Mi serve un aiuto!!

[Dante88]

Ciao a tutti! E' da un po che seguo il sito per avere informazioni utili e devo dire che siete davvero ingamba
Ora però mi servirebbe il vostro aiuto, perché sono abbastanza incasinato
Ecco il problema:quando cerco di aprire pagine ,sia da IE sia con FF,contenenti la parola "Avenger" mi esce dal browser. Ho visto che anche altri utenti hanno il mio problema ,e o cercato di seguire i vostri consigli ,solo che non mi apre il link;nè di Avenger ,ne di hijackthis, nè Gmer!!Niente!!
Ho scaricato sSpybot è mi a trovato delle minacce: subito eliminate.
pensavo che fosse tutto apposto,invece non e cambiato nulla
Se qualcuno mi puo dar qualche consiglio, ne sarei davvero grato
Grazie in anticipo

[Amantide]

Ciao e benvenuto Dante

Per prima cosa fai la scansione con Virit dalla modalità provvisoria e dopo scarica questo archivio con i vari tool.
Vedi se riesci a fare la scansione con Gmer delle sezioni Autostart e Rootkit e postami qui i log.

[Dante88]

allora con Virit non mi ha trovato nulla;invece con i tools che ho scaricato Avenger, Gmer e hijackthis non me li apre, anzi me li apre per un nano secondo,non riesco neppure a vedere cosa esce e subito si chiude.

[Amantide]

Vedi se riesci a fare la scansione con Systemscan.
Fatta la scansione cerca il file report.txt che si trova in c:\suspectfile, comprimilo in un archivio ed allegalo qui.

[Dante88]

Niente,neache Systemscan mi fa scaricare. Mi sa che l'unica cosa che mi rimane da fare è formatare tutto

[Amantide]

Niente,neache Systemscan mi fa scaricare. Mi sa che l'unica cosa che mi rimane da fare è formatare tutto

Su, non arrenderti
Ora devo uscire ma stasera vedo di trovare qualche alternativa... se hai pazienza di aspettare...

[Amantide]

Allora, riproviamo..
Avenger, Gmer ed altri avevi provato ad eseguire solo dalla modalità normale? hai provato a vedere se si avviano dalla modalità provvisoria?

Il problema di Systemscan stà solo nell'impossibilità di scaricare il programma?
Prova a scaricarlo da questo allegato, avvialo in modalità provvisoria, spunta tutte le voci e fai la scansione.
Attendo la tua risposta.

[Dante88]

Si ho provato a usare Gmer,avenger e gli altri anche in modalità provvisoria, ma nulla,neppure qui mi funzionano.
Per systemscan invece,ora sono riuscito a scaricarlo,ma non mi apre neppure questo,fa come con gli altri, si apre e subito dopo si chiude
mi sa che mi son preso la versione ultra rinforzata di sto virus.
P.s. scusatemi per tutti i fastidi che vi sto dando,ma siete davvero la mia unica speranza.

[research]

Uhm interessante
Scarica questo file sul desktop http://www.bleepingcomputer.com/files/o ... npfind.exe
Avvia il files e si creerà una cartella sul desktop(Winpfind)
Avvia in modalità provvisoria
Apri la cartella WinPFind esegui il file WinPFind.exe
Clicca su start scan
Attendi la fine della scansione
Finita la scansione riavvia normalmente
Apri la solita cartella(Winpfind) e trovi il file winpfind.txt
Copia e incolla il contenuto nella tua risposta

Ciao

Research

PS:Probabilmente vedrai il messaggio "L'applicazione non risponde" lascialo andare si sbloccherà da solo

[Dante88]

la scansione è questa(è abbastanza lunga):
WinPFind logfile created on: 17/02/2007 14.49.54
WinPFind by OldTimer - v2.0.1 Folder = C:\Documents and Settings\Svanz\Desktop\WinPFind\

»»»»»»»»»»»»»»»»»»»» Windows OS and Versions »»»»»»»»»»»»»»»»»»»»

Product Name: Microsoft Windows XP Service Pack 2 | Version: 5.1.2600
Internet Explorer Version: 6.0.2900.2180

»»»»»»»»»»»»»»»»»»»» Memory/Drive Info »»»»»»»»»»»»»»»»»»»»»»»»»»

245232 Kb Total Physical Memory | 168140 Kb Available Physical Memory | 68,56% Memory free
599804 Kb Paging File | 537896 Kb Available in Paging File | 89,68% Paging File free
Paging file location: C:\pagefile.sys 0 0

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programmi
Drive C: | 80027764 Kb Total Space | 49444084 Kb Free Space | 61,78% Space Free
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded

»»»»»»»»»»»»»»»»»»»» Running Processes (All) »»»»»»»»»»»»»»»»»»

C:\Documents and Settings\Svanz\Desktop\WinPFind\WinPFind.exe ()
C:\WINDOWS\explorer.exe (Microsoft Corporation)
C:\WINDOWS\system32\csrss.exe (Microsoft Corporation)
C:\WINDOWS\system32\lsass.exe (Microsoft Corporation)
c:\WINDOWS\system32\services.exe (Microsoft Corporation)
C:\WINDOWS\system32\services.exe (Microsoft Corporation)
C:\WINDOWS\system32\smss.exe (Microsoft Corporation)
C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)
C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)
C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)
C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)
C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)
C:\WINDOWS\system32\winlogon.exe (Microsoft Corporation)

»»»»»»»»»»»»»»»»»»»» Win32 Services (All) »»»»»»»»»»»»»»»»»»»»»

(Alerter) Avvisi [Win32_Shared | Disabled | Stopped]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(ALG) Servizio Gateway di livello applicazione [Win32_Own | On_Demand | Stopped]
= C:\WINDOWS\system32\alg.exe (Microsoft Corporation)

(AppMgmt) Gestione applicazione [Win32_Shared | On_Demand | Stopped]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(AudioSrv) Audio Windows [Win32_Shared | Auto | Stopped]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(BITS) Servizio trasferimento intelligente in background [Win32_Shared | On_Demand | Stopped]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(Browser) Browser di computer [Win32_Shared | Auto | Stopped]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(CiSvc) Servizio di indicizzazione [Win32_Shared | On_Demand | Stopped]
= C:\WINDOWS\system32\cisvc.exe (Microsoft Corporation)

(ClipSrv) ClipBook [Win32_Own | Disabled | Stopped]
= C:\WINDOWS\system32\clipsrv.exe (Microsoft Corporation)

(COMSysApp) Applicazione di sistema COM+ [Win32_Own | On_Demand | Stopped]
= C:\WINDOWS\system32\dllhost.exe (Microsoft Corporation)

(CryptSvc) Servizi di crittografia [Win32_Shared | Auto | Running]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(DcomLaunch) Utilità di avvio processo server DCOM [Win32_Shared | Auto | Running]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(Dhcp) Client DHCP [Win32_Shared | Auto | Running]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(dmadmin) Servizio amministrativo di Gestione disco logico [Win32_Shared | On_Demand | Stopped]
= C:\WINDOWS\system32\dmadmin.exe (Microsoft Corp., Veritas Software)

(dmserver) Gestione dischi logici [Win32_Shared | Auto | Running]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(Dnscache) Client DNS [Win32_Shared | Auto | Running]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(ERSvc) Servizio di segnalazione errori [Win32_Shared | Auto | Stopped]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(Eventlog) Registro eventi [Win32_Shared | Auto | Running]
= C:\WINDOWS\system32\services.exe (Microsoft Corporation)

(EventSystem) Sistema di eventi COM+ [Win32_Shared | On_Demand | Stopped]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(FastUserSwitchingCompatibility) Compatibilità di Cambio rapido utente [Win32_Shared | On_Demand | Stopped]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(helpsvc) Guida in linea e supporto tecnico [Win32_Shared | Auto | Running]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(HidServ) Accesso periferica Human Interface [Win32_Shared | Disabled | Stopped]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(HTTPFilter) SSL HTTP [Win32_Shared | On_Demand | Stopped]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(IDriverT) InstallDriver Table Manager [Win32_Own | On_Demand | Stopped]
= C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)

(ImapiService) Servizio COM di masterizzazione CD IMAPI [Win32_Own | On_Demand | Stopped]
= C:\WINDOWS\system32\imapi.exe (Microsoft Corporation)

(lanmanserver) Server [Win32_Shared | Auto | Running]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(lanmanworkstation) Workstation [Win32_Shared | Auto | Running]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(LmHosts) Helper NetBIOS di TCP/IP [Win32_Shared | Auto | Running]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(MDM) Machine Debug Manager [Win32_Own | Auto | Stopped]
= C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation)

(Messenger) Messenger [Win32_Shared | Disabled | Stopped]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(mnmsrvc) Condivisione desktop remoto di NetMeeting [Win32_Own | On_Demand | Stopped]
= C:\WINDOWS\system32\mnmsrvc.exe (Microsoft Corporation)

(MSDTC) Distributed Transaction Coordinator [Win32_Own | On_Demand | Stopped]
= C:\WINDOWS\system32\msdtc.exe (Microsoft Corporation)

(MSIServer) Windows Installer [Win32_Shared | On_Demand | Stopped]
= C:\WINDOWS\system32\msiexec.exe (Microsoft Corporation)

