Disattiva il ripristino configurazione di sistema, e tienilo disattivato, fino alla soluzione del problema http://guide.aiutamici.com/guide?C1=7&C2=68&ID=80121

Avvia hijackthis, metti la spunta alle voci che andrò ad elencarti e con tutte le applicazioni chiuse e disconnesso da Internet,premi su fix checked

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Programmi\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [WINREMOTE] C:\Programmi\InterVideo\Common\Bin\WinRemote.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Programmi\Trust\MI-4550XP WIRELESS OPTICAL MINI MOUSE\Mouse32a.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Programmi\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [P2kAutostart] C:\DOCUME~1\Maurizia\IMPOST~1\Temp\ZIPPHO3TEMP\P2kCommander-V3.3.0-[Italian Version] by flash.tato\P2kAutostart.exe
O4 - HKCU\..\Run: [Rainlendar2] C:\Programmi\Rainlendar2\Rainlendar2.exe
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmi\Windows Live\Messenger\msnmsgr.exe" /background
O4 - Startup: Collegamento a BTTray.exe.lnk = C:\Programmi\Sitecom\Software Bluetooth\BTTray.exe
O4 - Startup: Outlook Express.lnk = C:\Programmi\Outlook Express\msimn.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://212.162.68.228/rainet02/Rawflow.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://www.inforiviera.it/new_webcam/AxisCamControl.ocx
O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {FA81E151-CFE7-4B18-8B9E-8B96E62BAC11} (DownloadManager) - https://it.web.sonynetservices.com/web/applets/DownloadManager.cab

Vai in "Installazione Applicazioni" e Rimuovi tutte versioni Java che trovi.

Dai una pulita (registro compreso)con CCleaner http://www.aiutaamici.com/software?ID=11223
Nella schermata iniziale di CCleaner, clicca su Opzioni e poi Avanzate, togli il segno di spunta a: Cancella i file in Windows Temp solo se più vecchi di 48 ore. (poi esegui le pulizie)

Riavvia il pc.

Scarica ed installa MalwareBytes:
clicca qui per il download : http://www.aiutamici.com/software?id=80346
Prima di fare la scansione AGGIORNALO. (è molto importante)
Esegui una scansione completa del sistema.
Posta il log.

Installa l'ultima versione del Java:

http://www.aiutamici.com/software?ID=11134

Poi:
Start\Esegui\copia e incolla la stringa %temp% clicca su Ok, svuota la cartella temp. (non eliminare la cartella)
Poi:
Provvedi a svuotare del suo contenuto la cartella Prefetch :
clicca su Risorse del Computer
clicca su Disco locale C:
cerca, all’interno delle cartelle che saranno visualizzate la cartella Windows, aprila ed, al suo interno, cerca la cartella Prefetch, la apri ed elimina tutte le voci conservate al suo interno ( non eliminare la cartella)
SVUOTA IL CESTINO
Poi:
Lancia Hijackthis e pulisci gli ADS in questo modo:
clicca sulla voce Open the misc tool section
clicca su Open ads spy
togli la spunta alla voce Quick scan (windows base folder only)
clicca su Scan.
Aspetta pazientemente la fine della scansione.
se venissero rilevati ADS, spunta tutte (senza paura) le caselline e clicca su Remove selected

Fai uno ScanDisk approfondito, e una deframmentazione del HD.

Riattiva il ripristino configurazione di sistema e, se tutto è a posto, creane uno nuovo.

Io di sicuro, non voglio metterti fretta.
Anzi, vai piano, ma esegui tutte le indicazioni.

Bene.
Se hai eseguito tutte le altre operazioni, e il pc, non presenta problemi, direi che sei a posto.

Ho fatto tutto quello che mi è stato detto.

Mi rimane però sempre il problema della lentezza. Per aprire le pagine di internet o anche solo i programmi ci mette una vita.
Dovrò verificare il problema!!

Grazie mille per l'aiuto, quando si legge infezione nel pc, prende veramente il panico!!

Posto il log.
io ho disabilitato avg facendo esci dalla barra in fondo ma mi sembra di capire che è rimasto attivo.
Spero di non avere fatto un casino!


