Olimpo Informatico

[nikman]

Ciao, innanzitutto vi saluto come benvenuto nel vostro forum; seguo spesso i vostri forum sulla sicurezza e dai vostri consigli son risucito spesso a risolvere i vari problemi di pc che si presentano quando si naviga ma questa volta voglio chiedervi direttamente di aiutarmi a risolvere un problema che ancora non son riuscito ad eliminare e si tratta del dialer internet connection o più precisamente delle sottocartelle bak: in pratica appena si presenta il problema (disconnessione della mia linea e tentativi di connessione a internet connection che si crea nella nelle connessioni di rete) ho fatto più volte la pulizia delle cartelle bak con sostituzione dei file ke si trovano in queste cartelle ma per qualche giorno sembrava che il problema fosse risolto ma poi si verificava nuovamente. E quindi deduco che dalla procedura salto qualche passaggio in quanto dalla scansione fatta con finawf mi si presenta l'identica lista dei file bak sia prima ke dopo la procedura di pulizia. Vi kiedo quindi se possibile i possibili passi da eseguire per la risoluzione del problema, scusandomi sin da ora se non capirò qualche passaggio perchè è la prima volta che seguo questa procedura. Grazie

[nikman]

ho postato come da procedura attraverso findwaf ed ora se qualcuno mi aiuta a dire cosa dovrei fare, grazie:

