aiuto....avvio pc pagine internet

[christiancek]

AIUTOOOOOO.....quando avvio il pc mi si aprono delle pagine internet con l'indirizzo click.vnn.bz ecc ecc......che faccio?
questo è il log di hijack this:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16.27.00, on 03/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\a-squared Free\a2service.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe
C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Virtual CD v4 SDK\system\vcssecs.exe
C:\Programmi\Java\jre1.6.0_05\bin\jusched.exe
C:\Programmi\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\File comuni\Mediafour\MACVNTFY.EXE
C:\Programmi\Philips\Philips Device Manager\Bin\DeviceManager.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Programmi\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Macrogaming\SweetIM\SweetIM.exe
C:\Programmi\RamCleaner\RamCleaner.exe
C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O1 - Hosts: 1.1 www.windrivesafe.com ## added by CiD
O1 - Hosts: 127..1 www.windrivesafe.com ## added by CiD
O1 - Hosts: .1 w
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Programmi\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [MediafourGettingStartedWithMacDrive6] "C:\Programmi\Mediafour\MacDrive\MacDrive.exe" /runonce
O4 - HKLM\..\Run: [Mediafour Mac Volume Notifications] "C:\Programmi\File comuni\Mediafour\MACVNTFY.EXE" /auto
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Programmi\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PhilipsDM] C:\Programmi\Philips\Philips Device Manager\Bin\DeviceManager.exe OS_STARTUP
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [default settings support the] C:\Documents and Settings\All Users\Dati applicazioni\meet tray default settings\stupid media.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SweetIM] C:\Programmi\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [RamCleaner] C:\Programmi\RamCleaner\RamCleaner.exe
O4 - HKCU\..\Run: [NBJ] "C:\Programmi\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programmi\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [Philips Intelligent Agent] "C:\Programmi\Philips Intelligent Agent\Philips Intelligent Agent.exe" /SILENT
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [browseabout] C:\DOCUME~1\CHRIST~1\DATIAP~1\UPMEMO~1\drv web title.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &eBay Search - res://C:\Programmi\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: Aggiungi all'elenco di stampa Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Anteprima Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Invia a &Bluetooth - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie_ctx.htm
O8 - Extra context menu item: Stampa ad alta velocità Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Stampa Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Crea preferito portatile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Organizzatore ricerche - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Programmi\File comuni\Microsoft Shared\Encarta Researcher\EROProj.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\it.htm
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programmi\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://christiancek.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/IT-IT/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1160897138515
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://mariavergine-christian.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab55762.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab55579.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab55200.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: MacDrive-iTunes compatibility - C:\Programmi\File comuni\Mediafour\MacDriveiTunesPatch.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Programmi\a-squared Free\a2service.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avagnt - Unknown owner - C:\WINDOWS\system32\avagnt.exe (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programmi\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Programmi\Virtual CD v4 SDK\system\vcssecs.exe

--
End of file - 11965 bytes

[xcdegasp]

log rimosso, leggere le Regole di Sezione (http://www.hwupgrade.it/forum/showthread.php?t=1589984)


Segui la semplice procedura descritta in Guida alla Disinfezione per Infetti (http://www.hwupgrade.it/forum/showthread.php?t=1599737) e pubblica tutti i log richiesti facendo attenzione alle Regole di Sezione, così potremmo aiutarti :)

[christiancek]

va bene così?
chi è che mi aiuta?
che log devo togliere?

