Portatile lento

[omar_hs88]

Ciao ragazzi,ho un problema,stavolta sul portatile,che da un paio di giorni è notevolmente lento.
Questo è il risultato di HijackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19.43.39, on 26/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Programmi\AGI\common\win32\PythonService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Programmi\ATKOSD2\ATKOSD2.exe
c:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\ATK Hotkey\Hcontrol.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programmi\ASUS\ATK Media\DMEDIA.EXE
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\ASUS\Splendid\ACMON.exe
C:\Programmi\Motorola\SMSERIAL\sm56hlpr.exe
C:\Programmi\Wireless Console 2\wcourier.exe
C:\WINDOWS\system32\ASUSTPE.exe
C:\WINDOWS\ASScrPro.exe
C:\Programmi\Atheros\ACU.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\Eset\nod32kui.exe
C:\Programmi\ATK Hotkey\ATKOSD.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\ACEngSvr.exe
C:\PROGRA~1\ALICET~1\SMARTB~1\MotiveSB.exe
C:\Programmi\Microsoft LifeCam\MSCamS32.exe
C:\Programmi\Eset\nod32krn.exe
C:\WINDOWS\vVX1000.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\Programmi\Google\Google Desktop Search\GoogleDesktop.exe
C:\Programmi\Spyware Doctor\pctsAuxs.exe
C:\Programmi\Spyware Doctor\pctsTray.exe
C:\Programmi\Kiwee Toolbar\2.8.167\kwtbaim.exe
C:\Programmi\File comuni\Ulead Systems\AutoDetector\monitor.exe
C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Windows Live\Messenger\msnmsgr.exe
C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\documents and settings\utente\impostazioni locali\dati applicazioni\igumysq.exe
C:\Programmi\ATK Hotkey\KBFiltr.exe
C:\Programmi\ATK Hotkey\WDC.exe
C:\Programmi\Sygate\SPF\smc.exe
C:\Programmi\Alice ti aiuta\bin\mpbtn.exe
C:\Programmi\OpenOffice.org 2.3\program\soffice.exe
C:\Programmi\Google\Google Desktop Search\GoogleDesktop.exe
C:\Programmi\OpenOffice.org 2.3\program\soffice.BIN
C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
c:\Programmi\ATI Technologies\ATI.ACE\Core-Static\mom.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
c:\Programmi\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmi\Windows Live\Messenger\usnsvc.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\DOCUME~1\Utente\IMPOST~1\Temp\Rar$EX00.953\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://it.msn.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://it.msn.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://it.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://it.msn.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: AGSearchHook Class - {0BC6E3FA-78EF-4886-842C-5A1258C4455A} - C:\Programmi\AGI\common\agcutils.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Programmi\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Programmi\Kiwee Toolbar\2.8.167\KiweeIEToolbar.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar1.dll
O3 - Toolbar: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Programmi\Kiwee Toolbar\2.8.167\KiweeIEToolbar.dll
O4 - HKLM\..\Run: [ATKOSD2] "C:\Programmi\ATKOSD2\ATKOSD2.exe"
O4 - HKLM\..\Run: [ATKHOTKEY] "C:\Programmi\ATK Hotkey\Hcontrol.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ATKMEDIA] C:\Programmi\ASUS\ATK Media\DMEDIA.EXE
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ACMON] "C:\Programmi\ASUS\Splendid\ACMON.exe"
O4 - HKLM\..\Run: [ABLKSR] C:\WINDOWS\ABLKSR\ABLKSR.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\Programmi\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [Power_Gear] C:\Programmi\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [Wireless Console 2] "C:\Programmi\Wireless Console 2\wcourier.exe"
O4 - HKLM\..\Run: [ASUSTPE] C:\WINDOWS\system32\ASUSTPE.exe
O4 - HKLM\..\Run: [ASUS Camera ScreenSaver] C:\WINDOWS\ASScrProlog.exe
O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\WINDOWS\ASScrPro.exe
O4 - HKLM\..\Run: [ACU] C:\Programmi\Atheros\ACU.exe -nogui
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [nod32kui] "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\ALICET~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [LifeCam] "C:\Programmi\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Programmi\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [ISTray] "C:\Programmi\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [KiweeHook] C:\Programmi\Kiwee Toolbar\2.8.167\kwtbaim.exe
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Programmi\File comuni\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe /autorun
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Programmi\File comuni\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmi\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [igumysq] "c:\documents and settings\utente\impostazioni locali\dati applicazioni\igumysq.exe" igumysq
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9f.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - .DEFAULT User Startup: CCC.lnk = ? (User 'Default user')
O4 - Startup: CCC.lnk = ?
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Programmi\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Alice ti aiuta.lnk = C:\Programmi\Alice ti aiuta\bin\matcli.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Programmi\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Inserisci blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programmi\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: Inserisci &blog in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programmi\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/ ... ontrol.cab
O16 - DPF: {4A85DBE0-BFB2-4119-8401-186A7C6EB653} - http://messenger.zone.msn.com/binary/MJSS.cab69309.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/IT-IT/a-U ... E_UNO1.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-3938142ee67e7d4b.spaces.live ... nPUpld.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZI ... b56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{31F6007D-89AF-4275-A063-D550482415C8}: NameServer = 85.37.17.5 85.38.28.77
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GO333C~1\GOEC62~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Programmi\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Servizio di configurazione Atheros (ACS) - Atheros - C:\WINDOWS\system32\acs.exe
O23 - Service: AG Windows Service (AGWinService) - Unknown owner - C:\Programmi\AGI\common\win32\PythonService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Programmi\File comuni\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Programmi\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Programmi\File comuni\LightScribe\LSSrvc.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmi\Eset\nod32krn.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Programmi\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Programmi\Spyware Doctor\pctsSvc.exe
O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Programmi\Sygate\SPF\smc.exe
O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe

--
End of file - 12758 bytes

Problemi??

[ste_95]

Seleziona a sinistra queste voci e premi in basso il pulsante Fix Checked:

O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe
O4 - HKCU\..\Run: [igumysq] "c:\documents and settings\utente\impostazioni locali\dati applicazioni\igumysq.exe" igumysq

Scarica Avenger
Estrailo in una cartella a tua scelta
Esegui il file avenger.exe con la figura di una spada
Ora incolla queste righe nella box bianca che si è aperta:

Codice: Seleziona tutto

Files to delete:
C:\WINDOWS\vVX1000.exe
c:\documents and settings\utente\impostazioni locali\dati applicazioni\igumysq.exe
c:\documents and settings\utente\impostazioni locali\dati applicazioni\igumysq.dat
c:\documents and settings\utente\impostazioni locali\dati applicazioni\igumysq_nav.dat
c:\documents and settings\utente\impostazioni locali\dati applicazioni\igumysq_navps.dat

Togli il segno di spunta dalla voce Scan for Rootkits
Premi il pulsante Execute
Rispondi di Si alle due richieste di Avenger
Adesso il tuo computer dovrebbe riavviarsi, nel caso non succedesse, riavvialo tu manualmente
Al riavvio del computer, copia e incolla qui il contenuto del blocco note che apparirà.

Se Avenger riporta un errore, prova a riscrivere manualmente la prima riga (Files to delete:) ricordando i due punti. Se il problema persiste prova con la vecchia versione di Avenger.

[omar_hs88]

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File "C:\WINDOWS\vVX1000.exe" deleted successfully.
File "c:\documents and settings\utente\impostazioni locali\dati applicazioni\igumysq.exe" deleted successfully.
File "c:\documents and settings\utente\impostazioni locali\dati applicazioni\igumysq.dat" deleted successfully.
File "c:\documents and settings\utente\impostazioni locali\dati applicazioni\igumysq_nav.dat" deleted successfully.
File "c:\documents and settings\utente\impostazioni locali\dati applicazioni\igumysq_navps.dat" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

[ste_95]

Hai ancora problemi?

