processo Kmd.exe in C:\ e explorer.exe altissimo senza rete

[dovesono?]

Ciao. Ho bisogno di aiuto.
Ho un portatile Lenovo R60 e con S.O. XP professionale 2002, 512 Mb di Ram.
Non so se è un virus o un problema hardware.
Ho il processo explorer.exe nel task manager che a connessione staccata sale di moltissimi kb
e nel contempo la memoria disponibile sempre nel task scende molto.
La CPU resta a 0 o 1%.
L' altro giorno explorer.exe è arrivato a 140000 kb mentre aprivo alcuni file di windows.
Ma altra stranezza è che questi valori nonostante io chiuda i programmi o i file aperti scendono
lentamente.
Un altra cosa che mi ha atterrita è Kmd.exe in C:\ ; ha la forma del dos, un rettangolino nero sui cui puntando
il mouse si legge, processore dei comandi di windows.
Ho fatto un controllo con virustotal, ma esce l' analisi a cmd.exe che credo sia un altra cosa.
Pochi giorni fa ho eliminato qualcosa come 37 MB di programmi inutili di windows seguendo
vostri consigli.
Vi ringrazio tanto.

[Amantide]

Scarica ComboFix ed esegui la scansione seguendo queste istruzioni (giù in fondo). Al termine della scansione verrà creato il file di report C:\combofix.txt, copia qui il suo contenuto.

[dovesono?]

Gentilissima Amantide, grazie per la dritta.
Perfortuna leggendo un po' di post Combofix l' ho scaricato stamani, perché da qui mi appare questo messaggio e non posso scaricarlo.
Fatal error: Call to a member function getID() on a non-object in /usr/www/vhosts/MegaLab.it/www/mli2/libs/class/mli_dbdata/Log.class.php on line 185

Tra l' altro ho avuto problemi anche per il login.
Adesso eseguo Combofix e poi mi riconnetto.

[dovesono?]

Scusa Amantide non riesco ad allegare il log di Combo nella finestrina a destra.
Ho una connessione dial-up e se sto anche 5 minuti ferma su una pagina mi cade la connessione.

[Amantide]

Scusa Amantide non riesco ad allegare il log di Combo nella finestrina a destra .

Di che finestrina parli?
Copia il contenuto del file log ed incollalo direttamente qui.

[dovesono?]

Avevo letto delle nuove regole per i messaggi. Quando si apre la pagina per scrivere c' è a destra la scritta Log dentro un rettangolino.
Comunque grazie ancora Amantide.
Combofix è partito da sè, io mi ricordavo che si doveva digitare 1 e poi invio.
Ho visto che ha eliminato un componente di Norton e tutte le volte che apro il suddetto
antivirus mi appare la finestra di Windows installer, attendere configurazione di Symantec antivirus.
Finestra che non si chiude finchè non appare inviare segnalazione a Microsoft.
Poi in C:\ si sono create 6 cartelle, 3 della Symantec, un file setup.wis,
un Data1.cab a forma di mobiletto con 2 cassetti. E una relativa a Combofix, ma se l' ho salvato
sul desktop.
Ragazzi sono quasi in lacrime.
Impazzisco prima io del pc?

ComboFix 08-12-12.05 - 2008-12-14 17:15:31.6 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1040.18.502.159 [GMT 1:00]
Eseguito da: c:\documents and settings\mionome\Desktop\ComboFixza.exe (l' ho rinominato io combo come suggerito in un post)

ATENÇÃO - ESTA MAQUINA NAO TEM A CONSOLE DE RECUPERAÇÃO INSTALADA !!
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
c:\documents and settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr1.dat
C:\kmd.exe
c:\windows\system32\NavLogon.dll
c:\windows\system32\tphklock.dll

.
((((((((((((((((((((((((( Files Creati Da 2008-11-14 al 2008-12-14 )))))))))))))))))))))))))))))))))))
.

2008-12-12 20:36 . 2008-12-12 20:36 142,096 --a------ c:\windows\system32\drivers\tmcomm.sys
2008-12-12 20:35 . 2008-12-12 20:36 <DIR> d-------- c:\programmi\RootkitBuster2.2.1014
2008-12-12 19:57 . 2008-12-12 19:57 981,274 --a------ c:\programmi\RootkitBuster2.2.1014.zip
2008-12-11 22:49 . 2008-12-11 22:49 <DIR> d-------- c:\programmi\Dial-a-fix-v0.60.0.24
2008-12-11 12:31 . 2008-12-11 12:31 <DIR> d-------- C:\Desktop
2008-12-10 22:40 . 2008-12-10 22:40 <DIR> d-------- c:\programmi\Malwarebytes' Anti-Malware
2008-12-10 22:40 . 2008-12-10 22:40 <DIR> d-------- c:\documents and settings\mionome\Dati applicazioni\Malwarebytes
2008-12-10 22:40 . 2008-12-10 22:40 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\Malwarebytes
2008-12-10 22:40 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-10 22:40 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-10 21:44 . 2008-12-11 11:37 <DIR> d-------- c:\programmi\SUPERAntiSpyware
2008-12-10 21:44 . 2008-12-10 21:44 <DIR> d-------- c:\documents and settings\mionome\Dati applicazioni\SUPERAntiSpyware.com
2008-12-10 21:44 . 2008-12-10 21:44 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\SUPERAntiSpyware.com
2008-12-10 20:10 . 2008-12-10 20:10 <DIR> d-------- c:\programmi\File comuni\Wise Installation Wizard
2008-12-10 20:09 . 2008-12-10 20:09 5,780,000 --a------ c:\programmi\SUPERAntiSpyware.exe
2008-12-09 22:12 . 2008-12-09 22:12 <DIR> d-------- c:\programmi\Panda Security
2008-12-09 22:12 . 2008-06-19 17:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys
2008-12-09 10:51 . 2008-12-09 10:52 <DIR> d-------- c:\programmi\CCleaner
2008-12-08 20:06 . 2008-12-08 20:06 <DIR> d-------- c:\programmi\Trend Micro
2008-12-08 19:25 . 2008-12-08 19:25 335,992 --a------ c:\programmi\Dial-a-fix-v0.60.0.24.zip
2008-12-08 18:50 . 2008-12-08 18:50 812,344 --a------ c:\programmi\HJTInstall.exe
2008-12-06 18:15 . 2008-12-06 18:15 <DIR> d--hs---- c:\windows\ftpcache

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-14 16:17 19,470,368 --sha-w c:\windows\system32\drivers\fidbox.dat
2008-12-14 15:59 228,452 --sha-w c:\windows\system32\drivers\fidbox.idx
2008-12-14 15:58 --------- d-----w c:\programmi\Eraser
2008-12-14 14:39 5,427 ----a-w c:\windows\system32\EGATHDRV.SYS
2008-12-08 13:50 --------- d---a-w c:\programmi\Spyware Terminator
2008-12-07 23:20 --------- d---a-w c:\documents and settings\All Users\Dati applicazioni\Spyware Terminator
2008-10-16 17:30 2,588,647 ----a-w c:\windows\Internet Logs\tvDebug.zip
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe
2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll
2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-09-08 23:35 2,811,211 ------w c:\programmi\Eraser57Setup.zip
2008-01-15 00:33 210,416 ------w c:\programmi\zaSetup_it.exe
.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
-c----w 2,778,112 2007-09-21 19:29:58 c:\programmi\Spyware Terminator\bak\SpywareTerminatorShield.exe
------w 2,778,112 2008-01-17 22:00:23 c:\programmi\Spyware Terminator\Spywareterminatorshield.Exe

