Olimpo Informatico

[t0r3]

sono giorni che mi assilla kaspersky non lo elimina, ho fatto una scansione online con il panda ma niente

questo è il risultato della scansione con hijackthis

Logfile of HijackThis v1.99.1
Scan saved at 15.20.20, on 24/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\service32.exe
C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\Toshiba\Tvs\TvsTray.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Programmi\Toshiba\Toshiba Applet\thotkey.exe
C:\Programmi\TOSHIBA\ConfigFree\NDSTray.exe
C:\Programmi\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\Programmi\TOSHIBA\Touch and Launch\PadExe.exe
C:\Programmi\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\WINDOWS\system32\TPSMain.exe
C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programmi\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
C:\Programmi\TOSHIBA\ConfigFree\CFSServ.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\Programmi\QuickTime\qttask.exe
C:\Programmi\iTunes\iTunesHelper.exe
C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\TEMP\okjc1.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\iolo\System Mechanic 5 Professional\PopupStopper.exe
C:\Programmi\iolo\Common\Task Agent\Task_Agent.exe
C:\Programmi\MSN Messenger\msnmsgr.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\Skype\Phone\Skype.exe
C:\Programmi\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Programmi\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Programmi\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Programmi\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
C:\Programmi\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\Programmi\TOSHIBA\ConfigFree\CFXFER.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Programmi\Mozilla Firefox\firefox.exe
C:\DOCUME~1\SALVAT~1\IMPOST~1\Temp\Directory temporanea 1 per hijackthis_199.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Tvs] C:\Programmi\Toshiba\Tvs\TvsTray.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [THotkey] C:\Programmi\Toshiba\Toshiba Applet\thotkey.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [SmoothView] C:\Programmi\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [PadTouch] C:\Programmi\TOSHIBA\Touch and Launch\PadExe.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Programmi\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Programmi\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [okjc1.exe] C:\WINDOWS\TEMP\okjc1.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [System Mechanic Popup Stopper] "C:\Programmi\iolo\System Mechanic 5 Professional\PopupStopper.exe"
O4 - HKCU\..\Run: [iolo Task Agent] C:\Programmi\iolo\Common\Task Agent\Task_Agent.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmi\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Programmi\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Bluetooth Manager.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Programmi\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Programmi\File comuni\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: SecTwb - Unknown owner - \\?\C:\Programmi\Windows NT\lpt1.exe (file missing)
O23 - Service: SecVim - Unknown owner - \\?\C:\Programmi\File comuni\System\lpt5.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Programmi\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: WinXvw - Unknown owner - \\?\C:\Programmi\File comuni\Services\lpt9.exe (file missing)

se mi cercate sono in un angolo a disperarmi

[BilloKenobi]

hai un macello!!!!!

hai tre LinkOptimizer, oltre al clicker.

il fatto è che per eliminare il clicker sarebbe consigliabile usare un programma bloccato dal LinkOptimizer...

cerchiamo di sbloccarlo con questo tool

http://www.mytempdir.com/988986

quando lo hai scaricato, fallo girare e posta il log contenuto in C:\gromozon_removal.log

[holifay]

Prova anche il tool symantec dalla modalità provvisoria. Trovi i link qui: http://forum.zeusnews.com/viewtopic.php?t=18285

[chemicalbit]

[holifay]

[t0r3]

grazie tante

Removal tool loaded into memory
Gromozon rootkit component not detected - searching for other components
Scanning: C:\WINDOWS
Scanning: C:\Programmi\File comuni
Gromozon-Related Malicious Code Detected!
FileName: C:\WINDOWS\Temp\okjc1.exe
>>>Error: File C:\WINDOWS\Temp\okjc1.exe could not be removed - it will be removed on the next reboot.


Trojan.Gromozon Removed!

che faccio ora???

[Smjert]

[t0r3]

non riesco ad entrare neanche più nella modalità provvisoria, il caricamento delle impostazioni personali in corso ha un corso lunghissimo
è un brutto segno?

