b.skitodayplease,doginhispen etc etc. "Risolto"

[baroneashura]

Ho il problema con doginhispen....a.skitodayplease etc ....
Chi è così gentile da darmi un aiuto?
posto il log Hijackthis......
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23.11.53, on 04/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Intel\Wireless\Bin\EvtEng.exe
C:\Programmi\Intel\Wireless\Bin\S24EvMon.exe
C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Windows\RUNXMLPL.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
C:\Programmi\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\roberto\Documenti\prevxcsi.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programmi\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
C:\Programmi\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\SPYWAREfighter\spftray.exe
C:\Programmi\SPYWAREfighter\spfprc.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\notepad.exe
C:\Programmi\Symantec\LiveUpdate\LuComServer_3_4.EXE
C:\Programmi\Symantec\LiveUpdate\AUPDATE.EXE
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Programmi\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Programmi\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Documents and Settings\roberto\Impostazioni locali\Temporary Internet Files\Content.IE5\WR73UA33\HiJackThis[1].exe
C:\Programmi\Symantec\LiveUpdate\LuCallbackProxy.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://virgilio.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://it.rd.yahoo.com/customize/ycomp/ ... .yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Yahoo! Toolbar con blocco Pop-Up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Programmi\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Programmi\File comuni\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\FILECO~1\SYMANT~1\IDS\IPSBHO.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar con blocco Pop-Up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Programmi\Macrogaming\SweetIMBarForIE\toolbar.dll
O3 - Toolbar: Mostra Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Programmi\File comuni\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [preload] C:\Windows\RUNXMLPL.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AzMixerSel] C:\Programmi\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ntiMUI] C:\Programmi\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [LaunchAp] "C:\Programmi\Launch Manager\LaunchAp.exe"
O4 - HKLM\..\Run: [LManager] "C:\Programmi\Launch Manager\HotkeyApp.exe"
O4 - HKLM\..\Run: [CtrlVol] "C:\Programmi\Launch Manager\CtrlVol.exe"
O4 - HKLM\..\Run: [LMgrOSD] "C:\Programmi\Launch Manager\OSDCtrl.exe"
O4 - HKLM\..\Run: [Wbutton] "C:\Programmi\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [eLockMonitor] C:\Acer\Empowering Technology\eLock\Monitor\LaunchMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Programmi\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Programmi\File comuni\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Programmi\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Programmi\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Programmi\Brother\Brmfl04g\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Programmi\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [Pinnacle WebUpdater] "C:\Programmi\Pinnacle\Shared Files\Programs\WebUpdater\WebUpdater.exe" -s -f=UpdateVersion.xml -url=http://cdn.pinnaclesys.com/SupportFiles
O4 - HKLM\..\Run: [SweetIM] C:\Programmi\Macrogaming\SweetIM\SweetIM.exe
O4 - HKLM\..\Run: [InCD] C:\Programmi\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Programmi\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [spywarefighterguard] C:\Programmi\SPYWAREfighter\spftray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Programmi\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [updateMgr] C:\Programmi\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [SweetIM] C:\Programmi\Macrogaming\SweetIM\SweetIM.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: PrevxCSI.lnk = ?