[wjmat]

Segui la GUIDA alla DISINFEZIONE per INFETTI, per diminuire i files da scansionare fai prima una bella pulizia con ccleaner (http://www.hwupgrade.it/forum/showthread.php?t=1599737)


Poi carica i log da questo sito (http://www.fileup.itadib.com/index.php)
clicca su sfoglia,poi invia e poi ti copi tutto il contenuto della riga [BB CODE] e lo incolli nella risposta (se al posto di "Clicca qui per scaricare" ci metti il nome del log, è il top ;))

E controlla di avere i programmi a rischio aggiornati su questo link (http://secunia.com/software_inspector/)

[christiancek]

niente...ho eseguito le scansioni con prevx csi
adsr
ma niente....prevx non ha trovato niente...mentre adsr ha trovato qualcosa e l'ha eliminato...
il log di hijack this ora è questo:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19.41.57, on 03/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\a-squared Free\a2service.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe
C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Virtual CD v4 SDK\system\vcssecs.exe
C:\Programmi\Java\jre1.6.0_05\bin\jusched.exe
C:\Programmi\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\File comuni\Mediafour\MACVNTFY.EXE
C:\Programmi\Philips\Philips Device Manager\Bin\DeviceManager.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Programmi\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Macrogaming\SweetIM\SweetIM.exe
C:\Programmi\RamCleaner\RamCleaner.exe
C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
C:\Programmi\Windows Live\Messenger\msnmsgr.exe
C:\Programmi\Windows Live\Messenger\usnsvc.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Programmi\PrevxCSI\PrevxCSI.exe
C:\Programmi\PrevxCSI\PrevxCSI.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O1 - Hosts: 1.1 www.windrivesafe.com ## added by CiD
O1 - Hosts: 127..1 www.windrivesafe.com ## added by CiD
O1 - Hosts: .1 w
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Programmi\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [MediafourGettingStartedWithMacDrive6] "C:\Programmi\Mediafour\MacDrive\MacDrive.exe" /runonce
O4 - HKLM\..\Run: [Mediafour Mac Volume Notifications] "C:\Programmi\File comuni\Mediafour\MACVNTFY.EXE" /auto
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Programmi\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PhilipsDM] C:\Programmi\Philips\Philips Device Manager\Bin\DeviceManager.exe OS_STARTUP
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [default settings support the] C:\Documents and Settings\All Users\Dati applicazioni\meet tray default settings\stupid media.exe
O4 - HKLM\..\Run: [PrevxCSI] "C:\Programmi\PrevxCSI\prevxcsi.exe" /bootupreg
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SweetIM] C:\Programmi\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [RamCleaner] C:\Programmi\RamCleaner\RamCleaner.exe
O4 - HKCU\..\Run: [NBJ] "C:\Programmi\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programmi\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [Philips Intelligent Agent] "C:\Programmi\Philips Intelligent Agent\Philips Intelligent Agent.exe" /SILENT
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [browseabout] C:\DOCUME~1\CHRIST~1\DATIAP~1\UPMEMO~1\drv web title.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &eBay Search - res://C:\Programmi\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: Aggiungi all'elenco di stampa Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Anteprima Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Invia a &Bluetooth - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie_ctx.htm
O8 - Extra context menu item: Stampa ad alta velocità Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Stampa Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Crea preferito portatile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Organizzatore ricerche - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Programmi\File comuni\Microsoft Shared\Encarta Researcher\EROProj.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\it.htm
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programmi\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://christiancek.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/IT-IT/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1160897138515
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://mariavergine-christian.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab55762.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab55579.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab55200.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: MacDrive-iTunes compatibility - C:\Programmi\File comuni\Mediafour\MacDriveiTunesPatch.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Programmi\a-squared Free\a2service.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avagnt - Unknown owner - C:\WINDOWS\system32\avagnt.exe (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
O23 - Service: CSIScanner - Prevx - C:\Programmi\PrevxCSI\\PrevxCSI.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programmi\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Programmi\Virtual CD v4 SDK\system\vcssecs.exe

--
End of file - 12260 bytes

[wjmat]

dal log di hijackthis si vede che hai dentro un pò di porcherie....
fai la scansione con a-squared e kaspersky online e posta i log
ciao

[murack83pa]

aggiungo questo:

1- fixa queste voci(fai ripartire di nuovo hijackthis, selezioni le voci che ti indico qui sotto e poi clicca su fix checked)

O1 - Hosts: 1.1 www.windrivesafe.com ## added by CiD
O1 - Hosts: 127..1 www.windrivesafe.com ## added by CiD
O1 - Hosts: .1 w
O23 - Service: avagnt - Unknown owner - C:\WINDOWS\system32\avagnt.exe (file missing)


nuovo log di hijackthis

2- fai analizzare su www.virustotal.com questi file:
C:\Documents and Settings\All Users\Dati applicazioni\meet tray default settings\stupid media.exe
C:\DOCUME~1\CHRIST~1\DATIAP~1\UPMEMO~1\drv web title.exe

posta il link del report della scansione su virustotal di ciascun file...

conosci quei file?

