trojan navapromo.aa

[hydra]

ciao a tutti..
ho bisogno di aiuto.
sul mio pc(windows xp sp2) avg 8 aggiornato ha trovato un trjan che durante a scansione continua ad eliminare.
ma ritorna di continuo.come devo fare per eliminarlo? ho visto su un altro topic che già era successo.ho scaricato HijackThis ed mi ha creato questo file log. ora aspetto un aiuto. grazie

Codice: Seleziona tutto

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 07:38, on 2009-02-08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Programmi\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\Launch Manager\QtZgAcer.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAHE.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\documents and settings\ugo.acer-72ypzyj8gc.000\impostazioni locali\dati applicazioni\akgoq.exe
C:\Programmi\WinZip\WZQKPICK.EXE
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Programmi\Winamp Toolbar\winamptb.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Programmi\Winamp Toolbar\winamptb.dll
O2 - BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programmi\AVG\AVG8\avgssie.dll
O2 - BHO: Windows Live OneCare Family Safety Browser Helper Class - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Programmi\Windows Live\Family Safety\fssbho.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Programmi\AVG\AVG8\avgtoolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programmi\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Programmi\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {FFFFFEF0-5B30-21D4-945D-000000000000} - C:\PROGRA~1\STARDO~1\SDIEInt.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Programmi\Winamp Toolbar\winamptb.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Programmi\AVG\AVG8\avgtoolbar.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programmi\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LManager] C:\Programmi\Launch Manager\QtZgAcer.EXE
O4 - HKLM\..\Run: [EPSON Stylus Photo R240 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAHE.EXE /P30 "EPSON Stylus Photo R240 Series" /O6 "USB001" /M "Stylus Photo R240"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [akgoq] "c:\documents and settings\ugo.acer-72ypzyj8gc.000\impostazioni locali\dati applicazioni\akgoq.exe" akgoq
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programmi\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dati applicazioni\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: &Windows Live Search - res://C:\Programmi\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Download with Star Downloader - C:\Programmi\Star Downloader\sdie.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Inserisci blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programmi\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: Inserisci &blog in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programmi\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1135533232200
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1167040079985
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://www.inforiviera.it/new_webcam/AxisCamControl.ocx
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programmi\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD File System Service (InCDsrv) - Unknown owner - C:\Programmi\Ahead\InCD\InCDsrv.exe

--
End of file - 8797 bytes

[Frate Aurelio]

@ugo64
ciao

Il tuo computer è a rischio!
Rilevo, come tu evidenzi, che non hai installato il Service Pack 3 (SP3) !
Presumibilmente non effettui gli aggiornamenti di Windows con Windows Update.
Gli aggiornamenti di Windows non sono un’ opzional, ma sono la primaria attività per la sicurezza del proprio PC.

● Consiglio Generale
Tutte le operazioni devono essere eseguite:
- Avvio PC in modalità normale
- Con il minor numero possibile di programmi in attività

● Correzione degli elementi trovati nelle "aree-chiave" del sistema da Hijackthis:
- Cliccare sulla icona Hijackthis sul Desktop
- Premere il pulsante:
- Do System scan only
- Fixare (premere il tasto Fix Checked di Hijackthis) dopo avere spuntato le seguenti voci:

Codice: Seleziona tutto

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKCU\..\Run: [akgoq] "c:\documents and settings\ugo.acer-72ypzyj8gc.000\impostazioni locali\dati applicazioni\akgoq.exe" akgoq
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programmi\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dati applicazioni\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe

● Scarica Combofix (puoi salvarlo sul desktop) da:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
● Importante:- Non funziona in modalità provvisoria.
- Chiudere la connessione a Internet (meglio se spegni il modem).
- Disabilitare temporaneamente l’antivirus, antispyware e firewall.
- Chiudere tutti i programmi aperti.
- Non usare nessun programma sino al termine.
- Se durante la scansione viene richiesta la rimozione di driver, acconsentire.
- Sono eventualmente drivers infetti.
- Durante la scansione non usare il PC. Lasciare inattiva la tastiera e attendere il termine di tutte le operazione.
- Combofix puo riavviare il PC, non fate assolutamente nulla.

