Olimpo Informatico

[profiteroles]

ciao sono nuova, ieri il mio pc è andato in tilt, forse per colpa di un virus.

ogni programma che apro si blocca, tipo nero, tipo internet explorer.

ho fatto scansione con avast aggiornato a ieri e mi ha riconosciuto un bel pò di virus, ma cmq li ho spostati nel cestino, ho fatto ripristino configurazione al giorno precedente, ho deframmentato pensando potesse essere dovuto al fatto che ho l'hard disk pieno (ma è stato anche più pieno e non ho mai avuto problemi)

come posso risolvere? per esempio i film li riesco a vedere (quindi ok winamp e media player), ho usato il software dell'hp per le foto e ha funzionato, mentre photoshop, nero e explorer niente!


si bloccano appena li apro!

sarà colpa di qualche virus non rilevato? devo formattare il pc?

[ste_95]

Cominciamo con il vedere un log di hijackthis:

Scarica HijackThis
Salvalo in una cartella (non aprirlo direttamente, sennò non farà i backup!)
Apri l'eseguibile
Clicca quindi su "Do a System Scan and Save a Logfile"
Attendi che finisca la scansione
Quindi copia il contenuto del blocco note qui sul forum.

[profiteroles]

ok, un attimo perchè sono connessa con un altro pc (infatti con quello non posso nemmeno connettermi), e devo salvare il file in word per trasferirlo.

cmq all'accensione del pc mi esce un mess di errore. esce scritto che il file PfMgrApi.dll non è installato (o una cosa simile...)

[profiteroles]

fatto, pensavo fosse più complicato spostare il file con la penna, scusate sono un pò imbranata!


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15.41.04, on 01/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Intel\Wireless\Bin\EvtEng.exe
C:\Programmi\Intel\Wireless\Bin\S24EvMon.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\TPSMain.exe
C:\WINDOWS\system32\ZoomingHook.exe
C:\WINDOWS\system32\TCtrlIOHook.exe
C:\Programmi\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\TOSHIBA\ConfigFree\NDSTray.exe
C:\Programmi\TOSHIBA\TOSHIBA Direct Disc Writer\ddwmon.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Programmi\TOSHIBA\TOSHIBA Direct Disc Writer\bak\ddwmon.exe
C:\Programmi\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Programmi\TOSHIBA\ConfigFree\CFSServ.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\TODDSrv.exe
C:\Programmi\ARESCOM\Modem Telindus Arescom ND220b\dslmon.exe
C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
C:\Programmi\Zone Labs\ZoneAlarm\zonealarm.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\HP\Digital Imaging\bin\hpqgalry.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\Programmi\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Programmi\File comuni\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.live.com/results.aspx?mkt=it-it&q=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.it/0SEITIT/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.alice.it/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.it/0SEITIT/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Programmi\Macrogaming\SweetIMBarForIE\toolbar.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\Programmi\MegauploadToolbar\megauploadtoolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\Programmi\MegauploadToolbar\megauploadtoolbar.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Apoint] C:\Programmi\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [PadTouch] C:\Programmi\TOSHIBA\Touch and Launch\PadExe.exe
O4 - HKLM\..\Run: [CeEKEY] C:\Programmi\TOSHIBA\E-KEY\CeEKey.exe
O4 - HKLM\..\Run: [HWSetup] C:\Programmi\TOSHIBA\TOSHIBA Applet\HWSetup.exe hwSetUP
O4 - HKLM\..\Run: [SVPWUTIL] C:\Programmi\Toshiba\Windows Utilities\SVPWUTIL.exe SVPwUTIL
O4 - HKLM\..\Run: [TPNF] C:\Programmi\TOSHIBA\TouchPad\TPTray.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [Zooming] ZoomingHook.exe
O4 - HKLM\..\Run: [SmoothView] C:\Programmi\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [TCtryIOHook] TCtrlIOHook.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [Tvs] C:\Programmi\TOSHIBA\Tvs\TvsTray.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [DDWMon] C:\Programmi\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Programmi\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Programmi\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Programmi\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Programmi\Winamp\winampa.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TOSCDSPD] C:\Programmi\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [MsnMsgr] ~"C:\Programmi\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SweetIM] C:\Programmi\Macrogaming\SweetIM\SweetIM.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Avvio rapido di HP Image Zone.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: DSLMON.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: ZoneAlarm.lnk = C:\Programmi\Zone Labs\ZoneAlarm\zonealarm.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Programmi\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/IT-IT/a-UNO1/GAME_UNO1.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-5b2ad6e7b08b6104.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/ActiveX/downloadcontrol.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab55579.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Programmi\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Sony SPTI Service for DVE (ICDSPTSV) - Sony Corporation - C:\WINDOWS\system32\IcdSptSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Programmi\File comuni\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\SsBeSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\WINDOWS\system32\TODDSrv.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 11275 bytes

