Aiuto! ho cancellato i file.exe, e avast non va

[Or4colo]

ecco fatto

All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
Service WDICA stopped successfully!
Service WDICA deleted successfully!
Service PDRFRAME stopped successfully!
Service PDRFRAME deleted successfully!
Service PDRELI stopped successfully!
Service PDRELI deleted successfully!
Service PDFRAME stopped successfully!
Service PDFRAME deleted successfully!
Service PDCOMP stopped successfully!
Service PDCOMP deleted successfully!
Service PCIDump stopped successfully!
Service PCIDump deleted successfully!
Service lbrtfdc stopped successfully!
Service lbrtfdc deleted successfully!
Service i2omgmt stopped successfully!
Service i2omgmt deleted successfully!
Service Changer stopped successfully!
Service Changer deleted successfully!
Service catchme stopped successfully!
Service catchme deleted successfully!
File C:\ComboFix\catchme.sys not found.
Registry key HKEY_USERS\S-1-5-21-1229272821-1390067357-725345543-500\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}\ not found.
Prefs.js: wrc@avast.com:6.0.1289 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}:6.0.25 removed from extensions.enabledItems
Prefs.js: jqs@sun.com:1.0 removed from extensions.enabledItems
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} folder moved successfully.
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Extensions folder moved successfully.
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\44boro8x.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}\defaults\preferences folder moved successfully.
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\44boro8x.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}\defaults folder moved successfully.
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\44boro8x.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}\chrome folder moved successfully.
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\44boro8x.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} folder moved successfully.
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\44boro8x.default\extensions\crossriderapp5060@crossrider.com\skin folder moved successfully.
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\44boro8x.default\extensions\crossriderapp5060@crossrider.com\locale\en-US folder moved successfully.
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\44boro8x.default\extensions\crossriderapp5060@crossrider.com\locale folder moved successfully.
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\44boro8x.default\extensions\crossriderapp5060@crossrider.com\defaults\preferences folder moved successfully.
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\44boro8x.default\extensions\crossriderapp5060@crossrider.com\defaults folder moved successfully.
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\44boro8x.default\extensions\crossriderapp5060@crossrider.com\chrome\content\lib folder moved successfully.
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\44boro8x.default\extensions\crossriderapp5060@crossrider.com\chrome\content folder moved successfully.
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\44boro8x.default\extensions\crossriderapp5060@crossrider.com\chrome folder moved successfully.
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\44boro8x.default\extensions\crossriderapp5060@crossrider.com folder moved successfully.
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\44boro8x.default\extensions folder moved successfully.
Folder C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\44boro8x.default\extensions\crossriderapp5060@crossrider.com\ not found.
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\44boro8x.default\searchplugins\askcom.xml moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\zh-TW folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\zh-CN folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\sv-SE folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\ko-KR folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\ja-JP folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\it-IT folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\fr-FR folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\es-ES folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\en-US folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\de-DE folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\content\ffjcext folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\content folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\chrome\icons\default folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\chrome\icons folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\chrome folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\skin\png folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\skin\icons folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\skin\ico 24x24px folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\skin\ico 16x16px folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\skin folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\zh-TW folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\zh-CN folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\vi-VN folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\ur-PK folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\uk-UA folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\tr-TR folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\th-TH folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\sv-SE folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\sl-SI folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\sk-SK folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\ru-RU folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\ro-RO folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\pt-PT folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\pt-BR folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\pl-PL folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\nl-NL folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\nb-NO folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\ko-KR folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\ja-JP folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\it-IT folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\id-ID folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\hu-HU folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\hr-HR folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\he-IL folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\fr-FR folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\fi-FI folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\et-EE folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\es-ES folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\en-US folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\en-GB folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\el-GR folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\de-DE folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\da-DK folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\cs-CZ folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\ca-ES folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\bg-BG folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\be-BY folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\ar-SA folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\defaults\preferences folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\defaults folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\content folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF folder moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry value HKEY_USERS\S-1-5-21-1229272821-1390067357-725345543-500\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{4B3803EA-5230-4DC3-A7FC-33638F3D3542} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}\ not found.
Registry value HKEY_USERS\S-1-5-21-1229272821-1390067357-725345543-500\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{4B3803EA-5230-4DC3-A7FC-33638F3D3542} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\avast deleted successfully.
C:\Programmi\AVAST Software\Avast\AvastUI.exe moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\HonorAutoRunSetting deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDrives deleted successfully.
Registry key HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun deleted successfully.
Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoFavoritesMenu deleted successfully.
Registry key HKEY_USERS\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found.
Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun not found.
Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoFavoritesMenu not found.
Registry key HKEY_USERS\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry value HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1229272821-1390067357-725345543-500\Software\Policies\Microsoft\Internet Explorer\Control Panel\ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1229272821-1390067357-725345543-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1229272821-1390067357-725345543-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1229272821-1390067357-725345543-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDrives deleted successfully.
C:\Documents and Settings\All Users\Menu Avvio\Programmi\avast! Free Antivirus folder moved successfully.
C:\WINDOWS\system32\aswBoot.exe moved successfully.
C:\Programmi\AVAST Software\Avast\WebRep\Safari folder moved successfully.
C:\Programmi\AVAST Software\Avast\WebRep\Opera folder moved successfully.
C:\Programmi\AVAST Software\Avast\WebRep\Chrome folder moved successfully.
C:\Programmi\AVAST Software\Avast\WebRep folder moved successfully.
C:\Programmi\AVAST Software\Avast\Setup\INF folder moved successfully.
C:\Programmi\AVAST Software\Avast\Setup folder moved successfully.
C:\Programmi\AVAST Software\Avast\License folder moved successfully.
C:\Programmi\AVAST Software\Avast\flash\ammap\maps folder moved successfully.
C:\Programmi\AVAST Software\Avast\flash\ammap\icons folder moved successfully.
C:\Programmi\AVAST Software\Avast\flash\ammap folder moved successfully.
C:\Programmi\AVAST Software\Avast\flash folder moved successfully.
C:\Programmi\AVAST Software\Avast\defs\12082100 folder moved successfully.
C:\Programmi\AVAST Software\Avast\defs folder moved successfully.
C:\Programmi\AVAST Software\Avast\1040 folder moved successfully.
C:\Programmi\AVAST Software\Avast folder moved successfully.
C:\Programmi\AVAST Software folder moved successfully.
C:\WINDOWS\avastSS.scr moved successfully.
C:\Documents and Settings\Administrator\Desktop\aswclear.exe moved successfully.
C:\TDSSKiller_Quarantine\18.09.2012_00.16.37\mbr0000\mbr0000 folder moved successfully.
C:\TDSSKiller_Quarantine\18.09.2012_00.16.37\mbr0000 folder moved successfully.
C:\TDSSKiller_Quarantine\18.09.2012_00.16.37 folder moved successfully.
C:\TDSSKiller_Quarantine folder moved successfully.
C:\WINDOWS\tasks\avast! Emergency Update.job moved successfully.
File C:\Documents and Settings\Administrator\Desktop\aswclear.exe not found.
File C:\WINDOWS\tasks\avast! Emergency Update.job not found.
C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\WPFFontCache_v0400-S-1-5-21-1229272821-1390067357-725345543-500-0.dat moved successfully.
C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\WPFFontCache_v0400-System.dat moved successfully.
========== REGISTRY ==========
HKEY_USERS\S-1-5-21-1229272821-1390067357-725345543-500\SOFTWARE\Classes\<extension>\\.html [@ | htmlfile] -- Reg Error: Key error. File not found /E :invalid edit format. Invalid data type.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List\\3389:TCP deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List\\1900:UDP not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List\\2869:TCP not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\\avast not found.
========== FILES ==========
< ipconfig /flushdns /c >
Configurazione IP di Windows
Svuotata la cache del resolver DNS.
C:\Documents and Settings\Administrator\Desktop\cmd.bat deleted successfully.
C:\Documents and Settings\Administrator\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 223616290 bytes
->Temporary Internet Files folder emptied: 55783431 bytes
->Java cache emptied: 13 bytes
->FireFox cache emptied: 83064445 bytes
->Flash cache emptied: 1112 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: HelpAssistant
->Temp folder emptied: 4446701 bytes
->Temporary Internet Files folder emptied: 119775827 bytes
->Java cache emptied: 15790 bytes
->FireFox cache emptied: 32853042 bytes
->Flash cache emptied: 52093 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 35562 bytes
->Flash cache emptied: 12554 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2133872 bytes
%systemroot%\System32 .tmp files removed: 2885 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 1077120 bytes
Windows Temp folder emptied: 1778545 bytes
RecycleBin emptied: 640 bytes

