Vi prego di controllare il seguente log dato improvviso rallentamento apetrtura programmi. Fatta scansione con malwarebytes e con AVG antivirus 9 ed ambedue hanno dato esito segativo.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10.26.19, on 24/11/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\AVG\AVG9\avgchsvx.exe
C:\Programmi\AVG\AVG9\avgrsx.exe
C:\Programmi\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\Programmi\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Programmi\Samsung\EmoDio\SMSTray.exe
C:\Programmi\AVG\AVG9\avgwdsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\ThreatFire\TFTray.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Java\jre6\bin\jusched.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Programmi\Java\jre6\bin\jqs.exe
C:\Programmi\Panda USB Vaccine\USBVaccine.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Creative\MediaSource\RemoteControl\RCMan.EXE
C:\Programmi\filehippo.com\UpdateChecker.exe
C:\Programmi\rnamfler\naofsvc.exe
C:\Programmi\AVG\AVG9\avgnsx.exe
C:\Programmi\Macrium\Reflect\ReflectService.exe
C:\PROGRA~1\Nero\Nero PhotoShow 4\data\xtras\mssysmgr.exe
C:\Programmi\Pinnacle\Shared Files\Programs\Scheduler\PCLEScheduler.exe
C:\Programmi\Fastweb\PrintAndFax\FaxMonitor.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\ThreatFire\TFService.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\System32\alg.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.speedapps.com/search.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programmi\AVG\AVG9\avgssie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programmi\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: WOT Helper - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Programmi\WOT\WOT.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmi\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O3 - Toolbar: WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Programmi\WOT\WOT.dll
O4 - HKLM\..\Run: [CTSysVol] C:\Programmi\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTDVDDET] C:\Programmi\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [SBDrvDet] C:\Programmi\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] c:\PROGRA~1\FILECO~1\INSTAL~1\updateservice\isuspm.exe -startup
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SMSTray] C:\Programmi\Samsung\EmoDio\SMSTray.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Programmi\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [OutpostMonitor] C:\PROGRA~1\Agnitum\OUTPOS~1\op_mon.exe /tray /noservice
O4 - HKLM\..\Run: [OutpostFeedBack] "C:\Programmi\Agnitum\Outpost Firewall\feedback.exe" /dump:os_startup
O4 - HKLM\..\Run: [ThreatFire] C:\Programmi\ThreatFire\TFTray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RemoteCenter] C:\Programmi\Creative\MediaSource\RemoteControl\RCMan.EXE
O4 - HKCU\..\Run: [filehippo.com] "C:\Programmi\filehippo.com\UpdateChecker.exe" /background
O4 - HKCU\..\Run: [Nero PhotoShow Media Manager] C:\PROGRA~1\Nero\Nero PhotoShow 4\data\xtras\mssysmgr.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Global Startup: Pinnacle Scheduler.lnk = ?
O4 - Global Startup: PrintAndFax.lnk = C:\Programmi\Fastweb\PrintAndFax\FaxMonitor.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Scarica con Download &Express - C:\Programmi\Download Express\Add_Url.htm
O9 - Extra button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: I&nvia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O16 - DPF: {6D2EF4B4-CB62-4C0B-85F3-B79C236D702C} (ContactExtractor Class) - http://www.facebook.com/controls/contactx.dll
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programmi\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programmi\AVG\AVG9\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Programmi\WOT\WOT.dll
O20 - AppInit_DLLs: c:\progra~1\agnitum\outpos~1\wl_hook.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Agnitum Client Security Service (acssrv) - Agnitum Ltd. - C:\PROGRA~1\Agnitum\OUTPOS~1\acs.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Programmi\AVG\AVG9\avgwdsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmi\Java\jre6\bin\jqs.exe
O23 - Service: RdnaoFlSvc - Unknown owner - C:\Programmi\rnamfler\naofsvc.exe
O23 - Service: Macrium Reflect Image Mounting Service (ReflectService) - Unknown owner - C:\Programmi\Macrium\Reflect\ReflectService.exe
O23 - Service: ThreatFire - PC Tools - C:\Programmi\ThreatFire\TFService.exe

--
End of file - 9571 bytes

In attesa vi saluto caramente.

ciao io questo lo eliminerei, ma se vuoi attendere chi più esperto di me, attendi:
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

Poi questo di facebook, ma vale il discorso di cui sopra:

O16 - DPF: {6D2EF4B4-CB62-4C0B-85F3-B79C236D702C} (ContactExtractor Class) - http://www.facebook.com/controls/contactx.dll

contactx.dll:
controlla questo file su www.virustotal.it

Inoltre se già non lo hai fatto scaricati ed esegui una pulizia con questo programma:

http://software.aiutamici.com/software?ID=11223

Buongiorno.

