Tale software mi si inchioda appena arriva a
scannerizzare la cartella C:\\WINDOWS\\Microsoft.NET\Managed Directx\v.9.03.91

Qualcuno potrebbe spiegarmi il perchè e come posso ovviare ? TAD
SO : winxpsp2
Se può servire allego qui sotto il mio log:
Logfile of HijackThis v1.99.1
Scan saved at 10.25.57, on 20/04/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\aaksrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
c:\programmi\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\Programmi\Eset\nod32krn.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\ups.exe
C:\Programmi\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE
C:\Programmi\ClocX\ClocX.exe
C:\Programmi\Eset\nod32kui.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programmi\SlySoft\AnyDVD\AnyDVD.exe
C:\Programmi\Eraser\eraser.exe
C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\ABIT\ABITEQ\ABITEQ.exe
C:\Programmi\Advanced Anti Keylogger\aak.exe
C:\Programmi\BHODemon 2\BHODemon.exe
C:\Programmi\Windows Media Bonus Pack for Windows XP\PowerToys\mpxptray.exe
C:\Programmi\OpenOffice.org 2.0\program\soffice.exe
C:\Programmi\OpenOffice.org 2.0\program\soffice.BIN
C:\Programmi\Alice ti aiuta\bin\mpbtn.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\System32\dllhost.exe
C:\WINDOWS\system32\inetsrv\DavCData.exe
C:\Documents and Settings\walter\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Programmi\SiteAdvisor\saIE.dll
O2 - BHO: Bugnosis - {3A6514CD-A457-11D4-8AF3-000102686B79} - C:\Programmi\Bugnosis\WebBug.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Programmi\SiteAdvisor\saIE.dll
O3 - Toolbar: Bugnosis - {930E4DE1-973D-42D6-BF6E-6788E06BD003} - C:\Programmi\Bugnosis\WebBug.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Programmi\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [EPSON Stylus C46 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE /P23 "EPSON Stylus C46 Series" /O6 "USB001" /M "Stylus C46"
O4 - HKLM\..\Run: [Diagnostica SpeedTouch USB] "C:\Programmi\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [ClocX] C:\Programmi\ClocX\ClocX.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AnyDVD] "C:\Programmi\SlySoft\AnyDVD\AnyDVD.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmi\File comuni\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [Eraser] C:\Programmi\Eraser\eraser.exe -hide
O4 - HKCU\..\Run: [AWMON] "C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AAK] C:\Programmi\Advanced Anti Keylogger\aak.exe /silent
O4 - HKCU\..\Run: [updateMgr] "C:\Programmi\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - Startup: ABITEQ.lnk = C:\Programmi\ABIT\ABITEQ\ABITEQ.exe
O4 - Startup: Advanced Anti Keylogger.lnk = C:\Programmi\Advanced Anti Keylogger\aak.exe
O4 - Startup: BHODemon 2.0.lnk = C:\Programmi\BHODemon 2\BHODemon.exe
O4 - Startup: MPXPTray.lnk = C:\Programmi\Windows Media Bonus Pack for Windows XP\PowerToys\mpxptray.exe
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Programmi\OpenOffice.org 2.0\program\quickstart.exe
O4 - Global Startup: Alice ti aiuta.lnk = C:\Programmi\Alice ti aiuta\bin\matcli.exe
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: + Offline andExplorer: Download the link - file://C:\Programmi\Offline Explorer Pro\Add_UrlO.htm
O8 - Extra context menu item: + Offline Eandxplorer: Download the current page - file://C:\Programmi\Offline Explorer Pro\Add_AllO.htm
O8 - Extra context menu item: Scarica con Download andExpress - C:\Programmi\Download Express\Add_Url.htm
O8 - Extra context menu item: _TYPEPAD_QUICKPOST_LABEL - https://www.typepad.com/t/app?__mode=reg_qp_jsandqp_show=ac,ew&qp_height=540
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Zoom In - {A0E6D3BD-A661-447D-8634-0751467857F3} - C:\Programmi\Easy Read\ZoomIn.js
O9 - Extra button: Zoom Out - {AEBB571B-4C48-438D-808D-999F168CDECE} - C:\Programmi\Easy Read\ZoomOut.js
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O15 - Trusted Zone: http://portale.rossoalice.virgilio.it
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0036A314-0307-4C2A-89B1-136EEAFCD165}: NameServer = 85.37.17.8 85.38.28.73
O17 - HKLM\System\CS3\Services\Tcpip\..\{0036A314-0307-4C2A-89B1-136EEAFCD165}: NameServer = 85.37.17.8 85.38.28.73
O23 - Service: aaksrv - Spydex, Inc. - C:\WINDOWS\system32\aaksrv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\programmi\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmi\Eset\nod32krn.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - :ProgramFiles:\WinPcap\rpcapd.exe" -d -f ":ProgramFiles:\WinPcap\rpcapd.ini (file missing)



Edited by - w_l_e_53 on 04/20/2006 10:47:42

Edited by - w_l_e_53 on 04/20/2006 10:52:57

Il log é pulito da spyware

fai una scansione antivirus on line da questo indirizzo
http://it.mcafee.com/root/mfs/default.asp

poi fai una scansione con SCANDISK in modalità provvisoria
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=306&SH=N

---

Collaboratore Aiutamici

Purtroppo è così come dici tu. Anche, se, però alla fine in una schermata blu ni dice che il disco fisso è integro. Grazie al cielo ho un HD esterno di 80 GB sui quali ho copiato tutti gli applicativi che ed ho anche il disco originale di winxpsp2. E' possibile fare il backup sul disco esterno o posso copiare tutti i files sull'HD esterno dal disco fisso interno C...
Oltre la spesa sono davvero preoccupato di dover cambiare HD ecc.ecc. anche perchè ho già provato cosa vuol dire formattare C ben tre volte. L'ultima volta ci ho messo otto giorni per ripristinare il tutto... <img src=icon_smile_angry.gif border=0 align=middle><img src=icon_smile_sad.gif border=0 align=middle> Grazie comunque. In ogni caso adesso, dopo il "trattamento" suggerito da Alfonso Ad-Aware non viene più bloccato dal malefico files... Dimmi qualcosa, se puoi...
TAD

Lancia SCANDISK in modalità provvisoria e spunta le due caselline per la correzione degli errori, questi correggeranno la traccia difettosa.

Ripeti la scansione nei giorni seguenti, se non si ripresentano altre tracce danneggiate, puoi continuare a utilizzare tranquillamente quel disco fisso, se invece escono fuori altre tracce danneggiate, e meglio comprare un nuovo disco fisso, nel frattempo fai spesso le copie di riserva dei tuoi dati, o salva i dati importanti su un altro disco.

---

Collaboratore Aiutamici