268 --ah----- C:\sqmdata08.sqm
2008-02-07 19:13 . 2008-02-07 19:13 244 --ah----- C:\sqmnoopt08.sqm
2008-02-07 01:31 . 2008-02-07 01:31 268 --ah----- C:\sqmdata07.sqm
2008-02-07 01:31 . 2008-02-07 01:31 244 --ah----- C:\sqmnoopt07.sqm
2008-02-06 23:25 . 2008-02-06 23:26 92,224 --a------ C:\WINDOWS\system32\itggynpg.dll
2008-02-06 18:23 . 2008-02-06 18:23 268 --ah----- C:\sqmdata06.sqm
2008-02-06 18:23 . 2008-02-06 18:23 244 --ah----- C:\sqmnoopt06.sqm
2008-02-06 00:16 . 2008-02-06 00:16 268 --ah----- C:\sqmdata05.sqm
2008-02-06 00:16 . 2008-02-06 00:16 244 --ah----- C:\sqmnoopt05.sqm
2008-02-06 00:00 . 2008-02-06 00:00 268 --ah----- C:\sqmdata04.sqm
2008-02-06 00:00 . 2008-02-06 00:00 244 --ah----- C:\sqmnoopt04.sqm
2008-02-05 01:05 . 2008-02-05 01:05 268 --ah----- C:\sqmdata03.sqm
2008-02-05 01:05 . 2008-02-05 01:05 244 --ah----- C:\sqmnoopt03.sqm
2008-02-03 23:32 . 2008-02-03 23:32 268 --ah----- C:\sqmdata02.sqm
2008-02-03 23:32 . 2008-02-03 23:32 244 --ah----- C:\sqmnoopt02.sqm
2008-02-03 16:10 . 2008-02-03 16:10 268 --ah----- C:\sqmdata01.sqm
2008-02-03 16:10 . 2008-02-03 16:10 244 --ah----- C:\sqmnoopt01.sqm
2008-02-03 04:28 . 2008-02-03 04:28 268 --ah----- C:\sqmdata00.sqm
2008-02-03 04:28 . 2008-02-03 04:28 244 --ah----- C:\sqmnoopt00.sqm
2008-02-03 00:16 . 2004-08-19 15:39 91,136 --a------ C:\WINDOWS\system32\kswdmcap.ax
2008-01-30 21:09 . 2008-01-30 21:09 <DIR> d-------- C:\Programmi\Nero
2008-01-30 21:09 . 2008-01-30 21:12 <DIR> d-------- C:\Programmi\File comuni\Nero
2008-01-30 21:07 . 2008-01-30 21:07 36,864 --a------ C:\WINDOWS\system32\efcdeef.dll
2008-01-30 21:07 . 2008-01-30 21:07 36,352 --a------ C:\WINDOWS\system32\cbxyxvu.dll
2008-01-30 21:04 . 2008-01-30 21:04 36,352 --a------ C:\WINDOWS\system32\xxyayxx.dll
2008-01-30 21:00 . 2008-01-30 21:01 36,864 --a------ C:\WINDOWS\system32\byxwtrs.dll.vir
2008-01-30 13:57 . 2008-01-30 14:38 <DIR> d-a------ C:\Documents and Settings\All Users\Dati applicazioni\TEMP
2008-01-29 21:52 . 2008-02-03 13:53 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2008-01-29 21:52 . 2008-02-02 09:44 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2008-01-29 21:52 . 2008-02-03 13:53 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-01-29 21:50 . 2008-01-29 21:50 <DIR> dr-h----- C:\Documents and Settings\FEDERICO\Dati applicazioni\SecuROM
2008-01-29 21:50 . 2008-01-29 21:50 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2008-01-29 21:25 . 2008-01-29 21:25 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-01-29 21:08 . 2007-05-16 16:45 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll
2008-01-29 21:08 . 2007-05-16 16:45 1,124,720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll
2008-01-29 21:08 . 2007-03-12 16:42 1,123,696 --a------ C:\WINDOWS\system32\D3DCompiler_33.dll
2008-01-29 21:08 . 2007-05-16 16:45 443,752 --a------ C:\WINDOWS\system32\d3dx10_34.dll
2008-01-29 21:08 . 2007-03-15 16:57 443,752 --a------ C:\WINDOWS\system32\d3dx10_33.dll
2008-01-29 21:08 . 2007-06-20 20:46 266,088 --a------ C:\WINDOWS\system32\xactengine2_8.dll
2008-01-29 21:08 . 2007-04-04 18:55 261,480 --a------ C:\WINDOWS\system32\xactengine2_7.dll
2008-01-29 21:08 . 2007-04-04 18:53 81,768 --a------ C:\WINDOWS\system32\xinput1_3.dll
2008-01-29 21:08 . 2007-06-20 20:45 18,280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll
2008-01-29 21:07 . 2007-03-12 16:42 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll
2008-01-29 21:07 . 2007-01-24 15:27 255,848 --a------ C:\WINDOWS\system32\xactengine2_6.dll
2008-01-29 21:07 . 2007-03-05 12:42 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll
2008-01-28 18:29 . 2008-01-28 18:29 43,520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll
2008-01-25 20:34 . 2008-01-25 20:34 <DIR> d-------- C:\Programmi\Creative
2008-01-25 20:34 . 2002-06-06 14:38 139,264 --a------ C:\WINDOWS\system32\eax.dll
2008-01-25 20:23 . 2003-04-09 10:39 233,472 -ra------ C:\WINDOWS\system32\MafiaSetup.exe
2008-01-25 20:20 . 2008-01-25 20:21 <DIR> d-------- C:\Documents and Settings\FEDERICO\Dati applicazioni\DAEMON Tools Pro
2008-01-25 20:16 . 2008-01-25 20:21 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\DAEMON Tools Pro
2008-01-25 14:11 . 2008-01-25 14:11 715,248 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-01-21 11:30 . 2008-01-21 11:30 <DIR> d-------- C:\WINDOWS\Cache
2008-01-21 11:30 . 2008-01-21 11:30 7,319 --a------ C:\WINDOWS\SETUP.LST
2008-01-21 11:30 . 2008-01-21 11:30 327 --a------ C:\WINDOWS\ST6UNST.002
2008-01-21 11:30 . 2008-01-21 11:30 327 --a------ C:\WINDOWS\ST6UNST.001
2008-01-21 11:30 . 2008-01-21 11:30 327 --a------ C:\WINDOWS\ST6UNST.000
