virus

[intermario87]

ragazzi ciao a tutti..
l'altro giorno una mia amica mi ha inviato una mail su facebook contente un video...siccome ho un pc nuovo e pensavo che ci volesse una versione di flashplayer piu aggiornata ho scaricato il file che mi veniva chiesto di scaricare...
GRANDE CAVOLATA
il mio pc ha cominciato ad aprire pagine a caso contenete siti porno o siti di sicurezza
fortunatamente ho scovato il file dannoso e ora questo problema nn ce l'ho piu
ma ce ne sono altri:
- quando navigo la connessione mi si è rallentata di parecchio e in piu nn posso aprire tutti i siti, soprattutto quelli contenenti antivirus;
- in piu alle volte quando navigo e inserisco qualche indirizzo web il browser mi carica pagine che io nn ho richiesto;

ragazzi vi prego aiutatemi...ho un notebook toshiba da un mese e nn ho voglia di riformattare tutto
il sistema operativo è windows 7 e come browser uso firefox.
vi prego aiutatemi
grazie mille

[Berga95]

Prova ad usare HiJackThis e postaci il log (mi raccomando, usa la funzione log come scritto qui)
Stai tranquillo che non ci sarà bisogno di formattare

[intermario87]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:20:51, on 09/03/2010
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskhost.exe
C:\Windows\Explorer.EXE
C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
C:\Program Files\Toshiba TEMPRO\TemproTray.exe
C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe
C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\TOSHIBA\Toshiba Online Product Information\TOPI.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\Windows\system32\igfxext.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
C:\Windows\system32\taskhost.exe
C:\Users\Utente\Desktop\Documents\firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource= ... =CT2124320
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Messenger Plus Live Toolbar - {9b339f6e-ddcd-401b-8764-230adbd01761} - C:\Program Files\Messenger_Plus_Live\tbMess.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\mskapbho.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Guida per l'accesso a Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Messenger Plus Live Toolbar - {9b339f6e-ddcd-401b-8764-230adbd01761} - C:\Program Files\Messenger_Plus_Live\tbMess.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: Messenger Plus Live Toolbar - {9b339f6e-ddcd-401b-8764-230adbd01761} - C:\Program Files\Messenger_Plus_Live\tbMess.dll
O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL
O4 - HKLM\..\Run: [HWSetup] "C:\Program Files\TOSHIBA\Utilities\HWSetup.exe" hwSetUP
O4 - HKLM\..\Run: [KeNotify] C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
O4 - HKLM\..\Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Toshiba TEMPRO] C:\Program Files\Toshiba TEMPRO\TemproTray.exe
O4 - HKLM\..\Run: [TosNC] %ProgramFiles%\Toshiba\BulletinBoard\TosNcCore.exe
O4 - HKLM\..\Run: [TosReelTimeMonitor] %ProgramFiles%\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SmartFaceVWatcher] %ProgramFiles%\Toshiba\SmartFaceV\SmartFaceVWatcher.exe
O4 - HKLM\..\Run: [ToshibaServiceStation] "C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60
O4 - HKLM\..\Run: [TWebCamera] "%ProgramFiles%\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe /boot
O4 - HKLM\..\RunOnce: [avp6_post_install] msiexec.exe /i"C:\ProgramData\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 2010 9.0.0.736\Italian\kav.it.msi"
O4 - HKCU\..\Run: [TOSHIBA Online Product Information] C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [AutoStartNPSAgent] C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [TOSHIBA Online Product Information] C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [TOSHIBA Online Product Information] C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe (User 'Default user')
O4 - .DEFAULT User Startup: TRDCReminder.lnk = C:\Program Files\TOSHIBA\TRDCReminder\TRDCReminder.exe (User 'Default user')
O4 - Global Startup: McAfee Security Scan Plus.lnk = ?
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Inserisci blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: Inserisci &blog in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{295C3C29-D0E6-4CFE-9706-6CD1D3027C5A}: NameServer = 151.100.4.2,151.100.13.4
O17 - HKLM\System\CS1\Services\Tcpip\..\{295C3C29-D0E6-4CFE-9706-6CD1D3027C5A}: NameServer = 151.100.4.2,151.100.13.4
O17 - HKLM\System\CS2\Services\Tcpip\..\{295C3C29-D0E6-4CFE-9706-6CD1D3027C5A}: NameServer = 151.100.4.2,151.100.13.4
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O23 - Service: McAfee Application Installer Cleanup (0042701268143808) (0042701268143808mcinstcleanup) - McAfee, Inc. - C:\Users\Utente\AppData\Local\Temp\004270~1.EXE
O23 - Service: ConfigFree WiMAX Service (cfWiMAXService) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe
O23 - Service: ConfigFree Service - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Notebook Performance Tuning Service (TEMPRO) (TemproMonitoringService) - Toshiba Europe GmbH - C:\Program Files\Toshiba TEMPRO\TemproSvc.exe
O23 - Service: TMachInfo - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA HDD SSD Alert Service - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
O23 - Service: webserver - Unknown owner - C:\Program Files\webserver\webserver.exe

