problemi di navigazione con i browser...dialer?

[MARCO79]

ciao a tutti!

ho problemi con la navigazione con qualsiasi browser usi... sia explorer che mozilla.... sicuramente ho un dialer, perché me lo ha detto anche un tecnico di infostrada quando l'ho chiamato per via della connessione (guarda caso mi ha cominciato a dare problemi quando ho attivato l'adsl con loro... c'entra qualcosa secondo voi?)

comunque... mi aiutate ad estirparlo?

vi posto qui sotto il log di hijackthis!
grazie


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13.17.10, on 30/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\ehome\bak\ehtray.exe
C:\Programmi\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programmi\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programmi\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe
C:\Programmi\ADSL\StarModem ADSL USB MODEM\dslmon.exe
C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\Magentic\bin\MgApp.exe
C:\Programmi\Hewlett-Packard\HP Pavilion Webcam\HPWebcam.exe
C:\Programmi\HP\Digital Imaging\bin\hpqimzone.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Programmi\SPAMfighter\sfus.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Programmi\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Programmi\Windows Live\Messenger\msnmsgr.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE= ... &pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
F2 - REG:system.ini: UserInit=userinit.exe,autorun.bat
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar3.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Programmi\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Programmi\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Programmi\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Programmi\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [9xadiras] 9xadiras.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [BearShare] "C:\Programmi\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [WireLessMouse] C:\Programmi\Trust\Trust R-series Mouse And Keyboard\StartAutorun.exe MouseDrv.exe
O4 - HKLM\..\Run: [KMCONFIG] C:\Programmi\Mouse Driver\StartAutorun.exe KMConfig.exe
O4 - HKLM\..\Run: [SPAMfighter Agent] "C:\Programmi\SPAMfighter\SFAgent.exe" update delay 60
O4 - HKLM\..\Run: [StatusClient] C:\Programmi\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto
O4 - HKLM\..\Run: [TomcatStartup] C:\Programmi\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe
O4 - HKLM\..\Run: [HPLJ Config] C:\Programmi\Hewlett-Packard\hp LaserJet 1010 Series\SetConfig.exe -c Direct -p DOT4_001 -pn "hp LaserJet 1010 Series Driver" -n 0 -l 1040 -sl 120000
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Magentic] C:\PROGRA~1\Magentic\bin\Magentic.exe /c
O4 - HKCU\..\Run: [WMPNSCFG] C:\Programmi\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Avvio rapido HP Photosmart Premier.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: DSLMON.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Pavilion Webcam Tray Icon.lnk = C:\Programmi\Hewlett-Packard\HP Pavilion Webcam\HPWebcam.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=IT_IT&c=64&bd=pavilion&pf=laptop
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/IT-IT/a-U ... E_UNO1.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/S ... anager.ocx
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E3743E1B-5186-45E1-87BC-F4F8BFF3D222}: NameServer = 193.70.152.15 193.70.152.25
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Programmi\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Programmi\File comuni\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SPAMfighter Update Service - SPAMfighter ApS - C:\Programmi\SPAMfighter\sfus.exe

--
End of file - 10773 bytes

[crazy.cat]

C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\ehome\bak\ehtray.exe

Si, hai un trojan dialer.

Fai una scansione con findaw e posta il risultato
http://noahdfear.geekstogo.com/FindAWF.exe

[MARCO79]

non va...
HO SELEZIONATO AL VOCE 1 E MI DICE: "impossibile caricare il supporto VDM IPS/SPX"

[MARCO79]

scusami... eccolo!


