Olimpo Informatico

[kikko1980]

[Smjert]

Per vedere se sei a posto prova a fare un log di HijackThis!

[kikko1980]

[Smjert]

No il firewall tienilo, disattiva l'antivirus..

prova poi a fare una scansione con questo tool:

Scarica GMER (camuffato) da http://www.mytempdir.com/1042828

Avvia GMER e fai due scansioni (tasto Scan) una dal tab rootkit e l´altra dal tab autostart. Copiale tutte e due premendo il tasto Copy nei rispettivi tab e incollali in un file di testo che salverai.

Posta il contenuto di quel file di testo.

[kikko1980]

[kikko1980]

l'unica cosa che ho trovato è un file che si chiama AKDeInstall in c/windows....sarà lui?

[Smjert]

No è legittimo.

[kikko1980]

fatto.eccolo:

Logfile of RunAlyzer 0.3. Copyright © 2000-2005 Safer Networking Limited. Tutti i diritti sono riservati.
Scan saved at 06/11/2006 20.59.18
Platform: Windows XP (Build: 2600) Service Pack 1 (5.1.2600)

Running processes:
[System]
System
C:\WINDOWS\system32\Ati2evxx.exe
c:\windows\symantecspeed.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\Programmi\iTunes\iTunesHelper.exe
C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\crypserv.exe
C:\Programmi\ewido anti-spyware 4.0\guard.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmi\Eset\nod32krn.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Programmi\Belkin\Software Bluetooth\BTTray.exe
C:\Programmi\Safer Networking\RunAlyzer\RunAlyzer.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\uwdf.exe
C:\WINDOWS\system32\uwdf.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Programmi\Internet Explorer\iexplore.exe