Find AWF report by noahdfear ©2006
Version 1.40



bak folders found
~~~~~~~~~~~

Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 247A-1CD2

Directory di C:\WINDOWS\EHOME\BAK

17/08/2005 23.40 64.512 ehtray.exe
1 File 64.512 byte
2 Directory 52.185.247.744 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 247A-1CD2

Directory di C:\WINDOWS\SYSTEM32\BAK

07/09/2004 14.00 15.360 ctfmon.exe
09/07/2001 12.50 155.648 NeroCheck.exe
2 File 171.008 byte
2 Directory 52.185.247.744 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 247A-1CD2

Directory di C:\PROGRA~1\ANALOG~1\SOUNDMAX\BAK

23/09/2004 14.41 860.160 Smax4.exe
14/10/2004 11.11 1.388.544 SMax4PNP.exe
2 File 2.248.704 byte
2 Directory 52.185.243.648 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 247A-1CD2

Directory di C:\PROGRA~1\LOGITECH\ITOUCH\BAK

01/12/2003 12.38 892.928 iTouch.exe
1 File 892.928 byte
2 Directory 52.185.243.648 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 247A-1CD2

Directory di C:\PROGRA~1\NOKIA\NOKIAS~1\BAK

07/09/2007 15.44 3.100.672 NSLauncher.exe
1 File 3.100.672 byte
2 Directory 52.185.243.648 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 247A-1CD2

Directory di C:\PROGRA~1\ADOBE\READER~1.0\READER\BAK

10/10/2007 20.51 39.792 Reader_sl.exe
1 File 39.792 byte
2 Directory 52.185.243.648 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 247A-1CD2

Directory di C:\PROGRA~1\JAVA\JRE15~1.0_0\BIN\BAK

26/08/2005 19.14 36.975 jusched.exe
1 File 36.975 byte
2 Directory 52.185.243.648 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 247A-1CD2

Directory di C:\PROGRA~1\ADOBE\PHOTOS~1\3.0\APPS\BAK

07/07/2005 18.41 57.344 apdproxy.exe
1 File 57.344 byte
2 Directory 52.185.243.648 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 247A-1CD2

Directory di C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\BAK

21/06/2002 12.28 188.416 hpztsb05.exe
1 File 188.416 byte
2 Directory 52.185.243.648 byte disponibili


Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~

59392 10 Aug 2004 "C:\WINDOWS\$NtUninstallKB900325$\ehtray.exe"
64512 17 Aug 2005 "C:\WINDOWS\ehome\ehtray.exe"
64512 17 Aug 2005 "C:\WINDOWS\ehome\bak\ehtray.exe"
15360 7 Sep 2004 "C:\WINDOWS\system32\ctfmon.exe"
15360 7 Sep 2004 "C:\WINDOWS\system32\bak\ctfmon.exe"
155648 9 Jul 2001 "C:\WINDOWS\system32\NeroCheck .exe"
155648 9 Jul 2001 "C:\WINDOWS\system32\bak\NeroCheck.exe"
860160 23 Sep 2004 "C:\Programmi\Analog Devices\SoundMAX\Smax4.exe"
860160 23 Sep 2004 "C:\Programmi\Analog Devices\SoundMAX\bak\Smax4.exe"
14348 22 Apr 2008 "C:\Programmi\Analog Devices\SoundMAX\SMax4PNP.exe"
1388544 14 Oct 2004 "C:\Programmi\Analog Devices\SoundMAX\bak\SMax4PNP.exe"
14348 22 Apr 2008 "C:\Programmi\Logitech\iTouch\iTouch.exe"
892928 1 Dec 2003 "C:\Programmi\Logitech\iTouch\bak\iTouch.exe"
3100672 7 Sep 2007 "C:\Programmi\Nokia\Nokia Software Launcher\NSLauncher.exe"
327680 22 Dec 2007 "C:\WINDOWS\Installer\{A8C856AD-63CD-4613-AA29-E6C85607EA06}\NSLauncher2_8C75ED63874746D18905B6C4AF1D7A30.exe"
3100672 7 Sep 2007 "C:\Programmi\Nokia\Nokia Software Launcher\bak\NSLauncher.exe"
39792 10 Oct 2007 "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
39792 10 Oct 2007 "C:\Programmi\Adobe\Reader 8.0\Reader\bak\Reader_sl.exe"
14348 22 Apr 2008 "C:\Programmi\Java\jre1.5.0_05\bin\jusched.exe"
36975 26 Aug 2005 "C:\Programmi\Java\jre1.5.0_05\bin\bak\jusched.exe"
57344 7 Jul 2005 "C:\Programmi\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
57344 7 Jul 2005 "C:\Programmi\Adobe\Photoshop Album Starter Edition\3.0\Apps\bak\apdproxy.exe"
14348 22 Apr 2008 "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe"
188416 21 Jun 2002 "C:\WINDOWS\system32\spool\drivers\w32x86\3\bak\hpztsb05.exe"


end of report

[nikman]

Per maggiori informazioni come richiesto nel forum ho come sistema operativo windows xp professional e come antivirus ad ora nessuno. Per il resto vale il log postato nel messaggio precedente e ringrazio anticipatamente per l'aiuto che vorrete darmi.

[chemicalbit]

Posta anche un log di HijackThis (vedi qui)

[nikman]

Ecco il log di HijackThis come richiesto:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14.39.14, on 23/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Programmi\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmi\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\DOCUME~1\Angelo\IMPOST~1\Temp\Rar$EX00.750\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.libero.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: 205.238.40.53 www.winmx.com err.winmx.com
O1 - Hosts: 205.238.40.1 cache0.winmx.com test3201.winmx.com test3205.winmx.com
O1 - Hosts: 205.238.40.2 cache1.winmx.com test3202.winmx.com test3206.winmx.com
O1 - Hosts: 82.43.224.20 cache2.winmx.com test3203.winmx.com test3207.winmx.com
O1 - Hosts: 82.204.21.111 cache3.winmx.com test3204.winmx.com test3208.winmx.com
O1 - Hosts: 205.238.40.1 c3310.z1301.winmx.com c3310.z1302.winmx.com c3310.z1303.winmx.com c3310.z1304.winmx.com c3310.z1305.winmx.com c3310.z1306.winmx.com
O1 - Hosts: 205.238.40.1 c3311.z1301.winmx.com c3311.z1302.winmx.com c3311.z1303.winmx.com c3311.z1304.winmx.com c3311.z1305.winmx.com c3311.z1306.winmx.com
