Olimpo Informatico

[v3r0]

ciao a tutti, da alcune settimane trovo nella cronologia: a.doginhispen, b.skitodayplease e 88.80.7.66
sistema operativo: XP
utilizzo antivir e spybot
ho fatto una scansione con hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17.51.15, on 27/01/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Programmi\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Programmi\Hewlett-Packard\HP Software Update\bak\HPWuSchd.exe
C:\Programmi\D-Link\AirPlus G\AirGCFG.exe
C:\Programmi\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\BITWARE\NT\bwprnmon.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Programmi\KODAK\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\NetEx\netex.exe
C:\Programmi\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Programmi\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
C:\Programmi\AntiVir PersonalEdition Classic\sched.exe
C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe
C:\Programmi\Borland\InterBase\bin\ibguard.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\Programmi\Borland\InterBase\bin\ibserver.exe
C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\Veronica\Internet\exe\HJT\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.trentino.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fornito da TrentinoNet powered by D.Net
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: FiltURL Class - {5038FED1-CEFE-11D2-9E74-00A0C945A948} - C:\PROGRA~2\NetEx\URLSEA~1.DLL
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Programmi\Macrogaming\SweetIMBarForIE\toolbar.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SWEETIE Class - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Virgilio Rapido - {844FC402-F06A-4A47-ACB9-45BDC9721BD1} - C:\WINDOWS\Downloaded Program Files\VirgilioBands187.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Programmi\Macrogaming\SweetIMBarForIE\toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [HP Software Update] "C:\Programmi\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [zzizba.exe] C:\DOCUME~1\utente\IMPOST~1\Temp\zzizba.exe
O4 - HKLM\..\Run: [sysszylr] "c:\windows\system32\sysszylr.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [crtfmon] C:\DOCUME~1\utente\IMPOST~1\Temp\1189425144pSjDa.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SweetIM] C:\Programmi\Macrogaming\SweetIM\SweetIM.exe
O4 - HKLM\..\Run: [SMSTray] C:\Programmi\Samsung\Samsung Media Studio 5\SMSTray.exe
O4 - HKLM\..\Run: [MAAgent] C:\Programmi\MarkAny\ContentSafer\MAAgent.exe
O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Programmi\D-Link\AirPlus G\AirGCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Programmi\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [BackWeb LiteInstaller] C:\DOCUME~1\utente\IMPOST~1\Temp\ins1.tmp\LiteInst.exe /NoIntervention
O4 - HKCU\..\Run: [SweetIM] C:\Programmi\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [AliceMessenger] C:\Programmi\Alice Messenger\alicemessenger.exe
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Programmi\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: NetEx.LNK = C:\Program Files\NetEx\netex.exe
O4 - Startup: Utilità controllo supporti di Picture Motion Browser.lnk = C:\Programmi\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: BitWare Print Monitor.lnk = C:\BITWARE\NT\bwprnmon.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Programmi\KODAK\Kodak EasyShare software\bin\EasyShare.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O14 - IERESET.INF: START_PAGE_URL=http://www.trentino.net/
O15 - Trusted Zone: *.whataboutadog.com
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programmi\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Programmi\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmi\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InterBase Guardian (InterBaseGuardian) - Borland Software Corporation - C:\Programmi\Borland\InterBase\bin\ibguard.exe
O23 - Service: InterBase Server (InterBaseServer) - Borland Software Corporation - C:\Programmi\Borland\InterBase\bin\ibserver.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Programmi\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O24 - Desktop Component 0: (no name) - http://www.manikomio.it/sanremo2004/cantanti/stefanopicchi/stefanopicchi1tn.jpg
O24 - Desktop Component 1: (no name) - http://image.excite.it/www/musica/sanremo2004/55/picchi55.jpg
O24 - Desktop Component 2: (no name) - http://www.sanremostory.it/images/album/stefanopicchi.jpg
O24 - Desktop Component 3: (no name) - http://www.externamusic.it/artisti/stefano_picchi/foto_lovino/min/2.jpg
O24 - Desktop Component 4: (no name) - http://www.externamusic.it/intro/intro2_r1_c2.jpg

