Ciao r16,
ti allego qui sotto i due file log di poco fa.
Dopo averli realizzati ho spento il pc e dopo 5 minuti l’ho acceso e l’operazione a andata normalmente a buon fine: miracolo!?!?
Due ore fa invece l’ho spento e 1 ora dopo l’ho acceso ed è apparsa ancora la videata azzura che con il resettamento e l’invio(ok) su “avvia normalmente il pc” ho potuto accedere alle varie funzioni e leggere la tua ultima risposta.
In questa ultima videata azzurra ho notato che mancava una delle righe con i dati che ti ho segnalato (in basso) nel mio primo post.
Inoltre con miticoalex ho evidenziato il fatto che cliccando su “riavvia” il pc si accendeva normalmente.
Se invece lo spegnevo e lo riaccendevo dopo diverse ore (una notte ad es.) compariva la videata azzurra che ti segnalavo nel mio primo post.
Personalmente incrocio le dita che tutto sia andato a posto!
Che ne pensi?
Che sia andato davvero tutto a posto???Ciao
ComboFix 11-09-11.02 - Martino 11/09/2011 16.22.47.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.39.1040.18.768.400 [GMT 2:00]
Eseguito da: c:\documents and settings\Martino\Desktop\ComboFix.exe
Opzioni usate :: c:\documents and settings\Martino\Desktop\CFScript.txt
AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Martino\Impostazioni locali\Dati applicazioni\ApplicationHistory
c:\documents and settings\Martino\Impostazioni locali\Dati applicazioni\ApplicationHistory\hpqimzone.exe.fd734169.ini.inuse
c:\documents and settings\Martino\Impostazioni locali\Dati applicazioni\ApplicationHistory\hpqthb08.exe.8be1ac5.ini
.
.
((((((((((((((((((((((((( Files Creati Da 2011-08-11 al 2011-09-11 )))))))))))))))))))))))))))))))))))
.
.
2011-09-10 18:13 . 2011-09-10 18:13 388096 ----a-r- c:\documents and settings\Martino\Dati applicazioni\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-09-10 15:16 . 2011-09-10 15:16 -------- d-----w- c:\documents and settings\LocalService\Impostazioni locali\Dati applicazioni\HP
2011-09-10 15:00 . 2011-09-10 15:00 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\HP Product Assistant
2011-09-10 15:00 . 2011-09-10 15:00 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\HP
2011-09-10 11:11 . 2011-09-11 14:04 -------- d-----w- c:\programmi\BONJOUR
2011-09-10 08:48 . 2011-06-24 14:10 139656 -c----w- c:\windows\system32\dllcache\rdpwd.sys
2011-09-10 08:48 . 2011-04-21 13:37 105472 -c----w- c:\windows\system32\dllcache\mup.sys
2011-09-10 08:45 . 2011-07-08 14:02 10496 -c----w- c:\windows\system32\dllcache\ndistapi.sys
2011-09-09 17:51 . 2011-09-09 17:51 -------- d-----w- c:\documents and settings\Martino\Dati applicazioni\AVG2012
2011-09-09 17:45 . 2011-09-09 17:45 -------- d-----w- c:\programmi\AVG
2011-09-09 16:43 . 2011-09-09 16:43 -------- d-----w- c:\windows\system32\wbem\Repository
2011-09-09 16:31 . 2011-09-09 16:31 -------- d-----w- c:\documents and settings\Martino\Impostazioni locali\Dati applicazioni\QuickStores
2011-09-09 16:28 . 2011-09-09 16:28 -------- d-----w- c:\programmi\CCleaner
2011-09-09 16:25 . 2011-09-09 16:30 -------- d-----w- c:\windows\LastGood(2).Tmp
2011-09-09 13:57 . 2011-09-09 15:44 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Avira(2)
2011-09-06 18:55 . 2011-09-06 18:55 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Common Files
2011-09-06 18:54 . 2011-09-11 09:47 -------- d-----w- c:\windows\system32\drivers\AVG
2011-09-06 18:54 . 2011-09-09 17:47 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\AVG2012
2011-09-06 18:47 . 2011-09-11 09:48 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\MFAData
2011-09-06 18:41 . 2001-08-30 21:07 66048 -c--a-w- c:\windows\system32\dllcache\s3legacy.dll
2011-09-06 08:00 . 2011-09-11 14:34 -------- d-----w- c:\windows\system32\CatRoot2
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-03 10:17 . 2004-08-30 20:00 603136 ----a-w- c:\windows\system32\crypt32.dll
2011-08-08 04:08 . 2011-08-08 04:08 40016 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2011-07-15 13:29 . 2004-08-30 20:00 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-10 23:14 . 2011-07-10 23:14 295248 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2011-07-10 23:14 . 2011-07-10 23:14 16720 ----a-w- c:\windows\system32\drivers\AVGIDSShim.sys