[t0r3]

sono riuscito ad entrare,non come amministratore, nella modalità provv, ho fatto la scansione con fxlink e questo è il risutato

Symantec Trojan.Linkoptimizer Removal Tool 1.0.8
Restored SeDebugPrivilege to Administrators group

Trojan.Linkoptimizer has not been found on your computer.

poi ho ripasato hijackthis e mi ha dato questo

Logfile of HijackThis v1.99.1
Scan saved at 17.38.14, on 24/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\service32.exe
C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\Toshiba\Tvs\TvsTray.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Programmi\Toshiba\Toshiba Applet\thotkey.exe
C:\Programmi\TOSHIBA\ConfigFree\NDSTray.exe
C:\Programmi\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\Programmi\TOSHIBA\Touch and Launch\PadExe.exe
C:\Programmi\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\WINDOWS\system32\TPSMain.exe
C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programmi\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
C:\Programmi\TOSHIBA\ConfigFree\CFSServ.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\Programmi\QuickTime\qttask.exe
C:\Programmi\iTunes\iTunesHelper.exe
C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\iolo\System Mechanic 5 Professional\PopupStopper.exe
C:\Programmi\iolo\Common\Task Agent\Task_Agent.exe
C:\Programmi\MSN Messenger\msnmsgr.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\Skype\Phone\Skype.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Programmi\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Programmi\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Programmi\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Programmi\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
C:\Programmi\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Programmi\TOSHIBA\ConfigFree\CFXFER.exe
C:\DOCUME~1\SALVAT~1\IMPOST~1\Temp\Directory temporanea 2 per hijackthis_199.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Tvs] C:\Programmi\Toshiba\Tvs\TvsTray.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [THotkey] C:\Programmi\Toshiba\Toshiba Applet\thotkey.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [SmoothView] C:\Programmi\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [PadTouch] C:\Programmi\TOSHIBA\Touch and Launch\PadExe.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Programmi\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Programmi\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [okjc1.exe] C:\WINDOWS\TEMP\okjc1.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [System Mechanic Popup Stopper] "C:\Programmi\iolo\System Mechanic 5 Professional\PopupStopper.exe"
O4 - HKCU\..\Run: [iolo Task Agent] C:\Programmi\iolo\Common\Task Agent\Task_Agent.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmi\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Programmi\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Bluetooth Manager.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Programmi\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Programmi\File comuni\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Programmi\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

dottori, come sta?

[BilloKenobi]

è presto per dirlo , scarica gmer

gmer= http://www.gmer.net/files.php

estrailo e fai uno scan delle sezioni "Rootkit" e "autostart", poi allega sul forum i log

ciao

[t0r3]

sono riuscito a salvare solo il log di rootkit

che si fa ora, si va di cacciavite?

GMER 1.0.11.11390 - http://www.gmer.net
Rootkit 2006-10-25 21:54:35
Windows 5.1.2600 Service Pack 2


