Salve a tutti, mi trovo a scrivere da un pc di un collega di lavoro che è preso davvero male..
ho tentato di usare l'hijackthis ma non ancora, dopo aver fixato tantissimi worm e altro far funzionare bene....
ora vi posto l'ultimo log e spero sappiate darmi una mano...
(mi dava all'ultimo riavvio , errore grave di windows...)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sgate.al.group-net.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com/1Q00CDT/0410/bl8.asp
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.compaq.com/1Q00CDT/0410/bl7.asp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.sttspa.it/vpn.bmw-conc.pac
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.group-net.it:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.group-net.it;*.group-net.de;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O1 - Hosts: 192.109.189.254 bmw_dns
O1 - Hosts: 192.109.189.125 bmw_notes1
O1 - Hosts: 192.109.189.160 bmw_notes2
O1 - Hosts: 192.109.189.100 bmw_os2
O1 - Hosts: 192.109.189.120 bmw_ntserv
O1 - Hosts: 193.42.235.200 bmw_email
O1 - Hosts: 192.109.189.252 ftp.conc.zi
O1 - Hosts: 194.10.153.1 motor1
O1 - Hosts: 194.10.153.2 motor2
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
O4 - HKLM\..\Run: [CPQEASYACC] C:\Programmi\COMPAQ\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [WCOLOREAL] C:\Programmi\COMPAQ\Coloreal\coloreal.exe
O4 - HKLM\..\Run: [Smapp] C:\Programmi\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [DrvLsnr] C:\Programmi\Analog Devices\SoundMAX\DrvLsnr.exe
O4 - HKLM\..\Run: [WinVNC] "C:\Programmi\RealVNC\WinVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [UpdateSa] C:\BMW_SA21\UpdateSA3.exe
O4 - HKLM\..\Run: [EPSON Stylus C62 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C62 Series" /O5 "LPT1:" /M "Stylus C62"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RealTray] C:\Real\Player\realplay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [AVGCtrl] "C:\Programmi\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [gwiz] C:\Windows\system32\ntsystem.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\Windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [Adware Spy] C:\Programmi\AdwareSpy\AdwareSpy.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Programmi\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v ... 5072807953
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = gielle.group-net.it
O17 - HKLM\Software\..\Telephony: DomainName = gielle.group-net.it
O17 - HKLM\System\CCS\Services\Tcpip\..\{DB10AEAE-DCDA-4683-B3E6-D1819D2A92C7}: NameServer = 62.180.104.130,62.180.104.131
O17 - HKLM\System\CCS\Services\Tcpip\..\{E1C06C33-733D-4682-B2C6-8350C5B4CFD7}: NameServer = 80.74.176.132,80.74.180.132
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = gielle.group-net.it
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = gielle.group-net.it
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = gielle.group-net.it
O20 - Winlogon Notify: igfxcui - C:\Windows\SYSTEM32\igfxsrvc.dll
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programmi\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programmi\AVPersonal\AVWUPSRV.EXE
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\Windows\System32\NMSSvc.exe
O23 - Service: OracleOraHome81ClientCache - Unknown owner - C:\orant\bin\Onrsd.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: SwvInstall - Camtec Software GmbH - C:\BMW_SA21\SwvInstall.exe
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Programmi\RealVNC\WinVNC\WinVNC.exe" -service (file missing)
aspe vostri consigli sul dafarsi
grazie mille
Registrazione