Olimpo Informatico

[pitre]

Buonasera a tutti, seguo questo forum da un pò come....esterna essendo iscritta alla newsletter di Zeusnews.
Ora ho un problema che vorrei cercare di risolvere.
Ogni tanto, senza particolare riferimento a qualche azione io possa fare, il pc rallenta moltissimo, si blocca quasi, per poi riprendere da solo, senza che io abbia fatto nulla.
Mi piacerebbe sottoporVi il log file di Hijackthis (ho letto spesso che a Voi esperti riesce a dare molte indicazioni) tanto per sapere se può essere qualcosa presente nel pc, che crea questi rallentamenti. Grazie a chi vorrà dedicare un pò del suo tempo alla interpretazione di questo log file che posto di seguito

Logfile of HijackThis v1.99.1
Scan saved at 21.50.13, on 07/07/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Stardock\Object Desktop\WindowBlinds\wbload.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Programmi\Java\jre1.5.0_07\bin\jusched.exe
C:\Programmi\VolumeTray\VolumeTray.exe
C:\Programmi\Brother\ControlCenter2\brctrcen.exe
C:\Programmi\Unlocker\UnlockerAssistant.exe
C:\Programmi\McAfee\Managed VirusScan\Agent\myagttry.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\Programmi\BillP Studios\WinPatrol\winpatrol.exe
C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programmi\CursorXP\CursorXP.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\File comuni\RTE\RTEGPRS.exe
C:\Programmi\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Programmi\Brother\Brmfcmon\BrMfcWnd.exe
C:\Programmi\Stardock\DesktopGadgets\AquariumDesktop2006\AquariumDesktop2006.exe
C:\Programmi\FreePOPs\freepopsd.exe
C:\Programmi\Brother\Brmfcmon\BrMfcmon.exe
C:\Programmi\MemoRex\MemoRex.exe
C:\WINDOWS\ATKKBService.exe
C:\WINDOWS\$NtUninstallKB319740$\IEXPLORE.EXE
C:\Programmi\ewido anti-spyware 4.0\guard.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmi\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRISNA~1\SSI\SYSENF~1.EXE
C:\Programmi\Avant Browser\avant.exe
C:\PROGRA~1\McAfee\MANAGE~1\VScan\McShield.exe
C:\Programmi\Outlook Express\msimn.exe
C:\Programmi\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe
C:\Programmi\Winamp\winamp.exe
C:\Programmi\ewido anti-spyware 4.0\ewido.exe
C:\HIJACKTHIS\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.pitre.altervista.org/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Programmi\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_07\bin\ssv.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Programmi\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [VolumeTray] C:\Programmi\VolumeTray\VolumeTray.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Programmi\Brother\Brmfl05a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Programmi\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Programmi\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [McAfee Managed Services Tray] "C:\Programmi\McAfee\Managed VirusScan\Agent\myagttry.exe"
O4 - HKLM\..\Run: [Windows Spooler] C:\WINDOWS\system32\spoolsv32.exe
O4 - HKLM\..\Run: [Windows DLL Host] C:\WINDOWS\system32\dllhost32.exe
O4 - HKLM\..\Run: [MemoREX] "C:\Programmi\MemoRex\MemoRexStart.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinPatrol] C:\Programmi\BillP Studios\WinPatrol\winpatrol.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [CursorXP] C:\Programmi\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RTEGPRS] "C:\Programmi\File comuni\RTE\RTEGPRS.exe" tray
O4 - HKCU\..\Run: [VisualTaskTips] C:\Programmi\VisualTaskTips\VisualTaskTips.exe
O4 - HKCU\..\Run: [RoboForm] "C:\Programmi\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [WashAndGo - Cleanup of old Backupfiles] C:\Programmi\WashAndGo\checker.exe /check
O4 - Startup: Adobe Gamma.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: AquariumDesktop2006.lnk = C:\Programmi\Stardock\DesktopGadgets\AquariumDesktop2006\AquariumDesktop2006.exe
