Ciao a tutti,
vorrei inviarvi i miei log per controllo dato che da un pò di tempo il mio computer si è notevolmente rallentato, quando cerco di intallare dei programmi immancabilmente mi và in errore, mi parte una scansione automatica ogni volta che vado in internet oppure vengo dirottata su dei siti da me non richiesti per ultimo mi arriva tanta posta spazzatura che non riesco a bloccare (anche con il mio stesso indirizzo di posta elettronica).
Per cercare di risolvere il problema non faccio altro che peggiorare la situazione installando vari programmi che poi non riesco più a disistallare o a disistallare completamente.
Potete aiutarmi per favore?????? ve ne sarei grata.
Grazie

p.s. non è molto che mi hanno formattato tutto

Scusate mi sono dimenticata i log che allego:



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16.24.25, on 11/10/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Programmi\AVG\AVG8\avgcsrvx.exe
C:\Programmi\Java\jre6\bin\jqs.exe
C:\Programmi\Telecom Italia\WanMiniport1st\srvany.exe
C:\Programmi\Telecom Italia\WanMiniport1st\WanMiniport1st_srv.exe
C:\Programmi\PC Tools Firewall Plus\FWService.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\TomTom HOME 2\TomTomHOMEService.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Programmi\Java\jre6\bin\jusched.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/ymj/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.live.com/sphome.aspx
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Yahoo! Toolbar con blocco Pop-Up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: PHPNukeIT Toolbar - {2c965f3f-8efd-4bfc-a2c5-1672845fdbbf} - C:\Programmi\PHPNukeIT\tbPHP1.dll
O2 - BHO: (no name) - {05647034-1833-4EF0-AD7E-D6603C152BFe} - C:\WINDOWS\System32\dpvoice32.dll
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: PHPNukeIT Toolbar - {2c965f3f-8efd-4bfc-a2c5-1672845fdbbf} - C:\Programmi\PHPNukeIT\tbPHP1.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programmi\AVG\AVG8\avgssie.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Programmi\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programmi\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Programmi\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmi\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programmi\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programmi\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: PHPNukeIT Toolbar - {2c965f3f-8efd-4bfc-a2c5-1672845fdbbf} - C:\Programmi\PHPNukeIT\tbPHP1.dll
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [CTStartup] C:\Programmi\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [Jet Detection] C:\Programmi\Creative\SBAudigy\PROGRAM\ADGJDet.exe
O4 - HKLM\..\Run: [StormCodec_Helper] "C:\Programmi\Ringz Studio\Storm Codec\StormSet.exe" /S /opti
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [00PCTFW] "C:\Programmi\PC Tools Firewall Plus\FirewallGUI.exe" -s
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Programmi\File comuni\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [HP Software Update] C:\Programmi\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Programmi\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [Disc Detector] C:\Programmi\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Programmi\Google\Quick Search Box\GoogleQuickSearchBox.exe" /autorun
O4 - HKLM\..\Run: [snp2uvc] C:\WINDOWS\vsnp2uvc.exe
O4 - HKLM\..\Run: [AliceRE_McciTrayApp] C:\PROGRA~1\ALICET~1\vendors\AliceRE\content\template\DRIVEN~1\syncer\MCCITR~1.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Programmi\TomTom HOME 2\TomTomHOMERunner.exe"
O4 - HKCU\..\Run: [TaskTray] C:\Programmi\Creative\SBAudigy\TaskBar\CTLTray.exe
O4 - HKCU\..\Run: [TaskBar] C:\Programmi\Creative\SBAudigy\TaskBar\CTLTask.exe
O4 - HKCU\..\Run: [Sidebar] C:\Programmi\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Skype] "C:\Programmi\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'c:\programmi\bonjour\mdnsnsp.dll' missing
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://a516.g.akamai.net/f/516/25175/7d/runaware.download.akamai.com/25175/citrix/wficat-no-eula.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programmi\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Programmi\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: C:\WINDOWS\System32\expsrv32.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O20 - Winlogon Notify: fc170e3e660 - C:\WINDOWS\System32\expsrv32.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programmi\File comuni\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate1c98afdb2c2012c) (gupdate1c98afdb2c2012c) - Google Inc. - C:\Programmi\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmi\Java\jre6\bin\jqs.exe
O23 - Service: Network WanMiniport First Position - Unknown owner - C:\Programmi\Telecom Italia\WanMiniport1st\srvany.exe
O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Programmi\PC Tools Firewall Plus\FWService.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Programmi\TomTom HOME 2\TomTomHOMEService.exe

