Ciao e scusa per il ritardo nella risposta ma stavo postando da un altro pc,dopo diverse scansioni con mab sono riuscito a far funzionare il ripristino di configurazione di sistema e ho ripristinato ad una data precedente,sembra essere tornato tutto nella normalità ,anche se il pc mi sembra legermente rallentato.Dove posso trovare i log di mab fatte in modalità provvisoria,il so è vista, per poterli postare e devo sempre fare la scansione con combofix o con qualche altro programma?
Ho visto che in quarantena d MSE ci sono diversi troian,tra cui Win 32/sirefef.AB

questi sono i log di otl:

Extras.Txt

OTL.Txt

questi i log di mab prima e dopo l'infezione:
Logs.zip

Farò come hai detto appena avrò il pc del mio amico a disposizione ,fra circa un mese ,abitiamo a più di 100 km di distanza tra di noi.
Per il momento gli consiglierò di non utilizzare la partizione con vista ma di usare quella con seven,faccio bene o il virus potrebbe continuare a creare danni?
Ti ringrazio per l'aiuto e il supporto che mi hai dato fino ad ora, ti aggiornerò degli eventi appena possibile.
Grazie

Ciao shapiro, cosa devo fare ora?

Ciao braccetto, forse shapiro si è dimenticato del tuo topic visto che è trascorso parecchio tempo, posso proseguire io, le scansioni che hai fatto dovrebbero aver eliminato un pò di roba però io non riesco ad aprire i tuoi log. Fai così posta un log di Hijack This aggiornato e vedo cosa c'è sul pc, se hai 2 S.O scansionali entrambi. Ciao

