Olimpo Informatico

[Fimony]

Ciao a tutti ...
vi ho trovato nelle ricerca in rete per un rimedio al mio problema.
questo è il mio pc: marca Hyundai sistema Microsoft Windows XP Pro versione 2002 service pack 3 Intel Pentium 4 CPU 3.00GHz 2.99 GHz 1,49 GB di RAM.
Utilizzo due browser chrome ed explorer. Il primo fino ad un mese fa era molto veloce (explorer lentissimo invece) ma adesso o mi apre altre pagine di pubblicità così a caso oppure si spegne con l'immagine "UFFA..." ricarico la pagina e così ho continuato fino ad oggi (faccio presente che l'ho disinstallato e reinstallato più volte). Adesso incredibilmail non si apre così neanche word, excel... Ho fatto varie scansioni con avast (che non trova niente) e con altri programmi installati. Ma la situazione non si risolve. Il pc ogni tanto si spegne da solo e si riavvia. cosa posso fare? Premetto che sono molto scarsa in materia.

Inserisco il log HiJackThis

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16.34.04, on 18/07/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Bonjour\mDNSResponder.exe
C:\Programmi\ewido anti-malware\ewidoctrl.exe
C:\Programmi\ewido anti-malware\ewidoguard.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\FsUsbExService.Exe
C:\Programmi\Logitech\iTouch\iTouch.exe
C:\WINDOWS\LOGI_MWX.EXE
C:\Programmi\File comuni\Java\Java Update\jusched.exe
C:\Programmi\Alwil Software\Avast5\avastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\File comuni\Nero\Lib\NMIndexStoreSvr.exe
C:\Programmi\Samsung\Samsung New PC Studio\NPSAgent.exe
C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
C:\Programmi\Java\jre6\bin\jqs.exe
C:\Programmi\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\CNAC4RPK.EXE
C:\WINDOWS\system32\slrundll.exe
C:\Programmi\File comuni\Nero\Lib\NMIndexingService.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Programmi\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mystart.incredimail.com/?a=13T2RVR2Jix
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: IncrediMail MediaBar 2 Toolbar - {d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} - C:\Programmi\IncrediMail_MediaBar_2\tbIncr.dll (file missing)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programmi\ConduitEngine\ConduitEngine.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: IncrediMail MediaBar 2 Toolbar - {d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} - C:\Programmi\IncrediMail_MediaBar_2\tbIncr.dll (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmi\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: IncrediMail MediaBar 2 Toolbar - {d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} - C:\Programmi\IncrediMail_MediaBar_2\tbIncr.dll (file missing)
O3 - Toolbar: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programmi\ConduitEngine\ConduitEngine.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmi\File comuni\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Programmi\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmi\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] LOGI_MWX.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\File comuni\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [avast] "C:\Programmi\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [AutoStartNPSAgent] C:\Programmi\Samsung\Samsung New PC Studio\NPSAgent.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Programmi\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F7FABAA3-98F1-47DF-A1D8-E25C6F9D56FD}: NameServer = 212.216.112.112,212.216.172.62,151.99.125.2,151.99.250.2
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! Antivirus - AVAST Software - C:\Programmi\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Programmi\Bonjour\mDNSResponder.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programmi\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programmi\ewido anti-malware\ewidoguard.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programmi\File comuni\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FsUsbExService - Teruten - C:\WINDOWS\system32\FsUsbExService.Exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Programmi\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Update Service (gupdate1c98c771bd42b7a) (gupdate1c98c771bd42b7a) - Google Inc. - C:\Programmi\Google\Update\GoogleUpdate.exe
O23 - Service: Servizio Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Programmi\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmi\Java\jre6\bin\jqs.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Programmi\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programmi\File comuni\Nero\Lib\NMIndexingService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

--
End of file - 9229 bytes

Ringrazio in anticipo per l'attenzione e il tempo dedicatomi
grazie

[R16]

Ciao e benvenuta.
Scarica TDSSKiller.zip sul desktop:
link
Estrai i dati in una cartella e fai doppio clik su TDSSKiller.exe
clicca su "Start Scan"
Se trova qualche infezione di default avrai l'opzione "Cure" per cui, clicca su "Continue".
Se un file sospetto viene trovato,l'azione di default sarà skip,clicca su "Continue".
Se è richiesto il riavvio,(Reboot) acconsenti. (per eliminare l'infezione è necessario riavviare il pc)
Se nessun riavvio è richiesto clicca su report e salva il contenuto in un file di testo.
Il log lo trovi in C:\
Postalo qui.

Poi:

Pulisci i files temporanei con CCleaner (registro compreso)
http://forum.zeusnews.com/viewtopic.php?p=282670#282670

Segui questo percorso e svuota la cartella Prefetch : (non eliminare la cartella)
C:\Windows\Prefetch

Svuota il cestino


Scarica e installa la versione Free di SuperAntispyware:
link
lo configuri come da immagini :
http://www.zeusnews.it/zz_upload/img/PSV/SAS/7477731.jpg
http://www.zeusnews.it/zz_upload/img/PSV/SAS/9926902.jpg
Esegui una scansione completa.

Segui le istruzioni di questo topic per usare MBAM: (ricorda di aggiornarlo prima della scansione)
http://forum.zeusnews.com/viewtopic.php?p=297823#297823
Esegui una scansione completa.
Elimina gli eventuali file infetti trovati.

Carica i log di SuperAntispyware, MBAM, TDSSKiller su link e posta il Forum Link che ti viene assegnato.

[Fimony]

grazie tante per la risposta... mi metto all'opera e ti faccio sapere.

grazie ancora.

