Non esce la scritta "svuota cestino"

[dragona]

salve a tutti!! da poco sono riuscita a risolvere il problema dell'icona del cestino che non mi segnalava quando era pieno...! adesso però devo svuotarlo manualmente e cioè, aprirlo selezionare i file e cancellarli, perché non c'è più la scritta svuota cestino quando vado a cliccare col tasto destro del mouse su di esso!! perché?? aiutatemi per favore!! grazie!!

[Fred]

Prova a fare una scansione con CCleaner

[dragona]

ma ccleaner non serve per fare pulizia nel pc?? e comunque già lo uso ma non mi è cambiato niente...!!

[Fred]

CCleaner ha anche la funzione di pulitore di registro...

[dragona]

si lo so ma niente...purtroppo!!

[Fred]

Hai qualche prodotto symantec installato?

[Fred]

http://support.microsoft.com/kb/173416/it
Che te ne pare? Prova a fare quello che dice la Microsoft

[dragona]

no non ho nessun programma symantec installato!
ti ringrazio per la guida della microsoft ma a parte che già la avevo provata e non mi ha dato risultati...ma poi sotto c'è scritto che non è compatibile nè con xp nè con vista che sarebbe il s.o. che uso io(purtroppo!!)!

[Fred]

Se clicchi con il tasto destro sul cestino ti da "svuota cestino" fra le opzioni?
In qualunque caso posta il log di HijackThis.

[dragona]

no no la scritta non esce proprio...non c'è! ecco qui...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at Ylenia 11.20.57, on 15/03/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Grisoft\AVG7\avgw.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9e.exe
C:\Users\Ilenia\AppData\Local\Temp\Rar$EX00.490\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SMSERIAL] "C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe"
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [HP Health Check Scheduler] "C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [NvSvc] "RUNDLL32.EXE" C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] "C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE" -startup
O4 - HKLM\..\Run: [AVG7_CC] "C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" /STARTUP
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] "C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe"
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O13 - Gopher Prefix:
O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - NetGroup - Politecnico di Torino - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

--
End of file - 6701 bytes

[Fred]

O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe

Fixa questa, decisamente non mi convince.... poi vedi se riavviando ricompare la scritta. Se no ripeti la scansione con HT e fanne una anche con GMER.

Edit: Questa cos'è? O13 - Gopher Prefix:
Edit2: In modalità provvisoria c'è la scritta?

[dragona]

ciao fred!! innanzitutto grazie per l'aiuto che mi stai dando!! poi non so se potrebbe esserti d'aiuto ma io ho anche aperto una discussione riguardo al fatto che io ho uno spyware nel pc che si chiama drivecleaner 2006, ma nessuno è riuscito ad aiutarmi a toglierlo...! vabbè...! tornando a noi e alla scritta svuota cestino...! allora ho fatto la scansione con HT e ho fixato quella riga come hai detto tu e poi ho riavviato, ma non solo non esce la scritta, ma HT continua a rilevare quella riga dannosa!! perché? uffa! comunque non so cosa sia quel 013 Gopher Prefix!! googlando alcuni dicono che è dannosa e altri dicono che non lo è ma che serve per windows vista riguardo ad internet explorer se non sbaglio! ma tu cosa mi consigli?? appena posso ti posto anche la scansione con GMER!! grazie ancora!!

[dragona]

ecco vedi ho selezionato la riga che nonostante abbia fixato c'è sempre!

[ste_95]

Edit: Questa cos'è? O13 - Gopher Prefix:

Nulla di chè

[dragona]

ecco qua fred! la scansione con GMER!! confido in te!! fammi sapere!! uffi speriamo che mi ritorni quella scritta svuota cestino...!!

GMER 1.0.13.12551 - http://www.gmer.net
Rootkit scan 2008-03-16 09:58:49
Windows 6.0.6000


---- System - GMER 1.0.13 ----

SSDT \SystemRoot\system32\drivers\iksysflt.sys ZwCreateKey
SSDT \SystemRoot\system32\drivers\iksysflt.sys ZwCreateProcess
SSDT \SystemRoot\system32\drivers\iksysflt.sys ZwCreateProcessEx
SSDT \SystemRoot\system32\drivers\iksysflt.sys ZwDeleteKey
SSDT \SystemRoot\system32\drivers\iksysflt.sys ZwDeleteValueKey
SSDT \SystemRoot\system32\drivers\iksysflt.sys ZwRenameKey
SSDT \SystemRoot\system32\drivers\iksysflt.sys ZwSetValueKey
SSDT \SystemRoot\system32\drivers\iksysflt.sys ZwTerminateProcess
SSDT \SystemRoot\system32\drivers\iksysflt.sys ZwWriteVirtualMemory
SSDT \SystemRoot\system32\drivers\iksysflt.sys ZwCreateUserProcess

---- Kernel code sections - GMER 1.0.13 ----

? C:\Windows\system32\Drivers\mchInjDrv.sys Impossibile trovare il file specificato.

