ADWARE MY WEB SEARCH/FUNWEB PRODUCT e TROJAN DNS CHANGER COD

[spitfire10]

Ciao a tutti,
come ho già spiegato nella sezione del forum dedicata ai sistemi operativi, ultimamente ho dei problemi con il pc. Questi a volte si "pianta" e devo riavviarlo, contestualmente salta anche la connessione di rete e per riabilitarla devo spegnere e riaccendere il modem. Ieri ho effettuato una scansione con SuperAntispyware ed ho rilevato i due maleware che ho scritto nel titolo. Dopo la scansione li avevo messi in quarentena, ma questa mattina mia figlia ha voluto rimuoverli, il computer è il suo...., però il pc stamattina si è piantato nuovamente. Ho rifatto la scansione con SuperaA, ma non ha rilevato nulla, allora ne ho fatta una con hijackthis, di cui allego il log. Se gentilmente potete controllarmi il log ed eventualmente fornirmi qualche suggerimento per far fronte al problema. Ho già effettuato il controllo delle temperature e della RAM, tutto a posto. Dal registro degli eventi rilevo sempre il solito errore "DHCP"
Grazie.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13.31.42, on 22/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Programmi\Bonjour\mDNSResponder.exe
C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Programmi\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Programmi\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\DNA\btdna.exe
C:\Documents and Settings\All Users\Dati applicazioni\Macrovision\FLEXnet Connect\6\ISUSPM.exe
C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Programmi\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Programmi\eMule\emule.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\DOCUME~1\user\IMPOST~1\Temp\Directory temporanea 1 per HiJackThis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://virgilio.alice.it/index.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Yahoo! Toolbar con blocco Pop-Up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar1.dll
O4 - HKLM\..\Run: [LXCGCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [StartCCC] "C:\Programmi\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [AVP] "C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Programmi\DNA\btdna.exe"
O4 - HKCU\..\Run: [ISUSPM] "C:\Documents and Settings\All Users\Dati applicazioni\Macrovision\FLEXnet Connect\6\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Aggiungi ad Anti-Banner - C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partne ... nicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Programmi\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promot ... 371420.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O16 - DPF: {F758FE6D-9949-4D78-B748-97781F55AF19} (TXTDM Control) - http://rivideo.mediaset.it/_res/cab/TXTDMCab.CAB
O17 - HKLM\System\CCS\Services\Tcpip\..\{4A5ED9C8-D6BA-409B-9469-E48E6F4D84BB}: NameServer = 85.37.17.14 85.38.28.78
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Programmi\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Programmi\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: LXCGCustomerConnect - Unknown owner - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGserv.exe
O23 - Service: lxcg_device - Unknown owner - C:\WINDOWS\system32\lxcgcoms.exe

--
End of file - 7785 bytes
[LOG]

[/LOG]

[Amantide]

Nel log di Hijackthis non si vede nulla di particolare.
Scarica ComboFix ed esegui la scansione seguendo queste istruzioni (giù in fondo). Al termine della scansione verrà creato il file di report C:\combofix.txt, copia qui il suo contenuto.

[spitfire10]

Nel log di Hijackthis non si vede nulla di particolare.
Scarica ComboFix ed esegui la scansione seguendo queste istruzioni (giù in fondo). Al termine della scansione verrà creato il file di report C:\combofix.txt, copia qui il suo contenuto.

Ciao Amantide,
ecco il report di Combofix.

ComboFix 09-01-21.02 - user 2009-01-22 14.16.46.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1040.18.1918.1260 [GMT 1:00]
Eseguito da: c:\documents and settings\user\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning enabled* (Updated)
FW: Kaspersky Internet Security *enabled*
* Creato nuovo punto di ripristino

ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\user\Impostazioni locali\Dati applicazioni\iogie.dat
c:\documents and settings\user\Impostazioni locali\Dati applicazioni\iogie_nav.dat
c:\documents and settings\user\Impostazioni locali\Dati applicazioni\iogie_navps.dat

.
((((((((((((((((((((((((( Files Creati Da 2008-12-22 al 2009-01-22 )))))))))))))))))))))))))))))))))))
.