2011-07-10 23:14 . 2011-07-10 23:14 24272 ----a-w- c:\windows\system32\drivers\AVGIDSFilter.sys
2011-07-10 23:14 . 2011-07-10 23:14 23120 ----a-w- c:\windows\system32\drivers\AVGIDSEH.sys
2011-07-10 23:14 . 2011-07-10 23:14 134608 ----a-w- c:\windows\system32\drivers\AVGIDSDriver.sys
2011-07-10 23:13 . 2011-07-10 23:13 229840 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2011-07-10 23:13 . 2011-07-10 23:13 32464 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
2011-07-08 14:02 . 2004-08-30 20:00 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2011-07-06 17:52 . 2011-07-31 09:31 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 17:52 . 2011-07-31 09:31 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-06-24 14:10 . 2010-10-09 14:55 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-23 18:30 . 2004-08-30 20:00 916480 ----a-w- c:\windows\system32\wininet.dll
2011-06-23 18:30 . 2004-08-30 20:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-06-23 18:30 . 2004-08-30 20:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2011-06-23 12:05 . 2004-08-30 20:00 385024 ----a-w- c:\windows\system32\html.iec
2011-06-20 17:44 . 2004-08-30 20:00 293888 ----a-w- c:\windows\system32\winsrv.dll
2011-09-03 06:31 . 2011-09-10 11:01 134104 ----a-w- c:\programmi\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((
SnapShot@2011-09-11_12.30.46 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-09-11 14:33 . 2011-09-11 14:33 16384 c:\windows\temp\Perflib_Perfdata_434.dat
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SunJavaUpdateSched"="c:\programmi\File comuni\Java\Java Update\jusched.exe" [2011-04-08 254696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyPictures"= 0 (0x0)
"NoStartMenuMyMusic"= 0 (0x0)
"NoCommonGroups"= 0 (0x0)
"NoSimpleStartMenu"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoChangeAnimation"= 0 (0x0)
"NoDFSTab"= 0 (0x0)
"NoFileAssociate"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^Avvio rapido HP Photosmart Premier.lnk]
path=c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\Avvio rapido HP Photosmart Premier.lnk
backup=c:\windows\pss\Avvio rapido HP Photosmart Premier.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG_TRAY]
2011-08-19 04:24 2387296 ----a-w- c:\programmi\AVG\AVG2012\avgtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-03-11 19:34 49152 ----a-w- c:\programmi\HP\HP Software Update\hpwuSchd2.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmi\\aTube Catcher 2.0\\yct.exe"=
"c:\\Programmi\\Java\\jre6\\bin\\java.exe"=
"c:\\Programmi\\AVG\\AVG2012\\avgnsx.exe"=
"c:\\Programmi\\AVG\\AVG2012\\avgdiagex.exe"=
"c:\\Programmi\\AVG\\AVG2012\\avgmfapx.exe"=
"c:\\Programmi\\AVG\\AVG2012\\avgemcx.exe"=
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [11/07/2011 1.14.28 23120]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [11/07/2011 1.13.42 32464]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [11/07/2011 1.13.46 229840]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [11/07/2011 1.14.38 295248]
R2 AVGIDSAgent;AVGIDSAgent;c:\programmi\AVG\AVG2012\AVGIDSAgent.exe [16/08/2011 6.27.28 5264736]
R2 avgwd;AVG WatchDog;c:\programmi\AVG\AVG2012\avgwdsvc.exe [02/08/2011 6.09.08 192776]
R2 PPPoEService;PPPoE Service;c:\progra~1\Alice\ALICEE~1\app\pppoeservice.exe [09/10/2010 17.37.59 49152]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [11/07/2011 1.14.26 134608]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [11/07/2011 1.14.28 24272]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [11/07/2011 1.14.30 16720]
S3 CH2KCCID;Cherry CCID Driver;c:\windows\system32\drivers\ch2kccid.sys [15/02/2010 8.55.52 144640]
S3 NTSPPPOE;Efficient Networks Enternet P.P.P.o.E LAN Miniport Driver;c:\windows\system32\drivers\ntspppoe.sys [09/10/2010 17.37.58 161640]
S3 RAWESR;RAWESR;c:\progra~1\Alice\ALICEE~1\app\RAWESR.SYS [09/10/2010 17.37.59 12924]
S3 TAPBIND;TAPBIND;c:\progra~1\Alice\ALICEE~1\app\TAPBIND1.SYS [09/10/2010 17.37.59 44544]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08
.