[ste_95]

Esegui una scansione con FindAWF seguendo queste istruzioni:

http://forum.zeusnews.com/viewtopic.php?p=194965#194965

[profiteroles]

questo è il risultato:

Find AWF report by noahdfear ©2006
Version 1.40



bak folders found
~~~~~~~~~~~

Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\PROGRA~1\APOINT2K\BAK

24/03/2004 06.40 196.608 Apoint.exe
1 File 196.608 byte
2 Directory 9.521.328.128 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\PROGRA~1\WINAMP\BAK

20/12/2004 19.41 33.792 winampa.exe
1 File 33.792 byte
2 Directory 9.521.328.128 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\WINDOWS\SYSTEM32\BAK

19/08/2004 11.00 15.360 ctfmon.exe
07/02/2006 16.36 77.824 hkcmd.exe
07/02/2006 16.40 118.784 igfxpers.exe
07/02/2006 16.39 94.208 igfxtray.exe
09/07/2001 10.50 155.648 NeroCheck.exe
5 File 461.824 byte
2 Directory 9.521.324.032 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\PROGRA~1\ALWILS~1\AVAST4\BAK

04/12/2007 14.00 79.224 ashDisp.exe
1 File 79.224 byte
2 Directory 9.521.324.032 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\PROGRA~1\HP\HPCORE~1\BAK

12/05/2004 15.18 241.664 hpcmpmgr.exe
1 File 241.664 byte
6 Directory 9.521.324.032 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\PROGRA~1\MACROG~1\SWEETIM\BAK

27/12/2006 15.53 73.840 SweetIM.exe
1 File 73.840 byte
2 Directory 9.521.328.128 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\PROGRA~1\TOSHIBA\E-KEY\BAK

12/04/2006 15.31 638.976 CeEKey.exe
1 File 638.976 byte
2 Directory 9.521.328.128 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\PROGRA~1\TOSHIBA\TOF266~1\BAK

28/04/2006 10.45 262.144 ddwmon.exe
1 File 262.144 byte
2 Directory 9.521.328.128 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\PROGRA~1\TOSHIBA\TOSCDSPD\BAK

12/04/2005 09.14 65.536 toscdspd.exe
1 File 65.536 byte
2 Directory 9.521.328.128 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\PROGRA~1\TOSHIBA\TOSHIB~2\BAK

01/05/2004 12.45 28.672 HWSetup.exe
1 File 28.672 byte
2 Directory 9.521.328.128 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\PROGRA~1\TOSHIBA\TOSHIB~3\BAK

12/05/2005 12.33 118.784 SmoothView.exe
1 File 118.784 byte
2 Directory 9.521.324.032 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\PROGRA~1\TOSHIBA\TOUCHA~1\BAK

22/12/2005 13.16 1.077.330 PadExe.exe
1 File 1.077.330 byte
2 Directory 9.521.324.032 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\PROGRA~1\TOSHIBA\TOUCHPAD\BAK

04/04/2006 13.57 53.248 TPTray.exe
1 File 53.248 byte
2 Directory 9.521.324.032 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\PROGRA~1\TOSHIBA\TVS\BAK

02/02/2006 12.11 73.728 TvsTray.exe
1 File 73.728 byte
2 Directory 9.521.324.032 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\PROGRA~1\TOSHIBA\WINDOW~1\BAK

01/05/2004 12.45 65.536 SVPWUTIL.exe
1 File 65.536 byte
2 Directory 9.521.324.032 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\PROGRA~1\FILECO~1\AHEAD\LIB\BAK

28/10/2005 16.25 94.208 NMBgMonitor.exe
1 File 94.208 byte
2 Directory 9.521.324.032 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\PROGRA~1\INTEL\WIRELESS\BIN\BAK

28/11/2005 11.41 602.182 ifrmewrk.exe
05/12/2005 12.37 667.718 ZCfgSvc.exe
2 File 1.269.900 byte
2 Directory 9.521.324.032 byte disponibili


Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~

10256 17 Jan 2008 "C:\Programmi\Apoint2K\Apoint.exe"
