facendo una scansione con anti.rootkit mi ha rilevato codeste voci che però non posso eliminare o almeno così dice anti-rootkit, è una cosa pericolosa? di seguito vi lascio ciò che c'è scritto
area Windows Registry
hidden Registry Value
\HKEY_USERS\S-1-5-21-3495722017-1985487799-1902824246-1008\software\microsoft\windows\currentverson\run\mpmwxd
area local hard Drives
unknown hidden file
C:\Documents and Setting\Compaq_Presario\Impostazioni locali\dati applicazioni\mpmwxd_navps.dat
C:\documents and setting\compq_presario\impostazioni locali\dati applicazioni\mpmwxd.dat
""" """ idem come sopra \mpmwxd.exe
idem come sopra \nav.dat
ringraziando anticipatamente tutti coloro che potranno aiutarmi

Dovrebbe trattarsi di files "nascosti" collegati in qualche modo al Norton Antivirus...
Quale anti-rootkit hai usato? Prova, magari, a riavviare il computer e poi rifar la scansione antirootkit.

fai una scansione con Gmer. Come anti rootkit non ha uguali. Se c'è qualcosa di sospetto lo scrive in rosso. Vai qui, leggi e scarica.
http://www.gmer.net/index.php

---

cos'hai un HP come pc? sembrano file legati al pc oppure al sistema, non mi sembrano virus, io ho il tuo stesso antirootkit ed una volta mi ha trovato dei file "pericolosi" pero' poi diceva che non andavano eliminati. Dopo alcune ricerche ho capito che non erano virus.

allora ho fatto la scansione con GMER a metà si è bloccata con questa dicitura
WARNING!!!
GMER has found system modification caused by ROOTKIT activity
c'erano anche nella scansione queste voci rosse che vi riporto
Process C:\Documents and Settings\compaq_proprietario\impostazioni locali\dati applicazioni\mpmwxd.exe (***hidden***)
Library C:\Documents and Settings\compaq_proprietario\impostazioni locali\dati applicazioni\mpmwxd.exe @C:\Documents and settings\compaq_proprietario\impostazioni locali\dati applicazioni\mpmwxd.exe [496]
ho un HP come pc
e che ne sappia io non ho mai avuto un norton lo comprato nuovo...boh

AIUTOOOOOOOOOOOO
elimino la voce quella del processo mi dice kill process io dico si nella library invece mi da solo options e about e non riesco ad eliminarla quella voce
ho riavviato e ilprocesso c'era di nuovo cosa posso fare???????

GMER 1.0.14.14205 - http://www.gmer.net
Autostart scan 2008-03-13 18:52:39
Windows 5.1.2600 Service Pack 2


HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems@Windows = %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon@Userinit = C:\WINDOWS\system32\userinit.exe,

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon@DLLName = WgaLogon.dll

HKLM\SYSTEM\CurrentControlSet\Services\ >>>
Avg7Alrt@ = C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
Avg7UpdSvc@ = C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
AVGEMS@ = C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
DevNotifySvc@ = C:\Programmi\Common Files\Sitecom Shared\PnP Universal Installer\DevNotifySvc.exe
NVSvc@ = %SystemRoot%\system32\nvsvc32.exe
PCToolsFirewallPlus@ = C:\Programmi\PC Tools Firewall Plus\FWService.exe
WinDefend@ = "C:\Programmi\Windows Defender\MsMpEng.exe"

HKLM\Software\Microsoft\Windows\CurrentVersion\Run >>>
@SunJavaUpdateSched"C:\Programmi\Java\jre1.6.0_02\bin\jusched.exe" = "C:\Programmi\Java\jre1.6.0_02\bin\jusched.exe"
@hpsysdrvc:\windows\system\hpsysdrv.exe = c:\windows\system\hpsysdrv.exe
@NvCplDaemonRUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup = RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
@nwiznwiz.exe /installquiet /keeploaded /nodetect = nwiz.exe /installquiet /keeploaded /nodetect
@RemoteControlC:\Programmi\ASUS\ASUS Remote\RemoteControlAppl.exe = C:\Programmi\ASUS\ASUS Remote\RemoteControlAppl.exe
@RecguardC:\WINDOWS\SMINST\RECGUARD.EXE = C:\WINDOWS\SMINST\RECGUARD.EXE
@PS2C:\WINDOWS\system32\ps2.exe = C:\WINDOWS\system32\ps2.exe
@TkBellExe"C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot = "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
@LXBYCATSrundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBYtime.dll,_RunDLLEntry@16 = rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBYtime.dll,_RunDLLEntry@16
@Windows Defender"C:\Programmi\Windows Defender\MSASCui.exe" -hide = "C:\Programmi\Windows Defender\MSASCui.exe" -hide
@00PCTFW"C:\Programmi\PC Tools Firewall Plus\FirewallGUI.exe" -s = "C:\Programmi\PC Tools Firewall Plus\FirewallGUI.exe" -s
@AVG7_CCC:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP = C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP

HKCU\Software\Microsoft\Windows\CurrentVersion\Run >>>
@ctfmon.exeC:\WINDOWS\system32\ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe
@swgC:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe = C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
@mpmwxdc:\documents and settings\compaq_proprietario\impostazioni locali\dati applicazioni\mpmwxd.exe mpmwxd /*file not found*/ = c:\documents and settings\compaq_proprietario\impostazioni locali\dati applicazioni\mpmwxd.exe mpmwxd /*file not found*/

HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad@WPDShServiceObj = C:\WINDOWS\system32\WPDShServiceObj.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks@{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} = C:\PROGRA~1\WIFD1F~1\MpShHook.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved >>>
@{42071714-76d4-11d1-8b24-00a0c9068ff3} /*Estensione panoramica video del Pannello di controllo*/deskpan.dll /*file not found*/ = deskpan.dll /*file not found*/
@{596AB062-B4D2-4215-9F74-E9109B0A8153} /*Pagina proprietà versioni precedenti*/%SystemRoot%\system32\twext.dll = %SystemRoot%\system32\twext.dll
@{9DB7A13C-F208-4981-8353-73CC61AE2783} /*Versioni precedenti*/%SystemRoot%\system32\twext.dll = %SystemRoot%\system32\twext.dll
@{00E7B358-F65B-4dcf-83DF-CD026B94BFD4} /*Autoplay for SlideShow*/(null) =
@{692F0339-CBAA-47e6-B5B5-3B84DB604E87} /*Extensions Manager Folder*/%SystemRoot%\system32\extmgr.dll = %SystemRoot%\system32\extmgr.dll
@{A70C977A-BF00-412C-90B7-034C51DA2439} /*NvCpl DesktopContext Class*/C:\WINDOWS\system32\nvcpl.dll = C:\WINDOWS\system32\nvcpl.dll
@{FFB699E0-306A-11d3-8BD1-00104B6F7516} /*Play on my TV helper*/C:\WINDOWS\system32\nvcpl.dll = C:\WINDOWS\system32\nvcpl.dll
@{1CDB2949-8F65-4355-8456-263E7C208A5D} /*Desktop Explorer*/C:\WINDOWS\system32\nvshell.dll = C:\WINDOWS\system32\nvshell.dll
@{1E9B04FB-F9E5-4718-997B-B8DA88302A47} /*Desktop Explorer Menu*/C:\WINDOWS\system32\nvshell.dll = C:\WINDOWS\system32\nvshell.dll
@{1E9B04FB-F9E5-4718-997B-B8DA88302A48} /*nView Desktop Context Menu*/C:\WINDOWS\system32\nvshell.dll = C:\WINDOWS\system32\nvshell.dll
@{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} /*Shell Extensions for RealOne Player*/C:\Programmi\Real\RealPlayer\rpshell.dll = C:\Programmi\Real\RealPlayer\rpshell.dll
@{7F67036B-66F1-411A-AD85-759FB9C5B0DB} /*ShellViewRTF*/C:\WINDOWS\system32\ShellvRTF.dll = C:\WINDOWS\system32\ShellvRTF.dll
@{B327765E-D724-4347-8B16-78AE18552FC3} /*NeroDigitalIconHandler*/(null) =
@{7F1CF152-04F8-453A-B34C-E609530A9DC8} /*NeroDigitalPropSheetHandler*/(null) =
@{35786D3C-B075-49b9-88DD-029876E11C01} /*Portable Devices*/%SystemRoot%\system32\wpdshext.dll = %SystemRoot%\system32\wpdshext.dll
@{D6791A63-E7E2-4fee-BF52-5DED8E86E9B8} /*Portable Devices Menu*/%SystemRoot%\system32\wpdshext.dll = %SystemRoot%\system32\wpdshext.dll
@{45AC2688-0253-4ED8-97DE-B5370FA7D48A} /*Shell Extension for Malware scanning*/(null) =
@{BD88A479-9623-4897-8546-BC62B9628F44} /*SPTHandler*/(null) =
@{792F0537-F929-4eb7-AC1D-FB6334C71550} /*LG Phone*/C:\PROGRA~1\LGPCSU~1\LGPHON~1\Phone.dll = C:\PROGRA~1\LGPCSU~1\LGPHON~1\Phone.dll
@{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} /*AVG7 Shell Extension*/C:\Programmi\Grisoft\AVG7\avgse.dll = C:\Programmi\Grisoft\AVG7\avgse.dll
@{9F97547E-460A-42C5-AE0C-81C61FFAEBC3} /*AVG7 Find Extension*/C:\Programmi\Grisoft\AVG7\avgse.dll = C:\Programmi\Grisoft\AVG7\avgse.dll
@{23170F69-40C1-278A-1000-000100020000} /*7-Zip Shell Extension*/C:\Programmi\7-Zip\7-zip.dll = C:\Programmi\7-Zip\7-zip.dll

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ >>>
7-Zip@{23170F69-40C1-278A-1000-000100020000} = C:\Programmi\7-Zip\7-zip.dll
AVG7 Shell Extension@{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} = C:\Programmi\Grisoft\AVG7\avgse.dll

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\7-Zip@{23170F69-40C1-278A-1000-000100020000} = C:\Programmi\7-Zip\7-zip.dll

