aiuto sospetto virus

[margi75_]

Buona sera ho un problema, ho acceso il pc e mi sono comparse delle icone sul desktop.. precisamente LTSMMSG.exe , TFncKy.exe , 000StTHK.exe ,
TFNF5.exe . l'unica cosa strana che ho fatto e scaricare musica da emule.. èremetto che nn riesco a far partire hijackthis e nemmeno avenger.
grazie a chi vorra' aiutarmi..
Marica

[SkinDriver]

Mhm... in teoria non sono files dannosi (pc Toshiba?)... ma non è normale averli nel desktop.

Usa regedit per vedere se hai qualcosa di strano in avvio... prima di cancellare delle eventuali chiavi di registro sospette cerca su google, onde evitare di eliminare delle cose essenziali per il sistema.

Poi scarica ed aggiorna AdAware e Spybot Search and Destroy e fai una scansione con entrambi (e per sicurezza pure con l'antivirus) in modalità provvisoria.

[margi75_]

ok grazie.. un altra cosa.. continua ad aprirsi la finestra di antivir e segnala che dovrei fare la scanzione del sistema ma... l' ho fatta ieri!
mah!! si il pc è un toshiba :-)
adaware ce l' ho.. grazie mille per i consigli.

[SkinDriver]

continua ad aprirsi la finestra di antivir e segnala che dovrei fare la scanzione del sistema ma... l' ho fatta ieri!

Per questo consiglio di fare le scansioni con antivir/adaware/spybot in modalità provvisoria... così il pc carica solo il minimo essenziale ed eviti che un possibile retrovirus attacchi antivir ed eluda la rilevazione.

adaware ce l' ho

Ok.. Spybot invece lo trovi qui: http://www.safer-networking.org/it/mirrors/index.html

grazie mille per i consigli

Di nulla, poi fammi sapere se abbiamo risolto.

[margi75_]

dunque...va sempre peggio .. non sono riuscita a fare nessuna scansione perché il pc si surriscalda e si spegne.. poi alla riaccensione mi parte un installer nokia pc suite se lo fermo riparte se non lo fermo non si installa ma ritenta in continuazione e si inchioda tutto. ho fatto il ripristino le icone non ci sono + ma l'installer parte sempre. non mi andava nemmeno + explorer, adesso sono riuscita , non so cosa fare ..sono andata in regedit e ho eliminato tutte le voci nokia che avevo..ma la vedo dura..

[SkinDriver]

non sono riuscita a fare nessuna scansione perché il pc si surriscalda e si spegne..

Ahia... come soluzione temporanea a questo problema prova a diminuire la frequenza di clock del processore (per farlo vai nel bios).
In questo modo dovresti riuscire ad eseguire le scansioni senza che si surriscaldi troppo. (ma lo fa pure in modalità provvisoria??)

[margi75_]

ci sono riuscita.. a fare le scansioni. ora ho avviato gmer tra poco posto il log speriamo bene.
le sto provando tutte!!

[margi75_]

GMER 1.0.14.14205 - http://www.gmer.net
Rootkit scan 2008-03-12 02:02:54
Windows 5.1.2600 Service Pack 2


---- System - GMER 1.0.14 ----

SSDT \??\C:\WINDOWS\System32\drivers\wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) ZwAllocateVirtualMemory [0xF9A7BB30]
SSDT d347bus.sys (PnP BIOS Extension/ ) ZwClose [0xF987F818]
SSDT d347bus.sys (PnP BIOS Extension/ ) ZwCreateKey [0xF987F7D0]
SSDT d347bus.sys (PnP BIOS Extension/ ) ZwCreatePagingFile [0xF9873A20]
SSDT F9FB2434 ZwCreateThread
SSDT d347bus.sys (PnP BIOS Extension/ ) ZwEnumerateKey [0xF98742A8]
SSDT d347bus.sys (PnP BIOS Extension/ ) ZwEnumerateValueKey [0xF987F910]
SSDT \??\C:\WINDOWS\System32\drivers\wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) ZwMapViewOfSection [0xF9A7B470]
SSDT d347bus.sys (PnP BIOS Extension/ ) ZwOpenKey [0xF987F794]
SSDT F9FB2420 ZwOpenProcess
SSDT F9FB2425 ZwOpenThread
SSDT \??\C:\WINDOWS\System32\drivers\wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) ZwProtectVirtualMemory [0xF9A7BC50]
SSDT d347bus.sys (PnP BIOS Extension/ ) ZwQueryKey [0xF98742C8]
SSDT d347bus.sys (PnP BIOS Extension/ ) ZwQueryValueKey [0xF987F866]
SSDT d347bus.sys (PnP BIOS Extension/ ) ZwSetSystemPowerState [0xF987F0B0]
SSDT \??\C:\WINDOWS\System32\drivers\wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) ZwShutdownSystem [0xF9A7B990]
SSDT F9FB242F ZwTerminateProcess
SSDT F9FB242A ZwWriteVirtualMemory

