Grazie shapiro............ho fatto quello che mi hai detto e il risultato mi sembra questo
Nome file: FreemakeUtilsService.exe
Data di presentazione: 2011/08/22 13:49:11 (UTC)
Stato attuale: finito
Risultato: 0 / 44 (0,0%)

Fatto anche quello....ecco il risultato
CKScanner - Additional Security Risks - These are not necessarily bad
c:\programmi\custom\tela\cracks2c.pcx
c:\programmi\custom\tiles\cracks2m.cpt
scanner sequence 3.LB.11.PCAAMS
----- EOF -----

ho fatto combofix

ecco il risultato

ComboFix 11-09-12.02 - Admin 12/09/2011 17.42.31.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.39.1040.18.2037.1434 [GMT 2:00]
Eseguito da: c:\documents and settings\Admin\Documenti\Scarico\ComboFix.exe
AV: Kaspersky Anti-Virus *Disabled/Updated* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Anti-Virus *Disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.
ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Admin\Dati applicazioni\facemoods.com
c:\documents and settings\Admin\Dati applicazioni\OfferBox
c:\documents and settings\Admin\Dati applicazioni\OfferBox\config.xml
c:\documents and settings\Admin\Dati applicazioni\PriceGong
c:\documents and settings\Admin\Dati applicazioni\PriceGong\Data\1.xml
c:\documents and settings\Admin\Dati applicazioni\PriceGong\Data\a.xml
c:\documents and settings\Admin\Dati applicazioni\PriceGong\Data\b.xml
c:\documents and settings\Admin\Dati applicazioni\PriceGong\Data\c.xml
c:\documents and settings\Admin\Dati applicazioni\PriceGong\Data\d.xml
c:\documents and settings\Admin\Dati applicazioni\PriceGong\Data\e.xml
c:\documents and settings\Admin\Dati applicazioni\PriceGong\Data\f.xml
c:\documents and settings\Admin\Dati applicazioni\PriceGong\Data\g.xml
c:\documents and settings\Admin\Dati applicazioni\PriceGong\Data\h.xml
c:\documents and settings\Admin\Dati applicazioni\PriceGong\Data\i.xml
c:\documents and settings\Admin\Dati applicazioni\PriceGong\Data\J.xml
c:\documents and settings\Admin\Dati applicazioni\PriceGong\Data\k.xml
c:\documents and settings\Admin\Dati applicazioni\PriceGong\Data\l.xml
c:\documents and settings\Admin\Dati applicazioni\PriceGong\Data\m.xml
c:\documents and settings\Admin\Dati applicazioni\PriceGong\Data\mru.xml
c:\documents and settings\Admin\Dati applicazioni\PriceGong\Data\n.xml
c:\documents and settings\Admin\Dati applicazioni\PriceGong\Data\o.xml
c:\documents and settings\Admin\Dati applicazioni\PriceGong\Data\p.xml
c:\documents and settings\Admin\Dati applicazioni\PriceGong\Data\q.xml
c:\documents and settings\Admin\Dati applicazioni\PriceGong\Data\r.xml
c:\documents and settings\Admin\Dati applicazioni\PriceGong\Data\s.xml
c:\documents and settings\Admin\Dati applicazioni\PriceGong\Data\t.xml
c:\documents and settings\Admin\Dati applicazioni\PriceGong\Data\u.xml
c:\documents and settings\Admin\Dati applicazioni\PriceGong\Data\v.xml
c:\documents and settings\Admin\Dati applicazioni\PriceGong\Data\w.xml
c:\documents and settings\Admin\Dati applicazioni\PriceGong\Data\x.xml
c:\documents and settings\Admin\Dati applicazioni\PriceGong\Data\y.xml
c:\documents and settings\Admin\Dati applicazioni\PriceGong\Data\z.xml
c:\documents and settings\Admin\Impostazioni locali\Dati applicazioni\setup.exe
c:\documents and settings\Admin\WINDOWS
c:\windows\IsUn0410.exe
.
.
((((((((((((((((((((((((( Files Creati Da 2011-08-12 al 2011-09-12 )))))))))))))))))))))))))))))))))))
.
.
2011-09-12 15:14 . 2011-09-12 15:24 -------- dc----w- c:\programmi\FindyKill
2011-09-12 07:46 . 2011-09-12 07:46 -------- dc----w- c:\programmi\VirusTotalUploader2
2011-09-11 15:19 . 2011-09-11 15:19 25992 ----a-w- c:\windows\system32\pgdfgsvc.exe
2011-09-11 07:45 . 2011-09-11 07:45 -------- dc----w- c:\programmi\ImTOO
2011-09-07 12:58 . 2011-09-07 12:58 -------- dc----w- c:\programmi\File comuni\ANDShared
2011-09-07 12:58 . 2011-09-07 13:01 -------- dc----w- C:\R99itITA
2011-09-07 09:27 . 2011-09-07 09:27 -------- dc----w- c:\programmi\File comuni\SWiSHzone.com
2011-09-07 09:27 . 2011-09-07 09:33 -------- dc----w- c:\programmi\SWiSH Max3
2011-09-07 09:18 . 2011-09-07 09:20 -------- dc----w- c:\programmi\DownVision
2011-09-06 14:39 . 2011-09-06 14:39 -------- dc----w- c:\documents and settings\Admin\Dati applicazioni\gtk-2.0
2011-09-06 14:39 . 2011-09-06 14:39 -------- dc----w- c:\documents and settings\Admin\.thumbnails
2011-09-06 14:30 . 2011-09-06 14:43 -------- dc----w- c:\documents and settings\Admin\.gimp-2.6
2011-09-06 14:20 . 2011-09-06 14:20 -------- dc----w- c:\documents and settings\Admin\Dati applicazioni\AntsSoft
2011-09-06 06:53 . 2011-09-06 06:53 -------- dc----w- c:\documents and settings\LocalService\Dati applicazioni\TightVNC
2011-09-06 06:52 . 2011-09-06 07:14 -------- dc----w- c:\documents and settings\Admin\Impostazioni locali\Dati applicazioni\CrossLoop
2011-09-04 09:13 . 2011-09-04 09:17 -------- dc----w- c:\documents and settings\All Users\Dati applicazioni\SpeedBit
2011-09-04 09:13 . 2011-09-04 09:13 -------- dc----w- c:\programmi\File comuni\SpeedBit
2011-09-04 09:13 . 2011-09-04 09:13 84480 ----a-w- c:\windows\system32\EasyHook32.dll
2011-09-04 09:13 . 2011-09-04 09:13 109216 ----a-w- c:\windows\system32\EasyHook64.dll
2011-09-04 09:13 . 2011-09-04 09:18 -------- dc----w- c:\programmi\DAP
2011-09-04 09:09 . 2011-09-04 09:09 -------- dc----w- c:\programmi\SAVERS4FREE.COM
2011-09-03 10:17 . 2011-09-03 10:17 603136 -c----w- c:\windows\system32\dllcache\crypt32.dll
2011-09-03 07:42 . 2011-09-03 07:42 -------- dc----w- c:\programmi\Glary Utilities
2011-09-02 07:27 . 2011-09-11 06:38 -------- dc----w- C:\TEMP
2011-08-31 09:34 . 2011-08-31 09:34 -------- dc----w- c:\documents and settings\All Users\Dati applicazioni\casualArts
2011-08-31 09:34 . 2011-08-31 09:34 -------- dc----w- c:\documents and settings\Admin\Dati applicazioni\casualArts
2011-08-31 06:31 . 2011-08-31 17:50 -------- dc----w- c:\programmi\Sandboxie
2011-08-28 14:04 . 2011-08-28 14:04 -------- dc----w- c:\programmi\File comuni\Logishrd
2011-08-28 14:03 . 2011-08-28 14:03 -------- dc----w- c:\programmi\Logitech
2011-08-26 18:03 . 2011-08-26 18:04 -------- dc----w- c:\documents and settings\All Users\Dati applicazioni\DVD Shrink
2011-08-25 17:00 . 2011-08-25 17:00 -------- dc----w- c:\documents and settings\Admin\Dati applicazioni\GlarySoft
2011-08-25 11:12 . 1997-06-03 07:31 108032 ------w- c:\windows\system32\sh33w32.dll
2011-08-25 07:15 . 2011-08-26 17:54 -------- dc----w- c:\programmi\DVD Cutter Plus
2011-08-25 06:49 . 2011-08-25 07:19 -------- dc----w- c:\programmi\AVS4YOU
2011-08-24 17:07 . 2011-08-24 17:07 -------- dc----w- c:\documents and settings\Admin\Dati applicazioni\HillStoneAnimationStudios