[Fimony]

intanto ti faccio vedere...
ho scaricato tds e non ha rilevato niente. Ho aggiornato ccleaner (che utilizzo tutti i giorni a fine giornata) e ripulito bene il tutto. ho scaricato superantispyware e ho dovuto eseguire la scansione 4 volte. Le prime due mi si spengeva il pc da solo e non terminava la scansione .
La terza volta ha terminato la scansione completa, ecco il log:


SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 07/19/2011 at 12:06 PM

Application Version : 4.55.1000

Core Rules Database Version : 7421
Trace Rules Database Version: 5233

Scan type : Complete Scan
Total Scan Time : 00:59:21

Memory items scanned : 594
Memory threats detected : 0
Registry items scanned : 9450
Registry threats detected : 1
File items scanned : 40887
File threats detected : 10

Trojan.DNSChanger-Codec
HKU\S-1-5-21-1220945662-1547161642-682003330-1003\Software\fcn

Trojan.Agent/Gen-FakeDrop
C:\CHEF\UNINSTAL.EXE

Adware.Tracking Cookie
wstat.wibiya.com [ C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\Google\Chrome\User Data\Default\Cookies ]
.apmebf.com [ C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\Google\Chrome\User Data\Default\Cookies ]
.mediaplex.com [ C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\Google\Chrome\User Data\Default\Cookies ]
.doubleclick.net [ C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\Google\Chrome\User Data\Default\Cookies ]
.doubleclick.net [ C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\Google\Chrome\User Data\Default\Cookies ]
.invitemedia.com [ C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\Google\Chrome\User Data\Default\Cookies ]
.invitemedia.com [ C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\Google\Chrome\User Data\Default\Cookies ]
ad.yieldmanager.com [ C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\Google\Chrome\User Data\Default\Cookies ]
ad.yieldmanager.com [ C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\Google\Chrome\User Data\Default\Cookies ]

poi ho rifatto un'altra scansione veloce :


SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 07/19/2011 at 01:25 PM

Application Version : 4.55.1000

Core Rules Database Version : 7421
Trace Rules Database Version: 5233

Scan type : Quick Scan
Total Scan Time : 00:11:20

Memory items scanned : 510
Memory threats detected : 0
Registry items scanned : 1684
Registry threats detected : 0
File items scanned : 7233
File threats detected : 13

Adware.Tracking Cookie
.imrworldwide.com [ C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\Google\Chrome\User Data\Default\Cookies ]
.imrworldwide.com [ C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\Google\Chrome\User Data\Default\Cookies ]
.serving-sys.com [ C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\Google\Chrome\User Data\Default\Cookies ]
.serving-sys.com [ C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\Google\Chrome\User Data\Default\Cookies ]
.atdmt.com [ C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\Google\Chrome\User Data\Default\Cookies ]
.atdmt.com [ C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\Google\Chrome\User Data\Default\Cookies ]
.content.yieldmanager.com [ C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\Google\Chrome\User Data\Default\Cookies ]
.adtech.de [ C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\Google\Chrome\User Data\Default\Cookies ]
s14.shinystat.com [ C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\Google\Chrome\User Data\Default\Cookies ]
s14.shinystat.com [ C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\Google\Chrome\User Data\Default\Cookies ]
.shinystat.com [ C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\Google\Chrome\User Data\Default\Cookies ]
.serving-sys.com [ C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\Google\Chrome\User Data\Default\Cookies ]
.serving-sys.com [ C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\Google\Chrome\User Data\Default\Cookies ]

ne ho fatta un'altra e non ha trovato niente.
adesso i programmi di office si aprono bene, chrome ogni tanto mi da la schermata "uffa..." ma il pc mi sembra un pò lentino .

continuo con quello che mi hai detto.

ciao

[Fimony]

ecco i link:
mbam-log-2011-07-19 (15-47-45).txt

SUPERAntiSpyware Scan Log - 07-19-2011 - 12-06-37.log

ciao

[R16]

Ciao.

Disattiva il ripristino configurazione di sistema, e tienilo disattivato, fino alla soluzione del problema.
http://forum.zeusnews.com/viewtopic.php?t=22084

Disattiva il Tea Timer di SpyBot così: (serve solo s creare problemi)

Apri SpyBot in modalità avanzata (menù modalità - avanzata) poi vai in utilità - resident e togli la spunta a TeaTimer, e riavvia il pc.

Poi:
Avvia hijackthis, metti la spunta alle voci che andrò ad elencarti e con tutte le applicazioni chiuse e disconnesso da Internet,premi su "fix checked":

[Fimony]

Ciao
ecco l'ultimo log


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15.08.22, on 21/07/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\FsUsbExService.Exe
C:\Programmi\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\CNAC4RPK.EXE
C:\WINDOWS\system32\slrundll.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Programmi\Logitech\iTouch\iTouch.exe
C:\WINDOWS\LOGI_MWX.EXE
C:\Programmi\Alwil Software\Avast5\avastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\File comuni\Nero\Lib\NMIndexStoreSvr.exe
C:\Programmi\File comuni\Nero\Lib\NMIndexingService.exe
C:\WINDOWS\system32\msiexec.exe
C:\Programmi\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Programmi\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: (no name) - {d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmi\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmi\File comuni\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Programmi\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmi\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] LOGI_MWX.EXE
O4 - HKLM\..\Run: [avast] "C:\Programmi\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [Adobe ARM] "C:\Programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\File comuni\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Programmi\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O17 - HKLM\System\CCS\Services\Tcpip\..\{F7FABAA3-98F1-47DF-A1D8-E25C6F9D56FD}: NameServer = 212.216.112.112,212.216.172.62,151.99.125.2,151.99.250.2
O20 - Winlogon Notify: !SASWinLogon - C:\Programmi\SUPERAntiSpyware\SASWINLO.DLL
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! Antivirus - AVAST Software - C:\Programmi\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Programmi\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programmi\File comuni\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FsUsbExService - Teruten - C:\WINDOWS\system32\FsUsbExService.Exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Programmi\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Update Service (gupdate1c98c771bd42b7a) (gupdate1c98c771bd42b7a) - Google Inc. - C:\Programmi\Google\Update\GoogleUpdate.exe
O23 - Service: Servizio Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Programmi\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmi\Java\jre6\bin\jqs.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Programmi\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programmi\File comuni\Nero\Lib\NMIndexingService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

--
End of file - 7371 bytes

[R16]

Ancora "lentino " il pc?

[Fimony]

guarda, più che lentino è che chrome si blocca spesso e mi da la schermata blu con la scritta uffa... e la mattina prima di far funzionare il pc devo fare come minimo tre riavvii (si accende il pc con la barra bianca in fondo invece che blu. Scusami, spero che tu abbia capito perchè non saprei come spiegartelo se non con una foto ) . Explorer è più lento è per questo che utilizzo chrome.

[Fimony]

aggiornamento:

adesso ho molti problemi con internet: chrome non riesce a stare aperto, ogni pagina che apro mi apre la schermata blu con la scritta uffa e devo ricaricarla così per molte volte e per tutti i siti web. Ho provato ad andare con explorer ma non riesce neanche ad andare sulla home page di google, mi dice "questa pagina è stata recuperata" per due volte e poi sparisce tutto. Che faccio?

