Analizzare un log di hijackthis da soli

[MrOZ]

Questa è una pag web con uno script x analizzare un log di hijackthis

http://hijackthis.de/index.php?langselect=english

basta copiare il contenuto di hijackthis.log nel box in fondo e premere "analyze" dopodichè avrete una analisi del vostro log.

- Attenzione xò che questo sistema è ancora in fase di sviluppo, quindi non riconosce ancora tutti i prog.


Mentre qui è disponibile un tutorial su HiJackThis:
http://www.bleepingcomputer.com/tutorials/tutorial42.html

Ciao.

[Bandit]

ok;)

[netquik]

ottimo MrOz!

mi sembra utilizzi le informazioni di pacman per gli startups o erro?

ciauz

[wgator]

:)

wow... mica male... e ci prende anche parecchio :D

ottimo ausilio all'interpretazione dei log...

Edit

Ho fatto un po' di esperimenti con i log appestati :D di alcuni utenti del forum. Come giustamente mette in evidenza MrOz un po' di cautela non guasta prima di cancellare qualcosa, comunque sembra piuttosto affidabile.

Forse meriterebbe di essere messo in evidenza... cosa ne pensi Eraser? :)

[eraser]

si lo metto in rilievo

scusate ma sono tornato ieri e mi sono perso un pò di cose :D

[wgator]

Originariamente inviato da eraser
si lo metto in rilievo

scusate ma sono tornato ieri e mi sono perso un pò di cose :D

:spam: Uhmm... niente di grave o importante, purtroppo non sono passate a trovarci nè Naomi nè Megane sul nostro forum preferito :cry:

... solo virus, trojan e malware assortiti...

:D ciao

[The Lenny]

Originariamente inviato da MrOZ
Questa è una pag web con uno script x analizzare un log di hijackthis

http://hijackthis.de/index.php?langselect=english

basta copiare il contenuto di hijackthis.log nel box in fondo e premere "analyze" dopodichè avrete una analisi del vostro log.

- Attenzione xò che questo sistema è ancora in fase di sviluppo, quindi non riconosce ancora tutti i prog.

Ciao.

In effetti, qualche prg ancora sfugge, ma non credo ci sia da strapparsi i capelli x questo..
EBBRAVO MROZ!!
:winner:

[MrOZ]

Beh cmq dal giorno in cui ho postato il link hanno fatto notevoli progressi... ora riconosce molti + progr installati e non pericolosi...

...avevo mandato loro una mail informandoli che il log checker non riconosceva i file di DialerControl, BOClean e L'n'S, ora invece lo fa ;)

[Idx]

Veramente ottimo! Ora i log sono più comprensibili! ;)

[fabius00]

mni da questo a me

http://hijackthis.de/logfiles/301ed24a1de2e6e4d8f11a5db4fe91aa.html

[wgator]

Ciao,

:D :sofico: hehehe, ora, non so perchè :eek: riconosce come "pericoloso" il pulsante "collegamenti" sulla barra degli strumenti di Internet explorer.

Fino ad un paio di giorni lo considerava solo "sconosciuto"

Edit del 07/08/04:

Abbiamo scoperto che gli sfugge (segnalandola come sicura) questa cosetta qua:
O4 - HKLM\..\Run: [Multimedia Codecs] C:\WINDOWS\System32\mcc.exe

che invece sembrerebbe appartenere a questo trojan:

Name: Mojuo.w32
Type: Trojan
File Name: mcc.exe
Found: 06.23.2004
Packer: UPX based
Installation: Copies itself to "Windows\System32" and registers itself in autostartup key [HKEY_LOCAL_MACHINE\ SOFTWARE\ Microsoft\ CurrentVersion\ Run] "Multimedia Codecs" = “%system%\mcc.exe”
Size (bytes): 36864
Components: mcc.exe

Il Log Analizer invece dice che:

The entered application Multimedia Codecs was identified: Multimedia KBDorMULTIMEDIA KEYBOARD. Hit rate: 43,08 % (result)

Morale: ricontrollare tutto anche con gli antichi sistemi :D

[iron84]

Grazie a questo tread, sto imparando ad analizzarmi da solo il log di HijackThis. Ho già trovato degli spyware.... Poi, una volta terminata la mia analisi, proverò a far analizzare il log in quella pagina che analizza i log per vedere il risultato del duro lavoro.
Volevo però porVi una domanda.
Per le righe O2 e O3 che si deve guardare la pagina www.sysinfo.org/bholist.php, e se l'oggetto in questione è classificato come X (spyware), come L ("buono"), O(sotto dibattito) e ?. Ma a me capita che una riga non viene riconosciuta all'interno del sito: è la seguente:

O3 - Toolbar: (no name) - {31D1CA78-F919-4198-8DA5-AB6F44E4AB28} - (no file)
come bisogna comportarsi in questi casi?


Un ultima precisazione, cosa significano le diciture "BHO" e "LT"in piccolo vicino alle lettere sopra-citate?

Vi ringrazio molto.

[MrOZ]

Originariamente inviato da iron84
Grazie a questo tread, sto imparando ad analizzarmi da solo il log di HijackThis. Ho già trovato degli spyware.... Poi, una volta terminata la mia analisi, proverò a far analizzare il log in quella pagina che analizza i log per vedere il risultato del duro lavoro.
Volevo però porVi una domanda.
Per le righe O2 e O3 che si deve guardare la pagina www.sysinfo.org/bholist.php, e se l'oggetto in questione è classificato come X (spyware), come L ("buono"), O(sotto dibattito) e ?. Ma a me capita che una riga non viene riconosciuta all'interno del sito: è la seguente:

O3 - Toolbar: (no name) - {31D1CA78-F919-4198-8DA5-AB6F44E4AB28} - (no file)
come bisogna comportarsi in questi casi?


Un ultima precisazione, cosa significano le diciture "BHO" e "LT"in piccolo vicino alle lettere sopra-citate?

Vi ringrazio molto.


Quella stringa 03 è un rimasuglio, puoi eliminarla.

"BHO" significa browser helper object e sta a rappresentare qualsiasi cosa/file che modifica le impostazioni o la struttura del browser.

[netquik]

cosa significano le diciture "BHO" e "LT"in piccolo vicino alle lettere sopra-citate?


per BHO ti ha detto MrOZ

per LT... penso tu volessi dire TB che ovviamente sta per ToolBar

[Nicky]

Questa è una buona notizia.
Ultimamente sto diventando una maniaca della sicurezza e rompere sempre le scatole qui non mi sembra il caso.
Quando torno dalle ferie vedo come funge :p

[MrOZ]

Originariamente inviato da Nicky
Questa è una buona notizia.
Ultimamente sto diventando una maniaca della sicurezza e rompere sempre le scatole qui non mi sembra il caso.
Quando torno dalle ferie vedo come funge :p


TOH... chi si rivede :p

Attenta che 6 agli sgoccioli... sono gli ultimi gg. :D :D GODITELI!!! :gluglu:


ciao :vicini: ...ed a presto :cincin:

[iron84]

So di aver letto in un tread che si diceva che se non si hanno problemi con il computer di non

postare log di hijackthis. Io a perte che qualche volta crasha Explorer o si blocca wmplayer non ho

grossi problemi, ma penso che si tratti per il fatto che devo formattare e quindi non mi preoccupo.
Il fatto è che adesso, appunto prima di formattare, stavo sperimentando un po di cose tra le quali

questa della sicurezza.
Ho usato poi spybot.
Ora vi posto il log prima e poi, di seguito ci metto quello "pulito da me". (Devo ancora eliminare

DAP) per vedere se ho fatto un buon lavoro e quindi, se tutto va bene dovrei riuscire a cavarmela da

solo senza abusare del vostro tempo.

Le mie domande sono:
1) Come mai DAP e Statbar vengono considerati spyware?
2) Cos'è secondo voi quel processo attivo rundll32.exe? Non mi sembra sia zozzeria di win.
3) Non so cosa corrisponde questa riga => F:\WINDOWS\downlo~1\f4bwd1g\jvxtf2.exe





Logfile of HijackThis v1.98.2
Scan saved at 18.49.00, on 15/08/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\Programmi\Sygate\SPF\smc.exe
F:\WINDOWS\Explorer.EXE
F:\Documents and Settings\Diego\Desktop\RedLine\Taskbar.exe
F:\programmi\ASUS\AsusProb.exe
F:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
F:\SCANJET\PrecisionScanLT\hppwrsav.exe
F:\Programmi\File comuni\Real\Update_OB\realsched.exe
F:\WINDOWS\system32\spoolsv.exe
F:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
F:\Programmi\QuickTime\qttask.exe
F:\PROGRA~1\NORTON~1\navapw32.exe
F:\Programmi\Elaborate Bytes\CloneCD\CloneCDTray.exe
F:\Programmi\D-Tools\daemon.exe
F:\PROGRAMMI\EASY FILE PROTECTOR\EFPA.exe
F:\WINDOWS\System32\rundll32.exe
F:\Programmi\File comuni\Nokia\NCLTools\NclTray.exe
F:\Programmi\Nokia\Nokia PC Suite 5\DataLayer.exe
C:\sj652\hpupdate.exe
F:\Programmi\Messenger\msmsgs.exe
F:\Programmi\ATI Multimedia\RemCtrl\ATIX10.exe
F:\Programmi\ATI Multimedia\main\ATISched.EXE
F:\Programmi\vmtu\VMTU.Exe
F:\Programmi\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
F:\Programmi\File comuni\Nokia\Services\ServiceLayer.exe
F:\WINDOWS\System32\Ati2evxx.exe
F:\WINDOWS\System32\rundll32.exe
F:\Programmi\Digisoft AntiDialer\AntiDialer.exe
F:\WINDOWS\downlo~1\f4bwd1g\jvxtf2.exe
F:\Documents and Settings\Diego\Desktop\redline\gameutil.exe
F:\Programmi\SEC\Natural Color\NaturalColorLoad.exe
F:\Programmi\Norton AntiVirus\navapsvc.exe
F:\Programmi\Palick Soft\SIGuardian\SIGuardian.exe
F:\Programmi\Globe Software\StatBar\StatBar.exe
F:\Programmi\File comuni\Real\Update_OB\rnathchk.exe
F:\Documents and Settings\Diego\Impostazioni locali\Temp\HijackThis.exe
F:\Programmi\Expert System\PlanetGate Trio\Point&Go.exe
F:\Programmi\Expert System\PlanetGate Trio\txtuser.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - F:\Programmi\DAP\DAPBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Programmi\Adobe\Acrobat

5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: URLLink Class - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} -

F:\Programmi\NewDotNet\newdotnet6_22.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - F:\Programmi\Norton

AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - F:\Programmi\Norton

AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - F:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - F:\Programmi\DAP\DAPIEBar.dll
O3 - Toolbar: (no name) - {31D1CA78-F919-4198-8DA5-AB6F44E4AB28} - (no file)
O3 - Toolbar: UCmore - The Search Accelerator Toolbar - {44BE0690-5429-47f0-85BB-3FFD8020233E} -