questo è il log di combofix:
ComboFix 12-12-01.01 - lucia 01/12/2012 16.11.36.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.39.1040.18.1791.833 [GMT 1:00]
Eseguito da: c:\users\lucia\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\StartSearch plugin
c:\program files\StartSearch plugin\IEhelperActiveX.dll
c:\program files\StartSearch plugin\startsplg.crx
c:\program files\StartSearch plugin\uninst.exe
.
.
((((((((((((((((((((((((( Files Creati Da 2012-11-01 al 2012-12-01 )))))))))))))))))))))))))))))))))))
.
.
2012-12-01 15:19 . 2012-12-01 15:19 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2012-12-01 15:19 . 2012-12-01 15:19 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-12-01 15:05 . 2012-12-01 15:05 6429 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\UICORE.JS
2012-12-01 15:05 . 2012-12-01 15:05 63115 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\USERTILE.JS
2012-12-01 15:05 . 2012-12-01 15:05 4599 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\UIRESOURCE.JS
2012-12-01 15:05 . 2012-12-01 15:05 9310 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TEXTBOX.JS
2012-12-01 15:05 . 2012-12-01 15:05 8646 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TILEBOX.JS
2012-12-01 15:05 . 2012-12-01 15:05 8613 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\SAVEDUSER.JS
2012-12-01 15:05 . 2012-12-01 15:05 5927 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TEXT.JS
2012-12-01 15:05 . 2012-12-01 15:05 1651 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\QUERYSTRING.JS
2012-12-01 15:05 . 2012-12-01 15:05 8288 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\IMAGE.JS
2012-12-01 15:05 . 2012-12-01 15:05 6910 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\NEWUSERCOMM.JS
2012-12-01 15:05 . 2012-12-01 15:05 6208 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\LINK.JS
2012-12-01 15:05 . 2012-12-01 15:05 18541 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\LOCALIZATION.JS
2012-12-01 15:04 . 2012-12-01 15:04 7271 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\CHECKBOX.JS
2012-12-01 15:04 . 2012-12-01 15:04 51852 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\EXTERNALWRAPPER.JS
2012-12-01 15:04 . 2012-12-01 15:04 23327 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\COMBOBOX.JS
2012-12-01 15:04 . 2012-12-01 15:04 20719 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\DIVWRAPPER.JS
2012-12-01 15:04 . 2012-12-01 15:04 8782 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\BUTTON.JS
2012-12-01 15:02 . 2012-12-01 15:02 -------- d-----w- C:\_OTL
2012-12-01 14:12 . 2012-12-01 14:06 740840 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B849B984-3CE9-457B-B26D-24AACD8FA335}\gapaengine.dll
2012-12-01 14:11 . 2012-11-08 18:00 6812136 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{868706B3-0EBD-4624-999A-500F3A539D56}\mpengine.dll
2012-11-03 18:15 . 2012-10-17 01:32 6918632 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-11-03 16:17 . 2012-11-03 16:19 -------- d-----w- c:\programdata\pcdfdata
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-12-01 14:05 . 2012-04-07 18:04 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-12-01 14:05 . 2011-07-30 17:27 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2010-06-25 08:47 . 2010-06-25 08:47 119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-03-04 21:38 121392 ----a-w- c:\acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-08-23 68856]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-03-26 5369856]
"Acer Empowering Technology Monitor"="c:\acer\Empowering Technology\SysMonitor.exe" [2008-01-09 326176]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-03-04 526896]
"PCMMediaSharing"="c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe" [2008-01-25 204908]
"WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344]
"NVRaidService"="c:\windows\system32\nvraidservice.exe" [2008-06-06 203296]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-07-01 37888]
"Skytel"="Skytel.exe" [2007-11-20 1826816]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-17 421888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-08-31 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-29 937920]
"Browsers Protector"="c:\program files\Browsers Protector\regmon32.exe" [2012-02-15 147784]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-05-02 931584]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-06-25 30192]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"Windows Defender"=%ProgramFiles%\Windows Defender\MSASCui.exe -hide
"AliceRV_McciTrayApp"=c:\program files\Alice ti aiuta\McciTrayApp.exe
.
S2 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service;c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe [x]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contenuto della cartella 'Scheduled Tasks'
.
2012-12-01 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-07 14:05]
.
2012-12-01 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2009-10-25 11:45]
.
2012-12-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-24 22:01]
.
2012-12-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-24 22:01]
.
2012-11-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1073731349-3415163795-1329833120-1000Core.job
- c:\users\lucia\AppData\Local\Google\Update\GoogleUpdate.exe [2011-02-21 22:01]
.
2012-12-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1073731349-3415163795-1329833120-1000UA.job
- c:\users\lucia\AppData\Local\Google\Update\GoogleUpdate.exe [2011-02-21 22:01]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
mStart Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = local
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
.
- - - - CHIAVI ORFANE RIMOSSE - - - -
.
URLSearchHooks-{2c965f3f-8efd-4bfc-a2c5-1672845fdbbf} - (no file)
Toolbar-{2c965f3f-8efd-4bfc-a2c5-1672845fdbbf} - (no file)
Toolbar-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file)
WebBrowser-{A1E75A0E-4397-4BA8-BB50-E19FB66890F4} - (no file)
AddRemove-30be663c - c:\windows\system32\30be663c.exe
AddRemove-StartSearch Toolbar - c:\program files\StartSearch plugin\uninst.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-12-01 16:20
Windows 6.0.6002 Service Pack 2 NTFS
.
scansione processi nascosti ...
.
scansione entrate autostart nascoste ...
.
Scansione files nascosti ...
.
Scansione completata con successo
Files nascosti: 0
.
**************************************************************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Ora fine scansione: 2012-12-01 16:27:00
ComboFix-quarantined-files.txt 2012-12-01 15:26
.
Pre-Run: 112.420.646.912 byte disponibili
Post-Run: 112.490.938.368 byte disponibili
.
- - End Of File - - D72C1DCCC24C9902E0E5123AEDCEC5E3

Sono stati eliminati tutti i file dello script di OTL, anche combofix ha eliminato qualcosa e pure Mbam, dovresti dire come va il pc, se ci sono altri problemi quando avrai sottomano il pc si potrà proseguire. Ciao

Ciao auguri anche a te.

Vai QUI ed esegui FixIt potrebbe risolvere il problema.