Da qualche tempo il mio computer è molto lento. Non escludo che ci sia qualche intrusione.

Chiedo, per favore, se è meglio passare HIJACKTHIS, COMBOFIX, o qualche altro programma nuovo più efficace.

E se poi, dopo aver passato il programma posso postare qui il Log.

Il mio computer e' un ALL IN ONE. Ha solo 1 Giga di Ram. Il sistema opeativo è W7 Starter, a 32 bit.

Antivirus: Kaspersky in abbonamento annuale.

Grazie per la vostra attenzione.

Ciao
Non escluderei che sia proprio kav ad essere pesante visto che hai solo 1 giga di ram.
Comunque prova a seguire le indicazioni della guida che trovi in sez virus

---

Ciao,
Ho fatto tutto quello che mi hai detto di fare.
Ho scaricato e passato Malwerebytes, Adwcleaner, JRT, Eusing Free Registry.
La velocità del computer è migliorata molto. Anche se, per il momento,
non sono ancora sicuro che sia tutto a posto. Lo posso verificare lavorandoci su un po’.

Fammi sapere, per favore, se devo anche scaricare e passare HIJAKTHIS.


Intanto Posto qui il tutto.
=================

Con MalwereBytes, ho fatto 2 scansioni.
La prima con Rootkit: Disattivata.
La seconda con Rootkit: Attivata.
=================================
--PRIMA SCANSIONE--
Log-MalwereBytes-con-Rootkit: Disattivata-28-9-18

=================================

Malwarebytes
www.malwarebytes.com

-Dettagli log-
Data scansione: 28/09/18
Ora scansione: 15:42
File di log: 6518e2d2-c324-11e8-87d5-00ff46a9a1f7.json

-Informazioni software-
Versione: 3.6.1.2711
Versione componenti: 1.0.463
Aggiorna versione pacchetto: 1.0.7065
Licenza: Free

-Informazioni sistema-
SO: Windows 7 Service Pack 1
CPU: x86
File system: NTFS
Utente: Moksha-PC\Moksha

-Riepilogo scansione-
Tipo di scansione: Ricerca elementi nocivi
Scansione avviata da: Manuale
Risultati: Completata
Elementi analizzati: 169070
Minacce rilevate: 1
Minacce messe in quarantena: 0
Tempo impiegato: 18 min, 44 sec

-Opzioni di scansione-
Memoria: Attivata
Esecuzioni automatiche: Attivata
File system: Attivata
Archivi compressi: Attivata
Rootkit: Disattivata
Analisi euristica: Attivata
PUP: Rilevare
PUM: Rilevare

-Dettagli scansione-
Processo: 0
(Nessun elemento nocivo rilevato)

Modulo: 0
(Nessun elemento nocivo rilevato)

Chiave di registro: 0
(Nessun elemento nocivo rilevato)

Valore di registro: 0
(Nessun elemento nocivo rilevato)

Dati di registro: 0
(Nessun elemento nocivo rilevato)

Flusso di dati: 0
(Nessun elemento nocivo rilevato)

Cartella: 0
(Nessun elemento nocivo rilevato)

File: 1
PUP.Optional.Reimage, C:\$RECYCLE.BIN\S-1-5-21-227713952-2352024697-1479288484-1000\$RK2YV8A\REI_UNDOUTILITY.EXE, Nessuna

azione intrapresa, [1385], [327181],1.0.7065

Settore fisico: 0
(Nessun elemento nocivo rilevato)

WMI: 0
(Nessun elemento nocivo rilevato)

(end)

================================
--SECONDA SCANSIONE--
Log-MalwereBytes-con-Rootkit: Attivata-28-9-18

================================

Malwarebytes
www.malwarebytes.com

-Dettagli log-
Data scansione: 28/09/18
Ora scansione: 16:38
File di log: 1d306faa-c32c-11e8-a078-00ff46a9a1f7.json