O4 - Startup: FreePOPs.lnk = C:\Programmi\FreePOPs\freepopsd.exe
O4 - Startup: HDDlife.lnk = C:\Programmi\BinarySense\HDDlife\HDDlifePro.exe
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Controllo dello stato.lnk = C:\Programmi\Brother\Brmfcmon\BrMfcWnd.exe
O8 - Extra context menu item: Aggiungi l'indirizzo alla Lista Nera della pubblicità - C:\Programmi\Avant Browser\AddToADBlackList.htm
O8 - Extra context menu item: Apri PDF in Word (PDF Converter 3.0) - res://C:\Programmi\ScanSoft\OmniPage15.0\PDFConverter3\IEShellExt.dll /400
O8 - Extra context menu item: Apri tutti i collegamenti nella pagina in linguette diverse - C:\Programmi\Avant Browser\OpenAllLinks.htm
O8 - Extra context menu item: Blocca tutte le immagini provenienti dal server di questa - C:\Programmi\Avant Browser\AddAllToADBlackList.htm
O8 - Extra context menu item: Cerca con Google - C:\Programmi\Avant Browser\Search.htm
O8 - Extra context menu item: Compila Modulo - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Evidenzia in questa pagina - C:\Programmi\Avant Browser\Highlight.htm
O8 - Extra context menu item: Generatore di Password - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComPasswordGenerator.html
O8 - Extra context menu item: Open In New Avant Browser - C:\Programmi\Avant Browser\OpenInNewBrowser.htm
O8 - Extra context menu item: Opzioni di RoboForm - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComOptions.html
O8 - Extra context menu item: Personalizza - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Pulisci Campi - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComClearFields.html
O8 - Extra context menu item: RF Barra strumenti - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Robo Icona sulla TaskBar - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComTaskBarIcon.html
O8 - Extra context menu item: Salva Moduli - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Schede - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComEditPass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Compila - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Compila Modulo - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Salva - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Salva Moduli - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Pulisci Campi - {320AF880-6646-11D3-ABEE-C5DBF3571F54} - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComClearFields.html
O9 - Extra 'Tools' menuitem: Pulisci Campi - {320AF880-6646-11D3-ABEE-C5DBF3571F54} - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComClearFields.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RF Barra strumenti - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {3ECA07FC-E5AB-46F6-8D13-C083D52BFE7B} (SIPActiveX Object) - http://www.abbeyphone.com/activex/SIPActiveX.cab
O16 - DPF: {40C83AF8-FEA7-4A6A-A470-431EE84A0886} (SecureObjectFactory Class) - http://vs.mcafeeasap.com/MC/ITA/VS40/bin/myCioAgt.20060421231628.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/0976de4b688a74bb8021/netzip/RdxIE601_it.cab
O16 - DPF: {94EB57FE-2720-496C-B33F-D9353C6E23F7} (F-Secure Online Scanner 2.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: myrm - {4D034FC3-013F-4B95-B544-44D49ABE3E76} - C:\Programmi\McAfee\Managed VirusScan\Agent\MyRmProt4.0.0.358.dll
O20 - Winlogon Notify: WB - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: DirectX Service (DirectHilr) - Unknown owner - c:\windows\system32\directx.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Programmi\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McShield - McAfee, Inc. - C:\PROGRA~1\McAfee\MANAGE~1\VScan\McShield.exe
O23 - Service: McAfee Total Protection Agent Service (myAgtSvc) - McAfee, Inc. - C:\Programmi\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
O23 - Service: SysEnforce - Unknown owner - C:\PROGRA~1\TRISNA~1\SSI\SYSENF~1.EXE



