virus

[lollo40]

ciao, sono ancora a chiedervi aiuto per i casini che combino. mi è entrato un virus e c'è un avviso che non riesco a togliere. ho fatto la scansione con hijackthis,ma non riesco a inviarvela con mediafire. come posso fare? vi ringrazio sono disperata

[ste_95]

Scarica HijackThis
Salvalo in una cartella (non aprirlo direttamente, sennò non farà i backup!)
Apri l'eseguibile
Clicca quindi su "Do a System Scan and Save a Logfile"
Attendi che finisca la scansione
Posta sul forum il risultato facendo attenzione a queste regole.

[lollo40]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9.51.39, on 10/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 SP3 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\crypserv.exe
C:\Programmi\PC Tools AntiVirus\PCTAVSvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Java\jre1.6.0_07\bin\jusched.exe
C:\Programmi\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\Programmi\PC Tools AntiVirus\PCTAV.exe
C:\WINDOWS\system32\frmwrk32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe
C:\Programmi\Skype\Phone\Skype.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Programmi\Skype\Plugin Manager\skypePM.exe
C:\Programmi\Malwarebytes' Anti-Malware\mbam.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\ntdll64.exe
C:\WINDOWS\system32\ntdll64.exe
C:\Documents and Settings\User\Desktop\HiJackThis.exe
C:\Programmi\File comuni\Ahead\Lib\NMIndexStoreSvr.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://it.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://radarsync.netvibes.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: DefaultSearchHook Class - {C94E154B-1459-4A47-966B-4B843BEFC7DB} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmi\File comuni\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Programmi\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PCTAVApp] "C:\Programmi\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN
O4 - HKLM\..\Run: [Framework Windows] frmwrk32.exe
O4 - HKLM\..\Run: [SpywareCleaner] C:\WINDOWS\system32\SpywareRemover.exe
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Programmi\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Skype] "C:\Programmi\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Programmi\IObit\Advanced SystemCare 3\AWC.exe" /startup
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: PartMetBackup.lnk = C:\Programmi\Java\jre1.6.0_07\bin\javaw.exe
O4 - Startup: PowerReg Scheduler V3.exe
O8 - Extra context menu item: &Google Search - res://C:\Programmi\Google\googletoolbar.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Programmi\Google\googletoolbar.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Programmi\Google\googletoolbar.dll/cmcache.html
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\Programmi\Google\googletoolbar.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Programmi\Google\googletoolbar.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'c:\docume~1\user\impost~1\temp\ntdll64.dll' missing
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Programmi/The%20Hidden%20Object%20Show/Images/stg_drm.ocx
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{A7CC8A1F-A8AB-4607-A195-B1D1218007D7}: NameServer = 85.37.17.6 85.38.28.89
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmi\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programmi\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: .NET Runtime Optimization Service v2.0.50727_X86 (clr_optimization_v2.0.50727_32) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (file missing)
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: Windows Presentation Foundation Font Cache 3.0.0.0 (FontCache3.0.0.0) - Unknown owner - C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe (file missing)
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Programmi\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Windows CardSpace (idsvc) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (file missing)
O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - PC Tools Research Pty Ltd - C:\Programmi\PC Tools AntiVirus\PCTAVSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O24 - Desktop Component 0: (no name) - http://www.rivelazioni.com/images/listen.gif

--
End of file - 7930 bytes

non so se va bene, come dicevo non riesco a far funzionare mediafire.grazie ste

Non serve usare mediafire...
By crazy.cat

[ste_95]

Seleziona a sinistra queste voci e premi in basso il pulsante Fix Checked:

R3 - URLSearchHook: DefaultSearchHook Class - {C94E154B-1459-4A47-966B-4B843BEFC7DB} - (no file)
O4 - HKLM\..\Run: [Framework Windows] frmwrk32.exe
O4 - HKLM\..\Run: [SpywareCleaner] C:\WINDOWS\system32\SpywareRemover.exe
O10 - Broken Internet access because of LSP provider 'c:\docume~1\user\impost~1\temp\ntdll64.dll' missing

Scarica Avenger
Estrailo in una cartella a tua scelta
Esegui il file avenger.exe con la figura di una spada
Ora incolla queste righe nella box bianca che si è aperta:

Codice: Seleziona tutto

Files to delete:
C:\WINDOWS\system32\frmwrk32.exe
c:\docume~1\user\impost~1\temp\ntdll64.dll
C:\WINDOWS\system32\SpywareRemover.exe
C:\WINDOWS\system32\ntdll64.exe

Togli il segno di spunta dalla voce Scan for Rootkits
Premi il pulsante Execute
Rispondi di Si alle due richieste di Avenger
Adesso il tuo computer dovrebbe riavviarsi, nel caso non succedesse, riavvialo tu manualmente
Al riavvio del computer, copia e incolla qui il contenuto del blocco note che apparirà.

