Olimpo Informatico

[Lorhaf]

Ciao a tutti, e' qualche giorno ke ho riscontrato un problema con un virus;
ovvero quasi tutte le volte ke apro una pagina internet o un qualsiasi programma mi si apre una schermata di AVG e mi dice le seguenti problematiche dice ke ha trovato un virus:

While opening file: C:\WINDOWS\system32\efsadus.dll
Virus identified Obfustat.ADMO


Se gli dico di curare il sistema mi kiede il riavvio , e dopo averlo fatto e' tutto come prima, se faccio move to vault mi chiede la conferma e il riavvio ma appena riacceso il pc nn e' cambiato nulla...


Ho provato a far girare anke l'antispyware di avg e programmi vari per dialer trojan e simili ma nulla...

Di seguito posto un log di Hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16.30.33, on 09/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programmi\Java\jre1.6.0_02\bin\jusched.exe
C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\Programmi\Alice ti aiuta\bin\mpbtn.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\internet explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Lorhaf\Desktop\hijack\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5D8F3D03-CCDB-4E25-B95E-8D8B689E372F} - c:\windows\system32\efsadus.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_02\bin\ssv.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [y51qsc5euqef] C:\WINDOWS\system32\y51qsc5euqef.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [y51qsc5euqef] C:\WINDOWS\system32\y51qsc5euqef.exe
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Alice ti aiuta.lnk = C:\Programmi\Alice ti aiuta\bin\matcli.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} (GameDesire Poker Games) - http://194.244.16.123/g_bin/eng/poker_2_0_0_48.cab
O16 - DPF: {9085316E-42BA-11D4-BAA3-0080C8D7ED4A} (GameDesire JungleHunter) - http://194.244.16.123/g_bin/eng/hunter_2_0_0_27.cab
O16 - DPF: {BFA1F11D-3121-AFE1-4112-983219421AEF} (GameDesire 1Player Word Games) - http://194.244.16.123/g_bin/eng/wordssingle_2_0_0_48.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game03.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.fueps.com/gp/resources/games/puzzle/PopCapGames/popcaploader_v10.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{23E82070-7BC4-479F-9D32-63DDF69C2BCB}: NameServer = 213.140.2.12,213.140.2.21
O17 - HKLM\System\CCS\Services\Tcpip\..\{FB8AD34F-204F-485E-9CA2-A2FA3D9E34FA}: NameServer = 85.37.17.13 85.38.28.81
O17 - HKLM\System\CS1\Services\Tcpip\..\{23E82070-7BC4-479F-9D32-63DDF69C2BCB}: NameServer = 213.140.2.12,213.140.2.21
O17 - HKLM\System\CS2\Services\Tcpip\..\{23E82070-7BC4-479F-9D32-63DDF69C2BCB}: NameServer = 213.140.2.12,213.140.2.21
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: lejdvvxq - C:\WINDOWS\SYSTEM32\efsadus.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 7059 bytes


Grazie in anticipo Lorhaf

[Orange]

Benvenuto

E' Vundo il tuo problemino. Segui per favore queste indicazioni e posta i log richiesti.

[Lorhaf]

ciao orange , c'e' un problema Vundofix nn riesco a scaricarlo mi dice pagina non trovata

[bdoriano]

Ciao Lorhaf,

ritenta, magari sei più fortunato. Se anche uno dei files non riuscissi a scaricarlo, procedi con le altre operazioni, ok?
Ti riporto qui tutti i passaggi da fare:

• Scarica VundoFix e VirtumundoBegone e salvali sul desktop.
  
• Avvia VundoFix
  Seleziona Scan for Vundo e a scansione terminata scegli Remove Vundo.
  Clicca Yes e alla richiesta di riavviare il Pc rispondi Ok.
  Al riavvio dovrebbe comparire il blocco-note con dentro il log, copia e posta sul forum il contenuto.
  