Total Files Cleaned = 501,00 mb


[EMPTYJAVA]

User: Administrator
->Java cache emptied: 0 bytes

User: All Users

User: Default User

User: HelpAssistant
->Java cache emptied: 0 bytes

User: LocalService

User: NetworkService
->Java cache emptied: 0 bytes

Total Java Files Cleaned = 0,00 mb

C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYFLASH]

User: Administrator
->Flash cache emptied: 0 bytes

User: All Users

User: Default User

User: HelpAssistant
->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0,00 mb

Unable to stop System Restore Service. Error code 1722. Restore points not cleared.
Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.69.0 log created on 10012012_185437

Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\Administrator\Impostazioni locali\Temporary Internet Files\Content.IE5\NVY37FP7\viewtopic[1].htm not found!
File\Folder C:\Documents and Settings\Administrator\Impostazioni locali\Temporary Internet Files\Content.IE5\17A8148A\dis[1].htm not found!
File\Folder C:\Documents and Settings\Administrator\Impostazioni locali\Temporary Internet Files\Content.IE5\17A8148A\eas[1].htm not found!
File\Folder C:\Documents and Settings\Administrator\Impostazioni locali\Temporary Internet Files\Content.IE5\17A8148A\likebox[1].htm not found!
C:\Documents and Settings\Administrator\Impostazioni locali\Temporary Internet Files\Content.IE5\17A8148A\xcid,qmqHHmy1Ft6hpN5ygibZCsecxvIhle7Qber_Wzb0LmoBfKo4eS1N1bvVhlvi7e9u[1].htm moved successfully.
C:\Documents and Settings\Administrator\Impostazioni locali\Temporary Internet Files\Content.IE5\10Q9J96O\autoscout24_it[1].htm moved successfully.
C:\Documents and Settings\Administrator\Impostazioni locali\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

e ora? grazie

[GERONIMO*]

ok
ora prova ad installare un antivirus
http://www.avira.com/it/avira-free-antivirus

poi comunica se tutto ok o no

[Or4colo]

Ci proverei ad installarlo, se solo riuscissi a scaricarlo... ops, sono un idiota, non hai delle volte un link diretto??? mi sono reistrato ma non cambia nulla..uff
ok sto scaricando scusate!!!

[Or4colo]

Ok Avira dovrebbe essere installato, che sudata... appena partito ha fatto una scansione posto il log

Avira Free Antivirus
Data del file di report: lunedì 1 ottobre 2012 21:45

Ricerca di 4294391 virus e programmi indesiderati.

Il programma funziona come versione completa e illimitata.
I servizi online sono disponibili.

Concesso in licenza a : Avira AntiVir Personal - Free Antivirus
Numero di serie : 0000149996-ADJIE-0000001
Piattaforma : Microsoft Windows XP
Versione di Windows : (Service Pack 3) [5.1.2600]
Modalità di avvio : Booting eseguito regolarmente
Nome utente : Administrator
Nome computer : PC

