windoows- disco non presente

[giuseppe67]

ciao, mi da errore disco non presente, se apro la stampante.
incollo il log di :

Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 11.15.48, on 16/03/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programmi\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\File comuni\Nero\Nero BackItUp 4\NBService.exe
C:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Programmi\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Microsoft Student\Microsoft Encarta 2009 - Premium + Student DVD\EDICT.EXE
C:\Programmi\Ninja\ninja.exe
C:\WINDOWS\system32\attrib.exe
C:\Programmi\Avant Browser\avant.exe
C:\Programmi\TrendMicro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://it.search.yahoo.com/?fr=avantsearch
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programmi\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: Bandoo IE Plugin - {EB5CEE80-030A-4ED8-8E20-454E9C68380F} - C:\Programmi\Bandoo\Plugins\IE\ieplugin.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: LEC - {1DBAB667-A486-421e-AFE4-CF07DD0088E5} - C:\Programmi\Power Translator 10\Applications\LEC IE Translation Extension.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [AVP] "C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Programmi\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [L09IXLRD_4004734] "C:\Programmi\Microsoft Student\Microsoft Encarta 2009 - Premium + Student DVD\EDICT.EXE" -m
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\user\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Ritaglio schermata e avvio di OneNote 2007.lnk = C:\Programmi\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: ninja.lnk = C:\Programmi\Ninja\ninja.exe
O8 - Extra context menu item: Aggiungi ad Anti-Banner - C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: I&nvia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Barra di ricerca di Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programmi\File comuni\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{45DC4DE7-2584-4638-8886-1B223360BF58}: NameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{45DC4DE7-2584-4638-8886-1B223360BF58}: NameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{45DC4DE7-2584-4638-8886-1B223360BF58}: NameServer = 192.168.1.1
O17 - HKLM\System\CS3\Services\Tcpip\..\{45DC4DE7-2584-4638-8886-1B223360BF58}: NameServer = 192.168.1.1
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programmi\Microsoft Office\Office12\GrooveSystemServices.dll
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Programmi\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Programmi\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LEC TranslateDotNet Server - Language Engineering Corporation, LLC - C:\Programmi\Power Translator 10\LogoMedia TranslateDotNet Server.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Programmi\File comuni\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programmi\File comuni\PCSuite\Services\ServiceLayer.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

--
End of file - 7915 bytes

[crazy.cat]

ciao, mi da errore disco non presente, se apro la stampante.

Spiegati meglio e prova a reinstallare i driver della stampante.

[giuseppe67]

lo fatto, ma quando fa l'aggiornamento di windos mi rifa la stessa cosa.sul log di hijtackthis ce qualcosa come un warn o no?

[Uomo_Senza_Sonno]

Nel log non c'è nulla di rilevante, è pulito.. questo problema non è di natura virale, e se per cortesia dai altre informazioni risolverlo diventa di colpo più semplice

[giuseppe67]

se accendo la stampante mi da windows-disco non presente exception processing message c0000013 parameters 75b1bf7c 4 75b1bf7c 75b1bf7c .o disistallato i stallato la stampante nel riavvio di windows che prende gli aggiornamenti di windows mi rifa la stessa cosa,o fatto un punto di ripristino anecedente e come rifa l'aggiornamento di windows mi rifa lo stesso disco non presente

[mattpillon]

sarà banale, ma hai provato a mettere nel lettore un disco di windows?
sembra che il sistema cerchi qualche componente non presente e provi a reistallarlo.

[giuseppe67]

fatto pure quello ma al primo aggiornamento ritorna uguale

[stevens]

ciao

abilita la visualizzazione dei file nascosti (apri una cartella qualsiasi, vai su Strumenti--> Opzioni cartella--> Visualizzazione e spunta Visualizza file e cartelle nascosti

controlla se hai nel pc questi file

C:\WINDOWS\Installer\24ha12\cmp\insDr.exe
C:\WINDOWS\Installer\24ha12\drv\hvNrtUD.exe
C:\WINDOWS\Installer\24ha12\inet\int2com.exe
C:\WINDOWS\Installer\24ha12\inet\slp2.exe
C:\WINDOWS\sys32_.exe


e queste cartelle

C:\WINDOWS\Installer\24ha12\cmp
C:\WINDOWS\Installer\24ha12\drv
C:\WINDOWS\Installer\24ha12\inet
C:\WINDOWS\Installer\24ha12

[giuseppe67]

nada de nada nessuno di que file o cartelle

[stevens]

prova a fare una scansione con combofix dopo aver disattivato il tuo antivirus -

(non installare la recovery console)
Lascia lavorare il programma senza interferire
Allega il rapporto C:\ComboFix.txt nella tua risposta.

