Olimpo Informatico

[3iolo]

Qualche buon anima può controllare il log che vi metto qui? Ho una domanda da farvi: qualc1 sa perchè non riesco più ad accedere al mio WIndows Live Space? Io non ho toccato nulla ma non riesco più a effettuare il login nonostante nome utente e password siano corrette...
Grazie 1000

Logfile of HijackThis v1.99.1
Scan saved at 19.30.35, on 20/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe
C:\Programmi\Symantec AntiVirus\DefWatch.exe
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\QCONSVC.EXE
C:\Programmi\Symantec AntiVirus\SavRoam.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Symantec AntiVirus\Rtvscan.exe
C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\tp4serv.exe
C:\PROGRA~1\ThinkPad\CONNEC~1\Qctray.exe
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Programmi\Java\jre1.5.0_10\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\WINDOWS\TEMP\3836.tmp
C:\Documents and Settings\Administrator\Desktop\is1.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Dati applicazioni\Prevx\pxbho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [TrackPointSrv] tp4serv.exe
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [QCTRAY] C:\PROGRA~1\ThinkPad\CONNEC~1\Qctray.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [TPTRAY] C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PrevxOne] "C:\Programmi\Prevx1\PXConsole.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} - http://elearning5.unibg.it/qp2.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://innoallavita.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1153733870215
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = samedeutz-fahr.com
O17 - HKLM\Software\..\Telephony: DomainName = samedeutz-fahr.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{FC6FFF59-915C-4254-8089-F514BF8925E7}: NameServer = 85.37.17.40 85.38.28.85
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = samedeutz-fahr.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = samedeutz-fahr.com
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = samedeutz-fahr.com
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe
O23 - Service: Applicazione di sistema COM+ (COMSysApp) - Unknown owner - C:\WINDOWS\System32\dllhost.exe (file missing)
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Programmi\Symantec AntiVirus\DefWatch.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Programmi\Ahead\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Programmi\Prevx1\PXAgent.exe" -f (file missing)
O23 - Service: QCONSVC - Unknown owner - C:\WINDOWS\System32\QCONSVC.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Programmi\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: MS Software Shadow Copy Provider (SwPrv) - Unknown owner - C:\WINDOWS\System32\dllhost.exe (file missing)
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Programmi\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Windows System Service (SYSTEMSVC) - Unknown owner - C:\WINDOWS\system\system.exe (file missing)
O23 - Service: Windows RPC Service (WINRPC) - Unknown owner - C:\WINDOWS\system\winrpc.exe (file missing)

[chemicalbit]

[Orange]

ciao!

vorrei togliermi qualche dubbio:
C:\Documents and Settings\Administrator\Desktop\is1.exe--- è il tuo HiJack?
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = samedeutz-fahr.com--- l'hai impostato tu? Ho cercato qualche informazione in proposito e mi dà questo. Non sembra essere pericoloso, ma vorrei una conferma.

per il resto andiamo in ordine
scarica questo TOOL di Symantec
Scarica ed installa Pserv
scarica ed installa VirIt

Assicurati di avere accesso a file e cartelle nascosti
disattiva il ripristino configurazione di sistema
avvia in modalità provvisoria
Avvia hijackthis, clicca "Do a System Scan Only" metti la spunta a queste voci e premi "Fix checked"

C:\WINDOWS\TEMP\3836.tmp
O23 - Service: Windows System Service (SYSTEMSVC) - Unknown owner - C:\WINDOWS\system\system.exe (file missing)
O23 - Service: Windows RPC Service (WINRPC) - Unknown owner - C:\WINDOWS\system\winrpc.exe (file missing)

Avvia Pserv da Start / Tutti i programmi
Mediante il destro del mouse evidenzia
Windows System Service (SYSTEMSVC) e
Windows RPC Service (WINRPC) e scegli DELETE.

ora fai lo scan con il tool di Symantec e VirIt (salva i log)
rifai il log di Hijack
posta qui i risultati

[3iolo]

C:\Documents and Settings\Administrator\Desktop\is1.exe--- è il mio HiJack!
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = samedeutz-fahr.com è sicuro!

Nel NIENTE SPAM! non riesco neppure ad entrare...Vi do il link, provate voi a entrare e poi fatemi sapere. Sembra addirittura che sia stato eliminato!!!