--
End of file - 10571 bytes

speriamo...la vedo brutta...grazie anticipatamente

[Berga95]

Vediamo...
queste le puoi fixare:

Codice: Seleziona tutto

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource= ... =CT2124320
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)


Ma non vedo nulla di strano... (a parte i migliaia di servizi di toshiba )
Prova a fare una scansione con Malware Bytes Anti Malware, speriamo che risolva qualcosa...
Se non riesci a scaricarlo vai qui: http://filemirrors.wordpress.com/2009/0 ... lware-1-40 invece che dal sito ufficiale

EDIT: Ahia, ho dato una occhiata un po' meglio e

Codice: Seleziona tutto

O23 - Service: webserver - Unknown owner - C:\Program Files\webserver\webserver.exe

questo non sembra essere niente di buono...
http://www.threatexpert.com/files/webserver.exe.html

[Berga95]

Mi è venuto il mal di pancia vedendo tutte le chiavi di registro create...
http://www.threatexpert.com/report.aspx ... 745365442b
Allora, vai con mbam, poi vedremo cos'è rimasto...

[crazy.cat]

e in piu non posso aprire tutti i siti, soprattutto quelli contenenti antivirus;

Controlla il file hosts http://www.MegaLab.it/2833/il-file-hosts-di-windows se è stato modificato dal virus

[intermario87]

il file di host mi dice questo nella parte finale :
# 127.0.0.1 localhost
# ::1 localhost
c'è qualche problema?..cosa è quel " ::1 " ?
comunque mi sono fatto scaricare mbam da un mio amico perche quello che ho scaricato da quel link risale all'anno scorso...oggi pomeriggio vado a prenderlo faccio la scansione e posto il log

[intermario87]

allora ragazzi...ho installato mbam e scansionato...vi premetto che la versione non è delle ultime:

data: 1 / 7 / 10
versione database: 3510
impronte caricate: 174959

in effetti è stato trovato il kobaface e l'ho "rimosso"...comunque il problema persiste poiche nn riesco ad aggiornare gli antivirus e nn riesco ad accedere a tutte le paginie internet

comunque eccovi il log

Malwarebytes' Anti-Malware 1.44
Versione del database: 3510
Windows 6.1.7600
Internet Explorer 8.0.7600.16385

10/03/2010 13:46:25
mbam-log-2010-03-10 (13-46-25).txt

Tipo di scansione: Scansione completa (C:\|D:\|)
Elementi scansionati: 186077
Tempo trascorso: 36 minute(s), 27 second(s)

Processi delle memoria infetti: 0
Moduli della memoria infetti: 0
Chiavi di registro infette: 0
Valori di registro infetti: 0
Elementi dato del registro infetti: 0
Cartelle infette: 0
File infetti: 3

Processi delle memoria infetti:
(Nessun elemento malevolo rilevato)

Moduli della memoria infetti:
(Nessun elemento malevolo rilevato)

Chiavi di registro infette:
(Nessun elemento malevolo rilevato)

Valori di registro infetti:
(Nessun elemento malevolo rilevato)

Elementi dato del registro infetti:
(Nessun elemento malevolo rilevato)

Cartelle infette:
(Nessun elemento malevolo rilevato)

File infetti:
C:\Windows\bk23567.dat (KoobFace.Trace) -> Quarantined and deleted successfully.
C:\Windows\fdgg34353edfgdfdf (KoobFace.Trace) -> Quarantined and deleted successfully.
C:\Program Files\webserver\webserver.exe (Worm.KoobFace) -> Quarantined and deleted successfully.