(NetDDE) DDE di rete [Win32_Shared | Disabled | Stopped]
= C:\WINDOWS\system32\netdde.exe (Microsoft Corporation)

(NetDDEdsdm) DDE DSDM di rete [Win32_Shared | Disabled | Stopped]
= C:\WINDOWS\system32\netdde.exe (Microsoft Corporation)

(Netlogon) Accesso rete [Win32_Shared | On_Demand | Stopped]
= C:\WINDOWS\system32\lsass.exe (Microsoft Corporation)

(Netman) Connessioni di rete [Win32_Shared | On_Demand | Running]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(Nla) NLA (Network Location Awareness) [Win32_Shared | On_Demand | Stopped]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(NtLmSsp) Provider supporto protezione LM NT [Win32_Shared | On_Demand | Stopped]
= C:\WINDOWS\system32\lsass.exe (Microsoft Corporation)

(NtmsSvc) Archivi rimovibili [Win32_Shared | On_Demand | Stopped]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(ose) Office Source Engine [Win32_Own | On_Demand | Stopped]
= C:\Programmi\File comuni\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)

(PlugPlay) Plug and Play [Win32_Shared | Auto | Running]
= C:\WINDOWS\system32\services.exe (Microsoft Corporation)

(PolicyAgent) Servizi IPSEC [Win32_Shared | Auto | Stopped]
= C:\WINDOWS\system32\lsass.exe (Microsoft Corporation)

(ProtectedStorage) Archiviazione protetta [Win32_Shared | Auto | Stopped]
= C:\WINDOWS\system32\lsass.exe (Microsoft Corporation)

(RasAuto) Auto Connection Manager di Accesso remoto [Win32_Shared | On_Demand | Stopped]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(RasMan) Connection Manager di Accesso remoto [Win32_Shared | On_Demand | Stopped]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(RDSessMgr) Gestione sessione di assistenza mediante desktop remoto [Win32_Own | On_Demand | Stopped]
= C:\WINDOWS\system32\sessmgr.exe (Microsoft Corporation)

(RemoteAccess) Routing e Accesso remoto [Win32_Shared | Disabled | Stopped]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(RemoteRegistry) Registro di sistema remoto [Win32_Shared | Auto | Stopped]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(RpcLocator) RPC Locator [Win32_Own | On_Demand | Stopped]
= C:\WINDOWS\system32\locator.exe (Microsoft Corporation)

(RpcSs) RPC (Remote Procedure Call) [Win32_Shared | Auto | Running]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(RSVP) QoS RSVP [Win32_Own | On_Demand | Stopped]
= C:\WINDOWS\system32\rsvp.exe (Microsoft Corporation)

(SamSs) Gestione account di protezione (SAM) [Win32_Shared | Auto | Stopped]
= C:\WINDOWS\system32\lsass.exe (Microsoft Corporation)

(SCardSvr) smart card [Win32_Shared | On_Demand | Stopped]
= C:\WINDOWS\system32\scardsvr.exe (Microsoft Corporation)

(Schedule) Utilità di pianificazione [Win32_Shared | Auto | Stopped]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(seclogon) Accesso secondario [Win32_Shared | Auto | Stopped]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(SENS) Notifica eventi di sistema [Win32_Shared | Auto | Stopped]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(SharedAccess) Windows Firewall / Condivisione connessione Internet (ICS) [Win32_Shared | Auto | Running]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(ShellHWDetection) Rilevamento hardware shell [Win32_Shared | Auto | Stopped]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(Spooler) Spooler di stampa [Win32_Own | Auto | Stopped]
= C:\WINDOWS\system32\spoolsv.exe (Microsoft Corporation)

(srservice) Servizio Ripristino configurazione di sistema [Win32_Shared | Auto | Stopped]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(SSDPSRV) Servizio di rilevamento SSDP [Win32_Shared | On_Demand | Stopped]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(stisvc) Acquisizione di immagini di Windows (WIA) [Win32_Shared | On_Demand | Stopped]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(SwPrv) MS Software Shadow Copy Provider [Win32_Own | On_Demand | Stopped]
= C:\WINDOWS\system32\dllhost.exe (Microsoft Corporation)

(SysmonLog) Avvisi e registri di prestazioni [Win32_Own | On_Demand | Stopped]
= C:\WINDOWS\system32\smlogsvc.exe (Microsoft Corporation)

(TapiSrv) Telefonia [Win32_Shared | On_Demand | Stopped]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(TermService) Servizi terminal [Win32_Shared | On_Demand | Running]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(Themes) Temi [Win32_Shared | Auto | Stopped]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(TlntSvr) Telnet [Win32_Own | Disabled | Stopped]
= C:\WINDOWS\system32\tlntsvr.exe (Microsoft Corporation)

(TrkWks) Manutenzione collegamenti distribuiti client [Win32_Shared | Auto | Stopped]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(UMWdf) Windows User Mode Driver Framework [Win32_Own | Auto | Stopped]
= C:\WINDOWS\system32\wdfmgr.exe (Microsoft Corporation)

(upnphost) Host di periferiche Plug and Play universali [Win32_Shared | On_Demand | Stopped]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(UPS) Gruppo di continuità [Win32_Own | On_Demand | Stopped]
= C:\WINDOWS\system32\ups.exe (Microsoft Corporation)

(usnsvc) Servizio Messenger Sharing USN Journal Reader [Win32_Own | On_Demand | Stopped]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(viritsvclite) Virit eXplorer Lite [Win32_Own | Auto | Stopped]
= C:\VEXPLITE\VIRITSVC.EXE (TG Soft Sas www.tgsoft.it)

(VSS) Copia replicata del volume [Win32_Own | On_Demand | Stopped]
= C:\WINDOWS\system32\vssvc.exe (Microsoft Corporation)

(W32Time) Ora di Windows [Win32_Shared | Auto | Stopped]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(WebClient) WebClient [Win32_Shared | Auto | Stopped]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(winmgmt) Strumentazione gestione Windows [Win32_Shared | Auto | Running]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(WmdmPmSN) Servizio Numero di serie per dispositivi multimediali portatili [Win32_Shared | On_Demand | Stopped]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(Wmi) Estensioni driver di Strumentazione gestione Windows [Win32_Shared | On_Demand | Stopped]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(WmiApSrv) Scheda WMI Performance [Win32_Own | On_Demand | Stopped]
= C:\WINDOWS\system32\wbem\wmiapsrv.exe (Microsoft Corporation)

(wscsvc) Centro sicurezza PC [Win32_Shared | Auto | Stopped]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(wuauserv) Aggiornamenti automatici [Win32_Shared | Auto | Stopped]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(WZCSVC) Zero Configuration reti senza fili [Win32_Shared | Auto | Running]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

(xmlprov) Servizio Provisioning di rete [Win32_Shared | On_Demand | Stopped]
= C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)

»»»»»»»»»»»»»»»»»»»» Driver Services (All) »»»»»»»»»»»»»»»»»»»»

(Abiosdsk) Abiosdsk [Kernel | Disabled | Stopped]
= (File not found)

(abp480n5) abp480n5 [Kernel | Disabled | Stopped]
= (File not found)

(ACPI) Driver ACPI Microsoft [Kernel | Boot | Running]
= C:\WINDOWS\system32\drivers\acpi.sys (Microsoft Corporation)

(ACPIEC) ACPIEC [Kernel | Disabled | Stopped]
= C:\WINDOWS\System32\drivers\acpiec.sys (Microsoft Corporation)

(adpu160m) adpu160m [Kernel | Disabled | Stopped]
= (File not found)

(aec) Eliminatore di eco acustico del kernel Microsoft [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\aec.sys (Microsoft Corporation)

(AFD) AFD [Kernel | System | Running]
= C:\WINDOWS\system32\drivers\afd.sys (Microsoft Corporation)

(Aha154x) Aha154x [Kernel | Disabled | Stopped]
= (File not found)

(aic78u2) aic78u2 [Kernel | Disabled | Stopped]
= (File not found)

(aic78xx) aic78xx [Kernel | Disabled | Stopped]
= (File not found)

(alcan5wn) Alcatel SpeedTouch USB ADSL PPP Networking Driver (NDISWAN) [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\alcan5wn.sys (THOMSON multimedia)

(alcaudsl) Alcatel Speed Touch ADSL Modem ATM Transport [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\alcaudsl.sys (THOMSON multimedia)

(AliIde) AliIde [Kernel | Disabled | Stopped]
= (File not found)

(AmdK7) Driver del processore AMD K7 [Kernel | System | Stopped]
= C:\WINDOWS\system32\drivers\amdk7.sys (Microsoft Corporation)

(amsint) amsint [Kernel | Disabled | Stopped]
= (File not found)

(asc) asc [Kernel | Disabled | Stopped]
= (File not found)

(asc3350p) asc3350p [Kernel | Disabled | Stopped]
= (File not found)

(asc3550) asc3550 [Kernel | Disabled | Stopped]
= (File not found)

(AsyncMac) Driver per supporti asincroni RAS [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\asyncmac.sys (Microsoft Corporation)

(atapi) Controller disco rigido IDE/ESDI standard [Kernel | Boot | Running]
= C:\WINDOWS\system32\drivers\atapi.sys (Microsoft Corporation)

