www.MegaLab.it

da **lollo40** » mer set 30, 2009 11:16 pm

ragazzi, scusate, ma ho installato questo programma credendolo un prodotto microsoft (aveva anche il logo) purtroppo mi blocca tutto il pc, non riesco a far funzionare neanche malwarebytes e avira non mi segnala nulla. vi allego la scansione di Hjiiackthis vi sarei grata di un consiglio.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 0.02.40, on 01/10/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Avira\AntiVir Desktop\sched.exe
C:\Programmi\Avira\AntiVir Desktop\avguard.exe
C:\Programmi\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Avira\AntiVir Desktop\avmailc.exe
C:\Programmi\Avira\AntiVir Desktop\AVWEBGRD.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Programmi\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\sistray.EXE
C:\PROGRA~1\ALICET~1\SMARTB~1\MotiveSB.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\LClock\lclock.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\TS\tsc.exe
C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
C:\Programmi\Glass2k\Glass2k.exe
C:\Programmi\Alice ti aiuta\bin\mpbtn.exe
C:\Programmi\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1040
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7171
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;192.168.1.1;*.local;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: MSN helper - {1F54D346-5778-46D5-BA44-F934B15BD8D6} - ploj0.dll (file missing)
O2 - BHO: &IE Help - {35A5B43B-CB8A-49CA-A9F4-D3B308D2E3CC} - C:\WINDOWS\system32\iehelpmod.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar.dll
O3 - Toolbar: (no name) - {1DBAB667-A486-421e-AFE4-CF07DD0088E5} - (no file)
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programmi\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\sisUSBrg.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programmi\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SiS Tray] C:\WINDOWS\system32\sistray.EXE
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\ALICET~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [calc] rundll32.exe C:\WINDOWS\system32\calc.dll,_IWMPEvents@0
O4 - HKCU\..\Run: [LClock] C:\Programmi\LClock\lclock.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [calc] rundll32.exe C:\DOCUME~1\GRISHN~1\protect.dll,_IWMPEvents@0
O4 - HKCU\..\Run: [TS] C:\Programmi\TS\tsc.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [LClock] C:\Programmi\LClock\LClock.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [calc] rundll32.exe C:\WINDOWS\system32\config\SYSTEM~1\protect.dll,_IWMPEvents@0 (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [mserv] C:\WINDOWS\system32\config\systemprofile\Dati applicazioni\seres.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [svchost] C:\WINDOWS\system32\config\systemprofile\Dati applicazioni\svcst.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User sYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - S-1-5-18 Startup: glass2k.exe.lnk = C:\Programmi\Glass2k\Glass2k.exe (User 'SYSTEM')
O4 - S-1-5-18 Startup: scandisk.lnk = ? (User 'SYSTEM')
O4 - .DEFAULT Startup: glass2k.exe.lnk = C:\Programmi\Glass2k\Glass2k.exe (User 'Default user')
O4 - .DEFAULT Startup: scandisk.lnk = ? (User 'Default user')
O4 - .DEFAULT User Startup: glass2k.exe.lnk = C:\Programmi\Glass2k\Glass2k.exe (User 'Default user')
O4 - Startup: glass2k.exe.lnk = C:\Programmi\Glass2k\Glass2k.exe
O4 - Startup: scandisk.lnk = ?
O4 - Global Startup: Alice ti aiuta.lnk = C:\Programmi\Alice ti aiuta\bin\matcli.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Google Search - res://C:\Programmi\Google\googletoolbar.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Programmi\Google\googletoolbar.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Programmi\Google\googletoolbar.dll/cmcache.html
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\Programmi\Google\googletoolbar.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Programmi\Google\googletoolbar.dll/cmtrans.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Programmi/Escape%20Rosecliff%20Island/Images/stg_drm.ocx
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira Firewall (AntiVirFirewallService) - Avira GmbH - C:\Programmi\Avira\AntiVir Desktop\avfwsvc.exe
O23 - Service: Avira AntiVir MailGuard (AntiVirMailService) - Avira GmbH - C:\Programmi\Avira\AntiVir Desktop\avmailc.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Programmi\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programmi\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Avira AntiVir WebGuard (AntiVirWebService) - Avira GmbH - C:\Programmi\Avira\AntiVir Desktop\AVWEBGRD.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun microsystems, Inc. - C:\Programmi\Java\jre6\bin\jqs.exe
O23 - Service: LEC TranslateDotNet Server - Unknown owner - C:\Programmi\Power Translator 11\LogoMedia TranslateDotNet Server.exe (file missing)
O23 - Service: NMIndexingService - Nero AG - C:\Programmi\File comuni\Ahead\Lib\NMIndexingService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 8559 bytes

