Olimpo Informatico

[checcoline]

Ciao ragazzi sono dinuovo alle prese con un mal funzionamento del PC
si aprono pagine di internet all'impazzata, potreste darmi una controllato che non riesco a usare il pc in modo corretto
GRAZIE!!!!!

in più non so perchè mi funziona male AVG,, non fà gli aggiornamenti non so se dipende da questo........

[checcoline]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12.42.21, on 09/01/2009
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16711)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\rundll32.exe
C:\Windows\WindowsMobile\wmdSync.exe
C:\Windows\V0270Mon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\eHome\ehshell.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9f.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\explorer.exe
C:\Program Files\Nero\Nero 7\Nero StartSmart\NeroStartSmart.exe
C:\Program Files\Nero\Nero 7\Nero Vision\NeroVision.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\DllHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar con blocco Pop-Up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [V0270Mon.exe] C:\Windows\V0270Mon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [EPSON Stylus Photo RX585 Series (Copia 1)] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICLE.EXE /FU "C:\Windows\TEMP\E_SF40E.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVIZIO DI RETE')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4819DFDF-ABC4-488C-A323-919848C51175} (Conviva Streaming Control) - http://portal3.rinera.com/download/ConvivaStreamingPlugin-1.7.0.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/VistaMSNPUpldit-it.cab
O16 - DPF: {6D2EF4B4-CB62-4C0B-85F3-B79C236D702C} (ContactExtractor Class) - http://www.facebook.com/controls/contactx.dll
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game02.zylom.com/activex/zylomgamesplayer.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{42C427C7-712B-4FB8-B670-FBBC180DBA60}: NameServer = 85.255.115.235,85.255.112.171
O17 - HKLM\System\CCS\Services\Tcpip\..\{9163B982-B326-4EB4-828F-897AC09B777C}: NameServer = 85.255.115.235,85.255.112.171
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.235,85.255.112.171
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.235,85.255.112.171
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

--
End of file - 7676 bytes

[mdweb]

Temo che sia il mio stesso problema,guarda qui:
http://forum.zeusnews.com/viewtopic.php?t=38770&start=0

[checcoline]

ho letto il tuo topic,, hai anche tu AVG,, ma io facendo la scansione non ho riscontrato virus ma solo cookies

[Riverside]

[checcoline]

spero di aver fatto tutti i passaggi correttamente....... mille grazie


http://wikisend.com/download/581126/hijackthis.log

http://wikisend.com/download/532962/mbam-log-2009-01-09 (21-30-57).txt

http://wikisend.com/download/556748/SUPERAntiSpyware Scan Log - 01-09-2009 - 15-10-17.log

[Riverside]

Disattiva, temporaneamente, il tuo antivirus (dalla icona presente nella traybar accanto all'orologio) e, scarica ed installa Kaspersky Virus Removal tool: clicca qui per il download

● al termine della installazione verrà mostrata la schermata principale del tool
● seleziona la partizione da cansionare e clicca su Scan per avviare la scansione
● terminata la scansione, in caso di rilevazione di infezioni, clicca su Neutralize all
● si apriranno dei popup dove potrai scegliere se Cancellare o Disinfettare l'oggetto
● metti la spunta su Apply to all e clicca su Quarantine
● per salvare il Report che verrà rilasciato, clicca sul tasto Reports, salvalo sul Desktop e lo alleghi

Terminate tutte le operazioni, chiudi il programma che si autodisinstallerà.

Poi, scarica ed esegui Combofix clicca qui per il download ed allega il log che verrà rilasciato.