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programmi\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programmi\ICQLite\ICQLite.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Programmi\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Programmi\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{3F601675-5211-4C2B-A1E1-049B5FA03C3B}: NameServer = 213.215.115.88,147.175.167.50
O17 - HKLM\System\CCS\Services\Tcpip\..\{6BE7F8D7-8E81-419D-934D-D22FE506DC26}: NameServer = 193.70.152.25 193.70.192.25
O17 - HKLM\System\CS1\Services\Tcpip\..\{3F601675-5211-4C2B-A1E1-049B5FA03C3B}: NameServer = 213.215.115.88,147.175.167.50
O17 - HKLM\System\CS2\Services\Tcpip\..\{3F601675-5211-4C2B-A1E1-049B5FA03C3B}: NameServer = 213.215.115.88,147.175.167.50
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Programmi\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\VAScanner\comHost.exe
O23 - Service: eLock Service (eLockService) - - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Programmi\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Programmi\WinPcap\rpcapd.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SPYWAREfighterRP - SpamFighter APS - C:\Programmi\SPYWAREfighter\spfprc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\FILECO~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: Utilità di pianificazione di LiveUpdate automatico - Symantec Corporation - C:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe

--
End of file - 12389 bytes

e il log Awf

Find AWF report by noahdfear ©2006
Version 1.40



bak folders found
~~~~~~~~~~~

Il volume nell'unit… C Š ACER
Numero di serie del volume: 75A0-C17C

Directory di C:\WINDOWS\BAK

19/05/2005 17.09 32.768 RUNXMLPL.exe
1 File 32.768 byte
2 Directory 38.998.540.288 byte disponibili
Il volume nell'unit… C Š ACER
Numero di serie del volume: 75A0-C17C

Directory di C:\WINDOWS\SYSTEM32\BAK

07/09/2004 05.00 15.360 ctfmon.exe
10/11/2003 17.06 406.016 PSDrvCheck.exe
2 File 421.376 byte
2 Directory 38.998.540.288 byte disponibili
Il volume nell'unit… C Š ACER
Numero di serie del volume: 75A0-C17C

Directory di C:\WINDOWS\EHOME\BAK

17/08/2005 22.40 64.512 ehtray.exe
1 File 64.512 byte
2 Directory 38.998.540.288 byte disponibili
Il volume nell'unit… C Š ACER
Numero di serie del volume: 75A0-C17C

Directory di C:\PROGRA~1\MESSEN~1\BAK

13/10/2004 17.24 1.694.208 msmsgs.exe
1 File 1.694.208 byte
2 Directory 38.998.540.288 byte disponibili
Il volume nell'unit… C Š ACER
Numero di serie del volume: 75A0-C17C

Directory di C:\PROGRA~1\LAUNCH~1\BAK

16/09/2003 14.28 20.480 CtrlVol.exe
19/04/2006 15.08 69.632 HotkeyApp.exe
25/07/2005 13.36 32.768 LaunchAp.exe
25/07/2005 10.45 241.664 OSDCtrl.exe
20/04/2006 09.23 86.016 Wbutton.exe
5 File 450.560 byte
2 Directory 38.998.540.288 byte disponibili
Il volume nell'unit… C Š ACER
Numero di serie del volume: 75A0-C17C

Directory di C:\PROGRA~1\MICROS~2\BAK

24/03/2005 00.26 217.088 point32.exe
1 File 217.088 byte
