8FFBE65D-2C9C-4669-84BD-5829DC0B603C come eliminarlo?

[vincy59]

Da molto tempo ho problemi con il computer; si blocca, è lento. Oggi, per caso ho notato che su "cronologia esplorazioni impostazione file temporanei - visualizza oggetti -download program files- c'è questa serie strana 8FFBE65D-2C9C-4669-84BD-5829DC0B603C e cercando su internet ho scoperto che è un virus. Mi potete spiegare "passo-passo" come eliminarlo? non sono molto esperta. Ho fatto scansione con Advances Sistem Care e con IOBit Security 360 ma non ho risolto nulla.
Grazie

[shel]

ciao

Scarica questo programma :
http://www.trendsecure.com/portal/en-US ... kthis.php#
e mettilo nella directory C dove avrai preparato una cartella con il suo nome.
Lanci l'eseguibile e clicchi su " do a system scan and save a log" alla fine salvi questo file con estensione *.TXT e lo alleghi ad un post sul forum.

[vincy59]

Fatto
Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 11.57.53, on 14/01/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16945)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Programmi\IObit\IObit Security 360\IS360srv.exe
C:\WINDOWS\system32\carpserv.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Programmi\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\wfxsnt40.exe
C:\Programmi\D-Link\AirPlus G\AirGCFG.exe
C:\Programmi\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Programmi\Google\Quick Search Box\GoogleQuickSearchBox.exe
C:\Programmi\Java\jre6\bin\jusched.exe
C:\Programmi\IObit\IObit Security 360\IS360tray.exe
C:\Programmi\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\IObit\Advanced SystemCare 3\AWC.exe
C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Programmi\Java\jre6\bin\jqs.exe
C:\Programmi\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Programmi\AVG\AVG8\avgcsrvx.exe
C:\Programmi\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\alg.exe
C:\Programmi\internet explorer\iexplore.exe
C:\Programmi\Windows Live\Toolbar\wltuser.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\msiexec.exe
C:\Programmi\TrendMicro\HiJackThis\HiJackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: IObitCom Toolbar - {31c7d459-9cc3-44f2-9dca-fc11795309b4} - C:\Programmi\IObitCom\tbIObi.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IObitCom Toolbar - {31c7d459-9cc3-44f2-9dca-fc11795309b4} - C:\Programmi\IObitCom\tbIObi.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programmi\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programmi\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programmi\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmi\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Programmi\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Programmi\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programmi\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: IObitCom Toolbar - {31c7d459-9cc3-44f2-9dca-fc11795309b4} - C:\Programmi\IObitCom\tbIObi.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programmi\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Programmi\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [PE2CKFNT SE] C:\Programmi\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe
O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe
O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Programmi\D-Link\AirPlus G\AirGCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Programmi\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Programmi\Google\Quick Search Box\GoogleQuickSearchBox.exe" /autorun
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [IObit Security 360] "C:\Programmi\IObit\IObit Security 360\IS360tray.exe" /autostart
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmi\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Programmi\IObit\Advanced SystemCare 3\AWC.exe" /startup
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Programmi\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: Inserisci blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programmi\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: Inserisci &blog in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programmi\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 6394180031
O17 - HKLM\System\CCS\Services\Tcpip\..\{F4D307EE-B554-4D1E-936E-D826D61D7916}: NameServer = 85.37.17.39 85.38.28.71
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programmi\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Programmi\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Servizio di Google Update (gupdate1ca4128ce09348c) (gupdate1ca4128ce09348c) - Google Inc. - C:\Programmi\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: IS360service - IObit - C:\Programmi\IObit\IObit Security 360\IS360srv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmi\Java\jre6\bin\jqs.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 9871 bytes

[shel]

ho controllato il log ma non sembra esserci nessuna infezione

questo programma lo riconosci? >>>>> IObitCom

Lancia HiJackThis -> Clicca Do a scan only -> Metti la spunta a fianco delle righe che ti segnalo qui sotto -> Clicca su Fix Checked

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)


Scarica ed installa CCleaner: clicca qui per il download
http://www.filehippo.com/download_ccleaner/

durante l’installazione deseleziona l’opzione per la barra di Yahoo, lo apri, vai in Opzioni>Avanzate, togli la spunta a “Cancella file temp diwindows solo se più vecchi di 48 ore”, poi avvialo, seleziona "Analizza" ed alla fine dell'analisi premi "Avvia pulizia''

clicca su Registro, nella pagina successiva clicca Trova problemi, poi al termine dello scan clicca su Ripara selezionati , risposndi di sì alla richiesta di salvare il backup (salvalo in una cartella a piacimento) poi ripara tutti gli elementi trovati.


