HD macina continuamente, Symantec non raggiungibile

[freetecno]

eccomi. scansione eseguita. di seguito includo il testo del file log (ma come si allega un file?). ho nascosto il percorso dei files rilevati come (potenziali) virus, per una misura di riservatezza. ti dico che i files rilevati appartengono ad una applicazione web e non sono (sicuramente) virati. credo piuttosto che l'estensione tragga in inganno l'antivirus. i files sono gli stessi benché segnalati in c: e d: (copia).

Norman SinowalMBR Cleaner
Copyright © 1990 - 2008, Norman ASA. Built 2008/05/13 16:21:18

Norman Scanner Engine Version: 5.92.04
Nvcbin.def Version: 5.92.00, Date: 2008/05/13 16:21:18, Variants: 0

Running pre-scan cleanup routine:
Operating System: Microsoft Windows XP Professional 5.1.2600 Service Pack 3
Logged on user: IO-DESK\marco

Set registry value: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLS = "00 00 00 00 20 25 2A 00 " -> ""
Removed registry value: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -> DisableRegistryTools = 0x00000000

Scan started: 25/11/2009 11:21:23

Scanning bootsectors...

No SinowalMBR hooks found

Number of sectors found: 1
Number of sectors scanned: 1
Number of sectors not scanned: 0
Number of infections found: 0
Number of infections removed: 0
Total scanning time: 0s 172ms


Scanning running processes and process memory...

Number of processes/threads found: 3187
Number of processes/threads scanned: 3187
Number of processes/threads not scanned: 0
Number of infected processes/threads terminated: 0
Total scanning time: 28s


Scanning file system...

Scanning: C:\*.*

C:\...\core.1341.tgz/unknown0 (Error whilst scanning file: I/O Error)
C:\...\core.1341.tgz (Possible archive bomb)

C:\...\core.2404.gz/unknown0 (Error whilst scanning file: I/O Error)
C:\...\core.2404.gz (Possible archive bomb)

C:\...\core.2437.gz/unknown0 (Error whilst scanning file: I/O Error)
C:\...\core.2437.gz (Possible archive bomb)

C:\...\log.tar/unknown0 (Error whilst scanning file: I/O Error)
C:\...\log.tar (Possible archive bomb)

C:\...\log_rolling.tar/unknown0 (Error whilst scanning file: I/O Error)
C:\...\log_rolling.tar (Possible archive bomb)

C:\...\core.1341.tgz/unknown0 (Error whilst scanning file: I/O Error)
C:\...\core.1341.tgz (Possible archive bomb)

C:\...\core.2404.gz/unknown0 (Error whilst scanning file: I/O Error)
C:\...\core.2404.gz (Possible archive bomb)

C:\...\core.2437.gz/unknown0 (Error whilst scanning file: I/O Error)
C:\...\core.2437.gz (Possible archive bomb)

C:\...\log.tar/unknown0 (Error whilst scanning file: I/O Error)
C:\...\log.tar (Possible archive bomb)

C:\...\log_rolling.tar/unknown0 (Error whilst scanning file: I/O Error)
C:\...\log_rolling.tar (Possible archive bomb)

C:\WINDOWS\pchealth\ERRORREP\QSIGNOFF\1D44D31.cab/unknown1 (Error whilst scanning file: I/O Error)

Scanning: D:\*.*

D:\Documents and Settings\HelpAssistant.IO-DESK\Impostazioni locali\Dati applicazioni\Mozilla\Firefox\Profiles\obkfhwb1.default\Cache\A16DA66Bd01/unknown0 (Error whilst scanning file: I/O Error)

D:\Documents and Settings\marco\Desktop\...\core.1341.tgz/unknown0 (Error whilst scanning file: I/O Error)
D:\Documents and Settings\marco\Desktop\...\core.1341.tgz (Possible archive bomb)

D:\Documents and Settings\marco\Desktop\...\core.2404.gz/unknown0 (Error whilst scanning file: I/O Error)
D:\Documents and Settings\marco\Desktop\...\core.2404.gz (Possible archive bomb)

D:\Documents and Settings\marco\Desktop\...\core.2437.gz/unknown0 (Error whilst scanning file: I/O Error)
D:\Documents and Settings\marco\Desktop\...\core.2437.gz (Possible archive bomb)

