Da un pò di tempo chi compare,subito dopo l'avvio di windows,una finestra con su scritto
winlogon.exe-Errore di applicazione
L'istruzione a "0x10001300"ha fatto riferimento alla memoria a "0x67706a28".La memoria non poteva essere "written".
Fare click su OK per terminare l'applicazione
Fare click su Annulla per eseguire il debug dell'applicazione
Se clicco su ok\annulla e per chiudere la finestra mi si riavvia il pc e la finestra ritorna...
Ho provato a cercare su Internete a quanto pare può dipendere o da un worm o da un file danneggiato...ma non ci capisco lo stesso!!!
Ma la cosa strana è che prima che mi compare la suddetta finestra il PC va LENTISSIMO,poi l'avast non funziona proprio più,non riesco neanche a disinstallarloper non parlare dell'AVg che non riesco ad installarlo...
insomma quella finestra ha rovinato la mia vita!!!!Chi è che ne capisce qualcosa può aiutarmi?
Con l'a-squared HijackFree ho analizzato il sistema ed ho postato qua sotto i risultati:
Version info: Result ToDo
Your used version of a-squared HiJackFree: 1.20
The current version of a-squared HiJackFree: 1.20
Your used operating system version: Windows XP Service Pack 2
The current version of your operating system: Windows XP Service Pack 2
Registry Autoruns: Result ToDo
Name: NeroFilterCheck
Path: C:\WINDOWS\system32\NeroCheck.exe
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Good: 2 - Bad: 2
View Details Requires Attention!
Compare details with your local values
and/or search at Google
Name: SpeedTouch USB Diagnostics
Path: C:\Programmi\Thomson\SpeedTouch USB\Dragdiag.exe /icon
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Good: 1 - Bad: 0
View Details
Name: BluetoothAuthenticationAgent
Path: rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Good: 1 - Bad: 15
View Details Requires Attention!
Compare details with your local values
and/or search at Google
Name: avast!
Path: C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Good: 2 - Bad: 0
View Details
Name: AT-Watch
Path:
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Good: 1 - Bad: 0
View Details
Name: UserFaultCheck
Path: C:\WINDOWS\system32\system32\dumprep 0 -u
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Good: 3 - Bad: 0
View Details
Name: MSMSGS
Path: C:\Programmi\Messenger\msmsgs.exe /background
Location: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Good: 1 - Bad: 11
View Details Requires Attention!
Compare details with your local values
and/or search at Google
Name: Babylon Translator
Path: C:\Programmi\Babylon\babylon.exe
Location: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Good: 2 - Bad: 0
View Details
Name: a-squared
Path: C:\Programmi\a-squared\a2guard.exe
Location: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Good: 2 - Bad: 0
View Details
Name: Uniblue Registry Booster
Path: C:\Programmi\Uniblue\Registry Booster\RegistryBooster.exe /S
Location: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Good: 0 - Bad: 0
Unknown Item
Search at Google
Tricky and Other Autoruns: Result ToDo
Name: load
Path:
Location: win.ini
Not checked Unknown Item
Search at Google
Name: run
Path:
Location: win.ini
Not checked Unknown Item
Search at Google
Name: shell
Path: Explorer.exe
Location: win.ini
Not checked Unknown Item
Search at Google
Name: scrnsave.exe
Path:
Location: win.ini
Not checked Unknown Item
Search at Google
Name: nul
Path: C:\Programmi\E-nrgyPlus\E-nrgyPlus.exe
Location: win.ini
Not checked Unknown Item
Search at Google
Name: EarthView
Path:
Location: C:\Documents and Settings\Cristina\Menu Avvio\Programmi\Esecuzione automatica\
Not checked Unknown Item
Search at Google
Name: palmOne Registration
Path:
