eccolo:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15.47.54, on 02/06/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\AVG\AVG9\avgchsvx.exe
C:\Programmi\AVG\AVG9\avgrsx.exe
C:\Programmi\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programmi\AVG\AVG9\avgwdsvc.exe
C:\Programmi\Java\jre6\bin\jqs.exe
C:\Programmi\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Programmi\Power Translator\LogoMedia TranslateDotNet Server.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Programmi\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Programmi\Ralink\Common\RalinkRegistryWriter.exe
C:\Programmi\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\AVG\AVG9\avgnsx.exe
C:\Programmi\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Programmi\Keyboard Driver\OEMDriver.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Magentic\bin\MgApp.exe
C:\Programmi\Ralink\Common\RaUI.exe
C:\WINDOWS\System32\svchost.exe
E:\PROGRAMMI\HIJACTHIS\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE}
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE}
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programmi\AVG\AVG9\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programmi\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre6\bin\ssv.dll
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmi\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [EPSON Stylus DX5000 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBVE.EXE /FU "C:\WINDOWS\TEMP\E_SAC.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [KBDriver] C:\Programmi\Keyboard Driver\OEMDriver.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmi\File comuni\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Automatico EPSON Stylus DX5000 Series su ANTONELLA] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBVE.EXE /FU "C:\WINDOWS\TEMP\E_S39.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [Automatico Automatico Automatico EPSON Stylus DX5000 Series su ANTONELLA su SARA su ANTONELLA] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBVE.EXE /FU "C:\WINDOWS\TEMP\E_S16.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKCU\..\Run: [Magentic] C:\PROGRA~1\Magentic\bin\Magentic.exe /c
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Programmi\Ralink\Common\RaUI.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1187101806843
O16 - DPF: {C9386579-3C0F-4713-82C6-5BA8088C7C8D} (Windows Live SkyDrive Upload Tool) - https://secure.shared.live.com/Pa6vGqB728AxD-ckvrPc0A/etc/Microsoft.Live.Folders.RichUpload.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{50558C43-21D4-474E-AD03-CB31B327721C}: NameServer = 212.216.112.112,212.216.172.62
O17 - HKLM\System\CCS\Services\Tcpip\..\{89F85571-C206-4140-8D25-26722273F96F}: NameServer = 212.216.112.112,212.216.172.62
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programmi\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Programmi\AVG\AVG9\avgwdsvc.exe
O23 - Service: Bluetooth Service (btwdins) - Unknown owner - D:\Sara\bin\btwdins.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmi\Java\jre6\bin\jqs.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Programmi\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: LEC TranslateDotNet Server - Language Engineering Corporation, LLC - C:\Programmi\Power Translator\LogoMedia TranslateDotNet Server.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Ralink Registry Writer (RalinkRegistryWriter) - Ralink Technology, Corp. - C:\Programmi\Ralink\Common\RalinkRegistryWriter.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

--
End of file - 8883 bytes

grazie
mi sono accorta adesso, non lo uso io quel pc, che ie 8 va in crash, che ha installato una barra bing cvhe non ho messo e che non voglio, e mi da problemi con msn e con il ripristino dicendo che explorer ha avutio un problema e quindi verrà chiuso

Ciao lunanera-nera .
Il log non presenta infezioni attive.
Per cercare, di trovare chi, o cosa, produce i problemi, si devono fare alcuni tentativi:

Provare a disistallare il firewall.(Sunbelt Kerio Personal Firewall 4)
E vedi se il problema era lui.

Disistallare l'antivirus, e installarne uno provvisorio.
E vedi se il problema era lui.

Provare un Browser diverso da IE. (Fiefox, Opera, Chrome etcc...)
E vedi se i problemi persistono.

Mi dispiace lunanera-nera , lo sò che è un lavoraccio, ma prima di riempire di scansioni il pc, sarebbe meglio fare questi tentativi.