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\AVG7 Shell Extension@{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} = C:\Programmi\Grisoft\AVG7\avgse.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects >>>
@{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll = C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
@{53707962-6F74-2D53-2644-206D7942484F}C:\Programmi\Spybot - Search & Destroy\SDHelper.dll = C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
@{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}C:\Programmi\Java\jre1.6.0_02\bin\ssv.dll = C:\Programmi\Java\jre1.6.0_02\bin\ssv.dll
@{AA58ED58-01DD-4d91-8333-CF10577473F7}c:\programmi\google\googletoolbar3.dll = c:\programmi\google\googletoolbar3.dll
@{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}C:\Programmi\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll = C:\Programmi\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll

HKLM\Software\Microsoft\Internet Explorer\Main >>>
@Default_Page_URLhttp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
@Start Pagehttp://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
@Local Page%SystemRoot%\system32\blank.htm = %SystemRoot%\system32\blank.htm

HKCU\Software\Microsoft\Internet Explorer\Main >>>
@Default_Page_URLhttp://it.msn.com/ = http://it.msn.com/
@Start Pagehttp://www.google.it/ = http://www.google.it/
@Local PageC:\WINDOWS\system32\blank.htm = C:\WINDOWS\system32\blank.htm

HKLM\Software\Classes\PROTOCOLS\Handler\ >>>
dvd@CLSID = C:\WINDOWS\system32\msvidctl.dll
its@CLSID = C:\WINDOWS\system32\itss.dll
mhtml@CLSID = %SystemRoot%\system32\inetcomm.dll
ms-its@CLSID = C:\WINDOWS\system32\itss.dll
ms-itss@CLSID = c:\Programmi\File comuni\Microsoft Shared\Information Retrieval\msitss.dll
tv@CLSID = C:\WINDOWS\system32\msvidctl.dll

HKLM\Software\Classes\PROTOCOLS\Handler\wia@CLSID = C:\WINDOWS\system32\wiascr.dll

---- EOF - GMER 1.0.14 ----
e questo che dovevo copiare? spero di si ti posto anche l'altro log con i file in rosso ok?

GMER 1.0.14.14205 - http://www.gmer.net
Rootkit scan 2008-03-13 20:05:41
Windows 5.1.2600 Service Pack 2


---- System - GMER 1.0.14 ----

SSDT \SystemRoot\system32\drivers\pctmp.sys (Memory Monitor Driver/PCTools Research Pty Ltd.) ZwAllocateVirtualMemory [0xF77D2EEC]
SSDT \SystemRoot\system32\drivers\pctmp.sys (Memory Monitor Driver/PCTools Research Pty Ltd.) ZwProtectVirtualMemory [0xF77D327E]
SSDT \SystemRoot\system32\drivers\pctmp.sys (Memory Monitor Driver/PCTools Research Pty Ltd.) ZwSetValueKey [0xF77D398A]