F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe,"c:\windows\lanscr.exe","c:\windows\sonynet.exe","c:\windows\symantecspeed.exe",
O20 - Winlogon Notify: AtiExtEvent = Ati2evxx.dll
O20 - Winlogon Notify: Schedule = wlnotify.dll
O4 - Global Startup: BTTray.lnk = C:\Programmi\Belkin\Software Bluetooth\BTTray.exe
O4 - HKLM\..\Run: [QuickTime Task] C:\Programmi\QuickTime\qttask.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [TkBellExe] C:\Programmi\File comuni\Real\Update_OB\realsched.exe
O4 - HKLM\..\Run: [AdslTaskBar] C:\WINDOWS\system32\stmctrl.dll
O4 - HKLM\..\Run: [iTunesHelper] C:\Programmi\iTunes\iTunesHelper.exe
O23 - Service: Driver ACPI Microsoft (ACPI) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\ACPI.sys
O23 - Service: Eliminatore di eco acustico del kernel Microsoft (aec) - /owner unsupported/ - C:\WINDOWS\system32\drivers\aec.sys
O23 - Service: Ambiente supporto di rete AFD (AFD) - /owner unsupported/ - C:\WINDOWS\System32\drivers\afd.sys
O23 - Service: Service for Realtek AC97 Audio (WDM) (ALCXWDM) - /owner unsupported/ - C:\WINDOWS\system32\drivers\ALCXWDM.SYS
O23 - Service: Avvisi (Alerter) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Servizio Gateway di livello applicazione (ALG) - /owner unsupported/ - C:\WINDOWS\System32\alg.exe
O23 - Service: Driver del processore AMD K7 (AmdK7) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\amdk7.sys
O23 - Service: AMON (AMON) - /owner unsupported/ - C:\WINDOWS\System32\drivers\amon.sys
O23 - Service: Gestione applicazione (AppMgmt) - /owner unsupported/ - C:\WINDOWS\system32\svchost.exe
O23 - Service: Protocollo client ARP 1394 (Arp1394) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\arp1394.sys
O23 - Service: ASP.NET State Service (aspnet_state) - /owner unsupported/ - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
O23 - Service: Driver per supporti asincroni RAS (AsyncMac) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\asyncmac.sys
O23 - Service: Controller disco rigido IDE/ESDI standard (atapi) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\atapi.sys
O23 - Service: Protocollo client ARP ATM (Atmarpc) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\atmarpc.sys
O23 - Service: NEC 313 Command Port Driver (atusba) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\atusba.sys
O23 - Service: NEC 313 CONTROL Driver (atusbc) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\atusbc.sys
O23 - Service: NEC 313 ENUMERATION Driver (atusbe) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\atusbe.sys
O23 - Service: NEC 313 OBEX Port Driver (atusbo) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\atusbo.sys
O23 - Service: Audio Windows (AudioSrv) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Driver stub audio (audstub) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\audstub.sys
O23 - Service: Servizio trasferimento intelligente in background (BITS) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Browser di computer (Browser) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Bluetooth Audio (BtAudio) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\btaudio.sys
O23 - Service: Bluetooth Virtual Communications Driver (BTDriver) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\btport.sys
O23 - Service: Bluetooth Protocol Stack (BTKRNL) - /owner unsupported/ - C:\WINDOWS\System32\drivers\btkrnl.sys
O23 - Service: Bluetooth Serial Driver (BTSERIAL) - /owner unsupported/ - C:\WINDOWS\System32\drivers\btserial.sys
O23 - Service: Bluetooth Port Client Driver (BTSLBCSP) - /owner unsupported/ - C:\WINDOWS\System32\drivers\btslbcsp.sys
O23 - Service: Bluetooth LAN Access Server (BTWDNDIS) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\btwdndis.sys
O23 - Service: WIDCOMM USB Bluetooth Driver (BTWUSB) - /owner unsupported/ - C:\WINDOWS\System32\Drivers\btwusb.sys
O23 - Service: Decoder sottotitoli codificati (CCDECODE) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\CCDECODE.sys
O23 - Service: Driver del CD-ROM (Cdrom) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\cdrom.sys
O23 - Service: Servizio di indicizzazione (CiSvc) - /owner unsupported/ - C:\WINDOWS\system32\cisvc.exe
O23 - Service: ClipBook (ClipSrv) - /owner unsupported/ - C:\WINDOWS\system32\clipsrv.exe
O23 - Service: .NET Runtime Optimization Service v2.0.50727_X86 (clr_optimization_v2.0.50727_32) - /owner unsupported/ - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
O23 - Service: Applicazione di sistema COM+ (COMSysApp) - /owner unsupported/ - C:\WINDOWS\System32\dllhost.exe
O23 - Service: Crypkey License (Crypkey License) - /owner unsupported/ - C:\WINDOWS\system32\crypserv.exe
O23 - Service: Servizi di crittografia (CryptSvc) - /owner unsupported/ - C:\WINDOWS\system32\svchost.exe