-c----w 15,360 2004-08-19 21:00:00 c:\windows\system32\bak\ctfmon.exe
------w 15,360 2004-08-19 21:00:00 c:\windows\system32\ctfmon.exe

.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="c:\programmi\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"MSMSGS"="c:\programmi\Messenger\msmsgs.exe" [2004-10-13 1694208]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-19 15360]
"Eraser"="c:\programmi\Eraser\eraser.exe" [2003-07-25 536576]
"WMPNSCFG"="c:\programmi\Windows Media Player\WMPNSCFG.exe" [2006-11-02 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"vptray"="c:\progra~1\SYMANT~2\SYMANT~1\vptray.exe" [2002-08-22 77824]
"TVT Scheduler Proxy"="c:\programmi\File comuni\Lenovo\Scheduler\scheduler_proxy.exe" [2007-07-10 540672]
"TPKMAPHELPER"="c:\programmi\ThinkPad\Utilities\TpKmapAp.exe" [2006-06-02 856064]
"TPHOTKEY"="c:\progra~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe" [2006-07-25 94208]
"SpywareTerminator"="c:\programmi\Spyware Terminator\SpywareTerminatorShield.exe" [2008-01-17 2778112]
"SoundMAXPnP"="c:\programmi\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]
"PWRMGRTR"="c:\progra~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2006-05-25 151552]
"Picasa Media Detector"="c:\programmi\Picasa2\PicasaMediaDetector.exe" [2006-03-16 421888]
"PDService.exe"="c:\programmi\Lenovo\SafeGuard PrivateDisk\pdservice.exe" [2006-03-13 41472]
"LPManager"="c:\progra~1\THINKV~1\PrdCtr\LPMGR.exe" [2006-07-04 110592]
"ISUSScheduler"="c:\programmi\File comuni\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"ISUSPM Startup"="c:\progra~1\FILECO~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-07-25 94208]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-07-25 118784]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-07-25 77824]
"EZEJMNAP"="c:\progra~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2006-02-23 237568]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2006-02-02 122940]
"DiskeeperSystray"="c:\programmi\Diskeeper Corporation\Diskeeper\DkIcon.exe" [2006-05-18 196696]
"cssauth"="c:\programmi\Lenovo\Client Security Solution\cssauth.exe" [2006-07-14 2341632]
"BLOG"="c:\progra~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2006-05-25 208896]
"AwaySch"="c:\programmi\Lenovo\AwayTask\AwaySch.EXE" [2006-08-16 69632]
"AMSG"="c:\progra~1\THINKV~1\AMSG\amsg.exe" [2005-11-14 487424]
"ACWLIcon"="c:\programmi\ThinkPad\ConnectUtilities\ACWLIcon.exe" [2006-08-26 110592]
"ACTray"="c:\programmi\ThinkPad\ConnectUtilities\ACTray.exe" [2006-08-26 409600]
"ZoneAlarm Client"="c:\programmi\Zone Labs\ZoneAlarm\zlclient.exe" [2007-12-13 919016]
"SunJavaUpdateSched"="c:\programmi\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 132496]
"TrackPointSrv"="tp4serv.exe" [2005-07-12 c:\windows\system32\tp4serv.exe]
"TP4EX"="tp4ex.exe" [2005-10-17 c:\windows\system32\TP4EX.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360]

c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Avvio veloce di Adobe Reader.lnk - c:\programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
BTTray.lnk - c:\programmi\ThinkPad\Bluetooth Software\BTTray.exe [2006-05-31 622653]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-11-16 24576]
Microsoft Office.lnk - c:\programmi\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\programmi\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-03 14:56 352256 c:\programmi\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AwayNotify]
2006-08-16 18:07 49152 c:\programmi\Lenovo\AwayTask\AwayNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
2005-07-05 15:45 28672 c:\windows\system32\notifyf2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Programmi\\Messenger\\msmsgs.exe"=

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-12-09 28544]
R1 ANC;ANC;c:\windows\system32\drivers\ANC.SYS [2006-11-16 11520]
R1 IBMTPCHK;IBMTPCHK;\??\c:\windows\system32\Drivers\IBMBLDID.sys [2006-11-16 6016]
R1 SASDIFSV;SASDIFSV;\??\c:\programmi\SUPERAntiSpyware\SASDIFSV.SYS [2008-12-04 8944]
R1 SASKUTIL;SASKUTIL;\??\c:\programmi\SUPERAntiSpyware\SASKUTIL.sys [2008-12-04 55024]
R1 sp_rsdrv2;Spyware Terminator Driver 2;\??\c:\windows\system32\drivers\sp_rsdrv2.sys [2007-07-03 138624]
R1 TPPWRIF;TPPWRIF;c:\windows\system32\drivers\Tppwrif.sys [2006-11-16 4442]
R2 DbgMsg;Debug Message;\??\c:\windows\System32\Drivers\DbgMsg.sys [2007-03-28 18240]
R2 PrivateDisk;PrivateDisk;\??\c:\programmi\Lenovo\SafeGuard PrivateDisk\PrivateDiskM.sys [2006-03-13 58368]
R2 smi2;smi2;\??\c:\programmi\SMI2\smi2.sys [2006-07-14 3968]
R3 Tp4Track;PS/2 TrackPoint Driver;c:\windows\system32\DRIVERS\tp4track.sys [2006-11-17 13840]
S3 MosIrUsb;MosIrUsb.sys;c:\windows\system32\DRIVERS\MosIrUsb.sys [2004-08-02 48128]
S3 SASENUM;SASENUM;\??\c:\programmi\SUPERAntiSpyware\SASENUM.SYS [2008-12-04 7408]
.
Contenuto della cartella 'Scheduled Tasks'

2008-12-14 c:\windows\Tasks\PMTask.job
- c:\progra~1\ThinkPad\UTILIT~1\PWMIDTSK.EXE [2006-05-25 17:13]

2007-07-08 c:\windows\Tasks\Symantec NetDetect.job
- c:\programmi\Symantec\LiveUpdate\NDETECT.EXE [2005-04-11 18:16]
.
.
------- Supplementare di scansione -------
.
uStart Page = hxxp://www.lenovo.com/welcome/thinkpad
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Invia a periferica &Bluetooth... - c:\programmi\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
TCP: {D35CAF2C-A1A6-472A-99A0-2EFDD7E55C40} = 131.110.80.20,131.110.20.25

c:\windows\system32\capicom.dll - c:\windows\Downloaded Program Files\acpir2.dll
O16 -: {2DAD3559-2923-4935-AD49-B673D2539944}
hxxp://download.boulder.ibm.com/ibmdl/p ... /acpir.cab
c:\windows\Downloaded Program Files\acpir.inf
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-14 17:17:18
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