2008-01-19 15:36 . 2008-01-19 15:36 <DIR> d-------- C:\Programmi\Microsoft SQL Server Compact Edition
2008-01-19 15:36 . 2006-11-29 13:06 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll
2008-01-19 15:28 . 2008-01-19 15:28 <DIR> d-------- C:\Documents and Settings\FEDERICO\Contacts
2008-01-19 15:05 . 2008-01-19 15:27 <DIR> d--hsc--- C:\Programmi\File comuni\WindowsLiveInstaller
2008-01-19 15:04 . 2008-02-02 11:04 <DIR> d-------- C:\Programmi\Windows Live
2008-01-19 15:04 . 2008-01-19 15:04 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\WLInstaller
2008-01-15 18:44 . 2008-01-15 18:44 196 --a------ C:\WINDOWS\Spaix2PC.INI
2008-01-15 18:44 . 2008-01-15 18:44 174 --a------ C:\WINDOWS\Wilo30.INI
2008-01-15 18:43 . 2004-11-18 16:02 3,392,512 --a------ C:\WINDOWS\system32\vsImport.exe
2008-01-15 18:43 . 2000-02-03 06:01 2,023,424 --a------ C:\WINDOWS\system32\vcl50.bpl
2008-01-15 18:43 . 2003-03-12 16:18 452,608 --a------ C:\WINDOWS\system32\WiloRemoteSrv.exe
2008-01-15 18:43 . 2003-09-01 15:19 383,488 --a------ C:\WINDOWS\system32\SpaixLocalSrv.dll
2008-01-15 18:43 . 2000-02-03 06:01 265,216 --a------ C:\WINDOWS\system32\midas.dll
2008-01-15 18:43 . 2001-11-09 11:52 157,696 --a------ C:\WINDOWS\system32\vsRt32v3.dll
2008-01-15 18:43 . 2000-02-03 06:01 36,864 --a------ C:\WINDOWS\system32\VCL50.DE
2008-01-15 18:43 . 2000-02-03 06:01 20,480 --a------ C:\WINDOWS\system32\STDVCL40.DE
2008-01-15 18:43 . 1998-07-10 06:00 3,324 --a------ C:\WINDOWS\system32\stdvcl40.tlb
2008-01-15 18:38 . 2008-01-15 18:38 <DIR> d-------- C:\WINDOWS\_ISTMP1.DIR
2008-01-15 18:38 . 2008-01-15 18:38 <DIR> d-------- C:\Programmi\File comuni\VSX
2008-01-15 18:38 . 2008-01-15 18:44 782,289 --a------ C:\WINDOWS\UninstWilo3.isu
2008-01-15 18:38 . 2008-01-15 18:44 125 --a------ C:\WINDOWS\VsProg.INI
2008-01-15 18:38 . 2008-01-15 18:44 44 --a------ C:\WINDOWS\VsxSetup.INI
2008-01-15 17:10 . 2008-01-15 18:44 <DIR> d-------- C:\Documents and Settings\FEDERICO\Dati applicazioni\VSX
2008-01-15 17:10 . 2005-02-17 14:12 6,656,000 --a------ C:\WINDOWS\system32\ddVue.ocx
2008-01-15 17:10 . 2004-04-30 14:29 4,632,064 --a------ C:\WINDOWS\system32\vsPCv1.dll
2008-01-15 17:10 . 2003-07-18 19:37 621,568 --a------ C:\WINDOWS\system32\vsDataset.dll
2008-01-15 17:10 . 2000-02-03 06:01 453,632 --a------ C:\WINDOWS\system32\stdvcl40.dll
2008-01-15 17:10 . 2004-03-12 19:18 273,408 --a------ C:\WINDOWS\system32\vsRt32v4.dll
2008-01-15 17:10 . 2006-05-15 15:25 268,048 --a------ C:\WINDOWS\system32\dxtmeta2.dll
2008-01-15 17:10 . 2005-01-21 12:49 232,960 --a------ C:\WINDOWS\system32\WiloLocalSrv.dll
2008-01-12 16:30 . 2008-02-01 15:03 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Polysun4Demo
2008-01-10 18:21 . 2008-02-07 19:14 <DIR> d-------- C:\Documents and Settings\FEDERICO\Dati applicazioni\BitTorrent
2008-01-09 17:57 . 2008-01-09 17:57 1,142 --a------ C:\WINDOWS\mozver.dat
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-10 14:55 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\DesignBuilder
2008-02-07 18:04 --------- d-----w C:\Documents and Settings\FEDERICO\Dati applicazioni\Skype
2008-02-02 23:16 --------- d--h--w C:\Programmi\InstallShield Installation Information
2008-01-14 20:23 --------- d-----w C:\Documents and Settings\FEDERICO\Dati applicazioni\Winamp
2008-01-11 10:30 --------- d-----w C:\Documents and Settings\FEDERICO\Dati applicazioni\BSplayer PRO
2008-01-09 11:25 --------- d-----w C:\Programmi\File comuni\Sonic Shared
2008-01-09 11:25 --------- d-----w C:\Programmi\File comuni\InstallShield
2008-01-09 11:24 --------- d-----w C:\Programmi\Sonic
2008-01-09 10:35 --------- d-----w C:\Programmi\Microsoft Works
2008-01-07 19:47 --------- d-----w C:\Programmi\Google
2008-01-07 08:57 --------- d-----w C:\Programmi\File comuni\Symantec Shared
2008-01-07 08:57 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\Symantec
2008-01-04 21:05 --------- d-----w C:\Programmi\Skype
2008-01-04 21:05 --------- d-----w C:\Programmi\File comuni\Skype
2008-01-04 21:05 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\Skype
2008-01-04 20:15 --------- d-----w C:\Programmi\Synaptics
2008-01-04 20:14 --------- d-----w C:\Programmi\Servizi in linea
2008-01-04 20:13 --------- d-----w C:\Programmi\microsoft frontpage
2008-01-04 20:13 --------- d-----w C:\Programmi\Java
2008-01-04 20:13 --------- d-----w C:\Programmi\Intel
2008-01-04 20:13 --------- d-----w C:\Programmi\HP
2008-01-04 20:12 --------- d-----w C:\Programmi\Hewlett-Packard
2008-01-04 20:11 --------- d-----w C:\Programmi\File comuni\SpeechEngines
2008-01-04 20:11 --------- d-----w C:\Programmi\File comuni\ODBC
