aiutatemi ve ne prego...non so come liberarmi di loro in modo definitivo...ma senza formattare sono come l'erba cattiva....allego log....

Logfile of HijackThis v1.99.1
Scan saved at 16.44.41, on 18/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\MalwareRemover.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmi\MSN Messenger\msnmsgr.exe
C:\Documents and Settings\Administrator\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tim.it/
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {0070A397-436C-1BBD-AED0-655794276F6E} - C:\WINDOWS\idftu1.dll (file missing)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)
O4 - HKLM\..\Run: [MSGlobal] C:\WINDOWS\system32\Idro.exe
O4 - HKLM\..\Run: [MicrosoftFirewall] C:\WINDOWS\system32\MSFirewall.exe
O4 - HKLM\..\Run: [SmilEmail] C:\Programmi\SmilEmail\SmilEmail.exe
O4 - HKLM\..\Run: [TrojanScanner] C:\Programmi\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [MSMalwareKit] C:\WINDOWS\system32\MalwareRemover.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ScaricaMP3] C:\Documents and Settings\Administrator\Dati applicazioni\ScaricaMP3[1].exe t
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmi\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [lateshow.exe] C:\WINDOWS\system32\lateshow.exe
O4 - HKCU\..\Run: [wke.exe] C:\WINDOWS\system32\wke.exe
O9 - Extra button: ScaricaMP3 - {EF6D6AE3-2625-40D6-A5AB-920DFD2DAF8C} - C:\Documents and Settings\Administrator\Dati applicazioni\ScaricaMP3[1].exe
O15 - Trusted Zone: www.acquadirose.com
O15 - Trusted Zone: www.cisiamodibrutto.com
O15 - Trusted Zone: www.cywanstorage.biz
O15 - Trusted Zone: www.forteforte.com
O15 - Trusted Zone: www.gooogle.bz
O15 - Trusted Zone: www.nanobyte.biz
O15 - Trusted Zone: www.phishingfix.biz
O15 - Trusted Zone: www.playmore.biz
O15 - Trusted Zone: www.preferiti-windows.com
O15 - Trusted Zone: www.ricercadoppia.com
O15 - Trusted Zone: www.scalalap.com
O15 - Trusted Zone: www.smilemail.biz
O15 - Trusted Zone: www.tuttaqualita.com
O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab
O16 - DPF: {3A4DCD02-A451-4799-9E1C-AC0D4F769A97} - http://www.cywanstorage.biz/PHFX/MSPhish.exe
O16 - DPF: {3F5E67E1-81E6-4487-BF6F-07941A080BAB} - http://www.cywanstorage.biz/SUPERINSTALLER/messenger.exe
O16 - DPF: {5C626A4F-28A7-4A29-9EC8-6BE20FC70424} - http://www.playmore.biz/pop/amarcord/Amarcord.exe
O16 - DPF: {9CAEE012-5DFF-11DB-8373-B622A1EF5492} - http://www.cywanstorage.biz/SUPERINSTALLER/Amarcord.exe
O16 - DPF: {EA5B2F8A-2094-47A1-ADC5-373E93EAF936} - http://www.cywanstorage.biz/DRT65/IBWire.exe
O16 - DPF: {EA8804CE-A2F0-4773-89B8-1E5168A1D8D7} - http://www.playmore.biz/pop/smile.exe
O16 - DPF: {EB5CDBC6-DBA4-48BC-B888-5E2CFF9DF3CD} - http://www.playmore.biz/pop/MSF.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe

Ciao ,
esegui queste operazioni

Disattiva il ripristino di configurazione, leggi qui come fare
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=257&SH=N

Riavvia in modalità provvisoria, leggi qui come fare
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=344&SH=N

apri HIJAC THIS ed elimina come indicato in questo articolo
http://www.aiutamici.com/software/descrizione.asp?CodSw=1175
le righe che seguono.