[checcoline]

Ciao Riverside

scusa il ritardo ma non ci sono stato in questi giorni,, pensavo che avevo eliminato tutto invece kasper mi ha individuato altri 2 worm
GRAZIE


ComboFix 09-01-11.03 - Checco 2009-01-12 14.15.04.1 - NTFSx86
Microsoft® Windows Vista? Home Premium 6.0.6000.0.1252.1.1040.18.3326.2031 [GMT 1:00]
Eseguito da: c:\users\Checco\Documents\Progammi\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Outdated)
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

D:\resycled
E:\Autorun.inf
E:\resycled
e:\resycled\boot.com

.
((((((((((((((((((((((((( Files Creati Da 2008-12-12 al 2009-01-12 )))))))))))))))))))))))))))))))))))
.

2009-01-12 10:22 . 2009-01-12 10:22 <DIR> d-------- c:\users\All Users\is-TRIFO
2009-01-12 10:22 . 2009-01-12 10:22 <DIR> d-------- c:\programdata\is-TRIFO
2009-01-12 10:22 . 2009-01-12 13:14 4,692,000 --ahs---- c:\windows\System32\drivers\fidbox.dat
2009-01-12 10:22 . 2009-01-12 13:14 57,104 --ahs---- c:\windows\System32\drivers\fidbox.idx
2009-01-09 19:47 . 2009-01-09 19:47 <DIR> d-------- c:\users\Checco\AppData\Roaming\Malwarebytes
2009-01-09 19:47 . 2009-01-09 19:47 <DIR> d-------- c:\users\All Users\Malwarebytes
2009-01-09 19:47 . 2009-01-09 19:47 <DIR> d-------- c:\programdata\Malwarebytes
2009-01-09 19:47 . 2009-01-09 19:47 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-01-09 19:47 . 2009-01-04 18:38 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys
2009-01-09 19:47 . 2009-01-04 18:38 15,504 --a------ c:\windows\System32\drivers\mbam.sys
2009-01-09 19:38 . 2009-01-09 19:38 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2009-01-09 13:37 . 2009-01-09 13:37 <DIR> d-------- c:\users\Checco\AppData\Roaming\SUPERAntiSpyware.com
2009-01-09 13:37 . 2009-01-09 13:37 <DIR> d-------- c:\users\All Users\SUPERAntiSpyware.com
2009-01-09 13:37 . 2009-01-09 13:37 <DIR> d-------- c:\programdata\SUPERAntiSpyware.com
2009-01-09 13:37 . 2009-01-09 19:38 <DIR> d-------- c:\program files\SUPERAntiSpyware
2009-01-09 12:18 . 2009-01-09 12:18 <DIR> d-------- c:\program files\Trend Micro
2009-01-08 22:29 . 2009-01-08 22:29 <DIR> d-------- c:\users\Checco\AppData\Roaming\Babylon
2009-01-08 22:29 . 2009-01-08 22:29 <DIR> d-------- c:\users\All Users\Babylon
2009-01-08 22:29 . 2009-01-08 22:29 <DIR> d-------- c:\programdata\Babylon
2009-01-08 13:20 . 2009-01-08 13:20 <DIR> d-------- c:\users\Checco\AppData\Roaming\Wireshark
2009-01-08 01:10 . 2009-01-08 01:11 <DIR> d-------- c:\users\All Users\eMule
2009-01-08 01:10 . 2009-01-08 01:11 <DIR> d-------- c:\programdata\eMule
2009-01-08 01:10 . 2009-01-08 01:10 <DIR> d-------- c:\program files\eMule
2009-01-08 01:07 . 2009-01-08 01:09 <DIR> d-------- c:\users\Checco\AppData\Roaming\uTorrent
2009-01-08 00:52 . 2009-01-08 00:52 <DIR> d-------- c:\windows\System32\QuickTime
2009-01-08 00:52 . 2009-01-08 00:53 <DIR> d-------- c:\program files\QuickTime
2009-01-08 00:52 . 1999-11-10 11:05 86,016 --a------ c:\windows\unvise32qt.exe
2009-01-08 00:51 . 2009-01-08 00:52 <DIR> d-------- c:\users\All Users\QuickTime
2009-01-08 00:51 . 2009-01-08 00:52 <DIR> d-------- c:\programdata\QuickTime
2009-01-02 22:37 . 2009-01-02 22:39 <DIR> d-------- c:\users\Checco\AppData\Roaming\muvee Technologies
2009-01-02 22:34 . 2009-01-02 22:34 <DIR> d-------- c:\users\Checco\AppData\Roaming\Creative
2009-01-02 22:31 . 2003-06-12 23:25 7,062 --a------ c:\windows\System32\audiopid.vxd
2009-01-02 22:30 . 2000-05-22 09:58 647,872 --------- c:\windows\System32\Mscomct2.ocx
2009-01-02 22:30 . 1999-10-10 18:00 41,984 --------- c:\windows\Ctregrun.exe
2009-01-02 22:28 . 2009-01-02 22:28 <DIR> d-------- c:\users\All Users\muvee Technologies
2009-01-02 22:28 . 2009-01-02 22:28 <DIR> d-------- c:\programdata\muvee Technologies
2009-01-02 22:28 . 1998-06-17 18:08 57,344 --------- c:\windows\System32\Mfc42loc.dll
2009-01-02 22:27 . 1998-10-06 18:57 327,168 --a------ c:\windows\IsUn0410.exe
2009-01-02 22:25 . 2009-01-02 22:30 <DIR> d-------- c:\program files\Creative