2009-01-21 18:26 . 2009-01-21 18:26 <DIR> d-------- c:\programmi\File comuni\Wise Installation Wizard
2009-01-20 17:09 . 2005-05-02 21:15 36,484 --a------ c:\windows\system32\drivers\SMBios.sys
2009-01-20 17:01 . 2009-01-20 17:01 34 --a------ c:\windows\system32\oeminfo.ini
2009-01-19 18:06 . 2009-01-21 13:42 <DIR> d-------- c:\programmi\SpeedFan
2009-01-19 18:01 . 2009-01-19 18:06 45 --a------ c:\windows\system32\initdebug.nfo
2009-01-10 19:24 . 2009-01-10 19:24 <DIR> d-------- c:\documents and settings\user\Dati applicazioni\Macrovision
2009-01-10 18:24 . 2009-01-10 18:24 <DIR> d-------- c:\programmi\Vodafone
2009-01-10 18:24 . 2009-01-10 18:24 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\Macrovision
2009-01-10 18:24 . 2007-11-05 11:56 101,120 -ra------ c:\windows\system32\drivers\ewusbmdm.sys
2009-01-10 14:18 . 2009-01-22 14:21 <DIR> d-------- c:\programmi\DNA
2009-01-10 14:18 . 2009-01-10 14:33 <DIR> d-------- c:\programmi\BitTorrent
2009-01-10 14:18 . 2009-01-22 14:21 <DIR> d-------- c:\documents and settings\user\Dati applicazioni\DNA
2009-01-10 12:28 . 2009-01-20 16:59 <DIR> d-------- c:\documents and settings\user\Dati applicazioni\uTorrent
2009-01-10 09:16 . 2008-10-29 20:25 4,244,744 --a------ c:\windows\system32\qtp-mt334.dll
2009-01-10 09:16 . 2008-10-29 20:25 247,560 --a------ c:\windows\system32\prgiso.dll
2009-01-10 09:16 . 2008-10-29 20:25 13,576 --a------ c:\windows\system32\wnaspi32.dll
2009-01-09 18:52 . 2009-01-09 18:52 <DIR> d-------- c:\programmi\FogelSoft
2009-01-09 17:43 . 2009-01-09 17:43 <DIR> d-------- c:\programmi\MSBuild
2009-01-09 17:42 . 2009-01-09 17:43 <DIR> d-------- c:\windows\system32\XPSViewer
2009-01-09 17:42 . 2009-01-09 17:42 <DIR> d-------- c:\programmi\Reference Assemblies
2009-01-09 17:42 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll
2009-01-08 16:22 . 2009-01-08 16:22 <DIR> d-------- c:\programmi\Techland
2009-01-08 13:42 . 2009-01-08 14:37 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\Avira
2009-01-05 10:00 . 2009-01-05 19:33 28 --a------ c:\windows\v2d.INI
2009-01-05 09:26 . 2009-01-05 13:30 <DIR> d-------- C:\v2d
2009-01-05 09:25 . 2009-01-20 16:59 <DIR> d-------- c:\programmi\Total Video2Dvd
2008-12-25 18:16 . 2009-01-16 17:41 <DIR> d-------- c:\programmi\PokerStars.IT
2008-12-25 17:37 . 2008-12-25 17:37 <DIR> d-------- c:\programmi\Bonjour