-Informazioni software-
Versione: 3.6.1.2711
Versione componenti: 1.0.463
Aggiorna versione pacchetto: 1.0.7067
Licenza: Free

-Informazioni sistema-
SO: Windows 7 Service Pack 1
CPU: x86
File system: NTFS
Utente: Moksha-PC\Moksha

-Riepilogo scansione-
Tipo di scansione: Ricerca elementi nocivi
Scansione avviata da: Manuale
Risultati: Completata
Elementi analizzati: 169381
Minacce rilevate: 0
Minacce messe in quarantena: 0
Tempo impiegato: 36 min, 5 sec

-Opzioni di scansione-
Memoria: Attivata
Esecuzioni automatiche: Attivata
File system: Attivata
Archivi compressi: Attivata
Rootkit: Attivata
Analisi euristica: Attivata
PUP: Rilevare
PUM: Rilevare

-Dettagli scansione-
Processo: 0
(Nessun elemento nocivo rilevato)

Modulo: 0
(Nessun elemento nocivo rilevato)

Chiave di registro: 0
(Nessun elemento nocivo rilevato)

Valore di registro: 0
(Nessun elemento nocivo rilevato)

Dati di registro: 0
(Nessun elemento nocivo rilevato)

Flusso di dati: 0
(Nessun elemento nocivo rilevato)

Cartella: 0
(Nessun elemento nocivo rilevato)

File: 0
(Nessun elemento nocivo rilevato)

Settore fisico: 0
(Nessun elemento nocivo rilevato)

WMI: 0
(Nessun elemento nocivo rilevato)


(end)

=========================
--NOTA--
Ho passato Malwarebytes AdwCleaner,
e alla fine si sono prodotti 2 Logs.
Li posto tutti e due.
=========================

--PRIMO LOG--
# -------------------------------
# Malwarebytes AdwCleaner 7.2.4.0
# -------------------------------
# Build: 09-25-2018
# Database: 2018-09-21.1 (Local)
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Scan
# -------------------------------
# Start: 09-28-2018
# Duration: 00:01:06
# OS: Windows 7 Starter
# Scanned: 42056
# Detected: 5


***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

No malicious folders found.

***** [ Files ] *****

PUP.Optional.Reimage C:\Windows\System32\reimage.rep

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

No malicious tasks found.

***** [ Registry ] *****

PUP.Optional.ProductSetup.A HKCU\Software\PRODUCTSETUP
PUP.Optional.Reimage HKLM\Software\Reimage

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries found.

***** [ Chromium URLs ] *****

PUP.Optional.Legacy Ask
PUP.Optional.Legacy AOL

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries found.

***** [ Firefox URLs ] *****

No malicious Firefox URLs found.

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[S00].txt ##########

===================================================

--SECONDO LOG--

# -------------------------------
# Malwarebytes AdwCleaner 7.2.4.0
# -------------------------------
# Build: 09-25-2018
# Database: 2018-09-21.1 (Local)
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start: 09-28-2018
# Duration: 00:00:20
# OS: Windows 7 Starter
# Cleaned: 5
# Failed: 0


***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

No malicious folders cleaned.

***** [ Files ] *****

Deleted C:\Windows\System32\reimage.rep

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

Deleted HKCU\Software\PRODUCTSETUP
Deleted HKLM\Software\Reimage

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries cleaned.

***** [ Chromium URLs ] *****

Deleted Ask
Deleted AOL

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.


*************************

[+] Delete Tracing Keys
[+] Reset Winsock

*************************

AdwCleaner[S00].txt - [1406 octets] - [28/09/2018 21:22:44]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C00].txt ##########


===================================

--SEGUE IL RISULTATO DI: Junkware Removal Tool (JRT) .