---- User code sections - GMER 1.0.14 ----

.text C:\Programmi\Java\jre1.6.0_02\bin\jusched.exe[236] ntdll.dll!NtEnumerateKey 7C91D94C 5 Bytes JMP 1000200E
.text C:\Programmi\Java\jre1.6.0_02\bin\jusched.exe[236] ntdll.dll!NtEnumerateValueKey 7C91D976 5 Bytes JMP 10001DAF
.text C:\Programmi\Java\jre1.6.0_02\bin\jusched.exe[236] ntdll.dll!NtQueryDirectoryFile 7C91DF5E 5 Bytes JMP 10001CF2
.text C:\Programmi\Java\jre1.6.0_02\bin\jusched.exe[236] ntdll.dll!NtQuerySystemInformation 7C91E1AA 5 Bytes JMP 1000191B
.text C:\windows\system\hpsysdrv.exe[252] ntdll.dll!NtEnumerateKey 7C91D94C 5 Bytes JMP 00EF200E
.text C:\windows\system\hpsysdrv.exe[252] ntdll.dll!NtEnumerateValueKey 7C91D976 5 Bytes JMP 00EF1DAF
.text C:\windows\system\hpsysdrv.exe[252] ntdll.dll!NtQueryDirectoryFile 7C91DF5E 5 Bytes JMP 00EF1CF2
.text C:\windows\system\hpsysdrv.exe[252] ntdll.dll!NtQuerySystemInformation 7C91E1AA 5 Bytes JMP 00EF191B
.text C:\Programmi\ASUS\ASUS Remote\RemoteControlAppl.exe[304] ntdll.dll!NtEnumerateKey 7C91D94C 5 Bytes JMP 00F3200E
.text C:\Programmi\ASUS\ASUS Remote\RemoteControlAppl.exe[304] ntdll.dll!NtEnumerateValueKey 7C91D976 5 Bytes JMP 00F31DAF
.text C:\Programmi\ASUS\ASUS Remote\RemoteControlAppl.exe[304] ntdll.dll!NtQueryDirectoryFile 7C91DF5E 5 Bytes JMP 00F31CF2
.text C:\Programmi\ASUS\ASUS Remote\RemoteControlAppl.exe[304] ntdll.dll!NtQuerySystemInformation 7C91E1AA 5 Bytes JMP 00F3191B
.text C:\WINDOWS\system32\rundll32.exe[336] ntdll.dll!NtEnumerateKey 7C91D94C 5 Bytes JMP 00CF200E
.text C:\WINDOWS\system32\rundll32.exe[336] ntdll.dll!NtEnumerateValueKey 7C91D976 5 Bytes JMP 00CF1DAF
.text C:\WINDOWS\system32\rundll32.exe[336] ntdll.dll!NtQueryDirectoryFile 7C91DF5E 5 Bytes JMP 00CF1CF2
.text C:\WINDOWS\system32\rundll32.exe[336] ntdll.dll!NtQuerySystemInformation 7C91E1AA 5 Bytes JMP 00CF191B
.text C:\WINDOWS\system32\rundll32.exe[336] USER32.dll!DialogBoxParamW 7E3A555F 5 Bytes JMP 00D11050 C:\Programmi\Common Files\Sitecom Shared\PnP Universal Installer\signhook.dll
.text C:\WINDOWS\system32\rundll32.exe[336] USER32.dll!DialogBoxParamA 7E3BB10C 5 Bytes JMP 00D11000 C:\Programmi\Common Files\Sitecom Shared\PnP Universal Installer\signhook.dll
.text C:\WINDOWS\system32\ps2.exe[344] ntdll.dll!NtEnumerateKey 7C91D94C 5 Bytes JMP 00A0200E
.text C:\WINDOWS\system32\ps2.exe[344] ntdll.dll!NtEnumerateValueKey 7C91D976 5 Bytes JMP 00A01DAF
.text C:\WINDOWS\system32\ps2.exe[344] ntdll.dll!NtQueryDirectoryFile 7C91DF5E 5 Bytes JMP 00A01CF2
.text C:\WINDOWS\system32\ps2.exe[344] ntdll.dll!NtQuerySystemInformation 7C91E1AA 5 Bytes JMP 00A0191B
.text C:\Programmi\File comuni\Real\Update_OB\realsched.exe[352] ntdll.dll!NtEnumerateKey 7C91D94C 5 Bytes JMP 0103200E
.text C:\Programmi\File comuni\Real\Update_OB\realsched.exe[352] ntdll.dll!NtEnumerateValueKey 7C91D976 5 Bytes JMP 01031DAF
.text C:\Programmi\File comuni\Real\Update_OB\realsched.exe[352] ntdll.dll!NtQueryDirectoryFile 7C91DF5E 5 Bytes JMP 01031CF2
.text C:\Programmi\File comuni\Real\Update_OB\realsched.exe[352] ntdll.dll!NtQuerySystemInformation 7C91E1AA 5 Bytes JMP 0103191B
.text C:\Programmi\Windows Defender\MSASCui.exe[388] ntdll.dll!NtEnumerateKey 7C91D94C 5 Bytes JMP 017B200E
.text C:\Programmi\Windows Defender\MSASCui.exe[388] ntdll.dll!NtEnumerateValueKey 7C91D976 5 Bytes JMP 017B1DAF
.text C:\Programmi\Windows Defender\MSASCui.exe[388] ntdll.dll!NtQueryDirectoryFile 7C91DF5E 5 Bytes JMP 017B1CF2
.text C:\Programmi\Windows Defender\MSASCui.exe[388] ntdll.dll!NtQuerySystemInformation 7C91E1AA 5 Bytes JMP 017B191B
