problemino backdoor...

[tower]

ciao ragazzi! scusate se torno ad approfittare della vostra gentilezza...ecco ho un piccolo problemino:ogni volta che accendo il pc avg rileva un virus "c:\windows\system32\epaa.dll" e mi dice che è un trojan backdoor o roba simile...gli dico di cancellarlo e lo fa normalmente ma ad ogni riavvio si rigenera


che posso fare?? grazie in anticipo per l'aiuto!

[BilloKenobi]

prova a usare questo tool. esso rilascia un log in C:\gromozon_removal.log. postane il contenuto

http://www.mytempdir.com/1012500

[tower]

ecco il log:
Removal tool loaded into memory
Gromozon rootkit component not detected - searching for other components
Scanning: C:\WINDOWS
Scanning: C:\Programmi\File comuni


Trojan.Gromozon does not exist - your system is clean.



come vedi non sembra esserci nulla...non ho sto gromozon e nemmeno il link optimizer...ho pulito tutto giorni fa...

francamente non capisco cosa sia sto file che continua a rigenerarsi...

secondo voi cos'è?

[BilloKenobi]

prova con quest'altro tool...quel file è sicuramente legato al LinkOptimizer...

http://www.mytempdir.com/1010789

questo il log lo rilascia in C:\FixLinkopt.log. posta anche quello

[Luke57]

Ciao, non sempre è collegato alle classiche caratterizzazioni del famigerato trojan. esegui anche l'altro tool, poi posta un log di hijackthis.

[tower]

ho eseguito il tool della symantec...ma non riesco a trovare il log relativo...anche se non sembra aver trovato nulla...
intanto vi posto il log di hijackthis:
Logfile of HijackThis v1.99.1
Scan saved at 16.32.04, on 03/11/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\AntiVir PersonalEdition Classic\sched.exe
C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe
C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\System32\CTHELPER.EXE
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Programmi\Logitech\Video\LogiTray.exe
C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programmi\Winamp\winampa.exe
C:\Programmi\iTunes\iTunesHelper.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\Programmi\Logitech\Video\FxSvr2.exe
C:\Programmi\QuickTime\qttask.exe
C:\Programmi\Unlocker\UnlockerAssistant.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Programmi\AGEIA Technologies\TrayIcon.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\PROGRA~1\MESSEN~1\msmsgs.exe
C:\Programmi\MSN Messenger\msnmsgr.exe
C:\Programmi\VIA\RAID\raid_tool.exe
C:\Programmi\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Programmi\WinZip\WZQKPICK.EXE
C:\Programmi\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Documents and Settings\fabio\Menu Avvio\Programmi\Esecuzione automatica\kljsuno.exe
C:\Documents and Settings\fabio\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.virgilio.it/free
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.it.netscape.com/it/home/winsearch200.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.it.netscape.com/it/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8088
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=userinit.exe,userinit32.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] C:\Programmi\Creative\SBLive\PROGRAM\ADGJDet.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Programmi\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Programmi\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [MSNS PLUS XP2] msnnsg.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Programmi\Winamp\winampa.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Programmi\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [AGEIA PhysX SysTray] C:\Programmi\AGEIA Technologies\TrayIcon.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\RunServices: [MSNS PLUS XP2] msnnsg.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [svshost32] svshost32.exe
O4 - HKCU\..\Run: [Compaq32 Service Drivers] msnt32.exe
O4 - HKCU\..\Run: [Spamihilator] "C:\Programmi\Spamihilator\spamihilator.exe"
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] C:\Programmi\Logitech\Video\ManifestEngine.exe boot
O4 - HKCU\..\Run: [ScaricaMP3] C:\Documents and Settings\fabio\Dati applicazioni\ScaricaMP3[1].exe t
O4 - HKCU\..\Run: [MSMSGS] "C:\PROGRA~1\MESSEN~1\msmsgs.exe" /background
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Programmi\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmi\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\RunServices: [svshost32] svshost32.exe
O4 - HKCU\..\RunServices: [Compaq32 Service Drivers] msnt32.exe
O4 - Startup: kljsuno.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: raid_tool.exe.lnk = C:\Programmi\VIA\RAID\raid_tool.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Programmi\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programmi\WinZip\WZQKPICK.EXE
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Programmi\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: ScaricaMP3 - {EF6D6AE3-2625-40D6-A5AB-920DFD2DAF8C} - C:\Documents and Settings\fabio\Dati applicazioni\ScaricaMP3[1].exe (file missing)
O14 - IERESET.INF: START_PAGE_URL=http://www.virgilio.it/free
O15 - Trusted Zone: http://www.archiviosex.net
O15 - Trusted Zone: http://www.linkautomatici.com
O15 - Trusted Zone: http://www.master69.biz
O15 - Trusted Zone: http://www.master70.biz
O15 - Trusted Zone: http://www.master71.biz
O15 - Trusted Zone: http://www.redfunny.com
O15 - Trusted Zone: http://www.skymasters.biz
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/ms ... b31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/Mi ... b31267.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/Shar ... vSniff.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://clacli1989.spaces.msn.com//Photo ... nPUpld.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/Shar ... /cabsa.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b31267.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/So ... b31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs:
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmi\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Estensione eventi dll (evedll) - Unknown owner - C:\WINDOWS\Downlo~1\g1ht0tf\ghn44f9.exe (file missing)
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