2 Directory 38.998.540.288 byte disponibili
Il volume nell'unit… C Š ACER
Numero di serie del volume: 75A0-C17C

Directory di C:\WINDOWS\IME\IMJP8_1\BAK

07/09/2004 05.00 208.952 IMJPMIG.EXE
1 File 208.952 byte
2 Directory 38.998.540.288 byte disponibili
Il volume nell'unit… C Š ACER
Numero di serie del volume: 75A0-C17C

Directory di C:\PROGRA~1\FILECO~1\SYMANT~1\BAK

0 File 0 byte
2 Directory 38.998.540.288 byte disponibili
Il volume nell'unit… C Š ACER
Numero di serie del volume: 75A0-C17C

Directory di C:\PROGRA~1\SYNAPT~1\SYNTP\BAK

0 File 0 byte
2 Directory 38.998.540.288 byte disponibili
Il volume nell'unit… C Š ACER
Numero di serie del volume: 75A0-C17C

Directory di C:\PROGRA~1\REALTEK\INSTAL~1\BAK

11/06/2005 20.51 53.248 AzMixerSel.exe
1 File 53.248 byte
2 Directory 38.998.540.288 byte disponibili
Il volume nell'unit… C Š ACER
Numero di serie del volume: 75A0-C17C

Directory di C:\PROGRA~1\NEWTEC~1\NTICD&~1\BAK

11/05/2005 17.15 45.056 ntiMUI.exe
1 File 45.056 byte
2 Directory 38.998.540.288 byte disponibili
Il volume nell'unit… C Š ACER
Numero di serie del volume: 75A0-C17C

Directory di C:\PROGRA~1\SCANSOFT\PAPERP~1\BAK

10/03/2004 12.19 40.960 IndexSearch.exe
10/03/2004 12.04 57.393 pptd40nt.exe
2 File 98.353 byte
2 Directory 38.998.540.288 byte disponibili
Il volume nell'unit… C Š ACER
Numero di serie del volume: 75A0-C17C

Directory di C:\PROGRA~1\BROTHER\BRMFL04G\BAK

11/11/2004 17.14 49.152 BrStDvPt.exe
1 File 49.152 byte
2 Directory 38.998.540.288 byte disponibili
Il volume nell'unit… C Š ACER
Numero di serie del volume: 75A0-C17C

Directory di C:\PROGRA~1\BROTHER\CONTRO~1\BAK

11/11/2004 22.00 864.256 brctrcen.exe
1 File 864.256 byte
2 Directory 38.998.540.288 byte disponibili
Il volume nell'unit… C Š ACER
Numero di serie del volume: 75A0-C17C

Directory di C:\PROGRA~1\MACROG~1\SWEETIM\BAK

12/08/2007 11.02 103.712 SweetIM.exe
1 File 103.712 byte
2 Directory 38.998.540.288 byte disponibili
Il volume nell'unit… C Š ACER
Numero di serie del volume: 75A0-C17C

Directory di C:\PROGRA~1\AHEAD\INCD\BAK

12/09/2002 18.13 1.101.824 InCD.exe
1 File 1.101.824 byte
2 Directory 38.998.540.288 byte disponibili
Il volume nell'unit… C Š ACER
Numero di serie del volume: 75A0-C17C

Directory di C:\ACER\EMPOWE~1\EDATAS~1\BAK

17/03/2006 15.00 345.088 eDSloader.exe
1 File 345.088 byte
2 Directory 38.998.540.288 byte disponibili
Il volume nell'unit… C Š ACER
Numero di serie del volume: 75A0-C17C

Directory di C:\ACER\EMPOWE~1\EPOWER\BAK

15/03/2006 22.12 579.584 Boot.exe
30/03/2006 18.47 421.888 ePower_DMC.exe
2 File 1.001.472 byte
2 Directory 38.998.540.288 byte disponibili
Il volume nell'unit… C Š ACER
Numero di serie del volume: 75A0-C17C

Directory di C:\ACER\EMPOWE~1\EPRESE~1\BAK

31/03/2006 16.39 204.800 ePresentation.exe
1 File 204.800 byte
2 Directory 38.998.540.288 byte disponibili
Il volume nell'unit… C Š ACER
Numero di serie del volume: 75A0-C17C

Directory di C:\ACER\EMPOWE~1\ERECOV~1\BAK

01/06/2006 14.40 413.696 eRAgent.exe
1 File 413.696 byte
