Come accennato nel precedente messaggio, quando sono connesso a Internet mi compare sempre una finestra di connessione abusiva e nella barra in basso delle cartelle (vuote) dal nome "AnnaNuda". Ho eliminato da windows l'origine di queste cartelle, ma inutilmente.
Il mio pc possiede i normali antivirus e le altre usuali protezioni che pero non bloccano questa intrusione indesiderata.
Aiutamici gentilmente mi ha inviato le istruzioni per fornire il mio LOG, che riporto qui di seguito. Grazie per l'assistenza.
Logfile of HijackThis v1.99.1
Scan saved at 16:00:20, on 9/08/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\Explorer.EXE
C:\windows\system32\spoolsv.exe
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\OSD.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\PROGRA~1\CA\ETRUST~1\realmon.exe
C:\windows\System32\PRISMSTA.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\DC1300\DCMnt1_0\DC1300mi.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\windows\SOUNDMAN.EXE
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Spamihilator\spamihilator.exe
C:\windows\System32\rundll32.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\windows\System32\rokgfmsqlc.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\ANYCOM\Blue USB-120-240\bin\btwdins.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
C:\Program Files\CA\eTrust Antivirus\InoRT.exe
C:\Program Files\CA\eTrust Antivirus\InoTask.exe
C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\windows\System32\svchost.exe
C:\windows\system32\fxssvc.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.98\AnnaNuda.exe
C:\PROGRA~1\WinZip\winzip32.exe
C:\DOCUME~1\ANTONI~1.SVA\LOCALS~1\Temp\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.it/0SEITIT/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.popup-freesex-adv.biz/landing.php?login=8wp320
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.virgilio.it/free
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = www.ricercadoppia.com/behaviors/google
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.it/0SEITIT/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Ricerca Doppia - {01E69986-A054-4C52-ABE8-EF63DF1C5211} - C:\WINDOWS\Downloaded Program Files\CONFLICT.6\Ricercadoppia.dll
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: m1a2 - {521693AA-7453-47ED-9959-3BD47DAA1B1A} - C:\windows\System32\msx.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: XBTB08814 - {9EC0E71A-88BE-49af-B690-7C032CDCE8B4} - C:\WINDOWS\DOWNLO~1\CONFLICT.6\RICERC~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: MSN Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1082\it-it\msntb.dll
O2 - BHO: Bytemobile BHO - {C68AE9C0-0909-4DDC-B661-C1AFB9F5AE53} - (no file)
O2 - BHO: ComCap - {E1B2E864-8BFC-4072-AE11-924E0F8BBA96} - C:\windows\System32\comcap16.dll
O2 - BHO: Dredge - {EB870508-E2B7-4169-8120-760F69703776} - C:\windows\System32\kaboom.dll
O2 - BHO: Intense - {FB47056B-B34D-410E-819A-E8A51CC8E2EB} - C:\windows\System32\Kaboom.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1082\it-it\msntb.dll
O3 - Toolbar: Virgilio Toolbar - {D3403F28-7D39-435F-A8CB-45016C29E48E} - C:\Program Files\Virgilio Toolbar\VirgilioBand.dll
O3 - Toolbar: Ricerca Doppia - {01E69986-A054-4C52-ABE8-EF63DF1C5211} - C:\WINDOWS\Downloaded Program Files\CONFLICT.6\Ricercadoppia.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe
O4 - HKLM\..\Run: [HotkeyApp] C:\Program Files\Launch Manager\HotkeyApp.exe
O4 - HKLM\..\Run: [OSD] C:\Program Files\Launch Manager\OSD.exe
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe
O4 - HKLM\..\Run: [VOBRegCheck] C:\WINDOWS\System32\VOBREGCheck.exe -CheckReg
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [PRISMSTA.EXE] PRISMSTA.EXE START
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [DC1300 Monitor] C:\Program Files\DC1300\DCMnt1_0\DC1300mi.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Connector] C:\WINDOWS\System32\Winx\SYS3.EXE -n
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [StopPhish] C:\windows\System32\PhishingFix.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SmilEmail] C:\Program Files\SmilEmail\SmilEmail.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [Spamihilator] "C:\Program Files\Spamihilator\spamihilator.exe"
O4 - HKCU\..\Run: [NBJ] "C:\PROGRA~1\Ahead\NEROBA~1\NBJ.exe"
O4 - HKCU\..\Run: [mssys.exe] C:\windows\System32\mssys.exe
O4 - HKCU\..\Run: [wke.exe] C:\windows\System32\wke.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Microsoft Security] C:\windows\System32\msbase.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Corel Family & Friends Reminders.LNK = C:\Corel\Print House Magic\cffrem.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\it-it\bin\WindowsSearch.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1082\it-it\msntb.dll/search.htm
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Apri in nuova scheda in primo piano - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0001.1119\it-it\msntabres.dll/230?7a7c50359cfd489680a8557bcf483f19