---- Kernel code sections - GMER 1.0.14 ----

.text tcpip.sys!IPTransmit + 10BC F0623CFA 6 Bytes CALL F96AEE50 Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
.text tcpip.sys!IPTransmit + 263D F062527B 6 Bytes CALL F96AEE50 Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
.text tcpip.sys!ARPRcv + 521E F062A4BE 6 Bytes CALL F96AEE50 Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
.text wanarp.sys F9AAE3FD 4 Bytes CALL F96AEFA0 Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
.text wanarp.sys F9AAE402 2 Bytes [ 90, 90 ]

---- User code sections - GMER 1.0.14 ----

.text C:\Programmi\MSN Messenger\MsnMsgr.Exe[4008] kernel32.dll!SetUnhandledExceptionFilter 7C84467D 5 Bytes JMP 004DE392 C:\Programmi\MSN Messenger\MsnMsgr.Exe (Messenger/Microsoft Corporation)

---- Kernel IAT/EAT - GMER 1.0.14 ----

IAT \SystemRoot\System32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisCloseAdapter] [F96AFC70] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisOpenAdapter] [F96AFBD0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisDeregisterProtocol] [F96AFB10] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisRegisterProtocol] [F96AF8E0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol] [F96AF8E0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisOpenAdapter] [F96AFBD0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisCloseAdapter] [F96AFC70] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisDeregisterProtocol] [F96AFB10] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisDeregisterProtocol] [F96AFB10] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisRegisterProtocol] [F96AF8E0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisOpenAdapter] [F96AFBD0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisCloseAdapter] [F96AFC70] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisRegisterProtocol] [F96AF8E0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisCloseAdapter] [F96AFC70] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisOpenAdapter] [F96AFBD0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisDeregisterProtocol] [F96AFB10] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\tcpip.sys[NDIS.SYS!NdisCloseAdapter] [F96AFC70] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\tcpip.sys[NDIS.SYS!NdisOpenAdapter] [F96AFBD0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol] [F96AF8E0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol] [F96AFB10] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol] [F96AF8E0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter] [F96AFBD0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisCloseAdapter] [F96AFC70] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)

---- Devices - GMER 1.0.14 ----

Device \FileSystem\Ntfs \Ntfs 81335030

AttachedDevice \FileSystem\Ntfs \Ntfs avgntmgr.sys (Avira Antivir File Filter Driver Manager/Avira GmbH)

Device \FileSystem\Fastfat \FatCdrom FFA7E030
Device \Driver\Tcpip \Device\Ip wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.)
Device \Driver\Tcpip \Device\Tcp wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.)
Device \FileSystem\Rdbss \Device\FsWrap FF8EDAF8
Device \Driver\atapi \Device\Ide\IdePort0 FF99A008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 FF99A008
Device \Driver\atapi \Device\Ide\IdePort1 FF99A008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e FF99A008
Device \FileSystem\Srv \Device\LanmanServer FF861F20
Device \Driver\Tcpip \Device\Udp wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.)
Device \Driver\Tcpip \Device\RawIp wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.)
Device \Driver\Tcpip \Device\IPMULTICAST wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.)
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver FF8F8E98
Device \FileSystem\MRxSmb \Device\LanmanRedirector FF8F8E98
Device \FileSystem\Npfs \Device\NamedPipe FF891868
Device \FileSystem\Msfs \Device\Mailslot FF895878
Device \Driver\d347prt \Device\Scsi\d347prt1Port2Path0Target0Lun0 FF94C580
Device \Driver\d347prt \Device\Scsi\d347prt1 FF94C580
Device \FileSystem\Fastfat \Fat FFA7E030