● Caricamento ComboFix
Cliccare su:
- combofix.exe
- Premere Invio.
- Alla richiesta di creare una console di ripristino rispondere:
NO
● Importante:
Non usare nessun programma sino a che Combofix non abbia terminato.
- Al termine, verrà creato un file log in C:\ComboFix.txt
Viene aperto da Combofix con il Blocco Note o potrebbe essere da voi aperto con il citato percorso.
Eseguire:
- Modifica►Seleziona tutto►Tasto Destro del mouse►copia
Copiarlo nel topic aperto

Seguiranno istruzioni

Frate Aurelio

[hydra]

seguite tutte le istruzioni.
non mi ha chiesto di driver...
questo è quanto ha scritto.
grazie..

Codice: Seleziona tutto

ComboFix 09-02-06.04 - ugo 2009-02-08 10:11:50.1 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Home Edition  5.1.2600.2.1252.1.1040.18.494.217 [GMT 1:00]
Eseguito da: c:\documents and settings\ugo.ACER-72YPZYJ8GC.000\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)

ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.

(((((((((((((((((((((((((((((((((((((   Altre eliminazioni   )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\ugo.ACER-72YPZYJ8GC.000\Impostazioni locali\Dati applicazioni\akgoq.dat
c:\documents and settings\ugo.ACER-72YPZYJ8GC.000\Impostazioni locali\Dati applicazioni\akgoq.exe
c:\documents and settings\ugo.ACER-72YPZYJ8GC.000\Impostazioni locali\Dati applicazioni\akgoq_nav.dat
c:\documents and settings\ugo.ACER-72YPZYJ8GC.000\Impostazioni locali\Dati applicazioni\akgoq_navps.dat
c:\documents and settings\ugo.ACER-72YPZYJ8GC.000\Preferiti\Videos.url
c:\windows\system32\nvs2.inf

.
(((((((((((((((((((((((((   Files Creati Da 2009-01-08 al 2009-02-08  )))))))))))))))))))))))))))))))))))
.

2009-02-07 21:17 . 2009-02-07 21:17   <DIR>   d--------   c:\programmi\Trend Micro
2009-02-07 08:45 . 2009-02-07 08:45   10,520   --a------   c:\windows\system32\avgrsstx.dll
2009-01-20 20:12 . 2009-01-20 20:12   <DIR>   d--------   c:\documents and settings\ugo.ACER-72YPZYJ8GC.000\Dati applicazioni\AVS4YOU
2009-01-20 20:12 . 2009-01-20 20:12   <DIR>   d--------   c:\documents and settings\All Users\Dati applicazioni\AVS4YOU
2009-01-20 20:08 . 2009-01-20 20:08   <DIR>   d--------   c:\programmi\File comuni\AVSMedia
2009-01-20 20:08 . 2009-01-20 20:08   <DIR>   d--------   c:\programmi\AVS4YOU
2009-01-20 20:08 . 2008-08-13 10:22   1,700,352   --a------   c:\windows\system32\GdiPlus.dll
2009-01-20 20:08 . 2008-08-13 10:22   974,848   --a------   c:\windows\system32\mfc70.dll
2009-01-20 20:08 . 2008-08-13 10:22   487,424   --a------   c:\windows\system32\msvcp70.dll
2009-01-20 20:08 . 2008-08-13 10:22   24,576   --a------   c:\windows\system32\msxml3a.dll
2009-01-19 22:21 . 2009-01-19 22:21   <DIR>   d--------   c:\programmi\Xvid
2009-01-19 22:21 . 2008-12-04 21:42   815,104   --a------   c:\windows\system32\xvidcore.dll
2009-01-19 22:21 . 2008-12-04 21:46   180,224   --a------   c:\windows\system32\xvidvfw.dll
2009-01-19 22:21 . 2008-12-13 20:01   77,824   --a------   c:\windows\system32\xvid.ax
2009-01-19 22:13 . 2009-01-19 22:13   107   --a------   c:\windows\VobEdit.INI
2009-01-18 09:28 . 2009-01-18 09:28   <DIR>   d--------   c:\documents and settings\ugo.ACER-72YPZYJ8GC.000\Dati applicazioni\DivX
2009-01-18 09:27 . 2008-11-06 17:37   120,056   ---------   c:\windows\system32\pxcpyi64.exe
2009-01-18 09:27 . 2008-11-06 17:37   118,520   ---------   c:\windows\system32\pxinsi64.exe

