Ciao Shapiro...ho scaricato il programma e mi dice che il mio antivirus (MSE) è da intralcio...cosa faccio?

ComboFix 13-01-26.02 - alex 26/01/2013 17:52:45.1.4 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.39.1040.18.3583.1587 [GMT 1:00]
Eseguito da: c:\users\alex\Downloads\ComboFix.exe
AV: Microsoft Security Essentials *Enabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}
SP: Microsoft Security Essentials *Enabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\alex\AppData\Roaming\Funay
c:\users\alex\AppData\Roaming\Funay\uxizu.mye
c:\windows\IsUn0410.exe
c:\windows\system32\MailBee.dll
.
.
((((((((((((((((((((((((( Files Creati Da 2012-12-26 al 2013-01-26 )))))))))))))))))))))))))))))))))))
.
.
2013-01-26 16:58 . 2013-01-26 16:58 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-01-26 16:37 . 2013-01-26 16:37 29904 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{3546CB2B-669A-42D7-93DF-5E33F4C562A7}\MpKsl8e687906.sys
2013-01-26 09:56 . 2013-01-08 04:57 6991832 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{3546CB2B-669A-42D7-93DF-5E33F4C562A7}\mpengine.dll
2013-01-25 08:57 . 2013-01-08 04:57 6991832 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-01-22 11:03 . 2013-01-22 11:03 -------- d-----w- c:\users\alex\AppData\Local\Programs
2013-01-20 08:37 . 2013-01-20 08:37 448 ----a-w- C:\user.js
2013-01-20 08:37 . 2011-06-10 22:58 773968 ----a-w- c:\windows\system32\msvcr100.dll
2013-01-20 08:37 . 2011-06-10 22:58 421200 ----a-w- c:\windows\system32\msvcp100.dll
2013-01-20 08:37 . 2011-05-13 23:17 632656 ----a-w- c:\windows\system32\msvcr80.dll
2013-01-20 08:37 . 2011-05-13 23:17 479232 ----a-w- c:\windows\system32\msvcm80.dll
2013-01-20 08:37 . 2011-05-13 23:17 554832 ----a-w- c:\windows\system32\msvcp80.dll
2013-01-20 08:36 . 2013-01-20 08:36 242240 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2013-01-20 08:36 . 2013-01-20 08:36 -------- d-----w- c:\program files\DAEMON Tools Lite
2013-01-16 18:56 . 2012-11-01 04:47 1389568 ----a-w- c:\windows\system32\msxml6.dll
2013-01-16 18:56 . 2012-11-09 04:43 492032 ----a-w- c:\windows\system32\win32spl.dll
2013-01-16 18:56 . 2012-11-20 04:51 220160 ----a-w- c:\windows\system32\ncrypt.dll
2013-01-16 18:56 . 2012-11-23 02:48 49152 ----a-w- c:\windows\system32\taskhost.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-01-25 21:21 . 2011-10-27 16:29 91952 ----a-w- c:\windows\system32\drivers\VIRAGTLT.sys
2013-01-09 12:22 . 2012-10-11 09:58 697864 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-01-09 12:22 . 2011-06-04 06:33 74248 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-12-16 14:13 . 2012-12-21 19:55 295424 ----a-w- c:\windows\system32\atmfd.dll
2012-12-16 14:13 . 2012-12-21 19:55 34304 ----a-w- c:\windows\system32\atmlib.dll
2012-12-14 15:49 . 2011-03-12 21:06 21104 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-11-28 14:25 . 2012-11-28 14:25 740840 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9FF29894-4F8D-42C3-943B-D260E3E05EA6}\gapaengine.dll
2012-11-28 09:35 . 2012-09-07 09:38 859072 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-11-28 09:35 . 2012-04-12 10:28 779704 ----a-w- c:\windows\system32\deployJava1.dll
2012-11-15 08:48 . 2012-03-19 22:14 83912 ----a-w- c:\windows\system32\LMIRfsClientNP.dll
2012-11-15 08:48 . 2012-03-19 22:14 52648 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\LMIproc.dll
2012-11-15 08:48 . 2012-03-19 22:14 31144 ----a-w- c:\windows\system32\LMIport.dll
2012-11-15 08:48 . 2012-03-19 22:14 92072 ----a-w- c:\windows\system32\LMIinit.dll
2012-11-14 02:09 . 2012-12-12 09:43 1800704 ----a-w- c:\windows\system32\jscript9.dll
2012-11-14 01:58 . 2012-12-12 09:43 1427968 ----a-w- c:\windows\system32\inetcpl.cpl
2012-11-14 01:57 . 2012-12-12 09:43 1129472 ----a-w- c:\windows\system32\wininet.dll
2012-11-14 01:49 . 2012-12-12 09:43 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2012-11-14 01:48 . 2012-12-12 09:43 420864 ----a-w- c:\windows\system32\vbscript.dll
2012-11-14 01:44 . 2012-12-12 09:43 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2012-11-09 04:42 . 2012-12-12 09:39 2048 ----a-w- c:\windows\system32\tzres.dll
2012-11-02 05:11 . 2012-12-12 09:39 376832 ----a-w- c:\windows\system32\dpnet.dll
2013-01-18 20:09 . 2013-01-18 20:09 262552 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{373BCD12-5B7A-4c09-897B-6B42EC48B0F8}]
2012-12-07 17:44 101016 ----a-w- c:\vexplite\VIRITIE.DLL