196608 24 Mar 2004 "C:\TOOLSCD\Touch pad Driver\Apoint.exe"
196608 24 Mar 2004 "C:\Programmi\Apoint2K\bak\Apoint.exe"
10256 17 Jan 2008 "C:\Programmi\Winamp\winampa.exe"
33792 20 Dec 2004 "C:\Programmi\Winamp\bak\winampa.exe"
15360 19 Aug 2004 "C:\WINDOWS\system32\ctfmon.exe"
15360 19 Aug 2004 "C:\WINDOWS\system32\bak\ctfmon.exe"
10256 17 Jan 2008 "C:\WINDOWS\system32\hkcmd.exe"
77824 7 Feb 2006 "C:\TOOLSCD\Display Driver\Win2000\hkcmd.exe"
77824 7 Feb 2006 "C:\WINDOWS\system32\bak\hkcmd.exe"
10256 17 Jan 2008 "C:\WINDOWS\system32\igfxpers.exe"
118784 7 Feb 2006 "C:\TOOLSCD\Display Driver\Win2000\igfxpers.exe"
118784 7 Feb 2006 "C:\WINDOWS\system32\bak\igfxpers.exe"
10256 17 Jan 2008 "C:\WINDOWS\system32\igfxtray.exe"
94208 7 Feb 2006 "C:\TOOLSCD\Display Driver\Win2000\igfxtray.exe"
94208 7 Feb 2006 "C:\WINDOWS\system32\bak\igfxtray.exe"
10256 17 Jan 2008 "C:\WINDOWS\system32\NeroCheck.exe"
155648 9 Jul 2001 "C:\WINDOWS\system32\bak\NeroCheck.exe"
79224 4 Dec 2007 "C:\Programmi\Alwil Software\Avast4\ashDisp.exe"
79224 4 Dec 2007 "C:\Programmi\Alwil Software\Avast4\bak\ashDisp.exe"
10256 17 Jan 2008 "C:\Programmi\HP\hpcoretech\hpcmpmgr.exe"
241664 12 May 2004 "C:\Programmi\HP\hpcoretech\bak\hpcmpmgr.exe"
531 17 Jan 2008 "C:\Programmi\HP\hpcoretech\data\EvntData-66481975.xml"
324 23 Jan 2008 "C:\Programmi\HP\hpcoretech\bak\data\EvntData-1200357384.xml"
10256 17 Jan 2008 "C:\Programmi\Macrogaming\SweetIM\SweetIM.exe"
73840 27 Dec 2006 "C:\Programmi\Macrogaming\SweetIM\bak\SweetIM.exe"
10256 17 Jan 2008 "C:\Programmi\TOSHIBA\E-KEY\CeEKey.exe"
638976 12 Apr 2006 "C:\Programmi\TOSHIBA\E-KEY\bak\CeEKey.exe"
10256 17 Jan 2008 "C:\Programmi\TOSHIBA\TOSHIBA Direct Disc Writer\ddwmon.exe"
262144 28 Apr 2006 "C:\Programmi\TOSHIBA\TOSHIBA Direct Disc Writer\bak\ddwmon.exe"
10256 17 Jan 2008 "C:\Programmi\TOSHIBA\TOSCDSPD\toscdspd.exe"
65536 12 Apr 2005 "C:\Programmi\TOSHIBA\TOSCDSPD\bak\toscdspd.exe"
10256 17 Jan 2008 "C:\Programmi\TOSHIBA\TOSHIBA Applet\HWSetup.exe"
28672 1 May 2004 "C:\Programmi\TOSHIBA\TOSHIBA Applet\bak\HWSetup.exe"
10256 17 Jan 2008 "C:\Programmi\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe"
118784 12 May 2005 "C:\Programmi\TOSHIBA\TOSHIBA Zooming Utility\bak\SmoothView.exe"
10256 17 Jan 2008 "C:\Programmi\TOSHIBA\Touch and Launch\PadExe.exe"
1077330 22 Dec 2005 "C:\Programmi\TOSHIBA\Touch and Launch\bak\PadExe.exe"
10256 17 Jan 2008 "C:\Programmi\TOSHIBA\TouchPad\TPTray.exe"
53248 4 Apr 2006 "C:\Programmi\TOSHIBA\TouchPad\bak\TPTray.exe"
10256 17 Jan 2008 "C:\Programmi\TOSHIBA\Tvs\TvsTray.exe"
73728 2 Feb 2006 "C:\Programmi\TOSHIBA\Tvs\bak\TvsTray.exe"
10256 17 Jan 2008 "C:\Programmi\TOSHIBA\Windows Utilities\SVPWUTIL.exe"
65536 1 May 2004 "C:\Programmi\TOSHIBA\Windows Utilities\bak\SVPWUTIL.exe"
10256 17 Jan 2008 "C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe"
94208 28 Oct 2005 "C:\Programmi\File comuni\Ahead\Lib\bak\NMBgMonitor.exe"
10256 17 Jan 2008 "C:\Programmi\Intel\Wireless\Bin\ifrmewrk.exe"
602182 28 Nov 2005 "C:\Programmi\Intel\Wireless\Bin\bak\ifrmewrk.exe"
10256 17 Jan 2008 "C:\Programmi\Intel\Wireless\Bin\ZCfgSvc.exe"
667718 5 Dec 2005 "C:\Programmi\Intel\Wireless\Bin\bak\ZCfgSvc.exe"


end of report

[profiteroles]

nessuno mi può aiutare?

[ste_95]

Scarica Avenger
Estrailo in una cartella a tua scelta
Esegui il file avenger.exe con la figura di una spada
