virus Kazy.24502 e probabili suoi effetti

[=ele=]

Ciao a tutti,
qualche giorno fa il computer ha iniziato a fare cose strane (se aprivo internet e digitavo un indirizzo venivo prima mandata ad un altro sito non richiesto, skype non si apriva più e word neppure). Ho installato Bit Defender (ma avevo già Avira attivo) e ho fatto una scansione completa. Ha trovato parecchi virus (o malware, o qualsiasi sia il termine tecnico) e li ha eliminati quasi tutti tranne un certo Kazy.24502. Intanto internet ha smesso di funzionare del tutto e ho dovuto deselezionare l'uso del server proxy per farlo ripartire. Ho mandato un'email al servizio assistenza skype e mi hanno spiegato come fare a farlo rifunzionare.
Ora funziona praticamente tutto di nuovo, ma Avira (che sembra essersi risvegliato da quando ho installato BitDefender) continua a dirmi spessissimo che ha trovato tot. virus. Io ogni volta gli do il comando elimina, ma non sembra avere effetti perchè il messaggio continua a comparire. I file incriminati si chiamano sempre tmp seguiti da cifre diverse e come rilevamento Avira mi da: ADSPY/AdSpy.Gen.
Potrebbe essere questo virus Kazy che continua in qualche modo a creare dei file dannosi? Come faccio a sbarazzarmene?

Vi ringrazio per l'aiuto!

[Luke57]

Ciao, quale sistema operativo hai?

[=ele=]

Ho Windows 7.
(e intanto grazie della risposta )

[Luke57]

Ciao, scarica sul desktop
http://www.suspectfile.com/systemscan
aprilo ed assicurati che tutte le opzioni siano spuntate, clicca su "Scan Now" al termine della scansione verranno rilasciati (sempre sul desktop all'interno della cartella suspectfile) due file. Inserisci il file con estensione .zip in
http://wikisend.com/
fornisci in un successivo post il link che ti sarà dato dopo l'upload del file per poterlo vedere

[=ele=]

eccolo:

http://wikisend.com/download/128860/03_ ... report.zip

[Luke57]

Ciao, scarica ccleaner (per pulire file temporanei):
http://www.filehippo.com/download_ccleaner/
Una volta installato configuralo in questo modo:
lancia il programma, nel menu di sinistra portati alla voce Opzioni e nella finestra successiva clicca su:
Impostazioni, e spunta la voce Cancellazione sicura (lenta)
poi clicca su:
Avanzate, togli la spunta alla voce Cancella solo file più vecchi di 48 ore
alla voce Pulizia, nella sezione Avanzate spunta le voci Vecchi dati Prefetch
nel menu a sinistra, clicca sulla voce Pulizia
clicca su tasto Avvia pulizia per eseguire la scansione, al termine di essa, ripetila per sicurezza

Poi, per ulteriore controllo scarica combofix (prima disattiva l'antivrus)
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
salvalo sul desktop e disconnettiti dalla rete
Una volta posizionato il programma sul desktop incolla nello spazio bianco di esegui questo comando, cosi' com'e':

"%userprofile%\desktop\combofix.exe" /killall <==copia e incolla

Premi OK, partirà la scansione.Durante questa fase non fare assolutamente niente con il pc.
Apparirà una schermata di esonero garanzie sul software-clicca su si,
Apparirà una schermata (solo per chi usa windows xp) per installare la console di ripristino,clicca su no.
Al termine apparirà a schermo il log di combofix che potrai anche trovare in C:\combofix.txt .Inseriscilo in un post fra i tag [code][/code]

[=ele=]

al terzo tentativo combofix è riuscito a terminare l'operazione (ci ha messo parecchio tempo, non so se è indicativo). copio e incollo come mi hai detto:

