MegaLab.it

cm da titolo,da quando ho avuto un virus il pc è molto rallentato nell'accendersi e in generale.Ad esempio:la schermata nera con scritto windows xp che poi porta alla schermata azzurra, rimane 3 ore....Poi il pc ci mette un sacco ad aprire le risorse i documenti etc.Che posso fare?

Intanto vediamo un log della scansione di hijackthis
http://www.MegaLab.it/2286
poi vedremo.

questo è quello che è uscito :
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 16.48.54, on 22/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Network Associates\Common Framework\FrameworkService.exe
C:\Programmi\Network Associates\VirusScan\Mcshield.exe
C:\Programmi\Network Associates\VirusScan\VsTskMgr.exe
C:\Programmi\Olivetti\ANY_WAY\olMntrService.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Programmi\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe
C:\Programmi\Network Associates\VirusScan\SHSTAT.EXE
C:\Programmi\Network Associates\Common Framework\UpdaterUI.exe
C:\Programmi\File comuni\Network Associates\TalkBack\TBMon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programmi\Olivetti\ANY_WAY\olDvcStatus.exe
C:\Programmi\Java\jre1.5.0_11\bin\jusched.exe
C:\Programmi\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\Programmi\Azureus\Azureus.exe
C:\Programmi\MSN Messenger\usnsvc.exe
C:\Programmi\Windows Media Player\wmplayer.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Documents and Settings\User\Documenti\File ricevuti\HiJackThis_v2.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.bearshare.com/sidebar.html?src=ssb
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Programmi\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Programmi\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Programmi\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Programmi\File comuni\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [OlStatusMon] "C:\Programmi\Olivetti\ANY_WAY\olDvcStatus.exe" dvcStatusMinimize