Scarica Combofix

http://download.bleepingcomputer.com/sUBs/ComboFix.exe


Salvalo sul desktop.

Importante: Disabilita il tuo antivirus e chiudi TUTTI i programmi aperti,(Firewall compreso) e dopo aver scaricato COMBOFIX, chiudi la connessione.
Doppio click su combofix.exe (comparirà una videata.)
Se ti verrà chiesto se vuoi Installare LA CONSOLE DI RIPRISTINO DI EMERGENZA, clicca NO.
E' probabile che ti siano inviati messaggi dall'antivirus, tu ignorali.
Durante l'operazione di scansione è importante non usare il PC (neanche il mouse) e attendere pazientemente la fine delle operazioni.
Al termine, verrà creato un file log sul Desktop, chiamato C:\ComboFix.txt. Postalo qui.

Disinstalla combofix in questo modo: (dopo che avrò visto il log)
Start
Esegui
nella finestra di dialogo, copia ed incolla questo comando: Combofix /u e premi Invio poi cancella le cartelle in "C" di Combofix e (qoobox)

Buonasera.
Ci sono "rimasugli" di SUPERAntiSpyware sparsi per il pc.
Se è Stato disistallato, esegui questa operazione:

Apri un file di testo sul Desktop (start \ esegui \ digita: notepad.exe \ Ok
Ci incolli il codice che vedi qui sotto, e salvi il file di testo [color = red] obbligatoriamente [/ color] con il nome [b] CFScript.txt [/ b]

Driver::
LBD
SASDIFSV
SASKUTIL
SASENUM

E trascinalo sull'icona di ComboFix.
Attendi La fine dei lavori, senza toccare tastiera, mouse o altro.
Posta il log aggiornato di combofix

Fai cosi:
Copia-incolla la dicitura in rosso che ti ho postato, nel file di testo, che hai creato sul Desktop.
Clicca su File. (in alto a sinistra).
Poi scegli dal menù che si apre, "Salva".
In basso, trovi "Nome file" con scritto "*.txt".
Lo selezioni, e poi lo elimini. (Oppure premi il tasto "Canc".)
Al posto suo, fai un copia di CFScript.txt e lo incolli .
Poi clicca "Salva ".
Lo chiudi cliccando sulla X rossa,

Adesso, trovi sul desktop il file di testo salvato.
con il tasto sinistro del mouse,e lo trascini sopra l'icona di Combofix che hai sul desktop.
Parte la scansione che eliminerà i driver che ho scritto nel post.
Sarebbe gradito, sapere se c'è un miglioramento del pc.

Buona giornata a tutti.
Ecco il log aggiornato

ComboFix 09-11-23.04 - agostino 25/11/2009 8.39.12.3.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.39.1040.18.2558.1822 [GMT 1:00]
Eseguito da: c:\documents and settings\agostino\Desktop\ComboFix.exe
Opzioni usate :: c:\documents and settings\agostino\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: Outpost Firewall *enabled* {8A20CA2A-9E02-4A64-923B-0A38208EB7FD}

ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Driver/Servizi )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_LBD
-------\Legacy_SASDIFSV
-------\Legacy_SASENUM
-------\Legacy_SASKUTIL
-------\Service_Lbd
-------\Service_SASDIFSV
-------\Service_SASENUM
-------\Service_SASKUTIL


((((((((((((((((((((((((( Files Creati Da 2009-10-25 al 2009-11-25 )))))))))))))))))))))))))))))))))))
.