[R16]

Ciao.
Segui le istruzioni di questo topic per usare Combofix: ( ricorda di salvarlo sul Desktop)
http://forum.zeusnews.com/viewtopic.php?t=45224
Posta il log.

Se la scansione non parte, fai una scansione con OTL:
http://forum.zeusnews.com/viewtopic.php?t=51382
Posta i 2 log.

[Fimony]

ciao, Combofix non mi si apre.

[R16]

Apri OTL.
Clicca sul pulsante CleanUP.
Il pc dovrebbe riavviarsi, altrimenti riavvialo tu.
Sia Combofix che OTL saranno eliminati.

Riprova la scansione con combofix in questo modo:

Scarica Combofix

link

Rinomina combofix prima di salvarlo sul desktop in abc.exe
Per rinominare il file, quando lo scarichi ti chiede dove salvarlo, e ti compare la casella "nome file" ,basta che cambi il nome che ti appare li in abc.exe)
Una volta scaricato il programma, clicca su start\ esegui nel box bianco copia e incolla questo comando, virgolette comprese:
"%userprofile%\desktop\abc.exe" /killall
Premi OK.
Durante la scansione non usare il pc. (nemmeno il mouse)
Posta il log

Per postare il log:

Collegati ad internet e vai alla pagina WikiSend: link
Clicca sul bottone "Sfoglia"
Seleziona il file appena salvato
Clicca su Upload file
Dopo qualche secondo, vieni spostato su una nuova pagina con il link in diversi formati:
Download Link / Forum Link
Seleziona Forum Link, copialo e incollalo in un nuovo messaggio per il forum.

[Fimony]

aspetta ho visto solo ora che non ti ho inviato il log OTL quello sono riuscita a farlo. Combofix me lo blocca Avast e non lo fa aprire (anche se spunto la casella fonte sicura aprire normalmente)
Ieri ho dovuto installa firefox in quanto explorer non si apre chrome si blocca (addirittura premendo canc o invio).


ecco il log

OTL logfile created on: 22/07/2011 18.48.10 - Run 1
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Documents and Settings\Monica\Documenti\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000410 | Country: Italia | Language: ITA | Date Format: dd/MM/yyyy

1,49 Gb Total Physical Memory | 0,81 Gb Available Physical Memory | 54,49% Memory free
2,83 Gb Paging File | 2,36 Gb Available in Paging File | 83,35% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programmi
Drive C: | 73,24 Gb Total Space | 21,87 Gb Free Space | 29,86% Space Free | Partition Type: NTFS
Drive D: | 75,80 Gb Total Space | 27,71 Gb Free Space | 36,56% Space Free | Partition Type: NTFS

Computer Name: RECEPTION | User Name: Monica | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/07/22 18.47.27 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Monica\Documenti\Downloads\OTL.exe
PRC - [2011/07/09 06.51.19 | 001,012,792 | ---- | M] (Google Inc.) -- C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\Google\Chrome\Application\chrome.exe
PRC - [2011/07/04 13.43.54 | 003,493,720 | ---- | M] (AVAST Software) -- C:\Programmi\Alwil Software\Avast5\AvastUI.exe
PRC - [2011/07/04 13.43.51 | 000,042,184 | ---- | M] (AVAST Software) -- C:\Programmi\Alwil Software\Avast5\AvastSvc.exe
PRC - [2011/04/08 12.59.52 | 000,254,696 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programmi\File comuni\Java\Java Update\jusched.exe
PRC - [2009/03/31 09.39.36 | 000,233,472 | ---- | M] (Teruten) -- C:\WINDOWS\system32\FsUsbExService.Exe
PRC - [2008/04/14 04.14.20 | 000,032,866 | ---- | M] (Smart Link) -- C:\WINDOWS\system32\slrundll.exe
PRC - [2008/04/14 04.14.07 | 001,036,288 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/12/13 20.10.56 | 001,688,872 | ---- | M] (Nero AG) -- C:\Programmi\File comuni\Nero\Lib\NMIndexStoreSvr.exe
PRC - [2007/12/13 20.10.56 | 000,447,784 | ---- | M] (Nero AG) -- C:\Programmi\File comuni\Nero\Lib\NMIndexingService.exe
PRC - [2007/08/09 09.27.52 | 000,073,728 | ---- | M] (HP) -- C:\WINDOWS\system32\HPZipm12.exe
PRC - [2005/09/19 17.00.00 | 000,057,407 | ---- | M] (CANON INC.) -- C:\WINDOWS\system32\CNAC4RPK.EXE
PRC - [2005/02/07 18.42.00 | 000,057,344 | ---- | M] ( ) -- C:\WINDOWS\system32\slserv.exe
PRC - [2003/12/01 11.38.16 | 000,892,928 | ---- | M] (Logitech Inc.) -- C:\Programmi\Logitech\iTouch\iTouch.exe
PRC - [2003/11/07 11.50.00 | 000,019,968 | ---- | M] (Logitech Inc.) -- C:\WINDOWS\LOGI_MWX.EXE


========== Modules (SafeList) ==========

MOD - [2011/07/22 18.47.27 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Monica\Documenti\Downloads\OTL.exe
MOD - [2011/07/04 13.43.51 | 000,199,792 | ---- | M] (AVAST Software) -- C:\Programmi\Alwil Software\Avast5\snxhk.dll
MOD - [2010/08/23 18.12.14 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
MOD - [2003/12/01 11.31.44 | 000,004,608 | ---- | M] (Logitech Inc.) -- C:\Programmi\Logitech\iTouch\itchhk.dll
MOD - [2003/12/01 11.31.42 | 000,114,688 | ---- | M] (Logitech Inc.) -- C:\Programmi\File comuni\Logitech\Scrolling\LGMSGHK.DLL
MOD - [1998/06/12 00.00.00 | 000,014,848 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\MSSCRIT.DLL


========== Win32 Services (SafeList) ==========

SRV - [2011/07/04 13.43.51 | 000,042,184 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Programmi\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2009/03/31 09.39.36 | 000,233,472 | ---- | M] (Teruten) [Auto | Running] -- C:\WINDOWS\system32\FsUsbExService.Exe -- (FsUsbExService)
SRV - [2008/11/18 11.59.48 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Programmi\File comuni\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2008/08/29 10.00.30 | 000,033,752 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Programmi\NOS\bin\getPlus_HelperSvc.exe -- (getPlus(R) Helper) getPlus(R)
SRV - [2007/12/13 20.10.56 | 000,447,784 | ---- | M] (Nero AG) [On_Demand | Running] -- C:\Programmi\File comuni\Nero\Lib\NMIndexingService.exe -- (NMIndexingService)
SRV - [2007/08/09 09.27.52 | 000,073,728 | ---- | M] (HP) [Auto | Running] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)
SRV - [2005/02/07 18.42.00 | 000,057,344 | ---- | M] ( ) [Auto | Running] -- C:\WINDOWS\System32\slserv.exe -- (SLService)
SRV - [2003/07/28 20.28.22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programmi\File comuni\Microsoft Shared\Source Engine\OSE.EXE -- (ose)