Codice: Seleziona tutto

ComboFix 11-06-04.02 - newcity 04/06/2011  11:41:20.3.4 - x64
Microsoft Windows 7 Home Premium   6.1.7600.0.1252.39.1040.18.4014.1920 [GMT 2:00]
Eseguito da: c:\users\newcity\Desktop\combofix.exe
Opzioni usate :: /killall
AV: AntiVir Desktop *Disabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
AV: BitDefender Antivirus *Disabled/Updated* {50909708-FF80-02AF-F814-B28405891E92}
FW: BitDefender Firewall *Disabled* {68AB162D-B5EF-03F7-D34B-1BB1FB5A59E9}
SP: AntiVir Desktop *Disabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: BitDefender Antispyware *Disabled/Updated* {EBF176EC-D9BA-0D21-C2A4-89F67E0E542F}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((   Files Creati Da 2011-05-04 al 2011-06-04  )))))))))))))))))))))))))))))))))))
.
.
2011-06-04 09:59 . 2011-06-04 09:59   --------   d-----w-   c:\users\Default\AppData\Local\temp
2011-06-03 23:19 . 2011-06-03 23:19   0   ----a-w-   c:\windows\system32\wnlogon.sys
2011-06-03 21:55 . 2011-06-03 21:55   --------   d-----w-   c:\program files\CCleaner
2011-06-03 21:50 . 2011-06-03 21:50   --------   d-----w-   c:\users\newcity\AppData\Roaming\Reviversoft
2011-06-03 21:49 . 2011-06-03 21:49   --------   d-----w-   c:\program files (x86)\Reviversoft
2011-06-03 21:49 . 2011-05-17 12:51   18240   ----a-w-   c:\windows\system32\roboot64.exe
2011-05-28 18:21 . 2011-06-03 20:18   --------   d-----w-   c:\users\newcity\AppData\Roaming\go
2011-05-28 18:21 . 2011-06-03 20:38   --------   d-----w-   c:\programdata\Easybits GO
2011-05-27 13:01 . 2011-05-31 15:45   --------   d-----w-   c:\programdata\Skype Extras
2011-05-26 16:50 . 2011-05-26 16:50   --------   d-----w-   c:\program files (x86)\Common Files\Skype
2011-05-26 15:53 . 2011-05-26 15:53   --------   d-----w-   c:\users\newcity\AppData\Roaming\BitDefender
2011-05-26 15:53 . 2011-05-26 15:53   --------   d-----w-   c:\program files\BitDefender
2011-05-26 15:48 . 2011-05-26 15:55   --------   d-----w-   c:\programdata\BitDefender
2011-05-26 15:48 . 2011-05-26 15:53   --------   d-----w-   c:\program files\Common Files\BitDefender
2011-05-26 15:48 . 2010-07-09 12:08   388168   ----a-w-   c:\windows\system32\drivers\bdfsfltr.sys
2011-05-26 15:48 . 2011-05-26 15:55   65922   ----a-w-   c:\programdata\bdinstall.bin
2011-05-26 15:42 . 2011-05-27 20:36   --------   d-----w-   c:\users\newcity\AppData\Roaming\QuickScan
2011-05-26 14:49 . 2011-05-26 16:50   --------   d-----r-   c:\program files (x86)\Skype
2011-05-26 11:39 . 2011-05-26 11:39   --------   d-----w-   c:\windows\SysWow64\wbem\en-US
2011-05-26 11:39 . 2011-05-26 11:39   --------   d-----w-   c:\windows\system32\wbem\en-US
2011-05-26 11:29 . 2011-05-26 11:30   --------   d-----w-   c:\program files (x86)\Help
2011-05-25 07:16 . 2011-04-22 20:18   27008   ----a-w-   c:\windows\system32\drivers\Diskdump.sys
2011-05-24 10:16 . 2011-04-09 06:58   142336   ----a-w-   c:\windows\system32\poqexec.exe
2011-05-24 10:16 . 2011-04-09 05:56   123904   ----a-w-   c:\windows\SysWow64\poqexec.exe
2011-05-11 11:13 . 2011-04-09 06:45   5509504   ----a-w-   c:\windows\system32\ntoskrnl.exe
2011-05-11 11:13 . 2011-04-09 06:13   3957632   ----a-w-   c:\windows\SysWow64\ntkrnlpa.exe
2011-05-11 11:13 . 2011-04-09 06:13   3901824   ----a-w-   c:\windows\SysWow64\ntoskrnl.exe
2011-05-11 11:13 . 2011-03-25 03:23   343040   ----a-w-   c:\windows\system32\drivers\usbhub.sys
2011-05-11 11:13 . 2011-03-25 03:23   98816   ----a-w-   c:\windows\system32\drivers\usbccgp.sys
2011-05-11 11:13 . 2011-03-25 03:23   324608   ----a-w-   c:\windows\system32\drivers\usbport.sys
2011-05-11 11:13 . 2011-03-25 03:22   52224   ----a-w-   c:\windows\system32\drivers\usbehci.sys
2011-05-11 11:13 . 2011-03-25 03:22   25600   ----a-w-   c:\windows\system32\drivers\usbohci.sys
