Benvenuto Ospite Cerca | Topic Attivi | Utenti | | Log In | Registra

Virus permanente.. Opzioni
pinottolo
Inviato: Wednesday, December 07, 2011 12:46:07 AM
Rank: Newbie

Iscritto dal : 12/7/2011
Posts: 1
Avira Antivirus segnala:

Nel file 'C:\WINDOWS\gckhp.exe'
è stato rilevato un virus o programma indesiderato 'TR/Drop.Injector.ycd' [trojan].
Azione eseguita: Nega accesso

non riesco a toglierlo e mi blocca Microsoft Word non facendomi salvare i file.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 0.29.33, on 07/12/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17103)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\anvshell.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programmi\Avira\AntiVir Desktop\avgnt.exe
C:\Programmi\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\SweetIM\Messenger\SweetIM.exe
C:\Programmi\Microsoft Office\Office12\GrooveMonitor.exe
C:\PROGRA~1\IMESHA~1\MediaBar\Datamngr\DATAMN~1.EXE
C:\Programmi\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Programmi\uTorrent\uTorrent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
C:\Programmi\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\asuskbservice.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Programmi\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programmi\Avira\AntiVir Desktop\avshadow.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\System32\alg.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Programmi\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\pinotto\Documenti\Download\HiJackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://downloads.phpnuke.org/it/index.php?rvs=hompag
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://downloads.phpnuke.org/it/index.php?rvs=hompag
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://downloads.phpnuke.org/it/index.php?rvs=hompag
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=f0bd43e9000000000000000e2e9715ad&tlver=1.4.19.19&ss=1&affID=17982
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: PHPNukeIT Toolbar - {2c965f3f-8efd-4bfc-a2c5-1672845fdbbf} - C:\Programmi\PHPNukeIT\prxtbPHPN.dll
O2 - BHO: MediaBar - {28387537-e3f9-4ed7-860c-11e69af4a8a0} - C:\PROGRA~1\IMESHA~1\MediaBar\ToolBar\imeshdtxmltbpi.dll
O2 - BHO: PHPNukeIT - {2c965f3f-8efd-4bfc-a2c5-1672845fdbbf} - C:\Programmi\PHPNukeIT\prxtbPHPN.dll
O2 - BHO: UrlHelper Class - {474597C5-AB09-49d6-A4D5-2E8D7341384E} - C:\PROGRA~1\IMESHA~1\MediaBar\Datamngr\IEBHO.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programmi\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: PHPNukeIT Toolbar - {2c965f3f-8efd-4bfc-a2c5-1672845fdbbf} - C:\Programmi\PHPNukeIT\prxtbPHPN.dll
O3 - Toolbar: MediaBar - {28387537-e3f9-4ed7-860c-11e69af4a8a0} - C:\PROGRA~1\IMESHA~1\MediaBar\ToolBar\imeshdtxmltbpi.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [anvshell] anvshell.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Programmi\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [HP Software Update] C:\Programmi\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SweetIM] C:\Programmi\SweetIM\Messenger\SweetIM.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Programmi\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [DATAMNGR] C:\PROGRA~1\IMESHA~1\MediaBar\Datamngr\DATAMN~1.EXE
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [sqixe.exe] "C:\WINDOWS\sqixe.exe"
O4 - HKLM\..\Run: [hrqgm.exe] "C:\WINDOWS\hrqgm.exe"
O4 - HKLM\..\Run: [qpbnj.exe] "C:\WINDOWS\qpbnj.exe"
O4 - HKLM\..\Run: [uqzdv.exe] "C:\WINDOWS\uqzdv.exe"
O4 - HKLM\..\Run: [cwwmi.exe] "C:\WINDOWS\cwwmi.exe"
O4 - HKLM\..\Run: [syyeq.exe] "C:\WINDOWS\syyeq.exe"
O4 - HKLM\..\Run: [ckwui.exe] "C:\WINDOWS\ckwui.exe"
O4 - HKLM\..\Run: [fiioy.exe] "C:\WINDOWS\fiioy.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Programmi\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [ezmui.exe] "C:\WINDOWS\ezmui.exe"
O4 - HKLM\..\Run: [fbfqc.exe] "C:\WINDOWS\fbfqc.exe"
O4 - HKLM\..\Run: [xcnhu.exe] "C:\WINDOWS\xcnhu.exe"
O4 - HKLM\..\Run: [rutqy.exe] "C:\WINDOWS\rutqy.exe"
O4 - HKLM\..\Run: [cxmys.exe] "C:\WINDOWS\cxmys.exe"