Location: C:\Documents and Settings\Cristina\Menu Avvio\Programmi\Esecuzione automatica\
Not checked Unknown Item
Search at Google
Name: Avvio veloce di Adobe Reader
Path:
Location: C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Not checked Unknown Item
Search at Google
Name: BTTray
Path:
Location: C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Not checked Unknown Item
Search at Google
Name: XoftSpy
Path:
Location: C:\WINDOWS\tasks\
Not checked Unknown Item
Search at Google
Name: CTFMON.EXE
Path: C:\WINDOWS\system32\CTFMON.EXE
Location: HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Run\
Not checked Unknown Item
Search at Google
Name: Shell
Path: Explorer.exe
Location: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\
Not checked Unknown Item
Search at Google
Name: {22d6f312-b0f6-11d0-94ab-0080c74c7e95}
Path: C:\WINDOWS\inf\unregmp2.exe /ShowWMP
Location: HKLM\Software\Microsoft\Active Setup\Installed Components\
Not checked Unknown Item
Search at Google
Name: {26923b43-4d38-484f-9b9e-de460746276c}
Path: C:\WINDOWS\system32\system32\shmgrate.exe OCInstallUserConfigIE
Location: HKLM\Software\Microsoft\Active Setup\Installed Components\
Not checked Unknown Item
Search at Google
Name: {60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS
Path: RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
Location: HKLM\Software\Microsoft\Active Setup\Installed Components\
Not checked Unknown Item
Search at Google
Name: {881dd1c5-3dcf-431b-b061-f3f88e8be88a}
Path: C:\WINDOWS\system32\system32\shmgrate.exe OCInstallUserConfigOE
Location: HKLM\Software\Microsoft\Active Setup\Installed Components\
Not checked Unknown Item
Search at Google
Name: {2C7339CF-2B09-4501-B3F3-F3508C9228ED}
Path: C:\WINDOWS\system32\system32\regsvr32.exe /s /n /i:/UserInstall C:\WINDOWS\system32\system32\themeui.dll
Location: HKLM\Software\Microsoft\Active Setup\Installed Components\
Not checked Unknown Item
Search at Google
Name: {44BBA840-CC51-11CF-AAFA-00AA00B6015C}
Path: C:\Programmi\Outlook Express\setup50.exe /APP:OE /CALLER:WINNT /user /install
Location: HKLM\Software\Microsoft\Active Setup\Installed Components\
Not checked Unknown Item
Search at Google
Name: {44BBA842-CC51-11CF-AAFA-00AA00B6015B}
Path: rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
Location: HKLM\Software\Microsoft\Active Setup\Installed Components\
Not checked Unknown Item
Search at Google
Name: {5945c046-1e7d-11d1-bc44-00c04fd912be}
Path: rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
Location: HKLM\Software\Microsoft\Active Setup\Installed Components\
Not checked Unknown Item
Search at Google
Name: {6BF52A52-394A-11d3-B153-00C04F79FAA6}
Path: rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub
Location: HKLM\Software\Microsoft\Active Setup\Installed Components\
Not checked Unknown Item
Search at Google
Name: {7790769C-0471-11d2-AF11-00C04FA35D02}
Path: C:\Programmi\Outlook Express\setup50.exe /APP:WAB /CALLER:WINNT /user /install
Location: HKLM\Software\Microsoft\Active Setup\Installed Components\
Not checked Unknown Item
Search at Google
Name: {89820200-ECBD-11cf-8B85-00AA005B4340}
Path: regsvr32.exe /s /n /i:U shell32.dll
Location: HKLM\Software\Microsoft\Active Setup\Installed Components\
Not checked Unknown Item
Search at Google
Name: {89820200-ECBD-11cf-8B85-00AA005B4383}
Path: C:\WINDOWS\system32\system32\ie4uinit.exe
Location: HKLM\Software\Microsoft\Active Setup\Installed Components\
Not checked Unknown Item
Search at Google
Name: File di script VBScript
Path: C:\WINDOWS\system32\System32\WScript.exe %1 %*
Location: HKEY_CLASSES_ROOT\vbsfile\shell\open\command\
Not checked Unknown Item
Search at Google
