ok grazie, intanto dico che era una mia fissazione perche' mi era rimasto il dubbio se avevo fatto bene a cancellare quelle voci al nr 17(ma anche in rete si parla di cambio di dns, domain ecc ecc), infatti tolte scritte e ip e' sparito il reindirizzamento su' rapidns(infatti rapiDNS, Finisce con dns e non a caso).

ok adesso faro' quello che mi hai consigliato, una domanda; che differenza c'e' tra fixare ed eliminare con HJ?


edit; con Hj ho fixato la prima voce, tutto ok, ma le altre 3(quelle da cancellare) non si cancellano, sono le ultime 3 voci dell'elenco, le ultime 23.

ora scarica l'altro programma

hai scritto mentre editavo, cmq ho fixato la prima voce, ma le altre tre non si cancellano(le ultime 3 voci dell'elenco), vedendo in rete, anche se voci diverse, molti utenti hanno problemi ad eliminare le voci nr23.

cmq ora scarico l'altro programma.


HO I 2 LOG che devo caricare su wikisend, poi cosa succede, li devo postare?

vado a cricare i due .txt e mi da' errore, provo con firefox-

allora ho caricato il file extra su wikisend, ti metto tutti e due i link che mi ha dato

http://wikisend.com/download/331018/Extras.Txt

Extras.Txt">Extras.Txt

ora cerco di caricare l'altro .txt

questo e' download link; http://wikisend.com/download/200064/OTL.Txt


questo e' forum link(la stessa cosa sopra

OTL.Txt">OTL.Txt


tanto il primo e secondo link di ogni file caricato portano alla stessa pagina.

adesso apri otl e copia sotto "Custom Scans\Fixes" questo codice (non copiare Code:)






premi RUN FIX e allega il log che rilascia

fai anche una scansione con combofix scaricalo sil desktop (non installare la recovery console quando te lo chiede)
Lascia lavorare il programma senza interferire
Allega il rapporto C:\ComboFix.txt nella tua risposta.

ecco il file di combo; ma adesso in C// c'ho tante cartelle, prima ne avevo solo 3, combo va disinstallato? fa' impressione questo programma