.text C:\Programmi\PC Tools Firewall Plus\FirewallGUI.exe[396] ntdll.dll!NtEnumerateKey 7C91D94C 5 Bytes JMP 010E200E
.text C:\Programmi\PC Tools Firewall Plus\FirewallGUI.exe[396] ntdll.dll!NtEnumerateValueKey 7C91D976 5 Bytes JMP 010E1DAF
.text C:\Programmi\PC Tools Firewall Plus\FirewallGUI.exe[396] ntdll.dll!NtQueryDirectoryFile 7C91DF5E 5 Bytes JMP 010E1CF2
.text C:\Programmi\PC Tools Firewall Plus\FirewallGUI.exe[396] ntdll.dll!NtQuerySystemInformation 7C91E1AA 5 Bytes JMP 010E191B
.text C:\PROGRA~1\Grisoft\AVG7\avgcc.exe[408] ntdll.dll!NtEnumerateKey 7C91D94C 5 Bytes JMP 0178200E
.text C:\PROGRA~1\Grisoft\AVG7\avgcc.exe[408] ntdll.dll!NtEnumerateValueKey 7C91D976 5 Bytes JMP 01781DAF
.text C:\PROGRA~1\Grisoft\AVG7\avgcc.exe[408] ntdll.dll!NtQueryDirectoryFile 7C91DF5E 5 Bytes JMP 01781CF2
.text C:\PROGRA~1\Grisoft\AVG7\avgcc.exe[408] ntdll.dll!NtQuerySystemInformation 7C91E1AA 5 Bytes JMP 0178191B
.text C:\WINDOWS\system32\ctfmon.exe[464] ntdll.dll!NtEnumerateKey 7C91D94C 5 Bytes JMP 1000200E
.text C:\WINDOWS\system32\ctfmon.exe[464] ntdll.dll!NtEnumerateValueKey 7C91D976 5 Bytes JMP 10001DAF
.text C:\WINDOWS\system32\ctfmon.exe[464] ntdll.dll!NtQueryDirectoryFile 7C91DF5E 5 Bytes JMP 10001CF2
.text C:\WINDOWS\system32\ctfmon.exe[464] ntdll.dll!NtQuerySystemInformation 7C91E1AA 5 Bytes JMP 1000191B
.text C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[476] ntdll.dll!NtEnumerateKey 7C91D94C 5 Bytes JMP 012A200E
.text C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[476] ntdll.dll!NtEnumerateValueKey 7C91D976 5 Bytes JMP 012A1DAF
.text C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[476] ntdll.dll!NtQueryDirectoryFile 7C91DF5E 5 Bytes JMP 012A1CF2
.text C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[476] ntdll.dll!NtQuerySystemInformation 7C91E1AA 5 Bytes JMP 012A191B
.text C:\documents and settings\compaq_proprietario\impostazioni locali\dati applicazioni\mpmwxd.exe[484] ntdll.dll!NtEnumerateKey 7C91D94C 5 Bytes JMP 01E6200E
.text C:\documents and settings\compaq_proprietario\impostazioni locali\dati applicazioni\mpmwxd.exe[484] ntdll.dll!NtEnumerateValueKey 7C91D976 5 Bytes JMP 01E61DAF
.text C:\documents and settings\compaq_proprietario\impostazioni locali\dati applicazioni\mpmwxd.exe[484] ntdll.dll!NtQueryDirectoryFile 7C91DF5E 5 Bytes JMP 01E61CF2
.text C:\documents and settings\compaq_proprietario\impostazioni locali\dati applicazioni\mpmwxd.exe[484] ntdll.dll!NtQuerySystemInformation 7C91E1AA 5 Bytes JMP 01E6191B
.text C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe[732] ntdll.dll!NtEnumerateKey 7C91D94C 5 Bytes JMP 1000200E
.text C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe[732] ntdll.dll!NtEnumerateValueKey 7C91D976 5 Bytes JMP 10001DAF
.text C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe[732] ntdll.dll!NtQueryDirectoryFile 7C91DF5E 5 Bytes JMP 10001CF2
.text C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe[732] ntdll.dll!NtQuerySystemInformation 7C91E1AA 5 Bytes JMP 1000191B
.text C:\WINDOWS\system32\csrss.exe[740] ntdll.dll!NtEnumerateKey 7C91D94C 5 Bytes JMP 1000200E
.text C:\WINDOWS\system32\csrss.exe[740] ntdll.dll!NtEnumerateValueKey 7C91D976 5 Bytes JMP 10001DAF
.text C:\WINDOWS\system32\csrss.exe[740] ntdll.dll!NtQueryDirectoryFile 7C91DF5E 5 Bytes JMP 10001CF2
.text C:\WINDOWS\system32\csrss.exe[740] ntdll.dll!NtQuerySystemInformation 7C91E1AA 5 Bytes JMP 1000191B
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[784] ntdll.dll!NtEnumerateKey 7C91D94C 5 Bytes JMP 1000200E
