Olimpo Informatico

[Legatoalfuturo]

Ciao a tutti ragazzi,

stavolta è il mio PC che fa le bizze.

Il mio NOD32 continua spesoa trovarmi varianti di un cavallo di un cavallo di troia e le elimina mettendole in quarantena.

Potete dirmi se ho qualcosa di strano nel mio PC?

Grazie infinite

Marco

*************************************************
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19.24.02, on 23/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\windows\system32\winlogon.exe
C:\Programmi\Java\jre1.6.0_05\bin\jusched.exe
C:\Programmi\iTunes\iTunesHelper.exe
C:\Programmi\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Programmi\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Programmi\Creative\Creative Live! Cam\VideoFX\StartFX.exe
C:\Programmi\Eset\nod32kui.exe
C:\Programmi\Windows Live\Family Safety\fssui.exe
C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Programmi\Bonjour\mDNSResponder.exe
C:\Programmi\File comuni\Ahead\Lib\NMIndexStoreSvr.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Programmi\Eset\nod32krn.exe
C:\WINDOWS\system32\PSIService.exe
C:\Programmi\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Programmi\PC Connectivity Solution\ServiceLayer.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\Utente Principale\Documenti\File ricevuti\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.it/0SEITIT/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.it/0SEITIT/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.it/0SEITIT/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Programmi\Orbitdownloader\orbitcth.dll
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live OneCare Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Programmi\Windows Live\Family Safety\fssbho.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar2.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [netncfjg] "c:\windows\system32\netncfjg.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmi\File comuni\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Programmi\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [StartCCC] "C:\Programmi\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [AVFX Engine] C:\Programmi\Creative\Creative Live! Cam\VideoFX\StartFX.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [fssui] "C:\Programmi\Windows Live\Family Safety\fssui.exe" -autorun
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PeerGuardian] C:\Programmi\PeerGuardian2\pg2.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Programma di avvio BounceBack Launcher.lnk = ?
O4 - Global Startup: Orbit.lnk = C:\Programmi\Orbitdownloader\orbitdm.exe
O8 - Extra context menu item: &Download by Orbit - res://C:\Programmi\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Programmi\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: &Windows Live Search - res://C:\Programmi\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Programmi\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Programmi\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: Download Video - http://www.viloader.net/addon.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O15 - Trusted Zone: *.whataboutadog.com
O15 - Trusted Zone: *.whataboutarabit.com
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://eu-housecall.trendmicro-europe.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1182969701843
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su2/CTL_V02002/ocx/15034/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{489F4276-3A2F-4B99-8B48-A4ED82C9FFF8}: NameServer = 193.70.152.15,193.70.152.25
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Programmi\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Programmi\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmi\Eset\nod32krn.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Programmi\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Programmi\Spyware Doctor\pctsSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programmi\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 10999 bytes

[bdoriano]

Ciao Legatoalfuturo,

vedo dal log che hai una nostra vecchia conoscenza...

• Disabilita il ripristino di sistema.
  
• Pulisci i files temporanei con ATF-Cleaner e/o CCleaner
  
• Fai questa scansione con FindAWF
  
• Segui le istruzioni di questo topic per postare il log di combofix.

[Legatoalfuturo]

Ciao Bdoriano!!

Ho fatto ciò che mi hai chiesto ed ecco qua, ti posto i tre log:
prima quello di Find AWF, poi quello di combofix ed infine quello di HijackThis che ho fatto al termine di tutto. Aseptto tue nuove