--
End of file - 8444 bytes


grazie

[v3r0]

ho fatto anche una scansione con FindAWF:


Find AWF report by noahdfear ©2006
Version 1.40



bak folders found
~~~~~~~~~~~

Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 6C76-BADD

Directory di C:\PROGRA~1\ALICEM~1\BAK

0 File 0 byte
2 Directory 66.329.939.968 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 6C76-BADD

Directory di C:\PROGRA~1\ANTIVI~1\BAK

31/10/2006 16.07 262.184 avgnt.exe
1 File 262.184 byte
2 Directory 66.329.939.968 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 6C76-BADD

Directory di C:\SCANJET\PRECIS~1\BAK

07/06/1999 12.27 23.552 hppwrsav.exe
1 File 23.552 byte
2 Directory 66.329.935.872 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 6C76-BADD

Directory di C:\WINDOWS\SYSTEM32\BAK

21/08/2003 05.17 483.328 hphmon05.exe
09/07/2001 10.50 155.648 NeroCheck.exe
2 File 638.976 byte
2 Directory 66.329.935.872 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 6C76-BADD

Directory di C:\PROGRA~1\GOOGLE\GOOGLE~1\BAK

06/01/2008 18.04 68.856 GoogleToolbarNotifier.exe
1 File 68.856 byte
2 Directory 66.329.935.872 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 6C76-BADD

Directory di C:\PROGRA~1\HEWLET~1\HPSOFT~1\BAK

25/06/2003 12.24 49.152 HPWuSchd.exe
1 File 49.152 byte
2 Directory 66.329.935.872 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 6C76-BADD

Directory di C:\PROGRA~1\HEWLET~1\{45B61~1\BAK

21/08/2003 05.23 49.152 hphupd05.exe
1 File 49.152 byte
2 Directory 66.329.935.872 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 6C76-BADD

Directory di C:\PROGRA~1\MACROG~1\SWEETIM\BAK

12/08/2007 10.02 103.712 SweetIM.exe
1 File 103.712 byte
2 Directory 66.329.935.872 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 6C76-BADD

Directory di C:\PROGRA~1\MARKANY\CONTEN~1\BAK

30/01/2007 19.36 57.344 MAAgent.exe
1 File 57.344 byte
2 Directory 66.329.935.872 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 6C76-BADD

Directory di C:\PROGRA~1\SAMSUNG\SAMSUN~1\BAK

23/02/2007 15.32 126.976 SMSTray.exe
1 File 126.976 byte
2 Directory 66.329.935.872 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 6C76-BADD

Directory di C:\WINDOWS\SYSTEM32\DLA\BAK

13/06/2006 04.20 127.036 DLACTRLW.EXE
22/10/2003 01.04 114.741 tfswctrl.exe
2 File 241.777 byte
2 Directory 66.329.935.872 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 6C76-BADD

Directory di C:\PROGRA~1\FILECO~1\SONIC\UPDATE~1\BAK

13/02/2003 02.01 49.152 AniGifDisplay.ocx
13/02/2003 02.01 135.168 Archived.dll
13/02/2003 02.01 36.864 Graph.ocx
10/02/2003 02.00 331.848 sfcwall31.dll
13/02/2003 02.01 65.536 sgpropsht.dll
13/02/2003 02.01 155.648 sgtray.exe
10/02/2003 02.00 155.648 sus.dll
13/02/2003 02.01 335.872 trayrita.dll
30/01/2003 02.00 61.440 vxhttp.dll
9 File 1.327.176 byte
2 Directory 66.329.931.776 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 6C76-BADD

Directory di C:\PROGRA~1\INTEL\NCS\PROSET\BAK

11/03/2003 17.24 86.016 PRONoMgr.exe
1 File 86.016 byte
2 Directory 66.329.931.776 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 6C76-BADD

Directory di C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\BAK

25/07/2003 22.14 188.416 hpztsb09.exe
1 File 188.416 byte
2 Directory 66.329.931.776 byte disponibili


Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~

249896 20 Jan 2008 "C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe"
262184 31 Oct 2006 "C:\Programmi\AntiVir PersonalEdition Classic\bak\avgnt.exe"