ComboFix 09-10-08.04 - X 10/10/2009 18.17.54.1.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.39.1040.18.1534.728 [GMT 2:00]
Eseguito da: c:\documents and settings\X\Desktop\Foto da sviluppare\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}

ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Installer\182934.msi
c:\windows\Installer\303e76.msp
c:\windows\Installer\511df96.msi
c:\windows\Installer\c0e07.msi
c:\windows\Installer\ceb98a.msp
c:\windows\Installer\ceb991.msp
D:\Autorun.inf

.
((((((((((((((((((((((((( Files Creati Da 2009-09-10 al 2009-10-10 )))))))))))))))))))))))))))))))))))
.

2009-10-09 19:53 . 2009-10-09 19:53 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-10-09 04:57 . 2009-10-09 04:57 -------- d-----w- c:\programmi\TeaTimer (Spybot - Search & Destroy)
2009-10-09 04:57 . 2009-10-09 04:57 -------- d-----w- c:\programmi\Misc. Support Library (Spybot - Search & Destroy)
2009-10-09 04:57 . 2009-10-09 04:57 -------- d-----w- c:\programmi\File Scanner Library (Spybot - Search & Destroy)
2009-10-09 04:35 . 2009-10-09 04:35 -------- d-----w- c:\documents and settings\X\Dati applicazioni\Malwarebytes
2009-10-09 04:35 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-09 04:35 . 2009-10-09 04:35 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Malwarebytes
2009-10-09 04:35 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-08 12:43 . 2009-09-23 06:07 59664 ----a-w- c:\windows\system32\drivers\TfSysMon.sys
2009-10-08 12:43 . 2009-09-23 06:07 51984 ----a-w- c:\windows\system32\drivers\TfFsMon.sys
2009-10-08 12:43 . 2009-09-23 06:07 33552 ----a-w- c:\windows\system32\drivers\TfNetMon.sys
2009-10-08 12:43 . 2009-10-08 12:44 -------- d-----w- c:\programmi\ThreatFire
2009-10-08 12:43 . 2009-10-08 12:43 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\PC Tools
2009-10-07 15:15 . 2008-06-19 15:24 28544 ----a-w- c:\windows\system32\drivers\pavboot.sys
2009-10-03 05:19 . 2009-10-01 08:29 195440 ------w- c:\windows\system32\MpSigStub.exe
2009-09-19 12:01 . 2009-09-19 12:01 -------- d-----w- c:\documents and settings\X\Impostazioni locali\Dati applicazioni\Downloaded Installations
2009-09-16 17:41 . 2009-10-09 12:04 -------- d-----w- c:\documents and settings\X\Tracing
2009-09-16 17:17 . 2009-09-18 10:13 -------- d-----w- c:\programmi\Microsoft Silverlight
2009-09-16 17:17 . 2009-08-05 20:48 54752 ----a-w- c:\windows\system32\drivers\fssfltr_tdi.sys
2009-09-16 17:16 . 2009-09-16 17:16 -------- d-----w- c:\programmi\Microsoft Sync Framework
2009-09-16 17:15 . 2006-11-29 11:06 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll
2009-09-16 17:15 . 2009-09-16 17:15 -------- d-----w- c:\programmi\Microsoft SQL Server Compact Edition
2009-09-16 17:13 . 2009-09-16 17:13 -------- d-----w- c:\programmi\Windows Live SkyDrive
2009-09-10 16:49 . 2009-09-12 06:35 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\NOS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-10 15:13 . 2009-02-15 13:19 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Google Updater
2009-10-10 06:50 . 2004-08-30 11:20 64848 ----a-w- c:\windows\system32\perfc010.dat
2009-10-10 06:50 . 2004-08-30 11:20 3388 ----a-w- c:\windows\system32\perfh010.dat
2009-10-09 19:52 . 2006-04-20 20:17 -------- d-----w- c:\programmi\Java
2009-10-09 16:48 . 2006-08-20 08:53 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Spybot - Search & Destroy
2009-10-09 16:36 . 2006-04-20 20:11 -------- d--h--w- c:\programmi\InstallShield Installation Information
2009-10-08 13:59 . 2006-08-18 12:13 -------- d-----w- c:\documents and settings\X\Dati applicazioni\Lavasoft
2009-10-08 13:02 . 2009-08-01 11:19 -------- d-----w- c:\programmi\Alice MOBILE E1692
2009-09-22 14:52 . 2009-08-03 16:50 62999 ----a-w- c:\documents and settings\X\Dati applicazioni\mdbu.bin
2009-09-21 04:24 . 2008-02-25 15:58 60 -c--a-w- c:\windows\wpd99.drv
