Olimpo Informatico

[Gavilan]

Ciao,
copio qui sotto il log.
Tra l'altro non so se è completo, perchè ad un certo punto viene scritto che hijack ha causato un errore e verrà chiuso!
Grazie...

Logfile of HijackThis v1.99.1
Scan saved at 22.55.07, on 17/02/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
E:\WINNT\System32\smss.exe
E:\WINNT\system32\winlogon.exe
E:\WINNT\system32\services.exe
E:\WINNT\system32\lsass.exe
E:\WINNT\system32\svchost.exe
E:\WINNT\system32\ZoneLabs\vsmon.exe
E:\WINNT\system32\spoolsv.exe
E:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
E:\Program Files\AntiVir PersonalEdition Classic\sched.exe
E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
E:\Program Files\Alwil Software\Avast4\ashServ.exe
E:\WINNT\System32\svchost.exe
E:\WINNT\System32\nvsvc32.exe
E:\WINNT\system32\pctspk.exe
E:\PROGRA~1\Alice\ALICEE~1\app\pppoeservice.exe
E:\WINNT\system32\MSTask.exe
E:\WINNT\system32\stisvc.exe
E:\WINNT\System32\WBEM\WinMgmt.exe
E:\WINNT\System32\mspmspsv.exe
E:\WINNT\system32\svchost.exe
E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
E:\Program Files\Alwil Software\Avast4\ashWebSv.exe
E:\WINNT\Explorer.EXE
E:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
E:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
E:\WINNT\System32\spool\drivers\w32x86\3\hpztsb08.exe
E:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
E:\Program Files\HP\hpcoretech\hpcmpmgr.exe
E:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
E:\PROGRA~1\COMMON~1\ADAPTE~1\CreateCD\CREATE~1.EXE
E:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
E:\WINNT\system32\internat.exe
E:\Program Files\Netropa\Multimedia Keyboard\TrayMon.exe
E:\Program Files\Netropa\Onscreen Display\OSD.exe
E:\Program Files\FinePixViewer\QuickDCF.exe
E:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
E:\Program Files\Alice ti aiuta\bin\mpbtn.exe
E:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqgalry.exe
E:\WINNT\system32\NOTEPAD.EXE
E:\PROGRA~1\Alice\ALICEE~1\app\EnterNet.exe
E:\Program Files\Internet Explorer\IEXPLORE.EXE
E:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://gw.aliceadsl.it/minisearch
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fornito da Alice
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;127.0.0.1;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINNT\System32\msdxm.ocx
O3 - Toolbar: (no name) - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [NeroCheck] E:\WINNT\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] E:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [HP Software Update] E:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] E:\WINNT\System32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [DeviceDiscovery] E:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O4 - HKLM\..\Run: [REGSHAVE] E:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [HP Component Manager] "E:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] "E:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [CreateCD50] E:\PROGRA~1\COMMON~1\ADAPTE~1\CreateCD\CREATE~1.EXE -r
O4 - HKLM\..\Run: [avgnt] "E:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [avast!] E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Zone Labs Client] "E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - Global Startup: Alice ti aiuta.lnk = E:\Program Files\Alice ti aiuta\bin\matcli.exe
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = E:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Exif Launcher.lnk = E:\Program Files\FinePixViewer\QuickDCF.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = E:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = E:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office\OSA9.EXE
O12 - Plugin for .spop: E:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {33331111-1111-1111-1111-611111193423} -
O16 - DPF: {33331111-1111-1111-1111-611111193429} -
O16 - DPF: {33331111-1111-1111-1111-615111193427} -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1165310453711
O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{973265CB-9F90-4F45-9477-A7989D88A815}: NameServer = 208.67.222.222,208.67.220.220
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} - (no file)
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - E:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - E:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - E:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - E:\WINNT\System32\dmadmin.exe
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - E:\WINNT\System32\msasvc.exe (file missing)
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - E:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - E:\WINNT\System32\nvsvc32.exe
O23 - Service: W2k PCtel speaker phone (Pctspk) - PCtel, Inc. - E:\WINNT\system32\pctspk.exe
O23 - Service: PPPoE Service (PPPoEService) - Unknown owner - E:\PROGRA~1\Alice\ALICEE~1\app\pppoeservice.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - E:\WINNT\system32\ZoneLabs\vsmon.exe
O23 - Service: wlmsngr - Unknown owner - E:\WINNT\wlmsngr.exe (file missing)

[Benny]

Sembra completo.
Hai qualche sintomo particolare?