========== Driver Services (SafeList) ==========

DRV - [2011/07/12 23.55.22 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programmi\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2011/07/12 23.55.22 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programmi\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2011/07/06 19.52.42 | 000,041,272 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2011/07/04 13.36.43 | 000,441,176 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2011/07/04 13.36.32 | 000,309,848 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2011/07/04 13.35.23 | 000,043,608 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2011/07/04 13.35.12 | 000,102,616 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2011/07/04 13.32.32 | 000,025,432 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2011/07/04 13.32.13 | 000,030,808 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2011/07/04 13.32.12 | 000,019,544 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2009/03/31 09.39.36 | 000,036,608 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\FsUsbExDisk.Sys -- (FsUsbExDisk)
DRV - [2009/03/20 10.01.26 | 000,121,856 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ss_bmdm.sys -- (ss_bmdm)
DRV - [2009/03/20 10.01.26 | 000,090,112 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ss_bbus.sys -- (ss_bbus) SAMSUNG USB Mobile Device (WDM)
DRV - [2009/03/20 10.01.26 | 000,014,976 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ss_bmdfl.sys -- (ss_bmdfl) SAMSUNG USB Mobile Modem (Filter)
DRV - [2005/02/07 18.17.00 | 000,653,008 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SLDRV\slntamr.sys -- (Slntamr)
DRV - [2005/02/07 18.14.00 | 000,014,520 | ---- | M] ( ) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\SLDRV\RecAgent.sys -- (RecAgent)
DRV - [2005/02/07 18.12.00 | 000,229,720 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SLDRV\mtlmnt5.sys -- (Mtlmnt5)
DRV - [2005/02/07 18.07.00 | 000,101,136 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SLDRV\slnthal.sys -- (SlNtHal)
DRV - [2005/02/07 18.05.00 | 001,396,048 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SLDRV\mtlstrm.sys -- (Mtlstrm)
DRV - [2005/02/07 17.55.00 | 000,013,216 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SLDRV\slwdmsup.sys -- (SlWdmSup)
DRV - [2004/09/03 11.31.00 | 000,159,488 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\vinyl97.sys -- (VIAudio) Vinyl AC'97 Audio Controller (WDM)
DRV - [2004/06/19 16.30.28 | 000,190,336 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k)
DRV - [2003/11/09 00.24.17 | 000,012,953 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\itchfltr.sys -- (itchfltr)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1220945662-1547161642-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKU\S-1-5-21-1220945662-1547161642-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKU\S-1-5-21-1220945662-1547161642-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
IE - HKU\S-1-5-21-1220945662-1547161642-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKU\S-1-5-21-1220945662-1547161642-682003330-1003\..\URLSearchHook: {d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-1220945662-1547161642-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1220945662-1547161642-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programmi\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programmi\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Programmi\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programmi\Google\Update\1.3.21.57\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programmi\Google\Update\1.3.21.57\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programmi\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\Google\Update\1.3.21.57\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=8: C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\Google\Update\1.2.183.39\npGoogleOneClick8.dll File not found
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\Google\Update\1.3.21.57\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0.1\extensions\\Components: C:\Programmi\Mozilla Firefox\components [2011/07/22 17.19.16 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0.1\extensions\\Plugins: C:\Programmi\Mozilla Firefox\plugins

[2009/03/06 10.39.16 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Monica\Dati applicazioni\Mozilla\Extensions
[2009/03/06 10.39.16 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Monica\Dati applicazioni\Mozilla\Extensions\home2@tomtom.com
[2011/07/22 17.19.16 | 000,000,000 | ---D | M] (No name found) -- C:\Programmi\Mozilla Firefox\extensions
File not found (No name found) --
[2011/07/21 15.06.55 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMMI\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2009/07/13 14.00.24 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2011/07/08 09.44.14 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Programmi\mozilla firefox\components\browsercomps.dll
[2010/01/01 10.00.00 | 000,002,252 | ---- | M] () -- C:\Programmi\mozilla firefox\searchplugins\bing.xml
[2010/01/01 10.00.00 | 000,000,744 | ---- | M] () -- C:\Programmi\mozilla firefox\searchplugins\eBay-it.xml
[2010/01/01 10.00.00 | 000,000,825 | ---- | M] () -- C:\Programmi\mozilla firefox\searchplugins\hoepli.xml
[2010/01/01 10.00.00 | 000,001,182 | ---- | M] () -- C:\Programmi\mozilla firefox\searchplugins\wikipedia-it.xml
[2010/01/01 10.00.00 | 000,000,953 | ---- | M] () -- C:\Programmi\mozilla firefox\searchplugins\yahoo-it.xml

