Anche io ho beccato - e non so neppure come - questo axfreeporn.
Qui c'è il mio log di hijack. Mi potete aiutare?
Logfile of HijackThis v1.99.1
Scan saved at 10.33.06, on 22/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmi\Prevx1\PXAgent.exe
C:\Programmi\Spyware Doctor\sdhelp.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Programmi\File comuni\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Programmi\File comuni\Softwin\BitDefender Scan Server\bdss.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Programmi\Softwin\BitDefender Free Edition\bdmcon.exe
C:\Programmi\Softwin\BitDefender Free Edition\bdnagent.exe
C:\Programmi\Java\j2re1.4.2_05\bin\jusched.exe
C:\Programmi\Java\j2re1.4.2_05\bin\bak\jusched.exe
C:\WINDOWS\system32\dslagent.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
c:\programmi\internet explorer\iexplore.exe
C:\Programmi\Prevx1\PXConsole.exe
C:\Programmi\Spyware Doctor\swdoctor.exe
C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Programmi\Digisoft AntiDialer\AntiDialer.exe
C:\Programmi\VIA\RAID\raid_tool.exe
C:\Programmi\SpywareGuard\sgmain.exe
C:\Programmi\SpywareGuard\sgbhp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Administrator\Desktop\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Yahoo! Toolbar con blocco Pop-Up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: 81.174.48.32 l2authd.lineage2.com
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuardDLBLOCK.CBrowserHelper - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Programmi\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Dati applicazioni\Prevx\pxbho.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: Yahoo! Toolbar con blocco Pop-Up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [BDMCon] C:\Programmi\Softwin\BitDefender Free Edition\\bdmcon.exe
O4 - HKLM\..\Run: [BDNewsAgent] C:\Programmi\Softwin\BitDefender Free Edition\\bdnagent.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PrevxOne] "C:\Programmi\Prevx1\PXConsole.exe"
O4 - HKCU\..\Run: [ccleaner] "C:\Programmi\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [msnmsgr] "C:\recupero\Programmi\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Programmi\Spyware Doctor\swdoctor.exe" /Q
O4 - Startup: SpywareGuard.lnk = C:\Programmi\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digisoft AntiDialer.lnk = C:\Programmi\Digisoft AntiDialer\AntiDialer.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Programmi\VIA\RAID\raid_tool.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://elearning5.unibg.it/qp2.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programmi\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {B7039D87-D648-4431-BA87-C3A04E6111DA} (wodTelnetDLX Class) - https://81.174.48.32:4643/vz/ssh/wodTelnetDLX.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E03924FA-B1D3-4B0D-9ABA-5FE2EA5FB9C8}: NameServer = 212.245.255.2
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Programmi\File comuni\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Programmi\Prevx1\PXAgent.exe" -f (file missing)
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Programmi\Spyware Doctor\sdhelp.exe
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Programmi\File comuni\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)
questo invece è il log del programma FINDawf
Find AWF report by noahdfear ©2006
bak folders found
~~~~~~~~~~~
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 0416-F02A
Directory di C:\VEXPLITE\BAK
20/03/2007 19.07 241.664 MONLITE.EXE
1 File 241.664 byte
2 Directory 17.603.334.144 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 0416-F02A
Directory di C:\PROGRA~1\CCLEANER\BAK
02/02/2005 19.04 425.984 ccleaner.exe
1 File 425.984 byte
2 Directory 17.603.317.760 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 0416-F02A
Directory di C:\PROGRA~1\ITUNES\BAK
30/10/2006 09.36 256.576 iTunesHelper.exe
1 File 256.576 byte
2 Directory 17.603.313.664 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 0416-F02A
Directory di C:\PROGRA~1\QUICKT~1\BAK
25/10/2006 18.58 282.624 qttask.exe