O23 - Service: Client DHCP (Dhcp) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Driver del disco (Disk) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\disk.sys
O23 - Service: Servizio amministrativo di Gestione disco logico (dmadmin) - /owner unsupported/ - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Gestione dischi logici (dmserver) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Sintetizzatore DLS Microsoft Kernel (DMusic) - /owner unsupported/ - C:\WINDOWS\system32\drivers\DMusic.sys
O23 - Service: Client DNS (Dnscache) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Decodificatore audio DRM del kernel Microsoft (drmkaud) - /owner unsupported/ - C:\WINDOWS\system32\drivers\drmkaud.sys
O23 - Service: Servizio di segnalazione errori (ERSvc) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Registro eventi (Eventlog) - /owner unsupported/ - C:\WINDOWS\system32\services.exe
O23 - Service: Sistema di eventi COM+ (EventSystem) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: ewido anti-spyware 4.0 driver (ewido anti-spyware 4.0 driver) - /owner unsupported/ - C:\Programmi\ewido anti-spyware 4.0\guard.sys
O23 - Service: ewido anti-spyware 4.0 guard (ewido anti-spyware 4.0 guard) - /owner unsupported/ - C:\Programmi\ewido anti-spyware 4.0\guard.exe
O23 - Service: Compatibilità di Cambio rapido utente (FastUserSwitchingCompatibility) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Driver controller disco floppy (Fdc) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\fdc.sys
O23 - Service: Driver NT scheda Fast Ethernet VIA PCI 10/100Mb (FETNDIS) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\fetnd5.sys
O23 - Service: Driver disco floppy (Flpydisk) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\flpydisk.sys
O23 - Service: Driver archiviazione volumi (Ftdisk) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\ftdisk.sys
O23 - Service: GEARAspiWDM (GEARAspiWDM) - /owner unsupported/ - System32\Drivers\GEARAspiWDM.sys
O23 - Service: Utilità di classificazione pacchetti generica (Gpc) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\msgpc.sys
O23 - Service: Guida in linea e supporto tecnico (helpsvc) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Accesso periferica Human Interface (HidServ) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Driver di classe HID Microsoft (HidUsb) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\hidusb.sys
O23 - Service: Driver di porta mouse PS/2 e tastiera i8042 (i8042prt) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\i8042prt.sys
O23 - Service: InstallDriver Table Manager (IDriverT) - /owner unsupported/ - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Driver filtro masterizzazione CD (Imapi) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\imapi.sys
O23 - Service: Servizio COM di masterizzazione CD IMAPI (ImapiService) - /owner unsupported/ - C:\WINDOWS\System32\imapi.exe
O23 - Service: Driver filtro traffico IP (IpFilterDriver) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\ipfltdrv.sys
O23 - Service: Driver tunnel IP in IP (IpInIp) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\ipinip.sys
O23 - Service: Traduttore indirizzi di rete IP (IpNat) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\ipnat.sys
O23 - Service: iPodService (iPodService) - /owner unsupported/ - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: Driver IPSEC (IPSec) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\ipsec.sys
O23 - Service: Servizio enumeratore infrarossi (IRENUM) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\irenum.sys
O23 - Service: Driver bus PnP ISA/EISA (isapnp) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\isapnp.sys
O23 - Service: Driver classe tastiera (Kbdclass) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\kbdclass.sys
O23 - Service: Mixer wave audio del kernel Microsoft (kmixer) - /owner unsupported/ - C:\WINDOWS\system32\drivers\kmixer.sys
O23 - Service: Server (lanmanserver) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Workstation (lanmanworkstation) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Helper NetBIOS di TCP/IP (LmHosts) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Machine Debug Manager (MDM) - /owner unsupported/ - C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
O23 - Service: Messenger (Messenger) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Condivisione desktop remoto di NetMeeting (mnmsrvc) - /owner unsupported/ - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: Mantenimento DataBase (mntdbb) - /owner unsupported/ - C:\WINDOWS\Downlo~1\7r1vi\qab3h.exe
O23 - Service: Driver classe mouse (Mouclass) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\mouclass.sys