Name: File di script codificato in VBScript
Path: C:\WINDOWS\system32\System32\WScript.exe %1 %*
Location: HKEY_CLASSES_ROOT\vbefile\shell\open\command\
Not checked Unknown Item
Search at Google
Name: File di script JScript
Path: C:\WINDOWS\system32\System32\WScript.exe %1 %*
Location: HKEY_CLASSES_ROOT\jsfile\shell\open\command\
Not checked Unknown Item
Search at Google
Name: File di script codificato in JScript
Path: C:\WINDOWS\system32\System32\WScript.exe %1 %*
Location: HKEY_CLASSES_ROOT\jsefile\shell\open\command\
Not checked Unknown Item
Search at Google
Name: File di impostazioni di Windows Script Host
Path: C:\WINDOWS\system32\System32\WScript.exe %1 %*
Location: HKEY_CLASSES_ROOT\wshfile\shell\open\command\
Not checked Unknown Item
Search at Google
Name: File di script Windows
Path: C:\WINDOWS\system32\System32\WScript.exe %1 %*
Location: HKEY_CLASSES_ROOT\wsffile\shell\open\command\
Not checked Unknown Item
Search at Google
Name: Applicazione
Path: %1 %*
Location: HKEY_CLASSES_ROOT\exefile\shell\open\command\
Not checked Unknown Item
Search at Google
Name: Applicazione per MS-DOS
Path: %1 %*
Location: HKEY_CLASSES_ROOT\comfile\shell\open\command\
Not checked Unknown Item
Search at Google
Name: File batch MS-DOS
Path: %1 %*
Location: HKEY_CLASSES_ROOT\batfile\shell\open\command\
Not checked Unknown Item
Search at Google
Name: Screen saver
Path: %1 /S
Location: HKEY_CLASSES_ROOT\scrfile\shell\open\command\
Not checked Unknown Item
Search at Google
Name: Collegamento ad un programma per MS-DOS
Path: %1 %*
Location: HKEY_CLASSES_ROOT\piffile\shell\open\command\
Not checked Unknown Item
Search at Google
Name: sockspy.dll
Path: sockspy.dll
Location: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\
Not checked Unknown Item
Search at Google
Name: sockspy.dll
Path: sockspy.dll
Location: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\
Not checked Unknown Item
Search at Google
Name: BootExecute
Path: autocheck autochk *
Location: HKLM\System\CurrentControlSet\Control\Session Manager\
Not checked Unknown Item
Search at Google
Name: PostBootReminder
Path: C:\WINDOWS\system32\system32\SHELL32.dll
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\
Not checked Unknown Item
Search at Google
Name: CDBurn
Path: C:\WINDOWS\system32\system32\SHELL32.dll
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\
Not checked Unknown Item
Search at Google
Name: WebCheck
Path: C:\WINDOWS\system32\system32\webcheck.dll
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\
Not checked Unknown Item
Search at Google
Name: SysTray
Path: C:\WINDOWS\system32\stobject.dll
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\
Not checked Unknown Item
Search at Google
Layered Service Providers (LSP): Result ToDo
Name: mswsock.dll
Path: C:\WINDOWS\system32\system32\
Location: HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\
Good: 1 - Bad: 0
View Details
Name: rsvpsp.dll
Path: C:\WINDOWS\system32\system32\
Location: HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\
Good: 1 - Bad: 0
View Details
Explorer And Browser Addons: Result ToDo
Name: AcroIEHlprObj Class
Path: C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
Location: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
ClsID: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
Good: 1 - Bad: 0
View Details
Name: Hook per lesecuzione degli URL
Path: shell32.dll
Location: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
ClsID: {AEB6717E-7E19-11d0-97EE-00C04FD91972}
Good: 0 - Bad: 0
Unknown Item
Search at Google
Name: CShellExecuteHookImpl Object
Path: C:\Programmi\ewido anti-malware\shellhook.dll