---- User code sections - GMER 1.0.13 ----

.text C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe[420] ntdll.dll!NtClose 770FF354 3 Bytes [ FF, 25, 1E ]
.text C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe[420] ntdll.dll!NtClose + 4 770FF358 2 Bytes [ 35, 5F ]
.text C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe[420] ntdll.dll!NtCreateFile 770FF414 3 Bytes [ FF, 25, 1E ]
.text C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe[420] ntdll.dll!NtCreateFile + 4 770FF418 2 Bytes [ 17, 5F ]
.text C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe[420] ntdll.dll!NtCreateKey 770FF454 3 Bytes [ FF, 25, 1E ]
.text C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe[420] ntdll.dll!NtCreateKey + 4 770FF458 2 Bytes [ 05, 5F ]
.text C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe[420] ntdll.dll!NtCreateProcess 770FF4D4 3 Bytes [ FF, 25, 1E ]
.text C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe[420] ntdll.dll!NtCreateProcess + 4 770FF4D8 2 Bytes [ 29, 5F ]
.text C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe[420] ntdll.dll!NtCreateProcessEx 770FF4E4 3 Bytes [ FF, 25, 1E ]
.text C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe[420] ntdll.dll!NtCreateProcessEx + 4 770FF4E8 2 Bytes [ 2C, 5F ]
.text C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe[420] ntdll.dll!NtCreateSection 770FF504 3 Bytes [ FF, 25, 1E ]
.text C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe[420] ntdll.dll!NtCreateSection + 4 770FF508 2 Bytes [ 23, 5F ]
.text C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe[420] ntdll.dll!NtDeleteKey 770FF804 3 Bytes [ FF, 25, 1E ]
.text C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe[420] ntdll.dll!NtDeleteKey + 4 770FF808 2 Bytes [ 0B, 5F ]
.text C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe[420] ntdll.dll!NtDeleteValueKey 770FF834 3 Bytes [ FF, 25, 1E ]
.text C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe[420] ntdll.dll!NtDeleteValueKey + 4 770FF838 2 Bytes [ 11, 5F ]
.text C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe[420] ntdll.dll!NtRenameKey 77100104 3 Bytes [ FF, 25, 1E ]
.text C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe[420] ntdll.dll!NtRenameKey + 4 77100108 2 Bytes [ 14, 5F ]
.text C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe[420] ntdll.dll!NtSetInformationFile 77100364 3 Bytes [ FF, 25, 1E ]
.text C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe[420] ntdll.dll!NtSetInformationFile + 4 77100368 2 Bytes [ 20, 5F ]
.text C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe[420] ntdll.dll!NtSetValueKey 771004D4 3 Bytes [ FF, 25, 1E ]
.text C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe[420] ntdll.dll!NtSetValueKey + 4 771004D8 2 Bytes [ 0E, 5F ]
.text C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe[420] ntdll.dll!NtTerminateProcess 77100574 3 Bytes [ FF, 25, 1E ]
.text C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe[420] ntdll.dll!NtTerminateProcess + 4 77100578 2 Bytes [ 2F, 5F ]
.text C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe[420] ntdll.dll!NtWriteFile 771006C4 3 Bytes [ FF, 25, 1E ]
.text C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe[420] ntdll.dll!NtWriteFile + 4 771006C8 2 Bytes [ 1A, 5F ]
.text C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe[420] ntdll.dll!NtWriteFileGather 771006D4 3 Bytes [ FF, 25, 1E ]
.text C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe[420] ntdll.dll!NtWriteFileGather + 4 771006D8 2 Bytes [ 1D, 5F ]
.text C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe[420] ntdll.dll!NtWriteVirtualMemory 771006F4 3 Bytes [ FF, 25, 1E ]
.text C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe[420] ntdll.dll!NtWriteVirtualMemory + 4 771006F8 2 Bytes [ 32, 5F ]
.text C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe[420] ntdll.dll!NtCreateUserProcess 771008A4 3 Bytes [ FF, 25, 1E ]
