Ciao Alfonso, ti scrivo dal pc di un mio amico che era impestato di tutto, ho installato l'antivirus e fatta la scansione e sono stati trovati u paio di virus, ma nonostanteio abbia fatto il controllo anche con Spybot - Search & Destroy, Ad-Aware e CWShredder, continuano ad aprirsi finestr estrane ed ancheuna motore di ricerca strano, ti allego il file log:

Logfile of HijackThis v1.98.2
Scan saved at 11.23.37, on 11/03/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
C:\Programmi\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\winn.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programmi\Pinnacle\Shared Files\remoterm.exe
C:\WINDOWS\System32\GSICON.EXE
C:\WINDOWS\System32\dslagent.exe
C:\WINDOWS\System32\cassl.exe
C:\WINDOWS\System32\MSDATLST.exe
C:\WINDOWS\sixtypopsix.exe
C:\WINDOWS\glggnq.exe
C:\WINDOWS\qttasks.exe
C:\WINDOWS\realschd.exe
C:\WINDOWS\System32\wmpa36d.exe
C:\WINDOWS\System32\systems.exe
C:\WINDOWS\System32\rundll32.exe
C:\Documents and Settings\Photo 2000\removeme.exe
C:\Programmi\File comuni\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\ap9h4qmo.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmi\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe
C:\Programmi\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
C:\WINDOWS\System32\MSDATLST.exe
C:\Corel\Graphics8\programs\MFIndexer.exe
C:\Programmi\FinePixViewer\QuickDCF.exe
C:\Programmi\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Program Files\Media Pass\MediaPass.exe
C:\Program Files\Media Pass\MediaPassK.exe
C:\Program Files\Internet Optimizer\optimize.exe
c:\temp\salm.exe
C:\Programmi\ISTsvc\istsvc.exe
C:\Documents and Settings\Photo 2000\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: &EliteSideBar - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - C:\WINDOWS\EliteSideBar\EliteSideBar 08.dll
O3 - Toolbar: (no name) - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - C:\WINDOWS\EliteToolBar\EliteToolBar version 59.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Programmi\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [mswspl] C:\Programmi\MosaicCreator\crack\run.exe
O4 - HKLM\..\Run: [PE2CKFNT SE] C:\Programmi\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe
O4 - HKLM\..\Run: [PinnacleRemote] C:\Programmi\Pinnacle\Shared Files\remoterm.exe
O4 - HKLM\..\Run: [GSICONEXE] GSICON.EXE
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [winservit] cassl.exe
O4 - HKLM\..\Run: [MS windows Data list process] MSDATLST.exe
O4 - HKLM\..\Run: [Windows Update Server] winn.exe
O4 - HKLM\..\Run: [System] mah.exe
O4 - HKLM\..\Run: [sixtysix] C:\WINDOWS\sixtypopsix.exe
O4 - HKLM\..\Run: [pIi76iT] C:\WINDOWS\glggnq.exe
O4 - HKLM\..\Run: [glaytk] c:\windows\system32\glaytk.exe
O4 - HKLM\..\Run: [SheduIer] C:\WINDOWS\qttasks.exe /i
O4 - HKLM\..\Run: [TkBellExee] C:\WINDOWS\realschd.exe
O4 - HKLM\..\Run: [antiware] C:\windows\system32\eliteizn32.exe