Se vuoi invece cominciare con le scansioni:
Scarica ed installa MalwareBytes:
clicca qui per il download : http://www.aiutamici.com/software?id=80346
Prima di fare la scansione AGGIORNALO. (è molto importante)
Esegui una scansione completa del sistema.
Posta il log.

dimenticavo lo spybot mi aveva trovato un win 32 mi pare che ho fatto eliminare

no tanto se non va devo formattare comunque.
però non ce l 'ho sul pc devo cercarlo e installarlo

ok appena finisce malware posto il log, e poi aspetto per sapere se fare anche confizx o lo faccio pure?

ok

Sì, falla lo stesso.

P.S:
Per curiosità, ho fatto delle ricerche su cos'è stà barra Bing.
Ho scoperto, che è collegata a Windows Live Search, e che su IE8,è installata di default.
In pratica, BING è il motore di ricerca della Microsoft.
Prenditi il tempo di fare una ricerca su Google digitando : Rimuovere Bing.
Ci sono varie soluzioni.

Posta questa soluzione, e vediamo.

"Bing", si installa in automatico, (non l'ha installato nessuno) quando si scaricano alcuni aggiornamenti di IE8.
Qual'è la pagina principale, attualmente?
Elimina queste voci di HJT:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE}
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE}
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1187101806843
O16 - DPF: {C9386579-3C0F-4713-82C6-5BA8088C7C8D} (Windows Live SkyDrive Upload Tool) - https://secure.shared.live.com/Pa6vGqB728AxD-ckvrPc0A/etc/Microsoft.Live.Folders.RichUpload.cab

Riavvia il pc.
Prova a impostare Google come pagina principale.

allora la pagina è msn che però non riesce ad apruirelo stesso.adesso fixo quelle voci e vediamo che succede

ComboFix 10-06-03.01 - Antonella 04/06/2010 20.31.38.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.39.1040.18.1535.974 [GMT 2:00]
Eseguito da: c:\documents and settings\Antonella\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: Sunbelt Kerio Personal Firewall *disabled* {E659E0EE-10E6-49B7-8696-60F38D0EB174}

ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Antonella\RavMonLog
c:\windows\system32\Thumbs.db

.
((((((((((((((((((((((((( Files Creati Da 2010-05-04 al 2010-06-04 )))))))))))))))))))))))))))))))))))
.