3- asquared rigorosamente in deep scan, di tutto il pc, log in formato .txt

4- fai la scansione con gmer e posta il log in formato .txt

5- fai la scansione online con kaspersky di tutto il pc, impiegherà ore, ma c serve, salva la pagina del report in html

visto il log di hijackthis, c serve necessariamente il log di prevx csi, sempre rigorosamente in formato .txt

[christiancek]

aggiungo questo:

2- fai analizzare su www.virustotal.com questi file:


posta il link del report della scansione su virustotal di ciascun file...

conosci quei file?



non so proprio cosa siano..mai installato cose del genere....inoltre il sito che hai postato non riesce a trovare i file .exe e poi l'ultimo file ha la parola "drv" e questa mi esce sempre in mezzo all'indirizzo in cui il pc si collega all'accensione

[christiancek]

nuovo log hijack this
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23.47.01, on 03/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\a-squared Free\a2service.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe
C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
C:\Programmi\PrevxCSI\PrevxCSI.exe
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Virtual CD v4 SDK\system\vcssecs.exe
C:\Programmi\Java\jre1.6.0_05\bin\jusched.exe
C:\Programmi\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\File comuni\Mediafour\MACVNTFY.EXE
C:\Programmi\Philips\Philips Device Manager\Bin\DeviceManager.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Programmi\PrevxCSI\PrevxCSI.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Programmi\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Macrogaming\SweetIM\SweetIM.exe
C:\Programmi\RamCleaner\RamCleaner.exe
C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Programmi\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [MediafourGettingStartedWithMacDrive6] "C:\Programmi\Mediafour\MacDrive\MacDrive.exe" /runonce
O4 - HKLM\..\Run: [Mediafour Mac Volume Notifications] "C:\Programmi\File comuni\Mediafour\MACVNTFY.EXE" /auto
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Programmi\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PhilipsDM] C:\Programmi\Philips\Philips Device Manager\Bin\DeviceManager.exe OS_STARTUP
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [default settings support the] C:\Documents and Settings\All Users\Dati applicazioni\meet tray default settings\stupid media.exe
O4 - HKLM\..\Run: [PrevxCSI] "C:\Programmi\PrevxCSI\prevxcsi.exe" /bootupreg
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SweetIM] C:\Programmi\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [RamCleaner] C:\Programmi\RamCleaner\RamCleaner.exe
O4 - HKCU\..\Run: [NBJ] "C:\Programmi\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programmi\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [Philips Intelligent Agent] "C:\Programmi\Philips Intelligent Agent\Philips Intelligent Agent.exe" /SILENT
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [browseabout] C:\DOCUME~1\CHRIST~1\DATIAP~1\UPMEMO~1\drv web title.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &eBay Search - res://C:\Programmi\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: Aggiungi all'elenco di stampa Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Anteprima Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Invia a &Bluetooth - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie_ctx.htm
O8 - Extra context menu item: Stampa ad alta velocità Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Stampa Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Crea preferito portatile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Organizzatore ricerche - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Programmi\File comuni\Microsoft Shared\Encarta Researcher\EROProj.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\it.htm
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programmi\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://christiancek.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/IT-IT/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1160897138515
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://mariavergine-christian.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab55762.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab55579.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab55200.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: MacDrive-iTunes compatibility - C:\Programmi\File comuni\Mediafour\MacDriveiTunesPatch.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Programmi\a-squared Free\a2service.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
O23 - Service: CSIScanner - Prevx - C:\Programmi\PrevxCSI\\PrevxCSI.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programmi\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Programmi\Virtual CD v4 SDK\system\vcssecs.exe

--
End of file - 11939 bytes

log prevxcsi:
http://www.fileden.com/files/2007/9/28/1466969/prevxcsi.txt

[christiancek]

scansione asquared in deepscan:
http://www.fileden.com/files/2007/9/28/1466969/a2scan_080404-145340.txt

[xcdegasp]

il resto dei log?