(Atdisk) Atdisk [Kernel | Disabled | Stopped]
= (File not found)

(Atmarpc) Protocollo client ARP ATM [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\atmarpc.sys (Microsoft Corporation)

(audstub) Driver stub audio [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\audstub.sys (Microsoft Corporation)

(Beep) Beep [Kernel | System | Running]
= C:\WINDOWS\System32\drivers\beep.sys (Microsoft Corporation)

(cbidf2k) cbidf2k [Kernel | Disabled | Stopped]
= C:\WINDOWS\System32\drivers\cbidf2k.sys (Microsoft Corporation)

(cd20xrnt) cd20xrnt [Kernel | Disabled | Stopped]
= (File not found)

(Cdaudio) Cdaudio [Kernel | System | Stopped]
= C:\WINDOWS\System32\drivers\cdaudio.sys (Microsoft Corporation)

(Cdfs) Cdfs [File_System | Disabled | Running]
= C:\WINDOWS\System32\drivers\cdfs.sys (Microsoft Corporation)

(Cdrom) Driver del CD-ROM [Kernel | System | Running]
= C:\WINDOWS\system32\drivers\cdrom.sys (Microsoft Corporation)

(Changer) Changer [Kernel | System | Stopped]
= (File not found)

(CmdIde) CmdIde [Kernel | Disabled | Stopped]
= (File not found)

(Cpqarray) Cpqarray [Kernel | Disabled | Stopped]
= (File not found)

(dac960nt) dac960nt [Kernel | Disabled | Stopped]
= (File not found)

(Disk) Driver del disco [Kernel | Boot | Running]
= C:\WINDOWS\system32\drivers\disk.sys (Microsoft Corporation)

(dmboot) dmboot [Kernel | Disabled | Stopped]
= C:\WINDOWS\system32\drivers\dmboot.sys (Microsoft Corp., Veritas Software)

(dmio) Driver Gestione dischi logici [Kernel | Boot | Running]
= C:\WINDOWS\system32\drivers\dmio.sys (Microsoft Corp., Veritas Software)

(dmload) dmload [Kernel | Boot | Running]
= C:\WINDOWS\system32\drivers\dmload.sys (Microsoft Corp., Veritas Software.)

(DMusic) Sintetizzatore DLS Microsoft Kernel [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\DMusic.sys (Microsoft Corporation)

(dpti2o) dpti2o [Kernel | Disabled | Stopped]
= (File not found)

(drmkaud) Decodificatore audio DRM del kernel Microsoft [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\drmkaud.sys (Microsoft Corporation)

(Fastfat) Fastfat [File_System | Disabled | Running]
= C:\WINDOWS\System32\drivers\fastfat.sys (Microsoft Corporation)

(Fdc) Driver controller disco floppy [Kernel | On_Demand | Running]
= C:\WINDOWS\system32\drivers\fdc.sys (Microsoft Corporation)

(FETNDIS) Driver NT scheda Fast Ethernet VIA PCI 10/100Mb [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\fetnd5.sys (VIA Technologies, Inc. )

(FETNDISB) VIA Rhine Family Fast Ethernet Adapter Driver Service [Kernel | On_Demand | Running]
= C:\WINDOWS\system32\drivers\fetnd5b.sys (VIA Technologies, Inc. )

(Fips) Fips [Kernel | System | Stopped]
= C:\WINDOWS\System32\drivers\fips.sys (Microsoft Corporation)

(Flpydisk) Driver disco floppy [Kernel | On_Demand | Running]
= C:\WINDOWS\system32\drivers\flpydisk.sys (Microsoft Corporation)

(FltMgr) FltMgr [File_System | Boot | Running]
= C:\WINDOWS\system32\drivers\fltmgr.sys (Microsoft Corporation)

(Ftdisk) Driver archiviazione volumi [Kernel | Boot | Running]
= C:\WINDOWS\system32\drivers\ftdisk.sys (Microsoft Corporation)

(gmer) gmer [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\gmer.sys (GMER)

(Gpc) Utilità di classificazione pacchetti generica [Kernel | On_Demand | Running]
= C:\WINDOWS\system32\drivers\msgpc.sys (Microsoft Corporation)

(hpn) hpn [Kernel | Disabled | Stopped]
= (File not found)

(HTTP) HTTP [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\http.sys (Microsoft Corporation)

(i2omgmt) i2omgmt [Kernel | System | Stopped]
= (File not found)

(i2omp) i2omp [Kernel | Disabled | Stopped]
= (File not found)

(i8042prt) Driver di porta mouse PS/2 e tastiera i8042 [Kernel | System | Running]
= C:\WINDOWS\system32\drivers\i8042prt.sys (Microsoft Corporation)

(Imapi) Driver filtro masterizzazione CD [Kernel | System | Running]
= C:\WINDOWS\system32\drivers\imapi.sys (Microsoft Corporation)

(ini910u) ini910u [Kernel | Disabled | Stopped]
= (File not found)

(IntelIde) IntelIde [Kernel | Disabled | Stopped]
= (File not found)

(Ip6Fw) Driver Windows Firewall IPv6 [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\ip6fw.sys (Microsoft Corporation)

(IpFilterDriver) Driver filtro traffico IP [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\ipfltdrv.sys (Microsoft Corporation)

(IpInIp) Driver tunnel IP in IP [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\ipinip.sys (Microsoft Corporation)

(IpNat) Traduttore indirizzi di rete IP [Kernel | On_Demand | Running]
= C:\WINDOWS\system32\drivers\ipnat.sys (Microsoft Corporation)

(IPSec) Driver IPSEC [Kernel | System | Running]
= C:\WINDOWS\system32\drivers\ipsec.sys (Microsoft Corporation)

(IRENUM) Servizio enumeratore infrarossi [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\irenum.sys (Microsoft Corporation)

(isapnp) Driver bus PnP ISA/EISA [Kernel | Boot | Running]
= C:\WINDOWS\system32\drivers\isapnp.sys (Microsoft Corporation)

(Kbdclass) Driver classe tastiera [Kernel | System | Running]
= C:\WINDOWS\system32\drivers\kbdclass.sys (Microsoft Corporation)

(kmixer) Mixer wave audio del kernel Microsoft [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\kmixer.sys (Microsoft Corporation)

(KSecDD) KSecDD [Kernel | Boot | Running]
= C:\WINDOWS\System32\drivers\ksecdd.sys (Microsoft Corporation)

(lbrtfdc) lbrtfdc [Kernel | System | Stopped]
= (File not found)

(MEMSWEEP2) MEMSWEEP2 [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\4.tmp (File not found)

(mnmdd) mnmdd [Kernel | System | Stopped]
= C:\WINDOWS\System32\drivers\mnmdd.sys (Microsoft Corporation)

(Modem) Modem [Kernel | On_Demand | Stopped]
= C:\WINDOWS\System32\drivers\modem.sys (Microsoft Corporation)

(Mouclass) Driver classe mouse [Kernel | System | Running]
= C:\WINDOWS\system32\drivers\mouclass.sys (Microsoft Corporation)

(MountMgr) MountMgr [Kernel | Boot | Running]
= C:\WINDOWS\System32\drivers\mountmgr.sys (Microsoft Corporation)

(mraid35x) mraid35x [Kernel | Disabled | Stopped]
= (File not found)

(MRxDAV) Redirector del client WebDav [File_System | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\mrxdav.sys (Microsoft Corporation)

(MRxSmb) MRxSmb [File_System | System | Running]
= C:\WINDOWS\system32\drivers\mrxsmb.sys (Microsoft Corporation)

(Msfs) Msfs [File_System | System | Running]
= C:\WINDOWS\System32\drivers\msfs.sys (Microsoft Corporation)

(MSKSSRV) Proxy di servizio di flusso Microsoft [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\MSKSSRV.sys (Microsoft Corporation)

(MSPCLOCK) Proxy clock di flusso Microsoft [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\MSPCLOCK.sys (Microsoft Corporation)

(MSPQM) Proxy di gestione qualità di flusso Microsoft [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\MSPQM.sys (Microsoft Corporation)

(mssmbios) Driver BIOS Microsoft System Management [Kernel | On_Demand | Running]
= C:\WINDOWS\system32\drivers\mssmbios.sys (Microsoft Corporation)

(Mup) Mup [File_System | Boot | Running]
= C:\WINDOWS\System32\drivers\mup.sys (Microsoft Corporation)

(NDIS) Driver di sistema NDIS [Kernel | Boot | Running]
= C:\WINDOWS\System32\drivers\ndis.sys (Microsoft Corporation)

(NdisTapi) Driver TAPI NDIS di accesso remoto [Kernel | On_Demand | Running]
= C:\WINDOWS\system32\drivers\ndistapi.sys (Microsoft Corporation)

(Ndisuio) Protocollo I/O modalità utente su NDIS [Kernel | On_Demand | Running]
= C:\WINDOWS\system32\drivers\ndisuio.sys (Microsoft Corporation)

(NdisWan) Driver WAN NDIS di accesso remoto [Kernel | On_Demand | Running]
= C:\WINDOWS\system32\drivers\ndiswan.sys (Microsoft Corporation)

(NDProxy) Proxy NDIS [Kernel | On_Demand | Running]
= C:\WINDOWS\System32\drivers\ndproxy.sys (Microsoft Corporation)