---- Threads - GMER 1.0.11 ----

Thread 4:104 866B6950
Thread 4:108 86696C60
Thread 4:112 86696C60

---- Files - GMER 1.0.11 ----

ADS C:\boot.ini:KAVICHS
ADS C:\Documents and Settings\Administrator\Dati applicazioni\Adobe\Acrobat\6.0\AcroForm\MRUFormsList:KAVICHS
ADS C:\Documents and Settings\Administrator\Dati applicazioni\Adobe\Acrobat\6.0\TMGrpPrm.sav:KAVICHS
ADS C:\Documents and Settings\Administrator\Dati applicazioni\Adobe\Acrobat\6.0\Updater\udstore.js:KAVICHS
ADS C:\Documents and Settings\Administrator\Dati applicazioni\desktop.ini:KAVICHS
ADS C:\Documents and Settings\Administrator\Dati applicazioni\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol:KAVICHS
ADS C:\Documents and Settings\Administrator\Dati applicazioni\Microsoft\Address Book\Proprietario.wab:KAVICHS
ADS C:\Documents and Settings\Administrator\Dati applicazioni\Microsoft\Address Book\Proprietario.wab~:KAVICHS
ADS C:\Documents and Settings\Administrator\Dati applicazioni\Microsoft\CryptnetUrlCache\Content\3C83474D61E624A4F9844DF935AFE217:KAVICHS
ADS C:\Documents and Settings\Administrator\Dati applicazioni\Microsoft\CryptnetUrlCache\Content\60E31627FDA0A46932B0E5948949F2A5:KAVICHS
ADS C:\Documents and Settings\Administrator\Dati applicazioni\Microsoft\CryptnetUrlCache\Content\A8FABA189DB7D25FBA7CAC806625FD30:KAVICHS
ADS ...
ADS C:\Documents and Settings\salvat0r3\Documenti\[ _share_ ]\[ mutzik ]\[ rock-indie ]\Magnolia Electric Co [ What Comes After The Blues ]\Magnolia Electric Co - What Comes After The Blues (2005 Advance) - 192 NMR - 01 The Dark Don't Hide\01 The Dark Don't Hide It.mp3:KAVICHS
ADS C:\Documents and Settings\salvat0r3\Documenti\[ _share_ ]\[ mutzik ]\[ rock-indie ]\Magnolia Electric Co [ What Comes After The Blues ]\Magnolia Electric Co - What Comes After The Blues (2005 Advance) - 192 NMR - 01 The Dark Don't Hide\02 The Night Shift Lullaby.mp3:KAVICHS
ADS C:\Documents and Settings\salvat0r3\Documenti\[ _share_ ]\[ mutzik ]\[ rock-indie ]\Magnolia Electric Co [ What Comes After The Blues ]\Magnolia Electric Co - What Comes After The Blues (2005 Advance) - 192 NMR - 01 The Dark Don't Hide\04 Hard To Love A Man.mp3:KAVICHS
ADS C:\Documents and Settings\salvat0r3\Documenti\[ _share_ ]\[ mutzik ]\[ rock-indie ]\Magnolia Electric Co [ What Comes After The Blues ]\Magnolia Electric Co - What Comes After The Blues (2005 Advance) - 192 NMR - 01 The Dark Don't Hide\05 Give Something Else Away Every Day.mp3:KAVICHS
ADS C:\Documents and Settings\salvat0r3\Documenti\[ _share_ ]\[ mutzik ]\[ rock-indie ]\Magnolia Electric Co [ What Comes After The Blues ]\Magnolia Electric Co - What Comes After The Blues (2005 Advance) - 192 NMR - 01 The Dark Don't Hide\06 Northstar Blues.mp3:KAVICHS
ADS C:\Documents and Settings\salvat0r3\Documenti\[ _share_ ]\[ mutzik ]\[ rock-indie ]\Magnolia Electric Co [ What Comes After The Blues ]\Magnolia Electric Co - What Comes After The Blues (2005 Advance) - 192 NMR - 01 The Dark Don't Hide\08 I Can Not Have Seen The Light.mp3:KAVICHS
ADS C:\Documents and Settings\salvat0r3\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat:KAVICHS
ADS C:\Documents and Settings\salvat0r3\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG:KAVICHS
ADS C:\Documents and Settings\salvat0r3\NTUSER.DAT:KAVICHS
ADS C:\Documents and Settings\salvat0r3\ntuser.dat.LOG:KAVICHS

---- EOF - GMER 1.0.11 ----

[holifay]

non è necessario, questo log è pulito

Perchè non riesci a salvare quello di Autostart?

[t0r3]

non ho idea, non riesco a salvarlo, forse non so farlo,ma non mi da la stessa opzione di rootkit

ma ora che il log è pulito cosa si fa?

ps-grazie x l'aiuto

[holifay]

Dopo la scansione, promi COPY e poi lo incolli dove vuoi. Non te lo copia?