[christiancek]

log di GMER
GMER 1.0.14.14205 - http://www.gmer.net
Rootkit scan 2008-04-04 18:52:34
Windows 5.1.2600 Service Pack 2


---- System - GMER 1.0.14 ----

SSDT sptd.sys ZwCreateKey [0xF777FAC8]
SSDT sptd.sys ZwEnumerateKey [0xF777FC22]
SSDT sptd.sys ZwEnumerateValueKey [0xF777FF9A]
SSDT sptd.sys ZwOpenKey [0xF777F98E]
SSDT sptd.sys ZwQueryKey [0xF7780064]
SSDT sptd.sys ZwQueryValueKey [0xF777FEFC]
SSDT sptd.sys ZwSetValueKey [0xF77800EC]

---- Kernel code sections - GMER 1.0.14 ----

? C:\WINDOWS\system32\drivers\sptd.sys Impossibile accedere al file. Il file è utilizzato da un altro processo.
? C:\WINDOWS\System32\Drivers\SPTD5453.SYS Impossibile accedere al file. Il file è utilizzato da un altro processo.
.text dtscsi.sys!A0DB34FC6FE35D429A28ADDE5467D4D7 F714F4F0 16 Bytes [ 0A, C8, FB, 49, 1C, 1F, 93, ... ]
.text dtscsi.sys!A0DB34FC6FE35D429A28ADDE5467D4D7 + 11 F714F501 31 Bytes [ E0, 14, F7, 2F, 67, 33, A3, ... ]
? C:\WINDOWS\System32\Drivers\dtscsi.sys Impossibile accedere al file. Il file è utilizzato da un altro processo.