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-07 07:45   325,128   ----a-w   c:\windows\system32\drivers\avgldx86.sys
2008-12-13 06:36   3,593,216   ----a-w   c:\windows\system32\dllcache\mshtml.dll
2008-12-11 11:57   333,184   ----a-w   c:\windows\system32\drivers\srv.sys
2008-12-11 11:57   333,184   ------w   c:\windows\system32\dllcache\srv.sys
2008-12-11 00:33   86,016   ----a-w   c:\windows\system32\dpl100.dll
2008-12-11 00:33   200,704   ----a-w   c:\windows\system32\dtu100.dll
2008-12-09 02:28   593,920   ----a-w   c:\windows\system32\dpuGUI11.dll
2008-12-09 02:28   57,344   ----a-w   c:\windows\system32\dpv11.dll
2008-12-09 02:28   344,064   ----a-w   c:\windows\system32\dpus11.dll
2008-12-09 02:28   294,912   ----a-w   c:\windows\system32\dpu11.dll
2008-01-22 14:56   32   ----a-w   c:\documents and settings\All Users\Dati applicazioni\ezsid.dat
2007-05-21 18:58   17,920   ----a-w   c:\documents and settings\ugo.ACER-72YPZYJ8GC.000\Dati applicazioni\GDIPFONTCACHEV1.DAT
2008-07-27 18:00   67,696   ----a-w   c:\programmi\mozilla firefox\components\jar50.dll
2008-07-27 18:00   54,376   ----a-w   c:\programmi\mozilla firefox\components\jsd3250.dll
2008-07-27 18:00   34,952   ----a-w   c:\programmi\mozilla firefox\components\myspell.dll
2008-07-27 18:00   46,720   ----a-w   c:\programmi\mozilla firefox\components\spellchk.dll
2008-07-27 18:00   172,144   ----a-w   c:\programmi\mozilla firefox\components\xpinstal.dll
.

(((((((((((((((((((((((((((((((((((((   Punti Reg Caricati   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\programmi\Winamp Toolbar\winamptb.dll" [2008-03-20 1267040]

[HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-19 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" [X]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2003-01-24 155648]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-01-24 114688]
"SynTPLpr"="c:\programmi\Synaptics\SynTP\SynTPLpr.exe" [2002-11-15 126976]
"SynTPEnh"="c:\programmi\Synaptics\SynTP\SynTPEnh.exe" [2002-11-18 561152]
"LManager"="c:\programmi\Launch Manager\QtZgAcer.EXE" [2003-05-22 307200]
"EPSON Stylus Photo R240 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIAHE.EXE" [2005-04-25 98304]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-02-07 1601304]
"SoundMan"="SOUNDMAN.EXE" [2003-03-27 c:\windows\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-19 15360]
"DWQueuedReporting"="c:\progra~1\FILECO~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{93994DE8-8239-4655-B1D1-5F4E91300429}"= "c:\progra~1\DVDREG~1\DVDShell.dll" [2004-10-09 49152]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-02-07 08:45 10520 c:\windows\system32\avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\System32\\ftp.exe"=
"c:\\Programmi\\eMule\\emule.exe"=
"c:\\Programmi\\Messenger\\msmsgs.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\livecall.exe"=
"c:\\WINDOWS\\System32\\dpvsetup.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmi\\LimeWire\\LimeWire.exe"=
"c:\\Programmi\\SopCast\\adv\\SopAdver.exe"=
"c:\\Programmi\\Winamp Remote\\bin\\Orb.exe"=
"c:\\Programmi\\Winamp Remote\\bin\\OrbTray.exe"=
"c:\\Programmi\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"c:\\Programmi\\Skype\\Phone\\Skype.exe"=
"c:\\Programmi\\AVG\\AVG8\\avgupd.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"4662:TCP"= 4662:TCP:e-mule
"4672:UDP"= 4672:UDP:e-mule