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[784] ntdll.dll!NtEnumerateValueKey 7C91D976 5 Bytes JMP 10001DAF
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[784] ntdll.dll!NtQueryDirectoryFile 7C91DF5E 5 Bytes JMP 10001CF2
.text C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe[784] ntdll.dll!NtQuerySystemInformation 7C91E1AA 5 Bytes JMP 1000191B
.text C:\WINDOWS\system32\services.exe[808] ntdll.dll!NtEnumerateKey 7C91D94C 5 Bytes JMP 1000200E
.text C:\WINDOWS\system32\services.exe[808] ntdll.dll!NtEnumerateValueKey 7C91D976 5 Bytes JMP 10001DAF
.text C:\WINDOWS\system32\services.exe[808] ntdll.dll!NtQueryDirectoryFile 7C91DF5E 5 Bytes JMP 10001CF2
.text C:\WINDOWS\system32\services.exe[808] ntdll.dll!NtQuerySystemInformation 7C91E1AA 5 Bytes JMP 1000191B
.text C:\PROGRA~1\Grisoft\AVG7\avgemc.exe[824] ntdll.dll!NtEnumerateKey 7C91D94C 5 Bytes JMP 011B200E
.text C:\PROGRA~1\Grisoft\AVG7\avgemc.exe[824] ntdll.dll!NtEnumerateValueKey 7C91D976 5 Bytes JMP 011B1DAF
.text C:\PROGRA~1\Grisoft\AVG7\avgemc.exe[824] ntdll.dll!NtQueryDirectoryFile 7C91DF5E 5 Bytes JMP 011B1CF2
.text C:\PROGRA~1\Grisoft\AVG7\avgemc.exe[824] ntdll.dll!NtQuerySystemInformation 7C91E1AA 5 Bytes JMP 011B191B
.text C:\WINDOWS\system32\svchost.exe[972] ntdll.dll!NtEnumerateKey 7C91D94C 5 Bytes JMP 1000200E
.text C:\WINDOWS\system32\svchost.exe[972] ntdll.dll!NtEnumerateValueKey 7C91D976 5 Bytes JMP 10001DAF
.text C:\WINDOWS\system32\svchost.exe[972] ntdll.dll!NtQueryDirectoryFile 7C91DF5E 5 Bytes JMP 10001CF2
.text C:\WINDOWS\system32\svchost.exe[972] ntdll.dll!NtQuerySystemInformation 7C91E1AA 5 Bytes JMP 1000191B
.text C:\Programmi\PC Tools Firewall Plus\FWService.exe[1032] ntdll.dll!NtEnumerateKey 7C91D94C 5 Bytes JMP 0204200E
.text C:\Programmi\PC Tools Firewall Plus\FWService.exe[1032] ntdll.dll!NtEnumerateValueKey 7C91D976 5 Bytes JMP 02041DAF
.text C:\Programmi\PC Tools Firewall Plus\FWService.exe[1032] ntdll.dll!NtQueryDirectoryFile 7C91DF5E 5 Bytes JMP 02041CF2
.text C:\Programmi\PC Tools Firewall Plus\FWService.exe[1032] ntdll.dll!NtQuerySystemInformation 7C91E1AA 5 Bytes JMP 0204191B
.text C:\Programmi\Common Files\Sitecom Shared\PnP Universal Installer\DevNotifySvc.exe[1136] ntdll.dll!NtEnumerateKey 7C91D94C 5 Bytes JMP 00A7200E
.text C:\Programmi\Common Files\Sitecom Shared\PnP Universal Installer\DevNotifySvc.exe[1136] ntdll.dll!NtEnumerateValueKey 7C91D976 5 Bytes JMP 00A71DAF
.text C:\Programmi\Common Files\Sitecom Shared\PnP Universal Installer\DevNotifySvc.exe[1136] ntdll.dll!NtQueryDirectoryFile 7C91DF5E 5 Bytes JMP 00A71CF2
.text C:\Programmi\Common Files\Sitecom Shared\PnP Universal Installer\DevNotifySvc.exe[1136] ntdll.dll!NtQuerySystemInformation 7C91E1AA 5 Bytes JMP 00A7191B
.text C:\Programmi\Windows Defender\MsMpEng.exe[1200] ntdll.dll!NtEnumerateKey 7C91D94C 5 Bytes JMP 1000200E
.text C:\Programmi\Windows Defender\MsMpEng.exe[1200] ntdll.dll!NtEnumerateValueKey 7C91D976 5 Bytes JMP 10001DAF
.text C:\Programmi\Windows Defender\MsMpEng.exe[1200] ntdll.dll!NtQueryDirectoryFile 7C91DF5E 5 Bytes JMP 10001CF2
.text C:\Programmi\Windows Defender\MsMpEng.exe[1200] ntdll.dll!NtQuerySystemInformation 7C91E1AA 5 Bytes JMP 1000191B
.text C:\WINDOWS\System32\svchost.exe[1240] ntdll.dll!NtEnumerateKey 7C91D94C 5 Bytes JMP 1000200E
.text C:\WINDOWS\System32\svchost.exe[1240] ntdll.dll!NtEnumerateValueKey 7C91D976 5 Bytes JMP 10001DAF
.text C:\WINDOWS\System32\svchost.exe[1240] ntdll.dll!NtQueryDirectoryFile 7C91DF5E 5 Bytes JMP 10001CF2