[giuseppe67]

ciao, o fatto come mi aidetto ecco i log di :ComboFix 10-03-18.02 - user 19/03/2010 18.35.02.4.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.39.1040.18.1023.656 [GMT 1:00]
Eseguito da: c:\documents and settings\user\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
AV: Lavasoft Ad-Watch Live! Anti-virus *On-access scanning disabled* (Updated) {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\InfoSat.txt
c:\windows\system32\Thumbs.db

.
((((((((((((((((((((((((( Files Creati Da 2010-02-19 al 2010-03-19 )))))))))))))))))))))))))))))))))))
.

2010-03-19 13:10 . 2009-01-16 13:46 2486848 ----a-w- c:\documents and settings\user\Dati applicazioni\Simply Super Software\Trojan Remover\was1.exe
2010-03-18 10:57 . 2010-03-18 10:57 -------- d-----w- c:\programmi\File comuni\PCSuite
2010-03-18 10:57 . 2010-03-18 10:57 -------- d-----w- c:\programmi\File comuni\Nokia
2010-03-18 10:55 . 2010-03-18 10:55 -------- d-----w- c:\documents and settings\user\Impostazioni locali\Dati applicazioni\Nokia
2010-03-17 01:17 . 2010-03-17 01:17 -------- d-----w- C:\df27ee4c8abfb6747b255d49bb6642fa
2010-03-16 08:11 . 2010-03-16 08:11 -------- d-----w- c:\windows\system32\wbem\Repository
2010-03-16 08:10 . 2010-03-16 08:10 -------- d-----w- c:\programmi\SweetIM
2010-03-10 18:41 . 2009-10-23 15:28 3558912 -c----w- c:\windows\system32\dllcache\moviemk.exe
2010-03-08 18:51 . 2010-03-18 10:56 -------- d-----w- c:\documents and settings\user\Impostazioni locali\Dati applicazioni\Temp
2010-03-08 18:51 . 2010-03-08 18:57 -------- d-----w- c:\documents and settings\user\Impostazioni locali\Dati applicazioni\Google
2010-03-02 20:12 . 2010-03-02 20:12 17632 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Lavasoft\Ad-Aware\Update\WSCUpdate.dll
2010-03-01 22:57 . 2010-03-02 20:13 15688 ----a-w- c:\windows\system32\lsdelete.exe
2010-03-01 18:45 . 2010-03-02 20:12 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys
2010-03-01 18:45 . 2009-01-18 21:43 2892112 -c--a-w- c:\documents and settings\All Users\Dati applicazioni\{83C91755-2546-441D-AC40-9A6B4B860800}\Ad-AwareAE.exe
2010-02-24 19:18 . 2010-03-19 15:52 -------- d-----w- c:\programmi\Ninja
2010-02-24 17:40 . 2010-02-24 17:40 -------- d-----w- c:\programmi\Wondershare
2010-02-24 15:58 . 2010-02-28 23:03 -------- d-----w- c:\documents and settings\Default User\Impostazioni locali\Dati applicazioni\Adobe
2010-02-24 15:54 . 2010-02-28 23:17 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\NOS
2010-02-24 10:06 . 2010-02-24 14:07 -------- d-----w- c:\programmi\FindyKill
2010-02-23 13:51 . 2010-02-23 13:51 388096 ----a-r- c:\documents and settings\user\Dati applicazioni\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-02-23 13:51 . 2010-02-23 13:51 -------- d-----w- c:\programmi\TrendMicro
2010-02-22 19:09 . 2010-02-22 19:09 -------- d-----w- c:\documents and settings\user\Impostazioni locali\Dati applicazioni\Conduit
2010-02-22 19:09 . 2010-02-22 19:09 -------- d-----w- c:\programmi\Conduit
2010-02-22 19:09 . 2010-02-23 08:15 -------- d-----w- c:\documents and settings\user\Impostazioni locali\Dati applicazioni\Softonic_Italia
2010-02-22 19:09 . 2010-02-22 20:55 -------- d-----w- c:\programmi\Softonic_Italia
2010-02-22 19:07 . 2010-02-25 16:08 -------- d-----w- c:\programmi\JDownloader

