Pagine che si aprono da sole.

[davide72]

salva sul desktop http://wikisend.com/download/806904/fixlist.txt , poi esegui FRST e clicca su fix

[Tatanka]

ciao
anch'io mi sono appestata con qualcosa che mi apre delle pagine pubblicitarie con i browser.
Ecco i miei file:
http://wikisend.com/download/349540/Addition.txt
http://wikisend.com/download/607886/FRST.txt

mi fate capire come funziona la pulizia?

Io ho notato che la dir Wsis32 è stata inserita il giorno che ho fatto il danno, non basta cancellarla?

Ho anche questa dir che non so cosa sia: C:\Users\Tata\AppData\Local\Retuthertazward, rimuovo?

grazie in anticipo a chi mi darà una mano

tata

[Luke57]

Ciaao, scarica adwcleaner da qui:
http://www.bleepingcomputer.com/download/adwcleaner/

lo metti sul desktop, lo avvii, premi Scan.
Al termine della scansione, premi Clean, confermando con Ok le opzioni successive.
Al riavvio del computer, copia e incolla in un post il report rilasciato.

[Tatanka]

ok fatto. Questo è l'output
# AdwCleaner v6.020 - Creato file registro eventi 16/09/2016 in 12:24:37
# Aggiornato su 14/09/2016 da ToolsLib
# Database : 2016-09-15.2 [Server]
# Sistema operativo : Windows 10 Pro (X64)
# Utente : Tata - TATA-PC
# In esecuzione da : C:\Users\Tata\Desktop\AdwCleaner.exe
# Modo: pulizia
# Supporto : https://toolslib.net/forum



***** [ Servizi ] *****



***** [ Cartelle ] *****

[-] Cartella eliminata: C:\Users\Tata\AppData\LocalLow\AskToolbar
[-] Cartella eliminata: C:\Users\Tata\AppData\Roaming\RPEng
[-] Cartella eliminata: C:\Users\Tata\AppData\Roaming\GameLauncher\Seviler


***** [ File ] *****

[-] File eliminato: C:\Program Files (x86)\Mozilla Firefox\wtsapi32.dll
[-] File eliminato: C:\Program Files (x86)\Google\Chrome\Application\wtsapi32.dll


***** [ DLL ] *****



***** [ WMI ] *****



***** [ Collegamenti ] *****



***** [ Attività pianificate ] *****



***** [ Registro ] *****

[-] Chiave eliminata: HKLM\SOFTWARE\Classes\OCComSDK.ComSDK
[-] Chiave eliminata: HKLM\SOFTWARE\Classes\OCComSDK.ComSDK.1
[#] Chiave eliminata al riavvio: [x64] HKLM\SOFTWARE\Classes\OCComSDK.ComSDK
[#] Chiave eliminata al riavvio: [x64] HKLM\SOFTWARE\Classes\OCComSDK.ComSDK.1
[-] Chiave eliminata: HKLM\SOFTWARE\Classes\CLSID\{3CCC052E-BDEE-408A-BEA7-90914EF2964B}
[-] Chiave eliminata: HKLM\SOFTWARE\Classes\CLSID\{61F47056-E400-43D3-AF1E-AB7DFFD4C4AD}
[-] Chiave eliminata: HKLM\SOFTWARE\Classes\CLSID\{E2B98EEA-EE55-4E9B-A8C1-6E5288DF785A}
[-] Chiave eliminata: HKLM\SOFTWARE\Classes\CLSID\{B9D64D3B-BE75-4FA2-B94A-C4AE772A0146}
[-] Chiave eliminata: HKLM\SOFTWARE\Classes\CLSID\{47A1DF02-BCE4-40C3-AE47-E3EA09A65E4A}
[-] Chiave eliminata: HKLM\SOFTWARE\Classes\CLSID\{95E84BD3-3604-4AAC-B2CA-D9AC3E55B64B}
[-] Chiave eliminata: HKLM\SOFTWARE\Classes\Interface\{FA7B2795-C0C8-4A58-8672-3F8D80CC0270}
[-] Chiave eliminata: HKLM\SOFTWARE\Classes\Interface\{47A1DF02-BCE4-40C3-AE47-E3EA09A65E4A}
[-] Chiave eliminata: HKLM\SOFTWARE\Classes\TypeLib\{1112F282-7099-4624-A439-DB29D6551552}
[-] Chiave eliminata: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BD6ECB00-7C4A-4F97-B425-44117F2A7AAE}
[-] Chiave eliminata: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95E84BD3-3604-4AAC-B2CA-D9AC3E55B64B}
[-] Chiave eliminata: HKU\S-1-5-21-2499405340-4166306687-3534985506-1001\Software\distromatic
[-] Chiave eliminata: HKU\S-1-5-21-2499405340-4166306687-3534985506-1001\Software\IM
[-] Chiave eliminata: HKU\S-1-5-21-2499405340-4166306687-3534985506-1001\Software\COMMONMSG
[#] Chiave eliminata al riavvio: HKCU\Software\distromatic
[#] Chiave eliminata al riavvio: HKCU\Software\IM
[#] Chiave eliminata al riavvio: HKCU\Software\COMMONMSG
[-] Chiave eliminata: HKLM\SOFTWARE\trotuxSoftware
[#] Chiave eliminata al riavvio: [x64] HKCU\Software\distromatic
[#] Chiave eliminata al riavvio: [x64] HKCU\Software\IM
[#] Chiave eliminata al riavvio: [x64] HKCU\Software\COMMONMSG
[-] Chiave eliminata: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\euask.com
[-] Chiave eliminata: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\piroga.space
[-] Chiave eliminata: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\piroga.space
[#] Chiave eliminata al riavvio: [x64] HKCU\Software\Microsoft\Internet Explorer\DOMStorage\euask.com
[#] Chiave eliminata al riavvio: [x64] HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\piroga.space
[#] Chiave eliminata al riavvio: [x64] HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\piroga.space


