Penso di aver risolto con le scansioni.
posto Malwarebytes
Malwarebytes
www.malwarebytes.com-Dettagli log-
Data scansione: 30/04/17
Ora scansione: 09:34
File di log: malware.txt
Amministratore: Sì
-Informazioni software-
Versione: 3.0.6.1469
Versione componenti: 1.0.103
Aggiorna versione pacchetto: 1.0.1838
Licenza: Free
-Informazioni sistema-
SO: Windows 7 Service Pack 1
CPU: x64
File system: NTFS
Utente: FRANCO-PC\FRANCO
-Riepilogo scansione-
Tipo di scansione: Ricerca elementi nocivi
Risultati: Completata
Elementi analizzati: 320898
Tempo impiegato: 2 min, 29 sec
-Opzioni di scansione-
Memoria: Attivata
Esecuzioni automatiche: Attivata
File system: Attivata
Archivi compressi: Attivata
Rootkit: Disattivata
Analisi euristica: Attivata
PUP: Attivata
PUM: Attivata
-Dettagli scansione-
Processo: 0
(Nessun elemento nocivo rilevato)
Modulo: 0
(Nessun elemento nocivo rilevato)
Chiave di registro: 9
Hijack.AutoConfigURL.PrxySvrRST, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\NLASVC\PARAMETERS\INTERNET\MANUALPROXIES, In quarantena, [270], [-1],0.0.0
Adware.Elex, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\SysUrlHL, In quarantena, [2], [380899],1.0.1838
Adware.Elex, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\SysUrlSH, In quarantena, [2], [380899],1.0.1838
PUP.Optional.Elex.SHHKRST, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Wepusp Log, In quarantena, [347], [339259],1.0.1838
Adware.Sasquor.SPL, HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\PRINT\PROVIDERS\g2ir88s9, In quarantena, [1710], [339986],1.0.1838
PUP.Optional.Elex.SHHKRST, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{3D515391-6284-4D4B-8D54-28D3ED2B0A4F}, In quarantena, [347], [339251],1.0.1838
Adware.Elex, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{8AB42622-97E0-4431-8225-62E057087B8A}, In quarantena, [2], [380898],1.0.1838
Adware.Elex, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{AC11D2E0-1F3B-4519-A909-75F14FA11387}, In quarantena, [2], [380898],1.0.1838
Adware.Elex.SHHKRST, HKLM\SOFTWARE\WOW6432NODE\initialsite123Software, In quarantena, [11], [386267],1.0.1838
Valore di registro: 12
Hijack.AutoConfigURL.PrxySvrRST, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\NLASVC\PARAMETERS\INTERNET\MANUALPROXIES|, In quarantena, [270], [391288],1.0.1838
Hijack.AutoConfigURL.PrxySvrRST, HKU\S-1-5-21-309102820-1572729186-1090038843-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|AUTOCONFIGURL, In quarantena, [270], [-1],0.0.0
Hijack.AutoConfigURL.PrxySvrRST, HKU\S-1-5-18\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|PROXYENABLE, In quarantena, [270], [-1],0.0.0
Hijack.AutoConfigURL.PrxySvrRST, HKU\S-1-5-21-309102820-1572729186-1090038843-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|PROXYENABLE, In quarantena, [270], [-1],0.0.0
Hijack.AutoConfigURL.PrxySvrRST, HKU\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|PROXYENABLE, In quarantena, [270], [-1],0.0.0