Intanto potersti fixare questa voce

[Orange]

ciao
con molta attenzione fixa tutte queste voci:
O3 - Toolbar: (no name) - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
O16 - DPF: {33331111-1111-1111-1111-611111193423} -
O16 - DPF: {33331111-1111-1111-1111-611111193429} -
O16 - DPF: {33331111-1111-1111-1111-615111193427} -
O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} - (no file)
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - E:\WINNT\System32\msasvc.exe (file missing)
O23 - Service: wlmsngr - Unknown owner - E:\WINNT\wlmsngr.exe (file missing)

poi posta qui il log aggiornato

[Gavilan]

@ Benny: ogni volta che navigo mi sia prono pagine internet non volute e mi arrivano messaggi che sembrano di windows (ma ovviamente non lo sono!) che mi dicono che ho dei virus e mi invitano a fare una scansione approfondita con... non mi ricordo il nome... poi si apre la sua pag internet.

[Orange]

[Gavilan]

Ok, adesso sto usando un altro computer, però intanto l'ho scaricato.
Speriamo faccia qualcosa, perchè comunque ho già due antivirus e due anti spyware...
Grazie

[Gavilan]

Dunque, ho installato VirIT e ho fatto partire la scansione: mi ha trovato e rimosso 4 trojan!

Se ho capito bene, VirIT è sempre attivo, quindi non dovrei più 'beccarmi' questi trojan, giusto? Molto interessante...

Per ora sto navigando senza problemi, però: non esiste un sw analogo che sia free? Perchè questo mi dura solo 30 giorni

Ecco, come non detto: mi si è aperta ora la pag. web di un certo John Casablanca e la pubblicità di ebay...

[Orange]

ciao
per ANTITROJAN specifici freeware ti consiglierei Ewido Security Suite
http://www.ewido.de/en/
Ottimo Antitrojan per rimuovere programmi Trojani, Backdoor e altri malware; oltre alla rimozione è possibile visualizzare i programmi caricati all'avvio, i processi attivi e le connessioni aperte
NOTA: terminato il periodo di prova (30 gg) perderà la protezione in tempo reale ......
Sarà comunque possibile aggiornarlo e continuerà a rimuovere i Trojan individuati con la scansione manuale.

o anche A2 (A- squared)
http://www.a-2.org/en/software/personal/
RICHIEDE REGISTRAZIONE FREE
La versione freeware permette di effettuare una scansione del sistema per trovare e rimuovere questi oggetti pericolosi
NOTA: Nella versione freeware, Configura Background-Guard e Controlla il tuo sistema con Strumenti-Analisi non sono disponibili ed è solo possibile utilizzare la voce Esamina il tuo computer in cerca di infezioni da malware, sufficiente comunque per individuare e rimuovere moltissimi Trojan.

per quanto riguarda le finestre pop-up
scarica anche questo TOOL PER LA RIMOZIONE DI LINKOPTIMIZER
http://www.prevx.com/gromozon.asp

e alla fine della procedura
riposta qui il log di HiJackThis, che gli diamo un occhiata

[Gavilan]

Ok...
Ma io ho già su Spybot e Adaware, non sono equivalenti a quelli che mi dici tu?
Tanto per completezza: di antivirus ho Avast e Antivir, però di quest'ultimo non mi parte il guard, già da un po', e non so perchè...
Come firewall ho Zone Alarm

Ah, un'altra cosa: da qualche giorno ogni tanto mi viene fuori un messaggio che mi dice che ho poca memoria virtuale... però l'ho aumentata due o tre mesi fa!

Ah, ogni tanto mi parte anche il conto alla rovescia per l'autodistruzione... scherzo!

Intanto ecco il log aggiornato:
Thanks...

