Olimpo Informatico

[quasar186]

Ragazzi va alla grande!!!
1. Il pc non si riavvia più! Nè quando uso Google Earth nè quando collego l'hd esterno!
2. Adobe Reader ha ripreso a funzionare benissimo!
3. Combofix ha finalmente girato correttamente e generato un log! Eccolo qua:

ComboFix 08-05-29.1 - WinXp 2008-05-30 21.46.22.8 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1040.18.658 [GMT 2:00]
Eseguito da: C:\Documents and Settings\WinXp\Desktop\ComboFix.exe
* Creato nuovo punto di ripristino

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr1.dat
C:\WINDOWS\Downloaded Program Files\setup.inf

.
((((((((((((((((((((((((( Files Creati Da 2008-04-28 al 2008-05-30 )))))))))))))))))))))))))))))))))))
.

2008-05-28 22:52 . 2008-05-28 22:52 <DIR> d-------- C:\WINDOWS\SiS
2008-05-28 22:52 . 2008-05-28 22:52 <DIR> d-------- C:\Programmi\Multimedia V3.54
2008-05-28 22:52 . 2003-10-30 14:10 667,648 --a------ C:\WINDOWS\system32\sistray.exe
2008-05-28 22:52 . 2003-10-30 14:09 249,856 --a------ C:\WINDOWS\system32\Keyhook.exe
2008-05-28 22:52 . 2003-10-30 14:07 176,128 --------- C:\WINDOWS\system32\SiSApCom.dll
2008-05-28 22:52 . 2003-10-30 14:11 106,496 --------- C:\WINDOWS\system32\TVModeLib.dll
2008-05-28 22:51 . 2003-10-30 03:35 1,861,817 --a------ C:\WINDOWS\system32\sisgl.dll
2008-05-28 22:51 . 2003-10-30 03:01 1,118,720 --a------ C:\WINDOWS\system32\sisgrv.dll
2008-05-28 22:51 . 2003-10-30 03:01 1,118,720 --a--c--- C:\WINDOWS\system32\dllcache\sisgrv.dll
2008-05-28 22:51 . 2003-10-30 14:08 258,048 --a------ C:\WINDOWS\system32\SiSParse.dll
2008-05-28 22:51 . 2003-10-30 14:08 172,032 --a------ C:\WINDOWS\system32\SiSInst.dll
2008-05-28 22:51 . 2003-10-01 16:30 65,536 --a------ C:\WINDOWS\system32\sis660.bin
2008-05-28 22:51 . 2003-10-30 14:07 49,152 --a------ C:\WINDOWS\system32\SiSBase.dll
2008-05-28 22:51 . 2003-10-30 03:36 11,264 --a------ C:\WINDOWS\system32\drivers\srvkp.sys
2008-05-28 22:51 . 2003-10-30 14:08 5,632 --a------ C:\WINDOWS\system32\instFunc.dll
2008-05-28 22:47 . 2008-05-28 22:52 <DIR> d-------- C:\WINDOWS\system32\trayres
2008-05-28 22:47 . 2008-05-28 22:53 102,387 --a------ C:\WINDOWS\system32\VGAunistlog.ini
2008-05-17 08:47 . 2008-05-17 08:47 <DIR> d-------- C:\Programmi\PC Wizard 2008
2008-05-17 08:47 . 2007-09-15 15:11 27,136 --a------ C:\WINDOWS\system32\PCWizard.cpl
2008-05-16 15:12 . 2008-05-16 15:12 66,048 --a------ C:\mbr.exe
2008-05-14 13:28 . 2008-05-14 13:30 <DIR> d-------- C:\Programmi\EsetOnlineScanner
2008-05-14 11:08 . 2008-05-28 17:57 <DIR> d-------- C:\Programmi\Unlocker