Hijack.AutoConfigURL.PrxySvrRST, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|PROXYENABLE, In quarantena, [270], [-1],0.0.0
Hijack.AutoConfigURL.PrxySvrRST, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|PROXYENABLE, In quarantena, [270], [-1],0.0.0
Adware.Sasquor.SPL, HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\PRINT\PROVIDERS\g2ir88s9|NAME, In quarantena, [1710], [339986],1.0.1838
PUP.Optional.Elex.SHHKRST, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{3D515391-6284-4D4B-8D54-28D3ED2B0A4F}|PATH, In quarantena, [347], [339251],1.0.1838
Adware.Elex, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{8AB42622-97E0-4431-8225-62E057087B8A}|PATH, In quarantena, [2], [380898],1.0.1838
Adware.Elex, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{AC11D2E0-1F3B-4519-A909-75F14FA11387}|PATH, In quarantena, [2], [380898],1.0.1838
Hijack.AutoConfigURL.PrxySvrRST, HKU\S-1-5-21-309102820-1572729186-1090038843-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|AUTOCONFIGURL, In quarantena, [270], [391291],1.0.1838
Dati di registro: 0
(Nessun elemento nocivo rilevato)
Flusso di dati: 0
(Nessun elemento nocivo rilevato)
Cartella: 9
Adware.Elex, C:\Wsis32\urlSH\Release\Resources, In quarantena, [2], [380885],1.0.1838
Adware.Elex, C:\Wsis32\urlHL\Release, In quarantena, [2], [380885],1.0.1838
Adware.Elex, C:\Wsis32\urlSH\Release, In quarantena, [2], [380885],1.0.1838
Adware.Elex, C:\Wsis32\config, In quarantena, [2], [380885],1.0.1838
Adware.Elex, C:\Wsis32\urlHL, In quarantena, [2], [380885],1.0.1838
Adware.Elex, C:\Wsis32\urlSH, In quarantena, [2], [380885],1.0.1838
Adware.Elex, C:\Wsis32\temp, In quarantena, [2], [380885],1.0.1838
Adware.Elex, C:\WSIS32, In quarantena, [2], [380885],1.0.1838
PUP.Optional.ProxyGate, C:\WINDOWS\SYSTEM32\SSL, In quarantena, [954], [382064],1.0.1838
File: 42
PUP.Optional.AshampooDriverUpdater, C:\PROGRAMDATA\ASHAMPOO\ICO_ASHAMPOO_DEALS.ICO, In quarantena, [2432], [354924],1.0.1838
Adware.Elex, C:\USERS\FRANCO\APPDATA\ROAMING\PROFILES\ANUMESP.DEFAULT\PREFS.JS, Sostituito, [2], [387123],1.0.1838
Adware.Elex, C:\USERS\FRANCO\APPDATA\ROAMING\PROFILES\ANUMESP.DEFAULT\PREFS.JS, Sostituito, [2], [387123],1.0.1838
Adware.Elex, C:\USERS\FRANCO\APPDATA\ROAMING\PROFILES\ANUMESP.DEFAULT\PREFS.JS, Sostituito, [2], [387123],1.0.1838
Adware.Elex, C:\USERS\FRANCO\APPDATA\ROAMING\PROFILES\ANUMESP.DEFAULT\PREFS.JS, Sostituito, [2], [387123],1.0.1838
Adware.Elex, C:\USERS\FRANCO\APPDATA\ROAMING\PROFILES\ANUMESP.DEFAULT\PREFS.JS, Sostituito, [2], [387123],1.0.1838
Adware.Elex, C:\USERS\FRANCO\APPDATA\ROAMING\PROFILES\ANUMESP.DEFAULT\PREFS.JS, Sostituito, [2], [387123],1.0.1838
Adware.Elex, C:\USERS\FRANCO\APPDATA\ROAMING\PROFILES\ANUMESP.DEFAULT\PREFS.JS, Sostituito, [2], [387123],1.0.1838
Adware.Elex, C:\USERS\FRANCO\APPDATA\ROAMING\PROFILES\ANUMESP.DEFAULT\SEARCHPLUGINS\G2IR88S9.XML, In quarantena, [2], [387118],1.0.1838