[omar_hs88]

si,grazie per ora,ma è sempre ultra lento.
Noto vari processi pesantissimi,li elenco:

ptcsSvc.exe 54 mb
RTHDCPL.exe 33 mb
svchost.exe (fra i tanti) 37 mb

Infatti nelle prestazioni l'utilizzo CPU non scende sotto il 25%...
Firefox con solo questa pagina aperta mi prende 60 mb

[crazy.cat]

ptcsSvc.exe 54 mb

Ecco il mattone spywaredoctor, eliminalo e passa a spywareterminator per la protezione in tempo reale, poi vediamo la differenza.

RTHDCPL.exe 33 mb
Questo è il pannello di controllo dell'audio Realtek. Poco utile si può anche rimuovere senza troppi rimpianti.

svchost.exe (fra i tanti) 37 mb
Da tenere.

Infatti nelle prestazioni l'utilizzo CPU non scende sotto il 25%...

chi è che usa la cpu?

[zenith]

RTHDCPL.exe 33 mb
Questo è il pannello di controllo dell'audio Realtek. Poco utile si può anche rimuovere senza troppi rimpianti.

E' strano che sia così grande questo processo. A me occupa si e no 6 Kb... non vorrei ci fosse qualcosa dietro.

[omar_hs88]

Infatti nelle prestazioni l'utilizzo CPU non scende sotto il 25%...

chi è che usa la cpu?

Non lo sò,anche con nessun programma aperto mi lavora parecchio.

[crazy.cat]

Scarica ComboFix, salvandolo sul PC con un nome di fantasia, ed esegui la scansione seguendo queste istruzioni (giù in fondo). Al termine della scansione verrà creato il file di report C:\combofix.txt, copia qui il suo contenuto inserendolo tra i tag LOG.

[omar_hs88]

ComboFix 09-01-01.02 - Utente 2009-01-03 15:09:54.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1040.18.895.406 [GMT 1:00]
Eseguito da: c:\documents and settings\Utente\Desktop\ComboFix.exe
* Resident AV is active


ATENÇÃO - ESTA MAQUINA NAO TEM A CONSOLE DE RECUPERAÇÃO INSTALADA !!
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
c:\programmi\FunWebProducts
c:\programmi\MyWebSearch
c:\programmi\MyWebSearch\bar\Settings\s_pid.dat
c:\windows\IE4 Error Log.txt
c:\windows\system32\f3PSSavr.scr
D:\Autorun.inf

.
((((((((((((((((((((((((( Files Creati Da 2008-12-03 al 2009-01-03 )))))))))))))))))))))))))))))))))))
.

2009-01-02 21:27 . 2009-01-02 21:28 <DIR> d-------- c:\programmi\iTunes
2009-01-02 21:27 . 2009-01-02 21:28 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-01-02 21:26 . 2009-01-02 21:26 <DIR> d-------- c:\programmi\Bonjour
2009-01-02 21:23 . 2009-01-02 21:23 54,156 --ah----- c:\windows\QTFont.qfn
2009-01-02 21:23 . 2009-01-02 21:23 1,409 --a------ c:\windows\QTFont.for
2009-01-02 21:22 . 2009-01-02 21:22 <DIR> d-------- c:\programmi\Apple Software Update
2009-01-02 21:21 . 2009-01-02 21:28 <DIR> d-------- c:\programmi\File comuni\Apple
2009-01-02 21:21 . 2009-01-02 21:21 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\Apple
2008-12-31 15:14 . 2008-12-31 15:21 <DIR> d-------- c:\programmi\HooTech
2008-12-31 15:02 . 2008-12-31 15:54 <DIR> d-------- c:\documents and settings\Utente\Dati applicazioni\Azureus
2008-12-31 15:02 . 2008-12-31 15:02 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\Azureus
2008-12-31 14:57 . 2008-12-31 14:58 <DIR> d-------- c:\programmi\Vuze
2008-12-31 14:57 . 2008-12-31 14:57 <DIR> d-------- c:\programmi\File comuni\i4j_jres
2008-12-13 20:23 . 2008-12-13 20:23 <DIR> d-------- c:\programmi\Adobe Media Player
2008-12-13 20:17 . 2008-12-13 20:17 <DIR> d-------- c:\programmi\File comuni\Adobe AIR
2008-12-13 19:57 . 2008-12-13 19:57 <DIR> d-------- c:\programmi\File comuni\Macrovision Shared