Informazioni sulla versione:
BUILD.DAT : 12.0.0.330 40867 Bytes 07/09/2012 22:38:00
AVSCAN.EXE : 12.3.0.33 468472 Bytes 07/09/2012 18:26:57
AVSCAN.DLL : 12.3.0.15 63440 Bytes 05/06/2012 22:40:21
LUKE.DLL : 12.3.0.15 68304 Bytes 02/07/2012 13:39:45
AVSCPLR.DLL : 12.3.0.27 97064 Bytes 02/07/2012 13:39:38
AVREG.DLL : 12.3.0.33 232232 Bytes 02/07/2012 13:39:38
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06/11/2009 18:18:34
VBASE001.VDF : 7.11.0.0 13342208 Bytes 14/12/2010 23:26:32
VBASE002.VDF : 7.11.19.170 14374912 Bytes 20/12/2011 23:34:41
VBASE003.VDF : 7.11.21.238 4472832 Bytes 01/02/2012 09:58:50
VBASE004.VDF : 7.11.26.44 4329472 Bytes 28/03/2012 22:40:11
VBASE005.VDF : 7.11.34.116 4034048 Bytes 29/06/2012 08:15:36
VBASE006.VDF : 7.11.41.250 4902400 Bytes 06/09/2012 18:37:27
VBASE007.VDF : 7.11.41.251 2048 Bytes 06/09/2012 18:37:27
VBASE008.VDF : 7.11.41.252 2048 Bytes 06/09/2012 18:37:27
VBASE009.VDF : 7.11.41.253 2048 Bytes 06/09/2012 18:37:27
VBASE010.VDF : 7.11.41.254 2048 Bytes 06/09/2012 18:37:27
VBASE011.VDF : 7.11.41.255 2048 Bytes 06/09/2012 18:37:27
VBASE012.VDF : 7.11.42.0 2048 Bytes 06/09/2012 18:37:27
VBASE013.VDF : 7.11.42.1 2048 Bytes 06/09/2012 18:37:27
VBASE014.VDF : 7.11.42.65 203264 Bytes 09/09/2012 19:43:41
VBASE015.VDF : 7.11.42.125 156672 Bytes 11/09/2012 19:43:42
VBASE016.VDF : 7.11.42.171 187904 Bytes 12/09/2012 19:43:42
VBASE017.VDF : 7.11.42.235 141312 Bytes 13/09/2012 19:43:43
VBASE018.VDF : 7.11.43.35 133632 Bytes 15/09/2012 19:43:43
VBASE019.VDF : 7.11.43.89 129024 Bytes 18/09/2012 19:43:44
VBASE020.VDF : 7.11.43.141 130560 Bytes 19/09/2012 19:43:44
VBASE021.VDF : 7.11.43.187 121856 Bytes 21/09/2012 19:43:44
VBASE022.VDF : 7.11.43.251 147456 Bytes 24/09/2012 19:43:45
VBASE023.VDF : 7.11.44.43 152064 Bytes 25/09/2012 19:43:46
VBASE024.VDF : 7.11.44.103 165888 Bytes 27/09/2012 19:43:46
VBASE025.VDF : 7.11.44.167 160256 Bytes 30/09/2012 19:43:47
VBASE026.VDF : 7.11.44.168 2048 Bytes 30/09/2012 19:43:47
VBASE027.VDF : 7.11.44.169 2048 Bytes 30/09/2012 19:43:47
VBASE028.VDF : 7.11.44.170 2048 Bytes 30/09/2012 19:43:47
VBASE029.VDF : 7.11.44.171 2048 Bytes 30/09/2012 19:43:47
VBASE030.VDF : 7.11.44.172 2048 Bytes 30/09/2012 19:43:47
VBASE031.VDF : 7.11.44.202 125952 Bytes 01/10/2012 19:43:48
Motore : 8.2.10.178
AEVDF.DLL : 8.1.2.10 102772 Bytes 23/07/2012 12:28:35
AESCRIPT.DLL : 8.1.4.58 463226 Bytes 01/10/2012 19:44:02
AESCN.DLL : 8.1.9.2 131444 Bytes 01/10/2012 19:44:01
AESBX.DLL : 8.2.5.12 606578 Bytes 10/07/2012 08:15:52
AERDL.DLL : 8.1.9.15 639348 Bytes 20/01/2012 23:25:54
AEPACK.DLL : 8.3.0.38 811382 Bytes 01/10/2012 19:44:01
AEOFFICE.DLL : 8.1.2.48 201082 Bytes 01/10/2012 19:43:59
AEHEUR.DLL : 8.1.4.108 5329272 Bytes 01/10/2012 19:43:58
AEHELP.DLL : 8.1.24.0 258423 Bytes 01/10/2012 19:43:50
AEGEN.DLL : 8.1.5.38 434548 Bytes 01/10/2012 19:43:49
AEEXP.DLL : 8.2.0.2 115060 Bytes 01/10/2012 19:44:02
AEEMU.DLL : 8.1.3.2 393587 Bytes 23/07/2012 12:28:35
AECORE.DLL : 8.1.28.2 201079 Bytes 01/10/2012 19:43:49
AEBB.DLL : 8.1.1.0 53618 Bytes 20/01/2012 23:25:50
AVWINLL.DLL : 12.3.0.15 27344 Bytes 02/07/2012 13:39:40
AVPREF.DLL : 12.3.0.15 51920 Bytes 02/07/2012 13:39:38
AVREP.DLL : 12.3.0.15 179208 Bytes 02/07/2012 13:39:38
AVARKT.DLL : 12.3.0.15 211408 Bytes 02/07/2012 13:39:36
AVEVTLOG.DLL : 12.3.0.15 169168 Bytes 02/07/2012 13:39:37
SQLITE3.DLL : 3.7.0.1 398288 Bytes 02/07/2012 13:39:47
AVSMTP.DLL : 12.3.0.32 63480 Bytes 02/07/2012 13:39:38
NETNT.DLL : 12.3.0.15 17104 Bytes 02/07/2012 13:39:45
RCIMAGE.DLL : 12.1.0.13 4449488 Bytes 20/01/2012 23:26:50
RCTEXT.DLL : 12.3.0.31 100344 Bytes 07/09/2012 18:26:59

Impostazioni di configurazione per la scansione attuale:
Nome del job................................: Breve scansione del sistema dopo l'installazione
File di configurazione......................: c:\programmi\avira\antivir desktop\setupprf.dat
Report......................................: standard
Azione primaria.............................: interattivo
Azione secondaria...........................: ignora
Scansione dei record master di avvio........: Attivo
Scansiona record di avvio...................: Attivo
Scansione dei programmi attivi..............: Attivo
Scansiona la registrazione..................: Attivo
Cerca Rootkits..............................: Non attivo
Controllo di integrità dei file di sistema..: Non attivo
Modalità di scansione file..................: Selezione intelligente dei file
Scansione degli archivi.....................: Attivo
Limita la profondità di ricorsione..........: 20
Archivio estensioni Smart...................: Attivo
Macro euristico.............................: Attivo
File euristico..............................: avanzato

Avvio della scansione: lunedì 1 ottobre 2012 21:45

Avvio della scansione dei record master di avvio:
Record master di avvio dell'Hard Disk 0
[INFO] Nessun virus è stato trovato!