D:\Documents and Settings\marco\Desktop\...\core.546.saturation.gz/unknown0 (Error whilst scanning file: I/O Error)
D:\Documents and Settings\marco\Desktop\...\core.546.saturation.gz (Possible archive bomb)

D:\Documents and Settings\marco\Desktop\...\log.tar/unknown0 (Error whilst scanning file: I/O Error)
D:\Documents and Settings\marco\Desktop\...\log.tar (Possible archive bomb)

D:\Documents and Settings\marco\Desktop\...\log_rolling.tar/unknown0 (Error whilst scanning file: I/O Error)
D:\Documents and Settings\marco\Desktop\...\log_rolling.tar (Possible archive bomb)

D:\Documents and Settings\marco\Impostazioni locali\Dati applicazioni\Mozilla\Firefox\Profiles\obkfhwb1.default\Cache\A16DA66Bd01/unknown0 (Error whilst scanning file: I/O Error)

D:\...\core.1341.tgz/unknown0 (Error whilst scanning file: I/O Error)
D:\...\core.1341.tgz (Possible archive bomb)

D:\...\core.2404.gz/unknown0 (Error whilst scanning file: I/O Error)
D:\...\core.2404.gz (Possible archive bomb)

D:\...\core.2437.gz/unknown0 (Error whilst scanning file: I/O Error)
D:\...\core.2437.gz (Possible archive bomb)

D:\...\log.tar/unknown0 (Error whilst scanning file: I/O Error)
D:\...\log.tar (Possible archive bomb)

D:\...\log_rolling.tar/unknown0 (Error whilst scanning file: I/O Error)
D:\...\log_rolling.tar (Possible archive bomb)

Scanning: F:\*.*


Running post-scan cleanup routine:

Number of files found: 346384
Number of archives unpacked: 10611
Number of files scanned: 346302
Number of files not scanned: 82
Number of files skipped due to exclude list: 0
Number of infected files found: 21
Number of infected files repaired/deleted: 0
Number of infections removed: 0
Total scanning time: 1h 6m 26s

Aggiungo che al momento il pc non "macina" l'hd ... ma non l'ho ancora collegato alla rete!
Spero in risposte positive.

[gahan]

Esegui quest'altra operazione:

scarica Dr.Web CureIt! da questo link:

ftp://ftp.drweb.com/pub/drweb/cureit/cureit.exe

Doppio click su CureIt - clicca su Avvia - alla domanda Avvia ora il controllo? clicca su OK;
Al termine di questa fase clicca su "Completa scansione" e avvia cliccando sul triangolino verde;
Gli eventuali malware rilevati mettili in quarantena cliccando sul tasto Sposta.

Finita la scansione, copia ed incolla qui sul forum il log prodotto da CureIt situato in

C:\Documents and Settings\nomeutente\DoctorWeb\CureIt.log

[freetecno]

dobbiamo ripetere un'operazione già fatta?

[gahan]

è puro e semplice controllo...falla per sicurezza

[freetecno]

va bene. userò il file .exe che avevo già installato.

[gahan]

va bene. userò il file .exe che avevo già installato.

certo

[freetecno]

eccomi. la scansione è terminata ora.
come ti ripeto, il file di log è da 82MB ed evito di inviarlo.
le uniche segnalazioni avute riguardano i files che posti nella cartella Quarantine dalla precedente scansione.
Per questi files l'azione è stata:

1 )204295185907.exe, D:\Documents and Settings\marco\DoctorWeb\uarantine, Trojan.Starter.502,Cancellato.
2) 204295185907.exe.vir, D:\Documents and Settings\marco\DoctorWeb\uarantine, Trojan.Starter.502, Cancellato.
3) ComboFix.exe\32788R22FWJFW\FIND3M.bat, D:\Documents and Settings\marco\DoctorWeb\uarantine\ComboFix.exe, Probabile BATCH.Virus, ...(nessuna azione).
4) ComboFix.exe\32788R22FWJFW\List-C.bat, D:\Documents and Settings\marco\DoctorWeb\uarantine\ComboFix.exe, Probabile BATCH.Virus, ...(nessuna azione)
5) ComboFix.exe, D:\Documents and Settings\marco\DoctorWeb\uarantine, l'Archivio contiene oggetti infetti, Spostato.
6) POSTOOBE.NEC, D:\Documents and Settings\marco\DoctorWeb\uarantine VBS.Generic.278, Cancellato.
7) vaderetro_oe.exe, D:\Documents and Settings\marco\DoctorWeb\uarantine, BackDoor.Nels.11, Cancellato.