si riesce a capire qualcosa???

[Smjert]

Sì, hai un sacco di schifezze.

Avvia HijackThis, premi Do a system scan only, spunta queste voci e poi premi FixChecked:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8088
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=userinit.exe,userinit32.exe
O4 - HKLM\..\Run: [MSNS PLUS XP2] msnnsg.exe
O4 - HKLM\..\RunServices: [MSNS PLUS XP2] msnnsg.exe
O4 - HKCU\..\Run: [svshost32] svshost32.exe
O4 - HKCU\..\Run: [Compaq32 Service Drivers] msnt32.exe
O4 - HKCU\..\RunServices: [svshost32] svshost32.exe
O4 - HKCU\..\RunServices: [Compaq32 Service Drivers] msnt32.exe
O4 - Startup: kljsuno.exe
O9 - Extra button: ScaricaMP3 - {EF6D6AE3-2625-40D6-A5AB-920DFD2DAF8C} - C:\Documents and Settings\fabio\Dati applicazioni\ScaricaMP3[1].exe (file missing)
O15 - Trusted Zone: http://www.archiviosex.net
O15 - Trusted Zone: http://www.linkautomatici.com
O15 - Trusted Zone: http://www.master69.biz
O15 - Trusted Zone: http://www.master70.biz
O15 - Trusted Zone: http://www.master71.biz
O15 - Trusted Zone: http://www.redfunny.com
O15 - Trusted Zone: http://www.skymasters.biz
O23 - Service: Estensione eventi dll (evedll) - Unknown owner - C:\WINDOWS\Downlo~1\g1ht0tf\ghn44f9.exe (file missing)
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe (file missing)

Riavvia in Modalità Provvisoria (F8 al boot, segnati da qualche parte le operazioni da fare perchè non potrai accedere a Internet).

Apri una cartella qualunque, vai su
Strumenti->Opzioni Cartella->scheda Visualizzazione,
spunta la voce "Visualizza cartelle e file nascosti", togli la spunta a
"Nascondi file protetti di sistema" (digli di sì).

Usa la ricerca di Windows e trova questi file/cartelle: userinit32.exe, msnnsg.exe, svshost32.exe, msnt32.exe, kljsuno.exe, ScaricaMP3[1].exe, g1ht0tf, hwclock.exe
(ricordati di attivare la ricerca nelle cartelle e nei file nascosti andando
in "Altre opzioni avanzate" e spuntando la voce
"Cerca nei file e nelle cartelle nascosti").

Se li trovi li cancelli

Torna in Modalità Normale

Fai una scansione online con Panda, alla fine salva il report e posta il contenuto.

[tower]

ho fatto tutto quello che mi hai detto....ma non riesco a scaricare sto panda che dici tu...qualche altro programma di scansione?

[Smjert]

Ma non è un software da scaricare... è una scansione online, devi premere il pulsante al centro dello schermo, quello animato con l'immagine del pc.

