vai in pannello di controllo e guarda se tra i programmi installati risulta qualcosa che non conosci.
@fdaccc:a parte il fatto che dubito che riuscirebbe ad aprirlo anche rinominandolo,preferisco che determinate operazioni gliele faccia fare qualcuno che ha la piena padronanza dell argomento,io personalmente preferisco attenermi a cose che in ogni caso non comportino rischi di sorta se qualcosa non andasse per il giusto verso,e mi sembra che il webmaster ti abbia chiesto espressamente di fare lo stesso.
edit:
come non detto,è arrivato chi ti puo aiutare davvero.

scusa una domanda: per l'installazione di combofix devo disattivare pure il firewall, o semplicemente chiuderlo?

non riesco a scaricare il file dal link che mi hai dato tu, r16; ho provato sia con mozilla, che con IE: mi trova "errore nel server" e "Impossibile trovare il server. Posso provare qualche altro link? o cos'altro?
Vorrei gentilmente sapere se succede solo a me, o se succede pure a voi.

no,succede a te perchè le infezioni che hai impediscono certe operazioni,se vedi il mio post piu' sopra l avevo spiegato ad un altro utente,in ogni caso era un tentativo da fare.adesso,se vuoi seguire il mio consiglio,aspetti pazientemente r16 che sa cosa fare in questi casi,e SOPRATTUTTO non ti espone a rischi di problemi maggiori.

PERFETTO!
ho seguito tutte le istruzioni descritte da r16, tutte!

Una volta aperto ComboFix ha fatto diversi passaggi:
- mi ha fatto riavviare due volte o tre il pc (mi parlava di un certo cd emulation)
- La prima sua scansione ha trovato dei file di cui mi ha detto di prendere nota. Questi sono:

Titolo della finestra aperta: Rootkit !!

Combofix ha rilevato la presenza di attività Rootkit ed è necessario riavviare il pc
KAnnotare i nomi poichè potranno servirci dopo


c:\windows\system32\drivers\H8SRTyfucfmcufj.sys
c:\windows\system32\H8SRTxjexexrlot.dll
c:\windows\system32\H8SRTobwhxxtprt.dat
c:\windows\system32\H8SRTlewbekcrhw.dll
c:\windows\system32\H8SRTvdevbvxrxx.dll
c:\windows\system32\H8SRTypftidwkrd.dll

- Dopodichè, dopo aver riavviato il pc fa un'altra scansione e nella finestra appaiono nel tempo tanti stage, fino al num. 50
- Procede con l'eliminazione di certi file
- e poi con ulteriori cose, che hanno fine nella creazione del report.


Ecco il log di ComboFix:

ComboFix 10-02-12.01 - amministratore 17/02/2010 12.26.51.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.39.1040.18.1024.750 [GMT 1:00]
Eseguito da: c:\documents and settings\amministratore.USER-AAAB15D8C2\Desktop\SomboFix.exe

ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users.WINDOWS\Dati applicazioni\h8srtkrl32mainweq.dll
c:\documents and settings\All Users.WINDOWS\Dati applicazioni\h8srtmainqt.dll
c:\documents and settings\All Users.WINDOWS\Dati applicazioni\sysReserve.ini
c:\documents and settings\amministratore.USER-AAAB15D8C2\Impostazioni locali\Dati applicazioni\vcraoesb.dat
c:\documents and settings\amministratore.USER-AAAB15D8C2\Impostazioni locali\Dati applicazioni\vcraoesb_nav.dat
c:\documents and settings\amministratore.USER-AAAB15D8C2\Impostazioni locali\Dati applicazioni\vcraoesb_navps.dat
c:\recycler\S-1-5-21-436374069-1500820517-839522115-1003
c:\recycler\S-1-5-21-484763869-583907252-839522115-1003
c:\windows\explorer.exe.tmp
c:\windows\system32\drivers\down
c:\windows\system32\drivers\H8SRTyfucfmcufj.sys
c:\windows\system32\h8srtkrl32mainweq.dll
c:\windows\system32\H8SRTlewbekcrhw.dll
c:\windows\system32\H8SRTobwhxxtprt.dat
c:\windows\system32\h8srtshsyst.dll
c:\windows\system32\H8SRTvdevbvxrxx.dll
c:\windows\system32\H8SRTxjexexrlot.dll
c:\windows\system32\H8SRTypftidwkrd.dll
c:\windows\WINDOWS

.
((((((((((((((((((((((((((((((((((((((( Driver/Servizi )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_H8SRTd.sys
-------\Legacy_H8SRTd.sys


((((((((((((((((((((((((( Files Creati Da 2010-01-17 al 2010-02-17 )))))))))))))))))))))))))))))))))))
.