Logfile of HijackThis v1.99.1
Scan saved at 14.32.12, on 19/02/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
E:\WINNT\System32\smss.exe
E:\WINNT\system32\winlogon.exe
E:\WINNT\system32\services.exe
E:\WINNT\system32\lsass.exe
E:\WINNT\system32\svchost.exe
E:\WINNT\system32\ZoneLabs\vsmon.exe
E:\WINNT\system32\spoolsv.exe
E:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
E:\Program Files\AntiVir PersonalEdition Classic\sched.exe
E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
E:\Program Files\Alwil Software\Avast4\ashServ.exe
E:\WINNT\System32\svchost.exe
E:\WINNT\System32\nvsvc32.exe
E:\WINNT\system32\pctspk.exe
E:\PROGRA~1\Alice\ALICEE~1\app\pppoeservice.exe
E:\WINNT\system32\MSTask.exe
E:\WINNT\system32\stisvc.exe
E:\VEXPLITE\viritsvc.exe
E:\WINNT\System32\WBEM\WinMgmt.exe
E:\WINNT\System32\mspmspsv.exe
E:\WINNT\system32\svchost.exe
E:\Program Files\Alwil Software\Avast4\ashWebSv.exe
E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
E:\WINNT\Explorer.EXE
E:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
E:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
E:\WINNT\System32\spool\drivers\w32x86\3\hpztsb08.exe
E:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
E:\Program Files\HP\hpcoretech\hpcmpmgr.exe
E:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
E:\Program Files\Netropa\Multimedia Keyboard\TrayMon.exe
E:\PROGRA~1\COMMON~1\ADAPTE~1\CreateCD\CREATE~1.EXE
E:\Program Files\Netropa\Onscreen Display\OSD.exe
E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
E:\VEXPLITE\MONLITE.EXE
E:\WINNT\system32\internat.exe
E:\Program Files\FinePixViewer\QuickDCF.exe
E:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
E:\Program Files\Alice ti aiuta\bin\mpbtn.exe
E:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqgalry.exe
E:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
E:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = E:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = E:\windows\system32\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fornito da Alice
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;127.0.0.1;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {021C75C6-60E0-4D25-893E-0D7D70B1D6BA} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {07BC2E18-3DB7-4E80-965D-134AF76AC1B2} - (no file)
O2 - BHO: (no name) - {2A295ED8-EB23-47A1-8196-D89465C56751} - (no file)
O2 - BHO: (no name) - {2A8B872F-FF8C-417C-A61E-0AED07D617B0} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5D3A1E94-76F9-43A3-A15F-CAB2C7CDB93B} - E:\WINNT\System32\opnnn.dll (file missing)
O2 - BHO: (no name) - {5DED3B1D-08CE-44B4-A5CD-8FA5EED1F391} - (no file)
O2 - BHO: (no name) - {6F95C1FD-923F-475F-A933-9B81E6E7AEAD} - (no file)
O2 - BHO: (no name) - {73C1B5FE-27A9-40CF-83DB-1321107D6F32} - (no file)
O2 - BHO: (no name) - {9BDEF01A-589D-42ED-9F4B-425923083DD6} - (no file)
O2 - BHO: (no name) - {9DE7C710-B816-47B0-9011-09DC6B553CA9} - (no file)
O2 - BHO: (no name) - {AC44D8B4-25F6-4CE6-90B0-4D150A6FAFB8} - (no file)
O2 - BHO: (no name) - {C2D09612-0D9A-407B-9E4B-BDC71E5D57A2} - (no file)
O2 - BHO: (no name) - {D97C5770-E315-415E-B99A-02D68F8F8828} - (no file)
O2 - BHO: (no name) - {E03C740E-BB24-4d3c-B92A-6F84DE1DD99C} - E:\WINNT\system32\iummpxmx.dll
O2 - BHO: (no name) - {E3B0F9FD-C703-492B-A114-0BC7770C7895} - (no file)
O2 - BHO: (no name) - {F15DE131-4CC0-4CB9-8165-9F9F4A1D4381} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINNT\System32\msdxm.ocx
O3 - Toolbar: (no name) - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [NeroCheck] E:\WINNT\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] E:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [HP Software Update] E:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] E:\WINNT\System32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [DeviceDiscovery] E:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O4 - HKLM\..\Run: [REGSHAVE] E:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [HP Component Manager] "E:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] "E:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [CreateCD50] E:\PROGRA~1\COMMON~1\ADAPTE~1\CreateCD\CREATE~1.EXE -r
O4 - HKLM\..\Run: [avgnt] "E:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [avast!] E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Zone Labs Client] "E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [VIRIT LITE MONITOR] E:\VEXPLITE\MONLITE.EXE
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - Global Startup: Alice ti aiuta.lnk = E:\Program Files\Alice ti aiuta\bin\matcli.exe
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = E:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Exif Launcher.lnk = E:\Program Files\FinePixViewer\QuickDCF.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = E:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = E:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office\OSA9.EXE
O12 - Plugin for .spop: E:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1165310453711
O17 - HKLM\System\CCS\Services\Tcpip\..\{973265CB-9F90-4F45-9477-A7989D88A815}: NameServer = 208.67.222.222,208.67.220.220
O20 - Winlogon Notify: opnnn - E:\WINNT\System32\opnnn.dll (file missing)
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} - (no file)
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - E:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - E:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - E:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - E:\WINNT\System32\dmadmin.exe
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - E:\WINNT\System32\msasvc.exe (file missing)
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - E:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - E:\WINNT\System32\nvsvc32.exe
O23 - Service: W2k PCtel speaker phone (Pctspk) - PCtel, Inc. - E:\WINNT\system32\pctspk.exe
O23 - Service: PPPoE Service (PPPoEService) - Unknown owner - E:\PROGRA~1\Alice\ALICEE~1\app\pppoeservice.exe
O23 - Service: Virit eXplorer Lite (viritsvclite) - TG Soft Sas www.tgsoft.it - E:\VEXPLITE\viritsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - E:\WINNT\system32\ZoneLabs\vsmon.exe
O23 - Service: wlmsngr - Unknown owner - E:\WINNT\wlmsngr.exe (file missing)