Avvio della scansione dei record di avvio:

La scansione dei processi in esecuzione verrà avviata:
Scansione processo 'avscan.exe' - '1' modulo(i) scansionato(i)
Scansione processo 'avshadow.exe' - '1' modulo(i) scansionato(i)
Scansione processo 'avguard.exe' - '1' modulo(i) scansionato(i)
Scansione processo 'avgnt.exe' - '1' modulo(i) scansionato(i)
Scansione processo 'wmiprvse.exe' - '1' modulo(i) scansionato(i)
Scansione processo 'avcenter.exe' - '1' modulo(i) scansionato(i)
Scansione processo 'avconfig.exe' - '1' modulo(i) scansionato(i)
Scansione processo 'sched.exe' - '1' modulo(i) scansionato(i)
Scansione processo 'svchost.exe' - '1' modulo(i) scansionato(i)
Scansione processo 'setup.exe' - '1' modulo(i) scansionato(i)
Scansione processo 'presetup.exe' - '1' modulo(i) scansionato(i)
Scansione processo 'avira_free_antivirus_it.exe' - '1' modulo(i) scansionato(i)
Modulo OK -> <C:\Documents and Settings\Administrator\Desktop\avira_free_antivirus_it.exe>
[AVVISO] Il file è protetto da password
Scansione processo 'wuauclt.exe' - '1' modulo(i) scansionato(i)
Scansione processo 'ctfmon.exe' - '1' modulo(i) scansionato(i)
Scansione processo 'PlusService.exe' - '1' modulo(i) scansionato(i)
Scansione processo 'RTHDCPL.EXE' - '1' modulo(i) scansionato(i)
Scansione processo 'alg.exe' - '1' modulo(i) scansionato(i)
Scansione processo 'wmiapsrv.exe' - '1' modulo(i) scansionato(i)
Scansione processo 'svchost.exe' - '1' modulo(i) scansionato(i)
Scansione processo 'MDM.EXE' - '1' modulo(i) scansionato(i)
Scansione processo 'jqs.exe' - '1' modulo(i) scansionato(i)
Scansione processo 'svchost.exe' - '1' modulo(i) scansionato(i)
Scansione processo 'Explorer.EXE' - '1' modulo(i) scansionato(i)
Scansione processo 'WgaTray.exe' - '1' modulo(i) scansionato(i)
Scansione processo 'Ati2evxx.exe' - '1' modulo(i) scansionato(i)
Scansione processo 'UMVPFSrv.exe' - '1' modulo(i) scansionato(i)
Scansione processo 'spoolsv.exe' - '1' modulo(i) scansionato(i)
Scansione processo 'svchost.exe' - '1' modulo(i) scansionato(i)
Scansione processo 'svchost.exe' - '1' modulo(i) scansionato(i)
Scansione processo 'svchost.exe' - '1' modulo(i) scansionato(i)
Scansione processo 'svchost.exe' - '1' modulo(i) scansionato(i)
Scansione processo 'svchost.exe' - '1' modulo(i) scansionato(i)
Scansione processo 'Ati2evxx.exe' - '1' modulo(i) scansionato(i)
Scansione processo 'lsass.exe' - '1' modulo(i) scansionato(i)
Scansione processo 'services.exe' - '1' modulo(i) scansionato(i)
Scansione processo 'winlogon.exe' - '1' modulo(i) scansionato(i)
Scansione processo 'csrss.exe' - '1' modulo(i) scansionato(i)
Scansione processo 'smss.exe' - '1' modulo(i) scansionato(i)

Avvio della scansione dei file eseguibili (registro):
C:\Programmi\uTorrent\uTorrent.exe
[RILEVAMENTO] Contiene il codice del virus Windows W32/Fipp.A
C:\Programmi\Skype\Phone\Skype.exe
[RILEVAMENTO] Contiene il codice del virus Windows W32/Fipp.A
C:\Programmi\Haali\MatroskaSplitter\gdsmux.exe
[RILEVAMENTO] Contiene il codice del virus Windows W32/Fipp.A
C:\Programmi\Haali\MatroskaSplitter\uninstall.exe
[RILEVAMENTO] Contiene il codice del virus Windows W32/Fipp.A
C:\Programmi\Unlocker\UnlockerAssistant.exe
[RILEVAMENTO] Contiene il codice del virus Windows W32/Fipp.A
C:\Programmi\Unlocker\Unlocker.exe
[RILEVAMENTO] Contiene il codice del virus Windows W32/Fipp.A
C:\Programmi\Unlocker\uninst.exe
[RILEVAMENTO] Contiene il codice del virus Windows W32/Fipp.A
C:\Programmi\BeClean\BeClean.exe
[RILEVAMENTO] Contiene il codice del virus Windows W32/Fipp.A
C:\Programmi\Bit Che\Bit_Che.exe
[RILEVAMENTO] Contiene il codice del virus Windows W32/Fipp.A
C:\Programmi\eMule\eMule.exe
[RILEVAMENTO] Contiene il codice del virus Windows W32/Fipp.A
C:\Programmi\ffdshow\unins000.exe
[RILEVAMENTO] Contiene il codice del virus Windows W32/Fipp.A
C:\Programmi\Malwarebytes' Anti-Malware\unins000.exe
[RILEVAMENTO] Contiene il codice del virus Windows W32/Fipp.A
C:\Programmi\Malwarebytes' Anti-Malware\mbam.exe
[RILEVAMENTO] Contiene il codice del virus Windows W32/Fipp.A
C:\Programmi\Nero\Nero 7\Core\nero.exe
[RILEVAMENTO] Contiene il codice del virus Windows W32/Fipp.A
C:\Programmi\File comuni\Ahead\Lib\NMIndexingService.exe
[RILEVAMENTO] Contiene il codice del virus Windows W32/Fipp.A
C:\Programmi\Skype\Updater\Updater.exe
[RILEVAMENTO] Contiene il codice del virus Windows W32/Fipp.A

Il registro è stato scansionato ( 1299 file ).