--
End of file - 9964 bytes

Ho fatto tutto come indicato e invio i log Combofix


ComboFix 09-10-11.01 - Proprietario 12/10/2009 3.18.12.1.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.39.1040.18.1024.600 [GMT 2:00]
Eseguito da: c:\documents and settings\Proprietario\Desktop\ComboFix.exe
FW: PC Tools Firewall Plus *enabled* {ABBD5028-5A95-4B6D-996E-98D64AE88D52}

ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Proprietario\Dati applicazioni\02000000e751b0e8660C.manifest
c:\documents and settings\Proprietario\Dati applicazioni\02000000e751b0e8660O.manifest
c:\documents and settings\Proprietario\Dati applicazioni\02000000e751b0e8660P.manifest
c:\documents and settings\Proprietario\Dati applicazioni\02000000e751b0e8660S.manifest
c:\programmi\\setup.exe
c:\programmi\autorun.inf
c:\windows\GnuHashes.ini
c:\windows\Installer\65d12f.msi
c:\windows\Installer\f562.msi
c:\windows\system32\29MF0.vbs
c:\windows\system32\9.tmp
c:\windows\system32\A.tmp
c:\windows\system32\aN9tz6L91lEOe.vbs
c:\windows\system32\DHCPMON32.DLL
c:\windows\system32\DPVOICE32.DLL
c:\windows\system32\DPWSOCKX32.DLL
c:\windows\system32\DSSEC32.DLL
c:\windows\system32\GroupPolicy000.dat
c:\windows\system32\hjpPS.vbs
c:\windows\system32\LocalService\313.crack.zip.kwd
c:\windows\system32\LocalService\314.keygen.zip.kwd
c:\windows\system32\LocalService\315.serial.zip.kwd
c:\windows\system32\LocalService\316.setup.zip.kwd
c:\windows\system32\LocalService\317.music.au
c:\windows\system32\LocalService\317.music.au.kwd
c:\windows\system32\LocalService\318.music2.au
c:\windows\system32\LocalService\318.music2.au.kwd
c:\windows\system32\LocalService\319.music3.au
c:\windows\system32\LocalService\319.music3.au.kwd
c:\windows\system32\LocalService\320.music4.au
c:\windows\system32\LocalService\320.music4.au.kwd
c:\windows\system32\lUP4K7MSpXnyF.vbs
c:\windows\system32\mCsIqXT5RC3MH.vbs
c:\windows\system32\MtcJw.vbs
c:\windows\system32\nbUK5gM.vbs
c:\windows\system32\oDScgoqCfMuTDBO.vbs
c:\windows\system32\QzI9Y.vbs
c:\windows\system32\RhSUcMs9N9OzMij.vbs
c:\windows\system32\u3HTW.vbs
c:\windows\system32\vKPRRWKZPQAJN.vbs
c:\windows\system32\VX86mb1.vbs
D:\resycled
d:\resycled\boot.com

.
((((((((((((((((((((((((( Files Creati Da 2009-09-12 al 2009-10-12 )))))))))))))))))))))))))))))))))))
.

