Faccio spesso (anche più volte a settimana) il controllo del log, e da quanto ne possa capire io dovrebbe andare tutto bene. A me pare pulito, vedi tu:

<pre id=code><font face=courier size=2 id=code>
Logfile of HijackThis v1.99.1
Scan saved at 17.57.16, on 24/09/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmi\Eset\nod32krn.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\carpserv.exe
C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programmi\CyberLink\PowerDVD\PDVDServ.exe
C:\Programmi\IPM\Adsl\DataWay\dslstat.exe
C:\WINDOWS\system32\dslagent.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\Programmi\QuickTime\qttask.exe
C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programmi\MessengerPlus! 3\MsgPlus.exe
C:\Programmi\Eset\nod32kui.exe
C:\Programmi\DAP\DAP.EXE
C:\Programmi\Java\jre1.5.0_04\bin\jusched.exe
C:\Programmi\Cobian Backup 7\CobBU.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\WinZip\WZQKPICK.EXE
C:\Programmi\Digisoft AntiDialer\AntiDialer.exe
C:\Programmi\Cobian Backup 7\cobui.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Documents and Settings\Domenico\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.it/0SEITIT/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.it/0SEITIT/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.it/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.it/0SEITIT/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fornito da Alice
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar2.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programmi\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar2.dll
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [RemoteControl] C:\Programmi\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Programmi\IPM\Adsl\DataWay\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [REGSHAVE] C:\Programmi\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
O4 - HKLM\..\Run: [BDOESRV] C:\Programmi\Softwin\BitDefender8\\bdoesrv.exe
O4 - HKLM\..\Run: [BDNewsAgent] C:\Programmi\Softwin\BitDefender8\bdnagent.exe
O4 - HKLM\..\Run: [BDSwitchAgent] C:\Programmi\Softwin\BitDefender8\\bdswitch.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programmi\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Programmi\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Programmi\DAP\DAP.EXE" /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [SpeedOptimizer] C:\PROGRA~1\SPEEDO~1\SPO.EXE -s
O4 - HKLM\..\Run: [Cobian Backup 7] "C:\Programmi\Cobian Backup 7\CobBU.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Shareaza] "C:\Programmi\Shareaza\Shareaza.exe" -tray
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Programmi\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programmi\WinZip\WZQKPICK.EXE
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digisoft AntiDialer.lnk = C:\Programmi\Digisoft AntiDialer\AntiDialer.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programmi\file comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: RealGuide - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Programmi\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1127573973817
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B402DBB3-BBBB-45FB-B131-788AEDFBA735}: NameServer = 85.37.17.50 151.99.125.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: MySQL - Unknown owner - C:\WM\MySQL-4.0.22\bin\mysqld-nt.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmi\Eset\nod32krn.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe
</font id=code></pre id=code>



La riga 017, compare quando mi connetto ad internet e poi scompare e se la elimino ritorna sempre!!!

Ok, ma tornando al motivo per cui ho aperto la discussione?? :o(

Buongiorno.
Alfonso sto facendo come mi hai detto. E' in esecuzione la scansione on-line, con RegSeeker ho eliminato oltre 1890 chiavi. Intanto ho utilizzato anche EtRemover, ecco il rapporto della sua scansione... che si può dedurre?

Registry Log file generated by *** ETRemover - V.2.0.1 ***
25/09/2005 - 10.59.04

System info:

OS Platform: Microsoft Windows 2000
OS Version: 5.01.2600
OS Update: Service Pack 2
CPU Maker: AuthenticAMD
CPU Model: x86 Family 6 Model 10 Stepping 0
CPU Speed: 1855 MHz


Running processes:

[system process] [SYSTEM]
system [SYSTEM]
smss.exe [\SystemRoot\System32\smss.exe]
csrss.exe [SYSTEM]
winlogon.exe [\??\C:\WINDOWS\system32\winlogon.exe]
services.exe [C:\WINDOWS\system32\services.exe]
lsass.exe [C:\WINDOWS\system32\lsass.exe]
svchost.exe [C:\WINDOWS\system32\svchost.exe]
svchost.exe [SYSTEM]
svchost.exe [C:\WINDOWS\System32\svchost.exe]
svchost.exe [SYSTEM]
svchost.exe [SYSTEM]
spoolsv.exe [C:\WINDOWS\system32\spoolsv.exe]
mdm.exe [C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE]
nod32krn.exe [C:\Programmi\Eset\nod32krn.exe]
vsmon.exe [C:\WINDOWS\system32\ZONELABS\vsmon.exe]
alg.exe [SYSTEM]
explorer.exe [C:\WINDOWS\Explorer.EXE]
carpserv.exe [C:\WINDOWS\system32\carpserv.exe]
atiptaxx.exe [C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe]
pdvdserv.exe [C:\Programmi\CyberLink\PowerDVD\PDVDServ.exe]
dslstat.exe [C:\Programmi\IPM\Adsl\DataWay\dslstat.exe]
dslagent.exe [C:\WINDOWS\system32\dslagent.exe]
qttask.exe [C:\Programmi\QuickTime\qttask.exe]
zlclient.exe [C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe]
msgplus.exe [C:\Programmi\MessengerPlus! 3\MsgPlus.exe]
nod32kui.exe [C:\Programmi\Eset\nod32kui.exe]
jusched.exe [C:\Programmi\Java\jre1.5.0_04\bin\jusched.exe]
cobbu.exe [C:\Programmi\Cobian Backup 7\CobBU.exe]
ctfmon.exe [C:\WINDOWS\system32\ctfmon.exe]
wzqkpick.exe [C:\Programmi\WinZip\WZQKPICK.EXE]
antidialer.exe [C:\Programmi\Digisoft AntiDialer\AntiDialer.exe]
cobui.exe [C:\Programmi\Cobian Backup 7\cobui.exe]
iexplore.exe [C:\Programmi\Internet Explorer\iexplore.exe]
etremover_v201.exe [C:\APPLICAZIONI\EtRemover\ETRemover_v201.exe]