da **crazy.cat** » gio ott 01, 2009 7:17 am

Si vedono un sacco di problemi, fai una scansione con superantispyware e poi posta il log di combofix.

da **lollo40** » gio ott 01, 2009 1:12 pm

ciao crazt cat e grazie dell'attenzione. ho fatto a scansione, ma combi fix non riesco a farlo partire: mi spiego ci clicco sopra parte il loding e poi basta. cosa devo fare?

da **crazy.cat** » gio ott 01, 2009 1:23 pm

Prova a riscarica combofix rinominandolo con un nome qualsiasi.
Se proprio non parte rifai il log di hijackthis magari incollandolo un po meglio di prima che era illeggibile.

da **lollo40** » gio ott 01, 2009 1:33 pm

ho riprovato combo, ma non succede nulla. ti mando l'Hijackthis sperando si veda meglio.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14.37.05, on 01/10/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Avira\AntiVir Desktop\sched.exe
C:\Programmi\Avira\AntiVir Desktop\avguard.exe
C:\Programmi\Java\jre6\bin\jqs.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\sistray.EXE
C:\PROGRA~1\ALICET~1\SMARTB~1\MotiveSB.exe
C:\Programmi\LClock\lclock.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
C:\Programmi\Glass2k\Glass2k.exe
C:\Programmi\Alice ti aiuta\bin\mpbtn.exe
C:\Programmi\Avira\AntiVir Desktop\avmailc.exe
C:\Programmi\Avira\AntiVir Desktop\AVWEBGRD.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Programmi\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\notepad.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1040
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7171
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;192.168.1.1;*.local;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar.dll
O3 - Toolbar: (no name) - {1DBAB667-A486-421e-AFE4-CF07DD0088E5} - (no file)
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programmi\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\sisUSBrg.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programmi\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SiS Tray] C:\WINDOWS\system32\sistray.EXE
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\ALICET~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [calc] rundll32.exe C:\WINDOWS\system32\calc.dll,_IWMPEvents@0
O4 - HKCU\..\Run: [LClock] C:\Programmi\LClock\lclock.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [calc] rundll32.exe C:\DOCUME~1\GRISHN~1\protect.dll,_IWMPEvents@0
O4 - HKCU\..\Run: [TS] C:\Programmi\TS\tsc.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [LClock] C:\Programmi\LClock\LClock.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [calc] rundll32.exe C:\WINDOWS\system32\config\SYSTEM~1\protect.dll,_IWMPEvents@0 (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [mserv] C:\WINDOWS\system32\config\systemprofile\Dati applicazioni\seres.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [svchost] C:\WINDOWS\system32\config\systemprofile\Dati applicazioni\svcst.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - S-1-5-18 Startup: glass2k.exe.lnk = C:\Programmi\Glass2k\Glass2k.exe (User 'SYSTEM')
O4 - S-1-5-18 Startup: scandisk.lnk = ? (User 'SYSTEM')
O4 - .DEFAULT Startup: glass2k.exe.lnk = C:\Programmi\Glass2k\Glass2k.exe (User 'Default user')
O4 - .DEFAULT Startup: scandisk.lnk = ? (User 'Default user')
O4 - .DEFAULT User Startup: glass2k.exe.lnk = C:\Programmi\Glass2k\Glass2k.exe (User 'Default user')
O4 - Startup: glass2k.exe.lnk = C:\Programmi\Glass2k\Glass2k.exe
O4 - Startup: scandisk.lnk = ?
O4 - Global Startup: Alice ti aiuta.lnk = C:\Programmi\Alice ti aiuta\bin\matcli.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Google Search - res://C:\Programmi\Google\googletoolbar.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Programmi\Google\googletoolbar.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Programmi\Google\googletoolbar.dll/cmcache.html
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\Programmi\Google\googletoolbar.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Programmi\Google\googletoolbar.dll/cmtrans.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Programmi/Escape%20Rosecliff%20Island/Images/stg_drm.ocx
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0B0F49B7-8B89-492A-B788-C3C5A9C9B45D}: NameServer = 85.37.17.6 85.38.28.89
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Programmi\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Avira Firewall (AntiVirFirewallService) - Avira GmbH - C:\Programmi\Avira\AntiVir Desktop\avfwsvc.exe
O23 - Service: Avira AntiVir MailGuard (AntiVirMailService) - Avira GmbH - C:\Programmi\Avira\AntiVir Desktop\avmailc.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Programmi\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programmi\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Avira AntiVir WebGuard (AntiVirWebService) - Avira GmbH - C:\Programmi\Avira\AntiVir Desktop\AVWEBGRD.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmi\Java\jre6\bin\jqs.exe
O23 - Service: LEC TranslateDotNet Server - Unknown owner - C:\Programmi\Power Translator 11\LogoMedia TranslateDotNet Server.exe (file missing)
O23 - Service: NMIndexingService - Nero AG - C:\Programmi\File comuni\Ahead\Lib\NMIndexingService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: sscSched - Unknown owner - C:\WINDOWS\system32\sscsched.exe