2008-01-04 20:11 --------- d-----w C:\Programmi\File comuni\MSSoap
2008-01-04 20:11 --------- d-----w C:\Programmi\File comuni\LightScribe
2008-01-04 20:11 --------- d-----w C:\Programmi\File comuni\Java
2008-01-04 20:11 --------- d-----w C:\Programmi\File comuni\HP
2008-01-04 20:11 --------- d-----w C:\Programmi\CONEXANT
2008-01-04 20:08 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\Sonic
2008-01-04 20:08 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\SBSI
2008-01-04 20:08 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\InstallShield
2008-01-04 20:08 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\HP
2008-01-04 20:08 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\CyberLink
2008-01-04 12:12 1,749 ----a-w C:\WINDOWS\system32\drivers\103C_HP_NTBK_HP Pavilion dv5000 (EW789EA#ABZ)_YN_0Pavi_QCND621013Z_E398803063_46_I30A7_SHP_V56.25_BF.0A_T060413_WXH2_L410_M1023_J100_7Intel_8T2400_91.83_#080104_N80861092_(EW789EA#ABZ)_XMOBILE_CN10_Z_2F.0A.MRK
2008-01-04 11:46 --------- d-----w C:\Programmi\HPQ
2007-12-13 18:09 972,072 ----a-w C:\WINDOWS\UNNeroMediaHome.exe
2007-12-04 08:59 972,072 ----a-w C:\WINDOWS\UNRecode.exe
2005-09-23 22:49 12,288 ----a-w C:\WINDOWS\Fonts\RandFont.dll
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{838B6A16-8E22-4EFA-82FA-9ED139C3F2C0}]
C:\WINDOWS\system32\jkklk.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{880c501f-3393-4ddd-b6c9-4667e55afb28}]
2008-02-06 23:26 92224 --a------ C:\WINDOWS\system32\itggynpg.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2007-08-30 17:43 4670704]
"swg"="C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-01-15 21:24 68856]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 09:00 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Programmi\File comuni\Nero\Lib\NMBgMonitor.exe" [2007-12-13 19:10 103720]
"MsnMsgr"="C:\Programmi\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
"AlcoholAutomount"="C:\Programmi 2\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-12-22 08:23 221568]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-12-15 12:42 7331840]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-12-15 12:42 86016]
"nwiz"="nwiz.exe" [2005-12-15 12:42 1519616 C:\WINDOWS\system32\nwiz.exe]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-02-16 14:16 61952 C:\WINDOWS\system32\CHDAudPropShortcut.exe]
"SunJavaUpdateSched"="C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 12:03 36975]
"HP Software Update"="C:\Programmi\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 22:11 49152]
"SynTPEnh"="C:\Programmi\Synaptics\SynTP\SynTPEnh.exe" [2005-11-11 09:04 761945]
"hpWirelessAssistant"="C:\Programmi\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-12-13 15:45 507904]
"QPService"="C:\Programmi\HP\QuickPlay\QPService.exe" [2005-12-12 10:39 94208]
"eabconfg.cpl"="C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe" [2005-12-22 07:57 405504]
"Cpqset"="C:\Programmi\HPQ\Default Settings\cpqset.exe" [2005-06-29 12:48 233534]
"RecGuard"="C:\Windows\SMINST\RecGuard.exe" [2005-10-11 09:23 1187840]
"NBKeyScan"="C:\Programmi\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-12-03 14:21 2213160]
"nod32kui"="C:\Programmi\Eset\nod32kui.exe" [2008-01-09 16:22 949376]
"WinampAgent"="C:\Programmi 2\Winamp\winampa.exe" [2007-10-10 06:28 36352]
"Adobe Reader Speed Launcher"="C:\Programmi 2\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"NeroFilterCheck"="C:\Programmi\File comuni\Nero\Lib\NeroCheck.exe" [2007-03-01 14:57 153136]
"c877808c"="C:\WINDOWS\system32\vjxxcsrc.dll" [ ]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 09:00 15360]
S3 usbscan;Driver scanner USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Driver archiviazione di massa USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-07 20:45:05
Windows 5.1.2600 Service Pack 2 NTFS
scansione processi nascosti ...
scansione entrate autostart nascoste ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Programmi\HPQ\Default Settings\cpqset.exe???????????????????|?????? ???B?????????????hLC????????
Scansione files nascosti ...
Scansione completata con successo
Files nascosti: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180]
-> C:\Programmi\Eset\pr_imon.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Programmi\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Programmi\HP\Digital Imaging\bin\hpqimzone.exe
C:\PROGRA~1\HPQ\SHARED\HPQTOA~1.EXE
.
**************************************************************************
.
Ora fine scansione: 2008-02-07 20:46:41 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-07 19:46:38 |
|
Top |
|
 |
f.denart Mortale pio