Se Avenger riporta un errore, prova a riscrivere manualmente la prima riga (Files to delete:) ricordando i due punti. Se il problema persiste prova con la vecchia versione di Avenger.

[lollo40]

ho fatto la prima cosa che mi hai suggerito, ma non riesco ad aprire avenger sia l'ultimo che il primo.cosa fare?

[ste_95]

Scarica ComboFix ed esegui una scansione, le istruzioni le trovi in fondo a questo articolo.

[lollo40]

ciao ste95, finalmente sono riuscita ad aprire avenger e ti posto il risultato. comunque quel fastidioso avviso c'è sempre. devo fare anche con combofix una scansione?grazie

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File "C:\WINDOWS\system32\frmwrk32.exe" deleted successfully.

Error: file "c:\docume~1\user\impost~1\temp\ntdll64.dll" not found!
Deletion of file "c:\docume~1\user\impost~1\temp\ntdll64.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
the object does not exist

File "C:\WINDOWS\system32\SpywareRemover.exe" deleted successfully.
File "C:\WINDOWS\system32\ntdll64.exe" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.



Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:


Error: file "H:\Program Files\Wga microsoft\Windows XP Keygen.exe" not found!
Deletion of file "H:\Program Files\Wga microsoft\Windows XP Keygen.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
the object does not exist


Error: file "C:\Documents and Settings\User\Impostazioni locali\Temp\ntdll64.dll" not found!
Deletion of file "C:\Documents and Settings\User\Impostazioni locali\Temp\ntdll64.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
the object does not exist


Completed script processing.

*******************

Finished! Terminate.

[ste_95]

devo fare anche con combofix una scansione?

Sì.

[lollo40]

ciao, ho fatto la scansione con combofix, ma sono riuscita a farla solo in modalità provvisoria, sperando di non aver fatto guai peggiori di quelli già fatti. ti mando il risultato e ti ringrazio[LOG][/L ComboFix 09-01-10.02 - User 2009-01-11 10:24:36.1 - NTFSx86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1040.18.383.245 [GMT 1:00]
Eseguito da: c:\documents and settings\User\Desktop\ComboFix.exe

ATENÇÃO - ESTA MAQUINA NAO TEM A CONSOLE DE RECUPERAÇÃO INSTALADA !!
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\ahtn.htm
c:\windows\system32\msrdo20.dll
c:\windows\system32\rdocurs.dll
c:\windows\system32\test.ttt
c:\windows\system32\uniq.tll
c:\windows\system32\warning.gif
c:\windows\system32\win32hlp.cnf

.
((((((((((((((((((((((((((((((((((((((( Driver/Servizi )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_TDSSSERV
-------\Service_TDSSserv


((((((((((((((((((((((((( Files Creati Da 2008-12-11 al 2009-01-11 )))))))))))))))))))))))))))))))))))
.