ComboFix 12-10-18.03 - Fabio 19/10/2012 15:11:20.1.2 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.39.1040.18.1013.280 [GMT 2:00]
Eseguito da: c:\users\Fabio\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}
SP: Microsoft Security Essentials *Disabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\100
c:\programdata\AMMYY
c:\programdata\AMMYY\hr
c:\programdata\AMMYY\hr3
c:\programdata\AMMYY\settings3.bin
c:\users\Fabio\AppData\Local\unins000.exe
c:\windows\XSxS
.
.
((((((((((((((((((((((((( Files Creati Da 2012-09-19 al 2012-10-19 )))))))))))))))))))))))))))))))))))
.
.
2012-10-19 13:23 . 2012-10-19 13:24 -------- d-----w- c:\users\Fabio\AppData\Local\temp
2012-10-19 13:23 . 2012-10-19 13:23 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-10-19 12:56 . 2012-10-12 05:56 6918632 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7AA046EA-D847-47DF-9D0E-37855CF01991}\mpengine.dll
2012-10-19 12:26 . 2012-08-30 08:17 6980552 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-10-18 08:36 . 2010-03-09 00:04 -------- d-----w- c:\program files\REG
2012-10-18 08:36 . 2012-07-08 20:40 -------- d-----w- c:\program files\SKIN
2012-10-18 08:36 . 2012-09-21 22:14 -------- d-----w- c:\program files\pl
2012-10-18 08:36 . 2012-06-09 15:51 -------- d-----w- c:\program files\LENG
2012-10-17 15:18 . 2012-10-17 15:18 -------- d-----w- c:\program files\TVdream
2012-10-17 12:06 . 2012-09-24 21:16 93672 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-10-17 09:28 . 2012-10-17 09:28 -------- d-----w- c:\program files\Mozilla Maintenance Service
2012-10-15 16:09 . 2012-10-19 12:25 -------- d-----w- c:\users\Fabio\AppData\Local\PowerOffer
2012-10-15 16:09 . 2012-10-19 12:25 -------- d-----w- c:\users\Fabio\AppData\Local\ServUpdater
2012-10-15 16:09 . 2012-10-19 12:25 -------- d-----w- c:\users\Fabio\AppData\Local\PosService
2012-10-15 15:59 . 2012-10-15 16:00 -------- d-----w- c:\users\Fabio\AppData\Local\Songr
2012-10-15 15:57 . 2012-10-19 12:25 -------- d-----w- c:\users\Fabio\AppData\Local\SoftwareUpdater
2012-10-10 07:40 . 2012-08-24 16:57 172544 ----a-w- c:\windows\system32\wintrust.dll
2012-10-10 07:38 . 2012-06-02 04:36 140288 ----a-w- c:\windows\system32\cryptsvc.dll
2012-10-10 07:38 . 2012-06-02 04:36 1159680 ----a-w- c:\windows\system32\crypt32.dll
2012-10-10 07:38 . 2012-06-02 04:36 103936 ----a-w- c:\windows\system32\cryptnet.dll
2012-10-10 07:38 . 2012-08-31 17:18 1211760 ----a-w- c:\windows\system32\drivers\ntfs.sys
2012-10-10 07:38 . 2012-08-10 23:56 542208 ----a-w- c:\windows\system32\kerberos.dll
2012-10-10 07:38 . 2012-08-30 17:12 3914096 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-10-10 07:38 . 2012-08-30 17:12 3968880 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-10-09 15:55 . 2012-10-09 15:55 -------- d-----w- c:\users\Fabio\AppData\Roaming\Groovedown_Uninstall
2012-10-05 14:58 . 2012-10-03 10:50 740784 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{91FAD3C6-AB09-497E-A6D9-A1459EF25001}\gapaengine.dll
2012-09-30 09:46 . 2012-09-30 09:56 -------- d-----w- c:\users\Fabio\AppData\Local\Riot
2012-09-30 09:45 . 2012-09-30 09:45 -------- d-----w- c:\program files\Riot
2012-09-26 07:51 . 2012-08-21 20:12 245760 ----a-w- c:\windows\system32\OxpsConverter.exe
2012-09-21 10:44 . 2012-09-21 10:44 -------- d-----w- c:\programdata\Motive
2012-09-21 10:43 . 2010-09-20 10:13 69632 ----a-w- c:\windows\system32\MCCDevice.dll
2012-09-21 10:43 . 2010-09-20 10:13 6048 ----a-w- c:\windows\system32\MCC16.dll
2012-09-21 10:43 . 2012-09-21 10:44 -------- d-----w- c:\program files\Common Files\Motive
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-09 15:47 . 2012-04-04 07:38 696760 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-10-09 15:47 . 2011-12-11 11:09 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-10-03 10:50 . 2012-02-10 22:00 740784 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2012-09-07 15:04 . 2012-06-23 08:43 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-08-31 10:27 . 2012-08-15 07:51 821736 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-08-31 10:27 . 2011-12-24 12:15 746984 ----a-w- c:\windows\system32\deployJava1.dll
