credo di aver preso il virus bagle :(

[argentofolle]

Salve a tutti!
Credo proprio di aver preso il virus bagle,in quanto l'antivirus non si avvia più e mi dà l'errore "...non è un'applicazione di win32 valida". E probabilmente l'ho scaricato accidentalmente da Emule. Ho provato a vedere in giro come eliminarlo ma ci sono tante procedure diverse e soprattutto in quasi ognuna di queste è previsto l'uso di Elibagla. Ne sono riuscito a scaricare una versione ma mi dice che è vecchia e deve essere aggiornata. Il problema è che sul sito principale dove scaricare Elibagla,non me lo fa fare perché trova un altro errore "You have an error in your SQL syntax".
Qualcuno sa darmi qualche dritta o procedura migliore? Grazie mille!!
Qui posto il log ottenuto con ComboFix:

ComboFix 09-09-04.02 - Mauro Tucci 05/09/2009 15.32.22.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.39.1040.18.503.280 [GMT 2:00]
Eseguito da: c:\documents and settings\Mauro Tucci\Desktop\ComboFixmauro.exe
AV: Avira AntiVir PersonalEdition *On-access scanning enabled* (Outdated) {00000000-F0B8-0012-00E9-917C0802927C}
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Dati applicazioni\1doc2pdf.dll
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\111wfs1intwq.sys
c:\documents and settings\Mauro Tucci\Dati applicazioni\Drivers\11s11ro1s1a2.sys
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\1322734.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\1347828.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\1393796.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\1394203.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\1395281.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\1432390.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\1432687.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\1432718.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\1434421.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\198859.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\200078.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\201171.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\201437.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\201781.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\201906.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\253875.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\254468.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\255656.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\256218.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\256234.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\256843.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\259203.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\262671.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\263156.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\329593.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\347656.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\478078.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\6065421.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\6065671.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\6065687.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\6067328.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\6156390.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\6157500.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\6158312.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\6165671.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\6166328.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\6166406.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\6170562.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\6171750.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\6172328.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\6173187.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\6173875.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\6174312.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\6209453.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\6212812.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\6294015.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\6303390.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\6309906.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\6437609.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\6441125.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\6441203.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\6441531.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\6442562.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\downld\6442656.exe
c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers\winupgro.exe
c:\windows\system32\_000003_.tmp.dll
c:\windows\system32\_000006_.tmp.dll
c:\windows\system32\_000007_.tmp.dll
c:\windows\system32\_000008_.tmp.dll
c:\windows\system32\_000009_.tmp.dll
c:\windows\system32\_000010_.tmp.dll
c:\windows\system32\_000012_.tmp.dll
c:\windows\system32\_000013_.tmp.dll
c:\windows\system32\_000014_.tmp.dll
c:\windows\system32\logs
c:\windows\system32\logs\{90280149-637F-4C45-9469-91411B577E9A}.log

.
((((((((((((((((((((((((((((((((((((((( Driver/Servizi )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_111111S1RO1S1A
-------\Legacy_111111S1RO1S1A


((((((((((((((((((((((((( Files Creati Da 2009-08-05 al 2009-09-05 )))))))))))))))))))))))))))))))))))
.

2009-09-05 09:39 . 2009-09-05 10:16 -------- d-----w- c:\programmi\FindyKill
2009-09-05 09:13 . 2009-08-17 16:02 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-09-05 09:13 . 2009-08-17 16:06 93392 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-09-05 09:12 . 2009-08-17 16:10 1279456 ----a-w- c:\windows\system32\aswBoot.exe
2009-09-05 09:12 . 2009-09-05 09:12 -------- d-----w- c:\programmi\Alwil Software
2009-09-05 08:55 . 2009-09-05 08:55 2164095 ----a-w- c:\windows\system32\pythondll.zip
2009-08-29 12:54 . 2009-08-29 12:54 -------- d-----w- c:\documents and settings\Mauro Tucci\Dati applicazioni\Participatory Culture Foundation
2009-08-25 11:05 . 2009-08-25 11:05 -------- d-----w- c:\documents and settings\LocalService\Dati applicazioni\agi
2009-08-25 11:05 . 2009-08-25 11:05 -------- d-----w- c:\documents and settings\Mauro Tucci\Impostazioni locali\Dati applicazioni\Kiwee Toolbar
2009-08-25 11:03 . 2009-08-25 11:03 339968 ----a-w- c:\windows\system32\pythoncom25.dll
2009-08-25 11:03 . 2009-08-25 11:03 114688 ----a-w- c:\windows\system32\pywintypes25.dll
2009-08-25 11:03 . 2009-08-25 11:03 2117632 ----a-w- c:\windows\system32\python25.dll
2009-08-20 18:46 . 2009-09-05 13:40 -------- d--h--w- c:\documents and settings\Mauro Tucci\Dati applicazioni\drivers
2009-08-18 13:31 . 2009-08-18 13:32 -------- d-----w- c:\programmi\eMule MorphXt
2009-08-12 16:33 . 2009-07-10 13:26 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2009-08-10 13:39 . 2009-08-10 13:39 -------- d-----w- c:\windows\system32\XPSViewer
2009-08-10 13:39 . 2009-08-10 13:39 -------- d-----w- c:\programmi\Reference Assemblies
2009-08-10 13:38 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-08-10 13:38 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-08-10 13:38 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2009-08-10 13:38 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2009-08-10 13:38 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-08-10 13:38 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2009-08-10 13:38 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2009-08-10 13:38 . 2009-08-11 09:07 -------- d-----w- c:\windows\SxsCaPendDel