2009-09-21 04:24 . 2008-02-25 15:58 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\pdf995
2009-09-16 17:40 . 2007-04-09 10:48 87520 ----a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
2009-09-16 17:17 . 2007-03-03 06:20 -------- d-----w- c:\programmi\Microsoft
2009-09-16 17:17 . 2008-08-28 17:29 -------- d-----w- c:\programmi\Windows Live
2009-09-16 17:14 . 2006-10-21 11:11 -------- d-----w- c:\programmi\MSN Messenger
2009-09-09 16:50 . 2009-08-25 15:09 -------- d-----w- c:\documents and settings\X\Dati applicazioni\dvdcss
2009-09-09 16:04 . 2006-08-10 10:44 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\DVD Shrink
2009-08-26 16:30 . 2009-08-26 16:30 -------- d-----w- c:\programmi\vso
2009-08-24 15:47 . 2007-04-19 12:30 -------- d-----w- c:\documents and settings\X\Dati applicazioni\vlc
2009-08-24 15:45 . 2009-08-24 15:44 -------- d-----w- c:\programmi\Kantaris
2009-08-22 13:44 . 2009-08-22 13:44 -------- d-----w- c:\documents and settings\X\Dati applicazioni\DivX
2009-08-22 13:44 . 2009-08-22 13:43 -------- d-----w- c:\programmi\DivX
2009-08-22 13:43 . 2009-08-22 13:43 -------- d-----w- c:\programmi\File comuni\DivX Shared
2009-08-19 14:51 . 2009-08-19 14:50 -------- d-----w- c:\documents and settings\X\Dati applicazioni\eMule
2009-08-19 14:51 . 2009-08-19 14:50 -------- d-----w- c:\programmi\eMule
2009-08-19 10:15 . 2008-08-30 06:14 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-08-19 10:15 . 2008-08-30 06:13 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-08-19 10:15 . 2008-08-30 06:13 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-08-06 17:24 . 2004-08-19 08:00 327896 ----a-w- c:\windows\system32\wucltui.dll
2009-08-06 17:24 . 2004-08-19 08:00 209632 ----a-w- c:\windows\system32\wuweb.dll
2009-08-06 17:24 . 2005-05-26 02:16 44768 ----a-w- c:\windows\system32\wups2.dll
2009-08-06 17:24 . 2004-08-19 08:00 35552 ----a-w- c:\windows\system32\wups.dll
2009-08-06 17:24 . 2004-08-19 08:00 53472 ----a-w- c:\windows\system32\wuauclt.exe
2009-08-06 17:24 . 2004-08-19 08:00 96480 ----a-w- c:\windows\system32\cdm.dll
2009-08-06 17:23 . 2004-08-19 08:00 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-08-06 17:23 . 2006-10-22 15:48 274288 ----a-w- c:\windows\system32\mucltui.dll
2009-08-06 17:23 . 2006-10-22 15:48 215920 ----a-w- c:\windows\system32\muweb.dll
2009-08-06 17:23 . 2004-08-19 08:00 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-08-05 08:59 . 2004-08-19 08:00 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-26 20:00 . 2007-09-19 19:23 45056 ----a-w- c:\windows\NCUNINST.EXE
2009-07-26 14:44 . 2009-07-26 14:44 48448 ----a-w- c:\windows\system32\sirenacm.dll
2009-07-17 19:01 . 2004-08-19 08:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-14 00:15 . 2009-07-14 00:15 90112 ----a-w- c:\windows\system32\dpl100.dll
2009-07-14 00:15 . 2009-07-14 00:15 823296 ----a-w- c:\windows\system32\divx_xx0c.dll
2009-07-14 00:15 . 2009-07-14 00:15 823296 ----a-w- c:\windows\system32\divx_xx07.dll
2009-07-14 00:15 . 2009-07-14 00:15 815104 ----a-w- c:\windows\system32\divx_xx0a.dll
2009-07-14 00:15 . 2009-07-14 00:15 811008 ----a-w- c:\windows\system32\divx_xx16.dll
2009-07-14 00:15 . 2009-07-14 00:15 802816 ----a-w- c:\windows\system32\divx_xx11.dll
2009-07-14 00:15 . 2009-07-14 00:15 685056 ----a-w- c:\windows\system32\DivX.dll
2009-07-13 21:43 . 2004-08-19 08:00 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2004-08-19 08:00 . 2004-08-19 08:00 94816 --sh--w- c:\windows\twain.dll
2008-04-14 02:13 . 2004-08-19 08:00 50688 --sh--w- c:\windows\twain_32.dll
2006-07-29 09:12 . 2006-07-29 09:12 22 --sha-w- c:\windows\SMINST\HPCD.sys
2008-04-14 02:13 . 2004-08-19 08:00 1028096 --sha-w- c:\windows\system32\mfc42.dll
2008-04-14 02:13 . 2004-08-19 08:00 57344 --sh--w- c:\windows\system32\msvcirt.dll
2008-04-14 02:13 . 2004-08-19 08:00 413696 --sha-w- c:\windows\system32\msvcp60.dll