---- User code sections - GMER 1.0.14 ----

.text C:\Programmi\Windows Live\Messenger\msnmsgr.exe[4016] kernel32.dll!LoadResource 7C809FB5 7 Bytes JMP 28001CD0 C:\Programmi\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programmi\Windows Live\Messenger\msnmsgr.exe[4016] kernel32.dll!FindResourceExW 7C80AC88 7 Bytes JMP 28001B10 C:\Programmi\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programmi\Windows Live\Messenger\msnmsgr.exe[4016] kernel32.dll!FindResourceW 7C80BBCE 7 Bytes JMP 28001A90 C:\Programmi\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programmi\Windows Live\Messenger\msnmsgr.exe[4016] kernel32.dll!SizeofResource 7C80BC69 7 Bytes JMP 28001D90 C:\Programmi\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programmi\Windows Live\Messenger\msnmsgr.exe[4016] kernel32.dll!FindResourceA 7C80BE89 7 Bytes JMP 28001BA0 C:\Programmi\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programmi\Windows Live\Messenger\msnmsgr.exe[4016] kernel32.dll!LockResource 7C80CC97 5 Bytes JMP 28001E00 C:\Programmi\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programmi\Windows Live\Messenger\msnmsgr.exe[4016] kernel32.dll!CreateEventA 7C8308AD 5 Bytes JMP 28001850 C:\Programmi\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programmi\Windows Live\Messenger\msnmsgr.exe[4016] kernel32.dll!FindResourceExA 7C835F78 7 Bytes JMP 28001C30 C:\Programmi\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programmi\Windows Live\Messenger\msnmsgr.exe[4016] kernel32.dll!SetUnhandledExceptionFilter 7C84467D 5 Bytes JMP 0056DBBD C:\Programmi\Windows Live\Messenger\msnmsgr.exe (Windows Live Messenger/Microsoft Corporation)
.text C:\Programmi\Windows Live\Messenger\msnmsgr.exe[4016] kernel32.dll!OutputDebugStringW 7C85A42D 5 Bytes JMP 28001E60 C:\Programmi\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programmi\Windows Live\Messenger\msnmsgr.exe[4016] ADVAPI32.dll!CryptDeriveKey 77F5A685 7 Bytes JMP 28001000 C:\Programmi\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programmi\Windows Live\Messenger\msnmsgr.exe[4016] ADVAPI32.dll!CryptDecrypt 77F5A7B1 2 Bytes JMP 28001060 C:\Programmi\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programmi\Windows Live\Messenger\msnmsgr.exe[4016] ADVAPI32.dll!CryptDecrypt + 3 77F5A7B4 4 Bytes [ 0A, B0, CC, CC ]
.text C:\Programmi\Windows Live\Messenger\msnmsgr.exe[4016] USER32.dll!PeekMessageW 7E39929B 5 Bytes JMP 280040C0 C:\Programmi\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programmi\Windows Live\Messenger\msnmsgr.exe[4016] USER32.dll!CreateWindowExW 7E39FC25 5 Bytes JMP 28003850 C:\Programmi\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programmi\Windows Live\Messenger\msnmsgr.exe[4016] USER32.dll!SetWindowRgn 7E39FFB2 7 Bytes JMP 280059A0 C:\Programmi\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programmi\Windows Live\Messenger\msnmsgr.exe[4016] USER32.dll!LoadIconW 7E3A0894 5 Bytes JMP 280062B0 C:\Programmi\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programmi\Windows Live\Messenger\msnmsgr.exe[4016] USER32.dll!LoadImageW 7E3A2CFE 5 Bytes JMP 280060C0 C:\Programmi\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programmi\Windows Live\Messenger\msnmsgr.exe[4016] USER32.dll!CreateDialogParamW 7E3A7D4F 5 Bytes JMP 28005AC0 C:\Programmi\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programmi\Windows Live\Messenger\msnmsgr.exe[4016] USER32.dll!SetWindowPlacement 7E3AD84C 5 Bytes JMP 28005860 C:\Programmi\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programmi\Windows Live\Messenger\msnmsgr.exe[4016] USER32.dll!MessageBoxIndirectW 7E3E62AB 5 Bytes JMP 28005CB0 C:\Programmi\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programmi\Windows Live\Messenger\msnmsgr.exe[4016] USER32.dll!TrackPopupMenuEx 7E3ECD28 5 Bytes JMP 280049A0 C:\Programmi\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programmi\Windows Live\Messenger\msnmsgr.exe[4016] WS2_32.dll!send 71A3428A 5 Bytes JMP 2800A2C0 C:\Programmi\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programmi\Windows Live\Messenger\msnmsgr.exe[4016] WS2_32.dll!WSARecv 71A34318 5 Bytes JMP 2800A0A0 C:\Programmi\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programmi\Windows Live\Messenger\msnmsgr.exe[4016] WS2_32.dll!recv 71A3615A 5 Bytes JMP 28009F00 C:\Programmi\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programmi\Windows Live\Messenger\msnmsgr.exe[4016] WS2_32.dll!WSASend 71A36233 5 Bytes JMP 2800A4A0 C:\Programmi\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programmi\Windows Live\Messenger\msnmsgr.exe[4016] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 2800A6E0 C:\Programmi\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programmi\Windows Live\Messenger\msnmsgr.exe[4016] SHELL32.dll!Shell_NotifyIconW 7CA361F5 5 Bytes JMP 28003000 C:\Programmi\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programmi\Windows Live\Messenger\msnmsgr.exe[4016] ole32.dll!CoInitializeEx 774CEF6B 5 Bytes JMP 28002110 C:\Programmi\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programmi\Windows Live\Messenger\msnmsgr.exe[4016] ole32.dll!CoRegisterClassObject 774E8720 5 Bytes JMP 28002210 C:\Programmi\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programmi\Windows Live\Messenger\msnmsgr.exe[4016] WININET.dll!InternetCloseHandle 4330DAC1 5 Bytes JMP 28009110 C:\Programmi\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programmi\Windows Live\Messenger\msnmsgr.exe[4016] WININET.dll!HttpOpenRequestA 43314399 5 Bytes JMP 28008DD0 C:\Programmi\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programmi\Windows Live\Messenger\msnmsgr.exe[4016] WININET.dll!InternetReadFile 4331ABF4 5 Bytes JMP 28008F60 C:\Programmi\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programmi\Windows Live\Messenger\msnmsgr.exe[4016] WININET.dll!HttpSendRequestA 4331CD78 5 Bytes JMP 28009040 C:\Programmi\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)