O1 - Hosts: 205.238.40.1 c3312.z1301.winmx.com c3312.z1302.winmx.com c3312.z1303.winmx.com c3312.z1304.winmx.com c3312.z1305.winmx.com c3312.z1306.winmx.com
O1 - Hosts: 205.238.40.2 c3313.z1301.winmx.com c3313.z1302.winmx.com c3313.z1303.winmx.com c3313.z1304.winmx.com c3313.z1305.winmx.com c3313.z1306.winmx.com
O1 - Hosts: 205.238.40.2 c3314.z1301.winmx.com c3314.z1302.winmx.com c3314.z1303.winmx.com c3314.z1304.winmx.com c3314.z1305.winmx.com c3314.z1306.winmx.com
O1 - Hosts: 205.238.40.2 c3315.z1301.winmx.com c3315.z1302.winmx.com c3315.z1303.winmx.com c3315.z1304.winmx.com c3315.z1305.winmx.com c3315.z1306.winmx.com
O1 - Hosts: 82.43.224.20 c3316.z1301.winmx.com c3316.z1302.winmx.com c3316.z1303.winmx.com c3316.z1304.winmx.com c3316.z1305.winmx.com c3316.z1306.winmx.com
O1 - Hosts: 82.43.224.20 c3317.z1301.winmx.com c3317.z1302.winmx.com c3317.z1303.winmx.com c3317.z1304.winmx.com c3317.z1305.winmx.com c3317.z1306.winmx.com
O1 - Hosts: 82.204.21.111 c3318.z1301.winmx.com c3318.z1302.winmx.com c3318.z1303.winmx.com c3318.z1304.winmx.com c3318.z1305.winmx.com c3318.z1306.winmx.com
O1 - Hosts: 82.204.21.111 c3319.z1301.winmx.com c3319.z1302.winmx.com c3319.z1303.winmx.com c3319.z1304.winmx.com c3319.z1305.winmx.com c3319.z1306.winmx.com
O1 - Hosts: 205.238.40.1 c3520.z1301.winmx.com c3520.z1302.winmx.com c3520.z1303.winmx.com c3520.z1304.winmx.com c3520.z1305.winmx.com c3520.z1306.winmx.com
O1 - Hosts: 205.238.40.1 c3521.z1301.winmx.com c3521.z1302.winmx.com c3521.z1303.winmx.com c3521.z1304.winmx.com c3521.z1305.winmx.com c3521.z1306.winmx.com
O1 - Hosts: 205.238.40.1 c3522.z1301.winmx.com c3522.z1302.winmx.com c3522.z1303.winmx.com c3522.z1304.winmx.com c3522.z1305.winmx.com c3522.z1306.winmx.com
O1 - Hosts: 205.238.40.2 c3523.z1301.winmx.com c3523.z1302.winmx.com c3523.z1303.winmx.com c3523.z1304.winmx.com c3523.z1305.winmx.com c3523.z1306.winmx.com
O1 - Hosts: 205.238.40.2 c3524.z1301.winmx.com c3524.z1302.winmx.com c3524.z1303.winmx.com c3524.z1304.winmx.com c3524.z1305.winmx.com c3524.z1306.winmx.com
O1 - Hosts: 205.238.40.2 c3525.z1301.winmx.com c3525.z1302.winmx.com c3525.z1303.winmx.com c3525.z1304.winmx.com c3525.z1305.winmx.com c3525.z1306.winmx.com
O1 - Hosts: 82.43.224.20 c3526.z1301.winmx.com c3526.z1302.winmx.com c3526.z1303.winmx.com c3526.z1304.winmx.com c3526.z1305.winmx.com c3526.z1306.winmx.com
O1 - Hosts: 82.43.224.20 c3527.z1301.winmx.com c3527.z1302.winmx.com c3527.z1303.winmx.com c3527.z1304.winmx.com c3527.z1305.winmx.com c3527.z1306.winmx.com
O1 - Hosts: 82.204.21.111 c3528.z1301.winmx.com c3528.z1302.winmx.com c3528.z1303.winmx.com c3528.z1304.winmx.com c3528.z1305.winmx.com c3528.z1306.winmx.com
O1 - Hosts: 82.204.21.111 c3529.z1301.winmx.com c3529.z1302.winmx.com c3529.z1303.winmx.com c3529.z1304.winmx.com c3529.z1305.winmx.com c3529.z1306.winmx.com
O1 - Hosts: 205.238.40.53 winmx-com.winmxgroup.com winmx-com-v30.winmxgroup.com
O1 - Hosts: 205.238.40.1 test0.winmxgroup.net test4.winmxgroup.net
O1 - Hosts: 205.238.40.2 test1.winmxgroup.net test5.winmxgroup.net
O1 - Hosts: 82.43.224.20 test2.winmxgroup.net test6.winmxgroup.net
O1 - Hosts: 82.204.21.111 test3.winmxgroup.net
O1 - Hosts: 205.238.40.1 cache0.winmxgroup.com cache4.winmxgroup.com cache8.winmxgroup.com cache2.winmxgroup.net cache6.winmxgroup.net cache10.winmxgroup.net cache14.winmxgroup.net cache18.winmxgroup.com
O1 - Hosts: 205.238.40.2 cache1.winmxgroup.com cache5.winmxgroup.com cache9.winmxgroup.com cache3.winmxgroup.net cache7.winmxgroup.net cache11.winmxgroup.net cache15.winmxgroup.net cache19.winmxgroup.com
O1 - Hosts: 82.43.224.20 cache2.winmxgroup.com cache6.winmxgroup.com cache0.winmxgroup.net cache4.winmxgroup.net cache8.winmxgroup.net cache12.winmxgroup.net cache16.winmxgroup.net
O1 - Hosts: 82.204.21.111 cache3.winmxgroup.com cache7.winmxgroup.com cache1.winmxgroup.net cache5.winmxgroup.net cache9.winmxgroup.net cache13.winmxgroup.net cache17.winmxgroup.net
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Programmi\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Programmi\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmi\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programmi\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NSLauncher] C:\Programmi\Nokia\Nokia Software Launcher\NSLauncher.exe /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [IETI] C:\Programmi\Skype\Phone\IEPlugin\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [IETI] C:\Programmi\Skype\Phone\IEPlugin\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Programmi\Yahoo!\Messenger\yhexbmesit.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Programmi\Yahoo!\Messenger\yhexbmesit.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O15 - Trusted Zone: www.master70.biz
O15 - Trusted Zone: www.master71.biz
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programmi\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{C0835856-69A6-4A63-91D9-0B77E1D78023}: NameServer = 85.37.17.49 85.38.28.91
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programmi\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--
End of file - 10559 bytes

[bdoriano]

Ultimo log che serve per avere un quadro completo:
Segui le istruzioni di questo topic per postare il log di combofix.

[nikman]

ecco il log combofix rickiesto x avere un quadro + kiaro. attendo istruzioni:

ComboFix 08-04-22.5 - Angelo 2008-04-23 16.19.33.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1040.18.660 [GMT 2:00]
Eseguito da: C:\Documents and Settings\Angelo\Desktop\ComboFix.exe
* Creato nuovo punto di ripristino

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\Downloaded Program Files\setup.inf

.
((((((((((((((((((((((((( Files Creati Da 2008-03-23 al 2008-04-23 )))))))))))))))))))))))))))))))))))
.

2008-04-23 16:19 . 2008-04-23 16:19 1,024 --ah----- C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG
2008-04-21 21:39 . 2001-07-09 12:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck .exe
2008-04-21 21:39 . 2004-09-07 14:00 15,360 --a--c--- C:\WINDOWS\system32\dllcache\ctfmon.exe
2008-04-21 21:39 . 2004-09-07 14:00 15,360 --a------ C:\WINDOWS\system32\ctfmon.exe3743615371
2008-04-21 21:39 . 2004-09-07 14:00 15,360 --a------ C:\WINDOWS\system32\ctfmon.exe
2008-04-21 21:39 . 2004-09-07 14:00 15,360 --a------ C:\WINDOWS\system32\ctfmon .exe
2008-04-21 21:39 . 2008-04-22 21:08 14,348 --a------ C:\WINDOWS\system32\NeroCheck.exe3459083658
2008-04-21 21:36 . 2005-08-17 23:40 64,512 --a--c--- C:\WINDOWS\system32\dllcache\ehtray.exe
2008-04-21 21:28 . 2008-04-21 21:28 6,144 --ahs---- C:\WINDOWS\system32\Thumbs.db
2008-04-16 13:15 . 2008-04-16 13:15 <DIR> d-------- C:\Programmi\File comuni\Skype
2008-04-16 13:14 . 2008-04-16 13:14 <DIR> d-------- C:\Documents and Settings\LocalService\Dati applicazioni\AVG7
2008-04-02 13:08 . 2008-04-02 13:08 <DIR> d-------- C:\Documents and Settings\Angelo\Dati applicazioni\skypePM
2008-04-02 13:08 . 2008-04-02 13:08 32 --a------ C:\Documents and Settings\All Users\Dati applicazioni\ezsid.dat
2008-03-31 23:25 . 2008-03-31 23:25 831,488 --a------ C:\WINDOWS\system32\divx_xx0a.dll
2008-03-31 23:25 . 2008-03-31 23:25 823,296 --a------ C:\WINDOWS\system32\divx_xx0c.dll
2008-03-31 23:25 . 2008-03-31 23:25 823,296 --a------ C:\WINDOWS\system32\divx_xx07.dll
2008-03-31 23:25 . 2008-03-31 23:25 802,816 --a------ C:\WINDOWS\system32\divx_xx11.dll
2008-03-31 23:25 . 2008-03-31 23:25 682,496 --a------ C:\WINDOWS\system32\DivX.dll
2008-03-31 23:25 . 2008-03-31 23:25 161,096 --a--c--- C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-03-24 21:45 . 2008-03-24 21:45 630,784 --a------ C:\WINDOWS\system32\divxdec.ax

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-23 13:59 --------- d-----w C:\Documents and Settings\Angelo\Dati applicazioni\Skype
2008-04-22 19:09 --------- d-----w C:\Programmi\C6 Messenger
2008-04-22 18:44 --------- d-----w C:\Documents and Settings\Angelo\Dati applicazioni\SopCast
2008-04-21 18:16 --------- d-----w C:\Programmi\eMule
2008-04-17 11:08 --------- d-----w C:\Programmi\DivX
2008-04-16 11:15 --------- d-----w C:\Programmi\SopCast
2008-03-21 20:30 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-03-21 20:30 3,596,288 -c--a-w C:\WINDOWS\system32\qt-dx331.dll
2008-03-21 20:30 200,704 -c--a-w C:\WINDOWS\system32\ssldivx.dll
2008-03-21 20:30 1,044,480 -c--a-w C:\WINDOWS\system32\libdivx.dll
2008-03-21 20:28 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-03-21 20:28 593,920 -c--a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-03-21 20:28 57,344 -c--a-w C:\WINDOWS\system32\dpv11.dll
2008-03-21 20:28 53,248 -c--a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-03-21 20:28 344,064 -c--a-w C:\WINDOWS\system32\dpus11.dll
2008-03-21 20:28 294,912 -c--a-w C:\WINDOWS\system32\dpu11.dll
2008-03-21 20:28 294,912 -c--a-w C:\WINDOWS\system32\dpu10.dll
2008-03-21 20:28 196,608 -c--a-w C:\WINDOWS\system32\dtu100.dll
2008-03-21 20:28 12,288 -c--a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-03-20 08:06 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-02-20 06:50 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:33 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-16 09:31 668,672 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-12 08:54 737,280 -c--a-w C:\WINDOWS\iun6002.exe
2007-12-28 11:30 69,176 ----a-w C:\Documents and Settings\Angelo\Dati applicazioni\GDIPFONTCACHEV1.DAT
.

[bdoriano]

Crea un file di testo con le seguenti istruzioni:

[nikman]

ecco il nuovo log di combofix postato dopo la craezione del file FScript.txt:

ComboFix 08-04-22.5 - Angelo 2008-04-23 16.40.46.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1040.18.621 [GMT 2:00]
Eseguito da: C:\Documents and Settings\Angelo\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Angelo\Desktop\CFScript.txt
* Creato nuovo punto di ripristino

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\Programmi\C6 Messenger\rundll32.exe stmctrl .exe
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Programmi\C6 Messenger\rundll32.exe stmctrl .exe

.
((((((((((((((((((((((((( Files Creati Da 2008-03-23 al 2008-04-23 )))))))))))))))))))))))))))))))))))
.

2008-04-23 16:19 . 2008-04-23 16:19 1,024 --ah----- C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG
2008-04-21 21:39 . 2001-07-09 12:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2008-04-21 21:39 . 2004-09-07 14:00 15,360 --a--c--- C:\WINDOWS\system32\dllcache\ctfmon.exe