Registrato: 07/02/08 20:26 Messaggi: 19
|
Inviato: 07 Feb 2008 21:52 Oggetto: log di HijackThis |
|
|
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 20.51.22, on 07/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Programmi\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
C:\Programmi\Hp\HP Software Update\HPWuSchd2.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Programmi\HP\QuickPlay\QPService.exe
C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe
C:\Programmi\Eset\nod32kui.exe
C:\Programmi 2\Winamp\winampa.exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Programmi\HP\Digital Imaging\bin\hpqimzone.exe
C:\PROGRA~1\HPQ\SHARED\HPQTOA~1.EXE
C:\Documents and Settings\FEDERICO\Desktop\virus\HiJackThis_v2.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.hp.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://msg.edit.yahoo.com/config/reset_cookies?&.y=Y%3dv%3d1%26n%3daislrs2k0862k%26l%3di8ced0_3h02ki7eh/o%26p%3df2lvvro1133o0500%26jb%3d24%7c69%7c%26iz%3d700120%26r%3dc7%26lg%3den-US%26intl%3dus%26np%3d1%3b%20path%3d/%3b%20domain%3d.yahoo.com&.t=T%3dz%3dTCfgHBTI0gHB9.UWZ6iLtKoMjYxBjU2MDUwNjY2TzY-%26a%3dQAE%26sk%3dDAAIKo3Wlup1rx%26ks%3dEAAb5uA0iYPX_1wZfCCOtBSwg--~A%26d%3dc2wBTlRFMkFUSXhOekkzTVRFeE9ERS0BYQFRQUUBenoBVENmZ0hCZ1dBAXRpcAFYQ2pQMkI-%3b%20path%3d/%3b%20domain%3d.yahoo.com&.ver=2&.done=http://it.rd.yahoo.com/messenger/client/%3fhttp://it.mail.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {838B6A16-8E22-4EFA-82FA-9ED139C3F2C0} - C:\WINDOWS\system32\jkklk.dll (file missing)
O2 - BHO: {82bfa55e-7664-9c6b-ddd4-3933f105c088} - {880c501f-3393-4ddd-b6c9-4667e55afb28} - C:\WINDOWS\system32\itggynpg.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Programmi\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Programmi\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [QPService] "C:\Programmi\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Programmi\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Programmi\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [WinampAgent] "C:\Programmi 2\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi 2\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmi\File comuni\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [c877808c] rundll32.exe "C:\WINDOWS\system32\vjxxcsrc.dll",b
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Programmi 2\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Avvio rapido HP Photosmart Premier.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: I&nvia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programmi\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{9C779E52-035E-4D2C-8841-8436B3336C75}: NameServer = 192.168.0.2
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Programmi\File comuni\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Programmi\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programmi\File comuni\Nero\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmi\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
--
End of file - 9101 bytes |
|
Top |
|
 |
bdoriano Amministratore


