Olimpo Informatico

Blax · Eroe in grazia degli dei Registrato: 02/03/07 19:34 Messaggi: 97

Salve a tutti,
ultimamente il mio pc è un tantino lento, e volevo farvi controllare se nel log di Hijackthis potrebbe esserci qualche spyware o simile che causa questo problema.
Grazie per l'aiuto.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 0.07.16, on 03/03/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\crypserv.exe
C:\Programmi\Java\jre6\bin\jqs.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Programmi\AVG\AVG8\avgcsrvx.exe
C:\Programmi\Java\jre6\bin\jusched.exe
E:\Programmi\iTunes\iTunesHelper.exe
C:\Programmi\D-Link\AirPlus XtremeG\AirPlusCFG.exe
C:\Programmi\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\DNA\btdna.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Documents and Settings\Rocco.HOME\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - D:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programmi\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre6\bin\ssv.dll
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Programmi\AVG\AVG8\avgtoolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmi\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Programmi\AVG\AVG8\avgtoolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "E:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [D-Link AirPlus XtremeG] C:\Programmi\D-Link\AirPlus XtremeG\AirPlusCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Programmi\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [mirc] C:\WINDOWS\WINCRA\mirc.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Programmi\DNA\btdna.exe"
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9f.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Inserisci blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programmi\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: Inserisci &blog in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programmi\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - D:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - e:\Programmi\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - e:\Programmi\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/IT-IT/a-UNO1/GAME_UNO1.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/webplayer/stage6/windows/AutoDLDivXWebPlayerInstaller.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-4b393176ae729f8d.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game10.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F184A6DA-2B5A-4507-8555-C05C5C5C9A9B} (ITCClient Control) - https://82.85.38.60/itcclient.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7E02E4C6-3065-45A2-BE76-DFFB82AFD518}: NameServer = 192.168.1.1
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programmi\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O20 - Winlogon Notify: ldr64 - C:\WINDOWS\SYSTEM32\ldr64.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Programmi\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmi\Java\jre6\bin\jqs.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: NexusDB Server V3 (NXDBServerV3) - Unknown owner - D:\Nx3Beta1\nxServer_3.00_beta1\nxServer.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\SSScsiSV.exe

--
End of file - 10156 bytes

bdoriano · Inviato: 03 Mar 2009 09:15 Oggetto:

Ciao Blax, Ciao

Mi sembra di vedere almeno un paio di ospiti indesiderati
Fai queste operazioni preliminari:

Pulisci i files temporanei con CCleaner
Segui le istruzioni di questo messaggio per rimuovere gli ADS con HiJackThis.
Segui le istruzioni di questo topic per usare MBAM.
scarica e installa la versione Free di SuperAntispyware:
la configuri come da immagini:

esegui una scansione completa del sistema
Fai questa scansione con SystemScan.
Riferisci con un nuovo messaggio in questa discussione dell'esito: se ci sono stati problemi particolari, ecc. ecc. E riporta:
- Carica il log di MBAM su WikiSend (o FreeFileHosting) e posta il Forum Link che ti viene assegnato.
- Carica il log di SuperAntiSpyware su WikiSend (o FreeFileHosting) e posta il Forum Link che ti viene assegnato.
- Carica il log di SystemScan su WikiSend (o FreeFileHosting) e posta il Forum Link che ti viene assegnato.

Blax · Inviato: 03 Mar 2009 14:27 Oggetto:

Allora, ho fatto la pulizia con CCleaner e dopo ho fatto lo scan ADS con Hijackthis, però con quest'ultimo non ho proseguito con l'eliminazione dei file perchè ho notato che ci sono delle foto tra i file nella lista, quindi visto che non voglio cancellarle, e visto che trovo strano che delle foto possano essere infette, volevo chiedere se posso procedere tranquillamente senza eliminazioni indesiderate. Metto qui il log di Hijackthis.