O23 - Service: Driver di mouse HID (mouhid) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\mouhid.sys
O23 - Service: Redirector del client WebDav (MRxDAV) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\mrxdav.sys
O23 - Service: MRXSMB (MRxSmb) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\mrxsmb.sys
O23 - Service: Distributed Transaction Coordinator (MSDTC) - /owner unsupported/ - C:\WINDOWS\System32\msdtc.exe
O23 - Service: Windows Installer (MSIServer) - /owner unsupported/ - C:\WINDOWS\System32\msiexec.exe
O23 - Service: Proxy di servizio di flusso Microsoft (MSKSSRV) - /owner unsupported/ - C:\WINDOWS\system32\drivers\MSKSSRV.sys
O23 - Service: Proxy clock di flusso Microsoft (MSPCLOCK) - /owner unsupported/ - C:\WINDOWS\system32\drivers\MSPCLOCK.sys
O23 - Service: Proxy di gestione qualità di flusso Microsoft (MSPQM) - /owner unsupported/ - C:\WINDOWS\system32\drivers\MSPQM.sys
O23 - Service: Convertitore a T/Sito a sito per flusso Microsoft (MSTEE) - /owner unsupported/ - C:\WINDOWS\system32\drivers\MSTEE.sys
O23 - Service: Mup (Mup) - /owner unsupported/ -
O23 - Service: NABTS/FEC VBI Codec (NABTSFEC) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\NABTSFEC.sys
O23 - Service: Driver di sistema NDIS (NDIS) - /owner unsupported/ -
O23 - Service: Connesione TV/Video Microsoft (NdisIP) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\NdisIP.sys
O23 - Service: Driver TAPI NDIS di accesso remoto (NdisTapi) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\ndistapi.sys
O23 - Service: Protocollo I/O modalità utente su NDIS (Ndisuio) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\ndisuio.sys
O23 - Service: Driver WAN NDIS di accesso remoto (NdisWan) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\ndiswan.sys
O23 - Service: Interfaccia NetBIOS (NetBIOS) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\netbios.sys
O23 - Service: NetBT (NetBT) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\netbt.sys
O23 - Service: DDE di rete (NetDDE) - /owner unsupported/ - C:\WINDOWS\system32\netdde.exe
O23 - Service: DDE DSDM di rete (NetDDEdsdm) - /owner unsupported/ - C:\WINDOWS\system32\netdde.exe
O23 - Service: Accesso rete (Netlogon) - /owner unsupported/ - C:\WINDOWS\System32\lsass.exe
O23 - Service: Connessioni di rete (Netman) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: NetworkX (NetworkX) - /owner unsupported/ - C:\WINDOWS\system32\ckldrv.sys
O23 - Service: 1394 Net Driver (NIC1394) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\nic1394.sys
O23 - Service: NLA (Network Location Awareness) (Nla) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - /owner unsupported/ - C:\Programmi\Eset\nod32krn.exe
O23 - Service: Provider supporto protezione LM NT (NtLmSsp) - /owner unsupported/ - C:\WINDOWS\System32\lsass.exe
O23 - Service: Archivi rimovibili (NtmsSvc) - /owner unsupported/ - C:\WINDOWS\system32\svchost.exe
O23 - Service: Driver filtro traffico IPX (NwlnkFlt) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\nwlnkflt.sys
O23 - Service: Driver inoltratore traffico IPX (NwlnkFwd) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\nwlnkfwd.sys
O23 - Service: Host controller VIA OHCI compatibile IEEE 1394 (ohci1394) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\ohci1394.sys
O23 - Service: Office Source Engine (ose) - /owner unsupported/ - C:\Programmi\File comuni\Microsoft Shared\Source Engine\OSE.EXE
O23 - Service: Driver della porta parallela (Parport) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\parport.sys
O23 - Service: Driver bus PCI (PCI) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\pci.sys
O23 - Service: Plug and Play (PlugPlay) - /owner unsupported/ - C:\WINDOWS\system32\services.exe
O23 - Service: Servizi IPSEC (PolicyAgent) - /owner unsupported/ - C:\WINDOWS\System32\lsass.exe
O23 - Service: WAN Miniport (PPTP) (PptpMiniport) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\raspptp.sys
O23 - Service: Driver processore (Processor) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\processr.sys
O23 - Service: Archiviazione protetta (ProtectedStorage) - /owner unsupported/ - C:\WINDOWS\system32\lsass.exe
O23 - Service: Utilità di pianificazione pacchetti QoS (PSched) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\psched.sys
O23 - Service: Driver Direct Parallel Link (Ptilink) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\ptilink.sys
O23 - Service: PxHelp20 (PxHelp20) - /owner unsupported/ - C:\WINDOWS\System32\Drivers\PxHelp20.sys
O23 - Service: Fotocamera digitale Casio (QV2KUX) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\qv2kux.sys
O23 - Service: Driver connessione automatica Accesso remoto (RasAcd) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\rasacd.sys