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-03 10:26 --------- d-----w c:\documents and settings\Utente\Dati applicazioni\OpenOffice.org2
2009-01-02 20:28 --------- d-----w c:\programmi\iPod
2009-01-02 20:25 --------- d-----w c:\programmi\QuickTime
2009-01-02 20:24 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Apple Computer
2009-01-02 20:18 --------- d-----w c:\programmi\RogueRemover FREE
2009-01-02 20:11 --------- d-----w c:\programmi\File comuni\Wise Installation Wizard
2009-01-02 20:11 --------- d-----w c:\documents and settings\Utente\Dati applicazioni\SUPERAntiSpyware.com
2009-01-02 20:03 --------- d---a-w c:\documents and settings\All Users\Dati applicazioni\TEMP
2009-01-02 19:38 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Google Updater
2008-12-31 14:12 --------- d-----w c:\programmi\eMule
2008-12-13 21:01 --------- d-----w c:\programmi\File comuni\Adobe
2008-12-12 14:00 --------- d-----w c:\programmi\Norton Security Scan
2008-12-09 23:03 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Microsoft Help
2008-12-02 22:16 --------- d-----w c:\programmi\MSXML 4.0
2008-12-01 16:46 --------- d-----w c:\programmi\Samsung
2008-11-29 20:05 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\WLInstaller
2008-11-25 18:56 --------- d-----w c:\documents and settings\Utente\Dati applicazioni\gtk-2.0
2008-11-23 14:09 --------- d-----w c:\documents and settings\Utente\Dati applicazioni\Ulead Systems
2008-11-23 14:03 --------- d--h--w c:\programmi\InstallShield Installation Information
2008-11-23 14:03 --------- d-----w c:\programmi\File comuni\Ulead Systems
2008-11-23 14:02 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Ulead Systems
2008-11-23 14:00 --------- d-----w c:\programmi\Corel
2008-11-21 14:08 --------- d-----w c:\programmi\File comuni\Symantec Shared
2008-11-07 14:12 --------- d-----w c:\programmi\SUPERAntiSpyware
2008-09-27 16:34 122,880 ----a-w c:\programmi\mozilla firefox\components\GoogleDesktopMozilla.dll
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2006-03-02 15360]
"swg"="c:\programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-03-01 68856]
"msnmsgr"="c:\programmi\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATKOSD2"="c:\programmi\ATKOSD2\ATKOSD2.exe" [2007-07-03 7708672]
"ATKHOTKEY"="c:\programmi\ATK Hotkey\Hcontrol.exe" [2007-07-12 225280]
"ATKMEDIA"="c:\programmi\ASUS\ATK Media\DMEDIA.EXE" [2006-11-02 61440]
"SynTPEnh"="c:\programmi\Synaptics\SynTP\SynTPEnh.exe" [2006-05-25 786521]
"ACMON"="c:\programmi\ASUS\Splendid\ACMON.exe" [2007-07-10 851968]
"ABLKSR"="c:\windows\ABLKSR\ABLKSR.exe" [2006-01-02 61440]
"SMSERIAL"="c:\programmi\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-22 630784]
"Power_Gear"="c:\programmi\ASUS\Power4 Gear\BatteryLife.exe" [2006-07-26 90112]
"Wireless Console 2"="c:\programmi\Wireless Console 2\wcourier.exe" [2007-07-05 1040384]
"ASUSTPE"="c:\windows\system32\ASUSTPE.exe" [2007-01-16 106496]
"ASUS Camera ScreenSaver"="c:\windows\ASScrProlog.exe" [2007-10-16 37232]
"ASUS Screen Saver Protector"="c:\windows\ASScrPro.exe" [2007-10-16 33136]
"ACU"="c:\programmi\Atheros\ACU.exe" [2007-05-03 376921]
"nod32kui"="c:\programmi\Eset\nod32kui.exe" [2007-12-26 949376]
"Motive SmartBridge"="c:\progra~1\ALICET~1\SMARTB~1\MotiveSB.exe" [2006-04-21 438359]
"SmcService"="c:\progra~1\Sygate\SPF\smc.exe" [2005-09-27 2635472]
"Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"LifeCam"="c:\programmi\Microsoft LifeCam\LifeExp.exe" [2007-05-17 279912]
"TkBellExe"="c:\programmi\File comuni\Real\Update_OB\realsched.exe" [2008-03-22 185896]
"Google Desktop Search"="c:\programmi\Google\Google Desktop Search\GoogleDesktop.exe" [2008-09-27 29744]
"Ulead AutoDetector v2"="c:\programmi\File comuni\Ulead Systems\AutoDetector\monitor.exe" [2007-08-02 95504]
"Samsung PanelMgr"="c:\windows\Samsung\PanelMgr\SSMMgr.exe" [2008-05-07 524288]
"AdobeCS4ServiceManager"="c:\programmi\File comuni\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"QuickTime Task"="c:\programmi\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\programmi\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"RTHDCPL"="RTHDCPL.EXE" [2006-10-30 c:\windows\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2006-03-02 c:\windows\system32\bthprops.cpl]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-03-02 15360]