Location: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
ClsID: {54D9498B-CF93-414F-8984-8CE7FDE0D391}
Good: 0 - Bad: 0
Unknown Item
Search at Google
Local Open Ports: Result ToDo
Port: 135 TCP
Path: C:\WINDOWS\system32\svchost.exe (Process ID: 764)
Good: 1 - Bad: 0
View Details
Port: 139 TCP
Path: C:\WINDOWS\system32\svchost.exe (Process ID: 800)
Good: 1 - Bad: 0
View Details
Port: 445 TCP
Path: ? (Process ID: 4)
Good: 1 - Bad: 0
View Details
Port: 3071 TCP
Path: C:\Programmi\Internet Explorer\iexplore.exe (Process ID: 1772)
Good: 0 - Bad: 0
Unknown Item
Search at Google
Port: 3389 TCP
Path: C:\WINDOWS\system32\svchost.exe (Process ID: 704)
Good: 1 - Bad: 0
View Details
Port: 123 UDP
Path: C:\WINDOWS\system32\svchost.exe (Process ID: 800)
Good: 1 - Bad: 0
View Details
Port: 123 UDP
Path: C:\WINDOWS\system32\svchost.exe (Process ID: 800)
Good: 1 - Bad: 0
View Details
Port: 137 UDP
Path: C:\WINDOWS\system32\svchost.exe (Process ID: 800)
Good: 1 - Bad: 0
View Details
Port: 138 UDP
Path: C:\WINDOWS\system32\svchost.exe (Process ID: 800)
Good: 1 - Bad: 0
View Details
Port: 445 UDP
Path: C:\Programmi\Internet Explorer\iexplore.exe (Process ID: 4)
Good: 1 - Bad: 0
View Details
Port: 500 UDP
Path: C:\WINDOWS\system32\lsass.exe (Process ID: 560)
Good: 1 - Bad: 0
View Details
Port: 1035 UDP
Path: C:\WINDOWS\system32\svchost.exe (Process ID: 848)
Good: 1 - Bad: 0
View Details
Port: 1036 UDP
Path: C:\WINDOWS\system32\svchost.exe (Process ID: 848)
Good: 0 - Bad: 0
Unknown Item
Search at Google
Port: 1037 UDP
Path: C:\WINDOWS\system32\svchost.exe (Process ID: 848)
Good: 0 - Bad: 0
Unknown Item
Search at Google
Port: 1041 UDP
Path: C:\WINDOWS\system32\svchost.exe (Process ID: 848)
Good: 0 - Bad: 0
Unknown Item
Search at Google
Port: 1047 UDP
Path: C:\WINDOWS\system32\svchost.exe (Process ID: 848)
Good: 0 - Bad: 0
Unknown Item
Search at Google
Port: 1900 UDP
Path: C:\WINDOWS\system32\svchost.exe (Process ID: 896)
Good: 0 - Bad: 0
Unknown Item
Search at Google
Port: 1900 UDP
Path: C:\WINDOWS\system32\svchost.exe (Process ID: 896)
Good: 0 - Bad: 0
Unknown Item
Search at Google
Port: 2841 UDP
Path: C:\Programmi\Microsoft Office\OFFICE11\WINWORD.EXE (Process ID: 4012)
Good: 0 - Bad: 0
Unknown Item
Search at Google
Port: 2955 UDP
Path: C:\Programmi\Internet Explorer\iexplore.exe (Process ID: 1772)
Good: 0 - Bad: 0
Unknown Item
Search at Google
Port: 4500 UDP
Path: C:\WINDOWS\system32\lsass.exe (Process ID: 560)
Good: 0 - Bad: 0
Unknown Item
Search at Google
Running Processes: Result ToDo
Name: [System Process]
Process ID: 0
Path:
Info: Threads: 1 - Priority: Normal - Visible: No
Good: 1 - Bad: 0
View Details
Name: System
Process ID: 4
Path:
Info: Threads: 73 - Priority: Normal - Visible: No
Good: 1 - Bad: 0
View Details
Name: rundll32.exe
Process ID: 168
Path: C:\WINDOWS\system32\
Info: Threads: 4 - Priority: Normal - Visible: No
Good: 1 - Bad: 0
View Details
Name: msmsgs.exe
Process ID: 204
Path: C:\Programmi\Messenger\
Info: Threads: 2 - Priority: Normal - Visible: No
Good: 1 - Bad: 0
View Details
Name: a2sys.exe (a-squared HiJackFree)
Process ID: 280
Path: C:\Programmi\a-squared\
Info: Threads: 1 - Priority: Normal - Visible: Yes
Good: 1 - Bad: 0
View Details
Name: smss.exe
Process ID: 416
Path: C:\WINDOWS\system32\
Info: Threads: 3 - Priority: Normal - Visible: No
Good: 1 - Bad: 0
View Details
Name: csrss.exe (winlogon.exe - Errore di applicazione)
Process ID: 480
Path: C:\WINDOWS\system32\
Info: Threads: 12 - Priority: Normal - Visible: Yes
Good: 1 - Bad: 0
View Details
Name: winlogon.exe
Process ID: 504
Path: C:\WINDOWS\system32\
Info: Threads: 22 - Priority: High - Visible: No
Good: 1 - Bad: 0
View Details
Name: services.exe