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [FASTTRACKPassepartout Light] C:\WINDOWS\Passepartout Light.exe -A *fJa9F8S0YLBdyXzGfwZ8DtWgEfkbwCgWM1blj8WuILld4XuXLwdRT4XpIORfzTpCLkI1m0G8VNFa4zuHZQYRX320xMhcQjlDYJIoX8GvNO5LzDv3ZkbdXyi3BMBdhzjycAb5nz2mRM5MvzzzdFZYX8WwQLNLgX1nTwddGtGzlflfnC2Fa1aNH8X8RLxR8X0nMwcxjymOlfUf8DgCaFY1H828RLVT0XuncwdwDtGtofVfvCzCL1a138W8BL1LhXpXcxIw3xGtNdFflWsDclIQGuHxFZNfyGlDdlYEGj2s9a9M1SuSdBZwDlGxId8LuXgDdJcEHvGsJIVMhHynZBIwmlHtZcVfpiuCYBI121H8FbRLkilXdBbxm0X1FZBcuWvHY1Ig2wGuUbNZuyvXbBbhmjXlVbBf02sFf1ZNDwX8EbNMwGzzMVagjzX2IcZM42vXflIxD2GOIbRfzypCfBIIDkG=
O4 - HKLM\..\Run: [FASTTRACKFreeDownload] C:\WINDOWS\Passepartout.exe -A *fX5uFwzLY4ZWyOW1fTNhDk1YE0dywNG1NzlmTQ2cA3am2MXVLjxlTV0LI8cWzOmFLDUumkgdVyYG4M2lZzV2XAuaxzdXQMGJYzV1XFzcN8ayzLW1ZX1uXwpbBtI3hfGNcCFwn1sYR8IWvLH0dXNtXwlZRyYG8f29RD93nFubJ8ZmlLGxZX8vUwgYRtcWvfGQdCVu21yb58ImsLHVbXV02xuLFxI3kdHxfWRTEllflubFFZXNfGB8DlvUIjI31aGxfSNGGBvfhlbE0dX5dXB8HJsTAvZn6IXwLHNtyBzf9laEwcX5YiZ8XBvLN1IXzbGwZiRtXBpfB0IChZG1cW98n10LRwdXvbGwdy80XBgMQjbXubWwd2lxH1uLJwdDhbXEZGRsmVpMZzfSpcCwY21x2l8LF2aDkbHJdyR8mB0LFkcXuaDwYSot2BvfUzLCuZ21bWZ8mkydVgZX0bWBfWU4DltLEuZmwdGVNXV4TRmZApYX2IXxfGVTDFsfIudDzYCMf214Dh1NJlcj8IGFLGR8X5hTwvdntbGxfiUOCBtf1jdC8b2IL2l=
O4 - HKLM\..\Run: [FASTTRACKInternet Free] C:\WINDOWS\Passepartout.exe -A *fC9pF1ubY8ciyO21fDVtDkjYE5dWwNXMMDRtjcpZU0dnzNmJLzllTI8ZIzdSzfH1LDJhmglbV5In4MGRZjNpXMldxwbmQMnlYzRyXMldNxcXzf2MZCltX1tbB8amhLS9cXBznwhcRtbGvfCFdCBtX1zLR8ZW8MWRSnNvWwvd5xb20fm5ZCRsX1vbJ8I2uLHFZXBkXwlLQtcmgfi5RCBln11dJ8bHlcixZXBTXV0fxpZFJbWNRm18XRwUwpb3yYyxN2BGXkjfxgbEoZ25dX18HVwTRybnwbGwOyVtiBzf8wcEvZ25cXl8GI2LFgbXzdywcWBt24kfVgaCwdS1YGB8XVvLJtdX0cHwbGR038vMVgIX0YGwL21xn9pLRtbDycnEYGVsWx0MZlaSmcXwa3wxWNtLNpfDhdGJZmh8H80LZgdXhZHwbGAtmk6fNgLClcy1L298mVmd5pcXlImBdGV4H1lLwpLmxbWVMnR4DVlZI0ZX1amxMSFT3B1fwhbDybHMMmQ43NtNwodjyZXFfSB8CBkT1uYn8bXxL2RTX4lfwgLCtYXIf2d=
O4 - HKLM\..\Run: [FASTTRACKInternet Explorers] C:\WINDOWS\Passepartout.exe -A *ftB2FfjlYCbuy12Lf85WDLz1EXZhwwWYN4NyjO11MTdm3kGcL0lmTN2VIzalzQXLL3xWmM0FVjcu4VmdZ8UGXOglxDY2Qk2aYyVXXMuJNzd1zAGcZzVyXMz1BzauhFWbc813nLpNRXIwvwGYdtFWXfs0RCIt81HZS8NGWLl95XY30w2bZy9mXfuxJDZvuFGYZ88WXLgQQXcugwGbRtVmXfyVhCI0w1Hfb8VFGLuN9XI8yxHUZxR3XdlxJWbTzlXffuBEEZvZlGI8FlGTfjNnDavxISbO1BXfflBCGds1hXZ80JXTdvNnHIzwAHat6BXfLlZCycv19iI8wBGLY1RXXbpwNiItzBGfZ09DXZ0QBWdxh1Gfcw8DnbgERybsvBWMdjlSXbuwQ2dxu1XLdwRDHbpEJGfshVCMZz1nmc8wZ2atplHfY2RC2b01Fyc8kBDLdkoXmavxFSL1uB2cYzZH2ZygUWZuukWZbgUXmbthVWZl0lGffuVFDdmNEXY8wRXMNpVzjIsgMGd23FCMfu1XDY1xI2cOzhGfflRFDIhNJGd885GILvUgXbt=wid=
