Olimpo Informatico

[MasterDdj]

Ok.dopo la prima volta mi ha dato questi:

Direct Link: http://www.freefilehosting.net/download/MTIzOA==

HTML Code: <a href="http://www.freefilehosting.net/files/MTIzOA==">Nuovo Documento di testo.txt</a>

Forum Link: [URL="http://www.freefilehosting.net/files/MTIzOA=="]Nuovo Documento di testo.txt[/URL]

La seconda volta mi ha dato questi:

Direct Link: http://www.freefilehosting.net/download/MTI0Mg==

HTML Code: <a href="http://www.freefilehosting.net/files/MTI0Mg==">Nuovo Documento di testo (3).txt</a>

Forum Link: [URL="http://www.freefilehosting.net/files/MTI0Mg=="]Nuovo Documento di testo (3).txt[/URL]

[bdoriano]

Avvia AVENGER
Clicca su input script manually
Clicca sulla lente d'ingrandimento
Inserisci queste righe:

[MasterDdj]

ok.Questo è il log di hijackthis.Ora faccio la scansione online con kaspersky.Poi ti dico.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13.50.23, on 14/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\windows\system32\winlogon.exe
C:\WINDOWS\ATKKBService.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Programmi\File comuni\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Programmi\File comuni\Softwin\BitDefender Scan Server\bdss.exe
C:\Programmi\File comuni\Softwin\BitDefender Update Service\livesrv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programmi\QuickTime\qttask.exe
C:\Programmi\iTunes\iTunesHelper.exe
C:\Programmi\Softwin\BitDefender10\bdmcon.exe
C:\Programmi\Softwin\BitDefender10\bdagent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\MSN Messenger\MsnMsgr.Exe
C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Programmi\Alice ti aiuta\bin\mpbtn.exe
C:\Programmi\Softwin\BitDefender10\vsserv.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
D:\hjt\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {323E945D-299A-400A-A874-11A10696B4EC} - c:\windows\system32\dazgfuik.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Encarta Web Companion Oggetto helper - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Programmi\File comuni\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O2 - BHO: (no name) - {B2C447B0-11E6-4E5F-9B60-1BD986E888C8} - c:\windows\system32\mafbmaf.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Encarta Web Companion - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Programmi\File comuni\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programmi\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BDMCon] "C:\Programmi\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Programmi\Softwin\BitDefender10\bdagent.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Alice ti aiuta.lnk = C:\Programmi\Alice ti aiuta\bin\matcli.exe
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BlueSoleil.lnk = D:\BlueSoleil.exe
O4 - Global Startup: Tasto di scelta rapida per l'avvio di AutoCAD.lnk = C:\Programmi\File comuni\Autodesk Shared\acstart16.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Programmi\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Aggiungi all'elenco di stampa Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Anteprima Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Apri in nuova scheda in primo piano - res://C:\Programmi\Windows Live Toolbar\Components\it-it\msntabres.dll.mui/230?a334552ccaa9449bbfa7a47275b7054c
O8 - Extra context menu item: Apri in nuova scheda in secondo piano - res://C:\Programmi\Windows Live Toolbar\Components\it-it\msntabres.dll.mui/229?a334552ccaa9449bbfa7a47275b7054c
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Stampa ad alta velocità Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Stampa Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programmi\File comuni\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: Yahoo! Chess - http://download2.games.yahoo.com/games/clients/y/ct5_x.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1183657730609
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1183657677718
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O20 - Winlogon Notify: igpopqil - C:\WINDOWS\SYSTEM32\mafbmaf.dll
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Programmi\File comuni\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Programmi\File comuni\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - D:\BTNtService.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Programmi\File comuni\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Telefonia TapiSrv Hid Service (TapiSrv Hid Service) - Unknown owner - C:\WINDOWS\system32\AcSignExtResx.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Programmi\Softwin\BitDefender10\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Programmi\File comuni\Softwin\BitDefender Communicator\xcommsvr.exe

--
End of file - 8313 bytes

[bdoriano]

Mi serve vedere anche il log generato da avenger.
E comunque:

[MasterDdj]

ok.questo è il log di avenger:

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\jvlmrtka

*******************

Script file located at: \??\C:\WINDOWS\system32\oegfdsot.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\TEMP\zzaqkb.exe deleted successfully.
File c:\windows\system32\dazgfuik.dll deleted successfully.


Could not open file c:\windows\system32\mafbmaf.dll for deletion
Deletion of file c:\windows\system32\mafbmaf.dll failed!

Could not process line:
c:\windows\system32\mafbmaf.dll
Status: 0xc0000022



Could not open registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B2C447B0-11E6-4E5F-9B60-1BD986E888C8} for deletion
Deletion of registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B2C447B0-11E6-4E5F-9B60-1BD986E888C8} failed!
Status: 0xc0000022



Could not open registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igpopqil for deletion
Deletion of registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igpopqil failed!
Status: 0xc0000022


Completed script processing.

*******************

Finished! Terminate.