--
End of file - 8904 bytes

da **crazy.cat** » gio ott 01, 2009 2:10 pm

Fai analizzare su www.virustotal.com questi due file C:\WINDOWS\system32\calc.dll, C:\WINDOWS\system32\sscsched.exe
Non è chiaro se sono dei virus, in base al risultato li aggiungi nello script qui sotto dopo la riga File to delete:

Scarica Avenger
Estrailo in una cartella a tua scelta
Esegui il file avenger.exe con la figura di una spada
Ora incolla queste righe nel box bianco che si è aperto:

Codice: Seleziona tutto: Files to delete: C:\DOCUME~1\GRISHN~1\protect.dll C:\Programmi\TS\tsc.exe C:\WINDOWS\system32\config\SYSTEM~1\protect.dll C:\WINDOWS\system32\config\systemprofile\Dati applicazioni\seres.exe C:\WINDOWS\system32\config\systemprofile\Dati applicazioni\svcst.exe

Togli il segno di spunta dalla voce Scan for Rootkits
Premi il pulsante Execute
Rispondi di Si alle due richieste di Avenger
Adesso il tuo computer dovrebbe riavviarsi, nel caso non succedesse, riavvialo tu manualmente
Al riavvio del computer, copia e incolla qui il contenuto del blocco note che apparirà.