**********************************************
Find AWF report by noahdfear ©2006
Version 1.40



bak folders found
~~~~~~~~~~~

Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 7421-EB68

Directory di C:\PROGRA~1\TOMTOM~1\BAK

12/12/2006 17.08 3.577.512 TomTomHOME.exe
1 File 3.577.512 byte
2 Directory 11.054.784.512 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 7421-EB68

Directory di C:\WINDOWS\SYSTEM32\BAK

30/08/2004 21.00 15.360 ctfmon.exe
1 File 15.360 byte
2 Directory 11.054.784.512 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 7421-EB68

Directory di C:\PROGRA~1\HEWLET~1\HPSOFT~1\BAK

18/02/2004 18.55 49.152 HPWuSchd2.exe
1 File 49.152 byte
2 Directory 11.054.780.416 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 7421-EB68

Directory di C:\PROGRA~1\HP\HPCORE~1\BAK

22/12/2003 07.38 241.664 hpcmpmgr.exe
1 File 241.664 byte
6 Directory 11.054.780.416 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 7421-EB68

Directory di C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\BAK

04/03/2004 15.46 172.032 hpztsb10.exe
1 File 172.032 byte
2 Directory 11.054.780.416 byte disponibili


Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~

3577512 12 Dec 2006 "C:\Programmi\TomTom HOME\bak\TomTomHOME.exe"
23552 1 Dec 2007 "C:\WINDOWS\system32\ctfmon.exe"
15360 30 Aug 2004 "C:\WINDOWS\system32\bak\ctfmon.exe"
49152 18 Feb 2004 "C:\Programmi\Hewlett-Packard\HP Software Update\bak\HPWuSchd2.exe"
241664 22 Dec 2003 "C:\Programmi\HP\hpcoretech\bak\hpcmpmgr.exe"
531 12 Jun 2007 "C:\Programmi\HP\hpcoretech\data\EvntData-2006981715.xml"
324 17 Jul 2007 "C:\Programmi\HP\hpcoretech\bak\data\EvntData-338711970.xml"
172032 4 Mar 2004 "C:\WINDOWS\system32\spool\drivers\w32x86\3\bak\hpztsb10.exe"


end of report
*******************************************

*******************************************
ComboFix 08-03-23.2 - Utente Principale 2008-03-24 18:48:22.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1040.18.132 [GMT 1:00]
Eseguito da: C:\Documents and Settings\Utente Principale\Desktop\ComboFix.exe
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Creati Da 2008-02-24 al 2008-03-24 )))))))))))))))))))))))))))))))))))
.

2008-03-24 18:36 . 2008-03-24 18:36 <DIR> d-------- C:\Programmi\CCleaner
2008-03-24 14:20 . 2008-03-24 14:20 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Elaborate Bytes
2008-03-24 14:17 . 2008-03-24 14:19 48 ---hs---- C:\WINDOWS\SFED0B0AE.tmp
2008-03-24 14:15 . 2008-03-24 14:15 <DIR> d-------- C:\Programmi\Elaborate Bytes
2008-03-22 12:46 . 2008-03-22 12:58 <DIR> d-a------ C:\Documents and Settings\All Users\Dati applicazioni\TEMP
2008-03-22 12:45 . 2008-03-22 12:51 <DIR> d-------- C:\Programmi\Spyware Doctor
2008-03-22 12:45 . 2008-03-22 12:45 <DIR> d-------- C:\Documents and Settings\Utente Principale\Dati applicazioni\PC Tools
2008-03-22 12:45 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-03-22 12:45 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-03-22 12:45 . 2008-02-01 12:55 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-03-22 12:45 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-03-15 21:20 . 2008-03-15 21:27 <DIR> d-------- C:\ACER TRAVELMATE 4050
2008-03-15 16:40 . 2008-03-15 16:40 <DIR> d---s---- C:\WINDOWS\system32\%USERPROFILE%
2008-03-14 23:33 . 2008-03-14 23:33 <DIR> d-------- C:\Documents and Settings\Utente Principale\Dati applicazioni\Grisoft
2008-03-14 23:32 . 2008-03-14 23:32 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Grisoft
2008-03-14 23:32 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-03-14 23:25 . 2008-03-14 23:25 <DIR> d-------- C:\Programmi\File comuni\PC Tools
2008-03-14 23:25 . 2005-09-23 08:29 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2008-03-09 12:39 . 2007-06-07 21:38 <DIR> d--h----- C:\Documents and Settings\Administrator\Risorse di stampa
2008-03-09 12:39 . 2007-06-07 21:38 <DIR> d--h----- C:\Documents and Settings\Administrator\Risorse di rete
2008-03-09 12:39 . 2007-06-07 21:38 <DIR> d-------- C:\Documents and Settings\Administrator\Preferiti
2008-03-09 12:39 . 2007-06-07 19:44 <DIR> d--h----- C:\Documents and Settings\Administrator\Modelli