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-06-07 325128]
R2 acernbm;acernbm;c:\windows\system32\drivers\acernbm.sys [2003-06-13 6431]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-02-07 298264]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2008-01-03 43816]
R2 fsssvc;Windows Live OneCare Family Safety;c:\programmi\Windows Live\Family Safety\fsssvc.exe [2007-12-17 523816]
R2 ipasintf;ipasintf;c:\windows\system32\drivers\pas2k.sys [2000-10-03 78280]
R3 Stmatm;ATM/ADSL miniport;c:\windows\system32\drivers\stmatm.sys [2004-01-25 59338]
S3 BRGSp50;BRGSp50 NDIS Protocol Driver;c:\windows\system32\drivers\BRGSp50.sys [2005-06-08 20608]
S3 TaurusUsb;ADSL Modem USB Service 1.09a;c:\windows\system32\drivers\torususb.sys [2004-01-25 527980]
S3 UtilNT;UtilNT;c:\windows\system32\drivers\utilnt.sys [2004-08-12 5533]
S3 ZD1211BU(WLAN);802.11g USB 2.0 Wireless LAN Driver (USB)(WLAN);c:\windows\system32\drivers\ZD1211BU.sys [2005-10-28 402432]
.
Contenuto della cartella 'Scheduled Tasks'

2009-02-08 c:\windows\Tasks\Verifica aggiornamenti per Windows Live Toolbar.job
- c:\programmi\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]
.
- - - - CHIAVI ORFANE RIMOSSE - - - -

HKLM-Run-UniKey - (no file)
HKLM-RunServices-360SCProgram - (no file)


.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = 127.0.0.1
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Windows Live Search - c:\programmi\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: Download with Star Downloader - c:\programmi\Star Downloader\sdie.htm
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\ugo.ACER-72YPZYJ8GC.000\Dati applicazioni\Mozilla\Firefox\Profiles\44k9055e.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.it/
FF - component: c:\programmi\Mozilla Firefox\components\xpinstal.dll
FF - component: c:\programmi\Mozilla Firefox\extensions\talkback@mozilla.org\components\qfaservices.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-08 10:14:01
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------

- - - - - - - > 'winlogon.exe'(560)
c:\windows\system32\basecsp.dll
c:\windows\system32\bcsprsrc.dll
.
Ora fine scansione: 2009-02-08 10:15:18
ComboFix-quarantined-files.txt  2009-02-08 09:15:18

Pre-Run: 8,200,093,696 byte disponibili
Post-Run: 8,229,650,432 byte disponibili

162   --- E O F ---   2009-01-18 02:04:50

[Frate Aurelio]

@ugo64
Ciao
Come va il PC ?
sappimi dire

Frate Aurelio

[ugo64]

ciao, frate aurelio
il mio pc ora va benissimo.
grazie ancora per il tuo aiuto e le tue parole 'benedette', senza il quale il computer sarebbe 'impestato' ancora
ps ho scaricato tutti gli aggiornamenti di windows sulla protezione.
a presto

[Frate Aurelio]

@ugo64
Sono contento....

Frate Aurelio

[hydra]

Per favore, quando inserite dei log metteteli nel tag code, almeno il topic risulta più leggibile. Tnx.

Inoltre, dato che è un problema legato a virus&co., sposto in sezione adatta.

[Frate Aurelio]

@hydra
OK e grazie

Frate Aurelio