Process ID: 548
Path: C:\WINDOWS\system32\
Info: Threads: 15 - Priority: Normal - Visible: No
Good: 1 - Bad: 0
View Details
Name: lsass.exe
Process ID: 560
Path: C:\WINDOWS\system32\
Info: Threads: 18 - Priority: Normal - Visible: No
Good: 1 - Bad: 0
View Details
Name: svchost.exe
Process ID: 704
Path: C:\WINDOWS\system32\
Info: Threads: 18 - Priority: Normal - Visible: No
Good: 1 - Bad: 0
View Details
Name: svchost.exe
Process ID: 764
Path: C:\WINDOWS\system32\
Info: Threads: 9 - Priority: Normal - Visible: No
Good: 1 - Bad: 0
View Details
Name: svchost.exe
Process ID: 800
Path: C:\WINDOWS\system32\
Info: Threads: 60 - Priority: Normal - Visible: No
Good: 1 - Bad: 0
View Details
Name: svchost.exe
Process ID: 848
Path: C:\WINDOWS\system32\
Info: Threads: 6 - Priority: Normal - Visible: No
Good: 1 - Bad: 0
View Details
Name: svchost.exe
Process ID: 896
Path: C:\WINDOWS\system32\
Info: Threads: 14 - Priority: Normal - Visible: No
Good: 1 - Bad: 0
View Details
Name: spoolsv.exe
Process ID: 1028
Path: C:\WINDOWS\system32\
Info: Threads: 11 - Priority: Normal - Visible: No
Good: 1 - Bad: 0
View Details
Name: svchost.exe
Process ID: 1192
Path: C:\WINDOWS\system32\
Info: Threads: 3 - Priority: Normal - Visible: No
Good: 1 - Bad: 0
View Details
Name: btwdins.exe
Process ID: 1212
Path: C:\Programmi\WIDCOMM\Software Bluetooth\bin\
Info: Threads: 3 - Priority: Normal - Visible: No
Good: 1 - Bad: 0
View Details
Name: CDAC11BA.EXE
Process ID: 1228
Path: C:\WINDOWS\system32\drivers\
Info: Threads: 4 - Priority: Normal - Visible: No
Good: 1 - Bad: 0
View Details
Name: MDM.EXE
Process ID: 1288
Path: C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\
Info: Threads: 4 - Priority: Normal - Visible: No
Good: 1 - Bad: 0
View Details
Name: svchost.exe
Process ID: 1384
Path: C:\WINDOWS\system32\
Info: Threads: 6 - Priority: Normal - Visible: No
Good: 1 - Bad: 0
View Details
Name: wdfmgr.exe
Process ID: 1416
Path: C:\WINDOWS\system32\
Info: Threads: 4 - Priority: Normal - Visible: No
Good: 1 - Bad: 0
View Details
Name: a2start.exe
Process ID: 1552
Path: C:\Programmi\a-squared\
Info: Threads: 1 - Priority: Normal - Visible: No
Good: 1 - Bad: 0
View Details
Name: BTTray.exe
Process ID: 1708
Path: C:\Programmi\WIDCOMM\Software Bluetooth\
Info: Threads: 2 - Priority: Normal - Visible: No
Good: 1 - Bad: 0
View Details
Name: Explorer.EXE (a-squared HiJackFree)
Process ID: 1732
Path: C:\WINDOWS\
Info: Threads: 14 - Priority: Normal - Visible: Yes
Good: 1 - Bad: 0
View Details
Name: iexplore.exe (pc-facile.com :: Inserisci un nuovo Topic - Microsoft Internet Explorer)
Process ID: 1772
Path: C:\Programmi\Internet Explorer\
Info: Threads: 15 - Priority: Normal - Visible: Yes
Good: 1 - Bad: 0
View Details
Name: Dragdiag.exe
Process ID: 2036
Path: C:\Programmi\Thomson\SpeedTouch USB\
Info: Threads: 1 - Priority: Normal - Visible: No
Good: 1 - Bad: 0
View Details
Name: ewidoctrl.exe
Process ID: 2304
Path: C:\Programmi\ewido anti-malware\
Info: Threads: 5 - Priority: Normal - Visible: No
Good: 1 - Bad: 0
View Details
Name: SecuritySuite.exe (ewido anti-malware)
Process ID: 2444
Path: C:\Programmi\ewido anti-malware\
Info: Threads: 21 - Priority: Normal - Visible: Yes
Good: 0 - Bad: 0
Unknown Item
Search at Google
Submit new process info
Name: WINWORD.EXE (Nuovo Documento di Microsoft Word - Microsoft Word)
Process ID: 4012
Path: C:\Programmi\Microsoft Office\OFFICE11\
Info: Threads: 6 - Priority: Normal - Visible: Yes
Good: 1 - Bad: 0
View Details
This analysis is saved and available for at least 7 days at this website address.
Analysis generated on 3/19/2006 4:12:39 PM
Comunque ringrazio anticipatamente chi mi aiuterà.ciao