- - - - - - - > 'winlogon.exe'(1396)
c:\windows\system32\tvt_gina.dll
c:\programmi\Lenovo\Client Security Solution\css_gina_plugin.dll
c:\programmi\Lenovo\Client Security Solution\css_wait_bar.dll
c:\programmi\Lenovo\Client Security Solution\cssuserdatadispatcher.dll
c:\programmi\Lenovo\Client Security Solution\csswait.dll
c:\programmi\File comuni\Lenovo\tvt_banner.dll
c:\programmi\Lenovo\Client Security Solution\cssdlgpwentry.dll
c:\programmi\Lenovo\Client Security Solution\dlganswerprompt.dll
c:\programmi\Lenovo\Client Security Solution\tvttsp.dll
c:\programmi\Lenovo\Client Security Solution\tcsrpc.dll
c:\programmi\File comuni\Lenovo\tvt_res.dll
c:\programmi\SUPERAntiSpyware\SASWINLO.dll
c:\programmi\Lenovo\AwayTask\AwayNotify.dll
.
Ora fine scansione: 2008-12-14 17:18:25
ComboFix-quarantined-files.txt 2008-12-14 16:18:21

Pre-Run: 36,748,505,088 byte disponibili
Post-Run: 36,723,302,400 byte disponibili

205 --- E O F --- 2008-02-23 01:29:02

[Amantide]

Scusa, ma dal momento che vedo nel log la presenza di Panda Antivirus, cosa te ne fai dell'antivirus di Norton?
Forse sarà meglio se scarichi dal sito della Symantec il tool specifico per la rimozioni di loro prodotti e rimuovi definitivamente il Norton.

Apri il task manager e termina questi 2 processi:
ctfmon.exe
Spywareterminatorshield.Exe

Ora elimina questi file indicati in rosso e rimpiazzali con quelli indicati in blu.

c:\programmi\Spyware Terminator\bak\SpywareTerminatorShield.exe
c:\programmi\Spyware Terminator\Spywareterminatorshield.Exe

c:\windows\system32\bak\ctfmon.exe
c:\windows\system32\ctfmon.exe

Fatto questo, riavvia il pc, fai la scansione con Malwarebytes Anti-malware e posta qui il suo report.

[dovesono?]

Scusami ancora Amantide, ma non ho una grande competenza con l' informatica.
Non ho capito come sostituire i file rossi con quelli blu.
Ti ringrazio

[Amantide]

Sfogliando le cartelle trova prima i file che ho evidenziato in rosso. Questi file sono infetti e quindi devono essere eliminati, però siccome sono in uso, prima di rimuoverli li devi terminare. Quindi, apri il task manager (combinazione di tasti Ctrl+Alt+Canc) trova quei 2 processi che ti ho evidenziato in neretto e terminali. A questo punto potrai eliminare i file "rossi" senza alcun problema.
Ora, nelle stesse cartelle c'è anche la cartella chiamata bak ed al suo interno si trova la copia sana del file. Devi semplicemente copiare il file sano ed incollarla nella posizione originale, cioè li, da dove avrai appena rimosso il file infetto.
Spero di essere stata abbastanza chiara

[dovesono?]

Mitica Amantide.
Ho eliminato i due file, Spywareterminatorshield.exe e Cftmon.exe e li ho sostituiti con quelli sani.
Insieme al primo ho eliminato un file exe che aveva la stessa data e ora di quello infetto.
Ci sono altri file, per es. unins000.dat creato alla stessa ora e giorno di quello infetto. Lo lascio lì o lo tolgo?
Cftmon.exe mi sta dando qualche problema; come lo elimino si ricrea dopo 2 secondi. Anche lì accanto ce n' era un' altro .exe con questi numeri 444515326 che ho meliminato facilmente.
Sia Spywareterminator che cftmon sono riapparsi sul task manager.
E' tutto ok o ho sbagliato qualcosa?

[Amantide]

E' tutto ok o ho sbagliato qualcosa?

Intanto mandami un nuovo log di Combofix così vediamo se l'hai fatto bene questa operazione.
Fai anche la scansione con Kaspersky online e posta qui il report per vedere se c'è dell'altro da eliminare.

[dovesono?]

Carissima Amantide Buongiorno.
Scusami se rispondo solo ora, ma ieri non mi sono potuta collegare.
Spywareterminator l' ho eliminato, è rimasta una dll nel percorso C:\Programmi\Spywareterminator che non si eliminava.
Ho riavviato ed è sparita. Spero che questo malware sia cassato.
Ctfmon.exe è più noioso. Non si può cancellare.
Ti allego la scansione di Combo dove ho visto come sia attuale il problema.
Infatti all' avvio del pc la memoria disponibile ha sfiorato quota 5000 kb e non so cosa poteva accadere,
e inolte appare configurazione Symantec con il windows installer.
Grazie mille ancora.

ComboFix 08-12-12.05 - 2008-12-16 0.07.24.7 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1040.18.502.198 [GMT 1:00]
Eseguito da: c:\documents and settings\mionome\Desktop\ComboFixza.exe

ATENÇÃO - ESTA MAQUINA NAO TEM A CONSOLE DE RECUPERAÇÃO INSTALADA !!
.

((((((((((((((((((((((((( Files Creati Da 2008-11-15 al 2008-12-15 )))))))))))))))))))))))))))))))))))
.