[crazy.cat]

c'è qualche problema?..cosa è quel " ::1 " ?

No è a posto. Visto che dicevi di non aggiornare più gli antivirus pensavo fosse stato modificato, di solito il trucco usato dai virus è questo.

[intermario87]

crazy qualche altra indicazione dopo aver usato mbam?

[crazy.cat]

Già malwarebytes potrebbe risolvere molti problemi, puoi provare anche questo antivirus http://www.MegaLab.it/2894/kaspersky-virus-removal-tool per un ulteriore controllo.

[Berga95]

intermario87, prova come è stato detto con il kaspersky removal tool... comunque adesso siamo presi "leggermente" meglio: sappiamo con chi abbiamo a che fare.
Adesso cerco qualcosa in google e ti dirò...

[crazy.cat]

Ci potrebbero essere molte altre cose da eliminare http://www.spywareremove.com/removeNetW ... ceeyf.html
Controlla le presenza dei file e dei servizi indicati, meglio se fai una scansione con combofix e posti il suo log.

[Berga95]

Sì, come dice crazy.cat, bisognerà usare combofix (sempre che kaspersky non ce la faccia da solo)
Comunque potremmo controllare (dopo combofix e kaspersky) se ci sono questi file: http://vil.nai.com/vil/content/v_148955.htm#VirusInfo
@ crazy.cat: ti può servire sapere che il worm

si pone in ascolto sulla porta TCP 9090 e esegue il proxing dell'intero traffico HTTP

(http://www.tweakness.net/news/4862)
Byee

[crazy.cat]

@ crazy.cat: ti può servire sapere che il worm

si pone in ascolto sulla porta TCP 9090 e esegue il proxing dell'intero traffico HTTP

(http://www.tweakness.net/news/4862)
Byee

Troppo vecchio come articolo 8 dicembre 2008 alle 18.35 di netquik ci sono ormai 20000 varianti di quel virus.

[Berga95]

8 dicembre 2008

Ups...

[intermario87]

ecco il log di combofix

ComboFix 10-03-09.08 - Utente 10/03/2010 19:07:52.1.2 - x86
Microsoft Windows 7 Professional 6.1.7600.0.1252.39.1040.18.2909.1954 [GMT 1:00]
Eseguito da: c:\users\Utente\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2408909432-1924856789-4021319429-500
c:\program files\temp
c:\program files\webserver

.
((((((((((((((((((((((((( Files Creati Da 2010-02-10 al 2010-03-10 )))))))))))))))))))))))))))))))))))
.