[MasterDdj]

questi sono i link dopo la scansione online con kaspersky:

Direct Link: http://www.freefilehosting.net/download/MTI5Mw==

HTML Code: <a href="http://www.freefilehosting.net/files/MTI5Mw==">kaspersky.html</a>

Forum Link: [URL="http://www.freefilehosting.net/files/MTI5Mw=="]kaspersky.html[/URL]

[MasterDdj]

Solo una cosa:

Citazione:
O2 - BHO: (no name) - {323E945D-299A-400A-A874-11A10696B4EC} - c:\windows\system32\dazgfuik.dll (file missing)
O2 - BHO: (no name) - {B2C447B0-11E6-4E5F-9B60-1BD986E888C8} - c:\windows\system32\mafbmaf.dll
O20 - Winlogon Notify: igpopqil - C:\WINDOWS\SYSTEM32\mafbmaf.d

Di questi file devo fare fix checked con hijackthis?

[bdoriano]

Orpo!
Di animaletti ce n'è più di quanti me ne aspettassi!

Disabilita il ripristino di sistema

Avvia AVENGER
Clicca su input script manually
Clicca sulla lente d'ingrandimento
Inserisci queste righe:

[MasterDdj]

ma le voci da fixare con hijackthis devo solo farlo in modalità provvissoria?

[MasterDdj]

Log di avenger:

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\hfnsymdw

*******************

Script file located at: \??\C:\Program Files\lankciku.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\Documents and Settings\Utente\Dati applicazioni\errorsafeitaliannewreleaseinstall[1].exe deleted successfully.
File C:\Documents and Settings\Utente\Impostazioni locali\Temp\Temporary Internet Files\Content.IE5\7VCWEUVN\11679-23[1].exe deleted successfully.
File C:\Documents and Settings\Utente\Impostazioni locali\Temp\vojdk.exe deleted successfully.
File C:\Documents and Settings\Utente\Impostazioni locali\Temp\~wa6psetup.exe deleted successfully.
File C:\Documents and Settings\Utente\Impostazioni locali\Temp\Temporary Internet Files\Content.IE5\4T67W9YV\index[3].htm deleted successfully.
File C:\Documents and Settings\Utente\Impostazioni locali\Temp\Temporary Internet Files\Content.IE5\4T67W9YV\index[4].htm deleted successfully.
File C:\Documents and Settings\Utente\Impostazioni locali\Temp\Temporary Internet Files\Content.IE5\4T67W9YV\movie[1].qtl deleted successfully.


File C:\Documents and Settings\Utente\Impostazioni locali\Temp\Temporary Internet Files\Content.IE5\7VCWEUVN\11679-23[1].exe not found!
Deletion of file C:\Documents and Settings\Utente\Impostazioni locali\Temp\Temporary Internet Files\Content.IE5\7VCWEUVN\11679-23[1].exe failed!

Could not process line:
C:\Documents and Settings\Utente\Impostazioni locali\Temp\Temporary Internet Files\Content.IE5\7VCWEUVN\11679-23[1].exe
Status: 0xc0000034

File C:\Documents and Settings\Utente\Impostazioni locali\Temporary Internet Files\Content.IE5\O9A3SPMN\riff_last[1].bin deleted successfully.
File C:\Documents and Settings\Utente\Impostazioni locali\Temporary Internet Files\Content.IE5\OD2NGDEZ\riff_last[1].bin deleted successfully.
File C:\Documents and Settings\Utente\Impostazioni locali\Temporary Internet Files\Content.IE5\OD2NGDEZ\riff_last[2].bin deleted successfully.
File C:\Documents and Settings\Utente\Impostazioni locali\Temporary Internet Files\Content.IE5\ORZJY81T\riff_last[1].bin deleted successfully.
File C:\Documents and Settings\Utente\Impostazioni locali\Temporary Internet Files\Content.IE5\VNPZFXOW\riff_last[1].bin deleted successfully.
File C:\Documents and Settings\Utente\Impostazioni locali\Temporary Internet Files\Content.IE5\WLQN0TQB\riff_last[1].bin deleted successfully.
File C:\Documents and Settings\Utente\Impostazioni locali\Temporary Internet Files\Content.IE5\WLQN0TQB\riff_last[2].bin deleted successfully.
File C:\Documents and Settings\Utente\Impostazioni locali\Temporary Internet Files\Content.IE5\XKPCHVQM\gvhuzg[1].ani deleted successfully.
File C:\Documents and Settings\Utente\Impostazioni locali\Temporary Internet Files\Content.IE5\XSVF7TSK\11679-23[1].exe deleted successfully.
File C:\Documents and Settings\Utente\Impostazioni locali\Temporary Internet Files\Content.IE5\XSVF7TSK\gvhuzg[1].ani deleted successfully.
File C:\WINDOWS\08w1lt8o.exe deleted successfully.
File C:\WINDOWS\14bvx5b8.exe deleted successfully.
File C:\WINDOWS\4go08xm8.exe deleted successfully.
File C:\WINDOWS\Downloaded Program Files\ciuccia.exe deleted successfully.
File C:\WINDOWS\svchost.dll deleted successfully.
File C:\WINDOWS\system32\cmss.exe deleted successfully.
File C:\WINDOWS\system32\gdbirftr.dll.bak deleted successfully.