2008-12-16 00:00 . 2008-12-16 00:00 <DIR> d-------- C:\SevInst
2008-12-14 23:09 . 2008-12-14 23:09 724,952 --a------ c:\programmi\avenger.zip
2008-12-14 17:57 . 2008-12-14 17:57 <DIR> d-------- C:\VirDefs
2008-12-14 17:57 . 2008-12-14 17:57 <DIR> d-------- C:\LiveUpdt
2008-12-14 17:57 . 2008-12-14 17:57 <DIR> d-------- C:\Data
2008-12-14 17:57 . 2008-12-16 00:05 1,252,314 --a------ C:\Data1.cab
2008-12-14 17:57 . 2008-12-16 00:05 1,663 --a------ C:\Setup.wis
2008-12-12 20:36 . 2008-12-12 20:36 142,096 --a------ c:\windows\system32\drivers\tmcomm.sys
2008-12-12 20:35 . 2008-12-12 20:36 <DIR> d-------- c:\programmi\RootkitBuster2.2.1014
2008-12-12 19:57 . 2008-12-12 19:57 981,274 --a------ c:\programmi\RootkitBuster2.2.1014.zip
2008-12-11 22:49 . 2008-12-11 22:49 <DIR> d-------- c:\programmi\Dial-a-fix-v0.60.0.24
2008-12-11 12:31 . 2008-12-11 12:31 <DIR> d-------- C:\Desktop
2008-12-10 22:40 . 2008-12-10 22:40 <DIR> d-------- c:\programmi\Malwarebytes' Anti-Malware
2008-12-10 22:40 . 2008-12-10 22:40 <DIR> d-------- c:\documents and settings\mionome\Dati applicazioni\Malwarebytes
2008-12-10 22:40 . 2008-12-10 22:40 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\Malwarebytes
2008-12-10 22:40 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-10 22:40 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-10 21:44 . 2008-12-11 11:37 <DIR> d-------- c:\programmi\SUPERAntiSpyware
2008-12-10 21:44 . 2008-12-10 21:44 <DIR> d-------- c:\documents and settings\mionome\Dati applicazioni\SUPERAntiSpyware.com
2008-12-10 21:44 . 2008-12-10 21:44 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\SUPERAntiSpyware.com
2008-12-10 20:10 . 2008-12-10 20:10 <DIR> d-------- c:\programmi\File comuni\Wise Installation Wizard
2008-12-10 20:09 . 2008-12-10 20:09 5,780,000 --a------ c:\programmi\SUPERAntiSpyware.exe
2008-12-09 22:12 . 2008-12-09 22:12 <DIR> d-------- c:\programmi\Panda Security
2008-12-09 22:12 . 2008-06-19 17:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys
2008-12-09 10:51 . 2008-12-09 10:52 <DIR> d-------- c:\programmi\CCleaner
2008-12-08 20:06 . 2008-12-08 20:06 <DIR> d-------- c:\programmi\Trend Micro
2008-12-08 19:25 . 2008-12-08 19:25 335,992 --a------ c:\programmi\Dial-a-fix-v0.60.0.24.zip
2008-12-08 18:50 . 2008-12-08 18:50 812,344 --a------ c:\programmi\HJTInstall.exe
2008-12-06 18:15 . 2008-12-06 18:15 <DIR> d--hs---- c:\windows\ftpcache

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-15 23:09 19,722,272 --sha-w c:\windows\system32\drivers\fidbox.dat
2008-12-15 22:44 231,500 --sha-w c:\windows\system32\drivers\fidbox.idx
2008-12-15 22:43 --------- d-----w c:\programmi\Eraser
2008-12-14 14:39 5,427 ----a-w c:\windows\system32\EGATHDRV.SYS
2008-10-16 17:30 2,588,647 ----a-w c:\windows\Internet Logs\tvDebug.zip
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe
2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll
2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-09-08 23:35 2,811,211 ------w c:\programmi\Eraser57Setup.zip
2008-01-15 00:33 210,416 ------w c:\programmi\zaSetup_it.exe
.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
-c----w 15,360 2004-08-19 21:00:00 c:\windows\system32\bak\ctfmon.exe
----a-w 15,360 2004-08-19 21:00:00 c:\windows\system32\ctfmon.exe

.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="c:\programmi\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"MSMSGS"="c:\programmi\Messenger\msmsgs.exe" [2004-10-13 1694208]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-19 15360]
"Eraser"="c:\programmi\Eraser\eraser.exe" [2003-07-25 536576]
"WMPNSCFG"="c:\programmi\Windows Media Player\WMPNSCFG.exe" [2006-11-02 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"vptray"="c:\progra~1\SYMANT~2\SYMANT~1\vptray.exe" [2002-08-22 77824]
"TVT Scheduler Proxy"="c:\programmi\File comuni\Lenovo\Scheduler\scheduler_proxy.exe" [2007-07-10 540672]
"TPKMAPHELPER"="c:\programmi\ThinkPad\Utilities\TpKmapAp.exe" [2006-06-02 856064]
"TPHOTKEY"="c:\progra~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe" [2006-07-25 94208]
"SoundMAXPnP"="c:\programmi\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]
"PWRMGRTR"="c:\progra~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2006-05-25 151552]
"Picasa Media Detector"="c:\programmi\Picasa2\PicasaMediaDetector.exe" [2006-03-16 421888]
"PDService.exe"="c:\programmi\Lenovo\SafeGuard PrivateDisk\pdservice.exe" [2006-03-13 41472]
"LPManager"="c:\progra~1\THINKV~1\PrdCtr\LPMGR.exe" [2006-07-04 110592]
"ISUSScheduler"="c:\programmi\File comuni\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"ISUSPM Startup"="c:\progra~1\FILECO~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-07-25 94208]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-07-25 118784]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-07-25 77824]
"EZEJMNAP"="c:\progra~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2006-02-23 237568]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2006-02-02 122940]
"DiskeeperSystray"="c:\programmi\Diskeeper Corporation\Diskeeper\DkIcon.exe" [2006-05-18 196696]
"cssauth"="c:\programmi\Lenovo\Client Security Solution\cssauth.exe" [2006-07-14 2341632]
"BLOG"="c:\progra~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2006-05-25 208896]
"AwaySch"="c:\programmi\Lenovo\AwayTask\AwaySch.EXE" [2006-08-16 69632]
"AMSG"="c:\progra~1\THINKV~1\AMSG\amsg.exe" [2005-11-14 487424]
"ACWLIcon"="c:\programmi\ThinkPad\ConnectUtilities\ACWLIcon.exe" [2006-08-26 110592]
"ACTray"="c:\programmi\ThinkPad\ConnectUtilities\ACTray.exe" [2006-08-26 409600]
"ZoneAlarm Client"="c:\programmi\Zone Labs\ZoneAlarm\zlclient.exe" [2007-12-13 919016]
"SunJavaUpdateSched"="c:\programmi\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 132496]
"TrackPointSrv"="tp4serv.exe" [2005-07-12 c:\windows\system32\tp4serv.exe]
"TP4EX"="tp4ex.exe" [2005-10-17 c:\windows\system32\TP4EX.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360]

c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Avvio veloce di Adobe Reader.lnk - c:\programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
BTTray.lnk - c:\programmi\ThinkPad\Bluetooth Software\BTTray.exe [2006-05-31 622653]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-11-16 24576]
Microsoft Office.lnk - c:\programmi\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\programmi\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-03 14:56 352256 c:\programmi\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AwayNotify]
2006-08-16 18:07 49152 c:\programmi\Lenovo\AwayTask\AwayNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
2005-07-05 15:45 28672 c:\windows\system32\notifyf2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Programmi\\Messenger\\msmsgs.exe"=