Metti il pallino su input script manually
Quindi scegli la lente e cliccaci
Ora incolla queste righe nella box bianca che si è aperta:

Files to delete:
C:\Programmi\Apoint2K\Apoint.exe
C:\Programmi\Winamp\winampa.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\NeroCheck.exe
C:\Programmi\Alwil Software\Avast4\ashDisp.exe
C:\Programmi\HP\hpcoretech\hpcmpmgr.exe
C:\Programmi\Macrogaming\SweetIM\SweetIM.exe
C:\Programmi\TOSHIBA\E-KEY\CeEKey.exe
C:\Programmi\TOSHIBA\TOSHIBA Direct Disc Writer\ddwmon.exe
C:\Programmi\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\Programmi\TOSHIBA\TOSHIBA Applet\HWSetup.exe
C:\Programmi\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\Programmi\TOSHIBA\Touch and Launch\PadExe.exe
C:\Programmi\TOSHIBA\TouchPad\TPTray.exe
C:\Programmi\TOSHIBA\Tvs\TvsTray.exe
C:\Programmi\TOSHIBA\Windows Utilities\SVPWUTIL.exe
C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe
C:\Programmi\Intel\Wireless\Bin\ifrmewrk.exe
C:\Programmi\Intel\Wireless\Bin\ZCfgSvc.exe

Files to move:
C:\Programmi\Intel\Wireless\Bin\bak\ZCfgSvc.exe | C:\Programmi\Intel\Wireless\Bin\ZCfgSvc.exe
C:\Programmi\Intel\Wireless\Bin\bak\ifrmewrk.exe | C:\Programmi\Intel\Wireless\Bin\ifrmewrk.exe
C:\Programmi\File comuni\Ahead\Lib\bak\NMBgMonitor.exe | C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe
C:\Programmi\TOSHIBA\Windows Utilities\bak\SVPWUTIL.exe | C:\Programmi\TOSHIBA\Windows Utilities\SVPWUTIL.exe
C:\Programmi\TOSHIBA\Windows Utilities\bak\SVPWUTIL.exe | C:\Programmi\TOSHIBA\Windows Utilities\SVPWUTIL.exe
C:\Programmi\TOSHIBA\Tvs\bak\TvsTray.exe | C:\Programmi\TOSHIBA\Tvs\TvsTray.exe
C:\Programmi\TOSHIBA\TouchPad\bak\TPTray.exe | C:\Programmi\TOSHIBA\TouchPad\TPTray.exe
C:\Programmi\TOSHIBA\Touch and Launch\bak\PadExe.exe | C:\Programmi\TOSHIBA\Touch and Launch\PadExe.exe
C:\Programmi\TOSHIBA\TOSHIBA Zooming Utility\bak\SmoothView.exe | C:\Programmi\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\Programmi\TOSHIBA\TOSHIBA Applet\bak\HWSetup.exe | C:\Programmi\TOSHIBA\TOSHIBA Applet\HWSetup.exe
C:\Programmi\TOSHIBA\TOSCDSPD\bak\toscdspd.exe | C:\Programmi\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\Programmi\TOSHIBA\TOSHIBA Direct Disc Writer\bak\ddwmon.exe | C:\Programmi\TOSHIBA\TOSHIBA Direct Disc Writer\ddwmon.exe
C:\Programmi\TOSHIBA\E-KEY\bak\CeEKey.exe | C:\Programmi\TOSHIBA\E-KEY\CeEKey.exe
C:\Programmi\Macrogaming\SweetIM\bak\SweetIM.exe | C:\Programmi\Macrogaming\SweetIM\SweetIM.exe
C:\Programmi\HP\hpcoretech\bak\hpcmpmgr.exe | C:\Programmi\HP\hpcoretech\hpcmpmgr.exe
C:\Programmi\Alwil Software\Avast4\bak\ashDisp.exe | C:\Programmi\Alwil Software\Avast4\ashDisp.exe
C:\WINDOWS\system32\bak\NeroCheck.exe | C:\WINDOWS\system32\NeroCheck.exe
C:\WINDOWS\system32\bak\igfxtray.exe | C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\bak\igfxpers.exe | C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\bak\hkcmd.exe | C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\bak\ctfmon.exe | C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Winamp\bak\winampa.exe | C:\Programmi\Winamp\winampa.exe
C:\Programmi\Apoint2K\bak\Apoint.exe | C:\Programmi\Apoint2K\Apoint.exe

Adesso devi cliccare su Done in basso nella box
Seleziona il semaforino in alto a destra
Rispondi di Si alle due richieste di Avenger
Adesso il tuo computer dovrebbe riavviarsi, nel caso non succedesse, riavvialo tu manualmente