.text C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe[420] ntdll.dll!NtCreateUserProcess + 4 771008A8 2 Bytes [ 26, 5F ]
.text C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe[420] kernel32.dll!LoadLibraryExW 76D095AF 6 Bytes JMP 5F070F5A
.text C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe[420] USER32.dll!SetWindowsHookExA 76C4891A 6 Bytes JMP 5F370F5A
.text C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe[420] USER32.dll!SetWindowsHookExW 76C4913D 6 Bytes JMP 5F3B0F5A
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[476] ntdll.dll!NtClose 770FF354 3 Bytes [ FF, 25, 1E ]
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[476] ntdll.dll!NtClose + 4 770FF358 2 Bytes [ 35, 5F ]
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[476] ntdll.dll!NtCreateFile 770FF414 3 Bytes [ FF, 25, 1E ]
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[476] ntdll.dll!NtCreateFile + 4 770FF418 2 Bytes [ 17, 5F ]
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[476] ntdll.dll!NtCreateKey 770FF454 3 Bytes [ FF, 25, 1E ]
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[476] ntdll.dll!NtCreateKey + 4 770FF458 2 Bytes [ 05, 5F ]
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[476] ntdll.dll!NtCreateProcess 770FF4D4 3 Bytes [ FF, 25, 1E ]
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[476] ntdll.dll!NtCreateProcess + 4 770FF4D8 2 Bytes [ 29, 5F ]
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[476] ntdll.dll!NtCreateProcessEx 770FF4E4 3 Bytes [ FF, 25, 1E ]
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[476] ntdll.dll!NtCreateProcessEx + 4 770FF4E8 2 Bytes [ 2C, 5F ]
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[476] ntdll.dll!NtCreateSection 770FF504 3 Bytes [ FF, 25, 1E ]
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[476] ntdll.dll!NtCreateSection + 4 770FF508 2 Bytes [ 23, 5F ]
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[476] ntdll.dll!NtDeleteKey 770FF804 3 Bytes [ FF, 25, 1E ]
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[476] ntdll.dll!NtDeleteKey + 4 770FF808 2 Bytes [ 0B, 5F ]
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[476] ntdll.dll!NtDeleteValueKey 770FF834 3 Bytes [ FF, 25, 1E ]
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[476] ntdll.dll!NtDeleteValueKey + 4 770FF838 2 Bytes [ 11, 5F ]
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[476] ntdll.dll!NtRenameKey 77100104 3 Bytes [ FF, 25, 1E ]
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[476] ntdll.dll!NtRenameKey + 4 77100108 2 Bytes [ 14, 5F ]
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[476] ntdll.dll!NtSetInformationFile 77100364 3 Bytes [ FF, 25, 1E ]
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[476] ntdll.dll!NtSetInformationFile + 4 77100368 2 Bytes [ 20, 5F ]
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[476] ntdll.dll!NtSetValueKey 771004D4 3 Bytes [ FF, 25, 1E ]
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[476] ntdll.dll!NtSetValueKey + 4 771004D8 2 Bytes [ 0E, 5F ]
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[476] ntdll.dll!NtTerminateProcess 77100574 3 Bytes [ FF, 25, 1E ]
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[476] ntdll.dll!NtTerminateProcess + 4 77100578 2 Bytes [ 2F, 5F ]
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[476] ntdll.dll!NtWriteFile 771006C4 3 Bytes [ FF, 25, 1E ]
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[476] ntdll.dll!NtWriteFile + 4 771006C8 2 Bytes [ 1A, 5F ]
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[476] ntdll.dll!NtWriteFileGather 771006D4 3 Bytes [ FF, 25, 1E ]
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[476] ntdll.dll!NtWriteFileGather + 4 771006D8 2 Bytes [ 1D, 5F ]
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[476] ntdll.dll!NtWriteVirtualMemory 771006F4 3 Bytes [ FF, 25, 1E ]