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-09 19:47 --------- d-----w c:\program files\CCleaner
2009-01-08 17:07 --------- d-----w c:\programdata\avg8
2009-01-07 11:41 --------- d-----w c:\users\Checco\AppData\Roaming\dvdcss
2009-01-06 17:48 --------- d-----w c:\users\Checco\AppData\Roaming\Skype
2009-01-06 17:32 --------- d-----w c:\users\Checco\AppData\Roaming\skypePM
2009-01-02 21:43 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-02 21:29 --------- d-----w c:\program files\Common Files\InstallShield
2008-12-10 11:18 --------- d-----w c:\program files\Yahoo!
2008-12-10 10:32 97,928 ----a-w c:\windows\system32\drivers\avgldx86.sys
2008-12-10 10:32 10,520 ----a-w c:\windows\System32\avgrsstx.dll
2008-12-10 10:32 --------- d-----w c:\program files\AVG
2008-12-02 17:23 --------- d-----w c:\program files\NCH Software
2008-11-24 17:52 56 ---ha-w c:\users\All Users\ezsidmv.dat
2008-11-24 17:52 56 ---ha-w c:\programdata\ezsidmv.dat
2008-11-24 17:45 --------- d-----w c:\programdata\Skype
2008-11-24 17:45 --------- d-----w c:\program files\Skype
2008-11-24 17:45 --------- d-----w c:\program files\Common Files\Skype
2008-11-15 14:39 --------- d-----w c:\program files\Boris FX, Inc
2008-11-14 10:52 --------- d-----w c:\programdata\Apple
2008-11-14 10:52 --------- d-----w c:\program files\Apple Software Update
2008-08-26 01:26 174 --sha-w c:\program files\desktop.ini
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-08-26 1232896]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-01-15 147456]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]
"EPSON Stylus Photo RX585 Series (Copia 1)"="c:\windows\system32\spool\DRIVERS\W32X86\3\E_FATICLE.EXE" [2007-03-30 182272]
"Creative Live! Cam Manager"="c:\program files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe" [2006-09-06 143360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13535776]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 92704]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2006-11-02 215552]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-12-10 1261336]
"V0270Mon.exe"="c:\windows\V0270Mon.exe" [2006-09-26 32768]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-08 77824]