AttachedDevice \FileSystem\Fastfat \Fat avgntmgr.sys (Avira Antivir File Filter Driver Manager/Avira GmbH)

Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer FF8C3878
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer FF8C3878
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer FF8C3878
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer FF8C3878
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer FF8C3878
Device \FileSystem\Cdfs \Cdfs FF2674A8

---- Modules - GMER 1.0.14 ----

Module _________ F97DE000-F97F6000 (98304 bytes)

---- Registry - GMER 1.0.14 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000d3c20a38d
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000d3c20a38d@0002eed5423b 0xBD 0xD0 0x9B 0x47 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000d3c20a38d@001d3b10fd9f 0xEA 0x67 0xF2 0x23 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000d3c20a38d@001a89463f3b 0xCB 0x83 0xA6 0xB2 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf40@khjeh 0x20 0x02 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf40@hj34z0 0x50 0x36 0x2E 0x7E ...
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\000d3c20a38d
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\000d3c20a38d@0002eed5423b 0xBD 0xD0 0x9B 0x47 ...
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\000d3c20a38d@001d3b10fd9f 0xEA 0x67 0xF2 0x23 ...
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\000d3c20a38d@001a89463f3b 0xCB 0x83 0xA6 0xB2 ...
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OODEFRAG08.00.00.01WORKSTATION 49E6F7845CD2CFF89D038690EA1003CCE0FA668EBF9D9320A11B2F3CA0E05D56EB95D88050FE84B8ADBB8F0
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts@Esperanza\x2122 (TrueType) ES______.TTF
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts@Lyonesse\x2122 (TrueType) LY______.TTF
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts@Ranegund\x2122 (TrueType) RANEG.TTF


SPERO SIA QUELLO GIUSTO
GRAZIE

[margi75_]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2.14.02, on 12/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Sygate\SPF\smc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\AntiVir PersonalEdition Classic\sched.exe
C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe
C:\Programmi\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\00THotkey.exe
C:\WINDOWS\LTSMMSG.exe
C:\Programmi\Apoint2K\Apoint.exe
C:\Programmi\TOSHIBA\TouchED\TouchED.Exe
C:\Programmi\TOSHIBA\PadTouch\PadExe.exe
C:\WINDOWS\system32\TFNF5.exe
C:\WINDOWS\system32\TPSMain.exe
C:\Programmi\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\Apoint2K\Apntex.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0S2.EXE
C:\Programmi\Google\Gmail Notifier\G001-1.0.25.0\gnotify.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Programmi\D-Tools\daemon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\File comuni\PCSuite\DataLayer\DataLayer.exe
C:\Programmi\Trust\MI-4550XP WIRELESS OPTICAL MINI MOUSE\Mouse32a.exe
C:\Programmi\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\Programmi\MSN Messenger\MsnMsgr.Exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\msiexec.exe
C:\PROGRA~1\FILECO~1\PCSuite\Services\SERVIC~1.EXE
C:\WINDOWS\system32\MsiExec.exe
C:\PROGRA~1\FILECO~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe
C:\Programmi\MSN Messenger\usnsvc.exe
C:\Programmi\File comuni\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file:///C:\Programmi\TOSHIBA\Free Update Service\splash.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar4.dll
O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\System32\00THotkey.exe
O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
O4 - HKLM\..\Run: [LTSMMSG] LTSMMSG.exe
O4 - HKLM\..\Run: [Apoint] C:\Programmi\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [TouchED] C:\Programmi\TOSHIBA\TouchED\TouchED.Exe
O4 - HKLM\..\Run: [PadTouch] "C:\Programmi\TOSHIBA\PadTouch\PadExe.exe
O4 - HKLM\..\Run: [TFNF5] TFNF5.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [EPSON Stylus C66 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0S2.EXE /P23 "EPSON Stylus C66 Series" /O6 "USB001" /M "Stylus C66"
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Programmi\Google\Gmail Notifier\G001-1.0.25.0\gnotify.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [avgnt] "C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programmi\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [PrevxRootkitRemovalTool] "C:\Documents and Settings\marica\Impostazioni locali\Temporary Internet Files\Content.IE5\7Z30VLHD\D54966B[1].exe" -scan
O4 - HKLM\..\Run: [fgquglpj] C:\wqymxwaq.bat
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [DataLayer] C:\Programmi\File comuni\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [Nokia Tray Application] C:\Programmi\File comuni\Nokia\Tools\NclTray.exe
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Programmi\Trust\MI-4550XP WIRELESS OPTICAL MINI MOUSE\Mouse32a.exe
O4 - HKCU\..\Run: [TOSCDSPD] C:\Programmi\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [EPSON Stylus C66 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0S2.EXE /P23 "EPSON Stylus C66 Series" /M "Stylus C66" /EF "HKCU"
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [Win32 USB2 Driver] rofl.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [Win32 USB2 Driver] rofl.exe (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesit.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesit.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O12 - Plugin for .fpx: C:\Programmi\Internet Explorer\PLUGINS\NPRVRT34.dll
O12 - Plugin for .ivr: C:\Programmi\Internet Explorer\PLUGINS\NPRVRT34.dll
O14 - IERESET.INF: START_PAGE_URL=file:///C:\Programmi\TOSHIBA\Free Update Service\splash.html
O16 - DPF: Yahoo! Backgammon - http://download2.games.yahoo.com/games/ ... /at1_x.cab
O16 - DPF: Yahoo! Literati - http://download2.games.yahoo.com/games/ ... /tt5_x.cab
O16 - DPF: Yahoo! MahJong Solitaire - http://download2.games.yahoo.com/games/ ... jst4_x.cab
O16 - DPF: Yahoo! Pool 2 - http://download2.games.yahoo.com/games/ ... poti_x.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/ms ... b31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/Shar ... vSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programmi\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/IT-IT/a-U ... E_UNO1.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resour ... se9602.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 0430108375
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/Shar ... /cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 3737773064
O16 - DPF: {79E0C1C0-316D-11D5-A72A-006097BFA1AC} (EPSON Web Printer-SelfTest Control Class) - http://esupport.epson-europe.com/selfte ... TPTest.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan ... asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnme ... loader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZI ... b56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{02D1E752-EA5E-4B3A-80FC-E03A46AA454A}: NameServer = 193.70.192.25 193.70.152.25
O17 - HKLM\System\CS1\Services\Tcpip\..\{02D1E752-EA5E-4B3A-80FC-E03A46AA454A}: NameServer = 193.70.192.25 193.70.152.25
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmi\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - Avira GmbH - C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Programmi\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Programmi\Sygate\SPF\smc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 11556 bytes