F:\Programmi\TheSearchAccelerator\UCMTSAIE.dll
O4 - HKLM\..\Run: [RedLine Taskbar] F:\Documents and Settings\Diego\Desktop\RedLine\Taskbar.exe
O4 - HKLM\..\Run: [ASUS Probe] f:\programmi\ASUS\AsusProb.exe
O4 - HKLM\..\Run: [EM_EXEC] F:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [hppwrsav] F:\SCANJET\PrecisionScanLT\hppwrsav.exe
O4 - HKLM\..\Run: [TkBellExe] F:\Programmi\File comuni\Real\Update_OB\realsched.exe -osboot
O4 - HKLM\..\Run: [ATIPTA] F:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "F:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] F:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] "F:\Programmi\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [NAV Agent] F:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "F:\Programmi\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [CloneCDTray] "F:\Programmi\Elaborate Bytes\CloneCD\CloneCDTray.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "F:\Programmi\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [MBM 5] "C:\Program Files\Motherboard Monitor 5\MBM5.EXE"
O4 - HKLM\..\Run: [Prozrachnaya2.exe] F:\Programmi\DBSOFT\PYE.exe
O4 - HKLM\..\Run: [mspwr] F:\WINDOWS\System32\pwrupst.exe
O4 - HKLM\..\Run: [PCXLSE] F:\Programmi\PCAccel6000\pcaccel.exe
O4 - HKLM\..\Run: [New.net Startup] rundll32 F:\PROGRA~1\NewDotNet\newdotnet6_22.dll,NewDotNetStartup
O4 - HKLM\..\Run: [RVP] "F:\Programmi\RVP\bpc.e*e"
O4 - HKLM\..\Run: [webHancer Survey Companion] "F:\Program Files\webHancer\Programs\whSurvey.exe"
O4 - HKLM\..\Run: [SmcService] F:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [Nokia Tray Application] F:\Programmi\File comuni\Nokia\NCLTools\NclTray.exe
O4 - HKLM\..\Run: [DataLayer] F:\Programmi\Nokia\Nokia PC Suite 5\DataLayer.exe
O4 - HKLM\..\Run: [HP Update 3400C] C:\sj652\hpupdate.exe 3400C
O4 - HKCU\..\Run: [MSMSGS] "F:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ATI Remote Control] F:\Programmi\ATI Multimedia\RemCtrl\ATIX10.exe
O4 - HKCU\..\Run: [ATI Scheduler] F:\Programmi\ATI Multimedia\main\ATISched.EXE
O4 - HKCU\..\Run: [WashAndGo - Cleanup of old Backupfiles] "F:\Programmi\WashAndGo\checker.exe

/check"
O4 - HKCU\..\Run: [VMTU] F:\Programmi\vmtu\VMTU.Exe
O4 - Startup: SIGuardian.lnk = F:\Programmi\Palick Soft\SIGuardian\SIGuardian.exe
O4 - Startup: StatBarr.lnk = F:\Programmi\Globe Software\StatBar\StatBar.exe
O4 - Global Startup: Acrobat Assistant.lnk = F:\Programmi\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = F:\Programmi\File comuni\Adobe\Calibration\Adobe

Gamma Loader.exe
O4 - Global Startup: Digisoft AntiDialer.lnk = F:\Programmi\Digisoft AntiDialer\AntiDialer.exe
O4 - Global Startup: gameutil.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = F:\Programmi\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: NaturalColorLoad.lnk = ?
O8 - Extra context menu item: &Download with &DAP - F:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - F:\PROGRA~1\DAP\dapextie2.htm
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - F:\Programmi\ATI

Multimedia\TV\EXPLBAR.DLL
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - F:\PROGRA~1\DAP\DAP.EXE
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O12 - Plugin for .spop: F:\Programmi\Internet Explorer\Plugins\NPDocBox.dll


=====================================================================================
Dopo la pulizia

Logfile of HijackThis v1.98.2
Scan saved at 23.51.49, on 27/08/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\Programmi\Sygate\SPF\smc.exe
F:\WINDOWS\Explorer.EXE
F:\Documents and Settings\Diego\Desktop\RedLine\Taskbar.exe
F:\programmi\ASUS\AsusProb.exe
F:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
F:\SCANJET\PrecisionScanLT\hppwrsav.exe
F:\WINDOWS\system32\spoolsv.exe
F:\Programmi\File comuni\Real\Update_OB\realsched.exe
F:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
F:\Programmi\QuickTime\qttask.exe
F:\PROGRA~1\NORTON~1\navapw32.exe
F:\Programmi\Elaborate Bytes\CloneCD\CloneCDTray.exe
F:\PROGRAMMI\EASY FILE PROTECTOR\EFPA.exe
F:\Programmi\D-Tools\daemon.exe
F:\Programmi\File comuni\Nokia\NCLTools\NclTray.exe
F:\Programmi\Nokia\Nokia PC Suite 5\DataLayer.exe
F:\Programmi\Messenger\msmsgs.exe
F:\Programmi\ATI Multimedia\RemCtrl\ATIX10.exe
F:\Programmi\ATI Multimedia\main\ATISched.EXE
F:\WINDOWS\System32\Ati2evxx.exe
F:\Programmi\File comuni\Nokia\Services\ServiceLayer.exe
F:\Programmi\vmtu\VMTU.Exe
F:\WINDOWS\downlo~1\f4bwd1g\jvxtf2.exe
F:\Programmi\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
F:\Programmi\Digisoft AntiDialer\AntiDialer.exe
F:\Documents and Settings\Diego\Desktop\redline\gameutil.exe
F:\WINDOWS\System32\rundll32.exe
F:\Programmi\SEC\Natural Color\NaturalColorLoad.exe
F:\Programmi\Norton AntiVirus\navapsvc.exe
F:\Programmi\Palick Soft\SIGuardian\SIGuardian.exe
F:\Programmi\Globe Software\StatBar\StatBar.exe
F:\Documents and Settings\Diego\Impostazioni locali\Temp\HijackThis.exe

O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - F:\Programmi\DAP\DAPBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Programmi\Adobe\Acrobat

5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - F:\PROGRA~1\Spybot - Search &

Destroy\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - F:\Programmi\Norton

AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - F:\Programmi\Norton

AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - F:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - F:\Programmi\DAP\DAPIEBar.dll
O4 - HKLM\..\Run: [RedLine Taskbar] F:\Documents and Settings\Diego\Desktop\RedLine\Taskbar.exe
O4 - HKLM\..\Run: [ASUS Probe] f:\programmi\ASUS\AsusProb.exe
O4 - HKLM\..\Run: [EM_EXEC] F:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [hppwrsav] F:\SCANJET\PrecisionScanLT\hppwrsav.exe
O4 - HKLM\..\Run: [TkBellExe] F:\Programmi\File comuni\Real\Update_OB\realsched.exe -osboot
O4 - HKLM\..\Run: [ATIPTA] F:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "F:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] F:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] "F:\Programmi\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [NAV Agent] F:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "F:\Programmi\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [CloneCDTray] "F:\Programmi\Elaborate Bytes\CloneCD\CloneCDTray.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "F:\Programmi\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [MBM 5] "C:\Program Files\Motherboard Monitor 5\MBM5.EXE"
O4 - HKLM\..\Run: [mspwr] F:\WINDOWS\System32\pwrupst.exe
O4 - HKLM\..\Run: [PCXLSE] F:\Programmi\PCAccel6000\pcaccel.exe
O4 - HKLM\..\Run: [SmcService] F:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [Nokia Tray Application] F:\Programmi\File comuni\Nokia\NCLTools\NclTray.exe
O4 - HKLM\..\Run: [DataLayer] F:\Programmi\Nokia\Nokia PC Suite 5\DataLayer.exe
O4 - HKCU\..\Run: [MSMSGS] "F:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ATI Remote Control] F:\Programmi\ATI Multimedia\RemCtrl\ATIX10.exe
O4 - HKCU\..\Run: [ATI Scheduler] F:\Programmi\ATI Multimedia\main\ATISched.EXE
O4 - HKCU\..\Run: [WashAndGo - Cleanup of old Backupfiles] "F:\Programmi\WashAndGo\checker.exe

/check"
O4 - HKCU\..\Run: [VMTU] F:\Programmi\vmtu\VMTU.Exe
O4 - Startup: SIGuardian.lnk = F:\Programmi\Palick Soft\SIGuardian\SIGuardian.exe
O4 - Startup: StatBarr.lnk = F:\Programmi\Globe Software\StatBar\StatBar.exe
O4 - Global Startup: Acrobat Assistant.lnk = F:\Programmi\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = F:\Programmi\File comuni\Adobe\Calibration\Adobe

Gamma Loader.exe
O4 - Global Startup: Digisoft AntiDialer.lnk = F:\Programmi\Digisoft AntiDialer\AntiDialer.exe
O4 - Global Startup: gameutil.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = F:\Programmi\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: NaturalColorLoad.lnk = ?
O8 - Extra context menu item: &Download with &DAP - F:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - F:\PROGRA~1\DAP\dapextie2.htm
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - F:\Programmi\ATI

Multimedia\TV\EXPLBAR.DLL
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - F:\PROGRA~1\DAP\DAP.EXE
O12 - Plugin for .spop: F:\Programmi\Internet Explorer\Plugins\NPDocBox.dll





Ringrazio molto e scusate la lunghezza.
P.S. Molto utile la guida per hijackthis

[Nicky]

Edit: risolto da sola... :p

[Max The Carret]

allora, mi son beccato un trojan:rolleyes: , se non era per zone alarm che lo bloccava chissà se me ne accorgevo, avg lo ha trovato il giorno seguente dopo aver fatto l'aggiornamento. ma non lo toglie.
fatto scansioni in rete, individuato, non tolto.
fatto log con hijackthis, individuato:rolleyes:
il fatto è che ho appena formattato e me ne sono accorto subito dopo, chissà dove si era intanato... impossibile averlo preso nei tre minuti in cui zone era disattivato mentre facevo l'up.
non mi costa nulla riformattare, ma se risiede ancora nei documenti? penso mi sia entrato attraverso un p2p, oppure con mirc. si chiama linux.exe, trojan/irc/backdoor.sdbot.47

mi aiutate a toglierlo? vi posto il log:
grazie per l'aiuto :)

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\soundman.exe
C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programmi\iTunes\iTunesHelper.exe
C:\Programmi\QuickTime\qttask.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmi\MSN Messenger\MsnMsgr.Exe
D:\Service Disk\html2pop3117betawin32\html2pop3.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\Programmi\Outlook Express\msimn.exe
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\Programmi\iTunes\iTunes.exe
D:\Service Disk\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://xoomer.virgilio.it/pronius
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Microsoft Update Machine] Linux.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Programmi\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\RunServices: [Microsoft Update Machine] Linux.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Microsoft Update Machine] Linux.exe
O4 - Startup: Collegamento a html2pop3.lnk = D:\Service Disk\html2pop3117betawin32\html2pop3.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{794D9CDA-DCD4-4A81-9BE4-D4F51C3A0A15}: NameServer = 80.18.114.155 151.99.125.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{794D9CDA-DCD4-4A81-9BE4-D4F51C3A0A15}: NameServer = 80.18.114.155 151.99.125.1

[BadMirror]

.