2009-11-23 09:58 . 2009-11-23 09:58 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Azureus
2009-11-23 09:57 . 2009-11-24 00:51 -------- d-----w- c:\documents and settings\agostino\Dati applicazioni\Azureus
2009-11-23 09:57 . 2009-11-23 09:57 -------- d-----w- c:\programmi\Vuze
2009-11-22 09:18 . 2009-11-13 11:15 497944 ----a-w- c:\documents and settings\All Users\Dati applicazioni\avg9\update\backup\avgchjwx.dll
2009-11-22 09:18 . 2009-11-13 11:15 3963648 ----a-w- c:\documents and settings\All Users\Dati applicazioni\avg9\update\backup\avgcorex.dll
2009-11-22 09:17 . 2009-11-13 11:15 877848 ----a-w- c:\documents and settings\All Users\Dati applicazioni\avg9\update\backup\avgupd.exe
2009-11-22 09:17 . 2009-11-13 11:15 1657112 ----a-w- c:\documents and settings\All Users\Dati applicazioni\avg9\update\backup\avgupd.dll
2009-11-18 13:39 . 2009-11-18 13:39 -------- d-----w- c:\documents and settings\agostino\Impostazioni locali\Dati applicazioni\OOoLive
2009-11-16 16:01 . 2008-12-04 00:25 120832 ----a-w- c:\documents and settings\agostino\Dati applicazioni\Mozilla\Firefox\Profiles\3h6ti7k2.default\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}\plugins\npietab.dll
2009-11-14 15:15 . 2009-11-25 06:43 -------- d-----w- c:\documents and settings\agostino\Dati applicazioni\vlc
2009-11-13 12:44 . 2009-11-13 12:49 -------- d-----w- c:\programmi\Unlocker
2009-11-13 12:24 . 2009-11-13 12:24 -------- d-sh--w- c:\documents and settings\Default User\IETldCache
2009-11-13 11:15 . 2009-11-14 16:45 -------- d-----w- C:\$AVG
2009-11-13 11:15 . 2009-11-13 11:15 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-11-13 11:15 . 2009-11-13 11:15 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2009-11-13 11:15 . 2009-11-13 11:15 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-11-13 11:15 . 2009-11-13 11:15 28424 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-11-13 11:15 . 2009-11-24 16:46 -------- d-----w- c:\windows\system32\drivers\Avg
2009-11-13 11:14 . 2009-11-13 11:14 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\avg9
2009-11-13 10:54 . 2009-11-13 10:54 -------- d-----w- c:\programmi\Java
2009-11-13 10:52 . 2009-11-13 10:52 152576 ----a-w- c:\documents and settings\agostino\Dati applicazioni\Sun\Java\jre1.6.0_17\lzma.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-25 08:02 . 2009-03-07 18:11 1339545632 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-11-25 07:57 . 2009-03-07 18:11 15700484 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-11-25 07:57 . 2007-09-26 16:34 384 ----a-w- c:\windows\system32\DVCStateBkp-{00000000-00000000-0000000C-00001102-00000004-20021102}.dat
2009-11-25 07:57 . 2007-09-26 16:34 384 ----a-w- c:\windows\system32\DVCState-{00000000-00000000-0000000C-00001102-00000004-20021102}.dat
2009-11-25 06:22 . 2001-08-31 11:00 80268 ----a-w- c:\windows\system32\perfc010.dat
2009-11-25 06:22 . 2001-08-31 11:00 481664 ----a-w- c:\windows\system32\perfh010.dat
2009-11-24 09:25 . 2008-08-22 11:25 -------- d---a-w- c:\documents and settings\All Users\Dati applicazioni\TEMP
2009-11-24 09:25 . 2009-08-12 11:43 -------- d-----w- c:\programmi\SpywareBlaster
2009-11-24 09:24 . 2009-09-17 10:12 -------- d-----w- c:\programmi\Navilog1
2009-11-21 18:23 . 2008-11-14 12:36 -------- d-----w- c:\programmi\Innovative Solutions
2009-11-20 14:20 . 2009-10-11 14:57 -------- d-----w- c:\programmi\QuickTime Alternative
2009-11-14 16:37 . 2008-12-08 18:44 -------- d-----w- c:\documents and settings\agostino\Dati applicazioni\TeraCopy
2009-11-14 15:44 . 2008-11-20 13:08 -------- d-----w- c:\documents and settings\agostino\Dati applicazioni\IObit
2009-11-14 15:41 . 2008-12-15 20:12 -------- d-----w- c:\documents and settings\agostino\Dati applicazioni\Any Video Converter
2009-11-14 15:41 . 2007-09-26 17:20 -------- d-----w- c:\documents and settings\agostino\Dati applicazioni\Vso
2009-11-14 15:41 . 2009-10-11 14:40 -------- d-----w- c:\programmi\K-Lite Codec Pack
2009-11-14 15:41 . 2009-01-06 13:50 -------- d-----w- c:\programmi\Any Video Converter Professional
2009-11-14 15:41 . 2007-09-26 16:21 -------- d-----w- c:\programmi\Windows Media Connect 2
