Controllo log di hijackthis

[gilmol]

Gentilmente....
C'è qualcuno che mi sa dare qualche "dritta" circa questo log di hijackthis?
Mille grazie !!

Logfile of HijackThis v1.99.1
Scan saved at 12.46.49, on 11/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Programmi\QuickTime\qttask.exe
C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\dslagent.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0K2.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0K2.EXE
C:\Programmi\HPQ\SHARED\HPQWMI.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmi\WinRAR\WinRAR.exe
C:\DOCUME~1\PRINCI~1\IMPOST~1\Temp\Rar$EX00.672\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://it.finance.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.hp.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Programmi\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Programmi\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [GSICONEXE] GSICON.EXE
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Programmi\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [EPSON Stylus Photo RX500 (Copia 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0K2.EXE /P34 "EPSON Stylus Photo RX500 (Copia 1)" /O6 "USB001" /M "Stylus Photo RX500"
O4 - HKLM\..\Run: [EPSON Stylus Photo RX500] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0K2.EXE /P24 "EPSON Stylus Photo RX500" /O6 "USB001" /M "Stylus Photo RX500"
O4 - HKLM\..\Run: [NavRegReminder] "C:\WINDOWS\temp\NavBrowser.exe" /r /i "C:\WINDOWS\temp\NavLoad.ini"
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan ... asinst.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Programmi\HPQ\SHARED\HPQWMI.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe

[andorra24]

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

Queste 2 voci del log indicano che l'uso dell'editor del registro di sistema e' disabilitato. Se questa restrizione non e' stata voluta da te (o dall'amministratore di sistema) allora devi eliminarle premendo fix checked.

[gilmol]

mille grazie davvero.!

[gilmol]

ma il blocco di cui parli (dato che non sono io ad aver settato il pc ..incapace come sono..) a che serve? Perchè mai si fa fare una cosa del genere ?....
Grazie ancora per la risp!
Gil

[gilmol]

nello stesso pc del log di cui sopra mi appare dopo una scansione con il Kaspersky (che non ho) questo report con indicati un bel po' di virus .
Che consigli darmi? Con quale antivirus poter estirpare i "maligni" , dato che il mio Avast non è idoneo al caso?Anzi quale antivirus è migliore : kaspersky o Nod32?
Ancora un milione di grazie !

KASPERSKY ONLINE SCANNER REPORT
Tuesday, August 29, 2006 1:24:07 AM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 28/08/2006
Kaspersky Anti-Virus database records: 206071


Scan Settings
Scan using the following antivirus database standard
Scan Archives true
Scan Mail Bases false

Scan Target My Computer
C:\
D:\

Scan Statistics
Total number of scanned objects 67760
Number of viruses found 3
Number of infected objects 29 / 0
Number of suspicious objects 0
Duration of the scan process 01:02:46

Infected Object Name Virus Name Last Action
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\principale\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\principale\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\principale\Impostazioni locali\Cronologia\History.IE5\MSHist012006082920060830\index.dat Object is locked skipped

C:\Documents and Settings\principale\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\principale\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\principale\Impostazioni locali\Temp\hsperfdata_principale\3772 Object is locked skipped

C:\Documents and Settings\principale\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\principale\Impostazioni locali\Temporary Internet Files\Content.IE5\MJEFE5I3\ang22[1].gif Object is locked skipped

C:\Documents and Settings\principale\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\principale\ntuser.dat.LOG Object is locked skipped

C:\Programmi\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped

C:\Programmi\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped

C:\Programmi\Alwil Software\Avast4\DATA\integ\avast.int Object is locked skipped

C:\Programmi\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped

C:\Programmi\ESET\cache\CACHE.NDB Object is locked skipped

C:\Programmi\ESET\logs\virlog.dat Object is locked skipped

C:\Programmi\ESET\logs\warnlog.dat Object is locked skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\System Volume Information\_restore{8B7A22D4-A76E-4996-8147-5F0473E9EDE1}\RP20\A0002763.exe/ir32/Joo32.exe Infected: HackTool.Win32.Aost skipped