Find AWF report by noahdfear ©2006
Version 1.40



bak folders found
~~~~~~~~~~~

Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\BEARSH~1\BAK

0 File 0 byte
2 Directory 12.807.856.128 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\MOUSED~1\BAK

06/03/2007 14.51 212.992 StartAutorun.exe
1 File 212.992 byte
2 Directory 12.807.856.128 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\QUICKT~1\BAK

29/06/2007 05.24 286.720 qttask.exe
1 File 286.720 byte
2 Directory 12.807.852.032 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\SPAMFI~1\BAK

01/11/2007 17.15 308.880 SFAgent.exe
1 File 308.880 byte
2 Directory 12.807.852.032 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\WINDOW~1\BAK

02/11/2006 22.56 204.288 WMPNSCFG.exe
1 File 204.288 byte
2 Directory 12.807.852.032 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\WINDOWS\EHOME\BAK

18/08/2005 05.40 64.512 ehtray.exe
1 File 64.512 byte
2 Directory 12.807.852.032 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\WINDOWS\SMINST\BAK

11/10/2005 09.23 1.187.840 RecGuard.exe
1 File 1.187.840 byte
2 Directory 12.807.852.032 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\WINDOWS\SYSTEM32\BAK

11/04/2006 05.00 15.360 ctfmon.exe
1 File 15.360 byte
2 Directory 12.807.852.032 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\ALWILS~1\AVAST4\BAK

04/12/2007 14.00 79.224 ashDisp.exe
1 File 79.224 byte
2 Directory 12.807.852.032 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\GOOGLE\GOOGLE~1\BAK

25/06/2007 18.17 68.856 GoogleToolbarNotifier.exe
1 File 68.856 byte
2 Directory 12.807.852.032 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\HEWLET~1\DEFAUL~1\BAK

19/06/2006 09.50 40.960 cpqset.exe
1 File 40.960 byte
2 Directory 12.807.852.032 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\HP\HPSOFT~1\BAK

19/02/2006 01.41 49.152 HPWuSchd2.exe
1 File 49.152 byte
2 Directory 12.807.847.936 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\HP\QUICKP~1\BAK

19/07/2006 14.14 102.400 QPService.exe
1 File 102.400 byte
2 Directory 12.807.847.936 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\HPQ\HPWIRE~1\BAK

0 File 0 byte
2 Directory 12.807.847.936 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\INCRED~1\BIN\BAK

04/12/2007 18.01 214.456 IncMail.exe
1 File 214.456 byte
2 Directory 12.807.847.936 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\SYNAPT~1\SYNTP\BAK

17/06/2006 06.22 794.713 SynTPEnh.exe
1 File 794.713 byte
2 Directory 12.807.847.936 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\TRUST\TRUSTR~1\BAK

06/03/2007 10.18 212.992 StartAutorun.exe
1 File 212.992 byte
2 Directory 12.807.847.936 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\JAVA\JRE16~3.0_0\BIN\BAK

25/09/2007 01.11 132.496 jusched.exe
1 File 132.496 byte
2 Directory 12.807.847.936 byte disponibili


Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~

14348 11 Jan 2008 "C:\Programmi\Mouse Driver\StartAutorun.exe"
212992 6 Mar 2007 "C:\Programmi\Mouse Driver\bak\StartAutorun.exe"
14348 11 Jan 2008 "C:\Programmi\Trust\Trust R-series Mouse And Keyboard\StartAutorun.exe"
212992 6 Mar 2007 "C:\Programmi\Trust\Trust R-series Mouse And Keyboard\bak\StartAutorun.exe"
14348 11 Jan 2008 "C:\Programmi\QuickTime\qttask.exe"
286720 29 Jun 2007 "C:\Programmi\QuickTime\bak\qttask.exe"
14348 11 Jan 2008 "C:\Programmi\SPAMfighter\SFAgent.exe"
308880 1 Nov 2007 "C:\Programmi\SPAMfighter\bak\SFAgent.exe"
14348 11 Jan 2008 "C:\Programmi\Windows Media Player\WMPNSCFG.exe"
204288 2 Nov 2006 "C:\Programmi\Windows Media Player\bak\WMPNSCFG.exe"
14348 11 Jan 2008 "C:\WINDOWS\ehome\ehtray.exe"
64512 18 Aug 2005 "C:\WINDOWS\ehome\bak\ehtray.exe"
14348 11 Jan 2008 "C:\WINDOWS\SMINST\RecGuard.exe"
1187840 11 Oct 2005 "C:\WINDOWS\SMINST\bak\RecGuard.exe"
15360 10 Apr 2006 "C:\WINDOWS\system32\ctfmon.exe"
15360 11 Apr 2006 "C:\WINDOWS\system32\bak\ctfmon.exe"
79224 4 Dec 2007 "C:\Programmi\Alwil Software\Avast4\ashDisp.exe"
79224 4 Dec 2007 "C:\Programmi\Alwil Software\Avast4\bak\ashDisp.exe"
