C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\LogonUI.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\userinit.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\runonce.exe

--------------- [ Infected files / folders ] ----------------


»»»» Supression files in C:


»»»» Supression files in C:\Windows


»»»» Supression files in C:\Windows\Prefetch

Deleted ! - C:\Windows\prefetch\1037874.EXE-2FD0B1DD.pf
Deleted ! - C:\Windows\prefetch\1043397.EXE-2C8EF70E.pf
Deleted ! - C:\Windows\prefetch\1156716.EXE-3F02803E.pf
Deleted ! - C:\Windows\prefetch\1280456.EXE-C2335451.pf
Deleted ! - C:\Windows\prefetch\140634.EXE-A8223559.pf
Deleted ! - C:\Windows\prefetch\149674769.EXE-032B1810.pf
Deleted ! - C:\Windows\prefetch\149693317.EXE-B572EF5E.pf
Deleted ! - C:\Windows\prefetch\149720898.EXE-5CA4CBBE.pf
Deleted ! - C:\Windows\prefetch\149814920.EXE-98F2CEB5.pf
Deleted ! - C:\Windows\prefetch\187372.EXE-D068BC33.pf
Deleted ! - C:\Windows\prefetch\440484.EXE-7773BEF7.pf
Deleted ! - C:\Windows\prefetch\512541.EXE-41BCF471.pf
Deleted ! - C:\Windows\prefetch\561681.EXE-B6EFE2A6.pf
Deleted ! - C:\Windows\prefetch\597764.EXE-3524882D.pf
Deleted ! - C:\Windows\prefetch\895991.EXE-564497BC.pf
Deleted ! - C:\Windows\prefetch\FLEC006.EXE-54A3A211.pf
Deleted ! - C:\Windows\prefetch\MDELK.EXE-74B0283C.pf
Deleted ! - C:\Windows\prefetch\WINTEMS.EXE-9889BB0E.pf

»»»» Supression files in C:\Windows\system32

Deleted ! - C:\Windows\system32\mdelk.exe
Deleted ! - C:\Windows\system32\wintems.exe
Deleted ! - C:\Windows\system32\ban_list.txt

»»»» Supression files in C:\Windows\system32\drivers

Deleted ! - C:\Windows\system32\drivers\srosa.sys
Deleted ! - C:\Windows\system32\drivers\srosa2.sys
Deleted ! - C:\Windows\system32\drivers\down\149720898.exe
Deleted ! - "C:\Windows\system32\drivers\down"