• Ora avvia in modalità provvisoria
  Avvia VirtumundoBeGone e segui le indicazioni a video.
  riavvia il Pc in modalità normale e posta il log.
  
• Segui le istruzioni di questo topic per postare il log di combofix.
  
• Fai anche un nuovo log di HijackThis e mettilo qui.

[Lorhaf]

rieccomi scusate l'assenza ma mi e' toccato formattare tutto... si era inchiodato il pc e nn c'era + verso ne di connettermi ne di poter aprir nessuan finestra, ora ho un altro problema, ogni tanto mi appare quest'errore di windows: Generic host process for win32 services , mi casca la connessione e devo riavviare il pc x riattivarla... ke faccio? cmq vi posto di seguito uno scan con hjiackthis...


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13.20.51, on 11/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\RunDll32.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\ALICET~1\SMARTB~1\MotiveSB.exe
C:\Programmi\Alice ti aiuta\vendors\AliceRE\content\template\driven_dev\syncer\McciTrayApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe
C:\Programmi\Google\Google Updater\GoogleUpdater.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Programmi\Alice ti aiuta\bin\mpbtn.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\File comuni\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\ALICET~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [AliceRE_McciTrayApp] C:\Programmi\Alice ti aiuta\vendors\AliceRE\content\template\driven_dev\syncer\McciTrayApp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Alice ti aiuta.lnk = C:\Programmi\Alice ti aiuta\bin\matcli.exe
O4 - Global Startup: Google Updater.lnk = C:\Programmi\Google\Google Updater\GoogleUpdater.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1200050237687
O17 - HKLM\System\CCS\Services\Tcpip\..\{767FA085-891B-4B82-8B3E-2FCD83AC6C79}: NameServer = 85.37.17.13 85.38.28.81
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe

--
End of file - 5076 bytes

[bdoriano]

Il log di hijackthis sembra ok.

Segui le istruzioni di questo topic per postare il log di combofix.

[Lorhaf]

ecco il log di combo fix:

ComboFix 08-01-09.2 - Mosquito 2008-01-12 1.54.15.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1040.18.1620 [GMT 1:00]
Eseguito da: C:\Documents and Settings\Mosquito\Desktop\ComboFix.exe
* Creato nuovo punto di ripristino
.

((((((((((((((((((((((((( Files Creati Da 2007-12-12 al 2008-01-12 )))))))))))))))))))))))))))))))))))
.