c:\documents and settings\Administrator\Menu Avvio\Programmi\Esecuzione automatica\
CCC.lnk - c:\programmi\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [2006-09-29 49152]

c:\documents and settings\Utente\Menu Avvio\Programmi\Esecuzione automatica\
CCC.lnk - c:\programmi\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [2006-09-29 49152]

c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Alice ti aiuta.lnk - c:\programmi\Alice ti aiuta\bin\matcli.exe [2008-01-21 217088]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.X264"= x264vfw.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programmi\\Microsoft LifeCam\\LifeCam.exe"=
"c:\\Programmi\\Microsoft LifeCam\\LifeExp.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"c:\\Programmi\\File comuni\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Programmi\\Bonjour\\mDNSResponder.exe"=
"c:\\Programmi\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2007-12-26 15424]
R3 WSIMD;wsimd Service;c:\windows\system32\DRIVERS\wsimd.sys [2007-10-16 57024]
S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys []
S3 {EE37FD10-8FAE-4c12-AE2F-D47E54120E4D};{EE37FD10-8FAE-4c12-AE2F-D47E54120E4D};\??\c:\windows\system32\{EE37FD10-8FAE-4c12-AE2F-D47E54120E4D} []
S3 AtcL002;NDIS Miniport Driver for Atheros L2 Fast Ethernet Controller;c:\windows\system32\DRIVERS\l251x86.sys [2007-08-21 30208]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;"c:\programmi\Google\Google Desktop Search\GoogleDesktop.exe" [2008-03-28 29744]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\ccc-core-static]
msiexec /fums {857D4360-762B-978B-76AD-491AA719E47A} /qb
.
Contenuto della cartella 'Scheduled Tasks'

2009-01-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programmi\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2008-12-12 c:\windows\Tasks\Norton Security Scan.job
- c:\programmi\Norton Security Scan\Nss.exe [2007-09-18 23:42]