Vi ringrazio...

Ecco il log di Hijack

Logfile of HijackThis v1.99.1
Scan saved at 22.02.37, on 21/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe
C:\Programmi\Symantec AntiVirus\DefWatch.exe
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\QCONSVC.EXE
C:\Programmi\Symantec AntiVirus\SavRoam.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Symantec AntiVirus\Rtvscan.exe
C:\VEXPLITE\viritsvc.exe
C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\tp4serv.exe
C:\PROGRA~1\ThinkPad\CONNEC~1\Qctray.exe
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Programmi\Java\jre1.5.0_10\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\VEXPLITE\MONLITE.EXE
C:\Programmi\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrator\Desktop\is1.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tgsoft.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Dati applicazioni\Prevx\pxbho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [TrackPointSrv] tp4serv.exe
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [QCTRAY] C:\PROGRA~1\ThinkPad\CONNEC~1\Qctray.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [TPTRAY] C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PrevxOne] "C:\Programmi\Prevx1\PXConsole.exe"
O4 - HKLM\..\Run: [VIRIT LITE MONITOR] C:\VEXPLITE\MONLITE.EXE
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} - http://elearning5.unibg.it/qp2.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://innoallavita.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1153733870215
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = samedeutz-fahr.com
O17 - HKLM\Software\..\Telephony: DomainName = samedeutz-fahr.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{FC6FFF59-915C-4254-8089-F514BF8925E7}: NameServer = 85.37.17.40 85.38.28.85
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = samedeutz-fahr.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = samedeutz-fahr.com
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = samedeutz-fahr.com
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Programmi\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe
O23 - Service: Applicazione di sistema COM+ (COMSysApp) - Unknown owner - C:\WINDOWS\System32\dllhost.exe (file missing)
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Programmi\Symantec AntiVirus\DefWatch.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Programmi\Ahead\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Programmi\Prevx1\PXAgent.exe" -f (file missing)
O23 - Service: QCONSVC - Unknown owner - C:\WINDOWS\System32\QCONSVC.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Programmi\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: MS Software Shadow Copy Provider (SwPrv) - Unknown owner - C:\WINDOWS\System32\dllhost.exe (file missing)
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Programmi\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Virit eXplorer Lite (viritsvclite) - TG Soft Sas www.tgsoft.it - C:\VEXPLITE\viritsvc.exe

[Orange]

[3iolo]

Il tool di Symantec dice che non è stato trovato il virus.
Il log di VirIt è questo:
VirIT eXplorer Lite Log

[SCANSIONE DELLA MEMORIA]
OK
--------------------------------------------------------
21/03/2007 - 20:14:13

[SCANSIONE DEL REGISTRO]
{74DD705D-6834-439C-A735-A6DBE2677452} Infetto da BHO.VSAdd.A