[margi75_]

Il problema è questo maledetto windows installer che non si ferma... nokia pc suite 5.8 . ho provato a disinstallarlo anche da installaione applicazioni ma non va!! helppp
ora vado a dormire che domani lavoro.
buonanotte e grazie

[ste_95]

Seleziona a sinistra queste voci e premi fix checked:

O4 - HKLM\..\Run: [fgquglpj] C:\wqymxwaq.bat
O4 - HKUS\S-1-5-18\..\RunOnce: [Win32 USB2 Driver] rofl.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [Win32 USB2 Driver] rofl.exe (User 'Default user')

Poi cerca nel tuo computer il file rofl.exe.

[crazy.cat]

Seleziona a sinistra queste voci e premi fix checked:

O4 - HKLM\..\Run: [fgquglpj] C:\wqymxwaq.bat
O4 - HKUS\S-1-5-18\..\RunOnce: [Win32 USB2 Driver] rofl.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [Win32 USB2 Driver] rofl.exe (User 'Default user')

Poi cerca nel tuo computer il file rofl.exe.

Questo è pulito?
O4 - HKLM\..\Run: [PrevxRootkitRemovalTool] "C:\Documents and Settings\marica\Impostazioni locali\Temporary Internet Files\Content.IE5\7Z30VLHD\D54966B[1].exe" -scan

[ste_95]

Mi sono fidato del nome del valore, è nocivo?

[crazy.cat]

E' strano e in una cartella ancora più strana.
Un giretto su www.virustotal.com gli e lo farei fare a quel file.

[margi75_]

volevo ringraziare per l' aiuto .. ho risolto ..pare.
unica cosa quella riga di cui parla crazy.. devo fixare anche quella oppure no?
ciao e ancora grazie
Marica

[ste_95]

Vai su www.virustotal.com e fai scansionare il file:

C:\Documents and Settings\marica\Impostazioni locali\Temporary Internet Files\Content.IE5\7Z30VLHD\D54966B[1].exe

Riporta i risultati ottenuti.