O1 HOSTS File: ([2007/08/02 14.00.00 | 000,000,768 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O3 - HKU\S-1-5-21-1220945662-1547161642-682003330-1003\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-1220945662-1547161642-682003330-1003\..\Toolbar\WebBrowser: (no name) - {30F9B915-B755-4826-820B-08FBA6BD249D} - No CLSID value found.
O3 - HKU\S-1-5-21-1220945662-1547161642-682003330-1003\..\Toolbar\WebBrowser: (no name) - {D40B90B4-D3B1-4D6B-A5D7-DC041C1B76C0} - No CLSID value found.
O4 - HKLM..\Run: [Adobe ARM] C:\Programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avast] C:\Programmi\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Logitech Utility] C:\WINDOWS\LOGI_MWX.EXE (Logitech Inc.)
O4 - HKLM..\Run: [NBKeyScan] C:\Programmi\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programmi\File comuni\Nero\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [NPSStartup] File not found
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programmi\File comuni\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [zBrowser Launcher] C:\Programmi\Logitech\iTouch\iTouch.exe (Logitech Inc.)
O4 - HKU\.DEFAULT..\Run: [DWQueuedReporting] C:\Programmi\File comuni\Microsoft Shared\DW\DWTRIG20.EXE (Microsoft Corporation)
O4 - HKU\S-1-5-18..\Run: [DWQueuedReporting] C:\Programmi\File comuni\Microsoft Shared\DW\DWTRIG20.EXE (Microsoft Corporation)
O4 - HKU\S-1-5-21-1220945662-1547161642-682003330-1003..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Programmi\File comuni\Nero\Lib\NMIndexStoreSvr.exe (Nero AG)
O4 - HKU\S-1-5-21-1220945662-1547161642-682003330-1003..\Run: [PoService] File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1220945662-1547161642-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1220945662-1547161642-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programmi\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O15 - HKU\S-1-5-21-1220945662-1547161642-682003330-1003\..Trusted Ranges: Range1 ([http] in Local intranet)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.microsoft.com/download/E/3/9/E39C664F-A8E3-4F69-A109-1AE9849204EE/OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programmi\File comuni\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programmi\File comuni\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programmi\File comuni\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Programmi\SUPERAntiSpyware\SASWINLO.DLL - C:\Programmi\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O24 - Desktop Components:0 (Pagina iniziale corrente) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Programmi\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/10/22 10.45.19 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2011/02/12 13.29.40 | 000,000,000 | RHSD | M] - C:\Autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2011/02/12 13.29.40 | 000,000,000 | RHSD | M] - D:\Autorun.inf -- [ NTFS ]
O33 - MountPoints2\{2e0e1ec3-a200-11df-ae9e-00030d22dd9b}\Shell - "" = AutoRun
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/07/22 18.46.37 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2011/07/22 18.46.16 | 000,000,000 | --SD | C] -- C:\ComboFix
[2011/07/22 18.45.42 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/07/22 18.15.12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Monica\Documenti\Download
[2011/07/22 17.19.22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\Mozilla
[2011/07/22 17.19.15 | 000,000,000 | ---D | C] -- C:\Programmi\Mozilla Firefox
[2011/07/21 16.39.03 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Monica\Recent
[2011/07/21 14.23.45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Avvio\Programmi\Spybot - Search & Destroy
[2011/07/19 14.53.16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Monica\Dati applicazioni\Malwarebytes
[2011/07/19 14.53.10 | 000,041,272 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/07/19 14.53.10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Avvio\Programmi\Malwarebytes' Anti-Malware
[2011/07/19 14.53.09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dati applicazioni\Malwarebytes
[2011/07/19 14.53.05 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/07/19 14.53.05 | 000,000,000 | ---D | C] -- C:\Programmi\Malwarebytes' Anti-Malware
[2011/07/19 11.00.47 | 001,436,976 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Monica\Desktop\TDSSKiller.exe
[2011/07/18 18.40.24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Monica\Dati applicazioni\SUPERAntiSpyware.com
[2011/07/18 18.40.24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dati applicazioni\SUPERAntiSpyware.com
[2011/07/18 18.40.14 | 000,000,000 | ---D | C] -- C:\Programmi\SUPERAntiSpyware
[2011/07/18 14.56.12 | 000,000,000 | ---D | C] -- C:\Programmi\ewido anti-malware
[2011/07/18 14.29.24 | 000,000,000 | ---D | C] -- C:\Programmi\Trend Micro
[2011/07/18 14.29.24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Monica\Menu Avvio\Programmi\HiJackThis
[2011/07/18 14.13.28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dati applicazioni\SecTaskMan
[2011/07/18 14.13.25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Avvio\Programmi\Security Task Manager
[2011/07/18 14.13.23 | 000,000,000 | ---D | C] -- C:\Programmi\Security Task Manager
[2011/07/16 13.32.15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Avvio\Programmi\Games
[2011/07/16 13.32.00 | 000,000,000 | ---D | C] -- C:\Programmi\IncrediMail
[2011/07/16 13.26.24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Monica\Menu Avvio\Programmi\Google Chrome
[2011/07/13 10.43.35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Avvio\Programmi\Google Earth
[2011/07/05 16.51.04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Monica\Dati applicazioni\Youtube Downloader HD
[2011/07/05 16.50.52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Avvio\Programmi\Youtube Downloader HD
[2011/07/05 16.50.48 | 000,000,000 | ---D | C] -- C:\Programmi\Youtube Downloader HD
[2011/07/05 16.50.21 | 003,723,717 | ---- | C] (YoutubeDownloaderHD.com ) -- C:\Documents and Settings\Monica\Desktop\youtube_downloader_hd_setup_2.5.exe
[2011/07/01 15.43.00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Monica\Desktop\claudio
[2009/01/30 13.00.10 | 000,018,944 | ---- | C] ( ) -- C:\WINDOWS\System32\gw_shell.dll
[2008/11/18 11.51.06 | 000,014,976 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\winddx.sys
[2008/11/18 11.39.52 | 000,057,344 | ---- | C] ( ) -- C:\WINDOWS\System32\slserv.exe
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/07/22 18.41.00 | 000,001,130 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/07/22 18.30.00 | 000,001,246 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1220945662-1547161642-682003330-1003UA.job
[2011/07/22 17.19.18 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2011/07/22 17.06.02 | 000,013,668 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/07/22 17.05.41 | 000,000,236 | ---- | M] () -- C:\WINDOWS\tasks\OGALogon.job