2010-04-28 13:32 . 2010-04-28 13:32 -------- d-----w- c:\programmi\AVG
2010-04-28 13:23 . 2010-04-28 13:23 65950560 ----a-w- c:\programmi\avg_free_stf_eu_85_287a1483.exe
2009-10-12 01:07 . 2009-10-12 01:07 116736 ----a-w- c:\windows\system32\csseqchk32.dll
2009-10-11 20:51 . 2009-10-11 20:51 116736 ----a-w- c:\windows\system32\fontext32.dll
2009-10-11 14:22 . 2009-10-11 14:22 -------- d-----w- c:\programmi\Trend Micro
2009-10-11 14:21 . 2009-10-11 14:21 812344 ----a-w- c:\programmi\HJTInstall.exe
2009-10-11 07:34 . 2009-10-11 07:34 -------- d-----w- c:\programmi\File comuni\Macrovision Shared
2009-10-11 06:38 . 2009-10-11 14:52 -------- d-----w- c:\programmi\Bonjour
2009-10-08 21:27 . 2009-10-12 01:23 -------- d-sh--w- c:\windows\system32\LocalService
2009-09-26 13:33 . 2009-09-26 13:33 -------- d-----w- c:\documents and settings\NetworkService\Impostazioni locali\Dati applicazioni\Temp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-12 01:27 . 2008-09-28 17:43 -------- d---a-w- c:\documents and settings\All Users\Dati applicazioni\TEMP
2009-10-12 01:26 . 2008-09-26 16:21 24 ----a-w- c:\windows\system32\DVCStateBkp-{00000000-00000000-0000000A-00001102-00000004-005A1102}.dat
2009-10-12 01:26 . 2008-09-26 16:21 24 ----a-w- c:\windows\system32\DVCState-{00000000-00000000-0000000A-00001102-00000004-005A1102}.dat
2009-10-12 01:25 . 2009-08-12 14:02 -------- d-----w- c:\documents and settings\Proprietario\Dati applicazioni\Skype
2009-10-12 01:14 . 2008-09-26 16:55 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\avg8
2009-10-11 18:21 . 2009-08-07 20:02 -------- d-----w- c:\documents and settings\Proprietario\Dati applicazioni\skypePM
2009-10-11 14:35 . 2009-08-25 08:41 129 ----a-w- c:\documents and settings\Proprietario\udpcrawl.tmp
2009-10-11 07:45 . 2008-09-26 16:53 -------- d-----w- c:\programmi\File comuni\Adobe
2009-10-11 07:26 . 2008-09-28 22:45 -------- d-----w- c:\programmi\Java
2009-10-11 06:46 . 2008-09-26 16:06 74984 ----a-w- c:\documents and settings\Proprietario\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2009-10-06 17:55 . 2009-02-09 21:29 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Google Updater
2009-10-02 18:21 . 2008-09-28 22:50 -------- d-----w- c:\documents and settings\Proprietario\Dati applicazioni\LimeWire
2009-09-05 21:27 . 2009-09-05 21:27 -------- d-----w- c:\documents and settings\Proprietario\Dati applicazioni\Leadertech
2009-08-30 19:53 . 2009-08-30 19:53 -------- d-----w- c:\programmi\File comuni\PAC7311
2009-08-30 19:53 . 2009-08-30 19:53 -------- d-----w- c:\programmi\Trust
2009-08-30 10:05 . 2009-08-30 10:05 -------- d-----w- c:\documents and settings\Proprietario\Dati applicazioni\GlarySoft
2009-08-30 10:01 . 2009-08-30 10:01 -------- d-----w- c:\programmi\Glary Utilities
2009-08-30 10:00 . 2009-08-30 10:00 -------- d-----w- c:\programmi\Glary_Utilities
2009-08-30 09:56 . 2009-08-30 09:56 5488957 ----a-w- c:\programmi\Glary_Utilities.zip
2009-08-30 09:39 . 2009-08-30 09:39 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Fighters
2009-08-24 23:38 . 2009-08-24 23:37 -------- d-----w- c:\programmi\Paint.NET
2009-08-24 21:13 . 2009-08-24 21:13 1603760 ----a-w- c:\programmi\Paint.NET.3.36.zip
2009-08-24 15:57 . 2009-08-24 15:57 -------- d-----w- c:\programmi\File comuni\Adobe Systems Shared
2009-08-24 05:49 . 2009-08-24 05:22 -------- d-----w- c:\programmi\PhotoScape
2009-08-24 05:21 . 2009-08-24 05:21 15063882 ----a-w- c:\programmi\PhotoScapeSetup_V3.3.exe
2009-08-23 19:53 . 2009-08-23 19:53 119296 ----a-w- c:\windows\system32\expsrv32.dll