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-05 13:09 . 2009-04-11 13:07 -------- d-----w- c:\documents and settings\Mauro Tucci\Dati applicazioni\XnView
2009-09-05 10:04 . 2001-08-31 10:00 80268 ----a-w- c:\windows\system32\perfc010.dat
2009-09-05 10:04 . 2001-08-31 10:00 481664 ----a-w- c:\windows\system32\perfh010.dat
2009-09-05 09:06 . 2009-04-09 17:13 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Avira
2009-09-05 08:52 . 2007-08-23 17:57 -------- d-----w- c:\programmi\Xvid
2009-08-26 14:43 . 2007-08-03 14:16 -------- d-----w- c:\programmi\Messenger Plus! Live
2009-08-19 09:12 . 2009-06-27 09:22 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-08-17 15:05 . 2007-09-08 13:16 85184 -c--a-w- c:\documents and settings\Mauro Tucci\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2009-08-12 19:19 . 2007-07-31 18:18 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Microsoft Help
2009-08-10 13:39 . 2007-07-31 18:23 -------- d-----w- c:\programmi\MSBuild
2009-08-05 08:59 . 2007-07-31 16:42 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-01 08:41 . 2008-03-29 15:28 -------- d-----w- c:\programmi\Microsoft Silverlight
2009-07-17 19:01 . 2007-07-31 17:33 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-12 10:21 . 2007-07-31 18:02 233472 ----a-w- c:\windows\system32\wmpdxm.dll
2009-06-29 15:55 . 2007-07-31 17:31 827392 ----a-w- c:\windows\system32\wininet.dll
2009-06-29 15:55 . 2007-07-31 18:02 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-06-29 15:54 . 2001-08-31 10:00 17408 ----a-w- c:\windows\system32\corpol.dll
2009-06-16 14:36 . 2001-08-31 10:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2001-08-31 10:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-15 10:43 . 2002-09-09 11:51 78336 ----a-w- c:\windows\system32\telnet.exe
2009-06-15 10:43 . 2007-07-31 17:33 82432 ----a-w- c:\windows\system32\tlntsess.exe
2009-06-10 14:13 . 2007-07-31 17:33 85504 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 07:19 . 2007-07-31 17:32 2066432 ----a-w- c:\windows\system32\mstscax.dll
2009-06-10 06:14 . 2001-08-31 10:00 132096 ----a-w- c:\windows\system32\wkssvc.dll
.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2006-11-16 17:04 . 2006-11-16 17:04 139264 c:\programmi\File comuni\Ahead\Lib\bak\NMBgMonitor.exe
2006-11-16 17:04 . 2004-06-13 02:09 823296 c:\programmi\File comuni\Ahead\Lib\NMBgMonitor.exe

2004-11-14 13:26 . 2004-11-14 13:26 188459 c:\programmi\IncrediMail\bin\bak\IncMail.exe
2004-11-14 13:26 . 2008-08-16 15:41 188459 c:\programmi\IncrediMail\bin\IncMail.exe

2006-06-27 15:21 . 2006-06-27 15:21 1449984 c:\programmi\Nokia\Nokia PC Suite 6\bak\PcSync2.exe