Avvio della disinfezione:
C:\Programmi\Skype\Updater\Updater.exe
[RILEVAMENTO] Contiene il codice del virus Windows W32/Fipp.A
[NOTA] È stato creato un backup con nome '530c575a.qua' ( QUARANTENA )
[AVVISO] Impossibile riparare il file!
[NOTA] Il file è stato selezionato per essere eliminato dopo il riavvio.
[NOTA] Per la riparazione conclusiva è necessario riavviare il computer.
C:\Programmi\File comuni\Ahead\Lib\NMIndexingService.exe
[RILEVAMENTO] Contiene il codice del virus Windows W32/Fipp.A
[NOTA] È stato creato un backup con nome '4be47892.qua' ( QUARANTENA )
[AVVISO] Impossibile riparare il file!
[NOTA] Il file è stato selezionato per essere eliminato dopo il riavvio.
[NOTA] Per la riparazione conclusiva è necessario riavviare il computer.
C:\Programmi\Nero\Nero 7\Core\nero.exe
[RILEVAMENTO] Contiene il codice del virus Windows W32/Fipp.A
[NOTA] È stato creato un backup con nome '19d22262.qua' ( QUARANTENA )
[AVVISO] Impossibile riparare il file!
[NOTA] Il file è stato selezionato per essere eliminato dopo il riavvio.
[NOTA] Per la riparazione conclusiva è necessario riavviare il computer.
C:\Programmi\Malwarebytes' Anti-Malware\mbam.exe
[RILEVAMENTO] Contiene il codice del virus Windows W32/Fipp.A
[NOTA] È stato creato un backup con nome '7ff46ddc.qua' ( QUARANTENA )
[AVVISO] Impossibile riparare il file!
[NOTA] Il file è stato selezionato per essere eliminato dopo il riavvio.
[NOTA] Per la riparazione conclusiva è necessario riavviare il computer.
C:\Programmi\Malwarebytes' Anti-Malware\unins000.exe
[RILEVAMENTO] Contiene il codice del virus Windows W32/Fipp.A
[NOTA] È stato creato un backup con nome '3a6840ee.qua' ( QUARANTENA )
[AVVISO] Impossibile riparare il file!
[NOTA] Il file è stato selezionato per essere eliminato dopo il riavvio.
[NOTA] Per la riparazione conclusiva è necessario riavviare il computer.
C:\Programmi\ffdshow\unins000.exe
[RILEVAMENTO] Contiene il codice del virus Windows W32/Fipp.A
[NOTA] È stato creato un backup con nome '4573728e.qua' ( QUARANTENA )
[AVVISO] Impossibile riparare il file!
[NOTA] Il file è stato selezionato per essere eliminato dopo il riavvio.
[NOTA] Per la riparazione conclusiva è necessario riavviare il computer.
C:\Programmi\eMule\eMule.exe
[RILEVAMENTO] Contiene il codice del virus Windows W32/Fipp.A
[NOTA] È stato creato un backup con nome '09c75ea5.qua' ( QUARANTENA )
[AVVISO] Impossibile riparare il file!
[NOTA] Il file è stato selezionato per essere eliminato dopo il riavvio.
[NOTA] Per la riparazione conclusiva è necessario riavviare il computer.
C:\Programmi\Bit Che\Bit_Che.exe
[RILEVAMENTO] Contiene il codice del virus Windows W32/Fipp.A
[NOTA] È stato creato un backup con nome '75dc1e91.qua' ( QUARANTENA )
[AVVISO] Impossibile riparare il file!
[NOTA] Il file è stato selezionato per essere eliminato dopo il riavvio.
[NOTA] Per la riparazione conclusiva è necessario riavviare il computer.
C:\Programmi\BeClean\BeClean.exe
[RILEVAMENTO] Contiene il codice del virus Windows W32/Fipp.A
[NOTA] È stato creato un backup con nome '58f731d0.qua' ( QUARANTENA )
[AVVISO] Impossibile riparare il file!
[NOTA] Il file è stato selezionato per essere eliminato dopo il riavvio.
[NOTA] Per la riparazione conclusiva è necessario riavviare il computer.
C:\Programmi\Unlocker\uninst.exe
[RILEVAMENTO] Contiene il codice del virus Windows W32/Fipp.A
[NOTA] È stato creato un backup con nome '41e10a43.qua' ( QUARANTENA )
[AVVISO] Impossibile riparare il file!
[NOTA] Il file è stato selezionato per essere eliminato dopo il riavvio.
[NOTA] Per la riparazione conclusiva è necessario riavviare il computer.
C:\Programmi\Unlocker\Unlocker.exe
[RILEVAMENTO] Contiene il codice del virus Windows W32/Fipp.A
[NOTA] È stato creato un backup con nome '2dba2673.qua' ( QUARANTENA )
[AVVISO] Impossibile riparare il file!
[NOTA] Il file è stato selezionato per essere eliminato dopo il riavvio.
[NOTA] Per la riparazione conclusiva è necessario riavviare il computer.
C:\Programmi\Unlocker\UnlockerAssistant.exe
[RILEVAMENTO] Contiene il codice del virus Windows W32/Fipp.A
[NOTA] È stato creato un backup con nome '5c031fe6.qua' ( QUARANTENA )
[AVVISO] Impossibile riparare il file!
[NOTA] Il file è stato selezionato per essere eliminato dopo il riavvio.
[NOTA] Per la riparazione conclusiva è necessario riavviare il computer.
C:\Programmi\Haali\MatroskaSplitter\uninstall.exe
[RILEVAMENTO] Contiene il codice del virus Windows W32/Fipp.A
[NOTA] È stato creato un backup con nome '521e2f21.qua' ( QUARANTENA )
[AVVISO] Impossibile riparare il file!
[NOTA] Il file è stato selezionato per essere eliminato dopo il riavvio.
[NOTA] Per la riparazione conclusiva è necessario riavviare il computer.
C:\Programmi\Haali\MatroskaSplitter\gdsmux.exe
[RILEVAMENTO] Contiene il codice del virus Windows W32/Fipp.A
[NOTA] È stato creato un backup con nome '17395669.qua' ( QUARANTENA )
[AVVISO] Impossibile riparare il file!
[NOTA] Il file è stato selezionato per essere eliminato dopo il riavvio.
[NOTA] Per la riparazione conclusiva è necessario riavviare il computer.
C:\Programmi\Skype\Phone\Skype.exe
[RILEVAMENTO] Contiene il codice del virus Windows W32/Fipp.A
[NOTA] È stato creato un backup con nome '1e0c52cb.qua' ( QUARANTENA )
[AVVISO] Impossibile riparare il file!
[NOTA] Il file è stato selezionato per essere eliminato dopo il riavvio.
[NOTA] Per la riparazione conclusiva è necessario riavviare il computer.
C:\Programmi\uTorrent\uTorrent.exe
[RILEVAMENTO] Contiene il codice del virus Windows W32/Fipp.A
[NOTA] È stato creato un backup con nome '46774bd7.qua' ( QUARANTENA )
[AVVISO] Impossibile riparare il file!
[NOTA] Il file è stato selezionato per essere eliminato dopo il riavvio.
[NOTA] Per la riparazione conclusiva è necessario riavviare il computer.