2011-08-23 09:56 . 2011-08-23 09:56 -------- d-----w- c:\windows\system32\wbem\Repository
2011-08-23 09:55 . 2011-08-23 09:55 -------- d-----w- c:\windows\The Curse of the Ring
2011-08-23 09:55 . 2011-08-23 09:55 -------- d-----w- c:\windows\Robin's Quest
2011-08-23 09:55 . 2011-08-23 09:55 -------- d-----w- c:\windows\Spirit Seasons
2011-08-23 09:55 . 2011-08-23 09:55 -------- d-----w- c:\windows\Mystic Gateways The Celestial Quest
2011-08-23 09:55 . 2011-08-23 09:55 -------- d-----w- c:\windows\Mystery of Mortlake Mansion
2011-08-23 09:55 . 2011-08-23 09:55 -------- d-----w- c:\windows\Eternal Night - Realm of Souls
2011-08-23 09:55 . 2011-08-23 09:55 -------- d-----w- c:\programmi\Nightmare Realm Collector's Edition
2011-08-23 09:54 . 2011-08-23 09:54 -------- d-----w- c:\windows\Between the Worlds
2011-08-23 09:54 . 2011-08-23 09:54 -------- d-----w- c:\windows\Downtown Secrets
2011-08-23 09:54 . 2011-08-23 09:54 -------- d-----w- c:\windows\Dominic Crane 2 - Dark Mystery Revealed
2011-08-23 08:46 . 2011-08-23 09:54 -------- dc----w- c:\programmi\TuneUp Utilities 2011
2011-08-22 11:23 . 2011-08-22 11:23 -------- dc----w- c:\programmi\VS Revo Group
2011-08-18 08:41 . 2011-08-18 08:41 -------- dc----w- c:\programmi\Digital Photo Software
2011-08-17 17:52 . 2011-08-17 17:52 -------- dc----w- c:\documents and settings\All Users\Dati applicazioni\Fenomen Games
2011-08-16 17:32 . 2011-08-16 17:32 -------- dc----w- c:\programmi\iWebAlbum
2011-08-15 10:30 . 2011-08-15 13:22 -------- dc----w- c:\documents and settings\Admin\Dati applicazioni\XnView
2011-08-15 10:30 . 2011-08-15 10:30 -------- dc----w- c:\programmi\XnView
2011-08-15 06:50 . 2011-08-15 07:08 -------- dc----w- c:\documents and settings\Admin\Dati applicazioni\Anvsoft
2011-08-15 06:50 . 2011-08-15 07:06 -------- dc----w- c:\programmi\AnvSoft
2011-08-14 17:12 . 2011-08-14 17:15 -------- dc----w- c:\programmi\Notepad++
2011-08-14 17:12 . 2011-08-14 17:15 -------- dc----w- c:\documents and settings\Admin\Dati applicazioni\Notepad++
2011-08-14 16:33 . 2011-08-14 16:33 -------- dc----w- c:\documents and settings\All Users\Dati applicazioni\WinMaximizer
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-03 10:17 . 2004-08-19 12:00 603136 ----a-w- c:\windows\system32\crypt32.dll
2011-07-15 13:29 . 2004-08-19 12:00 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2004-08-19 12:00 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2011-07-06 17:52 . 2010-10-25 11:39 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 17:52 . 2010-10-25 11:39 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-06-24 14:10 . 2010-10-11 15:09 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-23 18:30 . 2004-08-19 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2011-06-23 18:30 . 2004-08-19 12:00 43520 ------w- c:\windows\system32\licmgr10.dll
2011-06-23 18:30 . 2004-08-19 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-06-23 12:05 . 2004-08-19 12:00 385024 ------w- c:\windows\system32\html.iec
2011-06-20 17:44 . 2004-08-19 12:00 293888 ----a-w- c:\windows\system32\winsrv.dll
2011-08-20 16:09 . 2011-08-20 16:09 134104 ----a-w- c:\programmi\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\programmi\Ask.com\GenericAskToolbar.dll" [2011-02-01 1487240]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 -c--a-w- c:\documents and settings\Admin\Dati applicazioni\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 -c--a-w- c:\documents and settings\Admin\Dati applicazioni\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 -c--a-w- c:\documents and settings\Admin\Dati applicazioni\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 -c--a-w- c:\documents and settings\Admin\Dati applicazioni\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IncrediMail"="c:\programmi\IncrediMail\bin\IncMail.exe" [2011-07-20 366024]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="c:\programmi\Kaspersky Lab\Kaspersky Anti-Virus 2011\avp.exe" [2010-11-02 365336]
"QuickTime Task"="c:\programmi\QuickTime\qttask.exe" [2010-11-29 421888]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]
.
c:\documents and settings\Admin\Menu Avvio\Programmi\Esecuzione automatica\
Dropbox.lnk - c:\documents and settings\Admin\Dati applicazioni\Dropbox\bin\Dropbox.exe [2011-5-25 24176560]
.
c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Microsoft Office.lnk - c:\programmi\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 0 (0x0)
"NoFileAssociate"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\IMFservice]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^Corel MEDIA FOLDERS INDEXER 8.LNK]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-09-16 20:04 1164584 -c--a-w- c:\programmi\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-13 17:14 1695232 ------w- c:\programmi\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mxomssmenu]
2006-08-11 09:15 81920 -c--a-w- c:\programmi\Maxtor\OneTouch Status\MaxMenuMgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
2010-07-04 19:51 17408 -c--a-w- c:\programmi\Unlocker\UnlockerAssistant.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2011-05-03 09:12 399736 -c--a-w- c:\programmi\uTorrent\uTorrent.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Advanced SystemCare 4"=c:\programmi\IObit\Advanced SystemCare 4\ASCTray.exe
"FTweakFCleaner"=c:\programmi\FCleaner\FCleaner.exe -a
"ctfmon.exe"=c:\windows\system32\ctfmon.exe
"Google Update"="c:\documents and settings\Admin\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe" /c
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"HP Component Manager"="c:\programmi\HP\hpcoretech\hpcmpmgr.exe"
"HPDJ Taskbar Utility"=c:\windows\system32\spool\drivers\w32x86\3\hpztsb10.exe
"HP Software Update"="c:\programmi\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
"RemoteControl"=c:\programmi\CyberLink\PowerDVD\PDVDServ.exe
"LanguageShortcut"=c:\programmi\CyberLink\PowerDVD\Language\Language.exe
"GrooveMonitor"="f:\office12\GrooveMonitor.exe"
"Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe"
"RTHDCPL"=RTHDCPL.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Programmi\\IncrediMail\\Bin\\IncMail.exe"=
"c:\\Programmi\\IncrediMail\\Bin\\ImApp.exe"=
"c:\\Programmi\\eMule\\emule.exe"=
"c:\\Programmi\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Programmi\\Pinnacle\\Studio 14\\Programs\\Studio.exe"=
"c:\\Programmi\\Kyodai Mahjongg\\kmj.exe"=
"c:\\Programmi\\IncrediMail\\Bin\\ImpCnt.exe"=