2007-07-31 17:33 . 2004-08-19 13:39 15360 c:\windows\system32\bak\ctfmon.exe
2007-07-31 17:33 . 2008-04-14 02:14 15360 c:\windows\system32\ctfmon.exe

.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\programmi\File comuni\Ahead\lib\NMBgMonitor.exe" [2004-06-13 823296]
"Packard Bell Software Suite"="c:\programmi\Packard Bell\Packard Bell Software Suite\Launcher.exe" [2008-08-28 1934144]
"Nokia.PCSync"="c:\programmi\Nokia\Nokia PC Suite 7\PCSync2.exe" [2008-06-17 1249280]
"swg"="c:\programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-05 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\programmi\Java\jre6\bin\jusched.exe" [2009-03-15 136600]
"igfxtray"="c:\windows\System32\igfxtray.exe" [2005-09-20 94208]
"igfxpers"="c:\windows\System32\igfxpers.exe" [2005-09-20 114688]
"igfxhkcmd"="c:\windows\System32\hkcmd.exe" [2005-09-20 77824]
"GrooveMonitor"="c:\programmi\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"SSBkgdUpdate"="c:\programmi\File comuni\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-09-28 185896]
"OpwareSE4"="c:\programmi\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-10-11 75304]
"TrueImageMonitor.exe"="c:\programmi\Acronis\TrueImageHome\TrueImageMonitor.exe" [2008-10-13 4344472]
"AcronisTimounterMonitor"="c:\programmi\Acronis\TrueImageHome\TimounterMonitor.exe" [2008-10-13 960376]
"Acronis Scheduler2 Service"="c:\programmi\File comuni\Acronis\Schedule2\schedhlp.exe" [2008-10-13 165144]
"QuickTime Task"="c:\programmi\QuickTime\QTTask.exe" [2009-05-26 413696]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-09-05 81000]
"Cmaudio"="cmicnfg.cpl" [N/A]
"9xadiras"="9xadiras.exe" [N/A]
"adiras"="adiras.exe" [N/A]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-04-14 110592]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2007-8-3 25214]
DSLMON.lnk - c:\programmi\ADSL\StarModem ADSL USB MODEM\dslmon.exe [2007-7-31 929861]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Programmi\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Programmi\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Programmi\\IncrediMail\\bin\\IMApp.exe"=
"c:\\Programmi\\IncrediMail\\bin\\IncMail.exe"=
"c:\\Programmi\\IncrediMail\\bin\\ImpCnt.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmi\\uTorrent\\uTorrent.exe"=
"c:\\Programmi\\TVUPlayer\\TVUPlayer.exe"=
"c:\\Programmi\\SopCast\\SopCast.exe"=
"c:\\Programmi\\Skype\\Phone\\Skype.exe"=
"d:\\Università\\Programmazione in rete\\Dispense Lanubile\\Laboratorio\\SOLUZIONE_esercizio1_CARRIERI_DIDONNA\\server\\Debug\\string_srv.exe"=
"c:\\EclipseCdt\\Hellow\\Debug\\Hellow.exe"=
"c:\\EclipseCdt\\esonero1\\Debug\\esonero1.exe"=
"c:\\Programmi\\SopCast\\adv\\SopAdver.exe"=
"c:\\Programmi\\eMule0.49a\\emule.exe"=
"c:\\Programmi\\File comuni\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Programmi\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\Programmi\\TrackMania Nations ESWC\\TmNationsESWC.exe"=
"c:\\Programmi\\Codemasters\\Worms 4 Mayhem\\WORMS 4 MAYHEM.EXE"=
"c:\\Programmi\\eMule 0.49c\\emule.exe"=
"c:\\Programmi\\eMule MorphXt\\eMule.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=

R0 snapman380;Acronis Snapshots Manager (Build 380);c:\windows\system32\drivers\snman380.sys [27/12/2008 13.52.31 134272]
R0 tdrpman147;Acronis Try&Decide and Restore Points filter (build 147);c:\windows\system32\drivers\tdrpm147.sys [27/12/2008 13.53.19 971232]
R2 Vcs;Vcs support;c:\windows\system32\drivers\Vcs.sys [02/06/2009 11.37.56 6852]
S1 aswSP;avast! Self Protection; [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys c:\windows\system32\DRIVERS\aswFsBlk.sys
S3 cdrmkaun;cdrmkaun;\??\c:\docume~1\MAUROT~1\IMPOST~1\Temp\cdrmkaun.sys c:\docume~1\MAUROT~1\IMPOST~1\Temp\cdrmkaun.sys
S3 MovRVDrv32;MovRVDrv32;c:\windows\system32\drivers\MovRVDrv32.sys [12/08/2008 16.01.04 3768]
S3 wsvad_driver;Daniusoft Audio Device;c:\windows\system32\drivers\VirtualAudio.sys [12/08/2008 15.01.42 20608]
.
Contenuto della cartella 'Scheduled Tasks'