2008-01-12 01:53 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-11 15:16 . 2006-09-05 17:03 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-01-11 14:34 . 2008-01-11 14:34 <DIR> d-------- C:\Documents and Settings\Mosquito\Dati applicazioni\vlc
2008-01-11 13:20 . 2008-01-11 13:20 <DIR> d-------- C:\Programmi\Trend Micro
2008-01-11 13:03 . 2008-01-11 13:07 <DIR> d--hsc--- C:\Programmi\File comuni\WindowsLiveInstaller
2008-01-11 13:02 . 2008-01-11 13:09 <DIR> d-------- C:\Programmi\Windows Live
2008-01-11 13:02 . 2008-01-11 13:02 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\WLInstaller
2008-01-11 12:53 . 2008-01-11 12:53 <DIR> d-------- C:\Documents and Settings\Mosquito\Contacts
2008-01-11 12:52 . 2008-01-11 12:52 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-01-11 12:18 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll
2008-01-11 12:18 . 2007-07-30 19:19 38,232 --a------ C:\WINDOWS\system32\wucltui.dll.mui
2008-01-11 12:18 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
2008-01-11 12:18 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2008-01-11 12:18 . 2007-07-30 19:18 21,336 --a------ C:\WINDOWS\system32\wuaueng.dll.mui
2008-01-11 12:05 . 2008-01-11 12:05 <DIR> d-------- C:\Programmi\Google
2008-01-11 12:05 . 2008-01-11 12:05 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Google Updater
2008-01-11 11:58 . 2008-01-11 11:58 <DIR> d-------- C:\Programmi\File comuni\Motive
2008-01-11 11:58 . 2008-01-11 11:58 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Motive
2008-01-11 11:38 . 2008-01-11 13:24 <DIR> d-------- C:\Programmi\MobMapUpdater
2008-01-11 11:36 . 2008-01-11 11:36 <DIR> d-------- C:\Documents and Settings\Mosquito\Dati applicazioni\teamspeak2
2008-01-11 11:35 . 2008-01-11 11:36 <DIR> d-------- C:\Programmi\Teamspeak2_RC2
2008-01-11 11:35 . 2008-01-11 11:35 34,064 --a------ C:\WINDOWS\system32\lhacm.acm
2008-01-11 11:31 . 2008-01-11 11:31 <DIR> d-------- C:\Programmi\VideoLAN
2008-01-10 19:40 . 2008-01-11 14:58 <DIR> d-------- C:\Documents and Settings\Mosquito\Dati applicazioni\AVG7
2008-01-10 19:39 . 2008-01-10 19:39 <DIR> d-------- C:\Documents and Settings\LocalService\Dati applicazioni\AVG7
2008-01-10 19:39 . 2008-01-12 01:49 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Grisoft
2008-01-10 19:39 . 2008-01-11 14:58 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\avg7
2008-01-10 19:39 . 2008-01-10 19:39 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2008-01-10 19:39 . 2008-01-10 19:39 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
2008-01-10 19:29 . 2008-01-10 19:38 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Spybot - Search & Destroy
2008-01-10 19:29 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2008-01-10 19:27 . 2008-01-10 19:27 <DIR> d-------- C:\Programmi\Lavasoft
2008-01-10 19:27 . 2008-01-10 19:27 <DIR> d-------- C:\Programmi\File comuni\Wise Installation Wizard
2008-01-10 19:27 . 2008-01-10 19:27 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Lavasoft
2008-01-10 19:19 . 2008-01-10 19:19 <DIR> d---s---- C:\Documents and Settings\Mosquito\UserData
2008-01-10 19:12 . 2008-01-10 19:12 <DIR> d-------- C:\Documents and Settings\Mosquito\Dati applicazioni\Motive
2008-01-10 19:08 . 2008-01-10 19:08 <DIR> d-------- C:\Programmi\Pirelli
2008-01-10 19:08 . 2008-01-10 19:08 <DIR> d-------- C:\Documents and Settings\LocalService\Menu Avvio
2008-01-10 19:08 . 2004-10-05 17:41 52,864 --a------ C:\WINDOWS\system32\drivers\CnxTrUsb.sys
2008-01-10 19:08 . 2004-10-05 17:41 25,984 --a------ C:\WINDOWS\system32\drivers\CnxTrLan.sys
2008-01-10 19:06 . 2008-01-11 11:57 <DIR> d-------- C:\Programmi\Motive
2008-01-10 19:06 . 2008-01-10 19:06 <DIR> d-------- C:\Programmi\Common Files
2008-01-10 19:06 . 2008-01-11 11:58 <DIR> d-------- C:\Programmi\Alice ti aiuta
2008-01-10 19:05 . 2008-01-10 19:05 <DIR> d-------- C:\Programmi\Telecom Italia
2008-01-10 14:08 . 2004-08-12 08:50 2,568,192 -ra------ C:\WINDOWS\system\cmicnfg.cpl
2008-01-10 14:07 . 2008-01-10 19:06 <DIR> d--h----- C:\Programmi\InstallShield Installation Information
2008-01-10 14:07 . 2008-01-10 14:07 <DIR> d-------- C:\Programmi\C-Media 3D Audio
2008-01-10 14:07 . 2003-08-05 14:23 266,240 --a------ C:\WINDOWS\CMIUninstall.exe
2008-01-10 14:07 . 2003-07-22 11:15 225,280 --a------ C:\WINDOWS\CmiRmRedundDir.exe
2008-01-10 14:07 . 2002-10-18 15:56 28,672 --a------ C:\WINDOWS\CMIRmDriver.dll
2008-01-10 14:07 . 2008-01-10 14:07 167 --a------ C:\WINDOWS\system\CmiCnfg.ini
2008-01-10 14:07 . 2008-01-10 14:07 92 --a------ C:\WINDOWS\CMISETUP.INI
2008-01-10 14:07 . 2008-01-10 14:07 26 --a------ C:\WINDOWS\CMCDPLAY.INI
2008-01-10 14:07 . 2008-01-10 14:07 0 --a------ C:\WINDOWS\Wininit.ini
2008-01-10 14:05 . 2001-08-17 22:59 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2008-01-10 14:04 . 2004-08-19 16:39 4,274,816 --a------ C:\WINDOWS\system32\nv4_disp.dll
2008-01-10 14:04 . 2004-08-03 23:29 1,897,408 --a------ C:\WINDOWS\system32\drivers\nv4_mini.sys
2008-01-10 14:04 . 2004-08-19 16:24 58,240 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2008-01-10 14:03 . 2004-08-19 16:39 76,800 --a------ C:\WINDOWS\system32\usbui.dll
2008-01-10 14:03 . 2004-08-04 00:07 44,672 --a------ C:\WINDOWS\system32\drivers\UAGP35.SYS
2008-01-10 14:03 . 2001-08-17 21:13 27,165 --a------ C:\WINDOWS\system32\drivers\fetnd5.sys
2008-01-10 14:03 . 2004-08-04 00:08 10,624 --a------ C:\WINDOWS\system32\drivers\gameenum.sys
2008-01-10 14:02 . 2008-01-10 14:02 <DIR> d-------- C:\Programmi\File comuni\SpeechEngines
2008-01-10 14:02 . 2008-01-10 14:02 <DIR> d-------- C:\Programmi\File comuni\ODBC
2008-01-10 14:01 . 2008-01-11 15:14 <DIR> d-------- C:\WINDOWS\system32\CatRoot2
2008-01-10 14:01 . 2008-01-10 19:05 <DIR> d-------- C:\Programmi\File comuni\InstallShield
2008-01-10 14:01 . 2008-01-10 14:01 <DIR> d--h----- C:\Documents and Settings\Default User\Risorse di stampa
2008-01-10 14:01 . 2008-01-10 14:01 <DIR> d--h----- C:\Documents and Settings\Default User\Risorse di rete
2008-01-10 14:01 . 2008-01-10 14:01 <DIR> d-------- C:\Documents and Settings\Default User\Preferiti
2008-01-10 14:01 . 2008-01-10 13:07 <DIR> d--h----- C:\Documents and Settings\Default User\Modelli
2008-01-10 14:01 . 2008-01-10 14:01 <DIR> dr------- C:\Documents and Settings\Default User\Menu Avvio
2008-01-10 14:01 . 2008-01-10 14:01 <DIR> dr-h----- C:\Documents and Settings\Default User\Impostazioni locali
2008-01-10 14:01 . 2008-01-10 14:01 <DIR> d-------- C:\Documents and Settings\Default User\Documenti
2008-01-10 14:01 . 2008-01-10 14:01 <DIR> dr-h----- C:\Documents and Settings\Default User\Dati applicazioni
2008-01-10 14:01 . 2008-01-10 14:01 <DIR> d-------- C:\Documents and Settings\All Users\Preferiti
2008-01-10 14:01 . 2008-01-10 14:01 <DIR> d--h----- C:\Documents and Settings\All Users\Modelli
2008-01-10 14:01 . 2008-01-10 13:15 <DIR> dr------- C:\Documents and Settings\All Users\Menu Avvio
2008-01-10 14:01 . 2008-01-10 13:09 <DIR> dr------- C:\Documents and Settings\All Users\Documenti
2008-01-10 14:01 . 2008-01-11 13:02 <DIR> dr-h----- C:\Documents and Settings\All Users\Dati applicazioni
2008-01-10 14:00 . 2003-11-11 11:41 41,984 -ra------ C:\WINDOWS\system32\drivers\fetnd5b.sys
2008-01-10 14:00 . 2003-07-17 09:10 7,040 -ra------ C:\WINDOWS\system32\ntsim.sys
2008-01-10 14:00 . 2008-01-10 13:05 211 ---hs---- C:\boot.ini