O8 - Extra context menu item: Apri in nuova scheda in secondo piano - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0001.1119\it-it\msntabres.dll/229?7a7c50359cfd489680a8557bcf483f19
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\ANYCOM\Blue USB-120-240\btsendto_ie_ctx.htm
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\windows\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\windows\web\related.htm
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ANYCOM\Blue USB-120-240\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ANYCOM\Blue USB-120-240\btsendto_ie.htm
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.virgilio.it/free
O15 - Trusted Zone: www.baciamistupido.biz
O15 - Trusted Zone: www.ciritorno.biz
O15 - Trusted Zone: www.coppiastrana.biz
O15 - Trusted Zone: www.dettaglio.biz
O15 - Trusted Zone: www.dnsreload.net
O15 - Trusted Zone: www.dolcezze.biz
O15 - Trusted Zone: content.licenseacquisition.org
O15 - Trusted Zone: www.melagodo.biz
O15 - Trusted Zone: www.nanobyte.biz
O15 - Trusted Zone: www.pergentina.biz
O15 - Trusted Zone: www.phishingfix.biz
O15 - Trusted Zone: www.playmore.biz
O15 - Trusted Zone: www.popup-freesex-adv.biz
O15 - Trusted Zone: www.preferiti-windows.com
O15 - Trusted Zone: www.redfunny.com
O15 - Trusted Zone: www.ricercadoppia.com
O15 - Trusted Zone: www.roserosse.biz
O15 - Trusted Zone: www.securize.biz
O15 - Trusted Zone: www.skymasters.biz
O15 - Trusted Zone: www.smilemail.biz
O15 - Trusted Zone: www.sumiko.biz
O15 - Trusted Zone: www.super-videochat-community.biz
O15 - Trusted Zone: www.terzodesiderio.biz
O15 - Trusted Zone: *.Trusted sites
O15 - Trusted Zone: www.umts-gprs-mondo-telefonino-cellulare.biz
O15 - Trusted Zone: www.vispateresa.biz
O15 - Trusted Zone: cds.zangocash.com
O15 - Trusted Zone: static.zangocash.com
O16 - DPF: {01E69986-A054-4C52-ABE8-EF63DF1C5211} (Ricerca Doppia) - http://www.phishingfix.biz/CheckedUrlList/Ricercadoppia_webinstall/Ricercadoppia.cab
O16 - DPF: {16E166F9-35E8-4CA5-B50D-5CEFABF45B09} - http://www.ricercadoppia.com/banner/AnnaNuda.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {2F6C63DF-48AD-44C3-A761-7FB53ECF064A} - http://www.ricercadoppia.com/tangary.exe
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/yinst/yinst_current.cab
O16 - DPF: {3CA6DFF6-C6B0-11D4-8035-0050BF0BA18C} (BMSPX Control) - http://62.72.111.226/bmspx.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqemea/downloads/sysinfo.cab
O16 - DPF: {4BEF29D6-A5C7-4330-9B56-2AF01286E45B} - http://www.popup-freesex-adv.biz/regphidett.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/242fede73d3f49446621/netzip/RdxIE601_fr.cab
O16 - DPF: {5AA5A569-F96F-4628-A528-8B3698F558BB} (HS_live Control) - http://install.homestead.com/~site/InstallFiles/SIFiles/lpxlive/HS_live.cab
O16 - DPF: {6EC7D3AB-0716-4D89-8019-6CECFA09EDD3} - http://www.popup-freesex-adv.biz/MacromediaFlashPlayerFreeDownload.cab
O16 - DPF: {73B9A791-BA9E-418A-B5A4-948B63BE04F7} - http://www.popup-freesex-adv.biz/tialla.exe
O16 - DPF: {8FA9D107-547B-4DBC-9D88-FABD891EDB0A} (shizmoo Class) - http://arcade.icq.com/multiplayer/odyssey_web8.cab
O16 - DPF: {8FEED82A-42A6-4117-A803-7EC3EB9339E0} (ClientControl Class) - http://192.168.1.2/plugin/client.cab
O16 - DPF: {9A54032D-31F7-400D-B184-83B33BDE65FA} (MSN File Upload Control) - http://sc.groups.msn.com/controls/FileUC/MsnUpld.cab
O16 - DPF: {9F54BF10-C88E-43FD-AA9E-16BF45747C72} - http://www.phishingfix.biz/CheckedUrlList/Foto.exe
O16 - DPF: {A93B47FD-9BF6-4DA8-97FC-9270B9D64A6C} (VaPgCtrl Class) - http://192.168.1.2/plugin/h263ctrl.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {C1B7E532-3ECB-4E9E-BB3A-2951FFE67C61} (DownloaderActiveX Control) - http://c6.community.virgilio.it/download/DownloaderActiveX.cab
O16 - DPF: {C3CDCDA1-FD97-488D-8EE8-24098CD9C0D2} - http://www.popup-freesex-adv.biz/start.exe
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
O16 - DPF: {EA8804CE-A2F0-4773-89B8-1E5168A1D8D7} - http://www.playmore.biz/pop/smile.exe
O16 - DPF: {EF0DBA6F-43CE-4B26-9808-2AB38FA0DB29} (MSN Money Ticker) - http://fdl.msn.com/public/investor/v13/ticker.cab
O16 - DPF: {F4F013D2-D396-4942-AF79-F826BB006021} - http://www.ricercadoppia.com/tialla.exe
O16 - DPF: {FDD394B8-F6A0-4307-95F2-EF3ED18874FB} - http://www.phishingfix.biz/CheckedUrlList/tialla.exe
O18 - Protocol: bw+0 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {056008D4-C81A-4EA9-9A0A-48616C970F9A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - (no file)
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\ANYCOM\Blue USB-120-240\bin\btwdins.exe
O23 - Service: Client de licence CA (CA_LIC_CLNT) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: Serveur de licence CA (CA_LIC_SRVR) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe
O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoTask.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
O23 - Service: Smart Servellience System Launcher (NB_ST3402) - Unknown owner - C:\Program Files\Smart VS-IP Surveillance System\Launcher_NB.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