2009-08-23 14:56 . 2009-08-23 14:56 52636 ---ha-w- c:\windows\system32\mlfcache.dat
2009-08-23 13:47 . 2009-08-23 13:46 -------- d-----w- c:\programmi\Informazioni Tecniche
2009-08-23 13:47 . 2009-08-23 13:46 -------- d-----w- c:\programmi\Extra
2009-08-23 13:47 . 2009-08-23 13:46 -------- d-----w- c:\programmi\AutoPlay
2009-08-23 13:46 . 2009-08-23 13:46 -------- d-----w- c:\programmi\Assistenza clienti
2009-08-23 13:46 . 2009-08-23 13:46 -------- d-----w- c:\programmi\Adobe Solutions Network
2009-08-23 13:46 . 2009-08-23 13:46 -------- d-----w- c:\programmi\Adobe Reader 7.0
2009-08-23 08:15 . 2009-08-23 08:15 -------- d-----w- c:\programmi\Alice ti aiuta
2009-08-19 22:25 . 2009-08-19 22:25 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Adobe Systems
2009-08-16 06:33 . 2009-08-16 06:33 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Motive
2009-08-15 05:01 . 2009-08-15 05:01 -------- d-----w- c:\programmi\Microsoft CAPICOM 2.1.0.2
2009-08-14 10:37 . 2008-11-23 18:33 -------- d-----w- c:\programmi\Virtual Earth 3D
2009-08-12 14:01 . 2009-08-12 14:00 2032936 ----a-w- c:\programmi\SkypeSetup.exe
2009-08-12 13:53 . 2009-08-12 13:53 8599101 ----a-w- c:\programmi\15355_01.exe
2009-08-07 20:02 . 2009-08-07 20:02 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-08-06 17:24 . 2008-09-26 15:43 327896 ----a-w- c:\windows\system32\wucltui.dll
2009-08-06 17:24 . 2008-09-26 15:43 209632 ----a-w- c:\windows\system32\wuweb.dll
2009-08-06 17:24 . 2008-09-26 15:43 35552 ----a-w- c:\windows\system32\wups.dll
2009-08-06 17:24 . 2008-07-18 20:10 44768 ----a-w- c:\windows\system32\wups2.dll
2009-08-06 17:24 . 2008-09-26 15:43 53472 ----a-w- c:\windows\system32\wuauclt.exe
2009-08-06 17:24 . 2006-03-02 12:00 96480 ----a-w- c:\windows\system32\cdm.dll
2009-08-06 17:23 . 2008-09-26 15:43 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-08-06 17:23 . 2009-08-15 04:07 274288 ----a-w- c:\windows\system32\mucltui.dll
2009-08-06 17:23 . 2009-08-15 04:07 215920 ----a-w- c:\windows\system32\muweb.dll
2009-08-06 17:23 . 2008-09-26 15:43 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-08-05 08:59 . 2006-03-02 12:00 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-19 23:35 . 2009-07-19 23:34 22962563 ----a-w- c:\programmi\Rubrica.exe
2009-07-19 16:48 . 2009-07-19 16:48 71540 ----a-w- c:\programmi\CalendarPrint.zip
2009-07-17 19:01 . 2006-03-02 12:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-06-09 17:07 . 2009-06-09 17:07 3342809 ----a-w- c:\programmi\eMule0.49c-Installer.exe
2009-06-09 09:57 . 2009-06-09 09:57 10053112 ----a-w- c:\programmi\picasa3-setup.exe
2009-05-02 05:28 . 2009-05-02 05:28 1053744 ----a-w- c:\programmi\revosetup.exe
2008-12-14 19:13 . 2008-12-14 19:13 372520 ----a-w- c:\programmi\ymjsetup_24.exe
2008-12-07 18:27 . 2008-12-07 18:27 14958253 ----a-w- c:\programmi\Windows_Sidebar__Real_one_Pack_by_joshoon.zip
2008-10-13 00:00 . 2008-10-12 23:55 183 ----a-w- c:\programmi\presence_sip_pandreoni_alice_it.xml
2008-10-12 23:52 . 2008-10-12 23:52 183 ----a-w- c:\programmi\presence_sip_pandreono_alice_it.xml
2008-10-07 20:12 . 2008-10-07 20:11 1011844 ----a-w- c:\programmi\SetupPoigpsGo.zip
2008-10-05 21:41 . 2008-10-05 21:41 7730856 ----a-w- c:\programmi\GoogleEarth.exe
2004-08-10 21:09 . 2009-08-23 13:46 126976 ----a-w- c:\programmi\epic_eula.dll
2004-03-01 05:43 . 2009-08-23 13:46 625 ----a-w- c:\programmi\Setup.exe.manifest
2003-04-20 18:39 . 2009-08-23 13:46 245408 ----a-w- c:\programmi\unicows.dll
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{2c965f3f-8efd-4bfc-a2c5-1672845fdbbf}"= "c:\programmi\PHPNukeIT\tbPHP1.dll" [2009-07-12 2215960]