[2011/07/22 17.05.40 | 000,001,126 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/07/22 17.05.32 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/07/22 13.30.02 | 000,001,194 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1220945662-1547161642-682003330-1003Core.job
[2011/07/22 10.40.21 | 000,002,934 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2011/07/22 10.40.21 | 000,001,664 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2011/07/21 15.07.53 | 000,002,427 | ---- | M] () -- C:\Documents and Settings\Monica\Desktop\HiJackThis.lnk
[2011/07/21 15.00.24 | 000,001,714 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2011/07/21 14.23.45 | 000,000,905 | ---- | M] () -- C:\Documents and Settings\Monica\Desktop\Spybot - Search & Destroy.lnk
[2011/07/20 15.14.37 | 000,114,666 | ---- | M] () -- C:\Documents and Settings\Monica\Desktop\listino-estate.pdf
[2011/07/20 15.06.44 | 002,702,624 | ---- | M] () -- C:\Documents and Settings\Monica\Desktop\_focus giro di campiglio.pdf
[2011/07/20 14.33.57 | 000,699,305 | ---- | M] () -- C:\Documents and Settings\Monica\Desktop\cartinacampiglio2011.pdf
[2011/07/19 14.53.10 | 000,000,756 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/07/19 11.03.21 | 000,000,654 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2011/07/18 18.40.17 | 000,001,642 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011/07/18 11.19.41 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Monica\NETSTAT
[2011/07/18 10.47.16 | 000,000,036 | ---- | M] () -- C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\housecall.guid.cache
[2011/07/18 10.27.23 | 000,000,212 | RHS- | M] () -- C:\boot.ini
[2011/07/18 10.05.18 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2011/07/16 13.32.15 | 000,001,730 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\IncrediMail.lnk
[2011/07/16 13.26.29 | 000,002,347 | ---- | M] () -- C:\Documents and Settings\Monica\Desktop\Google Chrome.lnk
[2011/07/15 11.29.43 | 000,762,780 | ---- | M] () -- C:\Documents and Settings\Monica\Desktop\fattura Tim.pdf
[2011/07/13 10.43.35 | 000,001,887 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2011/07/13 10.16.50 | 001,568,472 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/07/12 17.02.00 | 000,112,640 | ---- | M] () -- C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/07/11 16.58.52 | 001,436,976 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Monica\Desktop\TDSSKiller.exe
[2011/07/06 19.52.42 | 000,041,272 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/07/06 19.52.42 | 000,022,712 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/07/05 16.50.52 | 000,000,800 | ---- | M] () -- C:\Documents and Settings\Monica\Desktop\Youtube Downloader HD.lnk
[2011/07/05 16.50.27 | 003,723,717 | ---- | M] (YoutubeDownloaderHD.com ) -- C:\Documents and Settings\Monica\Desktop\youtube_downloader_hd_setup_2.5.exe
[2011/07/04 13.43.53 | 000,040,112 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2011/07/04 13.43.51 | 000,199,304 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2011/07/04 13.36.43 | 000,441,176 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys
[2011/07/04 13.36.32 | 000,309,848 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2011/07/04 13.35.23 | 000,043,608 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2011/07/04 13.35.12 | 000,102,616 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2011/07/04 13.35.09 | 000,096,344 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2011/07/04 13.32.32 | 000,025,432 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2011/07/04 13.32.13 | 000,030,808 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2011/07/04 13.32.12 | 000,019,544 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2011/06/24 18.24.37 | 000,496,020 | ---- | M] () -- C:\WINDOWS\System32\perfh010.dat
[2011/06/24 18.24.37 | 000,448,210 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/06/24 18.24.37 | 000,087,826 | ---- | M] () -- C:\WINDOWS\System32\perfc010.dat
[2011/06/24 18.24.37 | 000,074,458 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/07/22 17.19.18 | 000,000,702 | ---- | C] () -- C:\Documents and Settings\All Users\Menu Avvio\Programmi\Mozilla Firefox.lnk
[2011/07/22 17.19.18 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2011/07/21 15.00.24 | 000,001,804 | ---- | C] () -- C:\Documents and Settings\All Users\Menu Avvio\Programmi\Adobe Reader X.lnk
[2011/07/21 15.00.24 | 000,001,714 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2011/07/21 14.23.45 | 000,000,905 | ---- | C] () -- C:\Documents and Settings\Monica\Desktop\Spybot - Search & Destroy.lnk
[2011/07/20 15.14.41 | 000,114,666 | ---- | C] () -- C:\Documents and Settings\Monica\Desktop\listino-estate.pdf
[2011/07/20 15.06.44 | 002,702,624 | ---- | C] () -- C:\Documents and Settings\Monica\Desktop\_focus giro di campiglio.pdf
[2011/07/20 14.33.57 | 000,699,305 | ---- | C] () -- C:\Documents and Settings\Monica\Desktop\cartinacampiglio2011.pdf
[2011/07/19 14.53.10 | 000,000,756 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/07/18 18.40.17 | 000,001,642 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011/07/18 14.29.24 | 000,002,427 | ---- | C] () -- C:\Documents and Settings\Monica\Desktop\HiJackThis.lnk
[2011/07/18 11.19.41 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Monica\NETSTAT
[2011/07/18 10.47.16 | 000,000,036 | ---- | C] () -- C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\housecall.guid.cache
[2011/07/16 13.32.15 | 000,001,736 | ---- | C] () -- C:\Documents and Settings\All Users\Menu Avvio\Programmi\IncrediMail.lnk
[2011/07/16 13.32.15 | 000,001,730 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\IncrediMail.lnk
[2011/07/16 13.26.29 | 000,002,347 | ---- | C] () -- C:\Documents and Settings\Monica\Desktop\Google Chrome.lnk
[2011/07/16 13.25.34 | 000,001,246 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1220945662-1547161642-682003330-1003UA.job
[2011/07/16 13.25.34 | 000,001,194 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1220945662-1547161642-682003330-1003Core.job
[2011/07/15 11.29.40 | 000,762,780 | ---- | C] () -- C:\Documents and Settings\Monica\Desktop\fattura Tim.pdf
[2011/07/13 10.43.35 | 000,001,887 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2011/07/05 16.50.52 | 000,000,800 | ---- | C] () -- C:\Documents and Settings\Monica\Desktop\Youtube Downloader HD.lnk
[2011/04/13 18.25.00 | 000,112,515 | ---- | C] () -- C:\WINDOWS\hpoins07.dat
[2011/04/13 18.25.00 | 000,021,124 | ---- | C] () -- C:\WINDOWS\hpomdl07.dat
[2011/04/13 17.28.21 | 000,071,097 | ---- | C] () -- C:\WINDOWS\hpqins09.dat.temp
[2011/03/21 12.45.52 | 000,087,552 | ---- | C] () -- C:\WINDOWS\System32\cpwmon2k.dll
[2011/02/09 15.25.02 | 000,071,122 | ---- | C] () -- C:\WINDOWS\hpqins04.dat.temp
[2011/02/09 15.00.47 | 000,071,097 | ---- | C] () -- C:\WINDOWS\hpqins09.dat
