granuz...siamo in sicurezza virus e privacy...
io m9 sono trovato in una situazione simile,ed ho risolto con una scansioneonline.
http://www.bitdefender.com/scan8/ie.html
devi farla con internet explorer...in bocca al lupo

Ciao granuz88 .
Sicuramente lo ho spostato Alfonso.

Per goldgrass61 :
Posta un log di HJT:
http://www.aiutamici.com/software?ID=11175

altro problema quando entro in mod. provvisoria mi ricompare sempre l'avviso: programma in modalita provvisoria
continuare si/no premo sul si scompare e mi riappare pero se chiudo l'avviso con la x riesco ad aprire solo tasc

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6.14.06, on 17/04/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\Programmi\Java\jre6\bin\jqs.exe
C:\Programmi\Google\Update\GoogleUpdate.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmi\Telecom Italia\WanMiniport1st\srvany.exe
C:\Programmi\Telecom Italia\WanMiniport1st\WanMiniport1st_srv.exe
C:\WINDOWS\system32\slserv.exe
C:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.virgilio.it/search/home/index.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.virgilio.it
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O4 - HKLM\..\Run: [avast!] "C:\Programmi\Alwil Software\Avast4\ashDisp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SmartRAM] "C:\Programmi\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe" /m
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Scarica con Download &Express - C:\Programmi\Download Express\Add_Url.htm
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.asem.it
O22 - SharedTaskScheduler: sdfg54y54yhhgth6w4efvrg - {E2BA40A2-74F3-42BD-F434-2604812C8953} - C:\WINDOWS\system32\sdfgerfgf3f.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Servizio di Google Update (gupdate1c9b9537a742990) (gupdate1c9b9537a742990) - Google Inc. - C:\Programmi\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmi\Java\jre6\bin\jqs.exe
O23 - Service: Network WanMiniport First Position - Unknown owner - C:\Programmi\Telecom Italia\WanMiniport1st\srvany.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

--
End of file - 4788 bytes

fatta scansione con malware invio file log
Malwarebytes' Anti-Malware 1.36
Versione del database: 1997
Windows 5.1.2600 Service Pack 3

18/04/2009 3.21.58
mbam-log-2009-04-18 (03-21-31).txt

Tipo di scansione: Scansione rapida
Elementi scansionati: 83517
Tempo trascorso: 14 minute(s), 55 second(s)

Processi delle memoria infetti: 0
Moduli della memoria infetti: 1
Chiavi di registro infette: 12
Valori di registro infetti: 1
Elementi dato del registro infetti: 4
Cartelle infette: 0
File infetti: 8

Processi delle memoria infetti:
(Nessun elemento malevolo rilevato)

Moduli della memoria infetti:
C:\WINDOWS\system32\ssqQgFWQ.dll (Trojan.Vundo.H) -> No action taken.

Chiavi di registro infette:
HKEY_CLASSES_ROOT\CLSID\{6b0a1a6c-a632-4341-afa1-fce8a46226d1} (Trojan.Vundo.H) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6b0a1a6c-a632-4341-afa1-fce8a46226d1} (Trojan.Vundo.H) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{94a5a238-6b76-46b7-b33b-003aa72ef18d} (Trojan.Vundo.H) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{94a5a238-6b76-46b7-b33b-003aa72ef18d} (Trojan.Vundo.H) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\OOO (Rogue.LivePlayer) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\OOO (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Live-Player (Malware.Trace) -> No action taken.

Valori di registro infetti:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diagnostic manager (Trojan.Downloader) -> No action taken.

Elementi dato del registro infetti:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\ssqqgfwq -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\ssqqgfwq -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> No action taken.