2011-05-11 11:13 . 2011-03-25 03:22   30720   ----a-w-   c:\windows\system32\drivers\usbuhci.sys
2011-05-11 11:13 . 2011-03-25 03:22   7936   ----a-w-   c:\windows\system32\drivers\usbd.sys
2011-05-09 21:15 . 2011-05-09 21:15   --------   d-----w-   c:\users\newcity\AppData\Local\{E716D4D9-B1F2-451E-AEF7-D3A0C264045E}
2011-05-07 17:41 . 2011-05-07 17:41   --------   d-----w-   c:\users\newcity\AppData\Local\{CE5DFE96-8366-4C58-A9BD-5C6FFCF3C424}
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-01 05:10 . 2011-04-01 05:10   539232   ----a-w-   c:\windows\SysWow64\LVUI2RC.dll
2011-04-01 05:10 . 2011-04-01 05:10   543328   ----a-w-   c:\windows\SysWow64\LVUI2.dll
2011-04-01 05:08 . 2011-04-01 05:08   301664   ----a-w-   c:\windows\SysWow64\lvcodec2.dll
2011-04-01 05:07 . 2011-04-01 05:07   4184672   ----a-w-   c:\windows\system32\drivers\lvuvc64.sys
2011-04-01 05:07 . 2011-04-01 05:07   559712   ----a-w-   c:\windows\system32\LVUIRC64.dll
2011-04-01 05:07 . 2011-04-01 05:07   767584   ----a-w-   c:\windows\system32\LVUI64.dll
2011-04-01 05:07 . 2011-04-01 05:07   10877272   ----a-w-   c:\windows\SysWow64\LogiDPP.dll
2011-04-01 05:07 . 2011-04-01 05:07   10877272   ----a-w-   c:\windows\system32\LogiDPP.dll
2011-04-01 05:07 . 2011-04-01 05:07   102744   ----a-w-   c:\windows\SysWow64\LogiDPPApp.exe
2011-04-01 05:07 . 2011-04-01 05:07   102744   ----a-w-   c:\windows\system32\LogiDPPApp.exe
2011-04-01 05:06 . 2011-04-01 05:06   331608   ----a-w-   c:\windows\SysWow64\DevManagerCore.dll
2011-04-01 05:06 . 2011-04-01 05:06   331608   ----a-w-   c:\windows\system32\DevManagerCore.dll
2011-04-01 05:06 . 2011-04-01 05:06   341856   ----a-w-   c:\windows\system32\drivers\lvrs64.sys
2011-04-01 05:05 . 2011-04-01 05:05   261728   ----a-w-   c:\windows\system32\lvco13251014.dll
2011-04-01 05:05 . 2011-04-01 05:05   172128   ----a-w-   c:\windows\system32\lvcod64.dll
2011-04-01 04:56 . 2011-04-01 04:56   39318   ----a-w-   c:\windows\system32\Repository.reg
2011-03-22 22:02 . 2011-03-22 22:02   15192   ----a-w-   c:\windows\system32\drivers\iKeyLFT264.dll
2011-03-12 12:03 . 2011-04-27 16:10   662528   ----a-w-   c:\windows\system32\XpsPrint.dll
2011-03-12 11:31 . 2011-04-27 16:10   442880   ----a-w-   c:\windows\SysWow64\XpsPrint.dll
2011-03-11 06:23 . 2011-04-27 16:10   187264   ----a-w-   c:\windows\system32\drivers\storport.sys
2011-03-11 06:23 . 2011-04-27 16:10   166272   ----a-w-   c:\windows\system32\drivers\nvstor.sys
2011-03-11 06:23 . 2011-04-27 16:10   1657216   ----a-w-   c:\windows\system32\drivers\ntfs.sys
2011-03-11 06:23 . 2011-04-27 16:10   148352   ----a-w-   c:\windows\system32\drivers\nvraid.sys
2011-03-11 06:23 . 2011-04-27 16:10   410496   ----a-w-   c:\windows\system32\drivers\iaStorV.sys
2011-03-11 06:22 . 2011-04-27 16:10   107904   ----a-w-   c:\windows\system32\drivers\amdsata.sys
2011-03-11 06:22 . 2011-04-27 16:10   27008   ----a-w-   c:\windows\system32\drivers\amdxata.sys
2011-03-11 06:19 . 2011-04-15 06:14   1359872   ----a-w-   c:\windows\system32\mfc42u.dll
2011-03-11 06:19 . 2011-04-15 06:14   1395712   ----a-w-   c:\windows\system32\mfc42.dll
2011-03-11 06:18 . 2011-04-27 16:10   2566144   ----a-w-   c:\windows\system32\esent.dll
2011-03-11 06:15 . 2011-04-27 16:10   96768   ----a-w-   c:\windows\system32\fsutil.exe
2011-03-11 05:40 . 2011-04-15 06:14   1164288   ----a-w-   c:\windows\SysWow64\mfc42u.dll
2011-03-11 05:40 . 2011-04-15 06:14   1137664   ----a-w-   c:\windows\SysWow64\mfc42.dll
2011-03-11 05:39 . 2011-04-27 16:10   1686016   ----a-w-   c:\windows\SysWow64\esent.dll
2011-03-11 05:37 . 2011-04-27 16:10   74240   ----a-w-   c:\windows\SysWow64\fsutil.exe
2011-03-09 08:41 . 2010-06-24 09:33   18328   ----a-w-   c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-03-08 06:14 . 2011-04-15 06:14   976896   ----a-w-   c:\windows\system32\inetcomm.dll
2011-03-08 05:38 . 2011-04-15 06:14   740864   ----a-w-   c:\windows\SysWow64\inetcomm.dll
2011-01-25 14:08 . 2011-01-25 14:08   425768   ------w-   c:\program files\iTunesPhotoProcessor.exe
2011-01-25 14:08 . 2011-01-25 14:08   294688   ----a-w-   c:\program files\iTunesOutlookAddIn.dll
2011-01-25 14:08 . 2011-01-25 14:08   216864   ----a-w-   c:\program files\iTunesPhotoProcessor.dll
2011-01-25 14:08 . 2011-01-25 14:08   421160   ----a-w-   c:\program files\iTunesHelper.exe
2011-01-25 14:08 . 2011-01-25 14:08   387368   ------w-   c:\program files\iTunesAdmin.dll
2011-01-25 14:08 . 2011-01-25 14:08   174368   ----a-w-   c:\program files\iTunesHelper.dll
2011-01-25 14:08 . 2011-01-25 14:08   9777448   ------w-   c:\program files\iTunes.exe
2011-01-25 14:08 . 2011-01-25 14:08   754976   ----a-w-   c:\program files\gnsdk_sdkmanager.dll
2011-01-25 14:08 . 2011-01-25 14:08   267552   ----a-w-   c:\program files\gnsdk_submit.dll
2011-01-25 14:08 . 2011-01-25 14:08   197920   ----a-w-   c:\program files\gnsdk_musicid.dll
2011-01-25 14:08 . 2011-01-25 14:08   18934048   ----a-w-   c:\program files\iTunes.dll
2011-01-25 14:08 . 2011-01-25 14:08   111912   ----a-w-   c:\program files\ITDetector.ocx
2011-01-25 14:08 . 2011-01-25 14:08   2733344   ----a-w-   c:\program files\gnsdk_dsp.dll
2010-07-08 07:37 . 2010-07-08 07:37   101544   ----a-w-   c:\program files\Common Files\LinkInstaller.exe
.
.
(((((((((((((((((((((((((((((   SnapShot@2011-06-03_23.34.32   )))))))))))))))))))))))))))))))))))))))))
.
- 2011-06-03 23:32 . 2011-06-03 23:32   13342              c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\SoftGrid Client\Icon Cache\icon_ex.dat
+ 2011-06-04 10:01 . 2011-06-04 10:01   13342              c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\SoftGrid Client\Icon Cache\icon_ex.dat
- 2009-07-14 04:54 . 2011-06-03 20:00   16384              c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2011-06-04 09:24   16384              c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2011-06-03 20:00   32768              c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-06-04 09:24   32768              c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-06-04 09:24   16384              c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2011-06-03 20:00   16384              c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-03-25 22:01 . 2011-06-04 10:04   74468              c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-06-04 10:04   42104              c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
- 2009-07-14 05:10 . 2011-06-03 20:02   42104              c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-09-18 15:59 . 2011-06-04 10:04   11906              c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2089545616-3809711562-2215708041-1000_UserData.bin
- 2010-05-11 10:42 . 2011-06-03 23:32   32768              c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-05-11 10:42 . 2011-06-04 10:02   32768              c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2011-06-03 23:32   16384              c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2011-06-04 10:02   16384              c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-03-25 22:06 . 2011-06-04 10:01   3155              c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Bluetooth\bthservsdp.dat
- 2010-03-25 22:06 . 2011-06-03 23:32   3155              c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Bluetooth\bthservsdp.dat
+ 2011-06-04 10:01 . 2011-06-04 10:01   2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-06-03 23:32 . 2011-06-03 23:32   2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-06-04 10:01 . 2011-06-04 10:01   2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2011-06-03 23:32 . 2011-06-03 23:32   2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2010-05-11 20:36 . 2011-06-04 09:29   699014              c:\windows\system32\perfh010.dat