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-19 17:45 . 2009-01-11 08:37 551968 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-03-19 17:44 . 2009-01-11 08:37 3629344 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2010-03-19 17:33 . 2009-01-11 08:37 32 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-03-19 17:31 . 2009-01-11 08:37 343244 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2010-03-19 17:10 . 2009-11-18 15:51 -------- d-----w- c:\programmi\Avant Browser
2010-03-19 16:07 . 2009-01-11 08:37 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Kaspersky Lab
2010-03-19 13:15 . 2009-01-16 05:50 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Spybot - Search & Destroy
2010-03-19 13:10 . 2009-01-11 07:41 -------- d---a-w- c:\documents and settings\All Users\Dati applicazioni\TEMP
2010-03-18 11:00 . 2009-01-10 20:48 -------- d--h--w- c:\programmi\InstallShield Installation Information
2010-03-18 10:59 . 2009-04-04 20:37 -------- d-----w- c:\documents and settings\user\Dati applicazioni\PC Suite
2010-03-18 10:59 . 2009-04-04 20:36 -------- d-----w- c:\programmi\Nokia
2010-03-18 08:33 . 2009-01-10 21:54 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\UDL
2010-03-18 08:28 . 2009-01-10 21:51 -------- d-----w- c:\programmi\epson
2010-03-17 23:24 . 2009-04-04 20:36 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Downloaded Installations
2010-03-16 08:38 . 2009-01-10 23:17 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Microsoft Help
2010-03-16 08:10 . 2009-01-11 10:12 -------- d-----w- c:\documents and settings\user\Dati applicazioni\uTorrent
2010-03-15 15:01 . 2009-01-11 07:41 -------- d-----w- c:\documents and settings\user\Dati applicazioni\Any DVD Converter Professional
2010-03-03 17:39 . 2009-01-16 05:50 -------- d-----w- c:\programmi\Spybot - Search & Destroy
2010-03-03 00:46 . 2009-01-11 07:41 -------- d-----w- c:\programmi\Any DVD Converter Professional
2010-03-02 21:55 . 2009-03-16 10:38 -------- d-----w- c:\programmi\Malwarebytes' Anti-Malware
2010-03-02 21:53 . 2009-03-16 10:44 5115823 -c--a-w- c:\documents and settings\All Users\Dati applicazioni\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-03-02 20:12 . 2010-03-02 20:12 303456 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Lavasoft\Ad-Aware\Update\UpdateManager.dll
2010-03-01 18:46 . 2010-02-27 20:03 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Lavasoft
2010-03-01 18:45 . 2010-02-27 20:03 -------- dc-h--w- c:\documents and settings\All Users\Dati applicazioni\{83C91755-2546-441D-AC40-9A6B4B860800}
2010-03-01 16:36 . 2009-06-06 13:59 1324 ----a-w- c:\windows\system32\d3d9caps.dat
2010-02-28 23:13 . 2009-01-11 08:35 -------- d-----w- c:\programmi\File comuni\Adobe
2010-02-28 11:58 . 2009-01-10 21:02 116424 ----a-w- c:\documents and settings\user\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2010-02-28 11:57 . 2010-02-25 21:53 -------- d-----w- c:\programmi\SUPERAntiSpyware
2010-02-28 11:54 . 2010-02-28 11:54 -------- d-----w- c:\programmi\NOS
2010-02-28 11:54 . 2010-02-24 19:52 -------- dc----w- c:\documents and settings\All Users\Dati applicazioni\{33284F1B-AA9B-4290-B5B9-2F38EBF6EA01}
2010-02-28 11:54 . 2010-02-26 17:48 -------- d-----w- c:\programmi\GridinSoft Trojan Killer
2010-02-28 11:54 . 2009-10-09 18:07 -------- d-----w- c:\programmi\VS Revo Group
2010-02-28 11:53 . 2010-02-28 11:53 -------- d-----w- c:\programmi\Vuze
2010-02-27 20:03 . 2010-02-27 20:03 -------- d-----w- c:\programmi\Lavasoft
2010-02-26 11:23 . 2010-02-25 11:12 685816 ----a-w- c:\windows\system32\drivers\SPTD.SYS.TMP
2010-02-25 21:53 . 2010-02-25 21:53 -------- d-----w- c:\documents and settings\user\Dati applicazioni\SUPERAntiSpyware.com
2010-02-25 21:52 . 2009-02-17 12:37 -------- d-----w- c:\programmi\File comuni\Wise Installation Wizard
2010-02-25 11:12 . 2010-02-25 11:12 641469 ----a-w- c:\windows\WINDOWSUPDATE.LOG.TMP
2010-02-25 11:12 . 2010-02-25 11:12 318572 ----a-w- c:\windows\system32\drivers\FIDBOX2.IDX.TMP
2010-02-25 11:12 . 2010-02-25 11:12 241952 ----a-w- c:\windows\system32\drivers\FIDBOX.DAT.TMP
2010-02-25 11:12 . 2010-02-25 11:12 11378 ----a-w- c:\windows\SCHEDLGU.TXT.TMP
2010-02-24 10:21 . 2004-08-19 12:00 84996 ----a-w- c:\windows\system32\perfc010.dat
2010-02-24 10:21 . 2004-08-19 12:00 491438 ----a-w- c:\windows\system32\perfh010.dat
2010-02-15 19:56 . 2009-04-04 20:41 -------- d-----w- c:\documents and settings\user\Dati applicazioni\Datalayer
2010-02-14 23:29 . 2010-02-14 22:31 -------- d-----w- c:\programmi\NSS
2010-02-14 14:07 . 2010-02-14 14:07 -------- d-----w- c:\programmi\Returnil
2010-02-14 08:59 . 2010-02-14 08:59 -------- d-----w- c:\documents and settings\Administrator\Dati applicazioni\vlc
2010-02-14 08:38 . 2009-09-14 14:53 -------- d-----w- c:\programmi\Bandoo
2010-02-11 13:51 . 2010-02-11 13:51 24419312 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Installations\{4C911A61-39EA-41CC-AB3C-FE3BFFDB5F78}\NokiaSoftwareUpdaterSetup_it[1].exe
2010-02-11 11:44 . 2010-02-11 11:44 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2010-02-11 11:44 . 2010-02-11 11:44 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2010-02-11 11:40 . 2009-04-07 18:06 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Installations
2010-02-11 11:35 . 2010-02-11 11:35 3351812 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Installations\{4C911A61-39EA-41CC-AB3C-FE3BFFDB5F78}\Installer\CommonCustomActions\msxml6Exec.exe
2010-02-11 11:35 . 2010-02-11 11:35 36864 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Installations\{4C911A61-39EA-41CC-AB3C-FE3BFFDB5F78}\Installer\CommonCustomActions\Sleep.exe
2010-02-11 11:35 . 2010-02-11 11:35 3203453 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Installations\{4C911A61-39EA-41CC-AB3C-FE3BFFDB5F78}\Installer\CommonCustomActions\vcredistExec.exe
2010-02-11 11:31 . 2010-02-11 11:38 24419312 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Installations\{4C911A61-39EA-41CC-AB3C-FE3BFFDB5F78}\NokiaSoftwareUpdaterSetup_it.exe
2010-02-11 11:23 . 2010-02-11 11:23 -------- d-----w- c:\documents and settings\Fra\Dati applicazioni\Avant Profiles
2010-02-11 11:23 . 2009-01-12 19:47 116424 -c--a-w- c:\documents and settings\Fra\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2010-01-23 18:35 . 2009-06-06 09:13 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Electronic Arts
2010-01-23 18:34 . 2010-01-23 18:34 -------- d-----w- c:\programmi\File comuni\Adobe AIR
2010-01-23 18:34 . 2010-01-23 18:34 38784 ----a-w- c:\documents and settings\Default User\Dati applicazioni\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-01-07 15:07 . 2009-03-16 10:38 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 15:07 . 2009-03-16 10:38 19160 -c--a-w- c:\windows\system32\drivers\mbam.sys
2009-12-31 16:50 . 2004-08-19 12:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-22 05:08 . 2004-08-19 12:00 669696 ------w- c:\windows\system32\wininet.dll
2009-12-22 05:08 . 2004-08-19 12:00 81920 -c--a-w- c:\windows\system32\ieencode.dll
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EB5CEE80-030A-4ED8-8E20-454E9C68380F}]
2009-09-29 07:24 1863616 ----a-w- c:\programmi\Bandoo\Plugins\IE\ieplugin.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"L09IXLRD_4004734"="c:\programmi\Microsoft Student\Microsoft Encarta 2009 - Premium + Student DVD\EDICT.EXE" [2009-03-02 351000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"Ad-Watch"="c:\programmi\Lavasoft\Ad-Aware\AAWTray.exe" [2010-03-02 524632]
"DataLayer"="c:\programmi\File comuni\PCSuite\DataLayer\DataLayer.exe" [2005-06-07 819712]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\user\Menu Avvio\Programmi\Esecuzione automatica\
Ritaglio schermata e avvio di OneNote 2007.lnk - c:\programmi\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]