2010-02-14 15:02 . 2010-02-16 08:57 -------- d-----w- c:\programmi\a-squared Anti-Malware
2010-02-09 08:12 . 2010-02-09 08:12 -------- d-----w- c:\documents and settings\amministratore.USER-AAAB15D8C2\Dati applicazioni\Music Recognition
2010-02-09 08:11 . 2010-02-09 08:11 -------- d-----w- c:\programmi\WIDI 4.0 Pro
2010-02-02 13:07 . 2009-11-25 10:19 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-01-31 13:44 . 2010-02-02 13:00 -------- d-----w- c:\documents and settings\amministratore.USER-AAAB15D8C2\Dati applicazioni\AVGTOOLBAR

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-16 09:29 . 2009-06-09 15:05 -------- d-----w- c:\programmi\Google
2010-01-31 13:44 . 2007-09-17 07:05 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Dati applicazioni\Grisoft
2010-01-31 12:32 . 2007-02-26 16:38 -------- d-----w- c:\programmi\eMule
2010-01-29 15:21 . 2007-09-16 22:18 -------- d-----w- c:\documents and settings\amministratore.USER-AAAB15D8C2\Dati applicazioni\MSN6
2009-11-23 18:37 . 2009-11-23 18:37 152576 ----a-w- c:\documents and settings\amministratore.USER-AAAB15D8C2\Dati applicazioni\Sun\Java\jre1.6.0_17\lzma.dll
2009-11-23 18:37 . 2009-11-23 18:37 79488 ----a-w- c:\documents and settings\amministratore.USER-AAAB15D8C2\Dati applicazioni\Sun\Java\jre1.6.0_17\gtapi.dll
2006-07-18 12:41 . 2006-06-17 16:32 1019094 --sh--r- c:\programmi\serial.zip
2006-07-18 12:41 . 2006-06-17 16:32 1019094 --sh--r- c:\programmi\serial.tde
2006-05-28 15:46 . 2006-05-28 15:45 397306 --sh--r- c:\programmi\wunauclt.zip
2006-05-28 15:46 . 2006-05-28 15:45 397306 --sh--r- c:\programmi\wunauclt.tbe
2004-03-11 12:27 . 2007-02-26 21:25 40960 ------w- c:\programmi\Uninstall_CDS.exe
2000-09-15 23:40 . 2007-07-22 20:16 0 -c-h--r- c:\programmi\EBUSetup.sem
.

------- Sigcheck -------

[-] 2006-12-19 . FAD73705BED0910E910DE852B0F8AEBC . 134656 . . [6.00.2900.3051] . . c:\windows\system32\shsvcs.dll
[-] 2006-12-19 . FAD73705BED0910E910DE852B0F8AEBC . 134656 . . [6.00.2900.3051] . . c:\windows\system32\dllcache\shsvcs.dll
[-] 2006-12-19 . 89F95338182388B65DC381AEAAB62079 . 135168 . . [6.00.2900.3051] . . c:\windows\$hf_mig$\KB928255\SP2QFE\shsvcs.dll
[7] 2004-08-19 . 500E8EF27757B1C463A4A263ED2C95D2 . 134656 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB928255$\shsvcs.dll
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-06-14 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"I downloaded pirated Software from P2P "="Need for Speed Carbon" [X]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"AdslTaskBar"="stmctrl.dll" [2003-01-22 151552]
"Easy-PrintToolBox"="c:\programmi\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2006-10-17 398944]
"NSLauncher"="c:\programmi\Nokia\Nokia Software Launcher\NSLauncher.exe" [2007-05-09 3084288]
"OlStatusMon"="c:\programmi\Olivetti\ANY_WAY\olDvcStatus.exe" [2006-01-03 94208]
"SunJavaUpdateSched"="c:\programmi\Java\jre6\bin\jusched.exe" [2009-10-11 149280]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360]

c:\documents and settings\All Users.WINDOWS\Menu Avvio\Programmi\Esecuzione automatica\
Adobe Reader Speed Launch.lnk - c:\programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\eMule\\emule.exe"=
"c:\\Programmi\\Messenger\\msmsgs.exe"=
"c:\\Games\\KKND Xtreme\\KKND Xtreme.EXE"=
"c:\\Programmi\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=

