Olimpo Informatico

[cardrag]

salve a tutti ho un grave problema , ultimamente spesso mi apre questa finestra con prima ...errore....la memoria non poteva essere read...
poi subito dopo un'altra finestra con runtime error....
Da ricerche su internet mi dice che si tratta di un trojan come fare per
cancellarlo, premetto che ho scansionato con lavasoft, avg, spyware doctor, nod 32, ma niente , anzi mi cancella qualcosa, ma subito dopo appena apro pagine di internet usando mozilla mi apre altre pagine che mi avvisano di pc infetto giochi da scaricare, addirittura paris hilton... che devo fà?
Sono abbastanza inesperto, al limite vi posto il log di hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15.24.42, on 17/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmi\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\File comuni\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
c:\documents and settings\ilaria-d\impostazioni locali\dati applicazioni\htatnpi.exe
F:\eMule\emule.exe
C:\WINDOWS\explorer.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Documents and Settings\ilaria-d\Desktop\HiJackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://controlpage.info/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Yahoo! Toolbar con blocco Pop-Up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live OneCare Family Safety Browser Helper Class - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Programmi\Windows Live\Family Safety\fssbho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar con blocco Pop-Up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [htatnpi] c:\documents and settings\ilaria-d\impostazioni locali\dati applicazioni\htatnpi.exe htatnpi
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: *Copy to Image Visual Photo++ Favorite* - C:\Programmi\Visual Photo++\image.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C156A5D1-7857-489B-8DE6-D9F0A77623C0}: NameServer = 85.37.17.9 85.38.28.75
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
O23 - Service: Servizio iPod (iPod Service) - Unknown owner - C:\Programmi\iPod\bin\iPodService.exe (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmi\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 6647 bytes

[bdoriano]

Ciao cardrag,

• Disabilita il ripristino di sistema.
  
• Pulisci i files temporanei con ATF-Cleaner e/o CCleaner
  
• Fai una scansione cone Norman Malware Cleaner.
  
  • Scarica il programma
    
  • Avvia il pc in modalità provvisoria.
    
  • Avvia Norman Malware Cleaner e fagli fare la scansione completa.
    
  • Alla fine della scansione viene generato un log sul desktop chiamato NFix_2008-MM-gg_hh-mm-ss.log.
  
  
• Riavvia il computer in modalità normale
  
• Segui le istruzioni di questo topic per eseguire combofix.
  
• Riferisci con un nuovo messaggio in questa discussione dell'esito: se ci sono stati problemi particolari, ecc. ecc. E riporta:
  
  • Carica il log di Norman Malware Cleaner su FreeFileHosting come indicato qui e posta il link che ti viene assegnato
    
  • Il log di Combofix generalmente non è molto lungo, quindi postalo direttamente nel messaggio

PS: se vuoi, puoi presentarti qui

[cardrag]

grazie bdoriano per la tua risposta immediata.
sinceramente non ho capito tanto cosa ho fatto però mi affido a te e spero di averlo fatto nel migliore dei modi
questo dovrebbe essere il log di combofix:

ComboFix 08-05-15.3 - ilaria-d 2008-05-17 17:00:44.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1040.18.606 [GMT 2:00]
Eseguito da: C:\Documents and Settings\ilaria-d\Desktop\ComboFix.exe
* Creato nuovo punto di ripristino
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\ilaria-d\Impostazioni locali\Dati applicazioni\eakixwedbq.dat
C:\Documents and Settings\ilaria-d\Impostazioni locali\Dati applicazioni\eakixwedbq_nav.dat
C:\Documents and Settings\ilaria-d\Impostazioni locali\Dati applicazioni\eakixwedbq_navps.dat
c:\Documents and Settings\ilaria-d\Impostazioni locali\Dati applicazioni\htatnpi.dat
c:\documents and settings\ilaria-d\impostazioni locali\dati applicazioni\htatnpi.exe
C:\Documents and Settings\ilaria-d\Impostazioni locali\Dati applicazioni\htatnpi_nav.dat
c:\Documents and Settings\ilaria-d\Impostazioni locali\Dati applicazioni\htatnpi_navps.dat
C:\Programmi\File comuni\sogou pxp
C:\Programmi\instant access
C:\Programmi\instant access\Center\Crazy Girls.upd
C:\Programmi\instant access\Dialer\1100652811\es6-external-api.dlv4.com\js\88470978530621cb7e93bd6e4d616a89
C:\Programmi\instant access\Dialer\1100652811\es6-www.0texkax7c6hzuidk.com\Common\424ee8456dd4ef143f531fabdd2a8e00.html
C:\Programmi\instant access\Dialer\1100652811\es6-www.0texkax7c6hzuidk.com\custom\4239\4239_dialer.ico
C:\Programmi\instant access\Dialer\1100652811\es6-www.0texkax7c6hzuidk.com\custom\4239\EN\button1.gif
C:\Programmi\instant access\Dialer\1100652811\es6-www.0texkax7c6hzuidk.com\custom\4239\EN\button2.gif
C:\Programmi\instant access\Dialer\1100652811\es6-www.0texkax7c6hzuidk.com\custom\4239\EN\button3.gif
C:\Programmi\instant access\Dialer\1100652811\es6-www.0texkax7c6hzuidk.com\custom\4239\EN\button4.gif
C:\Programmi\instant access\Dialer\1100652811\fp.gad-network.com\50252\images\EN\index_01.gif
C:\Programmi\instant access\Dialer\1100652811\fp.gad-network.com\50252\images\EN\index_02.gif
C:\Programmi\instant access\Dialer\1100652811\fp.gad-network.com\50252\images\index_03.jpg
C:\Programmi\instant access\Dialer\1100652811\fp.gad-network.com\50252\images\index_05.gif
C:\Programmi\instant access\Dialer\1100652811\fp.gad-network.com\50252\images\index_06.jpg
C:\Programmi\instant access\Dialer\1100652811\fp.gad-network.com\b40423701e536efad62a4d411571eed1.html
C:\Programmi\instant access\Dialer\1100652811\fp.gad-network.com\b40423701e536efad62a4d411571eed1.html_0.loginvis
C:\Programmi\instant access\Dialer\1100652811\www.rapid-pass.net\771b98154084d39056dce41a8e4fc786
C:\Programmi\uusee
C:\Programmi\uusee\AD\1\000\index.html
C:\Programmi\uusee\AD\1\001\index.html
C:\Programmi\uusee\AD\1\100\ad.swf
C:\Programmi\uusee\AD\1\100\index.html
C:\Programmi\uusee\AD\1\dsj\dsj.html
C:\Programmi\uusee\AD\1\dsj2\dsj2.html
C:\Programmi\uusee\AD\1\dy\dy.html
C:\Programmi\uusee\AD\1\dy2\dy2.html
C:\Programmi\uusee\AD\1\dy3\dy3.html
C:\Programmi\uusee\AD\1\jk\jk.html
C:\Programmi\uusee\AD\1\ln\ln.html
C:\Programmi\uusee\AD\1\ty\ty.html
C:\Programmi\uusee\AD\1\ty2\ty2.html
C:\Programmi\uusee\AD\1\yl\yl.html
C:\Programmi\uusee\AD\1\yl2\yl2.html
C:\Programmi\uusee\AD\1\yl3\yl3.html
C:\Programmi\uusee\AD\1\yx\yx.html
C:\Programmi\uusee\AD\1\zx\zx.html
C:\Programmi\uusee\AD\1\zx2\zx2.html
C:\Programmi\uusee\AD\2\000\index.html
C:\Programmi\uusee\AD\UUAD_Banner.html
C:\Programmi\uusee\AD\UUAD_Banner.swf
C:\Programmi\uusee\AD\UUAD_Buffering.html
C:\Programmi\uusee\AD\UUAD_Buffering.swf
C:\Programmi\uusee\AD\UUAD_TextLink_0.xml
C:\Programmi\uusee\ARMP.ocx
C:\Programmi\uusee\bak_ARMP.ocx
C:\Programmi\uusee\in_psp.dll
C:\Programmi\uusee\last_ver.ini
C:\Programmi\uusee\MultiVMR9.dll
C:\Programmi\uusee\out_mmshttp.dll
C:\Programmi\uusee\patch_cmd.exe
C:\Programmi\uusee\u264Dec.ax
C:\Programmi\uusee\UFDeMux.ax
C:\Programmi\uusee\uninst.exe
C:\Programmi\uusee\updateC2.ocx
C:\Programmi\uusee\UUPlayer.dll
C:\Programmi\uusee\UUPlayer.ocx
C:\Programmi\uusee\UUPlayer.skn
C:\Programmi\uusee\UUSee.url
C:\Programmi\uusee\uusee_video.dll
C:\Programmi\uusee\UUSEEAudioDec.ax
C:\Programmi\uusee\UUTV.xml
C:\Programmi\uusee\UUTV_MY.xml
C:\Programmi\uusee\vermini.ini
C:\Programmi\uusee\vermini.ini.uuuu.dat
C:\Programmi\uusee\vermini_x.ini
C:\Programmi\uusee\vermini_x1.ini
C:\WINDOWS\system32\Cache
C:\WINDOWS\system32\nsinet.exe
C:\WINDOWS\system32\nvs2.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_P4P_SERVICE