(NetBIOS) Interfaccia NetBIOS [File_System | System | Running]
= C:\WINDOWS\system32\drivers\netbios.sys (Microsoft Corporation)

(NetBT) NetBios su Tcpip [Kernel | System | Running]
= C:\WINDOWS\system32\drivers\netbt.sys (Microsoft Corporation)

(Npfs) Npfs [File_System | System | Running]
= C:\WINDOWS\System32\drivers\npfs.sys (Microsoft Corporation)

(Ntfs) Ntfs [File_System | Disabled | Running]
= C:\WINDOWS\System32\drivers\ntfs.sys (Microsoft Corporation)

(Null) Null [Kernel | System | Running]
= C:\WINDOWS\System32\drivers\null.sys (Microsoft Corporation)

(NwlnkFlt) Driver filtro traffico IPX [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\nwlnkflt.sys (Microsoft Corporation)

(NwlnkFwd) Driver inoltratore traffico IPX [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\nwlnkfwd.sys (Microsoft Corporation)

(Parport) Driver della porta parallela [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\parport.sys (Microsoft Corporation)

(PartMgr) PartMgr [Kernel | Boot | Running]
= C:\WINDOWS\System32\drivers\partmgr.sys (Microsoft Corporation)

(ParVdm) ParVdm [Kernel | Auto | Stopped]
= C:\WINDOWS\System32\drivers\parvdm.sys (Microsoft Corporation)

(PCI) PCI Bus Driver [Kernel | Boot | Running]
= C:\WINDOWS\system32\drivers\pci.sys (Microsoft Corporation)

(PCIDump) PCIDump [Kernel | System | Stopped]
= (File not found)

(PCIIde) PCIIde [Kernel | Disabled | Stopped]
= (File not found)

(Pcmcia) Pcmcia [Kernel | Disabled | Stopped]
= C:\WINDOWS\System32\drivers\pcmcia.sys (Microsoft Corporation)

(PDCOMP) PDCOMP [Kernel | On_Demand | Stopped]
= (File not found)

(PDFRAME) PDFRAME [Kernel | On_Demand | Stopped]
= (File not found)

(PDRELI) PDRELI [Kernel | On_Demand | Stopped]
= (File not found)

(PDRFRAME) PDRFRAME [Kernel | On_Demand | Stopped]
= (File not found)

(perc2) perc2 [Kernel | Disabled | Stopped]
= (File not found)

(perc2hib) perc2hib [Kernel | Disabled | Stopped]
= (File not found)

(PptpMiniport) WAN Miniport (PPTP) [Kernel | On_Demand | Running]
= C:\WINDOWS\system32\drivers\raspptp.sys (Microsoft Corporation)

(PSched) Utilità di pianificazione pacchetti QoS [Kernel | On_Demand | Running]
= C:\WINDOWS\system32\drivers\psched.sys (Microsoft Corporation)

(Ptilink) Driver Direct Parallel Link [Kernel | On_Demand | Running]
= C:\WINDOWS\system32\drivers\ptilink.sys (Parallel Technologies, Inc.)

(PxHelp20) PxHelp20 [Kernel | Boot | Running]
= C:\WINDOWS\system32\drivers\PxHelp20.sys (Sonic Solutions)

(ql1080) ql1080 [Kernel | Disabled | Stopped]
= (File not found)

(Ql10wnt) Ql10wnt [Kernel | Disabled | Stopped]
= (File not found)

(ql12160) ql12160 [Kernel | Disabled | Stopped]
= (File not found)

(ql1240) ql1240 [Kernel | Disabled | Stopped]
= (File not found)

(ql1280) ql1280 [Kernel | Disabled | Stopped]
= (File not found)

(RasAcd) Driver connessione automatica Accesso remoto [Kernel | System | Running]
= C:\WINDOWS\system32\drivers\rasacd.sys (Microsoft Corporation)

(Rasl2tp) WAN Miniport (L2TP) [Kernel | On_Demand | Running]
= C:\WINDOWS\system32\drivers\rasl2tp.sys (Microsoft Corporation)

(RasPppoe) Driver PPPOE di accesso remoto [Kernel | On_Demand | Running]
= C:\WINDOWS\system32\drivers\raspppoe.sys (Microsoft Corporation)

(Raspti) Direct Parallel [Kernel | On_Demand | Running]
= C:\WINDOWS\system32\drivers\raspti.sys (Microsoft Corporation)

(Rdbss) Rdbss [File_System | System | Running]
= C:\WINDOWS\system32\drivers\rdbss.sys (Microsoft Corporation)

(RDPCDD) RDPCDD [Kernel | System | Running]
= C:\WINDOWS\system32\drivers\rdpcdd.sys (Microsoft Corporation)

(rdpdr) Driver redirector periferica Terminal Server [Kernel | On_Demand | Running]
= C:\WINDOWS\system32\drivers\rdpdr.sys (Microsoft Corporation)

(RDPWD) RDPWD [Kernel | On_Demand | Stopped]
= C:\WINDOWS\System32\drivers\rdpwd.sys (Microsoft Corporation)

(redbook) Driver filtro riproduzione CD-ROM audio digitale [Kernel | System | Running]
= C:\WINDOWS\system32\drivers\redbook.sys (Microsoft Corporation)

(S3Psddr) S3Psddr [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\s3gnbm.sys (S3 Graphics, Inc.)

(S3SavageNB) S3SavageNB [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\s3gnbm.sys (S3 Graphics, Inc.)

(Secdrv) Secdrv [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\secdrv.sys ()

(serenum) Driver filtro Serenum [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\serenum.sys (Microsoft Corporation)

(Serial) Driver della porta seriale [Kernel | System | Stopped]
= C:\WINDOWS\system32\drivers\serial.sys (Microsoft Corporation)

(Sfloppy) Sfloppy [Kernel | System | Stopped]
= C:\WINDOWS\System32\drivers\sfloppy.sys (Microsoft Corporation)

(Simbad) Simbad [Kernel | Disabled | Stopped]
= (File not found)

(Sparrow) Sparrow [Kernel | Disabled | Stopped]
= (File not found)

(splitter) Frazionatore audio del kernel Microsoft [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\splitter.sys (Microsoft Corporation)

(sr) Driver filtro Ripristino configurazione di sistema [File_System | Disabled | Stopped]
= C:\WINDOWS\system32\drivers\sr.sys (Microsoft Corporation)

(Srv) Srv [File_System | On_Demand | Running]
= C:\WINDOWS\system32\drivers\srv.sys (Microsoft Corporation)

(swenum) Driver bus software [Kernel | On_Demand | Running]
= C:\WINDOWS\system32\drivers\swenum.sys (Microsoft Corporation)

(swmidi) Sintetizzatore Wavetable GS kernel Microsoft [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\swmidi.sys (Microsoft Corporation)

(symc810) symc810 [Kernel | Disabled | Stopped]
= (File not found)

(symc8xx) symc8xx [Kernel | Disabled | Stopped]
= (File not found)

(sym_hi) sym_hi [Kernel | Disabled | Stopped]
= (File not found)

(sym_u3) sym_u3 [Kernel | Disabled | Stopped]
= (File not found)

(sysaudio) Periferica audio di sistema Microsoft Kernel [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\sysaudio.sys (Microsoft Corporation)

(Tcpip) Driver protocollo TCP/IP [Kernel | System | Running]
= C:\WINDOWS\system32\drivers\tcpip.sys (Microsoft Corporation)

(TDPIPE) TDPIPE [Kernel | On_Demand | Stopped]
= C:\WINDOWS\System32\drivers\tdpipe.sys (Microsoft Corporation)

(TDTCP) TDTCP [Kernel | On_Demand | Stopped]
= C:\WINDOWS\System32\drivers\tdtcp.sys (Microsoft Corporation)

(TermDD) Driver della periferica terminale [Kernel | System | Running]
= C:\WINDOWS\system32\drivers\termdd.sys (Microsoft Corporation)

(tmcomm) tmcomm [Kernel | Auto | Stopped]
= C:\WINDOWS\system32\drivers\tmcomm.sys (Trend Micro Inc.)

(TosIde) TosIde [Kernel | Disabled | Stopped]
= (File not found)

(Udfs) Udfs [File_System | Disabled | Stopped]
= C:\WINDOWS\System32\drivers\udfs.sys (Microsoft Corporation)

(ultra) ultra [Kernel | Disabled | Stopped]
= (File not found)

(Update) Driver aggiornamento microcodice [Kernel | On_Demand | Running]
= C:\WINDOWS\system32\drivers\update.sys (Microsoft Corporation)

(usbbus) LGE Mobile Composite USB Device [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\lgusbbus.sys (LG Electronics Inc.)

(usbccgp) Driver principale generico USB Microsoft [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\usbccgp.sys (Microsoft Corporation)

(UsbDiag) LGE Mobile USB Serial Port [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\lgusbdiag.sys (LG Electronics Inc.)

(usbehci) Driver Miniport controller enhanced host USB 2.0 Microsoft [Kernel | On_Demand | Running]
= C:\WINDOWS\system32\drivers\usbehci.sys (Microsoft Corporation)

(usbhub) Driver hub USB standard Microsoft [Kernel | On_Demand | Running]
= C:\WINDOWS\system32\drivers\usbhub.sys (Microsoft Corporation)

(USBModem) LGE Mobile USB Modem [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\lgusbmodem.sys (LG Electronics Inc.)

(USBSTOR) Driver archiviazione di massa USB [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\USBSTOR.SYS (Microsoft Corporation)

(usbuhci) Driver Miniport Controller Universal Host USB Microsoft [Kernel | On_Demand | Running]
= C:\WINDOWS\system32\drivers\usbuhci.sys (Microsoft Corporation)

(VgaSave) VgaSave [Kernel | System | Running]
= C:\WINDOWS\system32\drivers\vga.sys (Microsoft Corporation)

(viaagp) Filtro bus VIA AGP [Kernel | Boot | Running]
= C:\WINDOWS\system32\drivers\VIAAGP.SYS (Microsoft Corporation)

(viaagp1) VIA AGP Filter [Kernel | Boot | Running]
= C:\WINDOWS\system32\drivers\VIAAGP1.SYS (VIA Technologies, Inc.)

(ViaIde) ViaIde [Kernel | Boot | Running]
= C:\WINDOWS\system32\drivers\viaide.sys (Microsoft Corporation)

(VIAudio) VIA AC'97 Audio Controller (WDM) [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\viaudios.sys (VIA Technologies, Inc.)

(VIRAGTLT) VIRAGTLT [Kernel | Disabled | Stopped]
= C:\WINDOWS\system32\drivers\VIRAGTLT.SYS (TG Soft S.a.s.)

(VolSnap) VolSnap [Kernel | Boot | Running]
= C:\WINDOWS\System32\drivers\volsnap.sys (Microsoft Corporation)

(Wanarp) Driver ARP IP di accesso remoto [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\wanarp.sys (Microsoft Corporation)

(WDICA) WDICA [Kernel | On_Demand | Stopped]
= (File not found)

(wdmaud) Driver di compatibilità audio Microsoft WINMM WDM [Kernel | On_Demand | Stopped]
= C:\WINDOWS\system32\drivers\wdmaud.sys (Microsoft Corporation)

(WS2IFSL) Ambiente di supporto del provider del Servizio Non-IFS di Windows Socket 2.0 [Kernel | Disabled | Stopped]
= C:\WINDOWS\system32\drivers\ws2ifsl.sys (Microsoft Corporation)

»»»»»»»»»»»»»»»»»»»» Registry Items (All) »»»»»»»»»»»»»»»»»»»»»

>>>>> Run Keys and Auto-Start Folders <<<<<

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
a-squared = C:\Programmi\a-squared Anti-Malware\a2guard.exe (Emsi Software GmbH)
MessengerPlus3 = C:\Programmi\MessengerPlus! 3\MsgPlus.exe (Patchou)
NeroFilterCheck = C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
NI.UWA6PT_0001_N91M2107 = C:\Documents and Settings\Svanz\Desktop\WinAntiVirusPro2006FreeInstall_it.exe (File not found)
QuickTime Task = C:\Programmi\QuickTime\qttask.exe (Apple Computer, Inc.)
SunJavaUpdateSched = C:\Programmi\Java\jre1.5.0_10\bin\jusched.exe (Sun Microsystems, Inc.)
VIRIT LITE MONITOR = C:\VEXPLITE\MONLITE.EXE (TG Soft S.a.s.)

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation)
MessengerPlus3 = C:\Programmi\MessengerPlus! 3\MsgPlus.exe (Patchou)
MSMSGS = C:\Programmi\Messenger\msmsgs.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Setup]
Registrando Panda ActiveX = C:\WINDOWS\system32\regsvr32.exe /s C:\WINDOWS\system32\ActiveScan\as.dll (File not found)
Registrando Panda Almacen = C:\WINDOWS\system32\regsvr32.exe /s C:\WINDOWS\system32\ActiveScan\pavpz.dll (File not found)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx]*


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx]*


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
Installed = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
Installed = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
Installed = 1

< Common Startup Folder = C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica >
C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\Avvio veloce di Adobe Reader.lnk
= C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)

C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\desktop.ini ()

< User Startup Folder = C:\Documents and Settings\Svanz\Menu Avvio\Programmi\Esecuzione automatica >
C:\Documents and Settings\Svanz\Menu Avvio\Programmi\Esecuzione automatica\desktop.ini ()

C:\Documents and Settings\Svanz\Menu Avvio\Programmi\Esecuzione automatica\Trend Micro Anti-Spyware.lnk
C:\Programmi\Trend Micro\Tmasy\Tmasy.exe (Trend Micro Incorporated)

>>>>> MsConfig Disabled Items <<<<<

>>>>> Disabled Startup Folder Items <<<<<

>>>>> Items Started Through Miscellaneous Registry Keys <<<<<

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path]
Debugger = C:\WINDOWS\system32\ntsd.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
CDBurn = {fbeb8a05-beee-4442-804e-409d6c4515e9} ( HKLM = C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) )
PostBootReminder = {7849596a-48ea-486e-8937-a2a3009f31a9} ( HKLM = C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) )
SysTray = {35CEC8A3-2BE6-11D2-8773-92E220524153} ( HKLM = C:\WINDOWS\system32\stobject.dll (Microsoft Corporation) )
WebCheck = {E6FB5E20-DE35-11CF-9C87-00AA005127ED} ( HKLM = C:\WINDOWS\system32\webcheck.dll (Microsoft Corporation) )

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972} = ( HKLM = C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) )

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
{438755C2-A8BA-11D1-B96B-00A0C90312E1} = Precaricatore Browseui ( HKLM = C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) )
{8C7461EF-2B13-11d2-BE35-3078302C2030} = Daemon di cache delle categorie di componenti ( HKLM = C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) )

>>>>> Security Providers <<<<<

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders]
C:\WINDOWS\system32\msapsspc.dll (Microsoft Corporation)
C:\WINDOWS\system32\schannel.dll (Microsoft Corporation)
C:\WINDOWS\system32\digest.dll (Microsoft Corporation)
C:\WINDOWS\system32\msnsspc.dll (Microsoft Corporation)

>>>>> Winlogon Keys <<<<<

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell]
C:\WINDOWS\explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit]
c:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
c:\WINDOWS\system32\lotusmonitor.exe ()

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet]
C:\WINDOWS\system32\rundll32.exe (Microsoft Corporation)
C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
Control_RunDLL (File not found)
C:\WINDOWS\system32\sysdm.cpl (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
DllName = C:\WINDOWS\system32\crypt32.dll (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
DllName = C:\WINDOWS\system32\cryptnet.dll (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
DllName = C:\WINDOWS\system32\cscdll.dll (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
DllName = C:\WINDOWS\system32\wlnotify.dll (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
DllName = C:\WINDOWS\system32\wlnotify.dll (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
DllName = C:\WINDOWS\system32\sclgntfy.dll (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
DllName = C:\WINDOWS\system32\wlnotify.dll (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
DllName = C:\WINDOWS\system32\wlnotify.dll (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
DllName = C:\WINDOWS\system32\wlnotify.dll (Microsoft Corporation)

>>>>> Policy Keys <<<<<

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]*

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum]
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} = 1
{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} = 1073741857
{0DF44EAA-FF21-4412-828E-260A8728E7F1} = 32

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
dontdisplaylastusername = 0
legalnoticecaption =
legalnoticetext =
shutdownwithoutlogon = 1
undockwithoutlogon = 1

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]*

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]
NoDriveTypeAutoRun = 145

>>>>> Desktop Components <<<<<

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
FriendlyName = Pagina iniziale corrente
Source = About:Home
SubscribedURL = About:Home

>>>>> HOSTS File <<<<<

HOSTS file found at: C:\WINDOWS\System32\drivers\etc\Hosts (Size: 768 bytes | Modified Date: 31/08/2001 16.00.00)
127.0.0.1 localhost

>>>>> Internet Explorer Settings <<<<<

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
Default_Page_URL = http://www.microsoft.com/isapi/redir.dl ... ar=msnhome
Default_Search_URL = http://www.google.com/ie
Local Page = %SystemRoot%\system32\blank.htm
Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search]
CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
Default_Search_URL = http://www.google.com/ie
SearchAssistant = http://www.google.com/ie

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main]
Local Page = C:\WINDOWS\system32\blank.htm
Search Bar = http://www.google.com/ie
Search Page = http://www.google.com
Start Page = http://www.google.it/

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Search]
SearchAssistant = http://www.google.com/ie

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
{CFBFAE00-17A6-11D0-99CB-00C04FD64497} = Hook per la ricerca di URL Microsoft ( HKLM = C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation) )

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
ProxyEnable = 0

>>>>> Browser Helper Objects <<<<<

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
- Adobe PDF Reader Link Helper ( HKLM = C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) )

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0A60E309-B029-EB32-22EA-47FAAC242B45}]
- Class ( HKLM = C:\WINDOWS\mwije1.dll (File not found) )

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{311F9DE8-6126-4EEE-B15F-65CBB3B4F9F6}]
- XBTP06568 Class ( HKLM = C:\Programmi\AOL Security Toolbar\AOL_security_toolbar.dll () )