2009-01-10 10:33 . 2009-01-10 10:33 <DIR> d-------- c:\programmi\RealAV
2009-01-10 01:06 . 2009-01-11 10:31 <DIR> d-a------ c:\documents and settings\All Users\Dati applicazioni\TEMP
2009-01-10 01:00 . 2009-01-10 01:00 111,616 --a--c--- c:\windows\system32\dllcache\userinit.exe
2009-01-10 00:57 . 2009-01-10 00:57 <DIR> d----c--- c:\documents and settings\All Users\Dati applicazioni\{51019853-129C-4EDE-9030-D5FD7BBD9AD0}
2009-01-10 00:17 . 2009-01-10 00:17 <DIR> dr-h----- C:\AHCache
2009-01-09 22:08 . 2009-01-09 22:08 <DIR> d-------- c:\programmi\Zero Assumption Digital Image Recovery
2009-01-09 21:49 . 2009-01-09 21:49 <DIR> d-------- c:\programmi\Digital Photo Recovery
2009-01-09 16:51 . 2009-01-09 16:51 <DIR> d-------- c:\programmi\Outlook Express Backup Wizard
2009-01-08 16:53 . 2009-01-08 23:29 <DIR> d-------- c:\programmi\Alice Messenger
2008-12-29 23:51 . 2009-01-09 23:34 <DIR> d-------- c:\programmi\Oberon Media
2008-12-29 23:51 . 2008-12-29 23:51 <DIR> d-------- c:\programmi\File comuni\Oberon Media
2008-12-28 17:27 . 2009-01-04 16:46 <DIR> d-------- c:\documents and settings\User\Dati applicazioni\SpinTop
2008-12-28 17:25 . 2008-12-28 17:25 <DIR> d-------- c:\programmi\ABC Amber LIT Converter
2008-12-21 23:43 . 2008-12-21 23:43 <DIR> d-------- c:\programmi\The Adventure Company
2008-12-18 16:31 . 2008-12-19 00:20 <DIR> d-------- c:\windows\SxsCaPendDel
2008-12-15 01:45 . 2008-12-18 17:39 <DIR> d-------- c:\programmi\IrfanView
2008-12-15 01:41 . 2008-12-15 01:41 <DIR> d-------- C:\Languages
2008-12-15 01:37 . 2003-07-07 15:08 1,121,280 --a------ c:\windows\system32\CRDE2003.dll
2008-12-15 01:37 . 2003-07-07 15:08 242,688 --a------ c:\windows\system32\ISP2003.dll
2008-12-15 01:37 . 2003-07-07 15:08 122,880 --a------ c:\windows\system32\ILRawRead.dll
2008-12-15 01:37 . 2002-02-18 18:25 6,197 --a------ c:\windows\system32\Int2f.vxd