2008-04-14 02:13 . 2004-08-19 08:00 343040 --sha-w- c:\windows\system32\msvcrt.dll
2008-04-14 02:13 . 2004-08-19 08:00 551936 --sha-w- c:\windows\system32\oleaut32.dll
2008-04-14 02:13 . 2004-08-19 08:00 84992 --sha-w- c:\windows\system32\olepro32.dll
2008-04-14 02:14 . 2004-08-19 08:00 12288 --sh--w- c:\windows\system32\regsvr32.exe
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\programmi\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-09-02 09:58 1107200 ----a-w- c:\programmi\AVG\AVG8\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\programmi\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\programmi\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpWirelessAssistant"="c:\programmi\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-12-13 507904]
"WinAlarm"="c:\programmi\WinAlarm\WinAlarm.exe" [2006-02-16 347648]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-10-05 2023704]
"ThreatFire"="c:\programmi\ThreatFire\TFTray.exe" [2009-09-23 382224]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-12-15 7331840]
"SunJavaUpdateSched"="c:\programmi\Java\jre6\bin\jusched.exe" [2009-10-09 149280]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\FILECO~1\MICROS~1\DW\dwtrig20.exe" [2007-02-25 437160]
"Nokia.PCSync"="c:\programmi\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 1744896]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-19 10:15 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^Avvio rapido HP Photosmart Premier.lnk]
path=c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\Avvio rapido HP Photosmart Premier.lnk
backup=c:\windows\pss\Avvio rapido HP Photosmart Premier.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"c:\\Nuovi programmi\\Internet TV\\Internet TV.exe"=
"c:\\Programmi\\ArcSoft\\VideoImpression 1.6\\videoimp.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmi\\AVG\\AVG8\\avgemc.exe"=
"c:\\Programmi\\AVG\\AVG8\\avgupd.exe"=
"c:\\Programmi\\miofotografo.it\\myComposer\\Loader.exe"=
"c:\\Programmi\\eMule\\emule.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programmi\\Windows Live\\Sync\\WindowsLiveSync.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [07/10/2009 17.15.07 28544]
R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [08/10/2009 14.43.59 51984]
R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [08/10/2009 14.43.59 59664]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [30/08/2008 8.13.56 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [30/08/2008 8.14.01 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [30/08/2008 8.13.33 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [30/08/2008 8.13.32 297752]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [16/09/2009 19.17.08 54752]
R2 ThreatFire;ThreatFire;c:\programmi\ThreatFire\TFService.exe service --> c:\programmi\ThreatFire\TFService.exe service [?]
R2 WinDefend;Windows Defender;c:\programmi\Windows Defender\MsMpEng.exe [03/11/2006 18.19.58 13592]
R3 Stmatm;ATM/ADSL miniport;c:\windows\system32\drivers\stmatm.sys [31/07/2006 14.17.11 59338]
R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [08/10/2009 14.43.59 33552]
S2 gupdate1c98f7040d79870;Servizio di Google Update (gupdate1c98f7040d79870);c:\programmi\Google\Update\GoogleUpdate.exe [15/02/2009 15.21.00 133104]
S3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\drivers\ewusbnet.sys [01/08/2009 13.19.47 112640]
S3 fsssvc;Servizio Windows Live Family Safety;c:\programmi\Windows Live\Family Safety\fsssvc.exe [05/08/2009 22.48.42 704864]
S3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\drivers\ewusbfake.sys [01/08/2009 13.19.47 102656]
S3 PAC207;Trust WB-1200p Mini Webcam;c:\windows\system32\drivers\PFC027.sys [24/02/2005 12.29.14 162176]
S3 TaurusUsb;ADSL Modem USB Service 1.09a;c:\windows\system32\drivers\torususb.sys [31/07/2006 14.17.11 527980]
.
Contenuto della cartella 'Scheduled Tasks'