2008-03-09 12:39 . 2007-06-07 21:38 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Avvio
2008-03-09 12:39 . 2007-06-07 21:38 <DIR> d--h----- C:\Documents and Settings\Administrator\Impostazioni locali
2008-03-09 12:39 . 2007-06-07 21:38 <DIR> d-------- C:\Documents and Settings\Administrator\Documenti
2008-03-09 12:39 . 2007-06-07 21:38 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dati applicazioni
2008-02-28 21:54 . 2007-10-17 13:53 43,816 --a------ C:\WINDOWS\system32\drivers\fssfltr.sys
2008-02-28 21:52 . 2008-02-28 21:52 <DIR> d-------- C:\Programmi\Microsoft SQL Server Compact Edition
2008-02-28 21:41 . 2008-02-28 21:54 <DIR> d-------- C:\Programmi\Windows Live
2008-02-28 21:41 . 2008-02-28 21:41 <DIR> d--hsc--- C:\Programmi\File comuni\WindowsLiveInstaller
2008-02-28 21:41 . 2008-02-28 21:41 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\WLInstaller
2008-02-24 09:29 . 2008-02-24 09:29 <DIR> d-------- C:\Programmi\ieHTTPHeaders

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-24 17:37 --------- d-----w C:\Documents and Settings\Utente Principale\Dati applicazioni\Orbit
2008-03-24 08:27 --------- d-----w C:\Programmi\Orbitdownloader
2008-03-22 14:04 --------- d-----w C:\Programmi\eMule
2008-03-12 19:48 --------- d-----w C:\Programmi\Java
2008-02-23 08:12 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\Lavasoft
2008-02-23 08:11 --------- d-----w C:\Programmi\File comuni\Wise Installation Wizard
2008-02-16 10:39 360,064 ----a-w C:\WINDOWS\system32\drivers\TCPIP.SYS.ORIGINAL
2008-02-16 10:39 360,064 ----a-w C:\WINDOWS\system32\drivers\TCPIP.SYS
2008-02-12 19:58 --------- d-----w C:\Documents and Settings\Utente Principale\Dati applicazioni\ICQ
2008-02-12 19:45 --------- d--h--w C:\Programmi\InstallShield Installation Information
2008-02-08 19:07 --------- d-----w C:\Programmi\ESET
2008-02-07 21:12 512,096 ----a-w C:\WINDOWS\system32\drivers\amon.sys
2008-02-07 21:12 298,104 ----a-w C:\WINDOWS\system32\imon.dll
2008-02-07 21:12 15,424 ----a-w C:\WINDOWS\system32\drivers\nod32drv.sys
2008-02-07 21:07 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\Avg7
2008-02-07 20:59 --------- d-----w C:\Programmi\Spybot - Search & Destroy
2008-02-07 20:46 691,545 ----a-w C:\WINDOWS\unins000.exe
2008-02-03 12:35 --------- d-----w C:\Programmi\Creative
2008-01-28 19:48 --------- d-----w C:\Documents and Settings\Utente Principale\Dati applicazioni\AVG7
2008-01-27 21:04 --------- d-----w C:\Documents and Settings\Utente Principale\Dati applicazioni\uTorrent
2008-01-27 20:20 --------- d-----w C:\Programmi\uTorrent
2008-01-27 16:31 --------- d-----w C:\Documents and Settings\LocalService\Dati applicazioni\AVG7
2008-01-26 10:31 --------- d-----w C:\Documents and Settings\Utente Principale\Dati applicazioni\Creative
2008-01-26 10:20 --------- d-----w C:\Programmi\muvee Technologies
2008-01-26 10:20 --------- d-----w C:\Programmi\File comuni\muvee Technologies
2008-01-26 10:20 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\muvee Technologies
2008-01-26 10:19 --------- d-----w C:\Programmi\SightSpeed
2008-01-25 22:45 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\ATI
2008-01-25 22:41 --------- d-----w C:\Programmi\ATI Technologies
2008-01-24 21:24 --------- d-----w C:\Programmi\PeerGuardian2
.

------- Sigcheck -------

2006-04-20 13:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys
2007-10-30 17:53 360832 64798ecfa43d78c7178375fcdd16d8c8 C:\WINDOWS\$hf_mig$\KB941644\SP2QFE\tcpip.sys
2004-08-30 21:00 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\$NtUninstallKB917953$\tcpip.sys
2007-12-30 11:36 359808 de891ad282e856acfd40990094a63b6f C:\WINDOWS\$NtUninstallKB941644$\tcpip.sys
2008-02-16 11:39 360064 8283a4d489b207991efdc8328733d0bc C:\WINDOWS\system32\dllcache\TCPIP.SYS
2008-02-16 11:39 360064 8283a4d489b207991efdc8328733d0bc C:\WINDOWS\system32\drivers\TCPIP.SYS
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* i valori vuoti & legittimi/default non sono visualizzati.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4f3ed5cd-0726-42a9-87f5-d13f3d2976ac}]