R0 Vax347s;Vax347s;c:\windows\system32\drivers\Vax347s.sys [05/08/2007 7.36.24 5248]
R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [23/02/2007 18.48.01 75904]
R2 olMntrService;olMntrService;c:\programmi\Olivetti\ANY_WAY\olMntrService.exe [03/01/2006 11.36.32 69632]
R3 Stmatm;ATM/ADSL miniport;c:\windows\system32\drivers\stmatm.sys [17/09/2007 8.12.33 59338]
S2 LrWdm;FlyVideo PnP Controller;c:\windows\system32\drivers\Lr25Wdm.sys [07/09/2000 5.00.00 43928]
S3 PAC207;Trust WB-1200p Mini Webcam;c:\windows\system32\drivers\PFC027.sys [24/02/2005 12.29.14 162176]
S3 TaurusUsb;ADSL Modem USB Service 1.09a;c:\windows\system32\drivers\torususb.sys [17/09/2007 8.12.33 527980]
S3 z220wModem;Samsung Electronics Co., LTD z220wModem;c:\windows\system32\drivers\z220.sys [22/03/2007 7.08.45 114944]
S4 Vax347b;Vax347b;c:\windows\system32\drivers\Vax347b.sys [05/08/2007 7.36.24 159616]
.
Contenuto della cartella 'Scheduled Tasks'
.
.
------- Scansione supplementare -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}
mStart Page = hxxp://www.forospyware.com
mWindow Title =
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Aggiungi all'elenco di stampa Easy-WebPrint - c:\programmi\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Anteprima Easy-WebPrint - c:\programmi\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Stampa ad alta velocità Easy-WebPrint - c:\programmi\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Stampa Easy-WebPrint - c:\programmi\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949}
DPF: CabBuilder - hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
FF - ProfilePath - c:\documents and settings\amministratore.USER-AAAB15D8C2\Dati applicazioni\Mozilla\Firefox\Profiles\mk0pvf8f.default\
FF - prefs.js: browser.search.selectedEngine - Live Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.it
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=it-it&FORM=MICI05&q=
.
- - - - CHIAVI ORFANE RIMOSSE - - - -

HKCU-Run-PowerBar - (no file)
AddRemove-HijackThis - c:\docume~1\AMMINI~1.USE\IMPOST~1\Temp\Rar$EX00.094\HijackThis.exe
AddRemove-PharaohSharewareDeinstKey - c:\programmi\Pharaoh’s Ascent Shareware\DeIsL1.isu



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-17 12:35
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
PowerBar = ????????????l?@?l?@?D?????9~??????????????9~l?@?l?@????? ???????????W?<~??9~??????9~K?9~x???????[?9~???????? ??????????????|x???0???????????? lt??9~?????????????????d[?\???K???????l?@?l?@?????Q?:~????t?@?????l?@?8?@?l?@?3??s????????????????????8?@?_??s8?@?8?@

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\OMSCAN]
"ImagePath"="\Sys"
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------

- - - - - - - > 'winlogon.exe'(672)
c:\windows\system32\Ati2evxx.dll
.
Ora fine scansione: 2010-02-17 12:39:58
ComboFix-quarantined-files.txt 2010-02-17 11:39

Pre-Run: 15.901.368.320 byte disponibili
Post-Run: 16.435.122.176 byte disponibili

- - End Of File - - 816D70AB2393CDE69AD1FE84E27EB385

Seguendo le tue precise istruzioni, ecco il log aggiornato di Combofix:

ComboFix 10-02-12.01 - amministratore 17/02/2010 15.13.35.3.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.39.1040.18.1024.705 [GMT 1:00]
Eseguito da: c:\documents and settings\amministratore.USER-AAAB15D8C2\Desktop\SomboFix.exe
Opzioni usate :: c:\documents and settings\amministratore.USER-AAAB15D8C2\Desktop\CFScript.txt

ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.

((((((((((((((((((((((((( Files Creati Da 2010-01-17 al 2010-02-17 )))))))))))))))))))))))))))))))))))
.