[HKEY_CLASSES_ROOT\clsid\{2c965f3f-8efd-4bfc-a2c5-1672845fdbbf}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{05647034-1833-4EF0-AD7E-D6603C152BFe}]
2009-10-11 20:51 116736 ----a-w- c:\windows\system32\fontext32.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2c965f3f-8efd-4bfc-a2c5-1672845fdbbf}]
2009-07-12 09:38 2215960 ----a-w- c:\programmi\PHPNukeIT\tbPHP1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{2c965f3f-8efd-4bfc-a2c5-1672845fdbbf}"= "c:\programmi\PHPNukeIT\tbPHP1.dll" [2009-07-12 2215960]

[HKEY_CLASSES_ROOT\clsid\{2c965f3f-8efd-4bfc-a2c5-1672845fdbbf}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{2C965F3F-8EFD-4BFC-A2C5-1672845FDBBF}"= "c:\programmi\PHPNukeIT\tbPHP1.dll" [2009-07-12 2215960]

[HKEY_CLASSES_ROOT\clsid\{2c965f3f-8efd-4bfc-a2c5-1672845fdbbf}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\programmi\Messenger\msmsgs.exe" [2008-04-14 1695232]
"TomTomHOME.exe"="c:\programmi\TomTom HOME 2\TomTomHOMERunner.exe" [2009-08-07 247144]
"TaskTray"="c:\programmi\Creative\SBAudigy\TaskBar\CTLTray.exe" [2001-06-29 163840]
"TaskBar"="c:\programmi\Creative\SBAudigy\TaskBar\CTLTask.exe" [2002-05-08 122880]
"Sidebar"="c:\programmi\Windows Sidebar\sidebar.exe" [2007-07-28 1230848]
"swg"="c:\programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-11-16 68856]
"Skype"="c:\programmi\Skype\Phone\Skype.exe" [2009-07-16 25604904]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-10 90112]
"CTStartup"="c:\programmi\Creative\Splash Screen\CTEaxSpl.EXE" [2001-12-19 28672]
"Jet Detection"="c:\programmi\Creative\SBAudigy\PROGRAM\ADGJDet.exe" [2001-11-29 28672]
"StormCodec_Helper"="c:\programmi\Ringz Studio\Storm Codec\StormSet.exe" [2006-11-26 97357]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"00PCTFW"="c:\programmi\PC Tools Firewall Plus\FirewallGUI.exe" [2008-12-11 2652056]
"SSBkgdUpdate"="c:\programmi\File comuni\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-09-29 155648]
"HP Software Update"="c:\programmi\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2002-12-17 49152]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb08.exe" [2003-03-26 172032]
"DeviceDiscovery"="c:\programmi\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" [2002-12-02 40960]
"Disc Detector"="c:\programmi\Creative\ShareDLL\CtNotify.exe" [2001-12-25 191488]
"Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"Google Quick Search Box"="c:\programmi\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-06-08 68592]
"snp2uvc"="c:\windows\vsnp2uvc.exe" [2007-06-22 569344]
"SunJavaUpdateSched"="c:\programmi\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"WINDVDPatch"="CTHELPER.EXE" - c:\windows\system32\CTHELPER.EXE [2002-07-02 24576]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Bluetooth Manager.lnk - c:\programmi\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2004-12-24 483328]
