Mi chiamo Francesco, volevo sfruttare questo topic per esporvi un problema similare a quello descritto da Alex.
Come sistema operativo utilizzo Windows Vista Ultimate.Mi è capitato che nell' installare la versione prova di avira premium e rimettendo in seguito il personal free, sono entrati decine di trojan puntualmente fermati dall' antivirus, ma come già detto, probabilmente hanno lasciato qualche rimasuglio che tende a crare errori.
Il messaggio cita questo: "Desktop" ""Impossibile caricare o eseguire il file "C:\Lepro\LOCALS(bisciolina)1\APPLIC(bisciolina)1\mqtgsvc.exe, specificato nel Registro di sistema. Controllare che il file esista, oppure rimuoverne il relativo riferimento nel Registro di sistema.""
Una volta che clicco su -ok- il desktop finisce di caricarsi, ossia esce la sidebar, la rocketdock, il logo di avira, per quello che posso vedere.
Ho scansionato con HiJackThis ed il log è allegato come da vostre raccomandazioni.
Spero e vi ringrazio anticipatamente per il vostro prezioso aiuto.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11.01.35, on 17/08/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\QUAD Utilities\QUAD Registry Cleaner\QUAD Scheduler.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Lepro\Desktop\Nuova cartella\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F3 - REG:win.ini: load=C:\Users\Lepro\LOCALS~1\APPLIC~1\mqtgsvc.exe
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKLM\..\Policies\Explorer\Run: [Mstsc] C:\Windows\mstsc.exe /waitservice
O4 - HKLM\..\Policies\Explorer\Run: [MstInit] C:\Windows\System\mstinit.exe /waitservice
O4 - HKLM\..\Policies\Explorer\Run: [rsvp] C:\Users\Lepro\LOCALS~1\APPLIC~1\rsvp.exe /waitservice
O4 - HKLM\..\Policies\Explorer\Run: [DllHst] C:\Users\Lepro\LOCALS~1\APPLIC~1\dllhst3g.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [IEudinit] C:\Users\Lepro\AppData\Local\Temp\ieudinit.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [Cisvc] C:\Users\Lepro\AppData\Local\Temp\cisvc.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [Spool] C:\Users\Lepro\AppData\Roaming\spoolsv.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [Mstsc] C:\Users\Lepro\AppData\Roaming\mstsc.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [MstInit] C:\Windows\System32\drivers\mstinit.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [ClipSrv] C:\Users\Lepro\LOCALS~1\APPLIC~1\MICROS~1\clipsrv.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [rsvp] C:\Users\Lepro\AppData\Roaming\MICROS~1\rsvp.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [Logman] C:\Users\Lepro\LOCALS~1\APPLIC~1\MICROS~1\logman.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [DllHst] C:\Users\Lepro\AppData\Local\Temp\dllhst3g.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [ComRepl] C:\Windows\System\comrepl.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [CmSTP] C:\Users\Lepro\LOCALS~1\APPLIC~1\MICROS~1\cmstp.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [SessMgr] C:\Users\Lepro\LOCALS~1\APPLIC~1\sessmgr.exe /waitservice
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [MqtgSVC] C:\Windows\mqtgsvc.exe /waitservice (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [MqtgSVC] C:\Windows\mqtgsvc.exe /waitservice (User 'Default user')
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\Microsoft Office\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C5B43175-F62B-43AD-B87E-4F152B6E3779}: NameServer = 29.253.128.10,29.253.128.11
O22 - SharedTaskScheduler: MsmacrobPau - {FB87BE85-13F2-481F-80F1-63F21B26F021} - C:\Windows\system32\msmacrob.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Servizio di Google Update (gupdate1c9d898d5ec94d0) (gupdate1c9d898d5ec94d0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
--
End of file - 6586 bytes
Scan saved at 11.01.35, on 17/08/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\QUAD Utilities\QUAD Registry Cleaner\QUAD Scheduler.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Lepro\Desktop\Nuova cartella\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F3 - REG:win.ini: load=C:\Users\Lepro\LOCALS~1\APPLIC~1\mqtgsvc.exe
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKLM\..\Policies\Explorer\Run: [Mstsc] C:\Windows\mstsc.exe /waitservice
O4 - HKLM\..\Policies\Explorer\Run: [MstInit] C:\Windows\System\mstinit.exe /waitservice
O4 - HKLM\..\Policies\Explorer\Run: [rsvp] C:\Users\Lepro\LOCALS~1\APPLIC~1\rsvp.exe /waitservice
O4 - HKLM\..\Policies\Explorer\Run: [DllHst] C:\Users\Lepro\LOCALS~1\APPLIC~1\dllhst3g.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [IEudinit] C:\Users\Lepro\AppData\Local\Temp\ieudinit.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [Cisvc] C:\Users\Lepro\AppData\Local\Temp\cisvc.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [Spool] C:\Users\Lepro\AppData\Roaming\spoolsv.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [Mstsc] C:\Users\Lepro\AppData\Roaming\mstsc.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [MstInit] C:\Windows\System32\drivers\mstinit.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [ClipSrv] C:\Users\Lepro\LOCALS~1\APPLIC~1\MICROS~1\clipsrv.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [rsvp] C:\Users\Lepro\AppData\Roaming\MICROS~1\rsvp.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [Logman] C:\Users\Lepro\LOCALS~1\APPLIC~1\MICROS~1\logman.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [DllHst] C:\Users\Lepro\AppData\Local\Temp\dllhst3g.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [ComRepl] C:\Windows\System\comrepl.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [CmSTP] C:\Users\Lepro\LOCALS~1\APPLIC~1\MICROS~1\cmstp.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [SessMgr] C:\Users\Lepro\LOCALS~1\APPLIC~1\sessmgr.exe /waitservice
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [MqtgSVC] C:\Windows\mqtgsvc.exe /waitservice (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [MqtgSVC] C:\Windows\mqtgsvc.exe /waitservice (User 'Default user')
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\Microsoft Office\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C5B43175-F62B-43AD-B87E-4F152B6E3779}: NameServer = 29.253.128.10,29.253.128.11
O22 - SharedTaskScheduler: MsmacrobPau - {FB87BE85-13F2-481F-80F1-63F21B26F021} - C:\Windows\system32\msmacrob.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Servizio di Google Update (gupdate1c9d898d5ec94d0) (gupdate1c9d898d5ec94d0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
--
End of file - 6586 bytes