Dopo il riavvio, rifai la scansione con hijackthis e selezioni le caselle di queste righe e premi fix checked per eliminarle.
O4 - HKLM\..\Run: [calc] rundll32.exe C:\WINDOWS\system32\calc.dll,_IWMPEvents@0 (solo se l'analisi dice che è un virus)
O4 - HKCU\..\Run: [calc] rundll32.exe C:\DOCUME~1\GRISHN~1\protect.dll,_IWMPEvents@0
O4 - HKCU\..\Run: [TS] C:\Programmi\TS\tsc.exe
O4 - HKUS\S-1-5-18\..\Run: [calc] rundll32.exe C:\WINDOWS\system32\config\SYSTEM~1\protect.dll,_IWMPEvents@0 (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [mserv] C:\WINDOWS\system32\config\systemprofile\Dati applicazioni\seres.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [svchost] C:\WINDOWS\system32\config\systemprofile\Dati applicazioni\svcst.exe (User 'SYSTEM')

Poi riprovi anche malwarebytes per vedere se parte e se è rimasto qualche altra schifezza.

da **lollo40** » gio ott 01, 2009 2:59 pm

ti mando i risultati di virus total. li devo aggiungere? se si come?

Informazioni addizionali
File size: 64 bytes
MD5 : 70a1973404b267feb22ddd8fce1cfbda
SHA1 : 0d2e9f0dbe94775b584c3530e143f0924e7e798f
SHA256: 33fdd2e022448c32dd11cb9e439ca988960c89fd13118a238e6bd89eb5cd678c
TrID : File type identification
Unknown!
ssdeep: 3:oN3JcWtXB5fN3JcWt2BJn:oRLh5LYBJ
PEiD : -
RDS : NSRL Reference Data Set

grazie

da **crazy.cat** » gio ott 01, 2009 3:05 pm

lollo40 ha scritto:ti mando i risultati di virus total. li devo aggiungere? se si come?

Riprovaci, qualcosa non ha funzionato.
Deve analizzarli e deve darti un report finale.

da **lollo40** » gio ott 01, 2009 3:11 pm

File programmi.txt ricevuto il 2009.10.01 13:45:17 (UTC
Stato corrente: finito
Risultato: 0/41 (0.00%)
Formattato Formattato
Stampa risultati Stampa risultati
Antivirus Versione Ultimo aggiornamento Risultato
a-squared 4.5.0.24 2009.10.01 -
AhnLab-V3 5.0.0.2 2009.10.01 -
AntiVir 7.9.1.27 2009.10.01 -
Antiy-AVL 2.0.3.7 2009.10.01 -
Authentium 5.1.2.4 2009.10.01 -
Avast 4.8.1351.0 2009.09.30 -
AVG 8.5.0.412 2009.10.01 -
BitDefender 7.2 2009.10.01 -
CAT-QuickHeal 10.00 2009.09.30 -
ClamAV 0.94.1 2009.10.01 -
Comodo 2483 2009.10.01 -
DrWeb 5.0.0.12182 2009.10.01 -
eSafe 7.0.17.0 2009.09.30 -
eTrust-Vet 31.6.6771 2009.10.01 -
F-Prot 4.5.1.85 2009.10.01 -
F-Secure 8.0.14470.0 2009.10.01 -
Fortinet 3.120.0.0 2009.10.01 -
GData 19 2009.10.01 -
Ikarus T3.1.1.72.0 2009.10.01 -
Jiangmin 11.0.800 2009.09.27 -
K7AntiVirus 7.10.857 2009.09.30 -
Kaspersky 7.0.0.125 2009.10.01 -
McAfee 5757 2009.09.30 -
McAfee+Artemis 5757 2009.09.30 -
McAfee-GW-Edition 6.8.5 2009.10.01 -
Microsoft 1.5101 2009.10.01 -
NOD32 4473 2009.10.01 -
Norman 6.01.09 2009.09.30 -
nProtect 2009.1.8.0 2009.10.01 -
Panda 10.0.2.2 2009.10.01 -
PCTools 4.4.2.0 2009.10.01 -
Prevx 3.0 2009.10.01 -
Rising 21.49.22.00 2009.09.30 -
Sophos 4.45.0 2009.10.01 -
Sunbelt 3.2.1858.2 2009.09.30 -
Symantec 1.4.4.12 2009.10.01 -
TheHacker 6.5.0.2.024 2009.10.01 -
TrendMicro 8.950.0.1094 2009.10.01 -
VBA32 3.12.10.11 2009.09.30 -
ViRobot 2009.10.1.1967 2009.10.01 -
VirusBuster 4.6.5.0 2009.09.30 -
Informazioni addizionali
File size: 64 bytes
MD5 : 70a1973404b267feb22ddd8fce1cfbda
SHA1 : 0d2e9f0dbe94775b584c3530e143f0924e7e798f
SHA256: 33fdd2e022448c32dd11cb9e439ca988960c89fd13118a238e6bd89eb5cd678c
TrID : File type identification
Unknown!
ssdeep: 3:oN3JcWtXB5fN3JcWt2BJn:oRLh5LYBJ
PEiD : -
RDS : NSRL Reference Data Set
-ATENTION