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-12-09 28544]
R1 ANC;ANC;c:\windows\system32\drivers\ANC.SYS [2006-11-16 11520]
R1 IBMTPCHK;IBMTPCHK;\??\c:\windows\system32\Drivers\IBMBLDID.sys [2006-11-16 6016]
R1 SASDIFSV;SASDIFSV;\??\c:\programmi\SUPERAntiSpyware\SASDIFSV.SYS [2008-12-04 8944]
R1 SASKUTIL;SASKUTIL;\??\c:\programmi\SUPERAntiSpyware\SASKUTIL.sys [2008-12-04 55024]
R1 TPPWRIF;TPPWRIF;c:\windows\system32\drivers\Tppwrif.sys [2006-11-16 4442]
R2 DbgMsg;Debug Message;\??\c:\windows\System32\Drivers\DbgMsg.sys [2007-03-28 18240]
R2 PrivateDisk;PrivateDisk;\??\c:\programmi\Lenovo\SafeGuard PrivateDisk\PrivateDiskM.sys [2006-03-13 58368]
R2 smi2;smi2;\??\c:\programmi\SMI2\smi2.sys [2006-07-14 3968]
R3 Tp4Track;PS/2 TrackPoint Driver;c:\windows\system32\DRIVERS\tp4track.sys [2006-11-17 13840]
S3 MosIrUsb;MosIrUsb.sys;c:\windows\system32\DRIVERS\MosIrUsb.sys [2004-08-02 48128]
S3 SASENUM;SASENUM;\??\c:\programmi\SUPERAntiSpyware\SASENUM.SYS [2008-12-04 7408]

*Newly Created Service* - CATCHME
*Newly Created Service* - DEFWATCH
.
Contenuto della cartella 'Scheduled Tasks'

2008-12-15 c:\windows\Tasks\PMTask.job
- c:\progra~1\ThinkPad\UTILIT~1\PWMIDTSK.EXE [2006-05-25 17:13]

2007-07-08 c:\windows\Tasks\Symantec NetDetect.job
- c:\programmi\Symantec\LiveUpdate\NDETECT.EXE [2005-04-11 18:16]
.
.
------- Supplementare di scansione -------
.
uStart Page = hxxp://www.lenovo.com/welcome/thinkpad
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Invia a periferica &Bluetooth... - c:\programmi\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
TCP: {D35CAF2C-A1A6-472A-99A0-2EFDD7E55C40} = 131.110.80.20,131.110.80.25

c:\windows\system32\capicom.dll - c:\windows\Downloaded Program Files\acpir2.dll
O16 -: {2DAD3559-2923-4935-AD49-B673D2539944}
hxxp://download.boulder.ibm.com/ibmdl/p ... /acpir.cab
c:\windows\Downloaded Program Files\acpir.inf
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-16 00:09:21
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

- - - - - - - > 'winlogon.exe'(1400)
c:\windows\system32\tvt_gina.dll
c:\programmi\Lenovo\Client Security Solution\css_gina_plugin.dll
c:\programmi\Lenovo\Client Security Solution\css_wait_bar.dll
c:\programmi\Lenovo\Client Security Solution\cssuserdatadispatcher.dll
c:\programmi\Lenovo\Client Security Solution\csswait.dll
c:\programmi\File comuni\Lenovo\tvt_banner.dll
c:\programmi\Lenovo\Client Security Solution\cssdlgpwentry.dll
c:\programmi\Lenovo\Client Security Solution\dlganswerprompt.dll
c:\programmi\Lenovo\Client Security Solution\tvttsp.dll
c:\programmi\Lenovo\Client Security Solution\tcsrpc.dll
c:\programmi\File comuni\Lenovo\tvt_res.dll
c:\programmi\SUPERAntiSpyware\SASWINLO.dll
c:\programmi\Lenovo\AwayTask\AwayNotify.dll
.
Ora fine scansione: 2008-12-16 0.10.17
ComboFix-quarantined-files.txt 2008-12-15 23:10:14

Pre-Run: 36.779.646.976 byte disponibili
Post-Run: 36,781,391,872 byte disponibili

195 --- E O F --- 2008-02-23 01:29:02

[Amantide]

Per favore, la prossima volta allega i log seguendo queste istruzioni.

Scarica The Avenger, estrailo in una cartella ed avvia il file avenger.exe.
Incolla il seguente spript nello spazio bianco sotto alla voce Input script here, togli la spunta alla voce Scan for rootkits e clicca su Execute.

Codice: Seleziona tutto

Files to remove:
c:\windows\Tasks\Symantec NetDetect.job

Files to move: 
C:\WINDOWS\system32\bak\ctfmon.exe | C:\WINDOWS\system32\ctfmon.exe

Il pc dovrebbe riavviarsi, se così non fosse, riavvialo manualmente.
Al riavvio dovrebbe apparire il log avenger.txt, posta qui il suo contenuto.

Per quanto riguarda i rimasugli di Symantec, prova a rimuoverli con questo Removal Tool.

[dovesono?]

Avenger per farlo partire ho dovuto inserire il comando files to delete e non remove perché dava il messaggio "Error: Invalid script. A valid script must begin with a command directive. Aborting execution!"
Spero di aver fatto tutto secondo regola.
Ciao e grazie

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 2)
Tue Dec 16 16:57:55 2008

16:57:55: Error: Invalid script. A valid script must begin with a command directive.
Aborting execution!


//////////////////////////////////////////


//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 2)
Tue Dec 16 16:59:22 2008

16:59:22: Error: Invalid script. A valid script must begin with a command directive.
Aborting execution!


//////////////////////////////////////////


//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 2)
Tue Dec 16 17:02:22 2008

17:02:22: Error: Invalid script. A valid script must begin with a command directive.
Aborting execution!


//////////////////////////////////////////


Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File "c:\windows\Tasks\Symantec NetDetect.job" deleted successfully.
File move operation "C:\WINDOWS\system32\bak\ctfmon.exe|C:\WINDOWS\system32\ctfmon.exe" completed successfully.

Completed script processing.

*******************

Finished! Terminate.

[Amantide]

Avenger per farlo partire ho dovuto inserire il comando files to delete e non remove perché dava il messaggio "Error: Invalid script. A valid script must begin with a command directive. Aborting execution!"
Spero di aver fatto tutto secondo regola.

Si si, hai fatto più che benissimo
Ora vedi di risolvere anche con la Symantec.

[dovesono?]

Ciao Amantide, peccato che non ci troviamo mai in diretta. Mentre eri connessa stavo facendo la scansione con Kaspersky e con la dial-up si fa notte. L' antivirus russo mi aveva segnalato 5 trojan, in realtà erano quelli che avevo già eliminato 7 giorni fa ed erano rimasti in una cartella di back-up di symantec. Ma non redo influissero sul sistema, che dici?
Adesso li ho eliminati andando nella cartella interessata.
La rottura sono 8 cartelle in C:\, symantec e altre stranezze. Per esempio dopo l' accensione del pc, le icone non assumono subito il loro aspetto, ma quello di un file bianco e poi tutto lo schermo fa una specie sobbalzo e poi ritorna normale.

Ecco il log di kaspersky. Attendo tue istruzioni. A presto e grazie.