O4 - HKLM\..\Run: [xcatv.exe] "C:\WINDOWS\xcatv.exe"
O4 - HKLM\..\Run: [xcvih.exe] "C:\WINDOWS\xcvih.exe"
O4 - HKLM\..\Run: [ewzaf.exe] "C:\WINDOWS\ewzaf.exe"
O4 - HKLM\..\Run: [urrdj.exe] "C:\WINDOWS\urrdj.exe"
O4 - HKLM\..\Run: [gckhp.exe] "C:\WINDOWS\gckhp.exe"
O4 - HKCU\..\Run: [uTorrent] "C:\Programmi\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [sqixe.exe] "C:\WINDOWS\sqixe.exe"
O4 - HKCU\..\Run: [hrqgm.exe] "C:\WINDOWS\hrqgm.exe"
O4 - HKCU\..\Run: [qpbnj.exe] "C:\WINDOWS\qpbnj.exe"
O4 - HKCU\..\Run: [uqzdv.exe] "C:\WINDOWS\uqzdv.exe"
O4 - HKCU\..\Run: [cwwmi.exe] "C:\WINDOWS\cwwmi.exe"
O4 - HKCU\..\Run: [syyeq.exe] "C:\WINDOWS\syyeq.exe"
O4 - HKCU\..\Run: [ckwui.exe] "C:\WINDOWS\ckwui.exe"
O4 - HKCU\..\Run: [fiioy.exe] "C:\WINDOWS\fiioy.exe"
O4 - HKCU\..\Run: [ezmui.exe] "C:\WINDOWS\ezmui.exe"
O4 - HKCU\..\Run: [fbfqc.exe] "C:\WINDOWS\fbfqc.exe"
O4 - HKCU\..\Run: [xcnhu.exe] "C:\WINDOWS\xcnhu.exe"
O4 - HKCU\..\Run: [rutqy.exe] "C:\WINDOWS\rutqy.exe"
O4 - HKCU\..\Run: [cxmys.exe] "C:\WINDOWS\cxmys.exe"
O4 - HKCU\..\Run: [xcatv.exe] "C:\WINDOWS\xcatv.exe"
O4 - HKCU\..\Run: [xcvih.exe] "C:\WINDOWS\xcvih.exe"
O4 - HKCU\..\Run: [ewzaf.exe] "C:\WINDOWS\ewzaf.exe"
O4 - HKCU\..\Run: [urrdj.exe] "C:\WINDOWS\urrdj.exe"
O4 - HKCU\..\Run: [gckhp.exe] "C:\WINDOWS\gckhp.exe"
O4 - HKUS\S-1-5-19\..\Run: [sqixe.exe] "C:\WINDOWS\sqixe.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [hrqgm.exe] "C:\WINDOWS\hrqgm.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [kqylg.exe] "C:\WINDOWS\kqylg.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [qpbnj.exe] "C:\WINDOWS\qpbnj.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [uqzdv.exe] "C:\WINDOWS\uqzdv.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [cwwmi.exe] "C:\WINDOWS\cwwmi.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [syyeq.exe] "C:\WINDOWS\syyeq.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [fiioy.exe] "C:\WINDOWS\fiioy.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [ezmui.exe] "C:\WINDOWS\ezmui.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [fbfqc.exe] "C:\WINDOWS\fbfqc.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [xcnhu.exe] "C:\WINDOWS\xcnhu.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [wjlmx.exe] "C:\WINDOWS\wjlmx.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [dpnai.exe] "C:\WINDOWS\dpnai.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [rutqy.exe] "C:\WINDOWS\rutqy.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [cxmys.exe] "C:\WINDOWS\cxmys.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [xcatv.exe] "C:\WINDOWS\xcatv.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [xcvih.exe] "C:\WINDOWS\xcvih.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [ewzaf.exe] "C:\WINDOWS\ewzaf.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [urrdj.exe] "C:\WINDOWS\urrdj.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [crrab.exe] "C:\WINDOWS\crrab.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [gckhp.exe] "C:\WINDOWS\gckhp.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [sqixe.exe] "C:\WINDOWS\sqixe.exe" (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Free YouTube Download - C:\Documents and Settings\pinotto\Dati applicazioni\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Documents and Settings\pinotto\Dati applicazioni\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: I&nvia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programmi\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - AppInit_DLLs: C:\PROGRA~1\IMESHA~1\MediaBar\Datamngr\datamngr.dll C:\PROGRA~1\IMESHA~1\MediaBar\Datamngr\IEBHO.dll
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmi\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programmi\Avira\AntiVir Desktop\avguard.exe
O23 - Service: ASUSKeyboardService - ASUSTeK COMPUTER INC. - C:\WINDOWS\asuskbservice.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Programmi\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Programmi\CDBurnerXP\NMSAccessU.exe
O23 - Service: %NVSVC.name% (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 11714 bytes
Sponsor
Inviato: Wednesday, December 07, 2011 12:46:07 AM