c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
ninja.lnk - c:\programmi\Ninja\ninja.exe [2010-3-9 764416]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\eMule\\emule.exe"=
"c:\\Programmi\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Programmi\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Programmi\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Documents and Settings\\All Users\\Dati applicazioni\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 7.0.1.325\\Italian\\setup.exe"=
"c:\\Documents and Settings\\user\\Desktop\\[Mondololloso-Script] v2.0.1\\[Mondololloso Script] v2.0.1.exe"=
"c:\\Programmi\\Electronic Arts\\L'Ascesa del Re Stregone\\lotrbfme2ep1.exe"=
"c:\\Programmi\\Kaspersky Lab\\Kaspersky Internet Security 7.0\\avp.exe"=
"c:\\Programmi\\uTorrent\\uTorrent.exe"=
"c:\\Programmi\\Messenger\\msmsgs.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programmi\\Vuze\\Azureus.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmi\\TeamViewer\\Version4\\TeamViewer.exe"=
"c:\\Documents and Settings\\user\\temp\\TeamViewer\\Version5\\TeamViewer.exe"=
"c:\\xdccMule\\mIRC.exe"=
"c:\\Programmi\\Java\\jre1.6.0_07\\bin\\javaw.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [01/03/2010 19.45.59 64160]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\programmi\Lavasoft\Ad-Aware\AAWService.exe [18/01/2009 22.34.37 1029456]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [13/12/2007 13.28.40 24592]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [11/01/2009 0.26.06 685816]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\programmi\MAGIX\Common\Database\bin\fbserver.exe [11/10/2009 16.43.27 1527900]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys c:\windows\system32\drivers\nmwcdnsu.sys
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys c:\windows\system32\drivers\nmwcdnsuc.sys
S3 PRODIGY;PRODIGY;c:\windows\system32\drivers\prodigy.sys [14/02/2010 23.31.55 32377]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contenuto della cartella 'Scheduled Tasks'