[MrOZ]

Originariamente inviato da Max The Carret
allora, mi son beccato un trojan:rolleyes: , se non era per zone alarm che lo bloccava chissà se me ne accorgevo, avg lo ha trovato il giorno seguente dopo aver fatto l'aggiornamento. ma non lo toglie.
fatto scansioni in rete, individuato, non tolto.
fatto log con hijackthis, individuato:rolleyes:
il fatto è che ho appena formattato e me ne sono accorto subito dopo, chissà dove si era intanato... impossibile averlo preso nei tre minuti in cui zone era disattivato mentre facevo l'up.
non mi costa nulla riformattare, ma se risiede ancora nei documenti? penso mi sia entrato attraverso un p2p, oppure con mirc. si chiama linux.exe, trojan/irc/backdoor.sdbot.47

mi aiutate a toglierlo? vi posto il log:
grazie per l'aiuto :)



NON POSTATE QUI I LOG DI HIJACHTHIS DA FAR ANALIZZARE AD ALTRI... in questo 3D non ve li visionerà nessuno.

Aprite un 3D nuovo, specificando + informazioni possibili.

Grazie.

[Max The Carret]

ok, grazie :)
pensavo ci fosse un trhead specifico, e non avendolo trovato...

cmq, lo ho analizzato in rete, ma non riuscendo a togliere il trojan, ho formattato :D

ciao

[Matrixbob]

Bisogna che il risultato siano tutte V verdi oppure sono ammesse anche le icone gialle?!

Rosse ovviamente no :) giusto?!

[gabryboom]

scusate ma hijackthis definisce il file Mqeuwxsrgbzo [c:\windows\system32\zdablpu.exe] (presente nella lista di startup) come sospetto,
ma a me sembra chiaramente un trojan
per di più all'avvio di windows xp si apre la connessione remota
che faccio ... posso rimuovere questo file con regcleaner oppure è un file di windows?????

:confused: :confused: :confused:

[Matrixbob]

Originariamente inviato da gabryboom
scusate ma hijackthis definisce il file Mqeuwxsrgbzo [c:\windows\system32\zdablpu.exe] (presente nella lista di startup) come sospetto,
ma a me sembra chiaramente un trojan
per di più all'avvio di windows xp si apre la connessione remota
che faccio ... posso rimuovere questo file con regcleaner oppure è un file di windows?????

:confused: :confused: :confused:
Non so se questo è il 3D giusto per discuterne, ma non ho mai visto un simile file di winzoz.
Prova con tutti gli antispyware consigliati dal forum (Lavasoft & co).
Prova con ewido o The Cleaner per vedere se è un trojan.
Inoltre regcleaner dovrebbe servire solo a pulire il registro e non i file dal PC, almeno il nome già suggerisce quello ... e poi non mi ricordo facce faville ... :rolleyes:

[wgator]

Originariamente inviato da Matrixbob
Bisogna che il risultato siano tutte V verdi oppure sono ammesse anche le icone gialle?!

Rosse ovviamente no :) giusto?!

Ciao,

bè... il motore di analisi per hijackthis è molto utile per fornire una traccia ma non va considerato la bibbia.

Le icone verdi normalmente sono file legittimi, quelle arancio dovrebbero essere controllate manualmente (si mette il nome del file in Google e si cerca di capire cos'è) a volte sono files di sistema o di programmi che non vengono riconosciuti a volte sono schifezze.

Anche per quanto riguarda le icone rosse è meglio fare un controllino prima di cancellarle, non è infrequente che il motore consideri infetti file che invece sono regolari.

Uno per tutti, viene considerato pericoloso questo:

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti

Si tratta invece del pulsante "collegamenti" sulla barra di Explorer che sarà sicuramente inutile ma non certo pericoloso :p

In conclusione: quel motore è molto utile però conviene fare anche un controllo incrociato con google perchè non è infallibile :)

[High Speed]

volevo dire grazie a chi ha inventato questo software ....
oggi grazie a lui sono riuscito a recuperare un pc che non voleva saperne di connettersi ad internet dopo avergli estirpato (con Kaspersky) 97 virus di almeno 30 tipi diversi, 250 (tra processi, chiavi di registro e files) elementi negativi con ad aware ed un paio di fix dal CWSrhedder.

Mi aveva fatto impazzire perchè la rete locale funzionava poi dopo aver fatto la prova del 9 con un "modem" adsl usb diretto quando ho visto che non si connetteva neanche in quel modo sono ricorso appunto al Hijackthis ed ho scoperto la causa semplicemente leggendo la scansione (cioè senza nemmeno allegare il log sul sito)....
la causa era il lsp.dll e relativo winsock stack, il programma mi ha indirizzato su un sito a cui devo dire veramente grazie (www.cexx.org/lspfix.htm) da cui appunto ho scaricato il fix riparando win xp.

Certo che questo pc è di una società, e conteneva troppi dati importanti per essere tenuto in quelle condizioni.... :rolleyes: no comment va....

Un grazie, ovviamente, anche a questo forum ed a MrOZ che diverso tempo addietro aveva segnalato questo programma, che a mia volta avevo pensato bene di mettere sulla mia Memory usb per i soccorsi di emergenza.
Ciao

[fedved]

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/...all/xscan53.cab

i due 04 ..... linux.exe mi puzzano come anche O4 - Startup: Collegamento a html2pop3.lnk = D:\Service Disk\html2pop3117betawin32\html2pop3.exe

e gli ultimi 2 dipendono dal tuo provider

[BravoGT83]

cacchio c'era già un 3d per hijackthis :rolleyes:

[3dsst]

volevo dire grazie a chi ha inventato questo software ....
oggi grazie a lui sono riuscito a recuperare un pc che non voleva saperne di connettersi ad internet dopo avergli estirpato (con Kaspersky) 97 virus di almeno 30 tipi diversi, 250 (tra processi, chiavi di registro e files) elementi negativi con ad aware ed un paio di fix dal CWSrhedder.

Mi aveva fatto impazzire perchè la rete locale funzionava poi dopo aver fatto la prova del 9 con un "modem" adsl usb diretto quando ho visto che non si connetteva neanche in quel modo sono ricorso appunto al Hijackthis ed ho scoperto la causa semplicemente leggendo la scansione (cioè senza nemmeno allegare il log sul sito)....
la causa era il lsp.dll e relativo winsock stack, il programma mi ha indirizzato su un sito a cui devo dire veramente grazie (www.cexx.org/lspfix.htm) da cui appunto ho scaricato il fix riparando win xp.

Certo che questo pc è di una società, e conteneva troppi dati importanti per essere tenuto in quelle condizioni.... :rolleyes: no comment va....

Un grazie, ovviamente, anche a questo forum ed a MrOZ che diverso tempo addietro aveva segnalato questo programma, che a mia volta avevo pensato bene di mettere sulla mia Memory usb per i soccorsi di emergenza.
Ciao
;)

[peppogio]

Ottimo link... ora ne capisco un po' di più! :D

[harry potter 87]

io ho cominciato ad usarlo adesso :D vedo che dall'ultimo post è passato un'anno :D è ancora utile come programma?

[juninho85]

io ho cominciato ad usarlo adesso :D vedo che dall'ultimo post è passato un'anno :D è ancora utile come programma?
utile?prova ad aprire il thread sulle discussioni ufficiali :D

[harry potter 87]

utile?prova ad aprire il thread sulle discussioni ufficiali :D

:doh: :doh: scusatemi :D

[byker]

Ciao a tutti
vorrei sapere una volta analizzato il log come devo procedere per eliminare i files infetti grazie.
Questo è il risultato dell'analisi del log.


Entry Kind
(Safe, Nasty, Unknown) Description Tip
Logfile of HijackThis v1.99.1
Safe. Shows the version of HijackThis an. The newest version is: v1.99.1!
This should be the newest version. (v1.99.1)
Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Safe. Shows the version of your Internet Explorer. Newest Version is: 6.00.2900.2180!
This should be the newest version. (6.00.2900.2180)
C:\WINDOWS\System32\smss.exe
Safe. This entry was classified from our visitors as good.
Click on the stars and look at the comments from our visitors, to see, why the entry was classified in such a way.
C:\WINDOWS\system32\winlogon.exe
Safe. This entry was classified from our visitors as good.
Click on the stars and look at the comments from our visitors, to see, why the entry was classified in such a way.
C:\WINDOWS\system32\services.exe
Safe. This entry was classified from our visitors as good.
Click on the stars and look at the comments from our visitors, to see, why the entry was classified in such a way.
C:\WINDOWS\system32\lsass.exe
Safe. This entry was classified from our visitors as good.
Click on the stars and look at the comments from our visitors, to see, why the entry was classified in such a way.
C:\WINDOWS\system32\Ati2evxx.exe
Safe. This entry was classified from our visitors as good.
Click on the stars and look at the comments from our visitors, to see, why the entry was classified in such a way.
C:\WINDOWS\system32\svchost.exe
Safe. This entry was classified from our visitors as good.
Click on the stars and look at the comments from our visitors, to see, why the entry was classified in such a way.
C:\WINDOWS\System32\svchost.exe
Safe. This entry was classified from our visitors as good.
Click on the stars and look at the comments from our visitors, to see, why the entry was classified in such a way.
C:\WINDOWS\system32\spoolsv.exe
Safe. This entry was classified from our visitors as good.
Click on the stars and look at the comments from our visitors, to see, why the entry was classified in such a way.
C:\Programmi\ewido anti-spyware 4.0\guard.exe
Safe. This entry was classified from our visitors as good.
Click on the stars and look at the comments from our visitors, to see, why the entry was classified in such a way.
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
Safe. running process. (MDM.EXE)
Machine Debug Manager. Used by developers.


C:\Programmi\Eset\nod32krn.exe
Safe. This entry was classified from our visitors as good.
Click on the stars and look at the comments from our visitors, to see, why the entry was classified in such a way.
C:\WINDOWS\system32\slmdmsr.exe
Safe. This entry was classified from our visitors as good.
Click on the stars and look at the comments from our visitors, to see, why the entry was classified in such a way.
C:\WINDOWS\system32\svchost.exe
Safe. This entry was classified from our visitors as good.
Click on the stars and look at the comments from our visitors, to see, why the entry was classified in such a way.
C:\WINDOWS\system32\Ati2evxx.exe
Safe. This entry was classified from our visitors as good.
Click on the stars and look at the comments from our visitors, to see, why the entry was classified in such a way.
C:\WINDOWS\Explorer.EXE
Safe. This entry was classified from our visitors as good.
Click on the stars and look at the comments from our visitors, to see, why the entry was classified in such a way.
C:\WINDOWS\SOUNDMAN.EXE
Safe. This entry was classified from our visitors as good.
Click on the stars and look at the comments from our visitors, to see, why the entry was classified in such a way.
C:\Programmi\HP\HP Software Update\HPWuSchd2.exe
Safe. running process. (HPWuSchd2.exe)
Part of Hewlett-Packard

Possibly nasty! According to our database this process runs normally in c:\programme\hewlett-packard\hp software update\! Check if you know this process and arrange a viruscheck where required.
C:\Programmi\File comuni\PCSuite\DataLayer\DataLayer.exe
Safe. running process. (DataLayer.exe)
Nokia DataLayer


C:\Programmi\Nokia\Nokia PC Suite 6\LaunchApplication.exe
Safe. running process. (LaunchApplication.exe)
Nokia PC Suite 6


C:\Programmi\Eset\nod32kui.exe
Safe. This entry was classified from our visitors as good.
Click on the stars and look at the comments from our visitors, to see, why the entry was classified in such a way.
C:\PROGRA~1\FILECO~1\PCSuite\Services\SERVIC~1.EXE
Safe. running process. (SERVIC~1.EXE)
Nokia PC Suite, F-Secure Backweb Client


C:\Programmi\ewido anti-spyware 4.0\ewido.exe
Safe. running process. (ewido.exe)
ewido anti-malware

Possibly nasty! According to our database this process runs normally in c:\programme\ewido anti-malware 4.0\! Check if you know this process and arrange a viruscheck where required.
C:\WINDOWS\system32\ctfmon.exe
Safe. This entry was classified from our visitors as good.
Click on the stars and look at the comments from our visitors, to see, why the entry was classified in such a way.
C:\Programmi\Messenger\msmsgs.exe
Safe. running process. (msmsgs.exe)
MSN Messenger


C:\Programmi\Phone\Skype.exe
Safe. running process. (Skype.exe)


Possibly nasty! According to our database this process runs normally in c:\programme\skype\phone\! Check if you know this process and arrange a viruscheck where required.
C:\Programmi\Nokia\Nokia PC Suite 6\PcSync2.exe
Safe. running process. (PcSync2.exe)
Nokia PC Suite 6


C:\PROGRA~1\FILECO~1\Nokia\MPAPI\MPAPI3s.exe
Safe. This entry was classified from our visitors as good.
Click on the stars and look at the comments from our visitors, to see, why the entry was classified in such a way.
C:\Programmi\Alice ti aiuta\bin\mpbtn.exe
Safe. running process. (mpbtn.exe)
System tray icon for the Virtual Assistant from AT&T Broadband, used to communicate internet problems via the network rather than telephone. Available via desktop shortcut or Start -> Programs - not required
Not dangerous, but unnecessary.