"c:\\Documents and Settings\\All Users\\Dati applicazioni\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 2011 11.0.2.556\\it\\setup.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programmi\\uTorrent\\uTorrent.exe"=
"f:\\Office12\\OUTLOOK.EXE"=
"f:\\Office12\\GROOVE.EXE"=
"f:\\Office12\\ONENOTE.EXE"=
"c:\\Programmi\\Microsoft LifeCam\\LifeCam.exe"=
"c:\\Programmi\\Microsoft LifeCam\\LifeEnC2.exe"=
"c:\\Programmi\\Microsoft LifeCam\\LifeExp.exe"=
"c:\\Programmi\\Microsoft LifeCam\\LifeTray.exe"=
"c:\\Programmi\\InCode Solutions\\RemoveIT Pro v4 - SE\\removeit.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\WINDOWS\\network diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\Admin\\Dati applicazioni\\Dropbox\\bin\\Dropbox.exe"=
"c:\\Documents and Settings\\Admin\\Impostazioni locali\\Dati applicazioni\\CrossLoop\\vncviewer.exe"=
"c:\\Documents and Settings\\Admin\\Impostazioni locali\\Dati applicazioni\\CrossLoop\\tvnserver.exe"=
"c:\\Documents and Settings\\Admin\\Impostazioni locali\\Dati applicazioni\\CrossLoop\\CrossLoopConnect.exe"=
"c:\\Programmi\\DownVision\\DownVision.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5910:TCP"= 5910:TCP:vnc5910
.
R1 kl2;kl2;c:\windows\system32\drivers\kl2.sys [09/06/2010 16.43.52 11352]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [09/11/2010 10.36.37 142592]
R2 AdvancedSystemCareService;Advanced SystemCare Service;c:\programmi\IObit\Advanced SystemCare 4\ASCService.exe [27/04/2011 8.42.39 328536]
R2 CrossLoopService;CrossLoop Service;c:\documents and settings\Admin\Impostazioni locali\Dati applicazioni\CrossLoop\CrossLoopService.exe [06/09/2011 8.52.58 563216]
R2 FreemakeUtilsService;Freemake Service;c:\documents and settings\All Users\Dati applicazioni\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [03/09/2011 9.13.42 74240]
R2 IMFservice;IMF Service;c:\programmi\IObit\IObit Malware Fighter\IMFsrv.exe [19/05/2011 8.42.26 821080]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [07/05/2010 11.06.26 32856]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [02/11/2009 19.27.24 19472]
R3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\drivers\nx6000.sys [07/06/2011 18.53.28 30576]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18/03/2010 13.16.28 130384]
S2 gupdate;Servizio di Google Update (gupdate);c:\programmi\Google\Update\GoogleUpdate.exe [02/03/2011 10.12.04 136176]
S3 __FOX__UNI_DRIVER__;__FOX__UNI_DRIVER__; [x]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [11/10/2010 17.25.35 1684736]
S3 FXDrv32;FXDrv32;\??\e:\fxdrv32.sys --> e:\FXDrv32.sys [?]
S3 gupdatem;Servizio Google Update (gupdatem);c:\programmi\Google\Update\GoogleUpdate.exe [02/03/2011 10.12.04 136176]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [25/10/2010 13.39.29 41272]
S3 PAC207;Trust 100K Series Webcam;c:\windows\system32\drivers\PFC027.SYS [13/10/2010 12.14.48 618112]
S3 RegFilter;RegFilter;c:\programmi\IObit\IObit Malware Fighter\Drivers\wxp_x86\RegFilter.sys [10/06/2011 15.51.27 30368]
S3 tvnserver;TightVNC Server;c:\documents and settings\Admin\Impostazioni locali\Dati applicazioni\CrossLoop\tvnserver.exe [06/09/2011 8.52.58 814080]
S3 UrlFilter;UrlFilter;c:\programmi\IObit\IObit Malware Fighter\Drivers\wxp_x86\UrlFilter.sys [10/06/2011 15.51.27 16080]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0; [x]
S4 FileMonitor;FileMonitor;c:\programmi\IObit\IObit Malware Fighter\Drivers\wxp_x86\FileMonitor.sys [10/06/2011 15.51.27 239472]
.
Contenuto della cartella 'Scheduled Tasks'
.
2011-09-12 c:\windows\Tasks\GlaryInitialize.job
- c:\programmi\Glary Utilities\initialize.exe [2011-09-03 07:26]
.
2011-09-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2011-03-02 08:11]
.
2011-09-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2011-03-02 08:11]
.
2011-09-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-854245398-2077806209-682003330-1004Core.job
- c:\documents and settings\Admin\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe [2011-07-31 11:13]
.
2011-09-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-854245398-2077806209-682003330-1004UA.job
- c:\documents and settings\Admin\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe [2011-07-31 11:13]
.
2011-09-12 c:\windows\Tasks\RegistryBooster.job
- c:\programmi\Uniblue\RegistryBooster\rbmonitor.exe [2011-07-28 13:29]
.
2011-09-12 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\programmi\Ask.com\UpdateTask.exe [2011-02-01 17:17]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://news.google.it/nwshp?hl=it&tab=wn
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Free YouTube Download - c:\documents and settings\Admin\Dati applicazioni\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Google Sidewiki... - c:\programmi\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Admin\Dati applicazioni\Mozilla\Firefox\Profiles\od6f3shp.default\
FF - prefs.js: browser.search.defaulturl - hxxp://home.speedbit.com/search.aspx?aff=106&q=
FF - prefs.js: browser.search.selectedEngine - SpeedBit Search
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: keyword.URL - hxxp://home.speedbit.com/search.aspx?aff=106&q=
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
- - - - CHIAVI ORFANE RIMOSSE - - - -
.
SafeBoot-SolutoService
AddRemove-ArcSoft PhotoImpression 3.0 - c:\windows\IsUn0410.exe
AddRemove-Copy Utility - c:\windows\IsUn0410.exe
AddRemove-EPSON Photo Print - c:\windows\IsUn0410.exe
AddRemove-Print Artist - c:\windows\IsUn0410.exe
AddRemove-unInstall AND Route 99 Italia - c:\windows\IsUn0410.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-12 17:52
Windows 5.1.2600 Service Pack 3 NTFS
.
scansione processi nascosti ...
.
scansione entrate autostart nascoste ...
.
Scansione files nascosti ...
.
Scansione completata con successo
Files nascosti: 0
.
**************************************************************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
.
[HKEY_USERS\S-1-5-21-854245398-2077806209-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{CBAB3619-048D-D41B-C2AE-04296B63CAE3}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"oalglijphbkoaiffmgcidnfnnnppdi"=hex:64,61,69,65,70,62,63,68,00,84
"oahhndbbkpmddnapfaiinchbipodgd"=hex:6a,61,6c,65,6b,65,63,6d,69,64,65,65,66,6e,
6a,65,6f,6b,66,62,00,02
"nanfbopkkgmooonoindipkbfgbmh"=hex:6a,61,6c,65,6b,65,63,6d,69,64,65,65,66,6e,
6a,65,6f,6b,66,62,00,02
.
Ora fine scansione: 2011-09-12 17:55:48
ComboFix-quarantined-files.txt 2011-09-12 15:55
.
Pre-Run: 470.933.356.544 byte disponibili
Post-Run: 471.053.950.976 byte disponibili
.
- - End Of File - - 529A059BF052DD02EF6F09AE55D2DD3B