Adware.Elex, C:\Wsis32\temp\urlHL.zip, In quarantena, [2], [380885],1.0.1838
Adware.Elex, C:\Wsis32\temp\urlSH.zip, In quarantena, [2], [380885],1.0.1838
Adware.Elex, C:\Wsis32\urlHL\Release\HtmlAgilityPack.dll, In quarantena, [2], [380885],1.0.1838
Adware.Elex, C:\Wsis32\urlHL\Release\System.Data.SQLite.dll, In quarantena, [2], [380885],1.0.1838
Adware.Elex, C:\Wsis32\urlHL\Release\System.Data.SQLite.Linq.dll, In quarantena, [2], [380885],1.0.1838
Adware.Elex, C:\Wsis32\urlHL\Release\sysWIN_IMP.exe, In quarantena, [2], [380885],1.0.1838
Adware.Elex, C:\Wsis32\urlHL\Release\sysWIN_IMP.exe.config, In quarantena, [2], [380885],1.0.1838
Adware.Elex, C:\Wsis32\urlHL\Release\UrlHistoryLibrary.dll, In quarantena, [2], [380885],1.0.1838
Adware.Elex, C:\Wsis32\urlSH\Release\Resources\chrome.ico, In quarantena, [2], [380885],1.0.1838
Adware.Elex, C:\Wsis32\urlSH\Release\Resources\edge.ico, In quarantena, [2], [380885],1.0.1838
Adware.Elex, C:\Wsis32\urlSH\Release\Resources\firefox-icon.ico, In quarantena, [2], [380885],1.0.1838
Adware.Elex, C:\Wsis32\urlSH\Release\Resources\internet-explorer.ico, In quarantena, [2], [380885],1.0.1838
Adware.Elex, C:\Wsis32\urlSH\Release\Newtonsoft.Json.dll, In quarantena, [2], [380885],1.0.1838
Adware.Elex, C:\Wsis32\urlSH\Release\sysWIN_SHW.exe, In quarantena, [2], [380885],1.0.1838
Adware.Elex, C:\Wsis32\urlSH\Release\sysWIN_SHW.pdb, In quarantena, [2], [380885],1.0.1838
Adware.Elex, C:\Wsis32\urlSH\Release\sysWIN_SHW.vshost.exe, In quarantena, [2], [380885],1.0.1838
Adware.Elex, C:\Wsis32\urlSH\Release\sysWIN_SHW.vshost.exe.manifest, In quarantena, [2], [380885],1.0.1838
Adware.OtherSearch, C:\PROGRAM FILES (X86)\KD2FQBFWKO\UNINSTALL.EXE, In quarantena, [2104], [384381],1.0.1838
PUP.Optional.FFHijacker, C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\34874741.CFG, In quarantena, [1094], [330649],1.0.1838
Hijack.HostFile, C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS, Rimozione non riuscita, [316], [329328],1.0.1838
RiskWare.DontStealOurSoftware, C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS, Rimozione non riuscita, [685], [353143],1.0.1838
PUP.Optional.SpyHunter, C:\USERS\FRANCO\APPDATA\LOCAL\TEMP\RAR$EXA0.098\SPYHUNTER 4 (FULL VERSION)\SPYHUNTERS4.EXE, In quarantena, [1326], [340933],1.0.1838
PUP.Optional.SpyHunter, C:\USERS\FRANCO\APPDATA\LOCAL\TEMP\RAR$EXA0.889\SPYHUNTER 4 (FULL VERSION)\SPYHUNTERS4.EXE, In quarantena, [1326], [340933],1.0.1838
PUP.Optional.SpyHunter, C:\USERS\FRANCO\APPDATA\LOCAL\TEMP\RAR$EXA0.752\SPYHUNTER 4 (FULL VERSION)\SPYHUNTERS4.EXE, In quarantena, [1326], [340933],1.0.1838
Adware.Elex, C:\USERS\FRANCO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\KGLT881H.DEFAULT\SEARCHPLUGINS\G2IR88S9.XML, In quarantena, [2], [387119],1.0.1838
Adware.Elex, C:\WINDOWS\SYSTEM32\TASKS\SysUrlHL, In quarantena, [2], [380900],1.0.1838
Adware.Elex, C:\WINDOWS\SYSTEM32\TASKS\SysUrlSH, In quarantena, [2], [380900],1.0.1838