Cartelle infette:
(Nessun elemento malevolo rilevato)

File infetti:
C:\WINDOWS\system32\ssqQgFWQ.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\QWFgQqss.ini (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\trz32.tmp (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\urqPhiJa.dll_old (Trojan.Vundo) -> No action taken.
C:\gcdaiups.exe (Trojan.Downloader) -> No action taken.
C:\Documents and Settings\comp01\Impostazioni locali\Temp\server2.exe (Trojan.Downloader) -> No action taken.
C:\Documents and Settings\comp01\Impostazioni locali\Temp\winlogqn.exe (Trojan.Agent) -> No action taken.
C:\Documents and Settings\comp01\Impostazioni locali\Temp\2953289168.exe (Trojan.Downloader) -> No action taken.

problema risolto dopo una lunga notte con scansione online e scansione con malwarebyte' vi devo ringraziare per le dritte anche se e'un po lento grazie

CIAO R16 TI IVIO LOG DI COMBO
ComboFix 09-04-19.01 - comp01 18/04/2009 20.05.49.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.39.1040.18.223.40 [GMT 2:00]
Eseguito da: c:\documents and settings\comp01\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090418-0] *On-access scanning disabled* (Updated)
* Creato nuovo punto di ripristino

ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\comp01\Dati applicazioni\QUAD Backups
c:\documents and settings\comp01\Dati applicazioni\QUAD Backups\04.08.2009,16-02-10\HKEY_CLASSES_ROOT.reg
c:\documents and settings\comp01\Dati applicazioni\QUAD Backups\04.08.2009,16-02-10\HKEY_CURRENT_CONFIG.reg
c:\documents and settings\comp01\Dati applicazioni\QUAD Backups\04.08.2009,16-02-10\HKEY_CURRENT_USER.reg
c:\documents and settings\comp01\Dati applicazioni\QUAD Backups\04.08.2009,16-02-10\HKEY_LOCAL_MACHINE.reg
c:\documents and settings\comp01\Dati applicazioni\QUAD Backups\04.08.2009,16-02-10\HKEY_USERS.reg
c:\documents and settings\comp01\Impostazioni locali\Dati applicazioni\ikiukek.dat
c:\documents and settings\comp01\Impostazioni locali\Dati applicazioni\ikiukek.exe
c:\documents and settings\comp01\Impostazioni locali\Dati applicazioni\ikiukek_nav.dat
c:\documents and settings\comp01\Impostazioni locali\Dati applicazioni\ikiukek_navps.dat
c:\documents and settings\comp01\Impostazioni locali\Dati applicazioni\waeakqk.dat
c:\documents and settings\comp01\Impostazioni locali\Dati applicazioni\waeakqk_nav.dat
c:\documents and settings\comp01\Impostazioni locali\Dati applicazioni\waeakqk_navps.dat
c:\documents and settings\comp01\Menu Avvio\Programmi\QUAD Utilities
c:\documents and settings\comp01\Menu Avvio\Programmi\QUAD Utilities\QUAD Registry Cleaner\QUAD Registry Cleaner website.lnk
c:\documents and settings\comp01\Menu Avvio\Programmi\QUAD Utilities\QUAD Registry Cleaner\QUAD Registry Cleaner.lnk
c:\documents and settings\comp01\Menu Avvio\Programmi\QUAD Utilities\QUAD Registry Cleaner\Uninstall QUAD Registry Cleaner.lnk
c:\programmi\QUAD Utilities
c:\programmi\QUAD Utilities\QUAD Registry Cleaner\optimize.bin
c:\programmi\QUAD Utilities\QUAD Registry Cleaner\program.log
c:\programmi\QUAD Utilities\QUAD Registry Cleaner\QUAD Registry Cleaner website.url
c:\programmi\QUAD Utilities\QUAD Registry Cleaner\QUAD Registry Cleaner.exe
c:\programmi\QUAD Utilities\QUAD Registry Cleaner\QUAD Scheduler.exe
c:\programmi\QUAD Utilities\QUAD Registry Cleaner\Styles\Vista.cjstyles
c:\programmi\QUAD Utilities\QUAD Registry Cleaner\uninst.exe
c:\programmi\QUAD Utilities\QUAD Registry Cleaner\Vista Scheduler.exe

.
((((((((((((((((((((((((( Files Creati Da 2009-03-19 al 2009-04-19 )))))))))))))))))))))))))))))))))))
.