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[476] ntdll.dll!NtWriteVirtualMemory + 4 771006F8 2 Bytes [ 32, 5F ]
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[476] ntdll.dll!NtCreateUserProcess 771008A4 3 Bytes [ FF, 25, 1E ]
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[476] ntdll.dll!NtCreateUserProcess + 4 771008A8 2 Bytes [ 26, 5F ]
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[476] kernel32.dll!LoadLibraryExW 76D095AF 6 Bytes JMP 5F070F5A
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[476] USER32.dll!SetWindowsHookExA 76C4891A 6 Bytes JMP 5F370F5A
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[476] USER32.dll!SetWindowsHookExW 76C4913D 6 Bytes JMP 5F3B0F5A
.text C:\Windows\system32\csrss.exe[504] ntdll.dll!NtClose 770FF354 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\csrss.exe[504] ntdll.dll!NtClose + 4 770FF358 2 Bytes [ 35, 5F ]
.text C:\Windows\system32\csrss.exe[504] ntdll.dll!NtCreateFile 770FF414 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\csrss.exe[504] ntdll.dll!NtCreateFile + 4 770FF418 2 Bytes [ 17, 5F ]
.text C:\Windows\system32\csrss.exe[504] ntdll.dll!NtCreateKey 770FF454 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\csrss.exe[504] ntdll.dll!NtCreateKey + 4 770FF458 2 Bytes [ 05, 5F ]
.text C:\Windows\system32\csrss.exe[504] ntdll.dll!NtCreateProcess 770FF4D4 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\csrss.exe[504] ntdll.dll!NtCreateProcess + 4 770FF4D8 2 Bytes [ 29, 5F ]
.text C:\Windows\system32\csrss.exe[504] ntdll.dll!NtCreateProcessEx 770FF4E4 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\csrss.exe[504] ntdll.dll!NtCreateProcessEx + 4 770FF4E8 2 Bytes [ 2C, 5F ]
.text C:\Windows\system32\csrss.exe[504] ntdll.dll!NtCreateSection 770FF504 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\csrss.exe[504] ntdll.dll!NtCreateSection + 4 770FF508 2 Bytes [ 23, 5F ]
.text C:\Windows\system32\csrss.exe[504] ntdll.dll!NtDeleteKey 770FF804 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\csrss.exe[504] ntdll.dll!NtDeleteKey + 4 770FF808 2 Bytes [ 0B, 5F ]
.text C:\Windows\system32\csrss.exe[504] ntdll.dll!NtDeleteValueKey 770FF834 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\csrss.exe[504] ntdll.dll!NtDeleteValueKey + 4 770FF838 2 Bytes [ 11, 5F ]
.text C:\Windows\system32\csrss.exe[504] ntdll.dll!NtRenameKey 77100104 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\csrss.exe[504] ntdll.dll!NtRenameKey + 4 77100108 2 Bytes [ 14, 5F ]
.text C:\Windows\system32\csrss.exe[504] ntdll.dll!NtSetInformationFile 77100364 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\csrss.exe[504] ntdll.dll!NtSetInformationFile + 4 77100368 2 Bytes [ 20, 5F ]
.text C:\Windows\system32\csrss.exe[504] ntdll.dll!NtSetValueKey 771004D4 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\csrss.exe[504] ntdll.dll!NtSetValueKey + 4 771004D8 2 Bytes [ 0E, 5F ]
.text C:\Windows\system32\csrss.exe[504] ntdll.dll!NtTerminateProcess 77100574 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\csrss.exe[504] ntdll.dll!NtTerminateProcess + 4 77100578 2 Bytes [ 2F, 5F ]
.text C:\Windows\system32\csrss.exe[504] ntdll.dll!NtWriteFile 771006C4 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\csrss.exe[504] ntdll.dll!NtWriteFile + 4 771006C8 2 Bytes [ 1A, 5F ]
.text C:\Windows\system32\csrss.exe[504] ntdll.dll!NtWriteFileGather 771006D4 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\csrss.exe[504] ntdll.dll!NtWriteFileGather + 4 771006D8 2 Bytes [ 1D, 5F ]
.text C:\Windows\system32\csrss.exe[504] ntdll.dll!NtWriteVirtualMemory 771006F4 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\csrss.exe[504] ntdll.dll!NtWriteVirtualMemory + 4 771006F8 2 Bytes [ 32, 5F ]