((((((((((((((((((((((((( Files Creati Da 2008-04-17 al 2008-05-17 )))))))))))))))))))))))))))))))))))
.

2008-05-16 15:08 . 2008-05-16 15:08 250 --a------ C:\WINDOWS\gmer.ini
2008-05-16 09:58 . 2008-05-16 09:58 <DIR> d-------- C:\Programmi\File comuni\Wise Installation Wizard
2008-05-11 01:06 . 2008-05-11 01:06 <DIR> d----c--- C:\Programmi\directx
2008-05-11 00:53 . 2008-05-11 00:53 <DIR> d----c--- C:\Programmi\Microids
2008-05-02 12:12 . 2008-05-02 12:12 <DIR> d----c--- C:\Artematica
2008-05-01 14:32 . 2007-01-20 23:26 1,565,480 --a------ C:\WINDOWS\system32\wmv9vcm.dll
2008-04-28 09:42 . 2008-04-28 09:42 <DIR> d----c--- C:\Programmi\iPod
2008-04-28 09:42 . 2008-05-16 08:53 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-04-28 09:42 . 2008-04-28 09:42 1,409 --a------ C:\WINDOWS\QTFont.for
2008-04-28 09:41 . 2008-05-16 15:25 <DIR> d----c--- C:\Programmi\iTunes
2008-04-28 09:39 . 2008-05-16 15:28 <DIR> d----c--- C:\Programmi\QuickTime
2008-04-28 09:26 . 2008-04-28 09:26 <DIR> d----c--- C:\Programmi\Apple Software Update
2008-04-26 14:28 . 2008-04-26 14:28 <DIR> d-------- C:\WINDOWS\wb
2008-04-22 16:33 . 2008-04-22 16:33 <DIR> d--h----- C:\WINDOWS\PIF
2008-04-19 20:03 . 2008-04-21 20:30 <DIR> d----c--- C:\Programmi\RegCleaner
2008-04-18 19:51 . 2008-04-18 19:51 <DIR> d----c--- C:\Programmi\DustBuster