KASPERSKY ONLINE SCANNER 7 REPORT
Tuesday, December 16, 2008
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Tuesday, December 16, 2008 22:52:49
Records in database: 1466314


Scan settings
Scan using the following database extended
Scan archives yes
Scan mail databases yes

Scan area My Computer
C:\
D:\
R:\

Scan statistics
Files scanned 45434
Threat name 1
Infected objects 5
Suspicious objects 0
Duration of the scan 01:12:53

File name Threat name Threats count
C:\Documents and Settings\All Users\Dati applicazioni\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0EB40000.VBN Infected: Trojan-Downloader.Java.OpenConnection.aq 1

C:\Documents and Settings\All Users\Dati applicazioni\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0EB40002.VBN Infected: Trojan-Downloader.Java.OpenConnection.aq 1

C:\Documents and Settings\All Users\Dati applicazioni\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0EB40004.VBN Infected: Trojan-Downloader.Java.OpenConnection.aq 1

C:\Documents and Settings\All Users\Dati applicazioni\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0EB40006.VBN Infected: Trojan-Downloader.Java.OpenConnection.aq 1

C:\Documents and Settings\All Users\Dati applicazioni\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0EB40008.VBN Infected: Trojan-Downloader.Java.OpenConnection.aq 1

The selected area was scanned.

[Amantide]

Tu attualmente che antivirus usi? Panda, TrendMicro o Symantec?

[dovesono?]

Ciao Amantide io al momento non ho antivirus, ma mi collego solo in questo sito. Sto pensando ad Avg o Nod 32.
Ti allego una nuova scansione di Combofix e Hijackthis.
In C:\ ho un file Data1.cab, una cartella Data creatisi il 14 alla stessa ora e una cartella desktop che prima non c'era e creatasi l' 11 dicembre. Posso eliminarle tranquillamente tutte?
Grazie.
Il pc mi sembra migliorato.
Grazie.

Questo è il report di Combofix

ComboFix 08-12-12.05 - 2008-12-17 21.39.20.8 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1040.18.502.143 [GMT 1:00]
Eseguito da: c:\documents and settings\mionome\Desktop\ComboFixza.exe

ATENÇÃO - ESTA MAQUINA NAO TEM A CONSOLE DE RECUPERAÇÃO INSTALADA !!
.

((((((((((((((((((((((((( Files Creati Da 2008-11-17 al 2008-12-17 )))))))))))))))))))))))))))))))))))
.

2008-12-17 00:23 . 2008-12-17 00:23 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\NortonInstaller
2008-12-16 16:52 . 2008-12-16 16:52 <DIR> d-------- c:\programmi\avenger
2008-12-16 02:24 . 2008-12-16 02:23 410,984 --a------ c:\windows\system32\deploytk.dll
2008-12-14 23:09 . 2008-12-14 23:09 724,952 --a------ c:\programmi\avenger.zip
2008-12-14 17:57 . 2008-12-14 17:57 <DIR> d-------- C:\Data
2008-12-14 17:57 . 2008-12-16 19:28 1,252,314 --a------ C:\Data1.cab
2008-12-12 20:36 . 2008-12-12 20:36 142,096 --a------ c:\windows\system32\drivers\tmcomm.sys
2008-12-12 20:35 . 2008-12-12 20:36 <DIR> d-------- c:\programmi\RootkitBuster2.2.1014
2008-12-12 19:57 . 2008-12-12 19:57 981,274 --a------ c:\programmi\RootkitBuster2.2.1014.zip
2008-12-11 22:49 . 2008-12-11 22:49 <DIR> d-------- c:\programmi\Dial-a-fix-v0.60.0.24
2008-12-11 12:31 . 2008-12-11 12:31 <DIR> d-------- C:\Desktop
2008-12-10 22:40 . 2008-12-10 22:40 <DIR> d-------- c:\programmi\Malwarebytes' Anti-Malware
2008-12-10 22:40 . 2008-12-10 22:40 <DIR> d-------- c:\documents and settings\mionome\Dati applicazioni\Malwarebytes
2008-12-10 22:40 . 2008-12-10 22:40 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\Malwarebytes
2008-12-10 22:40 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-10 22:40 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-10 21:44 . 2008-12-11 11:37 <DIR> d-------- c:\programmi\SUPERAntiSpyware
2008-12-10 21:44 . 2008-12-10 21:44 <DIR> d-------- c:\documents and settings\mionome\Dati applicazioni\SUPERAntiSpyware.com
2008-12-10 21:44 . 2008-12-10 21:44 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\SUPERAntiSpyware.com
2008-12-10 20:10 . 2008-12-10 20:10 <DIR> d-------- c:\programmi\File comuni\Wise Installation Wizard
2008-12-10 20:09 . 2008-12-10 20:09 5,780,000 --a------ c:\programmi\SUPERAntiSpyware.exe
2008-12-09 22:12 . 2008-12-09 22:12 <DIR> d-------- c:\programmi\Panda Security
2008-12-09 22:12 . 2008-06-19 17:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys
2008-12-09 10:51 . 2008-12-09 10:52 <DIR> d-------- c:\programmi\CCleaner
2008-12-08 20:06 . 2008-12-08 20:06 <DIR> d-------- c:\programmi\Trend Micro
2008-12-08 19:25 . 2008-12-08 19:25 335,992 --a------ c:\programmi\Dial-a-fix-v0.60.0.24.zip
2008-12-08 18:50 . 2008-12-08 18:50 812,344 --a------ c:\programmi\HJTInstall.exe
2008-12-06 18:15 . 2008-12-06 18:15 <DIR> d--hs---- c:\windows\ftpcache

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-17 19:19 234,404 --sha-w c:\windows\system32\drivers\fidbox.idx
2008-12-17 19:19 20,002,848 --sha-w c:\windows\system32\drivers\fidbox.dat
2008-12-17 19:19 --------- d-----w c:\programmi\Eraser
2008-12-16 01:23 --------- d---a-w c:\programmi\Java
2008-12-14 14:39 5,427 ----a-w c:\windows\system32\EGATHDRV.SYS
2008-10-16 17:30 2,588,647 ----a-w c:\windows\Internet Logs\tvDebug.zip
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe
2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll
2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-09-08 23:35 2,811,211 ------w c:\programmi\Eraser57Setup.zip
2008-01-15 00:33 210,416 ------w c:\programmi\zaSetup_it.exe
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="c:\programmi\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"MSMSGS"="c:\programmi\Messenger\msmsgs.exe" [2004-10-13 1694208]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-19 15360]
"Eraser"="c:\programmi\Eraser\eraser.exe" [2003-07-25 536576]
"WMPNSCFG"="c:\programmi\Windows Media Player\WMPNSCFG.exe" [2006-11-02 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TVT Scheduler Proxy"="c:\programmi\File comuni\Lenovo\Scheduler\scheduler_proxy.exe" [2007-07-10 540672]
"TPKMAPHELPER"="c:\programmi\ThinkPad\Utilities\TpKmapAp.exe" [2006-06-02 856064]
"TPHOTKEY"="c:\progra~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe" [2006-07-25 94208]
"SoundMAXPnP"="c:\programmi\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]
"PWRMGRTR"="c:\progra~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2006-05-25 151552]
"Picasa Media Detector"="c:\programmi\Picasa2\PicasaMediaDetector.exe" [2006-03-16 421888]
"PDService.exe"="c:\programmi\Lenovo\SafeGuard PrivateDisk\pdservice.exe" [2006-03-13 41472]
"LPManager"="c:\progra~1\THINKV~1\PrdCtr\LPMGR.exe" [2006-07-04 110592]
"ISUSScheduler"="c:\programmi\File comuni\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"ISUSPM Startup"="c:\progra~1\FILECO~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-07-25 94208]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-07-25 118784]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-07-25 77824]
"EZEJMNAP"="c:\progra~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2006-02-23 237568]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2006-02-02 122940]
"DiskeeperSystray"="c:\programmi\Diskeeper Corporation\Diskeeper\DkIcon.exe" [2006-05-18 196696]
"cssauth"="c:\programmi\Lenovo\Client Security Solution\cssauth.exe" [2006-07-14 2341632]
"BLOG"="c:\progra~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2006-05-25 208896]
"AwaySch"="c:\programmi\Lenovo\AwayTask\AwaySch.EXE" [2006-08-16 69632]
"AMSG"="c:\progra~1\THINKV~1\AMSG\amsg.exe" [2005-11-14 487424]
"ACWLIcon"="c:\programmi\ThinkPad\ConnectUtilities\ACWLIcon.exe" [2006-08-26 110592]
"ACTray"="c:\programmi\ThinkPad\ConnectUtilities\ACTray.exe" [2006-08-26 409600]
"ZoneAlarm Client"="c:\programmi\Zone Labs\ZoneAlarm\zlclient.exe" [2007-12-13 919016]
"SunJavaUpdateSched"="c:\programmi\Java\jre6\bin\jusched.exe" [2008-12-16 136600]
"TrackPointSrv"="tp4serv.exe" [2005-07-12 c:\windows\system32\tp4serv.exe]
"TP4EX"="tp4ex.exe" [2005-10-17 c:\windows\system32\TP4EX.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360]

