PC con Xp SP2 si blocca

[Uomo_Senza_Sonno]

Buonasera a tutti, ho un nuovo problema da affrontare e visto che non riesco proprio a risolvere, vi chiedo un parere.

Ho riacceso il pc dopo una settimana di inutilizzo, e prima di spegnerlo l'ultima volta il pc lavorava correttamente. Ieri come ho iniziato a navigare in rete il pc si è spento di colpo e ha iniziato a mandare dei beep. Resettando, il problema si è ripresentato mandando dei doppi beep.
Spento di nuovo, questo problema non si è presentanto più ma adesso il pc si blocca e rimane acceso, o a seconda di come gli gira, si riavvia.

Ho fatto fare una scansione al combofix, di cui posto il log

ComboFix 09-05-19.08 - ____neo____ 20/05/2009 12.06.02.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.39.1040.18.3582.3168 [GMT 2:00]
Eseguito da: e:\programmi\ComboFix.exe
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.

((((((((((((((((((((((((( Files Creati Da 2009-04-20 al 2009-05-20 )))))))))))))))))))))))))))))))))))
.

2009-05-19 16:01 . 2009-05-19 16:01 -------- d-----w c:\documents and settings\All Users\Dati applicazioni\TomTom
2009-05-19 14:50 . 2009-05-19 14:50 -------- d-----w c:\documents and settings\____neo____\Dati applicazioni\TomTom
2009-05-19 14:50 . 2009-05-19 14:50 -------- d-----w c:\documents and settings\____neo____\Impostazioni locali\Dati applicazioni\TomTom
2009-05-19 14:50 . 2009-05-19 14:50 -------- d-----w c:\programmi\TomTom International B.V
2009-05-19 14:50 . 2009-05-19 14:50 -------- d-----w c:\programmi\TomTom HOME 2
2009-05-19 14:42 . 2009-05-19 14:50 -------- d-----w c:\programmi\TomTom HOME
2009-05-03 15:25 . 2009-05-03 15:26 -------- d-----w c:\programmi\File comuni\uusee
2009-05-03 15:25 . 2009-05-03 15:33 -------- d-----w c:\programmi\uusee
2009-05-02 22:05 . 2009-05-02 22:09 -------- d-----w c:\programmi\Winmx
2009-05-01 23:42 . 2009-05-01 23:43 64 ----a-w c:\windows\msi.bat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-20 00:38 . 2008-10-10 20:05 -------- d-----w c:\programmi\eMule
2009-05-19 23:58 . 2008-10-10 11:54 -------- d--h--w c:\programmi\InstallShield Installation Information
2009-05-19 22:13 . 2009-01-07 21:44 -------- d-----w c:\programmi\Mozilla Thunderbird
2009-05-15 12:16 . 2008-10-10 17:37 999456 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-05-15 12:16 . 2008-10-10 17:37 7640 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-05-15 12:16 . 2008-10-10 17:37 15515168 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-05-15 12:16 . 2008-10-10 17:37 125436 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-05-03 17:49 . 2008-10-15 09:49 561112 ----a-w c:\documents and settings\LocalService\Impostazioni locali\Dati applicazioni\FontCache3.0.0.0.dat
2009-05-03 14:24 . 2009-01-08 02:11 -------- d-----w c:\programmi\Google
2009-02-24 19:34 . 2009-02-24 19:34 90112 ----a-w c:\windows\system32\dpl100.dll
2009-02-24 19:34 . 2009-02-24 19:34 823296 ----a-w c:\windows\system32\divx_xx0c.dll
2009-02-24 19:34 . 2009-02-24 19:34 823296 ----a-w c:\windows\system32\divx_xx07.dll
2009-02-24 19:34 . 2009-02-24 19:34 815104 ----a-w c:\windows\system32\divx_xx0a.dll
2009-02-24 19:34 . 2009-02-24 19:34 802816 ----a-w c:\windows\system32\divx_xx11.dll
2009-02-24 19:34 . 2009-02-24 19:34 684032 ----a-w c:\windows\system32\DivX.dll
2009-02-24 19:34 . 2009-02-24 19:34 1044480 ----a-w c:\programmi\mozilla firefox\plugins\libdivx.dll
2009-02-24 19:34 . 2009-02-24 19:34 200704 ----a-w c:\programmi\mozilla firefox\plugins\ssldivx.dll
2009-01-25 12:57 . 2009-01-25 12:57 28672 ----a-w c:\programmi\mozilla firefox\components\GooglePlusVideosXPCOM.dll
2004-03-01 15:41 . 2008-10-10 16:39 160325 --sha-w c:\windows\Resources\Themes\DameK UltraBlue\irunin.dat
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\programmi\Analog Devices\Core\smax4pnp.exe" [2006-05-01 843776]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-15 13680640]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-15 86016]
"AVP"="c:\programmi\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2009-02-06 206088]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-01-15 1657376]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-30 15360]