Nel caso potesse aiutarVi, il pc ha un processore AMD 64 3000, una MB ASUS A8N-E, 1 GB di ram ed il SO è XP PRO SP2.

[Typhoon90]

ce ne sono parecchi di sospetti e sconosciuti.
aspetta gli "espertoni"

ciao e benvenuto

[pitre]

sono in attesa .... grazie ...

[pitre]

nessun "esperto" passa da queste parti a dare un'occhiata al mio log file???

[Typhoon90]

aspetta e vedrai

Abbi fede figliuolo, Abbi fede!!

[pitre]

figliuolo???? a me??? con quell'avatar????

[holifay]

Benvenuta pitre nei nostri forum

In effeti hai qualcosa da eliminare.

Avvia HijackThis, poi chiudi tutte le finestre aperte e tutte le applicazioni, a parte HijackThis. Metti un segno di spunta accanto a queste voci e poi premi Fix Checked

[pitre]

Grazie Holifay per la risposta
Ho eseguito la prima parte di quello che mi hai scritto e ti posto intanto il nuovo logfile di Hijackthis.
Vado a fare la scansione on line (ci vorrà un pò di tempo) e poi ti posto anche quello che ne verrà fuori...grazie ancora

Logfile of HijackThis v1.99.1
Scan saved at 19.05.48, on 08/07/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Stardock\Object Desktop\WindowBlinds\wbload.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Programmi\Java\jre1.5.0_07\bin\jusched.exe
C:\Programmi\VolumeTray\VolumeTray.exe
C:\Programmi\Brother\ControlCenter2\brctrcen.exe
C:\Programmi\Unlocker\UnlockerAssistant.exe
C:\Programmi\McAfee\Managed VirusScan\Agent\myagttry.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\Programmi\BillP Studios\WinPatrol\winpatrol.exe
C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programmi\CursorXP\CursorXP.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\File comuni\RTE\RTEGPRS.exe
C:\Programmi\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Programmi\Stardock\DesktopGadgets\AquariumDesktop2006\AquariumDesktop2006.exe
C:\Programmi\FreePOPs\freepopsd.exe
C:\Programmi\MemoRex\MemoRex.exe
C:\Programmi\BinarySense\HDDlife\HDDlifePro.exe
C:\WINDOWS\ATKKBService.exe
C:\Programmi\ewido anti-spyware 4.0\guard.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmi\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRISNA~1\SSI\SYSENF~1.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\McAfee\MANAGE~1\VScan\McShield.exe
C:\Programmi\Avant Browser\avant.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HIJACKTHIS\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.pitre.altervista.org/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Programmi\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_07\bin\ssv.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Programmi\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [VolumeTray] C:\Programmi\VolumeTray\VolumeTray.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Programmi\Brother\Brmfl05a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Programmi\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Programmi\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [McAfee Managed Services Tray] "C:\Programmi\McAfee\Managed VirusScan\Agent\myagttry.exe"
O4 - HKLM\..\Run: [MemoREX] "C:\Programmi\MemoRex\MemoRexStart.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinPatrol] C:\Programmi\BillP Studios\WinPatrol\winpatrol.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmi\File comuni\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [MVS Splash] C:\Programmi\McAfee\Managed VirusScan\Agent\Splash.exe
O4 - HKCU\..\Run: [CursorXP] C:\Programmi\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RTEGPRS] "C:\Programmi\File comuni\RTE\RTEGPRS.exe" tray
O4 - HKCU\..\Run: [RoboForm] "C:\Programmi\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [WashAndGo - Cleanup of old Backupfiles] C:\Programmi\WashAndGo\checker.exe /check
O4 - HKCU\..\Run: [WeatherBug] C:\PROGRAM FILES\AWS\WeatherBug\WeatherBug.exe
O4 - Startup: Adobe Gamma.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: AquariumDesktop2006.lnk = C:\Programmi\Stardock\DesktopGadgets\AquariumDesktop2006\AquariumDesktop2006.exe
O4 - Startup: FreePOPs.lnk = C:\Programmi\FreePOPs\freepopsd.exe
O4 - Startup: HDDlife.lnk = C:\Programmi\BinarySense\HDDlife\HDDlifePro.exe
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Controllo dello stato.lnk = C:\Programmi\Brother\Brmfcmon\BrMfcWnd.exe
O8 - Extra context menu item: Aggiungi l'indirizzo alla Lista Nera della pubblicità - C:\Programmi\Avant Browser\AddToADBlackList.htm
O8 - Extra context menu item: Apri PDF in Word (PDF Converter 3.0) - res://C:\Programmi\ScanSoft\OmniPage15.0\PDFConverter3\IEShellExt.dll /400
O8 - Extra context menu item: Apri tutti i collegamenti nella pagina in linguette diverse - C:\Programmi\Avant Browser\OpenAllLinks.htm
O8 - Extra context menu item: Blocca tutte le immagini provenienti dal server di questa - C:\Programmi\Avant Browser\AddAllToADBlackList.htm
O8 - Extra context menu item: Cerca con Google - C:\Programmi\Avant Browser\Search.htm
O8 - Extra context menu item: Compila Modulo - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Evidenzia in questa pagina - C:\Programmi\Avant Browser\Highlight.htm
O8 - Extra context menu item: Generatore di Password - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComPasswordGenerator.html
O8 - Extra context menu item: Open In New Avant Browser - C:\Programmi\Avant Browser\OpenInNewBrowser.htm
O8 - Extra context menu item: Opzioni di RoboForm - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComOptions.html
O8 - Extra context menu item: Personalizza - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Pulisci Campi - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComClearFields.html
O8 - Extra context menu item: RF Barra strumenti - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Robo Icona sulla TaskBar - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComTaskBarIcon.html
O8 - Extra context menu item: Salva Moduli - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Schede - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComEditPass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Compila - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Compila Modulo - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Salva - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Salva Moduli - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Pulisci Campi - {320AF880-6646-11D3-ABEE-C5DBF3571F54} - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComClearFields.html
O9 - Extra 'Tools' menuitem: Pulisci Campi - {320AF880-6646-11D3-ABEE-C5DBF3571F54} - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComClearFields.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RF Barra strumenti - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O16 - DPF: {3ECA07FC-E5AB-46F6-8D13-C083D52BFE7B} (SIPActiveX Object) - http://www.abbeyphone.com/activex/SIPActiveX.cab
O16 - DPF: {40C83AF8-FEA7-4A6A-A470-431EE84A0886} (SecureObjectFactory Class) - http://vs.mcafeeasap.com/MC/ITA/VS40/bin/myCioAgt.20060421231628.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: myrm - {4D034FC3-013F-4B95-B544-44D49ABE3E76} - C:\Programmi\McAfee\Managed VirusScan\Agent\MyRmProt4.0.0.358.dll
O20 - Winlogon Notify: WB - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: DirectX Service (DirectHilr) - Unknown owner - c:\windows\system32\directx.exe (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Programmi\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McShield - McAfee, Inc. - C:\PROGRA~1\McAfee\MANAGE~1\VScan\McShield.exe
O23 - Service: McAfee Total Protection Agent Service (myAgtSvc) - McAfee, Inc. - C:\Programmi\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
O23 - Service: Spooler di stampa (Spooler) - Unknown owner - C:\WINDOWS\system32\spoolsv.exe (file missing)
O23 - Service: SysEnforce - Unknown owner - C:\PROGRA~1\TRISNA~1\SSI\SYSENF~1.EXE