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-10 18:06 155,995 ----a-w C:\WINDOWS\java\Packages\8ORLFNHZ.ZIP
2008-01-10 12:13 --------- d-----w C:\Programmi\microsoft frontpage
2008-01-10 12:10 --------- d-----w C:\Programmi\Servizi in linea
2008-01-10 12:09 --------- d-----w C:\Programmi\File comuni\MSSoap
2007-10-18 10:31 51,224 ----a-w C:\WINDOWS\system32\sirenacm.dll
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* i valori vuoti & legittimi/default non sono visualizzati.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-30 21:00 15360]
"SpybotSD TeaTimer"="C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46 1460560]
"swg"="C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-01-11 12:05 68856]
"MsnMsgr"="C:\Programmi\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cmaudio"="cmicnfg.cpl" []
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-10 19:39 579072]
"Motive SmartBridge"="C:\PROGRA~1\ALICET~1\SMARTB~1\MotiveSB.exe" [2006-04-21 15:41 438359]
"AliceRE_McciTrayApp"="C:\Programmi\Alice ti aiuta\vendors\AliceRE\content\template\driven_dev\syncer\McciTrayApp.exe" [2006-11-21 15:26 936960]
"!AVG Anti-Spyware"="C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2008-01-12 01:47 6731312]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-30 21:00 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-10 19:39 219136]