Registrato: 02/04/07 12:05 Messaggi: 14391 Residenza: 3° pianeta del sistema solare...
|
Inviato: 07 Feb 2008 21:58 Oggetto: |
|
|
Scarica avenger e scompattalo in una sua cartella non temporanea e non sul desktop
Avvia AVENGER
Clicca su input script manually
Clicca sulla lente d'ingrandimento
Inserisci queste righe:
Citazione: | files to delete:
C:\WINDOWS\system32\byxwtrs.V00dll
C:\WINDOWS\system32\byxwtrs.Vdll
C:\WINDOWS\system32\itggynpg.dll
C:\WINDOWS\system32\efcdeef.dll
C:\WINDOWS\system32\cbxyxvu.dll
C:\WINDOWS\system32\xxyayxx.dll
C:\WINDOWS\system32\byxwtrs.dll.vir
C:\WINDOWS\system32\jkklk.dll
C:\WINDOWS\system32\vjxxcsrc.dll
registry values to delete:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | c877808c
registry keys to delete:
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{838B6A16-8E22-4EFA-82FA-9ED139C3F2C0}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{880c501f-3393-4ddd-b6c9-4667e55afb28} |
Clicca su Done
Clicca sul semaforo
Il pc dovrebbe riavviarsi, se così non fosse, riavvialo tu.
Al termine dell'operazione, posta qui il risultato di Avenger con un log aggiornato di hijackthis.
Collegati a Kaspersky on-line scanner e fai la scansione estesa, come indicato qui.
Salva il risultato della scansione in un file (in formato HTML), carica il file su Freefilehosting e posta qui il link che ti viene assegnato. |
|
Top |
|
 |
f.denart Mortale pio