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-22 13:21 905,504 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-01-22 13:20 86,888 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-01-22 13:20 455,312 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-01-22 13:19 33,883,168 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-01-22 12:23 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Google Updater
2009-01-22 11:48 --------- d-----w c:\programmi\eMule
2009-01-22 11:05 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Kaspersky Lab
2009-01-21 17:27 --------- d-----w c:\programmi\SUPERAntiSpyware
2009-01-21 17:27 --------- d-----w c:\documents and settings\user\Dati applicazioni\SUPERAntiSpyware.com
2009-01-20 19:30 --------- d-----w c:\programmi\Lx_cats
2009-01-20 15:58 --------- d---a-w c:\documents and settings\All Users\Dati applicazioni\TEMP
2009-01-20 13:10 --------- d-----w c:\documents and settings\user\Dati applicazioni\U3
2009-01-12 08:46 --------- d-----w c:\documents and settings\user\Dati applicazioni\vlc
2009-01-10 08:17 --------- d--h--w c:\programmi\InstallShield Installation Information
2008-12-25 17:15 --------- d-----w c:\programmi\PokerStars.NET
2008-12-19 17:12 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\DVD Shrink
2008-12-19 15:11 --------- d-----w c:\programmi\DVD Shrink
2008-12-19 13:48 --------- d-----w c:\programmi\DVD Decrypter
2008-12-12 10:18 87,336 ----a-w c:\windows\system32\dns-sd.exe
2008-12-12 10:11 61,440 ----a-w c:\windows\system32\dnssd.dll
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-07 20:28 --------- d-----w c:\programmi\Spybot - Search & Destroy
2008-12-07 20:28 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Spybot - Search & Destroy
2008-12-07 08:26 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\SUPERAntiSpyware.com
2008-12-06 19:43 26,992 ----a-w c:\documents and settings\user\Dati applicazioni\GDIPFONTCACHEV1.DAT
2008-11-29 19:02 --------- d-----w c:\documents and settings\user\Dati applicazioni\DVD Flick
2008-11-29 16:52 --------- d-----w c:\programmi\DVD Flick
2008-11-28 13:48 --------- d-----w c:\programmi\File comuni\Adobe
2008-11-27 16:56 --------- d-----w c:\programmi\iTunes
2008-11-27 16:56 --------- d-----w c:\programmi\iPod
2008-11-27 16:56 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-11-27 16:54 --------- d-----w c:\programmi\QuickTime
2008-11-27 16:53 --------- d-----w c:\programmi\File comuni\Apple
2008-11-23 16:23 --------- d-----w c:\documents and settings\user\Dati applicazioni\GanymedeNet
2008-11-22 18:00 --------- d-----w c:\programmi\Ahead
2008-11-22 17:59 --------- d-----w c:\programmi\File comuni\Ahead
2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-06-27 14:14 32,768 --sha-w c:\windows\system32\config\systemprofile\Impostazioni locali\Cronologia\History.IE5\MSHist012008062720080628\index.dat
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"swg"="c:\programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-02-12 68856]
"MSMSGS"="c:\programmi\Messenger\msmsgs.exe" [2008-04-14 1695232]
"BitTorrent DNA"="c:\programmi\DNA\btdna.exe" [2009-01-10 342848]
"ISUSPM"="c:\documents and settings\All Users\Dati applicazioni\Macrovision\FLEXnet Connect\6\ISUSPM.exe" [2007-03-29 222128]
"SUPERAntiSpyware"="c:\programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-01-15 1830128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LXCGCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll" [2005-04-27 69632]
"StartCCC"="c:\programmi\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"SunJavaUpdateSched"="c:\programmi\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"QuickTime Task"="c:\programmi\QuickTime\qttask.exe" [2008-11-04 413696]
"RTHDCPL"="RTHDCPL.EXE" [2007-03-21 c:\windows\RTHDCPL.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoFileAssociate"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\programmi\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 11:05 356352 c:\programmi\SUPERAntiSpyware\SASWINLO.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-10-15 01:04 39792 c:\programmi\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
-ra------ 2008-09-26 11:02 2356088 c:\programmi\File comuni\Adobe\Updater5\AdobeUpdater.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
--a------ 2008-11-07 14:16 111936 c:\programmi\File comuni\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EzPrint]
--a------ 2005-05-09 21:06 73728 c:\programmi\Lexmark 2300 Series\ezprint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer]
--a------ 2005-05-03 19:20 299008 c:\programmi\Lexmark Fax Solutions\fm3032.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-11-20 13:20 290088 c:\programmi\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxcgmon.exe]
--a------ 2005-05-05 04:25 200704 c:\programmi\Lexmark 2300 Series\lxcgmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2008-04-14 03:14 1695232 c:\programmi\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 11:50 155648 c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-11-04 10:30 413696 c:\programmi\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2008-06-10 03:27 144784 c:\programmi\Java\jre1.6.0_07\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
--a------ 2009-01-15 16:17 1830128 c:\programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2008-02-12 18:11 68856 c:\programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmi\\Buena Vista Games\\Desperate Housewives\\DesperateHousewives.exe"=
"c:\\WINDOWS\\system32\\lxcgcoms.exe"=
"c:\\Programmi\\iTunes\\iTunes.exe"=
"c:\\Programmi\\Bonjour\\mDNSResponder.exe"=
"c:\\Programmi\\DNA\\btdna.exe"=

R1 SASDIFSV;SASDIFSV;c:\programmi\SUPERAntiSpyware\sasdifsv.sys [2009-01-15 8944]
R1 SASKUTIL;SASKUTIL;c:\programmi\SUPERAntiSpyware\SASKUTIL.SYS [2009-01-15 55024]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2007-04-04 24344]
R3 SASENUM;SASENUM;c:\programmi\SUPERAntiSpyware\SASENUM.SYS [2009-01-15 7408]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f3029ce4-deef-11dd-8d30-000f3ddaf9b5}]
\Shell\AutoRun\command - F:\StartVMCLite.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f3029e58-deef-11dd-8d30-000f3ddaf9b5}]
\Shell\AutoRun\command - F:\StartVMCLite.exe
.
Contenuto della cartella 'Scheduled Tasks'