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-17 14:35 --------- d-----w C:\Programmi\PPMate
2008-05-17 14:21 --------- dc----w C:\Programmi\Circle Developement
2008-05-16 12:54 --------- dc----w C:\Documents and Settings\ilaria-d\Dati applicazioni\uTorrent
2008-05-16 07:59 --------- d-----w C:\Programmi\Lavasoft
2008-05-16 07:01 --------- dc----w C:\Programmi\Briscola Mano a Mano
2008-05-04 11:50 --------- dc----w C:\Documents and Settings\ilaria-d\Dati applicazioni\SopCast
2008-04-13 20:39 --------- d-----w C:\Programmi\Google
2008-04-13 09:23 --------- d--h--w C:\Programmi\InstallShield Installation Information
2008-04-13 09:00 --------- d-----w C:\Programmi\DkZ Studio
2008-04-13 08:56 --------- dc----w C:\Programmi\Catalogo BTicino 2000
2008-04-13 08:54 --------- dc----w C:\Documents and Settings\All Users\Dati applicazioni\Yahoo! Companion
2008-04-13 08:37 --------- dc----w C:\Programmi\123 Free Memory
2008-04-08 14:35 --------- d-----w C:\Programmi\DivX
2008-04-08 13:59 --------- dc----w C:\Programmi\Lavalys
2008-04-07 13:44 --------- d-----w C:\Programmi\IObit
2008-04-06 19:38 --------- d-----w C:\Programmi\Messenger Plus! Live
2008-04-04 14:07 --------- d-----w C:\Programmi\Sophos
2008-04-04 14:02 --------- dc----w C:\Documents and Settings\All Users\Dati applicazioni\Active Shield
2008-04-04 07:56 --------- d-----w C:\Programmi\MSECache
2008-04-04 07:53 --------- d-----w C:\Programmi\Visualizzatore Cruciverba
2008-04-03 17:04 --------- d-----w C:\Programmi\K-Lite Codec Pack
2008-04-02 16:18 --------- dc----w C:\Documents and Settings\All Users\Dati applicazioni\Lavasoft
2008-03-31 16:37 --------- d-----w C:\Programmi\Microsoft Works
2008-03-31 16:22 --------- d-----w C:\Programmi\Microsoft.NET
2008-03-29 11:02 118,784 ----a-w C:\WINDOWS\SeaMonkeyUninstall.exe
2008-03-29 11:02 118,784 ----a-w C:\WINDOWS\GREUninstall.exe
2008-03-29 11:01 --------- d-----w C:\Programmi\mozilla.org
2008-03-29 10:50 --------- dc----w C:\Documents and Settings\ilaria-d\Dati applicazioni\Lavasoft
2008-03-29 08:58 --------- dc----w C:\Documents and Settings\All Users\Dati applicazioni\Microsoft Help
2008-03-28 16:28 --------- d-----w C:\Programmi\MSN Messenger
2008-03-28 16:26 --------- dc----w C:\Documents and Settings\All Users\Dati applicazioni\WLInstaller
2008-03-28 16:08 --------- d-----w C:\Programmi\Windows Live
2008-03-28 16:06 --------- d-----w C:\Programmi\Windows Live Toolbar
2008-03-28 10:40 --------- dc----w C:\Programmi\CCleaner
2008-03-28 10:36 --------- d-----w C:\Programmi\Yahoo!
2008-03-26 14:55 --------- dc----w C:\Documents and Settings\ilaria-d\Dati applicazioni\Microsoft Web Folders
2008-03-26 14:54 --------- d-----w C:\Programmi\microsoft frontpage
2008-03-23 15:51 --------- d-----w C:\Programmi\Project1
2008-03-20 08:06 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-19 17:05 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2008-03-17 23:01 --------- d-----w C:\Programmi\URUSoft
2008-03-17 23:00 --------- dc----w C:\Programmi\Aegisub
2008-03-01 12:58 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-20 06:50 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:33 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2007-10-07 11:39 2,293,712 -c--a-w C:\Programmi\FLV PlayerFCSetup.exe
2007-10-07 11:37 3,655,488 -c--a-w C:\Programmi\FLV PlayerRCATSetup.exe
2007-10-07 11:31 411,248 -c--a-w C:\Programmi\FLV PlayerRCSetup.exe
2008-01-23 16:18 80 --sh--r C:\WINDOWS\system32\A55C9356E1.dll
2007-03-09 07:12 27,648 --sha-w C:\WINDOWS\system32\AVSredirect.dll
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* i valori vuoti & legittimi/default non sono visualizzati.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4f3ed5cd-0726-42a9-87f5-d13f3d2976ac}]
2007-10-17 14:53 57384 --a------ C:\Programmi\Windows Live\Family Safety\fssbho.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15:39 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="C:\Programmi\File comuni\Real\Update_OB\realsched.exe" [2007-09-23 15:40 185896]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-10-10 15:49 7286784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 15:39 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3fhg"= mp3fhg.acm
"VIDC.X264"= x264vfw.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.i263"= i263_32.drv
"VIDC.YV12"= yv12vfw.dll
"msacm.divxa32"= divxa32.acm

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^Alice ti aiuta.lnk]
path=C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\Alice ti aiuta.lnk
backup=C:\WINDOWS\pss\Alice ti aiuta.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\Google Updater.lnk
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware]
C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AAWTray]
--a------ 2007-08-30 13:19 87392 C:\Programmi\Lavasoft\Ad-Aware 2007\AAWTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PrevxCSI]
C:\Programmi\PrevxCSI\prevxcsi.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Programmi\\PPStream\\PPStream.exe"=
"C:\\Programmi\\TVAnts\\Tvants.exe"=
"C:\\Programmi\\SopCast\\SopCast.exe"=
"C:\\Programmi\\TVUPlayer\\TVUPlayer.exe"=
"C:\\Programmi\\Briscolachiamata\\BriscolaChiamata.exe"=
"C:\\Programmi\\Kyodai\\kyodai.exe"=
"F:\\eMule\\emule.exe"=
"C:\\WINDOWS\\system32\\rtcshare.exe"=
"C:\\Programmi\\NetMeeting\\conf.exe"=
"C:\\Programmi\\uTorrent\\uTorrent.exe"=
"C:\\Documents and Settings\\ilaria-d\\Desktop\\mIRC\\mirc.exe"=
"C:\\Programmi\\VideoLAN\\VLC\\vlc.exe"=
"C:\\Programmi\\Mozilla Firefox\\firefox.exe"=
"C:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Programmi\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Programmi\\iTunes\\iTunes.exe"=