2009-08-08 c:\windows\Tasks\Auto Backup for Mauro Tucci.job
- c:\programmi\Packard Bell\Packard Bell Software Suite\DSMsg.exe [2008-01-09 14:14]
.
- - - - CHIAVI ORFANE RIMOSSE - - - -

ShellIconOverlayIdentifiers-{8D2223A2-B3C6-4e32-B096-CDD11F628C60} - (no file)


.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.tvblog.it/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Add animation to IncrediMail Style Box - c:\progra~1\INCRED~1\bin\resources\WebMenuImg.htm
IE: Aggiungi all'elenco di stampa Easy-WebPrint - c:\programmi\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
IE: Anteprima Easy-WebPrint - c:\programmi\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
IE: Convert link target to Adobe PDF - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Stampa ad alta velocità Easy-WebPrint - c:\programmi\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
IE: Stampa Easy-WebPrint - c:\programmi\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
FF - ProfilePath - c:\documents and settings\Mauro Tucci\Dati applicazioni\Mozilla\Firefox\Profiles\gbc8r1oa.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - GoogleCOM
FF - prefs.js: browser.startup.homepage - hxxp://www.cineblog.it/
FF - prefs.js: keyword.URL - hxxp://www.wcsearch.com/search/?ie=UTF- ... &gfns=1&q=
FF - component: c:\documents and settings\Mauro Tucci\Dati applicazioni\Mozilla\Firefox\Profiles\gbc8r1oa.default\extensions\bkmrksync@nokia.com\components\BkMrkExt.dll
FF - plugin: c:\documents and settings\Mauro Tucci\Dati applicazioni\Mozilla\plugins\npPxPlay.dll

---- FIREFOX POLICIES ----

FF - user.js: browser.search.selectedEngine - GoogleCOM
FF - user.js: keyword.URL - hxxp://www.wcsearch.com/search/?ie=UTF- ... &gfns=1&q=
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-05 15:40
Windows 5.1.2600 Service Pack 3 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
Ora fine scansione: 2009-09-05 15.48.51
ComboFix-quarantined-files.txt 2009-09-05 13:48

Pre-Run: 38.536.298.496 byte disponibili
Post-Run: 38.507.413.504 byte disponibili

WindowsXP-KB310994-SP2-Pro-BootDisk-ITA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
signature(df65df65)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect

275 --- E O F --- 2009-08-12 19:20

[ste_95]

Scarica FindyKill (by Chiquitine29)ed installalo (è in francese però è di facile comprensione).
Una volta installato chiudi tutte le applicazioni attive e disconnettiti dal internet, poi clicca sull'icona di FindyKill e nella finestra dos che si aprirà scrivi 2 e premi Invio. Attendi il termine della scansione e posta qui il log che trovi in C:\FindyKill.txt.

[argentofolle]

Scarica FindyKill (by Chiquitine29)ed installalo (è in francese però è di facile comprensione).
Una volta installato chiudi tutte le applicazioni attive e disconnettiti dal internet, poi clicca sull'icona di FindyKill e nella finestra dos che si aprirà scrivi 2 e premi Invio. Attendi il termine della scansione e posta qui il log che trovi in C:\FindyKill.txt.

Grazie per la risposta ste_95.
Allora ho fatto come mi hai detto, ti posto qui il log risultante:

###################### [ FindyKill V4.714 ]

# User : Mauro Tucci - PENTIUM
# Executed from : C:\Programmi\FindyKill
# Update on 19/01/09 by Chiquitine29
# Start at 17:34:33 the 05/09/2009
# Windows XP - Internet Explorer 7.0.5730.11

# [ FindyKill V4.714 - Deleting ] ###############

\\\\\\\\\\\\\\\\\\ [ Active Processes ] ///////////////////


C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LogonUI.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\File comuni\Acronis\Schedule2\schedul2.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Java\jre6\bin\jqs.exe
c:\Programmi\File comuni\Protexis\License Service\PsiService_2.exe
C:\Programmi\Photodex\ProShowGold\ScsiAccess.exe
C:\Programmi\Packard Bell\Packard Bell Software Suite\PowerSave\HDPBSSS.exe
C:\WINDOWS\system32\userinit.exe
C:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\alg.exe