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-11 09:29 --------- d-----w c:\programmi\PC Tools AntiVirus
2009-01-11 09:15 --------- d-----w c:\documents and settings\User\Dati applicazioni\Skype
2009-01-11 08:51 --------- d-----w c:\documents and settings\User\Dati applicazioni\skypePM
2009-01-10 00:00 111,616 ----a-w c:\windows\system32\userinit.exe
2009-01-08 22:29 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\SpinTop Games
2009-01-08 16:04 --------- d-----w c:\programmi\File comuni\Wise Installation Wizard
2009-01-04 17:47 --------- d-----w c:\programmi\IObit
2008-12-28 22:45 --------- d-----w c:\documents and settings\User\Dati applicazioni\avidemux
2008-12-28 22:45 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Trymedia
2008-12-28 22:26 --------- d-----w c:\documents and settings\User\Dati applicazioni\uTorrent
2008-12-28 14:22 --------- d-----w c:\documents and settings\User\Dati applicazioni\MysteryStudio
2008-12-21 22:43 --------- d--h--w c:\programmi\InstallShield Installation Information
2008-12-09 22:27 --------- d-----w c:\programmi\ZAR
2008-12-09 22:26 --------- d-----w c:\programmi\UndeleteMyFiles
2008-12-09 22:09 --------- d-----w c:\documents and settings\User\Dati applicazioni\PC Tools
2008-12-09 22:08 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\PC Tools
2008-12-07 22:27 --------- d-----w c:\programmi\Avidemux 2.4
2008-12-07 20:55 --------- d-----w c:\programmi\File comuni\PC Tools
2008-12-06 22:32 --------- d-----w c:\documents and settings\User\Dati applicazioni\IObit
2008-12-04 23:23 --------- d-----w c:\programmi\Azada
2008-12-04 23:23 --------- d-----w c:\documents and settings\User\Dati applicazioni\Big Fish Games
2008-12-04 22:54 --------- d-----w c:\programmi\Direct MIDI to MP3 Converter
2008-12-04 22:24 --------- d-----w c:\programmi\MediaCoder
2008-12-04 21:30 --------- d-----w c:\programmi\PowerISO
2008-12-03 21:58 --------- d-----w c:\programmi\Windows Media Connect 2
2008-12-03 21:00 --------- d-----w c:\documents and settings\User\Dati applicazioni\GameHouse
2008-12-02 21:35 --------- d-----w c:\programmi\Avira
2008-12-02 21:35 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Avira
2008-12-01 15:53 --------- d-----w c:\programmi\VS Revo Group
2008-12-01 15:10 --------- d-----w c:\programmi\File comuni\Adobe
2008-11-28 16:19 --------- d-----w c:\programmi\Registry Easy
2008-11-26 12:57 --------- d-----w c:\programmi\Mystère a Londres
2008-11-19 16:47 --------- d-----w c:\programmi\uTorrent
2008-11-18 14:06 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\FLEXnet
2008-11-17 23:39 --------- d-----w c:\programmi\Google
2008-11-16 22:58 --------- d-----w c:\programmi\File comuni\InstallShield
2008-11-15 23:46 --------- d-----w c:\programmi\Malwarebytes' Anti-Malware
2008-11-15 09:53 --------- d-----w c:\programmi\Yahoo!
2008-11-15 09:46 --------- d-----w c:\programmi\Seekeen
2008-11-13 00:02 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\MonteCristo
2008-11-12 08:29 --------- d-----w c:\documents and settings\User\Dati applicazioni\TeraCopy
2008-11-11 21:10 --------- d-----w c:\documents and settings\User\Dati applicazioni\vlc
2008-11-01 23:44 98,304 ----a-w c:\windows\system32\CmdLineExt.dll
2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-20 16:35 499,712 ----a-w c:\windows\system32\msvcp71.dll
2008-10-20 16:35 348,160 ----a-w c:\windows\system32\msvcr71.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-09-21 20:39 774,144 ----a-w c:\programmi\RngInterstitial.dll
2008-09-14 14:45 0 ----a-w c:\documents and settings\User\HidExpTitanic.dat
2008-08-29 22:17 51 ----a-w c:\programmi\MegaLab.it - TweakUI 2.10.url
2008-08-29 22:17 46 ----a-w c:\programmi\MegaLab.it.url
2004-10-07 15:12 150,192 ----a-w c:\programmi\Tweak UI.exe
2004-08-25 21:29 347 ----a-w c:\programmi\INFO.TXT
2004-07-22 08:51 3,432,656 ----a-w c:\programmi\ManagedDX.CAB
2004-07-19 20:58 1,156,363 ----a-w c:\programmi\BDANT.cab
2004-07-19 20:53 976,020 ----a-w c:\programmi\BDAXP.cab
2004-07-09 12:17 13,265,040 ----a-w c:\programmi\dxnt.cab
2004-07-09 07:13 703,080 ----a-w c:\programmi\BDA.cab
2004-07-09 07:13 15,493,481 ----a-w c:\programmi\DirectX.cab
2004-07-09 02:08 472,576 ----a-w c:\programmi\dxsetup.exe
2004-07-09 02:08 2,242,560 ----a-w c:\programmi\dsetup32.dll
2004-07-09 01:03 62,976 ----a-w c:\programmi\DSETUP.dll
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\programmi\File comuni\Ahead\Lib\NMBgMonitor.exe" [2007-01-15 147456]
"Skype"="c:\programmi\Skype\Phone\Skype.exe" [2008-08-11 21741864]
"Advanced SystemCare 3"="c:\programmi\IObit\Advanced SystemCare 3\AWC.exe" [2008-11-26 2235920]
"RealAV.exe"="c:\programmi\RealAV\RealAV.exe" [2009-01-10 2528256]
"MSMSGS"="c:\programmi\Messenger\msmsgs.exe" [2008-04-13 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\programmi\File comuni\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"SunJavaUpdateSched"="c:\programmi\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"avgnt"="c:\programmi\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-08-31 249896]
"TkBellExe"="c:\programmi\File comuni\Real\Update_OB\realsched.exe" [2008-10-20 185872]
"PCTAVApp"="c:\programmi\PC Tools AntiVirus\PCTAV.exe" [2008-09-25 1370000]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

c:\documents and settings\User\Menu Avvio\Programmi\Esecuzione automatica\
PartMetBackup.lnk - c:\programmi\Java\jre1.6.0_07\bin\javaw.exe [2008-09-21 135168]
PowerReg Scheduler V3.exe [2008-10-18 225280]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"PWRISOVM.EXE"=c:\programmi\PowerISO\PWRISOVM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"h:\\Program Files\\eMule\\emule.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Programmi\\Mozilla Firefox\\firefox.exe"=
"c:\\Programmi\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"c:\\Programmi\\Nero\\Nero 7\\Core\\nero.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Programmi\\File comuni\\Ahead\\Nero Web\\SetupX.exe"=
"c:\\Programmi\\uTorrent\\uTorrent.exe"=
"c:\\Programmi\\Skype\\Phone\\Skype.exe"=

S3 getPlus(R) Helper;getPlus(R) Helper;c:\programmi\NOS\bin\getPlus_HelperSvc.exe [2008-09-14 33752]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2008-09-13 38496]
.
Contenuto della cartella 'Scheduled Tasks'

2009-01-11 c:\windows\Tasks\GlaryInitialize.job
- f:\archivio 20 gb\cartella exe vari\Glary Utilities\initialize.exe [2008-09-17 15:35]