 
pidue
Inviato: Wednesday, December 07, 2011 12:11:22 PM

Rank: AiutAmico

Iscritto dal : 6/2/2005
Posts: 7,332
Il tuo pc è letteralmente devastato da ogni genere di porcheria.
Anche cercando di bonificarlo, qualcosa rimarrà in ogni caso.
Il mio consiglio è quello di formattare,




cbbusto
Inviato: Wednesday, December 07, 2011 12:29:45 PM

Rank: AiutAmico

Iscritto dal : 11/8/2008
Posts: 13,964
Ciao, certo che di porcherie ne hai parecchie, facciamo un pò di pulizie.
Prima cosa, questo programma C:\Programmi\SweetIM\Messenger\SweetIM.exe abbastanza inutile, lo usi?
altrimenti rimuovilo da installazione applicazioni.
Poi chiudi tutti i programmi e disconnesso fixa le seguenti voci e poi clicca su Fix checked:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=f0bd43e9000000000 000000e2e9715ad&tlver=1.4.19.19&ss=1&affID=17982

R3 - URLSearchHook: PHPNukeIT Toolbar - {2c965f3f-8efd-4bfc-a2c5-1672845fdbbf} - C:\Programmi\PHPNukeIT\prxtbPHPN.dll

O2 - BHO: MediaBar - {28387537-e3f9-4ed7-860c-11e69af4a8a0} - C:\PROGRA~1\IMESHA~1\MediaBar\ToolBar\imeshdtxmltbpi.dll

O2 - BHO: PHPNukeIT - {2c965f3f-8efd-4bfc-a2c5-1672845fdbbf} - C:\Programmi\PHPNukeIT\prxtbPHPN.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O3 - Toolbar: PHPNukeIT Toolbar - {2c965f3f-8efd-4bfc-a2c5-1672845fdbbf} - C:\Programmi\PHPNukeIT\prxtbPHPN.dll

O3 - Toolbar: MediaBar - {28387537-e3f9-4ed7-860c-11e69af4a8a0} - C:\PROGRA~1\IMESHA~1\MediaBar\ToolBar\imeshdtxmltbpi.dll

O4 - HKLM\..\Run: [HP Software Update] C:\Programmi\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [SweetIM] C:\Programmi\SweetIM\Messenger\SweetIM.exe