PUP.Optional.ProxyGate, C:\WINDOWS\SYSTEM32\SSL\XV.DB, In quarantena, [954], [382064],1.0.1838
PUP.Optional.ProxyGate, C:\Windows\System32\SSL\6216c92b655f9f53.cer, In quarantena, [954], [382064],1.0.1838
PUP.Optional.ProxyGate, C:\Windows\System32\SSL\cert.db, In quarantena, [954], [382064],1.0.1838
PUP.Optional.ProxyGate, C:\Windows\System32\SSL\x.db, In quarantena, [954], [382064],1.0.1838
PUP.Optional.Elex, C:\WINDOWS\SYSTEM32\TASKS\Wepusp Log, In quarantena, [8], [314312],1.0.1838
PUP.Optional.FFHijacker, C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\DEFAULTS\PREF\34874741.JS, In quarantena, [1094], [330648],1.0.1838
Settore fisico: 0
(Nessun elemento nocivo rilevato)
(end)
ADW cleaner
# AdwCleaner v6.046 - Creato file registro eventi 30/04/2017 in 09:29:36
# Aggiornato su 24/04/2017 da Malwarebytes
# Database : 2017-04-29.1 [Server]
# Sistema operativo : Windows 7 Home Premium Service Pack 1 (X64)
# Utente : FRANCO - FRANCO-PC
# In esecuzione da : C:\Users\FRANCO\Desktop\adwcleaner_6.046.exe
# Modo: pulizia
# Supporto :
https://www.malwarebytes.com/support***** [ Servizi ] *****
[-] Servizio eliminato: 3dd892a52d0a531e1a1c341d5633254b
[-] Servizio eliminato: Partner Service
[-] Servizio eliminato: esgiguard
[-] Servizio eliminato: pgt_svc
***** [ Cartelle ] *****
[-] Cartella eliminata: C:\Users\FRANCO\AppData\Roaming\Enigma Software Group
[-] Cartella eliminata: C:\Program Files\Enigma Software Group
[-] Cartella eliminata: C:\ProgramData\Partner
[#] Cartella eliminata al riavvio: C:\ProgramData\Application Data\Partner
[-] Cartella eliminata: C:\Program Files (x86)\ProxyGate
[-] Cartella eliminata: C:\Users\FRANCO\AppData\Roaming\Mozilla\Firefox\naweriweentcofise
***** [ File ] *****
[-] File eliminato: C:\Windows\SysNative\drivers\EsgScanner.sys
[-] File eliminato: C:\END
***** [ DLL ] *****
***** [ WMI ] *****
***** [ Collegamenti ] *****
[-] Collegamento disnfettato: C:\Users\Public\Desktop\Opera.lnk
[-] Collegamento disnfettato: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[-] Collegamento disnfettato: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
[-] Collegamento disnfettato: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Packard Bell - Security & Support\Contact.lnk
[-] Collegamento disnfettato: C:\Users\FRANCO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[-] Collegamento disnfettato: C:\Users\FRANCO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
[-] Collegamento disnfettato: C:\Users\FRANCO\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[-] Collegamento disnfettato: C:\Users\FRANCO\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Opera.lnk
[-] Collegamento disnfettato: C:\Users\FRANCO\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk
***** [ Attività pianificate ] *****
[-] Attività eliminata: 5npmAHUVJ8
[-] Attività eliminata: Zeoiedplawipy
***** [ Registro ] *****
[#] Chiave eliminata al riavvio: HKLM\SYSTEM\CurrentControlSet\services\partner service