- 2010-05-11 20:36 . 2011-06-03 20:07   699014              c:\windows\system32\perfh010.dat
+ 2009-07-14 02:36 . 2011-06-04 09:29   616452              c:\windows\system32\perfh009.dat
- 2009-07-14 02:36 . 2011-06-03 20:07   616452              c:\windows\system32\perfh009.dat
- 2010-05-11 20:36 . 2011-06-03 20:07   127950              c:\windows\system32\perfc010.dat
+ 2010-05-11 20:36 . 2011-06-04 09:29   127950              c:\windows\system32\perfc010.dat
- 2009-07-14 02:36 . 2011-06-03 20:07   106574              c:\windows\system32\perfc009.dat
+ 2009-07-14 02:36 . 2011-06-04 09:29   106574              c:\windows\system32\perfc009.dat
+ 2010-05-11 10:42 . 2011-06-04 10:02   327680              c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2010-05-11 10:42 . 2011-06-03 23:32   327680              c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 05:01 . 2011-06-03 23:32   460624              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2011-06-04 10:01   460624              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2011-05-27 00:23 . 2011-06-03 23:32   825218              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2089545616-3809711562-2215708041-1000-4096.dat
+ 2011-05-27 00:23 . 2011-06-04 10:01   825218              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2089545616-3809711562-2215708041-1000-4096.dat
+ 2011-05-26 16:27 . 2011-06-04 10:01   461392              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2089545616-3809711562-2215708041-1000-12288.dat
- 2011-05-26 16:27 . 2011-06-03 23:32   461392              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2089545616-3809711562-2215708041-1000-12288.dat
+ 2010-09-18 14:55 . 2011-06-04 10:01   3924956              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2089545616-3809711562-2215708041-1000-8192.dat
- 2010-09-18 14:55 . 2011-06-03 23:32   3924956              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2089545616-3809711562-2215708041-1000-8192.dat
- 2009-07-14 02:34 . 2011-06-03 07:18   10485760              c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
+ 2009-07-14 02:34 . 2011-06-04 09:40   10485760              c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
.
(((((((((((((((((((((((((((((((((((((   Punti Reg Caricati   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-05-11 39408]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072]
"Elbserver"="c:\program files (x86)\Sony\Media Gallery\ElbServer.exe" [2010-02-09 81328]
"googletalk"="c:\program files (x86)\Google\Google Talk\googletalk.exe" [2007-11-21 3293184]
"Logitech Vid"="c:\program files (x86)\Logitech\Vid HD\Vid.exe" [2010-10-29 5915480]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2009-11-20 284696]
"ISBMgr.exe"="c:\program files (x86)\Sony\ISB Utility\ISBMgr.exe" [2010-01-15 316784]
"PMBVolumeWatcher"="c:\program files (x86)\Sony\PMB\PMBVolumeWatcher.exe" [2010-01-21 597792]
"SHTtray.exe"="c:\program files (x86)\Common Files\Sony Shared\SOHLib\SHTtray.exe" [2010-02-24 99696]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2010-09-01 281768]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
"LWS"="c:\program files (x86)\Logitech\LWS\Webcam Software\LWS.exe" [2011-03-01 190808]
"iTunesHelper"="c:\program files\iTunesHelper.exe" [2011-01-25 421160]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2011\Antispam32\ieshow.exe" [2011-01-11 71216]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2010-3-12 1125152]
Evernote Clipper.lnk - c:\windows\Installer\{F761359C-9CED-45AE-9A51-9D6605CD55C4}\Evernote.ico [2011-1-6 293950]
Multi talen Woordenboek takenbalk.lnk - c:\program files (x86)\Easy Computing\Mult Talen Woordenboek\TrueTerm.exe [2011-2-1 532538]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages   REG_MULTI_SZ      kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Servizio di Google Update (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-11 135664]
R2 Roxio Upnp Server 10;Roxio Upnp Server 10;c:\program files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe [2009-11-25 362992]
R3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys [x]
R3 avc3;avc3;c:\windows\system32\DRIVERS\avc3.sys [x]
R3 avckf;avckf;c:\windows\system32\DRIVERS\avckf.sys [x]
R3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
R3 gupdatem;Servizio Google Update (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-11 135664]
R3 LVPr2M64;Logitech LVPr2M64 Driver;c:\windows\system32\DRIVERS\LVPr2M64.sys [x]
R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys [x]
R3 LVUVC64;Logitech Webcam 250(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys [x]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 Roxio UPnP Renderer 10;Roxio UPnP Renderer 10;c:\program files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [2009-11-25 313840]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 Update Server;BitDefender Update Server v2;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe [2010-11-30 467248]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [2010-02-19 115568]
R3 WatAdminSvc;Servizio Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S1 Bdfndisf;BitDefender Firewall NDIS 6 Filter Driver;c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [2010-08-20 88144]
S1 bdfwfpf;bdfwfpf;c:\program files\Common Files\BitDefender\BitDefender Firewall\bdfwfpf.sys [2010-08-20 99408]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-02-28 821664]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2009-11-20 13336]
S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [2009-10-24 360224]
S2 regi;regi;c:\windows\system32\drivers\regi.sys [x]
S2 rimspci;rimspci;c:\windows\system32\drivers\rimssne64.sys [x]
S2 risdsnpe;risdsnpe;c:\windows\system32\drivers\risdsne64.sys [x]
S2 SampleCollector;VAIO Care Performance Service;c:\program files\Sony\VAIO Care\VCPerfService.exe [2011-01-29 259192]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2010-04-23 483688]
S2 SOHCImp;VAIO Media plus Content Importer;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [2010-02-24 108400]
S2 SOHDms;VAIO Media plus Digital Media Server;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe [2010-02-24 422768]
S2 SOHDs;VAIO Media plus Device Searcher;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [2010-02-24 67952]
S2 uCamMonitor;CamMonitor;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [2008-09-18 104960]
S2 UMVPFSrv;UMVPFSrv;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [2011-04-01 428640]
S2 Updatesrv;BitDefender Desktop Update Service;c:\program files\BitDefender\BitDefender 2011\updatesrv.exe [2011-02-11 53224]
S2 VCFw;VAIO Content Folder Watcher;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2010-03-18 852336]
S2 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2010-02-19 529776]
S2 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [2010-02-19 386416]
S2 VSNService;VSNService;c:\program files\Sony\VAIO Smart Network\VSNService.exe [2010-08-11 845312]
S3 BDFM;BDFM;c:\windows\system32\DRIVERS\bdfm.sys [x]
S3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys [x]
S3 NETw5s64;Driver scheda Intel(R) Wireless WiFi Link per Windows 7 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [x]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]
S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\drivers\SFEP.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2010-04-23 209768]
S3 SpfService;VAIO Entertainment Common Service;c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService.exe [2010-02-08 302448]
S3 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe [2010-01-20 574320]
S3 VCService;VCService;c:\program files\Sony\VAIO Care\VCService.exe [2011-02-14 44736]
S3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update 5\VUAgent.exe [2010-04-09 1223024]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]
.
.
Contenuto della cartella 'Scheduled Tasks'
.
2011-06-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-11 10:47]
.
2011-06-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-11 10:47]
.
2011-06-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2089545616-3809711562-2215708041-1000Core.job
- c:\users\newcity\AppData\Local\Google\Update\GoogleUpdate.exe [2011-05-04 21:57]
.
2011-06-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2089545616-3809711562-2215708041-1000UA.job
- c:\users\newcity\AppData\Local\Google\Update\GoogleUpdate.exe [2011-05-04 21:57]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-02-22 16397416]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-02-25 10060320]
"Apoint"="c:\program files (x86)\Apoint\Apoint.exe" [BU]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2011\ieshow.exe" [2011-01-11 76360]
"BDAgent"="c:\program files\BitDefender\BitDefender 2011\bdagent.exe" [2011-05-26 2023072]
.
------- Scansione supplementare -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
uInternet Settings,ProxyServer = http=127.0.0.1:57152
IE: Add to Evernote 4.0 - c:\program files (x86)\Evernote\Evernote\EvernoteIE.dll/204
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
IE: Invia immagine alla periferica &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Invia pagina alla periferica &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: {{A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://c:\program files (x86)\Evernote\Evernote\EvernoteIE.dll/204
TCP: DhcpNameServer = 192.168.0.1
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SampleCollector]
"ImagePath"="\"c:\program files\Sony\VAIO Care\VCPerfService.exe\" \"/service\" \"/sstates\" \"/sampleinterval=5000\" \"/procinterval=5\" \"/dllinterval=120\" \"/counter=\Processor(_Total)\% Processor Time:1/counter=\PhysicalDisk(_Total)\Disk Bytes/sec:1\" \"/counter=\Network Interface(*)\Bytes Total/sec:1\" \"/expandcounter=\Processor Information(*)\Processor Frequency:1\" \"/expandcounter=\Processor(*)\% Idle Time:1\" \"/expandcounter=\Processor(*)\% C1 Time:1\" \"/expandcounter=\Processor(*)\% C2 Time:1\" \"/expandcounter=\Processor(*)\% C3 Time:1\" \"/expandcounter=\Processor(*)\% Processor Time:1\" \"/directory=c:\programdata\Sony Corporation\VAIO Care\inteldata\""
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\program files (x86)\Avira\AntiVir Desktop\sched.exe
c:\program files\BitDefender\BitDefender 2011\Antispam32\pchooklaunch32.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files (x86)\Sony\VAIO Event Service\VESMgr.exe
c:\windows\SysWOW64\DllHost.exe
c:\program files (x86)\Sony\VAIO Event Service\VESMgrSub.exe
c:\windows\SysWOW64\RunDll32.exe
c:\program files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\program files\Sony\VAIO Care\listener.exe
c:\program files\Sony\VAIO Personalization Manager\VpmIfPav.exe
.
**************************************************************************
.
Ora fine scansione: 2011-06-04  12:39:56 - Il pc è stato riavviato
ComboFix-quarantined-files.txt  2011-06-04 10:39
ComboFix2.txt  2011-06-03 23:41
.
Pre-Run: 376.754.556.928 byte disponibili
Post-Run: 376.470.659.072 byte disponibili
.
- - End Of File - - 0B10687AEE4775DD02898A02B4D9C4B1


[Luke57]

Ciao, scusa il ritardo; hai sempre la segnalazione di antivir?

[=ele=]

per ora non l'ha più fatto... il computer è guarito?

[Luke57]

Ciao, il report pare a posto.

[=ele=]

Grazie millissime E' già la seconda volta che mi salvi e non so davvero come ringraziarti!!

[=ele=]

Oh no, ho cantato vittoria troppo presto.. i messaggi di avira sono tornati! Caro Luke57, ti prego aiutami tu!

[Luke57]

Ciao, scarica
• Malwarebytes

http://download.cnet.com/Malwarebytes-A ... 04572.html


dopo averlo installato è necessario aggiornarlo e solo dopo eseguire la scansione completa del sistema, è altresì richiesto eliminare tutti gli oggetti identificati e salvare il log della scansione (il file di log da allegare per il controllo si trova nel Tab "File di log").Il file di log va salvato solamente dopo aver eliminato gli oggetti.
2) Scarica TDSS killer e salvalo sul desktop.
http://support.kaspersky.com/downloads/ ... killer.exe
Estrai il contenuto sul desktop.Doppio click su
TDSSKILLER.exe per avviare l'applicazione e poi su start scan.
Se un file infetto viene trovato,l'azione di default sarà cure,clicca su continua.
Se un file sospetto viene trovato,l'azione di default sarà skip,clicca su continua.
Se ti viene chiesto di riavviare il pc completa il processo.Clicca su riavvia ora.
Se nessun riavvio è richiesto clicca su report e salva il contenuto in un file di testo.
Se un riavvio è richiesto il report si trova in C:\folder in questa forma "TDSSKiller.[Version]_[Date]_[Time]_log.txt".

Inserisci il report di malwsrebytes e quello di tdsskiller su wikisend come hai fatto con il report di systemscan.

[=ele=]

Ciao, fatto.. il primo programma ha trovato file infetti e li ha eliminati, il secondo invece sembra non aver trovato niente. Ti mando i due link ai report. Intanto, Avira continua imperterrito a mandarmi messaggi di rilevamento malware.. ho anche provato a disinstallarlo e reinstallarlo, ma niente

malwarebytes: http://wikisend.com/download/264686/mbam-log-2011-06-05 (18-14-21).txt

TDSSKiller: http://wikisend.com/download/238210/TDS ... 20_log.txt

[Luke57]

Ciao, mi sono accorto adesso che nel report di combofix c'è qualcosa che non va:
apri un file di testo con il blocco note di windows, al suo interno copia e incolla il seguente script:

File::
c:\windows\system32\wnlogon.sys

salva il file nel desktop, chiamandolo obbligatoriamente CFScript.txt
Trascinalo con il puntatore del mouse sull'icona di combofix, il programma avvierà una nuova scansione, al termine inserisci nuovamente il report che rilascerà in modo da poterlo vedere.

Poi scarica dr.web cureit da qui:
http://www.freedrweb.com/download+cureit/gr/?lng=en
segui queste indicazioni per l'utilizzo del programma:
http://www.ilsoftware.it/articoli.asp?id=6382

Alla fine, inserisci su wikisend (come hai fatto con systemscan) il report della scansione

[=ele=]

Ciao, scusa il ritardo!

Ho fatto.. metto entrambi i file su wikisend.

Combofix: http://wikisend.com/download/456568/log combofix2.txt

Dr. Web: http://wikisend.com/download/328478/CureIt.log

Dr. Web non ha trovato niente, però ho fatto solo la scansione rapida. Devo fare anche l'altra? (l'ho avviato nella modalità di blocco del desktop comunque)

Che succede al mio computer? In ogni caso grazie infinite del tuo tempo!

[Luke57]

Ciao, esegui la scansione completa con cureit.

[=ele=]

Ciao, finalmente ha finito... ci ha messo 24 ore esatte :/

Ecco il log: http://wikisend.com/download/487530/CureIt2.log

Comunque non ha trovato nessun virus. Non è che potrebbero semplicemente essere i due antivirus a darsi fastidio a vicenda? Magari c'era un virus, che BitDefender o qualche altro programma da te consigliatomi ha eliminato, e ora ad Avira semplicemente da fastidio la presenza di Bit Defender? (supposizioni senza basi tecniche..)

[Luke57]

Ciao, non so, disistalla bitdefender, poi come ultimo controllo scarica Rsit da qui:

http://images.malwareremoval.com/random/RSIT.exe

avvialo ed eseguilo

Se Hijackthis (versione aggiornata) non é già presente nel sistema, RSIT lo scarica e dovrai accettare la sua licenza
Al termine saranno redatti due log, log.txt e info.txt che troverai nella cartella creata dal programma C:\rsit.exe

Inseriscili su wikisend, come per gli altri log.

[=ele=]

Eccoli:

http://wikisend.com/download/292420/log.txt

http://wikisend.com/download/287488/info.txt