scarica TDSSKiller e salvalo sul desktop

Estrai il contenuto sul desktop.Doppio click sull'exe per avviare l'applicazione e poi su start scan.

Se un file infetto viene trovato,l'azione di default sarà cure,clicca su continua.
Se un file sospetto viene trovato,l'azione di default sarà skip,clicca su continua.
Se ti viene chiesto di riavviare il pc completa il processo.Clicca su riavvia ora.
Se nessun riavvio è richiesto clicca su report e salva il contenuto in un file di testo.
Se un riavvio è richiesto il report si trova in C:\folder in questa forma "TDSSKiller.[Version]_[Date]_[Time]_log.txt"

edit

appena finita la scansione vai in pannello di controllo /installazione applicazioni e controlla se hai Fast Browser Search se presente rimuovilo

ribuongiorno.
Allora...ho riprovato di nuovo a fare l'installazione di un gioco (375 mb). Normalmente non parte (cartella scarico..dove è salvato l' exe...non risponde ) Mi fa sparire tutto dal desktop...dopo un po riappare tutto.
Ho disattivato l'antivirus per 15 min......rieseguito l'exe...ed è partito subito...e installato normalmante.
Siccome mi sta scadendo la licenza di Kaspersky...volevo chiedere se vale la pena rinnovarla o usare qualcos' altro
Grazie

dimenticavo....fast browser search...non è presente.

Allora...ho fatto CFScript.txt...lo metto sull'icona di combofix...parte e dopo un po mi dice nome ortograficamente non corretto
cosa faccio?????? (scritto come sopra da te evidenziato )