2009-04-18 04:48 . 2009-04-18 05:59 -------- d-----w c:\windows\BDOSCAN8
2009-04-18 00:42 . 2009-04-18 00:42 -------- d-----w c:\documents and settings\comp01\Dati applicazioni\Malwarebytes
2009-04-18 00:42 . 2009-04-06 13:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-04-18 00:42 . 2009-04-06 13:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-18 00:42 . 2009-04-18 00:42 -------- d-----w c:\documents and settings\All Users\Dati applicazioni\Malwarebytes
2009-04-16 02:42 . 2009-04-16 03:03 1374 ----a-w c:\windows\imsins.BAK
2009-04-16 02:05 . 2009-03-06 14:19 286208 -c----w c:\windows\system32\dllcache\pdh.dll
2009-04-16 02:05 . 2009-02-09 11:22 111104 -c----w c:\windows\system32\dllcache\services.exe
2009-04-16 02:05 . 2009-02-09 10:51 401408 -c----w c:\windows\system32\dllcache\rpcss.dll
2009-04-16 02:04 . 2009-02-09 10:51 473600 -c----w c:\windows\system32\dllcache\fastprox.dll
2009-04-16 02:04 . 2009-02-09 10:51 683520 -c----w c:\windows\system32\dllcache\advapi32.dll
2009-04-16 02:04 . 2009-02-09 10:51 734720 -c----w c:\windows\system32\dllcache\lsasrv.dll
2009-04-16 02:04 . 2009-02-09 10:51 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-16 02:04 . 2009-02-09 10:51 736256 -c----w c:\windows\system32\dllcache\ntdll.dll
2009-04-15 15:14 . 2009-04-15 15:14 95 ----a-w c:\windows\wininit.ini
2009-04-15 14:32 . 2009-04-15 14:31 185856 ----a-w c:\windows\system32\framedyn.dll
2009-04-15 14:31 . 2009-04-15 14:31 5415 ----a-w c:\windows\system32\Choice.com
2009-04-15 04:30 . 2009-04-15 04:30 0 ----a-w C:\1885521910
2009-04-15 04:27 . 2009-04-15 04:27 46 ----a-w C:\p2hhr.bat
2009-04-10 14:29 . 2009-04-10 14:29 -------- d-----w c:\documents and settings\NetworkService\Impostazioni locali\Dati applicazioni\Google
2009-04-10 05:35 . 2009-04-10 05:35 -------- d-----w c:\documents and settings\comp01\Dati applicazioni\Systenance
2009-04-09 20:41 . 2009-04-09 20:41 -------- d-----w c:\documents and settings\LocalService\Impostazioni locali\Dati applicazioni\Google
2009-04-06 17:05 . 2008-10-03 21:05 28672 ----a-w c:\windows\system32\CleanMem.exe
2009-04-06 17:05 . 2009-04-06 17:05 -------- d-----w c:\windows\CleanMem
2009-04-03 01:48 . 2009-03-09 00:53 73728 ----a-w c:\windows\system32\javacpl.cpl
2009-03-24 22:32 . 2009-03-24 22:32 -------- d-----w c:\documents and settings\comp01\Dati applicazioni\r2 Studios
2009-03-24 22:32 . 2009-03-24 22:32 -------- d-----w c:\documents and settings\All Users\Dati applicazioni\r2 Studios
2009-03-21 14:06 . 2009-03-21 14:06 1033728 -c----w c:\windows\system32\dllcache\kernel32.dll
2009-03-21 01:50 . 2009-01-09 19:19 1090181 -c----w c:\windows\system32\dllcache\ntprint.cat
2009-03-20 07:24 . 2009-03-20 07:24 -------- d-----w c:\documents and settings\comp01\Dati applicazioni\Windows Search
2009-03-20 01:10 . 2006-06-29 12:07 14048 ----a-w c:\windows\system32\spmsg2.dll
2009-03-20 00:30 . 2009-04-07 05:33 -------- d-----w c:\windows\system32\XPSViewer
2009-03-20 00:25 . 2008-07-06 12:06 89088 -c----w c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-03-20 00:25 . 2008-07-06 12:06 117760 ----a-w c:\windows\system32\prntvpt.dll
2009-03-20 00:25 . 2008-07-06 10:50 597504 -c----w c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-03-20 00:25 . 2008-07-06 12:06 575488 -c----w c:\windows\system32\dllcache\xpsshhdr.dll
2009-03-20 00:25 . 2008-07-06 12:06 575488 ----a-w c:\windows\system32\xpsshhdr.dll
2009-03-20 00:25 . 2008-07-06 12:06 1676288 -c----w c:\windows\system32\dllcache\xpssvcs.dll
2009-03-20 00:25 . 2008-07-06 12:06 1676288 ----a-w c:\windows\system32\xpssvcs.dll
2009-03-20 00:25 . 2009-03-20 00:28 -------- d-----w C:\aaed52da23f63b8a95233d
2009-03-20 00:23 . 2009-03-20 00:25 -------- d-----w c:\documents and settings\LocalService\Impostazioni locali\Dati applicazioni\Adobe
2009-03-20 00:06 . 2009-03-20 00:06 -------- d-----w c:\windows\system32\GroupPolicy