Registrato: 07/02/08 20:26 Messaggi: 19
|
Inviato: 08 Feb 2008 10:54 Oggetto: |
|
|
Buongiorno bdoriano.
Ho lanciato Avenger e dopo aver riavviato il pc compare un file di blocco note Avenger completamente bianco.
C'è un'altra cosa: ad ogni avvio del pc compare sempre il seguente messaggio di errore RUNDLL "Errore durante il caricamento di C:\WINDOWS\system32\vjxxcsrc.dll |
|
Top |
|
 |
f.denart Mortale pio

Registrato: 07/02/08 20:26 Messaggi: 19
|
Inviato: 08 Feb 2008 10:55 Oggetto: |
|
|
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 9.54.48, on 08/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
C:\Programmi\Hp\HP Software Update\HPWuSchd2.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Programmi\HP\QuickPlay\QPService.exe
C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe
C:\Programmi\Eset\nod32kui.exe
C:\Programmi 2\Winamp\winampa.exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Programmi\HP\Digital Imaging\bin\hpqimzone.exe
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Programmi\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\HPQ\SHARED\HPQTOA~1.EXE
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Documents and Settings\FEDERICO\Desktop\virus\HiJackThis_v2.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.hp.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://msg.edit.yahoo.com/config/reset_cookies?&.y=Y%3dv%3d1%26n%3daislrs2k0862k%26l%3di8ced0_3h02ki7eh/o%26p%3df2lvvro1133o0500%26jb%3d24%7c69%7c%26iz%3d700120%26r%3dc7%26lg%3den-US%26intl%3dus%26np%3d1%3b%20path%3d/%3b%20domain%3d.yahoo.com&.t=T%3dz%3dTCfgHBTI0gHB9.UWZ6iLtKoMjYxBjU2MDUwNjY2TzY-%26a%3dQAE%26sk%3dDAAIKo3Wlup1rx%26ks%3dEAAb5uA0iYPX_1wZfCCOtBSwg--~A%26d%3dc2wBTlRFMkFUSXhOekkzTVRFeE9ERS0BYQFRQUUBenoBVENmZ0hCZ1dBAXRpcAFYQ2pQMkI-%3b%20path%3d/%3b%20domain%3d.yahoo.com&.ver=2&.done=http://it.rd.yahoo.com/messenger/client/%3fhttp://it.mail.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {838B6A16-8E22-4EFA-82FA-9ED139C3F2C0} - C:\WINDOWS\system32\jkklk.dll (file missing)
O2 - BHO: {82bfa55e-7664-9c6b-ddd4-3933f105c088} - {880c501f-3393-4ddd-b6c9-4667e55afb28} - C:\WINDOWS\system32\itggynpg.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Programmi\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Programmi\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [QPService] "C:\Programmi\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Programmi\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Programmi\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [WinampAgent] "C:\Programmi 2\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi 2\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmi\File comuni\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [c877808c] rundll32.exe "C:\WINDOWS\system32\vjxxcsrc.dll",b
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Programmi 2\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Avvio rapido HP Photosmart Premier.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: I&nvia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programmi\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{9C779E52-035E-4D2C-8841-8436B3336C75}: NameServer = 192.168.0.2
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Programmi\File comuni\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Programmi\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programmi\File comuni\Nero\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmi\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
--
End of file - 9190 bytes |
|
Top |
|
 |
f.denart Mortale pio

