Olimpo Informatico

[piki]

cade la connessione dopo pochi minuti. poi non riesco a ripristinarla,a meno che non stacchi e riattacchi il modem usb. altri pc con lo stesso modem funzionano. ho formattato ad ottobre perlo stesso problema e per un po' ha funzionato. uso windows 2000 e avast home edition.nel primo scan,fatto prima che si aprisse windows(credo..), avast mi ha trovato una "cosa" che si chiama CTX e da quello che ho capito non è riuscito a ripararlo.poi però non mi ha trovato più nulla. se vado nel cestino però ci sono tre file di sistema:kernel32.dll, winsock.dll(x2),winsock32.dll. ho fato girare anche spybot aggiornato, stinger, il tutto anche in modalità provvisoria. spesso quando lo spengo dice che sta chiudendo il programma monitoraggio fax, ma io non ho un fax e non ho mai inviato un fax. vi ringrazio in anticipo per un aiuto qualsiasi. e scusate se sono stata un po',tanto, confusa.
vi allego il log di hijackthis


Scan saved at 10.19.49, on 08/12/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINNT\system32\pctspk.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\GlobespanVirata\Adsl\dslstat.exe
C:\Program Files\GlobespanVirata\Adsl\dslagent.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programmi\WinZip\WZQKPICK.EXE
C:\Programmi\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hal9000.cisi.unito.it/wf/BIBLIOTECH/Portale-bi/Banche-dati/index.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy-medicina.unito.it:3128
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\GlobespanVirata\Adsl\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\GlobespanVirata\Adsl\dslagent.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programmi\WinZip\WZQKPICK.EXE
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Servizio amministrativo di Gestione disco logico (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: W2k PCtel speaker phone (Pctspk) - PCtel, Inc. - C:\WINNT\system32\pctspk.exe

[piki]

ho provato anche a far girare il secondo programma consigliato e questo è il risultato. niente immagino....