2008-04-21 21:39 . 2004-09-07 14:00 15,360 --a------ C:\WINDOWS\system32\ctfmon.exe3743615371
2008-04-21 21:39 . 2004-09-07 14:00 15,360 --a------ C:\WINDOWS\system32\ctfmon.exe
2008-04-21 21:39 . 2008-04-22 21:08 14,348 --a------ C:\WINDOWS\system32\NeroCheck.exe3459083658
2008-04-21 21:36 . 2005-08-17 23:40 64,512 --a--c--- C:\WINDOWS\system32\dllcache\ehtray.exe
2008-04-21 21:28 . 2008-04-21 21:28 6,144 --ahs---- C:\WINDOWS\system32\Thumbs.db
2008-04-16 13:15 . 2008-04-16 13:15 <DIR> d-------- C:\Programmi\File comuni\Skype
2008-04-16 13:14 . 2008-04-16 13:14 <DIR> d-------- C:\Documents and Settings\LocalService\Dati applicazioni\AVG7
2008-04-02 13:08 . 2008-04-02 13:08 <DIR> d-------- C:\Documents and Settings\Angelo\Dati applicazioni\skypePM
2008-04-02 13:08 . 2008-04-02 13:08 32 --a------ C:\Documents and Settings\All Users\Dati applicazioni\ezsid.dat
2008-03-31 23:25 . 2008-03-31 23:25 831,488 --a------ C:\WINDOWS\system32\divx_xx0a.dll
2008-03-31 23:25 . 2008-03-31 23:25 823,296 --a------ C:\WINDOWS\system32\divx_xx0c.dll
2008-03-31 23:25 . 2008-03-31 23:25 823,296 --a------ C:\WINDOWS\system32\divx_xx07.dll
2008-03-31 23:25 . 2008-03-31 23:25 802,816 --a------ C:\WINDOWS\system32\divx_xx11.dll
2008-03-31 23:25 . 2008-03-31 23:25 682,496 --a------ C:\WINDOWS\system32\DivX.dll
2008-03-31 23:25 . 2008-03-31 23:25 161,096 --a--c--- C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-03-24 21:45 . 2008-03-24 21:45 630,784 --a------ C:\WINDOWS\system32\divxdec.ax

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-23 14:40 --------- d-----w C:\Programmi\C6 Messenger
2008-04-23 13:59 --------- d-----w C:\Documents and Settings\Angelo\Dati applicazioni\Skype
2008-04-22 18:44 --------- d-----w C:\Documents and Settings\Angelo\Dati applicazioni\SopCast
2008-04-21 18:16 --------- d-----w C:\Programmi\eMule
2008-04-17 11:08 --------- d-----w C:\Programmi\DivX
2008-04-16 11:15 --------- d-----w C:\Programmi\SopCast
2008-03-21 20:30 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-03-21 20:30 3,596,288 -c--a-w C:\WINDOWS\system32\qt-dx331.dll
2008-03-21 20:30 200,704 -c--a-w C:\WINDOWS\system32\ssldivx.dll
2008-03-21 20:30 1,044,480 -c--a-w C:\WINDOWS\system32\libdivx.dll
2008-03-21 20:28 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-03-21 20:28 593,920 -c--a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-03-21 20:28 57,344 -c--a-w C:\WINDOWS\system32\dpv11.dll
2008-03-21 20:28 53,248 -c--a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-03-21 20:28 344,064 -c--a-w C:\WINDOWS\system32\dpus11.dll
2008-03-21 20:28 294,912 -c--a-w C:\WINDOWS\system32\dpu11.dll
2008-03-21 20:28 294,912 -c--a-w C:\WINDOWS\system32\dpu10.dll
2008-03-21 20:28 196,608 -c--a-w C:\WINDOWS\system32\dtu100.dll
2008-03-21 20:28 12,288 -c--a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-03-20 08:06 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-02-20 06:50 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:33 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-16 09:31 668,672 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-12 08:54 737,280 -c--a-w C:\WINDOWS\iun6002.exe
2007-12-28 11:30 69,176 ----a-w C:\Documents and Settings\Angelo\Dati applicazioni\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((( snapshot@2008-04-23_16.21.18,31 )))))))))))))))))))))))))))))))))))))))))
.
+ 2002-06-21 10:28:47 188,416 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
.
((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
-c--a-w 57,344 2005-07-07 16:41:54 C:\Programmi\Adobe\Photoshop Album Starter Edition\3.0\Apps\bak\apdproxy.exe
----a-w 57,344 2005-07-07 16:41:54 C:\Programmi\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

----a-w 39,792 2007-10-10 18:51:55 C:\Programmi\Adobe\Reader 8.0\Reader\bak\Reader_sl.exe
----a-w 39,792 2007-10-10 18:51:55 C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe

-c--a-w 860,160 2004-09-23 12:41:54 C:\Programmi\Analog Devices\SoundMAX\bak\Smax4.exe
----a-w 860,160 2004-09-23 12:41:54 C:\Programmi\Analog Devices\SoundMAX\Smax4.exe

-c--a-w 1,388,544 2004-10-14 09:11:10 C:\Programmi\Analog Devices\SoundMAX\bak\SMax4PNP.exe
----a-w 1,388,544 2004-10-14 09:11:10 C:\Programmi\Analog Devices\SoundMAX\SMax4PNP.exe

-c--a-w 36,975 2005-08-26 17:14:44 C:\Programmi\Java\jre1.5.0_05\bin\bak\jusched.exe
----a-w 36,975 2005-08-26 17:14:44 C:\Programmi\Java\jre1.5.0_05\bin\jusched.exe

-c--a-w 892,928 2003-12-01 10:38:16 C:\Programmi\Logitech\iTouch\bak\iTouch.exe
----a-w 892,928 2003-12-01 10:38:16 C:\Programmi\Logitech\iTouch\iTouch.exe

----a-w 3,100,672 2007-09-07 13:44:30 C:\Programmi\Nokia\Nokia Software Launcher\bak\NSLauncher.exe
----a-w 3,100,672 2007-09-07 13:44:30 C:\Programmi\Nokia\Nokia Software Launcher\NSLauncher.exe

-c--a-w 64,512 2005-08-17 21:40:06 C:\WINDOWS\ehome\bak\ehtray.exe
----a-w 64,512 2005-08-17 21:40:06 C:\WINDOWS\ehome\ehtray.exe

----a-w 15,360 2004-09-07 12:00:00 C:\WINDOWS\system32\bak\ctfmon.exe
----a-w 15,360 2004-09-07 12:00:00 C:\WINDOWS\system32\ctfmon.exe

-c--a-w 155,648 2001-07-09 10:50:42 C:\WINDOWS\system32\bak\NeroCheck.exe