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
- SSVHelper Class ( HKLM = C:\Programmi\Java\jre1.5.0_10\bin\ssv.dll (Sun Microsystems, Inc.) )

>>>>> Bars, Toolbars and Extensions <<<<<

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376}]
- &Suggerimenti ( HKLM = C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation) )

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{21569614-B795-46B1-85F4-E737A8DC09AD}]
- Shell Search Band ( HKLM = C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) )

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{EFA24E61-B078-11D0-89E4-00C04FC9E26E}]
- Favorites Band ( HKLM = C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation) )

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{EFA24E62-B078-11D0-89E4-00C04FC9E26E}]
- History Band ( HKLM = C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation) )

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{EFA24E64-B078-11D0-89E4-00C04FC9E26E}]
- Explorer Band ( HKLM = C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation) )

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar]
{3BB63FD4-3C00-44D7-94A9-5DE211900DEF} - AOL Security Toolbar ( HKLM = C:\Programmi\AOL Security Toolbar\AOL_security_toolbar.dll () )

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\ToolBar\ShellBrowser]
{01E04581-4EEE-11D0-BFE9-00AA005B4383} - &Indirizzo ( HKLM = C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) )
{2318C2B1-4965-11D4-9B18-009027A5CD4F} - Reg Data - Key not found ( HKLM = Reg Data - Key not found (File not found) )

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\ToolBar\WebBrowser]
{01E04581-4EEE-11D0-BFE9-00AA005B4383} - &Indirizzo ( HKLM = C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) )
{0E5CBF21-D15F-11D0-8301-00AA005B4383} - Co&llegamenti ( HKLM = C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) )
{3BB63FD4-3C00-44D7-94A9-5DE211900DEF} - AOL Security Toolbar ( HKLM = C:\Programmi\AOL Security Toolbar\AOL_security_toolbar.dll () )

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} = 8194 - Reg Data - Value does not exist ( HKLM = Reg Data - Key not found (File not found) )
{92780B25-18CC-41C8-B9BE-3C9C571A8263} = 8193 - Reg Data - Key not found ( HKLM = Reg Data - Key not found (File not found) )
{FB5F1910-F110-11d2-BB9E-00C04F795683} = 8192 - Reg Data - Key not found ( HKLM = Reg Data - Key not found (File not found) )
NextId = 8195

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}]
MenuText = Sun Java Console
ClsidExtension = {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC} - Java Plug-in 1.5.0_10 ( HKLM C:\Programmi\Java\jre1.5.0_10\bin\npjpi150_10.dll (Sun Microsystems, Inc.) )
ClsidExtension = {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC} - Java Plug-in 1.5.0_10 ( HKCU C:\Programmi\Java\jre1.5.0_10\bin\ssv.dll (Sun Microsystems, Inc.) )

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{92780B25-18CC-41C8-B9BE-3C9C571A8263}]
ButtonText = Ricerche

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11d2-BB9E-00C04F795683}]
ButtonText = Messenger
MenuText = Windows Messenger
Exec = C:\Programmi\Messenger\msmsgs.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\E&sporta in Microsoft Excel]
@ = 000 (File not found)