C:\Programmi\HP\Digital Imaging\bin\hpqimzone.exe
Safe. running process. (hpqimzone.exe)
Hewlett-Packard


C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
Safe. running process. (hpqtra08.exe)
HP Digital Imaging


C:\Programmi\Kodak\Kodak EasyShare software\bin\EasyShare.exe
Safe. running process. (EasyShare.exe)



C:\Programmi\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
Unknown running process. (KodakSoftwareUpdater.exe)

This is a unknown process.

C:\Programmi\HP\Digital Imaging\bin\hpqSTE08.exe
Safe. running process. (hpqSTE08.exe)
Hewlett-Packard Digital Imaging


C:\Programmi\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
Safe. running process. (hprblog.exe)
Hewlett-Packard Digital Imaging


C:\Programmi\Internet Explorer\iexplore.exe
Safe. running process. (iexplore.exe)
Internet Explorer - Wir empfehlen einen sichereren alternativen Browser zu verwenden. (z.B. Firefox)


C:\Documents and Settings\Stefano Pacini\Documenti\My Skype Received Files\hijackthis_199\HijackThis.exe
Safe. running process. (HijackThis.exe)
Tool, mit dem sie dieses Logfile erzeugt haben. Das Programm sollte so angelegt sein ! C:\Programme\HijackThis\HijackThis.exe
Remember that Hijackthis must be run in an own folder. Only if Hijackthis run in an own folder it will create backups!
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
Safe. This page has been identified as safe.

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
Safe. This entry was classified from our visitors as good.
Click on the stars and look at the comments from our visitors, to see, why the entry was classified in such a way.
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
Safe. Entries found in this registry zone are potentially nasty. This application ([06849E9F-C8D7-4D59-B87D-784B7D6BE0B3] - Result: 06849E9F-C8D7-4D59-B87D-784B7D6BE0B3) has been checked. Hit rate: 100,00%

O2 - BHO: (no name) - {18701B47-164D-48C2-89E7-D24D0F385585} - (no file)
Unnecessarily Entries found in this registry zone are potentially nasty. This application ([18701B47-164D-48C2-89E7-D24D0F385585] - Result: ) has been checked. Hit rate: 0,00%
Unknown application.
Unnecessary (deactivated) entry that can be fixed.
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar2.dll
Safe. Entries found in this registry zone are potentially nasty. This application ([AA58ED58-01DD-4d91-8333-CF10577473F7] - Result: AA58ED58-01DD-4d91-8333-CF10577473F7) has been checked. Hit rate: 100,00%

O3 - Toolbar: Yahoo! Toolbar con blocco Pop-Up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
Safe. Entries found in this registry zone are potentially nasty. This application ([EF99BD32-C1FB-11D2-892F-0090271D4F88] - Result: EF99BD32-C1FB-11D2-892F-0090271D4F88) has been checked. Hit rate: 100,00%

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar2.dll
Safe. Entries found in this registry zone are potentially nasty. This application ([2318C2B1-4965-11d4-9B18-009027A5CD4F] - Result: 2318C2B1-4965-11D4-9B18-009027A5CD4F) has been checked. Hit rate: 97,22%

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
Safe. This entry was classified from our visitors as good.
Click on the stars and look at the comments from our visitors, to see, why the entry was classified in such a way.
O4 - HKLM\..\Run: [HP Software Update] C:\Programmi\HP\HP Software Update\HPWuSchd2.exe
Safe. HP software updates. If a shortcut doesn\'t exist create your own and run it manually
Hit rate: 94,44 % (result)
Not dangerous, but unnecessary.
O4 - HKLM\..\Run: [DataLayer] C:\Programmi\File comuni\PCSuite\DataLayer\DataLayer.exe
Safe. Nokia PC Suite 5 - "A collection of powerful tools that you can use to manage your phone features and data." Synchronize the phone with, for example Outlook. You can also use it to browse your phone, edit the phone list and so on
Hit rate: 100,00 % (result)

O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Programmi\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
Safe. Nokia PC Suite 6
Hit rate: 100,00 % (result)

O4 - HKLM\..\Run: [nod32kui] "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
Safe. This entry was classified from our visitors as good.
Click on the stars and look at the comments from our visitors, to see, why the entry was classified in such a way.
O4 - HKLM\..\Run: [!ewido] "C:\Programmi\ewido anti-spyware 4.0\ewido.exe" /minimized
Safe. Ewido Anti-Malware
Hit rate: 100,00 % (result)

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
Safe. CTFMon is involved with the language/alternative input services in Office XP. CTFMON.exe will continue to put itself back into MSConfig when you run the Office XP apps as long as the Text Services and Speech applets in the Control Panel are enabled. Not required if you don\'t need these features. For more info on ctfmon see here. CTFMON can be disabled from Control Panel, Text & Speech Services
Hit rate: 55,00 % (result)

O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
Safe. Windows Messenger utility. If you don\'t use Windows Messenger, this can be annoying. Available via Start -> Programs. Go to Windows Messenger > Tools > Options > Preferences and uncheck "Run this program when Windows starts"
Hit rate: 100,00 % (result)

O4 - HKCU\..\Run: [Skype] "C:\Programmi\Phone\Skype.exe" /nosplash /minimized
Safe. "Skype is free and simple software that will enable you to make free calls anywhere in the world in minutes"
Hit rate: 100,00 % (result)
Not dangerous, but unnecessary.
O4 - HKCU\..\Run: [PcSync] C:\Programmi\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
Safe. Nokia PC Suite 6
Hit rate: 100,00 % (result)

O4 - Global Startup: Alice ti aiuta.lnk = C:\Programmi\Alice ti aiuta\bin\matcli.exe
Safe. This entry was classified from our visitors as good.
Click on the stars and look at the comments from our visitors, to see, why the entry was classified in such a way.
O4 - Global Startup: Avvio rapido di HP Image Zone.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqthb08.exe
Safe. This entry was classified from our visitors as good.
Click on the stars and look at the comments from our visitors, to see, why the entry was classified in such a way.
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
Safe. Part of Acrobat Reader 7
Hit rate: 72,03 % (result)

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
Safe. HP digital imaging monitor; can apparently be launched manually.
Hit rate: 96,43 % (result)
Not dangerous, but unnecessary.
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Programmi\Kodak\Kodak EasyShare software\bin\EasyShare.exe
Safe. Software bundled with Kodak digital cameras to manage the connection between the PC and the Camera. Can be started manually.
Hit rate: 96,15 % (result)

O4 - Global Startup: Kodak software updater.lnk = C:\Programmi\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
Unknown
Hit rate: 0,00 % (result)
Unknown application.
O4 - Global Startup: LG SyncManager.lnk = ?
Safe.
Hit rate: 66,67 % (result)

The entry is unnecessary and can be fixed.
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Safe. The entry E&sporta in Microsoft Excel has been identified as safe.
If the entry 'E&sporta in Microsoft Excel ' is not needed anymore, it should be fixed.
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
Safe. The entry Ricerche has been identified as safe.
If the entry 'Ricerche ' is not needed anymore, it should be fixed.
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
Safe. The entry Messenger has been identified as safe.
If the entry 'Messenger ' is not needed anymore, it should be fixed.
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
Safe. The entry Windows Messenger has been identified as safe.
If the entry 'Windows Messenger ' is not needed anymore, it should be fixed.
O15 - Trusted Zone: www.adslconnection.name
Nasty This entry was classified from our visitors as bad.
Click on the stars and look at the comments from our visitors, to see, why the entry was classified in such a way.
O15 - Trusted Zone: www.archivio.name
Safe. If you did not add these pages to your trusted pages, they should be fixed.

O15 - Trusted Zone: www.archiviosex.net
Nasty This entry was classified from our visitors as bad.
Click on the stars and look at the comments from our visitors, to see, why the entry was classified in such a way.
O15 - Trusted Zone: www.hastalavista.it
Safe. If you did not add these pages to your trusted pages, they should be fixed.

O15 - Trusted Zone: www.otherchance.com
Nasty This entry was classified from our visitors as bad.
Click on the stars and look at the comments from our visitors, to see, why the entry was classified in such a way.
O15 - Trusted Zone: www.playitalia.com
Safe. If you did not add these pages to your trusted pages, they should be fixed.

O15 - Trusted Zone: www.pornoaccesso.com
Safe. If you did not add these pages to your trusted pages, they should be fixed.

O15 - Trusted Zone: www.redfunny.com
Nasty This entry was classified from our visitors as bad.
Click on the stars and look at the comments from our visitors, to see, why the entry was classified in such a way.
O15 - Trusted Zone: www.sgrunt.biz
Nasty This entry was classified from our visitors as bad.
Click on the stars and look at the comments from our visitors, to see, why the entry was classified in such a way.
O15 - Trusted Zone: www.skymasters.biz
Nasty This entry was classified from our visitors as bad.
Click on the stars and look at the comments from our visitors, to see, why the entry was classified in such a way.
O15 - Trusted Zone: www.softlab.name
Safe. If you did not add these pages to your trusted pages, they should be fixed.