2010-03-10 18:13 . 2010-03-10 18:13 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-03-09 19:27 . 2010-03-09 19:27 -------- d-----w- c:\users\Utente\AppData\Roaming\Malwarebytes
2010-03-09 19:27 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-09 19:27 . 2010-03-10 12:03 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-03-09 19:27 . 2010-03-09 19:27 -------- d-----w- c:\programdata\Malwarebytes
2010-03-09 19:27 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-09 15:05 . 2010-03-09 15:05 95259 ----a-w- c:\windows\system32\drivers\klick.dat
2010-03-09 15:05 . 2010-03-09 15:05 108059 ----a-w- c:\windows\system32\drivers\klin.dat
2010-03-09 15:04 . 2010-03-10 17:57 -------- d-----w- c:\programdata\Kaspersky Lab
2010-03-09 15:04 . 2010-03-09 15:04 -------- d-----w- c:\program files\Kaspersky Lab
2010-03-09 14:04 . 2010-03-09 14:04 -------- d-----w- c:\programdata\Kaspersky Lab Setup Files
2010-03-08 21:11 . 2010-03-08 21:11 -------- d-----w- c:\program files\CCleaner
2010-03-08 20:05 . 2010-03-08 20:05 -------- d-----w- c:\windows\Nuova cartella
2010-03-08 20:01 . 2010-03-08 20:01 -------- d-----w- c:\program files\Trend Micro
2010-03-08 13:55 . 2010-03-10 17:13 -------- dc----w- c:\windows\system32\DRVSTORE
2010-03-08 13:54 . 2010-03-10 17:13 -------- d-----w- c:\programdata\Lavasoft
2010-03-08 13:38 . 2010-03-08 13:40 685816 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-03-08 10:42 . 2010-03-08 10:42 -------- d-----w- c:\windows\Sun
2010-03-01 17:44 . 2010-03-01 17:44 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\Markup.dll
2010-03-01 17:44 . 2010-03-01 17:44 375616 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2010-02-28 14:17 . 2010-02-28 14:17 -------- d-----w- c:\users\Utente\AppData\Local\P5
2010-02-27 17:49 . 2010-02-27 17:49 439816 ----a-w- c:\users\Utente\AppData\Roaming\Real\Update\setup3.09\setup.exe
2010-02-27 17:49 . 2010-02-27 17:49 439816 ----a-w- c:\users\Utente\AppData\Roaming\Real\Update\recsetup\setup.exe
2010-02-27 17:49 . 2010-02-27 17:49 118784 ----a-w- c:\users\Utente\AppData\Roaming\Real\Update\recsetup\install.dll
2010-02-27 17:43 . 2010-02-27 17:43 -------- d-----w- c:\program files\Common Files\xing shared
2010-02-27 17:43 . 2010-02-27 17:43 -------- d-----w- c:\program files\Common Files\Real
2010-02-27 17:43 . 2010-02-27 17:43 -------- d-----w- c:\program files\Real
2010-02-27 13:35 . 2010-02-27 13:35 -------- d-----w- c:\program files\MarkAny
2010-02-27 13:35 . 2010-02-27 13:35 -------- d-----w- c:\program files\Samsung
2010-02-27 13:33 . 2010-02-27 13:33 -------- d-----w- c:\users\Utente\AppData\Local\Downloaded Installations
2010-02-25 19:08 . 2010-02-25 19:08 -------- d-----w- c:\program files\MSXML 4.0
2010-02-24 09:17 . 2009-12-13 09:30 641536 ----a-w- c:\windows\system32\CPFilters.dll
2010-02-24 09:17 . 2009-12-13 09:30 465408 ----a-w- c:\windows\system32\psisdecd.dll
2010-02-24 09:17 . 2009-12-13 09:29 417792 ----a-w- c:\windows\system32\msdri.dll
2010-02-24 09:17 . 2010-02-02 07:45 2048 ----a-w- c:\windows\system32\tzres.dll
2010-02-24 01:34 . 2010-02-24 01:34 1000992 ----a-w- c:\windows\system32\drivers\rtl8192se.sys
2010-02-22 19:48 . 2010-02-22 19:48 -------- d-----w- c:\windows\system32\Samsung_USB_Drivers
2010-02-22 19:48 . 2007-07-03 16:00 9256 ----a-w- c:\windows\system32\drivers\sscdwhnt.sys
2010-02-22 19:48 . 2007-07-03 16:00 9256 ----a-w- c:\windows\system32\drivers\sscdwh.sys
2010-02-22 19:48 . 2007-07-03 15:58 106792 ----a-w- c:\windows\system32\drivers\sscdmdm.sys
2010-02-22 19:48 . 2007-07-03 15:57 11944 ----a-w- c:\windows\system32\drivers\sscdmdfl.sys
2010-02-22 19:48 . 2007-07-03 15:56 9256 ----a-w- c:\windows\system32\drivers\sscdcmnt.sys
2010-02-22 19:48 . 2007-07-03 15:56 9256 ----a-w- c:\windows\system32\drivers\sscdcm.sys
2010-02-22 19:48 . 2007-07-03 15:54 80552 ----a-w- c:\windows\system32\drivers\sscdbus.sys