[tower]

si questo l'ho capito ma non riesce ad eseguirla...

[Smjert]

Devi spiegarti meglio :\ cosa succede esattamente? clicchi e non ti si apre niente?

[tower]

scusami se non ho un linguaggio tecnico ma di pc ne capisco poco ahimè
cmq:praticamente clicco sopra ilk cosino che lampeggia e mi si apre tutto tranquillamente...dico di eseguire la scansione ma al momento di effettuare la scansione mi dice che c'è un errore e che qualche mio componente non consente di eseguirla...

[Smjert]

Probabilmente è il tuo antivirus, prova a disattivare il controllo Real-Time (se no chiudi direttamente l'antivirus).

[tower]

ancora nulla...

ecco quello che mi dice:Error on downloading ActiveScanAn error has occurred downloading Panda ActiveScan. Please repeat the process. If the error occurs again, restart your system and try againPossible causes of this error are:

Not allowing the application's ActiveX control to be downloaded.

Problems with the Internet connection.

The error could be due to a download error or an installation error due to lack of hard disk space, privileges etc.,... Try again


ma per forza sto panda devo usare?non si può èprovare con qualcos'altro?

[Smjert]

Probabilmente ce li hai disattivati in IE, aprilo vai su Strumenti->Opzioni Internet->scheda Protezione, selezioni Internet, premi Livello personalizzato, nella lista trova la voce "Controlli e plug-in ActiveX" e spunta Attiva, dai ok e riprova a fare la scansione.

Ti sto facendo usare Panda perchè, per alcuni aspetti, è un ottimo antivirus, in più usa l'euristica per individuare possibili malware anche se non ce li ha in database.

[tower]

l'ho fatto ma....nulla! tutte a me capitano....

p.s.grazie della pazienza! mi starai odiando...eheheheh

[Smjert]

Ma va figurati...
Prova con Kaspesky allora anche se non credo cambi.

Fa una scansione online con Kaspersky, con database esteso
(dopo che ha scaricato gli aggiornamenti appare il pulsante Next,
premilo poi premi Scan Settings e spunta la voce Extended, dai ok e inizia la scansione scegliendo My Computer).

[Smjert]

Ah... posta il risultato della scansione.
Alla fine appare il pulsante Save Report As, usalo per salvare il risultato.

[tower]

Sunday, November 05, 2006 4:42:28 PM
Operating System: Microsoft Windows XP Professional, Service Pack 1 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 5/11/2006
Kaspersky Anti-Virus database records: 238402


Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
A:\
C:\
D:\

Scan Statistics
Total number of scanned objects 102468
Number of viruses found 1
Number of infected objects 11 / 0
Number of suspicious objects 0
Duration of the scan process 00:56:19

Infected Object Name Virus Name Last Action
C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\DEFAULT Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped

C:\WINDOWS\system32\config\SYSTEM Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\Debug\oakley.log Object is locked skipped

C:\WINDOWS\{00000000-00000000-0000000E-00001102-00000002-80671102}.CDF Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\avg7\Log\emc.log Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Grisoft\Avg7Data\avg7log.log Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\fabio\NTUSER.dat.LOG Object is locked skipped

C:\Documents and Settings\fabio\Impostazioni locali\Temp\~DFB6AD.tmp Object is locked skipped

C:\Documents and Settings\fabio\Impostazioni locali\Temp\8.tmp Object is locked skipped

C:\Documents and Settings\fabio\Impostazioni locali\Temp\9.tmp Object is locked skipped

C:\Documents and Settings\fabio\Impostazioni locali\Temp\A.tmp Object is locked skipped

C:\Documents and Settings\fabio\Impostazioni locali\Temp\B.tmp Object is locked skipped

C:\Documents and Settings\fabio\Impostazioni locali\Temp\me_O37bNvizcGQyA3H Object is locked skipped

C:\Documents and Settings\fabio\Impostazioni locali\Temp\me_LYBm6aRbNNaJDqc Object is locked skipped

C:\Documents and Settings\fabio\Impostazioni locali\Temp\me_T7oHos5NrbNCLqB Object is locked skipped

C:\Documents and Settings\fabio\Impostazioni locali\Temp\me_rWvmAMbsytxqXTq Object is locked skipped