2 Directory 38.998.540.288 byte disponibili
Il volume nell'unit… C Š ACER
Numero di serie del volume: 75A0-C17C

Directory di C:\WINDOWS\SYSTEM32\IME\PINTLGNT\BAK

07/09/2004 05.00 59.392 ImScInst.exe
1 File 59.392 byte
2 Directory 38.998.540.288 byte disponibili
Il volume nell'unit… C Š ACER
Numero di serie del volume: 75A0-C17C

Directory di C:\WINDOWS\SYSTEM32\IME\TINTLGNT\BAK

07/09/2004 05.00 455.168 TINTSETP.EXE
1 File 455.168 byte
2 Directory 38.998.540.288 byte disponibili
Il volume nell'unit… C Š ACER
Numero di serie del volume: 75A0-C17C

Directory di C:\PROGRA~1\FILECO~1\SCANSO~1\SSBKGD~1\BAK

14/10/2003 10.22 155.648 SSBkgdupdate.exe
1 File 155.648 byte
2 Directory 38.998.540.288 byte disponibili
Il volume nell'unit… C Š ACER
Numero di serie del volume: 75A0-C17C

Directory di C:\PROGRA~1\ADOBE\ACROBA~1.0\READER\BAK

30/03/2006 16.45 313.472 AdobeUpdateManager.exe
1 File 313.472 byte
2 Directory 38.998.540.288 byte disponibili
Il volume nell'unit… C Š ACER
Numero di serie del volume: 75A0-C17C

Directory di C:\PROGRA~1\PINNACLE\SHARED~1\PROGRAMS\WEBUPD~1\BAK

26/03/2006 12.10 380.928 WebUpdater.exe
1 File 380.928 byte
2 Directory 38.998.540.288 byte disponibili


Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~

14348 31 Jan 2008 "C:\WINDOWS\RUNXMLPL.exe"
32768 19 May 2005 "C:\WINDOWS\bak\RUNXMLPL.exe"
15360 7 Sep 2004 "C:\WINDOWS\system32\ctfmon.exe"
15360 7 Sep 2004 "C:\WINDOWS\system32\bak\ctfmon.exe"
14348 31 Jan 2008 "C:\WINDOWS\system32\PSDrvCheck.exe"
406016 10 Nov 2003 "C:\WINDOWS\system32\bak\PSDrvCheck.exe"
64512 17 Aug 2005 "C:\WINDOWS\ehome\ehtray.exe"
59392 10 Aug 2004 "C:\WINDOWS\$NtUninstallKB900325$\ehtray.exe"
64512 17 Aug 2005 "C:\WINDOWS\ehome\bak\ehtray.exe"
1667584 4 Aug 2004 "C:\WINDOWS\$NtUninstallKB887472$\msmsgs.exe"
14348 31 Jan 2008 "C:\Programmi\Messenger\msmsgs.exe"
1694208 13 Oct 2004 "C:\Programmi\Messenger\bak\msmsgs.exe"
1694208 13 Oct 2004 "C:\WINDOWS\$hf_mig$\KB887472\SP2QFE\msmsgs.exe"
14348 31 Jan 2008 "C:\Programmi\Launch Manager\LaunchAp.exe"
32768 25 Jul 2005 "C:\Programmi\Launch Manager\bak\LaunchAp.exe"
14348 31 Jan 2008 "C:\Programmi\Launch Manager\HotkeyApp.exe"
69632 19 Apr 2006 "C:\Programmi\Launch Manager\bak\HotkeyApp.exe"
14348 31 Jan 2008 "C:\Programmi\Launch Manager\CtrlVol.exe"
20480 16 Sep 2003 "C:\Programmi\Launch Manager\bak\CtrlVol.exe"
14348 31 Jan 2008 "C:\Programmi\Launch Manager\OSDCtrl.exe"
241664 25 Jul 2005 "C:\Programmi\Launch Manager\bak\OSDCtrl.exe"
14348 31 Jan 2008 "C:\Programmi\Launch Manager\Wbutton.exe"
86016 20 Apr 2006 "C:\Programmi\Launch Manager\bak\Wbutton.exe"
14348 31 Jan 2008 "C:\Programmi\Microsoft IntelliPoint\point32.exe"
217088 24 Mar 2005 "C:\Programmi\Microsoft IntelliPoint\bak\point32.exe"
208952 7 Sep 2004 "C:\WINDOWS\ime\imjp8_1\imjpmig.exe"
208952 7 Sep 2004 "C:\WINDOWS\ime\imjp8_1\bak\IMJPMIG.EXE"
14348 31 Jan 2008 "C:\Programmi\Realtek\InstallShield\AzMixerSel.exe"
53248 11 Jun 2005 "C:\Programmi\Realtek\InstallShield\bak\AzMixerSel.exe"