---

HKLM -> UserInit in NT:


DWORD: AutoRestartShell = 1

DefaultDomainName = DOMENICO_PC

DefaultUserName = Domy

LegalNoticeCaption =

LegalNoticeText =

PowerdownAfterShutdown = 0

ReportBootOk = 1

Shell = Explorer.exe

ShutdownWithoutLogon = 0

System =

Userinit = C:\WINDOWS\system32\userinit.exe,

VmApplet = rundll32 shell32,Control_RunDLL "sysdm.cpl"

DWORD: SfcQuota = -1

allocatecdroms = 0

allocatedasd = 0

allocatefloppies = 0

cachedlogonscount = 10

DWORD: forceunlocklogon = 0

DWORD: passwordexpirywarning = 14

scremoveoption = 0

DWORD: AllowMultipleTSSessions = 1

DWORD: LogonType = 1

Background = 0 0 0

DebugServerCommand = no

DWORD: SFCDisable = 0

WinStationsDisabled = 0

DWORD: HibernationPreviouslyEnabled = 1

DWORD: ShowLogonOptions = 0

AltDefaultUserName = Domy

AltDefaultDomainName = DOMENICO_PC

DWORD: SfcScan = 0

AutoAdminLogon = 0

---

HKCU -> UserInit in NT:


ParseAutoexec = 1

ExcludeProfileDirs = Impostazioni locali;Temporary Internet Files;Cronologia;Temp;Impostazioni locali\Dati applicazioni\Microsoft\Outlook

DWORD: BuildNumber = 2600

---

HKLM -> UserInit:

* Registry key not found *

---

HKCU -> UserInit in NT:

* Registry key not found *

---

Running processes in NT / HKLM -> RUN (Autorun entries from Registry):

* Registry key not found *

---

Running processes in HKLM -> RUN (Autorun entries from Registry):


PCTVOICE = pctspk.exe

CARPService = carpserv.exe

SynTPLpr = C:\Programmi\Synaptics\SynTP\SynTPLpr.exe

SynTPEnh = C:\Programmi\Synaptics\SynTP\SynTPEnh.exe

ATIModeChange = Ati2mdxx.exe

ATIPTA = C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe

RemoteControl = C:\Programmi\CyberLink\PowerDVD\PDVDServ.exe

NeroFilterCheck = C:\WINDOWS\system32\NeroCheck.exe

DSLSTATEXE = C:\Programmi\IPM\Adsl\DataWay\dslstat.exe icon

DSLAGENTEXE = dslagent.exe USB

TkBellExe = "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot

QuickTime Task = "C:\Programmi\QuickTime\qttask.exe" -atboottime

Zone Labs Client = C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe

MessengerPlus3 = "C:\Programmi\MessengerPlus! 3\MsgPlus.exe"

nod32kui = "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE

Easy-PrintToolBox = C:\Programmi\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon

SunJavaUpdateSched = C:\Programmi\Java\jre1.5.0_04\bin\jusched.exe

Cobian Backup 7 = "C:\Programmi\Cobian Backup 7\CobBU.exe"

---

Running processes in HKLM -> RUNONCE (Autorun entries from Registry):

* No values found *

---

Running processes in HKLM -> RUNONCEEX (Autorun entries from Registry):

* No values found *

---

Running processes in HKLM -> RUNSERVICES (Autorun entries from Registry):

* Registry key not found *

---

Running processes in HKLM -> RUNSERVICESONCE (Autorun entries from Registry):

* Registry key not found *

---

Running processes in NT / HKCU -> RUN (Autorun entries from Registry):

* Registry key not found *

---

Running processes in HKCU -> RUN (Autorun entries from Registry):


CTFMON.EXE = C:\WINDOWS\system32\ctfmon.exe

---

Running processes in HKCU -> RUNONCE (Autorun entries from Registry):

* Registry key not found *

---

Running processes in HKCU -> RUNONCEEX (Autorun entries from Registry):

* Registry key not found *

---

Running processes in HKCU -> RUNSERVICES (Autorun entries from Registry):

* Registry key not found *

---

Running processes in HKCU -> RUNSERVICESONCE (Autorun entries from Registry):

* Registry key not found *

---

Running processes in HKLM -> Browser Helper Objects:

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
* No values in SubKey *

{53707962-6F74-2D53-2644-206D7942484F}
* No values in SubKey *

{AA58ED58-01DD-4d91-8333-CF10577473F7}
* No values in SubKey *

---

Programs in HKLM -> Common Startup:

WinZip Quick Pick.lnk
Avvio veloce di Adobe Reader.lnk
Digisoft AntiDialer.lnk
Adobe Gamma Loader.lnk

------------------------------------------

Come dicevo prima, è in corso ancora... è arrivato a 53900 (e oltre) files e ancora non ha trovato nulla, però non è ancora completata.

Dal rapporto di EtRemover si deduce qualcosa che non va?

Non ci vedo nulla di strano, ma se si trata di virus non si può risolvere con quel programma.

---

Collaboratore Aiutamici

Be se utilizzi la ADSL non devi preoccuparti, probabilmente si tratta di qualche impostazione di dialer nel sistema che e rimasto li, risolveresti sicuramente con una formattazione, ma se non hai altri problemi puoi continuare anche senza formattare.

---

Collaboratore Aiutamici