----a-w 155,648 2001-07-09 10:50:42 C:\WINDOWS\system32\NeroCheck.exe

-c--a-w 188,416 2002-06-21 10:28:47 C:\WINDOWS\system32\spool\drivers\w32x86\3\bak\hpztsb05.exe
----a-w 188,416 2002-06-21 10:28:47 C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe

.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* i valori vuoti & legittimi/default non sono visualizzati.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-07 14:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-17 23:40 64512]
"SunJavaUpdateSched"="C:\Programmi\Java\jre1.5.0_05\bin\jusched.exe" [2005-08-26 19:14 36975]
"SoundMAXPnP"="C:\Programmi\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 11:11 1388544]
"SoundMAX"="C:\Programmi\Analog Devices\SoundMAX\Smax4.exe" [2004-09-23 14:41 860160]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-01-05 12:31 7323648]
"nwiz"="nwiz.exe" [2006-01-05 12:31 1519616 C:\WINDOWS\system32\nwiz.exe]
"AdslTaskBar"="stmctrl.dll" [2003-01-22 13:01 151552 C:\WINDOWS\system32\stmctrl.dll]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe" [2002-06-21 12:28 188416]
"zBrowser Launcher"="C:\Programmi\Logitech\iTouch\iTouch.exe" [2003-12-01 12:38 892928]
"Adobe Photo Downloader"="C:\Programmi\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-07-07 18:41 57344]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
"Adobe Reader Speed Launcher"="C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 20:51 39792]
"NSLauncher"="C:\Programmi\Nokia\Nokia Software Launcher\NSLauncher.exe" [2007-09-07 15:44 3100672]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-07 14:00 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"IETI"="C:\Programmi\Skype\Phone\IEPlugin\unins000.exe" [ ]

C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Microsoft Office.lnk - C:\Programmi\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoSMBalloonTip"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3codec"= l3codecp.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programmi\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Programmi\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Programmi\\MSN Messenger\\msnmsgr.exe"=
"C:\\Programmi\\MSN Messenger\\livecall.exe"=
"C:\\Programmi\\C6 Messenger\\plugin\\fsmodule\\C6FileSharing.exe"=
"C:\\Programmi\\eMule\\emule.exe"=
"C:\\Programmi\\C6 Messenger\\c6Messenger.exe"=
"C:\\Documents and Settings\\Angelo\\Dati applicazioni\\SopCast\\adv\\SopAdver.exe"=
"C:\\Programmi\\SopCast\\SopCast.exe"=
"C:\\Programmi\\Skype\\Phone\\Skype.exe"=

R3 3xHybrid;3xHybrid service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2006-01-24 17:45]
R3 Stmatm;ATM/ADSL miniport;C:\WINDOWS\system32\DRIVERS\stmatm.sys [2002-09-25 08:37]
R3 TaurusUsb;ADSL Modem USB Service 1.09a;C:\WINDOWS\system32\DRIVERS\torususb.sys [2003-01-09 16:21]
R3 usbstor;Driver archiviazione di massa USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-09-07 14:00]
R3 X10Hid;X10 Hid Device;C:\WINDOWS\system32\Drivers\x10hid.sys [2005-11-28 11:45]
S1 as6eio;as6eio;C:\WINDOWS\system32\drivers\as6eio.sys []

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-23 16:41:25
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
Ora fine scansione: 2008-04-23 16.42.01
ComboFix-quarantined-files.txt 2008-04-23 14:41:49
ComboFix2.txt 2008-04-23 14:21:39

10 Directory 52,217,860,096 byte disponibili
12 Directory 52,212,436,992 byte disponibili

170 --- E O F --- 2008-04-16 11:19:22

[bdoriano]

Ok, combofix ha lavorato bene.
Scarica avenger e scompattalo in una sua cartella non temporanea e non sul desktop

Avvia AVENGER
Clicca Ok
Inserisci queste righe nel riquadro bianco:

[nikman]

copiando il file ke mi hai scritto su avanger e cliccando EXECUTE mi appare il messaggio: "Error: Invalid script. A valid script must begin with a command directive. Aborting execution! " cosa dovrei fare x rimediare?

[bdoriano]

Che programmi di sicurezza utilizzi (antispyware, antivirus, firewall)?

[nikman]

da quando è sorto il problema ho disinstallato per fare prove di risoluzione del problema quello ke avevo, l'avira e al momento nn c'è nessun antivirus se non ad-aware personal, da sempre installato, e lo apro solo quando devo fare le scansioni.

[bdoriano]

Il testo, lo selezioni copi e incolli o lo digiti ex-novo?

[nikman]

lo copio e incollo come ho fatto per il passo precedente o come i log postati

[bdoriano]

Vabbene... proviamo un'altra strada.

• Avvia FindAWF e seleziona l'opzione 2:
  
  
• Ti si apre un file di testo
  
• Spostati sotto l'ultima riga del file di testo e inserisci le seguenti righe:
  

  Codice:

  "C:\Programmi\Analog Devices\SoundMAX\bak\SMax4PNP.exe" "C:\Programmi\Logitech\iTouch\bak\iTouch.exe" "C:\Programmi\Java\jre1.5.0_05\bin\bak\jusched.exe" "C:\WINDOWS\system32\spool\drivers\w32x86\3\bak\hpztsb05.exe"

  
  
• Chiudi il file di testo e conferma il salvataggio delle modifiche
  
• Al termine dell'operazione ti viene aperto un nuovo log con l'esito finale
  
• Incollalo nella tua prossima risposta

[nikman]

ecco il risultato del log findawf:


Find AWF report by noahdfear ©2006
Version 1.40
Option 2 run successfully



bak folders found
~~~~~~~~~~~

Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 247A-1CD2

Directory di C:\WINDOWS\EHOME\BAK

17/08/2005 23.40 64.512 ehtray.exe
1 File 64.512 byte
2 Directory 52.192.874.496 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 247A-1CD2

Directory di C:\WINDOWS\SYSTEM32\BAK

07/09/2004 14.00 15.360 ctfmon.exe
09/07/2001 12.50 155.648 NeroCheck.exe
2 File 171.008 byte
2 Directory 52.192.874.496 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 247A-1CD2

Directory di C:\PROGRA~1\ANALOG~1\SOUNDMAX\BAK

23/09/2004 14.41 860.160 Smax4.exe
14/10/2004 11.11 1.388.544 SMax4PNP.exe
2 File 2.248.704 byte
2 Directory 52.192.870.400 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 247A-1CD2

Directory di C:\PROGRA~1\LOGITECH\ITOUCH\BAK

01/12/2003 12.38 892.928 iTouch.exe
1 File 892.928 byte
2 Directory 52.192.870.400 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 247A-1CD2

Directory di C:\PROGRA~1\NOKIA\NOKIAS~1\BAK

07/09/2007 15.44 3.100.672 NSLauncher.exe
1 File 3.100.672 byte
2 Directory 52.192.870.400 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 247A-1CD2

Directory di C:\PROGRA~1\ADOBE\READER~1.0\READER\BAK

10/10/2007 20.51 39.792 Reader_sl.exe
1 File 39.792 byte
2 Directory 52.192.870.400 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 247A-1CD2