C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Alice ti aiuta.lnk - C:\Programmi\Alice ti aiuta\bin\matcli.exe [2008-01-11 11:57:41]
Google Updater.lnk - C:\Programmi\Google\Google Updater\GoogleUpdater.exe [2008-01-11 12:05:28]


*Newly Created Service* - PROCEXP90
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-12 01:55:34
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
Ora fine scansione: 2008-01-12 1.56.16

[bdoriano]

Anche il log di combofix sembra ok.

Fai queste scansioni con GMER e posta i logs su FreeFileHosting come indicato qui.

[Lorhaf]

ecco di seguito i 2 log da te richiesti:

Nuovo Documento di testo (2).txt

Nuovo Documento di testo (3).txt

ciao Lorhaf

[Orange]

A questo punto credo che non c'entrano i malware...

Prova a fare questo:
Start-- pannello di controllo-- strumenti di amministrazione-- visualizzatore eventi.
Seleziona un opzione alla volta-- azione-- cancella tutti gli eventi.

Al prossimo errore apri il visualizzatore eventi, doppio clic sul errore e riporta qui quanto c'è scritto nel riquadro "descrizione".

[Lorhaf]

ecco la descrizione dell' errore orange:

Applicazione che ha provocato l'errore svchost.exe, versione 5.1.2600.2180, modulo ke ha provocato l'errore netapi32.dll, versione 5.1.2600.2180, indirizzo errore 0x0000a3c0.

Per ulteriori informazioni consultare la Guida in linea e il supporto tecnico all' indirizzo: http://go.microsoft.com/fwlink/events.asp.

spero possa servire...

ciao Lorhaf

[Orange]

Dopo il format hai scaricato tutte le ultime patch di XP?

Per il tuo errore scarica ed installa questa patch (KB921883), riavvia il Pc e vedi se il problema si risolve.

Consiglierei di fare tutti gli aggiornamenti del SO disponibili su Windows Update

[Lorhaf]

grazie orange , l'errore pare debellato, grazie delle vostra pazienza e del vostro aiuto...




Ciao Lorhaf