2007-10-17 13:53 57384 --a------ C:\Programmi\Windows Live\Family Safety\fssbho.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-14 21:14 68856]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe" [2006-08-30 14:05 139264]
"MSMSGS"="C:\Programmi\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]
"PeerGuardian"="C:\Programmi\PeerGuardian2\pg2.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 12:47 57344 C:\WINDOWS\ALCXMNTR.EXE]
"netncfjg"="c:\windows\system32\netncfjg.exe" [2004-08-30 21:00 15461]
"NeroFilterCheck"="C:\Programmi\File comuni\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648]
"Adobe Reader Speed Launcher"="C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"SunJavaUpdateSched"="C:\Programmi\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"QuickTime Task"="C:\Programmi\QuickTime\qttask.exe" [2007-06-29 05:24 286720]
"iTunesHelper"="C:\Programmi\iTunes\iTunesHelper.exe" [2007-08-15 19:15 271672]
"PCSuiteTrayApplication"="C:\Programmi\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 14:10 271360]
"StartCCC"="C:\Programmi\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112]
"AVFX Engine"="C:\Programmi\Creative\Creative Live! Cam\VideoFX\StartFX.exe" [2006-10-19 19:44 20480]
"nod32kui"="C:\Programmi\Eset\nod32kui.exe" [2008-02-07 22:12 949376]
"fssui"="C:\Programmi\Windows Live\Family Safety\fssui.exe" [2007-10-17 13:53 243240]
"!AVG Anti-Spyware"="C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2007-12-01 16:28 23552]
"Nokia.PCSync"="C:\Programmi\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 09:17 1241088]

C:\Documents and Settings\Utente Principale\Menu Avvio\Programmi\Esecuzione automatica\
Programma di avvio BounceBack Launcher.lnk - C:\Programmi\CMS Products\BounceBack Express\BBLauncher.exe [2007-12-03 19:46:29 93888]

C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Orbit.lnk - C:\Programmi\Orbitdownloader\orbitdm.exe [2007-12-02 10:18:10 1678536]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programmi\\Bonjour\\mDNSResponder.exe"=
"C:\\Programmi\\eMule\\emule.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Programmi\\iTunes\\iTunes.exe"=
"C:\\Programmi\\Internet Explorer\\iexplore.exe"=
"C:\\Programmi\\Orbitdownloader\\orbitdm.exe"=
"C:\\Programmi\\Orbitdownloader\\orbitnet.exe"=
"C:\\Programmi\\uTorrent\\uTorrent.exe"=
"C:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Programmi\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Programmi\\Kyodai Mahjongg 2006\\kmj.exe"=

R2 fssfltr;FssFltr;C:\WINDOWS\system32\DRIVERS\fssfltr.sys [2007-10-17 13:53]
R2 fsssvc;Windows Live OneCare Family Safety;"C:\Programmi\Windows Live\Family Safety\fsssvc.exe" [2007-10-17 13:53]
S3 gAGP440p;gAGP440p;C:\DOCUME~1\UTENTE~1\IMPOST~1\Temp\gAGP440p.sys []

.
Contenuto della cartella 'Scheduled Tasks'
"2007-10-25 11:09:55 C:\WINDOWS\Tasks\abppyntf.job"
- c:\windows\system32\netncfjg.exe
"2007-11-01 15:48:29 C:\WINDOWS\Tasks\afd.job"
- c:\windows\system32\netncfjg.exe
"2007-06-27 21:21:03 C:\WINDOWS\Tasks\afxqg.job"
*******************************************************


*******************************************************
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:54, on 2008-03-24
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\windows\system32\services.exe
C:\Programmi\Bonjour\mDNSResponder.exe
C:\Programmi\Java\jre1.6.0_05\bin\jusched.exe
C:\Programmi\iTunes\iTunesHelper.exe
C:\Programmi\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Programmi\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Programmi\Creative\Creative Live! Cam\VideoFX\StartFX.exe
C:\Programmi\Windows Live\Family Safety\fssui.exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\Eset\nod32krn.exe
C:\WINDOWS\system32\PSIService.exe
C:\Programmi\File comuni\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Programmi\PC Connectivity Solution\ServiceLayer.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\Programmi\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Utente Principale\Documenti\File ricevuti\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.it/0SEITIT/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Programmi\Orbitdownloader\orbitcth.dll