2010-02-14 15:02 . 2010-02-16 08:57 -------- d-----w- c:\programmi\a-squared Anti-Malware
2010-02-09 08:12 . 2010-02-09 08:12 -------- d-----w- c:\documents and settings\amministratore.USER-AAAB15D8C2\Dati applicazioni\Music Recognition
2010-02-09 08:11 . 2010-02-09 08:11 -------- d-----w- c:\programmi\WIDI 4.0 Pro
2010-02-02 13:07 . 2009-11-25 10:19 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-01-31 13:44 . 2010-02-02 13:00 -------- d-----w- c:\documents and settings\amministratore.USER-AAAB15D8C2\Dati applicazioni\AVGTOOLBAR

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-16 09:29 . 2009-06-09 15:05 -------- d-----w- c:\programmi\Google
2010-01-31 13:44 . 2007-09-17 07:05 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Dati applicazioni\Grisoft
2010-01-31 12:32 . 2007-02-26 16:38 -------- d-----w- c:\programmi\eMule
2010-01-29 15:21 . 2007-09-16 22:18 -------- d-----w- c:\documents and settings\amministratore.USER-AAAB15D8C2\Dati applicazioni\MSN6
2009-11-23 18:37 . 2009-11-23 18:37 152576 ----a-w- c:\documents and settings\amministratore.USER-AAAB15D8C2\Dati applicazioni\Sun\Java\jre1.6.0_17\lzma.dll
2009-11-23 18:37 . 2009-11-23 18:37 79488 ----a-w- c:\documents and settings\amministratore.USER-AAAB15D8C2\Dati applicazioni\Sun\Java\jre1.6.0_17\gtapi.dll
2006-07-18 12:41 . 2006-06-17 16:32 1019094 --sh--r- c:\programmi\serial.zip
2006-07-18 12:41 . 2006-06-17 16:32 1019094 --sh--r- c:\programmi\serial.tde
2006-05-28 15:46 . 2006-05-28 15:45 397306 --sh--r- c:\programmi\wunauclt.zip
2006-05-28 15:46 . 2006-05-28 15:45 397306 --sh--r- c:\programmi\wunauclt.tbe
2004-03-11 12:27 . 2007-02-26 21:25 40960 ------w- c:\programmi\Uninstall_CDS.exe
2000-09-15 23:40 . 2007-07-22 20:16 0 -c-h--r- c:\programmi\EBUSetup.sem
.

------- Sigcheck -------

[-] 2006-12-19 . FAD73705BED0910E910DE852B0F8AEBC . 134656 . . [6.00.2900.3051] . . c:\windows\system32\shsvcs.dll
[-] 2006-12-19 . FAD73705BED0910E910DE852B0F8AEBC . 134656 . . [6.00.2900.3051] . . c:\windows\system32\dllcache\shsvcs.dll
[-] 2006-12-19 . 89F95338182388B65DC381AEAAB62079 . 135168 . . [6.00.2900.3051] . . c:\windows\$hf_mig$\KB928255\SP2QFE\shsvcs.dll
[7] 2004-08-19 . 500E8EF27757B1C463A4A263ED2C95D2 . 134656 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB928255$\shsvcs.dll
.
((((((((((((((((((((((((((((( SnapShot@2010-02-17_11.35.42 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-02-17 13:55 . 2010-02-17 13:55 16384 c:\windows\Temp\Perflib_Perfdata_6c4.dat
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-06-14 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"AdslTaskBar"="stmctrl.dll" [2003-01-22 151552]
"Easy-PrintToolBox"="c:\programmi\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2006-10-17 398944]
"NSLauncher"="c:\programmi\Nokia\Nokia Software Launcher\NSLauncher.exe" [2007-05-09 3084288]
"OlStatusMon"="c:\programmi\Olivetti\ANY_WAY\olDvcStatus.exe" [2006-01-03 94208]
"SunJavaUpdateSched"="c:\programmi\Java\jre6\bin\jusched.exe" [2009-10-11 149280]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360]

c:\documents and settings\All Users.WINDOWS\Menu Avvio\Programmi\Esecuzione automatica\
Adobe Reader Speed Launch.lnk - c:\programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\eMule\\emule.exe"=
"c:\\Programmi\\Messenger\\msmsgs.exe"=
"c:\\Games\\KKND Xtreme\\KKND Xtreme.EXE"=
"c:\\Programmi\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=