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.4 (07.09.2017)
Operating System: Windows 7 Starter x86
Ran by Moksha (Administrator) on Sat 09/29/2018 at 8:10:55.01
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


File System: 64

Successfully deleted: C:\Users\Moksha\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0XC5BSWP (Temporary

Internet Files Folder)
Successfully deleted: C:\Users\Moksha\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2X6I2Y7J (Temporary

Internet Files Folder)
Successfully deleted: C:\Users\Moksha\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3GLJQPUU (Temporary

Internet Files Folder)
Successfully deleted: C:\Users\Moksha\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3IEDTNNB (Temporary

Internet Files Folder)
Successfully deleted: C:\Users\Moksha\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3KVHF2M3 (Temporary

Internet Files Folder)
Successfully deleted: C:\Users\Moksha\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3TK5H2W3 (Temporary

Internet Files Folder)
Successfully deleted: C:\Users\Moksha\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4P7XAEUE (Temporary

Internet Files Folder)
Successfully deleted: C:\Users\Moksha\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JSL8SOO (Temporary

Internet Files Folder)
Successfully deleted: C:\Users\Moksha\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5S0JGVT1 (Temporary

Internet Files Folder)
Successfully deleted: C:\Users\Moksha\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7IOAQB0P (Temporary

Internet Files Folder)
Successfully deleted: C:\Users\Moksha\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9O31QAIC (Temporary

Internet Files Folder)
Successfully deleted: C:\Users\Moksha\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A83J97RG (Temporary

Internet Files Folder)
Successfully deleted: C:\Users\Moksha\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AC1CO5XG (Temporary

Internet Files Folder)
Successfully deleted: C:\Users\Moksha\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EKG6FKJP (Temporary

Internet Files Folder)
Successfully deleted: C:\Users\Moksha\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EPT6E13W (Temporary

Internet Files Folder)
Successfully deleted: C:\Users\Moksha\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F0YDXLPU (Temporary

Internet Files Folder)
Successfully deleted: C:\Users\Moksha\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FRY7R5RU (Temporary

Internet Files Folder)
Successfully deleted: C:\Users\Moksha\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GA5Y4D3W (Temporary

Internet Files Folder)
Successfully deleted: C:\Users\Moksha\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I98U2CQ2 (Temporary

Internet Files Folder)
Successfully deleted: C:\Users\Moksha\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IR9LO6O8 (Temporary

Internet Files Folder)
Successfully deleted: C:\Users\Moksha\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N29F4UTB (Temporary

Internet Files Folder)
Successfully deleted: C:\Users\Moksha\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NZI2UL0S (Temporary

Internet Files Folder)
Successfully deleted: C:\Users\Moksha\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QOND480I (Temporary

Internet Files Folder)
Successfully deleted: C:\Users\Moksha\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R8CXFCHB (Temporary

Internet Files Folder)
Successfully deleted: C:\Users\Moksha\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RXZF0QS5 (Temporary

Internet Files Folder)
Successfully deleted: C:\Users\Moksha\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S77YFQEU (Temporary

Internet Files Folder)
Successfully deleted: C:\Users\Moksha\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SM03X5DX (Temporary

Internet Files Folder)
Successfully deleted: C:\Users\Moksha\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SMRAUI32 (Temporary

Internet Files Folder)
Successfully deleted: C:\Users\Moksha\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TR94FWR1 (Temporary

Internet Files Folder)
Successfully deleted: C:\Users\Moksha\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V048AXAS (Temporary

Internet Files Folder)
Successfully deleted: C:\Users\Moksha\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y55IKZ5O (Temporary

Internet Files Folder)
Successfully deleted: C:\Users\Moksha\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZT1TF8NY (Temporary

Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files

\Content.IE5\0XC5BSWP (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files

\Content.IE5\2X6I2Y7J (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files

\Content.IE5\3GLJQPUU (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files

\Content.IE5\3IEDTNNB (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files

\Content.IE5\3KVHF2M3 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files

\Content.IE5\3TK5H2W3 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files

\Content.IE5\4P7XAEUE (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files

\Content.IE5\5JSL8SOO (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files