.text C:\Windows\system32\csrss.exe[504] ntdll.dll!NtCreateUserProcess 771008A4 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\csrss.exe[504] ntdll.dll!NtCreateUserProcess + 4 771008A8 2 Bytes [ 26, 5F ]
.text C:\Windows\system32\csrss.exe[504] USER32.dll!SetWindowsHookExA 76C4891A 6 Bytes JMP 5F370F5A
.text C:\Windows\system32\csrss.exe[504] USER32.dll!SetWindowsHookExW 76C4913D 6 Bytes JMP 5F3B0F5A
.text C:\Windows\system32\csrss.exe[504] KERNEL32.dll!LoadLibraryExW 76D095AF 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\wininit.exe[556] ntdll.dll!NtClose 770FF354 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\wininit.exe[556] ntdll.dll!NtClose + 4 770FF358 2 Bytes [ 35, 5F ]
.text C:\Windows\system32\wininit.exe[556] ntdll.dll!NtCreateFile 770FF414 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\wininit.exe[556] ntdll.dll!NtCreateFile + 4 770FF418 2 Bytes [ 17, 5F ]
.text C:\Windows\system32\wininit.exe[556] ntdll.dll!NtCreateKey 770FF454 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\wininit.exe[556] ntdll.dll!NtCreateKey + 4 770FF458 2 Bytes [ 05, 5F ]
.text C:\Windows\system32\wininit.exe[556] ntdll.dll!NtCreateProcess 770FF4D4 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\wininit.exe[556] ntdll.dll!NtCreateProcess + 4 770FF4D8 2 Bytes [ 29, 5F ]
.text C:\Windows\system32\wininit.exe[556] ntdll.dll!NtCreateProcessEx 770FF4E4 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\wininit.exe[556] ntdll.dll!NtCreateProcessEx + 4 770FF4E8 2 Bytes [ 2C, 5F ]
.text C:\Windows\system32\wininit.exe[556] ntdll.dll!NtCreateSection 770FF504 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\wininit.exe[556] ntdll.dll!NtCreateSection + 4 770FF508 2 Bytes [ 23, 5F ]
.text C:\Windows\system32\wininit.exe[556] ntdll.dll!NtDeleteKey 770FF804 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\wininit.exe[556] ntdll.dll!NtDeleteKey + 4 770FF808 2 Bytes [ 0B, 5F ]
.text C:\Windows\system32\wininit.exe[556] ntdll.dll!NtDeleteValueKey 770FF834 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\wininit.exe[556] ntdll.dll!NtDeleteValueKey + 4 770FF838 2 Bytes [ 11, 5F ]
.text C:\Windows\system32\wininit.exe[556] ntdll.dll!NtRenameKey 77100104 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\wininit.exe[556] ntdll.dll!NtRenameKey + 4 77100108 2 Bytes [ 14, 5F ]
.text C:\Windows\system32\wininit.exe[556] ntdll.dll!NtSetInformationFile 77100364 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\wininit.exe[556] ntdll.dll!NtSetInformationFile + 4 77100368 2 Bytes [ 20, 5F ]
.text C:\Windows\system32\wininit.exe[556] ntdll.dll!NtSetValueKey 771004D4 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\wininit.exe[556] ntdll.dll!NtSetValueKey + 4 771004D8 2 Bytes [ 0E, 5F ]
.text C:\Windows\system32\wininit.exe[556] ntdll.dll!NtTerminateProcess 77100574 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\wininit.exe[556] ntdll.dll!NtTerminateProcess + 4 77100578 2 Bytes [ 2F, 5F ]
.text C:\Windows\system32\wininit.exe[556] ntdll.dll!NtWriteFile 771006C4 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\wininit.exe[556] ntdll.dll!NtWriteFile + 4 771006C8 2 Bytes [ 1A, 5F ]
.text C:\Windows\system32\wininit.exe[556] ntdll.dll!NtWriteFileGather 771006D4 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\wininit.exe[556] ntdll.dll!NtWriteFileGather + 4 771006D8 2 Bytes [ 1D, 5F ]
.text C:\Windows\system32\wininit.exe[556] ntdll.dll!NtWriteVirtualMemory 771006F4 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\wininit.exe[556] ntdll.dll!NtWriteVirtualMemory + 4 771006F8 2 Bytes [ 32, 5F ]
.text C:\Windows\system32\wininit.exe[556] ntdll.dll!NtCreateUserProcess 771008A4 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\wininit.exe[556] ntdll.dll!NtCreateUserProcess + 4 771008A8 2 Bytes [ 26, 5F ]
.text C:\Windows\system32\wininit.exe[556] kernel32.dll!LoadLibraryExW 76D095AF 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\wininit.exe[556] USER32.dll!SetWindowsHookExA 76C4891A 6 Bytes JMP 5F370F5A