2010-02-22 19:48 . 2010-02-27 13:35 -------- d-----w- c:\users\Utente\AppData\Roaming\Samsung
2010-02-22 19:42 . 2010-02-22 19:42 -------- d-----w- c:\users\Utente\Messenger Plus! Live
2010-02-20 16:20 . 2010-02-20 16:58 114688 ----a-w- c:\programdata\eMule\lang\it_IT.dll
2010-02-19 20:13 . 2010-03-02 16:28 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2010-02-19 20:13 . 2010-02-19 20:13 375616 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2010-02-19 20:08 . 2010-02-19 20:08 -------- d-----w- c:\program files\MSECache
2010-02-19 20:01 . 2010-02-19 20:01 69632 ----a-r- c:\users\Utente\AppData\Roaming\Microsoft\Installer\{B358DA4D-0918-436E-A0E6-4813B1E5965A}\NewShortcut2_B358DA4D0918436EA0E64813B1E5965A.exe
2010-02-19 20:01 . 2010-02-19 20:01 69632 ----a-r- c:\users\Utente\AppData\Roaming\Microsoft\Installer\{B358DA4D-0918-436E-A0E6-4813B1E5965A}\NewShortcut1_B358DA4D0918436EA0E64813B1E5965A.exe
2010-02-19 20:01 . 2010-02-19 20:01 10134 ----a-r- c:\users\Utente\AppData\Roaming\Microsoft\Installer\{B358DA4D-0918-436E-A0E6-4813B1E5965A}\ARPPRODUCTICON.exe
2010-02-19 19:29 . 2010-02-19 19:29 -------- d-----w- c:\program files\Conduit
2010-02-19 19:29 . 2010-02-22 19:42 -------- d-----w- c:\program files\Messenger_Plus_Live
2010-02-19 17:00 . 2010-02-19 17:00 -------- d-----w- c:\users\Utente\AppData\Local\Diagnostics
2010-02-18 19:19 . 2010-02-18 19:19 -------- d-----w- c:\users\Utente\AppData\Local\Mozilla
2010-02-18 19:13 . 2010-02-18 19:13 -------- d-----w- c:\programdata\Messenger Plus!
2010-02-18 16:37 . 2010-02-20 16:20 -------- d-----w- c:\programdata\eMule
2010-02-18 16:37 . 2010-02-18 16:44 -------- d-----w- c:\users\Utente\AppData\Local\eMule
2010-02-18 16:37 . 2010-02-18 19:05 -------- d-----w- c:\program files\eMule
2010-02-17 23:18 . 2010-02-17 23:18 -------- d-----w- c:\windows\system32\Macromed
2010-02-17 22:48 . 2010-03-09 19:09 -------- d-----w- c:\users\Utente\Tracing
2010-02-17 22:42 . 2010-02-17 22:42 -------- d-----w- c:\users\Utente\AppData\Local\ElevatedDiagnostics
2010-02-13 15:59 . 2010-02-13 15:59 -------- d-----w- c:\users\Utente\AppData\Roaming\Ubisoft
2010-02-13 15:57 . 2010-02-13 15:57 -------- d-----w- c:\programdata\Ubisoft
2010-02-13 15:55 . 2005-05-26 14:34 2297552 ----a-w- c:\windows\system32\d3dx9_26.dll
2010-02-13 15:36 . 2010-02-13 15:36 -------- d-----w- c:\program files\Ubisoft
2010-02-13 15:35 . 2010-02-13 15:35 -------- d-----w- c:\users\Utente\AppData\Roaming\InstallShield
2010-02-10 16:54 . 2010-02-10 16:54 -------- d-----w- c:\programdata\Office Genuine Advantage
2010-02-10 16:43 . 2010-02-10 16:43 -------- d-----w- c:\users\Utente\AppData\Local\Microsoft Help
2010-02-10 16:33 . 2010-02-10 16:33 1 ----a-w- c:\users\Utente\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-02-10 16:33 . 2010-02-10 16:33 -------- d-----w- c:\users\Utente\AppData\Roaming\OpenOffice.org
2010-02-10 16:29 . 2010-02-10 16:29 -------- d-----w- c:\program files\JRE
2010-02-10 16:29 . 2010-02-10 16:29 -------- d-----w- c:\program files\OpenOffice.org 3
2010-02-10 16:28 . 2010-02-10 16:51 -------- d-----w- c:\program files\Java
2010-02-10 16:10 . 2010-02-10 16:10 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2010-02-10 15:50 . 2010-02-10 15:50 -------- d-----w- c:\users\Utente\AppData\Local\TOSHIBA_Corporation
2010-02-10 15:49 . 2009-09-10 05:52 257024 ----a-w- c:\windows\system32\msv1_0.dll
2010-02-10 15:47 . 2010-02-24 08:16 181632 ------w- c:\windows\system32\MpSigStub.exe
2010-02-10 15:47 . 2010-02-10 15:47 -------- d-----w- c:\users\Utente\AppData\Local\Google
2010-02-10 15:20 . 2010-03-04 10:21 -------- d-----w- c:\users\Utente\AppData\Roaming\Toshiba
2010-02-10 15:09 . 2010-02-10 16:55 113000 ----a-w- c:\users\Utente\AppData\Local\GDIPFONTCACHEV1.DAT
2010-02-10 15:09 . 2010-02-13 14:14 -------- d-----w- c:\users\Utente\AppData\Local\Toshiba