C:\Documents and Settings\Rocco.HOME : zylomtest (0 bytes)
C:\Documents and Settings\Rocco.HOME : zylomtr{000HQ7FF-AD7A-3FG5-BPAV-24QJBB1JIVUT} (16 bytes)
C:\Documents and Settings\Rocco.HOME : zylomtest (0 bytes)
C:\Documents and Settings\Rocco.HOME : zylomtr{000HQ7FF-AD7A-3FG5-BPAV-24QJBB1JIVUT} (16 bytes)
C:\Documents and Settings\Rocco.HOME\Preferiti\Dove posso trovare gli episodi di death note da scaricare - Yahoo! Answers.url : favicon (1150 bytes)
C:\Documents and Settings\Rocco.HOME\Preferiti\english\BBC World Service - World Service.url : favicon (958 bytes)
C:\Documents and Settings\Rocco.HOME\Preferiti\La storia del Tennis.url : favicon (894 bytes)
C:\Documents and Settings\Rocco.HOME\Preferiti\nDASH - NDS & GBA ROMs.url : favicon (1406 bytes)
C:\Documents and Settings\Rocco.HOME\Preferiti\Nonciclopedia.url : favicon (1150 bytes)
C:\Documents and Settings\Rocco.HOME\Preferiti\TinyPic - Condividi l'esperienza!?.url : favicon (1406 bytes)
C:\Documents and Settings\Rocco.HOME\Preferiti\WoW\Cronache da World of Warcraft Daily quest quali e dove, GUIDA.url : favicon (3638 bytes)
C:\Documents and Settings\Rocco.HOME\Preferiti\WoW\EgForum.it - Il portale del gaming online - Powered by vBulletin.url : favicon (10134 bytes)
C:\Documents and Settings\Rocco.HOME\Preferiti\WoW\Holy Alliance Index.url : favicon (894 bytes)
C:\Documents and Settings\Rocco.HOME\Preferiti\WoW\ISTRUZIONI per collegarsi al server PVP BloOdyWarS - EgForum.it - Il portale del gaming online.url : favicon (10134 bytes)
C:\Documents and Settings\Rocco.HOME\Preferiti\WoW\Stevenson, Robert Louis - Lo strano caso del dr. Jekyll e mr. Hyde - Recensioni libri.url : favicon (1150 bytes)
C:\Documents and Settings\Rocco.HOME\Preferiti\WoW\World of Warcraft Addons World of Warcraft @ Curse.com.url : favicon (1150 bytes)
C:\Documents and Settings\Rocco.HOME\Preferiti\WoW\WoWWiki.it Italian World Of Warcraft Resource Download Patch enGB.url : favicon (822 bytes)
C:\Documents and Settings\Rocco.HOME\Preferiti\wowhead Your skill in WoW has increased to 375..url : favicon (2550 bytes)
E:\Multimedia\Foto\PICT0002.JPG : Q30lsldxJoudresxAaaqpcawXc (7072 bytes)
E:\Multimedia\Foto\PICT0003.JPG : Q30lsldxJoudresxAaaqpcawXc (7636 bytes)
E:\Multimedia\Foto\PICT0004.JPG : Q30lsldxJoudresxAaaqpcawXc (8724 bytes)
E:\Multimedia\Foto\PICT0005.JPG : Q30lsldxJoudresxAaaqpcawXc (8616 bytes)
E:\Multimedia\Foto\PICT0006.JPG : Q30lsldxJoudresxAaaqpcawXc (8072 bytes)
E:\Multimedia\Foto\PICT0007.JPG : Q30lsldxJoudresxAaaqpcawXc (9408 bytes)
E:\Multimedia\Foto\PICT0008.JPG : Q30lsldxJoudresxAaaqpcawXc (9520 bytes)
E:\Multimedia\Foto\PICT0010.JPG : Q30lsldxJoudresxAaaqpcawXc (8868 bytes)
E:\Multimedia\Foto\PICT0142.JPG : Q30lsldxJoudresxAaaqpcawXc (9792 bytes)
E:\Multimedia\Foto\PICT0142mod2.JPG : Q30lsldxJoudresxAaaqpcawXc (9828 bytes)
E:\Multimedia\Foto\PICT0143.JPG : Q30lsldxJoudresxAaaqpcawXc (10468 bytes)
E:\Multimedia\Foto\PICT0432.JPG : Q30lsldxJoudresxAaaqpcawXc (7584 bytes)
E:\Multimedia\Foto\PICT0433.JPG : Q30lsldxJoudresxAaaqpcawXc (7076 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\07-08-08_1638.jpg : Q30lsldxJoudresxAaaqpcawXc (6240 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\07-08-08_1639.jpg : Q30lsldxJoudresxAaaqpcawXc (5924 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\07-08-08_1642.jpg : Q30lsldxJoudresxAaaqpcawXc (7316 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\07-08-08_1644.jpg : Q30lsldxJoudresxAaaqpcawXc (6912 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\07-08-08_1653.jpg : Q30lsldxJoudresxAaaqpcawXc (6916 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\07-08-08_1658.jpg : Q30lsldxJoudresxAaaqpcawXc (7104 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\07-08-08_1659.jpg : Q30lsldxJoudresxAaaqpcawXc (6512 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\07-08-08_1704.jpg : Q30lsldxJoudresxAaaqpcawXc (6460 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\07-08-08_1706.jpg : Q30lsldxJoudresxAaaqpcawXc (4092 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\07-08-08_1708.jpg : Q30lsldxJoudresxAaaqpcawXc (4796 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\07-08-08_1840.jpg : Q30lsldxJoudresxAaaqpcawXc (5480 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\07-08-08_1841.jpg : Q30lsldxJoudresxAaaqpcawXc (5068 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\07-08-08_1845.jpg : Q30lsldxJoudresxAaaqpcawXc (6144 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\09-08-08_1539.jpg : Q30lsldxJoudresxAaaqpcawXc (5080 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\09-08-08_1540.jpg : Q30lsldxJoudresxAaaqpcawXc (5348 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\09-08-08_1542.jpg : Q30lsldxJoudresxAaaqpcawXc (4944 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\PICT0001.JPG : Q30lsldxJoudresxAaaqpcawXc (9816 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\PICT0002.JPG : Q30lsldxJoudresxAaaqpcawXc (8936 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\PICT0003.JPG : Q30lsldxJoudresxAaaqpcawXc (9772 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\PICT0007.JPG : Q30lsldxJoudresxAaaqpcawXc (9796 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\PICT0009.JPG : Q30lsldxJoudresxAaaqpcawXc (9088 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\PICT0012.JPG : Q30lsldxJoudresxAaaqpcawXc (7000 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\PICT0068.JPG : Q30lsldxJoudresxAaaqpcawXc (6448 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\PICT0069.JPG : Q30lsldxJoudresxAaaqpcawXc (7260 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\PICT0070.JPG : Q30lsldxJoudresxAaaqpcawXc (8204 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\PICT0071.JPG : Q30lsldxJoudresxAaaqpcawXc (7216 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\PICT0072.JPG : Q30lsldxJoudresxAaaqpcawXc (6796 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\PICT0073.JPG : Q30lsldxJoudresxAaaqpcawXc (4752 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\PICT0074.JPG : Q30lsldxJoudresxAaaqpcawXc (3640 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\PICT0075.JPG : Q30lsldxJoudresxAaaqpcawXc (5100 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\PICT0076.JPG : Q30lsldxJoudresxAaaqpcawXc (3360 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\PICT0077.JPG : Q30lsldxJoudresxAaaqpcawXc (4640 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\PICT0078.JPG : Q30lsldxJoudresxAaaqpcawXc (5736 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\PICT0079.JPG : Q30lsldxJoudresxAaaqpcawXc (4832 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\PICT0080.JPG : Q30lsldxJoudresxAaaqpcawXc (3972 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\PICT0083.JPG : Q30lsldxJoudresxAaaqpcawXc (5168 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\PICT0084.JPG : Q30lsldxJoudresxAaaqpcawXc (8360 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\PICT0085.JPG : Q30lsldxJoudresxAaaqpcawXc (7872 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\PICT0086.JPG : Q30lsldxJoudresxAaaqpcawXc (5200 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\PICT0087.JPG : Q30lsldxJoudresxAaaqpcawXc (4936 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\PICT0088.JPG : Q30lsldxJoudresxAaaqpcawXc (5112 bytes)
E:\Multimedia\Foto\Rimini agosto 2008\PICT0089.JPG : Q30lsldxJoudresxAaaqpcawXc (7848 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\Foto\PICT0002.JPG : Q30lsldxJoudresxAaaqpcawXc (7072 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\Foto\PICT0003.JPG : Q30lsldxJoudresxAaaqpcawXc (7636 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\Foto\PICT0004.JPG : Q30lsldxJoudresxAaaqpcawXc (8724 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\Foto\PICT0005.JPG : Q30lsldxJoudresxAaaqpcawXc (8616 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\Foto\PICT0006.JPG : Q30lsldxJoudresxAaaqpcawXc (8072 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\Foto\PICT0007.JPG : Q30lsldxJoudresxAaaqpcawXc (9408 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\Foto\PICT0008.JPG : Q30lsldxJoudresxAaaqpcawXc (9520 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\Foto\PICT0010.JPG : Q30lsldxJoudresxAaaqpcawXc (8868 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\001.jpg : Q30lsldxJoudresxAaaqpcawXc (5128 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\002.jpg : Q30lsldxJoudresxAaaqpcawXc (5280 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\017.jpg : Q30lsldxJoudresxAaaqpcawXc (5068 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\9.JPG : Q30lsldxJoudresxAaaqpcawXc (7444 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\aglai 1209.jpg : Q30lsldxJoudresxAaaqpcawXc (7436 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\aglai 1210.jpg : Q30lsldxJoudresxAaaqpcawXc (7460 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\ana.JPG : Q30lsldxJoudresxAaaqpcawXc (8132 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\APt6MMZnvGsDRNM2KbekVA.jpg : Q30lsldxJoudresxAaaqpcawXc (6460 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\CAO1ENOP.jpg : Q30lsldxJoudresxAaaqpcawXc (5664 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\Copy (2) of Picture 36.jpg : Q30lsldxJoudresxAaaqpcawXc (3884 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\Copy of DSC00011.JPG : Q30lsldxJoudresxAaaqpcawXc (5620 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\Copy of IMG_0014.JPG : Q30lsldxJoudresxAaaqpcawXc (5848 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\Copy of Picture 91.jpg : Q30lsldxJoudresxAaaqpcawXc (4700 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\DSC00009.JPG : Q30lsldxJoudresxAaaqpcawXc (5384 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\DSC00010.JPG : Q30lsldxJoudresxAaaqpcawXc (6128 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\DSC02175.JPG : Q30lsldxJoudresxAaaqpcawXc (7776 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\DSC02177.JPG : Q30lsldxJoudresxAaaqpcawXc (6968 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\DSCF2724.JPG : Q30lsldxJoudresxAaaqpcawXc (6312 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\DSC_0260.JPG : Q30lsldxJoudresxAaaqpcawXc (5076 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\dXqBBLapaHi1RXIs-8uUGw.jpg : Q30lsldxJoudresxAaaqpcawXc (7652 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\Ecs P4IBASD.jpg : Q30lsldxJoudresxAaaqpcawXc (10652 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\GN0120~No-War-Posters.jpg : Q30lsldxJoudresxAaaqpcawXc (6732 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\img.jpg : Q30lsldxJoudresxAaaqpcawXc (9092 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\me.JPG : Q30lsldxJoudresxAaaqpcawXc (6644 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\oeATUcJT6deYXijC-4TIyw.jpg : Q30lsldxJoudresxAaaqpcawXc (9376 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\oFawi1dfK4YH71iX1ws5gQ.jpg : Q30lsldxJoudresxAaaqpcawXc (5956 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\P1010352.JPG : Q30lsldxJoudresxAaaqpcawXc (6144 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\P1010372.JPG : Q30lsldxJoudresxAaaqpcawXc (6404 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\P1010376.JPG : Q30lsldxJoudresxAaaqpcawXc (6752 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\P1010382.JPG : Q30lsldxJoudresxAaaqpcawXc (5156 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\PICT0142mod2.JPG : Q30lsldxJoudresxAaaqpcawXc (9828 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\Picture 1177.jpg : Q30lsldxJoudresxAaaqpcawXc (4684 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\Picture 128.jpg : Q30lsldxJoudresxAaaqpcawXc (5348 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\Picture 31.jpg : Q30lsldxJoudresxAaaqpcawXc (5936 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\Picture 44.jpg : Q30lsldxJoudresxAaaqpcawXc (4140 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\Picture 45.jpg : Q30lsldxJoudresxAaaqpcawXc (4208 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\Picture 62.jpg : Q30lsldxJoudresxAaaqpcawXc (5472 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\qZfIoqbgI-p9oPZ0o4GBmw.jpg : Q30lsldxJoudresxAaaqpcawXc (7408 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\Scan0007.JPG : Q30lsldxJoudresxAaaqpcawXc (7620 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\Scan0009.JPG : Q30lsldxJoudresxAaaqpcawXc (9348 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\Scan0010.JPG : Q30lsldxJoudresxAaaqpcawXc (7716 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\t1.jpg : Q30lsldxJoudresxAaaqpcawXc (8412 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\V5RW0DExQ4msSbkMfkPIaQ.jpg : Q30lsldxJoudresxAaaqpcawXc (6636 bytes)
E:\Multimedia\Musica\Roberto\HDD portatile\img\vika.JPG : Q30lsldxJoudresxAaaqpcawXc (6464 bytes)

bdoriano · Inviato: 03 Mar 2009 22:12 Oggetto:

La procedura di eliminazione degli Alternate Data Stream (flussi di dati alternativi) non elimina i files evidenziati, ma i flussi associati. In pratica, possono essere creati dei files "nascosti" agganciandoli a normalissimi files (questo solo in caso di utilizzo di NTFS).
La procedura che ti ho indicato serve a eliminare questo genere di files "nascosti".

Nella fattispecie, i files immagini (.JPG) che sono stati segnalati dalla procedura, sono stati creati da una fotocamera Nikon (o Canon?) Q30. Razz

Per farti un esempio:
E:\Multimedia\Foto\PICT0002.JPG : Q30lsldxJoudresxAaaqpcawXc (7072 bytes)
Viene cancellata la parte in rosso.

Procedi con il resto.

Blax · Inviato: 10 Mar 2009 14:17 Oggetto:

Ok, ho fatto tutte le operazioni che mi hai detto. Ecco i log.

Malware Byte's
mbam-log-2009-03-04 (13-51-19).txt

Super anti-spyware
SUPERAntiSpyware Scan Log - 03-04-2009 - 22-19-59.log

SuspectFile
10_03_2009_12_38_report.zip