Registrato: 07/02/08 20:26 Messaggi: 19
|
Inviato: 08 Feb 2008 14:23 Oggetto: |
|
|
freefilehosting mi assegna il seguente link
http://www.freefilehosting.net/download/3bjd5
grazie |
|
Top |
|
 |
bdoriano Amministratore


Registrato: 02/04/07 12:05 Messaggi: 14391 Residenza: 3° pianeta del sistema solare...
|
|
Top |
|
 |
f.denart Mortale pio

Registrato: 07/02/08 20:26 Messaggi: 19
|
Inviato: 11 Feb 2008 11:36 Oggetto: errore caricamento file dll |
|
|
Buonguiorno a tutti,
da quando ho rimosso alcuni files infetti dal mio pc(windows XP HOME, SP2), ad ogni avvio compare sempre il seguente messaggio di errore RUNDLL "Errore durante il caricamento di C:\WINDOWS\system32\vjxxcsrc.dll
E' un errore grave o posso ignorarlo?
Aiutatemi
Grazie |
|
Top |
|
 |
bdoriano Amministratore


Registrato: 02/04/07 12:05 Messaggi: 14391 Residenza: 3° pianeta del sistema solare...
|
Inviato: 11 Feb 2008 13:51 Oggetto: |
|
|
Forse ti era sfuggito il mio ultimo messaggio:
Per cortesia, non aprire nuovi thread, continuiamo con questo, ok?  |
|
Top |
|
 |
f.denart Mortale pio

Registrato: 07/02/08 20:26 Messaggi: 19
|
Inviato: 11 Feb 2008 14:43 Oggetto: |
|
|
salve bdoriano,
mi scuso ma nn mi ero accorto della risposta.
Dunque riporto quanto ottenuto da freefile hosting:
Dalla scansione con GMER autostart:
http://www.freefilehosting.net/download/3bmim |
|
Top |
|
 |
f.denart Mortale pio

Registrato: 07/02/08 20:26 Messaggi: 19
|
Inviato: 11 Feb 2008 14:44 Oggetto: |
|
|
adesso arriva anche il secondo |
|
Top |
|
 |
f.denart Mortale pio

Registrato: 07/02/08 20:26 Messaggi: 19
|
Inviato: 11 Feb 2008 14:48 Oggetto: |
|
|
ed ecco lo scan con GMER rootkit:
http://www.freefilehosting.net/download/3bmjc |
|
Top |
|
 |
bdoriano Amministratore


Registrato: 02/04/07 12:05 Messaggi: 14391 Residenza: 3° pianeta del sistema solare...
|
Inviato: 11 Feb 2008 14:57 Oggetto: |
|
|
Avvia AVENGER
Clicca su input script manually
Clicca sulla lente d'ingrandimento
Inserisci queste righe:
Citazione: | Files to delete:
C:\WINDOWS\system32\vjxxcsrc.dll
registry keys to delete:
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{838B6A16-8E22-4EFA-82FA-9ED139C3F2C0}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{880c501f-3393-4ddd-b6c9-4667e55afb28}
registry values to delete:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run | c877808c |
Clicca su Done
Clicca sul semaforo
Il pc dovrebbe riavviarsi, se così non fosse, riavvialo tu.
Al termine dell'operazione, posta qui il risultato di Avenger con un log aggiornato di hijackthis. |
|
Top |
|
 |
f.denart Mortale pio

Registrato: 07/02/08 20:26 Messaggi: 19
|
Inviato: 11 Feb 2008 15:10 Oggetto: |
|
|
una volta terminata la scansione con Avenger ottengo un errore e nessun altro risultato.
Hijackthis riporta:
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 14.08.25, on 11/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
C:\Programmi\Hp\HP Software Update\HPWuSchd2.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Programmi\HP\QuickPlay\QPService.exe
C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe
C:\Programmi\Eset\nod32kui.exe
C:\Programmi 2\Winamp\winampa.exe
C:\Programmi 2\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Programmi\HP\Digital Imaging\bin\hpqimzone.exe
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Programmi\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\HPQ\SHARED\HPQTOA~1.EXE
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\FEDERICO\Desktop\virus\HiJackThis_v2.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.hp.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://msg.edit.yahoo.com/config/reset_cookies?&.y=Y%3dv%3d1%26n%3daislrs2k0862k%26l%3di8ced0_3h02ki7eh/o%26p%3df2lvvro1133o0500%26jb%3d24%7c69%7c%26iz%3d700120%26r%3dc7%26lg%3den-US%26intl%3dus%26np%3d1%3b%20path%3d/%3b%20domain%3d.yahoo.com&.t=T%3dz%3dTCfgHBTI0gHB9.UWZ6iLtKoMjYxBjU2MDUwNjY2TzY-%26a%3dQAE%26sk%3dDAAIKo3Wlup1rx%26ks%3dEAAb5uA0iYPX_1wZfCCOtBSwg--~A%26d%3dc2wBTlRFMkFUSXhOekkzTVRFeE9ERS0BYQFRQUUBenoBVENmZ0hCZ1dBAXRpcAFYQ2pQMkI-%3b%20path%3d/%3b%20domain%3d.yahoo.com&.ver=2&.done=http://it.rd.yahoo.com/messenger/client/%3fhttp://it.mail.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {838B6A16-8E22-4EFA-82FA-9ED139C3F2C0} - C:\WINDOWS\system32\jkklk.dll (file missing)
O2 - BHO: {82bfa55e-7664-9c6b-ddd4-3933f105c088} - {880c501f-3393-4ddd-b6c9-4667e55afb28} - C:\WINDOWS\system32\itggynpg.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Programmi\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Programmi\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [QPService] "C:\Programmi\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Programmi\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Programmi\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [WinampAgent] "C:\Programmi 2\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi 2\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmi\File comuni\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [c877808c] rundll32.exe "C:\WINDOWS\system32\vjxxcsrc.dll",b
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Programmi 2\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Avvio rapido HP Photosmart Premier.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: I&nvia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programmi\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{9C779E52-035E-4D2C-8841-8436B3336C75}: NameServer = 192.168.0.2
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Programmi\File comuni\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Programmi\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programmi\File comuni\Nero\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmi\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
--
End of file - 9349 bytes |
|
Top |
|
 |
f.denart Mortale pio