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-09 15:03 . 2009-09-09 07:34 -------- d-----w- c:\programdata\McAfee
2010-03-08 20:02 . 2009-07-14 08:21 689472 ----a-w- c:\windows\system32\perfh010.dat
2010-03-08 20:02 . 2009-07-14 08:21 124626 ----a-w- c:\windows\system32\perfc010.dat
2010-03-02 17:22 . 2010-03-02 17:22 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2010-02-22 19:47 . 2009-09-09 07:22 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-18 14:05 . 2010-02-18 14:05 2232 ----a-w- c:\windows\Java\Packages\Data\6VFRBDB7.DAT
2010-02-18 14:05 . 2010-02-18 14:05 155995 ----a-w- c:\windows\Java\Packages\G3XVFLF9.ZIP
2010-02-18 14:05 . 2010-02-18 14:05 2678 ----a-w- c:\windows\Java\Packages\Data\G2WB713D.DAT
2010-02-18 14:05 . 2010-02-18 14:05 2678 ----a-w- c:\windows\Java\Packages\Data\ZHBRXFT7.DAT
2010-02-18 14:05 . 2010-02-18 14:05 2678 ----a-w- c:\windows\Java\Packages\Data\XZX35RJZ.DAT
2010-02-18 14:05 . 2010-02-18 14:05 2678 ----a-w- c:\windows\Java\Packages\Data\F3XRZB5N.DAT
2010-02-18 14:05 . 2010-02-18 14:05 2678 ----a-w- c:\windows\Java\Packages\Data\EXVRVFZZ.DAT
2010-02-18 13:34 . 2010-02-18 13:34 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_09_00.Wdf
2010-02-10 17:00 . 2009-09-09 07:42 -------- d-----w- c:\programdata\Microsoft Help
2010-02-10 16:43 . 2009-09-09 07:45 -------- d-----w- c:\program files\Microsoft Works
2010-02-10 16:41 . 2009-09-09 07:48 -------- d-----w- c:\program files\Microsoft
2010-02-10 16:23 . 2009-09-09 07:49 -------- d-----w- c:\program files\Microsoft Silverlight
2010-02-10 15:50 . 2009-09-09 07:33 -------- d-----w- c:\programdata\Partner
2010-02-10 15:06 . 2010-02-10 15:06 -------- d-----w- c:\programdata\ToshibaEurope
2010-02-10 15:06 . 2010-02-10 15:06 -------- d-sh--we c:\programdata\Preferiti
2010-02-10 15:06 . 2010-02-10 15:06 -------- d-sh--we c:\programdata\Modelli
2010-02-10 15:06 . 2010-02-10 15:06 -------- d-sh--we c:\programdata\Menu Avvio
2010-02-10 15:06 . 2010-02-10 15:06 -------- d-sh--we c:\programdata\Documenti
2010-02-10 15:06 . 2010-02-10 15:06 -------- d-sh--we c:\programdata\Dati applicazioni
2010-02-10 15:06 . 2010-02-10 15:06 -------- d-sh--we c:\program files\File comuni
2010-02-10 13:58 . 2010-02-10 13:58 0 --sha-r- c:\windows\system32\drivers\TOSHIBA_Satellite Pro L450_10241-IT_PSLY1E-01F00.MRK
2010-01-21 02:27 . 2010-01-21 02:27 -------- d-----w- c:\program files\Common Files\Toshiba Shared