[t0r3]

no, niente copy

ho fatto anche una scansione online con panda, il risultato è terribile

forse xchè sto continuando ad usare il computer


Incidente Stato Percorso

Spyware:Cookie/Ccbill Non Disinfettato C:\Documents and Settings\salvat0r3\Cookies\salvat0r3@ccbill[1].txt
Spyware:Cookie/DriveCleaner Non Disinfettato C:\Documents and Settings\salvat0r3\Cookies\salvat0r3@drivecleaner[1].txt
Spyware:Cookie/Reliablestats Non Disinfettato C:\Documents and Settings\salvat0r3\Cookies\salvat0r3@stats1.reliablestats[1].txt
Spyware:Cookie/DriveCleaner Non Disinfettato C:\Documents and Settings\salvat0r3\Cookies\salvat0r3@www.drivecleaner[1].txt
Spyware:Cookie/Doubleclick Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-1.txt[.doubleclick.net/]
Spyware:Cookie/2o7 Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-1.txt[.2o7.net/]
Spyware:Cookie/Tradedoubler Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-1.txt[.tradedoubler.com/]
Spyware:Cookie/Statcounter Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-1.txt[.statcounter.com/]
Spyware:Cookie/Advertising Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-1.txt[.advertising.com/]
Spyware:Cookie/Advertising Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-1.txt[.servedby.advertising.com/]
Spyware:Cookie/Advertising Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-1.txt[.advertising.com/]
Spyware:Cookie/Advertising Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-1.txt[.servedby.advertising.com/]
Spyware:Cookie/Zedo Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-1.txt[.zedo.com/]
Spyware:Cookie/WUpd Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-1.txt[.revenue.net/]
Spyware:Cookie/Searchportal Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-1.txt[.searchportal.information.com/]
Spyware:Cookie/Hitbox Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-1.txt[.hitbox.com/]
Spyware:Cookie/FastClick Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-1.txt[.fastclick.net/]
Spyware:Cookie/Hbmediapro Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-1.txt[.adopt.hbmediapro.com/]
Spyware:Cookie/YieldManager Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-1.txt[ad.yieldmanager.com/]
Spyware:Cookie/Hbmediapro Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-1.txt[.adopt.hbmediapro.com/]
Spyware:Cookie/YieldManager Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-1.txt[ad.yieldmanager.com/]
Spyware:Cookie/Falkag Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-1.txt[as1.falkag.de/]
Spyware:Cookie/Atwola Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-1.txt[.atwola.com/]
Spyware:Cookie/WebtrendsLive Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-1.txt[statse.webtrendslive.com/]
Spyware:Cookie/WebtrendsLive Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-1.txt[statse.webtrendslive.com/S151737]
Spyware:Cookie/DomainSponsor Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-1.txt[landing.domainsponsor.com/]
Spyware:Cookie/Itrack Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-1.txt[ilead.itrack.it/]
Spyware:Cookie/Atlas DMT Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-1.txt[.atdmt.com/]
Spyware:Cookie/Doubleclick Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-10.txt[.doubleclick.net/]
Spyware:Cookie/YieldManager Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-10.txt[ad.yieldmanager.com/]
Spyware:Cookie/Zedo Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-10.txt[.zedo.com/]
Spyware:Cookie/Tradedoubler Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-10.txt[.tradedoubler.com/]
Spyware:Cookie/Atlas DMT Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-10.txt[.atdmt.com/]
Spyware:Cookie/Weborama Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-10.txt[.weborama.fr/]
Spyware:Cookie/Statcounter Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-10.txt[.statcounter.com/]
Spyware:Cookie/Falkag Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-10.txt[.as-us.falkag.net/]
Spyware:Cookie/Mediaplex Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-10.txt[.mediaplex.com/]
Spyware:Cookie/bravenetA Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-10.txt[.bravenet.com/]
Spyware:Cookie/Falkag Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-10.txt[as1.falkag.de/]
Spyware:Cookie/2o7 Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-10.txt[.2o7.net/]
Spyware:Cookie/Advertising Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-10.txt[.advertising.com/]
Spyware:Cookie/Advertising Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-10.txt[.servedby.advertising.com/]
Spyware:Cookie/Advertising Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-10.txt[.advertising.com/]
Spyware:Cookie/Advertising Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-10.txt[.servedby.advertising.com/]
Spyware:Cookie/WUpd Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-10.txt[.revenue.net/]
Spyware:Cookie/Searchportal Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-10.txt[.searchportal.information.com/]
Spyware:Cookie/Hitbox Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-10.txt[.hitbox.com/]
Spyware:Cookie/FastClick Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-10.txt[.fastclick.net/]
Spyware:Cookie/Hbmediapro Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-10.txt[.adopt.hbmediapro.com/]
Spyware:Cookie/Atwola Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-10.txt[.atwola.com/]
Spyware:Cookie/WebtrendsLive Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-10.txt[statse.webtrendslive.com/]
Spyware:Cookie/WebtrendsLive Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-10.txt[statse.webtrendslive.com/S151737]
Spyware:Cookie/DomainSponsor Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-10.txt[landing.domainsponsor.com/]
Spyware:Cookie/Itrack Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-10.txt[ilead.itrack.it/]
Spyware:Cookie/Mediaplex Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-11.txt[.mediaplex.com/]
Spyware:Cookie/Tradedoubler Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-11.txt[.tradedoubler.com/]
Spyware:Cookie/Doubleclick Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-11.txt[.doubleclick.net/]
Spyware:Cookie/Tradedoubler Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-11.txt[.tradedoubler.com/]