O4 - HKLM\..\Run: [Windows Media Player 3.6d] wmpa36d.exe
O4 - HKLM\..\Run: [Starting up] wvsvc.exe
O4 - HKLM\..\Run: [Sygate Personal Firewall] systems.exe
O4 - HKLM\..\Run: [gah95on6] C:\WINDOWS\System32\gah95on6.exe
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [Windows Service Pack Auto Update] C:\Documents and Settings\Photo 2000\removeme.exe
O4 - HKLM\..\Run: [Media Pass] C:\Program Files\Media Pass\MediaPassK.exe
O4 - HKLM\..\Run: [IST Service] C:\Programmi\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [salm] c:\temp\salm.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [SAHBundle] C:\DOCUME~1\PHOTO2~1\IMPOST~1\Temp\SAHAGE~1.EXE run
O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Programmi\File comuni\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [ap9h4qmo] C:\WINDOWS\System32\ap9h4qmo.exe
O4 - HKLM\..\Run: [nqfoj] C:\WINDOWS\nqfoj.exe
O4 - HKLM\..\RunServices: [winservit] cassl.exe
O4 - HKLM\..\RunServices: [MS windows Data list process] MSDATLST.exe
O4 - HKLM\..\RunServices: [Windows Update Server] winn.exe
O4 - HKLM\..\RunServices: [System] mah.exe
O4 - HKLM\..\RunServices: [Windows Media Player 3.6d] wmpa36d.exe
O4 - HKLM\..\RunServices: [Starting up] wvsvc.exe
O4 - HKLM\..\RunServices: [Sygate Personal Firewall] systems.exe
O4 - HKLM\..\RunOnce: [Windows Update Server] winn.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [InstantTray] C:\Programmi\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe
O4 - HKCU\..\Run: [IW_Drop_Icon] C:\Programmi\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe /DropDisc
O4 - HKCU\..\Run: [MS windows Data list process] MSDATLST.exe
O4 - HKCU\..\Run: [winservit] cassl.exe
O4 - HKCU\..\Run: [Windows Update Server] winn.exe
O4 - HKCU\..\Run: [System] mah.exe
O4 - HKCU\..\Run: [Starting up] wvsvc.exe
O4 - HKCU\..\Run: [Sygate Personal Firewall] systems.exe
O4 - HKCU\..\RunOnce: [Windows Update Server] winn.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Corel MEDIA FOLDERS INDEXER 8.LNK = C:\Corel\Graphics8\programs\MFIndexer.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
O4 - Global Startup: Exif Launcher.lnk = C:\Programmi\FinePixViewer\QuickDCF.exe
O4 - Global Startup: GARO Status Monitor.lnk = C:\Programmi\Canon\GAROStatusMonitor\cnwism.exe
O4 - Global Startup: Logo Calibration loader.lnk = ?
O4 - Global Startup: Photo Express Calendar Checker SE.lnk = C:\Programmi\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exe
O15 - Trusted Zone: *.media-motor.net
O15 - Trusted Zone: *.popuppers.com
O16 - DPF: v3cab - http://searchmiracle.com/cab/8.cab
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/GamesUnlimited/ie/bridge-c267.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1110469699730
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CA73D4C9-19B9-472C-BCC1-0CE0F1835F35}: NameServer = 213.205.32.70 213.205.36.70

