Disistalla Messenger.
Poi, rifai la scansione completa (non veloce) con Malwarebytes.
Vedi se rileva ancora qualcosa. (elimina quello che trova)
Anzi, meglio se posti il log (di Malwarebytes)

Scusa roberto1980 , ma ti prego di leggere con un minimo di attenzione a quello che scrivo:

Mi sembra, di avere scritto che devi eliminarli.
Poi, siccome voglio essere sicuro che li hai eliminati, vorrei vedere il log.

Evidentemente, non ti rendi conto, di cosa hai fatto, e sopratutto di cosa hai scritto.
1) Hai commesso un reato.
2) Lo hai reso pubblico.
3) Io non sono un carabiniere, o un poliziotto della postale, o un finanziere, e nemmeno un magistrato o un giudice.
Ma, questo non toglie, che qualcuno di questi rappresentanti della legge,possa leggere questo topic,e procurarti dei problemi.
Può essere improbabile, ma non impossibile. (tieni presente, che i problemi, li puoi avere anche da un utente normale)
In più, io non posso più aiutarti, per non rendermi complice delle tue azioni.
Scaricare software (qualsiasi software) coperto da Copyright, dotato di crack, o keygen per farlo funzionare, è illegale.
Ti auguro un buon 2011.

scusami r16


non lo sapevo puo sembrare strano ma non me ne intento di queste cose, e stata una sprovvista comunque cancellero tutto per non avere problemi tanto non mi serve a niente.

scusami e ti ringrazio

no r16

hai capito male il S.O xp e originale e quindi sono a posto e il windows7 che non lo e comunque ripeto lo cancellero per non avere problemi e anche perche comunque non mi serve a niente averne 2 di S.O.

Io ti chiedo nuovamente scusa e se un giorno mi servira aiuto se vorrai mi aiuti altrimenti sei libero di non farlo. Se non vorrai farlo ti capiro

grazie

No per il momento non riscontro nessun problema,

anche perche lo abbiamo messo aposto circa un mese fa se ricordi perche mi hai aiutato tu a farlo comunque faccio bene se cancello il S.O di windows 7?

consigliami perche io di ste cose ho paura e non voglio avere problemi

ciao r16

Ho fatto tutto quello che mi ai detto di fare di seguito ti posto il log che mi e uscito da combofix
dopodiche cosa devo fare?

Grazie





ComboFix 11-01-02.02 - Roberto 02/01/2011 20:36:01.1.1 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.39.1040.18.1471.924 [GMT 1:00]
Eseguito da: i:\users\Roberto\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\ANTIGEN.dll
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\ANTIGEN.exe
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\ANTIGEN.sys
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\ANTIGEN.tmp
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\cb.dll
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\cb.drv
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\cb.tmp
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\cid.sys
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\CLSV.dll
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\CLSV.drv
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\CLSV.exe
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\CLSV.sys
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\CLSV.tmp
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\DBOLE.dll
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\DBOLE.drv
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\DBOLE.tmp
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\ddv.exe
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\ddv.sys
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\ddv.tmp
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\delfile.sys
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\eb.dll
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\eb.drv
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\eb.sys
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\eb.tmp
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\energy.dll
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\energy.drv
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\energy.exe
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\energy.tmp
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\exec.dll
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\exec.drv
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\exec.exe
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\exec.sys
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\fan.dll
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\fix.drv
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\fix.sys
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\FS.dll
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\FW.drv
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\grid.dll
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\kernel32.drv
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\kernel32.exe
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\kernel32.tmp
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\pal.exe
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\PE.dll
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\PE.drv
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\PE.exe
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\PE.sys
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\PE.tmp
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\ppal.dll
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\ppal.drv
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\runddl.dll
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\runddlkey.drv
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\runddlkey.exe
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\runddlkey.sys
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\runddlkey.tmp
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\SICKBOY.drv
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\SICKBOY.exe
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\SICKBOY.tmp
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\sld.exe
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\sld.tmp
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\SM.exe
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\SM.tmp
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\snl2w.drv
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\snl2w.sys
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\std.sys
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\tempdoc.exe
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\tempdoc.sys
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\tempdoc.tmp
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\tjd.dll
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\tjd.drv
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\tjd.exe
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Recent\tjd.tmp
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Smart Engine.lnk
i:\users\Roberto\AppData\Roaming\Microsoft\Windows\Start Menu\Smart Engine.lnk
i:\users\Roberto\AppData\Roaming\Smart Engine
i:\users\Roberto\AppData\Roaming\Smart Engine\Instructions.ini
i:\windows\7Loader.TAG

.
((((((((((((((((((((((((( Files Creati Da 2010-12-02 al 2011-01-02 )))))))))))))))))))))))))))))))))))
.