23552 7 Jun 1999 "C:\SCANJET\PrecisionScanLT\bak\hppwrsav.exe"
14348 19 Jan 2008 "C:\WINDOWS\system32\hphmon05.exe"
483328 21 Aug 2003 "C:\WINDOWS\system32\bak\hphmon05.exe"
14348 19 Jan 2008 "C:\WINDOWS\system32\NeroCheck.exe"
155648 9 Jul 2001 "C:\WINDOWS\system32\bak\NeroCheck.exe"
52272 19 Dec 2007 "C:\Programmi\Google\googletoolbar1user.exe"
14348 19 Jan 2008 "C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
138168 19 Dec 2007 "C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe"
68856 6 Jan 2008 "C:\Programmi\Google\GoogleToolbarNotifier\bak\GoogleToolbarNotifier.exe"
14348 19 Jan 2008 "C:\Programmi\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
49152 25 Jun 2003 "C:\Programmi\Hewlett-Packard\HP Software Update\bak\HPWuSchd.exe"
49152 21 Aug 2003 "C:\Programmi\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\bak\hphupd05.exe"
14348 19 Jan 2008 "C:\Programmi\Macrogaming\SweetIM\SweetIM.exe"
103712 12 Aug 2007 "C:\Programmi\Macrogaming\SweetIM\bak\SweetIM.exe"
14348 19 Jan 2008 "C:\Programmi\MarkAny\ContentSafer\MAAgent.exe"
57344 30 Jan 2007 "C:\Programmi\MarkAny\ContentSafer\bak\MAAgent.exe"
14348 19 Jan 2008 "C:\Programmi\Samsung\Samsung Media Studio 5\SMSTray.exe"
126976 23 Feb 2007 "C:\Programmi\Samsung\Samsung Media Studio 5\bak\SMSTray.exe"
127036 13 Jun 2006 "C:\WINDOWS\system32\dla\bak\DLACTRLW.EXE"
114741 22 Oct 2003 "C:\WINDOWS\system32\dla\bak\tfswctrl.exe"
49152 13 Feb 2003 "C:\Programmi\File comuni\Sonic\Update Manager\bak\AniGifDisplay.ocx"
135168 13 Feb 2003 "C:\Programmi\File comuni\Sonic\Update Manager\bak\Archived.dll"
36864 13 Feb 2003 "C:\Programmi\File comuni\Sonic\Update Manager\bak\Graph.ocx"
331848 10 Feb 2003 "C:\Programmi\File comuni\Sonic\Update Manager\bak\sfcwall31.dll"
65536 13 Feb 2003 "C:\Programmi\File comuni\Sonic\Update Manager\bak\sgpropsht.dll"
155648 13 Feb 2003 "C:\Programmi\File comuni\Sonic\Update Manager\bak\sgtray.exe"
155648 10 Feb 2003 "C:\Programmi\File comuni\Sonic\Update Manager\bak\sus.dll"
335872 13 Feb 2003 "C:\Programmi\File comuni\Sonic\Update Manager\bak\trayrita.dll"
61440 30 Jan 2003 "C:\Programmi\File comuni\Sonic\Update Manager\bak\vxhttp.dll"
86016 11 Mar 2003 "C:\Programmi\Intel\NCS\PROSet\bak\PRONoMgr.exe"
188416 25 Jul 2003 "C:\WINDOWS\system32\spool\drivers\w32x86\3\bak\hpztsb09.exe"


end of report

[bdoriano]

Ciao v3r0,

Scarica avenger e scompattalo in una sua cartella non temporanea e non sul desktop

Avvia AVENGER
Clicca su input script manually
Clicca sulla lente d'ingrandimento
Inserisci queste righe:

[v3r0]

hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14.51.46, on 28/01/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Programmi\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programmi\Hewlett-Packard\HP Software Update\bak\HPWuSchd.exe
C:\Programmi\D-Link\AirPlus G\AirGCFG.exe
C:\Programmi\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\BITWARE\NT\bwprnmon.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Programmi\KODAK\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\NetEx\netex.exe
C:\Programmi\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Programmi\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
C:\Programmi\AntiVir PersonalEdition Classic\sched.exe
C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe
C:\Programmi\Borland\InterBase\bin\ibguard.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\Programmi\Yahoo!\Messenger\ymsgr_tray.exe