[C:]
MASTER BOOT RECORD: OK
BOOT SECTOR: OK

C:\Documents and Settings\Administrator\Desktop\backups\backup-20070304-194952-626.dll Infetto da BHO.Revcomd.A
C:\Documents and Settings\Administrator\Desktop\backups\backup-20070306-110751-687.dll Infetto da BHO.Revcomd.A
C:\Documents and Settings\Administrator\Desktop\backups\backup-20070310-230841-672.dll Infetto da BHO.Revcomd.A
C:\Programmi\Symantec AntiVirus\ax.exe Infetto da Backdoor.SdBot.PV
C:\Programmi\Symantec AntiVirus\msb.exe Infetto da Backdoor.RBot.XH
C:\WINDOWS\system\system.exe Infetto da Backdoor.SdBot.PV
C:\WINDOWS\system32\celyowrb.dll Infetto da BHO.Agent.DH
C:\WINDOWS\system32\config\systemprofile\Impostazioni locali\Temporary Internet Files\Content.IE5\NPHOJJ89\s3.0[1].exe Possibile variante da Trojan.Win32.Agent.APP
C:\WINDOWS\system32\cronos.exe Infetto da Backdoor.RBot.XY
C:\WINDOWS\system32\crypts.dll Infetto da Trojan.Win32.Agent.APS
C:\WINDOWS\system32\ddcyaww.dll Infetto da BHO.Wbrrock.A
C:\WINDOWS\system32\efcywtt.dll Infetto da BHO.Wbrrock.A
C:\WINDOWS\system32\eineifxq.dll Infetto da Trojan.Win32.Vundo.AS
C:\WINDOWS\system32\fccdecc.dll Infetto da BHO.Wbrrock.A
C:\WINDOWS\system32\fjjouops.dll Infetto da Trojan.Win32.Agent.AMW
C:\WINDOWS\system32\gciermll.dll Infetto da Trojan.Win32.Vundo.AS
C:\WINDOWS\system32\gebyayw.dll Infetto da BHO.Wbrrock.A
C:\WINDOWS\system32\gxeapnwa.dll Infetto da BHO.Agent.DA
C:\WINDOWS\system32\hggdecb.dll Infetto da BHO.Wbrrock.A
C:\WINDOWS\system32\igrdmdeyie.exe Infetto da Backdoor.RBot.XY
C:\WINDOWS\system32\jsdxfbup.dll Infetto da BHO.Agent.DA
C:\WINDOWS\system32\khfgfgd.dll Infetto da BHO.Wbrrock.A
C:\WINDOWS\system32\mljgghg.dll Infetto da BHO.Wbrrock.A
C:\WINDOWS\system32\mljjkhe.dll Infetto da BHO.Wbrrock.A
C:\WINDOWS\system32\n00s.exe Infetto da Backdoor.RBot.XY
C:\WINDOWS\system32\oktbkwkp.dll Infetto da Trojan.Win32.Agent.AMW
C:\WINDOWS\system32\opnkjhh.dll Infetto da BHO.Wbrrock.A
C:\WINDOWS\system32\opnoonm.dll Infetto da BHO.Wbrrock.A
C:\WINDOWS\system32\pmnllli.dll Infetto da BHO.Wbrrock.A
C:\WINDOWS\system32\qisdimkm.dll Infetto da BHO.Agent.DA
C:\WINDOWS\system32\rieyqtid.dll Infetto da BHO.Agent.DH
C:\WINDOWS\system32\rqrpqol.dll Infetto da BHO.Wbrrock.A
C:\WINDOWS\system32\ssqolmn.dll Infetto da BHO.Wbrrock.A
C:\WINDOWS\system32\tfqakunl.dll Infetto da Trojan.Win32.Agent.AMW
C:\WINDOWS\system32\tuvsqrs.dll Infetto da BHO.Wbrrock.A
C:\WINDOWS\system32\urspq.dll Infetto da BHO.Revcomd.A

Chiavi Registro infette: 1.
Files Infetti: 36.
Files Sospetti: 0.
Files Analizzati: 63361.
Files Totali: 63361.
Chiavi Registro rimosse: 0.
Virus Rimossi: 0.

[SCANSIONE DELLA MEMORIA]
OK
--------------------------------------------------------
21/03/2007 - 21:53:53

[SCANSIONE DEL REGISTRO]
{74DD705D-6834-439C-A735-A6DBE2677452} Infetto da BHO.VSAdd.A

[C:]
MASTER BOOT RECORD: OK
BOOT SECTOR: OK

[SCANSIONE DELLA MEMORIA]
OK
--------------------------------------------------------
22/03/2007 - 09:27:30

[SCANSIONE DELLA MEMORIA]
OK
--------------------------------------------------------
22/03/2007 - 11:58:05

[SCANSIONE DEL REGISTRO]
{74DD705D-6834-439C-A735-A6DBE2677452} Infetto da BHO.VSAdd.A