Al riavvio del computer, copia e incolla qui il contenuto del blocco note che apparirà.

[profiteroles]

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\csepfuwj

*******************

Script file located at: \??\C:\ygaojnqq.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\Programmi\Apoint2K\Apoint.exe deleted successfully.
File C:\Programmi\Winamp\winampa.exe deleted successfully.
File C:\WINDOWS\system32\ctfmon.exe deleted successfully.
File C:\WINDOWS\system32\hkcmd.exe deleted successfully.
File C:\WINDOWS\system32\igfxpers.exe deleted successfully.
File C:\WINDOWS\system32\igfxtray.exe deleted successfully.
File C:\WINDOWS\system32\NeroCheck.exe deleted successfully.
File C:\Programmi\Alwil Software\Avast4\ashDisp.exe deleted successfully.
File C:\Programmi\HP\hpcoretech\hpcmpmgr.exe deleted successfully.
File C:\Programmi\Macrogaming\SweetIM\SweetIM.exe deleted successfully.
File C:\Programmi\TOSHIBA\E-KEY\CeEKey.exe deleted successfully.
File C:\Programmi\TOSHIBA\TOSHIBA Direct Disc Writer\ddwmon.exe deleted successfully.
File C:\Programmi\TOSHIBA\TOSCDSPD\toscdspd.exe deleted successfully.
File C:\Programmi\TOSHIBA\TOSHIBA Applet\HWSetup.exe deleted successfully.
File C:\Programmi\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe deleted successfully.
File C:\Programmi\TOSHIBA\Touch and Launch\PadExe.exe deleted successfully.
File C:\Programmi\TOSHIBA\TouchPad\TPTray.exe deleted successfully.
File C:\Programmi\TOSHIBA\Tvs\TvsTray.exe deleted successfully.
File C:\Programmi\TOSHIBA\Windows Utilities\SVPWUTIL.exe deleted successfully.
File C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe deleted successfully.
File C:\Programmi\Intel\Wireless\Bin\ifrmewrk.exe deleted successfully.
File C:\Programmi\Intel\Wireless\Bin\ZCfgSvc.exe deleted successfully.
File move operation C:\Programmi\Intel\Wireless\Bin\bak\ZCfgSvc.exe|C:\Programmi\Intel\Wireless\Bin\ZCfgSvc.exe completed successfully.
File move operation C:\Programmi\Intel\Wireless\Bin\bak\ifrmewrk.exe|C:\Programmi\Intel\Wireless\Bin\ifrmewrk.exe completed successfully.
File move operation C:\Programmi\File comuni\Ahead\Lib\bak\NMBgMonitor.exe|C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe completed successfully.
File move operation C:\Programmi\TOSHIBA\Windows Utilities\bak\SVPWUTIL.exe|C:\Programmi\TOSHIBA\Windows Utilities\SVPWUTIL.exe completed successfully.


File C:\Programmi\TOSHIBA\Windows Utilities\bak\SVPWUTIL.exe not found!
File move operation C:\Programmi\TOSHIBA\Windows Utilities\bak\SVPWUTIL.exe|C:\Programmi\TOSHIBA\Windows Utilities\SVPWUTIL.exe failed!

Could not process line:
C:\Programmi\TOSHIBA\Windows Utilities\bak\SVPWUTIL.exe|C:\Programmi\TOSHIBA\Windows Utilities\SVPWUTIL.exe
Status: 0xc0000034

File move operation C:\Programmi\TOSHIBA\Tvs\bak\TvsTray.exe|C:\Programmi\TOSHIBA\Tvs\TvsTray.exe completed successfully.
File move operation C:\Programmi\TOSHIBA\TouchPad\bak\TPTray.exe|C:\Programmi\TOSHIBA\TouchPad\TPTray.exe completed successfully.
File move operation C:\Programmi\TOSHIBA\Touch and Launch\bak\PadExe.exe|C:\Programmi\TOSHIBA\Touch and Launch\PadExe.exe completed successfully.
File move operation C:\Programmi\TOSHIBA\TOSHIBA Zooming Utility\bak\SmoothView.exe|C:\Programmi\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe completed successfully.