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [YeppStudioAgent] C:\Programmi\Samsung\SamsungMediaStudio4.1\SamsungMediaStudioAgent.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [FASTTRACKPassepartout Light] C:\WINDOWS\Passepartout Light.exe -A *fJa9F8S0YLBdyXzGfwZ8DtWgEfkbwCgWM1blj8WuILld4XuXLwdRT4XpIORfzTpCLkI1m0G8VNFa4zuHZQYRX320xMhcQjlDYJIoX8GvNO5LzDv3ZkbdXyi3BMBdhzjycAb5nz2mRM5MvzzzdFZYX8WwQLNLgX1nTwddGtGzlflfnC2Fa1aNH8X8RLxR8X0nMwcxjymOlfUf8DgCaFY1H828RLVT0XuncwdwDtGtofVfvCzCL1a138W8BL1LhXpXcxIw3xGtNdFflWsDclIQGuHxFZNfyGlDdlYEGj2s9a9M1SuSdBZwDlGxId8LuXgDdJcEHvGsJIVMhHynZBIwmlHtZcVfpiuCYBI121H8FbRLkilXdBbxm0X1FZBcuWvHY1Ig2wGuUbNZuyvXbBbhmjXlVbBf02sFf1ZNDwX8EbNMwGzzMVagjzX2IcZM42vXflIxD2GOIbRfzypCfBIIDkG=
O4 - HKCU\..\Run: [FASTTRACKFreeDownload] C:\WINDOWS\Passepartout.exe -A *fX5uFwzLY4ZWyOW1fTNhDk1YE0dywNG1NzlmTQ2cA3am2MXVLjxlTV0LI8cWzOmFLDUumkgdVyYG4M2lZzV2XAuaxzdXQMGJYzV1XFzcN8ayzLW1ZX1uXwpbBtI3hfGNcCFwn1sYR8IWvLH0dXNtXwlZRyYG8f29RD93nFubJ8ZmlLGxZX8vUwgYRtcWvfGQdCVu21yb58ImsLHVbXV02xuLFxI3kdHxfWRTEllflubFFZXNfGB8DlvUIjI31aGxfSNGGBvfhlbE0dX5dXB8HJsTAvZn6IXwLHNtyBzf9laEwcX5YiZ8XBvLN1IXzbGwZiRtXBpfB0IChZG1cW98n10LRwdXvbGwdy80XBgMQjbXubWwd2lxH1uLJwdDhbXEZGRsmVpMZzfSpcCwY21x2l8LF2aDkbHJdyR8mB0LFkcXuaDwYSot2BvfUzLCuZ21bWZ8mkydVgZX0bWBfWU4DltLEuZmwdGVNXV4TRmZApYX2IXxfGVTDFsfIudDzYCMf214Dh1NJlcj8IGFLGR8X5hTwvdntbGxfiUOCBtf1jdC8b2IL2l=
O4 - HKCU\..\Run: [FASTTRACKInternet Free] C:\WINDOWS\Passepartout.exe -A *fC9pF1ubY8ciyO21fDVtDkjYE5dWwNXMMDRtjcpZU0dnzNmJLzllTI8ZIzdSzfH1LDJhmglbV5In4MGRZjNpXMldxwbmQMnlYzRyXMldNxcXzf2MZCltX1tbB8amhLS9cXBznwhcRtbGvfCFdCBtX1zLR8ZW8MWRSnNvWwvd5xb20fm5ZCRsX1vbJ8I2uLHFZXBkXwlLQtcmgfi5RCBln11dJ8bHlcixZXBTXV0fxpZFJbWNRm18XRwUwpb3yYyxN2BGXkjfxgbEoZ25dX18HVwTRybnwbGwOyVtiBzf8wcEvZ25cXl8GI2LFgbXzdywcWBt24kfVgaCwdS1YGB8XVvLJtdX0cHwbGR038vMVgIX0YGwL21xn9pLRtbDycnEYGVsWx0MZlaSmcXwa3wxWNtLNpfDhdGJZmh8H80LZgdXhZHwbGAtmk6fNgLClcy1L298mVmd5pcXlImBdGV4H1lLwpLmxbWVMnR4DVlZI0ZX1amxMSFT3B1fwhbDybHMMmQ43NtNwodjyZXFfSB8CBkT1uYn8bXxL2RTX4lfwgLCtYXIf2d=