2008-11-28 c:\windows\Tasks\Schedule Task Weekly.job
- c:\programmi\Registry Easy\RE.exe []
.
.
------- Supplementare di scansione -------
.
uStart Page = hxxp://it.yahoo.com/
mStart Page = hxxp://radarsync.netvibes.com
IE: &Google Search - c:\programmi\Google\googletoolbar.dll/cmsearch.html
IE: Backward &Links - c:\programmi\Google\googletoolbar.dll/cmbacklinks.html
IE: Cac&hed Snapshot of Page - c:\programmi\Google\googletoolbar.dll/cmcache.html
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Si&milar Pages - c:\programmi\Google\googletoolbar.dll/cmsimilar.html
IE: Translate into English - c:\programmi\Google\googletoolbar.dll/cmtrans.html
LSP: c:\programmi\File comuni\PC Tools\Lsp\PCTLsp.dll

c:\windows\Downloaded Program Files\stg_drm.ocx - c:\windows\Downloaded Program Files\CONFLICT.1\stg_drm.ocx
c:\windows\Downloaded Program Files\CONFLICT.2\stg_drm.ocx
c:\windows\Downloaded Program Files\CONFLICT.3\stg_drm.ocx
c:\windows\Downloaded Program Files\CONFLICT.4\stg_drm.ocx
c:\windows\Downloaded Program Files\CONFLICT.8\stg_drm.ocx
O16 -: {149E45D8-163E-4189-86FC-45022AB2B6C9}
file:///C:/Programmi/The%20Hidden%20Object%20Show/Images/stg_drm.ocx

c:\windows\Downloaded Program Files\armhelper.ocx - O16 -: {CC450D71-CC90-424C-8638-1F2DBAC87A54}
FF - ProfilePath - c:\documents and settings\User\Dati applicazioni\Mozilla\Firefox\Profiles\xnpb1nas.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://it.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - component: c:\programmi\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nppl3260.dll
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nprjplug.dll
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nprpjplug.dll
FF - plugin: c:\programmi\Mozilla Firefox\plugins\npracplug.dll
FF - plugin: c:\programmi\Real\RealArcade\Plugins\Mozilla\npracplug.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-11 10:29:16
Windows 5.1.2600 Service Pack 3 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-842925246-1580436667-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{F341C797-1CDC-3D86-BA00-FB9F72132669}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"oanikobdpbcohkhfndldafibdlphgg"=hex:64,61,6f,67,6f,61,6c,6c,00,e0
"oabgkgafhlhladnapnnjoocnmiolkc"=hex:6a,61,6c,67,62,66,6b,68,63,66,70,6d,65,70,
67,63,61,70,6e,70,00,fd
"nadgeahjepdokbeahlgbpndncoon"=hex:6a,61,61,66,6b,66,6e,62,66,69,6b,6a,63,61,
6f,6f,6a,6b,61,65,00,fd
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

- - - - - - - > 'lsass.exe'(616)
c:\programmi\File comuni\PC Tools\Lsp\PCTLsp.dll
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\programmi\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\programmi\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\windows\system32\Crypserv.exe
c:\programmi\PC Tools AntiVirus\PCTAVSvc.exe
c:\windows\system32\HPZipm12.exe
c:\windows\system32\wscntfy.exe
c:\programmi\Skype\Plugin Manager\skypePM.exe
c:\programmi\File comuni\Ahead\Lib\NMIndexStoreSvr.exe
.
**************************************************************************
.
Ora fine scansione: 2009-01-11 10:34:44 - macchina è stato riavviato [User]
ComboFix-quarantined-files.txt 2009-01-11 09:34:38

Pre-Run: 32,014,340,096 byte disponibili
Post-Run: 31,585,099,776 byte disponibili

242 --- E O F --- 2008-12-23 15:01:49
OG]

[ste_95]

Con Avenger, lancia questo script:

Codice: Seleziona tutto

Files to delete:
C:\Windows\System32\drivers\tdssserv.sys

[lollo40]

fatto e mi sembra che tutto funzioni come prima. allego l'esito di avenger
. ti ringrazio tantissimo, siete veramente tutti molto bravi.

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:


Error: file "C:\Windows\System32\drivers\tdssserv.sys" not found!
Deletion of file "C:\Windows\System32\drivers\tdssserv.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
the object does not exist


Completed script processing.

*******************

Finished! Terminate.