O15 - Trusted Zone: www.xxx-content.name
Nasty This entry was classified from our visitors as bad.
Click on the stars and look at the comments from our visitors, to see, why the entry was classified in such a way.
O17 - HKLM\System\CCS\Services\Tcpip\..\{4DC0EAE8-D2A4-4A73-8D03-090340EDBFA3}: NameServer = 85.37.17.55 85.38.28.93
Possibly nasty If this Domain does not belong to your ISP, or your firms network, these entries should be fixed. 'SearchList' entries should be fixed too.
Do you know the IP or Domain '85.37.17.55 85.38.28.93'? If not, fix this entry.
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
Safe. This entry was classified from our visitors as good.
Click on the stars and look at the comments from our visitors, to see, why the entry was classified in such a way.
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
Safe. This entry was classified from our visitors as good.
Click on the stars and look at the comments from our visitors, to see, why the entry was classified in such a way.
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Programmi\ewido anti-spyware 4.0\guard.exe
Safe. These entries shows all services which are not from Microsoft. Often malware is starting as a systemservice and it's not easy to detect it.
This service (guard.exe) was identified as a good one.
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
Safe. These entries shows all services which are not from Microsoft. Often malware is starting as a systemservice and it's not easy to detect it.
This service (KodakCCS.exe) was identified as a good one.
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmi\Eset\nod32krn.exe
Safe. This entry was classified from our visitors as good.
Click on the stars and look at the comments from our visitors, to see, why the entry was classified in such a way.
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
Safe. This entry was classified from our visitors as good.
Click on the stars and look at the comments from our visitors, to see, why the entry was classified in such a way.
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slmdmsr.exe
Safe. This entry was classified from our visitors as good.
Click on the stars and look at the comments from our visitors, to see, why the entry was classified in such a way.


This log has been checked automatically.
Check your log file automatically at www.hijackthis.de.

[juninho85]

Ciao a tutti
vorrei sapere una volta analizzato il log come devo procedere per eliminare i files infetti grazie.

"fix selected items"

[Gandhi82]

Nessun firewall attivo è stato trovato nel tuo sistema oppure stai usando un firewall a noi sconosciuto. Se non usi un firewall dovresti scaricarne uno oppure puoi attivare quello incluso in windows xp. In caso tu abbia perplessità o voglia farci inserire il firewall che usi nel nostro database, contattaci sul forum: www.hijackthis.de/forum

Possibile che non abbia attivato nessun firewall,uso quello di windows e mi risulta attivato

[wizard1993]

quello di windows non è rilevabile tramite hijackthis

[Houdini87]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15.23.23, on 15/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Intel Audio Studio\IntelAudioStudio.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programmi\Logitech\Video\LogiTray.exe
C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
C:\Programmi\Winamp\Winampa.exe
C:\Programmi\QuickTime\QTTask.exe
C:\Programmi\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Programmi\Microsoft Encarta\Microsoft Encarta 2007 - Premium DVD\EDICT.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\LVComsX.exe
C:\Programmi\Logitech\Video\FxSvr2.exe
C:\Programmi\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Programmi\MSN Messenger\msnmsgr.exe
C:\Programmi\MSN Messenger\livecall.exe
C:\Programmi\MSN Messenger\usnsvc.exe
C:\Programmi\eMule\emule.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\Windows Media Player\wmplayer.exe
C:\Documents and Settings\utente\Desktop\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: (no name) - {bd0e4d83-654e-4213-965b-fcbe887061f4} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {49E0E0F0-5C30-11D4-945D-000000000000} - C:\WINDOWS\system32\iehelper3.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [IntelAudioStudio] "C:\Programmi\Intel Audio Studio\IntelAudioStudio.exe" TRAY
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Programmi\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Programmi\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Programmi\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [StartCCC] C:\Programmi\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [E07IXLRD_158781] "C:\Programmi\Microsoft Encarta\Microsoft Encarta 2007 - Premium DVD\EDICT.EXE" -m
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Barra di ricerca di Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programmi\File comuni\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C40908A6-38C4-4035-9D11-7A7BC6C80454}: NameServer = 85.37.17.49 85.38.28.91
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Programmi\File comuni\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programmi\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

--
End of file - 7012 bytes


raga aiutatemi.....

[juninho85]

link (http://www.hwupgrade.it/forum/showthread.php?t=937676)

[Houdini87]

link (http://www.hwupgrade.it/forum/showthread.php?t=937676)

nessuno mi può aiutare??a trovare se ho qualche problema?

[juninho85]

nessuno mi può aiutare??a trovare se ho qualche problema?
li si

[Houdini87]

li si

siceramente ho letto ma ho capito poco...dato che non sono molto esperto del campo...quindi volevo una mano da voi sul sapere se ho problemi e come risolverli..dato che non riesco a capire i significati dei log anche se ho letto la guida(non riesco a distinguare se sono beningi o maligni)

[juninho85]

non ci siamo capiti...devi postare li

[ste_95]

per l'analisi tramite sito, ho provatoa d aggiungere alcune cose che non vedeva, ma mica le aggiungeva! è normale?:mad:

[fabius00]

Questa è una pag web con uno script x analizzare un log di hijackthis

http://hijackthis.de/index.php?langselect=english

basta copiare il contenuto di hijackthis.log nel box in fondo e premere "analyze" dopodichè avrete una analisi del vostro log.

- Attenzione xò che questo sistema è ancora in fase di sviluppo, quindi non riconosce ancora tutti i prog.

Ciao.

il link nn funge più :(

il mio log è


Logfile of HijackThis v1.99.1
Scan saved at 14.22.06, on 30/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe
C:\Programmi\Eset\nod32krn.exe
C:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\File comuni\Ulead Systems\DVD\ULCDRSvr.exe
C:\Programmi\Canon\CAL\CALMAIN.exe
C:\Programmi\ATI Technologies\ATI.ACE\cli.exe
C:\Programmi\Java\jre1.6.0_03\bin\jusched.exe
C:\Programmi\Eset\nod32kui.exe
C:\Program Files\GlobespanVirata\Adsl\dslstat.exe
C:\Program Files\GlobespanVirata\Adsl\dslagent.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe
C:\Programmi\WIDCOMM\Software Bluetooth\BTTray.exe
C:\PROGRA~1\WIDCOMM\SOFTWA~1\BTSTAC~1.EXE
C:\Programmi\ATI Technologies\ATI.ACE\cli.exe
C:\Programmi\ATI Technologies\ATI.ACE\cli.exe
C:\Programmi\Windows Live\Messenger\usnsvc.exe
C:\Programmi\eMule\emule.exe
C:\Programmi\Last.fm\LastFMHelper.exe
C:\Programmi\Last.fm\LastFM.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Documents and Settings\fabio\Documenti\utility\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tim.it/consumer/homepage.do
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [ATICCC] "C:\Programmi\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\GlobespanVirata\Adsl\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\GlobespanVirata\Adsl\dslagent.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Programmi\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - Startup: Last.fm Helper.lnk = C:\Programmi\Last.fm\LastFMHelper.exe
O4 - Global Startup: BTTray.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O17 - HKLM\System\CCS\Services\Tcpip\..\{935E494C-562D-4F76-ADCB-E54E492BC25E}: NameServer = 193.70.152.15 193.70.152.25
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Programmi\File comuni\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FILECO~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Programmi\Canon\CAL\CALMAIN.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Programmi\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Unknown owner - C:\Programmi\Ahead\InCD\InCDsrv.exe (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmi\Eset\nod32krn.exe
O23 - Service: LiveShare P2P Server (RoxLiveShare) - Sonic Solutions - C:\Programmi\File comuni\Roxio Shared\SharedCOM8\RoxLiveShare.exe
O23 - Service: RoxUpnpRenderer (RoxUPnPRenderer) - Sonic Solutions - C:\Programmi\File comuni\Roxio Shared\SharedCom\RoxUpnpRenderer.exe
O23 - Service: Roxio Hard Drive Watcher (RoxWatch) - Unknown owner - C:\Programmi\File comuni\Roxio Shared\SharedCOM8\RoxWatch.exe (file missing)
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Programmi\File comuni\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: UPnPService - Magix AG - C:\Programmi\File comuni\MAGIX Shared\UPnPService\UPnPService.exe






cavolo mi si aprono delle pagine di firefox conn pubblicità!!!
ho usato adware ma nulla...

[lancetta]

il link nn funge più :(


sei nel posto sbagliato
se vuoi farti leggere il log da utenti esperti
http://www.hwupgrade.it/forum/showthread.php?t=937676

per l'analisi automatica
http://www.hijackthis.de/it

[nuovoUtente86]

In continuazione del post http://www.hwupgrade.it/forum/showthread.php?t=1707201 :
non ho il collegamento al desktop ne ho mai utilizzato l' installer in questione ma sempre e solo il .exe contenuto nell' archivio compresso scaricabile da sito.Come dicevo l' unica cosa che mi ritrovo è il programma installato nell' elenco Programmi e funzionalità(Gestione applicazioni in Windows XP).

[xcdegasp]

è normale, anche la 2.0.2 lo fa..

[Stefy_MHR]

Io non so come cancellare i file con il punto di domanda!:(

[ShoShen]

non devi cancellare necessariamente i file con il punto di domanda, stanno solo a significare che un dato programma, processo ecc non è conosciuto dall'analisi automatica
:)

[Stefy_MHR]

non devi cancellare necessariamente i file con il punto di domanda, stanno solo a significare che un dato programma, processo ecc non è conosciuto dall'analisi automatica
:)
a ok grassie... non si smette mai di imparare!:D

[ShoShen]

a ok grassie... non si smette mai di imparare!:D

di nulla :)

[crespo81]

Mi controllate questo?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16.24.08, on 08/07/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.EXE
D:\Programmi\Eset\nod32krn.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\Programmi\ASUS\NB Probe\SPM\spmgr.exe
D:\WINDOWS\system32\svchost.exe
D:\Programmi\Synaptics\SynTP\SynTPEnh.exe
D:\Programmi\Eset\nod32kui.exe
D:\Programmi\ASUS\ASUS Direct Console\LCMP.EXE
D:\WINDOWS\ATK0100\HControl.exe
D:\Programmi\ASUS\Power4 Gear\BatteryLife.exe
D:\Programmi\Wireless Console 2\wcourier.exe
D:\WINDOWS\RTHDCPL.EXE
D:\Programmi\ASUS\ASUS Splendid Video Enhancement Technology\ACMON.exe
D:\Programmi\Java\jre1.6.0_05\bin\jusched.exe
D:\WINDOWS\system32\RUNDLL32.EXE
D:\WINDOWS\system32\ctfmon.exe
D:\WINDOWS\system32\ACEngSvr.exe
D:\WINDOWS\ATK0100\ATKOSD.exe
D:\WINDOWS\system32\msiexec.exe
D:\Programmi\Mozilla Firefox\firefox.exe
D:\Programmi\Lavasoft\Ad-Aware\aawservice.exe
D:\Programmi\Lavasoft\Ad-Aware\Ad-Aware.exe
D:\Documents and Settings\Salvo\Desktop\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ircdown.com/it/index.php?rvs=hompag&d=79919297
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Programmi\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SynTPEnh] D:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [nod32kui] "D:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [DirectMessenger] "D:\Programmi\ASUS\ASUS Direct Console\LCMP.EXE"
O4 - HKLM\..\Run: [HControl] D:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [Power_Gear] D:\Programmi\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [Wireless Console 2] D:\Programmi\Wireless Console 2\wcourier.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ACMON] D:\Programmi\ASUS\ASUS Splendid Video Enhancement Technology\ACMON.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Programmi\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\RunOnce: [Cleanup] D:\cleanup.exe
O4 - HKLM\..\RunOnce: [SpybotSnD] "D:\Programmi\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programmi\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programmi\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{BF42416D-086F-43F6-B175-D648C0DDB134}: NameServer = 192.168.1.254
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - D:\Programmi\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Programmi\File comuni\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - D:\Programmi\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: spmgr - Unknown owner - D:\Programmi\ASUS\NB Probe\SPM\spmgr.exe

--
End of file - 6144 bytes

Grazie a tutti

[Chill-Out]

Ciao per il controllo del log di HJT devi postare qui http://www.hwupgrade.it/forum/showthread.php?t=937676 mi raccomando leggi le istruzioni in prima pagina su come allegare il log, ciao.