2008-05-12 14:02 . 2008-05-12 14:52 <DIR> d-------- C:\VEXPLITE
2008-05-12 14:02 . 2008-03-17 19:23 39,808 --a------ C:\WINDOWS\system32\drivers\VIRAGTLT.SYS
2008-05-04 20:01 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-05-04 20:01 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-05-04 20:01 . 2008-04-23 22:14 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-05-04 20:01 . 2008-04-23 22:14 82,944 --a------ C:\WINDOWS\system32\404Fix.exe
2008-05-04 20:01 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-05-04 20:01 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-05-04 20:01 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-05-03 20:17 . 2008-05-30 14:02 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Google Updater
2008-05-03 18:29 . 2008-05-03 18:42 <DIR> d-------- C:\Programmi\Auslogics
2008-05-03 18:29 . 2008-05-03 19:05 <DIR> d-------- C:\Documents and Settings\WinXp\Dati applicazioni\Auslogics
2008-04-30 19:24 . 2008-05-07 15:24 <DIR> d-------- C:\suspectfile
2008-04-30 12:23 . 2008-04-30 12:27 <DIR> d-------- C:\fixwareout
2008-04-26 16:47 . 2008-05-07 18:35 1,691,680 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-04-26 16:47 . 2008-05-07 18:35 21,944 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-04-25 17:21 . 2008-05-04 20:02 1,726 --a------ C:\WINDOWS\system32\tmp.reg
2008-04-25 15:15 . 2008-04-25 15:15 <DIR> d-------- C:\Programmi\RogueRemover FREE
2008-04-24 10:03 . 2007-07-23 18:55 <DIR> d--h----- C:\Documents and Settings\Administrator\Risorse di stampa
2008-04-24 10:03 . 2007-07-23 18:55 <DIR> d--h----- C:\Documents and Settings\Administrator\Risorse di rete
2008-04-24 10:03 . 2007-07-23 18:55 <DIR> d-------- C:\Documents and Settings\Administrator\Preferiti
2008-04-24 10:03 . 2007-07-23 17:07 <DIR> d--h----- C:\Documents and Settings\Administrator\Modelli
2008-04-24 10:03 . 2007-07-23 18:55 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Avvio
2008-04-24 10:03 . 2008-05-30 21:47 <DIR> d--h----- C:\Documents and Settings\Administrator\Impostazioni locali
2008-04-24 10:03 . 2007-07-23 18:55 <DIR> d-------- C:\Documents and Settings\Administrator\Documenti
2008-04-24 10:03 . 2007-10-07 10:02 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dati applicazioni
2008-04-24 10:03 . 2008-04-24 10:03 <DIR> d-------- C:\Documents and Settings\Administrator
2008-04-22 16:19 . 2008-04-22 16:19 12,299,947 --------- C:\AVG7QT.DAT
2008-04-02 13:45 . 2008-04-03 19:55 1,100,930,384 --------- C:\(PC.GAME.ITA)Sim.City4.Deluxe.Edition.rar