O4 - HKLM\..\Run: [DATAMNGR] C:\PROGRA~1\IMESHA~1\MediaBar\Datamngr\DATAMN~1.EXE

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [sqixe.exe] "C:\WINDOWS\sqixe.exe"
O4 - HKLM\..\Run: [hrqgm.exe] "C:\WINDOWS\hrqgm.exe"
O4 - HKLM\..\Run: [qpbnj.exe] "C:\WINDOWS\qpbnj.exe"
O4 - HKLM\..\Run: [uqzdv.exe] "C:\WINDOWS\uqzdv.exe"
O4 - HKLM\..\Run: [cwwmi.exe] "C:\WINDOWS\cwwmi.exe"
O4 - HKLM\..\Run: [syyeq.exe] "C:\WINDOWS\syyeq.exe"
O4 - HKLM\..\Run: [ckwui.exe] "C:\WINDOWS\ckwui.exe"
O4 - HKLM\..\Run: [fiioy.exe] "C:\WINDOWS\fiioy.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Programmi\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [ezmui.exe] "C:\WINDOWS\ezmui.exe"
O4 - HKLM\..\Run: [fbfqc.exe] "C:\WINDOWS\fbfqc.exe"
O4 - HKLM\..\Run: [xcnhu.exe] "C:\WINDOWS\xcnhu.exe"
O4 - HKLM\..\Run: [rutqy.exe] "C:\WINDOWS\rutqy.exe"
O4 - HKLM\..\Run: [cxmys.exe] "C:\WINDOWS\cxmys.exe"
O4 - HKLM\..\Run: [xcatv.exe] "C:\WINDOWS\xcatv.exe"
O4 - HKLM\..\Run: [xcvih.exe] "C:\WINDOWS\xcvih.exe"
O4 - HKLM\..\Run: [ewzaf.exe] "C:\WINDOWS\ewzaf.exe"
O4 - HKLM\..\Run: [urrdj.exe] "C:\WINDOWS\urrdj.exe"
O4 - HKLM\..\Run: [gckhp.exe] "C:\WINDOWS\gckhp.exe"
O4 - HKCU\..\Run: [sqixe.exe] "C:\WINDOWS\sqixe.exe"
O4 - HKCU\..\Run: [hrqgm.exe] "C:\WINDOWS\hrqgm.exe"
O4 - HKCU\..\Run: [qpbnj.exe] "C:\WINDOWS\qpbnj.exe"
O4 - HKCU\..\Run: [uqzdv.exe] "C:\WINDOWS\uqzdv.exe"
O4 - HKCU\..\Run: [cwwmi.exe] "C:\WINDOWS\cwwmi.exe"
O4 - HKCU\..\Run: [syyeq.exe] "C:\WINDOWS\syyeq.exe"
O4 - HKCU\..\Run: [ckwui.exe] "C:\WINDOWS\ckwui.exe"
O4 - HKCU\..\Run: [fiioy.exe] "C:\WINDOWS\fiioy.exe"
O4 - HKCU\..\Run: [ezmui.exe] "C:\WINDOWS\ezmui.exe"
O4 - HKCU\..\Run: [fbfqc.exe] "C:\WINDOWS\fbfqc.exe"
O4 - HKCU\..\Run: [xcnhu.exe] "C:\WINDOWS\xcnhu.exe"
O4 - HKCU\..\Run: [rutqy.exe] "C:\WINDOWS\rutqy.exe"
O4 - HKCU\..\Run: [cxmys.exe] "C:\WINDOWS\cxmys.exe"
O4 - HKCU\..\Run: [xcatv.exe] "C:\WINDOWS\xcatv.exe"
O4 - HKCU\..\Run: [xcvih.exe] "C:\WINDOWS\xcvih.exe"
O4 - HKCU\..\Run: [ewzaf.exe] "C:\WINDOWS\ewzaf.exe"
O4 - HKCU\..\Run: [urrdj.exe] "C:\WINDOWS\urrdj.exe"
O4 - HKCU\..\Run: [gckhp.exe] "C:\WINDOWS\gckhp.exe"
O4 - HKUS\S-1-5-19\..\Run: [sqixe.exe] "C:\WINDOWS\sqixe.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [hrqgm.exe] "C:\WINDOWS\hrqgm.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [kqylg.exe] "C:\WINDOWS\kqylg.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [qpbnj.exe] "C:\WINDOWS\qpbnj.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [uqzdv.exe] "C:\WINDOWS\uqzdv.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [cwwmi.exe] "C:\WINDOWS\cwwmi.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [syyeq.exe] "C:\WINDOWS\syyeq.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [fiioy.exe] "C:\WINDOWS\fiioy.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [ezmui.exe] "C:\WINDOWS\ezmui.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [fbfqc.exe] "C:\WINDOWS\fbfqc.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [xcnhu.exe] "C:\WINDOWS\xcnhu.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [wjlmx.exe] "C:\WINDOWS\wjlmx.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [dpnai.exe] "C:\WINDOWS\dpnai.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [rutqy.exe] "C:\WINDOWS\rutqy.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [cxmys.exe] "C:\WINDOWS\cxmys.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [xcatv.exe] "C:\WINDOWS\xcatv.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [xcvih.exe] "C:\WINDOWS\xcvih.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [ewzaf.exe] "C:\WINDOWS\ewzaf.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [urrdj.exe] "C:\WINDOWS\urrdj.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [crrab.exe] "C:\WINDOWS\crrab.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [gckhp.exe] "C:\WINDOWS\gckhp.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [sqixe.exe] "C:\WINDOWS\sqixe.exe" (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O20 - AppInit_DLLs: C:\PROGRA~1\IMESHA~1\MediaBar\Datamngr\datamngr.dll C:\PROGRA~1\IMESHA~1\MediaBar\Datamngr\IEBHO.dll

Poi vedo che hai Malwarebytes, aggiornalo a fai una scansione COMPLETA non veloce elimina quello che trova.
Fai una pulizia con Ccleaner compreso il Registro, per il Registro spunta tutte le voci, acconsenti il backup.
Vai in C:\windows cerca la cartella Prefetch e la svuoti completamente.
Disattiva il ripristino configurazione del sistema, Start/pannello di controllo/sistema/ripristino, metti la spunta
su disattiva ok poi riavvia il pc poi rifai il percorso di prima e togli la spunta, crea un nuovo punto.
Fai sapere come va.

PS- ho visto ora la risposta di pidue, ha ragione, comunque vediamo dopo le pulizie cosa succede.


pidue
Inviato: Wednesday, December 07, 2011 1:11:36 PM

Rank: AiutAmico

Iscritto dal : 6/2/2005
Posts: 7,332
cbbusto ha scritto:
R3 - URLSearchHook: PHPNukeIT Toolbar - {2c965f3f-8efd-4bfc-a2c5-1672845fdbbf} - C:\Programmi\PHPNukeIT\prxtbPHPN.dll
O2 - BHO: MediaBar - {28387537-e3f9-4ed7-860c-11e69af4a8a0} - C:\PROGRA~1\IMESHA~1\MediaBar\ToolBar\imeshdtxmltbpi.dll
O2 - BHO: PHPNukeIT - {2c965f3f-8efd-4bfc-a2c5-1672845fdbbf} - C:\Programmi\PHPNukeIT\prxtbPHPN.dll
03 - Toolbar: PHPNukeIT Toolbar - {2c965f3f-8efd-4bfc-a2c5-1672845fdbbf} - C:\Programmi\PHPNukeIT\prxtbPHPN.dll
O3 - Toolbar: MediaBar - {28387537-e3f9-4ed7-860c-11e69af4a8a0} - C:\PROGRA~1\IMESHA~1\MediaBar\ToolBar\imeshdtxmltbpi.dll
O4 - HKLM\..\Run: [HP Software Update] C:\Programmi\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SweetIM] C:\Programmi\SweetIM\Messenger\SweetIM.exe
O4 - HKLM\..\Run: [DATAMNGR] C:\PROGRA~1\IMESHA~1\MediaBar\Datamngr\DATAMN~1.EXE
O4 - HKLM\..\Run: [sqixe.exe] "C:\WINDOWS\sqixe.exe"
O4 - HKLM\..\Run: [hrqgm.exe] "C:\WINDOWS\hrqgm.exe"
O4 - HKLM\..\Run: [qpbnj.exe] "C:\WINDOWS\qpbnj.exe"
O4 - HKLM\..\Run: [uqzdv.exe] "C:\WINDOWS\uqzdv.exe"
O4 - HKLM\..\Run: [cwwmi.exe] "C:\WINDOWS\cwwmi.exe"
O4 - HKLM\..\Run: [syyeq.exe] "C:\WINDOWS\syyeq.exe"
O4 - HKLM\..\Run: [ckwui.exe] "C:\WINDOWS\ckwui.exe"
O4 - HKLM\..\Run: [fiioy.exe] "C:\WINDOWS\fiioy.exe"
O4 - HKLM\..\Run: [ezmui.exe] "C:\WINDOWS\ezmui.exe"
O4 - HKLM\..\Run: [fbfqc.exe] "C:\WINDOWS\fbfqc.exe"
O4 - HKLM\..\Run: [xcnhu.exe] "C:\WINDOWS\xcnhu.exe"
O4 - HKLM\..\Run: [rutqy.exe] "C:\WINDOWS\rutqy.exe"
O4 - HKLM\..\Run: [cxmys.exe] "C:\WINDOWS\cxmys.exe"
O4 - HKLM\..\Run: [xcatv.exe] "C:\WINDOWS\xcatv.exe"
O4 - HKLM\..\Run: [xcvih.exe] "C:\WINDOWS\xcvih.exe"
O4 - HKLM\..\Run: [ewzaf.exe] "C:\WINDOWS\ewzaf.exe"
O4 - HKLM\..\Run: [urrdj.exe] "C:\WINDOWS\urrdj.exe"
O4 - HKLM\..\Run: [gckhp.exe] "C:\WINDOWS\gckhp.exe"
O4 - HKCU\..\Run: [sqixe.exe] "C:\WINDOWS\sqixe.exe"
O4 - HKCU\..\Run: [hrqgm.exe] "C:\WINDOWS\hrqgm.exe"
O4 - HKCU\..\Run: [qpbnj.exe] "C:\WINDOWS\qpbnj.exe"
O4 - HKCU\..\Run: [uqzdv.exe] "C:\WINDOWS\uqzdv.exe"
O4 - HKCU\..\Run: [cwwmi.exe] "C:\WINDOWS\cwwmi.exe"
O4 - HKCU\..\Run: [syyeq.exe] "C:\WINDOWS\syyeq.exe"
O4 - HKCU\..\Run: [ckwui.exe] "C:\WINDOWS\ckwui.exe"
O4 - HKCU\..\Run: [fiioy.exe] "C:\WINDOWS\fiioy.exe"
O4 - HKCU\..\Run: [ezmui.exe] "C:\WINDOWS\ezmui.exe"
O4 - HKCU\..\Run: [fbfqc.exe] "C:\WINDOWS\fbfqc.exe"
O4 - HKCU\..\Run: [xcnhu.exe] "C:\WINDOWS\xcnhu.exe"
O4 - HKCU\..\Run: [rutqy.exe] "C:\WINDOWS\rutqy.exe"
O4 - HKCU\..\Run: [cxmys.exe] "C:\WINDOWS\cxmys.exe"
O4 - HKCU\..\Run: [xcatv.exe] "C:\WINDOWS\xcatv.exe"
O4 - HKCU\..\Run: [xcvih.exe] "C:\WINDOWS\xcvih.exe"
O4 - HKCU\..\Run: [ewzaf.exe] "C:\WINDOWS\ewzaf.exe"
O4 - HKCU\..\Run: [urrdj.exe] "C:\WINDOWS\urrdj.exe"
O4 - HKCU\..\Run: [gckhp.exe] "C:\WINDOWS\gckhp.exe"
O4 - HKUS\S-1-5-19\..\Run: [sqixe.exe] "C:\WINDOWS\sqixe.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [hrqgm.exe] "C:\WINDOWS\hrqgm.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [kqylg.exe] "C:\WINDOWS\kqylg.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [qpbnj.exe] "C:\WINDOWS\qpbnj.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [uqzdv.exe] "C:\WINDOWS\uqzdv.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [cwwmi.exe] "C:\WINDOWS\cwwmi.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [syyeq.exe] "C:\WINDOWS\syyeq.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [fiioy.exe] "C:\WINDOWS\fiioy.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [ezmui.exe] "C:\WINDOWS\ezmui.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [fbfqc.exe] "C:\WINDOWS\fbfqc.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [xcnhu.exe] "C:\WINDOWS\xcnhu.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [wjlmx.exe] "C:\WINDOWS\wjlmx.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [dpnai.exe] "C:\WINDOWS\dpnai.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [rutqy.exe] "C:\WINDOWS\rutqy.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [cxmys.exe] "C:\WINDOWS\cxmys.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [xcatv.exe] "C:\WINDOWS\xcatv.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [xcvih.exe] "C:\WINDOWS\xcvih.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [ewzaf.exe] "C:\WINDOWS\ewzaf.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [urrdj.exe] "C:\WINDOWS\urrdj.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [crrab.exe] "C:\WINDOWS\crrab.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [gckhp.exe] "C:\WINDOWS\gckhp.exe" (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [sqixe.exe] "C:\WINDOWS\sqixe.exe" (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O20 - AppInit_DLLs: C:\PROGRA~1\IMESHA~1\MediaBar\Datamngr\datamngr.dll C:\PROGRA~1\IMESHA~1\MediaBar\Datamngr\IEBHO.dll



Se fai la rimozione manuale,devi eliminare anche i file associati.
MBAM dovrebbe facilitarti il lavoro. Eseguilo nelle modalità suggerite da cbbusto, prima di usare HJTH.



cbbusto
Inviato: Wednesday, December 07, 2011 2:27:34 PM

Rank: AiutAmico

Iscritto dal : 11/8/2008
Posts: 13,964
Hai ragione pidue, infatti dovevo anteporre la scansione con Mbam prima dell'eliminazione delle voci.
Speriamo che si sistemi con tutte quelle porcherie.
Grazie, ciao
Utenti presenti in questo topic
Guest


Salta al Forum
Aggiunta nuovi Topic disabilitata in questo forum.
Risposte disabilitate in questo forum.
Eliminazione tuoi Post disabilitata in questo forum.
Modifica dei tuoi post disabilitata in questo forum.
Creazione Sondaggi disabilitata in questo forum.
Voto ai sondaggi disabilitato in questo forum.

Main Forum RSS : RSS

Aiutamici Theme
Powered by Yet Another Forum.net versione 1.9.1.8 (NET v2.0) - 3/29/2008
Copyright © 2003-2008 Yet Another Forum.net. All rights reserved.