O23 - Service: Auto Connection Manager di Accesso remoto (RasAuto) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: WAN Miniport (L2TP) (Rasl2tp) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\rasl2tp.sys
O23 - Service: Connection Manager di Accesso remoto (RasMan) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Driver PPPOE di accesso remoto (RasPppoe) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\raspppoe.sys
O23 - Service: Direct Parallel (Raspti) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\raspti.sys
O23 - Service: Rdbss (Rdbss) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\rdbss.sys
O23 - Service: Gestione sessione di assistenza mediante desktop remoto (RDSessMgr) - /owner unsupported/ - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Driver filtro riproduzione CD-ROM audio digitale (redbook) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\redbook.sys
O23 - Service: Routing e Accesso remoto (RemoteAccess) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Microsoft Legacy Modem Driver (ROOTMODEM) - /owner unsupported/ - C:\WINDOWS\System32\Drivers\RootMdm.sys
O23 - Service: RPC Locator (RpcLocator) - /owner unsupported/ - C:\WINDOWS\System32\locator.exe
O23 - Service: RPC (Remote Procedure Call) (RpcSs) - /owner unsupported/ - C:\WINDOWS\system32\svchost.exe
O23 - Service: QoS RSVP (RSVP) - /owner unsupported/ - C:\WINDOWS\System32\rsvp.exe
O23 - Service: Gestione account di protezione (SAM) (SamSs) - /owner unsupported/ - C:\WINDOWS\system32\lsass.exe
O23 - Service: Helper smart card (SCardDrv) - /owner unsupported/ - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: smart card (SCardSvr) - /owner unsupported/ - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Utilità di pianificazione (Schedule) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Secdrv (Secdrv) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\secdrv.sys
O23 - Service: Accesso secondario (seclogon) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Notifica eventi di sistema (SENS) - /owner unsupported/ - C:\WINDOWS\system32\svchost.exe
O23 - Service: Driver filtro Serenum (serenum) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\serenum.sys
O23 - Service: Driver della porta seriale (Serial) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\serial.sys
O23 - Service: Unità disco floppy ad alta capacità (Sfloppy) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\sfloppy.sys
O23 - Service: Firewall della connessione Internet (ICF) / Condivisione connessione Internet (ICS) (SharedAccess) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Rilevamento hardware shell (ShellHWDetection) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: BDA Slip De-Framer (SLIP) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\SLIP.sys
O23 - Service: Frazionatore audio del kernel Microsoft (splitter) - /owner unsupported/ - C:\WINDOWS\system32\drivers\splitter.sys
O23 - Service: Spooler di stampa (Spooler) - /owner unsupported/ - C:\WINDOWS\system32\spoolsv.exe
O23 - Service: Driver filtro Ripristino configurazione di sistema (sr) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\sr.sys
O23 - Service: srescan (srescan) - /owner unsupported/ - C:\WINDOWS\System32\ZoneLabs\srescan.sys
O23 - Service: Servizio Ripristino configurazione di sistema (srservice) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Srv (Srv) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\srv.sys
O23 - Service: Servizio di rilevamento SSDP (SSDPSRV) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Acquisizione di immagini di Windows (WIA) (stisvc) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: ATM/ADSL miniport (Stmatm) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\stmatm.sys
O23 - Service: BDA IPSink (streamip) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\StreamIP.sys
O23 - Service: Driver bus software (swenum) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\swenum.sys
O23 - Service: Sintetizzatore Wavetable GS kernel Microsoft (swmidi) - /owner unsupported/ - C:\WINDOWS\system32\drivers\swmidi.sys
O23 - Service: MS Software Shadow Copy Provider (SwPrv) - /owner unsupported/ - C:\WINDOWS\System32\dllhost.exe
O23 - Service: Symantec Core LC (Symantec Core LC) - /owner unsupported/ - C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: symlcbrd (symlcbrd) - /owner unsupported/ - C:\WINDOWS\System32\drivers\symlcbrd.sys
O23 - Service: Periferica audio di sistema Microsoft Kernel (sysaudio) - /owner unsupported/ - C:\WINDOWS\system32\drivers\sysaudio.sys
O23 - Service: Avvisi e registri di prestazioni (SysmonLog) - /owner unsupported/ - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Telefonia (TapiSrv) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: ADSL Modem USB Service (TaurusUsb) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\torususb.sys
