Newsgroup: it.comp.sicurezza.windows
Titolo: hijackthis

Voi vedete qualcosa di sospetto??ho scoperto grazie ad housecall 
di avere 2 trojan e non so come eliminarli...cosa mi 
consigliate? grazie in anticipo!
Ecco il log:
Logfile of HijackThis v1.97.7
Scan saved at 23.36.37, on 16/02/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe
C:\Programmi\File comuni\Symantec Shared\SNDSrvc.exe
C:\Programmi\File comuni\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
C:\Programmi\Norton AntiVirus\navapsvc.exe
C:\Programmi\Norton AntiVirus\IWP\NPFMntor.exe
C:\Programmi\Promise\Utility\MsgAgt.exe
C:\Programmi\Promise\Utility\MsgSvr.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programmi\SlySoft\AnyDVD\AnyDVD.exe
C:\WINDOWS\system32\svxpagms.exe
C:\PROGRA~1\FILECO~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\PROGRA~1\FILECO~1\PCSuite\Services\SERVIC~1.EXE
C:\Programmi\MSN Messenger\msnmsgr.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Documents and Settings\Sandro\Documenti\backup\File 
Ricevuti\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = 
http://www.virgilio.it/
R0 - HKLM\Software\Microsoft\Internet 
Explorer\Search,SearchAssistant = 
R0 - HKCU\Software\Microsoft\Internet 
Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - 
C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {0DE31469-73C2-9950-1F2A-FBF04E3A73FD} - 
C:\WINDOWS\system32\rdwewliw.dll
O2 - BHO: (no name) - {9B122238-8390-16CD-3278-C367FB53AAF8} - 
C:\WINDOWS\system32\jqhjragv.dll
O2 - BHO: (no name) - {F58D1BC0-39C9-C824-87C6-27680A028865} - 
C:\WINDOWS\system32\njttkdng.dll
O4 - HKLM\..\Run: [PtiuPbmd] "Rundll32.exe " 
ptipbm.dll,SetWriteBack
O4 - HKLM\..\Run: [SoundMan] "SOUNDMAN.EXE"
O4 - HKLM\..\Run: [ASUS Probe] "C:\Program 
Files\ASUS\Probe\AsusProb.exe"
O4 - HKLM\..\Run: [NeroCheck] "C:\WINDOWS\system32\NeroCheck.exe"
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [AnyDVD] C:\Programmi\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKLM\..\Run: [EPSON Stylus C62 Series] "C:\WINDOWS\System32
\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 " PSON Stylus C62 
Series" /O6 "USB001" /M "Stylus C62""
O4 - HKLM\..\Run: [QuickTime 
Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [svxpagms] C:\WINDOWS\system32\svxpagms.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec 
Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1
\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: 
[OpwareSE2] "C:\Programmi\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] 
C:\Programmi\Nokia\Nokia PC Suite 6\Launch Application 2.exe -
onlytray
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\FILECO~1
\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EPSON Stylus C62 Series] "C:\WINDOWS\System32
\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /A " :\WINDOWS\system32
\E_S96.tmp""
O4 - Global Startup: InterVideo WinCinema Manager.lnk = 
C:\Programmi\InterVideo\Common\Bin\WinCinemaMgr.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - 
res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O12 - Plugin for .spop: C:\Programmi\Internet 
Explorer\Plugins\NPDocBox.dll
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} 
(MessengerStatsClient Class) - 
http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31
267.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave 
ActiveX Control) - 
http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall 
Control) - 
http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicr
o.com/housecall/xscan53.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro 
Class) - 
http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave 
Flash Object) - 
http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash
cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9F169623-F545-49A4-9FFE-
BCA0CCDFD41E}: NameServer = 62.211.69.150 212.48.4.15
-- 
Inviato da Virgilio 
http://newsgroup.virgilio.it
Filtra gli antipatici, segnala le risposte, segue i thread, e tutto da web

se ci dici i siti porno che visiti abitualmente, ci sarà piu
facile dirti che trojan potrebbe essere! da quel che vedo nella
lista però ne visiti parecchi!


 Logfile of HijackThis v1.97.7
[...]
E' stata rilasciata la versione 1.99.1 di HijackThis:
http://www.spywareinfo.com/~merijn/downloads.html
Ti consiglio comunque di dare una 'sgrossata' all'immondizia con SpyBot S&D
e Ad-aware, poi eventualmente esegui HJT.
Ref: 
http://snipurl.com/MS_Technet_Spy
--
Vincenzo Di Russo
Microsoft® MVP - Windows - Internet Explorer/OE
http://support.microsoft.com/newsgroups
http://mvp.support.microsoft.com/

Ma io non vado su nessun sito porno!! :°)


 
http://www.spywareinfo.com/~merijn/downloads.html
Grazie ....;-) ero "fermo" alla 1.98.2