O4 - HKCU\..\Run: [FASTTRACKInternet Explorers] C:\WINDOWS\Passepartout.exe -A *ftB2FfjlYCbuy12Lf85WDLz1EXZhwwWYN4NyjO11MTdm3kGcL0lmTN2VIzalzQXLL3xWmM0FVjcu4VmdZ8UGXOglxDY2Qk2aYyVXXMuJNzd1zAGcZzVyXMz1BzauhFWbc813nLpNRXIwvwGYdtFWXfs0RCIt81HZS8NGWLl95XY30w2bZy9mXfuxJDZvuFGYZ88WXLgQQXcugwGbRtVmXfyVhCI0w1Hfb8VFGLuN9XI8yxHUZxR3XdlxJWbTzlXffuBEEZvZlGI8FlGTfjNnDavxISbO1BXfflBCGds1hXZ80JXTdvNnHIzwAHat6BXfLlZCycv19iI8wBGLY1RXXbpwNiItzBGfZ09DXZ0QBWdxh1Gfcw8DnbgERybsvBWMdjlSXbuwQ2dxu1XLdwRDHbpEJGfshVCMZz1nmc8wZ2atplHfY2RC2b01Fyc8kBDLdkoXmavxFSL1uB2cYzZH2ZygUWZuukWZbgUXmbthVWZl0lGffuVFDdmNEXY8wRXMNpVzjIsgMGd23FCMfu1XDY1xI2cOzhGfflRFDIhNJGd885GILvUgXbt=wid=
O4 - HKCU\..\Run: [BitTorrent] "C:\Programmi\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [FASTTRACKPassepartout] C:\WINDOWS\Passepartout.exe -A
O4 - HKCU\..\Run: [RocketDock] "C:\Programmi\RocketDock\RocketDock.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/MTSIns ... _load.html
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/ms ... b56986.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/Mi ... b31267.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/IT-IT/a-U ... E_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b31267.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O16 - DPF: {E473A65C-8087-49A3-AFFD-C5BC4A10669B} (Quantum Streaming IE Player Class) - http://mvnet.xlontech.net/qm/fox/061011 ... 101001.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/Mi ... b56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8A3651CB-91BA-4B75-AF81-D1CF0279A82F}: NameServer = 85.37.17.4 85.38.28.70
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: Servizio di framework di McAfee (McAfeeFramework) - Network Associates, Inc. - C:\Programmi\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Programmi\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Programmi\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: olMntrService - Olivetti - C:\Programmi\Olivetti\ANY_WAY\olMntrService.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O24 - Desktop Component 0: (no name) - http://www.nuerburgring.de/fileadmin/webcam/webcam.jpg