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-30 07:38 --------- d-----w C:\Documents and Settings\WinXp\Dati applicazioni\AVG7
2008-05-28 20:52 --------- d--h--w C:\Programmi\InstallShield Installation Information
2008-05-03 18:19 --------- d-----w C:\Programmi\Google
2008-02-11 07:39 253,952 ----a-w C:\WINDOWS\system32\OnlineScannerDLLA.dll
2008-02-11 07:39 237,568 ----a-w C:\WINDOWS\system32\OnlineScannerDLLW.dll
2008-02-08 11:53 110,592 ----a-w C:\WINDOWS\system32\OnlineScannerLang.dll
2008-02-05 06:48 77,824 ----a-w C:\WINDOWS\system32\OnlineScannerUninstaller.exe
2008-02-04 17:11 62,800 ----a-w C:\Documents and Settings\WinXp\Dati applicazioni\GDIPFONTCACHEV1.DAT
2007-11-12 19:17 8,873 ----a-w C:\Documents and Settings\WinXp\a.exe
2007-07-23 15:37 66,484 ----a-w C:\Documents and Settings\All Users\Dati applicazioni\firstlsp.reg.dat
2001-11-23 04:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
.

((((((((((((((((((((((((((((( snapshot@2008-04-24_13.30.27,29 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-24 11:11:38 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-30 18:48:17 2,048 --s-a-w C:\WINDOWS\bootstat.dat
- 2000-08-31 06:00:00 73,728 ----a-w C:\WINDOWS\fdsv.exe
+ 2000-08-31 06:00:00 89,504 ----a-w C:\WINDOWS\fdsv.exe
+ 2008-05-03 18:19:44 26,694 ----a-r C:\WINDOWS\Installer\{97C0EA4A-1A0B-4C53-ACEB-49984DA79C90}\ARPPRODUCTICON.exe
+ 2008-05-03 18:19:44 26,694 ----a-r C:\WINDOWS\Installer\{97C0EA4A-1A0B-4C53-ACEB-49984DA79C90}\googleearth.exe_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
+ 2008-05-03 18:19:44 26,694 ----a-r C:\WINDOWS\Installer\{97C0EA4A-1A0B-4C53-ACEB-49984DA79C90}\googleearth.exe1_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
+ 2008-05-03 18:19:44 26,694 ----a-r C:\WINDOWS\Installer\{97C0EA4A-1A0B-4C53-ACEB-49984DA79C90}\ShortcutDX_EB071909B9884F8CBF3D6115D4ADEE5E.exe
+ 2008-05-03 18:19:44 26,694 ----a-r C:\WINDOWS\Installer\{97C0EA4A-1A0B-4C53-ACEB-49984DA79C90}\ShortcutOGL_EB071909B9884F8CBF3D6115D4ADEE5E.exe
+ 2008-05-03 18:19:44 26,694 ----a-r C:\WINDOWS\Installer\{97C0EA4A-1A0B-4C53-ACEB-49984DA79C90}\UNINST_Uninstall_G_408FFBEED62349E08B232864A94D2864.exe
- 2007-09-02 08:46:39 25,214 ----a-r C:\WINDOWS\Installer\{AC76BA86-7AD7-1033-7B44-A70001000000}\NewShortcut1_AC76BA867AD710337DCD7E8A45A00001.exe
+ 2008-05-13 16:44:50 25,214 ----a-r C:\WINDOWS\Installer\{AC76BA86-7AD7-1033-7B44-A70001000000}\NewShortcut1_AC76BA867AD710337DCD7E8A45A00001.exe
- 2007-09-02 08:46:39 25,214 ----a-r C:\WINDOWS\Installer\{AC76BA86-7AD7-1033-7B44-A70001000000}\Reader_PM_SC_NON_OPT_AC76BA867AD710337DCD7E8A45A00001.exe
+ 2008-05-13 16:44:51 25,214 ----a-r C:\WINDOWS\Installer\{AC76BA86-7AD7-1033-7B44-A70001000000}\Reader_PM_SC_NON_OPT_AC76BA867AD710337DCD7E8A45A00001.exe
- 2007-09-02 08:46:39 25,214 ----a-r C:\WINDOWS\Installer\{AC76BA86-7AD7-1033-7B44-A70001000000}\SC_Reader.exe
+ 2008-05-13 16:44:47 25,214 ----a-r C:\WINDOWS\Installer\{AC76BA86-7AD7-1033-7B44-A70001000000}\SC_Reader.exe
- 2004-08-19 13:39:18 2,804,224 -c--a-w C:\WINDOWS\system32\dllcache\msi.dll
+ 2005-05-04 12:45:32 2,890,240 -c--a-w C:\WINDOWS\system32\dllcache\msi.dll