[pitre]

Sono finalmente riuscita a terminare la scansione on line con Kaspersky
Ti posto il log così appena hai un attimo mi dici qualcosa, per me, a parte il fatto che non mi sembra ci siano virus, il resto è quasi....arabo
KASPERSKY ONLINE SCANNER REPORT
Sunday, July 09, 2006 8:49:07 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 9/07/2006
Kaspersky Anti-Virus database records: 205937
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
H:\
K:\

Scan Statistics:
Total number of scanned objects: 133246
Number of viruses found: 0
Number of infected objects: 0 / 0
Number of suspicious objects: 0
Duration of the scan process: 07:21:08

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Patrizia\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Patrizia\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Patrizia\Impostazioni locali\Dati applicazioni\Apple Computer\QuickTime\downloads\07\06\764ad9eb-ab76d22c-845f0524-60a1c565.qtch Object is locked skipped
C:\Documents and Settings\Patrizia\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Patrizia\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Patrizia\Impostazioni locali\Temp\RTEGPRS.rlg Object is locked skipped
C:\Documents and Settings\Patrizia\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Patrizia\ntuser.dat Object is locked skipped
C:\Documents and Settings\Patrizia\ntuser.dat.LOG Object is locked skipped
C:\Programmi\FreePOPs\log.txt Object is locked skipped
C:\Programmi\FreePOPs\stderr.txt Object is locked skipped
C:\Programmi\FreePOPs\stdout.txt Object is locked skipped
C:\Programmi\McAfee\Managed VirusScan\Agent\Report\CIOC.tmp Object is locked skipped
C:\Programmi\Trisnap Technologies\SSI\SysEnforce.log Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{3EB005D0-2901-4CE3-8FDF-9F0FBD2D645F}\RP384\change.log Object is locked skipped
C:\WINDOWS\CSC\00000001 Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\BACKUP POSTA\OE backup\Pop3uidl.dbx Object is locked skipped
D:\BACKUP POSTA\OE backup\Offline.dbx Object is locked skipped
D:\BACKUP POSTA\OE backup\Folders.dbx Object is locked skipped
D:\BACKUP POSTA\OE backup\Posta in arrivo.dbx Object is locked skipped
D:\System Volume Information\_restore{3EB005D0-2901-4CE3-8FDF-9F0FBD2D645F}\RP384\change.log Object is locked skipped
E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
E:\System Volume Information\_restore{3EB005D0-2901-4CE3-8FDF-9F0FBD2D645F}\RP384\change.log Object is locked skipped
K:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
K:\System Volume Information\_restore{3EB005D0-2901-4CE3-8FDF-9F0FBD2D645F}\RP384\change.log Object is locked skipped

Scan process completed.