»»»» Supression files in C:\Users\stefano\AppData\Roaming

Deleted ! - "C:\Users\stefano\AppData\Roaming\m\flec006.exe"
Deleted ! - "C:\Users\stefano\AppData\Roaming\m\list.oct"
Deleted ! - "C:\Users\stefano\AppData\Roaming\m\data.oct"
Deleted ! - "C:\Users\stefano\AppData\Roaming\m\srvlist.oct"
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\3D_Tropical_Sunsets_1.0_Cracked.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\9Rays.Net TreeView for ASP.NET 3.6 Key.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Abexo_Free_Registry_Cleaner_1.0_Crack.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Acronis_True_Image_Server_for_Windows_9.1_build_3920_(With_Crack).zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\ActMask Document Converter Pro 4.12.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Adriana_Lima_11_Screensaver_1.0.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\AlgeFactors 3.0.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Analysis_Lotto_2.1.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\ArtBorders 1.3.3.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Ashkon Translation Pad 1.95.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Atomic_Mail_Verifier_5.05.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\AutoCaption Text 1.0.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Avast!.Professional.Edition.v4.6.744.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\AVS Ringtone Maker 1.5.1.20.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Bash_HTML_Editor_4.3.2_[Crack].zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Bill_of_Materials_1.0_Key+Serial.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\BoxesHelper_1.0.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\BSP SkinMaker 1.07.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Bubbles_-_Minimizing_the_Web_1.14.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Call_Display_Screensaver_1.05.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Catch a falling star Screensaver 1.0.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Ccy Wallpaper Changer 2.1.4.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Celtic Blue Knots Screensaver 1.0.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Chameleon_Button_2.1.5_[KeyGen].zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Convert PDF to Image 2.35.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\CPT-Generator_1.0a.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Cucusoft_iPod_Video_Converter_+_DVD_to_iPod_Suite_6.2.5.16_KeyGen.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\CurlyCue.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\DataForms.Net_2.0.2.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Db4o_for_.NET_4.5.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\DbaMgr_0.65.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\DC Painter Pro 1.05.1224.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Desktop-3D_Notes_3.0.4.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\DH Alligator 1.6 Beta.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\DiscJuggler_6.00.1400.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Dustbin 1.433.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\DVD To AVI Converter 1.00.2.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Easy_Chat_Server_2.2_Crack.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Easy_Icon_Maker_5.0_(With_Crack).zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Echive_Lease_Planner_2.1.57.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\eDice 1.0.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\edrsct_ehudqav127s10_toolbar_for_IE_4.5.127.0.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\EmailExtractor_6.3.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Encrypt Notes 2006 build 1026.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\eRSS Reader.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\eText typeSmart OSX 3.3.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Eyework_0.1b.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\EZ Backup Access Basic 6.14.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\EZ_World_1.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\F-Prot.Antivirus.For.Windows.3.16F.Incl.Patch.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\File_Scavenger_3.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\FirstStop_WebSearch_Visual_Edition_4.21_Patch.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\FlexibleSoft Quick Backup 1.3.150.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Front_Office_Football_The_College_Years_demo.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\FullSWITCH 06.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Genie_Backup_Manager_Home_7.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Grand Theft Auto IV Screensaver 1.1.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Hetman Photo Recovery 2.1.6.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\HidesFiles 1.3.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\iBack - iPod Backup Tool 1.3.3.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Ice Clock 3D Screensaver 1.1.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\ImTOO_DVD_to_PSP_Converter_4.0.82.0713.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\InqScribe_2.0.1.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Internet_Translator_3.1.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\IranZilla 0.1.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Kaspersky.clǸs.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Kernel_IncrediMail_Address_Book_Recovery_4.02.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Keyboard_Monitor_3.0_[Patch].zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Keygen.Crack.Panda.Platinum.Y.Titanium.Antivirus.2006 Serial.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\LeoGuard 1.0.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\LGPS Time 1.0.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\localTrezor_1.0.7.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Logic_Express_Update_7.1.1.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Maei-Beads Screensaver 1.0.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Math_Homework_Maker_1.0.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Miami_Toolbar_1.0.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Microcafe_Concept_1.0.1648.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\MR_Tech_Local_Install_5.0.4.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\MTH My Money 2.0.43.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\MultiFill Plug-In for Adobe Photoshop 1.1.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\musikCube beta 1.0.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\NetSpy_1.0.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\NetSupport_DNA_2.5.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\NetTrooper 1.0.37.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\NetXtremeMailPro Suite 2008.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Online meter XP Server Edition XP 2.1.1.2.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Original Calendar 1.0.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Outliner 0.7.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Passware_Kit_8.0.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Password Depot 3.2.2.0.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Patrician_The_Birth_of_Rome_(Medieval_Total_War)_1.2.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\PEERNET File Conversion Center 4.0.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Personal_Finance_Manager_2.2.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Ping-Probe 1.2.0.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Point_Cloud_for_Rhino_1.0.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Popup_Killer_Agent_6.4.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\PowerSync_WS_5.0.0.171_[Key].zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\PrintFolder_Pro_3.3.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Pro-Test 1.0.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Process_Guard_3.410_[Key].zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Radiant Clock Screensaver 2.3.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\ReaThumbnails - Thumbnail Gallery Creator 1.0.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\REST - Real Estate Success Tracker 3.7 Rev. B.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\RLT_Family_Budget_1.1_[Key].zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Rock_Art_Screensaver_1.0_[With_Crack].zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\RSS News Popup 0.0.1.3.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Secure Email Address Book 1.0.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Space_Beach_1.0.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\SQL_Delta_3.1_buld_7.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\SteinN Pro 1.2.1.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Stellar Phoenix - Data Recovery Software 9.1.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Story Master Pro 2.1.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\The Fly98 2.7.0.673.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Tinysoar Audio Converter 1.6.2.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Total PDF Printer 1.0.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Uconeer_2.4.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Unreal_Tournament_2003_-_Trite_1.1_skin.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\USAsoft DVD to iPod, PSP, Cell Phone, Pocket PC, MP4 Platinum 5.1.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Vehicle_Manager_2006_1.0.2618.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Visitation Manager 3.0.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Vocabox_1.6.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\WinDay_2.5.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\WinProxy Secure Suite 6.1 (With Crack).zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\WinSesasons_3.0_[Serial].zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Word Error Repair 1.0.zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\Zero-X_BeatQuantizer_1.52_[Key+Serial].zip
Deleted ! - C:\Users\stefano\AppData\Roaming\m\shared\zeta producer Desktop 8.1.0.10.zip
Deleted ! - "C:\Users\stefano\AppData\Roaming\m\shared"
Deleted ! - "C:\Users\stefano\AppData\Roaming\m"