va bene così? non so se sono i due file che mi hai detto (non ci capisco niente)

da **crazy.cat** » gio ott 01, 2009 3:15 pm

lollo40 ha scritto:va bene così?

No è il File programmi.txt che gli hai spedito.
Tramite il browse della pagina web che ti ho indicato devi andare a selezionare le cartelle contenenti i due file e caricarli.
http://www.MegaLab.it/2425/controllo-on ... volta-sola

da **lollo40** » gio ott 01, 2009 3:42 pm

ho capito, scusa. ho fatto la scansiome e te la mando. però non riesco a trovare il file C:\WINDOWS\sistem 32\call.dll. ho provato anche con cerca, ma zero. quando ho cercato l'sscsched.exe avira me lo segnala come cavallo di troia

File sscsched.exe ricevuto il 2009.08.11 18:37:19 (UTC)
Antivirus Versione Ultimo aggiornamento Risultato
a-squared 4.5.0.24 2009.08.11 Win32.SuspectCrc!IK
AhnLab-V3 5.0.0.2 2009.08.11 Win-Trojan/Agent.8192.Z
AntiVir 7.9.1.0 2009.08.11 TR/Drop.Agent.cck
Antiy-AVL 2.0.3.7 2009.08.11 -
Authentium 5.1.2.4 2009.08.11 -
Avast 4.8.1335.0 2009.08.10 -
AVG 8.5.0.406 2009.08.11 -
BitDefender 7.2 2009.08.11 -
CAT-QuickHeal 10.00 2009.08.11 (Suspicious) - DNAScan
ClamAV 0.94.1 2009.08.11 -
Comodo 1945 2009.08.11 -
DrWeb 5.0.0.12182 2009.08.11 -
eSafe 7.0.17.0 2009.08.11 Win32.Banker
eTrust-Vet 31.6.6672 2009.08.11 -
F-Prot 4.4.4.56 2009.08.10 -
F-Secure 8.0.14470.0 2009.08.11 -
Fortinet 3.120.0.0 2009.08.11 -
GData 19 2009.08.11 -
Ikarus T3.1.1.64.0 2009.08.11 Win32.SuspectCrc
Jiangmin 11.0.800 2009.08.11 -
K7AntiVirus 7.10.816 2009.08.11 -
Kaspersky 7.0.0.125 2009.08.11 -
McAfee 5706 2009.08.11 -
McAfee+Artemis 5706 2009.08.11 Artemis!CCC3C0B4411B
McAfee-GW-Edition 6.8.5 2009.08.11 Trojan.Drop.Agent.cck
Microsoft 1.4903 2009.08.11 -
NOD32 4326 2009.08.11 -
Norman 6.01.09 2009.08.11 -
nProtect 2009.1.8.0 2009.08.11 -
Panda 10.0.0.14 2009.08.11 -
PCTools 4.4.2.0 2009.08.11 -
Prevx 3.0 2009.08.11 High Risk Worm
Rising 21.42.14.00 2009.08.11 -
Sophos 4.44.0 2009.08.11 -
Sunbelt 3.2.1858.2 2009.08.11 Trojan-Dropper.Win32.Agent
Symantec 1.4.4.12 2009.08.11 -
TheHacker 6.3.4.3.380 2009.08.11 -
TrendMicro 8.950.0.1094 2009.08.11 -
VBA32 3.12.10.9 2009.08.10 -