[2011/02/09 15.00.28 | 000,071,076 | ---- | C] () -- C:\WINDOWS\hpqins05.dat.temp
[2011/02/08 18.29.40 | 000,000,135 | ---- | C] () -- C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\fusioncache.dat
[2011/02/08 18.25.46 | 000,071,062 | ---- | C] () -- C:\WINDOWS\hpqins06.dat.temp
[2011/02/08 18.25.17 | 000,071,122 | ---- | C] () -- C:\WINDOWS\hpqins04.dat
[2010/12/03 11.39.24 | 000,000,227 | ---- | C] () -- C:\WINDOWS\HP_CounterReport_Update_HPSU.ini
[2010/09/16 16.41.02 | 000,003,476 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2010/09/15 10.26.18 | 000,071,008 | ---- | C] () -- C:\WINDOWS\hpqins01.dat
[2010/09/15 10.25.03 | 000,071,062 | ---- | C] () -- C:\WINDOWS\hpqins06.dat
[2010/09/15 10.24.19 | 000,071,076 | ---- | C] () -- C:\WINDOWS\hpqins05.dat
[2010/07/28 11.37.41 | 000,240,036 | ---- | C] () -- C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\qbscoxi_nav.dat.vir
[2010/07/28 11.37.41 | 000,004,104 | ---- | C] () -- C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\qbscoxi.dat.vir
[2010/07/28 11.37.41 | 000,003,107 | ---- | C] () -- C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\qbscoxi_navps.dat.vir
[2009/10/02 17.33.17 | 000,000,221 | ---- | C] () -- C:\WINDOWS\NCLogConfig.ini
[2009/08/03 15.07.42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
[2009/08/03 15.07.42 | 000,230,768 | ---- | C] () -- C:\WINDOWS\System32\OGAEXEC.exe
[2009/07/14 16.07.05 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\FsUsbExDevice.Dll
[2009/07/14 16.07.05 | 000,036,608 | ---- | C] () -- C:\WINDOWS\System32\FsUsbExDisk.Sys
[2009/07/14 16.06.55 | 000,002,528 | ---- | C] () -- C:\Documents and Settings\Monica\Dati applicazioni\$_hpcst$.hpc
[2009/05/11 16.59.11 | 000,000,090 | ---- | C] () -- C:\WINDOWS\2pic.ini
[2009/03/12 11.46.26 | 000,303,104 | ---- | C] () -- C:\WINDOWS\Uninstall_tkexe.exe
[2009/03/09 18.08.21 | 000,000,036 | ---- | C] () -- C:\WINDOWS\FINSON.INI
[2009/03/04 18.02.44 | 000,000,099 | ---- | C] () -- C:\WINDOWS\MONAMI3K.INI
[2009/03/04 16.38.45 | 000,001,733 | ---- | C] () -- C:\WINDOWS\Dorea.Ini
[2009/02/27 11.48.23 | 000,000,214 | ---- | C] () -- C:\WINDOWS\HP_48BitScanUpdatePatch.ini
[2009/02/27 11.42.06 | 000,000,221 | ---- | C] () -- C:\WINDOWS\HP_RedboxHprblog_HPSU.ini
[2009/02/21 18.00.50 | 000,002,233 | ---- | C] () -- C:\WINDOWS\RBuilder.ini
[2009/02/21 17.59.25 | 000,001,664 | ---- | C] () -- C:\WINDOWS\OfficineWin.Ini
[2009/02/21 17.59.25 | 000,000,740 | ---- | C] () -- C:\WINDOWS\Officine.Ini
[2009/02/21 17.59.24 | 000,000,099 | ---- | C] () -- C:\WINDOWS\Titano.Ini
[2009/02/21 13.21.28 | 000,002,866 | ---- | C] () -- C:\WINDOWS\System32\RBuilder.ini
[2009/02/21 13.16.29 | 000,000,140 | ---- | C] () -- C:\WINDOWS\reg.ini
[2009/01/30 13.02.13 | 000,000,142 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2009/01/30 13.00.10 | 000,085,451 | ---- | C] () -- C:\WINDOWS\System32\PROTOCOL1.DAT
[2009/01/30 13.00.10 | 000,048,128 | ---- | C] () -- C:\WINDOWS\System32\WRKGADM.EXE
[2009/01/30 13.00.10 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\HLINKPRX.DLL
[2008/11/21 13.24.06 | 000,000,377 | ---- | C] () -- C:\WINDOWS\capture.ini
[2008/11/18 12.56.27 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2008/11/18 11.51.06 | 000,540,672 | ---- | C] () -- C:\WINDOWS\System32\SLLights.dll
[2008/11/18 11.51.06 | 000,380,928 | ---- | C] () -- C:\WINDOWS\System32\slmh.exe
[2008/11/18 11.51.06 | 000,221,184 | ---- | C] () -- C:\WINDOWS\System32\amr_cpl.dll
[2008/11/18 11.51.06 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\minirec.exe
[2008/11/18 11.51.06 | 000,151,552 | ---- | C] () -- C:\WINDOWS\System32\SLMOHServ.dll
[2008/11/18 11.51.06 | 000,077,824 | ---- | C] () -- C:\WINDOWS\SmCfg.exe
[2008/11/18 11.39.52 | 000,212,992 | ---- | C] () -- C:\WINDOWS\System32\slextspk.dll
[2008/11/18 11.39.52 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\SLGen.dll
[2008/11/18 11.39.52 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\slcoinst.dll
[2008/11/18 11.39.52 | 000,036,864 | ---- | C] () -- C:\WINDOWS\slrundll.exe
[2008/11/04 18.46.10 | 000,000,026 | ---- | C] () -- C:\WINDOWS\Viewer.INI
[2008/10/30 18.03.42 | 000,112,640 | ---- | C] () -- C:\Documents and Settings\Monica\Impostazioni locali\Dati applicazioni\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/10/27 13.40.52 | 000,112,515 | ---- | C] () -- C:\WINDOWS\hpoins07.dat.temp
[2008/10/27 13.40.52 | 000,021,124 | ---- | C] () -- C:\WINDOWS\hpomdl07.dat.temp
[2008/10/22 13.34.05 | 000,006,550 | ---- | C] () -- C:\WINDOWS\jautoexp.dat
[2008/10/22 12.33.08 | 000,004,346 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2008/10/22 12.31.51 | 001,568,472 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2008/10/22 11.26.44 | 000,676,224 | ---- | C] () -- C:\WINDOWS\System32\ogacheckcontrol.dll.bak
[2008/10/22 11.25.00 | 000,000,958 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2008/10/22 11.13.45 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4764.dll
[2008/10/22 11.04.57 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\UnAudioNT.dll
[2008/10/22 10.47.40 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2008/10/22 10.42.29 | 000,021,840 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2007/10/25 17.26.10 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
[2007/08/02 14.00.00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2007/08/02 14.00.00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2007/08/02 14.00.00 | 000,496,020 | ---- | C] () -- C:\WINDOWS\System32\perfh010.dat
[2007/08/02 14.00.00 | 000,448,210 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2007/08/02 14.00.00 | 000,300,212 | ---- | C] () -- C:\WINDOWS\System32\perfi010.dat
[2007/08/02 14.00.00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2007/08/02 14.00.00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2007/08/02 14.00.00 | 000,087,826 | ---- | C] () -- C:\WINDOWS\System32\perfc010.dat
[2007/08/02 14.00.00 | 000,074,458 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2007/08/02 14.00.00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2007/08/02 14.00.00 | 000,034,004 | ---- | C] () -- C:\WINDOWS\System32\perfd010.dat
[2007/08/02 14.00.00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2007/08/02 14.00.00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2007/08/02 14.00.00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2007/08/02 14.00.00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2007/08/02 14.00.00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2007/08/02 14.00.00 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\ufat.dll
[2007/08/02 14.00.00 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\typeperf.exe
[2004/06/09 22.38.01 | 000,184,320 | ---- | C] () -- C:\WINDOWS\System32\JPeg32.dll
[2003/04/01 11.49.16 | 000,005,360 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2001/07/06 16.30.02 | 000,003,267 | ---- | C] () -- C:\WINDOWS\System32\HPTCPMON.INI