2011-01-02 19:40 . 2011-01-02 19:40 -------- d-----w- i:\users\Default\AppData\Local\temp
2011-01-02 15:52 . 2010-11-09 19:33 6273872 ----a-w- i:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C5B710A7-DAD5-439B-BE66-F99BD325198E}\mpengine.dll
2010-12-31 09:57 . 2010-11-09 19:33 6273872 ----a-w- i:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2010-12-30 02:26 . 2010-12-30 02:26 -------- d-----w- i:\windows\system32\Wat
2010-12-30 02:09 . 2009-11-25 11:47 99176 ----a-w- i:\windows\system32\PresentationHostProxy.dll
2010-12-30 02:09 . 2009-11-25 11:47 49472 ----a-w- i:\windows\system32\netfxperf.dll
2010-12-30 02:09 . 2009-11-25 11:47 297808 ----a-w- i:\windows\system32\mscoree.dll
2010-12-30 02:09 . 2009-11-25 11:47 295264 ----a-w- i:\windows\system32\PresentationHost.exe
2010-12-30 02:09 . 2009-11-25 11:47 1130824 ----a-w- i:\windows\system32\dfshim.dll
2010-12-30 02:03 . 2010-02-11 07:10 293376 ----a-w- i:\windows\system32\browserchoice.exe
2010-12-29 13:27 . 2010-05-05 06:46 363520 ----a-w- i:\windows\system32\StructuredQuery.dll
2010-12-29 13:27 . 2010-06-29 04:57 4247040 ----a-w- i:\program files\Windows NT\Accessories\wordpad.exe
2010-12-29 13:27 . 2010-06-29 05:02 1413632 ----a-w- i:\windows\system32\ole32.dll
2010-12-29 13:27 . 2010-06-14 06:12 1286016 ----a-w- i:\windows\system32\drivers\tcpip.sys
2010-12-29 13:27 . 2010-08-21 05:32 316928 ----a-w- i:\windows\system32\spoolsv.exe
2010-12-29 13:25 . 2010-11-02 04:40 305152 ----a-w- i:\windows\system32\taskcomp.dll
2010-12-29 13:24 . 2010-08-27 05:46 168448 ----a-w- i:\windows\system32\srvsvc.dll
2010-12-29 13:24 . 2010-08-27 03:31 310784 ----a-w- i:\windows\system32\drivers\srv.sys
2010-12-29 13:24 . 2010-08-27 03:30 308736 ----a-w- i:\windows\system32\drivers\srv2.sys
2010-12-29 13:24 . 2010-08-27 03:30 113664 ----a-w- i:\windows\system32\drivers\srvnet.sys
2010-12-29 13:22 . 2010-03-08 21:33 427520 ----a-w- i:\windows\system32\vbscript.dll
2010-12-29 13:22 . 2010-10-16 04:41 101760 ----a-w- i:\windows\system32\consent.exe
2010-12-29 13:22 . 2010-08-21 05:36 738816 ----a-w- i:\windows\system32\wmpmde.dll
2010-12-29 13:22 . 2010-02-27 07:32 221696 ----a-w- i:\windows\system32\drivers\mrxsmb10.sys
2010-12-29 13:22 . 2010-02-27 07:32 95744 ----a-w- i:\windows\system32\drivers\mrxsmb20.sys
2010-12-29 13:22 . 2010-02-27 07:32 123392 ----a-w- i:\windows\system32\drivers\mrxsmb.sys
2010-12-29 13:20 . 2010-12-29 13:20 439632 ------w- i:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0C4F3911-8E3A-4365-8E0F-C54E8E27424D}\gapaengine.dll
2010-12-29 13:16 . 2010-10-20 03:00 2327552 ----a-w- i:\windows\system32\win32k.sys
2010-12-29 13:14 . 2009-12-29 06:55 172032 ----a-w- i:\windows\system32\wintrust.dll
2010-12-29 13:14 . 2010-01-09 06:52 132608 ----a-w- i:\windows\system32\cabview.dll
2010-12-29 13:06 . 2010-12-29 13:07 -------- d-----w- i:\program files\Microsoft Security Client
2010-12-29 13:06 . 2010-04-09 07:24 240008 ----a-w- i:\windows\system32\drivers\netio.sys
2010-12-28 12:46 . 2010-12-28 12:46 -------- d-----w- i:\program files\CCleaner
2010-12-28 12:01 . 2010-12-28 12:01 388096 ----a-r- i:\users\Roberto\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-12-27 18:48 . 2010-12-27 18:48 -------- d-----w- i:\program files\Trend Micro
2010-12-27 14:44 . 2010-12-27 14:44 -------- d-----w- i:\users\Roberto\AppData\Roaming\Malwarebytes
2010-12-27 14:44 . 2010-12-20 17:09 38224 ----a-w- i:\windows\system32\drivers\mbamswissarmy.sys
2010-12-27 14:44 . 2010-12-27 14:44 -------- d-----w- i:\programdata\Malwarebytes
2010-12-27 14:44 . 2010-12-30 07:55 -------- d-----w- i:\program files\Malwarebytes' Anti-Malware
2010-12-27 14:44 . 2010-12-20 17:08 20952 ----a-w- i:\windows\system32\drivers\mbam.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-24 20:25 . 2010-10-24 20:25 54144 ----a-w- i:\windows\system32\drivers\NisDrvWFP.sys
2010-10-24 20:25 . 2010-10-24 20:25 43392 ----a-w- i:\windows\system32\drivers\MpNWMon.sys
2010-10-24 20:25 . 2010-10-24 20:25 165264 ----a-w- i:\windows\system32\drivers\MpFilter.sys
2010-10-21 18:58 . 2010-10-21 18:58 48648 ----a-w- i:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2010-10-21 18:58 . 2010-10-21 18:58 375616 ----a-w- i:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2010-10-19 20:51 . 2010-01-31 18:20 222080 ------w- i:\windows\system32\MpSigStub.exe
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="i:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-12-28 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update"="i:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"Adobe Reader Speed Launcher"="i:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="i:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"VMonitorVMUVC"="i:\program files\Vimicro Corporation\VMUVC\VMonitor.exe" [2008-08-29 143360]
"SunJavaUpdateSched"="i:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"MSC"="i:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]
"Malwarebytes' Anti-Malware (reboot)"="i:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"