14348 31 Jan 2008 "C:\Programmi\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe"
45056 11 May 2005 "C:\Programmi\NewTech Infosystems\NTI CD & DVD-Maker 7\bak\ntiMUI.exe"
14348 31 Jan 2008 "C:\Programmi\ScanSoft\PaperPort\pptd40nt.exe"
57393 10 Mar 2004 "C:\Programmi\ScanSoft\PaperPort\bak\pptd40nt.exe"
14348 31 Jan 2008 "C:\Programmi\ScanSoft\PaperPort\IndexSearch.exe"
40960 10 Mar 2004 "C:\Programmi\ScanSoft\PaperPort\bak\IndexSearch.exe"
14348 31 Jan 2008 "C:\Programmi\Brother\Brmfl04g\BrStDvPt.exe"
49152 11 Nov 2004 "C:\Programmi\Brother\Brmfl04g\bak\BrStDvPt.exe"
14348 31 Jan 2008 "C:\Programmi\Brother\ControlCenter2\brctrcen.exe"
864256 11 Nov 2004 "C:\Programmi\Brother\ControlCenter2\bak\brctrcen.exe"
14348 31 Jan 2008 "C:\Programmi\Macrogaming\SweetIM\SweetIM.exe"
103712 12 Aug 2007 "C:\Programmi\Macrogaming\SweetIM\bak\SweetIM.exe"
14348 31 Jan 2008 "C:\Programmi\Ahead\InCD\InCD.exe"
1101824 12 Sep 2002 "C:\Programmi\Ahead\InCD\bak\InCD.exe"
14348 31 Jan 2008 "C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe"
345088 17 Mar 2006 "C:\Acer\Empowering Technology\eDataSecurity\bak\eDSloader.exe"
14348 31 Jan 2008 "C:\Acer\Empowering Technology\ePower\ePower_DMC.exe"
421888 30 Mar 2006 "C:\Acer\Empowering Technology\ePower\bak\ePower_DMC.exe"
14348 31 Jan 2008 "C:\Acer\Empowering Technology\ePower\Boot.exe"
579584 15 Mar 2006 "C:\Acer\Empowering Technology\ePower\bak\Boot.exe"
81920 26 Jan 2006 "C:\Acer\Empowering Technology\ePresentation\ePresentationLauncher.exe"
204800 31 Mar 2006 "C:\Acer\Empowering Technology\ePresentation\bak\ePresentation.exe"
14348 31 Jan 2008 "C:\Acer\Empowering Technology\eRecovery\eRAgent.exe"
413696 1 Jun 2006 "C:\Acer\Empowering Technology\eRecovery\bak\eRAgent.exe"
59392 7 Sep 2004 "C:\WINDOWS\system32\IME\PINTLGNT\imscinst.exe"
59392 7 Sep 2004 "C:\WINDOWS\system32\IME\PINTLGNT\bak\ImScInst.exe"
455168 7 Sep 2004 "C:\WINDOWS\system32\IME\TINTLGNT\tintsetp.exe"
455168 7 Sep 2004 "C:\WINDOWS\system32\IME\TINTLGNT\bak\TINTSETP.EXE"
14348 31 Jan 2008 "C:\Programmi\File comuni\ScanSoft Shared\SSBkgdUpdate\SSBkgdupdate.exe"
155648 14 Oct 2003 "C:\Programmi\File comuni\ScanSoft Shared\SSBkgdUpdate\bak\SSBkgdupdate.exe"
14348 31 Jan 2008 "C:\Programmi\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe"
313472 30 Mar 2006 "C:\Programmi\Adobe\Acrobat 7.0\Reader\bak\AdobeUpdateManager.exe"
331776 28 Jan 2000 "C:\Programmi\File comuni\InstallShield\WebUpdate\WebUpdate.exe"
331776 28 Jan 2000 "C:\Programmi\Common Files\InstallShield\WebUpdate\WebUpdate.exe"
14348 31 Jan 2008 "C:\Programmi\Pinnacle\Shared Files\Programs\WebUpdater\WebUpdater.exe"
380928 26 Mar 2006 "C:\Programmi\Pinnacle\Shared Files\Programs\WebUpdater\bak\WebUpdater.exe"

end of report

Con PrevxCSi mi trova 6 file infetti. se devo postarli perché poi è molto più facile eliminarli ditemelo.

Scusate se c'è tanta roba ma sono giorni che ci provo cercando quà e là nei vari forum ma sono una frana.
Grazie...in anticipo.