\Content.IE5\5S0JGVT1 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files

\Content.IE5\7IOAQB0P (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files

\Content.IE5\9O31QAIC (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files

\Content.IE5\A83J97RG (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files

\Content.IE5\AC1CO5XG (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files

\Content.IE5\EKG6FKJP (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files

\Content.IE5\EPT6E13W (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files

\Content.IE5\F0YDXLPU (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files

\Content.IE5\FRY7R5RU (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files

\Content.IE5\GA5Y4D3W (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files

\Content.IE5\I98U2CQ2 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files

\Content.IE5\IR9LO6O8 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files

\Content.IE5\N29F4UTB (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files

\Content.IE5\NZI2UL0S (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files

\Content.IE5\QOND480I (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files

\Content.IE5\R8CXFCHB (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files

\Content.IE5\RXZF0QS5 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files

\Content.IE5\S77YFQEU (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files

\Content.IE5\SM03X5DX (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files

\Content.IE5\SMRAUI32 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files

\Content.IE5\TR94FWR1 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files

\Content.IE5\V048AXAS (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files

\Content.IE5\Y55IKZ5O (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files

\Content.IE5\ZT1TF8NY (Temporary Internet Files Folder)



Registry: 4

Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{C500C267-63BF-451F-8797-4D720C9A2ED9}

(Registry Value)
Successfully deleted: HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} (Registry Key)
Successfully deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EC1E29BB-F56A-45D8-B023-

D3EF710FA0E0} (Registry Key)
Successfully deleted: HKLM\Software\Microsoft\Internet Explorer\Toolbar\\{C500C267-63BF-451F-8797-4D720C9A2ED9} (Registry Value)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sat 09/29/2018 at 8:18:37.44
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

--NOTA--
Eusing Free Registry, ha trovato 499 file sospetti.
Ho cliccato su " Ripara registro" e sono stati cancellati tutti.
=====================

Un'ultima cosa. Ho la sensazione che qulche intrusione abbia modificato il Prox di Internet Esplorer.
C'e' un metodo per poterlo verificare?

Grazie di tutto.
Aspetto le tue valutazioni. Ciao.

______
P.S.
Volevo sapere, a parte MalwereBytes, se i programmi che ho scaricato li devo tenere sul computer o li devo disinstallare.

Complimenti a Cbbusto....sempre efficiente ed efficace...... posso dire che se usi Kaspersky free acquisti in leggerezza..? ( anche in denaro..)

Ciao cbbusto,

Appena ho lanciato HJT, si aperta una finestra con quest’avviso:

--ENGLISH--
"For some reasonyour system denied write access the Hosts File. If any hijcked domain are in this file, HijackThis may NOT be able to fix this.

If That happens, you need to edit the file yourself. To do this, click Start, Run and type: notepad C:\Windows\System32\drivers\etc\hosts
and press Enter. Find the line(s) HijackThis reports and delete them.
Save the file as 'hostes'. (with quotes), and reboot.

For Vista and above: simply, exsit HijackThis, right click one the HijackThis icon, choose 'Run as administrator'.

--ITALIANO--
"Per qualche ragione al vostro sistema è stato negato l'accesso in scrittura al file host. Se in questo file ci sono dei domini hijacked, HijackThis potrebbe NON essere in grado di risolvere il problema.

Se questo accade, è necessario modificare il file da soli. Per fare questo, clicca su Start, Esegui e digita: notepad C:\Windows\System32\drivers\etc\etc\hosts
e premere Invio. Trovare le righe HijackThis report e cancellarli.
Salvare il file come 'hostes' ". (con virgolette), e riavviare.

Per Vista e sopra: semplicemente, uscire da HijackThis, fare clic destro del mouse sull'icona HijackThis, scegliere 'Esegui come amministratore'.