R2 gupdate;Servizio di Google Update (gupdate);i:\program files\Google\Update\GoogleUpdate.exe [2010-06-19 135664]
R3 jrdusbser;Modem Interface Device for Legacy Serial Communication;i:\windows\system32\DRIVERS\jrdusbser.sys [2009-05-11 105344]
R3 NisDrv;Microsoft Network Inspection System;i:\windows\system32\DRIVERS\NisDrvWFP.sys [2010-10-24 54144]
R3 NisSrv;Microsoft Network Inspection;i:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 206360]
R3 VMUVC;Vimicro Camera Service VMUVC;i:\windows\system32\Drivers\VMUVC.sys [2008-08-29 256512]
R3 vvftUVC;Vimicro Camera Filter Service VMUVC;i:\windows\system32\drivers\vvftUVC.sys [2008-07-01 398720]
R3 WatAdminSvc;Servizio Windows Activation Technologies;i:\windows\system32\Wat\WatAdminSvc.exe [2010-12-30 1343400]
S3 MpNWMon;Microsoft Malware Protection Network Driver;i:\windows\system32\DRIVERS\MpNWMon.sys [2010-10-24 43392]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contenuto della cartella 'Scheduled Tasks'

2011-01-02 i:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- i:\program files\Google\Update\GoogleUpdate.exe [2010-06-19 20:52]

2011-01-02 i:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- i:\program files\Google\Update\GoogleUpdate.exe [2010-06-19 20:52]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:25411
IE: Google Sidewiki... - i:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
.
- - - - CHIAVI ORFANE RIMOSSE - - - -

BHO-{b879dc47-7f5a-4973-a570-1e03a60c7c02} - i:\program files\ToolbarPorno\adxloader.dll
BHO-{cba0ec77-dd2c-4d2a-8853-94e4a8092822} - (no file)
Toolbar-{9e26c99f-6954-4e1e-80d4-de6dc4777ab3} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)


.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Ora fine scansione: 2011-01-02 20:41:56
ComboFix-quarantined-files.txt 2011-01-02 19:41

Pre-Run: 60.958.973.952 byte disponibili
Post-Run: 60.508.065.792 byte disponibili

- - End Of File - - EA24206ADE7F15671526AB19A6C754FB

Certo che in questa sezione...se ne vedono delle belle...