>>>>> Approved Shell Extensions <<<<<

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
{00020D75-0000-0000-C000-000000000046} = Microsoft Office Outlook ( HKLM = C:\Programmi\Microsoft Office\OFFICE11\MLSHEXT.DLL (Microsoft Corporation) )
{00022613-0000-0000-C000-000000000046} = Proprietà dei file Multimedia ( HKLM = C:\WINDOWS\system32\mmsys.cpl (Microsoft Corporation) )
{0006F045-0000-0000-C000-000000000046} = Estensione dell'icona del file di Outlook ( HKLM = C:\Programmi\Microsoft Office\OFFICE11\OLKFSTUB.DLL (Microsoft Corporation) )
{00BB2763-6A77-11D0-A535-00C04FD7D062} = Completamento automatico Microsoft ( HKLM = C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) )
{00BB2764-6A77-11D0-A535-00C04FD7D062} = Elenco di Completamento automatico della Cronologia di Microsoft ( HKLM = C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) )
{00BB2765-6A77-11D0-A535-00C04FD7D062} = Contenitore dell'elenco di Completamento automatico multiplo Microsoft ( HKLM = C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) )
{00E7B358-F65B-4dcf-83DF-CD026B94BFD4} = Shell Autoplay for Slideshow ( HKLM = Reg Data - Key not found (File not found) )
{01E04581-4EEE-11d0-BFE9-00AA005B4383} = &Indirizzo ( HKLM = C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) )
{03C036F1-A186-11D0-824A-00AA005B4383} = Elenco di Completamento automatico di Shell Folder di Microsoft ( HKLM = C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) )
{07798131-AF23-11d1-9111-00A0C98BA67D} = Ricerca Web ( HKLM = C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) )
{08165EA0-E946-11CF-9C87-00AA005127ED} = WebCheckWebCrawler ( HKLM = C:\WINDOWS\system32\webcheck.dll (Microsoft Corporation) )
{0A89A860-D7B1-11CE-8350-444553540000} = Shell Automation Inproc Service ( HKLM = C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation) )
{0B124F8F-91F0-11D1-B8B5-006008059382} = Enumeratore applicazioni installate ( HKLM = C:\WINDOWS\system32\appwiz.cpl (Microsoft Corporation) )
{0CD7A5C0-9F37-11CE-AE65-08002B2E1262} = File cabinet ( HKLM = C:\WINDOWS\system32\cabview.dll (Microsoft Corporation) )
{0D45D530-764B-11d0-A1CA-00AA00C16E65} = Directory Property UI ( HKLM = C:\WINDOWS\system32\dsuiext.dll (Microsoft Corporation) )
{0DF44EAA-FF21-4412-828E-260A8728E7F1} = Barra delle applicazioni e menu di avvio ( HKLM = Reg Data - Key not found (File not found) )
{0EEA25CC-4362-4A12-850B-86EE61B0D3EB} = Microsoft DocProp Inplace Droplist Combo Control ( HKLM = C:\WINDOWS\system32\docprop2.dll (Microsoft Corporation) )
{10CFC467-4392-11d2-8DB4-00C04FA31A66} = Offline Files Folder Options ( HKLM = C:\WINDOWS\system32\cscui.dll (Microsoft Corporation) )
{131A6951-7F78-11D0-A979-00C04FD705A2} = ISFBand OC ( HKLM = C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation) )
{143A62C8-C33B-11D1-84FE-00C04FA34A14} = Microsoft Agent Character Property Sheet Handler ( HKLM = C:\WINDOWS\msagent\agentpsh.dll (Microsoft Corporation) )
{163FDC20-2ABC-11d0-88F0-00A024AB2DBB} = Directory Object Find ( HKLM = C:\WINDOWS\system32\dsquery.dll (Microsoft Corporation) )
{169A0691-8DF9-11d1-A1C4-00C04FD75D13} = Ricerca all'interno ( HKLM = C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) )
{176d6597-26d3-11d1-b350-080036a75b03} = Gestore scanner ICM ( HKLM = C:\WINDOWS\system32\icmui.dll (Microsoft Corporation) )
{1F2E5C40-9550-11CE-99D2-00AA006E086C} = Estensione shell di protezione ( HKLM = C:\WINDOWS\system32\rshx32.dll (Microsoft Corporation) )
{21569614-B795-46b1-85F4-E737A8DC09AD} = Shell Search Band ( HKLM = C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) )
{2206CDB2-19C1-11D1-89E0-00C04FD7A829} = Microsoft OLE DB Service Component Data Links ( HKLM = C:\Programmi\File comuni\System\Ole DB\oledb32.dll (Microsoft Corporation) )
{22BF0C20-6DA7-11D0-B373-00A0C9034938} = Stato del download ( HKLM = C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) )
{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0} = Cerca ( HKLM = C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation) )
{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0} = Guida in linea e supporto tecnico ( HKLM = C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation) )
{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0} = Protezione di Windows ( HKLM = C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation) )
{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0} = Esegui... ( HKLM = C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation) )
{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0} = Internet ( HKLM = C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation) )
{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0} = Posta elettronica ( HKLM = C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation) )
{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0} = Set Program Access and Defaults ( HKLM = C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation) )
{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33} = Microsoft DocProp Inplace Time Control ( HKLM = C:\WINDOWS\system32\docprop2.dll (Microsoft Corporation) )
{30D02401-6A81-11d0-8274-00C04FD5AE38} = SearchBand ( HKLM = C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) )
{32714800-2E5F-11d0-8B85-00AA0044F941} = &Contatti... ( HKLM = C:\Programmi\Outlook Express\wabfind.dll (Microsoft Corporation) )
{352EC2B7-8B9A-11D1-B8AE-006008059382} = Gestione applicazioni shell ( HKLM = C:\WINDOWS\system32\appwiz.cpl (Microsoft Corporation) )
{3C374A40-BAE4-11CF-BF7D-00AA006946EE} = Servizio Cronologia Url Microsoft ( HKLM = C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation) )
{3CCF8A41-5C85-11d0-9796-00AA00B90ADF} = Shell DeskBarApp ( HKLM = C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) )
{3DC7A020-0ACD-11CF-A9BB-00AA004AE837} = Internet ( HKLM = C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation) )
{3EA48300-8CF6-101B-84FB-666CCB9BCD32} = Pagina di proprietà di Docfile OLE ( HKLM = C:\WINDOWS\system32\docprop.dll (Microsoft Corporation) )
{3F30C968-480A-4C6C-862D-EFC0897BB84B} = GDI + programma di estrazione file in anteprima ( HKLM = C:\WINDOWS\system32\shimgvw.dll (Microsoft Corporation) )
{3F953603-1008-4f6e-A73A-04AAC7A992F1} = Scanner e fotocamere digitali ( HKLM = C:\WINDOWS\system32\wiashext.dll (Microsoft Corporation) )
{40C3D757-D6E4-4b49-BB41-0E5BBEA28817} = Video Media Properties Handler ( HKLM = C:\WINDOWS\system32\shmedia.dll (Microsoft Corporation) )
{40dd6e20-7c17-11ce-a804-00aa003ca9f6} = Estensioni shell per la condivisione ( HKLM = C:\WINDOWS\system32\ntshrui.dll (Microsoft Corporation) )
{41E300E0-78B6-11ce-849B-444553540000} = Estensione CPL PlusPack ( HKLM = C:\WINDOWS\system32\themeui.dll (Microsoft Corporation) )
{42042206-2D85-11D3-8CFF-005004838597} = Microsoft Office HTML Icon Handler ( HKLM = C:\Programmi\Microsoft Office\OFFICE11\MSOHEV.DLL (Microsoft Corporation) )
{42071712-76d4-11d1-8b24-00a0c9068ff3} = Estensione scheda video del Pannello di controllo ( HKLM = C:\WINDOWS\system32\deskadp.dll (Microsoft Corporation) )
{42071713-76d4-11d1-8b24-00a0c9068ff3} = Estensione monitor del Pannello di controllo ( HKLM = C:\WINDOWS\system32\deskmon.dll (Microsoft Corporation) )
{42071714-76d4-11d1-8b24-00a0c9068ff3} = Estensione panoramica video del Pannello di controllo ( HKLM = deskpan.dll (File not found) )
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} = Shell Extension for Malware scanning ( CLSID not found! )
{4a7ded0a-ad25-11d0-98a8-0800361b1103} = MyDocs menu and properties ( HKLM = C:\WINDOWS\system32\mydocs.dll (Microsoft Corporation) )
{4E40F770-369C-11d0-8922-00A024AB2DBB} = Estensione shell di protezione ( HKLM = C:\WINDOWS\system32\dssec.dll (Microsoft Corporation) )
{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8} = Pagina compatibilità ( HKLM = C:\WINDOWS\system32\slayerxp.dll (Microsoft Corporation) )
{52B87208-9CCF-42C9-B88E-069281105805} = Trojan Remover Shell Extension ( CLSID not found! )
{56117100-C0CD-101B-81E2-00AA004AE837} = Gestore dati dei ritagli di shell ( HKLM = C:\WINDOWS\system32\shscrap.dll (Microsoft Corporation) )
{58f1f272-9240-4f51-b6d4-fd63d1618591} = Creazione guidata profilo Passport ( HKLM = C:\WINDOWS\system32\netplwiz.dll (Microsoft Corporation) )
{59099400-57FF-11CE-BD94-0020AF85B590} = Estensione copia dischi ( HKLM = C:\WINDOWS\system32\diskcopy.dll (Microsoft Corporation) )
{596AB062-B4D2-4215-9F74-E9109B0A8153} = Pagina proprietà versioni precedenti ( HKLM = C:\WINDOWS\system32\twext.dll (Microsoft Corporation) )
{59be4990-f85c-11ce-aff7-00aa003ca9f6} = Estensioni shell per oggetti Rete Microsoft Windows ( HKLM = C:\WINDOWS\system32\ntlanui2.dll (Microsoft Corporation) )
{5DB2625A-54DF-11D0-B6C4-0800091AA605} = Gestore monitor ICM ( HKLM = C:\WINDOWS\system32\icmui.dll (Microsoft Corporation) )
{5E6AB780-7743-11CF-A12B-00AA004AE837} = Barra degli strumenti Microsoft Internet ( HKLM = C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) )
{5F327514-6C5E-4d60-8F16-D07FA08A78ED} = Auto Update Property Sheet Extension ( HKLM = C:\WINDOWS\system32\wuaucpl.cpl (Microsoft Corporation) )
{60254CA5-953B-11CF-8C96-00AA00B8708C} = Shell Extension For Windows Script Host ( HKLM = C:\WINDOWS\system32\wshext.dll (Microsoft Corporation) )
{60fd46de-f830-4894-a628-6fa81bc0190d} = Oggetto DropTarget per Stampa guidata foto ( HKLM = C:\WINDOWS\system32\photowiz.dll (Microsoft Corporation) )
{62AE1F9A-126A-11D0-A14B-0800361B1103} = Directory Context Menu Verbs ( HKLM = C:\WINDOWS\system32\dsuiext.dll (Microsoft Corporation) )
{63da6ec0-2e98-11cf-8d82-444553540000} = Microsoft FTP Folder ( HKLM = C:\WINDOWS\system32\msieftp.dll (Microsoft Corporation) )
{6413BA2C-B461-11d1-A18A-080036B11A03} = Shell Folder 2 accresciuto ( HKLM = C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) )
{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178} = Shell Image Data Factory ( HKLM = C:\WINDOWS\system32\shimgvw.dll (Microsoft Corporation) )
{6756A641-DE71-11d0-831B-00AA005B4383} = Elenco di Completamento automatico MRU ( HKLM = C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) )
{675F097E-4C4D-11D0-B6C1-0800091AA605} = Gestore stampante ICM ( HKLM = C:\WINDOWS\system32\icmui.dll (Microsoft Corporation) )
{67EA19A0-CCEF-11d0-8024-00C04FD75D13} = CDF Extension Copy Hook ( HKLM = C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation) )
{692F0339-CBAA-47e6-B5B5-3B84DB604E87} = Extensions Manager Folder ( HKLM = C:\WINDOWS\system32\extmgr.dll (Microsoft Corporation) )
{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A} = Elenco di Completamento automatico MRU personalizzato ( HKLM = C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) )
{6A205B57-2567-4A2C-B881-F787FAB579A3} = Microsoft DocProp Inplace Calendar Control ( HKLM = C:\WINDOWS\system32\docprop2.dll (Microsoft Corporation) )
{6b33163c-76a5-4b6c-bf21-45de9cd503a1} = Oggetto Pubblicazione guidata sul Web ( HKLM = C:\WINDOWS\system32\netplwiz.dll (Microsoft Corporation) )
{7007ACC7-3202-11D1-AAD2-00805FC1270E} = Connessioni di rete ( HKLM = C:\WINDOWS\system32\netshell.dll (Microsoft Corporation) )
{7376D660-C583-11d0-A3A5-00C04FD706EC} = TridentImageExtractor ( HKLM = C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) )
{7444C717-39BF-11D1-8CD9-00C04FC29D45} = CryptPKO Class ( HKLM = C:\WINDOWS\system32\cryptext.dll (Microsoft Corporation) )
{7444C719-39BF-11D1-8CD9-00C04FC29D45} = CryptSig Class ( HKLM = C:\WINDOWS\system32\cryptext.dll (Microsoft Corporation) )
{750fdf0e-2a26-11d1-a3ea-080036587f03} = Offline Files Menu ( HKLM = C:\WINDOWS\system32\cscui.dll (Microsoft Corporation) )
{764BF0E1-F219-11ce-972D-00AA00A14F56} = Estensioni shell per la compressione dei file ( CLSID not found! )
{77597368-7b15-11d0-a0c2-080036af3f03} = Estensione shell per la stampante Web ( HKLM = C:\WINDOWS\system32\printui.dll (Microsoft Corporation) )
{792F0537-F929-4eb7-AC1D-FB6334C71550} = LG Phone ( HKLM = C:\Programmi\LG PC Suite\LG Phone Manager\Phone.dll (LG Electornics) )
{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF} = Scheduling UI property sheet handler ( HKLM = C:\WINDOWS\system32\mstask.dll (Microsoft Corporation) )
{7988B573-EC89-11cf-9C00-00AA00A14F56} = Microsoft Disk Quota UI ( HKLM = C:\WINDOWS\system32\dskquoui.dll (Microsoft Corporation) )
{7A80E4A8-8005-11D2-BCF8-00C04F72C717} = ExtractIcon Class ( HKLM = C:\WINDOWS\system32\mmcshext.dll (Microsoft Corporation) )
{7A9D77BD-5403-11d2-8785-2E0420524153} = Account utente ( HKLM = Reg Data - Key not found (File not found) )
{7BA4C742-9E81-11CF-99D3-00AA004AE837} = Microsoft BrowserBand ( HKLM = C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) )
{7BD29E00-76C1-11CF-9DD0-00A0C9034933} = File temporanei Internet ( HKLM = C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation) )
{7BD29E01-76C1-11CF-9DD0-00A0C9034933} = File temporanei Internet ( HKLM = C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation) )
{7D559C10-9FE9-11d0-93F7-00AA0059CE02} = Code Download Agent ( HKLM = C:\WINDOWS\system32\webcheck.dll (Microsoft Corporation) )
{7e653215-fa25-46bd-a339-34a2790f3cb7} = Accessibile ( HKLM = C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) )
{7F1CF152-04F8-453A-B34C-E609530A9DC8} = NeroDigitalPropSheetHandler Class ( HKLM = C:\Programmi\File comuni\Ahead\Lib\NeroDigitalExt.dll (Nero AG) )
{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB} = WebCheck SyncMgr Handler ( HKLM = C:\WINDOWS\system32\webcheck.dll (Microsoft Corporation) )
{83bbcbf3-b28a-4919-a5aa-73027445d672} = Scanner e fotocamere digitali ( HKLM = C:\WINDOWS\system32\wiashext.dll (Microsoft Corporation) )
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} = Menu di scelta rapida di crittografia ( CLSID not found! )
{85BBD920-42A0-1069-A2E4-08002B30309D} = Sincronia file ( HKLM = C:\WINDOWS\system32\syncui.dll (Microsoft Corporation) )
{871C5380-42A0-1069-A2EA-08002B30309D} = Internet Name Space ( HKLM = C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation) )
{875CB1A1-0F29-45de-A1AE-CFB4950D0B78} = Audio Media Properties Handler ( HKLM = C:\WINDOWS\system32\shmedia.dll (Microsoft Corporation) )
{87D62D94-71B3-4b9a-9489-5FE6850DC73E} = Avi Properties Handler ( HKLM = C:\WINDOWS\system32\shmedia.dll (Microsoft Corporation) )
{883373C3-BF89-11D1-BE35-080036B11A03} = Microsoft DocProp Shell Ext ( HKLM = C:\WINDOWS\system32\docprop2.dll (Microsoft Corporation) )
{88895560-9AA2-1069-930E-00AA0030EBC8} = HyperTerminal Icon Ext ( HKLM = C:\WINDOWS\system32\hticons.dll (Hilgraeve, Inc.) )
{888DCA60-FC0A-11CF-8F0F-00C04FD7D062} = Compressed (zipped) Folder SendTo Target ( HKLM = C:\WINDOWS\system32\zipfldr.dll (Microsoft Corporation) )
{88C6C381-2E85-11D0-94DE-444553540000} = Cartella cache ActiveX ( HKLM = C:\WINDOWS\system32\occache.dll (Microsoft Corporation) )
{8A23E65E-31C2-11d0-891C-00A024AB2DBB} = Directory Query UI ( HKLM = C:\WINDOWS\system32\dsquery.dll (Microsoft Corporation) )
{8DD448E6-C188-4aed-AF92-44956194EB1F} = WMP Burn Audio CD Launcher ( HKLM = C:\WINDOWS\system32\wmpshell.dll (Microsoft Corporation) )
{8EE97210-FD1F-4B19-91DA-67914005F020} = Microsoft DocProp Inplace ML Edit Box Control ( HKLM = C:\WINDOWS\system32\docprop2.dll (Microsoft Corporation) )
{905667aa-acd6-11d2-8080-00805f6596d2} = Scanner e fotocamere digitali ( HKLM = C:\WINDOWS\system32\wiashext.dll (Microsoft Corporation) )
{91EA3F8B-C99B-11d0-9815-00C04FD91972} = Shell Folder accresciuto ( HKLM = C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) )
{9461b922-3c5a-11d2-bf8b-00c04fb93661} = Search Assistant OC ( HKLM = C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation) )
{992CFFA0-F557-101A-88EC-00DD010CCC48} = Connessioni di rete ( HKLM = C:\WINDOWS\system32\netshell.dll (Microsoft Corporation) )
{9DB7A13C-F208-4981-8353-73CC61AE2783} = Versioni precedenti ( HKLM = C:\WINDOWS\system32\twext.dll (Microsoft Corporation) )
{9DBD2C50-62AD-11d0-B806-00C04FD706EC} = Summary Info Thumbnail handler (DOCFILES) ( HKLM = C:\WINDOWS\system32\shimgvw.dll (Microsoft Corporation) )
{9E51E0D0-6E0F-11d2-9601-00C04FA31A86} = Shell properties for a DS object ( HKLM = C:\WINDOWS\system32\dsquery.dll (Microsoft Corporation) )
{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE} = Sendmail service ( HKLM = C:\WINDOWS\system32\sendmail.dll (Microsoft Corporation) )
{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE} = Sendmail service ( HKLM = C:\WINDOWS\system32\sendmail.dll (Microsoft Corporation) )
{A08C11D2-A228-11d0-825B-00AA005B4383} = Address EditBox ( HKLM = C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) )
{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC} = Schermata iniziale applicazioni Internet Explorer 4 ( HKLM = C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation) )
{A5E46E3A-8849-11D1-9D8C-00C04FC99D61} = Microsoft Browser Architecture ( HKLM = C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation) )
{A6FD9E45-6E44-43f9-8644-08598F5A74D9} = Midi Properties Handler ( HKLM = C:\WINDOWS\system32\shmedia.dll (Microsoft Corporation) )
{A9CF0EAE-901A-4739-A481-E35B73E47F6D} = Microsoft DocProp Inplace Edit Box Control ( HKLM = C:\WINDOWS\system32\docprop2.dll (Microsoft Corporation) )
{AB77609F-2178-4E6F-9C4B-44AC179D937A} = a-squared context menu ( HKLM = C:\Programmi\a-squared Anti-Malware\a2contmenu.dll (Emsi Software GmbH) )
{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE} = Subscription Mgr ( HKLM = C:\WINDOWS\system32\webcheck.dll (Microsoft Corporation) )
{acf35015-526e-4230-9596-becbe19f0ac9} = Indicatore di avanzamento popup ( HKLM = C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) )
{add36aa8-751a-4579-a266-d66f5202ccbb} = Ordinazione di stampe tramite Web ( HKLM = C:\WINDOWS\system32\netp