Contenuto della cartella 'Scheduled Tasks'
.
2011-09-10 c:\windows\Tasks\WebReg .job
- c:\programmi\HP\Digital Imaging\bin\hpqwrg.exe [2007-03-11 19:27]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://it.ask.com/?l=dis&o=14672
uInternet Settings,ProxyOverride = *.local
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: Interfaces\{258ECCC1-12EE-46E3-9426-71C3DB8B4F36}: NameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Martino\Dati applicazioni\Mozilla\Firefox\Profiles\8m6p01xk.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.it/webhp?hl=it&tab=ww
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2011-09-11 16:33
Windows 5.1.2600 Service Pack 3 NTFS
.
scansione processi nascosti ...
.
scansione entrate autostart nascoste ...
.
Scansione files nascosti ...
.
Scansione completata con successo
Files nascosti: 0
.
**************************************************************************
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------
.
- - - - - - - > 'explorer.exe'(260)
c:\windows\system32\WININET.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\progra~1\AVG\AVG2012\avgrsx.exe
c:\programmi\AVG\AVG2012\avgcsrvx.exe
c:\programmi\File comuni\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\programmi\Java\jre6\bin\jqs.exe
c:\programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\programmi\AVG\AVG2012\avgnsx.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Ora fine scansione: 2011-09-11 16:40:58 - Il pc è stato riavviato
ComboFix-quarantined-files.txt 2011-09-11 14:40
ComboFix2.txt 2011-09-11 12:38
.
Pre-Run: 26.790.739.968 byte disponibili
Post-Run: 26.779.037.696 byte disponibili
.
- - End Of File - - 1BD572F011E9418A0ED1551CD4E05238
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16.42.43, on 11/09/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\PROGRA~1\AVG\AVG2012\avgrsx.exe
C:\Programmi\AVG\AVG2012\avgcsrvx.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Programmi\AVG\AVG2012\avgwdsvc.exe
C:\Programmi\Java\jre6\bin\jqs.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\Alice\ALICEE~1\app\pppoeservice.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\AVG\AVG2012\AVGIDSAgent.exe
C:\Programmi\AVG\AVG2012\avgnsx.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Programmi\File comuni\Java\Java Update\jusched.exe
C:\WINDOWS\explorer.exe
C:\Programmi\HijackThis\Trend Micro\HiJackThis\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://it.ask.com/?l=dis&o=14672R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programmi\AVG\AVG2012\avgssie.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmi\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\File comuni\Java\Java Update\jusched.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
O10 - Broken Internet access because of LSP provider 'c:\programmi\bonjour\mdnsnsp.dll' missing
O17 - HKLM\System\CCS\Services\Tcpip\..\{258ECCC1-12EE-46E3-9426-71C3DB8B4F36}: NameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{258ECCC1-12EE-46E3-9426-71C3DB8B4F36}: NameServer = 192.168.1.1
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programmi\AVG\AVG2012\avgpp.dll
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Programmi\AVG\AVG2012\AVGIDSAgent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Programmi\AVG\AVG2012\avgwdsvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmi\Java\jre6\bin\jqs.exe
O23 - Service: PPPoE Service (PPPoEService) - Unknown owner - C:\PROGRA~1\Alice\ALICEE~1\app\pppoeservice.exe
--
End of file - 4580 bytes