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live OneCare Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Programmi\Windows Live\Family Safety\fssbho.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar2.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [netncfjg] "c:\windows\system32\netncfjg.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmi\File comuni\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Programmi\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [StartCCC] "C:\Programmi\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [AVFX Engine] C:\Programmi\Creative\Creative Live! Cam\VideoFX\StartFX.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [fssui] "C:\Programmi\Windows Live\Family Safety\fssui.exe" -autorun
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PeerGuardian] C:\Programmi\PeerGuardian2\pg2.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Programma di avvio BounceBack Launcher.lnk = ?
O4 - Global Startup: Orbit.lnk = C:\Programmi\Orbitdownloader\orbitdm.exe
O8 - Extra context menu item: &Download by Orbit - res://C:\Programmi\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Programmi\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: &Windows Live Search - res://C:\Programmi\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Programmi\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Programmi\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: Download Video - http://www.viloader.net/addon.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O15 - Trusted Zone: *.whataboutarabit.com
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://eu-housecall.trendmicro-europe.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1182969701843
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su2/CTL_V02002/ocx/15034/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{489F4276-3A2F-4B99-8B48-A4ED82C9FFF8}: NameServer = 193.70.152.15,193.70.152.25
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Programmi\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Programmi\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmi\Eset\nod32krn.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Programmi\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Programmi\Spyware Doctor\pctsSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programmi\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 10577 bytes
***********************************************

[bdoriano]

Scarica avenger e scompattalo in una sua cartella non temporanea e non sul desktop

Avvia AVENGER
Clicca Ok
Inserisci queste righe nel riquadro bianco:

[Legatoalfuturo]

Ho avviato The Avenger ma, dopo aver copiato ed incollato le righe di comando che mi hai postato ed avendo cliccato su EXECUTe, il programma mi ha restituito un messaggio di errore che dice
"Error: Invalid script. A valid script must begin with a a command directive. Aborting execution!"
E il sistema non si riavvia, rimanendo aperta la finestra del programma.

Come devo comportarmi?

[bdoriano]

Proviamo a cambiare l'ordine dei comandi

[Legatoalfuturo]

Niente da fare, restituisce lo stesso messaggio d'errore.

Ho scompattato il file in C:\Avenger

[bdoriano]

Proviamo un'altra strada...

• Clicca qui (tenendo premuto il tasto CTRL).
  
• Dopo qualche secondo ti parte il download del programma di scansione.
  Si chiamerà SYS#####. Dove, al posto dei #####, ci saranno dei numeri casuali.
  
• Salvalo dove vuoi tu (anche sul desktop)
  
• Avvia il programma che hai appena scaricato (doppio click sull'icona)
  
  
• metti il segno di spunta a I have read and agree. Please let me free to proceed e clicca su Proceed
  
  
• clicca su Removal Script
  
  
• Nel riquadro inserisci il seguente script:
  

  Codice:

  Registry values to delete: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | netncfjg Files to delete: C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\SFED0B0AE.tmp c:\windows\system32\netncfjg.exe C:\WINDOWS\Tasks\abppyntf.job C:\WINDOWS\Tasks\afd.job C:\WINDOWS\Tasks\afxqg.job Files to move: C:\WINDOWS\system32\bak\ctfmon.exe | C:\WINDOWS\system32\ctfmon.exe

  
  e clicca Proceed with removal
  