2010-06-03 07:47 . 2010-06-03 07:47 242896 ----a-w- c:\documents and settings\All Users\Dati applicazioni\avg9\update\backup\avgtdix.sys
2010-06-03 07:47 . 2010-06-03 07:47 29512 ----a-w- c:\documents and settings\All Users\Dati applicazioni\avg9\update\backup\avgmfx86.sys
2010-06-02 15:38 . 2010-06-02 15:38 -------- d-----w- c:\documents and settings\Antonella\Dati applicazioni\Malwarebytes
2010-06-02 15:37 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-06-02 15:37 . 2010-06-02 15:37 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Malwarebytes
2010-06-02 15:37 . 2010-06-02 15:37 -------- d-----w- c:\programmi\Malwarebytes' Anti-Malware
2010-06-02 15:37 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-05-29 15:49 . 2010-05-29 15:49 73448 ----a-w- c:\documents and settings\Administrator\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2010-05-19 10:03 . 2010-05-19 10:03 -------- d-----w- c:\documents and settings\Antonella\Dati applicazioni\Foxit
2010-05-19 10:03 . 2010-05-19 10:03 -------- d-----w- c:\programmi\Foxit Software
2010-05-17 16:02 . 2010-05-17 16:02 -------- d-----w- C:\$AVG
2010-05-17 16:01 . 2010-05-17 16:01 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2010-05-17 16:01 . 2010-06-03 07:46 242896 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-05-17 16:01 . 2010-05-17 16:01 216200 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-05-17 16:01 . 2010-06-04 07:36 -------- d-----w- c:\windows\system32\drivers\Avg
2010-05-17 16:01 . 2010-06-03 07:46 29584 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-05-17 16:00 . 2010-05-17 16:00 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\avg9
2010-05-09 16:49 . 2010-05-09 16:49 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2010-05-08 15:13 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-04 17:53 . 2004-08-19 17:27 93084 ----a-w- c:\windows\system32\perfc010.dat
2010-06-04 17:53 . 2004-08-19 17:27 510826 ----a-w- c:\windows\system32\perfh010.dat
2010-06-03 13:17 . 2007-11-01 19:38 188152 ----a-w- c:\documents and settings\Antonella\Dati applicazioni\Mozilla\Firefox\Profiles\yi54jybw.default\FlashGot.exe
2010-06-02 07:31 . 2007-08-12 11:31 -------- d-----w- c:\programmi\Windows Live
2010-05-29 15:46 . 2007-08-16 05:17 30369 -c--a-w- c:\windows\system32\drivers\fwdrv.err
2010-05-19 09:16 . 2007-08-12 11:51 -------- d-----w- c:\programmi\Spybot - Search & Destroy
2010-05-17 17:13 . 2007-08-12 11:51 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Spybot - Search & Destroy
2010-05-17 17:12 . 2008-04-24 23:03 -------- d---a-w- c:\documents and settings\All Users\Dati applicazioni\TEMP
2010-05-17 17:12 . 2007-08-12 11:48 -------- d-----w- c:\programmi\SpywareBlaster
2010-05-17 17:08 . 2007-08-12 11:53 -------- d-----w- c:\programmi\CCleaner
2010-05-17 16:00 . 2008-04-24 21:24 -------- d-----w- c:\programmi\AVG
2010-05-09 17:07 . 2007-08-11 22:12 73448 -c--a-w- c:\documents and settings\Antonella\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2010-05-09 16:38 . 2009-11-24 18:46 -------- d-----w- c:\programmi\Microsoft
2010-05-09 16:37 . 2007-08-11 21:55 -------- d--h--w- c:\programmi\InstallShield Installation Information
2010-05-09 16:33 . 2007-08-12 10:38 -------- d-----w- c:\programmi\IncrediMail
2010-04-26 17:05 . 2008-08-25 09:40 -------- d-----w- c:\programmi\Canon
2010-04-26 16:17 . 2007-08-14 18:10 -------- d-----w- c:\programmi\Java
2010-04-26 16:17 . 2007-08-14 18:09 -------- d-----w- c:\programmi\File comuni\Java
2010-04-26 16:00 . 2007-08-12 11:29 -------- d-----w- c:\programmi\FreePOPs
2010-04-22 12:21 . 2007-08-12 12:39 -------- d-----w- c:\programmi\eMule
2010-04-22 11:54 . 2010-04-22 11:54 503808 ----a-w- c:\documents and settings\Antonella\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-3deaa0bf-n\msvcp71.dll
2010-04-22 11:54 . 2010-04-22 11:54 499712 ----a-w- c:\documents and settings\Antonella\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-3deaa0bf-n\jmc.dll
2010-04-22 11:54 . 2010-04-22 11:54 348160 ----a-w- c:\documents and settings\Antonella\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-3deaa0bf-n\msvcr71.dll
2010-04-22 11:54 . 2010-04-22 11:54 61440 ----a-w- c:\documents and settings\Antonella\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-56c5d840-n\decora-sse.dll
2010-04-22 11:54 . 2010-04-22 11:54 12800 ----a-w- c:\documents and settings\Antonella\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-56c5d840-n\decora-d3d.dll
2010-04-17 00:24 . 2010-04-17 00:24 306544 ----a-w- c:\windows\WLXPGSS.SCR
2010-04-16 20:12 . 2010-04-16 20:12 48464 ----a-w- c:\windows\system32\sirenacm.dll
2010-04-12 15:29 . 2010-04-22 11:54 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-03-10 06:15 . 2004-08-19 17:27 420352 ----a-w- c:\windows\system32\vbscript.dll
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Magentic"="c:\progra~1\Magentic\bin\Magentic.exe" [2007-07-10 475180]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\programmi\File comuni\Ahead\lib\NMBgMonitor.exe" [2006-03-01 90112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 61952]
"KBDriver"="c:\programmi\Keyboard Driver\OEMDriver.exe" [2004-08-25 151552]
"NeroFilterCheck"="c:\programmi\File comuni\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"nwiz"="nwiz.exe" [2006-10-22 1622016]
"QuickTime Task"="c:\programmi\QuickTime\qttask.exe" [2007-06-29 286720]
"RTHDCPL"="RTHDCPL.EXE" [2007-10-25 16855552]
"SkyTel"="SkyTel.EXE" [2007-10-11 1826816]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Antonella\Menu Avvio\Programmi\Esecuzione automatica\
Adobe Gamma.lnk - c:\programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]