[Orange]

ma sei peggiorata dall'ultima volta
allora fixa queste voci
O2 - BHO: (no name) - {07BC2E18-3DB7-4E80-965D-134AF76AC1B2} - (no file)
O2 - BHO: (no name) - {2A295ED8-EB23-47A1-8196-D89465C56751} - (no file)
O2 - BHO: (no name) - {2A8B872F-FF8C-417C-A61E-0AED07D617B0} - (no file)
O2 - BHO: (no name) - {5D3A1E94-76F9-43A3-A15F-CAB2C7CDB93B} - E:\WINNT\System32\opnnn.dll (file missing)
O2 - BHO: (no name) - {5DED3B1D-08CE-44B4-A5CD-8FA5EED1F391} - (no file)
O2 - BHO: (no name) - {6F95C1FD-923F-475F-A933-9B81E6E7AEAD} - (no file)
O2 - BHO: (no name) - {73C1B5FE-27A9-40CF-83DB-1321107D6F32} - (no file)
O2 - BHO: (no name) - {9BDEF01A-589D-42ED-9F4B-425923083DD6} - (no file)
O2 - BHO: (no name) - {9DE7C710-B816-47B0-9011-09DC6B553CA9} - (no file)
O2 - BHO: (no name) - {AC44D8B4-25F6-4CE6-90B0-4D150A6FAFB8} - (no file)
O2 - BHO: (no name) - {C2D09612-0D9A-407B-9E4B-BDC71E5D57A2} - (no file)
O2 - BHO: (no name) - {D97C5770-E315-415E-B99A-02D68F8F8828} - (no file)
O2 - BHO: (no name) - {E03C740E-BB24-4d3c-B92A-6F84DE1DD99C} - E:\WINNT\system32\iummpxmx.dll
O2 - BHO: (no name) - {E3B0F9FD-C703-492B-A114-0BC7770C7895} - (no file)
O2 - BHO: (no name) - {F15DE131-4CC0-4CB9-8165-9F9F4A1D4381} - (no file)
O3 - Toolbar: (no name) - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
O20 - Winlogon Notify: opnnn - E:\WINNT\System32\opnnn.dll (file missing)
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} - (no file)
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - E:\WINNT\System32\msasvc.exe (file missing)
O23 - Service: wlmsngr - Unknown owner - E:\WINNT\wlmsngr.exe (file missing)

[Gavilan]

[ioSOLOio]

[Gavilan]

[Jeppo59]

Oltre alle cose che ti sono state chieste di fare, credo che tu debba installare il service pack 2 per IE, ma se installi Firefox 2.0 ridurrai notevolmente i rischi di infettarti sul web!

[Gavilan]

IE dovrebbe essere aggiornato, lo fa automaticamente...

Eh lo so, prima o poi devo convertirmi a qualcosa di non-microsoft. Già avevo una mezza idea di mettere Linux sull'altra partizione

[Orange]

ciao
hai tralasciato un paio
O2 - BHO: (no name) - {021C75C6-60E0-4D25-893E-0D7D70B1D6BA} - (no file)
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - E:\WINNT\System32\msasvc.exe (file missing)

per il resto il log e pulito
devi fixare le voci in modalità provvisoria, in quella normale, solo se non appaiono...

Trova e se ci sono elimina questi files o cartelle:
C:\secure32.html(se esiste)
C:\WINDOWS\system32\msasvc.exe
Da StART\ESEGUI digita:
sc stop Microsoft authenticate service (e dai l'OK)
sc delete Microsoft authenticate service (e dai l'OK)

Ripulisci il sistema con Ccleaner
ma prima di effettuare la pulizia, vai in Opzioni\Avanzate e togli la spunta a :cancella files in Windows Temp solo se piu vecchi di 48 ore

(in seguito... Ccleaner usalo una volta al mese... )

comunque ti consiglierei di usare Mozilla Firefox è molto meno soggetto agli attacchi virus, rispetto IE

riposta il log aggiornato ( così, per pignoleria )

[Gavilan]

Ok Master, farò i compiti e poi ri-posterò i risultati...

[Jeppo59]

[Gavilan]

[Orange]