1 File 282.624 byte
2 Directory 17.603.313.664 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 0416-F02A
Directory di C:\PROGRA~1\SPYWAR~1\BAK
0 File 0 byte
2 Directory 17.603.313.664 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 0416-F02A
Directory di C:\WINDOWS\SYSTEM32\BAK
09/07/2001 10.50 155.648 NeroCheck.exe
1 File 155.648 byte
2 Directory 17.603.313.664 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 0416-F02A
Directory di C:\PROGRA~1\ALWILS~1\AVAST4\BAK
15/01/2007 18.28 108.160 ashDisp.exe
1 File 108.160 byte
2 Directory 17.603.313.664 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 0416-F02A
Directory di C:\PROGRA~1\GOOGLE\GOOGLE~1\BAK
12/05/2006 02.42 3.284.992 googletalk.exe
1 File 3.284.992 byte
2 Directory 17.603.313.664 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 0416-F02A
Directory di C:\PROGRA~1\SOFTWIN\BITDEF~1\BAK
22/04/2005 13.56 229.376 bdmcon.exe
22/04/2005 13.56 4.608 bdnagent.exe
2 File 233.984 byte
2 Directory 17.603.313.664 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 0416-F02A
Directory di C:\PROGRA~1\FILECO~1\REAL\UPDATE~1\BAK
08/05/2005 11.19 180.269 realsched.exe
1 File 180.269 byte
2 Directory 17.603.313.664 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 0416-F02A
Directory di C:\PROGRA~1\GOOGLE\GOOGLE~2\121128~1.546\BAK
27/01/2007 23.23 171.448 GoogleToolbarNotifier.exe
1 File 171.448 byte
2 Directory 17.603.313.664 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 0416-F02A
Directory di C:\PROGRA~1\JAVA\J2RE14~1.2_0\BIN\BAK
03/06/2004 21.05 32.881 jusched.exe
1 File 32.881 byte
2 Directory 17.603.309.568 byte disponibili
Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~
241664 16 Mar 2007 "C:\VEXPLITE\monlite.exe"
241664 20 Mar 2007 "C:\VEXPLITE\bak\MONLITE.EXE"
603016 6 Mar 2007 "C:\Programmi\CCleaner\ccleaner.exe"
425984 2 Feb 2005 "C:\Programmi\CCleaner\bak\ccleaner.exe"
24076 21 Mar 2007 "C:\Programmi\iTunes\iTunesHelper.exe"
256576 30 Oct 2006 "C:\Programmi\iTunes\bak\iTunesHelper.exe"
102400 28 Dec 2006 "C:\WINDOWS\Installer\{446DBFFA-4088-48E3-8932-74316BA4CAE4}\iTunesIco.exe"
108096 30 Oct 2006 "C:\Documents and Settings\All Users\Dati applicazioni\Apple Computer\Installer Cache\iTunes 7.0.2.16\iTunesSetupAdmin.exe"
24076 21 Mar 2007 "C:\Programmi\QuickTime\qttask.exe"
282624 25 Oct 2006 "C:\Programmi\QuickTime\bak\qttask.exe"
24076 21 Mar 2007 "C:\WINDOWS\system32\NeroCheck.exe"
155648 9 Jul 2001 "C:\WINDOWS\system32\bak\NeroCheck.exe"
108160 15 Jan 2007 "C:\Programmi\Alwil Software\Avast4\ashDisp.exe"
108160 15 Jan 2007 "C:\Programmi\Alwil Software\Avast4\bak\ashDisp.exe"
98352 19 Apr 2005 "C:\recupero\Programmi\Go!Zilla\Alwil Software\Avast4\ASHDISP.EXE"
465088 4 May 2004 "C:\Documents and Settings\Administrator\Desktop\tutto\GoogleToolbarInstaller.exe"
3284992 12 May 2006 "C:\Programmi\Google\Google Talk\bak\googletalk.exe"
24076 21 Mar 2007 "C:\Programmi\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe"
171448 27 Jan 2007 "C:\Programmi\Google\GoogleToolbarNotifier\1.2.1128.5462\bak\GoogleToolbarNotifier.exe"
229376 12 Feb 2004 "C:\Programmi\Softwin\BitDefender Free Edition\bdmcon.exe"
229376 22 Apr 2005 "C:\Programmi\Softwin\BitDefender Free Edition\bak\bdmcon.exe"
6656 16 Dec 2003 "C:\Programmi\Softwin\BitDefender Free Edition\bdnagent.exe"
4608 22 Apr 2005 "C:\Programmi\Softwin\BitDefender Free Edition\bak\bdnagent.exe"
24076 21 Mar 2007 "C:\Programmi\File comuni\Real\Update_OB\realsched.exe"
180269 8 May 2005 "C:\Programmi\File comuni\Real\Update_OB\bak\realsched.exe"
465088 4 May 2004 "C:\Documents and Settings\Administrator\Desktop\tutto\GoogleToolbarInstaller.exe"
3284992 12 May 2006 "C:\Programmi\Google\Google Talk\bak\googletalk.exe"
24076 21 Mar 2007 "C:\Programmi\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe"
171448 27 Jan 2007 "C:\Programmi\Google\GoogleToolbarNotifier\1.2.1128.5462\bak\GoogleToolbarNotifier.exe"
24076 21 Mar 2007 "C:\Programmi\Java\j2re1.4.2_05\bin\jusched.exe"
32881 3 Jun 2004 "C:\Programmi\Java\j2re1.4.2_05\bin\bak\jusched.exe"
end of report
Registrazione