R0 Vax347s;Vax347s;c:\windows\system32\drivers\Vax347s.sys [05/08/2007 7.36.24 5248]
R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [23/02/2007 18.48.01 75904]
R2 olMntrService;olMntrService;c:\programmi\Olivetti\ANY_WAY\olMntrService.exe [03/01/2006 11.36.32 69632]
R3 Stmatm;ATM/ADSL miniport;c:\windows\system32\drivers\stmatm.sys [17/09/2007 8.12.33 59338]
S2 LrWdm;FlyVideo PnP Controller;c:\windows\system32\drivers\Lr25Wdm.sys [07/09/2000 5.00.00 43928]
S3 PAC207;Trust WB-1200p Mini Webcam;c:\windows\system32\drivers\PFC027.sys [24/02/2005 12.29.14 162176]
S3 TaurusUsb;ADSL Modem USB Service 1.09a;c:\windows\system32\drivers\torususb.sys [17/09/2007 8.12.33 527980]
S3 z220wModem;Samsung Electronics Co., LTD z220wModem;c:\windows\system32\drivers\z220.sys [22/03/2007 7.08.45 114944]
S4 Vax347b;Vax347b;c:\windows\system32\drivers\Vax347b.sys [05/08/2007 7.36.24 159616]
.
.
------- Scansione supplementare -------
.
uSearch Page = hxxp://www.google.com
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}
uSearch Bar = hxxp://www.google.com/ie
mStart Page = hxxp://www.forospyware.com
mWindow Title =
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Aggiungi all'elenco di stampa Easy-WebPrint - c:\programmi\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Anteprima Easy-WebPrint - c:\programmi\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Stampa ad alta velocità Easy-WebPrint - c:\programmi\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Stampa Easy-WebPrint - c:\programmi\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949}
DPF: CabBuilder - hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
FF - ProfilePath - c:\documents and settings\amministratore.USER-AAAB15D8C2\Dati applicazioni\Mozilla\Firefox\Profiles\mk0pvf8f.default\
FF - prefs.js: browser.search.selectedEngine - Live Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.it
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=it-it&FORM=MICI05&q=
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-17 15:20
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\OMSCAN]
"ImagePath"="\Sys"
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------

- - - - - - - > 'winlogon.exe'(684)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2428)
c:\programmi\Windows Media Player\wmpband.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Ora fine scansione: 2010-02-17 15:23:20
ComboFix-quarantined-files.txt 2010-02-17 14:23
ComboFix2.txt 2010-02-17 11:39

Pre-Run: 16.423.428.096 byte disponibili
Post-Run: 16.399.273.984 byte disponibili

- - End Of File - - 2078747A53E8BE2BA51B6FB6B5CFC1C8


Ecco invece il log di HJT:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15.33.22, on 17/02/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\Ati2evxx.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\Programmi\Ahead\InCD\InCDsrv.exe
C:\windows\system32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\Programmi\Java\jre6\bin\jqs.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmi\Olivetti\ANY_WAY\olMntrService.exe
C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
C:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\windows\system32\svchost.exe
C:\windows\system32\wscntfy.exe
C:\windows\system32\Ati2evxx.exe
C:\windows\System32\svchost.exe
C:\windows\system32\rundll32.exe
C:\Programmi\Olivetti\ANY_WAY\olDvcStatus.exe
C:\Programmi\Java\jre6\bin\jusched.exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\windows\explorer.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://it.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.forospyware.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmi\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programmi\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Programmi\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [NSLauncher] C:\Programmi\Nokia\Nokia Software Launcher\NSLauncher.exe /startup
O4 - HKLM\..\Run: [OlStatusMon] "C:\Programmi\Olivetti\ANY_WAY\olDvcStatus.exe" dvcStatusMinimize
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [swg] "C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Aggiungi all'elenco di stampa Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Anteprima Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Stampa ad alta velocità Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Stampa Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\windows\system32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/IT-IT/a-UNO1/GAME_UNO1.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://gaetno92.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://eu.download.games.yahoo.com/zylom/activex/zylomloader.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\windows\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Programmi\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Programmi\Ahead\InCD\InCDsrv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmi\Java\jre6\bin\jqs.exe
O23 - Service: olMntrService - Olivetti - C:\Programmi\Olivetti\ANY_WAY\olMntrService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programmi\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

--
End of file - 7959 bytes

solo una domanda: a cosa vado incontro facendo la deframmentazione? ho sempre creduto che con la deframmentazione dell'HD si va incontro a danni nell'HD o nel sistema operativo...insomma in un certo qualmodo è dannoso. Vorrei gentilmente delle delucidazioni a riguardo.
P.S. credo che ci metterò qualche giorno per completare tutte le operazioni elencate sopra.

Benissimo! Come non detto ho fatto la deframmentazione e le cose che cerdevo erano compeltamente sbagliate...
Comunque ho fatto tutto e adesso non noto nessun problema...quindi perfetto direi! Vi ringrazio davvero, specie ad r16, spero di poter aiutare i vostri iscritti se potrò, e vi assicuro che pubblicizzerò molto il vostro forum.
Ora vorrei per ultimo solamente consigliato un buon firewall da installare e un buon antipyware, grazie ^_^

Grazie ancora r16!!!
A presto!