Find AWF report by noahdfear ©2006
Version 1.40



bak folders found
~~~~~~~~~~~



Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~



end of report

[Sante62]

Ciao piki
Il log di HjT sembra pulito.
Per cortesia, fai questi passaggi:
Scansione con GMER

[piki]

gmer51.txt

spero sia questo.

la parte con rootkit non riesco a farla. una volta mi si è riavviato il pc, la seconda è apparsa una pagina blu con scritto:
STOP: 0x00000050 ( 0xA12D1008, 0x00000000, 0xBDB6C745, 0x00000002)
PAGE_FAULT_IN_NONPAGED_AREA

Mistero... Ti ringrazio tantissimo per il tempo che mi dedichi.

[Sante62]

Il che è strano...
Guarda questa discussione relativa a combofix, scaricalo, installalo e fai la scansione del PC. Alla fine allega il risultato.

[piki]

ComboFix 07-12-08.1 - ilamari 08/12/2007 14.59.14.1 - NTFSx86
Eseguito da: C:\Documents and Settings\ilamari.ILAMARI-X9MUD14\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Creati Da 2007-11-08 al 2007-12-08 )))))))))))))))))))))))))))))))))))
.

2007-12-08 14:59 . 08/12/07 14.59 16,384 --a----t- C:\WINNT\system32\Perflib_Perfdata_2d4.dat
2007-12-08 13:50 . 08/12/07 13.50 <DIR> d-------- C:\Programmi\Sophos
2007-12-08 13:48 . 08/12/07 13.48 1,171,714 --a------ C:\Programmi\sarsfx.exe
2007-12-08 13:12 . 08/12/07 13.12 16,384 --a----t- C:\WINNT\system32\Perflib_Perfdata_208.dat
2007-12-08 13:04 . 08/12/07 13.04 16,384 --a----t- C:\WINNT\system32\Perflib_Perfdata_1fc.dat
2007-12-08 12:55 . 08/12/07 14.01 250 --a------ C:\WINNT\gmer.ini
2007-12-08 12:53 . 08/12/07 12.53 <DIR> d-------- C:\Programmi\gmer
2007-12-08 10:31 . 08/12/07 10.31 502,055 --a------ C:\Programmi\gmer.zip
2007-12-08 10:30 . 08/12/07 10.30 189,718 --a------ C:\Programmi\FindAWF.exe
2007-12-08 10:04 . 08/12/07 10.04 407,680 --a------ C:\Programmi\aswclnr.exe
2007-12-08 09:59 . 08/12/07 09.59 16,384 --a----t- C:\WINNT\system32\Perflib_Perfdata_200.dat
2007-12-08 09:45 . 08/12/07 09.45 16,384 --a----t- C:\WINNT\system32\Perflib_Perfdata_220.dat
2007-12-07 21:40 . 08/12/07 10.19 <DIR> d-------- C:\Programmi\hijackthis_199
2007-12-07 20:14 . 08/12/07 09.57 465,322 ---h----- C:\WINNT\ShellIconCache
2007-12-07 19:12 . 07/12/07 19.12 16,384 --a----t- C:\WINNT\system32\Perflib_Perfdata_21c.dat
2007-12-07 15:41 . 18/03/03 21.20 1,060,864 --a------ C:\WINNT\system32\MFC71.dll
2007-12-07 15:41 . 04/12/07 14.04 837,496 --a------ C:\WINNT\system32\aswBoot.exe
2007-12-07 15:41 . 09/01/04 10.13 380,928 --a------ C:\WINNT\system32\actskin4.ocx
2007-12-07 15:41 . 04/12/07 13.54 95,608 --a------ C:\WINNT\system32\AvastSS.scr
2007-12-07 15:41 . 04/12/07 15.55 94,544 --a------ C:\WINNT\system32\drivers\aswmon2.sys
2007-12-07 15:41 . 04/12/07 15.56 93,264 --a------ C:\WINNT\system32\drivers\aswmon.sys
2007-12-07 15:41 . 04/12/07 15.51 42,912 --a------ C:\WINNT\system32\drivers\aswTdi.sys
2007-12-07 15:41 . 04/12/07 15.49 26,624 --a------ C:\WINNT\system32\drivers\aavmker4.sys
2007-12-07 15:41 . 04/12/07 15.53 23,152 --a------ C:\WINNT\system32\drivers\aswRdr.sys
2007-12-07 15:40 . 07/12/07 15.40 <DIR> d-------- C:\Programmi\Alwil Software
2007-12-07 15:17 . 07/12/07 15.19 1,953,799 --a------ C:\Programmi\stinger.exe
2007-12-07 15:08 . 07/12/07 15.15 18,319,832 --a------ C:\Programmi\setupita.exe
2007-11-30 14:54 . 30/11/07 14.54 <DIR> d-------- C:\Documents and Settings\ilamari.ILAMARI-X9MUD14\Dati applicazioni\Uniblue
2007-11-30 14:45 . 30/11/07 14.45 881,192 --a------ C:\Programmi\WGAPluginInstall.exe
2007-11-30 14:11 . 30/11/07 14.11 <DIR> d-------- C:\Programmi\CCleaner
2007-11-30 14:08 . 30/11/07 14.08 2,724,328 --a------ C:\Programmi\ccsetup203.exe
2007-11-30 12:38 . 30/11/07 12.52 2,550 --a------ C:\WINNT\system32\Uninstall.ico
2007-11-30 12:38 . 30/11/07 12.52 1,406 --a------ C:\WINNT\system32\Help.ico
2007-11-27 11:08 . 08/12/07 09.43 <DIR> d-a------ C:\Documents and Settings\All Users.WINNT\Dati applicazioni\Spybot - Search & Destroy
2007-11-27 11:00 . 27/11/07 11.00 7,467,056 --a------ C:\Programmi\spybotsd15.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-08 11:42 --------- d-----w C:\Documents and Settings\ilamari.ILAMARI-X9MUD14\Dati applicazioni\uTorrent
2007-12-08 11:33 --------- d-----w C:\Programmi\eMule
2007-12-07 18:07 17 ----a-w C:\Programmi\stinger.opt
2007-12-07 14:17 17 ----a-w C:\Programmi\stng260.opt
2007-11-08 13:36 36,096 ----a-w C:\WINNT\system32\drivers\VIRAGTLT.SYS
2007-10-27 17:22 --------- d-----w C:\Programmi\Office 2003 Pro ITA + SP2
2007-10-26 16:41 --------- d-----w C:\Programmi\Microsoft.NET
2007-10-26 13:11 --------- d---a-w C:\Programmi\MSN Messenger
2007-09-10 21:46 4 --sha-w C:\WINNT\Fonts\ARIAL.TCX
2007-09-10 21:33 155,995 ----a-w C:\WINNT\java\Packages\3PRHR1FN.ZIP
2007-09-10 20:47 558,142 ----a-w C:\WINNT\java\Packages\40NTJBF5.ZIP
2007-09-10 20:46 271 ---h--w C:\Programmi\desktop.ini
2007-09-10 20:46 22,075 ---h--w C:\Programmi\folder.htt
2006-05-25 14:52 162,304 ----a-w C:\Programmi\unrar.dll
2006-05-11 12:50 844 ----a-w C:\Programmi\Connessione a Internet.LNK
1999-12-23 00:00 32,528 ----a-w C:\WINNT\inf\wbfirdma.sys
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* i valori vuoti & legittimi/default non sono visualizzati.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPLpr"="C:\Programmi\Synaptics\SynTP\SynTPLpr.exe" [27/04/01 11.09 ]
"SynTPEnh"="C:\Programmi\Synaptics\SynTP\SynTPEnh.exe" [27/04/01 11.08 ]