File move operation C:\Programmi\TOSHIBA\TOSHIBA Applet\bak\HWSetup.exe|C:\Programmi\TOSHIBA\TOSHIBA Applet\HWSetup.exe completed successfully.
File move operation C:\Programmi\TOSHIBA\TOSCDSPD\bak\toscdspd.exe|C:\Programmi\TOSHIBA\TOSCDSPD\toscdspd.exe completed successfully.
File move operation C:\Programmi\TOSHIBA\TOSHIBA Direct Disc Writer\bak\ddwmon.exe|C:\Programmi\TOSHIBA\TOSHIBA Direct Disc Writer\ddwmon.exe completed successfully.
File move operation C:\Programmi\TOSHIBA\E-KEY\bak\CeEKey.exe|C:\Programmi\TOSHIBA\E-KEY\CeEKey.exe completed successfully.
File move operation C:\Programmi\Macrogaming\SweetIM\bak\SweetIM.exe|C:\Programmi\Macrogaming\SweetIM\SweetIM.exe completed successfully.
File move operation C:\Programmi\HP\hpcoretech\bak\hpcmpmgr.exe|C:\Programmi\HP\hpcoretech\hpcmpmgr.exe completed successfully.
File move operation C:\Programmi\Alwil Software\Avast4\bak\ashDisp.exe|C:\Programmi\Alwil Software\Avast4\ashDisp.exe completed successfully.
File move operation C:\WINDOWS\system32\bak\NeroCheck.exe|C:\WINDOWS\system32\NeroCheck.exe completed successfully.
File move operation C:\WINDOWS\system32\bak\igfxtray.exe|C:\WINDOWS\system32\igfxtray.exe completed successfully.
File move operation C:\WINDOWS\system32\bak\igfxpers.exe|C:\WINDOWS\system32\igfxpers.exe completed successfully.
File move operation C:\WINDOWS\system32\bak\hkcmd.exe|C:\WINDOWS\system32\hkcmd.exe completed successfully.
File move operation C:\WINDOWS\system32\bak\ctfmon.exe|C:\WINDOWS\system32\ctfmon.exe completed successfully.
File move operation C:\Programmi\Winamp\bak\winampa.exe|C:\Programmi\Winamp\winampa.exe completed successfully.
File move operation C:\Programmi\Apoint2K\bak\Apoint.exe|C:\Programmi\Apoint2K\Apoint.exe completed successfully.

Completed script processing.

*******************

Finished! Terminate.

[ste_95]

Posta un nuovo log di hijackthis e di FindAWF.

[profiteroles]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13.15.09, on 02/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Intel\Wireless\Bin\EvtEng.exe
C:\Programmi\Intel\Wireless\Bin\S24EvMon.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programmi\Apoint2K\Apoint.exe
C:\Programmi\TOSHIBA\Touch and Launch\PadExe.exe
C:\Programmi\TOSHIBA\E-KEY\CeEKey.exe
C:\Programmi\TOSHIBA\TouchPad\TPTray.exe
C:\WINDOWS\system32\TPSMain.exe
C:\WINDOWS\system32\ZoomingHook.exe
C:\Programmi\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\WINDOWS\system32\TCtrlIOHook.exe
C:\Programmi\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\Programmi\TOSHIBA\Tvs\TvsTray.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\TOSHIBA\ConfigFree\NDSTray.exe
C:\Programmi\TOSHIBA\TOSHIBA Direct Disc Writer\ddwmon.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Programmi\Apoint2K\Apntex.exe
C:\Programmi\Intel\Wireless\bin\ZCfgSvc.exe
C:\Programmi\Intel\Wireless\Bin\ifrmewrk.exe
C:\Programmi\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Programmi\HP\hpcoretech\hpcmpmgr.exe
C:\Programmi\Intel\Wireless\Bin\RegSrvc.exe
C:\Programmi\TOSHIBA\ConfigFree\CFSServ.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\TODDSrv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programmi\Winamp\winampa.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe
C:\Programmi\Macrogaming\SweetIM\SweetIM.exe
C:\Programmi\ARESCOM\Modem Telindus Arescom ND220b\dslmon.exe
C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