52272 23 Feb 2007 "C:\Programmi\Google\googletoolbar3user.exe"
14348 11 Jan 2008 "C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
138168 23 Feb 2007 "C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe"
68856 25 Jun 2007 "C:\Programmi\Google\GoogleToolbarNotifier\bak\GoogleToolbarNotifier.exe"
14348 11 Jan 2008 "C:\Programmi\Hewlett-Packard\Default Settings\cpqset.exe"
40960 19 Jun 2006 "C:\Programmi\Hewlett-Packard\Default Settings\bak\cpqset.exe"
14348 11 Jan 2008 "C:\Programmi\HP\HP Software Update\HPWuSchd2.exe"
49152 19 Feb 2006 "C:\Programmi\HP\HP Software Update\bak\HPWuSchd2.exe"
14348 11 Jan 2008 "C:\Programmi\HP\QuickPlay\QPService.exe"
102400 19 Jul 2006 "C:\Programmi\HP\QuickPlay\bak\QPService.exe"
214456 23 Jan 2008 "C:\Programmi\IncrediMail\bin\IncMail.exe"
214456 4 Dec 2007 "C:\Programmi\IncrediMail\bin\bak\IncMail.exe"
214456 23 Jan 2008 "C:\Documents and Settings\MarDona\Impostazioni locali\Temp\IncrediMail\IMInstall\binaries\IncMail.exe"
14348 11 Jan 2008 "C:\Programmi\Synaptics\SynTP\SynTPEnh.exe"
794713 17 Jun 2006 "C:\Programmi\Synaptics\SynTP\bak\SynTPEnh.exe"
794713 17 Jun 2006 "C:\Programmi\Synaptics\SynTP\Media\SynTPEnh.exe"
901632 17 Jun 2006 "C:\SWSetup\Touchpad\x64\ALL\SynTPEnh.exe"
794713 17 Jun 2006 "C:\SWSetup\Touchpad\WinNT5\Full\All\SynTPEnh.exe"
794713 17 Jun 2006 "C:\SWSetup\Touchpad\WinWDF\Full\ALL\SynTPEnh.exe"
901632 17 Jun 2006 "C:\SWSetup\Touchpad\WinWDF64\Full\ALL\SynTPEnh.exe"
14348 11 Jan 2008 "C:\Programmi\Mouse Driver\StartAutorun.exe"
212992 6 Mar 2007 "C:\Programmi\Mouse Driver\bak\StartAutorun.exe"
14348 11 Jan 2008 "C:\Programmi\Trust\Trust R-series Mouse And Keyboard\StartAutorun.exe"
212992 6 Mar 2007 "C:\Programmi\Trust\Trust R-series Mouse And Keyboard\bak\StartAutorun.exe"
36975 10 Nov 2005 "C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe"
83608 14 Mar 2007 "C:\Programmi\Java\jre1.6.0_01\bin\jusched.exe"
132496 12 Jul 2007 "C:\Programmi\Java\jre1.6.0_02\bin\jusched.exe"
14348 11 Jan 2008 "C:\Programmi\Java\jre1.6.0_03\bin\jusched.exe"
132496 25 Sep 2007 "C:\Programmi\Java\jre1.6.0_03\bin\bak\jusched.exe"


end of report

[ste_95]

Scarica Avenger
Estrailo in una cartella a tua scelta
Esegui il file avenger.exe con la figura di una spada
Metti il pallino su input script manually
Quindi scegli la lente e cliccaci
Ora incolla queste righe nella box bianca che si è aperta:

Files to move:
C:\Programmi\Mouse Driver\bak\StartAutorun.exe | C:\Programmi\Mouse Driver\StartAutorun.exe
C:\Programmi\Trust\Trust R-series Mouse And Keyboard\bak\StartAutorun.exe | C:\Programmi\Trust\Trust R-series Mouse And Keyboard\StartAutorun.exe
C:\Programmi\QuickTime\bak\qttask.exe | C:\Programmi\QuickTime\qttask.exe
C:\Programmi\SPAMfighter\bak\SFAgent.exe | C:\Programmi\SPAMfighter\SFAgent.exe
C:\Programmi\Windows Media Player\bak\WMPNSCFG.exe | C:\Programmi\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\ehome\bak\ehtray.exe | C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\SMINST\bak\RecGuard.exe | C:\WINDOWS\SMINST\RecGuard.exe
C:\WINDOWS\system32\bak\ctfmon.exe | C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Alwil Software\Avast4\bak\ashDisp.exe | C:\Programmi\Alwil Software\Avast4\ashDisp.exe
C:\Programmi\Google\GoogleToolbarNotifier\bak\GoogleToolbarNotifier.exe | C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Programmi\Hewlett-Packard\Default Settings\bak\cpqset.exe | C:\Programmi\Hewlett-Packard\Default Settings\cpqset.exe
C:\Programmi\HP\HP Software Update\bak\HPWuSchd2.exe | C:\Programmi\HP\HP Software Update\HPWuSchd2.exe
C:\Programmi\HP\QuickPlay\bak\QPService.exe | C:\Programmi\HP\QuickPlay\QPService.exe
C:\Programmi\IncrediMail\bin\bak\IncMail.exe | C:\Programmi\IncrediMail\bin\IncMail.exe
C:\Programmi\Synaptics\SynTP\bak\SynTPEnh.exe | C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\Mouse Driver\bak\StartAutorun.exe | C:\Programmi\Mouse Driver\StartAutorun.exe
C:\Programmi\Trust\Trust R-series Mouse And Keyboard\bak\StartAutorun.exe | C:\Programmi\Trust\Trust R-series Mouse And Keyboard\StartAutorun.exe