--
End of file - 13706 bytes

Rifai la scansione con hijackthis, selezioni le caselle di queste righe e premi fix checked per eliminarle.
Termina tutti i processi Passepartout che trovi nel task manager e poi cancella i file Passepartout.exe e Passepartout Light.exe
Sono dei dialer.
Consigliata poi una scansione completa con A2 squared o superantispyware, al termine della scansione riavvia il pc e vedi come va.

O4 - HKLM\..\Run: [FASTTRACKPassepartout Light] C:\WINDOWS\Passepartout Light.exe -A *fJa9F8S0YLBdyXzGfwZ8DtWgEfkbwCgWM1blj8WuILld4XuXLwdRT4XpIORfzTpCLkI1m0G8VNFa4zuHZQYRX320xMhcQjlDYJIoX8GvNO5LzDv3ZkbdXyi3BMBdhzjycAb5nz2mRM5MvzzzdFZYX8WwQLNLgX1nTwddGtGzlflfnC2Fa1aNH8X8RLxR8X0nMwcxjymOlfUf8DgCaFY1H828RLVT0XuncwdwDtGtofVfvCzCL1a138W8BL1LhXpXcxIw3xGtNdFflWsDclIQGuHxFZNfyGlDdlYEGj2s9a9M1SuSdBZwDlGxId8LuXgDdJcEHvGsJIVMhHynZBIwmlHtZcVfpiuCYBI121H8FbRLkilXdBbxm0X1FZBcuWvHY1Ig2wGuUbNZuyvXbBbhmjXlVbBf02sFf1ZNDwX8EbNMwGzzMVagjzX2IcZM42vXflIxD2GOIbRfzypCfBIIDkG=
O4 - HKLM\..\Run: [FASTTRACKFreeDownload] C:\WINDOWS\Passepartout.exe -A *fX5uFwzLY4ZWyOW1fTNhDk1YE0dywNG1NzlmTQ2cA3am2MXVLjxlTV0LI8cWzOmFLDUumkgdVyYG4M2lZzV2XAuaxzdXQMGJYzV1XFzcN8ayzLW1ZX1uXwpbBtI3hfGNcCFwn1sYR8IWvLH0dXNtXwlZRyYG8f29RD93nFubJ8ZmlLGxZX8vUwgYRtcWvfGQdCVu21yb58ImsLHVbXV02xuLFxI3kdHxfWRTEllflubFFZXNfGB8DlvUIjI31aGxfSNGGBvfhlbE0dX5dXB8HJsTAvZn6IXwLHNtyBzf9laEwcX5YiZ8XBvLN1IXzbGwZiRtXBpfB0IChZG1cW98n10LRwdXvbGwdy80XBgMQjbXubWwd2lxH1uLJwdDhbXEZGRsmVpMZzfSpcCwY21x2l8LF2aDkbHJdyR8mB0LFkcXuaDwYSot2BvfUzLCuZ21bWZ8mkydVgZX0bWBfWU4DltLEuZmwdGVNXV4TRmZApYX2IXxfGVTDFsfIudDzYCMf214Dh1NJlcj8IGFLGR8X5hTwvdntbGxfiUOCBtf1jdC8b2IL2l=
O4 - HKLM\..\Run: [FASTTRACKInternet Free] C:\WINDOWS\Passepartout.exe -A *fC9pF1ubY8ciyO21fDVtDkjYE5dWwNXMMDRtjcpZU0dnzNmJLzllTI8ZIzdSzfH1LDJhmglbV5In4MGRZjNpXMldxwbmQMnlYzRyXMldNxcXzf2MZCltX1tbB8amhLS9cXBznwhcRtbGvfCFdCBtX1zLR8ZW8MWRSnNvWwvd5xb20fm5ZCRsX1vbJ8I2uLHFZXBkXwlLQtcmgfi5RCBln11dJ8bHlcixZXBTXV0fxpZFJbWNRm18XRwUwpb3yYyxN2BGXkjfxgbEoZ25dX18HVwTRybnwbGwOyVtiBzf8wcEvZ25cXl8GI2LFgbXzdywcWBt24kfVgaCwdS1YGB8XVvLJtdX0cHwbGR038vMVgIX0YGwL21xn9pLRtbDycnEYGVsWx0MZlaSmcXwa3wxWNtLNpfDhdGJZmh8H80LZgdXhZHwbGAtmk6fNgLClcy1L298mVmd5pcXlImBdGV4H1lLwpLmxbWVMnR4DVlZI0ZX1amxMSFT3B1fwhbDybHMMmQ43NtNwodjyZXFfSB8CBkT1uYn8bXxL2RTX4lfwgLCtYXIf2d=