»»»» Supression files in C:\Users\stefano\AppData\Local\Temp


»»»» Supression files in C:\Users\stefano\Local Settings\Temporary Internet Files\Content.IE5

Deleted ! - C:\Users\stefano\AppData\Local\Microsoft\Media Player\Cache copertina\LocalMLS\{BB64F149-FC72-45D3-8D2F-9631E3171DF5}.jpg

--------------- [ Registry / Infected keys ] ----------------

Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S

--------------- [ States / Restarting of services ] ----------------



+- Services : [ Auto=2 / Request=3 / Disable=4 ]

Ndisuio - Type of startup = 3

EapHost - Type of startup = 2

Wlansvc - Type of startup = 2

SharedAccess - Type of startup = 2

wuauserv - Type of startup = 2

wscsvc - Type of startup = 2

WinDefend - Type of startup = 2


--------------- [ Cleaning removable drives ] ----------------

+- Informations :

C: - Unit… fissa
D: - Unit… fissa

+- deleting files :


--------------- [ Registry / Mountpoint2 ] ----------------


-> Not found !


--------------- [ Searching Cracks / Keygen ] ----------------

C:\Users\stefano\Downloads\eMule\Incoming\ITALIANE\Elio e le Storie Tese - Discografia\[TNT Village] Elio e le Storie Tese - Discografia 192 kbps\Craccracriccrecr\01 Craccracriccracker.mp3


---------------- ! End of report ! ------------------

qusto e il primo log di elibag
<?xml version="1.0" encoding="utf-8" ?>
- <unattend xmlns="urn:schemas-microsoft-com:unattend">
- <settings pass="specialize">
- <component name="Microsoft-Windows-Deployment" processorArchitecture="x86" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
- <RunSynchronous>
- <RunSynchronousCommand wcm:action="add">
- <Credentials>
<Username>administrator</Username>
</Credentials>
<Order>1</Order>
<Description>Welcome</Description>
<Path>c:\sources\oem\generalize\rdtest.bat</Path>
</RunSynchronousCommand>
</RunSynchronous>
</component>
</settings>
- <settings pass="oobeSystem">
- <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="x86" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
- <OEMInformation>
<Manufacturer>Olidata S.p.A.</Manufacturer>
<Model>Microsoft Windows Vista</Model>
<SupportURL>http:\\www.olidata.com\supporto</SupportURL>
<SupportHours>Lunedì-Venerdì 9:00-13:00 e 14:30-18:30</SupportHours>
<SupportPhone>In Italia, Chiamare il Numero 0547-419106</SupportPhone>
</OEMInformation>
</component>
</settings>
<cpi:offlineImage cpi:source="wim:c:/sources/basic/install.wim#Windows Vista HOMEPREMIUM" xmlns:cpi="urn:schemas-microsoft-com:cpi" />
</unattend>

no su c non lo trovo

niente su cerca per InfoSat.txt
malwareb. e in esecuzione
l'antivirus lo devo reinstallare?

ti chiedo scusa ma devo andar via per qualche giorno ti spiace se continuiamo verso fine settimana?
grazie