  Il pc dovrebbe riavviarsi, se così non fosse, riavvialo tu.
  Al termine dell'operazione, posta qui il contenuto del file C:\Avenger.txt con un log aggiornato di hijackthis.

[Legatoalfuturo]

Niente da fare di nuovo.

Una volta che clicco su PROCEED WITH REMOVAL, compare una finestra (SCRIPT ERROR!) che recita "PLEASE COPY AND PAST A VALID SCRIPT FILE"

[bdoriano]

Mapporcaccialamiseriaccia...

Crea un file di testo con le seguenti istruzioni:

[Legatoalfuturo]

Ciao Bdoriano,

ieri sera ho seguito la procedura che mi hai scritto ma.....dopo che combofix ha finito le sue operazioni, il sistema si è riavviato in automatico e ..... il sistema operativo non si carica più!!!!

Ho provato a riaccendere il PC altre tre volte, provando anche a lanciare la modalità provvisoria ma....dopo un paio di schermate iniziali, lo schermo rimane nero con la freccia del mouse.

Ed ora che faccio?????????

[bdoriano]

Orpo! Addirittura?

Se hai il cd di Windows, possiamo entrare da console di ripristino e vedere di combinare qualcosa.
Presumo che il problema sia dovuto al file ctfmon.exe che non viene più trovato dove deve essere.

A grandi linee:

• inserisci il cd di windows xp
  
• avvii da cd
  
• scegli di entrare in console di ripristino (R)
  
• ti chiede su quale installazione di windows vuoi lavorare (dovrebbe essere 1)
  
• ti chiede la password di amministratore (di solito, basta premere invio)
  
• ti catapulta nella cartella C:\Windows
  
• a questo punto, digita

  Codice:

  cd C:\Windows\System32\bak

  e premi invio
  
• digita

  Codice:

  copy ctfmon.exe ..

  e premi invio
  
• riavvia il pc (togliendo il cd)
  
• vediamo se riparte normalmente

[Legatoalfuturo]

Proverò stasera, adesso sono al lavoro.....

potresti indicarmi nel dettaglio la procedura che dovrei seguire?

Seguire delle indicazioni a grandi linee temo che possa portarmi in confusione se il sistema mi pone davanti opzioni diverse.

Ti ringrazio

[Legatoalfuturo]

Scua Bdoriano ma.....quel file non viene installato da Office invece che da Windows?

[Legatoalfuturo]

Ciao Bdoriano,

nel caso in cui stasera, effettuando le operazioni che tu mi dici, non riuscissi ugualmente ad avviare il sistema cosa dovrei fare in alternativa?

In questo modo, se la cosa fossse inefficace, avrei una soluzione successiva da provare sulla macchina senza attendere a domani sera.

Ti ringrazio

Ciao

[bdoriano]

Più tardi ti segno tutta la procedura da utilizzare per usare la console di ripristino.
Nel frattempo, dai un'occhiata a questo messaggio che si riferisce all'uso di UBCD4WIN.
O quest'altro thread dove si menzionano diverse distribuzioni linux per verificare la presenza di virus.

La connessione internet avviene tramite modem usb o router ethernet?

Si, il file ctfmon.exe fa parte del bagaglio Office... ma è l'unico file "di sistema" che ti ho fatto cancellare perché era infetto.

[Legatoalfuturo]

Ok, mi stampo tutto.....quanto alla connessione Internet, utilizzo un Router/Modem US Robotics

[Legatoalfuturo]

Non ricordo se il router è connesso alla porta Ethernet o alla porta USB, ma comunque funziona come router, non come modem

[bdoriano]

1. Inserisci il cd di XP e riavvia il computer eseguendo il boot da cd.
   
2. Premi un tasto qualsiasi quando verrà chiesto di farlo per fare il boot dal cd.
   
3. Quando viene proposto di installare Windows premi invece R per accedere alla Console di ripristino
   
4. Ti verrà chiesto di scegliere l'installazione a cui accedere. (dovrebbe essere 1)
   
5. Inserisci la password dell'utente Administrator (di norma è vuota e basta dare invio)
   
6. a questo punto, digita

   Codice:

   cd C:\Windows\System32\bak

   e premi invio
   
7. digita

   Codice:

   copy ctfmon.exe ..

   e premi invio
   
8. riavvia il pc (togliendo il cd)
   
9. vediamo se riparte normalmente

[Legatoalfuturo]

Ciao Bdoriano,

ieri sera ho fatto ciò che mi hai detto ma, sebbene il file ctfmon.exe sia stato rimesso al suo posto nel sistema, il PC continua a non riavviarsi.
Dopo la schermatra di Windows XP con la barra scorrevole, viene una schermata neraq con solo l'icona del mouse e si pianta lì' senza fare niente.

Che facciamo?