C:\Programmi\Java\jre1.6.0_03\bin\bak\jusched.exe | C:\Programmi\Java\jre1.6.0_03\bin\jusched.exe

Adesso devi cliccare su Done in basso nella box
Seleziona il semaforino in alto a destra
Rispondi di Si alle due richieste di Avenger
Adesso il tuo computer dovrebbe riavviarsi, nel caso non succedesse, riavvialo tu manualmente
Al riavvio del computer, copia e incolla qui il contenuto del blocco note che apparirà.

[MARCO79]

tutto come hai detto te...
ma il blocco note che si è aperto è completamente bianco...!!

prima che si aprisse, mi aveva chiesto di creare un nuovo file avenger.txt e io gli ho detto Si!

[ste_95]

Posta un nuovo log di findawf e di hijackthis.

[MARCO79]

ok!!

questo è hijackthis!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14.53.47, on 30/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\ehome\bak\ehtray.exe
C:\Programmi\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programmi\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Magentic\bin\MgApp.exe
C:\Programmi\ADSL\StarModem ADSL USB MODEM\dslmon.exe
C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
C:\Programmi\Hewlett-Packard\HP Pavilion Webcam\HPWebcam.exe
C:\Programmi\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe
C:\Programmi\HP\Digital Imaging\bin\hpqimzone.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Programmi\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Programmi\SPAMfighter\sfus.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE= ... &pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
F2 - REG:system.ini: UserInit=userinit.exe,autorun.bat
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar3.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Programmi\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Programmi\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Programmi\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Programmi\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [9xadiras] 9xadiras.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [BearShare] "C:\Programmi\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [WireLessMouse] C:\Programmi\Trust\Trust R-series Mouse And Keyboard\StartAutorun.exe MouseDrv.exe
O4 - HKLM\..\Run: [KMCONFIG] C:\Programmi\Mouse Driver\StartAutorun.exe KMConfig.exe
O4 - HKLM\..\Run: [SPAMfighter Agent] "C:\Programmi\SPAMfighter\SFAgent.exe" update delay 60
O4 - HKLM\..\Run: [StatusClient] C:\Programmi\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto
O4 - HKLM\..\Run: [TomcatStartup] C:\Programmi\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe
O4 - HKLM\..\Run: [HPLJ Config] C:\Programmi\Hewlett-Packard\hp LaserJet 1010 Series\SetConfig.exe -c Direct -p DOT4_001 -pn "hp LaserJet 1010 Series Driver" -n 0 -l 1040 -sl 120000
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Magentic] C:\PROGRA~1\Magentic\bin\Magentic.exe /c
O4 - HKCU\..\Run: [WMPNSCFG] C:\Programmi\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Avvio rapido HP Photosmart Premier.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: DSLMON.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Pavilion Webcam Tray Icon.lnk = C:\Programmi\Hewlett-Packard\HP Pavilion Webcam\HPWebcam.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=IT_IT&c=64&bd=pavilion&pf=laptop
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/IT-IT/a-U ... E_UNO1.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/S ... anager.ocx
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E3743E1B-5186-45E1-87BC-F4F8BFF3D222}: NameServer = 193.70.152.15 193.70.152.25
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Programmi\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Programmi\File comuni\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SPAMfighter Update Service - SPAMfighter ApS - C:\Programmi\SPAMfighter\sfus.exe

--
End of file - 10724 bytes


questo invece è findawf:


Find AWF report by noahdfear ©2006
Version 1.40



bak folders found
~~~~~~~~~~~

Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\BEARSH~1\BAK

0 File 0 byte
2 Directory 12.816.314.368 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\MOUSED~1\BAK

06/03/2007 14.51 212.992 StartAutorun.exe
1 File 212.992 byte
2 Directory 12.816.314.368 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\QUICKT~1\BAK

29/06/2007 05.24 286.720 qttask.exe
1 File 286.720 byte
2 Directory 12.816.310.272 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\SPAMFI~1\BAK

01/11/2007 17.15 308.880 SFAgent.exe
1 File 308.880 byte
2 Directory 12.816.310.272 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\WINDOW~1\BAK

02/11/2006 22.56 204.288 WMPNSCFG.exe
1 File 204.288 byte
2 Directory 12.816.310.272 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\WINDOWS\EHOME\BAK

18/08/2005 05.40 64.512 ehtray.exe
1 File 64.512 byte
2 Directory 12.816.310.272 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\WINDOWS\SMINST\BAK

11/10/2005 09.23 1.187.840 RecGuard.exe
1 File 1.187.840 byte
2 Directory 12.816.310.272 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\WINDOWS\SYSTEM32\BAK

11/04/2006 05.00 15.360 ctfmon.exe
1 File 15.360 byte
2 Directory 12.816.310.272 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\ALWILS~1\AVAST4\BAK

04/12/2007 14.00 79.224 ashDisp.exe
1 File 79.224 byte
2 Directory 12.816.310.272 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\GOOGLE\GOOGLE~1\BAK

25/06/2007 18.17 68.856 GoogleToolbarNotifier.exe
1 File 68.856 byte
2 Directory 12.816.310.272 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\HEWLET~1\DEFAUL~1\BAK

19/06/2006 09.50 40.960 cpqset.exe
1 File 40.960 byte
2 Directory 12.816.310.272 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\HP\HPSOFT~1\BAK

19/02/2006 01.41 49.152 HPWuSchd2.exe
1 File 49.152 byte
2 Directory 12.816.306.176 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\HP\QUICKP~1\BAK

19/07/2006 14.14 102.400 QPService.exe
1 File 102.400 byte
2 Directory 12.816.306.176 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\HPQ\HPWIRE~1\BAK

0 File 0 byte
2 Directory 12.816.306.176 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\INCRED~1\BIN\BAK

04/12/2007 18.01 214.456 IncMail.exe
1 File 214.456 byte
2 Directory 12.816.306.176 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\SYNAPT~1\SYNTP\BAK

17/06/2006 06.22 794.713 SynTPEnh.exe
1 File 794.713 byte
2 Directory 12.816.306.176 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\TRUST\TRUSTR~1\BAK

06/03/2007 10.18 212.992 StartAutorun.exe
1 File 212.992 byte
2 Directory 12.816.306.176 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\JAVA\JRE16~3.0_0\BIN\BAK

25/09/2007 01.11 132.496 jusched.exe
1 File 132.496 byte
2 Directory 12.816.306.176 byte disponibili


Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~

14348 11 Jan 2008 "C:\Programmi\Mouse Driver\StartAutorun.exe"
212992 6 Mar 2007 "C:\Programmi\Mouse Driver\bak\StartAutorun.exe"
14348 11 Jan 2008 "C:\Programmi\Trust\Trust R-series Mouse And Keyboard\StartAutorun.exe"
212992 6 Mar 2007 "C:\Programmi\Trust\Trust R-series Mouse And Keyboard\bak\StartAutorun.exe"
14348 11 Jan 2008 "C:\Programmi\QuickTime\qttask.exe"
286720 29 Jun 2007 "C:\Programmi\QuickTime\bak\qttask.exe"
14348 11 Jan 2008 "C:\Programmi\SPAMfighter\SFAgent.exe"
308880 1 Nov 2007 "C:\Programmi\SPAMfighter\bak\SFAgent.exe"
14348 11 Jan 2008 "C:\Programmi\Windows Media Player\WMPNSCFG.exe"
204288 2 Nov 2006 "C:\Programmi\Windows Media Player\bak\WMPNSCFG.exe"
14348 11 Jan 2008 "C:\WINDOWS\ehome\ehtray.exe"
64512 18 Aug 2005 "C:\WINDOWS\ehome\bak\ehtray.exe"
14348 11 Jan 2008 "C:\WINDOWS\SMINST\RecGuard.exe"
1187840 11 Oct 2005 "C:\WINDOWS\SMINST\bak\RecGuard.exe"
15360 10 Apr 2006 "C:\WINDOWS\system32\ctfmon.exe"
15360 11 Apr 2006 "C:\WINDOWS\system32\bak\ctfmon.exe"
79224 4 Dec 2007 "C:\Programmi\Alwil Software\Avast4\ashDisp.exe"
79224 4 Dec 2007 "C:\Programmi\Alwil Software\Avast4\bak\ashDisp.exe"
52272 23 Feb 2007 "C:\Programmi\Google\googletoolbar3user.exe"
14348 11 Jan 2008 "C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
138168 23 Feb 2007 "C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe"
68856 25 Jun 2007 "C:\Programmi\Google\GoogleToolbarNotifier\bak\GoogleToolbarNotifier.exe"
14348 11 Jan 2008 "C:\Programmi\Hewlett-Packard\Default Settings\cpqset.exe"
40960 19 Jun 2006 "C:\Programmi\Hewlett-Packard\Default Settings\bak\cpqset.exe"
14348 11 Jan 2008 "C:\Programmi\HP\HP Software Update\HPWuSchd2.exe"
49152 19 Feb 2006 "C:\Programmi\HP\HP Software Update\bak\HPWuSchd2.exe"
14348 11 Jan 2008 "C:\Programmi\HP\QuickPlay\QPService.exe"
102400 19 Jul 2006 "C:\Programmi\HP\QuickPlay\bak\QPService.exe"
214456 23 Jan 2008 "C:\Programmi\IncrediMail\bin\IncMail.exe"
214456 4 Dec 2007 "C:\Programmi\IncrediMail\bin\bak\IncMail.exe"
214456 23 Jan 2008 "C:\Documents and Settings\MarDona\Impostazioni locali\Temp\IncrediMail\IMInstall\binaries\IncMail.exe"
14348 11 Jan 2008 "C:\Programmi\Synaptics\SynTP\SynTPEnh.exe"
794713 17 Jun 2006 "C:\Programmi\Synaptics\SynTP\bak\SynTPEnh.exe"
794713 17 Jun 2006 "C:\Programmi\Synaptics\SynTP\Media\SynTPEnh.exe"
901632 17 Jun 2006 "C:\SWSetup\Touchpad\x64\ALL\SynTPEnh.exe"
794713 17 Jun 2006 "C:\SWSetup\Touchpad\WinNT5\Full\All\SynTPEnh.exe"
794713 17 Jun 2006 "C:\SWSetup\Touchpad\WinWDF\Full\ALL\SynTPEnh.exe"
901632 17 Jun 2006 "C:\SWSetup\Touchpad\WinWDF64\Full\ALL\SynTPEnh.exe"
14348 11 Jan 2008 "C:\Programmi\Mouse Driver\StartAutorun.exe"
212992 6 Mar 2007 "C:\Programmi\Mouse Driver\bak\StartAutorun.exe"
14348 11 Jan 2008 "C:\Programmi\Trust\Trust R-series Mouse And Keyboard\StartAutorun.exe"
212992 6 Mar 2007 "C:\Programmi\Trust\Trust R-series Mouse And Keyboard\bak\StartAutorun.exe"
36975 10 Nov 2005 "C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe"
83608 14 Mar 2007 "C:\Programmi\Java\jre1.6.0_01\bin\jusched.exe"
132496 12 Jul 2007 "C:\Programmi\Java\jre1.6.0_02\bin\jusched.exe"
14348 11 Jan 2008 "C:\Programmi\Java\jre1.6.0_03\bin\jusched.exe"
132496 25 Sep 2007 "C:\Programmi\Java\jre1.6.0_03\bin\bak\jusched.exe"


