Logfile of HijackThis v1.99.0
Scan saved at 20.20.30, on 26/01/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
D:\AVAST\aswUpdSv.exe
D:\AVAST\ashServ.exe
C:\WINDOWS\System32\carpserv.exe
C:\Programmi\Apoint2K\Apoint.exe
C:\PROGRA~1\LAUNCH~1\QtaET2S.EXE
C:\WINDOWS\System32\cbpopw.exe
C:\WINDOWS\System32\win32d3u.exe
D:\DAP7\DAP\DAP.EXE
D:\AVAST\ashDisp.exe
C:\Programmi\Java\j2re1.4.2_02\bin\jusched.exe
D:\CLONE CD 5.0.4.5\CloneCD\CloneCDTray.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmi\Apoint2K\Apntex.exe
D:\BLUETOOTH\BTTray.exe
C:\PROGRA~1\INCRED~1\bin\IMAPP.EXE
D:\BLUETOOTH\BTStackServer.exe
D:\NORTON SYSTEMWORKS\Norton Utilities\NPROTECT.EXE
D:\NORTON~2\SPEEDD~1\nopdb.exe
D:\AVAST\ashMaiSv.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\CHINA65\Impostazioni locali\Temp\HijackThis.exe
C:\Programmi\Microsoft Office\Office10\WINWORD.EXE
C:\WINDOWS\msagent\AgentSvr.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.libero.it
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fornito da Libero
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - D:\DAP7\DAP\DAPBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - D:\DAP7\DAP\DAPIEBar.dll
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [Apoint] C:\Programmi\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtaET2S.EXE
O4 - HKLM\..\Run: [CallBumping] cbpopw.exe
O4 - HKLM\..\Run: [WSC-pm8u] win32d3u.exe
O4 - HKLM\..\Run: [ImInstaller_IncrediMail] C:\DOCUME~1\CHINA65\IMPOST~1\Temp\ImInstaller\IncrediMail\imloader.exe -startup -product IncrediMail
O4 - HKLM\..\Run: [DownloadAccelerator] D:\DAP7\DAP\DAP.EXE /STARTUP
O4 - HKLM\..\Run: [avast!] D:\AVAST\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\j2re1.4.2_02\bin\jusched.exe
O4 - HKLM\..\Run: [CloneCDTray] "D:\CLONE CD 5.0.4.5\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [ICQ Lite] C:\Programmi\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\RunServices: [WSC-pm8u] win32d3u.exe
O4 - HKLM\..\RunOnce: [tlc] C:\WINDOWS\update13.js
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [IncrediMail] C:\Programmi\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programmi\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &Download with &DAP - D:\DAP7\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - D:\DAP7\DAP\dapextie2.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\j2re1.4.2_02\bin\npjpi142_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\j2re1.4.2_02\bin\npjpi142_02.dll
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - D:\DAP7\DAP\DAP.EXE
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programmi\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programmi\ICQLite\ICQLite.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O14 - IERESET.INF: START_PAGE_URL=http://www.libero.it
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IncrediMail) - http://www2.incredimail.com/contents/setup/downloader_sp1/imloader.cab
O23 - Service: avast! iAVS4 Control Service - Unknown - D:\AVAST\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown - D:\AVAST\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - D:\AVAST\ashMaiSv.exe
O23 - Service: Norton Unerase Protection - Symantec Corporation - D:\NORTON SYSTEMWORKS\Norton Utilities\NPROTECT.EXE
O23 - Service: Speed Disk service - Symantec Corporation - D:\NORTON~2\SPEEDD~1\nopdb.exe

Ciao ,
esegui queste operazioni

1) Disattiva il ripristino di configurazione, leggi qui come fare
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=257&SH=N

2) riavvia in modalità provvisoria, leggi qui come fare
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=344&SH=N

apri HIJAC THIS ed elimina come indicato in questo articolo
http://www.aiutamici.com/software/descrizione.asp?CodSw=1175
le righe che seguono, (nel caso le righe da eliminare non compaiono in modalità provvisoria, eliminale dalla modalità normale e riavvia il computer).

==================================
O4 - HKLM\..\Run: [CallBumping] cbpopw.exe
O4 - HKLM\..\Run: [WSC-pm8u] win32d3u.exe
-
O4 - HKLM\..\RunServices: [WSC-pm8u] win32d3u.exe
O4 - HKLM\..\RunOnce: [tlc] C:\WINDOWS\update13.js
==================================

Con la funzione TROVA di Windows, cerca ed elimina questi file,

==================================
cbpopw.exe
win32d3u.exe
update13.js
==================================

al termine utilizza i programma AD-AWARE e SPYBOT indicati in questo articolo
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=388&SH=N

sempre in modalità provvisoria fai una scansione Antivirus

quindi riavvia il computer e controlla se il problema e risolto, se e tutto OK riattiva il ripristino configurazione disattivato all'inizio di questa procedura.

Ti consiglio di disainstallare DAP - Download Accelerator in quanto contiene adware, puoi sostituirlo con Download Express
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=930

---

Collaboratore Aiutamici