2010-03-15 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\programmi\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 20:12]

2010-03-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-117609710-688789844-682003330-1004Core.job
- c:\documents and settings\user\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe [2010-03-08 18:51]

2010-03-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-117609710-688789844-682003330-1004UA.job
- c:\documents and settings\user\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe [2010-03-08 18:51]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
uInternet Connection Wizard,ShellNext = iexplore
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: {45DC4DE7-2584-4638-8886-1B223360BF58} = 192.168.1.1
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-19 18:44
Windows 5.1.2600 Service Pack 3 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------

[HKEY_USERS\S-1-5-21-117609710-688789844-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*s*c*f* \OpenWithList]
@Class="Shell"
"a"="WORDPAD.EXE"
"MRUList"="ba"
"b"="NOTEPAD.EXE"

[HKEY_USERS\S-1-5-21-117609710-688789844-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*s*c*f* \OpenWithProgids]
"scf”_auto_file"=hex(0):

[HKEY_USERS\S-1-5-21-117609710-688789844-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{3DDAF073-4544-42D2-9CE2-AF2140346445}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"oalpggdoiiifkngjmbdfafhagggcbf"=hex:64,61,69,6a,6c,6f,70,64,00,85
"oahpokphhbhfmmjijgkfbcdpaolmae"=hex:6b,61,6c,6a,66,6a,6d,70,6e,6a,69,69,62,63,
66,68,6d,6a,70,66,67,64,00,7c
"nanoehbldjnoekdiacgdgiicahaj"=hex:6b,61,6c,6a,66,6a,6d,70,6e,6a,69,69,62,63,
66,68,6d,6a,70,66,67,64,00,7c
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------

- - - - - - - > 'winlogon.exe'(1320)
c:\programmi\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\klogon.dll

- - - - - - - > 'lsass.exe'(1376)
c:\programmi\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll
c:\programmi\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
c:\programmi\Kaspersky Lab\Kaspersky Internet Security 7.0\fssync.dll
.
Ora fine scansione: 2010-03-19 18:49:49
ComboFix-quarantined-files.txt 2010-03-19 17:49

Pre-Run: 96.505.868.288 byte disponibili
Post-Run: 96.490.983.424 byte disponibili

- - End Of File - - 75716655F354735F39DA74F134F65C95

[giuseppe67]

CE NESSUNO CHE MI AIUTA?

[giuseppe67]

ciao,mi e stato detto di aver aperto l'ostesso argomento in 2 parti,e chiedo scusa x questo.
non sapevo che non si poteva fare.il log di combifix lo allegatoe possibile sapere qualcosa

[giuseppe67]

aiuto cosa devo fare?

[giuseppe67]

ciao, argomento spostato ma dove?