"DSLSTATEXE"="C:\Program Files\GlobespanVirata\Adsl\dslstat.exe" [10/06/03 06.54 ]
"DSLAGENTEXE"="C:\Program Files\GlobespanVirata\Adsl\dslagent.exe" [19/08/03 04.47 ]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [04/12/07 14.00 ]
"Synchronization Manager"="mobsync.exe" [19/06/03 11.05 C:\WINNT\system32\mobsync.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"internat.exe"="internat.exe" [23/12/99 01.00 C:\WINNT\system32\internat.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"^SetupICWDesktop"="C:\Programmi\Internet Explorer\Connection Wizard\icwconn1.exe" [19/06/03 11.05 ]

C:\Documents and Settings\All Users.WINNT\Menu Avvio\Programmi\Esecuzione automatica\
Avvio veloce di Adobe Reader.lnk - C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26]
WinZip Quick Pick.lnk - C:\Programmi\WinZip\WZQKPICK.EXE [2007-09-10 23:03:54]

R2 aswMon;avast! Standard Shield Support;C:\WINNT\system32\drivers\aswMon.sys
R2 Pctspk;W2k PCtel speaker phone;C:\WINNT\system32\pctspk.exe
R3 smimini;smimini;C:\WINNT\system32\DRIVERS\smimini.sys
R3 wanusb;Nortek Jet ADSL WAN modem;C:\WINNT\system32\DRIVERS\gwausb.sys
S3 MEMSWEEP2;MEMSWEEP2;\??\C:\WINNT\system32\6.tmp

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
**************************************************************************

catchme 0.3.1331 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-08 15:01:58
Windows 5.0.2195 Service Pack 4 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
Ora fine scansione: 08/12/2007 15.04.11
.
--- E O F ---

[piki]

questo è il log aggiornato a dopo la scansione con combofix, non so se può servire...
Scan saved at 15.22.44, on 08/12/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINNT\system32\pctspk.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\GlobespanVirata\Adsl\dslstat.exe
C:\Program Files\GlobespanVirata\Adsl\dslagent.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programmi\WinZip\WZQKPICK.EXE
C:\WINNT\explorer.exe
C:\Programmi\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hal9000.cisi.unito.it/wf/BIBLIOTECH/Portale-bi/Banche-dati/index.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy-medicina.unito.it:3128
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\GlobespanVirata\Adsl\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\GlobespanVirata\Adsl\dslagent.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programmi\WinZip\WZQKPICK.EXE
O17 - HKLM\System\CCS\Services\Tcpip\..\{81503A07-6757-4039-AEEA-BF017132BE9E}: NameServer = 193.70.152.15 193.70.152.25
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Servizio amministrativo di Gestione disco logico (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: W2k PCtel speaker phone (Pctspk) - PCtel, Inc. - C:\WINNT\system32\pctspk.exe

[bdoriano]

Ciao piki,

prima di procedere oltre, ti conviene aggiornare Internet Explorer 6.

[piki]

dovrei aver fatto...

[Sante62]

Non mi pare abbia trovato qualcosa...
Riprova a fare lo scan Rootkit di GMER, ma tieni antivirus e firewall disattivati ed eventuali altri moduli in tempo reale.

[piki]

ore lo scan rootkit di GMER ha funzionato senza problemi.
Direct Link
http://www.freefilehosting.net/download/NDc1MDY=

[Sante62]

Mi sembra ci sia qualcosa...
Per cortesia collegati a Kaspersky online scanner e procedi con la scansione completa del PC.
Quando sta scaricando i file necessari, disattiva momentaneamente l'antivirus ed eventualmente anche il firewall. Non appena inizia la scansione del PC disconnettiti da internet.
Alla fine carica il risultato su www.freefilehosting.net, riportando quì il link che ti viene assegnato.

[piki]

http://www.freefilehosting.net/download/NDgxNDU=

[Sante62]

Il log di Kaspersky sembra pulito. Riscontri ancora problemi?.

[piki]

ciao!
ora con la navigazione sembra migliorato(sono riuscita a inviare un paio di mail importanti), mentre se apro utorrent o emule cade istantaneamente la connessione. chissà cosa può essere...
cmq ancora grazie mille

[Sante62]

Non saprei dirti di preciso.
Posta un altro log di Hijackthis.

[piki]

Logfile of HijackThis v1.99.1
Scan saved at 11.29.28, on 10/12/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINNT\system32\pctspk.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\GlobespanVirata\Adsl\dslstat.exe
C:\Program Files\GlobespanVirata\Adsl\dslagent.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programmi\WinZip\WZQKPICK.EXE
C:\WINNT\System32\svchost.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\WINNT\system32\mshta.exe
C:\Programmi\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\GlobespanVirata\Adsl\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\GlobespanVirata\Adsl\dslagent.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programmi\WinZip\WZQKPICK.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{81503A07-6757-4039-AEEA-BF017132BE9E}: NameServer = 193.70.152.15 193.70.152.25
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Servizio amministrativo di Gestione disco logico (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: W2k PCtel speaker phone (Pctspk) - PCtel, Inc. - C:\WINNT\system32\pctspk.exe

[Sante62]

Il log è pulito. Escluderei questo fatto la causa di eventuale malware.
Però installati un firewall al più presto per una maggiore protezione.
Sul primo link della pagina principale del forum trovi le discussioni al riguardo.