c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Ralink Wireless Utility.lnk - c:\programmi\Ralink\Common\RaUI.exe [2009-4-9 1634304]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-05-17 16:01 12464 ----a-w- c:\windows\system32\avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\Magentic\\bin\\MgImp.exe"=
"c:\\Programmi\\Magentic\\bin\\Magentic.exe"=
"c:\\Programmi\\Magentic\\bin\\MgApp.exe"=
"c:\\Programmi\\eMule\\emule.exe"=
"c:\\Programmi\\Sunbelt Software\\Personal Firewall\\kpf4gui.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmi\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Programmi\\AVG\\AVG9\\avgupd.exe"=
"c:\\Programmi\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"15886:TCP"= 15886:TCP:NortonAV
"13612:TCP"= 13612:TCP:NortonAV
"15648:TCP"= 15648:TCP:NortonAV

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [17/05/2010 18.01.21 216200]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [17/05/2010 18.01.23 242896]
R1 fwdrv;Firewall Driver;c:\windows\system32\drivers\fwdrv.sys [18/07/2006 12.02.50 284184]
R1 khips;Kerio HIPS Driver;c:\windows\system32\drivers\khips.sys [18/07/2006 12.02.52 91672]
R2 avg9wd;AVG Free WatchDog;c:\programmi\AVG\AVG9\avgwdsvc.exe [17/05/2010 18.00.58 308064]
R3 pctvnet;Pinnacle PCTV Ethernet Driver;c:\windows\system32\drivers\pctvnet.sys [12/08/2007 1.16.56 9340]
S3 netr73;D-Link DWA-111 Wireless G USB Adapter Driver;c:\windows\system32\drivers\netr73.sys [08/04/2009 19.38.50 256000]
S3 PAC207;Trust WB-1200p Mini Webcam;c:\windows\system32\DRIVERS\pfc027.sys --> c:\windows\system32\DRIVERS\pfc027.sys [?]
S3 pctvvbi;PCTVVBI;c:\windows\system32\drivers\pctvvbi.sys [12/08/2007 1.26.31 6400]
.
Contenuto della cartella 'Scheduled Tasks'

2010-06-04 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 14:07]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.com/webhp?hl=it
uInternet Connection Wizard,ShellNext = iexplore
TCP: {50558C43-21D4-474E-AD03-CB31B327721C} = 212.216.112.112,212.216.172.62
TCP: {89F85571-C206-4140-8D25-26722273F96F} = 212.216.112.112,212.216.172.62
FF - ProfilePath - c:\documents and settings\Antonella\Dati applicazioni\Mozilla\Firefox\Profiles\yi54jybw.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/intl/it/
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - component: c:\programmi\AVG\AVG9\Firefox\components\avgssff.dll
FF - plugin: c:\programmi\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\programmi\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
FF - plugin: c:\programmi\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - truec:\programmi\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\programmi\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\programmi\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\programmi\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\programmi\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-04 20:37
Windows 5.1.2600 Service Pack 3 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]
"0140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•9~*]
"0140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
Ora fine scansione: 2010-06-04 20:42:23
ComboFix-quarantined-files.txt 2010-06-04 18:42

Pre-Run: 6.017.077.248 byte disponibili
Post-Run: 6.129.979.392 byte disponibili

- - End Of File - - 8BEB9D7F0539D4822295F24CF412B70A


mi ha messo un icona di explorer sul desktop e avg mi da problemi adesso con la tray icon