c:\users\Checco\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1988824667-4001506291-1693971121-1000]
"EnableNotificationsRef"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{99ECED76-ECA2-4848-B791-050E85FA0964}"= UDP:c:\program files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe:Assassin's Creed Dx9
"{197658F0-B183-473C-AC06-0EAF0BF5362C}"= TCP:c:\program files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe:Assassin's Creed Dx9
"{5E96B09D-47A6-454D-9055-D7B88118EE8F}"= UDP:c:\program files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe:Assassin's Creed Dx10
"{2C98BEF8-E117-40C0-A9D0-B2807A34C0F2}"= TCP:c:\program files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe:Assassin's Creed Dx10
"{9FC2DFFF-B486-48BC-8F7F-1DF53CADD2F5}"= UDP:c:\program files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe:Assassin's Creed Update
"{1E628EDC-C0B8-4B52-9C4C-B79A7D5AD0E2}"= TCP:c:\program files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe:Assassin's Creed Update
"{27685FEF-4447-4F7C-97C7-6B7D2E917139}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{C39B0322-6BF0-4357-A648-F6FE3C199580}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{B555A5CE-693D-4022-9053-CC889D0BC9E0}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"TCP Query User{C159173F-7C4D-447F-B1AB-FBD98436DBFC}c:\\windows\\system32\\spool\\drivers\\w32x86\\3\\e_dupa20.exe"= UDP:c:\windows\system32\spool\drivers\w32x86\3\e_dupa20.exe:EPSON Driver Update
"UDP Query User{FDC7160E-58E0-4A58-8CB9-B6D412F365A6}c:\\windows\\system32\\spool\\drivers\\w32x86\\3\\e_dupa20.exe"= TCP:c:\windows\system32\spool\drivers\w32x86\3\e_dupa20.exe:EPSON Driver Update
"{0AD3F3E1-0B34-4F35-A197-73494B14F1E3}"= UDP:990:LocalSubnet:LocalSubnet|IF={4714CDC1-3F92-490F-A6D9-F8F89635F91A}|%SystemRoot%\system32\svchost.exe|Svc=rapimgr:@%systemroot%\WindowsMobile\wmdSync.exe,-4001
"TCP Query User{963C6ED6-4FD0-4FB6-AA59-971116289752}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{6B7B20B9-0A8B-4F71-8359-8429425C7A43}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"{5BF57A2F-C165-4E6B-B241-177E0F9F38C0}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{84B228C3-69BC-4AE9-9EFB-365A9845306F}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe
"TCP Query User{F3A0F6B2-C235-419B-A594-29868797AF22}c:\\program files\\sightspeed\\sightspeed.exe"= UDP:c:\program files\sightspeed\sightspeed.exe:SightSpeed
"UDP Query User{8DBD4613-DA25-48EF-8EE2-983C17D65551}c:\\program files\\sightspeed\\sightspeed.exe"= TCP:c:\program files\sightspeed\sightspeed.exe:SightSpeed
"TCP Query User{388391C5-015F-4AE7-8341-1B38A617E380}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{E608229E-FF3D-434D-AC8F-70CF26D227E5}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [2008-12-10 97928]
R3 VF0270Dev;Live! Cam Optia;c:\windows\System32\drivers\V0270Dev.sys [2009-01-02 225632]
R3 VF0270Vfx;VF0270 Video FX;c:\windows\System32\drivers\V0270Vfx.sys [2009-01-02 6912]
R4 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-12-10 231704]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-12-22 7408]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3579e530-7daf-11dd-a02f-001e8cc57941}]
\shell\auto\command - K:\Knight.exe open
\shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL K:\Knight.exe open
\shell\explore\command - K:\Knight.exe open
\shell\find\command - K:\Knight.exe open
\shell\install\command - K:\Knight.exe open
\shell\open\command - K:\Knight.exe open

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{996513c6-c1e4-11dd-a512-001e8cc57941}]
\shell\AutoRun\command - K:\xrdygg.bat
\shell\explore\Command - K:\xrdygg.bat
\shell\open\Command - K:\xrdygg.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ad994d06-9df4-11dd-8ecf-001e8cc57941}]
\shell\AutoRun\command - K:\
\shell\open\Command - rundll32.exe .\desktop.dll,InstallM
.
.
------- Supplementare di scansione -------
.
uStart Page = hxxp://www.google.it/
uInternet Settings,ProxyOverride = *.local
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O16 -: {4819DFDF-ABC4-488C-A323-919848C51175} - c:\windows\Downloaded Program Files\convivaproxy.inf