2009-11-13 12:28 . 2007-09-26 17:36 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Microsoft Help
2009-11-13 10:54 . 2008-12-08 14:56 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-10-19 09:28 . 2009-10-19 09:28 213888 ----a-w- c:\windows\system32\drivers\timntr.sys
2009-10-19 09:28 . 2009-10-19 09:28 126976 ----a-w- c:\windows\system32\snapapi.dll
2009-10-19 09:28 . 2008-11-14 11:07 82464 ----a-w- c:\windows\system32\drivers\snapman.sys
2009-10-19 09:28 . 2008-11-14 11:07 37888 ----a-w- c:\windows\system32\setupnt.dll
2009-10-19 09:28 . 2008-10-31 18:16 28928 ----a-w- c:\windows\system32\drivers\tifsfilt.sys
2009-10-19 09:28 . 2009-10-19 09:28 -------- d-----w- c:\programmi\Acronis
2009-10-17 21:08 . 2009-10-17 16:17 -------- d-----w- c:\programmi\Spybot - Search & Destroy
2009-10-17 21:06 . 2009-10-17 16:17 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Spybot - Search & Destroy
2009-10-17 16:43 . 2009-10-17 16:43 -------- d-----w- c:\programmi\AVG
2009-10-17 08:48 . 2009-06-30 13:11 -------- d-----w- c:\programmi\Microsoft Silverlight
2009-10-17 07:38 . 2008-12-27 20:21 -------- d-----w- c:\documents and settings\agostino\Dati applicazioni\wsInspector
2009-10-15 09:16 . 2009-10-15 09:16 -------- d-----w- c:\documents and settings\agostino\Dati applicazioni\aignes
2009-10-15 09:14 . 2009-10-15 09:14 -------- d-----w- c:\programmi\AM-DeadLink
2009-10-14 07:55 . 2007-09-26 17:14 -------- d-----w- c:\programmi\File comuni\Adobe
2009-10-14 07:52 . 2009-10-14 07:51 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\NOS
2009-10-14 07:51 . 2009-10-14 07:51 -------- d-----w- c:\programmi\NOS
2009-10-14 07:16 . 2008-12-03 10:44 -------- d-----w- c:\documents and settings\agostino\Dati applicazioni\Skype
2009-10-14 07:13 . 2008-10-18 12:39 -------- d-----w- c:\documents and settings\agostino\Dati applicazioni\skypePM
2009-10-11 14:59 . 2009-10-11 14:59 -------- d-----w- c:\programmi\Real Alternative
2009-10-11 14:58 . 2008-12-24 15:43 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Apple Computer
2009-10-11 14:36 . 2009-03-07 13:55 -------- d-----w- c:\programmi\Combined Community Codec Pack
2009-10-11 13:59 . 2009-10-11 13:59 43646 ----a-r- c:\documents and settings\agostino\Dati applicazioni\Microsoft\Installer\{986389BF-2AE7-4C4D-B284-519BA869EDD1}\_EF7BC6DDBE20B4C1311492.exe
2009-10-11 13:59 . 2009-10-11 13:59 43646 ----a-r- c:\documents and settings\agostino\Dati applicazioni\Microsoft\Installer\{986389BF-2AE7-4C4D-B284-519BA869EDD1}\_D707CE1C009F1381803C2C.exe
2009-10-11 13:59 . 2009-10-11 13:59 43646 ----a-r- c:\documents and settings\agostino\Dati applicazioni\Microsoft\Installer\{986389BF-2AE7-4C4D-B284-519BA869EDD1}\_81A4006ABC1B62DCE5F5CA.exe
2009-10-11 13:59 . 2009-10-11 13:59 43646 ----a-r- c:\documents and settings\agostino\Dati applicazioni\Microsoft\Installer\{986389BF-2AE7-4C4D-B284-519BA869EDD1}\_21F3885A18D238E15AAE81.exe
2009-10-11 13:59 . 2009-10-11 13:59 29926 ----a-r- c:\documents and settings\agostino\Dati applicazioni\Microsoft\Installer\{986389BF-2AE7-4C4D-B284-519BA869EDD1}\_455EF241629E11584EA727.exe
2009-10-11 13:59 . 2009-10-11 13:59 109534 ----a-r- c:\documents and settings\agostino\Dati applicazioni\Microsoft\Installer\{986389BF-2AE7-4C4D-B284-519BA869EDD1}\_6FEFF9B68218417F98F549.exe
2009-10-11 13:58 . 2009-10-11 13:58 -------- d-----w- c:\programmi\Macrium
2009-10-11 08:09 . 2009-10-11 08:09 -------- d-----w- c:\documents and settings\agostino\Dati applicazioni\dcunningham.net
2009-09-17 11:17 . 2007-09-26 17:30 76960 ----a-w- c:\documents and settings\agostino\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2009-09-11 14:17 . 2004-08-19 13:39 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-11 06:52 . 2009-07-14 08:50 4045528 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-09-10 12:54 . 2009-06-29 19:32 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-10 12:53 . 2009-06-29 19:32 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-04 21:03 . 2004-08-19 13:39 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 07:56 . 2007-01-03 10:56 916480 ------w- c:\windows\system32\wininet.dll
.