Spyware:Cookie/Falkag Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-11.txt[.as-us.falkag.net/]
Spyware:Cookie/YieldManager Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-11.txt[ad.yieldmanager.com/]
Spyware:Cookie/Serving-sys Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-11.txt[.serving-sys.com/]
Spyware:Cookie/Statcounter Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-11.txt[.statcounter.com/]
Spyware:Cookie/Zedo Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-11.txt[.zedo.com/]
Spyware:Cookie/Atlas DMT Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-11.txt[.atdmt.com/]
Spyware:Cookie/Weborama Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-11.txt[.weborama.fr/]
Spyware:Cookie/bravenetA Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-11.txt[.bravenet.com/]
Spyware:Cookie/Falkag Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-11.txt[as1.falkag.de/]
Spyware:Cookie/2o7 Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-11.txt[.2o7.net/]
Spyware:Cookie/Advertising Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-11.txt[.advertising.com/]
Spyware:Cookie/Advertising Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-11.txt[.servedby.advertising.com/]
Spyware:Cookie/Advertising Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-11.txt[.advertising.com/]
Spyware:Cookie/Advertising Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-11.txt[.servedby.advertising.com/]
Spyware:Cookie/WUpd Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-11.txt[.revenue.net/]
Spyware:Cookie/Searchportal Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-11.txt[.searchportal.information.com/]
Spyware:Cookie/Hitbox Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-11.txt[.hitbox.com/]
Spyware:Cookie/FastClick Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-11.txt[.fastclick.net/]
Spyware:Cookie/Hbmediapro Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-11.txt[.adopt.hbmediapro.com/]
Spyware:Cookie/Atwola Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-11.txt[.atwola.com/]
Spyware:Cookie/WebtrendsLive Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-11.txt[statse.webtrendslive.com/]
Spyware:Cookie/WebtrendsLive Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-11.txt[statse.webtrendslive.com/S151737]
Spyware:Cookie/DomainSponsor Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-11.txt[landing.domainsponsor.com/]
Spyware:Cookie/Itrack Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-11.txt[ilead.itrack.it/]
Spyware:Cookie/Doubleclick Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-12.txt[.doubleclick.net/]
Spyware:Cookie/Mediaplex Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-12.txt[.mediaplex.com/]
Spyware:Cookie/Tradedoubler Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-12.txt[.tradedoubler.com/]
Spyware:Cookie/Falkag Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-12.txt[.as-us.falkag.net/]
Spyware:Cookie/YieldManager Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-12.txt[ad.yieldmanager.com/]
Spyware:Cookie/Serving-sys Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-12.txt[.serving-sys.com/]
Spyware:Cookie/Statcounter Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-12.txt[.statcounter.com/]
Spyware:Cookie/Zedo Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-12.txt[.zedo.com/]
Spyware:Cookie/Atlas DMT Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-12.txt[.atdmt.com/]
Spyware:Cookie/Weborama Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-12.txt[.weborama.fr/]
Spyware:Cookie/bravenetA Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-12.txt[.bravenet.com/]
Spyware:Cookie/Falkag Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-12.txt[as1.falkag.de/]
Spyware:Cookie/2o7 Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-12.txt[.2o7.net/]
Spyware:Cookie/Advertising Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-12.txt[.advertising.com/]
Spyware:Cookie/Advertising Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-12.txt[.servedby.advertising.com/]
Spyware:Cookie/Advertising Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-12.txt[.advertising.com/]
Spyware:Cookie/Advertising Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-12.txt[.servedby.advertising.com/]
Spyware:Cookie/WUpd Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-12.txt[.revenue.net/]
Spyware:Cookie/Searchportal Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-12.txt[.searchportal.information.com/]
Spyware:Cookie/Hitbox Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-12.txt[.hitbox.com/]
Spyware:Cookie/FastClick Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-12.txt[.fastclick.net/]
Spyware:Cookie/Hbmediapro Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-12.txt[.adopt.hbmediapro.com/]
Spyware:Cookie/Atwola Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-12.txt[.atwola.com/]
Spyware:Cookie/WebtrendsLive Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-12.txt[statse.webtrendslive.com/]
Spyware:Cookie/WebtrendsLive Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-12.txt[statse.webtrendslive.com/S151737]
Spyware:Cookie/DomainSponsor Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-12.txt[landing.domainsponsor.com/]
Spyware:Cookie/Itrack Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-12.txt[ilead.itrack.it/]
Spyware:Cookie/YieldManager Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-13.txt[ad.yieldmanager.com/]
Spyware:Cookie/Doubleclick Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-13.txt[.doubleclick.net/]
Spyware:Cookie/Tradedoubler Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-13.txt[.tradedoubler.com/]
Spyware:Cookie/Mediaplex Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-13.txt[.mediaplex.com/]
Spyware:Cookie/Falkag Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-13.txt[.as-us.falkag.net/]
Spyware:Cookie/Serving-sys Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-13.txt[.serving-sys.com/]
Spyware:Cookie/Statcounter Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-13.txt[.statcounter.com/]
Spyware:Cookie/Zedo Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-13.txt[.zedo.com/]
Spyware:Cookie/Atlas DMT Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-13.txt[.atdmt.com/]