[xcdegasp]

tutorial di hijackthis:
http://hometown.aol.co.uk/jrmc137/hjttutorial/tutorial.htm

[Dom77]

tutorial di hijackthis:
http://hometown.aol.co.uk/jrmc137/hjttutorial/tutorial.htm

credo che sto link sia ormai inutile...

[xcdegasp]

Questa è una pag web con uno script x analizzare un log di hijackthis

http://hijackthis.de/index.php?langselect=english

basta copiare il contenuto di hijackthis.log nel box in fondo e premere "analyze" dopodichè avrete una analisi del vostro log.

- Attenzione xò che questo sistema è ancora in fase di sviluppo, quindi non riconosce ancora tutti i prog.


Mentre qui è disponibile un tutorial su HiJackThis:
http://www.bleepingcomputer.com/tutorials/tutorial42.html

Ciao.

Piccola nota informativa:
http://www.hwupgrade.it/forum/showpost.php?p=32012331&postcount=635

[Glhardware]

E ne esiste uno che ti analizza il file di Combofix?

[tigre652]

Buongiorno non essendo più troppo informato, qualcuno più esperto di me avrebbe voglia di dare un occhiata al mio log HJTHIS e dirmi se qualcosa di dannoso o inutile visto che noto rallentamenti nel PC, grazie.

Logfile of HiJackThis Fork (Beta) by Alex Dragokas v.2.10.0.6

Platform: x64 Windows 10 (Pro), 10.0.19042.928 (ReleaseId: 2009), Service Pack: 0
Time: 28.06.2021 - 18:20 (UTC+02:00)
Language: OS: Italian (0x410). Display: Italian (0x410). Non-Unicode: Italian (0x410)
Elevated: Yes
Ran by: 39340 (group: Administrator) on PC, FirstRun: yes

Chrome: 91.0.4472.114
Internet Explorer: 11.789.19041.0
Default: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --single-argument %1 (Google Chrome)