[Amantide]

Dobbiamo ringraziare research per averci consigliato questo programma

Allora, devi ripulire il valore Userinit del registro di sistema, vedi qui come si fa. Praticamente dovrai eliminare questa parte c:\WINDOWS\system32\lotusmonitor.exe
Fatto ciò elimina dalla modalità provvisoria il file lotusmonitor.exe
A questo punto dovresti poter utilizzare Avenger. Mentre tu sistemi Userinit ti preparo lo scipt da eseguire con Avenger.

[Amantide]

Eccolo qui:

Files to delete:
C:\WINDOWS\system32\4.tmp
c:\WINDOWS\system32\lotusmonitor.exe
C:\WINDOWS\mwije1.dll

registry keys to delete:
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0A60E309-B029-EB32-22EA-47FAAC242B45}
HKLM\SYSTEM\CurrentControlSet\Services\MEMSWEEP2

Fammi sapere come sarà andata

[research]

Prego
Il log postato è incompleto forse,non entrava tutto nel forum

Ciao

[Dante88]

Sono appena tornato è ho fatto tutto

Questo è il log di Avenger:


Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\bsw^yqts

*******************

Script file located at: \??\C:\WINDOWS\system32\dsmaccfe.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



File C:\WINDOWS\system32\4.tmp not found!
Deletion of file C:\WINDOWS\system32\4.tmp failed!

Could not process line:
C:\WINDOWS\system32\4.tmp
Status: 0xc0000034

File c:\WINDOWS\system32\lotusmonitor.exe deleted successfully.


File C:\WINDOWS\mwije1.dll not found!
Deletion of file C:\WINDOWS\mwije1.dll failed!

Could not process line:
C:\WINDOWS\mwije1.dll
Status: 0xc0000034

Registry key HKLM\SYSTEM\CurrentControlSet\Services\MEMSWEEP2 deleted successfully.
Registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0A60E309-B029-EB32-22EA-47FAAC242B45} deleted successfully.

Completed script processing.

*******************

Finished! Terminate.
Altro da fare ora?????
Per ora posso solo dirvi 1000000000000000000000000000000000 di grazie ! Siete fantastici!

[Amantide]

Mi dici i programmi di sicurezza che hai installati, eccetto Virit ed A-squared?
Hai l'antivirus di Trend Micro?

[Dante88]

Allora oltre ad Virit ho installato Ad-Aware,Antivir e CClearn.
Si prima avevo anche trend micro,ne avevo scaricati abbastanza prima,per cercare sto divolo di un virus, ma ora li ho gia eliminati

[Amantide]

Allora oltre ad Virit ho installato .............. Antivir ...........

Spero che funzioni bene... perché nel log non sono riuscita a vederlo

[Dante88]

Allora oltre ad Virit ho installato .............. Antivir ...........

Spero che funzioni bene... perché nel log non sono riuscita a vederlo

scusa se rispondo solo ora, ma oltre che un virus al pc, me lo son preso pure io
Su antivir hai ragione, infatti l'ho installato appena son riuscito a mettere tutto apposto.
Ora il pc va benissimo, grazie ancora per i mille aiuti che mi avete dato

[Panetto]

Scusate l'intrusione, ma mi sono iscritto giusto per ringraziarvi di questo argomento - e dei tools suggeriti - che mi hanno permesso di risolvere un doppio problema sul mio pc (simile a quello di Dante88).

Era un paio di settimane che ci stavo dietro!!!

Grazie di cuore, veramente!!!