end of report


che dici? se ne è andato quel figlio di trojan?

[ste_95]

Usa di nuovo Avenger, non aveva fatto nulla.

Il file autorun.bat lo conosci?

[MARCO79]

stavolta è andato!

quel file autorun nn sò se è un autorun della pennina o di qualche disco rimovibile... però ti dico che da questo pc ho abuto problemi con un virus che mi colpiva proprio l'autorun di alcuni dischi rimovibili...
forse è ancora lui!

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\tfbayinn

*******************

Script file located at: \??\C:\WINDOWS\system32\mocawbpn.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File move operation C:\Programmi\Mouse Driver\bak\StartAutorun.exe|C:\Programmi\Mouse Driver\StartAutorun.exe completed successfully.
File move operation C:\Programmi\Trust\Trust R-series Mouse And Keyboard\bak\StartAutorun.exe|C:\Programmi\Trust\Trust R-series Mouse And Keyboard\StartAutorun.exe completed successfully.
File move operation C:\Programmi\QuickTime\bak\qttask.exe|C:\Programmi\QuickTime\qttask.exe completed successfully.
File move operation C:\Programmi\SPAMfighter\bak\SFAgent.exe|C:\Programmi\SPAMfighter\SFAgent.exe completed successfully.
File move operation C:\Programmi\Windows Media Player\bak\WMPNSCFG.exe|C:\Programmi\Windows Media Player\WMPNSCFG.exe completed successfully.
File move operation C:\WINDOWS\ehome\bak\ehtray.exe|C:\WINDOWS\ehome\ehtray.exe completed successfully.
File move operation C:\WINDOWS\SMINST\bak\RecGuard.exe|C:\WINDOWS\SMINST\RecGuard.exe completed successfully.
File move operation C:\WINDOWS\system32\bak\ctfmon.exe|C:\WINDOWS\system32\ctfmon.exe completed successfully.
File move operation C:\Programmi\Alwil Software\Avast4\bak\ashDisp.exe|C:\Programmi\Alwil Software\Avast4\ashDisp.exe completed successfully.
File move operation C:\Programmi\Google\GoogleToolbarNotifier\bak\GoogleToolbarNotifier.exe|C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe completed successfully.
File move operation C:\Programmi\Hewlett-Packard\Default Settings\bak\cpqset.exe|C:\Programmi\Hewlett-Packard\Default Settings\cpqset.exe completed successfully.
File move operation C:\Programmi\HP\HP Software Update\bak\HPWuSchd2.exe|C:\Programmi\HP\HP Software Update\HPWuSchd2.exe completed successfully.
File move operation C:\Programmi\HP\QuickPlay\bak\QPService.exe|C:\Programmi\HP\QuickPlay\QPService.exe completed successfully.
File move operation C:\Programmi\IncrediMail\bin\bak\IncMail.exe|C:\Programmi\IncrediMail\bin\IncMail.exe completed successfully.
File move operation C:\Programmi\Synaptics\SynTP\bak\SynTPEnh.exe|C:\Programmi\Synaptics\SynTP\SynTPEnh.exe completed successfully.