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-18 07:25 . 2004-05-05 14:27 -------- d-----w c:\programmi\File comuni\Adobe
2009-04-18 00:42 . 2009-04-18 00:42 -------- d-----w c:\programmi\Malwarebytes' Anti-Malware
2009-04-17 04:46 . 2003-10-31 19:21 492504 ----a-w c:\windows\system32\perfh010.dat
2009-04-17 04:46 . 2003-10-31 19:21 85330 ----a-w c:\windows\system32\perfc010.dat
2009-04-15 23:49 . 2008-11-08 15:56 -------- d-----w c:\programmi\Telecom Italia
2009-04-15 23:49 . 2004-03-10 15:11 -------- d--h--w c:\programmi\InstallShield Installation Information
2009-04-15 23:28 . 2009-02-17 06:02 -------- d-----w c:\documents and settings\All Users\Dati applicazioni\Spybot - Search & Destroy
2009-04-12 18:42 . 2004-05-05 21:06 -------- d-----w c:\documents and settings\All Users\Dati applicazioni\QuickTime
2009-04-10 05:34 . 2009-04-10 05:34 -------- d-----w c:\programmi\Index.dat Analyzer
2009-04-09 20:49 . 2008-12-26 05:48 -------- d-----w c:\programmi\Google
2009-04-09 04:57 . 2009-04-09 04:57 -------- d-----w c:\programmi\CCleaner
2009-04-09 04:50 . 2009-04-09 04:48 -------- d-----w c:\programmi\Disk Cleaner
2009-04-07 18:02 . 2004-07-08 12:51 71224 -c--a-w c:\documents and settings\comp01\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2009-04-07 04:25 . 2009-04-06 17:05 -------- d-----w c:\programmi\CleanMem
2009-04-07 03:50 . 2009-04-07 03:50 -------- d-----w c:\programmi\Trend Micro
2009-04-06 20:51 . 2009-02-17 06:02 -------- d-----w c:\programmi\Spybot - Search & Destroy
2009-04-06 01:33 . 2009-04-06 01:33 -------- d-----w c:\programmi\Mz_CpuAcc
2009-04-03 01:47 . 2009-03-05 04:50 -------- d-----w c:\programmi\Java
2009-03-28 14:49 . 2009-03-03 19:58 -------- d-----w c:\documents and settings\comp01\Dati applicazioni\vlc
2009-03-24 22:32 . 2009-03-24 22:32 -------- d-----w c:\programmi\r2 Studios
2009-03-20 00:29 . 2009-03-20 00:29 -------- d-----w c:\programmi\MSBuild
2009-03-20 00:29 . 2009-03-20 00:29 -------- d-----w c:\programmi\Reference Assemblies
2009-03-15 18:16 . 2009-02-22 18:18 -------- d-----w c:\documents and settings\comp01\Dati applicazioni\live-player
2009-03-13 04:19 . 2008-11-27 21:12 -------- d-----w c:\documents and settings\comp01\Dati applicazioni\IObit
2009-03-13 04:19 . 2008-11-27 21:12 -------- d-----w c:\programmi\IObit
2009-03-12 07:09 . 2009-02-17 02:14 -------- d-----w c:\programmi\Opera
2009-03-09 03:19 . 2009-01-31 07:00 410984 ----a-w c:\windows\system32\deploytk.dll
2009-03-06 14:19 . 2003-10-31 19:21 286208 ----a-w c:\windows\system32\pdh.dll
2009-03-06 05:13 . 2009-02-28 08:11 -------- d-----w c:\programmi\JLC's Software
2009-03-03 00:03 . 2006-06-23 12:28 826368 ----a-w c:\windows\system32\wininet.dll
2009-02-28 16:57 . 2009-02-28 16:57 -------- d-----w c:\programmi\Windows Media Connect 2
2009-02-28 08:12 . 2009-02-28 08:12 -------- d-----w c:\documents and settings\comp01\Dati applicazioni\JLC's Software