------- Sigcheck -------

[-] 2008-04-14 . 6DC43081C760EEC1130D2C8C145DF375 . 549888 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\winlogon.exe
[-] 2008-04-14 . 6DC43081C760EEC1130D2C8C145DF375 . 549888 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe
[7] 2008-04-14 . 9259170D29B5A256735FCB8B80280857 . 510464 . . [5.1.2600.5512] . . c:\windows\VistaMizer\old\winlogon.exe
[7] 2004-08-19 . 4166454E2BCFCC20D1B8A5AC9FEAB243 . 504832 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\winlogon.exe

[-] 2008-04-14 . 97CBB1689BB951AD8DEE44C9F9C44318 . 724992 . . [5.82] . . c:\windows\ServicePackFiles\i386\comctl32.dll
[-] 2008-04-14 . 97CBB1689BB951AD8DEE44C9F9C44318 . 724992 . . [5.82] . . c:\windows\system32\comctl32.dll
[7] 2008-04-14 . 10AA0E13B4D20EE798E3382C9B89B3E3 . 617472 . . [5.82] . . c:\windows\VistaMizer\old\comctl32.dll
[-] 2007-01-03 . EFA21A3FE23BBCFDB6F61A3AF723E05A . 617472 . . [5.82] . . c:\windows\$NtServicePackUninstall$\comctl32.dll

[-] 2008-04-14 . 3DBD6DC6D74C517D55A1B3AECA88EF48 . 588800 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\user32.dll
[-] 2008-04-14 . 3DBD6DC6D74C517D55A1B3AECA88EF48 . 588800 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll
[7] 2008-04-14 . FA94696C0727BD59E517C674CD6E7C72 . 579584 . . [5.1.2600.5512] . . c:\windows\VistaMizer\old\user32.dll
[-] 2007-03-08 . BAB4F995E526484A235A276E269AAF7F . 579072 . . [5.1.2600.3099] . . c:\windows\$NtServicePackUninstall$\user32.dll

[-] 2008-04-14 . 287B3020F1324E99F313C9E7FCFCCCCC . 1554944 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[-] 2008-04-14 . 287B3020F1324E99F313C9E7FCFCCCCC . 1554944 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\explorer.exe
[7] 2008-04-14 . 70D7F99D95615C3C278367756287DB71 . 1036288 . . [6.00.2900.5512] . . c:\windows\VistaMizer\old\explorer.exe
[-] 2007-06-13 . B4E85805BE6D23DE697F7B3BA7492D0B . 1035776 . . [6.00.2900.3156] . . c:\windows\$NtServicePackUninstall$\explorer.exe