c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Avvio veloce di Adobe Reader.lnk - c:\programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
BTTray.lnk - c:\programmi\ThinkPad\Bluetooth Software\BTTray.exe [2006-05-31 622653]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-11-16 24576]
Microsoft Office.lnk - c:\programmi\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\programmi\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-03 14:56 352256 c:\programmi\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AwayNotify]
2006-08-16 18:07 49152 c:\programmi\Lenovo\AwayTask\AwayNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
2005-07-05 15:45 28672 c:\windows\system32\notifyf2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Programmi\\Messenger\\msmsgs.exe"=

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-12-09 28544]
R1 ANC;ANC;c:\windows\system32\drivers\ANC.SYS [2006-11-16 11520]
R1 IBMTPCHK;IBMTPCHK;\??\c:\windows\system32\Drivers\IBMBLDID.sys [2006-11-16 6016]
R1 SASDIFSV;SASDIFSV;\??\c:\programmi\SUPERAntiSpyware\SASDIFSV.SYS [2008-12-04 8944]
R1 SASKUTIL;SASKUTIL;\??\c:\programmi\SUPERAntiSpyware\SASKUTIL.sys [2008-12-04 55024]
R1 TPPWRIF;TPPWRIF;c:\windows\system32\drivers\Tppwrif.sys [2006-11-16 4442]
R2 DbgMsg;Debug Message;\??\c:\windows\System32\Drivers\DbgMsg.sys [2007-03-28 18240]
R2 PrivateDisk;PrivateDisk;\??\c:\programmi\Lenovo\SafeGuard PrivateDisk\PrivateDiskM.sys [2006-03-13 58368]
R2 smi2;smi2;\??\c:\programmi\SMI2\smi2.sys [2006-07-14 3968]
R3 Tp4Track;PS/2 TrackPoint Driver;c:\windows\system32\DRIVERS\tp4track.sys [2006-11-17 13840]
S3 MosIrUsb;MosIrUsb.sys;c:\windows\system32\DRIVERS\MosIrUsb.sys [2004-08-02 48128]
S3 SASENUM;SASENUM;\??\c:\programmi\SUPERAntiSpyware\SASENUM.SYS [2008-12-04 7408]
.
Contenuto della cartella 'Scheduled Tasks'

2008-12-17 c:\windows\Tasks\PMTask.job
- c:\progra~1\ThinkPad\UTILIT~1\PWMIDTSK.EXE [2006-05-25 17:13]
.
- - - - ORFÃOS REMOVIDOS - - - -

Notify-NavLogon - (no file)


.
------- Supplementare di scansione -------
.
uStart Page = hxxp://www.lenovo.com/welcome/thinkpad
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Invia a periferica &Bluetooth... - c:\programmi\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
TCP: {D35CAF2C-A1A6-472A-99A0-2EFDD7E55C40} = 131.114.79.20,131.114.21.25

c:\windows\system32\capicom.dll - c:\windows\Downloaded Program Files\acpir2.dll
O16 -: {2DAD3559-2923-4935-AD49-B673D2539944}
hxxp://download.boulder.ibm.com/ibmdl/p ... /acpir.cab
c:\windows\Downloaded Program Files\acpir.inf
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-17 21:41:11
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

- - - - - - - > 'winlogon.exe'(1396)
c:\windows\system32\tvt_gina.dll
c:\programmi\Lenovo\Client Security Solution\css_gina_plugin.dll
c:\programmi\Lenovo\Client Security Solution\css_wait_bar.dll
c:\programmi\Lenovo\Client Security Solution\cssuserdatadispatcher.dll
c:\programmi\Lenovo\Client Security Solution\csswait.dll
c:\programmi\File comuni\Lenovo\tvt_banner.dll
c:\programmi\Lenovo\Client Security Solution\cssdlgpwentry.dll
c:\programmi\Lenovo\Client Security Solution\dlganswerprompt.dll
c:\programmi\Lenovo\Client Security Solution\tvttsp.dll
c:\programmi\Lenovo\Client Security Solution\tcsrpc.dll
c:\programmi\File comuni\Lenovo\tvt_res.dll
c:\programmi\SUPERAntiSpyware\SASWINLO.dll
c:\programmi\Lenovo\AwayTask\AwayNotify.dll
.
Ora fine scansione: 2008-12-17 21.42.01
ComboFix-quarantined-files.txt 2008-12-17 20:41:58

Pre-Run: 36.984.483.840 byte disponibili
Post-Run: 36,985,311,232 byte disponibili