S2 fsssvc;Windows Live OneCare Family Safety;"C:\Programmi\Windows Live\Family Safety\fsssvc.exe" [2007-10-17 14:53]
S3 MEMSWEEP2;MEMSWEEP2;C:\WINDOWS\system32\34.tmp []

.
Contenuto della cartella 'Scheduled Tasks'
"2008-05-10 21:29:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Programmi\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-17 17:07:12
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

C:\WINDOWS\explorer.exe [1856] 0x84F8A788

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
"ImagePath"="\??\C:\WINDOWS\system32\34.tmp"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\Programmi\Eset\pr_imon.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmi\ESET\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Ora fine scansione: 2008-05-17 17:10:51 - machine was rebooted [ilaria-d]
ComboFix-quarantined-files.txt 2008-05-17 15:10:44

18 Directory 121,242,480,640 byte disponibili
21 Directory 121,129,734,144 byte disponibili

259 --- E O F --- 2008-04-15 09:02:49

Questo il log di normal malware cleaner:

NFix_2008-05-17_15-51-48.log

Questo il log di hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17.22.49, on 17/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmi\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Documents and Settings\ilaria-d\Desktop\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://controlpage.info/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Yahoo! Toolbar con blocco Pop-Up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live OneCare Family Safety Browser Helper Class - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Programmi\Windows Live\Family Safety\fssbho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar con blocco Pop-Up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: *Copy to Image Visual Photo++ Favorite* - C:\Programmi\Visual Photo++\image.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C156A5D1-7857-489B-8DE6-D9F0A77623C0}: NameServer = 85.37.17.9 85.38.28.75
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
O23 - Service: Servizio iPod (iPod Service) - Unknown owner - C:\Programmi\iPod\bin\iPodService.exe (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmi\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 6029 bytes

Spero di aver fatto tutto bene, grazie ancora.

[bdoriano]

Direi che andiamo meglio. Norman ha eliminato alcune schifezzuole e Combofix ne ha eliminate altre.

Adesso, fai questa scansione con VirIT.

[cardrag]

questo è il log di vir it:

VirIT eXplorer Lite Log

[SCANSIONE DELLA MEMORIA]
OK
[SCANSIONE DELLA MEMORIA]
OK
--------------------------------------------------------
17/05/2008 - 19:25:13

[SCANSIONE DEL REGISTRO]
{FE063DB9-4EC0-403e-8DD8-394C54984B2C} Infetto da BHO.Ask.A
* * * RIMOSSO * * *
{DF1C8E21-4045-4D67-B528-335F1A4F0DE9} Infetto da Trojan.Win32.InstantAcce.Gen
* * * RIMOSSO * * *

StartPage di Internet Explorer Hijacked: http://controlpage.info/
* * * RIMOSSO * * *

[A:]
BOOT SECTOR: OK


[C:]
MASTER BOOT RECORD: OK
BOOT SECTOR: OK

C:\Documents and Settings\ilaria-d\Desktop\HiJackThis\backups\backup-20080410-182205-184.dll Infetto da BHO.Ask.A
* * * RIMOSSO * * *
C:\Documents and Settings\ilaria-d\Desktop\HiJackThis\backups\backup-20080410-182205-495.dll Infetto da BHO.Ask.A
* * * RIMOSSO * * *
C:\Programmi\AskTBar\bar\1.bin\ASKTBAR.DLL Infetto da BHO.Ask.A
* * * RIMOSSO * * *
C:\Programmi\AskTBar\bar\2.bin\ASKTBAR.DLL Infetto da BHO.Ask.A
* * * RIMOSSO * * *
C:\Programmi\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL Infetto da BHO.Ask.A
* * * RIMOSSO * * *
C:\QooBox\Quarantine\C\WINDOWS\system32\nsinet.exe.vir Infetto da Trojan.Win32.InstantAcce.Gen
* * * RIMOSSO * * *

[D:]


[E:]


[F:]
MASTER BOOT RECORD: OK
BOOT SECTOR: OK


[G:]


Chiavi Registro infette: 2.
Files Infetti: 6.
Files Sospetti: 0.
Files Analizzati: 82216.
Files Totali: 82216.
Chiavi Registro rimosse: 2.
Virus Rimossi: 6.