[C:]
MASTER BOOT RECORD: OK
BOOT SECTOR: OK

C:\Documents and Settings\Administrator\Desktop\backups\backup-20070304-194952-626.dll Infetto da BHO.Revcomd.A
C:\Documents and Settings\Administrator\Desktop\backups\backup-20070306-110751-687.dll Infetto da BHO.Revcomd.A
C:\Documents and Settings\Administrator\Desktop\backups\backup-20070310-230841-672.dll Infetto da BHO.Revcomd.A
C:\Documents and Settings\Administrator\Impostazioni locali\Temporary Internet Files\Content.IE5\AI61Q9KI\s3.0[1].exe Possibile variante da Trojan.Win32.Agent.APP
C:\Programmi\Symantec AntiVirus\ax.exe Infetto da Backdoor.SdBot.PV
C:\Programmi\Symantec AntiVirus\msb.exe Infetto da Backdoor.RBot.XH
C:\WINDOWS\system\system.exe Infetto da Backdoor.SdBot.PV
C:\WINDOWS\system32\celyowrb.dll Infetto da BHO.Agent.DH
C:\WINDOWS\system32\config\systemprofile\Impostazioni locali\Temporary Internet Files\Content.IE5\NPHOJJ89\s3.0[1].exe Possibile variante da Trojan.Win32.Agent.APP
C:\WINDOWS\system32\cronos.exe Infetto da Backdoor.RBot.XY
C:\WINDOWS\system32\crypts.dll Infetto da Trojan.Win32.Agent.APS
C:\WINDOWS\system32\ddcyaww.dll Infetto da BHO.Wbrrock.A
C:\WINDOWS\system32\efcywtt.dll Infetto da BHO.Wbrrock.A
C:\WINDOWS\system32\eineifxq.dll Infetto da Trojan.Win32.Vundo.AS
C:\WINDOWS\system32\fccdecc.dll Infetto da BHO.Wbrrock.A
C:\WINDOWS\system32\fjjouops.dll Infetto da Trojan.Win32.Agent.AMW
C:\WINDOWS\system32\gciermll.dll Infetto da Trojan.Win32.Vundo.AS
C:\WINDOWS\system32\gebyayw.dll Infetto da BHO.Wbrrock.A
C:\WINDOWS\system32\gxeapnwa.dll Infetto da BHO.Agent.DA
C:\WINDOWS\system32\hggdecb.dll Infetto da BHO.Wbrrock.A
C:\WINDOWS\system32\igrdmdeyie.exe Infetto da Backdoor.RBot.XY
C:\WINDOWS\system32\jsdxfbup.dll Infetto da BHO.Agent.DA
C:\WINDOWS\system32\khfgfgd.dll Infetto da BHO.Wbrrock.A
C:\WINDOWS\system32\mljgghg.dll Infetto da BHO.Wbrrock.A
C:\WINDOWS\system32\mljjkhe.dll Infetto da BHO.Wbrrock.A
C:\WINDOWS\system32\n00s.exe Infetto da Backdoor.RBot.XY
C:\WINDOWS\system32\oktbkwkp.dll Infetto da Trojan.Win32.Agent.AMW
C:\WINDOWS\system32\opnkjhh.dll Infetto da BHO.Wbrrock.A
C:\WINDOWS\system32\opnoonm.dll Infetto da BHO.Wbrrock.A
C:\WINDOWS\system32\pmnllli.dll Infetto da BHO.Wbrrock.A
C:\WINDOWS\system32\qisdimkm.dll Infetto da BHO.Agent.DA
C:\WINDOWS\system32\rieyqtid.dll Infetto da BHO.Agent.DH
C:\WINDOWS\system32\rqrpqol.dll Infetto da BHO.Wbrrock.A
C:\WINDOWS\system32\ssqolmn.dll Infetto da BHO.Wbrrock.A
C:\WINDOWS\system32\tfqakunl.dll Infetto da Trojan.Win32.Agent.AMW
C:\WINDOWS\system32\tuvsqrs.dll Infetto da BHO.Wbrrock.A
C:\WINDOWS\system32\urspq.dll Infetto da BHO.Revcomd.A
C:\WINDOWS\Temp\AA19.tmp Possibile variante da Trojan.Win32.Agent.APP
C:\WINDOWS\Temp\C406.tmp Possibile variante da Trojan.Win32.Agent.APP
C:\WINDOWS\Temp\C5EF.tmp Possibile variante da Trojan.Win32.Agent.APP

Chiavi Registro infette: 1.
Files Infetti: 40.
Files Sospetti: 0.
Files Analizzati: 63835.
Files Totali: 63835.
Chiavi Registro rimosse: 0.
Virus Rimossi: 0.

[Orange]

Caspita, quanta roba?

Ma avevi gia usato in precedenza VirIT su questo computer?
I file infetti avrebbe dovuto rimuoverli...

posso consigliarti di fare lo scan con
A-Squared
Ewido Security Suite e
SysClean

[3iolo]

No mai usato quell'antivirus...ho eliminato i virus con Ewido visto che Virit non me li ha eliminati...

[chemicalbit]