[-] 2008-04-14 . 91B6AAC828F8BBE1796275424E44DFB0 . 25088 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ctfmon.exe
[-] 2008-04-14 . 91B6AAC828F8BBE1796275424E44DFB0 . 25088 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe
[7] 2008-04-14 . F53CDDEF33A4C41336A782BE3D170158 . 15360 . . [5.1.2600.5512] . . c:\windows\VistaMizer\old\ctfmon.exe
[7] 2004-08-19 . 5B33B4265966EE063C7FBEA28958D9C2 . 15360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ctfmon.exe
.
((((((((((((((((((((((((((((( SnapShot@2009-11-24_16.03.57 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-11-25 07:59 . 2009-11-25 07:59 16384 c:\windows\Temp\Perflib_Perfdata_e0.dat
+ 2007-09-26 17:53 . 2009-10-28 15:07 46080 c:\windows\system32\tzchange.exe
- 2007-09-26 17:53 . 2009-07-14 11:03 46080 c:\windows\system32\tzchange.exe
+ 2001-08-31 11:00 . 2009-11-25 06:22 68156 c:\windows\system32\perfc009.dat
- 2001-08-31 11:00 . 2009-11-24 14:32 68156 c:\windows\system32\perfc009.dat
+ 2009-11-24 23:17 . 2009-11-24 23:17 32768 c:\windows\Installer\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}\icon.exe
- 2001-08-31 11:00 . 2009-11-24 14:32 435260 c:\windows\system32\perfh009.dat
+ 2001-08-31 11:00 . 2009-11-25 06:22 435260 c:\windows\system32\perfh009.dat
+ 2009-11-24 23:17 . 2009-11-24 23:17 429568 c:\windows\Installer\1e53106.msi
+ 2009-07-20 23:03 . 2009-07-20 23:03 1348432 c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9876.0_x-ww_a621d1d5\msxml4.dll
+ 2007-05-15 13:43 . 2009-07-31 09:02 1372672 c:\windows\system32\msxml6.dll
+ 2009-07-20 23:05 . 2009-07-20 23:05 1348432 c:\windows\system32\msxml4.dll
+ 2007-01-03 10:50 . 2009-07-31 04:32 1172480 c:\windows\system32\msxml3.dll
+ 2008-09-20 07:24 . 2009-07-31 09:02 1372672 c:\windows\system32\dllcache\msxml6.dll
+ 2008-11-13 06:42 . 2009-07-31 04:32 1172480 c:\windows\system32\dllcache\msxml3.dll
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RemoteCenter"="c:\programmi\Creative\MediaSource\RemoteControl\RCMan.EXE" [2003-10-08 139264]
"filehippo.com"="c:\programmi\filehippo.com\UpdateChecker.exe" [2009-07-27 155648]
"Nero PhotoShow Media Manager"="c:\progra~1\Nero\Nero PhotoShow 4\data\xtras\mssysmgr.exe" [2006-01-13 249856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTSysVol"="c:\programmi\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe" [2003-09-17 57344]
"CTDVDDET"="c:\programmi\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE" [2003-06-17 45056]
"SBDrvDet"="c:\programmi\Creative\SB Drive Det\SBDrvDet.exe" [2002-12-03 45056]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-10 90112]
"ATIPTA"="c:\programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-05-15 339968]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2004-10-08 221184]
"ISUSPM Startup"="c:\progra~1\FILECO~1\INSTAL~1\updateservice\isuspm.exe" [2004-06-14 221184]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SMSTray"="c:\programmi\Samsung\EmoDio\SMSTray.exe" [2009-04-16 479232]
"Malwarebytes Anti-Malware (reboot)"="c:\programmi\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"OutpostMonitor"="c:\progra~1\Agnitum\OUTPOS~1\op_mon.exe" [2009-04-28 2374464]
"OutpostFeedBack"="c:\programmi\Agnitum\Outpost Firewall\feedback.exe" [2009-04-28 428032]
"ThreatFire"="c:\programmi\ThreatFire\TFTray.exe" [2009-09-23 382224]
"Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"SunJavaUpdateSched"="c:\programmi\Java\jre6\bin\jusched.exe" [2009-11-13 149280]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2009-11-13 2020120]
"CTHelper"="CTHELPER.EXE" - c:\windows\system32\CTHELPER.EXE [2003-10-06 24576]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 25088]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2009-03-08 128512]