--NOTA--
Ho provato a inserire, nella casella Esegui: "notepad C:\Windows\System32\drivers\etc\etc\hosts", ma si e’ aperto un notepad vuoto, insieme ad una finestra Windows che dice: The Siystem cannot find the path specified (Il Siystem non riesce a trovare il percorso specificato).

Traduzione fatta con: https://www.deepl.com/Translator

---

Volevo chiederti, per favore, se potresti darmi qualche indicazione per verificare lo stato del File Host. E nel caso sia stato manomesso, come posso intervenire per risolvere il problema.

Inoltre. Ho come l'impressione che ci siano state delle intrusione attraverso il router Vodafone per la connessione a internet.
Poi, siccome uso un programma, RoboForm, per la protezione delle password, anche qui c'e stato sicuramente un tentativo di intrusione. Ne sono (quasi) certo perché un giorno, avvio il computer, apro RoBoform e trovo che tutti i File fuori cartella erano spariti. Dopo qualche minuto, i file sono ritornati. Mi piacerebbe sapere se dalla lettura del Log di HJT, si riesce a vedere qualcosa di strano sui file Registro, di RoboForm.


--INTANTO TI POSTO QUI IL LOG DÌ HJT--

Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 4:22:46 PM, on 9/30/2018
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.19130)

FIREFOX: 58.0.2 (x86 en-US)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\ProgramData\DatacardService\DCSHelper.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 19.0.0\avpui.exe
C:\Program Files\Kaspersky Lab\Kaspersky Secure Connection 2.0\ksdeui.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Vodafone\Vodafone Mobile Wi-Fi\Launcher.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Siber Systems\AI RoboForm\Identities.exe
C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Windows\system32\prevhost.exe
C:\Users\Moksha\Documents\[A-L.C.W-]\[L.C.WEB]\A-PROGRAMMI SOFWER-L.C.W\HIJACK THIS\HJT-Eseguibile-30-9-18\HijackThis.exe
C:\Windows\system32\mspaint.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: RoboForm BHO - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.8.0_144\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre1.8.0_144\bin\jp2ssv.dll
O3 - Toolbar: &RoboForm Toolbar - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [AmIcoSinglun] C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
O4 - HKLM\..\Run: [VodafoneMobileWiFi] C:\Program Files\Vodafone\Vodafone Mobile Wi-Fi\Launcher.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Common Files\Java\Java Update\jusched.exe
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [CCleaner Smart Cleaning] "C:\Program Files\CCleaner\CCleaner.exe" /MONITOR
O4 - HKUS\S-1-5-18\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" (User 'Default user')
O8 - Extra context menu item: Compila Modulo - file://C:/Program Files/Siber Systems/AI RoboForm/RoboFormComFillForms.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Personalizza - file://C:/Program Files/Siber Systems/AI RoboForm/RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: RF Barra strumenti - file://C:/Program Files/Siber Systems/AI RoboForm/RoboFormComShowToolbar.html
O8 - Extra context menu item: Salva Moduli - file://C:/Program Files/Siber Systems/AI RoboForm/RoboFormComSavePass.html
O9 - Extra button: Compila - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O9 - Extra 'Tools' menuitem: Compila Modulo - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O9 - Extra button: Salva - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O9 - Extra 'Tools' menuitem: Salva Moduli - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O9 - Extra button: Mostra Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O9 - Extra 'Tools' menuitem: RF Barra strumenti - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Servizio Kaspersky Anti-Virus 19.0.0 (AVP19.0.0) - AO Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 19.0.0\avp.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: HWDeviceService.exe - Unknown owner - C:\ProgramData\DatacardService\HWDeviceService.exe
O23 - Service: Kaspersky Secure Connection Service 2.0.0 (KSDE2.0.0) - AO Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Secure Connection 2.0\ksde.exe
O23 - Service: Malwarebytes Service (MBAMService) - Malwarebytes - C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: UI Assistant Service - Unknown owner - C:\Program Files\Vodafone K4201 I\AssistantServices.exe

--
End of file - 6653 bytes