Ciao a tutti ho un pò di problema da questa mattina al pc
in particolare i motori di ricerca di internet explorer non mi funzionano piu bene, se cerco 1 parola mi danno dei risultati a caso e ho letto si tratta di un malware (credo) ma non so che fare..
vi posto il risultato di hijack mi potete dire se c'è qualcosa che non va?
grazie
Andrea
Logfile of HijackThis v1.99.1
Scan saved at 11.31.49, on 26/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Trend Micro\tmasea\tmasca.exe
C:\Programmi\LANDesk\Shared Files\residentagent.exe
C:\Programmi\LANDesk\LDClient\LocalSch.EXE
C:\WINDOWS\system32\CBA\pds.exe
C:\Programmi\LANDesk\LDClient\tmcsvc.exe
C:\PROGRA~1\LANDesk\LDClient\issuser.exe
C:\Programmi\LANDesk\LDClient\xddclient.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\Programmi\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\Programmi\LANDesk\LDClient\softmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Trend Micro\OfficeScan Client\tmlisten.exe
C:\Programmi\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
C:\Programmi\LANDesk\LDClient\collector.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programmi\Trend Micro\tmasea\tmasea.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\TEMP\KD3331.EXE
C:\Programmi\Trend Micro\OfficeScan Client\Pccntmon.exe
C:\Programmi\LANDesk\LDClient\webportal\sdclientmonitor.exe
C:\Programmi\RealPopup\RealPopup.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\aiori\Menu Avvio\Programmi\Esecuzione automatica\bokyypuh.exe
C:\Programmi\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\aiori\Desktop\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: edit_html Class - {14D1A72D-8705-11D8-B120-0040F46CB696} - C:\Documents and Settings\aiori\102653624.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {f250d521-225d-4d6b-8829-e064f944e180} - C:\WINDOWS\system32\gcaa.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Programmi\Trend Micro\OfficeScan Client\Pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [IntelAPMClient] "C:\Programmi\LANDesk\LDClient\amclient.exe" /apm /s /ro /Retry=2 /Tspan=60 /Rstart
O4 - HKLM\..\Run: [LANDeskVulscanClient] "C:\Programmi\LANDesk\LDClient\vulScan.exe" /rstart=60
O4 - HKLM\..\Run: [SDClientMonitor] "C:\Programmi\LANDesk\LDClient\webportal\sdclientmonitor.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\PROGRA~1\FILECO~1\INSTAL~1\UPDATE~1\ISUSPM.exe" -startup
O4 - HKCU\..\Run: [RealPopup] "C:\Programmi\RealPopup\RealPopup.exe" BOOT
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [SpySweeperUninstallSurvey] http://products.webroot.com/disp0201.ph ... omn=1&rsc=
O4 - Startup: Adobe Gamma.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: bokyypuh.exe
O4 - Global Startup: si4incsr32.lnk = ?
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resourc ... oscan8.cab
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Antispyware Client Agent - Trend Micro, Inc. - C:\Programmi\Trend Micro\tmasea\tmasca.exe
O23 - Service: Antispyware Engine Agent - Trend Micro, Inc. - C:\Programmi\Trend Micro\tmasea\tmasea.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: LANDesk(R) Management Agent (CBA8) - LANDesk Software, Ltd. - C:\Programmi\LANDesk\Shared Files\residentagent.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Intel Local Scheduler Service - LANDesk Software, Ltd. - C:\Programmi\LANDesk\LDClient\LocalSch.EXE
O23 - Service: Intel PDS - LANDesk Software Ltd. - C:\WINDOWS\system32\CBA\pds.exe
O23 - Service: LANDesk Targeted Multicast (Intel Targeted Multicast) - LANDesk Software, Ltd. - C:\Programmi\LANDesk\LDClient\tmcsvc.exe
O23 - Service: Servizio di controllo remoto LANDesk (ISSUSER) - LANDesk Software, Ltd. - C:\PROGRA~1\LANDesk\LDClient\issuser.exe
O23 - Service: LANDesk(R) Extended device discovery service (LDXDD) - Unknown owner - C:\Programmi\LANDesk\LDClient\xddclient.exe
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Programmi\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Programmi\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
O23 - Service: LANDesk(R) Software Monitoring Service (Softmon) - LANDesk Software, Ltd. - C:\Programmi\LANDesk\LDClient\softmon.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Programmi\Trend Micro\OfficeScan Client\tmlisten.exe
Registrazione