File C:\Programmi\Mouse Driver\bak\StartAutorun.exe not found!
File move operation C:\Programmi\Mouse Driver\bak\StartAutorun.exe|C:\Programmi\Mouse Driver\StartAutorun.exe failed!

Could not process line:
C:\Programmi\Mouse Driver\bak\StartAutorun.exe|C:\Programmi\Mouse Driver\StartAutorun.exe
Status: 0xc0000034



File C:\Programmi\Trust\Trust R-series Mouse And Keyboard\bak\StartAutorun.exe not found!
File move operation C:\Programmi\Trust\Trust R-series Mouse And Keyboard\bak\StartAutorun.exe|C:\Programmi\Trust\Trust R-series Mouse And Keyboard\StartAutorun.exe failed!

Could not process line:
C:\Programmi\Trust\Trust R-series Mouse And Keyboard\bak\StartAutorun.exe|C:\Programmi\Trust\Trust R-series Mouse And Keyboard\StartAutorun.exe
Status: 0xc0000034

File move operation C:\Programmi\Java\jre1.6.0_03\bin\bak\jusched.exe|C:\Programmi\Java\jre1.6.0_03\bin\jusched.exe completed successfully.

Completed script processing.

*******************

Finished! Terminate.

[ste_95]

Dovrebbe essere andato tutto a buon fine. Posta un nuovo log di hijackthis e di findawf.

[MARCO79]

speriamo...

vedi qui per hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16.14.36, on 30/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Programmi\SPAMfighter\sfus.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Programmi\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Programmi\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\HP\QuickPlay\QPService.exe
C:\Programmi\HP\HP Software Update\HPWuSchd2.exe
C:\Programmi\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programmi\Mouse Driver\StartAutorun.exe
C:\Programmi\SPAMfighter\SFAgent.exe
C:\Programmi\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe
C:\Programmi\Mouse Driver\KMConfig.exe
C:\Programmi\Trust\Trust R-series Mouse And Keyboard\MouseDrv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Programmi\Mouse Driver\KMProcess.exe
C:\PROGRA~1\Magentic\bin\MgApp.exe
C:\Programmi\Windows Media Player\WMPNSCFG.exe
C:\Programmi\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe
C:\Programmi\ADSL\StarModem ADSL USB MODEM\dslmon.exe
C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
C:\Programmi\Hewlett-Packard\HP Pavilion Webcam\HPWebcam.exe
C:\Programmi\HP\Digital Imaging\bin\hpqimzone.exe
C:\WINDOWS\system32\notepad.exe
C:\Programmi\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Documents and Settings\MarDona\Desktop\MegaLab antivirus\FindAWF.exe
C:\WINDOWS\system32\cmd.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE= ... &pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
F2 - REG:system.ini: UserInit=userinit.exe,autorun.bat
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar3.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Programmi\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Programmi\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Programmi\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Programmi\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [9xadiras] 9xadiras.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [BearShare] "C:\Programmi\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [WireLessMouse] C:\Programmi\Trust\Trust R-series Mouse And Keyboard\StartAutorun.exe MouseDrv.exe
O4 - HKLM\..\Run: [KMCONFIG] C:\Programmi\Mouse Driver\StartAutorun.exe KMConfig.exe
O4 - HKLM\..\Run: [SPAMfighter Agent] "C:\Programmi\SPAMfighter\SFAgent.exe" update delay 60
O4 - HKLM\..\Run: [StatusClient] C:\Programmi\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto
O4 - HKLM\..\Run: [TomcatStartup] C:\Programmi\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe
O4 - HKLM\..\Run: [HPLJ Config] C:\Programmi\Hewlett-Packard\hp LaserJet 1010 Series\SetConfig.exe -c Direct -p DOT4_001 -pn "hp LaserJet 1010 Series Driver" -n 0 -l 1040 -sl 120000
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Magentic] C:\PROGRA~1\Magentic\bin\Magentic.exe /c
O4 - HKCU\..\Run: [WMPNSCFG] C:\Programmi\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Avvio rapido HP Photosmart Premier.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: DSLMON.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Pavilion Webcam Tray Icon.lnk = C:\Programmi\Hewlett-Packard\HP Pavilion Webcam\HPWebcam.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=IT_IT&c=64&bd=pavilion&pf=laptop
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/IT-IT/a-U ... E_UNO1.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/S ... anager.ocx
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E3743E1B-5186-45E1-87BC-F4F8BFF3D222}: NameServer = 193.70.152.15 193.70.152.25
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Programmi\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Programmi\File comuni\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SPAMfighter Update Service - SPAMfighter ApS - C:\Programmi\SPAMfighter\sfus.exe

