Olimpo Informatico

[mattia]

Ho ricevuto un link da un contatto di msn e dopo averlo aperto sono iniziati i problemi....ho provato a fare la scansione con l'antivirus (antivir) e anche con i programmi da voi consigliati nella guida ma non riesco a trovarlo. Cos'altro dovrei fare?

[bdoriano]

Ciao mattia,

Segui le istruzioni di questo topic per postare il log di hijackthis.
Poi decideremo il da farsi.

[mattia]

Grazie!!
Ecco tutto:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19.05.29, on 06/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Programmi\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\AntiVir PersonalEdition Classic\sched.exe
C:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe
c:\Programmi\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Programmi\SPYWAREfighter\spfprc.exe
C:\Programmi\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\MSN Messenger\msnmsgr.exe
C:\Windows\msnmsgs.exe
C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\File comuni\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\Administrator\Documenti\Varie\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.libero.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.hp.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [avgnt] "C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [spywarefighterguard] C:\Programmi\SPYWAREfighter\spftray.exe
O4 - HKLM\..\Run: [MSN] msnmsgs.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Windows Live Search - res://C:\Programmi\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Apri in nuova scheda in primo piano - res://C:\Programmi\Windows Live Toolbar\Components\it-it\msntabres.dll.mui/230?f063cfb8e05e48d493383af303d84d67
O8 - Extra context menu item: Apri in nuova scheda in secondo piano - res://C:\Programmi\Windows Live Toolbar\Components\it-it\msntabres.dll.mui/229?f063cfb8e05e48d493383af303d84d67
O8 - Extra context menu item: Invia a &Bluetooth - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie_ctx.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/IT-IT/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1163597914468
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C854EEB3-432D-46D4-9A82-48EBF8A48797}: NameServer = 193.12.150.2 212.247.152.2
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Programmi\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmi\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Programmi\File comuni\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: PC Angel (PCA) - SoftThinks - C:\WINDOWS\SMINST\PCAngel.exe
O23 - Service: SPYWAREfighterRP - SpamFighter APS - C:\Programmi\SPYWAREfighter\spfprc.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

--
End of file - 6867 bytes

[bdoriano]

Disabilita il ripristino di sistema e avvia il pc in modalità provvisoria
esegui hijackthis
clicca su do a system scan only
metti il segno di spunta a queste voci:

[mattia]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19.33.22, on 06/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Programmi\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programmi\SPYWAREfighter\spftray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe
C:\Programmi\AntiVir PersonalEdition Classic\sched.exe
C:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe
c:\Programmi\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Programmi\SPYWAREfighter\spfprc.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\File comuni\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmi\Adobe\Reader 8.0\Reader\AcroRd32Info.exe
C:\Documents and Settings\Administrator\Documenti\Varie\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.libero.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.hp.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [avgnt] "C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [spywarefighterguard] C:\Programmi\SPYWAREfighter\spftray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Windows Live Search - res://C:\Programmi\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Apri in nuova scheda in primo piano - res://C:\Programmi\Windows Live Toolbar\Components\it-it\msntabres.dll.mui/230?f063cfb8e05e48d493383af303d84d67
O8 - Extra context menu item: Apri in nuova scheda in secondo piano - res://C:\Programmi\Windows Live Toolbar\Components\it-it\msntabres.dll.mui/229?f063cfb8e05e48d493383af303d84d67
O8 - Extra context menu item: Invia a &Bluetooth - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie_ctx.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/IT-IT/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1163597914468
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C854EEB3-432D-46D4-9A82-48EBF8A48797}: NameServer = 193.12.150.2 212.247.152.2
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Programmi\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmi\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Programmi\File comuni\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: PC Angel (PCA) - SoftThinks - C:\WINDOWS\SMINST\PCAngel.exe
O23 - Service: SPYWAREfighterRP - SpamFighter APS - C:\Programmi\SPYWAREfighter\spfprc.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

--
End of file - 6822 bytes


intanto faccio gli altri due passaggi!