========== LOP Check ==========

[2010/07/06 10.15.08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dati applicazioni\Alwil Software
[2009/05/11 09.35.35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dati applicazioni\ashampoo
[2008/10/22 13.08.19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dati applicazioni\IM
[2008/10/22 13.07.33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dati applicazioni\IncrediMail
[2009/07/14 16.14.33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dati applicazioni\PC Suite
[2011/01/07 11.26.10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dati applicazioni\Photo Notifier and Animation Creator
[2011/07/18 14.29.55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dati applicazioni\SecTaskMan
[2010/08/04 17.41.48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dati applicazioni\TEMP
[2009/05/11 09.35.39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Monica\Dati applicazioni\Ashampoo
[2010/08/13 18.34.43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Monica\Dati applicazioni\Audacity
[2009/02/26 16.03.29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Monica\Dati applicazioni\EssentialPIM
[2010/08/06 18.27.18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Monica\Dati applicazioni\FileMaker
[2008/11/06 13.23.22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Monica\Dati applicazioni\GARMIN
[2010/12/01 19.48.59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Monica\Dati applicazioni\GetRightToGo
[2011/04/13 17.28.49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Monica\Dati applicazioni\Image Zone Express
[2011/02/12 18.50.04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Monica\Dati applicazioni\IObit
[2009/03/12 12.03.07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Monica\Dati applicazioni\MiCla
[2009/03/06 13.46.42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Monica\Dati applicazioni\mojosoft
[2011/05/25 10.13.13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Monica\Dati applicazioni\OfferBox
[2008/12/20 17.11.09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Monica\Dati applicazioni\OpenOffice.org
[2009/07/14 16.14.32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Monica\Dati applicazioni\PC Suite
[2010/08/06 18.08.19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Monica\Dati applicazioni\Ricette
[2009/07/14 16.06.53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Monica\Dati applicazioni\Samsung
[2009/02/21 13.16.30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Monica\Dati applicazioni\Titano
[2009/03/06 10.39.14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Monica\Dati applicazioni\TomTom
[2011/02/12 13.24.59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Monica\Dati applicazioni\uTorrent
[2011/07/09 15.39.47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Monica\Dati applicazioni\Youtube Downloader HD
[2011/07/22 17.05.41 | 000,000,236 | ---- | M] () -- C:\WINDOWS\Tasks\OGALogon.job

========== Purity Check ==========



< End of report >

grazie per la pazienza.

[R16]

Ciao Fimony.
Io ho tutta la pazienza che vuoi.
Però ti avevo anche indicato COME postare i log.
Se metti i log direttamente sul forum, il topic verrà intasato.

[Fimony]

scusami non avevo capito niente, pensavo fosse la procedura del momento (come ti ho accennato sono molto scarsa) spero di non aver fatto molto danno adesso provo a disattivare avast e ti posto il log dove mi hai detto

[Fimony]

ecco il log combofix

ComboFix.txt
considera che è tutto il pomeriggio che provo a fare la scansione e si è interrotto una decina di volte con questi errori:

si è verificato un errore in grep.cfxxe l'applicazione verrà chiusa poi stesso messaggio con errore pev.cfxxe poi catchme.cfxxe non so se ti interessa saperlo.

ciao e buon fine settimana.
P.S. la pagina uffa per ora non mi si è ripresentata sembra ok per ora.

[Fimony]

P.S. la pagina uffa per ora non mi si è ripresentata sembra ok per ora.[/quote]

l'ho detto troppo presto, comunque non come prima !

[R16]

Disistalla SpyBot.

Non hai scaricato Combofix, sul DESKTOP come ho indicato.
E il log non è completo.

Adesso trascina l'icona di Combofix (quella a forma di testa di leone) sul DESKTOP.

Poi:

Apri un file di testo con il Block Note sul Desktop
Ci incolli il codice che vedi qui sotto, e salvi il file di testo obbligatoriamente con il nome CFScript.txt

[Fimony]

aspetta ti scrivo quello che faccio passo passo perchè combofix non mi va.
allora scarico il programma dai due link che mi hai postato o dal link ultimo che mi hai messo (li ho provati tutti e tre a rotazione per non so quante volte). Li apro con Chrome in quanto explorer non si apre più (ah cosa strana stamani mi sono ritrovata con due icone di explorer così appena acceso il pc) Chrome apre i programmi in una cartella Downloads. Quindi Start Documenti downloads e arrivo al programma scaricato. Lo trascino sul desktop come mi hai detto. disattivo avast e ok faccio partire il programma. qui il dramma: o si spegne il pc e quando si riavvia combofix non è più utilizzabile (lo tolgo tutte le volte con il tasto Cleanup di OTL) oppure non termina la scansione fermandosi al System infected in C:\\WINDOWS|system32\user32.dll oppure winlogon.exe.
Rifaccio la procedura da capo. riavvio il programma e o si blocca con vari messaggi errore in grep.exe e spariscono le icone sul desktop il pc si spegne e fa il controllo del disco C, quando ha terminato e il pc si riavvia il programma è sparito. rifaccio la procedura come mi hai suggerito l'ultima volta copio sul block quello che mi hai scritto e trascino CFScript.exe su combofix la scansione parte ma appena inizia a lavorare appare il messaggio di errore applicatioon corrupt e tutto si ferma.
sbaglio in qualcosa? oppure devo cestinare il pc (perchè sono molto tentata!!)