chiedo scusa...errore mio.
fatto...ecco il log
ComboFix 11-09-13.02 - Admin 13/09/2011 17.16.15.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.39.1040.18.2037.1332 [GMT 2:00]
Eseguito da: c:\documents and settings\Admin\Desktop\ComboFix.exe
Opzioni usate :: c:\documents and settings\Admin\Desktop\CFScript.txt
AV: Kaspersky Anti-Virus *Disabled/Updated* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Anti-Virus *Disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.
ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.
FILE ::
"c:\programmi\Ask.com\GenericAskToolbar.dll"
"c:\programmi\Ask.com\UpdateTask.exe"
"c:\windows\Tasks\Scheduled Update for Ask Toolbar.job"
.
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programmi\Ask.com
c:\programmi\Ask.com\assets\oobe\b.png
c:\programmi\Ask.com\assets\oobe\bl.png
c:\programmi\Ask.com\assets\oobe\br.png
c:\programmi\Ask.com\assets\oobe\l.png
c:\programmi\Ask.com\assets\oobe\pointer.png
c:\programmi\Ask.com\assets\oobe\r.png
c:\programmi\Ask.com\assets\oobe\t.png
c:\programmi\Ask.com\assets\oobe\tl.png
c:\programmi\Ask.com\assets\oobe\tr.png
c:\programmi\Ask.com\cobrand.ico
c:\programmi\Ask.com\config.xml
c:\programmi\Ask.com\favicon.ico
c:\programmi\Ask.com\fv_2c.ico
c:\programmi\Ask.com\GenericAskToolbar.dll
c:\programmi\Ask.com\mupcfg.xml
c:\programmi\Ask.com\SaUpdate.exe
c:\programmi\Ask.com\UpdateTask.exe
c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
.
.
((((((((((((((((((((((((( Files Creati Da 2011-08-13 al 2011-09-13 )))))))))))))))))))))))))))))))))))
.
.
2011-09-12 15:14 . 2011-09-12 15:24 -------- dc----w- c:\programmi\FindyKill
2011-09-12 07:46 . 2011-09-12 07:46 -------- dc----w- c:\programmi\VirusTotalUploader2
2011-09-11 15:19 . 2011-09-11 15:19 25992 ----a-w- c:\windows\system32\pgdfgsvc.exe
2011-09-11 07:45 . 2011-09-11 07:45 -------- dc----w- c:\programmi\ImTOO
2011-09-07 12:58 . 2011-09-07 12:58 -------- dc----w- c:\programmi\File comuni\ANDShared
2011-09-07 12:58 . 2011-09-07 13:01 -------- dc----w- C:\R99itITA
2011-09-07 09:27 . 2011-09-07 09:27 -------- dc----w- c:\programmi\File comuni\SWiSHzone.com
2011-09-07 09:27 . 2011-09-07 09:33 -------- dc----w- c:\programmi\SWiSH Max3
2011-09-07 09:18 . 2011-09-07 09:20 -------- dc----w- c:\programmi\DownVision
2011-09-06 14:39 . 2011-09-06 14:39 -------- dc----w- c:\documents and settings\Admin\Dati applicazioni\gtk-2.0
2011-09-06 14:39 . 2011-09-06 14:39 -------- dc----w- c:\documents and settings\Admin\.thumbnails
2011-09-06 14:30 . 2011-09-06 14:43 -------- dc----w- c:\documents and settings\Admin\.gimp-2.6
2011-09-06 14:20 . 2011-09-06 14:20 -------- dc----w- c:\documents and settings\Admin\Dati applicazioni\AntsSoft
2011-09-06 06:53 . 2011-09-06 06:53 -------- dc----w- c:\documents and settings\LocalService\Dati applicazioni\TightVNC
2011-09-06 06:52 . 2011-09-12 16:22 -------- dc----w- c:\documents and settings\Admin\Impostazioni locali\Dati applicazioni\CrossLoop
2011-09-04 09:13 . 2011-09-04 09:17 -------- dc----w- c:\documents and settings\All Users\Dati applicazioni\SpeedBit
2011-09-04 09:13 . 2011-09-04 09:13 -------- dc----w- c:\programmi\File comuni\SpeedBit
2011-09-04 09:13 . 2011-09-04 09:13 84480 ----a-w- c:\windows\system32\EasyHook32.dll
2011-09-04 09:13 . 2011-09-04 09:13 109216 ----a-w- c:\windows\system32\EasyHook64.dll
2011-09-04 09:13 . 2011-09-04 09:18 -------- dc----w- c:\programmi\DAP
2011-09-04 09:09 . 2011-09-04 09:09 -------- dc----w- c:\programmi\SAVERS4FREE.COM
2011-09-03 10:17 . 2011-09-03 10:17 603136 -c----w- c:\windows\system32\dllcache\crypt32.dll
2011-09-03 07:42 . 2011-09-03 07:42 -------- dc----w- c:\programmi\Glary Utilities
2011-09-02 07:27 . 2011-09-13 11:59 -------- dc----w- C:\TEMP
2011-08-31 09:34 . 2011-08-31 09:34 -------- dc----w- c:\documents and settings\All Users\Dati applicazioni\casualArts
2011-08-31 09:34 . 2011-08-31 09:34 -------- dc----w- c:\documents and settings\Admin\Dati applicazioni\casualArts
2011-08-31 06:31 . 2011-08-31 17:50 -------- dc----w- c:\programmi\Sandboxie
2011-08-28 14:04 . 2011-08-28 14:04 -------- dc----w- c:\programmi\File comuni\Logishrd
2011-08-28 14:03 . 2011-08-28 14:03 -------- dc----w- c:\programmi\Logitech
2011-08-26 18:03 . 2011-08-26 18:04 -------- dc----w- c:\documents and settings\All Users\Dati applicazioni\DVD Shrink
2011-08-25 17:00 . 2011-08-25 17:00 -------- dc----w- c:\documents and settings\Admin\Dati applicazioni\GlarySoft
2011-08-25 11:12 . 1997-06-03 07:31 108032 ------w- c:\windows\system32\sh33w32.dll
2011-08-25 07:15 . 2011-08-26 17:54 -------- dc----w- c:\programmi\DVD Cutter Plus
2011-08-25 06:49 . 2011-08-25 07:19 -------- dc----w- c:\programmi\AVS4YOU
2011-08-24 17:07 . 2011-08-24 17:07 -------- dc----w- c:\documents and settings\Admin\Dati applicazioni\HillStoneAnimationStudios
2011-08-23 09:56 . 2011-08-23 09:56 -------- d-----w- c:\windows\system32\wbem\Repository
2011-08-23 09:55 . 2011-08-23 09:55 -------- d-----w- c:\windows\The Curse of the Ring
2011-08-23 09:55 . 2011-08-23 09:55 -------- d-----w- c:\windows\Robin's Quest
2011-08-23 09:55 . 2011-08-23 09:55 -------- d-----w- c:\windows\Spirit Seasons
2011-08-23 09:55 . 2011-08-23 09:55 -------- d-----w- c:\windows\Mystic Gateways The Celestial Quest
2011-08-23 09:55 . 2011-08-23 09:55 -------- d-----w- c:\windows\Mystery of Mortlake Mansion
2011-08-23 09:55 . 2011-08-23 09:55 -------- d-----w- c:\windows\Eternal Night - Realm of Souls
2011-08-23 09:55 . 2011-08-23 09:55 -------- d-----w- c:\programmi\Nightmare Realm Collector's Edition
2011-08-23 09:54 . 2011-08-23 09:54 -------- d-----w- c:\windows\Between the Worlds