[mattia]

Find AWF report by noahdfear ©2006
Version 1.40



bak folders found
~~~~~~~~~~~

Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 7667-DEF3

Directory di C:\PROGRA~1\AVPERS~1\BAK

30/09/2004 10.10 127.016 AVGNT.EXE
1 File 127.016 byte
2 Directory 52.597.510.144 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 7667-DEF3

Directory di C:\PROGRA~1\DAEMON~1\BAK

14/09/2006 22.09 157.592 daemon.exe
1 File 157.592 byte
2 Directory 52.597.510.144 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 7667-DEF3

Directory di C:\WINDOWS\CREATOR\BAK

09/03/2006 17.38 806.912 Remind_XP.exe
1 File 806.912 byte
2 Directory 52.597.506.048 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 7667-DEF3

Directory di C:\WINDOWS\SMINST\BAK

20/12/2005 16.51 1.187.840 Recguard.exe
15/02/2006 17.43 892.928 Scheduler.exe
2 File 2.080.768 byte
2 Directory 52.597.506.048 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 7667-DEF3

Directory di C:\WINDOWS\SYSTEM32\BAK

19/08/2004 10.00 15.360 ctfmon.exe
23/03/2006 14.13 77.824 hkcmd.exe
23/03/2006 14.17 118.784 igfxpers.exe
23/03/2006 14.17 94.208 igfxtray.exe
09/07/2001 12.50 155.648 NeroCheck.exe
5 File 461.824 byte
2 Directory 52.597.506.048 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 7667-DEF3

Directory di C:\PROGRA~1\ANALOG~1\CORE\BAK

20/05/2005 10.11 925.696 smax4pnp.exe
1 File 925.696 byte
2 Directory 52.597.506.048 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 7667-DEF3

Directory di C:\PROGRA~1\ANALOG~1\SOUNDMAX\BAK

06/05/2005 14.06 716.800 Smax4.exe
1 File 716.800 byte
2 Directory 52.597.506.048 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 7667-DEF3

Directory di C:\PROGRA~1\HPQ\DEFAUL~1\BAK

26/01/2006 14.35 172.094 cpqset.exe
1 File 172.094 byte
2 Directory 52.597.506.048 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 7667-DEF3

Directory di C:\PROGRA~1\NOKIA\NOKIAP~1\BAK

23/03/2004 13.20 147.968 TRAYAP~1.EXE
1 File 147.968 byte
2 Directory 52.597.506.048 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 7667-DEF3

Directory di C:\PROGRA~1\SKYPE\PHONE\BAK

0 File 0 byte
2 Directory 52.597.506.048 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 7667-DEF3

Directory di C:\PROGRA~1\SYNAPT~1\SYNTP\BAK

03/03/2006 18.46 761.948 SynTPEnh.exe
1 File 761.948 byte
2 Directory 52.597.501.952 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 7667-DEF3

Directory di C:\PROGRA~1\FILECO~1\PCSUITE\DATALA~1\BAK

17/04/2004 20.19 1.159.168 DATALA~1.EXE
1 File 1.159.168 byte
2 Directory 52.597.501.952 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 7667-DEF3

Directory di C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\BAK

11/09/2003 05.00 99.840 E_S4I0H2.EXE
1 File 99.840 byte
2 Directory 52.597.501.952 byte disponibili


Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~

327720 2 Apr 2007 "C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe"
127016 30 Sep 2004 "C:\Programmi\AVPersonal\bak\AVGNT.EXE"
157592 14 Sep 2006 "C:\Programmi\DAEMON Tools\bak\daemon.exe"
806912 9 Mar 2006 "C:\WINDOWS\CREATOR\bak\Remind_XP.exe"
1187840 20 Dec 2005 "C:\WINDOWS\SMINST\bak\Recguard.exe"