Ti chiedo ancora una risposta. Spero ultima.

[gahan]

Rifai la scansione con hijackthis e posta il log;

Noti miglioramenti?

[freetecno]

eccolo:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 0.08.55, on 27/11/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Programmi\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Programmi\Microsoft SQL Server\MSSQL.2\OLAP\bin\msmdsrv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Apps\Softex\OmniPass\Omniserv.exe
C:\Programmi\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\File comuni\Symantec Shared\AppCore\AppSvc32.exe
C:\Programmi\File comuni\Ulead Systems\DVD\ULCDRSvr.exe
C:\Programmi\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
C:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Programmi\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\msftesql.exe
C:\Apps\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\sm56hlpr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe
C:\Programmi\File comuni\InstallShield\UpdateService\issch.exe
C:\Apps\Softex\OmniPass\scureapp.exe
C:\APPS\Powercinema\PCMService.exe
C:\apps\ABoard\ABoard.exe
C:\Programmi\QuickTime\qttask.exe
C:\Programmi\File comuni\Symantec Shared\ccApp.exe
C:\apps\ABoard\AOSD.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\APPS\SMP\SmpSys.exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe
C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe
C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Programmi\File comuni\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programmi\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Programmi\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Programmi\File comuni\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programmi\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [DetectorApp] C:\Programmi\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Programmi\File comuni\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [OmniPass] C:\Apps\Softex\OmniPass\scureapp.exe
O4 - HKLM\..\Run: [PCMService] "c:\APPS\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [osCheck] "C:\Programmi\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [NSS] "C:\Programmi\NortonInstaller\{397E31AA-0D78-4649-A01C-339D73A2ED35}\NSS\LicenseType\2.3.0.44\InstStub.exe" /RELAUNCH /RUNONCE /NOPROMPT /PRODID NSS
O4 - HKCU\..\Run: [SmpcSys] C:\APPS\SMP\SmpSys.exe
O4 - HKCU\..\Run: [InstallareEmule] D:\Documents and Settings\marco\Dati applicazioni\InstallareEmule.exe t
O4 - HKCU\..\Run: [updateMgr] "C:\Programmi\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKCU\..\Run: [swg] "C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FILECO~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Programmi\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Programmi\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/St ... b55579.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/Fac ... oader5.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - http://zone.msn.com/BinFrameWork/v10/ZB ... b55579.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZP ... b55579.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 5007647656
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 6286734187
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/A ... tPkMSN.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v ... b56649.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - http://zone.msn.com/binframework/v10/St ... b55579.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {F773E7B2-62A9-4524-9109-87D2F0BEFAA4} (ChessControl Class) - http://zone.msn.com/bingame/zpagames/zp ... b56961.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\VAScanner\comHost.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: Google Update Service (gupdate1c8f94afb9b5e7e) (gupdate1c8f94afb9b5e7e) - Google Inc. - C:\Programmi\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Programmi\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Softex Inc. - C:\Apps\Softex\OmniPass\Omniserv.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Programmi\File comuni\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: USBDeviceService - Unknown owner - C:\Programmi\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
O23 - Service: Utilità di pianificazione di LiveUpdate automatico - Symantec Corporation - C:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe

--
End of file - 12824 bytes

[gahan]

Non risultano infezioni.

[freetecno]

gahan, sono stato preso da altre attività alle quali, dopo essermi tranquillizzato per la soluzione virus, ho dato priorità maggiore. Non dimentico, però, di doverti ringraziare e molto. Sebbene mi occupi di sviluppo software ci sono argomenti estremamente destabilizzanti per me, come quello per il quale mi hai dato disponibilità e che non avrei potuto risolvere da solo.

Devo dire che non ho ancora rimesso in rete il pc in questione, ma di sicuro le operazioni anomale che prima effettuava non sono più presenti. Ho fatto la fesseria di non aggiornare per un po' di tempo l'antivirus e ne ho pagato le conseguenze.

Io sono a Roma. Se anche tu oppure ti trovassi a passare dalle mie parti manda un messaggio, potremmo incontrarci e avrei modo di ringraziarti di persona (freetecno@libero.it).
Buon tutto.

M.

[gahan]

Purtroppo non sono di Roma, tuttavia se dovesssi passare da quelle parti ti faccio sapere.

In ogni caso è stato un piacere aiutarti;

ciao e buona fortuna