Registrato: 07/02/08 20:26 Messaggi: 19
|
Inviato: 11 Feb 2008 15:17 Oggetto: |
|
|
adesso è andato a buon fine
Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\ksbdcrwd
*******************
Script file located at: \??\C:\mymchkdo.txt
Script file opened successfully.
Script file read successfully
Backups directory opened successfully at C:\Avenger
*******************
Beginning to process script file:
File C:\WINDOWS\system32\vjxxcsrc.dll not found!
Deletion of file C:\WINDOWS\system32\vjxxcsrc.dll failed!
Could not process line:
C:\WINDOWS\system32\vjxxcsrc.dll
Status: 0xc0000034
Registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{838B6A16-8E22-4EFA-82FA-9ED139C3F2C0} deleted successfully.
Registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{880c501f-3393-4ddd-b6c9-4667e55afb28} deleted successfully.
Registry value HKLM\Software\Microsoft\Windows\CurrentVersion\Run|c877808c deleted successfully.
Completed script processing.
*******************
Finished! Terminate. |
|
Top |
|
 |
f.denart Mortale pio

Registrato: 07/02/08 20:26 Messaggi: 19
|
Inviato: 11 Feb 2008 15:19 Oggetto: |
|
|
e questo è quanto mi ritorna HiJackThis
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 14.18.09, on 11/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
C:\Programmi\Hp\HP Software Update\HPWuSchd2.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Programmi\HP\QuickPlay\QPService.exe
C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe
C:\Programmi\Eset\nod32kui.exe
C:\Programmi 2\Winamp\winampa.exe
C:\Programmi 2\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Programmi\HP\Digital Imaging\bin\hpqimzone.exe
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Programmi\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\HPQ\SHARED\HPQTOA~1.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\FEDERICO\Desktop\virus\HiJackThis_v2.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.hp.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://msg.edit.yahoo.com/config/reset_cookies?&.y=Y%3dv%3d1%26n%3daislrs2k0862k%26l%3di8ced0_3h02ki7eh/o%26p%3df2lvvro1133o0500%26jb%3d24%7c69%7c%26iz%3d700120%26r%3dc7%26lg%3den-US%26intl%3dus%26np%3d1%3b%20path%3d/%3b%20domain%3d.yahoo.com&.t=T%3dz%3dTCfgHBTI0gHB9.UWZ6iLtKoMjYxBjU2MDUwNjY2TzY-%26a%3dQAE%26sk%3dDAAIKo3Wlup1rx%26ks%3dEAAb5uA0iYPX_1wZfCCOtBSwg--~A%26d%3dc2wBTlRFMkFUSXhOekkzTVRFeE9ERS0BYQFRQUUBenoBVENmZ0hCZ1dBAXRpcAFYQ2pQMkI-%3b%20path%3d/%3b%20domain%3d.yahoo.com&.ver=2&.done=http://it.rd.yahoo.com/messenger/client/%3fhttp://it.mail.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Programmi\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Programmi\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [QPService] "C:\Programmi\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Programmi\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Programmi\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [WinampAgent] "C:\Programmi 2\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi 2\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmi\File comuni\Nero\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Programmi 2\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Avvio rapido HP Photosmart Premier.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: I&nvia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programmi\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{9C779E52-035E-4D2C-8841-8436B3336C75}: NameServer = 192.168.0.2
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Programmi\File comuni\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Programmi\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programmi\File comuni\Nero\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmi\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
--
End of file - 9052 bytes |
|
Top |
|
 |
|
|
Non puoi inserire nuovi argomenti Non puoi rispondere a nessun argomento Non puoi modificare i tuoi messaggi Non puoi cancellare i tuoi messaggi Non puoi votare nei sondaggi
|
|