C:\Programmi\MSN Messenger\MsnMsgr.Exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Programmi\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Programmi\HP\Digital Imaging\bin\hpqgalry.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.live.com/results.aspx?mkt=it-it&q=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.it/0SEITIT/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.alice.it/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.it/0SEITIT/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Programmi\Macrogaming\SweetIMBarForIE\toolbar.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\Programmi\MegauploadToolbar\megauploadtoolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\Programmi\MegauploadToolbar\megauploadtoolbar.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Apoint] C:\Programmi\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [PadTouch] C:\Programmi\TOSHIBA\Touch and Launch\PadExe.exe
O4 - HKLM\..\Run: [CeEKEY] C:\Programmi\TOSHIBA\E-KEY\CeEKey.exe
O4 - HKLM\..\Run: [HWSetup] C:\Programmi\TOSHIBA\TOSHIBA Applet\HWSetup.exe hwSetUP
O4 - HKLM\..\Run: [SVPWUTIL] C:\Programmi\Toshiba\Windows Utilities\SVPWUTIL.exe SVPwUTIL
O4 - HKLM\..\Run: [TPNF] C:\Programmi\TOSHIBA\TouchPad\TPTray.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [Zooming] ZoomingHook.exe
O4 - HKLM\..\Run: [SmoothView] C:\Programmi\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [TCtryIOHook] TCtrlIOHook.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [Tvs] C:\Programmi\TOSHIBA\Tvs\TvsTray.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [DDWMon] C:\Programmi\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Programmi\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Programmi\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Programmi\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Programmi\Winamp\winampa.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TOSCDSPD] C:\Programmi\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [MsnMsgr] ~"C:\Programmi\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SweetIM] C:\Programmi\Macrogaming\SweetIM\SweetIM.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Avvio rapido di HP Image Zone.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: DSLMON.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: ZoneAlarm.lnk = C:\Programmi\Zone Labs\ZoneAlarm\zonealarm.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Programmi\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/IT-IT/a-UNO1/GAME_UNO1.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-5b2ad6e7b08b6104.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/ActiveX/downloadcontrol.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab55579.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Programmi\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Sony SPTI Service for DVE (ICDSPTSV) - Sony Corporation - C:\WINDOWS\system32\IcdSptSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Programmi\File comuni\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\SsBeSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\WINDOWS\system32\TODDSrv.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 11727 bytes




questo con l'altro:

Find AWF report by noahdfear ©2006
Version 1.40



bak folders found
~~~~~~~~~~~

Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\PROGRA~1\APOINT2K\BAK

0 File 0 byte
2 Directory 12.387.315.712 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\PROGRA~1\WINAMP\BAK

0 File 0 byte
2 Directory 12.387.315.712 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\WINDOWS\SYSTEM32\BAK

0 File 0 byte
2 Directory 12.387.311.616 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\PROGRA~1\ALWILS~1\AVAST4\BAK

0 File 0 byte
2 Directory 12.387.311.616 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\PROGRA~1\HP\HPCORE~1\BAK

0 File 0 byte
6 Directory 12.387.311.616 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

[ste_95]

Il log di FindAWF è tagliato.

[profiteroles]

Find AWF report by noahdfear ©2006
Version 1.40



bak folders found
~~~~~~~~~~~

Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\PROGRA~1\APOINT2K\BAK

0 File 0 byte
2 Directory 11.847.593.984 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\PROGRA~1\WINAMP\BAK

0 File 0 byte
2 Directory 11.847.593.984 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\WINDOWS\SYSTEM32\BAK

0 File 0 byte
2 Directory 11.847.589.888 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\PROGRA~1\ALWILS~1\AVAST4\BAK

0 File 0 byte
2 Directory 11.847.589.888 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\PROGRA~1\HP\HPCORE~1\BAK

0 File 0 byte
6 Directory 11.847.589.888 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\PROGRA~1\MACROG~1\SWEETIM\BAK

0 File 0 byte
2 Directory 11.847.589.888 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\PROGRA~1\TOSHIBA\E-KEY\BAK

0 File 0 byte
2 Directory 11.847.589.888 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\PROGRA~1\TOSHIBA\TOF266~1\BAK

0 File 0 byte
2 Directory 11.847.589.888 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\PROGRA~1\TOSHIBA\TOSCDSPD\BAK

0 File 0 byte
2 Directory 11.847.589.888 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\PROGRA~1\TOSHIBA\TOSHIB~2\BAK

0 File 0 byte
2 Directory 11.847.589.888 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\PROGRA~1\TOSHIBA\TOSHIB~3\BAK

0 File 0 byte
2 Directory 11.847.589.888 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\PROGRA~1\TOSHIBA\TOUCHA~1\BAK

0 File 0 byte
2 Directory 11.847.589.888 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\PROGRA~1\TOSHIBA\TOUCHPAD\BAK

0 File 0 byte
2 Directory 11.847.585.792 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\PROGRA~1\TOSHIBA\TVS\BAK

0 File 0 byte
2 Directory 11.847.585.792 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\PROGRA~1\TOSHIBA\WINDOW~1\BAK

0 File 0 byte
2 Directory 11.847.585.792 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\PROGRA~1\FILECO~1\AHEAD\LIB\BAK

0 File 0 byte
2 Directory 11.847.585.792 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 34BE-6684

Directory di C:\PROGRA~1\INTEL\WIRELESS\BIN\BAK

0 File 0 byte
2 Directory 11.847.585.792 byte disponibili


Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~

531 2 Feb 2008 "C:\Programmi\HP\hpcoretech\data\EvntData-66481975.xml"
324 23 Jan 2008 "C:\Programmi\HP\hpcoretech\bak\data\EvntData-1200357384.xml"


end of report

[ste_95]

Sembra tutto a posto. Hai ancora problemi?

[profiteroles]

si, ho provato a usare nero ed è partito, tutto ok mentre ieri non partiva.

mentre internet explorer ancora non funziona, lo apro, cerca di caricare la home page e si blocca quando arriva all'ultima tacchetta verde in basso (ma la home non compare proprio)



ti ringrazio cmq per la disponibilità

[ste_95]

Prova a utilizzare un browser alternativo

[profiteroles]

tipo?


perchè per ora sembra darmi problemi sono con explorer, il resto sembra funzioni, la connessione internet anche.

e se provo a disinstallare explorer e installare una versione diversa?

[ste_95]

Prova a installare Mozilla Firefox.

[profiteroles]

tutto il resto sembra funzionare, ieri non funzionava nemmeno la funzione "cerca"

[ioSOLOio]