2012-08-30 20:03 . 2012-08-30 20:03 193552 ----a-w- c:\windows\system32\drivers\MpFilter.sys
2012-08-30 20:03 . 2011-04-27 14:25 99272 ----a-w- c:\windows\system32\drivers\NisDrvWFP.sys
2012-08-22 17:16 . 2012-09-12 10:30 1292144 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-08-22 17:16 . 2012-09-12 10:30 712048 ----a-w- c:\windows\system32\drivers\ndis.sys
2012-08-22 17:16 . 2012-09-12 10:30 240496 ----a-w- c:\windows\system32\drivers\netio.sys
2012-08-22 17:16 . 2012-09-12 10:30 187760 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2012-08-02 16:57 . 2012-09-12 10:30 490496 ----a-w- c:\windows\system32\d3d10level9.dll
2012-10-11 01:05 . 2012-10-17 09:27 261600 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
"Memory Cleaner"="c:\users\Fabio\AppData\Roaming\KoshyJohn.com\MemClean\MemClean.exe" [2011-12-06 785489]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 150552]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-10-06 7772704]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2011-03-31 2221352]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 947176]
"MGSysCtrl"="c:\program files\System Control Manager\MGSysCtrl.exe" [2009-11-06 2244608]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-07-27 20:51 919008 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\B2C_AGENT]
2012-03-28 00:53 404568 ----a-w- c:\programdata\LGMOBILEAX\B2C_Client\B2CNotiAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LG LinkAir]
2011-11-16 22:18 2450288 ----a-w- c:\program files\LG Electronics\LG PC Suite IV\LinkAir\LinkAir.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2012-07-03 07:04 252848 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
R1 MpKsl4c47a63f;MpKsl4c47a63f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{3B289B99-43CC-436A-A5AA-81B2CB6BDBB5}\MpKsl4c47a63f.sys [x]
R2 gupdate;Servizio Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [x]
R2 PowerOffer Service;Pos Service;c:\users\Fabio\AppData\Local\PosService\Pos.exe [x]
R2 ServUpdater;Serv Updater;c:\users\Fabio\AppData\Local\ServUpdater\ServiceUpd.exe [x]
R2 SoftwareUpd;Software Upd;c:\users\Fabio\AppData\Local\SoftwareUpdater\SoftwareUpdService.exe [x]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
R3 Andbus;LGE Android Platform Composite USB Device;c:\windows\system32\DRIVERS\lgandbus.sys [x]
R3 AndDiag;LGE Android Platform USB Serial Port;c:\windows\system32\DRIVERS\lganddiag.sys [x]
R3 AndGps;LGE Android Platform USB GPS NMEA Port;c:\windows\system32\DRIVERS\lgandgps.sys [x]
R3 ANDModem;LGE Android Platform USB Modem;c:\windows\system32\DRIVERS\lgandmodem.sys [x]
R3 androidusb;ADB Interface Driver;c:\windows\system32\Drivers\lgandadb.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [x]
R3 gupdatem;Servizio Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [x]
R3 LGVMODEM;LGE Virtual Modem;c:\windows\system32\DRIVERS\lgvmodem.sys [x]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [x]
R3 MSILiveVirtualCamera;MSI Live Virtual Camera;c:\windows\system32\DRIVERS\MSILiveVirtualCamera.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 pneteth;PdaNet Broadband;c:\windows\system32\DRIVERS\pneteth.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 UsbGps;LGE Mobile USB GPS NMEA Port;c:\windows\system32\DRIVERS\lgusbgps.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Servizio Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]
S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x32.sys [x]
S2 Micro Star SCM;Micro Star SCM;c:\program files\System Control Manager\MSIService.exe [x]
S3 LgBttPort;LGE Bluetooth TransPort;c:\windows\system32\DRIVERS\lgbtport.sys [x]