C:\Documents and Settings\fabio\Impostazioni locali\Temp\me_aKoeWMTuiMLMiCw Object is locked skipped

C:\Documents and Settings\fabio\Impostazioni locali\Temp\~DFB74B.tmp Object is locked skipped

C:\Documents and Settings\fabio\Impostazioni locali\Temp\~DFC7AB.tmp Object is locked skipped

C:\Documents and Settings\fabio\Impostazioni locali\Temp\~DFC7C5.tmp Object is locked skipped

C:\Documents and Settings\fabio\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\fabio\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\fabio\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\fabio\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\fabio\Impostazioni locali\Dati applicazioni\Microsoft\Windows Live Contacts\fabi84@hotmail.it\real\members.stg Object is locked skipped

C:\Documents and Settings\fabio\Impostazioni locali\Dati applicazioni\Microsoft\Windows Live Contacts\fabi84@hotmail.it\shadow\members.stg Object is locked skipped

C:\Documents and Settings\fabio\Documenti\Le Mie Conversazioni\novembre 2006\vivitilla@katamail.com.html Object is locked skipped

C:\Documents and Settings\fabio\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\fabio\Dati applicazioni\Adobe\Acrobat\7.0\Updater\udlog.txt Object is locked skipped

C:\Documents and Settings\fabio\ntuser.dat Object is locked skipped

C:\Documents and Settings\claudia\Impostazioni locali\Temporary Internet Files\Content.IE5\E3MF2PUZ\index1[1].html Infected: Exploit.HTML.Mht skipped

C:\Documents and Settings\claudia\Impostazioni locali\Temporary Internet Files\Content.IE5\E3MF2PUZ\index1[2].html Infected: Exploit.HTML.Mht skipped

C:\Documents and Settings\claudia\Impostazioni locali\Temporary Internet Files\Content.IE5\E3MF2PUZ\index1[3].html Infected: Exploit.HTML.Mht skipped

C:\Documents and Settings\claudia\Impostazioni locali\Temporary Internet Files\Content.IE5\E3MF2PUZ\index1[4].html Infected: Exploit.HTML.Mht skipped

C:\Documents and Settings\claudia\Impostazioni locali\Temporary Internet Files\Content.IE5\E3MF2PUZ\index1[5].html Infected: Exploit.HTML.Mht skipped

C:\Documents and Settings\claudia\Impostazioni locali\Temporary Internet Files\Content.IE5\E3MF2PUZ\index1[6].html Infected: Exploit.HTML.Mht skipped

C:\Documents and Settings\claudia\Impostazioni locali\Temporary Internet Files\Content.IE5\E3MF2PUZ\index1[7].html Infected: Exploit.HTML.Mht skipped

C:\Documents and Settings\claudia\Impostazioni locali\Temporary Internet Files\Content.IE5\CPIB0XYF\index1[2].html Infected: Exploit.HTML.Mht skipped

C:\Documents and Settings\claudia\Impostazioni locali\Temporary Internet Files\Content.IE5\CPIB0XYF\index1[1].html Infected: Exploit.HTML.Mht skipped

C:\Documents and Settings\claudia\Impostazioni locali\Temporary Internet Files\Content.IE5\EPORE5M5\index1[1].html Infected: Exploit.HTML.Mht skipped

C:\Documents and Settings\claudia\Impostazioni locali\Temporary Internet Files\Content.IE5\EPORE5M5\index1[2].html Infected: Exploit.HTML.Mht skipped

C:\Programmi\Kodak\Kodak EasyShare software\bin\Catalog\EasyShare.mm Object is locked skipped

C:\Programmi\Kodak\Kodak EasyShare software\bin\Catalog\EasyShare.me Object is locked skipped

Scan process completed.

[Smjert]

Ok sembri a posto.. diamo però una pulitina di sicurezza ai file temporanei.

Scarica CCleaner e installalo.

Avvia CCleaner e vai su Opzioni->Avanzate, togli la spunta a "cancella file in windows temp solo se più vecchi di 48 ore",
torna su Cleaner e fai Analizza, quando ha finito clicca Avvia Cleaner.