2009-02-22 18:23 . 2009-02-22 18:18 -------- d-----w c:\programmi\Live-Player
2009-02-21 10:29 . 2004-05-12 13:32 -------- d-----w c:\documents and settings\comp01\Dati applicazioni\AdobeUM
2009-02-20 17:08 . 2004-08-19 22:39 78336 ----a-w c:\windows\system32\ieencode.dll
2009-02-10 17:02 . 2002-09-09 13:34 2069760 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-02-09 14:04 . 2003-10-31 19:21 1846784 ----a-w c:\windows\system32\win32k.sys
2009-02-09 11:23 . 2003-10-31 19:21 2192768 ----a-w c:\windows\system32\ntoskrnl.exe
2009-02-09 11:22 . 2003-10-31 19:21 111104 ----a-w c:\windows\system32\services.exe
2009-02-09 10:51 . 2003-10-31 19:21 734720 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 10:51 . 2005-07-26 04:38 401408 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 10:51 . 2003-10-31 19:21 683520 ----a-w c:\windows\system32\advapi32.dll
2009-02-09 10:51 . 2003-10-31 19:21 736256 ----a-w c:\windows\system32\ntdll.dll
2009-02-06 10:39 . 2003-10-31 19:21 35328 ----a-w c:\windows\system32\sc.exe
2009-02-03 19:57 . 2003-10-31 19:21 56832 ----a-w c:\windows\system32\secur32.dll
2009-01-23 02:43 . 2009-01-23 02:43 413184 ----a-w c:\windows\system32\paintball.scr
2009-01-23 02:18 . 2009-01-23 02:18 297984 ----a-w c:\windows\Turn3DShuttleExplorer.scr
2008-11-30 06:37 . 2008-11-30 06:37 71224 -c--a-w c:\documents and settings\EDDY II\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2008-11-26 19:35 . 2008-11-26 19:35 71224 -c--a-w c:\documents and settings\Administrator.PORTATILE01\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2008-11-26 19:35 . 2008-11-26 19:35 154 -c--a-w c:\documents and settings\Administrator.PORTATILE01\Impostazioni locali\Dati applicazioni\fusioncache.dat
2008-07-17 18:34 . 2008-07-17 18:34 135 -c--a-w c:\documents and settings\comp01\Impostazioni locali\Dati applicazioni\fusioncache.dat
2008-12-04 19:22 . 2008-12-04 19:22 32768 -csha-w c:\windows\system32\config\systemprofile\Impostazioni locali\Cronologia\History.IE5\MSHist012008111720081124\index.dat
2008-12-04 19:22 . 2008-12-04 19:22 32768 -csha-w c:\windows\system32\config\systemprofile\Impostazioni locali\Cronologia\History.IE5\MSHist012008120420081205\index.dat
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"SmartRAM"="c:\programmi\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe" [2009-02-19 202064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\programmi\Alwil Software\Avast4\ashDisp.exe" [2009-02-05 81000]
"Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Programmi\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmi\\Mozilla Firefox\\firefox.exe"=
"c:\\Programmi\\Download Express\\dep.exe"=
"c:\\Programmi\\Opera\\opera.exe"=
"c:\\Programmi\\Live-Player\\live-player.exe"=
"c:\\Programmi\\VideoLAN\\VLC\\vlc.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9453:TCP"= 9453:TCP:WWW