Could not open file C:\WINDOWS\system32\mafbmaf.dll.bak for deletion
Deletion of file C:\WINDOWS\system32\mafbmaf.dll.bak failed!

Could not process line:
C:\WINDOWS\system32\mafbmaf.dll.bak
Status: 0xc0000022

File C:\WINDOWS\system32\msboot.exe deleted successfully.
File C:\WINDOWS\system32\peltdfln.dll deleted successfully.
File C:\WINDOWS\system32\syakjjah.dll deleted successfully.
File C:\WINDOWS\system32\~.exe deleted successfully.
File C:\WINDOWS\ucdhctzb.exe deleted successfully.
File C:\WINDOWS\x67mho0q.exe deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

[MasterDdj]

Log di Hijack this:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16.56.54, on 14/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\windows\system32\winlogon.exe
C:\WINDOWS\ATKKBService.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\File comuni\Softwin\BitDefender Communicator\xcommsvr.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\File comuni\Softwin\BitDefender Update Service\livesrv.exe
C:\Programmi\iTunes\iTunesHelper.exe
C:\Programmi\Softwin\BitDefender10\bdmcon.exe
C:\Programmi\Softwin\BitDefender10\bdagent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Alice ti aiuta\bin\mpbtn.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\Programmi\File comuni\Softwin\BitDefender Scan Server\bdss.exe
C:\Programmi\Softwin\BitDefender10\vsserv.exe
D:\hjt\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Encarta Web Companion Oggetto helper - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Programmi\File comuni\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O2 - BHO: (no name) - {B2C447B0-11E6-4E5F-9B60-1BD986E888C8} - c:\windows\system32\mafbmaf.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Encarta Web Companion - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Programmi\File comuni\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programmi\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BDMCon] "C:\Programmi\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Programmi\Softwin\BitDefender10\bdagent.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Alice ti aiuta.lnk = C:\Programmi\Alice ti aiuta\bin\matcli.exe
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BlueSoleil.lnk = D:\BlueSoleil.exe
O4 - Global Startup: Tasto di scelta rapida per l'avvio di AutoCAD.lnk = C:\Programmi\File comuni\Autodesk Shared\acstart16.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Programmi\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Aggiungi all'elenco di stampa Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Anteprima Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Apri in nuova scheda in primo piano - res://C:\Programmi\Windows Live Toolbar\Components\it-it\msntabres.dll.mui/230?a334552ccaa9449bbfa7a47275b7054c
O8 - Extra context menu item: Apri in nuova scheda in secondo piano - res://C:\Programmi\Windows Live Toolbar\Components\it-it\msntabres.dll.mui/229?a334552ccaa9449bbfa7a47275b7054c
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Stampa ad alta velocità Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Stampa Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programmi\File comuni\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: Yahoo! Chess - http://download2.games.yahoo.com/games/clients/y/ct5_x.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1183657730609
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1183657677718
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O20 - Winlogon Notify: igpopqil - C:\WINDOWS\SYSTEM32\mafbmaf.dll
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Programmi\File comuni\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Programmi\File comuni\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - D:\BTNtService.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Programmi\File comuni\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Telefonia TapiSrv Hid Service (TapiSrv Hid Service) - Unknown owner - C:\WINDOWS\system32\AcSignExtResx.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Programmi\Softwin\BitDefender10\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Programmi\File comuni\Softwin\BitDefender Communicator\xcommsvr.exe

--
End of file - 8064 bytes

[MasterDdj]

Ho notato che quando faccio fixchecked su questo file:

O2 - BHO: (no name) - {B2C447B0-11E6-4E5F-9B60-1BD986E888C8} - c:\windows\system32\mafbmaf.dll

non me lo elimina perchè dice che è un file di sistema...mi è sembrato di capire.Infatti nei log successivi compare sempre.

[bdoriano]

Hai fatto queste operazioni?

[MasterDdj]

Dove mi hai detto Clicca qui mi collega al sito suspectfile,ma non mi fa scaricare il file.Mi esce una nota con scritto warning!

[Orange]

Niente di grave
prova cliccare sul link tenendo premuto il tasto CTRL.

[MasterDdj]

Ecco il link:

Direct Link: http://www.freefilehosting.net/download/MjQyMA==

HTML Code: <a href="http://www.freefilehosting.net/files/MjQyMA==">report3.txt</a>

Forum Link [URL="http://www.freefilehosting.net/files/MjQyMA=="]report3.txt[/URL]

[Orange]

ufff...
con Systemscan si vedono molti processi, ma interpretarlo....

qui c'è lo script per Avenger (spero di non aver dimenticato nulla... ):

[bdoriano]

Solo qualche modifica:

[MasterDdj]

Ho usato avenger.Ho inserito quelle voci ma mi ha dato alcuni errori prima di confermarmi il processo.Poi ha fatto tutto.Devo fare il log con hijackthis?

[MasterDdj]

Inoltre Avenger non mi ha generato un log.Non ho capito il perchè.