Microsoft Office.lnk - c:\programmi\Microsoft Office\Office\OSA9.EXE [2000-1-21 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fc170e3e660]
2009-08-23 19:53 119296 ----a-w- c:\windows\system32\expsrv32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmi\\LimeWire\\LimeWire.exe"=
"c:\\Programmi\\Skype\\Phone\\Skype.exe"=

R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [14/04/2009 13.16.34 159600]
R2 PCTAppEvent;PCTAppEvent Driver;c:\windows\system32\drivers\PCTAppEvent.sys [14/04/2009 13.16.40 73840]
R2 TomTomHOMEService;TomTomHOMEService;c:\programmi\TomTom HOME 2\TomTomHOMEService.exe [07/08/2009 16.31.40 92008]
R3 pctplfw;pctplfw;c:\windows\system32\drivers\pctplfw.sys [14/04/2009 13.16.20 95640]
S2 gupdate1c98afdb2c2012c;Google Update Service (gupdate1c98afdb2c2012c);c:\programmi\Google\Update\GoogleUpdate.exe [09/02/2009 23.30.56 133104]
S2 Network WanMiniport First Position;Network WanMiniport First Position;c:\programmi\Telecom Italia\WanMiniport1st\srvany.exe [28/09/2008 10.38.09 8192]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D58F39FF-953E-4F45-898F-59F243B9A523}]
"c:\programmi\Windows Sidebar\sidebar.exe" /RegServer
.
Contenuto della cartella 'Scheduled Tasks'

2009-10-11 c:\windows\Tasks\GlaryInitialize.job
- c:\programmi\Glary Utilities\initialize.exe [2009-08-30 14:09]

2009-10-12 c:\windows\Tasks\Google Software Updater.job
- c:\programmi\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-09-28 06:09]

2009-10-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2009-02-09 21:30]

2009-10-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2009-02-09 21:30]

2009-07-12 c:\windows\Tasks\User_Feed_Synchronization-{7B6974CF-900C-467F-9F8B-3243D7DE8C97}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uDefault_Search_URL = hxxp://www.google.com/ie
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/ymj/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride = 127.0.0.1
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
- - - - CHIAVI ORFANE RIMOSSE - - - -

HKLM-Run-AliceRE_McciTrayApp - c:\progra~1\ALICET~1\vendors\AliceRE\content\template\DRIVEN~1\syncer\MCCITR~1.EXE
Notify-avgrsstarter - avgrsstx.dll



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-12 03:27
Windows 5.1.2600 Service Pack 3 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTStartup = c:\programmi\Creative\Splash Screen\CTEaxSpl.EXE /run???????h??????s?????\?w? ?w???????w???w4???????.??w4???????4???TA?s4????????&??????\??? ??? ???\???\???????????5?:~e?:~\???\????????9`??????C@?\???\??????s????\??????s\????&??A??s?&???C@?x???`|?w\?????@
Disc Detector = c:\programmi\Creative\ShareDLL\CtNotify.exe?? ??X???????????????????E?@?Disc Detector?A????? ?A?p ????B?e!@???@???@?? C?????E?@?????????@?B???A????? ?A?? ????B???@?????P?????@?? ??????~?:~??????????@???????????????????B?????? ??????????????????????????r?B