--
End of file - 11318 bytes


questo è find awf



Find AWF report by noahdfear ©2006
Version 1.40



bak folders found
~~~~~~~~~~~

Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\BEARSH~1\BAK

0 File 0 byte
2 Directory 12.787.949.568 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\MOUSED~1\BAK

0 File 0 byte
2 Directory 12.787.949.568 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\QUICKT~1\BAK

0 File 0 byte
2 Directory 12.787.945.472 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\SPAMFI~1\BAK

0 File 0 byte
2 Directory 12.787.945.472 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\WINDOW~1\BAK

0 File 0 byte
2 Directory 12.787.945.472 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\WINDOWS\EHOME\BAK

0 File 0 byte
2 Directory 12.787.945.472 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\WINDOWS\SMINST\BAK

0 File 0 byte
2 Directory 12.787.945.472 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\WINDOWS\SYSTEM32\BAK

0 File 0 byte
2 Directory 12.787.945.472 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\ALWILS~1\AVAST4\BAK

0 File 0 byte
2 Directory 12.787.945.472 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\GOOGLE\GOOGLE~1\BAK

0 File 0 byte
2 Directory 12.787.945.472 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\HEWLET~1\DEFAUL~1\BAK

0 File 0 byte
2 Directory 12.787.945.472 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\HP\HPSOFT~1\BAK

0 File 0 byte
2 Directory 12.787.945.472 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\HP\QUICKP~1\BAK

0 File 0 byte
2 Directory 12.787.945.472 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\HPQ\HPWIRE~1\BAK

0 File 0 byte
2 Directory 12.787.941.376 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\INCRED~1\BIN\BAK

0 File 0 byte
2 Directory 12.787.941.376 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\SYNAPT~1\SYNTP\BAK

0 File 0 byte
2 Directory 12.787.941.376 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\TRUST\TRUSTR~1\BAK

0 File 0 byte
2 Directory 12.787.941.376 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 73C0-FFAD

Directory di C:\PROGRA~1\JAVA\JRE16~3.0_0\BIN\BAK

0 File 0 byte
2 Directory 12.787.941.376 byte disponibili


Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~



end of report

[ste_95]

Seleziona in hijackthis questa voce e premi fix checked:

F2 - REG:system.ini: UserInit=userinit.exe,autorun.bat

Poi dovrebbe essere tutto a posto. Come ti trovi?

[MARCO79]

sono riuscito a correggerlo/eliminarlo!

ora ho provato ad aprire subito explorer e per magia naviga nuovamente ma è un po' lento!
mozilla pure continua ad essere ancora un po' lento!

in ogni caso qualcosa di meglio va...
ora provo a riavviare il pc, magari si risolve completamente!

[MARCO79]

ah... un'altra cosa...

vedo che il nome di alcuni file nelle cartelle è scritto in blu invece che in nero... perché?

e ogni volta si contaminano di blu sempre più files che magari il giorno prima erano scritti in nero... è un effetto del virus?

[MARCO79]

guarda.... ho riavviato il pc... ma ho ancora problemi!!!

explorer ora si apre, ma comunque naviga con difficoltà!
inoltre, un'altra cosa che ho notato è che con emule, mi sono spariti praticamente tutti i server a cui potermi connettere dalla lista iniziale!
ora ne è rimasto solo uno!

in più ho quei file con il nome in blu come ti ho detto!!

secondo me c'è ancora dell'altro da levare!

[MARCO79]

ciao!!

mi fate sapere che altro posso fare per risolvere i miei problemi?

[ste_95]

Francamente credo che impiegheresti più tempo a trovare le cause dei problemi e a risolverli che a formattare. Cosa vuoi fare?

[MARCO79]

temevo mi dicessi questo

volevo provare a risolvere se era possibile prima di passare all'atto estremo!

pensi si possa fare qualcosa?

poi, ho notato che questi problemi sono nati da quando ho l'adsl con infostrada... prima nn li avevo!
e questi problemi nn ce li ho solo su un pc, ma su tutti i pc con cui mi connetto!

sarà un caso?

[ste_95]

Se la banda è poca e per di più è suddivisa tra più computer è praticamente naturale che la connessione vada lievemente a rilento...