892928 15 Feb 2006 "C:\WINDOWS\SMINST\bak\Scheduler.exe"
15360 19 Aug 2004 "C:\WINDOWS\system32\ctfmon.exe"
15360 19 Aug 2004 "C:\WINDOWS\system32\bak\ctfmon.exe"
77824 23 Mar 2006 "C:\SwSetup\VID1\hkcmd.exe"
77824 23 Mar 2006 "C:\SwSetup\VID1\Win2000\hkcmd.exe"
77824 23 Mar 2006 "C:\WINDOWS\system32\bak\hkcmd.exe"
77824 23 Mar 2006 "C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\hkcmd.exe"
77824 23 Mar 2006 "C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\hkcmd.exe"
118784 23 Mar 2006 "C:\SwSetup\VID1\igfxpers.exe"
118784 23 Mar 2006 "C:\SwSetup\VID1\Win2000\igfxpers.exe"
118784 23 Mar 2006 "C:\WINDOWS\system32\bak\igfxpers.exe"
118784 23 Mar 2006 "C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\igfxpers.exe"
118784 23 Mar 2006 "C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\igfxpers.exe"
94208 23 Mar 2006 "C:\SwSetup\VID1\igfxtray.exe"
94208 23 Mar 2006 "C:\SwSetup\VID1\Win2000\igfxtray.exe"
94208 23 Mar 2006 "C:\WINDOWS\system32\bak\igfxtray.exe"
94208 23 Mar 2006 "C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\igfxtray.exe"
94208 23 Mar 2006 "C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\igfxtray.exe"
155648 9 Jul 2001 "C:\WINDOWS\system32\bak\NeroCheck.exe"
925696 20 May 2005 "C:\SwSetup\audio\SMax4PNP.exe"
925696 20 May 2005 "C:\Programmi\Analog Devices\Core\bak\smax4pnp.exe"
925696 20 May 2005 "C:\SwSetup\audio\SMAXWDM\W2K_XP\SMax4PNP.exe"
716800 6 May 2005 "C:\Programmi\Analog Devices\SoundMAX\bak\Smax4.exe"
716800 6 May 2005 "C:\SwSetup\audio\SM_Panel\Sys\SMax4.exe"
172094 26 Jan 2006 "C:\Programmi\HPQ\Default Settings\bak\cpqset.exe"
147968 23 Mar 2004 "C:\Programmi\Nokia\Nokia PC Suite 6\bak\TRAYAP~1.EXE"
761948 3 Mar 2006 "C:\SwSetup\Touchpad\SynTPEnh.exe"
761948 3 Mar 2006 "C:\Programmi\Synaptics\SynTP\bak\SynTPEnh.exe"
761948 3 Mar 2006 "C:\Programmi\Synaptics\SynTP\Media\SynTPEnh.exe"
1159168 17 Apr 2004 "C:\Programmi\File comuni\PCSuite\DataLayer\bak\DATALA~1.EXE"
99840 11 Sep 2003 "C:\WINDOWS\system32\spool\drivers\w32x86\E_S4I0H2.EXE"
99840 11 Sep 2003 "C:\WINDOWS\system32\spool\drivers\w32x86\3\bak\E_S4I0H2.EXE"


end of report

[mattia]

1). http://www.freefilehosting.net/download/MTkyMzg=
2). http://www.freefilehosting.net/download/MTkyNDA=

[mattia]

Aspetto vostre informazioni...grazie!!

[bdoriano]

Ciao mattia, :ciao
Scusa il ritardo.

log i hijackthis: sembra ok
log di findawf: sembra ok
logs sdi gmer: sembrano ok... anche se vedo un rimasuglio strano..

Per toglierci ogni dubbio, usiamo i pezzi da 90...
Clicca qui (tieni premuto il tasto CTRL mentre clicchi).
Salva il file, anche sul desktop se vuoi.
Disattiva temporaneamente il tuo antivirus.
Avvia il file appena scaricato (sys#####)
Assicurati che tutte le voci siano spuntate.
clicca su Scan now
L'operazione può durare diversi minuti... abbi pazienza
Al termine della scansione, ti verrà aperto il blocco note. Puoi chiuderlo tranquillamente.
Chiudi il programma e riattiva il tuo antivirus.
Carica il file c:\suspectfile\report.txt su http://www.freefilehosting.net
Posta qui il link che ti viene assegnato.

[mattia]

Grazie!!
Ecco tutto: http://www.freefilehosting.net/download/MTk0MzI=