R2 gupdate1c9b9537a742990;Servizio di Google Update (gupdate1c9b9537a742990);c:\programmi\Google\Update\GoogleUpdate.exe [2009-04-09 133104]
R3 NT_DIO;NT_DIO; [x]
S1 aswSP;avast! Self Protection; [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560]
S2 Network WanMiniport First Position;Network WanMiniport First Position;c:\programmi\Telecom Italia\WanMiniport1st\srvany.exe [2003-04-18 8192]
S3 ENE;ENE;c:\windows\system32\DRIVERS\EMCR7SK.sys [2002-12-24 79392]


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
bepbpeh
.
Contenuto della cartella 'Scheduled Tasks'

2009-04-18 c:\windows\Tasks\Clean System Memory.job
- c:\windows\system32\CleanMem.exe [2009-04-06 21:05]

2009-04-15 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job
- c:\programmi\Spybot - Search & Destroy\SpybotSD.exe [2009-02-17 14:31]

2009-04-15 c:\windows\Tasks\Spybot - Search & Destroy Updater - Scheduled Task.job
- c:\programmi\Spybot - Search & Destroy\SDUpdate.exe [2009-04-06 13:31]
.
- - - - CHIAVI ORFANE RIMOSSE - - - -

BHO-{E2BA40A2-74F3-42BD-F434-2604812C8953} - (no file)
SharedTaskScheduler-{E2BA40A2-74F3-42BD-F434-2604812C8953} - (no file)


.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
uInternet Connection Wizard,ShellNext = iexplore
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Scarica con Download &Express - c:\programmi\Download Express\Add_Url.htm
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\comp01\Dati applicazioni\Mozilla\Firefox\Profiles\7a0jlblo.default\
FF - prefs.js: browser.search.selectedEngine - qtl
FF - prefs.js: network.proxy.type - 4
FF - component: c:\documents and settings\comp01\Dati applicazioni\Mozilla\Firefox\Profiles\7a0jlblo.default\extensions\{D249FD00-4DF9-11D9-9FDC-0080481ADA61}\components\mpint.dll
FF - plugin: c:\documents and settings\All Users\Dati applicazioni\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: c:\documents and settings\comp01\Dati applicazioni\Mozilla\Firefox\Profiles\7a0jlblo.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll
FF - plugin: c:\programmi\Google\Update\1.2.141.5\npGoogleOneClick7.dll
FF - plugin: c:\programmi\Mozilla Firefox\plugins\bin\new_plugin\npdeploytk.dll
FF - plugin: c:\programmi\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\programmi\Mozilla Firefox\plugins\npzylomgamesplayer.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-18 20:11
Windows 5.1.2600 Service Pack 3 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
Ora fine scansione: 2009-04-18 20.15.16
ComboFix-quarantined-files.txt 2009-04-18 18:15

Pre-Run: 30.316.318.720 byte disponibili
Post-Run: 30.140.125.184 byte disponibili

222 --- E O F --- 2009-04-16 03:04

log HJ
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20.56.30, on 18/04/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\Programmi\Java\jre6\bin\jqs.exe
C:\Programmi\Google\Update\GoogleUpdate.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmi\Telecom Italia\WanMiniport1st\srvany.exe
C:\Programmi\Telecom Italia\WanMiniport1st\WanMiniport1st_srv.exe
C:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\Programmi\Alwil Software\Avast4\ashDisp.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\explorer.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O4 - HKLM\..\Run: [avast!] "C:\Programmi\Alwil Software\Avast4\ashDisp.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SmartRAM] "C:\Programmi\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe" /m
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Scarica con Download &Express - C:\Programmi\Download Express\Add_Url.htm
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.asem.it
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Servizio di Google Update (gupdate1c9b9537a742990) (gupdate1c9b9537a742990) - Google Inc. - C:\Programmi\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmi\Java\jre6\bin\jqs.exe
O23 - Service: Network WanMiniport First Position - Unknown owner - C:\Programmi\Telecom Italia\WanMiniport1st\srvany.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

--
End of file - 4978 bytes


PER DISINSTALLARE COMBO HO FATTO COME DETTO MA MI E'RIPARTITO
COME LO TOLGO? X R16 GRAZIE