==================================
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {0070A397-436C-1BBD-AED0-655794276F6E} - C:\WINDOWS\idftu1.dll (file missing)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)
O4 - HKLM\..\Run: [MSGlobal] C:\WINDOWS\system32\Idro.exe
O4 - HKLM\..\Run: [MicrosoftFirewall] C:\WINDOWS\system32\MSFirewall.exe
O4 - HKLM\..\Run: [SmilEmail] C:\Programmi\SmilEmail\SmilEmail.exe
-
O4 - HKLM\..\Run: [MSMalwareKit] C:\WINDOWS\system32\MalwareRemover.exe
-
O4 - HKCU\..\Run: [ScaricaMP3] C:\Documents and Settings\Administrator\Dati applicazioni\ScaricaMP3[1].exe t
-
O4 - HKCU\..\Run: [lateshow.exe] C:\WINDOWS\system32\lateshow.exe
O4 - HKCU\..\Run: [wke.exe] C:\WINDOWS\system32\wke.exe
O9 - Extra button: ScaricaMP3 - {EF6D6AE3-2625-40D6-A5AB-920DFD2DAF8C} - C:\Documents and Settings\Administrator\Dati applicazioni\ScaricaMP3[1].exe
O15 - Trusted Zone: www.acquadirose.com
O15 - Trusted Zone: www.cisiamodibrutto.com
O15 - Trusted Zone: www.cywanstorage.biz
O15 - Trusted Zone: www.forteforte.com
O15 - Trusted Zone: www.gooogle.bz
O15 - Trusted Zone: www.nanobyte.biz
O15 - Trusted Zone: www.phishingfix.biz
O15 - Trusted Zone: www.playmore.biz
O15 - Trusted Zone: www.preferiti-windows.com
O15 - Trusted Zone: www.ricercadoppia.com
O15 - Trusted Zone: www.scalalap.com
O15 - Trusted Zone: www.smilemail.biz
O15 - Trusted Zone: www.tuttaqualita.com
-
O16 - DPF: {3A4DCD02-A451-4799-9E1C-AC0D4F769A97} - http://www.cywanstorage.biz/PHFX/MSPhish.exe
-
O16 - DPF: {5C626A4F-28A7-4A29-9EC8-6BE20FC70424} - http://www.playmore.biz/pop/amarcord/Amarcord.exe
O16 - DPF: {9CAEE012-5DFF-11DB-8373-B622A1EF5492} - http://www.cywanstorage.biz/SUPERINSTALLER/Amarcord.exe
O16 - DPF: {EA5B2F8A-2094-47A1-ADC5-373E93EAF936} - http://www.cywanstorage.biz/DRT65/IBWire.exe
O16 - DPF: {EA8804CE-A2F0-4773-89B8-1E5168A1D8D7} - http://www.playmore.biz/pop/smile.exe
O16 - DPF: {EB5CDBC6-DBA4-48BC-B888-5E2CFF9DF3CD} - http://www.playmore.biz/pop/MSF.exe
==================================


Elimina i file in rosso nei percorsi indicati
==================================
C:\WINDOWS\<font color=red><b>idftu1.dll</font id=red></b>
C:\WINDOWS\system32\<font color=red><b>Idro.exe </font id=red></b>
C:\WINDOWS\system32\<font color=red><b>MSFirewall.exe </font id=red></b>
C:\Programmi\SmilEmail\<font color=red><b>SmilEmail.exe </font id=red></b>
C:\WINDOWS\system32\<font color=red><b>MalwareRemover.exe </font id=red></b>
C:\Documents and Settings\Administrator\Dati applicazioni\<font color=red><b>ScaricaMP3[1].exe</font id=red></b>
C:\WINDOWS\system32\<font color=red><b>lateshow.exe </font id=red></b>
C:\WINDOWS\system32\<font color=red><b>wke.exe</font id=red></b>
==================================


Vai a PANNELLO DI CONTROLLO e clicca su OPZIONI INTERNET
nella finestra che si apre clicca i tre pulsanti
ELIMINA COOKIES - ELIMINA FILE - CANCELLA CRONOOLOGIA
poi clicca il pulsante PAGINA PREDEFINITA e su OK

al termine utilizza i programmi AD-AWARE e SPYBOT indicati in questo articolo
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=388&SH=N

sempre in modalità provvisoria fai una scansione Antivirus

quindi riavvia il computer e controlla se il problema e risolto, se e tutto OK riattiva il ripristino configurazione disattivato all'inizio di questa procedura e crea un nuovo punto di ripristino, leggi qui alla voce 8
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=170&SH=N

Fai una scansione antivirus on line da questo indirizzo
http://security.symantec.com/sscv6/default.asp?productid=globalsites&langid=it&venid=sym

Se la scansione antivirus on line rileva ancora virus, formatta il disco fisso e reinstalla tutto


Nel sistema non é presente un Firewall o è disattivato, installa questo o il tuo programma
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=56
e disattiva l'inutile firewall di XP, leggi qui
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=160&SH=N

Utilizza questo programma
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=1041

---

Collaboratore Aiutamici