ciao
sei messo maluccio , ma dammi 10 min che ti preparo la procedura da seguire , alla lettera mi raccomando ...
fai cosi:
- Scarica questi programmi (quelli che non hai)
Ti serviranno sia adesso per ripulire il log ma anche in seguito per la pulizia del tuo sistema.
<b>Antispyware e Protezioni</b>
Ad-aware - SpybotS&D - Spyware Blaster - CWShredder --)http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=388&SH=N

<b>Antimlware</b>
Ewido
http://www.ewido.net/en/download/
PS: é shareware ma dopo i 14 gg di prova,smetterà di funzionare solo
la protezione in tempo reale, il programma potrai continuare ad aggiornarlo per fare lo scan del tuo pc.

<b>Pulizia files inutili</b>
Ccleaner -> <b>(Quando lo installi ricordati che se lasci le spunte di defuat ,verrà installata anche la toolbar yahoo)</b>
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=1223

<b>Pulizia chiavi di registro obsolete</b>
RegSeeker
http://www.aiutamici.com/software/descrizione.asp?CodSw=931

Per il log prosegui cosi:
- Scarica lo script per riparare la trusted zone
http://www.mvps.org/winhelp2002/DelDomains.inf (--->(tasto destro sul link e salvalo sul desktop)
- Portati nelle installazioni/applicazioni del pannello di controllo e disinstalla tutto quello che non hai installato tu..