[ste_95]

I log sembrano puliti. Sicuro di avere i medesimi problemi?

[lollo40]

no adesso tutto funzioni bene. solo non riesco ad installare alice messenger e outlook mi avvisa sempre di comprimere la posta. dove devo postare i due problemi ancora tantissimo

[ste_95]

dove devo postare i due problemi ancora tantissimo

Nella sezione Software.

[lollo40]

grazie ancora ste_95

[ste_95]

grazie ancora ste_95

[popmart68]

SALVE, bentrovati, sono nuovo iscritto ho un problmea da 1 di gennaio, appena apro explorer google, mi si apre subito dopo una pagina pubblicitaria ma non sempre, ho scaricato HIJACKTHIS facendo le procedure a cui ho letto, spero potete aiutarmi..grazie questo è il mio log.........
la scansione non saprei quale file eliminare..... spero aver postato correttamente in base alle regole....grazie


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23.16.41, on 12/01/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
C:\Programmi\Java\jre6\bin\jqs.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmi\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programmi\Analog Devices\SoundMAX\SMTray.exe
C:\Programmi\Eset\nod32kui.exe
C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\svchost.exe
C:\Programmi\ScanSoft\OmniPageSE\opware32.exe
C:\Programmi\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe
C:\documents and settings\x\impostazioni locali\dati applicazioni\wcawo.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\WINDOWS\System32\alg.exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\Programmi\DAP\DAP.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: SrchHook Class - {F4F10C1D-87C7-404A-B4B3-000000000000} - C:\PROGRA~1\DAP\SBSearch.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programmi\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Programmi\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmi\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programmi\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Smapp] C:\Programmi\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Omnipage] C:\Programmi\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [a-squared Anti-Dialer] "C:\Programmi\a-squared Anti-Dialer\a2adguard.exe" /d=60
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Programmi\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [wcawo] "c:\documents and settings\x\impostazioni locali\dati applicazioni\wcawo.exe" wcawo
O4 - HKCU\..\Run: [DownloadAccelerator] "C:\Programmi\DAP\DAP.EXE" /STARTUP
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
O8 - Extra context menu item: &Clean Traces - C:\Programmi\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Programmi\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Programmi\DAP\dapextie2.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {C1B7E532-3ECB-4E9E-BB3A-2951FFE67C61} (DownloaderActiveX Control) - http://c6.community.alice.it/download/D ... ctiveX.cab
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmi\Java\jre6\bin\jqs.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmi\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 6598 bytes

[ste_95]

Correggi il tuo log seguendo queste regole per postare il log.

In hijackthis seleziona a sinistra questa voce e premi in basso il pulsante Fix Checked:

O4 - HKCU\..\Run: [wcawo] "c:\documents and settings\x\impostazioni locali\dati applicazioni\wcawo.exe" wcawo

Scarica Avenger
Estrailo in una cartella a tua scelta
Esegui il file avenger.exe con la figura di una spada
Ora incolla queste righe nella box bianca che si è aperta:

Codice: Seleziona tutto

Files to delete:
c:\documents and settings\x\impostazioni locali\dati applicazioni\wcawo.exe
c:\documents and settings\x\impostazioni locali\dati applicazioni\wcawo.dat
c:\documents and settings\x\impostazioni locali\dati applicazioni\wcawo_nav.dat
c:\documents and settings\x\impostazioni locali\dati applicazioni\wcawo_navps.dat

Togli il segno di spunta dalla voce Scan for Rootkits
Premi il pulsante Execute
Rispondi di Si alle due richieste di Avenger
Adesso il tuo computer dovrebbe riavviarsi, nel caso non succedesse, riavvialo tu manualmente
Al riavvio del computer, copia e incolla qui il contenuto del blocco note che apparirà.

Se Avenger riporta un errore, prova a riscrivere manualmente la prima riga (Files to delete:) ricordando i due punti. Se il problema persiste prova con la vecchia versione di Avenger.

[popmart68]

ecco questo è quanto mi è apparso dopo la procedura da te datomi........grazie


Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File "c:\documents and settings\x\impostazioni locali\dati applicazioni\wcawo.exe" deleted successfully.
File "c:\documents and settings\x\impostazioni locali\dati applicazioni\wcawo.dat" deleted successfully.
File "c:\documents and settings\x\impostazioni locali\dati applicazioni\wcawo_nav.dat" deleted successfully.
File "c:\documents and settings\x\impostazioni locali\dati applicazioni\wcawo_navps.dat" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

[ste_95]

Hai ancora problemi?