ViRobot 2009.8.11.1879 2009.08.11 -
VirusBuster 4.6.5.0 2009.08.11 -
Informazioni addizionali
File size: 4608 bytes
MD5   : ccc3c0b4411bb5bdf7e89fe5ac757124
SHA1  : c8aa5bc0d7ae0605fdbd88472250230e41e073c4
SHA256: 288cdbbce5f50f904f699baad30f89d49d6185d4833abad4ae9a1693d4206e68
PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x1136 timedatestamp.....: 0x43676346 (Tue Nov 1 13:44:54 2005) machinetype.......: 0x14C (Intel I386) ( 2 sections ) name viradd virsiz rawdsiz ntrpy md5 .data 0x1000 0x7BA 0x800 5.40 abe1f011a63cac5ddd9c06015c50b968 .rsrc 0x2000 0x541 0x600 3.07 00eac4211629b17f47a560ea594e4f13 ( 4 imports ) > kernel32.dll: HeapAlloc, GetCommandLineA, GetTempPathA, FindResourceA, LoadResource, LockResource, DeleteFileA, WaitForSingleObject, CreateProcessA, CloseHandle, WriteFile, CreateFileA, GetModuleFileNameA, GetTickCount, GetProcessHeap > msvcrt.dll: strlen, _strlwr, strcpy, strcat, strcmp > shlwapi.dll: StrToIntA > user32.dll: GetForegroundWindow, MessageBoxA, LoadStringA, wsprintfA ( 0 exports ) 
TrID  : File type identification Win32 Executable Generic (42.3%) Win32 Dynamic Link Library (generic) (37.6%) Generic Win/DOS Executable (9.9%) DOS Executable Generic (9.9%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
ssdeep: 48:iOGKwzQ88xY0kjCV7tIxK2ajkldelAqz4bhrHety9U8ZWqocz8wO5Wwd:pm/0kGV2/wUdSGhjlWtA8wOWw
Prevx Info: <a tooltip="linkalert-tip" href="http://info.prevx.com/aboutprogramtext.asp?PX5=023E60DC0012971212DF000E94B718009B91F912" target="_blank">http://info.prevx.com/aboutprogramtext.asp?PX5=023E60DC0012971212DF000E94B718009B91F912</a>
PEiD  : -
packers (Kaspersky): WScript
CWSandbox: <a tooltip="linkalert-tip" href="http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=ccc3c0b4411bb5bdf7e89fe5ac757124" target="_blank">http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=ccc3c0b4411bb5bdf7e89fe5ac757124</a>
RDS   : NSRL Reference Data Set -

da **lollo40** » gio ott 01, 2009 3:49 pm

ciao crazy-cat, ho trovato il file" call.dl" è nella quarantena di avira. cosa faccio? grazie

da **crazy.cat** » gio ott 01, 2009 5:27 pm

Segui le istruzioni che ti avevo dato in precedenza.