Ti posto anche un nuovo log di Hijackthis fatto ora, ieri ho avuto un piccolo problema con uno dei file che mi avevi chiesto di cancellare (spoolsv32.exe) , non trovandolo in system32, per errore, ho cancellato spolsv.exe, senza il 32 e la stampante non mi andava più
Logfile of HijackThis v1.99.1
Scan saved at 20.59.07, on 09/07/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Stardock\Object Desktop\WindowBlinds\wbload.exe
C:\WINDOWS\ATKKBService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\$NtUninstallKB886716$\IEXPLORE.EXE
C:\Programmi\ewido anti-spyware 4.0\guard.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmi\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRISNA~1\SSI\SYSENF~1.EXE
C:\PROGRA~1\McAfee\MANAGE~1\VScan\McShield.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programmi\Java\jre1.5.0_07\bin\jusched.exe
C:\Programmi\VolumeTray\VolumeTray.exe
C:\Programmi\Brother\ControlCenter2\brctrcen.exe
C:\Programmi\Unlocker\UnlockerAssistant.exe
C:\Programmi\McAfee\Managed VirusScan\Agent\myagttry.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\Programmi\BillP Studios\WinPatrol\winpatrol.exe
C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programmi\CursorXP\CursorXP.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\File comuni\RTE\RTEGPRS.exe
C:\Programmi\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Programmi\MemoRex\MemoRex.exe
C:\PROGRAM FILES\AWS\WeatherBug\WeatherBug.exe
C:\Programmi\Brother\Brmfcmon\BrMfcWnd.exe
C:\Programmi\Stardock\DesktopGadgets\AquariumDesktop2006\AquariumDesktop2006.exe
C:\Programmi\FreePOPs\freepopsd.exe
C:\Programmi\Avant Browser\avant.exe
C:\WINDOWS\explorer.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\HIJACKTHIS\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.pitre.altervista.org/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Programmi\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_07\bin\ssv.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Programmi\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [VolumeTray] C:\Programmi\VolumeTray\VolumeTray.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Programmi\Brother\Brmfl05a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Programmi\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Programmi\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [McAfee Managed Services Tray] "C:\Programmi\McAfee\Managed VirusScan\Agent\myagttry.exe"
O4 - HKLM\..\Run: [Windows Spooler] C:\WINDOWS\system32\spoolsv32.exe
O4 - HKLM\..\Run: [Windows DLL Host] C:\WINDOWS\system32\dllhost32.exe
O4 - HKLM\..\Run: [MemoREX] "C:\Programmi\MemoRex\MemoRexStart.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinPatrol] C:\Programmi\BillP Studios\WinPatrol\winpatrol.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [XP Syspad] C:\Programmi\XPSysPad\XPSysPad.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmi\File comuni\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [MVS Splash] C:\Programmi\McAfee\Managed VirusScan\Agent\Splash.exe
O4 - HKCU\..\Run: [CursorXP] C:\Programmi\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RTEGPRS] "C:\Programmi\File comuni\RTE\RTEGPRS.exe" tray
O4 - HKCU\..\Run: [VisualTaskTips] C:\Programmi\VisualTaskTips\VisualTaskTips.exe
O4 - HKCU\..\Run: [RoboForm] "C:\Programmi\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [WashAndGo - Cleanup of old Backupfiles] C:\Programmi\WashAndGo\checker.exe /check
O4 - HKCU\..\Run: [WeatherBug] C:\PROGRAM FILES\AWS\WeatherBug\WeatherBug.exe
O4 - Startup: Adobe Gamma.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: AquariumDesktop2006.lnk = C:\Programmi\Stardock\DesktopGadgets\AquariumDesktop2006\AquariumDesktop2006.exe
O4 - Startup: FreePOPs.lnk = C:\Programmi\FreePOPs\freepopsd.exe
O4 - Startup: HDDlife.lnk = C:\Programmi\BinarySense\HDDlife\HDDlifePro.exe
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Controllo dello stato.lnk = C:\Programmi\Brother\Brmfcmon\BrMfcWnd.exe
O8 - Extra context menu item: Aggiungi l'indirizzo alla Lista Nera della pubblicità - C:\Programmi\Avant Browser\AddToADBlackList.htm
O8 - Extra context menu item: Apri PDF in Word (PDF Converter 3.0) - res://C:\Programmi\ScanSoft\OmniPage15.0\PDFConverter3\IEShellExt.dll /400
O8 - Extra context menu item: Apri tutti i collegamenti nella pagina in linguette diverse - C:\Programmi\Avant Browser\OpenAllLinks.htm
O8 - Extra context menu item: Blocca tutte le immagini provenienti dal server di questa - C:\Programmi\Avant Browser\AddAllToADBlackList.htm
O8 - Extra context menu item: Cerca con Google - C:\Programmi\Avant Browser\Search.htm
O8 - Extra context menu item: Compila Modulo - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Evidenzia in questa pagina - C:\Programmi\Avant Browser\Highlight.htm
O8 - Extra context menu item: Generatore di Password - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComPasswordGenerator.html
O8 - Extra context menu item: Open In New Avant Browser - C:\Programmi\Avant Browser\OpenInNewBrowser.htm
O8 - Extra context menu item: Opzioni di RoboForm - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComOptions.html
O8 - Extra context menu item: Personalizza - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Pulisci Campi - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComClearFields.html
O8 - Extra context menu item: RF Barra strumenti - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Robo Icona sulla TaskBar - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComTaskBarIcon.html
O8 - Extra context menu item: Salva Moduli - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Schede - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComEditPass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Compila - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Compila Modulo - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Salva - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Salva Moduli - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Pulisci Campi - {320AF880-6646-11D3-ABEE-C5DBF3571F54} - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComClearFields.html
O9 - Extra 'Tools' menuitem: Pulisci Campi - {320AF880-6646-11D3-ABEE-C5DBF3571F54} - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComClearFields.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RF Barra strumenti - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Programmi\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {3ECA07FC-E5AB-46F6-8D13-C083D52BFE7B} (SIPActiveX Object) - http://www.abbeyphone.com/activex/SIPActiveX.cab
O16 - DPF: {40C83AF8-FEA7-4A6A-A470-431EE84A0886} (SecureObjectFactory Class) - http://vs.mcafeeasap.com/MC/ITA/VS40/bin/myCioAgt.20060421231628.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/0976de4b688a74bb8021/netzip/RdxIE601_it.cab
O16 - DPF: {94EB57FE-2720-496C-B33F-D9353C6E23F7} (F-Secure Online Scanner 2.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: myrm - {4D034FC3-013F-4B95-B544-44D49ABE3E76} - C:\Programmi\McAfee\Managed VirusScan\Agent\MyRmProt4.0.0.358.dll
O20 - Winlogon Notify: WB - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: DirectX Service (DirectHilr) - Unknown owner - c:\windows\system32\directx.exe (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Programmi\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McShield - McAfee, Inc. - C:\PROGRA~1\McAfee\MANAGE~1\VScan\McShield.exe
O23 - Service: McAfee Total Protection Agent Service (myAgtSvc) - McAfee, Inc. - C:\Programmi\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
O23 - Service: SysEnforce - Unknown owner - C:\PROGRA~1\TRISNA~1\SSI\SYSENF~1.EXE