2011-08-23 09:54 . 2011-08-23 09:54 -------- d-----w- c:\windows\Downtown Secrets
2011-08-23 09:54 . 2011-08-23 09:54 -------- d-----w- c:\windows\Dominic Crane 2 - Dark Mystery Revealed
2011-08-23 08:46 . 2011-08-23 09:54 -------- dc----w- c:\programmi\TuneUp Utilities 2011
2011-08-22 11:23 . 2011-08-22 11:23 -------- dc----w- c:\programmi\VS Revo Group
2011-08-18 08:41 . 2011-08-18 08:41 -------- dc----w- c:\programmi\Digital Photo Software
2011-08-17 17:52 . 2011-08-17 17:52 -------- dc----w- c:\documents and settings\All Users\Dati applicazioni\Fenomen Games
2011-08-16 17:32 . 2011-08-16 17:32 -------- dc----w- c:\programmi\iWebAlbum
2011-08-15 10:30 . 2011-08-15 13:22 -------- dc----w- c:\documents and settings\Admin\Dati applicazioni\XnView
2011-08-15 10:30 . 2011-08-15 10:30 -------- dc----w- c:\programmi\XnView
2011-08-15 06:50 . 2011-08-15 07:08 -------- dc----w- c:\documents and settings\Admin\Dati applicazioni\Anvsoft
2011-08-15 06:50 . 2011-08-15 07:06 -------- dc----w- c:\programmi\AnvSoft
2011-08-14 17:12 . 2011-08-14 17:15 -------- dc----w- c:\programmi\Notepad++
2011-08-14 17:12 . 2011-08-14 17:15 -------- dc----w- c:\documents and settings\Admin\Dati applicazioni\Notepad++
2011-08-14 16:33 . 2011-08-14 16:33 -------- dc----w- c:\documents and settings\All Users\Dati applicazioni\WinMaximizer
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-03 10:17 . 2004-08-19 12:00 603136 ----a-w- c:\windows\system32\crypt32.dll
2011-07-15 13:29 . 2004-08-19 12:00 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2004-08-19 12:00 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2011-07-06 17:52 . 2010-10-25 11:39 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 17:52 . 2010-10-25 11:39 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-06-24 14:10 . 2010-10-11 15:09 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-23 18:30 . 2004-08-19 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2011-06-23 18:30 . 2004-08-19 12:00 43520 ------w- c:\windows\system32\licmgr10.dll
2011-06-23 18:30 . 2004-08-19 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-06-23 12:05 . 2004-08-19 12:00 385024 ------w- c:\windows\system32\html.iec
2011-06-20 17:44 . 2004-08-19 12:00 293888 ----a-w- c:\windows\system32\winsrv.dll
2011-08-20 16:09 . 2011-08-20 16:09 134104 ----a-w- c:\programmi\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 -c--a-w- c:\documents and settings\Admin\Dati applicazioni\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 -c--a-w- c:\documents and settings\Admin\Dati applicazioni\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 -c--a-w- c:\documents and settings\Admin\Dati applicazioni\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 -c--a-w- c:\documents and settings\Admin\Dati applicazioni\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IncrediMail"="c:\programmi\IncrediMail\bin\IncMail.exe" [2011-07-20 366024]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="c:\programmi\Kaspersky Lab\Kaspersky Anti-Virus 2011\avp.exe" [2010-11-02 365336]
"QuickTime Task"="c:\programmi\QuickTime\qttask.exe" [2010-11-29 421888]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]
.
c:\documents and settings\Admin\Menu Avvio\Programmi\Esecuzione automatica\
Dropbox.lnk - c:\documents and settings\Admin\Dati applicazioni\Dropbox\bin\Dropbox.exe [2011-5-25 24176560]
.
c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Microsoft Office.lnk - c:\programmi\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 0 (0x0)
"NoFileAssociate"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\IMFservice]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^Corel MEDIA FOLDERS INDEXER 8.LNK]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-09-16 20:04 1164584 -c--a-w- c:\programmi\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-13 17:14 1695232 ------w- c:\programmi\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mxomssmenu]
2006-08-11 09:15 81920 -c--a-w- c:\programmi\Maxtor\OneTouch Status\MaxMenuMgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
2010-07-04 19:51 17408 -c--a-w- c:\programmi\Unlocker\UnlockerAssistant.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2011-05-03 09:12 399736 -c--a-w- c:\programmi\uTorrent\uTorrent.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Advanced SystemCare 4"=c:\programmi\IObit\Advanced SystemCare 4\ASCTray.exe
"FTweakFCleaner"=c:\programmi\FCleaner\FCleaner.exe -a
"ctfmon.exe"=c:\windows\system32\ctfmon.exe
"Google Update"="c:\documents and settings\Admin\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe" /c
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"HP Component Manager"="c:\programmi\HP\hpcoretech\hpcmpmgr.exe"
"HPDJ Taskbar Utility"=c:\windows\system32\spool\drivers\w32x86\3\hpztsb10.exe
"HP Software Update"="c:\programmi\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
"RemoteControl"=c:\programmi\CyberLink\PowerDVD\PDVDServ.exe
"LanguageShortcut"=c:\programmi\CyberLink\PowerDVD\Language\Language.exe
"GrooveMonitor"="f:\office12\GrooveMonitor.exe"
"Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe"
"RTHDCPL"=RTHDCPL.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Programmi\\IncrediMail\\Bin\\IncMail.exe"=
"c:\\Programmi\\IncrediMail\\Bin\\ImApp.exe"=
"c:\\Programmi\\eMule\\emule.exe"=
"c:\\Programmi\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Programmi\\Pinnacle\\Studio 14\\Programs\\Studio.exe"=
"c:\\Programmi\\Kyodai Mahjongg\\kmj.exe"=
"c:\\Programmi\\IncrediMail\\Bin\\ImpCnt.exe"=