[ste_95]

Scarica Avenger
Estrailo in una cartella a tua scelta
Esegui il file avenger.exe con la figura di una spada
Metti il pallino su input script manually
Quindi scegli la lente e cliccaci
Ora incolla queste righe nella box bianca che si è aperta:

Codice: Seleziona tutto

Files to move:
C:\WINDOWS\bak\RUNXMLPL.exe | C:\WINDOWS\RUNXMLPL.exe
C:\WINDOWS\system32\bak\ctfmon.exe | C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\bak\PSDrvCheck.exe | C:\WINDOWS\system32\PSDrvCheck.exe
C:\WINDOWS\ehome\bak\ehtray.exe | C:\WINDOWS\ehome\ehtray.exe
C:\Programmi\Messenger\bak\msmsgs.exe | C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\Launch Manager\bak\LaunchAp.exe | C:\Programmi\Launch Manager\LaunchAp.exe
C:\Programmi\Launch Manager\bak\HotkeyApp.exe | C:\Programmi\Launch Manager\HotkeyApp.exe
C:\Programmi\Launch Manager\bak\CtrlVol.exe | C:\Programmi\Launch Manager\CtrlVol.exe
C:\Programmi\Launch Manager\bak\OSDCtrl.exe | C:\Programmi\Launch Manager\OSDCtrl.exe
C:\Programmi\Launch Manager\bak\Wbutton.exe | C:\Programmi\Launch Manager\Wbutton.exe
C:\Programmi\Microsoft IntelliPoint\bak\point32.exe | C:\Programmi\Microsoft IntelliPoint\point32.exe
C:\WINDOWS\ime\imjp8_1\bak\IMJPMIG.EXE | C:\WINDOWS\ime\imjp8_1\imjpmig.exe
C:\Programmi\Realtek\InstallShield\bak\AzMixerSel.exe | C:\Programmi\Realtek\InstallShield\AzMixerSel.exe
C:\Programmi\NewTech Infosystems\NTI CD & DVD-Maker 7\bak\ntiMUI.exe | C:\Programmi\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
C:\Programmi\ScanSoft\PaperPort\bak\pptd40nt.exe | C:\Programmi\ScanSoft\PaperPort\pptd40nt.exe
C:\Programmi\ScanSoft\PaperPort\bak\IndexSearch.exe | C:\Programmi\ScanSoft\PaperPort\IndexSearch.exe
C:\Programmi\Brother\Brmfl04g\bak\BrStDvPt.exe | C:\Programmi\Brother\Brmfl04g\BrStDvPt.exe
C:\Programmi\Brother\ControlCenter2\bak\brctrcen.exe | C:\Programmi\Brother\ControlCenter2\brctrcen.exe
C:\Programmi\Macrogaming\SweetIM\bak\SweetIM.exe | C:\Programmi\Macrogaming\SweetIM\SweetIM.exe
C:\Programmi\Ahead\InCD\bak\InCD.exe | C:\Programmi\Ahead\InCD\InCD.exe
C:\Acer\Empowering Technology\eDataSecurity\bak\eDSloader.exe | C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\ePower\bak\ePower_DMC.exe | C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Acer\Empowering Technology\ePower\bak\Boot.exe | C:\Acer\Empowering Technology\ePower\Boot.exe
C:\Acer\Empowering Technology\eRecovery\bak\eRAgent.exe | C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\WINDOWS\system32\IME\PINTLGNT\bak\ImScInst.exe | C:\WINDOWS\system32\IME\PINTLGNT\imscinst.exe
C:\WINDOWS\system32\IME\TINTLGNT\bak\TINTSETP.EXE | C:\WINDOWS\system32\IME\TINTLGNT\tintsetp.exe
C:\Programmi\File comuni\ScanSoft Shared\SSBkgdUpdate\bak\SSBkgdupdate.exe | C:\Programmi\File comuni\ScanSoft Shared\SSBkgdUpdate\SSBkgdupdate.exe
C:\Programmi\Adobe\Acrobat 7.0\Reader\bak\AdobeUpdateManager.exe | C:\Programmi\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe
C:\Programmi\Pinnacle\Shared Files\Programs\WebUpdater\bak\WebUpdater.exe | C:\Programmi\Pinnacle\Shared Files\Programs\WebUpdater\WebUpdater.exe

Adesso devi cliccare su Done in basso nella box
Seleziona il semaforino in alto a destra
Rispondi di Si alle due richieste di Avenger
Adesso il tuo computer dovrebbe riavviarsi, nel caso non succedesse, riavvialo tu manualmente
Al riavvio del computer, copia e incolla qui il contenuto del blocco note che apparirà.