---

Grazie, Maria Luisa

Ciao ,
esegui queste operazioni

1) Disattiva il ripristino di configurazione, leggi qui come fare
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=257&SH=N

2) riavvia in modalità provvisoria, leggi qui come fare
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=344&SH=N

apri HIJAC THIS ed elimina come indicato in questo articolo
http://www.aiutamici.com/software/descrizione.asp?CodSw=1175
le righe che seguono, (nel caso le righe da eliminare non compaiono in modalità provvisoria, eliminale dalla modalità normale e riavvia il computer).

==================================
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: &EliteSideBar - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - C:\WINDOWS\EliteSideBar\EliteSideBar 08.dll
O3 - Toolbar: (no name) - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - C:\WINDOWS\EliteToolBar\EliteToolBar version 59.dll
-
O4 - HKLM\..\Run: [winservit] cassl.exe
O4 - HKLM\..\Run: [MS windows Data list process] MSDATLST.exe
O4 - HKLM\..\Run: [Windows Update Server] winn.exe
O4 - HKLM\..\Run: [System] mah.exe
O4 - HKLM\..\Run: [sixtysix] C:\WINDOWS\sixtypopsix.exe
O4 - HKLM\..\Run: [pIi76iT] C:\WINDOWS\glggnq.exe
O4 - HKLM\..\Run: [glaytk] c:\windows\system32\glaytk.exe
O4 - HKLM\..\Run: [SheduIer] C:\WINDOWS\qttasks.exe /i
O4 - HKLM\..\Run: [TkBellExee] C:\WINDOWS\realschd.exe
O4 - HKLM\..\Run: [antiware] C:\windows\system32\eliteizn32.exe
O4 - HKLM\..\Run: [Windows Media Player 3.6d] wmpa36d.exe
O4 - HKLM\..\Run: [Starting up] wvsvc.exe
O4 - HKLM\..\Run: [Sygate Personal Firewall] systems.exe
O4 - HKLM\..\Run: [gah95on6] C:\WINDOWS\System32\gah95on6.exe
-
O4 - HKLM\..\Run: [Windows Service Pack Auto Update] C:\Documents and Settings\Photo 2000\removeme.exe
O4 - HKLM\..\Run: [Media Pass] C:\Program Files\Media Pass\MediaPassK.exe
O4 - HKLM\..\Run: [IST Service] C:\Programmi\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [salm] c:\temp\salm.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [SAHBundle] C:\DOCUME~1\PHOTO2~1\IMPOST~1\Temp\SAHAGE~1.EXE run
-
O4 - HKLM\..\Run: [ap9h4qmo] C:\WINDOWS\System32\ap9h4qmo.exe
O4 - HKLM\..\Run: [nqfoj] C:\WINDOWS\nqfoj.exe
O4 - HKLM\..\RunServices: [winservit] cassl.exe
O4 - HKLM\..\RunServices: [MS windows Data list process] MSDATLST.exe
O4 - HKLM\..\RunServices: [Windows Update Server] winn.exe
O4 - HKLM\..\RunServices: [System] mah.exe
O4 - HKLM\..\RunServices: [Windows Media Player 3.6d] wmpa36d.exe
O4 - HKLM\..\RunServices: [Starting up] wvsvc.exe
O4 - HKLM\..\RunServices: [Sygate Personal Firewall] systems.exe
O4 - HKLM\..\RunOnce: [Windows Update Server] winn.exe
-
O4 - HKCU\..\Run: [MS windows Data list process] MSDATLST.exe
O4 - HKCU\..\Run: [winservit] cassl.exe
O4 - HKCU\..\Run: [Windows Update Server] winn.exe
O4 - HKCU\..\Run: [System] mah.exe
O4 - HKCU\..\Run: [Starting up] wvsvc.exe
O4 - HKCU\..\Run: [Sygate Personal Firewall] systems.exe
O4 - HKCU\..\RunOnce: [Windows Update Server] winn.exe
-
O15 - Trusted Zone: *.media-motor.net
O15 - Trusted Zone: *.popuppers.com
O16 - DPF: v3cab - http://searchmiracle.com/cab/8.cab
==================================

Con la funzione TROVA di Windows, cerca ed elimina questi file,

==================================
cassl.exe
MSDATLST.exe
winn.exe
mah.exe
sixtypopsix.exe
glggnq.exe
glaytk.exe
qttasks.exe
realschd.exe
eliteizn32.exe
wmpa36d.exe
wvsvc.exe
systems.exe
gah95on6.exe
removeme.exe
MediaPassK.exe
istsvc.exe
salm.exe
optimize.exe
ap9h4qmo.exe
nqfoj.exe
==================================

SVUOTA la cartella C:\DOCUME~1\PHOTO2~1\IMPOST~1\Temp

ELIMINA la cartella in rosso C:\WINDOWS\<font color=red><b>EliteSideBar</font id=red></b>

ELIMINA la cartella in rosso C:\WINDOWS\<font color=red><b>EliteToolBar</font id=red></b>


al termine utilizza i programmi AD-AWARE e SPYBOT indicati in questo articolo
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=388&SH=N

sempre in modalità provvisoria fai una scansione Antivirus

quindi riavvia il computer e controlla se il problema e risolto, se e tutto OK riattiva il ripristino configurazione disattivato all'inizio di questa procedura.

---

Collaboratore Aiutamici

Tutto a posto Alfonso, grazie ancora.
Maria Luisa