.text C:\WINDOWS\System32\svchost.exe[1240] ntdll.dll!NtQuerySystemInformation 7C91E1AA 5 Bytes JMP 1000191B
.text C:\WINDOWS\system32\nvsvc32.exe[1300] ntdll.dll!NtEnumerateKey 7C91D94C 5 Bytes JMP 008F200E
.text C:\WINDOWS\system32\nvsvc32.exe[1300] ntdll.dll!NtEnumerateValueKey 7C91D976 5 Bytes JMP 008F1DAF
.text C:\WINDOWS\system32\nvsvc32.exe[1300] ntdll.dll!NtQueryDirectoryFile 7C91DF5E 5 Bytes JMP 008F1CF2
.text C:\WINDOWS\system32\nvsvc32.exe[1300] ntdll.dll!NtQuerySystemInformation 7C91E1AA 5 Bytes JMP 008F191B
.text C:\WINDOWS\system32\wuauclt.exe[1412] ntdll.dll!NtEnumerateKey 7C91D94C 5 Bytes JMP 00CE200E
.text C:\WINDOWS\system32\wuauclt.exe[1412] ntdll.dll!NtEnumerateValueKey 7C91D976 5 Bytes JMP 00CE1DAF
.text C:\WINDOWS\system32\wuauclt.exe[1412] ntdll.dll!NtQueryDirectoryFile 7C91DF5E 5 Bytes JMP 00CE1CF2
.text C:\WINDOWS\system32\wuauclt.exe[1412] ntdll.dll!NtQuerySystemInformation 7C91E1AA 5 Bytes JMP 00CE191B
.text C:\WINDOWS\system32\svchost.exe[1668] ntdll.dll!NtEnumerateKey 7C91D94C 5 Bytes JMP 1000200E
.text C:\WINDOWS\system32\svchost.exe[1668] ntdll.dll!NtEnumerateValueKey 7C91D976 5 Bytes JMP 10001DAF
.text C:\WINDOWS\system32\svchost.exe[1668] ntdll.dll!NtQueryDirectoryFile 7C91DF5E 5 Bytes JMP 10001CF2
.text C:\WINDOWS\system32\svchost.exe[1668] ntdll.dll!NtQuerySystemInformation 7C91E1AA 5 Bytes JMP 1000191B
.text C:\WINDOWS\Explorer.EXE[1864] ntdll.dll!NtEnumerateKey 7C91D94C 5 Bytes JMP 020C200E
.text C:\WINDOWS\Explorer.EXE[1864] ntdll.dll!NtEnumerateValueKey 7C91D976 5 Bytes JMP 020C1DAF
.text C:\WINDOWS\Explorer.EXE[1864] ntdll.dll!NtQueryDirectoryFile 7C91DF5E 5 Bytes JMP 020C1CF2
.text C:\WINDOWS\Explorer.EXE[1864] ntdll.dll!NtQuerySystemInformation 7C91E1AA 5 Bytes JMP 020C191B
.text C:\WINDOWS\system32\spoolsv.exe[1900] ntdll.dll!NtEnumerateKey 7C91D94C 5 Bytes JMP 1000200E
.text C:\WINDOWS\system32\spoolsv.exe[1900] ntdll.dll!NtEnumerateValueKey 7C91D976 5 Bytes JMP 10001DAF
.text C:\WINDOWS\system32\spoolsv.exe[1900] ntdll.dll!NtQueryDirectoryFile 7C91DF5E 5 Bytes JMP 10001CF2
.text C:\WINDOWS\system32\spoolsv.exe[1900] ntdll.dll!NtQuerySystemInformation 7C91E1AA 5 Bytes JMP 1000191B
.text C:\Programmi\7-Zip\7zFM.exe[3640] ntdll.dll!NtEnumerateKey 7C91D94C 5 Bytes JMP 00E6200E
.text C:\Programmi\7-Zip\7zFM.exe[3640] ntdll.dll!NtEnumerateValueKey 7C91D976 5 Bytes JMP 00E61DAF
.text C:\Programmi\7-Zip\7zFM.exe[3640] ntdll.dll!NtQueryDirectoryFile 7C91DF5E 5 Bytes JMP 00E61CF2
.text C:\Programmi\7-Zip\7zFM.exe[3640] ntdll.dll!NtQuerySystemInformation 7C91E1AA 5 Bytes JMP 00E6191B
.text C:\DOCUME~1\COMPAQ~1\IMPOST~1\Temp\7zO1.tmp\gmer.exe[3672] ntdll.dll!NtEnumerateKey 7C91D94C 5 Bytes JMP 00EA200E
.text C:\DOCUME~1\COMPAQ~1\IMPOST~1\Temp\7zO1.tmp\gmer.exe[3672] ntdll.dll!NtEnumerateValueKey 7C91D976 5 Bytes JMP 00EA1DAF
.text C:\DOCUME~1\COMPAQ~1\IMPOST~1\Temp\7zO1.tmp\gmer.exe[3672] ntdll.dll!NtQueryDirectoryFile 7C91DF5E 5 Bytes JMP 00EA1CF2
.text C:\DOCUME~1\COMPAQ~1\IMPOST~1\Temp\7zO1.tmp\gmer.exe[3672] ntdll.dll!NtQuerySystemInformation 7C91E1AA 5 Bytes JMP 00EA191B
.text C:\WINDOWS\system32\wuauclt.exe[3724] ntdll.dll!NtEnumerateKey 7C91D94C 5 Bytes JMP 1000200E
.text C:\WINDOWS\system32\wuauclt.exe[3724] ntdll.dll!NtEnumerateValueKey 7C91D976 5 Bytes JMP 10001DAF
.text C:\WINDOWS\system32\wuauclt.exe[3724] ntdll.dll!NtQueryDirectoryFile 7C91DF5E 5 Bytes JMP 10001CF2
.text C:\WINDOWS\system32\wuauclt.exe[3724] ntdll.dll!NtQuerySystemInformation 7C91E1AA 5 Bytes JMP 1000191B