\\\\\\\\\\\\\\\\\\ [ Infected Files / Folders ] ///////////////////


################## [ C:\ ]


################## [ C:\WINDOWS ]


################## [ C:\WINDOWS\Prefetch ]

Deleted ! - C:\WINDOWS\prefetch\MDELK.EXE-38854776.pf

################## [ C:\WINDOWS\system32 ]


################## [ C:\WINDOWS\system32\drivers ]


################## [ C:\Documents and Settings\Mauro Tucci\Dati applicazioni ]

Deleted ! - "C:\Documents and Settings\Mauro Tucci\Dati applicazioni\drivers"

################## [ C:\DOCUME~1\MAUROT~1\IMPOST~1\Temp ]


################## [ C:\Documents and Settings\Mauro Tucci\Local Settings\Temporary Internet Files\Content.IE5 ]


\\\\\\\\\\\\\\\\\\ [ Registry / Infected keys ] ///////////////////

Deleted ! - HKEY_USERS\S-1-5-21-1757981266-1645522239-682003330-1003\Software\Local AppWizard-Generated Applications\winupgro

\\\\\\\\\\\\\\\\\\ [ States / Restarting of services ] ///////////////////


# Services : [ Auto=2 / Request=3 / Disable=4 ]

Ndisuio - # Type of startup = 3

EapHost - # Type of startup = 2

Ip6Fw - # Type of startup = 2

SharedAccess - # Type of startup = 2

wuauserv - # Type of startup = 2

wscsvc - # Type of startup = 2


\\\\\\\\\\\\\\\\\\ [ Cleaning Removable drives ] ///////////////////

# Informations :

C: - Unit… fissa

D: - Unit… fissa

F: - Unit… CD-ROM

H: - Unit… fissa


# deleting files :

Not deleted !! - F:\autorun.inf

\\\\\\\\\\\\\\\\\\ [ Registry / Mountpoint2 ] ///////////////////


-> Not found !


\\\\\\\\\\\\\\\\\\ [ Searching Other Infections ] ///////////////////

Références de comparaison Bagle MD5 :

8aa0c41f C:\Qoobox\Quarantine\C\Documents and Settings\Mauro Tucci\Dati applicazioni\drivers\winupgro.exe.vir
c001ee0f0675c7d1d57342f3c6e17a92 C:\Qoobox\Quarantine\C\Documents and Settings\Mauro Tucci\Dati applicazioni\drivers\winupgro.exe.vir


\\\\\\\\\\\\\\\\\\ [ Searching Cracks / Keygen ] ///////////////////

C:\Documents and Settings\Mauro Tucci\Dati applicazioni\uTorrent\nhl 08 crack.torrent

################## [ ! End of report # FindyKill V4.714 ! ]

[ste_95]

Scarica il Perlovga Removal Tool ed effettua una scansione come spiegato qui:
http://www.MegaLab.it/2899/2/worm-perlo ... desiderato

[argentofolle]

Scarica il Perlovga Removal Tool ed effettua una scansione come spiegato qui:
http://www.MegaLab.it/2899/2/worm-perlo ... desiderato

Ho fatto la scansione con il Perlovga (durata pochissimo tra l'altro) ma il mio antivirus (Avast) continua a non avviarsi. Non è che magari devo disinstallarlo e reinstallarlo?

[ste_95]

il mio antivirus (Avast) continua a non avviarsi. Non è che magari devo disinstallarlo e reinstallarlo?

Devi anche riscaricarlo.

[argentofolle]

il mio antivirus (Avast) continua a non avviarsi. Non è che magari devo disinstallarlo e reinstallarlo?

Devi anche riscaricarlo.

Già! :) Effettivamente ho disinstallato e reinstallato nuovamente (dopo averlo riscaricato :) ) ed ora 'antivirus pare funzionare. L'unico difetto che sto riscontrando ora è che ogni volta che apro Mozilla mi dice non è il browser di default. Spunto la casella per renderlo di default ma ogni volta che riavvio me lo chiede nuovamente.
A parte questo ti ringrazio per la disponibilità!ti sono debitore

[ste_95]

Prova a reinstallare anche Mozilla, tanto per sicurezza.