.text C:\Windows\system32\wininit.exe[556] USER32.dll!SetWindowsHookExW 76C4913D 6 Bytes JMP 5F3B0F5A
.text C:\Windows\system32\csrss.exe[568] ntdll.dll!NtClose 770FF354 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\csrss.exe[568] ntdll.dll!NtClose + 4 770FF358 2 Bytes [ 35, 5F ]
.text C:\Windows\system32\csrss.exe[568] ntdll.dll!NtCreateFile 770FF414 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\csrss.exe[568] ntdll.dll!NtCreateFile + 4 770FF418 2 Bytes [ 17, 5F ]
.text C:\Windows\system32\csrss.exe[568] ntdll.dll!NtCreateKey 770FF454 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\csrss.exe[568] ntdll.dll!NtCreateKey + 4 770FF458 2 Bytes [ 05, 5F ]
.text C:\Windows\system32\csrss.exe[568] ntdll.dll!NtCreateProcess 770FF4D4 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\csrss.exe[568] ntdll.dll!NtCreateProcess + 4 770FF4D8 2 Bytes [ 29, 5F ]
.text C:\Windows\system32\csrss.exe[568] ntdll.dll!NtCreateProcessEx 770FF4E4 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\csrss.exe[568] ntdll.dll!NtCreateProcessEx + 4 770FF4E8 2 Bytes [ 2C, 5F ]
.text C:\Windows\system32\csrss.exe[568] ntdll.dll!NtCreateSection 770FF504 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\csrss.exe[568] ntdll.dll!NtCreateSection + 4 770FF508 2 Bytes [ 23, 5F ]
.text C:\Windows\system32\csrss.exe[568] ntdll.dll!NtDeleteKey 770FF804 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\csrss.exe[568] ntdll.dll!NtDeleteKey + 4 770FF808 2 Bytes [ 0B, 5F ]
.text C:\Windows\system32\csrss.exe[568] ntdll.dll!NtDeleteValueKey 770FF834 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\csrss.exe[568] ntdll.dll!NtDeleteValueKey + 4 770FF838 2 Bytes [ 11, 5F ]
.text C:\Windows\system32\csrss.exe[568] ntdll.dll!NtRenameKey 77100104 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\csrss.exe[568] ntdll.dll!NtRenameKey + 4 77100108 2 Bytes [ 14, 5F ]
.text C:\Windows\system32\csrss.exe[568] ntdll.dll!NtSetInformationFile 77100364 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\csrss.exe[568] ntdll.dll!NtSetInformationFile + 4 77100368 2 Bytes [ 20, 5F ]
.text C:\Windows\system32\csrss.exe[568] ntdll.dll!NtSetValueKey 771004D4 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\csrss.exe[568] ntdll.dll!NtSetValueKey + 4 771004D8 2 Bytes [ 0E, 5F ]
.text C:\Windows\system32\csrss.exe[568] ntdll.dll!NtTerminateProcess 77100574 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\csrss.exe[568] ntdll.dll!NtTerminateProcess + 4 77100578 2 Bytes [ 2F, 5F ]
.text C:\Windows\system32\csrss.exe[568] ntdll.dll!NtWriteFile 771006C4 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\csrss.exe[568] ntdll.dll!NtWriteFile + 4 771006C8 2 Bytes [ 1A, 5F ]
.text C:\Windows\system32\csrss.exe[568] ntdll.dll!NtWriteFileGather 771006D4 3 Bytes [ FF, 25, 1E ]
.text C:\Windows\system32\csrss.exe[568] ntdll.dll!NtWriteFileGather + 4

[ste_95]

I log di GMER fanno hostati su www.freefilehosting.net

Se volete il mio parere: Non è colpa di un virus.

[dragona]

vabbè la prossima volta lo posto su questo sito...non lo sapevo! comunque secondo te ste qual è il problema? e come posso risolverlo??

[dragona]

ho fatto la scansione con HT e ho fixato quella riga come hai detto tu e poi ho riavviato, ma non solo non esce la scritta, ma HT continua a rilevare quella riga dannosa!! perché?

ste sai come eliminare questa riga che mi ha rilevato fred?? O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
grazie!

[ste_95]

No,non lo so... Si potrebbe eliminare il file, prima però creane una copia di backup.

[Fred]

Ora vado di fretta, però ho il tempo di dirti che non devi selezionare la riga ma spuntare la casella a fianco della riga. Vedi se così si elimina. una volta eliminato posta un nuovo log di GMER