Newsgroup: it.comp.sicurezza.varie
Titolo: hijackthis.log

Buongiorno a tutti!
Ho un problema con internet, IE6 SP1 su Win XP.
Ogni volta che apro una pagina mi si apre una finetra di pop-up che dice:
"Your computer is infected with Spyware and Adware"
o frasi simili. Cliccando sul link consigliato vengo reindirizzata a una
pagina che pubblicizza programmi anti-spyware a pagamento.
Fatto pulizia con Ad-Aware e Spybot aggiornati, ma ricompaiono.
Allora ho scaricato e lanciato HijackThis.exe; vi riporto il file
hijackthis.log.
Qualcuno puņ cortesemente aiutarmi ad interpretarlo?
Grazie.
Logfile of HijackThis v1.97.7
Scan saved at 10.17.56, on 28/06/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\srvany.exe
C:\WINDOWS\PCard.exe
C:\Program Files\RealVNC\WinVNC\WinVNC.exe
C:\WINDOWS\SYSTEM32\WISPTIS.EXE
C:\WINDOWS\System32\tabbtnu.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\smctrlw.exe
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Program Files\ACER\Launch Manager\LaunchAp.exe
C:\Program Files\ACER\Launch Manager\PowerKey.exe
C:\Program Files\ACER\Launch Manager\HotkeyApp.exe
C:\Program Files\ACER\Launch Manager\CtrlVol.exe
C:\Program Files\ACER\Launch Manager\Wbutton.exe
C:\WINDOWS\LTSMMSG.exe
C:\Program Files\Common Files\microsoft shared\ink\TPA.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jucheck.exe
C:\Program Files\CASIO\Photo Loader\Plauto.exe
C:\PROGRA~1\MI696F~1\Office\OUTLOOK.EXE
C:\Program Files\Common Files\System\MAPI\1040\nt\MAPISP32.EXE
C:\Program Files\Microsoft Office\Office\Winword.exe
C:\Program Files\Microsoft Office\Office\excel.exe
\Mecatronic02\comune\USERS\rcosta\sw\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
res://C:\WINDOWS\System32\pefhk.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
res://C:\WINDOWS\System32\pefhk.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
res://C:\WINDOWS\System32\pefhk.dll/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
res://C:\WINDOWS\System32\pefhk.dll/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
res://C:\WINDOWS\System32\pefhk.dll/sp.html (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
res://C:\WINDOWS\System32\pefhk.dll/sp.html (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
Collegamenti
O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - (no file)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program
Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: NavErrRedir Class - {4FC95EDD-4796-4966-9049-29649C80111D} - (no
file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program
Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program
Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {F833D458-A29E-41C1-8265-6DFBE9B27E9B} -
C:\WINDOWS\System32\pefhk.dll
O4 - HKLM\..\Run: [TabletTip] "C:\Program Files\Common Files\microsoft
shared\ink\tabtip.exe" /resume
O4 - HKLM\..\Run: [LaunchApp] LaunApp
O4 - HKLM\..\Run: [Control Panel] smctrlw.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LaunchAp] C:\Program Files\ACER\Launch
Manager\LaunchAp.exe
O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\ACER\Launch
Manager\PowerKey.exe"
O4 - HKLM\..\Run: [HotkeyApp] C:\Program Files\ACER\Launch
Manager\HotkeyApp.exe
O4 - HKLM\..\Run: [KeyHook] C:\Program Files\ACER\Launch Manager\KeyHook.exe
O4 - HKLM\..\Run: [CtrlVol] C:\Program Files\ACER\Launch Manager\CtrlVol.exe
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\ACER\Launch
Manager\Wbutton.exe"
O4 - HKLM\..\Run: [LTSMMSG] LTSMMSG.exe
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\RealVNC\WinVNC\WinVNC.exe"
-servicehelper
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec
Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec
Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program
Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe"
-atboottime
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program
Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [TUlaunch] C:\WINDOWS\help\latute.hta showme
O4 - HKCU\..\Run: [ClockSync] C:\PROGRA~1\CLOCKS~1\Sync.exe /q
O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe
/startup
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program
Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Photo Loader residente.lnk = C:\Program
Files\CASIO\Photo Loader\Plauto.exe
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
--------------------------------
Inviato via 
http://arianna.libero.it/usenet/

 C:WINDOWSSystem32pefhk.dll
di nuovo il mio dubbio
ATTENDI qualche giorno.
Altre PERSONE PIU' ESPERTE di me!?
Ciao.
-- 
questo articolo e` stato inviato via web dal servizio gratuito 
http://www.newsland.it/news
 segnala gli abusi ad 
ab...@newsland.it

 
se hai tanti dubbi non pensi che sia quantomeno imprudente consigliare 
qualcuno di cancellare chiavi dal registro di configurazione 'a vanvara' ?

Grazie per avermi risposto!
Per il momento non cancello niente, comunque credo che il problema sia
riconducibile a questi 2 file sp.html e pefhk.dll
Provo a documentarmi su questo.
Grazie ancora e buona giornata!

--------------------------------
Inviato via 
http://arianna.libero.it/usenet/

 typed:
http://alnitak.ctt.it/iltuodovere.jpg
-- 
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
A: Top-posting.
Q: What is the most annoying thing on usenet and in e-mail?

 qualcuno di cancellare chiavi dal registro di configurazione 'a vanvera' ?
Si'.
Però uno dice quello che sa.
Quello che capisce.
Tutti insieme cerchiamo la soluzione.
Non ti pare ?


 
http://alnitak.ctt.it/iltuodovere.jpg
LOL :-).  Preso.
--
NiBBle