- -Scarica e decomprimi <b><u>KillBox</u></b> (é standalone e non richiede installazione)

---

- <b>Consiglio__</b>Metti hijackthis in una cartella a lui dedicata,es;(C:\HJT) altrimenti non sarà in grado di fare il backup delle voci rimosse
- <b>Consiglio__</b>Stampati la pagina perché in modalità provvisoria non avrai accesso a internet

---

Poi:
- <b>Disattiva il ripristino di configurazione di sistema</b>,
guida-->> http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=257&SH=N

- <b>Riavvia in modalità provvisoria</b>
guida-->> http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=344&SH=NA

- <b>Assicurati di avere accesso a file e cartelle nascosti</b>
(Pannello di controllo--> Opzioni Cartella--> Visualizzazione) metti la spunta su:
1)Visualizza file e cartelle nascoste
2)Disattiva nascondi file protetti di sistema
- Ora tasto destro sul file <b>.inf</b> salvato sul desktop e seleziona installa

- Avvia hijackthis, metti la spunta alle voci che andro ad elencarti e con tutte le applicazioni chiuse e disconnesso da Internet,premi su <b>fix checked</b>
O2 - BHO: m1a2 - {521693AA-7453-47ED-9959-3BD47DAA1B1A} - C:\windows\System32\msx.dll
O2 - BHO: XBTB08814 - {9EC0E71A-88BE-49af-B690-7C032CDCE8B4} - C:\WINDOWS\DOWNLO~1\CONFLICT.6\RICERC~1.DLL
O2 - BHO: Bytemobile BHO - {C68AE9C0-0909-4DDC-B661-C1AFB9F5AE53} - (no file)
O2 - BHO: ComCap - {E1B2E864-8BFC-4072-AE11-924E0F8BBA96} - C:\windows\System32\comcap16.dll
O2 - BHO: Dredge - {EB870508-E2B7-4169-8120-760F69703776} - C:\windows\System32\kaboom.dll
O2 - BHO: Intense - {FB47056B-B34D-410E-819A-E8A51CC8E2EB} - C:\windows\System32\Kaboom.dll
O4 - HKLM\..\Run: [Connector] C:\WINDOWS\System32\Winx\SYS3.EXE -n
O4 - HKLM\..\Run: [StopPhish] C:\windows\System32\PhishingFix.exe
O4 - HKLM\..\Run: [SmilEmail] C:\Program Files\SmilEmail\SmilEmail.exe
O4 - HKCU\..\Run: [mssys.exe] C:\windows\System32\mssys.exe
O4 - HKCU\..\Run: [wke.exe] C:\windows\System32\wke.exe
O4 - HKCU\..\Run: [Microsoft Security] C:\windows\System32\msbase.exe
O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1082\it-it\msntb.dll/search.htm
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
Tutte le 015
O16 - DPF: {16E166F9-35E8-4CA5-B50D-5CEFABF45B09} - http://www.ricercadoppia.com/banner/AnnaNuda.exe
O16 - DPF: {01E69986-A054-4C52-ABE8-EF63DF1C5211} (Ricerca Doppia) - http://www.phishingfix.biz/CheckedUrlList/Ricercadoppia_webinstall/Ricercadoppia .cab
O16 - DPF: {2F6C63DF-48AD-44C3-A761-7FB53ECF064A} - http://www.ricercadoppia.com/tangary.exe
O16 - DPF: {3CA6DFF6-C6B0-11D4-8035-0050BF0BA18C} (BMSPX Control) - http://62.72.111.226/bmspx.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqemea/downloads/sysinfo.cab
O16 - DPF: {4BEF29D6-A5C7-4330-9B56-2AF01286E45B} - http://www.popup-freesex-adv.biz/regphidett.exe
O16 - DPF: {5AA5A569-F96F-4628-A528-8B3698F558BB} (HS_live Control) - http://install.homestead.com/~site/InstallFiles/SIFiles/lpxlive/HS_live.cab
O16 - DPF: {73B9A791-BA9E-418A-B5A4-948B63BE04F7} - http://www.popup-freesex-adv.biz/tialla.exe
O16 - DPF: {8FEED82A-42A6-4117-A803-7EC3EB9339E0} (ClientControl Class) - http://192.168.1.2/plugin/client.cab
O16 - DPF: {9F54BF10-C88E-43FD-AA9E-16BF45747C72} - http://www.phishingfix.biz/CheckedUrlList/Foto.exe
O16 - DPF: {C3CDCDA1-FD97-488D-8EE8-24098CD9C0D2} - http://www.popup-freesex-adv.biz/start.exe
O16 - DPF: {EA8804CE-A2F0-4773-89B8-1E5168A1D8D7} - http://www.playmore.biz/pop/smile.exe
O16 - DPF: {F4F013D2-D396-4942-AF79-F826BB006021} - http://www.ricercadoppia.com/tialla.exe
O16 - DPF: {FDD394B8-F6A0-4307-95F2-EF3ED18874FB} - http://www.phishingfix.biz/CheckedUrlList/tialla.exe
O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - (no file)