- 2004-08-19 13:39:42 77,312 -c--a-w C:\WINDOWS\system32\dllcache\msiexec.exe
+ 2005-05-04 12:45:36 78,848 -c--a-w C:\WINDOWS\system32\dllcache\msiexec.exe
- 2004-08-19 13:39:18 331,264 -c--a-w C:\WINDOWS\system32\dllcache\msihnd.dll
+ 2005-05-04 12:45:36 271,360 -c--a-w C:\WINDOWS\system32\dllcache\msihnd.dll
- 2004-08-19 13:38:20 884,736 -c--a-w C:\WINDOWS\system32\dllcache\msimsg.dll
+ 2005-05-04 12:45:36 884,736 -c--a-w C:\WINDOWS\system32\dllcache\msimsg.dll
- 2004-08-19 13:39:18 44,032 -c--a-w C:\WINDOWS\system32\dllcache\msisip.dll
+ 2005-05-04 12:45:36 15,360 -c--a-w C:\WINDOWS\system32\dllcache\msisip.dll
- 2003-10-29 18:54:58 427,776 -c--a-w C:\WINDOWS\system32\dllcache\sisgrp.sys
+ 2003-10-30 00:54:58 427,776 -c--a-w C:\WINDOWS\system32\dllcache\sisgrp.sys
- 2003-10-29 18:54:58 427,776 ----a-r C:\WINDOWS\system32\drivers\sisgrp.sys
+ 2003-10-30 00:54:58 427,776 ----a-w C:\WINDOWS\system32\drivers\sisgrp.sys
+ 2007-07-27 12:49:02 196,683 ----a-w C:\WINDOWS\system32\lnod32apiA.dll
+ 2007-07-27 12:49:02 225,355 ----a-w C:\WINDOWS\system32\lnod32apiW.dll
+ 2005-12-05 17:25:22 139,264 ----a-w C:\WINDOWS\system32\lnod32umc.dll
+ 2005-12-05 10:37:10 106,496 ----a-w C:\WINDOWS\system32\lnod32upd.dll
- 2004-08-19 13:39:18 2,804,224 ----a-w C:\WINDOWS\system32\msi.dll
+ 2005-05-04 12:45:32 2,890,240 ----a-w C:\WINDOWS\system32\msi.dll
- 2004-08-19 13:39:42 77,312 ----a-w C:\WINDOWS\system32\msiexec.exe
+ 2005-05-04 12:45:36 78,848 ----a-w C:\WINDOWS\system32\msiexec.exe
- 2004-08-19 13:39:18 331,264 ----a-w C:\WINDOWS\system32\msihnd.dll
+ 2005-05-04 12:45:36 271,360 ----a-w C:\WINDOWS\system32\msihnd.dll
- 2004-08-19 13:38:20 884,736 ----a-w C:\WINDOWS\system32\msimsg.dll
+ 2005-05-04 12:45:36 884,736 ----a-w C:\WINDOWS\system32\msimsg.dll
- 2004-08-19 13:39:18 44,032 ----a-w C:\WINDOWS\system32\msisip.dll
+ 2005-05-04 12:45:36 15,360 ----a-w C:\WINDOWS\system32\msisip.dll
+ 2005-05-04 12:45:28 15,072 ------w C:\WINDOWS\system32\spmsg.dll
+ 2004-12-07 08:11:34 258,352 ----a-w C:\WINDOWS\system32\unicows.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* i valori vuoti & legittimi/default non sono visualizzati.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EPSON Stylus D92 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBZE.exe" [2006-09-27 06:00 139264]
"Auslogics BoostSpeed 4"="C:\Programmi\Auslogics\AusLogics BoostSpeed\boostspeed.exe" [2008-04-08 12:00 255088]
"MSMSGS"="C:\Programmi\Messenger\msmsgs.exe" [2004-08-19 15:51 1667584]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2008-04-22 15:12 579584]
"UnlockerAssistant"="C:\Programmi\Unlocker\UnlockerAssistant.exe" [2008-05-02 06:15 15872]
"SiS Tray"="C:\WINDOWS\system32\sistray.EXE" [2003-10-30 14:10 667648]
"SiS Windows KeyHook"="C:\WINDOWS\system32\keyhook.exe" [2003-10-30 14:09 249856]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-23 19:34 219136]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programmi\\Grisoft\\AVG Free\\avginet.exe"=
"C:\\Programmi\\Grisoft\\AVG Free\\avgamsvr.exe"=
"C:\\Programmi\\Grisoft\\AVG Free\\avgcc.exe"=
"C:\\Programmi\\Grisoft\\AVG Free\\avgemc.exe"=
"C:\\cygwin\\usr\\X11R6\\bin\\XWin.exe"=