- hxxp://portal3.rinera.com/download/ConvivaStreamingPlugin-1.7.0.cab

c:\windows\Downloaded Program Files\contactx.dll - O16 -: {6D2EF4B4-CB62-4C0B-85F3-B79C236D702C}
hxxp://www.facebook.com/controls/contactx.dll

c:\windows\Downloaded Program Files\zylomgamesplayer.dll - O16 -: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B}
hxxp://game02.zylom.com/activex/zylomgamesplayer.cab
c:\windows\Downloaded Program Files\ZylomGamesPlayer.inf
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-12 14:16:05
Windows 6.0.6000 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

- - - - - - - > 'winlogon.exe'(616)
c:\windows\system32\avgrsstx.dll

- - - - - - - > 'lsass.exe'(640)
c:\windows\system32\avgrsstx.dll
.
Ora fine scansione: 2009-01-12 14.16.59
ComboFix-quarantined-files.txt 2009-01-12 13:16:57

Pre-Run: 547.222.343.680 byte disponibili
Post-Run: 547,198,889,984 byte disponibili

189 --- E O F --- 2008-08-27 01:04:54

[checcoline]

Statistics
----------
Object Scanned Detected Untreated Deleted Moved to Quarantine Archives Packed files Password protected Corrupted
------ ------- -------- --------- ------- ------------------- -------- ------------ ------------------ ---------
All objects 809354 2 0 2 0 7961 1551 42 23
System memory 6175 0 0 0 0 0 67 0 0
Startup objects 696 0 0 0 0 0 14 0 0
Disk boot sectors 5 0 0 0 0 0 0 0 0
HP (C 743134 0 0 0 0 7637 1470 42 23
CHECCO_PROJECT (D 59344 2 0 2 0 324 0 0 0


Settings
--------
Parameter Value
--------- -----
Security Level Recommended
Action Prompt for action when the scan is complete
Run mode Manually
File types Scan all files
Scan only new and changed files No
Scan archives All
Scan embedded OLE objects All
Skip if object is larger than No
Skip if scan takes longer than No
Parse email formats No
Scan password-protected archives No
Enable iChecker technology No
Enable iSwift technology No
Show detected threats on "Detected" tab Yes
Rootkits search Yes
Deep rootkits search No
Use heuristic analyzer Yes


Quarantine
----------
Status Object Size Added
------ ------ ---- -----


Backup
------
Status Object Size
------ ------ ----
Infected: virus Worm.Win32.AutoTDSS.aea d:\resycled\boot.com 30 KB
Infected: virus Worm.Win32.AutoRun.spw d:\autorun.inf 255 bytes

[Riverside]

Allega un nuovo log di Hthis.
E per favore, la prossima volta, i log non li copiare ed incollare, ma li alleghi come richiesto:

[checcoline]

scusa pensavo che quest'altri non si potevano allegare con il wikisend

http://wikisend.com/download/521406/hijackthis.log

[Riverside]

Andiamo, davvero, male

Segui il percorso, individua il file che ti indico in rosso:
C:\Windows\V0270Mon.exe
fallo analizzare su Virustotal: clicca qui
ed allega il link al report che verrà rilasciato.