2009-10-10 c:\windows\Tasks\Google Software Updater.job
- c:\programmi\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-15 18:15]

2009-10-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2009-02-15 13:20]

2009-10-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2009-02-15 13:20]

2009-10-10 c:\windows\Tasks\MP Scheduled Scan.job
- c:\programmi\Windows Defender\MpCmdRun.exe [2006-11-03 16:20]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
uInternet Connection Wizard,ShellNext = hxxp://redirect.hp.com/svs/rdr?TYPE=3&tp=ebay&pf=laptop&locale=it_it&bd=all&c=q106
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Invia a &Bluetooth - c:\programmi\Sitecom\Software Bluetooth\btsendto_ie_ctx.htm
FF - ProfilePath - c:\documents and settings\Maurizia\Dati applicazioni\Mozilla\Firefox\Profiles\espsvjxu.default\
FF - prefs.js: browser.startup.homepage - hxxp://ricerca.alice.it/index.html?f=promo
FF - plugin: c:\documents and settings\All Users\Dati applicazioni\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: c:\programmi\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
.
- - - - CHIAVI ORFANE RIMOSSE - - - -

AddRemove-Biliardo - c:\programmi\Biliardo2\Uninstall.exe
AddRemove-Cities of Earth 3D Screensaver_is1 - c:\programmi\Cities of Earth\unins000.exe
AddRemove-Download-for-Free - Free Christmas Lights ScreenSaver - c:\programmi\Christmas Lights ScreenSaver\uninstall.exe
AddRemove-DVD Decrypter - c:\programmi\DVD Decrypter\uninstall.exe
AddRemove-DVDFab Decrypter_is1 - c:\programmi\DVDFab Decrypter\unins000.exe
AddRemove-Ferrero Multimedia Lunes - c:\progra~1\Ferrero\Lunes\UNWISE.EXE
AddRemove-Gli Straspeed_is1 - c:\programmi\Ferrero\Straspeed\unins000.exe
AddRemove-Highway Pursuit_is1 - c:\documents and settings\All Users\Documenti\GIOCHI\highwaypursuit\HighwayPursuit\unins000.exe
AddRemove-HijackThis - c:\programmi\Trend Micro\HijackThis\HijackThis.exe
AddRemove-MP3 Repair Tool_is1 - c:\programmi\Aspect one\MP3 Repair Tool\unins000.exe
AddRemove-ShrinkTo5Basic - c:\programmi\ShrinkTo5Basic\uninstall.exe
AddRemove-Smile and Go_is1 - c:\programmi\Ferrero\Smile and Go\unins000.exe
AddRemove-BC07-IW-CH - c:\games\Moto Race Challenge 07 (Schweiz)\uninstall.exe
AddRemove-GP Vs Superbike - f:\documenti\GIOCHI\GP MOTO\GP Vs Superbike\uninstall.exe
AddRemove-Midnight Racing - f:\documenti\GIOCHI\MIND RACER\Midnight Racing\uninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-10 18:30
Windows 5.1.2600 Service Pack 3 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ThreatFire]
"AlternateImagePath"=""
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•9~*]
"0140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------

- - - - - - - > 'winlogon.exe'(972)
c:\programmi\ThreatFire\TFNI.dll
c:\programmi\ThreatFire\TFMon.dll
c:\programmi\ThreatFire\TFRK.dll
c:\programmi\ThreatFire\TFWAH.dll

- - - - - - - > 'lsass.exe'(1028)
c:\programmi\ThreatFire\TFWAH.dll
.
Ora fine scansione: 2009-10-10 18.36.58
ComboFix-quarantined-files.txt 2009-10-10 16:36

Pre-Run: 45.518.184.448 byte disponibili
Post-Run: 45.543.182.336 byte disponibili

260 --- E O F --- 2009-10-10 01:01

D è la partizione di ripristino del sistema creato all'installazione, non è una periferica esterna.
Devo ugualmente fare quello scritto su?

il pc è un attimo più veloce, ma non è il massimo.
La pagina da te indicata si è, per esempio, bloccata a metà e ho dovuto sbloccare con task manager. Poi forse qusto non c'entra nulla.
Usando chiavette esterne proverò anche le ultime istruzioni.

Grazie mille

Nelle partizioni per il recovery, è normale che ci sia quel file.

Ciao r16.

Si eliminali.
Poi con la funzione "Cerca" digita combofix ed elimina tutto quello che trovi.