187 --- E O F --- 2008-02-23 01:29:02

Questo è di Hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21.54.22, on 17/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Intel\Wireless\Bin\EvtEng.exe
C:\Programmi\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\IPSSVC.EXE
C:\Programmi\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
C:\Programmi\ThinkPad\Bluetooth Software\bin\btwdins.exe
C:\Programmi\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Java\jre6\bin\jqs.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\Programmi\Intel\Wireless\Bin\RegSrvc.exe
c:\programmi\lenovo\system update\suservice.exe
C:\Programmi\File comuni\Lenovo\tvt_reg_monitor_svc.exe
C:\WINDOWS\system32\TpKmpSVC.exe
C:\Programmi\Lenovo\Rescue and Recovery\rrservice.exe
C:\Programmi\File comuni\Lenovo\Scheduler\tvtsched.exe
C:\Programmi\Lenovo\Rescue and Recovery\ADM\IUService.exe
C:\Programmi\ThinkPad\ConnectUtilities\AcSvc.exe
C:\Programmi\File comuni\Lenovo\Logger\logmon.exe
C:\Programmi\Lenovo\Client Security Solution\cssauth.exe
C:\Programmi\File comuni\Lenovo\Scheduler\scheduler_proxy.exe
C:\WINDOWS\system32\tp4serv.exe
C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Programmi\Analog Devices\Core\smax4pnp.exe
C:\Programmi\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
C:\Programmi\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\Picasa2\PicasaMediaDetector.exe
C:\Programmi\Lenovo\SafeGuard PrivateDisk\pdservice.exe
C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe
C:\Programmi\File comuni\InstallShield\UpdateService\issch.exe
C:\Programmi\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\hkcmd.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Programmi\Lenovo\AwayTask\AwaySch.EXE
C:\PROGRA~1\THINKV~1\AMSG\amsg.exe
C:\Programmi\ThinkPad\ConnectUtilities\ACWLIcon.exe
C:\Programmi\ThinkPad\ConnectUtilities\ACTray.exe
C:\Programmi\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Eraser\eraser.exe
C:\Programmi\Windows Media Player\WMPNSCFG.exe
C:\Programmi\ThinkPad\Bluetooth Software\BTTray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.lenovo.com/welcome/thinkpad
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmi\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: ThinkVantage Password Manager - {F040E541-A427-4CF7-85D8-75E3E0F476C5} - C:\Programmi\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O4 - HKLM\..\Run: [TVT Scheduler Proxy] C:\Programmi\File comuni\Lenovo\Scheduler\scheduler_proxy.exe
O4 - HKLM\..\Run: [TrackPointSrv] tp4serv.exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Programmi\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Programmi\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Programmi\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [PDService.exe] "C:\Programmi\Lenovo\SafeGuard PrivateDisk\pdservice.exe"
O4 - HKLM\..\Run: [LPManager] C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Programmi\File comuni\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FILECO~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Programmi\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [cssauth] "C:\Programmi\Lenovo\Client Security Solution\cssauth.exe" silent
O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
O4 - HKLM\..\Run: [AwaySch] C:\Programmi\Lenovo\AwayTask\AwaySch.EXE
O4 - HKLM\..\Run: [AMSG] C:\PROGRA~1\THINKV~1\AMSG\amsg.exe
O4 - HKLM\..\Run: [ACWLIcon] C:\Programmi\ThinkPad\ConnectUtilities\ACWLIcon.exe
O4 - HKLM\..\Run: [ACTray] C:\Programmi\ThinkPad\ConnectUtilities\ACTray.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Programmi\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Eraser] C:\Programmi\Eraser\eraser.exe -hide
O4 - HKCU\..\Run: [WMPNSCFG] C:\Programmi\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Invia a periferica &Bluetooth... - C:\Programmi\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
O14 - IERESET.INF: START_PAGE_URL=http://www.lenovo.com/welcome/thinkpad
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://www.pandasecurity.com/activescan ... stubie.cab
O16 - DPF: {2DAD3559-2923-4935-AD49-B673D2539944} (IASRunner Class) - http://download.boulder.ibm.com/ibmdl/p ... /acpir.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 7387531215
O17 - HKLM\System\CCS\Services\Tcpip\..\{D35CAF2C-A1A6-472A-99A0-2EFDD7E55C40}: NameServer = 131.110.80.20,131.110.80.25
O20 - Winlogon Notify: !SASWinLogon - C:\Programmi\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: AwayNotify - C:\Programmi\Lenovo\AwayTask\AwayNotify.dll
O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Unknown owner - C:\Programmi\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Programmi\ThinkPad\ConnectUtilities\AcSvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Programmi\ThinkPad\Bluetooth Software\bin\btwdins.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Programmi\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: IPS Core Service (IPSSVC) - Lenovo Group Limited - C:\WINDOWS\system32\IPSSVC.EXE
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmi\Java\jre6\bin\jqs.exe
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: System Update (SUService) - Lenovo Group Limited - c:\programmi\lenovo\system update\suservice.exe
O23 - Service: ThinkVantage Registry Monitor Service - Unknown owner - C:\Programmi\File comuni\Lenovo\tvt_reg_monitor_svc.exe
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
O23 - Service: TVT Backup Service - Lenovo Group Limited - C:\Programmi\Lenovo\Rescue and Recovery\rrservice.exe
O23 - Service: TVT Scheduler - Lenovo Group Limited - C:\Programmi\File comuni\Lenovo\Scheduler\tvtsched.exe
O23 - Service: tvtnetwk - Unknown owner - C:\Programmi\Lenovo\Rescue and Recovery\ADM\IUService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 10718 bytes

[Amantide]

In C:\ ho un file Data1.cab, una cartella Data creatisi il 14 alla stessa ora e una cartella desktop che prima non c'era e creatasi l' 11 dicembre. Posso eliminarle tranquillamente tutte?

Prima di eliminarli abilita la visualizzazione dei file nascosti e controlla cosa c'è dentro a quelle cartelle.

Ti avevo chiesto che antivirus usi perché nel tuo pc se ne vedono tracce di 3 antivirus diversi ma non si capisce se e quale di quelli è attivo:

2008-12-09 22:12 . 2008-12-09 22:12 <DIR> d-------- c:\programmi\Panda Security
2008-12-09 22:12 . 2008-06-19 17:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys
2008-12-08 20:06 . 2008-12-08 20:06 <DIR> d-------- c:\programmi\Trend Micro
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-12-09 28544]
c:\windows\Tasks\Symantec NetDetect.job

Allora disinstalla dal pc tutte le tracce di questi programmi ed installa Avira.

[dovesono?]

Ciao Amantide
Scusa per gli antivirus.
Di Panda ho il file d' installazione per la scansione on line che ho fatto giorni fa.
Trend Micro è la cartella dove ho scaricato Hijackthis.
Questo sotto sinceramente non so cosa sia.
2008-12-09 22:12 . 2008-06-19 17:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-12-09 28544]

Ho parlato troppo presto sulla salute del pc; dopo aver riavviato è comparsa l' icona indicatrice della batteria sulla tray bar e mai vista.
Tornando a quei file in C:\ , ho deselezionato nascondi i file di sistema, e il file desktop che non si eliminava conteneva il programma malware antimalware e l' ho cancellato tornando in modalità provvisoria.
Il problema è che explore.exe tocca quota 20000 kb circa anche in provvisoria.
Il file cabinet Data1.cab e la cartella Data sempre in C:\ si sono creati quasi insieme, il giorno è lo stesso e differiscono di 3 minuti. La cartella Data contiene librerie di microsoft, un file batch Ms Dos e due sottocartelle pur con nomi diversi, hanno gli stessi programmi. Sono molto sospette. Aspetto però un tuo consiglio.
Il cabinet ha dei file con un nome global ma senza classificazione e una dll.
C' è qualcosa di strano.