Spyware:Cookie/Weborama Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-13.txt[.weborama.fr/]
Spyware:Cookie/bravenetA Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-13.txt[.bravenet.com/]
Spyware:Cookie/Falkag Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-13.txt[as1.falkag.de/]
Spyware:Cookie/2o7 Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-13.txt[.2o7.net/]
Spyware:Cookie/Advertising Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-13.txt[.advertising.com/]
Spyware:Cookie/Advertising Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-13.txt[.servedby.advertising.com/]
Spyware:Cookie/Advertising Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-13.txt[.advertising.com/]
Spyware:Cookie/Advertising Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-13.txt[.servedby.advertising.com/]
Spyware:Cookie/WUpd Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-13.txt[.revenue.net/]
Spyware:Cookie/Searchportal Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-13.txt[.searchportal.information.com/]
Spyware:Cookie/Hitbox Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-13.txt[.hitbox.com/]
Spyware:Cookie/FastClick Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-13.txt[.fastclick.net/]
Spyware:Cookie/Hbmediapro Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-13.txt[.adopt.hbmediapro.com/]
Spyware:Cookie/Atwola Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-13.txt[.atwola.com/]
Spyware:Cookie/WebtrendsLive Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-13.txt[statse.webtrendslive.com/]
Spyware:Cookie/WebtrendsLive Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-13.txt[statse.webtrendslive.com/S151737]
Spyware:Cookie/DomainSponsor Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-13.txt[landing.domainsponsor.com/]
Spyware:Cookie/Yadro Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-14.txt[.yadro.ru/]
Spyware:Cookie/Tradedoubler Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-14.txt[.tradedoubler.com/]
Spyware:Cookie/WebtrendsLive Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-14.txt[statse.webtrendslive.com/]
Spyware:Cookie/Doubleclick Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-14.txt[.doubleclick.net/]
Spyware:Cookie/YieldManager Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-14.txt[ad.yieldmanager.com/]
Spyware:Cookie/Zedo Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-14.txt[.zedo.com/]
Spyware:Cookie/Mediaplex Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-14.txt[.mediaplex.com/]
Spyware:Cookie/Falkag Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-14.txt[.as-us.falkag.net/]
Spyware:Cookie/Serving-sys Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-14.txt[.serving-sys.com/]
Spyware:Cookie/Statcounter Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-14.txt[.statcounter.com/]
Spyware:Cookie/Atlas DMT Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-14.txt[.atdmt.com/]
Spyware:Cookie/Weborama Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-14.txt[.weborama.fr/]
Spyware:Cookie/bravenetA Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-14.txt[.bravenet.com/]
Spyware:Cookie/Falkag Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-14.txt[as1.falkag.de/]
Spyware:Cookie/2o7 Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-14.txt[.2o7.net/]
Spyware:Cookie/Advertising Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-14.txt[.advertising.com/]
Spyware:Cookie/Advertising Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-14.txt[.servedby.advertising.com/]
Spyware:Cookie/Advertising Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-14.txt[.advertising.com/]
Spyware:Cookie/Advertising Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-14.txt[.servedby.advertising.com/]
Spyware:Cookie/WUpd Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-14.txt[.revenue.net/]
Spyware:Cookie/Searchportal Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-14.txt[.searchportal.information.com/]
Spyware:Cookie/Hitbox Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-14.txt[.hitbox.com/]
Spyware:Cookie/FastClick Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-14.txt[.fastclick.net/]
Spyware:Cookie/Hbmediapro Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-14.txt[.adopt.hbmediapro.com/]
Spyware:Cookie/Atwola Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-14.txt[.atwola.com/]
Spyware:Cookie/WebtrendsLive Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-14.txt[statse.webtrendslive.com/S151737]
Spyware:Cookie/DomainSponsor Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-14.txt[landing.domainsponsor.com/]
Spyware:Cookie/Tradedoubler Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-15.txt[.tradedoubler.com/]
Spyware:Cookie/Statcounter Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-15.txt[.statcounter.com/]
Spyware:Cookie/Yadro Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-15.txt[.yadro.ru/]
Spyware:Cookie/Atlas DMT Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-15.txt[.atdmt.com/]
Spyware:Cookie/YieldManager Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-15.txt[ad.yieldmanager.com/]
Spyware:Cookie/Mammamediasolutions Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-15.txt[.targetnet.com/]
Spyware:Cookie/Doubleclick Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-15.txt[.doubleclick.net/]
Spyware:Cookie/Belnk Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-15.txt[.belnk.com/]
Spyware:Cookie/Itrack Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-15.txt[ilead.itrack.it/]
Spyware:Cookie/Falkag Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-15.txt[as1.falkag.de/]
Spyware:Cookie/Traffic Marketplace Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-15.txt[.trafficmp.com/]
Spyware:Cookie/Advertising Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-15.txt[.advertising.com/]
Spyware:Cookie/Mediaplex Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-15.txt[.mediaplex.com/]
Spyware:Cookie/WebtrendsLive Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-15.txt[statse.webtrendslive.com/]
Spyware:Cookie/Zedo Non Disinfettato C:\Documents and Settings\salvat0r3\Dati applicazioni\Mozilla\Firefox\Profiles\xlgu48ys.default\cookies-15.txt[.zedo.com/]