scarica Atfcleaner

http://www.atribune.org/ccount/click.php?id=1

Avvia ATFCleaner.exe con un doppio click

1) seleziona la casella Select All
2) clicca sul pulsante Empty selected
3) aspetta l'avviso Done Cleaning
(se usi opera o firefox,spunta anche le loro sezioni)



Esegui questa scansione

scarica Malwarebytes


http://www.malwarebytes.org/mbam/program/mbam-setup.exe



1) lo installi
2) lo aggiorni
3) fai una scansione scegliendo la modalità completa
4) NON eliminare le eventuali minacce che rileva
5) finita la scansione seleziona il tabellino log, apri il file di testo e postalo sul forum

[vincy59]

Per l'ennesima volta mi si è bloccato il computer e l'ho dovuto riavviare.
IObit è un antivirus
Eseguo quanto hai scritto

[vincy59]

Purtroppo non porta a termine la scansione con Malwarebyte e ha trovato 2 virus. Ho provato 2 volte ma si blocca.
Cosa devo fare?

[shel]

Scarica questo e vedi se malwarebytes funziona
http://kixhelp.com/wr/files/mb/randmbam.exe

[vincy59]

OK ha fatto la scansione

Malwarebytes' Anti-Malware 1.44
Versione del database: 3559
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

14/01/2010 23.23.43
mbam-log-2010-01-14 (23-23-20).txt

Tipo di scansione: Scansione completa (C:\|)
Elementi scansionati: 191056
Tempo trascorso: 1 hour(s), 10 minute(s), 43 second(s)

Processi delle memoria infetti: 0
Moduli della memoria infetti: 0
Chiavi di registro infette: 0
Valori di registro infetti: 0
Elementi dato del registro infetti: 0
Cartelle infette: 0
File infetti: 2

Processi delle memoria infetti:
(Nessun elemento malevolo rilevato)

Moduli della memoria infetti:
(Nessun elemento malevolo rilevato)

Chiavi di registro infette:
(Nessun elemento malevolo rilevato)

Valori di registro infetti:
(Nessun elemento malevolo rilevato)

Elementi dato del registro infetti:
(Nessun elemento malevolo rilevato)

Cartelle infette:
(Nessun elemento malevolo rilevato)

File infetti:
C:\Documents and Settings\Desk\Documenti\Downloads\PCOptimizer_setup.exe (Adware.NaviPromo) -> No action taken.
C:\Qoobox\Quarantine\C\Programmi\ShoppingReport\Bin\2.5.0\ShoppingReport.dll.vir (Adware.Shopper) -> No action taken.

[shel]

ultimamente hai usato combofix?

elimina quello che malwarebytes ha trovato

[vincy59]

Si, l'ho usato circa 6 mesi fa x eliminare NaviPromo.

[shel]

se lo hai installato ancora, eliminalo in questo modo
Clicca su start>esegui nella finestra di dialogo, copia ed incolla questo comando: Combofix /Uninstall

scaricalo nuovamente

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
- disconnetiti da internet
- disattiva l'antivirus
- esegui ComboFix.exe
- digita 1
- segui le instruzioni
- finita la scansione portati in C:\ e copia/incolla, nella tua prossima risposta, il contenuto del file di testo Combofix.txt

[vincy59]

Fatto

ComboFix 10-01-15.05 - Desk 16/01/2010 14.01.21.3.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.39.1040.18.511.142 [GMT 1:00]
Eseguito da: c:\documents and settings\Desk\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Creati Da 2009-12-16 al 2010-01-16 )))))))))))))))))))))))))))))))))))
.

2010-01-14 12:01 . 2010-01-14 12:01 -------- d-----w- c:\documents and settings\Desk\Dati applicazioni\Malwarebytes
2010-01-14 12:01 . 2010-01-14 12:01 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Malwarebytes
2010-01-14 10:56 . 2010-01-14 10:56 -------- d-----w- c:\programmi\TrendMicro
2010-01-14 10:53 . 2010-01-14 10:54 -------- d-----w- C:\HijackThis
2010-01-10 15:55 . 2010-01-10 15:55 -------- d-----w- c:\programmi\VIA Technologies, Inc
2010-01-10 15:55 . 2003-07-04 22:14 32768 ----a-w- c:\windows\system32\UnAudioNT.dll
2010-01-10 14:45 . 2009-11-21 15:54 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2009-12-20 18:07 . 2009-12-23 22:04 -------- d-----w- c:\programmi\WinDS PRO
2009-12-19 10:17 . 2009-12-19 10:19 -------- d-----w- c:\documents and settings\Desk\Dati applicazioni\HpUpdate
2009-12-19 10:17 . 2009-12-19 10:17 -------- d-----w- c:\windows\Hewlett-Packard