O23 - Service: Driver protocollo TCP/IP (Tcpip) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\tcpip.sys
O23 - Service: Driver della periferica terminale (TermDD) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\termdd.sys
O23 - Service: Servizi terminal (TermService) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Temi (Themes) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Manutenzione collegamenti distribuiti client (TrkWks) - /owner unsupported/ - C:\WINDOWS\system32\svchost.exe
O23 - Service: Windows User Mode Driver Framework (UMWdf) - /owner unsupported/ - C:\WINDOWS\System32\wdfmgr.exe
O23 - Service: Driver aggiornamento microcodice (Update) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\update.sys
O23 - Service: UpdJct (UpdJct) - /owner unsupported/ - C:\:hqef.exe
O23 - Service: Upload Manager (uploadmgr) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Host di periferiche Plug and Play universali (upnphost) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Gruppo di continuità (UPS) - /owner unsupported/ - C:\WINDOWS\System32\ups.exe
O23 - Service: Driver principale generico USB Microsoft (usbccgp) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\usbccgp.sys
O23 - Service: Driver Miniport controller enhanced host USB 2.0 Microsoft (usbehci) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\usbehci.sys
O23 - Service: Driver hub USB standard Microsoft (usbhub) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\usbhub.sys
O23 - Service: Classe stampanti USB Microsoft (usbprint) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\usbprint.sys
O23 - Service: Motorola USB Modem Driver (usbser) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\usbser.sys
O23 - Service: Driver archiviazione di massa USB (usbstor) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS
O23 - Service: Driver Miniport Controller Universal Host USB Microsoft (usbuhci) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\usbuhci.sys
O23 - Service: Servizio Messenger Sharing USN Journal Reader (usnsvc) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: vsdatant (vsdatant) - /owner unsupported/ - C:\WINDOWS\System32\vsdatant.sys
O23 - Service: TrueVector Internet Monitor (vsmon) - /owner unsupported/ - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Copia replicata del volume (VSS) - /owner unsupported/ - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Ora di Windows (W32Time) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Driver ARP IP di accesso remoto (Wanarp) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\wanarp.sys
O23 - Service: Microsoft WDM Virtual Wave Driver (WDM) (wdmaud) - /owner unsupported/ - C:\WINDOWS\system32\drivers\wdmaud.sys
O23 - Service: WebClient (WebClient) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Strumentazione gestione Windows (winmgmt) - /owner unsupported/ - C:\WINDOWS\system32\svchost.exe
O23 - Service: Servizio Numero di serie per dispositivi multimediali portatili (WmdmPmSN) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Scheda WMI Performance (WmiApSrv) - /owner unsupported/ - C:\WINDOWS\System32\wbem\wmiapsrv.exe
O23 - Service: WpdUsb (WpdUsb) - /owner unsupported/ - C:\WINDOWS\System32\Drivers\wpdusb.sys
O23 - Service: Ambiente di supporto del provider del Servizio Non-IFS di Windows Socket 2.0 (WS2IFSL) - /owner unsupported/ - C:\WINDOWS\System32\drivers\ws2ifsl.sys
O23 - Service: Codec World Standard Teletext (WSTCODEC) - /owner unsupported/ - C:\WINDOWS\System32\DRIVERS\WSTCODEC.SYS
O23 - Service: Aggiornamenti automatici (wuauserv) - /owner unsupported/ - C:\WINDOWS\system32\svchost.exe
O23 - Service: Zero Configuration reti senza fili (WZCSVC) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} () - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} () - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[Smjert]

Vai sulla barra di avvio Start->Esegui->digita sc stop UpdJct e dai invio, poi rifai la stessa cosa ma digita sc delete UpdJct.

Scaricati questo programmino, decomprimilo e metti solo l'esegubile in C:\
Vai di nuovo su Esegui->digita cmd, dai invio e poi digita C:\streams -d C:\:hqef.exe

Sempre da Esegui digita regedit, ti si apre l'editor di registro, naviga fino a questa chiave HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, selezionala e nella parte destra guarda se ci sono questi valori sotto la colonna Dati c:\windows\lanscr.exe, c:\windows\sonynet.exe, c:\windows\symantecspeed.exe, se ci sono cancellali.

Riavvia in Modalità Provvisoria, cancella questi file c:\windows\lanscr.exe, c:\windows\sonynet.exe, c:\windows\symantecspeed.exe.

Prova a far rigirare il tool Symantec e poi in Modalità Normale anche quello Prevx.

[kikko1980]