[baroneashura]

Grazie Ste_95, ecco la risposta...........

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\chkqhivg

*******************

Script file located at: \??\C:\WINDOWS\system32\rhscmrxv.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File move operation C:\WINDOWS\bak\RUNXMLPL.exe|C:\WINDOWS\RUNXMLPL.exe completed successfully.
File move operation C:\WINDOWS\system32\bak\ctfmon.exe|C:\WINDOWS\system32\ctfmon.exe completed successfully.
File move operation C:\WINDOWS\system32\bak\PSDrvCheck.exe|C:\WINDOWS\system32\PSDrvCheck.exe completed successfully.
File move operation C:\WINDOWS\ehome\bak\ehtray.exe|C:\WINDOWS\ehome\ehtray.exe completed successfully.
File move operation C:\Programmi\Messenger\bak\msmsgs.exe|C:\Programmi\Messenger\msmsgs.exe completed successfully.
File move operation C:\Programmi\Launch Manager\bak\LaunchAp.exe|C:\Programmi\Launch Manager\LaunchAp.exe completed successfully.
File move operation C:\Programmi\Launch Manager\bak\HotkeyApp.exe|C:\Programmi\Launch Manager\HotkeyApp.exe completed successfully.
File move operation C:\Programmi\Launch Manager\bak\CtrlVol.exe|C:\Programmi\Launch Manager\CtrlVol.exe completed successfully.
File move operation C:\Programmi\Launch Manager\bak\OSDCtrl.exe|C:\Programmi\Launch Manager\OSDCtrl.exe completed successfully.
File move operation C:\Programmi\Launch Manager\bak\Wbutton.exe|C:\Programmi\Launch Manager\Wbutton.exe completed successfully.
File move operation C:\Programmi\Microsoft IntelliPoint\bak\point32.exe|C:\Programmi\Microsoft IntelliPoint\point32.exe completed successfully.
File move operation C:\WINDOWS\ime\imjp8_1\bak\IMJPMIG.EXE|C:\WINDOWS\ime\imjp8_1\imjpmig.exe completed successfully.
File move operation C:\Programmi\Realtek\InstallShield\bak\AzMixerSel.exe|C:\Programmi\Realtek\InstallShield\AzMixerSel.exe completed successfully.
File move operation C:\Programmi\NewTech Infosystems\NTI CD & DVD-Maker 7\bak\ntiMUI.exe|C:\Programmi\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe completed successfully.
File move operation C:\Programmi\ScanSoft\PaperPort\bak\pptd40nt.exe|C:\Programmi\ScanSoft\PaperPort\pptd40nt.exe completed successfully.
File move operation C:\Programmi\ScanSoft\PaperPort\bak\IndexSearch.exe|C:\Programmi\ScanSoft\PaperPort\IndexSearch.exe completed successfully.
File move operation C:\Programmi\Brother\Brmfl04g\bak\BrStDvPt.exe|C:\Programmi\Brother\Brmfl04g\BrStDvPt.exe completed successfully.
File move operation C:\Programmi\Brother\ControlCenter2\bak\brctrcen.exe|C:\Programmi\Brother\ControlCenter2\brctrcen.exe completed successfully.
File move operation C:\Programmi\Macrogaming\SweetIM\bak\SweetIM.exe|C:\Programmi\Macrogaming\SweetIM\SweetIM.exe completed successfully.
File move operation C:\Programmi\Ahead\InCD\bak\InCD.exe|C:\Programmi\Ahead\InCD\InCD.exe completed successfully.
File move operation C:\Acer\Empowering Technology\eDataSecurity\bak\eDSloader.exe|C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe completed successfully.
File move operation C:\Acer\Empowering Technology\ePower\bak\ePower_DMC.exe|C:\Acer\Empowering Technology\ePower\ePower_DMC.exe completed successfully.
File move operation C:\Acer\Empowering Technology\ePower\bak\Boot.exe|C:\Acer\Empowering Technology\ePower\Boot.exe completed successfully.
File move operation C:\Acer\Empowering Technology\eRecovery\bak\eRAgent.exe|C:\Acer\Empowering Technology\eRecovery\eRAgent.exe completed successfully.