- Adesso apri il bloc notes e copia\ incolla le seguenti voci:

<b>C:\windows\System32\rokgfmsqlc.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.98\AnnaNuda.exe
C:\windows\System32\msx.dll
C:\WINDOWS\DOWNLO~1\CONFLICT.6\RICERC~1.DLL
C:\windows\System32\comcap16.dll
C:\windows\System32\kaboom.dll
C:\windows\System32\PhishingFix.exe
windows\System32\mssys.exe
C:\Program Files\SmilEmail\SmilEmail.exe</b>

- Salva il file in formato txt ( ricordati il nome e dove lo salvi)
- Ora avvia KillBox (doppio click su killbox.exe)
- Nel menu file clicca su "Paste from Clipboard"
- Clicca sulla cartellina(vedi figura),cerca e seleziona il file.txt creato prima
- Seleziona "delete on reboot"
- Clicca su "All Files"
- Infine clicca sulla X bianca a sfondo rosso in alto a destra
- Il computer verrà riavviato

<img src="http://img453.imageshack.us/img453/4278/killbox4ek.jpg" border=0>

- Ora sempre dalla modalità provvisoria cerca ed elimina le rispettive cartelle se ancora presenti:
C:\WINDOWS\Downloaded Program Files\<b>CONFLICT.98</b>
C:\Program Files\<b>SmilEmail</b>

- Dai una ripulita ai files inutili,temp etc con Ccleaner
PS:prima di usarlo vai in opzioni-->avanzate e togli la spunta da:
(elimina file di windows solo se piu vecchi di 48 ore)

- Elimina le chiavi di registro ormai inutili con RegSeeker

- Fai una scansione con il tuo antivirus e con i programmi elencati sopra [SpybotS&D / Ad-aware / Ewido / CWShredder]
- Applica le protezioni di spyware blaster

- Ritorna in modalità normale,e <b>posta un log aggiornato per vedere cosa rimane</b>

- Al limite fai anche uno scan online:
BitDefender
oppure
Panda
http://steven.altervista.org/files/scan.html

- Dovresti fare il windows update per aggiornare il sistema compreso IE
http://update.microsoft.com/windowsupdate/v6/thanks.aspx?ln=it&&thankspage=5

- Se vuoi aumentare notevolmente il livello di sicurezza del tuo sistema dovresti installare il ServicePack2
http://www.microsoft.com/downloads/details.aspx?FamilyID=049c9dbe-3b8e-4f30-8245-9e368d3cdb5a&DisplayLang=it

Dovresti installare un firewall diverso da quello di windows -> http://www.aiutamici.com/software/descrizione.asp?CodSw=56

<b>PS__</b> Alla fine delle procedure é importante:
1) ri-nascondere i file e le cartelle di sistema
2) Riattivare il ripristino configurazione di sistema
3) Creare un nuovo punto di ripristino -> http://steven.altervista.org/files/ripristino.html

PS__mi raccomando disconnesso da internet e con tutte le applicazioni chiuse vanno fatte le procedure




Edited by - steven75 on 08/09/2006 19:46:06

Grazie ai suggerimenti di Aiutamici sono riuscito ad eliminare definitivamente (speriamo....) AnnaNuda. Grazie ancora.

svaldan - Bruxelles