2008-12-26 c:\windows\Tasks\OGADaily.job
- c:\windows\system32\OGAVerify.exe [2008-04-23 16:17]

2009-01-03 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAVerify.exe [2008-04-23 16:17]

2009-01-03 c:\windows\Tasks\Verifica aggiornamenti per Windows Live Toolbar.job
- c:\programmi\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]
.
- - - - ORFÃOS REMOVIDOS - - - -

ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - (no file)


.
------- Supplementare di scansione -------
.
uStart Page = hxxp://it.msn.com
uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
uInternet Settings,ProxyOverride = *.local
IE: &Windows Live Search - c:\programmi\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
LSP: c:\windows\system32\imon.dll
TCP: {31F6007D-89AF-4275-A063-D550482415C8} = 85.37.17.5 85.38.28.77

c:\windows\Downloaded Program Files\InstallerControl.dll - O16 -: CabBuilder
hxxp://kiw.imgag.com/imgag/kiw/toolbar/ ... ontrol.cab
c:\windows\Downloaded Program Files\OSDC5.OSD

O16 -: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
FF - ProfilePath - c:\documents and settings\Utente\Dati applicazioni\Mozilla\Firefox\Profiles\eou643gc.default\
FF - prefs.js: browser.startup.homepage - hxxp://it.msn.com
FF - prefs.js: keyword.URL - hxxp://kwtb.search.imgag.com/?c=GNKIW29 ... 3043ede&q=
FF - component: c:\programmi\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - plugin: c:\programmi\Google\Google Updater\2.4.1399.3742\npCIDetect13.dll
FF - plugin: c:\programmi\Picasa2\npPicasa2.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-03 15:20:59
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\vsdatant]
"ImagePath"=""

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{EE37FD10-8FAE-4c12-AE2F-D47E54120E4D}]
"ImagePath"="\??\c:\windows\system32\{EE37FD10-8FAE-4c12-AE2F-D47E54120E4D}"
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

- - - - - - - > 'winlogon.exe'(792)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(848)
c:\windows\system32\imon.dll
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\acs.exe
c:\programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\programmi\Bonjour\mDNSResponder.exe
c:\programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\programmi\File comuni\LightScribe\LSSrvc.exe
c:\programmi\File comuni\Microsoft Shared\VS7DEBUG\mdm.exe
c:\programmi\Microsoft LifeCam\MSCamS32.exe
c:\programmi\ESET\nod32krn.exe
c:\programmi\Sygate\SPF\Smc.exe
c:\program files\ASUS\NB Probe\SPM\spmgr.exe
c:\programmi\ATK Hotkey\ATKOSD.exe
c:\programmi\ATK Hotkey\KBFiltr.exe
c:\windows\system32\rundll32.exe
c:\programmi\ATK Hotkey\WDC.exe
c:\windows\system32\ACEngSvr.exe
c:\windows\system32\wbem\unsecapp.exe
c:\programmi\iPod\bin\iPodService.exe
c:\programmi\Alice ti aiuta\bin\mpbtn.exe
c:\programmi\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
.
**************************************************************************
.
Ora fine scansione: 2009-01-03 15:27:07 - macchina è stato riavviato [Utente]
ComboFix-quarantined-files.txt 2009-01-03 14:27:04

Pre-Run: 19,050,507,264 byte disponibili
Post-Run: 19,178,529,792 byte disponibili

229 --- E O F --- 2008-12-18 22:51:54

[Amantide]

Scansiona su www.virustotal.com questo file/cartella e vedi di cosa si tratta:
c:\windows\system32\{EE37FD10-8FAE-4c12-AE2F-D47E54120E4D}

[crazy.cat]

Scansiona su http://www.virustotal.com questo file/cartella e vedi di cosa si tratta:
c:\windows\system32\{EE37FD10-8FAE-4c12-AE2F-D47E54120E4D}

Tanto per togliermi il dubbio puoi far controllare anche questo file
- c:\windows\system32\OGAVerify.exe
Mi sembra strano trovarlo nei tasj
2009-01-03 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAVerify.exe [2008-04-23 16:17]

Hai fatto una scansione completa con superantispyware o malwarebytes?

combofix ha rimosso, forse non del tutto, alcuni malware che lasciano un mucchio di schifezze in giro per il pc.