S3 lgbusenum;LG Bluetooth Bus Enumerator;c:\windows\system32\DRIVERS\lgbtbus.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x]
.
.
Contenuto della cartella 'Scheduled Tasks'
.
2012-10-19 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 15:47]
.
2012-10-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-10-15 17:53]
.
2012-10-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-10-15 17:53]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.yahoo.it/
uInternet Settings,ProxyOverride = *.local
IE: Download ALL with IDA
IE: Download remotely with IDA
IE: Download with IDA
IE: Download with IDM - c:\users\Fabio\Downloads\IDM.v6.08.9\Internet Download Manager v6.08.9\Crack\IEExt.htm
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000
IE: I&nvia a OneNote - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105
IE: LG Air Sync (R-Click) - Save as Mobile Image - c:\program files\LG Electronics\LG PC Suite IV\LinkAir\IEContextMenu.dll/206
IE: LG Air Sync (R-Click) - Save as Mobile Memo - c:\program files\LG Electronics\LG PC Suite IV\LinkAir\IEContextMenu.dll/208
IE: LG Air Sync (R-Click) - Save as Mobile Text file - c:\program files\LG Electronics\LG PC Suite IV\LinkAir\IEContextMenu.dll/210
IE: LG Air Sync (R-Click) - Set as Mobile Wallpaper - c:\program files\LG Electronics\LG PC Suite IV\LinkAir\IEContextMenu.dll/205
IE: LG Air Sync Option - c:\program files\LG Electronics\LG PC Suite IV\LinkAir\IEContextMenu.dll/209
IE: Scarica con Mipony - file://c:\program files\MiPony\Browser\IEContext.htm
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{63343655-A0C6-4728-922E-DE5176C57507}: DhcpNameServer = 192.168.1.1
DPF: {4EC99A0B-E57C-4FBE-B9C4-8428424FBF88} - hxxp://77.238.10.101/security/services/static/McciInstaller.cab
FF - ProfilePath - c:\users\Fabio\AppData\Roaming\Mozilla\Firefox\Profiles\yf2dozaf.default\
FF - prefs.js: browser.startup.homepage - www.yahoo.it
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - ExtSQL: 2012-10-16 14:36; translator@zoli.bod; c:\users\Fabio\AppData\Roaming\Mozilla\Firefox\Profiles\yf2dozaf.default\extensions\translator@zoli.bod.xpi
FF - ExtSQL: 2012-10-16 14:37; artur.dubovoy@gmail.com; c:\users\Fabio\AppData\Roaming\Mozilla\Firefox\Profiles\yf2dozaf.default\extensions\artur.dubovoy@gmail.com.xpi
FF - ExtSQL: 2012-10-16 14:37; {64161300-e22b-11db-8314-0800200c9a66}; c:\users\Fabio\AppData\Roaming\Mozilla\Firefox\Profiles\yf2dozaf.default\extensions\{64161300-e22b-11db-8314-0800200c9a66}.xpi
.
- - - - CHIAVI ORFANE RIMOSSE - - - -
.
Toolbar-10 - (no file)
HKCU-Run-fsm - (no file)
HKCU-Run-LG LinkAir - (no file)
MSConfigStartUp-APSDaemon - c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
MSConfigStartUp-Google Update - c:\users\Fabio\AppData\Local\Google\Update\GoogleUpdate.exe
MSConfigStartUp-IDMan - c:\program files\Internet Download Manager\IDMan.exe
MSConfigStartUp-iTunesHelper - c:\program files\iTunes\iTunesHelper.exe
MSConfigStartUp-NokiaSuite - c:\program files\Nokia\Nokia Suite\NokiaSuite.exe
MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
AddRemove-{0B500125-92A7-40BF-ACF0-45A9221ADE21}_is1 - c:\users\Fabio\AppData\Local\unins000.exe
.
.
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
.
[HKEY_USERS\S-1-5-21-927511499-2580095553-3253916930-1001_Classes\CLSID\{4a75f2df-1b92-4305-9f12-97b774d52ed6}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"Model"=dword:0000002c
"Therad"=dword:00000014
.
[HKEY_USERS\S-1-5-21-927511499-2580095553-3253916930-1001_Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"scansk"=hex(0):9d,24,6b,fb,7f,08,2d,12,cd,a5,3e,18,a2,4d,dc,bf,f2,0c,08,eb,38,
16,a8,77,10,c9,04,10,ae,30,cc,ef,f4,30,10,4b,13,80,e9,6c,00,00,00,00,00,00,\
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Ora fine scansione: 2012-10-19 15:29:14
ComboFix-quarantined-files.txt 2012-10-19 13:29
.
Pre-Run: 19.149.361.152 byte disponibili
Post-Run: 18.981.826.560 byte disponibili
.
- - End Of File - - B042875FB63E880EF9E1C61DC179F9DB