R0 VIRAGTLT;VIRAGTLT;C:\WINDOWS\system32\drivers\VIRAGTLT.SYS [2008-03-17 19:23]
R2 viritsvclite;Virit eXplorer Lite;C:\VEXPLITE\viritsvc.exe [2008-05-12 14:04]
R3 ip100xp;10/100Mbps Fast Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\ipfnd51.sys [2004-07-23 14:33]
S3 BrlAPI;BrlAPI;C:\cygwin\bin\cygrunsrv.exe [2006-06-19 11:43]
S3 pwalker;Process Walker Driver;C:\DOCUME~1\WinXp\IMPOST~1\Temp\nsuD.tmp\pwalker.sys []
S3 USBSTOR;Driver archiviazione di massa USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-30 21:48:31
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
Ora fine scansione: 2008-05-30 21.59.59
ComboFix-quarantined-files.txt 2008-05-30 19:59:52

12 Directory 8,838,545,408 byte disponibili
14 Directory 9,095,495,680 byte disponibili

179


In definitiva, pare che i riavvii dipendano dal registro instabile (se ne parlava nell'altra discussione) e questo problema è stato aggirato, mentre aggiornare Windows Installer credo che sia stata decisamente la mossa vincente per il resto! Ringrazio chemicalbit per il suggerimento, ma anche bdoriano per l'assistenza indispensabile!
A questo punto devo vedere se quel BPSSR maledetto ora riesco a togliermelo in qualche modo, anche se non sembra dare particolari problemi...
Più che altro resta sempre la causa principale per cui vi ho scritto: il reindirizzamento dei motori di ricerca (uso il plurale perchè ho appurato che me lo fa anche sul motore di msn...). Che si può fare?

Mi farebbe piacere sentire una vostra risposta, è un po' di tempo che non vi fate vivi e vorrei sapere come si può procedere. Grazie!!!

[chemicalbit]

[quasar186]

Ancora una volta RogueRemover non rileva BPSSR...
Eppure è strano: in "installazione applicazioni" appare fra i programmi ma non compare alcun bottone per disinstallarlo!
Adesso provo SmitFraudFix, vediamo un po'...

[quasar186]

Ecco una cosa che avrei voluto non vedere per niente: apro smitfraudfix in modalità normale, per fargli cercare degli aggiornamenti prima di avviare il pc in modalità provvisoria e farlo girare, ed ecco che mi ricompare la stramaledettissima finestra di windows installer sullo stramaledettissimo BPSSR...
Ho fatto cancel e SFF si è aperto normalmente, l'ho aggiornato ed una volta finita l'installazione degli aggiornamenti è ricomparsa ancora. Ho rifatto cancel e ho chiuso SFF...
Mi permettete un francesismo?

CHE PALLE!!!

Ora riavvio in modalità provvisoria e faccio girare smitfraudfix, ci sentiamo più tardi. Se avete suggerimenti ve ne sarò grato!

[quasar186]

Ecco il report di smitfraudfix:

SmitFraudFix v2.323

Scan done at 12.14.05,56, 31/05/2008
Run from C:\Documents and Settings\WinXp\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Versione 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{64FACC80-3FDB-4C88-92AC-AFE9F903025E}: DhcpNameServer=1.253.128.30 213.156.54.81
HKLM\SYSTEM\CS1\Services\Tcpip\..\{64FACC80-3FDB-4C88-92AC-AFE9F903025E}: DhcpNameServer=1.253.128.30 213.156.54.81
HKLM\SYSTEM\CS2\Services\Tcpip\..\{64FACC80-3FDB-4C88-92AC-AFE9F903025E}: DhcpNameServer=1.253.128.30 213.156.54.81
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=1.253.128.30 213.156.54.81
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=1.253.128.30 213.156.54.81
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=1.253.128.30 213.156.54.81


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

Adesso che si può fare?

[bdoriano]

Scusa quasar186, ti avevo perso per strada...

Nei logs non vedo tracce di reindirizzamento.

Per sicurezza, prova a fare questa scansione con MBAM.

[quasar186]

[bdoriano]

Rimasugli di precedenti infezioni. Ti ha ripulito il file di registro dalle tracce lasciate.

Dal punto di vista di infezioni non vedo nulla di strano.