2010-01-21 02:27 . 2010-01-21 02:23 -------- d-----w- c:\programdata\TOSHIBA
2010-01-21 02:27 . 2009-09-09 07:24 -------- d-----w- c:\program files\TOSHIBA
2010-01-21 02:22 . 2009-09-09 07:25 -------- d-----w- c:\program files\Realtek
2010-01-21 02:22 . 2010-01-21 02:22 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_SynTP_01007.Wdf
2010-01-21 02:21 . 2010-01-21 02:21 -------- d-----w- c:\program files\Synaptics
2010-01-21 02:21 . 2010-01-21 02:20 -------- d-----w- c:\program files\Realtek WLAN Driver
2010-01-21 02:18 . 2009-09-09 07:24 -------- d-----w- c:\program files\Common Files\InstallShield
2010-01-18 23:29 . 2010-02-10 15:45 85504 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-01-18 23:29 . 2010-02-10 15:45 85504 ----a-w- c:\windows\system32\secproc_ssp.dll
2010-01-18 23:29 . 2010-02-10 15:45 365568 ----a-w- c:\windows\system32\secproc_isv.dll
2010-01-18 23:29 . 2010-02-10 15:45 369152 ----a-w- c:\windows\system32\secproc.dll
2010-01-18 23:28 . 2010-02-10 15:45 324608 ----a-w- c:\windows\system32\RMActivate_isv.exe
2010-01-18 23:28 . 2010-02-10 15:45 277504 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-01-18 23:28 . 2010-02-10 15:45 320512 ----a-w- c:\windows\system32\RMActivate.exe
2010-01-18 23:28 . 2010-02-10 15:45 280064 ----a-w- c:\windows\system32\RMActivate_ssp.exe
2010-01-08 03:18 . 2010-02-10 15:45 221184 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-01-08 03:17 . 2010-02-10 15:45 123392 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-12-19 09:02 . 2010-02-10 15:45 977920 ----a-w- c:\windows\system32\wininet.dll
2009-12-19 09:02 . 2010-02-10 15:45 12288 ----a-w- c:\windows\system32\tsbyuv.dll
2009-12-19 09:02 . 2010-02-10 15:45 1328640 ----a-w- c:\windows\system32\quartz.dll
2009-12-19 09:02 . 2010-02-10 15:45 22016 ----a-w- c:\windows\system32\msyuv.dll
2009-12-19 09:02 . 2010-02-10 15:45 31744 ----a-w- c:\windows\system32\msvidc32.dll
2009-12-19 09:02 . 2010-02-10 15:45 13312 ----a-w- c:\windows\system32\msrle32.dll
2009-12-19 09:02 . 2010-02-10 15:45 84480 ----a-w- c:\windows\system32\mciavi32.dll
2009-12-19 09:02 . 2010-02-10 15:45 50176 ----a-w- c:\windows\system32\iyuv_32.dll
2009-12-19 09:02 . 2010-02-10 15:45 91648 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{9b339f6e-ddcd-401b-8764-230adbd01761}"= "c:\program files\Messenger_Plus_Live\tbMess.dll" [2009-12-31 2349080]