lancio otl e faccio quelle operazioni con i file che ho uppato su wikisend, poi lancio sempre lo stesso exe e ci metto il codice che hai scritto(ho provato sia lasciando la configuazione di default che quella che mi hai dato prima), alla fine(dopo 2 secondi) mi si richiede di fare il reeboot, riavvio ma nessun log.

ma devo prima riuppare i file su wikisend?

in c non c'e' nulla, cosa intendi per prima? metto direttamente il codice oppure riuppo i file in wikisend?

ecco il log nella cartella otl in C


========== OTL ==========
No active process named PService.exe was found!
Service SoftwareUpd stopped successfully!
Service SoftwareUpd deleted successfully!
C:\Users\Fabio\AppData\Local\SoftwareUpdater\SoftwareUpdService.exe moved successfully.
Service PowerOffer Service stopped successfully!
Service PowerOffer Service deleted successfully!
C:\Users\Fabio\AppData\Local\PosService\Pos.exe moved successfully.
Service ServUpdater stopped successfully!
Service ServUpdater deleted successfully!
C:\Users\Fabio\AppData\Local\ServUpdater\ServiceUpd.exe moved successfully.
Service VGPU stopped successfully!
Service VGPU deleted successfully!
File System32\drivers\rdvgkmd.sys File not found not found.
Service UsbGps stopped successfully!
Service UsbGps deleted successfully!
File system32\DRIVERS\lgusbgps.sys File not found not found.
Service MpKsl4c47a63f stopped successfully!
Service MpKsl4c47a63f deleted successfully!
File C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3B289B99-43CC-436A-A5AA-81B2CB6BDBB5}\MpKsl4c47a63f.sys File not found not found.
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@microsoft.com/GENUINE\ deleted successfully.
Registry value HKEY_CURRENT_USER\software\mozilla\SeaMonkey\Extensions\\mozilla_cc@internetdownloadmanager.com deleted successfully.
File C:\Users\Fabio\AppData\Roaming\IDM\idmmzcc5 not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\10 not found.
Registry value HKEY_USERS\S-1-5-21-927511499-2580095553-3253916930-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
Registry value HKEY_USERS\S-1-5-21-927511499-2580095553-3253916930-1001\Software\Microsoft\Windows\CurrentVersion\Run\\fsm not found.
Registry value HKEY_USERS\S-1-5-21-927511499-2580095553-3253916930-1001\Software\Microsoft\Windows\CurrentVersion\Run\\LG LinkAir not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Download ALL with IDA\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Download remotely with IDA\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Download with IDA\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\E&sporta in Microsoft Excel\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\I&nvia a OneNote\ deleted successfully.
C:\Users\Fabio\AppData\Local\PowerOffer folder moved successfully.
C:\Users\Fabio\AppData\Local\ServUpdater\settings folder moved successfully.
C:\Users\Fabio\AppData\Local\ServUpdater folder moved successfully.
C:\Users\Fabio\AppData\Local\PosService\settings folder moved successfully.
C:\Users\Fabio\AppData\Local\PosService folder moved successfully.
C:\Users\Fabio\AppData\Local\SoftwareUpdater\settings folder moved successfully.
C:\Users\Fabio\AppData\Local\SoftwareUpdater folder moved successfully.
Unable to delete ADS C:\ProgramData\TEMP:D1B5B4F1 .
========== FILES ==========
File\Folder C:\Users\Fabio\AppData\Roaming\IDM\idmmzcc5 not found.
< ipconfig /flushdns /c >
Configurazione IP di Windows
Cache del resolver DNS svuotata.
C:\Users\Fabio\Desktop\cmd.bat deleted successfully.
C:\Users\Fabio\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

OTL by OldTimer - Version 3.2.69.0 log created on 10192012_172727

tenuto conto che questo succede spesso vuoi dire agli amici che leggono ( e al sottoscritto) sotto quale nome hai trovato il log?

adesso scarica adwcleaner clicca su delete e allega il log che rilascia