Ho fatto quanto richiesto. Per quel che riguarda il ripristino configuerazione sono andat a vedere. E' impostato con la spunta su : Disattiva proteszione sistema. Come lo devo mettere.
Sistema operativo: Windows 7 32. Come antivirus: MSE
Per quel che riguadta i Log:
A) quello con AdwCleaner, appene alo avvio, quando inizia la analisi euristica sui blocca e si chiude (non va anche in modalità provvisoria
B) Log di Malwarebytes :
Malwarebytes
www.malwarebytes.com-Dettagli log-
Data scansione: 18/10/17
Ora scansione: 19:39
File di log: 53c073fa-b42b-11e7-abea-08606e698e27.json
Amministratore: Sì
-Informazioni software-
Versione: 3.2.2.2029
Versione componenti: 1.0.212
Aggiorna versione pacchetto: 1.0.3042
Licenza: Trial
-Informazioni sistema-
SO: Windows 7 Service Pack 1
CPU: x86
File system: NTFS
Utente: TascaPane-PC\Tasca Pane
-Riepilogo scansione-
Tipo di scansione: Ricerca elementi nocivi
Risultati: Completata
Elementi analizzati: 369138
Minacce rilevate: 8
Minacce messe in quarantena: 0
(Nessun elemento nocivo rilevato)
Tempo impiegato: 29 min, 19 sec
-Opzioni di scansione-
Memoria: Attivata
Esecuzioni automatiche: Attivata
File system: Attivata
Archivi compressi: Attivata
Rootkit: Disattivata
Analisi euristica: Attivata
PUP: Rilevare
PUM: Rilevare
-Dettagli scansione-
Processo: 0
(Nessun elemento nocivo rilevato)
Modulo: 0
(Nessun elemento nocivo rilevato)
Chiave di registro: 2
PUP.Optional.SearchManager, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\NAHHMPBCKPGDIDFNMFKFGIFLPJIJILCE, Nessuna azione intrapresa, [526], [440037],1.0.3042
PUP.Optional.SearchManager, HKU\S-1-5-21-1227608380-2347549918-51477129-1000\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\nahhmpbckpgdidfnmfkfgiflpjijilce, Nessuna azione intrapresa, [526], [440037],1.0.3042
Valore di registro: 0
(Nessun elemento nocivo rilevato)
Dati di registro: 0
(Nessun elemento nocivo rilevato)
Flusso di dati: 0
(Nessun elemento nocivo rilevato)
Cartella: 3
PUP.Optional.YSearchTab, C:\Users\Tasca Pane\AppData\Roaming\Mozilla\Firefox\Profiles\z8vnwlpu.default-1493324181929\storage\default\http+++forumerit.ysearchtab.com\idb\301792106ttes.files, Nessuna azione intrapresa, [8283], [395234],1.0.3042
PUP.Optional.YSearchTab, C:\Users\Tasca Pane\AppData\Roaming\Mozilla\Firefox\Profiles\z8vnwlpu.default-1493324181929\storage\default\http+++forumerit.ysearchtab.com\idb, Nessuna azione intrapresa, [8283], [395234],1.0.3042
PUP.Optional.YSearchTab, C:\USERS\TASCA PANE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\Z8VNWLPU.DEFAULT-1493324181929\STORAGE\DEFAULT\http+++forumerit.ysearchtab.com, Nessuna azione intrapresa, [8283], [395234],1.0.3042
File: 3
PUP.Optional.YSearchTab, C:\Users\Tasca Pane\AppData\Roaming\Mozilla\Firefox\Profiles\z8vnwlpu.default-1493324181929\storage\default\http+++forumerit.ysearchtab.com\idb\301792106ttes.sqlite, Nessuna azione intrapresa, [8283], [395234],1.0.3042
PUP.Optional.YSearchTab, C:\Users\Tasca Pane\AppData\Roaming\Mozilla\Firefox\Profiles\z8vnwlpu.default-1493324181929\storage\default\http+++forumerit.ysearchtab.com\.metadata, Nessuna azione intrapresa, [8283], [395234],1.0.3042
PUP.Optional.YSearchTab, C:\Users\Tasca Pane\AppData\Roaming\Mozilla\Firefox\Profiles\z8vnwlpu.default-1493324181929\storage\default\http+++forumerit.ysearchtab.com\.metadata-v2, Nessuna azione intrapresa, [8283], [395234],1.0.3042
Settore fisico: 0
(Nessun elemento nocivo rilevato)
(end)
C) Log di Junkware Removal :
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.4 (07.09.2017)
Operating System: Windows 7 Ultimate x86
Ran by Tasca Pane (Administrator) on 18/10/2017 at 21:38:54,69
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
File System: 10
Successfully deleted: C:\Users\Tasca Pane\AppData\Local\drivertoolkit (Folder)
Successfully deleted: C:\Users\Tasca Pane\AppData\Roaming\productdata (Folder)