[omar_hs88]

Scansiona su http://www.virustotal.com questo file/cartella e vedi di cosa si tratta:
c:\windows\system32\{EE37FD10-8FAE-4c12-AE2F-D47E54120E4D}

Non lo trovo

[Amantide]

Prova ad abilitare la visualizzazione dei file nascosti e di sistema dalle Opzioni cartella.

[omar_hs88]

Scansiona su http://www.virustotal.com questo file/cartella e vedi di cosa si tratta:
c:\windows\system32\{EE37FD10-8FAE-4c12-AE2F-D47E54120E4D}

Tanto per togliermi il dubbio puoi far controllare anche questo file
- c:\windows\system32\OGAVerify.exe
Mi sembra strano trovarlo nei tasj
2009-01-03 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAVerify.exe [2008-04-23 16:17]

Hai fatto una scansione completa con superantispyware o malwarebytes?

combofix ha rimosso, forse non del tutto, alcuni malware che lasciano un mucchio di schifezze in giro per il pc.

File OGAVerify.exe ricevuto il 2008.05.28 11:59:59 (CET)
Stato corrente: finito
Risultato: 1/32 (3.12%)

La scansione completa con superantispyware l'ho fatta da poco e ha rimosso poca roba.Con malwarebytes mai provato.Ora lo faccio poi ti dico

[omar_hs88]

Prova ad abilitare la visualizzazione dei file nascosti e di sistema dalle Opzioni cartella.

Fatto,cercato manualmente e con la ricerca guidata,non si trova

[omar_hs88]

Malwarebytes' Anti-Malware 1.31
Versione del database: 1603
Windows 5.1.2600 Service Pack 2

03/01/2009 22.43.10
mbam-log-2009-01-03 (22-43-10).txt

Tipo di scansione: Scansione completa (C:\|D:\|)
Elementi scansionati: 125756
Tempo trascorso: 1 hour(s), 39 minute(s), 29 second(s)

Processi delle memoria infetti: 0
Moduli della memoria infetti: 0
Chiavi di registro infette: 5
Valori di registro infetti: 0
Elementi dato del registro infetti: 0
Cartelle infette: 0
File infetti: 2

Processi delle memoria infetti:
(Nessun elemento malevolo rilevato)

Moduli della memoria infetti:
(Nessun elemento malevolo rilevato)

Chiavi di registro infette:
HKEY_CLASSES_ROOT\Interface\{38a7c9da-8db7-4d0f-a7b1-c4b1a305bddb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{8d292ec0-6792-4a38-82ed-73a087e41ba6} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{98635087-3f5d-418f-990c-b1efe0797a3b} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Valori di registro infetti:
(Nessun elemento malevolo rilevato)

Elementi dato del registro infetti:
(Nessun elemento malevolo rilevato)

Cartelle infette:
(Nessun elemento malevolo rilevato)

File infetti:
C:\Qoobox\Quarantine\C\WINDOWS\system32\f3PSSavr.scr.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{96A776DE-7E2E-415B-94AB-C6F5824A27CC}\RP107\A0068596.scr (Adware.MyWebSearch) -> Quarantined and deleted successfully.

[omar_hs88]

se può tornare utile kaspersky ha rimosso due backdoor "win32"

[ste_95]

Se hai ancora problemi dai un'occhiata a questo articolo:
http://www.MegaLab.it/3502

[omar_hs88]

Più che altro ora il problema è che non mi trova più le connessioni alla rete senza fili!