c:\documents and settings\____neo____\Menu Avvio\Programmi\Esecuzione automatica\
YzShadow.lnk - c:\programmi\Yzshadow\YzShadow.exe [2008-10-10 151552]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMBalloonTip"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\programmi\TGTSoft\StyleXP\Logon\CurrentLogon.EXE"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^Adobe Reader Synchronizer.lnk]
path=c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^Avvio veloce di Adobe Acrobat.lnk]
path=c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\Avvio veloce di Adobe Acrobat.lnk
backup=c:\windows\pss\Avvio veloce di Adobe Acrobat.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^____neo____^Menu Avvio^Programmi^Esecuzione automatica^Adobe Gamma.lnk]
path=c:\documents and settings\____neo____\Menu Avvio\Programmi\Esecuzione automatica\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wuauserv"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\eMule\\emule.exe"=
"c:\\Programmi\\Autodesk\\Backburner\\monitor.exe"=
"c:\\Programmi\\Autodesk\\Backburner\\manager.exe"=
"c:\\Programmi\\Autodesk\\Backburner\\server.exe"=
"c:\\Programmi\\Autodesk\\3ds Max 2009\\3dsmax.exe"=
"c:\\Programmi\\WinMX\\WinMX.exe"=
"c:\\Programmi\\File comuni\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Programmi\\uusee\\UUSeePlayer.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 18.29.38 33808]
R0 xmasbus;xmasbus;c:\windows\system32\drivers\xmasbus.sys [10/10/2008 17.43.54 140800]
R0 xmasscsi;xmasscsi;c:\windows\system32\drivers\xmasscsi.sys [10/10/2008 17.43.54 5248]
R2 CachemanXPService;CachemanXP;c:\programmi\CachemanXP\CachemanXP.exe [15/10/2008 14.46.33 243200]
R2 TomTomHOMEService;TomTomHOMEService;c:\programmi\TomTom HOME 2\TomTomHOMEService.exe [24/04/2009 13.57.30 92008]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/04/2008 18.06.48 24592]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\programmi\NOS\bin\getPlus_HelperSvc.exe c:\programmi\NOS\bin\getPlus_HelperSvc.exe
S3 mi-raysat_3dsMax2009_32;mental ray 3.6 Satellite for Autodesk 3ds Max Design 2009 32-bit 32-bit;c:\programmi\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe [10/03/2008 0.04.52 65536]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.tiscali.it/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: Aggiungi a PDF esistente - c:\programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Aggiungi destinazione link a PDF esistente - c:\programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Converti destinazione link in Adobe PDF - c:\programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Converti destinazione link in file PDF esistente - c:\programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Converti i link selezionati in Adobe PDF - c:\programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Converti i link selezionati in file PDF esistente - c:\programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Converti in Adobe PDF - c:\programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Converti selezione in Adobe PDF - c:\programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Converti selezione in file PDF esistente - c:\programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: E&sporta in Microsoft Excel - c:\progra~1\Microsoft Office\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\____neo____\Dati applicazioni\Mozilla\Firefox\Profiles\smd0zhxh.default\
FF - prefs.js: browser.startup.homepage - http://www.tiscali.it
FF - component: c:\programmi\Mozilla Firefox\components\GooglePlusVideosXPCOM.dll
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nppl3260.dll
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nprjplug.dll
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nprpjplug.dll
FF - plugin: c:\programmi\Mozilla Firefox\plugins\np-mswmp.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-20 12:08
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{BEB3C0C7-B648-4257-96D9-B5D024816E27}\Version*Version]
"Version"=hex:a4,48,e3,be,70,05,6b,5b,7e,a7,20,5c,e7,a9,58,eb,3f,cd,63,86,d6,
19,70,5d,34,30,a5,85,a0,95,fa,1d,a2,97,c1,03,2e,10,1a,6e,06,ed,d0,9b,23,84,\

[HKEY_LOCAL_MACHINE\software\Minnetonka Audio Software\SurCode Dolby Digital Premiere\Version*Version]
"Version"=hex:a4,48,e3,be,70,05,6b,5b,7e,a7,20,5c,e7,a9,58,eb,3f,cd,63,86,d6,
19,70,5d,34,30,a5,85,a0,95,fa,1d,a2,97,c1,03,2e,10,1a,6e,06,ed,d0,9b,23,84,\
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------

- - - - - - - > 'winlogon.exe'(1000)
c:\programmi\File comuni\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll

- - - - - - - > 'explorer.exe'(2832)
c:\programmi\Yzshadow\YzShadow.dll
.
Ora fine scansione: 2009-05-20 12.09.46
ComboFix-quarantined-files.txt 2009-05-20 10:09
ComboFix2.txt 2009-04-04 11:24

Pre-Run: 42.980.573.184 byte disponibili
Post-Run: 43.819.819.008 byte disponibili

152

Posto anche il log di Hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23.39.05, on 20/05/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
C:\Programmi\Yzshadow\YzShadow.exe
C:\WINDOWS\ATKKBService.exe
C:\Programmi\File comuni\Autodesk Shared\Service\AdskScSrv.exe
C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
C:\Programmi\CachemanXP\CachemanXP.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\TomTom HOME 2\TomTomHOMEService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Programmi\phonostar\ps_radio.exe
C:\Programmi\phonostar\ps_olect.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe
C:\Programmi\Internet Explorer\IEXPLORE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tiscali.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Coolstreaming Tool-Bar v1.0 Toolbar - {bd0e4d83-654e-4213-965b-fcbe887061f4} - C:\Programmi\Coolstreaming_Tool-Bar_v1.0\tbCool.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Coolstreaming Tool-Bar v1.0 Toolbar - {bd0e4d83-654e-4213-965b-fcbe887061f4} - C:\Programmi\Coolstreaming_Tool-Bar_v1.0\tbCool.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Programmi\TGTSoft\StyleXP\TGT_BHO.dll
O3 - Toolbar: Coolstreaming Tool-Bar v1.0 Toolbar - {bd0e4d83-654e-4213-965b-fcbe887061f4} - C:\Programmi\Coolstreaming_Tool-Bar_v1.0\tbCool.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Programmi\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVP] "C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: YzShadow.lnk = C:\Programmi\Yzshadow\YzShadow.exe
O8 - Extra context menu item: Aggiungi a PDF esistente - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Aggiungi destinazione link a PDF esistente - res://C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Converti destinazione link in Adobe PDF - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Converti destinazione link in file PDF esistente - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Converti i link selezionati in Adobe PDF - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Converti i link selezionati in file PDF esistente - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Converti in Adobe PDF - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Converti selezione in Adobe PDF - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Converti selezione in file PDF esistente - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\Office12\EXCEL.EXE/3000
O9 - Extra button: Statistiche sulla protezione del traffico Web - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\Microsoft Office\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Programmi\File comuni\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
O23 - Service: CachemanXP (CachemanXPService) - Outertech - C:\Programmi\CachemanXP\CachemanXP.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Programmi\File comuni\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: getPlus(R) Helper - Unknown owner - C:\Programmi\NOS\bin\getPlus_HelperSvc.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: mental ray 3.6 Satellite for Autodesk 3ds Max Design 2009 32-bit 32-bit (mi-raysat_3dsMax2009_32) - Unknown owner - C:\Programmi\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StyleXPService - Unknown owner - C:\Programmi\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Programmi\TomTom HOME 2\TomTomHOMEService.exe

--
End of file - 7385 bytes

Il kaspersky non ha rilevato nulla di anomalo, e la cosa più divertente è che windows al riavvio non mi segnala nessun errore grave e di conseguenza nessun report di errori.

Il pc ha questa configurazione HW | AMD Athlon 64X2 | 4 Gb Ram | N-Vidia GeForce 7600 GS | HDD Maxtor 80 Gb [Boot] | HDD Maxtor 160 Gb [file scaricati] | HDD Samsung 500 Gb [Archivio] |

è protetto dal kaspersky, sempre aggiornato.
Spero solo che non siano avvisi di malfunzionamento di un HDD, perché ne ho già persi due.
Grazie in anticipo per i suggerimenti e l'aiuto.

[Ozne]

per prima cosa va in pdc > sistema > avanzate > avvio e ripristino (impostazioni) e togli la spunta su "riavvia automaticamente" e mettila a "scrivi l'evento nel registro eventi di sistema".

Fatto questo al prossimo problema potrai vedere l'errore o tramite finestra o andando a spunciare nel registro di sistema...

comunque sospetto un problema alla ram, fa un controllo

[Uomo_Senza_Sonno]

Giusto per scrupolo ho avviato uno scandisk per ogni disco, con correzione automatica di errori. Inoltre, è già impostato come mi hai detto.
Fino a questo momento il pc non si è bloccato (e ora come ora è proprio una sorpresa). A questo punto provo a farlo lavorare davvero per metterlo in crisi.

Provo con un test delle ram, grazie per il consiglio.. giusto perché quando l'ho comprato si è manifestato subito un problema di ram, ma non vorrei che un banco di memoria si sia rovinato..

Grazie per i consigli.

Aggiornamento: nonostante abbia disabilitato il riavvio automatico e impostato la scrittura nel registro di sistema, il pc si è riavviato da solo e ovviamente non ha riportato nessun report di crash. Ma che diavolo sta succedendo??

[Uomo_Senza_Sonno]

Finalmente un Crash riportato.... ecco qua il log

Microsoft (R) Windows Debugger Version 6.10.0003.233 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini052109-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\Debugging Tools for Windows (x86)\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805644a0
Debug session time: Thu May 21 14:26:50.828 2009 (GMT+2)
System Uptime: 0 days 0:28:01.500
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
................................................................
........
Loading User Symbols
Loading unloaded module list
.......
Unable to load image win32k.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for win32k.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c000001d, bf808ace, b9d5aa00, 0}

Unable to load image klif.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for klif.sys
*** ERROR: Module load completed but symbols could not be loaded for klif.sys
Probably caused by : klif.sys ( klif+10919 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c000001d, The exception code that was not handled
Arg2: bf808ace, The address that the exception occurred at
Arg3: b9d5aa00, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {ERRORE DI EXCEPTION} Istruzione non valida Si tentato di eseguire un'istruzione non valida.

FAULTING_IP:
win32k!vSynchronizeDriver+b3
bf808ace 51 push ecx

TRAP_FRAME: b9d5aa00 -- (.trap 0xffffffffb9d5aa00)
ErrCode = 00000000
eax=00000011 ebx=00000080 ecx=00000001 edx=00000000 esi=e2183008 edi=00000080
eip=bf808ace esp=b9d5aa74 ebp=b9d5aa80 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
win32k!vSynchronizeDriver+0xb3:
bf808ace 51 push ecx
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: csrss.exe

LAST_CONTROL_TRANSFER: from bf94a7ec to bf808ace

FAILED_INSTRUCTION_ADDRESS:
win32k!vSynchronizeDriver+b3
bf808ace 51 push ecx

STACK_TEXT:
b9d5aa80 bf94a7ec e2183008 bf8011b3 00000000 win32k!vSynchronizeDriver+0xb3
b9d5aa88 bf8011b3 00000000 00000118 00007ffe win32k!GreSynchronizeTimer+0xa
b9d5aab8 bf8aec95 00000022 00000034 00000000 win32k!TimersProc+0xad
b9d5ad14 bf8c8594 b9d6a4a8 00000002 b9d5ad38 win32k!RawInputThread+0x634
b9d5ad24 bf800ff4 b9d6a4a8 b9d5ad64 00000034 win32k!xxxCreateSystemThreads+0x60
b9d5ad38 b5a08919 00000000 00000022 006dfff4 win32k!NtUserCallOneParam+0x23
WARNING: Stack unwind information not available. Following frames may be wrong.
b9d5ad54 804ddf0f 00000000 00000022 00000000 klif+0x10919
b9d5ad58 00000000 00000022 00000000 7c91eb94 nt!ZwSetBootEntryOrder+0xc


STACK_COMMAND: kb

FOLLOWUP_IP:
klif+10919
b5a08919 ?? ???

SYMBOL_STACK_INDEX: 6

SYMBOL_NAME: klif+10919

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: klif

IMAGE_NAME: klif.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4981a9d4

FAILURE_BUCKET_ID: 0x8E_BAD_IP_klif+10919

BUCKET_ID: 0x8E_BAD_IP_klif+10919

Followup: MachineOwner
---------

Grazie per i suggerimenti

[Ozne]

prova ad aggiornare tutti i driver all'ultima versione disponibile, rimuovendoli completamente prima di reinstallarli.

fa comunque un memtest

[Amantide]

Molto probabilmente i riavvii sono dovuti a questo:

Unable to load image ntoskrnl.exe, Win32 error 0n2*** WARNING: Unable to verify timestamp for ntoskrnl.exe

Prova a sostituire il file con quello del CD d'installazione di XP dalla console di ripristino, eseguendo il comando expand d:\i386\ntoskrnl.ex_ c:\windows\system32

EDIT:
Volevo fare la modifica al post ma mi si era incantata la connessione.
Nel caso le lettere delle unità con SO e CD-Rom non corrispondessero a C:\ e D:\, cambiale con quelle esatte.

[Uomo_Senza_Sonno]

A seguito di diversi test che non hanno rilevato anomalie, il problema era proprio quello che temevo... ovvero un banco di ram è andato. Proprio ieri il pc all'accensione non ha emesso il beep classico, ma uno lungo seguito da due brevi. Dopo aver smontato gran parte dei componenti e rimontati uno dopo l'altro, ho trovato il problema in un banco di ram. Meglio quello che altro.

Grazie per i consigli, alla prossima