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------

[HKEY_USERS\S-1-5-21-1844237615-2052111302-839522115-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------

- - - - - - - > 'winlogon.exe'(748)
c:\windows\System32\expsrv32.dll

- - - - - - - > 'explorer.exe'(3468)
c:\windows\system32\WININET.dll
c:\programmi\Google\Quick Search Box\bin\1.2.1150.158\qsb.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\System32\expsrv32.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\windows\system32\CTSVCCDA.EXE
c:\programmi\Java\jre6\bin\jqs.exe
c:\programmi\PC Tools Firewall Plus\FWService.exe
c:\windows\system32\MsPMSPSv.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\programmi\Creative\ShareDLL\MEDIADET.EXE
c:\programmi\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
c:\programmi\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe
c:\programmi\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Ora fine scansione: 2009-10-12 3.30.41 - Il pc è stato riavviato
ComboFix-quarantined-files.txt 2009-10-12 01:30

Pre-Run: 81.158.500.352 byte disponibili
Post-Run: 81.267.724.288 byte disponibili

282 --- E O F --- 2009-09-09 06:01

ciao

analizza qui ====> http://www.virustotal.com/it/

questo file segnalato in rosso e dammi il responso dei 40 antivirus

c:\windows\system32\fontext32.dll

praticamente ti dice che non e' dannoso? potresti ripetere la scansione e salvare la pagina?

fai anche questo

tasto destro sul file in questione e scegli ''proprieta' ''- in alto clicca su ''versione'' e dammi le informazioni che riesci a prendere

societa'....file originale... ecc...ecc....

saltiamo questo passaggio per ora, lo riprendiamo dopo

esegui questa scansione

Scarica e installa malwarebytes.
http://www.malwarebytes.org/mbam/program/mbam-setup.exe
Aggiornalo: clicca sulla scheda "aggiornamenti" => "controlla aggiornamenti"
Esegui una "scansione completa" (seleziona l'opzione)
A scansione completata, posta il rapporto.

per ora non rimuovere niente

Vai nel pannello di controllo ed elimina la GoogleToolbarNotifier, e' solo un pericolo in piu' per il tuo pc

e pensare che ben 40 antivirus non avevano rilevato il file

C:\WINDOWS\system32\fontext32.dll

malwarebytes lo ha scovato- riavvia il programma ed elimina tutto



disinstalla ComboFix in questa maniera:

Start\esegui

nella casella di dlialogo copia ed incolla questo comando: combofix /u


2) vai in Disco Locale C: ed elimina la cartella QooBox

3) elimina l'eventuale cartella che avevi creato sul Desktop in cui avevi posizionato Combofix.


Postami un log aggiornato di hjt

Disattiva il ripristino, riavvia il pc- riattivalo e crea un nuovo punto


Avvia hijackthis, con tutte le applicazioni chiuse, premi su Do a system scan only , spunta ed elimina (fix checked) le seguenti righe:





scarica Ccleaner

http://www.filehippo.com/download_ccleaner/

1) per il download dell'ultima versione clicca a destra in alto sotto la freccia verde
2) installalo
3) clicca su "avvia pulizia", ripeti il procedimento 2 volte

poi

scarica Atfcleaner

http://www.atribune.org/ccount/click.php?id=1

Avvia ATFCleaner.exe con un doppio click

1) seleziona la casella Select All
2) clicca sul pulsante Empty selected
3) aspetta l'avviso Done Cleaning.
(se non vuoi eliminare le password togli la spunta) - (se usi opera o firefox,spunta anche le loro sezioni)



Riesegui malwarebytes aggiornato e fai una nuova scansione completa