O4 - HKLM\..\Run: [FASTTRACKInternet Explorers] C:\WINDOWS\Passepartout.exe -A *ftB2FfjlYCbuy12Lf85WDLz1EXZhwwWYN4NyjO11MTdm3kGcL0lmTN2VIzalzQXLL3xWmM0FVjcu4VmdZ8UGXOglxDY2Qk2aYyVXXMuJNzd1zAGcZzVyXMz1BzauhFWbc813nLpNRXIwvwGYdtFWXfs0RCIt81HZS8NGWLl95XY30w2bZy9mXfuxJDZvuFGYZ88WXLgQQXcugwGbRtVmXfyVhCI0w1Hfb8VFGLuN9XI8yxHUZxR3XdlxJWbTzlXffuBEEZvZlGI8FlGTfjNnDavxISbO1BXfflBCGds1hXZ80JXTdvNnHIzwAHat6BXfLlZCycv19iI8wBGLY1RXXbpwNiItzBGfZ09DXZ0QBWdxh1Gfcw8DnbgERybsvBWMdjlSXbuwQ2dxu1XLdwRDHbpEJGfshVCMZz1nmc8wZ2atplHfY2RC2b01Fyc8kBDLdkoXmavxFSL1uB2cYzZH2ZygUWZuukWZbgUXmbthVWZl0lGffuVFDdmNEXY8wRXMNpVzjIsgMGd23FCMfu1XDY1xI2cOzhGfflRFDIhNJGd885GILvUgXbt=wid=
O4 - HKCU\..\Run: [FASTTRACKPassepartout Light] C:\WINDOWS\Passepartout Light.exe -A *fJa9F8S0YLBdyXzGfwZ8DtWgEfkbwCgWM1blj8WuILld4XuXLwdRT4XpIORfzTpCLkI1m0G8VNFa4zuHZQYRX320xMhcQjlDYJIoX8GvNO5LzDv3ZkbdXyi3BMBdhzjycAb5nz2mRM5MvzzzdFZYX8WwQLNLgX1nTwddGtGzlflfnC2Fa1aNH8X8RLxR8X0nMwcxjymOlfUf8DgCaFY1H828RLVT0XuncwdwDtGtofVfvCzCL1a138W8BL1LhXpXcxIw3xGtNdFflWsDclIQGuHxFZNfyGlDdlYEGj2s9a9M1SuSdBZwDlGxId8LuXgDdJcEHvGsJIVMhHynZBIwmlHtZcVfpiuCYBI121H8FbRLkilXdBbxm0X1FZBcuWvHY1Ig2wGuUbNZuyvXbBbhmjXlVbBf02sFf1ZNDwX8EbNMwGzzMVagjzX2IcZM42vXflIxD2GOIbRfzypCfBIIDkG=
O4 - HKCU\..\Run: [FASTTRACKFreeDownload] C:\WINDOWS\Passepartout.exe -A *fX5uFwzLY4ZWyOW1fTNhDk1YE0dywNG1NzlmTQ2cA3am2MXVLjxlTV0LI8cWzOmFLDUumkgdVyYG4M2lZzV2XAuaxzdXQMGJYzV1XFzcN8ayzLW1ZX1uXwpbBtI3hfGNcCFwn1sYR8IWvLH0dXNtXwlZRyYG8f29RD93nFubJ8ZmlLGxZX8vUwgYRtcWvfGQdCVu21yb58ImsLHVbXV02xuLFxI3kdHxfWRTEllflubFFZXNfGB8DlvUIjI31aGxfSNGGBvfhlbE0dX5dXB8HJsTAvZn6IXwLHNtyBzf9laEwcX5YiZ8XBvLN1IXzbGwZiRtXBpfB0IChZG1cW98n10LRwdXvbGwdy80XBgMQjbXubWwd2lxH1uLJwdDhbXEZGRsmVpMZzfSpcCwY21x2l8LF2aDkbHJdyR8mB0LFkcXuaDwYSot2BvfUzLCuZ21bWZ8mkydVgZX0bWBfWU4DltLEuZmwdGVNXV4TRmZApYX2IXxfGVTDFsfIudDzYCMf214Dh1NJlcj8IGFLGR8X5hTwvdntbGxfiUOCBtf1jdC8b2IL2l=