---- Devices - GMER 1.0.14 ----

AttachedDevice \FileSystem\Ntfs \Ntfs avg7rsw.sys (AVG Resident Shield Unload Helper/GRISOFT, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Ip pctfw2.sys (PC Tools TDI Driver/PC Tools)
AttachedDevice \Driver\Tcpip \Device\Ip avgtdi.sys (AVG Network connection watcher/GRISOFT, s.r.o.)

Device \Driver\pctfw2 \Device\PcaTcpFilter avgtdi.sys (AVG Network connection watcher/GRISOFT, s.r.o.)

AttachedDevice \Driver\Tcpip \Device\Tcp pctfw2.sys (PC Tools TDI Driver/PC Tools)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdi.sys (AVG Network connection watcher/GRISOFT, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp pctfw2.sys (PC Tools TDI Driver/PC Tools)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdi.sys (AVG Network connection watcher/GRISOFT, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp pctfw2.sys (PC Tools TDI Driver/PC Tools)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdi.sys (AVG Network connection watcher/GRISOFT, s.r.o.)

Device \Driver\pctfw2 \Device\PCTFWPL avgtdi.sys (AVG Network connection watcher/GRISOFT, s.r.o.)
Device \Driver\pctfw2 \Device\PcaRawIpFilter avgtdi.sys (AVG Network connection watcher/GRISOFT, s.r.o.)
Device \Driver\pctfw2 \Device\PcaUdpFilter avgtdi.sys (AVG Network connection watcher/GRISOFT, s.r.o.)
Device \Driver\pctfw2 \Device\PCTFW2 avgtdi.sys (AVG Network connection watcher/GRISOFT, s.r.o.)

AttachedDevice \FileSystem\Fastfat \Fat avg7rsw.sys (AVG Resident Shield Unload Helper/GRISOFT, s.r.o.)

---- Processes - GMER 1.0.14 ----

Process C:\documents and settings\compaq_proprietario\impostazioni locali\dati applicazioni\mpmwxd.exe (*** hidden *** ) 484
Library C:\documents and settings\compaq_proprietario\impostazioni locali\dati applicazioni\mpmwxd.exe (*** hidden *** ) @ C:\documents and settings\compaq_proprietario\impostazioni locali\dati applicazioni\mpmwxd.exe [484] 0x00400000

---- Registry - GMER 1.0.14 ----

Reg HKLM\SOFTWARE\Classes\Software\BigFishGames\MahjongTowersII\author@forfun\3 Wiepie
Reg HKLM\SOFTWARE\Classes\Software\BigFishGames\MahjongTowersII\Boards@forfun\3 0,0,0,0,0,0,0,65536,0,698368,0,698368,0,8192,0,0,0,0,0,0,0,0,0,0,0,65536,0,698368,0,698368,0,8192,0,0,0,0,0,0,0,0,0,0,0,65536,0,698368,0,698368,0,8192,0,0,0,0,0,0,0,0,0,0,0,8388736,0,8388736,0,8388736,0,8388736,0,0,0,0,0,0,0,0,0,0,0,8388736,0,8388736,0,8388736,0,8388736,0,0,0,0,0,0,35652128,0,68158480,0,134744072,0,134744072,0,134744072,0,134744072,0,134744072,0,68157968,0,0,0,0,20971840,0,20971840,0,35652128,0,35652128,0,20971840,0,20971840,0,35651872,0,35651872,0,0,0,18874656,0,18874656,0,34603536,0,34603536,0,18874656,0,18874656,0,34603536,0,34603536,0,0,0,17826064,0,17826064,0,34079240,0,34079240,0,17826064,0,17826064,0,34079240,0,34079240
Reg HKLM\SOFTWARE\Classes\Software\BigFishGames\MahjongTowersII\Descriptions@forfun\3 NA
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Run@mpmwxd c:\documents and settings\compaq_proprietario\impostazioni locali\dati applicazioni\mpmwxd.exe mpmwxd

---- Files - GMER 1.0.14 ----

File C:\Documents and Settings\Compaq_Proprietario\Impostazioni locali\Dati applicazioni\mpmwxd.dat 4945 bytes
File C:\Documents and Settings\Compaq_Proprietario\Impostazioni locali\Dati applicazioni\mpmwxd.exe 364544 bytes
File C:\Documents and Settings\Compaq_Proprietario\Impostazioni locali\Dati applicazioni\mpmwxd_nav.dat 396721 bytes
File C:\Documents and Settings\Compaq_Proprietario\Impostazioni locali\Dati applicazioni\mpmwxd_navps.dat 806 bytes

---- EOF - GMER 1.0.14 ----
SCUSA P2 SCUSA è che sono molto ignorante in materia e non so come fare a riportarti solo quei file in rosso!!!!

Quanti hidden hai? Devi provare e riprovare. SE coln autostart non ci sono voci rosse, significa che non ci sono voci di registro infette. Devi insistere, perchè non c'è altro modo di rimuoverli, se tenti manualmente non li trovi, perchè sono ... *** hidden ***, ovvero nascosti.

---

Apri il registro così:

Start >> (scrivi) regedit.
Espandi (clicca sul segno "+") le seguenti chiavi:

HKEY_USERS\S-1-5-21-3495722017-1985487799-1902824246-1008\software\microsoft\windows\currentverson\run\
Fai 1 clic sulla cartellina run e spostati sulla parte destra. Individua la voce mpmwxd, tasto destro ed Elimina.
Poi, se non l'hai fatto, rendi visibili le cartelle nascoste ------ > procedura:
da Risorse del computer:
Strumenti >> Opzioni cartella >> visualizzazione;
metti la spunta su:
Visualizza file e cartelle nascoste;
togli la spunta da:
Nascondi file protetti del sistema(consigliato)

Cancella il file in rosso:
C:\Documents and settings\compaq_proprietario\impostazioni locali\dati applicazioni\mpmwxd.exe

Ciao.

---