Poi rilancia HThis e fixa, immediatamente, le voci che ti indico sotto (spunta la casellina corrispondente ad ogni singola voce e, una volta spuntate tutte, clicca sul tasto Fixchecked):

O17 - HKLM\System\CCS\Services\Tcpip\..\{42C427C7-712B-4FB8-B670-FBBC180DBA60}: NameServer = 85.255.115.235,85.255.112.171

O17 - HKLM\System\CCS\Services\Tcpip\..\{9163B982-B326-4EB4-828F-897AC09B777C}: NameServer = 85.255.115.235,85.255.112.171

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.235,85.255.112.171

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.235,85.255.112.171

Quegli indirizzi IP puntano tutti, a server ucraini, quindi devi esserti beccato una variante di Gromozon/LinkOptimizer

Disinstalla AVG (come antivirus è davvero penoso, visto che non ti ha rilevato nulla, po ti farò installare Avira Antivir), seguendo questa procedura:
prima di procedere con la disinstallazione di AVG, arresta l'esecuzione dell'Antivirus dalla icona presente sulla traybar (altrimenti restano residui e finisce che ci crea un problema con un messaggio di errore su una bella schermata blu).
Tra l'altro, vedi se è possibile disinstallarlo, se presente, dal uninstall proprietario, quindi fai la verifica del caso:
> Start
> tutti i programmi
> cerca il riferimento ad AVG
> ti posizioni con il mouse sulla voce di riferimento
> si apre un menu a tendina: guarda se è presente la voce Uninstall; se è presente, lo disinstalli da li, altrimenti, con la normale procedura da Installazione Applicazioni

Poi, esegui un controllo nel registro, quindi:
> Start
> Esegui
> nella casella di dialogo digita Regedit e conferma con Ok
> naviga e localizza le seguenti chiavi:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG7Uninstall

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG6INSTALL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG8Uninstall

HKEY_LOCAL_MACHINE\SOFTWARE\AVG\Avg8

Se fossero presenti, eliminale.

Infine, esegui una pulizia dei problemi con CCleaner
Al termine, riavvia il sistema ed allega un nuovo log di Hthis.

[checcoline]

ho fatto analizzare il file solo che nella cartella lo trovato ma non è un .exe
comunque il link del report è questo

http://www.virustotal.com/it/analisis/35464bd89014854268879f8bb9573942

"spero di aver fatto bene il passaggio"

le voci 017 - HKLM non le ho trovate in HJK

ho disistallato AVG come mi hai detto tu e sono anche andato a cancellare le voci nel registro solo che ho trovato solo la voce numero 4

ho fatto la pulizia ho riavviato e fatto un nuovo log

http://wikisend.com/download/500334/hijackthis.log

[Riverside]

[checcoline]

hai ragione lo vedo anche io dal log

però devo dirti una cosa che forse può dipendere

quando apro HJK mi esce una schermata :

For some reason your system denied write access to the hosts file. if any hijacked domains are in this file,
hijackthis many NOT be able to fix this

if that happens you need to edit the file yourself. to do this, click start, run and type

notepad C:\ Windows\System32\driver\etc\hosts

and press enter. find the line(s) hijackthis reports and delete them.
save the file as 'hosts'. (with quotes) and reboot.

for vista: simply, exit hijackthis, right click on the hijackthis icon, choose 'run as administrator'.

comunque ora procedo con l'istallazione di antivir

GRAZIE

[Riverside]

Prova ad eseguire l'operazione con Hthis, lanciandolo come Amministratore, quindi:
> ti posizioni sulla icona di Hthis
> tasto destro del mouse
> nel menu a tendina scegli Esegui come Amministratore

[checcoline]

l'avviso non mi esce più e neanche i 017

http://wikisend.com/download/481610/hijackthis.log

mentre antivir mi ha scovato 6 warning

http://wikisend.com/download/613200/AVSCAN-20090113-141948-6843A9C3.LOG

[Riverside]

[checcoline]

ho eliminato combofix come richiesto,, solo che la cartella non lo trovata

questo è il nuovo log

http://wikisend.com/download/517202/InfoSat.txt

[Riverside]

Ok, direi che sei a posto.
Cestina, direttamente, Elibagla, la cartella che hai creato e tutti gli eventuali log.
Poi esegui una pulzia (sia normale che pulizia dei problemi) con CCleaner e dimmi se riscontri ancora problemi con il computer.