Fine della scansione: lunedì 1 ottobre 2012 21:48
Tempo impiegato: 01:05 Minuto(i)

La scansione è stata completamente eseguita.

0 Directory scansionate
1994 I file sono stati scansionati
16 Rilevati virus e/o programmi indesiderati
0 I file sono stati classificati come sospetti
0 I file sono stati eliminati
0 I virus o i programmi indesiderati sono stati riparati
16 File spostati in quarantena
0 File rinominati
0 Impossibile scansionare i file
1978 File non infetti
23 Archivi scansionati
17 Avvisi
16 Note

Le istruzioni per la riparazione sono state riportate nel file 'C:\avrescue\rescue.avp'.

ho copiato i file in quarantena, oho fatto bene???grazie

[GERONIMO*]

ok
si,lasciali in quarantena,perché secondo me ti conviene reinstallarli quei programmi trovati da Avira
come va ora il pc?
hai risolto o riscontri ancora problemi?

[Or4colo]

Mah per ora il pc sembra funzioni, l'antivirus ora ce l'ho, anche se non sono così sicuro di avere un pc "pulito". Magari mi consigli di fare altre scansioni non saprei.
Per i miei programmi invece (i file .exe), quelli che sono ancora in quarantena in Malwarebytes, che mi consigli di fare? Riportarli alla posizione originale, lasciarli li, cancellarli e riscaricarmi quello che mi serve? Tipo nero, e mule, be clean ecc...Non so nemmeno quanti sono, dovrei ad uno ad uno segnarmeli da quel famoso log che ho postato qui, quello che me li ha spostati praticamente tutti.
Ciao, grazie!

[GERONIMO*]

il pc sembrebbe pulito ora
per precauzione fai uno scan con questo tool
http://support.kaspersky.com/downloads/ ... killer.exe

per i programmi ti conviene riscaricarli ed eliminare tutti quelli dalla quarantena
perché il virus li ha infettati tutti,quindi scaricateli puliti

[Or4colo]

OK Allora procedo così e se sbaglio correggimi pure (mio eroe )
- Elimino i file dalla quarantena di Avira e Malwarebytes, e riavvio il pc.
- Faccio una scansione con kaspersky, e magari posto il log qui.
- Disintallo tutti i programmi trovati infetti da malwarebytes (tipo Winrar, Vanbrasco, Hijackthis ecc) da Start-Impostazioni-Pannello di controllo-Installazione applicazioni.
- Scarico e installo tutti i programmi che avevo o che comunque mi servono. (quelli tipo videocamera, cam ecc li dovro reinstallare con il suo cd).
Dico bene? Grazie del solito supporto! Ciao

[GERONIMO*]

esatto
si il software per la cam volendo lo puoi scaricare anche dal sito del produttore del tuo pc
Acer
http://www.acer.it/ac/it/IT/content/drivers

Asus
http://support.asus.com/download/option ... =en&type=1

Dell
http://support.euro.dell.com/support/to ... l=it&s=gen

HP
http://www8.hp.com/it/it/support-drivers.html

Packard Bell
http://www.packardbell.it/pb/it/IT/content/download

[Or4colo]

Bene, ieri ho iniziato a disintallare qualcosa dal pc. L'unico problema è che appena dopo l'avvio Avira (nuovo antivirus installato) ha riscontrato tipo 150 infezioni, chiaramente ho spostato tutto in quarantena (stasera posto il log). Da quel poco che ne capisco io credo siano tutti quei programmi che già MalwareBytes aveva riconosciuto e spostato in quarantena (qualcuno per prova era stato riportato da me alla sua posizione originale). Ma se Avira mi riscontra il file.exe di Malwarebytes infettato, come posso cancellare la quarantena di MB? Cioè disintallandolo si cancella già in automatico? Forse mi sto incasinando troppo, ma spero che ci capiate qualcosa. Vi tengo aggiornati.Grazie
Ps.la scansione con kaspersky non sono ancora riuscito a farla perché ad ogni riscontro di minaccia Avira fa partire la sua scansione, occupandomi così il pc per diverso tempo.

[GERONIMO*]

ciao
segui in ordine ciò che ti scrivo

1 DISATTIVA AVIRA apri malwarebytes,vai sulla voce Quarantena seleziona tutti gli elementi che vedi e clicca su Elimina tutto

2 poi disinstalli malwarebytes e i programmi infetti
per disinstallare i programmi usa questo software IObit Uninstaller 2 che disinstalla meglio dell'utility di windows
http://www.iobit.com/advanceduninstaller.html

lo installi\lanci imposta la lingua Italiano


poi metti la spunta sulla voce Disinstalla in batch
Disinstalla in batch permette di disinstallare più programmi contemporaneamente
in un colpo solo,basta mettere il segno di spunta su tutti i programmi da disinstallare contemporaneamente,e cliccare su Disinstalla


durante la fine della disinstallazione di un programma,potrebbe uscirti l'avviso che bisogna Riavviare il sistema clicca su NO
Poi ti uscirà una finestra clicca su Scansione approfondita


poi su Seleziona tutti e poi su Elimina


3 Finito di disinstallare i programmi Riavvia il pc

4 A pc riavviato disattiva Avira guard
e lancia il tool di kaspersky per fare la scansione

[Or4colo]

Ok sto procedendo... Per ora posto il log di Avira che mi ha riscontrato ieri. Piu tardi posto quello di Kapestri, appena finisce il tutto. Grazie