da **lollo40** » gio ott 01, 2009 10:25 pm

ciao crazy-cat, scusa il ritardo. ho fatto come mi hai detto con avenger, però non mi ha dato nessun risultato dopo il riavvio del pc. ho fatto la scansione con malwarebyte e eliminato quanto mi diceva. ti mando la scansione di hjiackthis fatta per ultima.
non mi è riuscito di mettere i due file in avenger, come devo fare? uno è nella quarantena di avira. spero di aver fatto tutto per bene e ti ringrazio davvero tanto per la pazienza.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23.22.24, on 01/10/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Avira\AntiVir Desktop\sched.exe
C:\Programmi\Avira\AntiVir Desktop\avguard.exe
C:\Programmi\Java\jre6\bin\jqs.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\sistray.EXE
C:\PROGRA~1\ALICET~1\SMARTB~1\MotiveSB.exe
C:\Programmi\LClock\lclock.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
C:\Programmi\Glass2k\Glass2k.exe
C:\Programmi\Avira\AntiVir Desktop\avmailc.exe
C:\Programmi\Avira\AntiVir Desktop\AVWEBGRD.EXE
C:\Programmi\Alice ti aiuta\bin\mpbtn.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Programmi\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1040
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7171
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;192.168.1.1;*.local;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar.dll
O3 - Toolbar: (no name) - {1DBAB667-A486-421e-AFE4-CF07DD0088E5} - (no file)
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programmi\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\sisUSBrg.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programmi\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SiS Tray] C:\WINDOWS\system32\sistray.EXE
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\ALICET~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Programmi\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [LClock] C:\Programmi\LClock\lclock.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] C:\Programmi\DAEMON Tools Lite\daemon.exe -autorun
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [LClock] C:\Programmi\LClock\LClock.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - S-1-5-18 Startup: glass2k.exe.lnk = C:\Programmi\Glass2k\Glass2k.exe (User 'SYSTEM')
O4 - S-1-5-18 Startup: scandisk.lnk = ? (User 'SYSTEM')
O4 - .DEFAULT Startup: glass2k.exe.lnk = C:\Programmi\Glass2k\Glass2k.exe (User 'Default user')
O4 - .DEFAULT Startup: scandisk.lnk = ? (User 'Default user')
O4 - .DEFAULT User Startup: glass2k.exe.lnk = C:\Programmi\Glass2k\Glass2k.exe (User 'Default user')
O4 - Startup: glass2k.exe.lnk = C:\Programmi\Glass2k\Glass2k.exe
O4 - Startup: scandisk.lnk = ?
O4 - Global Startup: Alice ti aiuta.lnk = C:\Programmi\Alice ti aiuta\bin\matcli.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Google Search - res://C:\Programmi\Google\googletoolbar.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Programmi\Google\googletoolbar.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Programmi\Google\googletoolbar.dll/cmcache.html
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\Programmi\Google\googletoolbar.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Programmi\Google\googletoolbar.dll/cmtrans.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Programmi/Escape%20Rosecliff%20Island/Images/stg_drm.ocx
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Programmi\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Avira Firewall (AntiVirFirewallService) - Avira GmbH - C:\Programmi\Avira\AntiVir Desktop\avfwsvc.exe
O23 - Service: Avira AntiVir MailGuard (AntiVirMailService) - Avira GmbH - C:\Programmi\Avira\AntiVir Desktop\avmailc.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Programmi\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programmi\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Avira AntiVir WebGuard (AntiVirWebService) - Avira GmbH - C:\Programmi\Avira\AntiVir Desktop\AVWEBGRD.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmi\Java\jre6\bin\jqs.exe
O23 - Service: LEC TranslateDotNet Server - Unknown owner - C:\Programmi\Power Translator 11\LogoMedia TranslateDotNet Server.exe (file missing)
O23 - Service: NMIndexingService - Nero AG - C:\Programmi\File comuni\Ahead\Lib\NMIndexingService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: sscSched - Unknown owner - C:\WINDOWS\system32\sscsched.exe

--
End of file - 8275 bytes

da **crazy.cat** » ven ott 02, 2009 12:15 pm

qualcosa è sparito, come va il pc adesso?

da **lollo40** » ven ott 02, 2009 1:07 pm

ciao crazy, il pc va abbastanza bene, è un po' lentino. posso migliorarlo?

www.MegaLab.it

total security

total security

Re: total security

Re: total security

Re: total security

Re: total security

Re: total security

Re: total security

Re: total security

Re: total security

Re: total security

Re: total security

Re: total security

Re: total security

Re: total security

Re: total security

Re: total security

Chi c’è in linea