***** [ Browser ] *****


però il problema persiste.

la dir WSIS32 c'è ancora
:'(

[Tatanka]

il browser firefox l'avevo disinstallato, ma chrome no, infatti è chrome che mi dà problemi...

[Luke57]

Apri il blocco note, al suo interno copia e incolla il seguente script:


GroupPolicy: Restriction - Chrome <======= ATTENTION
2016-09-09 15:24 - 2016-09-09 15:24 - 00000046 _____ C:\WINDOWS\Joberphlusisp
2016-09-09 15:24 - 2016-09-09 15:24 - 00000000 ____D C:\Users\Tata\AppData\Local\Retuthertazward
Task: {047A61F0-18B1-4A1F-AA7F-4D84297AFE13} - \Microsoft\Windows\Setup\GWXTriggers\OnIdle-5d -> No File <==== ATTENTION
Task: {1FAA413A-1ED9-4E82-8B54-A08D66765280} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {2C44CACB-5CA1-4B52-B41E-9619E9EDA4E5} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {2FCEA300-D1BA-406C-955E-BC212C544701} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime -> No File <==== ATTENTION
Task: {32FAE560-DF6F-462E-AD84-CB6C26E509F5} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime -> No File <==== ATTENTION
Task: {47A6E4B5-3EA8-4F90-8103-A5C1E534F96E} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {49428FE9-BD4B-41EF-B875-B4527674FA2C} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {4B67D03A-6E2C-4C25-8E40-9155CBE96D8B} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {72DF7118-3628-4FBE-874E-F2B10049618E} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {9924F016-44FE-4D35-BE47-F8F6E3F4A27C} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {AFEE87F5-E80D-4A06-B367-67FC6C90D1A3} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {B9305E93-3D8C-499E-901A-86C7521D36BC} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {C11D6938-829B-4299-94EF-2F22C9F0AD5F} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {671CF3DD-DE04-4577-BE83-C1B4E49297DB} - System32\Tasks\UnregisterNonABICompliantCodeRange => C:\PROGRA~2\npqE79E\rc7E7BE.bat <==== ATTENTION
Task: {6CB01CFF-E2DD-4C51-81C9-3F83E69FB0C7} - System32\Tasks\SysUrlSH => C:\Wsis32\urlSH\Release\sysWIN_SHW.exe
Empytemp:

chiamalo fixlist.txt e salvalo nel desktop, su cui sposterai anche il tool FRST.exe (ambedue devono essere sul desktop).
Apri FRST.exe e premi il tasto fix.
Al termine posta il report fixlog.txt prodotto

[Tatanka]

sono mortificata, ho rifatto la procedura perchè mi si è riavviato il pc per degli update e mi sa che ho sovrascritto il log.
lo posto ugualmente:

Fix result of Farbar Recovery Scan Tool (x64) Version: 16-09-2016
Ran by Tata (16-09-2016 14:12:26) Run:2
Running from C:\Users\Tata\Desktop
Loaded Profiles: Tata (Available Profiles: Tata & DefaultAppPool)
Boot Mode: Normal
==============================================

fixlist content:
*****************

GroupPolicy: Restriction - Chrome <======= ATTENTION
2016-09-09 15:24 - 2016-09-09 15:24 - 00000046 _____ C:\WINDOWS\Joberphlusisp
2016-09-09 15:24 - 2016-09-09 15:24 - 00000000 ____D C:\Users\Tata\AppData\Local\Retuthertazward
Task: {047A61F0-18B1-4A1F-AA7F-4D84297AFE13} - \Microsoft\Windows\Setup\GWXTriggers\OnIdle-5d -> No File <==== ATTENTION
Task: {1FAA413A-1ED9-4E82-8B54-A08D66765280} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {2C44CACB-5CA1-4B52-B41E-9619E9EDA4E5} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {2FCEA300-D1BA-406C-955E-BC212C544701} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime -> No File <==== ATTENTION
Task: {32FAE560-DF6F-462E-AD84-CB6C26E509F5} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime -> No File <==== ATTENTION
Task: {47A6E4B5-3EA8-4F90-8103-A5C1E534F96E} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {49428FE9-BD4B-41EF-B875-B4527674FA2C} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {4B67D03A-6E2C-4C25-8E40-9155CBE96D8B} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {72DF7118-3628-4FBE-874E-F2B10049618E} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {9924F016-44FE-4D35-BE47-F8F6E3F4A27C} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {AFEE87F5-E80D-4A06-B367-67FC6C90D1A3} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {B9305E93-3D8C-499E-901A-86C7521D36BC} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {C11D6938-829B-4299-94EF-2F22C9F0AD5F} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {671CF3DD-DE04-4577-BE83-C1B4E49297DB} - System32\Tasks\UnregisterNonABICompliantCodeRange => C:\PROGRA~2\npqE79E\rc7E7BE.bat <==== ATTENTION
Task: {6CB01CFF-E2DD-4C51-81C9-3F83E69FB0C7} - System32\Tasks\SysUrlSH => C:\Wsis32\urlSH\Release\sysWIN_SHW.exe
Empytemp:

*****************

"C:\WINDOWS\system32\GroupPolicy\Machine" => not found.
"C:\WINDOWS\Joberphlusisp" => not found.
"C:\Users\Tata\AppData\Local\Retuthertazward" => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{047A61F0-18B1-4A1F-AA7F-4D84297AFE13} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OnIdle-5d => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1FAA413A-1ED9-4E82-8B54-A08D66765280} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxcontent => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2C44CACB-5CA1-4B52-B41E-9619E9EDA4E5} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Time-5d => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2FCEA300-D1BA-406C-955E-BC212C544701} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{32FAE560-DF6F-462E-AD84-CB6C26E509F5} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{47A6E4B5-3EA8-4F90-8103-A5C1E534F96E} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\launchtrayprocess => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{49428FE9-BD4B-41EF-B875-B4527674FA2C} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfig => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4B67D03A-6E2C-4C25-8E40-9155CBE96D8B} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Logon-5d => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{72DF7118-3628-4FBE-874E-F2B10049618E} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9924F016-44FE-4D35-BE47-F8F6E3F4A27C} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AFEE87F5-E80D-4A06-B367-67FC6C90D1A3} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B9305E93-3D8C-499E-901A-86C7521D36BC} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C11D6938-829B-4299-94EF-2F22C9F0AD5F} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{671CF3DD-DE04-4577-BE83-C1B4E49297DB} => key not found.
C:\WINDOWS\System32\Tasks\UnregisterNonABICompliantCodeRange => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\UnregisterNonABICompliantCodeRange => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6CB01CFF-E2DD-4C51-81C9-3F83E69FB0C7} => key not found.
C:\WINDOWS\System32\Tasks\SysUrlSH => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SysUrlSH => key not found.
Empytemp: => Error: No automatic fix found for this entry.