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-16 12:46 . 2010-01-14 23:29 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\avg9
2010-01-14 23:29 . 2010-01-15 12:47 3776280 ----a-w- c:\documents and settings\All Users\Dati applicazioni\avg9\update\backup\setup.exe
2010-01-14 23:29 . 2010-01-15 12:47 3967256 ----a-w- c:\documents and settings\All Users\Dati applicazioni\avg9\update\backup\avgcorex.dll
2010-01-14 23:29 . 2010-01-15 12:47 2352920 ----a-w- c:\documents and settings\All Users\Dati applicazioni\avg9\update\backup\avgresf.dll
2010-01-14 23:29 . 2010-01-15 12:47 4043032 ----a-w- c:\documents and settings\All Users\Dati applicazioni\avg9\update\backup\avgui.exe
2010-01-14 23:29 . 2010-01-15 12:47 2033432 ----a-w- c:\documents and settings\All Users\Dati applicazioni\avg9\update\backup\avgtray.exe
2010-01-14 23:29 . 2010-01-15 12:47 916248 ----a-w- c:\documents and settings\All Users\Dati applicazioni\avg9\update\backup\avgcfgx.dll
2010-01-14 23:29 . 2008-11-11 09:48 -------- d-----w- c:\programmi\AVG
2010-01-14 20:57 . 2009-03-16 17:41 -------- d-----w- c:\documents and settings\Desk\Dati applicazioni\gtk-2.0
2010-01-05 10:39 . 2008-11-11 09:45 90800 ----a-w- c:\documents and settings\Desk\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2009-12-19 10:18 . 2008-11-15 13:31 -------- d-----w- c:\programmi\HP
2009-12-13 11:56 . 2009-12-13 11:56 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\IObit
2009-12-13 11:56 . 2009-09-20 17:05 -------- d-----w- c:\programmi\IObit
2009-12-10 09:47 . 2003-04-08 12:00 80730 ----a-w- c:\windows\system32\perfc010.dat
2009-12-10 09:47 . 2003-04-08 12:00 482354 ----a-w- c:\windows\system32\perfh010.dat
2009-11-24 09:15 . 2009-03-16 13:08 -------- d-----w- c:\programmi\Java
2009-11-24 09:12 . 2009-11-24 09:12 152576 ----a-w- c:\documents and settings\Desk\Dati applicazioni\Sun\Java\jre1.6.0_17\lzma.dll
2009-11-24 09:11 . 2009-11-23 13:12 79488 ----a-w- c:\documents and settings\Desk\Dati applicazioni\Sun\Java\jre1.6.0_17\gtapi.dll
2009-11-21 15:54 . 2003-04-08 12:00 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-11-15 13:07 . 2009-11-15 13:07 2232 ----a-w- c:\windows\java\Packages\Data\J5VN9V9Z.DAT
2009-11-15 13:07 . 2009-11-15 13:07 155995 ----a-w- c:\windows\java\Packages\9NRHJDJJ.ZIP
2009-11-15 13:07 . 2009-11-15 13:07 2678 ----a-w- c:\windows\java\Packages\Data\MNJP3J35.DAT
2009-11-15 13:07 . 2009-11-15 13:07 2678 ----a-w- c:\windows\java\Packages\Data\SLJHZBHV.DAT
2009-11-15 13:07 . 2009-11-15 13:07 2678 ----a-w- c:\windows\java\Packages\Data\8EYZJR1V.DAT
2009-11-15 13:07 . 2009-11-15 13:07 2678 ----a-w- c:\windows\java\Packages\Data\FTR3J5F7.DAT
2009-11-15 13:07 . 2009-11-15 13:07 2678 ----a-w- c:\windows\java\Packages\Data\1FFN97HV.DAT
2009-11-04 15:49 . 2009-11-11 15:41 635664 ----a-w- c:\documents and settings\Desk\Dati applicazioni\IObit\Common\TB_Helper.exe
2009-10-29 07:42 . 2003-04-08 12:00 832512 ----a-w- c:\windows\system32\wininet.dll
2009-10-29 07:42 . 2008-11-11 09:32 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-10-29 07:42 . 2003-04-08 12:00 17408 ----a-w- c:\windows\system32\corpol.dll
2009-10-21 05:38 . 2008-11-11 09:32 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-21 05:38 . 2008-11-11 09:32 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-20 16:20 . 2008-11-17 20:21 265728 ----a-w- c:\windows\system32\drivers\http.sys
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\programmi\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CARPService"="carpserv.exe" [2001-12-23 4608]
"HP Software Update"="c:\programmi\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"PE2CKFNT SE"="c:\programmi\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe" [1998-07-03 25088]
"WinFaxAppPortStarter"="wfxsnt40.exe" [2001-09-10 45568]
"D-Link AirPlus G"="c:\programmi\D-Link\AirPlus G\AirGCFG.exe" [2006-11-17 1552384]
"ANIWZCS2Service"="c:\programmi\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2006-06-29 49152]
"Google Quick Search Box"="c:\programmi\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-09-12 122368]
"Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"SunJavaUpdateSched"="c:\programmi\Java\jre6\bin\jusched.exe" [2009-10-11 149280]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
HP Digital Imaging Monitor.lnk - c:\programmi\HP\Digital Imaging\bin\hpqtra08.exe [2005-12-15 282624]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^Photo Express Calendar Checker SE.lnk]
path=c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\Photo Express Calendar Checker SE.lnk
backup=c:\windows\pss\Photo Express Calendar Checker SE.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Desk^Menu Avvio^Programmi^Esecuzione automatica^CTI Tray Icon.lnk]
path=c:\documents and settings\Desk\Menu Avvio\Programmi\Esecuzione automatica\CTI Tray Icon.lnk
backup=c:\windows\pss\CTI Tray Icon.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 02:14 1695232 ----a-w- c:\programmi\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2009-07-26 15:44 3883856 ----a-w- c:\programmi\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 10:50 155648 ----a-r- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VoipStunt]
2007-12-13 15:31 8824112 ----a-w- c:\programmi\VoipStunt.com\VoipStunt\VoipStunt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WFXSwtch]
2001-09-10 18:03 27648 ----a-w- c:\progra~1\Symantec\WinFax\WFXSWTCH.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\VoipStunt.com\\VoipStunt\\VoipStunt.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmi\\Metin2_Italiano\\metin2.bin"=
"c:\\Programmi\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Documents and Settings\\Desk\\Desktop\\Simone\\Emule\\eMule\\emule.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programmi\\Windows Live\\Sync\\WindowsLiveSync.exe"=