All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
Service WDICA stopped successfully!
Service WDICA deleted successfully!
Service PDRFRAME stopped successfully!
Service PDRFRAME deleted successfully!
Service PDRELI stopped successfully!
Service PDRELI deleted successfully!
Service PDFRAME stopped successfully!
Service PDFRAME deleted successfully!
Service PDCOMP stopped successfully!
Service PDCOMP deleted successfully!
Service PCIDump stopped successfully!
Service PCIDump deleted successfully!
Service lbrtfdc stopped successfully!
Service lbrtfdc deleted successfully!
Service i2omgmt stopped successfully!
Service i2omgmt deleted successfully!
Service Changer stopped successfully!
Service Changer deleted successfully!
Service catchme stopped successfully!
Service catchme deleted successfully!
File C:\ComboFix\catchme.sys not found.
Registry key HKEY_USERS\S-1-5-21-1229272821-1390067357-725345543-500\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}\ not found.
Prefs.js: wrc@avast.com:6.0.1289 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}:6.0.25 removed from extensions.enabledItems
Prefs.js: jqs@sun.com:1.0 removed from extensions.enabledItems
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} folder moved successfully.
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Extensions folder moved successfully.
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\44boro8x.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}\defaults\preferences folder moved successfully.
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\44boro8x.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}\defaults folder moved successfully.
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\44boro8x.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}\chrome folder moved successfully.
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\44boro8x.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} folder moved successfully.
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\44boro8x.default\extensions\crossriderapp5060@crossrider.com\skin folder moved successfully.
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\44boro8x.default\extensions\crossriderapp5060@crossrider.com\locale\en-US folder moved successfully.
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\44boro8x.default\extensions\crossriderapp5060@crossrider.com\locale folder moved successfully.
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\44boro8x.default\extensions\crossriderapp5060@crossrider.com\defaults\preferences folder moved successfully.
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\44boro8x.default\extensions\crossriderapp5060@crossrider.com\defaults folder moved successfully.
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\44boro8x.default\extensions\crossriderapp5060@crossrider.com\chrome\content\lib folder moved successfully.
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\44boro8x.default\extensions\crossriderapp5060@crossrider.com\chrome\content folder moved successfully.
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\44boro8x.default\extensions\crossriderapp5060@crossrider.com\chrome folder moved successfully.
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\44boro8x.default\extensions\crossriderapp5060@crossrider.com folder moved successfully.
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\44boro8x.default\extensions folder moved successfully.
Folder C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\44boro8x.default\extensions\crossriderapp5060@crossrider.com\ not found.
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\44boro8x.default\searchplugins\askcom.xml moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\zh-TW folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\zh-CN folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\sv-SE folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\ko-KR folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\ja-JP folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\it-IT folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\fr-FR folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\es-ES folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\en-US folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale\de-DE folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\locale folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\content\ffjcext folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome\content folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\chrome folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\chrome\icons\default folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\chrome\icons folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\chrome folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} folder moved successfully.
C:\Programmi\Mozilla Firefox\extensions folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\skin\png folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\skin\icons folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\skin\ico 24x24px folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\skin\ico 16x16px folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\skin folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\zh-TW folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\zh-CN folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\vi-VN folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\ur-PK folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\uk-UA folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\tr-TR folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\th-TH folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\sv-SE folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\sl-SI folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\sk-SK folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\ru-RU folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\ro-RO folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\pt-PT folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\pt-BR folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\pl-PL folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\nl-NL folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\nb-NO folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\ko-KR folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\ja-JP folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\it-IT folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\id-ID folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\hu-HU folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\hr-HR folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\he-IL folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\fr-FR folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\fi-FI folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\et-EE folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\es-ES folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\en-US folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\en-GB folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\el-GR folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\de-DE folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\da-DK folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\cs-CZ folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\ca-ES folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\bg-BG folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\be-BY folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale\ar-SA folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\locale folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\defaults\preferences folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\defaults folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF\content folder moved successfully.
C:\PROGRAMMI\AVAST SOFTWARE\AVAST\WEBREP\FF folder moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry value HKEY_USERS\S-1-5-21-1229272821-1390067357-725345543-500\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{4B3803EA-5230-4DC3-A7FC-33638F3D3542} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}\ not found.
Registry value HKEY_USERS\S-1-5-21-1229272821-1390067357-725345543-500\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{4B3803EA-5230-4DC3-A7FC-33638F3D3542} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\avast deleted successfully.
C:\Programmi\AVAST Software\Avast\AvastUI.exe moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\HonorAutoRunSetting deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDrives deleted successfully.
Registry key HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun deleted successfully.
Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoFavoritesMenu deleted successfully.
Registry key HKEY_USERS\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found.
Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun not found.
Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoFavoritesMenu not found.
Registry key HKEY_USERS\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry value HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1229272821-1390067357-725345543-500\Software\Policies\Microsoft\Internet Explorer\Control Panel\ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1229272821-1390067357-725345543-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1229272821-1390067357-725345543-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1229272821-1390067357-725345543-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDrives deleted successfully.
C:\Documents and Settings\All Users\Menu Avvio\Programmi\avast! Free Antivirus folder moved successfully.
C:\WINDOWS\system32\aswBoot.exe moved successfully.
C:\Programmi\AVAST Software\Avast\WebRep\Safari folder moved successfully.
C:\Programmi\AVAST Software\Avast\WebRep\Opera folder moved successfully.
C:\Programmi\AVAST Software\Avast\WebRep\Chrome folder moved successfully.
C:\Programmi\AVAST Software\Avast\WebRep folder moved successfully.
C:\Programmi\AVAST Software\Avast\Setup\INF folder moved successfully.
C:\Programmi\AVAST Software\Avast\Setup folder moved successfully.
C:\Programmi\AVAST Software\Avast\License folder moved successfully.
C:\Programmi\AVAST Software\Avast\flash\ammap\maps folder moved successfully.
C:\Programmi\AVAST Software\Avast\flash\ammap\icons folder moved successfully.
C:\Programmi\AVAST Software\Avast\flash\ammap folder moved successfully.
C:\Programmi\AVAST Software\Avast\flash folder moved successfully.
C:\Programmi\AVAST Software\Avast\defs\12082100 folder moved successfully.
C:\Programmi\AVAST Software\Avast\defs folder moved successfully.
C:\Programmi\AVAST Software\Avast\1040 folder moved successfully.
C:\Programmi\AVAST Software\Avast folder moved successfully.
C:\Programmi\AVAST Software folder moved successfully.
C:\WINDOWS\avastSS.scr moved successfully.
C:\Documents and Settings\Administrator\Desktop\aswclear.exe moved successfully.
C:\TDSSKiller_Quarantine\18.09.2012_00.16.37\mbr0000\mbr0000 folder moved successfully.
C:\TDSSKiller_Quarantine\18.09.2012_00.16.37\mbr0000 folder moved successfully.
C:\TDSSKiller_Quarantine\18.09.2012_00.16.37 folder moved successfully.
C:\TDSSKiller_Quarantine folder moved successfully.
C:\WINDOWS\tasks\avast! Emergency Update.job moved successfully.
File C:\Documents and Settings\Administrator\Desktop\aswclear.exe not found.
File C:\WINDOWS\tasks\avast! Emergency Update.job not found.
C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\WPFFontCache_v0400-S-1-5-21-1229272821-1390067357-725345543-500-0.dat moved successfully.
C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\WPFFontCache_v0400-System.dat moved successfully.
========== REGISTRY ==========
HKEY_USERS\S-1-5-21-1229272821-1390067357-725345543-500\SOFTWARE\Classes\<extension>\\.html [@ | htmlfile] -- Reg Error: Key error. File not found /E :invalid edit format. Invalid data type.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List\\3389:TCP deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List\\1900:UDP not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List\\2869:TCP not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\\avast not found.
========== FILES ==========
< ipconfig /flushdns /c >
Configurazione IP di Windows
Svuotata la cache del resolver DNS.
C:\Documents and Settings\Administrator\Desktop\cmd.bat deleted successfully.
C:\Documents and Settings\Administrator\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 223616290 bytes
->Temporary Internet Files folder emptied: 55783431 bytes
->Java cache emptied: 13 bytes
->FireFox cache emptied: 83064445 bytes
->Flash cache emptied: 1112 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: HelpAssistant
->Temp folder emptied: 4446701 bytes
->Temporary Internet Files folder emptied: 119775827 bytes
->Java cache emptied: 15790 bytes
->FireFox cache emptied: 32853042 bytes
->Flash cache emptied: 52093 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 35562 bytes
->Flash cache emptied: 12554 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2133872 bytes
%systemroot%\System32 .tmp files removed: 2885 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 1077120 bytes
Windows Temp folder emptied: 1778545 bytes
RecycleBin emptied: 640 bytes