==== End of Fixlog 14:12:28 ====

comunque il problema persiste
:-(

[Luke57]

Ciao, quindi in teoria le voci non sono più presenti perché cancellate dal fix precedente l'update?
Ripeti uno scan con FRST.exe

[Tatanka]

temo di sì.
Per maggiore info: il danno l'ho fatti in data 9/9/2016. Quel giorno ho fatto solo quello, quindi tutto ciò che risulta installato/modificato in quella data si può cancellare, come quella strana directory Wsis32

http://wikisend.com/download/183726/Addition.txt
http://wikisend.com/download/608602/FRST.txt

grazie

[Luke57]

Ciao, nel file fixlist.txt copia e incolla il seguente script:

2016-09-09 15:25 - 2016-09-09 15:25 - 00003492 _____ C:\WINDOWS\System32\Tasks\SysUrlHL
2016-09-09 15:25 - 2016-09-09 15:25 - 00000000 ____D C:\Wsis32
2016-09-09 15:24 - 2016-09-09 15:24 - 00008948 _____ C:\WINDOWS\System32\Tasks\Anofotion Collector
Empytemp:

solito fix da frst.exe, dopo aver messo anche fixlist.exe sul desktop.

[Tatanka]

fatto tutto
ecco il log:
Fix result of Farbar Recovery Scan Tool (x64) Version: 16-09-2016
Ran by Tata (16-09-2016 17:08:07) Run:3
Running from C:\Users\Tata\Desktop
Loaded Profiles: Tata (Available Profiles: Tata & DefaultAppPool)
Boot Mode: Normal
==============================================

fixlist content:
*****************

2016-09-09 15:25 - 2016-09-09 15:25 - 00003492 _____ C:\WINDOWS\System32\Tasks\SysUrlHL
2016-09-09 15:25 - 2016-09-09 15:25 - 00000000 ____D C:\Wsis32
2016-09-09 15:24 - 2016-09-09 15:24 - 00008948 _____ C:\WINDOWS\System32\Tasks\Anofotion Collector
Empytemp:

*****************

C:\WINDOWS\System32\Tasks\SysUrlHL => moved successfully
C:\Wsis32 => moved successfully
C:\WINDOWS\System32\Tasks\Anofotion Collector => moved successfully
Empytemp: => Error: No automatic fix found for this entry.

==== End of Fixlog 17:08:07 ====

ma la rogna permane.
provo un reboot

[Luke57]

Guarda se quella cartella in C è effettivamente eliminata

https://productforums.google.com/forum/ ... qZ3h7wEQAJ

[Tatanka]

mammamia che lotta!
Ho risolto (almeno così sembra).
La cartella malefica era stata eliminata ma il problema permaneva.
Qiundi ho rimosso tutto quello che ho trovato che avesse la stessa data del danno, o la va o la spacca. In particolare ho trovato il file chrome.bat nella cartella /programmi (x86)/Google/chrome/Application modificato, ed il contenuto era:

start "" /I /B /D"C:\PROGRA~2\Google\Chrome\APPLIC~1\""C:\PROGRA~2\Google\Chrome\APPLIC~1\chrome.exe"
"http://mir2sk1.com/882Bh"
(che corrispondeva l'indirizzo che appariva per un attimo su chrome prima di aprire le pagine del gioco d'azzardo).
Ho cancellato il bat e reinstallato chrome.

Sembra tutto ok, anche rilanciando FRST i log sembrano più puliti.

Vi ringrazio tantissimo per la disponibilità.
grazie!!
(e speriamo che non succeda più)

[Luke57]

Bravissima! E grazie per il feedback

[marsenmax]

ragazzi buonasera stesso problema sto uscendo pazzo, stavo cercando su google il problema me lo da sia su opera firefox chrome e ie , ho letto il vostro post spero che possiate aiutarmi in anticipo grazie mille... intanto ho provveduto a cancellare la cartella C:\Wsis32
Addition.txt
FRST.txt

[shel]

ciao hai un attivatore per office ti consiglio di rimuoverlo al piu' presto per la sicurezza del tuo pc

ora apri la cartella Downloads e trascina il programma frst sul desktop, fatto questo salva questo file sul desktop apri frst e clicca fix, dopo il riavvio troverai un file fixlog.txt che dovrai allegare

[marsenmax]

fatto come mi hai scritto, quando ho aperto mozilla mi da ancora quelle due pagine 0.0.0.2 in opera 0.0.0.4 chrome 0.0.0.1
Fixlog.txt

[shel]

scarica Junkware Removal Tool da qui >> http://www.majorgeeks.com/mg/get/junkwa ... ool,1.html
clicca sull'icona di JRT e attendi pazientemente la fine della scansione
Una volta terminata dovrebbe aprirsi il log sul desktop come JRT.txt
Allegalo poi ripeti la scansione con Farbar recovery scan tool, se non c'e' la spunta su addition.txt mettila prima di avviare la scansione e allega i due report

[marsenmax]

niente
JRT.txt

[marsenmax]

Addition.txt
FRST.txt