C:\System Volume Information\_restore{8B7A22D4-A76E-4996-8147-5F0473E9EDE1}\RP20\A0002763.exe/ir32/lsass.exe Infected: Backdoor.Win32.Iroffer.b skipped

C:\System Volume Information\_restore{8B7A22D4-A76E-4996-8147-5F0473E9EDE1}\RP20\A0002763.exe/su32/Jo32.exe Infected: HackTool.Win32.Aost skipped

C:\System Volume Information\_restore{8B7A22D4-A76E-4996-8147-5F0473E9EDE1}\RP20\A0002763.exe/su32/svchost.exe Infected: Backdoor.Win32.ServU-based skipped

C:\System Volume Information\_restore{8B7A22D4-A76E-4996-8147-5F0473E9EDE1}\RP20\A0002763.exe/up32/secks69.exe Infected: HackTool.Win32.Aost skipped

C:\System Volume Information\_restore{8B7A22D4-A76E-4996-8147-5F0473E9EDE1}\RP20\A0002763.exe ZIP: infected - 5 skipped

C:\System Volume Information\_restore{8B7A22D4-A76E-4996-8147-5F0473E9EDE1}\RP20\A0002788.exe Infected: HackTool.Win32.Aost skipped

C:\System Volume Information\_restore{8B7A22D4-A76E-4996-8147-5F0473E9EDE1}\RP23\A0003463.exe/ir32/Joo32.exe Infected: HackTool.Win32.Aost skipped

C:\System Volume Information\_restore{8B7A22D4-A76E-4996-8147-5F0473E9EDE1}\RP23\A0003463.exe/ir32/lsass.exe Infected: Backdoor.Win32.Iroffer.b skipped

C:\System Volume Information\_restore{8B7A22D4-A76E-4996-8147-5F0473E9EDE1}\RP23\A0003463.exe/su32/Jo32.exe Infected: HackTool.Win32.Aost skipped

C:\System Volume Information\_restore{8B7A22D4-A76E-4996-8147-5F0473E9EDE1}\RP23\A0003463.exe/su32/svchost.exe Infected: Backdoor.Win32.ServU-based skipped

C:\System Volume Information\_restore{8B7A22D4-A76E-4996-8147-5F0473E9EDE1}\RP23\A0003463.exe/up32/secks69.exe Infected: HackTool.Win32.Aost skipped

C:\System Volume Information\_restore{8B7A22D4-A76E-4996-8147-5F0473E9EDE1}\RP23\A0003463.exe ZIP: infected - 5 skipped

C:\System Volume Information\_restore{8B7A22D4-A76E-4996-8147-5F0473E9EDE1}\RP23\A0003464.exe/ir32/Joo32.exe Infected: HackTool.Win32.Aost skipped

C:\System Volume Information\_restore{8B7A22D4-A76E-4996-8147-5F0473E9EDE1}\RP23\A0003464.exe/ir32/lsass.exe Infected: Backdoor.Win32.Iroffer.b skipped

C:\System Volume Information\_restore{8B7A22D4-A76E-4996-8147-5F0473E9EDE1}\RP23\A0003464.exe/su32/Jo32.exe Infected: HackTool.Win32.Aost skipped

C:\System Volume Information\_restore{8B7A22D4-A76E-4996-8147-5F0473E9EDE1}\RP23\A0003464.exe/su32/svchost.exe Infected: Backdoor.Win32.ServU-based skipped

C:\System Volume Information\_restore{8B7A22D4-A76E-4996-8147-5F0473E9EDE1}\RP23\A0003464.exe/up32/secks69.exe Infected: HackTool.Win32.Aost skipped

C:\System Volume Information\_restore{8B7A22D4-A76E-4996-8147-5F0473E9EDE1}\RP23\A0003464.exe ZIP: infected - 5 skipped

C:\System Volume Information\_restore{8B7A22D4-A76E-4996-8147-5F0473E9EDE1}\RP23\A0011554.exe/ir32/Joo32.exe Infected: HackTool.Win32.Aost skipped