[-] Chiave eliminata: HKLM\SOFTWARE\Classes\kt_bho.KettleBho
[-] Chiave eliminata: HKLM\SOFTWARE\Classes\kt_bho.KettleBho.1
[-] Chiave eliminata: HKLM\SOFTWARE\Classes\protector_dll.Protector
[-] Chiave eliminata: HKLM\SOFTWARE\Classes\protector_dll.Protector.1
[-] Chiave eliminata: HKLM\SOFTWARE\Classes\protector_dll.ProtectorBho
[-] Chiave eliminata: HKLM\SOFTWARE\Classes\protector_dll.ProtectorBho.1
[-] Chiave eliminata: HKLM\SOFTWARE\Classes\protector_dll.ProtectorLib
[-] Chiave eliminata: HKLM\SOFTWARE\Classes\protector_dll.ProtectorLib.1
[#] Chiave eliminata al riavvio: [x64] HKLM\SOFTWARE\Classes\kt_bho.KettleBho
[#] Chiave eliminata al riavvio: [x64] HKLM\SOFTWARE\Classes\kt_bho.KettleBho.1
[#] Chiave eliminata al riavvio: [x64] HKLM\SOFTWARE\Classes\protector_dll.Protector
[#] Chiave eliminata al riavvio: [x64] HKLM\SOFTWARE\Classes\protector_dll.Protector.1
[#] Chiave eliminata al riavvio: [x64] HKLM\SOFTWARE\Classes\protector_dll.ProtectorBho
[#] Chiave eliminata al riavvio: [x64] HKLM\SOFTWARE\Classes\protector_dll.ProtectorBho.1
[#] Chiave eliminata al riavvio: [x64] HKLM\SOFTWARE\Classes\protector_dll.ProtectorLib
[#] Chiave eliminata al riavvio: [x64] HKLM\SOFTWARE\Classes\protector_dll.ProtectorLib.1
[-] Chiave eliminata: HKLM\SOFTWARE\Classes\AppID\{28A88B70-D874-4F73-BBBA-9B2B222FB7D6}
[-] Chiave eliminata: HKLM\SOFTWARE\Classes\CLSID\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4}
[-] Chiave eliminata: HKLM\SOFTWARE\Classes\TypeLib\{86676E13-D6D8-4652-9FCF-F2047F1FB000}
[-] Chiave eliminata: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4}
[-] Chiave eliminata: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4}
[-] Chiave eliminata: HKU\.DEFAULT\Software\jhtrsq
[#] Chiave eliminata al riavvio: HKU\S-1-5-18\Software\jhtrsq
[-] Chiave eliminata: HKLM\SOFTWARE\OtherSearch
[-] Chiave eliminata: HKLM\SOFTWARE\jhtrsq
[-] Chiave eliminata: HKLM\SOFTWARE\{84416237-6490-494D-9AD6-4994DD978971}
[-] Chiave eliminata: HKLM\SOFTWARE\Socia2S Browser Enhancer
[-] Chiave eliminata: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EE171732-BEB4-4576-887D-CB62727F01CA}
[-] Chiave eliminata: [x64] HKLM\SOFTWARE\EnigmaSoftwareGroup
[-] Chiave eliminata: [x64] HKLM\SOFTWARE\jhtrsq
[-] Chiave eliminata: [x64] HKLM\SOFTWARE\Socia2S Browser Enhancer
[-] Chiave eliminata: HKLM\SOFTWARE\Classes\AppID\kt_bho_dll.dll
[-] Chiave eliminata: HKLM\SOFTWARE\CLASSES\APPID\56BF5154-0B48-4ADB-902A-6C8B12E270D9
[-] Valore eliminato: HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER [ENABLESHELLEXECUTEHOOKS]
***** [ Browser ] *****
*************************
:: " tracciamento " chiavi eliminate
:: Impostazioni Winsock ripristinate
*************************
C:\AdwCleaner\AdwCleaner[C0].txt - [5390 Byte] - [30/04/2017 09:29:36]
C:\AdwCleaner\AdwCleaner[S0].txt - [6028 Byte] - [30/04/2017 09:25:45]
########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [5534 Byte] ##########
Grazie e buona festa