O4 - HKCU\..\Run: [FASTTRACKInternet Free] C:\WINDOWS\Passepartout.exe -A *fC9pF1ubY8ciyO21fDVtDkjYE5dWwNXMMDRtjcpZU0dnzNmJLzllTI8ZIzdSzfH1LDJhmglbV5In4MGRZjNpXMldxwbmQMnlYzRyXMldNxcXzf2MZCltX1tbB8amhLS9cXBznwhcRtbGvfCFdCBtX1zLR8ZW8MWRSnNvWwvd5xb20fm5ZCRsX1vbJ8I2uLHFZXBkXwlLQtcmgfi5RCBln11dJ8bHlcixZXBTXV0fxpZFJbWNRm18XRwUwpb3yYyxN2BGXkjfxgbEoZ25dX18HVwTRybnwbGwOyVtiBzf8wcEvZ25cXl8GI2LFgbXzdywcWBt24kfVgaCwdS1YGB8XVvLJtdX0cHwbGR038vMVgIX0YGwL21xn9pLRtbDycnEYGVsWx0MZlaSmcXwa3wxWNtLNpfDhdGJZmh8H80LZgdXhZHwbGAtmk6fNgLClcy1L298mVmd5pcXlImBdGV4H1lLwpLmxbWVMnR4DVlZI0ZX1amxMSFT3B1fwhbDybHMMmQ43NtNwodjyZXFfSB8CBkT1uYn8bXxL2RTX4lfwgLCtYXIf2d=
O4 - HKCU\..\Run: [FASTTRACKInternet Explorers] C:\WINDOWS\Passepartout.exe -A *ftB2FfjlYCbuy12Lf85WDLz1EXZhwwWYN4NyjO11MTdm3kGcL0lmTN2VIzalzQXLL3xWmM0FVjcu4VmdZ8UGXOglxDY2Qk2aYyVXXMuJNzd1zAGcZzVyXMz1BzauhFWbc813nLpNRXIwvwGYdtFWXfs0RCIt81HZS8NGWLl95XY30w2bZy9mXfuxJDZvuFGYZ88WXLgQQXcugwGbRtVmXfyVhCI0w1Hfb8VFGLuN9XI8yxHUZxR3XdlxJWbTzlXffuBEEZvZlGI8FlGTfjNnDavxISbO1BXfflBCGds1hXZ80JXTdvNnHIzwAHat6BXfLlZCycv19iI8wBGLY1RXXbpwNiItzBGfZ09DXZ0QBWdxh1Gfcw8DnbgERybsvBWMdjlSXbuwQ2dxu1XLdwRDHbpEJGfshVCMZz1nmc8wZ2atplHfY2RC2b01Fyc8kBDLdkoXmavxFSL1uB2cYzZH2ZygUWZuukWZbgUXmbthVWZl0lGffuVFDdmNEXY8wRXMNpVzjIsgMGd23FCMfu1XDY1xI2cOzhGfflRFDIhNJGd885GILvUgXbt=wid=
O4 - HKCU\..\Run: [FASTTRACKPassepartout] C:\WINDOWS\Passepartout.exe -A

ho un paio di domande:
1-dove trovo i file pass etc.exe?
2-dv trovo i programmi x fare le scansioni?

1) sono in C:\WINDOWS\
2) http://download5.emsisoft.com/a2FreeSetup.exe
http://downloads2.superantispyware.com/ ... pyware.exe

quei file.exe li posso togliere anche se sta facendo la scansione?

Plu ha scritto:quei file.exe li posso togliere anche se sta facendo la scansione?

Si anche perché non verranno riconosciuti dai due programmi che ti ho suggerito e li devi togliere a mano tu.

non c sono

Abilita la visione dei file nascosti e di sistema.

e per favore non scrivere con abbreviazioni o K non necessarie nei messaggi.

come si fa?

Plu ha scritto:come si fa?

http://www.MegaLab.it/2127

ho fatto quello che dice nel link ma non li trovo comunque.Secondo me è operchè ho aperto un programma che mi fa impallare il pc,può essere?