[bdoriano]

Anche VirIT ha eliminato qualcosina.

• Scarica FixWareOut da uno di questi siti:
  Sito 1 Sito 2 Sito 3
  
• Salvalo sul desktop
  
• Avvialo
  
• Clicca Next
  
• Clicca Install
  
• Assicurati che ci sia il segno di spunta su "Run fixit"
  
• Clicca Finish.
  
• Segui le indicazioni.
  
• Ti chiederà di riavviare il pc, fallo.
  
• Ci metterà parecchio a riavviarsi. Sii paziente.
  
• Alla fine dell'operazione, riavvia ancora il pc.
  
• Rifai il log di hijackthis e postalo insieme al file C:\fixwareout\report.txt

Dopo, fai questa scansione con Kaspersky

[cardrag]

Scusami il ritardo bdoriano.
Ti posto il log di hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 0.43.54, on 18/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmi\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\VEXPLITE\viritsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\ilaria-d\Desktop\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tgsoft.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Yahoo! Toolbar con blocco Pop-Up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live OneCare Family Safety Browser Helper Class - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Programmi\Windows Live\Family Safety\fssbho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar con blocco Pop-Up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: *Copy to Image Visual Photo++ Favorite* - C:\Programmi\Visual Photo++\image.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
O23 - Service: Servizio iPod (iPod Service) - Unknown owner - C:\Programmi\iPod\bin\iPodService.exe (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmi\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Virit eXplorer Lite (viritsvclite) - TG Soft Sas www.tgsoft.it - C:\VEXPLITE\viritsvc.exe

--
End of file - 5595 bytes

Mentre questo è il log di fixwaeout:

Username "ilaria-d" - 18/05/2008 0.33.20 [Fixwareout edited 9/01/2007]

~~~~~ Prerun check

Svuotata la cache del resolver DNS.


System was rebooted successfully.

~~~~~ Postrun check
HKLM\SOFTWARE\~\Winlogon\ "System"=""
....
....
~~~~~ Misc files.
....
~~~~~ Checking for older varients.
....

~~~~~ Current runs (hklm hkcu "run" Keys Only)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
"TkBellExe"="\"C:\\Programmi\\File comuni\\Real\\Update_OB\\realsched.exe\" -osboot"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
....
Hosts file was reset, If you use a custom hosts file please replace it...
C:\WINDOWS\repair\autoexec.nt missing
C:\WINDOWS\repair\Config.nt missing
~~~~~ End report ~~~~~

[cardrag]

buongiorno, ce ne ha messo un pò kaspersky ma alla fine ci siamo riusciti.
ti posto il log:
kkkk.txt

inoltre, grazie ancora per la tua preziosa collaborazione.
Buona giornata

[bdoriano]

Anche Kaspersky ha fatto il suo dovere.

Riscontri ancora problemi?

[cardrag]

sinceramente già ieri con le prime operazioni andava meglio, comunque lo vedo più veloce sembra in buona forma, grazie ancora.
A questo punto mi chiedo ma gli antivirus che ho installato (NOD32, Ad-Aware Lavasoft) servono?
Altrimenti ce ne sono di migliori?

[bdoriano]

Bene. Puoi disinstallare Kaspersky e cancellare Combofix.
Se noti rallentamenti del pc, disinstalla anche VirIT.

Per quanto riguarda la tua domanda: l'efficacia di un antivirus dipende dalla frequenza dell'aggiornamento che ha.
Lavasoft AdAware non è un antivirus, ma un antispyware. Io preferisco utilizzare SuperAntiSpyware e A-Squared free.

Per entrare nel dettaglio, vedi le varie discussioni nella sezione Sicurezza e, al limite, apri un topic per chiedere maggiori info.

[cardrag]

non so proprio come ringraziarti che dire.... non ci sono parole.
Grazie di tutto e al mio prossimo problema.

[bdoriano]

Dimenticavo: riattiva il ripristino di sistema.