"c:\\Documents and Settings\\All Users\\Dati applicazioni\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 2011 11.0.2.556\\it\\setup.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programmi\\uTorrent\\uTorrent.exe"=
"f:\\Office12\\OUTLOOK.EXE"=
"f:\\Office12\\GROOVE.EXE"=
"f:\\Office12\\ONENOTE.EXE"=
"c:\\Programmi\\Microsoft LifeCam\\LifeCam.exe"=
"c:\\Programmi\\Microsoft LifeCam\\LifeEnC2.exe"=
"c:\\Programmi\\Microsoft LifeCam\\LifeExp.exe"=
"c:\\Programmi\\Microsoft LifeCam\\LifeTray.exe"=
"c:\\Programmi\\InCode Solutions\\RemoveIT Pro v4 - SE\\removeit.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\WINDOWS\\network diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\Admin\\Dati applicazioni\\Dropbox\\bin\\Dropbox.exe"=
"c:\\Documents and Settings\\Admin\\Impostazioni locali\\Dati applicazioni\\CrossLoop\\vncviewer.exe"=
"c:\\Documents and Settings\\Admin\\Impostazioni locali\\Dati applicazioni\\CrossLoop\\tvnserver.exe"=
"c:\\Documents and Settings\\Admin\\Impostazioni locali\\Dati applicazioni\\CrossLoop\\CrossLoopConnect.exe"=
"c:\\Programmi\\DownVision\\DownVision.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5910:TCP"= 5910:TCP:vnc5910
.
R1 kl2;kl2;c:\windows\system32\drivers\kl2.sys [09/06/2010 16.43.52 11352]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [09/11/2010 10.36.37 142592]
R2 AdvancedSystemCareService;Advanced SystemCare Service;c:\programmi\IObit\Advanced SystemCare 4\ASCService.exe [27/04/2011 8.42.39 328536]
R2 CrossLoopService;CrossLoop Service;c:\documents and settings\Admin\Impostazioni locali\Dati applicazioni\CrossLoop\CrossLoopService.exe [06/09/2011 8.52.58 563216]
R2 FreemakeUtilsService;Freemake Service;c:\documents and settings\All Users\Dati applicazioni\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [03/09/2011 9.13.42 74240]
R2 IMFservice;IMF Service;c:\programmi\IObit\IObit Malware Fighter\IMFsrv.exe [19/05/2011 8.42.26 821080]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [07/05/2010 11.06.26 32856]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [02/11/2009 19.27.24 19472]
R3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\drivers\nx6000.sys [07/06/2011 18.53.28 30576]
R4 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [25/10/2010 13.39.29 41272]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18/03/2010 13.16.28 130384]
S2 gupdate;Servizio di Google Update (gupdate);c:\programmi\Google\Update\GoogleUpdate.exe [02/03/2011 10.12.04 136176]
S3 __FOX__UNI_DRIVER__;__FOX__UNI_DRIVER__; [x]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [11/10/2010 17.25.35 1684736]
S3 FXDrv32;FXDrv32;\??\e:\fxdrv32.sys --> e:\FXDrv32.sys [?]
S3 gupdatem;Servizio Google Update (gupdatem);c:\programmi\Google\Update\GoogleUpdate.exe [02/03/2011 10.12.04 136176]
S3 PAC207;Trust 100K Series Webcam;c:\windows\system32\drivers\PFC027.SYS [13/10/2010 12.14.48 618112]
S3 RegFilter;RegFilter;c:\programmi\IObit\IObit Malware Fighter\Drivers\wxp_x86\RegFilter.sys [10/06/2011 15.51.27 30368]
S3 tvnserver;TightVNC Server;c:\documents and settings\Admin\Impostazioni locali\Dati applicazioni\CrossLoop\tvnserver.exe [06/09/2011 8.52.58 814080]
S3 UrlFilter;UrlFilter;c:\programmi\IObit\IObit Malware Fighter\Drivers\wxp_x86\UrlFilter.sys [10/06/2011 15.51.27 16080]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0; [x]
S4 FileMonitor;FileMonitor;c:\programmi\IObit\IObit Malware Fighter\Drivers\wxp_x86\FileMonitor.sys [10/06/2011 15.51.27 239472]
.
Contenuto della cartella 'Scheduled Tasks'
.
2011-09-13 c:\windows\Tasks\GlaryInitialize.job
- c:\programmi\Glary Utilities\initialize.exe [2011-09-03 07:26]
.
2011-09-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2011-03-02 08:11]
.
2011-09-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2011-03-02 08:11]
.
2011-09-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-854245398-2077806209-682003330-1004Core.job
- c:\documents and settings\Admin\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe [2011-07-31 11:13]
.
2011-09-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-854245398-2077806209-682003330-1004UA.job
- c:\documents and settings\Admin\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe [2011-07-31 11:13]
.
2011-09-13 c:\windows\Tasks\RegistryBooster.job
- c:\programmi\Uniblue\RegistryBooster\rbmonitor.exe [2011-07-28 13:29]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://news.google.it/nwshp?hl=it&tab=wn
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Free YouTube Download - c:\documents and settings\Admin\Dati applicazioni\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Google Sidewiki... - c:\programmi\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Admin\Dati applicazioni\Mozilla\Firefox\Profiles\od6f3shp.default\
FF - prefs.js: browser.search.defaulturl - hxxp://home.speedbit.com/search.aspx?aff=106&q=
FF - prefs.js: browser.search.selectedEngine - SpeedBit Search
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: keyword.URL - hxxp://home.speedbit.com/search.aspx?aff=106&q=
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-13 17:28
Windows 5.1.2600 Service Pack 3 NTFS
.
scansione processi nascosti ...
.
scansione entrate autostart nascoste ...
.
Scansione files nascosti ...
.
Scansione completata con successo
Files nascosti: 0
.
**************************************************************************
.
Ora fine scansione: 2011-09-13 17:31:02
ComboFix-quarantined-files.txt 2011-09-13 15:30
.
Pre-Run: 470.293.626.880 byte disponibili
Post-Run: 470.334.402.560 byte disponibili
.
- - End Of File - - B705F8B1457205B5336DD972A760A6E6