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-02-18 2423752]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2013-01-08 3674320]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck"="c:\program files\VIA\VIAudioi\VDeck\VDeck.exe" [2009-08-28 1486848]
"VIRIT LITE MONITOR"="c:\vexplite\MONLITE.EXE" [2013-01-25 335872]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2011-09-16 63048]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-11-28 59280]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 947176]
"V0230Mon.exe"="c:\windows\V0230Mon.exe" [2006-09-07 32768]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-12-12 152544]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 ServUpdater;Serv Updater;c:\users\alex\AppData\Local\ServUpdater\ServiceUpd.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]
R2 SoftwareUpd;Software Upd;c:\users\alex\AppData\Local\SoftwareUpdater\SoftwareUpdService.exe [x]
R3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Servizio Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 VIRAGTLT;VIRAGTLT;c:\windows\system32\drivers\VIRAGTLT.SYS [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S1 MpKsl8e687906;MpKsl8e687906;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{3546CB2B-669A-42D7-93DF-5E33F4C562A7}\MpKsl8e687906.sys [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [x]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\LogMeIn\x86\LMIGuardianSvc.exe [x]
S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys [x]
S2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
S2 viritsvclite;VirIT eXplorer Lite;c:\vexplite\viritsvc.exe [x]
S3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [x]
S3 V0230Vfx;V0230Vfx;c:\windows\system32\DRIVERS\V0230Vfx.sys [x]
S3 V0230VID;Live! Cam Video IM Pro;c:\windows\system32\DRIVERS\V0230VID.sys [x]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [x]
.
.
--- Altri Servizi/Drivers In Memoria ---
.
*NewlyCreated* - MPKSL8E687906
.
Contenuto della cartella 'Scheduled Tasks'
.
2013-01-26 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-11 12:22]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.tgsoft.it/
uInternet Settings,ProxyOverride = *.local
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 62.101.93.101 83.103.25.250
TCP: Interfaces\{D66AD7AB-A605-4BFC-9BEC-0C609FFDB10B}: NameServer = 8.8.8.8,8.8.4.4
TCP: Interfaces\{e29ac6c2-7037-11de-816d-806e6f6e6963}: NameServer = 8.8.8.8,8.8.4.4
FF - ProfilePath - c:\users\alex\AppData\Roaming\Mozilla\Firefox\Profiles\pth8h4zz.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.repubblica.it/
FF - prefs.js: keyword.URL - hxxp://mystart.incredibar.com/mb201/?loc=IB_DS&a=6PQWmkDzaQ&&i=26&search=
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
FF - user.js: extensions.incredibar_i.newTab - false
FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6PQWmkDzaQ&loc=IB_TB&i=26&search=
FF - user.js: extensions.incredibar_i.id - 9e38363000000000000020cf30cbdd2b
FF - user.js: extensions.incredibar_i.instlDay - 15725
FF - user.js: extensions.incredibar_i.vrsn - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsni - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsnTs - 1.5.11.149:37
FF - user.js: extensions.incredibar_i.prtnrId - Incredibar
FF - user.js: extensions.incredibar_i.prdct - incredibar
FF - user.js: extensions.incredibar_i.aflt - orgnl
FF - user.js: extensions.incredibar_i.smplGrp - none
FF - user.js: extensions.incredibar_i.tlbrId - base
FF - user.js: extensions.incredibar_i.instlRef -
FF - user.js: extensions.incredibar_i.dfltLng -
FF - user.js: extensions.incredibar_i.excTlbr - false
FF - user.js: extensions.incredibar_i.ms_url_id -
FF - user.js: extensions.incredibar_i.upn2 - 6PQWmkDzaQ
FF - user.js: extensions.incredibar_i.upn2n - 92544303495476724
FF - user.js: extensions.incredibar_i.productid - 26
FF - user.js: extensions.incredibar_i.installerproductid - 26
FF - user.js: extensions.incredibar_i.did - 10643
FF - user.js: extensions.incredibar_i.ppd - 1
.
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Ora fine scansione: 2013-01-26 18:00:14
ComboFix-quarantined-files.txt 2013-01-26 17:00
.
Pre-Run: 17.419.522.048 byte disponibili
Post-Run: 17.325.494.272 byte disponibili
.
- - End Of File - - F0F083C49A20868D7341E51C4B0611C3

Ho fatto tutto, ma non conosco Wikisend :-(

Buongiorno Shapiro ;-)

Extras.Txt
OTL.Txt

Va bene così?