R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [29/03/2009 13.57.53 54752]
S2 gupdate1ca4128ce09348c;Servizio di Google Update (gupdate1ca4128ce09348c);c:\programmi\Google\Update\GoogleUpdate.exe [29/09/2009 18.17.57 133104]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\documents and settings\Desk\Desktop\everestultimate_build_1990\kerneld.wnt [10/01/2010 17.23.05 27760]
S3 fsssvc;Servizio Windows Live Family Safety;c:\programmi\Windows Live\Family Safety\fsssvc.exe [05/08/2009 22.48.42 704864]
.
Contenuto della cartella 'Scheduled Tasks'

2010-01-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2009-09-29 17:17]

2010-01-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2009-09-29 17:17]

2010-01-15 c:\windows\Tasks\WebReg Deskjet F300 series.job
- c:\programmi\HP\Digital Imaging\bin\hpqwrg.exe [2005-12-15 15:45]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\programmi\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
.
- - - - CHIAVI ORFANE RIMOSSE - - - -

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-16 14:07
Windows 5.1.2600 Service Pack 3 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver]
"ImagePath"="\??\c:\documents and settings\Desk\Desktop\everestultimate_build_1990\kerneld.wnt"
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•Ñw*]
"0140211900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------

- - - - - - - > 'winlogon.exe'(492)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(864)
c:\windows\system32\WININET.dll
.
Ora fine scansione: 2010-01-16 14:11:00
ComboFix-quarantined-files.txt 2010-01-16 13:10
ComboFix2.txt 2009-05-20 17:02

Pre-Run: 54.500.872.192 byte disponibili
Post-Run: 54.564.802.560 byte disponibili

- - End Of File - - 41CF157BBAE87EA5A1519B847BD327CB

[shel]

il log sembra a posto

ma hai due antivirus? disinstalla IObit e lascia avg - fagli fare una scansione completa dopo averlo aggiornato e posta il rapporto

[vincy59]

Iobit l'ho disinstallato prima di eseguire Combofix. Per quanto riguarda AVG blocca sempre la scansione e non la porta a termine

[shel]

hai provato a disinstallarlo avg? sarebbe anche un'occasione per provare avira, per me e' molto piu' selettivo e piu' leggero

per disinstallare avg prova con questo

http://www.grisoft.cz/filedir/util/avg_ ... emover.exe

[vincy59]

Si oggi l'ho disinstallato e installato la versione nuova. In questo momento sto facendo un altro tentativo dopo di che provo con Avira.
Ma se il log è a posto cosa può essere questo 8FFBE65D-2C9C-4669-84BD-5829DC0B603C e perchè mi si blocca il computer in continuazione?

[vincy59]

Stranamente AVG non si è bloccato
Questo è Il rapporto
"C:\WINDOWS\system32\401COMUPD.EXE";"Il file è firmato con una firma digitale danneggiata, emessa da: Microsoft Corporation.";""

[vincy59]

Il computer continua a bloccarsi. AVG non termina la scansione; l'ho disinstallato e ho installato AVIRA che non porta a termine la scansione. Sono disperata