sto facendo l'altro ...appena fatto lo invio

Scilipoti siamo quasi alla fine ma vorrei darti un consiglio, meglio se rimuoviamo quel programma (gioco) cinese Kyodai Mahjongg il suo eseguibile sembrerebbe essere poco sicuro

rimuovi la versione di firefox che hai installata e scarica la piu' recente che puoi scaricare anche da qui


Installa Ccleaner

ccleaner

durante l’installazione deseleziona l’opzione per la barra di Yahoo, lo apri, vai in Opzioni>Avanzate, togli la spunta a “Cancella file temp diwindows solo se più vecchi di 48 ore”, poi avvialo, seleziona "Analizza" ed alla fine dell'analisi premi "Avvia pulizia''


clicca su Registro, nella pagina successiva clicca Trova problemi, poi al termine dello scan clicca su Ripara selezionati , risposndi di sì alla richiesta di salvare il backup (salvalo in una cartella a piacimento) poi ripara tutti gli elementi trovati.

scarica atf cleaner

non ha bisogno di installazione

Avvia ATF Cleaner.exe con un doppio click
- clicca sul menu main
- seleziona la casella Select All
- clicca sul pulsante Empty selected
- aspetta l'avviso Done Cleaning.
(se non vuoi eliminare le password togli la spunta)
(se usi opera o firefox,spunta anche le loro sezioni)

Apri il block notes di windows e copia e incolla questo (senza il code mi racomando)




Salva il file nella stessa posizione dove è presente combofix.exe e chiamalo CFScript.txt
Adesso trascina il file CFScript.txt su combofix.exe
Riavvia il pc se ti viene richiesto dal programma.
Riavvia e posta il contenuto del file C:\ComboFix.txt

ciao r16 avevo gia' visto quel FXDrv32 ma come al solito ci sono opinioni discordanti leggi qui

per le altre vorrei farle disinstallare alla fine