Sarà impegnato attendi un pò magari interviene r16, comunque ho visto che sei infettato da search.findeer che è un malware ti dovrebbe aver cambiato anche la pagina iniziale del browser e ci sono attivati anche dei servizi, ci vorrebbe uno script per OTL ma io ancora non me la sento di farlo.
Se in giornata o domani non ti risponde nessuno allora posta un log di Hijack This e ti dico cosa eliminare. Ciao

ho avuto un po' da fare mi spiace

ora apri otl e copia nel box bianco questo codice







clicca su run fix e allega il log che rilascia, dovresti trovarlo nella stessa cartella di otl e' un log numerico

dopo il riavvio controlla se hai sempre le rilevazioni

Shapiro una volta premuto run fix si riavviato il pc e si aperta una finestra con questo log

========== OTL ==========
Service SoftwareUpd stopped successfully!
Service SoftwareUpd deleted successfully!
C:\Users\alex\AppData\Local\SoftwareUpdater\SoftwareUpdService.exe moved successfully.
Service ServUpdater stopped successfully!
Service ServUpdater deleted successfully!
C:\Users\alex\AppData\Local\ServUpdater\ServiceUpd.exe moved successfully.
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Prefs.js: "http://mystart.incredibar.com/mb201/?loc=IB_DS&a=6PQWmkDzaQ&&i=26&search=" removed from keyword.URL
C:\Qoobox\Quarantine\Registry_backups folder moved successfully.
C:\Qoobox\Quarantine\C\Windows\System32 folder moved successfully.
C:\Qoobox\Quarantine\C\Windows folder moved successfully.
C:\Qoobox\Quarantine\C\Users\alex\AppData\Roaming\Funay folder moved successfully.
C:\Qoobox\Quarantine\C\Users\alex\AppData\Roaming folder moved successfully.
C:\Qoobox\Quarantine\C\Users\alex\AppData folder moved successfully.
C:\Qoobox\Quarantine\C\Users\alex folder moved successfully.
C:\Qoobox\Quarantine\C\Users folder moved successfully.
C:\Qoobox\Quarantine\C folder moved successfully.
C:\Qoobox\Quarantine folder moved successfully.
Folder move failed. C:\Qoobox\BackEnv scheduled to be moved on reboot.
C:\Qoobox folder moved successfully.
C:\ProgramData\mirmjmismia.dat moved successfully.
C:\Users\alex\AppData\Roaming\Asyc folder moved successfully.
C:\Users\alex\AppData\Roaming\Ebyh folder moved successfully.
ADS C:\ProgramData\TEMP:DFC29B88 deleted successfully.
ADS C:\ProgramData\TEMP:C31F31E6 deleted successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Configurazione IP di Windows
Cache del resolver DNS svuotata.
C:\Users\alex\Desktop\cmd.bat deleted successfully.
C:\Users\alex\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

OTL by OldTimer - Version 3.2.69.0 log created on 01292013_194936

Files\Folders moved on Reboot...
File\Folder C:\Qoobox\BackEnv not found!

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

si reinstalla java poi apri otl e clicca su cleanup dopo il riavvio fai queste pulizie


scarica e installa ccleaner

durante l’installazione deseleziona l’opzione per la barra di Yahoo, lo apri, vai in Opzioni>Avanzate, togli la spunta a “Cancella file temp diwindows solo se più vecchi di 48 ore”, poi avvialo, seleziona "Analizza" ed alla fine dell'analisi premi "Avvia pulizia''


clicca su Registro, nella pagina successiva clicca Trova problemi, poi al termine dello scan clicca su Ripara selezionati , risposndi di sì alla richiesta di salvare il backup (salvalo in una cartella a piacimento) poi ripara tutti gli elementi trovati.

disattiva il ripristino

riavvia

riattivalo e crea un nuovo punto


svuota la cartella prefetch ( non eliminarla)

se il pc ora va bene possiamo salutarci

http://windows.microsoft.com/it-IT/windows7/Turn-System-Restore-on-or-off

---