Directory di C:\PROGRA~1\JAVA\JRE15~1.0_0\BIN\BAK

26/08/2005 19.14 36.975 jusched.exe
1 File 36.975 byte
2 Directory 52.192.870.400 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 247A-1CD2

Directory di C:\PROGRA~1\ADOBE\PHOTOS~1\3.0\APPS\BAK

07/07/2005 18.41 57.344 apdproxy.exe
1 File 57.344 byte
2 Directory 52.192.870.400 byte disponibili
Il volume nell'unit? C non ha etichetta.
Numero di serie del volume: 247A-1CD2

Directory di C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\BAK

21/06/2002 12.28 188.416 hpztsb05.exe
1 File 188.416 byte
2 Directory 52.192.870.400 byte disponibili


Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~

59392 10 Aug 2004 "C:\WINDOWS\$NtUninstallKB900325$\ehtray.exe"
64512 17 Aug 2005 "C:\WINDOWS\ehome\ehtray.exe"
64512 17 Aug 2005 "C:\WINDOWS\ehome\bak\ehtray.exe"
15360 7 Sep 2004 "C:\WINDOWS\system32\ctfmon.exe"
15360 7 Sep 2004 "C:\WINDOWS\system32\bak\ctfmon.exe"
155648 9 Jul 2001 "C:\WINDOWS\system32\NeroCheck.exe"
155648 9 Jul 2001 "C:\WINDOWS\system32\bak\NeroCheck.exe"
860160 23 Sep 2004 "C:\Programmi\Analog Devices\SoundMAX\Smax4.exe"
860160 23 Sep 2004 "C:\Programmi\Analog Devices\SoundMAX\bak\Smax4.exe"
1388544 14 Oct 2004 "C:\Programmi\Analog Devices\SoundMAX\SMax4PNP.exe"
1388544 14 Oct 2004 "C:\Programmi\Analog Devices\SoundMAX\bak\SMax4PNP.exe"
892928 1 Dec 2003 "C:\Programmi\Logitech\iTouch\iTouch.exe"
892928 1 Dec 2003 "C:\Programmi\Logitech\iTouch\bak\iTouch.exe"
3100672 7 Sep 2007 "C:\Programmi\Nokia\Nokia Software Launcher\NSLauncher.exe"
327680 22 Dec 2007 "C:\WINDOWS\Installer\{A8C856AD-63CD-4613-AA29-E6C85607EA06}\NSLauncher2_8C75ED63874746D18905B6C4AF1D7A30.exe"
3100672 7 Sep 2007 "C:\Programmi\Nokia\Nokia Software Launcher\bak\NSLauncher.exe"
39792 10 Oct 2007 "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
39792 10 Oct 2007 "C:\Programmi\Adobe\Reader 8.0\Reader\bak\Reader_sl.exe"
36975 26 Aug 2005 "C:\Programmi\Java\jre1.5.0_05\bin\jusched.exe"
36975 26 Aug 2005 "C:\Programmi\Java\jre1.5.0_05\bin\bak\jusched.exe"
57344 7 Jul 2005 "C:\Programmi\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
57344 7 Jul 2005 "C:\Programmi\Adobe\Photoshop Album Starter Edition\3.0\Apps\bak\apdproxy.exe"
188416 21 Jun 2002 "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe"
188416 21 Jun 2002 "C:\WINDOWS\system32\spool\drivers\w32x86\3\bak\hpztsb05.exe"


end of report

[bdoriano]

Direi che ci siamo.
Un ultimo aggiustamento e poi ti faccio fare altri controlli.

Scarica DelDomains e salvalo sul desktop (clic con destro sul link > salva oggetto)
poi clic con destro sul file e scegli Installa.

Ulteriori controlli:

• Disabilita il ripristino di sistema.
  
• Pulisci i files temporanei con ATF-Cleaner e/o CCleaner
  
• Scarica Norman Malware Cleaner.
  
• Avvia il pc in modalità provvisoria.
  
• Avvia Norman Malware Cleaner e fagli fare la scansione completa.
  Viene generato un log sul desktop chiamandolo NFix_2008-04-gg_hh-mm-ss.log, alla fine della scansione caricalo su FreeFileHosting come indicato qui e posta il link che ti viene assegnato.
  
• Disabilita il tuo antivirus
  
• Collegati a BitDefender (con IE) e fai la scansione completa.
  
• Collegati a Kaspersky on-line scanner e fai la scansione estesa, come indicato qui.
  Salva il risultato della scansione in un file (in formato HTML), carica il file su Freefilehosting e posta qui il link che ti viene assegnato.

[nikman]

il seguente log è del file NFix_2008-04-23_21-17-55.log ti invio x mancanza di tempo un successivo messaggio con il log di kaspersky-on line come ultimo passo di quelli descritti.

[nikman]

eccoti ora come ultimo passo il log della scansione fatta con kaspersy on-line: log5.html . ti kiedo se posso riattivare il ripristino della configurazione di sistema disattivato per fare le precedenti operazioni o magari debba lasciarlo invariato per ulteriori altri controlli. grazie ancora dell'aiuto.