c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Pinnacle Scheduler.lnk - c:\programmi\Pinnacle\Shared Files\Programs\Scheduler\PCLEScheduler.exe [2007-9-27 245760]
PrintAndFax.lnk - c:\programmi\Fastweb\PrintAndFax\FaxMonitor.exe [2005-11-3 970856]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-11-13 11:15 12464 ----a-w- c:\windows\system32\avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\Skype\\Phone\\Skype.exe"=
"c:\\Programmi\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Programmi\\AVG\\AVG9\\avgupd.exe"=
"c:\\Programmi\\AVG\\AVG9\\avgnsx.exe"=

R0 pssnap;Paramount Software Snapshot Filter;c:\windows\system32\drivers\pssnap.sys [20/05/2008 8.32.40 15328]
R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [10/10/2009 10.16.25 51984]
R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [10/10/2009 10.16.25 59664]
R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [11/08/2004 17.22.54 77312]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [13/11/2009 12.15.13 333192]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [13/11/2009 12.15.17 360584]
R1 is-QVPF3drv;is-QVPF3drv;c:\windows\system32\drivers\38729904.sys [07/03/2009 19.10.59 148496]
R1 SandBox;SandBox;c:\windows\system32\drivers\SandBox.sys [04/10/2009 9.44.03 704384]
R2 acssrv;Agnitum Client Security Service;c:\progra~1\Agnitum\OUTPOS~1\acs.exe [04/10/2009 9.42.37 1195008]
R2 avg9wd;AVG Free WatchDog;c:\programmi\AVG\AVG9\avgwdsvc.exe [13/11/2009 12.15.00 285392]
R2 PfDetNT;PfDetNT;c:\windows\system32\drivers\PfModNT.sys [26/09/2007 17.28.18 15840]
R2 ReflectService;Macrium Reflect Image Mounting Service;c:\programmi\Macrium\Reflect\ReflectService.exe [25/08/2009 11.16.36 220128]
R2 ThreatFire;ThreatFire;c:\programmi\ThreatFire\TFService.exe service --> c:\programmi\ThreatFire\TFService.exe service [?]
R3 3xHybrid;Pinnacle PCTV Stereo service;c:\windows\system32\drivers\3xHybrid.sys [26/09/2007 17.56.01 698368]
R3 afw;Agnitum firewall driver;c:\windows\system32\drivers\afw.sys [04/10/2009 9.42.42 31128]
R3 afwcore;afwcore;c:\windows\system32\drivers\afwcore.sys [04/10/2009 9.43.57 257432]
R3 GETNDIS;VIA Networking Velocity Family Giga-bit Ethernet Adapter Driver;c:\windows\system32\drivers\getnd5b.sys [26/09/2007 18.07.59 44544]
R3 pctvvbi;PCTVVBI;c:\windows\system32\drivers\pctvvbi.sys [26/09/2007 18.11.17 6400]
R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [10/10/2009 10.16.25 33552]
S3 getPlusHelper;getPlus(R) Helper;c:\windows\System32\svchost.exe -k getPlusHelper [19/08/2004 14.39.46 14336]
S3 SIVDRIVER;SIV Kernel Driver;c:\windows\system32\drivers\SIVX32.sys [02/03/2009 13.17.03 49632]
S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys --> c:\windows\system32\DRIVERS\VBoxNetFlt.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contenuto della cartella 'Scheduled Tasks'

2009-11-25 c:\windows\Tasks\PandaUSBVaccine.job
- c:\programmi\Panda USB Vaccine\RunInteractiveWin.exe [2009-08-09 10:30]