[Smjert]

Sono tutti cookie che puoi andare a cancellare da Firefox:
Strumenti->Opzioni->tabella Privacy->scheda Cookie, premi Svuota i cookie adesso.

[t0r3]

ok farò cos'

però l'antivirus continua a rilevare il trojan e la CPU viaggia al 100%

dovrò formattare?

[Smjert]

Fai una scansione con questo tool, salva il risultato su un file txt e caricalo su questo sito http://www.mytempdir.com, posta poi il link al file.

[t0r3]

fatta scansione

http://www.mytempdir.com/1017483

caspita però è una cosa incasinata...oltretutto kasp mi ha anche trovato quest'altra cosa: packed.win32.polycrypt.a, un'altro trojan?

[Smjert]

Clicker trovato (sì hai anche un'altro trojan).

Scarica CCleaner.

Riavvia in Modalità Provvisoria (F8 al boot)

Installa CCleaner e poi avvialo, va su Opzioni->Avanzate, togli la spunta a "Cancella file in Windows Temp solo se più vecchi di 48 ore", torna nella sezione Cleaner e premi Analizza.
Finita la scansione premi Avvia Cleaner.

Crea sul Desktop un nuovo file txt (chiamalo come vuoi... ad esempio Delete) e copiaci dentro queste linee: