non riesco a eliminare dialer - Aiutatemi per favore

[greynold]

Per favore mi occorre il vostro aiuto....
da giorni ho preso un dialer che nn riesco a eliminare in nessun modo e che mi fa cadere il mio collegamento adsl.
in connessioni remote esce una fantomatica connessione chiamata INTERNET che mi fa partire il modem interno 56k ...
ho gia' provato a fare una scansione con il mio antivirus (avast), con spybot, adaware anche in modalita' provvisoria, ma nessuno vede niente... ho disattivato da gestione periferiche il modem 56k, ma niente da fare la connessione cade uguale e il dialer compare sempre..
sono all'ultima spiaggia senno mi tocca la formattazione , per favore AIUTATEMI !!!!!
Vi mando il mio log fatto con hijack

ogfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 12.01.54, on 15/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\Keyboard\Ikeymain.exe
C:\Programmi\Lexmark X1100 Series\lxbkbmgr.exe
C:\Programmi\TomTom HOME\TomTomHOME.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programmi\Lexmark X1100 Series\lxbkbmon.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Programmi\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\Programmi\Microsoft IntelliType Pro\type32.exe
C:\Programmi\Microsoft IntelliPoint\point32.exe
C:\DOCUME~1\FRANCE~1\IMPOST~1\Temp\bak\bak\epdhfa.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
c:\windows\system32\svchost.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\File comuni\PCSuite\Services\ServiceLayer.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\Francesco\Desktop\HiJackThis_v2.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://arianna.libero.it
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.libero.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.libero.it
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fornito da Libero
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programmi\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [2kadiras] 2kadiras.exe
O4 - HKLM\..\Run: [iKeyWorks] C:\PROGRA~1\Keyboard\Ikeymain.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Programmi\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Programmi\File comuni\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Programmi\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Programmi\TomTom HOME\TomTomHOME.exe" -s
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [CTSysVol] C:\Programmi\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [type32] "C:\Programmi\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Programmi\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [epdhfa.exe] C:\DOCUME~1\FRANCE~1\IMPOST~1\Temp\bak\bak\epdhfa.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Programmi\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Aggiungi all'elenco di stampa Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Anteprima Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Stampa ad alta velocità Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Stampa Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.libero.it
O15 - Trusted Zone: *.whataboutarabit.com
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Programmi\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan ... asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0E9101B1-0EB3-4335-A2BB-0E89BEC0878E}: NameServer = 193.70.152.15 193.70.152.25
O17 - HKLM\System\CS1\Services\Tcpip\..\{0E9101B1-0EB3-4335-A2BB-0E89BEC0878E}: NameServer = 193.70.152.15 193.70.152.25
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: ServiceLayer - Nokia. - C:\Programmi\File comuni\PCSuite\Services\ServiceLayer.exe

--
End of file - 7521 bytes

[Luke57]

Ciao, scarica findawf e vediamo il suo log

http://noahdfear.geekstogo.com/FindAWF.exe

dopo averlo avviato, scegli l'opzione 1 per avviare lo scan.
Posta il report generato dalla scansione.

[greynold]

Ciao, scarica findawf e vediamo il suo log

http://noahdfear.geekstogo.com/FindAWF.exe

dopo averlo avviato, scegli l'opzione 1 per avviare lo scan.
Posta il report generato dalla scansione.

ma dura parecchio la scansione ???
sta scritto da dieci minuti searching for duplicate file
please wait

[greynold]

Ciao, scarica findawf e vediamo il suo log

http://noahdfear.geekstogo.com/FindAWF.exe

dopo averlo avviato, scegli l'opzione 1 per avviare lo scan.
Posta il report generato dalla scansione.

ho fatto la scansione con questo programma che dicevi tu,
i risultati sono questi ma riguardano quasi tutti yahoo messenger....
quelli inerenti gli archivi messaggi li ho cancellati perche' credo siano irrilevanti
cmq questo e' il resto del risultato

14/08/2007 22.53 24.080 epdhfa.exe
1 File 24.080 byte
3 Directory 9.906.421.760 byte disponibili
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: FC76-8252

Directory di C:\DOCUME~1\FRANCE~1\IMPOST~1\TEMP\BAK\BAK

05/07/2006 12.56 63.488 epdhfa.exe
1 File 63.488 byte
2 Directory 9.906.421.760 byte disponibili


Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~

1281 14 Aug 2007 "C:\Programmi\Yahoo!\Messenger\cache\audiblemenu.xml"
1281 14 Aug 2007 "C:\Programmi\Yahoo!\Messenger\cache(2)\audiblemenu.xml"
1281 28 Mar 2007 "C:\Programmi\Yahoo!\Messenger\bak\cache\audiblemenu.xml"
752 14 Aug 2007 "C:\Programmi\Yahoo!\Messenger\cache\audiblerevoked.xml"
752 14 Aug 2007 "C:\Programmi\Yahoo!\Messenger\cache(2)\audiblerevoked.xml"
752 28 Mar 2007 "C:\Programmi\Yahoo!\Messenger\bak\cache\audiblerevoked.xml"
16333 14 Aug 2007 "C:\Programmi\Yahoo!\Messenger\cache\countries.xml"
16333 14 Aug 2007 "C:\Programmi\Yahoo!\Messenger\cache(2)\countries.xml"
16333 28 Mar 2007 "C:\Programmi\Yahoo!\Messenger\bak\cache\countries.xml"
7591 17 Jul 2004 "C:\Programmi\Movie Maker\shared\filters.xml"
4074 14 Aug 2007 "C:\Programmi\Yahoo!\Messenger\cache\filters.xml"
4074 14 Aug 2007 "C:\Programmi\Yahoo!\Messenger\cache(2)\filters.xml"
4074 28 Mar 2007 "C:\Programmi\Yahoo!\Messenger\bak\cache\filters.xml"
3520 14 Aug 2007 "C:\Programmi\Yahoo!\Messenger\cache\games.xml"
3520 14 Aug 2007 "C:\Programmi\Yahoo!\Messenger\cache(2)\games.xml"
3520 28 Mar 2007 "C:\Programmi\Yahoo!\Messenger\bak\cache\games.xml"
1460 14 Aug 2007 "C:\Programmi\Yahoo!\Messenger\cache\imvironments.xml"
1460 14 Aug 2007 "C:\Programmi\Yahoo!\Messenger\cache(2)\imvironments.xml"
1650 28 Mar 2007 "C:\Programmi\Yahoo!\Messenger\bak\cache\imvironments.xml"
330 14 Aug 2007 "C:\Programmi\Yahoo!\Messenger\cache(2)\Mr6_zM4UgF_efszy44AxpQ--.Display.dat"
906 29 Mar 2007 "C:\Programmi\Yahoo!\Messenger\bak\cache\Mr6_zM4UgF_efszy44AxpQ--.Display.dat"
872 14 Aug 2007 "C:\Programmi\Yahoo!\Messenger\cache\Mr6_zM4UgF_efszy44AxpQ--.chatCategories.xml"
4052 14 Aug 2007 "C:\Programmi\Yahoo!\Messenger\cache(2)\Mr6_zM4UgF_efszy44AxpQ--.ab.xml"
3584 28 Mar 2007 "C:\Programmi\Yahoo!\Messenger\bak\cache\Mr6_zM4UgF_efszy44AxpQ--.ab.xml"
41 14 Aug 2007 "C:\Programmi\Yahoo!\Messenger\cache\Mr6_zM4UgF_efszy44AxpQ--\Mr6_zM4UgF_efszy44AxpQ--_CallLogData.xml"
4052 14 Aug 2007 "C:\Programmi\Yahoo!\Messenger\cache\Mr6_zM4UgF_efszy44AxpQ--.ab.xml"
872 14 Aug 2007 "C:\Programmi\Yahoo!\Messenger\cache(2)\Mr6_zM4UgF_efszy44AxpQ--.chatCategories.xml"
872 28 Mar 2007 "C:\Programmi\Yahoo!\Messenger\bak\cache\Mr6_zM4UgF_efszy44AxpQ--.chatCategories.xml"
565 14 Aug 2007 "C:\Programmi\Yahoo!\Messenger\cache\sms.xml"
565 14 Aug 2007 "C:\Programmi\Yahoo!\Messenger\cache(2)\sms.xml"
565 28 Mar 2007 "C:\Programmi\Yahoo!\Messenger\bak\cache\sms.xml"
951 14 Aug 2007 "C:\Programmi\Yahoo!\Messenger\cache\system.xml"
951 14 Aug 2007 "C:\Programmi\Yahoo!\Messenger\cache(2)\system.xml"
951 28 Mar 2007 "C:\Programmi\Yahoo!\Messenger\bak\cache\system.xml"
16470 14 Aug 2007 "C:\Programmi\Yahoo!\Messenger\cache\Audibles\audibles.xml"
16470 14 Aug 2007 "C:\Programmi\Yahoo!\Messenger\cache(2)\Audibles(2)\audibles.xml"
16470 28 Mar 2007 "C:\Programmi\Yahoo!\Messenger\bak\cache\Audibles\audibles.xml"
59528 29 Mar 2007 "C:\Programmi\Yahoo!\Messenger\bak\cache\Avatars\1N8eOXLaxAAEBOQE_UIiXcVgA.full.swf"
41324 29 Mar 2007 "C:\Programmi\Yahoo!\Messenger\bak\cache\Avatars\1rm1MZLrjAAEDWKGbfKA2GAoB.full.swf"
20355 29 Mar 2007 "C:\Programmi\Yahoo!\Messenger\bak\cache\Icon\DC546A6"
163 14 Aug 2007 "C:\Programmi\Yahoo!\Messenger\Games\icons\bg_1.gif"
163 14 Aug 2007 "C:\Programmi\Yahoo!\Messenger\Games(2)\icons(2)\bg_1.gif"
163 28 Mar 2007 "C:\Programmi\Yahoo!\Messenger\bak\Games\icons\bg_1.gif"
225 14 Aug 2007 "C:\Programmi\Yahoo!\Messenger\Games\icons\ch_1.gif"
225 14 Aug 2007 "C:\Programmi\Yahoo!\Messenger\Games(2)\icons(2)\ch_1.gif"
225 28 Mar 2007 "C:\Programmi\Yahoo!\Messenger\bak\Games\icons\ch_1.gif"
180 14 Aug 2007 "C:\Programmi\Yahoo!\Messenger\Games\icons\ck_1.gif"
180 14 Aug 2007 "C:\Programmi\Yahoo!\Messenger\Games(2)\icons(2)\ck_1.gif"
180 28 Mar 2007 "C:\Programmi\Yahoo!\Messenger\bak\Games\icons\ck_1.gif"
288 14 Aug 2007 "C:\Programmi\Yahoo!\Messenger\Games\icons\do_1.gif"
288 14 Aug 2007 "C:\Programmi\Yahoo!\Messenger\Games(2)\icons(2)\do_1.gif"
288 28 Mar 2007 "C:\Programmi\Yahoo!\Messenger\bak\Games\icons\do_1.gif"
226 14 Aug 2007 "C:\Programmi\Yahoo!\Messenger\Games\icons\lt_1.gif"
226 14 Aug 2007 "C:\Programmi\Yahoo!\Messenger\Games(2)\icons(2)\lt_1.gif"
226 28 Mar 2007 "C:\Programmi\Yahoo!\Messenger\bak\Games\icons\lt_1.gif"
367 14 Aug 2007 "C:\Programmi\Yahoo!\Messenger\Games\icons\pl_1.gif"
367 14 Aug 2007 "C:\Programmi\Yahoo!\Messenger\Games(2)\icons(2)\pl_1.gif"
367 28 Mar 2007 "C:\Programmi\Yahoo!\Messenger\bak\Games\icons\pl_1.gif"
168 29 Jul 2007 "C:\Programmi\Yahoo!\Messenger\Profiles\greynoldit\iconindex.dat"
176 29 Mar 2007 "C:\Programmi\Yahoo!\Messenger\bak\Profiles\greynoldit\iconindex.dat"

24080 14 Aug 2007 "C:\Documents and Settings\Francesco\Impostazioni locali\Temp\bak\epdhfa.exe"
63488 5 Jul 2006 "C:\Documents and Settings\Francesco\Impostazioni locali\Temp\bak\bak\epdhfa.exe"
24080 14 Aug 2007 "C:\Documents and Settings\Francesco\Impostazioni locali\Temp\bak\epdhfa.exe"
63488 5 Jul 2006 "C:\Documents and Settings\Francesco\Impostazioni locali\Temp\bak\bak\epdhfa.exe"
24080 14 Aug 2007 "C:\Documents and Settings\Francesco\Impostazioni locali\Temp\bak\epdhfa.exe"
63488 5 Jul 2006 "C:\Documents and Settings\Francesco\Impostazioni locali\Temp\bak\bak\epdhfa.exe"


end of report