C:\System Volume Information\_restore{8B7A22D4-A76E-4996-8147-5F0473E9EDE1}\RP23\A0011554.exe/ir32/lsass.exe Infected: Backdoor.Win32.Iroffer.b skipped

C:\System Volume Information\_restore{8B7A22D4-A76E-4996-8147-5F0473E9EDE1}\RP23\A0011554.exe/su32/Jo32.exe Infected: HackTool.Win32.Aost skipped

C:\System Volume Information\_restore{8B7A22D4-A76E-4996-8147-5F0473E9EDE1}\RP23\A0011554.exe/su32/svchost.exe Infected: Backdoor.Win32.ServU-based skipped

C:\System Volume Information\_restore{8B7A22D4-A76E-4996-8147-5F0473E9EDE1}\RP23\A0011554.exe/up32/secks69.exe Infected: HackTool.Win32.Aost skipped

C:\System Volume Information\_restore{8B7A22D4-A76E-4996-8147-5F0473E9EDE1}\RP23\A0011554.exe ZIP: infected - 5 skipped

C:\System Volume Information\_restore{8B7A22D4-A76E-4996-8147-5F0473E9EDE1}\RP35\A0016844.exe Infected: HackTool.Win32.Aost skipped

C:\System Volume Information\_restore{8B7A22D4-A76E-4996-8147-5F0473E9EDE1}\RP35\A0016845.exe Infected: HackTool.Win32.Aost skipped

C:\System Volume Information\_restore{8B7A22D4-A76E-4996-8147-5F0473E9EDE1}\RP35\A0016846.exe Infected: HackTool.Win32.Aost skipped

C:\System Volume Information\_restore{8B7A22D4-A76E-4996-8147-5F0473E9EDE1}\RP35\A0016847.exe Infected: HackTool.Win32.Aost skipped

C:\System Volume Information\_restore{8B7A22D4-A76E-4996-8147-5F0473E9EDE1}\RP42\change.log Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\EventCache\{CC0FB999-F6B6-476C-9A58-9840A0E800E0}.bin Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\Temp\Perflib_Perfdata_604.dat Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

[andorra24]

ma il blocco di cui parli (dato che non sono io ad aver settato il pc ..incapace come sono..) a che serve? Perchè mai si fa fare una cosa del genere ?....
Grazie ancora per la risp!
Gil

Il pc e' tuo? Sei tu l'amministratore di sistema? Se tu non hai impostato quella restrizione che disabilita l'accesso al registro di sistema allora puo' darsi che sia stato un malware e quindi bisogna eliminare le 2 voci con hijackthis. Tutto qui.

[andorra24]

nello stesso pc del log di cui sopra mi appare dopo una scansione con il Kaspersky (che non ho) questo report con indicati un bel po' di virus .
Che consigli darmi? Con quale antivirus poter estirpare i "maligni" , dato che il mio Avast non è idoneo al caso?Anzi quale antivirus è migliore : kaspersky o Nod32?

Potresti disinstallare avast e scaricarti la versione trial di kaspersky 6.0 che dura 30 giorni e dopo averlo aggiornato puoi fare una scansione completa per eliminare le infezioni dal tuo pc. Oppure potresti mettere l'antivirus Active Virus Shield che e' gratuito ed usa il motore di scansione del kaspersky e quindi dovrebbe anche lui ripulirti per bene il pc. Se ti interessa lo trovi qui: http://www.activevirusshield.com/antivi ... /index.adp
Durante l'installazione c'e' un'opzione che installa una toolbar, bisogna escludere la toolbar dall'installazione.

Alcune infezioni sono localizzate nella cartella del ripristino di sistema. In questo caso dovrebbe essere sufficiente disattivare il ripristino di sistema per eliminarle:
http://service1.symantec.com/SUPPORT/IN ... 3151930924
Quando il tuo pc sara' del tutto pulito potrai riattivare nuovamente il ripristino di sistema.