la cartella avg e' in c:\programmi \avg l'abbiamo provata boh

voglio provare a eliminare anche la cartella di kaspersky dove trovo il percorso, e' scaricata sul desktop

nel frattempo quella voce del TM potrei eliminarla?

ti posto i log






ComboFix 08-06-05.3 - Augusto 2008-06-06 22.29.47.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.39.1040.18.1651 [GMT 2:00]
Eseguito da: C:\Documents and Settings\Utente\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Creati Da 2008-05-06 al 2008-06-06 )))))))))))))))))))))))))))))))))))
.

2008-06-05 23:06 . 2008-06-06 22:31 165,920 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-06-05 23:06 . 2008-06-06 22:26 2,540 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-06-05 18:44 . 2008-06-05 19:15 <DIR> d-------- C:\VEXPLITE
2008-06-05 18:44 . 2008-03-17 19:23 39,808 --a------ C:\WINDOWS\system32\drivers\VIRAGTLT.SYS
2008-06-03 23:06 . 2008-06-03 23:06 <DIR> d-------- C:\Programmi\Trend Micro
2008-06-03 22:08 . 2008-06-03 22:08 <DIR> d-------- C:\Programmi\AVG
2008-06-03 22:08 . 2008-06-03 22:08 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-05-15 22:50 . 2008-05-15 22:50 1,374 --a------ C:\WINDOWS\imsins.BAK

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-02 21:53 --------- d-----w C:\Documents and Settings\Utente\Dati applicazioni\Skype
2008-06-02 14:30 --------- d-----w C:\Documents and Settings\Utente\Dati applicazioni\skypePM
2008-06-01 17:31 --------- d-----w C:\Programmi\Java
2008-05-27 18:48 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\Grisoft
2008-05-02 21:06 --------- d-----w C:\Programmi\File comuni\Skype
2008-04-26 21:40 --------- d-----w C:\Documents and Settings\Utente\Dati applicazioni\vlc
2008-04-26 21:37 --------- d-----w C:\Programmi\VideoLAN
2008-04-13 20:08 --------- d-----w C:\Programmi\SlySoft
2008-04-13 20:07 --------- d-----w C:\Programmi\Elaborate Bytes
2008-04-12 14:24 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\Elaborate Bytes
2008-04-12 14:22 --------- d-----w C:\Documents and Settings\Utente\Dati applicazioni\SlySoft
2008-04-10 17:53 --------- d-----w C:\Programmi\DivX
2008-04-07 20:54 --------- d-----w C:\Programmi\Google
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 183,072 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:06 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2007-11-17 17:39 32 ----a-w C:\Documents and Settings\All Users\Dati applicazioni\ezsid.dat
2007-09-02 16:45 47,360 ------w C:\Documents and Settings\Utente\Dati applicazioni\pcouffin.sys
.