Total Files Cleaned = 501,00 mb


[EMPTYJAVA]

User: Administrator
->Java cache emptied: 0 bytes

User: All Users

User: Default User

User: HelpAssistant
->Java cache emptied: 0 bytes

User: LocalService

User: NetworkService
->Java cache emptied: 0 bytes

Total Java Files Cleaned = 0,00 mb

C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYFLASH]

User: Administrator
->Flash cache emptied: 0 bytes

User: All Users

User: Default User

User: HelpAssistant
->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0,00 mb

Unable to stop System Restore Service. Error code 1722. Restore points not cleared.
Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.69.0 log created on 10012012_185437

Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\Administrator\Impostazioni locali\Temporary Internet Files\Content.IE5\NVY37FP7\viewtopic[1].htm not found!
File\Folder C:\Documents and Settings\Administrator\Impostazioni locali\Temporary Internet Files\Content.IE5\17A8148A\dis[1].htm not found!
File\Folder C:\Documents and Settings\Administrator\Impostazioni locali\Temporary Internet Files\Content.IE5\17A8148A\eas[1].htm not found!
File\Folder C:\Documents and Settings\Administrator\Impostazioni locali\Temporary Internet Files\Content.IE5\17A8148A\likebox[1].htm not found!
C:\Documents and Settings\Administrator\Impostazioni locali\Temporary Internet Files\Content.IE5\17A8148A\xcid,qmqHHmy1Ft6hpN5ygibZCsecxvIhle7Qber_Wzb0LmoBfKo4eS1N1bvVhlvi7e9u[1].htm moved successfully.
C:\Documents and Settings\Administrator\Impostazioni locali\Temporary Internet Files\Content.IE5\10Q9J96O\autoscout24_it[1].htm moved successfully.
C:\Documents and Settings\Administrator\Impostazioni locali\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

[Or4colo]

Ok kaspersky ha fatto la sua scansione. ma non ha lasciato il log, o almeno io non lo vedo :) comunque ha trovato 54 file, e se ho visto bene erano tutti punti di ripristino, cioè in C volum system restore o qualcosa del genere. Ma non li avevamo cancellati? Mah. Comunque ora posso procedere a reintallare i miei programmi? Grazie

[GERONIMO*]

ciao aspetta c'è ancora il virus

fai quete operazioni
clicca su start poi Esegui
nella casella di testo copia\incolla questo comando
control userpasswords2
e dai ok


nell'elenco degli account cancella questo account
HelpAssistant e altri account se ci con nomi strani o che non hai creato tu
selezionali e clicca su Cancella dai applica -ok
Riavvia il pc

se il ripristino di configurazione di sistema è attivo
disattivalo e Riavvia il pc
http://support.microsoft.com/kb/310405/it

poi scarica (mbr.exe)
http://www2.gmer.net/mbr/mbr.exe
salvalo direttamente in disco locale C non sul Desktop

Entra in modalità provvisoria
apri il prompt dei comandi Start-Esegui e digita cmd dai ok


nel prompt di commando
digita C:\mbr.exe e premi invio sulla tastiera
attendi la fine
apparirà un log postalo sul forum

[Or4colo]

ok grazie Geronimo, come sempre presente! Appena ho un attimo a casa provo a fare tutto. Se hai un secondo dai un occhio all'altro post che ho messo, o tu o qualche altro adm, faccio di quei casini con sti pc... uff Grazie

[GERONIMO*]

[Or4colo]

CHE IDIOTA! Sono fuso, non ricordavo più che ieri poi mi sono messo ad installare qualcosa (ops, dovevo aspettare la tua conferma!!!) tipo MalwareBytes, Adobe reader, ccleaner e non so che altro. Dici sia meglio disintallarli con IObit, e poi fare quella cosa con MBR oppure non creano problemi, in fondo i file li avevo riscaricati puliti ed in effetti Avira non mi ha segnalato nulla di sospetto...Scusa ormai sono un assillo! Prima o dopo però so che ce la faremo :-) Grazie

[GERONIMO*]

fa niente non disinstallarli
continua con le operazioni

[Or4colo]

Ok allora ho fatto la procedura, ho cancellato un account che si chiamava ASPNET che di sicuro non avevo inserito io (Help assistant non c'era). In mod provvisoria però ho provato a lanciar MBR ma non è partita la scansione. Mi ha detto delle cose, ho salvato una finestra.se riesco posto l'immagine o copio che c'è scritto

[Or4colo]

Come si caricano le immagini???