Pazienza r16.

Visto che R16 ti aveva detto di eliminare Windows 7, posti il log di Windows 7?
Chi offre aiuto si aspetta, come minimo, che vengano letti i propri post con i consigli ...

Ciao.

ciao r16


ho eliminato il S.O. windows 7 e da Windows XP ho fatto la scansione con combofix.
in fine mi e uscito il log che ti posto di seguito.

Scusami tanto se sono svogliato nel leggere i tuoi consigli e poi di seguito sbaglio
Ti ringrazio per la tua immensa pazienza

attendo





ComboFix 11-01-02.04 - Roberto 03/01/2011 14.09.29.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.39.1040.18.1470.1004 [GMT 1:00]
Eseguito da: c:\documents and settings\Roberto\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Roberto\Dati applicazioni\OfferBox
c:\documents and settings\Roberto\Dati applicazioni\OfferBox\config.xml
c:\documents and settings\Roberto\lame_enc_en.dll
c:\documents and settings\Roberto\lametritonus_en.dll
c:\windows\system32\2114508511

.
((((((((((((((((((((((((( Files Creati Da 2010-12-03 al 2011-01-03 )))))))))))))))))))))))))))))))))))
.

2011-01-03 12:57 . 2011-01-03 12:57 709456 ----a-w- c:\windows\isRS-000.tmp
2010-12-16 08:03 . 2010-11-02 15:17 40960 -c----w- c:\windows\system32\dllcache\ndproxy.sys
2010-12-16 08:03 . 2010-10-11 14:59 45568 -c----w- c:\windows\system32\dllcache\wab.exe
2010-12-08 00:27 . 2010-09-18 06:53 974848 -c----w- c:\windows\system32\dllcache\mfc42.dll
2010-12-08 00:27 . 2010-09-18 06:53 953856 -c----w- c:\windows\system32\dllcache\mfc40u.dll
2010-12-08 00:27 . 2010-08-23 16:12 617472 -c----w- c:\windows\system32\dllcache\comctl32.dll
2010-12-07 11:45 . 2010-12-07 11:45 -------- d-----w- c:\windows\l2schemas
2010-12-07 11:45 . 2010-12-07 11:45 -------- d-----w- c:\windows\system32\it
2010-12-07 11:45 . 2010-12-07 11:45 -------- d-----w- c:\windows\system32\bits
2010-12-06 11:33 . 2010-12-06 11:33 -------- d-----w- c:\documents and settings\LocalService\Impostazioni locali\Dati applicazioni\ICS
2010-12-06 11:33 . 2010-12-07 07:02 -------- d-----w- c:\windows\LMI20.tmp
2010-12-06 11:32 . 2010-12-06 11:33 -------- d-----w- c:\documents and settings\Roberto\Impostazioni locali\Dati applicazioni\Deployment
2010-12-05 15:26 . 2010-12-05 15:26 -------- d-----w- c:\documents and settings\Roberto\Dati applicazioni\Malwarebytes
2010-12-05 15:26 . 2010-12-20 17:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-05 15:26 . 2010-12-05 15:26 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Malwarebytes
2010-12-05 15:26 . 2011-01-03 12:57 -------- d-----w- c:\programmi\Malwarebytes' Anti-Malware
2010-12-05 15:26 . 2010-12-20 17:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-05 15:12 . 2010-12-05 15:12 -------- d-----w- c:\programmi\CCleaner
2010-12-05 14:24 . 2010-12-05 14:24 388096 ----a-r- c:\documents and settings\Roberto\Dati applicazioni\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-12-05 14:24 . 2010-12-05 14:24 -------- d-----w- c:\programmi\Trend Micro
2010-12-05 11:13 . 2010-12-05 11:13 -------- d-----w- c:\documents and settings\Roberto\Dati applicazioni\PhotoFiltre
2010-12-05 08:36 . 2010-12-05 08:36 -------- d-----w- c:\windows\system32\XPSViewer
2010-12-05 08:36 . 2010-12-05 08:36 -------- d-----w- c:\programmi\MSBuild
2010-12-05 08:35 . 2010-12-05 08:35 -------- d-----w- c:\programmi\Reference Assemblies
2010-12-05 08:35 . 2008-07-06 12:06 89088 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2010-12-05 08:35 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-12-05 08:35 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2010-12-05 08:35 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2010-12-05 08:35 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2010-12-05 08:35 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-12-05 08:35 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2010-12-05 08:35 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2010-12-05 08:35 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2010-12-05 08:28 . 2010-12-05 08:28 -------- d-----w- c:\programmi\MSXML 6.0