C:\Programmi\Borland\InterBase\bin\ibserver.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Veronica\Internet\exe\HJT\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.trentino.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fornito da TrentinoNet powered by D.Net
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: FiltURL Class - {5038FED1-CEFE-11D2-9E74-00A0C945A948} - C:\PROGRA~2\NetEx\URLSEA~1.DLL
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Programmi\Macrogaming\SweetIMBarForIE\toolbar.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SWEETIE Class - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Virgilio Rapido - {844FC402-F06A-4A47-ACB9-45BDC9721BD1} - C:\WINDOWS\Downloaded Program Files\VirgilioBands187.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Programmi\Macrogaming\SweetIMBarForIE\toolbar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [HP Software Update] "C:\Programmi\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [zzizba.exe] C:\DOCUME~1\utente\IMPOST~1\Temp\zzizba.exe
O4 - HKLM\..\Run: [sysszylr] "c:\windows\system32\sysszylr.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [crtfmon] C:\DOCUME~1\utente\IMPOST~1\Temp\1189425144pSjDa.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Programmi\D-Link\AirPlus G\AirGCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Programmi\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [BackWeb LiteInstaller] C:\DOCUME~1\utente\IMPOST~1\Temp\ins1.tmp\LiteInst.exe /NoIntervention
O4 - HKCU\..\Run: [AliceMessenger] C:\Programmi\Alice Messenger\alicemessenger.exe
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Programmi\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: NetEx.LNK = C:\Program Files\NetEx\netex.exe
O4 - Startup: Utilità controllo supporti di Picture Motion Browser.lnk = C:\Programmi\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: BitWare Print Monitor.lnk = C:\BITWARE\NT\bwprnmon.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Programmi\KODAK\Kodak EasyShare software\bin\EasyShare.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O14 - IERESET.INF: START_PAGE_URL=http://www.trentino.net/
O15 - Trusted Zone: *.whataboutadog.com
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programmi\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Programmi\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmi\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: InterBase Guardian (InterBaseGuardian) - Borland Software Corporation - C:\Programmi\Borland\InterBase\bin\ibguard.exe
O23 - Service: InterBase Server (InterBaseServer) - Borland Software Corporation - C:\Programmi\Borland\InterBase\bin\ibserver.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Programmi\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O24 - Desktop Component 0: (no name) - http://www.manikomio.it/sanremo2004/cantanti/stefanopicchi/stefanopicchi1tn.jpg
O24 - Desktop Component 1: (no name) - http://image.excite.it/www/musica/sanremo2004/55/picchi55.jpg
O24 - Desktop Component 2: (no name) - http://www.sanremostory.it/images/album/stefanopicchi.jpg
O24 - Desktop Component 3: (no name) - http://www.externamusic.it/artisti/stefano_picchi/foto_lovino/min/2.jpg
O24 - Desktop Component 4: (no name) - http://www.externamusic.it/intro/intro2_r1_c2.jpg

--
End of file - 7915 bytes

[v3r0]

avenger non da nessun risultato. il documento .txt è vuoto
C:\ComboFix.txt non lo crea

[bdoriano]