------- Sigcheck -------

2005-03-02 20:12 2060672 de16030e8209fd96eeb06d9e3d8c84a8 C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
2007-02-28 18:06 2063104 f89d8e24fbe047506d60b850d00bdee3 C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe
2004-08-30 22:00 2060544 4dc3a3626b02c39aa69aae6f64bfbc2d C:\WINDOWS\$NtUninstallKB890859$\ntkrnlpa.exe
2005-03-02 20:06 2060544 8f485cf9683f1220ba27d10281052fce C:\WINDOWS\$NtUninstallKB931784$\ntkrnlpa.exe
2007-02-28 18:02 2061312 49baea1d9379df8cd897aff9f49bc9de C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe
2007-02-28 18:02 2061312 75c9351d7ce9ee0d6b8d54f2b06ce4f9 C:\WINDOWS\system32\ntkrnlpa.exe
2007-02-28 18:02 2061312 49baea1d9379df8cd897aff9f49bc9de C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
.
((((((((((((((((((((((((((((( snapshot@2008-06-05_20.40.21,34 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-05 18:24:19 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-06 20:27:37 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2007-07-05 12:34:52 134,160 ----a-w C:\WINDOWS\system32\drivers\klif.sys
+ 2004-08-30 20:00:00 36,096 ----a-w C:\WINDOWS\system32\ReinstallBackups\0001\DriverFiles\i386\isapnp.sys
+ 2004-08-30 20:00:00 95,360 ----a-w C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386\atapi.sys
+ 2004-08-30 20:00:00 3,328 ----a-w C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386\pciide.sys
+ 2004-08-30 20:00:00 25,088 ----a-w C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386\pciidex.sys
+ 2004-08-03 21:59:44 95,360 ----a-w C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\i386\atapi.sys
+ 2001-08-30 20:54:58 3,328 ----a-w C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\i386\pciide.sys
+ 2004-08-03 21:59:42 25,088 ----a-w C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\i386\pciidex.sys
+ 2004-08-30 20:00:00 57,600 ----a-w C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\i386\usbhub.sys
+ 2004-08-30 20:00:00 142,976 ----a-w C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\i386\usbport.sys
+ 2004-08-30 20:00:00 20,480 ----a-w C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\i386\usbuhci.sys
+ 2004-08-19 15:39:30 76,800 ----a-w C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\i386\usbui.dll
+ 2004-08-03 22:08:44 57,600 ----a-w C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\i386\usbhub.sys
+ 2004-08-03 22:08:44 142,976 ----a-w C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\i386\usbport.sys
+ 2004-08-03 22:08:38 20,480 ----a-w C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\i386\usbuhci.sys
+ 2004-08-19 14:39:30 76,800 ----a-w C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\i386\usbui.dll
+ 2004-08-03 22:08:44 57,600 ----a-w C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\usbhub.sys
+ 2004-08-03 22:08:44 142,976 ----a-w C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\usbport.sys
+ 2004-08-03 22:08:38 20,480 ----a-w C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\usbuhci.sys
+ 2004-08-19 14:39:30 76,800 ----a-w C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\usbui.dll
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* i valori vuoti & legittimi/default non sono visualizzati.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-30 22:00 15360]
"swg"="C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-16 21:51 68856]
"NBJ"="C:\Programmi\Ahead\Nero BackItUp\NBJ.exe" [2005-10-11 19:25 1961984]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2006-03-23 06:17 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-03-23 06:13 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2006-03-23 06:17 118784]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-28 08:54 16248320 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 12:04 2879488 C:\WINDOWS\SkyTel.exe]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"RemoteControl"="C:\Programmi\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 20:42 32768]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" []
"OrderReminder"="C:\Programmi\Hewlett-Packard\OrderReminder\OrderReminder.exe" [2006-01-30 18:00 98304]
"SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2004-06-30 16:56 2376928]
"Adobe Reader Speed Launcher"="C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"SunJavaUpdateSched"="C:\Programmi\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]
"VIRIT LITE MONITOR"="C:\VEXPLITE\MONLITE.EXE" [2008-06-05 18:47 245760]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-30 22:00 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"IETI"="C:\Programmi\Skype\Phone\IEPlugin\unins000.exe" [ ]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programmi\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"23100:TCP"= 23100:TCP:BitComet 23100 TCP
"23100:UDP"= 23100:UDP:BitComet 23100 UDP

R0 VIRAGTLT;VIRAGTLT;C:\WINDOWS\system32\drivers\VIRAGTLT.SYS [2008-03-17 19:23]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-06-03 22:08]
R2 setup_7.0.0.180_18.05.2008_22-36;setup_7.0.0.180_18.05.2008_22-36;"C:\Documents and Settings\All Users\Desktop\Kaspersky Lab Tool\setup_7.0.0.180_18.05.2008_22-36.exe" -r []
R2 viritsvclite;Virit eXplorer Lite;C:\VEXPLITE\viritsvc.exe [2008-06-05 18:47]
R3 PAC207;Trust WB-1200p Mini Webcam;C:\WINDOWS\system32\DRIVERS\pfc027.sys [2005-02-24 12:29]
S1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys []
S2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys []

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-06 22:31:20
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
Ora fine scansione: 2008-06-06 22.32.11
ComboFix-quarantined-files.txt 2008-06-06 20:32:05
ComboFix2.txt 2008-06-05 18:40:35

10 Directory 71,962,705,920 byte disponibili
13 Directory 71,952,474,112 byte disponibili

134 --- E O F --- 2008-05-16 22:45:27











quello di avenger






Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error: folder "C:\WINDOWS\system32\drivers\Avg" not found!
Deletion of folder "C:\WINDOWS\system32\drivers\Avg" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: folder "C:\WINDOWS\AVG" not found!
Deletion of folder "C:\WINDOWS\AVG" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

ecco il log



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22.54.12, on 06/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programmi\CyberLink\PowerDVD\PDVDServ.exe
C:\Programmi\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\Programmi\Java\jre1.6.0_06\bin\jusched.exe
C:\VEXPLITE\MONLITE.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Documents and Settings\All Users\Desktop\Kaspersky Lab Tool\setup_7.0.0.180_18.05.2008_22-36.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\VEXPLITE\viritsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ilmanifesto.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Yahoo! Toolbar con blocco Pop-Up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] C:\Programmi\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [OrderReminder] C:\Programmi\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [VIRIT LITE MONITOR] C:\VEXPLITE\MONLITE.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Programmi\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [IETI] C:\Programmi\Skype\Phone\IEPlugin\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [IETI] C:\Programmi\Skype\Phone\IEPlugin\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART (User 'Default user')
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programmi\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1193479365015
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O23 - Service: setup_7.0.0.180_18.05.2008_22-36 - Kaspersky Lab - C:\Documents and Settings\All Users\Desktop\Kaspersky Lab Tool\setup_7.0.0.180_18.05.2008_22-36.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Programmi\Sygate\SPF\smc.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: Virit eXplorer Lite (viritsvclite) - TG Soft Sas www.tgsoft.it - C:\VEXPLITE\viritsvc.exe

--
End of file - 5783 bytes

Se non vuoi fare la scansione di Kaspersky, lo rimuovi cosi:

clicca sull’icona per lanciare il tool

nella finestra principale, in basso, clicca sulla voce Complete Virus Protection

verrà visualizzato un messaggio: clicca su Ok

chiudi la pagina web che verrà aperta

nel messaggio successivo, clicca su SI per avviare la disinstallazione

al termine, verrà richiesto di riavviare il P.C.

Hai provato a eliminare i 5 file uno alla volta vero?

Prova a installare AVG8.

Si,poi fai queste operazioni:
Lancia Hijackthis
pulisci, prima di tutto, gli eventuali ADS (Alternate Data Streams), quindi:
lancia Hijackthis
clicca sulla voce Open the misc tool section
clicca su Open ads spy
togli la spunta alla voce Quick scan (windows base folder only)
lascia la spunta alla voce Ignore safe system info streams
togli la spunta alla voce Calculate md5 checksum of streams
clicca su Scan
se venissero rilevati ADS, spunta tutte le caselline e clicca su Remove selected
Terminata la scansione, devi riavviare il sistema.


Provvedi a svuotare del suo contenuto la cartella Prefetch :


clicca su Risorse del Computer
clicca su Disco locale C:
cerca, all’interno delle cartelle che saranno visualizzate la cartella Windows, aprila ed, al suo interno, cerca la cartella Prefetch, la apri ed elimina tutte le voci conservate al suo interno (mi raccomando, non eliminare la cartella)
SVUOTA IL CESTINO.
Poi:
Dai una pulita (registro compreso)con CCleaner
Prova a installare AVG8
disinstalla combofix in questo modo:
Start
Esegui
nella finestra di dialogo, digita (oppure, copia ed incolla) questo comando: combofix /u e premi invio poi cancella le cartelle in "C" di combofix (qoobox)
Per avenger cestina semplicamente il tool e le relative cartelle in "C"
Virit lo disistalli con il suo UNISTALL in Start\Tutti programmi|.

No domani ti dico come eliminarli.
Ciao e buonanotte.