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-18 18:12 . 2009-11-11 18:54 86016 ----a-w- c:\windows\system32\isign32.dll
2010-11-09 14:46 . 2010-11-09 14:46 0 ----a-w- c:\windows\system32\ConduitEngine.tmp
2010-11-06 00:21 . 2004-08-19 13:39 916480 ----a-w- c:\windows\system32\wininet.dll
2010-11-06 00:21 . 2004-08-19 13:39 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-11-06 00:21 . 2004-08-19 13:39 1469440 ------w- c:\windows\system32\inetcpl.cpl
2010-11-03 12:26 . 2004-08-19 13:26 385024 ----a-w- c:\windows\system32\html.iec
2010-11-02 15:17 . 2001-08-31 10:00 40960 ----a-w- c:\windows\system32\drivers\ndproxy.sys
2010-11-02 09:56 . 2010-11-02 09:56 293176 ----a-w- c:\programmi\SoftonicDownloader_per_nero-burnlite.exe
2010-10-28 13:13 . 2004-08-19 13:37 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-10-26 14:05 . 2004-08-19 13:31 1853312 ----a-w- c:\windows\system32\win32k.sys
2009-11-21 22:21 203776 --sh--w- c:\windows\system32\unrar.exe
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-10-10 7286784]
"VMonitorVMUVC"="c:\programmi\Vimicro Corporation\VMUVC\VMonitor.exe" [2008-08-29 143360]
"ANIWZCS2Service"="c:\programmi\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2005-10-19 49152]
"NeroFilterCheck"="c:\programmi\File comuni\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
HP Digital Imaging Monitor.lnk - c:\programmi\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\Messenger\\msmsgs.exe"=
"c:\\Programmi\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Programmi\\Java\\jre6\\bin\\java.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programmi\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Programmi\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqusgm.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqusgh.exe"=
"c:\\Programmi\\HP\\HP Software Update\\HPWUCli.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\smart web printing\\SmartWebPrintExe.exe"=
"l:\\Nuova cartella\\eMule\\emule.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmi\\Skype\\Phone\\Skype.exe"=

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [29/11/2009 12.50.48 165584]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [29/11/2009 12.50.48 17744]
S0 annywl;annywl;c:\windows\system32\drivers\scbp.sys --> c:\windows\system32\drivers\scbp.sys [?]
S2 gupdate;Servizio di Google Update (gupdate);c:\programmi\Google\Update\GoogleUpdate.exe [02/12/2010 22.41.51 136176]
S3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\drivers\ewusbnet.sys [09/03/2010 16.24.58 112640]
S3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\drivers\ewusbfake.sys [09/03/2010 16.29.00 102656]
S3 jrdusbser;Modem Interface Device for Legacy Serial Communication;c:\windows\system32\drivers\jrdusbser.sys [28/05/2010 17.02.35 105344]
S3 VMUVC;Vimicro Camera Service VMUVC;c:\windows\system32\drivers\VMUVC.sys [25/10/2010 17.41.22 256512]
S3 vvftUVC;Vimicro Camera Filter Service VMUVC;c:\windows\system32\drivers\vvftUVC.sys [25/10/2010 17.41.22 398720]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contenuto della cartella 'Scheduled Tasks'

2011-01-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2010-12-02 21:41]

2011-01-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2010-12-02 21:41]

2011-01-03 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 14:07]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.
- - - - CHIAVI ORFANE RIMOSSE - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file)
WebBrowser-{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - (no file)
AddRemove-BearShare MediaBar - c:\programmi\BearShare Applications\MediaBar\uninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-03 14:15
Windows 5.1.2600 Service Pack 3 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\ð•€|ÿÿÿÿ.•€|þ»Ñw*]
"0140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
Ora fine scansione: 2011-01-03 14:18:51
ComboFix-quarantined-files.txt 2011-01-03 13:18

Pre-Run: 20.828.397.568 byte disponibili
Post-Run: 20.934.078.464 byte disponibili

- - End Of File - - 47DC68816E68228BFF3D5E8ABAE12C76