File move operation C:\WINDOWS\system32\IME\PINTLGNT\bak\ImScInst.exe|C:\WINDOWS\system32\IME\PINTLGNT\imscinst.exe completed successfully.
File move operation C:\WINDOWS\system32\IME\TINTLGNT\bak\TINTSETP.EXE|C:\WINDOWS\system32\IME\TINTLGNT\tintsetp.exe completed successfully.
File move operation C:\Programmi\File comuni\ScanSoft Shared\SSBkgdUpdate\bak\SSBkgdupdate.exe|C:\Programmi\File comuni\ScanSoft Shared\SSBkgdUpdate\SSBkgdupdate.exe completed successfully.
File move operation C:\Programmi\Adobe\Acrobat 7.0\Reader\bak\AdobeUpdateManager.exe|C:\Programmi\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe completed successfully.
File move operation C:\Programmi\Pinnacle\Shared Files\Programs\WebUpdater\bak\WebUpdater.exe|C:\Programmi\Pinnacle\Shared Files\Programs\WebUpdater\WebUpdater.exe completed successfully.

Completed script processing.

*******************

Finished! Terminate.

[ste_95]

Sembra che sia andato tutto a buon fine. Come ti trovi?

[baroneashura]

apparentemente non ho rallentamenti o problemi con la connessione remota.........però nella cronologia che avevo pulito è riapparso...88.80.7.66.......

con PrevxCsi gratuito ho sempre questi 6 file infetti......

C:\Documents and settings\roberto\Impostazioni locali\Temp\481607510.exe
C:\Documents and settings\roberto\Impostazioni locali\Temp\1559197272.exe
C:\Documents and settings\roberto\Impostazioni locali\Temp\217942974.exe
C:\Documents and settings\roberto\Impostazioni locali\Temp\1295978556.exe
C:\Documents and settings\roberto\Impostazioni locali\Temp\542896612.exe
C:\Documents and settings\roberto\Impostazioni locali\Temp\1331431136.exe
Devo acquistare online a € 20 l'abbonamento annuale? che poi mi permette di eliminarli o mi suggerisci qualcosa?
Ciao, grazie.

[ste_95]

Annotati il nome con cui li identifica, poi segui queste istruzioni:

Scarica Avenger
Estrailo in una cartella a tua scelta
Esegui il file avenger.exe con la figura di una spada
Metti il pallino su input script manually
Quindi scegli la lente e cliccaci
Ora incolla queste righe nella box bianca che si è aperta:

Codice: Seleziona tutto

Folders to delete:
C:\Documents and settings\roberto\Impostazioni locali\Temp

Adesso devi cliccare su Done in basso nella box
Seleziona il semaforino in alto a destra
Rispondi di Si alle due richieste di Avenger
Adesso il tuo computer dovrebbe riavviarsi, nel caso non succedesse, riavvialo tu manualmente
Al riavvio del computer, copia e incolla qui il contenuto del blocco note che apparirà.

[baroneashura]

Ho fatto 3 volte la procedura che mi hai detto..

la 1^ volta nessuna nota......

la 2^ volta questo risultato..
ogfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\vgljvbce

*******************


Fatal error: integrity of Services key failed verification check! Security may be fatally compromised. Exiting immediately.

Could not open script file! Status: 0xc0000034 Abort!

la 3^ volta....questo.....
Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\htgcxpgf

*******************

Script file located at: \??\C:\Program Files\qbxbhwft.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Folder C:\Documents and settings\roberto\Impostazioni locali\Temp deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Ho rifatto la scansione con PrevxCsi....e i files infetti sono spariti....

Sembrerebbe tutto a posto..

comunque dei sei files infetti a parte il secondo che era codificato Trojan.nudos.....gli altri erano tutti Trojan.DoS.Win32.opdos.


Per adesso comunque grazie infinite.

[baroneashura]

Il problema appare risolto:
Dopo aver rifatto la scansione con PrevxCsia i files sono spariti;
non compaiono più i siti nella cronologia e al momento dell'accensione del pc, non si apre più la finestra di accesso alla connessione remota automaticamente.

grazie dell'aiuto.