Resto in attesa di tue notizie, grazie

[holifay]

accidenti, ma quanti file hai

è rimasto solo il residuo del servizio. Premi Start >> Esegui, digita CMD e premi invio. Nella finestra di DOS che si apre digita in successione:

sc stop DirectHilr (invio)
sc delete DirectHilr (invio)

controlla poi dal log di Hijackthis se questa voce è scomparsa:

[pitre]

effettivamente si ho un sacco di programmi installati, sono curiosa di provare cose nuove
Ho fatto queste due cose e dal file di Hijackthis è scomparsa quella voce, questo vuol dire che è tutto a posto? Che il log è .... pulito???
Grazie ancora ma, solo per mia ... ehmmm.... curiosità .... cosa avevo???
E pensi fosse quello a rallentarmi il pc a volte???
Scusa se approfitto ancora della tua disponibilità e soprattutto della tua bravura, cosa mi consigli di fare per evitare che possa succedere ancora??
Come hai visto ho
McAfee come antivirus (me lo fornisce Fastweb)
Ewido come antispyware
WinPatrol attivo
CCleaner e Wash and Go (alterno scansioni e pulizie ora con uno ora con l'altro)
AdAware SE ogni tanto
E spesso eseguo anche scansioni on line con Kaspersky, Panda o F-Secure

Sono sempre molto attenta anche con la posta, elimino senza aprire tutto quello che mi arriva di, anche solo leggermente, sospetto e non clicco mai sui link, ma digito gli indirizzi che voglio visitare nella barra dei browser.

L'unica cosa che non sono mai riuscita ad utilizzare è un firewall (escludendo quello di XP che è attivo ma non so quanto possa essere valido), forse perchè non sono riuscita a settarli bene ma, ho provato con ZoneAlarm e con altri che ora non ricordo, disinstallandoli sempre alla fine perchè mi rallentavano troppo il pc o perchè mi stressavano con continue finestre alle quali non sapevo cosa rispondere nella maggior parte dei casi

Grazie ancora Holifay e scusa se ho approfittato della tua esperienza

[pitre]

mi sono dimenticata di scrivere che, ogni tanto faccio anche scansioni con
a-squared free
manca qualcosa?

[holifay]

Ah, scusa pitre non avevo visto che attendevi una risposta.

Guarda, se vuoi il mio parere ti posso dire che sei fin troppo protetta. Io ho molto meno di te:

- firewall --> uso Outpost free (è facile da usare e non rompe con troppe finestre). Quando sei in dubbio se consentire l´accesso, se è un programma che non conosci, negalo sempre. Al massimo puoi cambiare in seguito la scelta

- antivirus --> AVG free

- file hosts di MVPS al posto del mio

- navigo con Firefox e Opera.

- non apro allegati non attesi nelle email

Con queste semplici regole, non mi prendo mai niente


Qui qualche software per la sicurezza: http://forum.zeusnews.com/viewtopic.php?t=16009

Ciao

[pitre]

di nulla Holifay, figurati, scusa se insisto ma non mi hai detto poi cosa avevo ed io, accidenti, sono molto curiosa
e visto che ti disturbo ancora, potresti dirmi esattamente come fare per sostituire il file host?
Non sono espertissima anche se cerco di fare del mio meglio,
navigo anche io con Firefox ed Opera ed uso Avast per quei siti che richiedono per forza IE.
proverò outpost free sperando di riuscire ad usarlo, devo disabilitare nel caso il firewall di XP?
Devo dire, comunque che, in realtà neanche io prendo virus, forse qualcosa del genere di quello che, non so cosa fosse, ma tu mi hai aiutato ad eliminare
Grazie ancora per la tua pazienza, ciao

[pitre]

ops, volevo dire Avant browser, non Avast antivirus

[holifay]

ah, sì ecco:

spoolsv32.exe è aggiunto da un worm o trojan non ben identificato, ne esistono diversi con lo stesso nome: http://www.castlecops.com/s11057-Windows_Spooler.html

Directx.exe il servizio [Directx service] è aggiunto dal trojan Crybot-B. E\' un trojan che permette attraverso i canali irc di controllare completamente il PC infetto. http://www.sophos.com/virusinfo/analyses/trojcrybotb.html


Il file Hosts di MVPS lo devi sostituire al tuo. E´ un file senza estensione che si trova in C:/windows/system32/drivers/etc

Quando installi Outpost devi disabilitare quello nativo di XP. Disabilitalo però a computer disconnesso dalla rete


Ciao

[pitre]

grazie mille Holifay sei un mitoooooo
tutto ok, sostituito file host, per outpost ci penserò appena ho un attimo,
grazie ancora e ciao

[ioSOLOio]

o.t. -->

[pitre]

Allora, spiego, io ho due HD interni + uno esterno ma quello lo uso solo come archivio di sicurezza, quindi lo accendo solo quando mi serve
I due interni però sono partizionati ed ecco il motivo di tutte quelle lettere, a parte masterizzatore e lettore dvd
In effetti però, altre volte ci ha messo molto meno, questa volta, mi sono chiesta anche io come mai non finisse più, senza però riuscire a darmi una spiegazione valida....magari qualcuno più esperto di me?

[ioSOLOio]

vero, non avevo pensato alle possibili partizioni di più hard disk !

non so invece da cosa possa dipendere la velocità di scansione a meno di rallentamenti/intasamenti di linea....che non so quanto possano concorrere