Boot mode: Normal

Running processes:
Number | Path
1 C:\Program Files (x86)\Avira\Antivirus\avgnt.exe
1 C:\Program Files (x86)\Avira\Antivirus\avguard.exe
1 C:\Program Files (x86)\Avira\Antivirus\avshadow.exe
1 C:\Program Files (x86)\Avira\Antivirus\protectedservice.exe
1 C:\Program Files (x86)\Avira\Antivirus\sched.exe
1 C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
1 C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
1 C:\Program Files (x86)\Avira\Optimizer Host\Avira.OptimizerHost.exe
1 C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.exe
1 C:\Program Files (x86)\Avira\SoftwareUpdater\Avira.SoftwareUpdater.ServiceHost.exe
1 C:\Program Files (x86)\Avira\VPN\Avira.VpnService.exe
1 C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
2 C:\Program Files (x86)\Google\Chrome Remote Desktop\92.0.4515.41\remoting_host.exe
20 C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
1 C:\Program Files (x86)\Google\Update\1.3.36.82\GoogleCrashHandler.exe
1 C:\Program Files (x86)\Google\Update\1.3.36.82\GoogleCrashHandler64.exe
1 C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
1 C:\Program Files (x86)\Universal Media Server\jre-x64\bin\javaw.exe
1 C:\Program Files\AMD\CNext\CNext\amdow.exe
1 C:\Program Files\AMD\CNext\CNext\AMDRSServ.exe
1 C:\Program Files\AMD\CNext\CNext\RadeonSoftware.exe
1 C:\Program Files\Bonjour\mDNSResponder.exe
1 C:\Program Files\CCleaner\CCleaner64.exe
1 C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
1 C:\Program Files\Macrium\Common\MacriumService.exe
1 C:\Program Files\Macrium\Common\ReflectMonitor.exe
1 C:\Program Files\Macrium\Common\ReflectUI.exe
1 C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
1 C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
1 C:\Program Files\Microsoft Mouse and Keyboard Center\MKCHelper.exe
1 C:\Program Files\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe
1 C:\Program Files\Samsung\USB Drivers\28_ssconn2\conn\ss_conn_service2.exe
1 C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.13426.20920.0_x64__8wekyb3d8bbwe\HxAccounts.exe
1 C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.13426.20920.0_x64__8wekyb3d8bbwe\HxOutlook.exe
1 C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.13426.20920.0_x64__8wekyb3d8bbwe\HxTsr.exe
1 C:\Program Files\WinRAR\WinRAR.exe
1 C:\ProgramData\Wondershare\Service\InstallAssistService.exe
1 C:\Users\39340\Desktop\hijackthis-devel\binary\HiJackThis.exe
1 C:\Windows\explorer.exe
1 C:\Windows\ImmersiveControlPanel\SystemSettings.exe
1 C:\Windows\System32\amdfendrsr.exe
1 C:\Windows\System32\ApplicationFrameHost.exe
1 C:\Windows\System32\audiodg.exe
1 C:\Windows\System32\AuthHost.exe
2 C:\Windows\System32\csrss.exe
1 C:\Windows\System32\ctfmon.exe
1 C:\Windows\System32\dasHost.exe
2 C:\Windows\System32\dllhost.exe
1 C:\Windows\System32\DriverStore\FileRepository\u0359160.inf_amd64_2abe2598d9a3141f\B358802\atieclxx.exe
1 C:\Windows\System32\DriverStore\FileRepository\u0359160.inf_amd64_2abe2598d9a3141f\B358802\atiesrxx.exe
1 C:\Windows\System32\dwm.exe
2 C:\Windows\System32\fontdrvhost.exe
1 C:\Windows\System32\lsass.exe
1 C:\Windows\System32\MoUsoCoreWorker.exe
1 C:\Windows\System32\PickerHost.exe
5 C:\Windows\System32\RuntimeBroker.exe
1 C:\Windows\System32\SearchFilterHost.exe
1 C:\Windows\System32\SearchIndexer.exe
2 C:\Windows\System32\SearchProtocolHost.exe
1 C:\Windows\System32\SecurityHealthService.exe
1 C:\Windows\System32\SecurityHealthSystray.exe
1 C:\Windows\System32\services.exe
1 C:\Windows\System32\SettingSyncHost.exe
1 C:\Windows\System32\SgrmBroker.exe
1 C:\Windows\System32\sihost.exe
1 C:\Windows\System32\smartscreen.exe
1 C:\Windows\System32\smss.exe
1 C:\Windows\System32\spoolsv.exe
78 C:\Windows\System32\svchost.exe
1 C:\Windows\System32\SystemSettingsBroker.exe
1 C:\Windows\System32\taskhostw.exe
1 C:\Windows\System32\wbem\WmiPrvSE.exe
1 C:\Windows\System32\wininit.exe
1 C:\Windows\System32\winlogon.exe
1 C:\Windows\System32\WirelessKB850NotificationService.exe
1 C:\Windows\System32\WUDFHost.exe
1 C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
1 C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
1 C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
1 C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
1 C:\Windows\SysWOW64\SearchProtocolHost.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: [ProxyOverride] = *.local
O4 - HKCU\..\Run: [CCleaner Smart Cleaning] = C:\Program Files\CCleaner\CCleaner64.exe /MONITOR
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] = C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe
O4 - HKLM\..\Run: [Reflect UI] = C:\Program Files\Macrium\Common\ReflectUI.exe
O4 - Startup Global: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Universal Media Server.lnk -> C:\Program Files (x86)\Universal Media Server\UMS.exe
O4-32 - HKLM\..\Run: [AdobeCS6ServiceManager] = C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe -launchedbylogin
O4-32 - HKLM\..\Run: [Avira SystrayStartTrigger] = C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe
O4-32 - HKLM\..\Run: [SwitchBoard] = C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O8 - Context menu item: HKCU\..\Internet Explorer\MenuExt\E&sporta in Microsoft Excel: (default) = C:\Program Files (x86)\Microsoft Office\Office10\EXCEL.EXE (file missing)
O17 - DHCP DNS 1: 192.168.178.1
O18 - HKLM\Software\Classes\Protocols\Handler\msdaipp\0x00000001: [CLSID] = {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll
O18 - HKLM\Software\Classes\Protocols\Handler\msdaipp\oledb: [CLSID] = {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll
O21 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive1: (no name) - {BBACC218-34EA-4666-9D7A-C78F2274A524} - (no file)
O21 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive2: (no name) - {5AB7172C-9C11-405C-8DD5-AF20F3606282} - (no file)
O21 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive3: (no name) - {A78ED123-AB77-406B-9962-2A5D9D2F7F30} - (no file)
O21 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive4: (no name) - {F241C880-6982-4CE5-8CF7-7085BA96DA5A} - (no file)
O21 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive5: (no name) - {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} - (no file)
O21 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive6: (no name) - {9AA2F32D-362A-42D9-9328-24A483E2CCC3} - (no file)
O21 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive7: (no name) - {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} - (no file)
O21 - HKLM\..\ShellIconOverlayIdentifiers\00asw: (no name) - {472083B0-C522-11CF-8763-00608CC02F24} - (no file)
O21-32 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive1: (no name) - {BBACC218-34EA-4666-9D7A-C78F2274A524} - (no file)
O21-32 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive2: (no name) - {5AB7172C-9C11-405C-8DD5-AF20F3606282} - (no file)
O21-32 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive3: (no name) - {A78ED123-AB77-406B-9962-2A5D9D2F7F30} - (no file)
O21-32 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive4: (no name) - {F241C880-6982-4CE5-8CF7-7085BA96DA5A} - (no file)
O21-32 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive5: (no name) - {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} - (no file)
O21-32 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive6: (no name) - {9AA2F32D-362A-42D9-9328-24A483E2CCC3} - (no file)
O21-32 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive7: (no name) - {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} - (no file)
O22 - BITS Job: (download) {73CCE7D7-759A-4A02-96B4-C5CDBAEA7DF0} - http://emupdate.avcdn.net/files/emupdate/pong.txt -> C:\Windows\TEMP\e242da0a-4640-47cc-8840-9c8884f2d7e4
O22 - BITS Job: Fix all (including legit)
O22 - Task (.job): (disabled) (Not scheduled) CreateExplorerShellUnelevatedTask.job - C:\Windows\explorer.exe
O22 - Task: (damaged) C:\WINDOWS\System32\Tasks\S-1-5-21-484543080-3762093799-3341681034-1001\EnterpriseMgmt\FAD95428-5B4D-4D90-A537-2681F85FC65E (empty)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{93C88D06-6C01-4122-B150-F7D567E8C318} - \SystemMaintanceTask (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{93C88D06-6C01-4122-B150-F7D567E8C318} (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Avira\System Speedup\Delayed Startup (empty)
O22 - Task: (disabled) (update) \Microsoft\Windows\UpdateOrchestrator\Reboot_AC - C:\WINDOWS\system32\MusNotification.exe /RunOnAC ReadyToReboot (Microsoft)
O22 - Task: (disabled) (update) \Microsoft\Windows\UpdateOrchestrator\Reboot_Battery - C:\WINDOWS\system32\MusNotification.exe /RunOnBattery ReadyToReboot (Microsoft)
O22 - Task: (disabled) \Microsoft\Windows\Management\Provisioning\Retry - C:\WINDOWS\system32\ProvTool.exe /turn 5 /source ProvRetryTask (Microsoft)
O22 - Task: (disabled) \Microsoft\Windows\Management\Provisioning\RunOnReboot - C:\WINDOWS\system32\ProvTool.exe /turn 5 /source ContinueSessionTask (Microsoft)
O22 - Task: (disabled) \Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work - C:\WINDOWS\system32\usoclient.exe StartMaintenanceWork (Microsoft)
O22 - Task: (disabled) \Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work - C:\WINDOWS\system32\usoclient.exe StartWork (Microsoft)
O22 - Task: (telemetry) \Microsoft\Office\OfficeTelemetryAgentFallBack2016 - C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe scan upload mininterval:2880 (Microsoft)
O22 - Task: (telemetry) \Microsoft\Office\OfficeTelemetryAgentLogOn2016 - C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe scan upload (Microsoft)
O22 - Task: (telemetry) \Microsoft\Windows\Application Experience\PcaPatchDbTask - C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\PcaSvc.dll,PcaPatchSdbTask (Microsoft)
O22 - Task: (update) \Microsoft\Windows\UpdateOrchestrator\USO_UxBroker - C:\WINDOWS\system32\MusNotification.exe (Microsoft)
O22 - Task: \Microsoft\Windows\EnterpriseMgmt\FAD95428-5B4D-4D90-A537-2681F85FC65E\OS Edition Upgrade event listener created by enrollment client - C:\WINDOWS\system32\deviceenroller.exe /s "FAD95428-5B4D-4D90-A537-2681F85FC65E" /c /OsEditionUpgradeAlert /SID "S-1-5-21-484543080-3762093799-3341681034-1001" (Microsoft)
O22 - Task: \Microsoft\Windows\EnterpriseMgmt\FAD95428-5B4D-4D90-A537-2681F85FC65E\Passport for Work alert created by enrollment client - C:\WINDOWS\system32\deviceenroller.exe /o "FAD95428-5B4D-4D90-A537-2681F85FC65E" /c /PFW (Microsoft)
O22 - Task: \Microsoft\Windows\EnterpriseMgmt\FAD95428-5B4D-4D90-A537-2681F85FC65E\Provisioning initiated session - C:\WINDOWS\system32\deviceenroller.exe /c /ProvInitiatedSession /o "FAD95428-5B4D-4D90-A537-2681F85FC65E" (Microsoft)
O22 - Task: \Microsoft\Windows\EnterpriseMgmt\FAD95428-5B4D-4D90-A537-2681F85FC65E\PushLaunch - C:\WINDOWS\system32\deviceenroller.exe /o "FAD95428-5B4D-4D90-A537-2681F85FC65E" /c /z (Microsoft)
O22 - Task: \Microsoft\Windows\EnterpriseMgmt\FAD95428-5B4D-4D90-A537-2681F85FC65E\PushRenewal - C:\WINDOWS\system32\deviceenroller.exe /o "FAD95428-5B4D-4D90-A537-2681F85FC65E" /c /y (Microsoft)
O22 - Task: \Microsoft\Windows\EnterpriseMgmt\FAD95428-5B4D-4D90-A537-2681F85FC65E\PushUpgrade - C:\WINDOWS\system32\deviceenroller.exe /o "FAD95428-5B4D-4D90-A537-2681F85FC65E" /c /PushUpgrade (Microsoft)
O22 - Task: \Microsoft\Windows\EnterpriseMgmt\FAD95428-5B4D-4D90-A537-2681F85FC65E\Schedule #1 created by enrollment client - C:\WINDOWS\system32\deviceenroller.exe /o "FAD95428-5B4D-4D90-A537-2681F85FC65E" /c (Microsoft)
O22 - Task: \Microsoft\Windows\EnterpriseMgmt\FAD95428-5B4D-4D90-A537-2681F85FC65E\Schedule #2 created by enrollment client - C:\WINDOWS\system32\deviceenroller.exe /o "FAD95428-5B4D-4D90-A537-2681F85FC65E" /c (Microsoft)
O22 - Task: \Microsoft\Windows\EnterpriseMgmt\FAD95428-5B4D-4D90-A537-2681F85FC65E\Schedule #3 created by enrollment client - C:\WINDOWS\system32\deviceenroller.exe /o "FAD95428-5B4D-4D90-A537-2681F85FC65E" /c /b (Microsoft)
O22 - Task: \Microsoft\Windows\EnterpriseMgmt\FAD95428-5B4D-4D90-A537-2681F85FC65E\Schedule created by enrollment client for renewal of certificate warning - C:\WINDOWS\system32\deviceenroller.exe /c /r /d FAD95428-5B4D-4D90-A537-2681F85FC65E (Microsoft)
O22 - Task: \Microsoft\Windows\EnterpriseMgmt\FAD95428-5B4D-4D90-A537-2681F85FC65E\Schedule to run OMADMClient by client - C:\WINDOWS\system32\omadmclient.exe /serverid "FAD95428-5B4D-4D90-A537-2681F85FC65E" /lookuptype 1 /initiator 0 (Microsoft)
O22 - Task: \Microsoft\Windows\EnterpriseMgmt\FAD95428-5B4D-4D90-A537-2681F85FC65E\Schedule to run OMADMClient by server - C:\WINDOWS\system32\omadmclient.exe /serverid "FAD95428-5B4D-4D90-A537-2681F85FC65E" /lookuptype 1 /initiator 1 (Microsoft)
O22 - Task: \Microsoft\Windows\EnterpriseMgmt\FAD95428-5B4D-4D90-A537-2681F85FC65E\Win10 S Mode event listener created by enrollment client - C:\WINDOWS\system32\deviceenroller.exe /s "FAD95428-5B4D-4D90-A537-2681F85FC65E" /c /Win10SModeAlert /SID "S-1-5-21-484543080-3762093799-3341681034-1001" (Microsoft)
O22 - Task: Adobe Acrobat Update Task - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
O22 - Task: AMDInstallLauncher - C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe /InstallAUEP
O22 - Task: AMDLinkUpdate - C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe -AMDLinkUpdate
O22 - Task: ASC_PerformanceMonitor - C:\Program Files (x86)\IObit\Advanced SystemCare\Monitor.exe /Task (file missing)
O22 - Task: ASC_SkipUac_39340 - C:\Program Files (x86)\IObit\Advanced SystemCare\ASC.exe /SkipUac (file missing)
O22 - Task: Avira_Antivirus_Systray - C:\Program Files (x86)\Avira\Antivirus\avgnt.exe /min
O22 - Task: Avira_Security_Service_SCM_Watchdog - C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe HandleServiceControlManagerEvent 7000
O22 - Task: Avira_Security_Update - C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Common.Updater.exe /CheckAndInstall
O22 - Task: AviraSystemSpeedupUpdate - C:\ProgramData\Avira\SystemSpeedup\Update\avira_speedup_setup_update.exe /VERIFY /VERYSILENT /NOSTART /NODOTNET /NORESTART
O22 - Task: CCleaner Update - C:\Program Files\CCleaner\CCUpdate.exe
O22 - Task: CCleanerSkipUAC - C:\Program Files\CCleaner\CCleaner.exe $(Arg0)
O22 - Task: GoogleUpdateTaskMachineCore - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
O22 - Task: GoogleUpdateTaskMachineUA - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
O22 - Task: HWiNFO - C:\Users\39340\Desktop\HWINFO\HWiNFO64.exe
O22 - Task: Microsoft_Hardware_Launch_ipoint_exe - C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
O22 - Task: Microsoft_Hardware_Launch_itype_exe - C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
O22 - Task: Microsoft_Hardware_Launch_mousekeyboardcenter_exe - C:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe
O22 - Task: Microsoft_MKC_Logon_Task_ceip.exe - C:\Program Files\Microsoft Mouse and Keyboard Center\ceip.exe
O22 - Task: Microsoft_MKC_Logon_Task_ipoint.exe - C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
O22 - Task: Microsoft_MKC_Logon_Task_itype.exe - C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
O22 - Task: ModifyLinkUpdate - C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe -UpdateCurrentUser
O22 - Task: OneDrive Standalone Update Task-S-1-5-21-484543080-3762093799-3341681034-1018 - C:\Users\39340\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe (file missing)
O22 - Task: StartCN - C:\Program Files\AMD\CNext\CNext\cncmd.exe startwithdelay
O22 - Task: StartDVR - C:\Program Files\AMD\CNext\CNext\RSServCmd.exe
O23 - Service R2: Servizio Bonjour - (Bonjour Service) - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service R2: Adobe Acrobat Update Service - (AdobeARMservice) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service R2: AMD Crash Defender Service - C:\WINDOWS\system32\amdfendrsr.exe
O23 - Service R2: AMD External Events Utility - C:\WINDOWS\System32\DriverStore\FileRepository\u0359160.inf_amd64_2abe2598d9a3141f\B358802\atiesrxx.exe
O23 - Service R2: Avira Optimizer Host - (AviraOptimizerHost) - C:\Program Files (x86)\Avira\Optimizer Host\Avira.OptimizerHost.exe
O23 - Service R2: Avira Phantom VPN - (AviraPhantomVPN) - C:\Program Files (x86)\Avira\VPN\Avira.VpnService.exe
O23 - Service R2: Avira Pianificatore - (AntiVirSchedulerService) - C:\Program Files (x86)\Avira\Antivirus\sched.exe
O23 - Service R2: Avira Protezione in tempo reale - (AntiVirService) - C:\Program Files (x86)\Avira\Antivirus\avguard.exe
O23 - Service R2: Avira Security - (AviraSecurity) - C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.exe
O23 - Service R2: Avira Service Host - (Avira.ServiceHost) - C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
O23 - Service R2: Avira Servizio protetto - (AntivirProtectedService) - C:\Program Files (x86)\Avira\Antivirus\ProtectedService.exe
O23 - Service R2: Avira Updater Service - (AviraUpdaterService) - C:\Program Files (x86)\Avira\SoftwareUpdater\Avira.SoftwareUpdater.ServiceHost.exe
O23 - Service R2: Macrium Service - (MacriumService) - C:\Program Files\Macrium\Common\MacriumService.exe
O23 - Service R2: SAMSUNG Mobile Connectivity Service - (ss_conn_service) - C:\Program Files\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe
O23 - Service R2: SAMSUNG Mobile Connectivity Service V2 - (ss_conn_service2) - C:\Program Files\Samsung\USB Drivers\28_ssconn2\conn\ss_conn_service2.exe
O23 - Service R2: Servizio Chrome Remote Desktop - (chromoting) - C:\Program Files (x86)\Google\Chrome Remote Desktop\92.0.4515.41\remoting_host.exe --type=daemon --host-config="C:\ProgramData\Google\Chrome Remote Desktop\host.json"
O23 - Service R2: Wireless Keyboard 850 Notification Service - (WirelessKB850NotificationService) - C:\WINDOWS\system32\WirelessKB850NotificationService.exe
O23 - Service R2: Wondershare Install Assist Service - (Wondershare InstallAssist) - C:\ProgramData\Wondershare\Service\InstallAssistService.exe
O23 - Service S2: Avira Protezione email - (AntiVirMailService) - C:\Program Files (x86)\Avira\Antivirus\avmailc7.exe
O23 - Service S2: Avira Protezione web - (AntiVirWebService) - C:\Program Files (x86)\Avira\Antivirus\avwebg7.exe
O23 - Service S2: Servizio Google Update (gupdate) - (gupdate) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /svc
O23 - Service S3: Google Chrome Elevation Service - (GoogleChromeElevationService) - C:\Program Files (x86)\Google\Chrome\Application\91.0.4472.114\elevation_service.exe
O23 - Service S3: InstallDriver Table Manager - (IDriverT) - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service S3: Rockstar Game Library Service - (Rockstar Service) - G:\GTAV\Launcher\RockstarService.exe (file missing)
O23 - Service S3: Servizio Google Update (gupdatem) - (gupdatem) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /medsvc
O23 - Service S3: Steam Client Service - C:\Program Files (x86)\Common Files\Steam\SteamService.exe /RunAsService
O23 - Service S3: SwitchBoard - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe



Warning: New Root certificate is detected! Report to developer, please:
Windows Registry Editor Version 5.00\n\n[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12ECCCE41034DB56EC978443531DB185327E70F5]\n"Blob"=hex:5c,00,00,00,01,00,00,00,04,00,00,00,00,10,00,00,19,00,00,00,01,00,\\n 00,00,10,00,00,00,5b,43,42,a0,39,a7,b2,38,e4,4e,6a,5a,0b,1d,d1,f7,0f,00,00,\\n 00,01,00,00,00,20,00,00,00,6a,ab,6c,c6,2e,d9,64,38,f2,e4,ce,b9,6a,9d,e4,88,\\n e9,d6,06,1c,0d,11,25,00,18,ce,bc,c5,44,07,e8,23,03,00,00,00,01,00,00,00,14,\\n 00,00,00,12,ec,cc,e4,10,34,db,56,ec,97,84,43,53,1d,b1,85,32,7e,70,f5,14,00,\\n 00,00,01,00,00,00,14,00,00,00,22,cb,8b,27,89,5e,1e,3f,c7,fb,cd,aa,be,de,28,\\n 03,4c,b2,ed,93,04,00,00,00,01,00,00,00,10,00,00,00,cd,30,86,d9,ba,5f,dc,79,\\n 21,e4,a1,1d,00,28,5a,5d,20,00,00,00,01,00,00,00,6d,05,00,00,30,82,05,69,30,\\n 82,03,51,a0,03,02,01,02,02,10,56,eb,08,88,34,c4,70,a7,4b,d0,7e,a1,f2,03,72,\\n 66,30,0d,06,09,2a,86,48,86,f7,0d,01,01,0b,05,00,30,38,31,36,30,34,06,03,55,\\n 04,03,13,2d,4d,69,63,72,6f,73,6f,66,74,20,49,6e,74,75,6e,65,20,52,6f,6f,74,\\n 20,43,65,72,74,69,66,69,63,61,74,69,6f,6e,20,41,75,74,68,6f,72,69,74,79,30,\\n 1e,17,0d,31,37,30,37,31,32,30,30,30,30,30,30,5a,17,0d,32,32,30,37,31,32,30,\\n 30,30,30,30,30,5a,30,38,31,36,30,34,06,03,55,04,03,13,2d,4d,69,63,72,6f,73,\\n 6f,66,74,20,49,6e,74,75,6e,65,20,52,6f,6f,74,20,43,65,72,74,69,66,69,63,61,\\n 74,69,6f,6e,20,41,75,74,68,6f,72,69,74,79,30,82,02,22,30,0d,06,09,2a,86,48,\\n 86,f7,0d,01,01,01,05,00,03,82,02,0f,00,30,82,02,0a,02,82,02,01,00,d1,37,8a,\\n 3e,8f,9d,f9,ea,c8,0b,4b,91,16,ce,cb,3e,ce,42,d4,40,28,4b,19,99,c1,f4,2d,ea,\\n e8,34,e8,f4,bb,9a,e8,60,67,f5,bc,c0,53,ae,95,d0,dc,9c,aa,b4,1c,35,e3,74,98,\\n 87,f4,09,31,17,19,b8,54,d6,db,e3,ed,a4,92,0d,fd,8d,6e,bf,3e,93,05,e7,84,51,\\n 2f,71,66,75,33,d7,db,50,1b,57,51,a8,a3,05,88,7c,cc,0b,db,21,30,9c,39,96,74,\\n 08,03,e5,5c,66,75,e3,8e,89,4a,5a,12,3a,f8,6b,2f,3a,a2,48,48,11,5b,bb,4f,08,\\n 40,de,69,3e,75,1c,92,2e,49,cc,d5,d1,cd,b1,5d,a4,5c,73,6f,99,2a,3e,bc,e7,e0,\\n 91,35,29,56,e9,d3,28,55,e7,ea,cd,54,8d,e3,1e,1d,ec,5c,16,c3,b4,ca,91,47,74,\\n a9,8c,34,b0,53,f2,a6,76,f2,a0,6b,38,c1,88,ca,08,51,f7,48,81,38,61,b0,25,f5,\\n 3d,65,16,a9,53,04,ee,30,f6,66,40,6b,29,d7,bd,30,1b,ec,f9,10,32,65,96,39,c9,\\n 58,ad,b5,f6,fe,8c,8d,c7,20,ad,7c,4d,34,07,6c,6c,ef,f1,0f,b4,fc,de,7c,71,4a,\\n 96,f3,72,f4,55,71,94,35,04,62,c0,f5,63,37,be,cc,d0,d7,90,13,fb,13,33,b1,ee,\\n 19,92,e5,bc,0d,2c,9d,31,85,bb,83,84,cd,99,63,fc,1c,55,e5,e5,71,dc,5e,2e,19,\\n ec,06,5c,1e,ce,2e,e0,6a,82,a7,55,d4,35,7d,30,db,88,5f,d3,db,d7,7e,a0,77,1e,\\n 72,d8,b8,85,36,8e,c2,f6,68,5c,0e,a5,c2,15,c1,13,54,b3,db,14,bc,31,d9,fd,d1,\\n 97,a4,fe,fe,ae,6e,02,94,ba,f6,02,e9,30,e9,70,20,be,d0,b8,6a,32,c4,a8,69,41,\\n bf,66,ab,5e,0b,78,d8,66,7d,5a,87,e2,8e,13,df,4d,7f,8c,e0,80,ef,38,b3,4d,f1,\\n 4f,6a,56,6b,51,c0,e3,09,76,bb,33,bf,f5,1b,75,3e,1a,b6,ac,14,26,97,e5,f8,ff,\\n f0,bb,af,9d,c0,18,11,93,fe,a7,e6,44,b1,a6,41,5c,a5,d4,2c,85,8f,89,f2,b8,ea,\\n b7,86,68,58,33,9c,65,b0,d2,80,af,ef,ed,ea,81,c6,32,ac,42,4b,bf,e8,20,bf,f5,\\n ce,c6,97,98,97,21,17,72,00,c0,e4,77,eb,f5,2a,b5,7a,24,87,59,8f,32,f4,22,19,\\n 60,ff,2a,2d,87,5e,ca,9c,71,02,03,01,00,01,a3,6f,30,6d,30,1d,06,03,55,1d,0e,\\n 04,16,04,14,22,cb,8b,27,89,5e,1e,3f,c7,fb,cd,aa,be,de,28,03,4c,b2,ed,93,30,\\n 0e,06,03,55,1d,0f,01,01,ff,04,04,03,02,01,86,30,12,06,03,55,1d,13,01,01,ff,\\n 04,08,30,06,01,01,ff,02,01,01,30,16,06,03,55,1d,25,01,01,ff,04,0c,30,0a,06,\\n 08,2b,06,01,05,05,07,03,02,30,10,06,09,2b,06,01,04,01,82,37,15,01,04,03,02,\\n 01,00,30,0d,06,09,2a,86,48,86,f7,0d,01,01,0b,05,00,03,82,02,01,00,90,76,8b,\\n 4e,60,a4,78,2e,25,4d,37,80,88,6e,8d,ce,7f,7c,c6,c9,ba,d5,61,0e,2b,07,10,23,\\n 91,b5,73,35,f5,53,29,e8,cb,6d,24,57,ca,1a,e6,d1,fa,df,45,86,1b,b1,c7,75,41,\\n f9,ad,da,98,73,fc,b7,8f,3e,fa,1d,2e,49,66,8b,65,67,08,7c,f5,44,01,6f,a8,4c,\\n f8,df,ad,48,51,4c,08,f8,c6,1e,6a,db,67,08,d7,78,c5,78,56,47,09,57,bb,18,92,\\n f3,91,d5,6d,d6,fb,2c,61,0f,d4,5b,8b,f9,22,3b,dc,a3,54,35,a6,f7,1c,80,1c,76,\\n e0,dc,cc,de,1e,2f,30,55,aa,3e,d1,bb,28,57,f9,c6,41,21,b5,b5,aa,a4,3a,f8,45,\\n ac,72,06,7a,f0,a6,78,37,93,05,cd,06,40,bb,8b,36,89,48,fd,5c,1b,5c,1c,a6,45,\\n 46,e8,68,3f,e5,c6,35,2a,ba,cc,f9,f6,2e,ec,05,08,41,ad,a1,80,ca,9d,97,a9,cf,\\n e4,f0,45,5a,ca,ff,a0,5b,48,24,40,8d,cd,81,68,ed,c7,9b,93,82,d9,b6,43,5a,47,\\n 2f,ee,c5,83,1a,5d,33,f9,da,07,87,fd,06,56,e9,6e,77,ee,2f,65,1c,d2,39,c5,ac,\\n ea,49,8f,b2,1b,f1,c0,0b,5f,55,23,0f,f7,dc,c6,88,e5,8e,38,e8,21,07,67,af,f6,\\n 0b,e5,57,03,d1,0d,af,e9,fe,2e,b9,5b,e1,db,da,6c,9f,44,52,68,25,5b,63,ea,cf,\\n ab,ad,53,e5,24,e4,a1,a8,4f,b5,e7,bb,bc,a9,4c,fa,20,76,20,ac,52,ab,7b,b0,f5,\\n e2,fb,f4,81,de,18,18,68,84,05,81,21,24,7b,0b,0b,1d,7a,41,92,40,68,b8,2b,00,\\n 8a,44,30,68,f7,e0,59,ec,09,b5,be,dc,fd,37,a3,7b,fd,ab,3a,e6,f4,5c,11,a9,ca,\\n 69,43,95,8b,25,47,ed,9a,c2,58,82,d8,56,f4,c1,a1,ac,5b,10,64,58,da,32,d7,a6,\\n 26,00,10,e5,f5,16,31,f1,b3,22,74,b5,eb,ea,04,f4,38,31,59,ca,8e,ed,29,5f,a0,\\n 56,2a,8c,d6,f6,ba,ec,f4,06,76,99,cb,f1,e1,97,7f,d9,81,33,51,c0,de,42,ca,09,\\n e4,c5,d8,d7,03,17,ef,fb,64,66,d9,c2,6c,96,a5,c6,e4,38,c4,bf,18,7b,b6,60,7b,\\n 8f,c9,e7,28,8b,04,42,5c,bb,59,53,18,16,31,4e,31,4b,82,41,4b,b7,62,df,fa,2c,\\n 3c,07,41,c3,f2,e4,99,da,49\n\n\n\n

--
End of file - Time spent: 18,8 sec. - 52186 bytes, CRC32: FFFFFFFF. Sign: 蒿