Successfully deleted: C:\Users\Tasca Pane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0IMB0K7N (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Tasca Pane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T3K0F7HD (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Tasca Pane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VD6GYBL3 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Tasca Pane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YNRDWAMN (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0IMB0K7N (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T3K0F7HD (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VD6GYBL3 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YNRDWAMN (Temporary Internet Files Folder)
Registry: 1
Successfully deleted: HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} (Registry Key)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 18/10/2017 at 21:42:30,39
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
D) Log di HijckThis:
Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 21:57:19, on 18/10/2017
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18817)
FIREFOX: 56.0 (x86 it)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\CCleaner\CCleaner.exe
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
C:\Windows\system32\DllHost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Tasca Pane\Desktop\TEST\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe
R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = d8b34ea5ca3b11e6b6bb08606e698e27
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.8.0_66\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe Acrobat Create PDF Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre1.8.0_66\bin\jp2ssv.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [MSC] "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner.exe" /MONITOR
O4 - HKCU\..\Run: [Dike 6] "C:\Program Files\InfoCert\DiKe 6\dike.exe" -o NO_SHELL -f "NO_MAIN_WIN"
O4 - Global Startup: PDFCreator.lnk = C:\Program Files\PDFCreator\PDFCreator.exe
O8 - Extra context menu item: Aggiungi a PDF esistente - res://C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Aggiungi destinazione link a PDF esistente - res://C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Converti destinazione link in Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Converti in Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: I&nvia a OneNote - res://C:\PROGRA~1\MICROS~3\Office14\ONBttnIE.dll/105
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cabO23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
O23 - Service: Servizio Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CodeMeter Runtime Server (CodeMeter.exe) - WIBU-SYSTEMS AG - C:\Program Files\CodeMeter\Runtime\bin\CodeMeter.exe
O23 - Service: FABS - Helping agent for MAGIX media database (Fabs) - MAGIX AG - C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - Firebird Project - C:\Program Files\Firebird\Firebird_2_5\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - Firebird Project - C:\Program Files\Firebird\Firebird_2_5\bin\fbserver.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe
O23 - Service: Freemake Improver - Freemake - C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe
O23 - Service: FreemakeVideoCapture - Ellora Assets Corp. - C:\Program Files\Freemake\CaptureLib\CaptureLibService.exe
O23 - Service: Servizio Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Servizio Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Key4SwitchService - bit4id srl -
http://www.bit4id.com - C:\Program Files\SwitchService\svc\hkeyswsvc.exe
O23 - Service: LiveUpdate (LiveUpdateSvc) - IObit - C:\Program Files\IObit\LiveUpdate\LiveUpdate.exe
O23 - Service: Malwarebytes Service (MBAMService) - Malwarebytes - C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: Macrium Reflect Image Mounting Service (ReflectService.exe) - Paramount Software UK Ltd - C:\Program Files\Macrium\Reflect\ReflectService.exe
O23 - Service: Management Service smart card embedded in a MicroSD (SCSD_Service) - Unknown owner - C:\Program Files\Oberthur Technologies\ID-One Cosmo microSD Driver 2.1.3\SC_SD_Service.exe
O23 - Service: Namirial WakeUpSD Service (WakeUpSvc) - Unknown owner - C:\Windows\system32\Namirial\WakeUpSDService.exe
--
End of file - 6557 bytes