2009-11-24 c:\windows\Tasks\User_Feed_Synchronization-{A6A01747-FD5F-45F8-86D4-862341F42BC4}.job
- c:\windows\system32\msfeedssync.exe [2007-01-03 02:31]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.speedapps.com/search.htm
IE: &Clean Traces
IE: &Download with &DAP
IE: Download &all with DAP
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: Scarica con Download &Express - c:\programmi\Download Express\Add_Url.htm
Name-Space Handler: ftp\HIEClickCatcher - {E131C96E-4DDB-11D4-84B8-008048B33DEA} - c:\progra~1\DOWNLO~1\mdpph.dll
Name-Space Handler: http\HIEClickCatcher - {E131C96E-4DDB-11D4-84B8-008048B33DEA} - c:\progra~1\DOWNLO~1\mdpph.dll
Name-Space Handler: https\HIEClickCatcher - {E131C96E-4DDB-11D4-84B8-008048B33DEA} - c:\progra~1\DOWNLO~1\mdpph.dll
DPF: {6D2EF4B4-CB62-4C0B-85F3-B79C236D702C} - hxxp://www.facebook.com/controls/contactx.dll
FF - ProfilePath - c:\documents and settings\agostino\Dati applicazioni\Mozilla\Firefox\Profiles\3h6ti7k2.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.it/
FF - component: c:\programmi\AVG\AVG9\Firefox\components\avgssff.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: browser.cache.memory.capacity - 16000
FF - user.js: browser.chrome.favicons - false
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: content.max.tokenizing.time - 3000000
FF - user.js: content.maxtextrun - 4095
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 1000000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 1000000
FF - user.js: dom.disable_window_status_change - true
FF - user.js: network.http.max-connections - 48
FF - user.js: network.http.max-connections-per-server - 16
FF - user.js: network.http.max-persistent-connections-per-proxy - 16
FF - user.js: network.http.max-persistent-connections-per-server - 8
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.firstrequest - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 1000
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
c:\programmi\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-25 09:00
Windows 5.1.2600 Service Pack 3 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ThreatFire]
"AlternateImagePath"=""
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Environment*]
"Licence0"="04F0D21-79D8-7A25-D702-433F"
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------

- - - - - - - > 'winlogon.exe'(1988)
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\sfc_os.dll
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\cscui.dll
c:\programmi\ThreatFire\TFWAH.dll
c:\programmi\ThreatFire\TFNI.dll
c:\programmi\ThreatFire\TFMon.dll
c:\programmi\ThreatFire\TFRK.dll

- - - - - - - > 'lsass.exe'(288)
c:\windows\system32\scecli.dll
c:\windows\system32\SETUPAPI.dll
c:\programmi\ThreatFire\TFWAH.dll

- - - - - - - > 'explorer.exe'(3472)
c:\windows\system32\SHDOCVW.dll
c:\windows\system32\WININET.dll
c:\programmi\ThreatFire\TfWah.dll
c:\windows\system32\COMRes.dll
c:\windows\System32\cscui.dll
c:\windows\system32\LINKINFO.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\msi.dll
c:\windows\system32\SETUPAPI.dll
c:\programmi\ThreatFire\TFNI.dll
c:\programmi\ThreatFire\TFMon.dll
c:\programmi\ThreatFire\TFRK.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
c:\windows\system32\eappcfg.dll
c:\windows\system32\MSVCP60.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\programmi\AVG\AVG9\avgchsvx.exe
c:\programmi\AVG\AVG9\avgrsx.exe
c:\programmi\AVG\AVG9\avgcsrvx.exe
c:\windows\system32\CTsvcCDA.exe
c:\programmi\Java\jre6\bin\jqs.exe
c:\programmi\ThreatFire\TFService.exe
c:\windows\system32\MsPMSPSv.exe
c:\programmi\Panda USB Vaccine\USBVaccine.exe
c:\programmi\AVG\AVG9\avgnsx.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Ora fine scansione: 2009-11-25 09:09 - Il pc è stato riavviato
ComboFix-quarantined-files.txt 2009-11-25 08:09
ComboFix2.txt 2009-11-24 16:12

Pre-Run: 21.377.122.304 byte disponibili
Post-Run: 21.343.678.464 byte disponibili

- - End Of File - - 8DFECE258D0212CF277EAE165D74872B


Per completezza allego immagini per quanto riguarda i nresidui lasciati da Spybot riscontrati con RICERCA





Resto in attesa e caldamente saluto.

Grazie r16.
Ho fatto tutto alla lettera ed ho notato un forte miglioramento che mi ha spinto ad effettuare una immagine con Acronis.
Nel ringraziarti per la tua gentile pazienza, ti saluto caramente.