2009-01-08 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programmi\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
- - - - CHIAVI ORFANE RIMOSSE - - - -

MSConfigStartUp-SpybotSD TeaTimer - c:\programmi\Spybot - Search & Destroy\TeaTimer.exe


.
------- Scansione supplementare -------
.
uStart Page = hxxp://virgilio.alice.it/index.html
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} - hxxp://download.zonelabs.com/bin/promot ... 371420.cab
DPF: {F758FE6D-9949-4D78-B748-97781F55AF19} - hxxp://rivideo.mediaset.it/_res/cab/TXTDMCab.CAB
FF - ProfilePath - c:\documents and settings\user\Dati applicazioni\Mozilla\Firefox\Profiles\gr3pws81.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://virgilio.alice.it/index.html
FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=
FF - plugin: c:\programmi\Google\Google Updater\2.4.1368.5602\npCIDetect13.dll
FF - plugin: c:\programmi\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\programmi\Mozilla Firefox\plugins\NPMAHJONG.dll
FF - plugin: c:\programmi\Mozilla Firefox\plugins\NPSUDOKU.dll

---- FIREFOX POLICIES ----
FF - user.js: network.prefetch-next - true
FF - user.js: nglayout.initialpaint.delay - 250
FF - user.js: layout.spellcheckDefault - 1
FF - user.js: browser.urlbar.autoFill - false
FF - user.js: browser.search.openintab - false
FF - user.js: browser.tabs.closeButtons - 1
FF - user.js: browser.tabs.opentabfor.middleclick - true
FF - user.js: browser.tabs.tabMinWidth - 100
FF - user.js: browser.urlbar.hideGoButton - false
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-22 14:21:20
Windows 5.1.2600 Service Pack 3 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXCGCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------

- - - - - - - > 'winlogon.exe'(1024)
c:\programmi\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
c:\programmi\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\klogon.dll

- - - - - - - > 'lsass.exe'(1080)
c:\programmi\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll
c:\programmi\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\programmi\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
c:\programmi\Bonjour\mDNSResponder.exe
c:\programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\windows\system32\spool\drivers\w32x86\3\lxcgserv.exe
c:\windows\system32\wscntfy.exe
c:\programmi\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\programmi\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
.
**************************************************************************
.
Ora fine scansione: 2009-01-22 14:25:55 - Il pc è stato riavviato
ComboFix-quarantined-files.txt 2009-01-22 13:25:50

Pre-Run: 23.397.232.640 byte disponibili
Post-Run: 23,616,598,016 byte disponibili

240 --- E O F --- 2009-01-14 14:27:09

[Amantide]

Combofix ha rimosso il trojan CID dal pc, per il resto - non si vede nient'altro di sospetto.

Abilita la visualizzazione di file nascosti e controlla se è ancora presente il seguente file:
c:\documents and settings\user\Impostazioni locali\Dati applicazioni\iogie.exe

Se lo trovi - eliminalo, poi riavvia il pc e vedi se la situazione è migliorata.

[spitfire10]

Combofix ha rimosso il trojan CID dal pc, per il resto - non si vede nient'altro di sospetto.

Abilita la visualizzazione di file nascosti e controlla se è ancora presente il seguente file:
c:\documents and settings\user\Impostazioni locali\Dati applicazioni\iogie.exe

Se lo trovi - eliminalo, poi riavvia il pc e vedi se la situazione è migliorata.

Cercando con la funzione "cerca" digitando l'estensione iogie.exe nel campo "una parola o una frase all'interno del file" mi salta fuori questo file: sessionstore tipo Jscript script file che è contenuto nella sottocartella gr3pw81.default di Mozilla. Devo rimuoverlo?

[Amantide]

Fai semplicemente la pulizia della cache e cookie di Firefox a browser chiuso, puoi usare CCleaner a questo scopo, importante è che il file iogie.exe non è più presente nella cartella che ti ho indicato.

P.S. Hai abilitato la visualizzazione dei file nascosti prima di effettuare la ricerca?

[spitfire10]

Fai semplicemente la pulizia della cache e cookie di Firefox a browser chiuso, puoi usare CCleaner a questo scopo, importante è che il file iogie.exe non è più presente nella cartella che ti ho indicato.

P.S. Hai abilitato la visualizzazione dei file nascosti prima di effettuare la ricerca?

OK, provvederò alla pulizia. Ho abilitato la visualizzazione prima di effettuare la ricerca e di quel file nessuna traccia.
Per il momento ti ringrazio dell'assitenza, se dovessi avere ancora problemi mi rifarò vivo.
Ciao, buona serata.