[HKEY_CLASSES_ROOT\clsid\{9b339f6e-ddcd-401b-8764-230adbd01761}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9b339f6e-ddcd-401b-8764-230adbd01761}]
2009-12-31 10:53 2349080 ----a-w- c:\program files\Messenger_Plus_Live\tbMess.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{9b339f6e-ddcd-401b-8764-230adbd01761}"= "c:\program files\Messenger_Plus_Live\tbMess.dll" [2009-12-31 2349080]

[HKEY_CLASSES_ROOT\clsid\{9b339f6e-ddcd-401b-8764-230adbd01761}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{9B339F6E-DDCD-401B-8764-230ADBD01761}"= "c:\program files\Messenger_Plus_Live\tbMess.dll" [2009-12-31 2349080]

[HKEY_CLASSES_ROOT\clsid\{9b339f6e-ddcd-401b-8764-230adbd01761}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSHIBA Online Product Information"="c:\program files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2009-08-12 6203296]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]
"AutoStartNPSAgent"="c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe" [2009-12-24 116056]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SVPWUTIL"="c:\program files\TOSHIBA\Utilities\SVPWUTIL.exe" [2009-08-12 352256]
"HWSetup"="c:\program files\TOSHIBA\Utilities\HWSetup.exe" [2009-06-02 425984]
"KeNotify"="c:\program files\TOSHIBA\Utilities\KeNotify.exe" [2009-01-13 34088]
"TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2009-08-03 611672]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"Toshiba TEMPRO"="c:\program files\Toshiba TEMPRO\TemproTray.exe" [2009-08-06 1050000]
"TosNC"="c:\program files\Toshiba\BulletinBoard\TosNcCore.exe" [2009-08-06 466792]
"TosReelTimeMonitor"="c:\program files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe" [2009-08-06 29528]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-02 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-02 174104]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-02 151064]
"TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2009-08-05 476512]
"SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2009-08-13 521528]
"00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2009-08-05 738616]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-07-28 7625248]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-07-20 1545512]
"SmartFaceVWatcher"="c:\program files\Toshiba\SmartFaceV\SmartFaceVWatcher.exe" [2009-07-29 163840]
"ToshibaServiceStation"="c:\program files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2009-08-17 1294136]
"TWebCamera"="c:\program files\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" [2009-08-11 2446648]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe" [2009-10-20 340456]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"TOSHIBA Online Product Information"="c:\program files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2009-08-12 6203296]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\mzvkbd3.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-03-08 685816]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 RTL8187B;Scheda di rete USB 2.0 54 Mbps 802.11b/g Realtek RTL8187B;c:\windows\system32\DRIVERS\RTL8187B.sys [2009-07-13 347136]
R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]
S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-10-14 36880]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2009-09-14 21520]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 cfWiMAXService;ConfigFree WiMAX Service;c:\program files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe [2009-08-10 185712]
S2 ConfigFree Service;ConfigFree Service;c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe [2009-03-10 46448]
S2 TemproMonitoringService;Notebook Performance Tuning Service (TEMPRO);c:\program files\Toshiba TEMPRO\TemproSvc.exe [2009-08-06 116104]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2009-07-10 122880]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2009-10-02 19472]
S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys [2009-06-22 24064]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-05-22 167936]
S3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;c:\windows\system32\DRIVERS\rtl8192se.sys [2010-02-24 1000992]
S3 TMachInfo;TMachInfo;c:\program files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2009-08-17 51512]
S3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2009-08-03 111960]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]

.
Contenuto della cartella 'Scheduled Tasks'
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://search.conduit.com?SearchSource= ... =CT2124320
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
TCP: {295C3C29-D0E6-4CFE-9706-6CD1D3027C5A} = 151.100.4.2,151.100.13.4
DPF: Microsoft XML Parser for Java - file:///C:/Windows/Java/classes/xmldso.cab
.
- - - - CHIAVI ORFANE RIMOSSE - - - -

HKLM-Run-NPSStartup - (no file)
SafeBoot-mcmscsvc
SafeBoot-MCODS
AddRemove-eMule Razorback 3 - c:\users\Utente\Desktop\Documents\Documents\emule\uninstall.exe
AddRemove-Mozilla Firefox (3.6) - c:\users\Utente\Desktop\Documents\Documents\Nuova cartella (2)\uninstall\helper.exe


.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Ora fine scansione: 2010-03-10 19:15:47
ComboFix-quarantined-files.txt 2010-03-10 18:15

Pre-Run: 97.739.833.344 byte disponibili
Post-Run: 97.534.595.072 byte disponibili

- - End Of File - - A05D11A9601F99A9369F9411A45CF8F8

[Berga95]

Non sembra aver fatto molto...
Kaspersky?

[intermario87]

kaspersky nn ha trovato nulla...sembra che ora sia tutto apposto...ma per essere sicuro c'è qualche procedimento?...non è che qualcosa è rimasto nei registri?

[crazy.cat]

kaspersky non ha trovato nulla...sembra che ora sia tutto apposto...ma per essere sicuro c'è qualche procedimento?...non è che qualcosa è rimasto nei registri?

Avevi controllato?

Ci potrebbero essere molte altre cose da eliminare http://www.spywareremove.com/removeNetW ... ceeyf.html
Controlla le presenza dei file e dei servizi indicati, meglio se fai una scansione con combofix e posti il suo log.