---- Kernel IAT/EAT - GMER 1.0.14 ----

IAT \WINDOWS\system32\hal.dll[ntoskrnl.exe!IoReadPartitionTable] [F7B670AA] MDPMGRNT.sys (Mediafour MacDrive Partition Manager/Mediafour Corporation)
IAT \WINDOWS\system32\hal.dll[ntoskrnl.exe!IoWritePartitionTable] [F7B67D78] MDPMGRNT.sys (Mediafour MacDrive Partition Manager/Mediafour Corporation)
IAT pci.sys[ntoskrnl.exe!IoDetachDevice] [F778889E] sptd.sys
IAT pci.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F779ED86] sptd.sys
IAT ftdisk.sys[ntoskrnl.exe!IoGetAttachedDeviceReference] [F7788E24] sptd.sys
IAT ftdisk.sys[ntoskrnl.exe!IoGetDeviceObjectPointer] [F7788D28] sptd.sys
IAT ftdisk.sys[ntoskrnl.exe!IofCallDriver] [F7788EF4] sptd.sys
IAT ftdisk.sys[ntoskrnl.exe!IoReadPartitionTableEx] [F7B67C98] MDPMGRNT.sys (Mediafour MacDrive Partition Manager/Mediafour Corporation)
IAT PartMgr.sys[ntoskrnl.exe!IoReadPartitionTableEx] [F7B67C98] MDPMGRNT.sys (Mediafour MacDrive Partition Manager/Mediafour Corporation)
IAT PartMgr.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F779E1AE] sptd.sys
IAT PartMgr.sys[ntoskrnl.exe!IoDetachDevice] [F7788A5A] sptd.sys
IAT cpqarray.sys[SCSIPORT.SYS!ScsiPortInitialize] [F776DE0E] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT cpqarray.sys[SCSIPORT.SYS!ScsiPortLogError] [F7766ECC] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT cpqarray.sys[SCSIPORT.SYS!ScsiPortStallExecution] [F77670D4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT cpqarray.sys[SCSIPORT.SYS!ScsiPortMoveMemory] [F7766F4C] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT cpqarray.sys[SCSIPORT.SYS!ScsiPortGetVirtualAddress] [F7767068] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT cpqarray.sys[SCSIPORT.SYS!ScsiPortGetDeviceBase] [F7762AFA] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT cpqarray.sys[SCSIPORT.SYS!ScsiPortValidateRange] [F77670A4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT cpqarray.sys[SCSIPORT.SYS!ScsiPortConvertUlongToPhysicalAddress] [F77670AE] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT cpqarray.sys[SCSIPORT.SYS!ScsiPortGetBusData] [F7763416] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT cpqarray.sys[SCSIPORT.SYS!ScsiPortFreeDeviceBase] [F7762C28] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT cpqarray.sys[SCSIPORT.SYS!ScsiPortGetPhysicalAddress] [F7766FE4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT cpqarray.sys[SCSIPORT.SYS!ScsiPortGetUncachedExtension] [F7763508] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT cpqarray.sys[SCSIPORT.SYS!ScsiPortNotification] [F77670E6] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT cpqarray.sys[SCSIPORT.SYS!ScsiPortGetLogicalUnit] [F7766DE2] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT cpqarray.sys[SCSIPORT.SYS!ScsiPortCompleteRequest] [F776746A] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT atapi.sys[ntoskrnl.exe!IofCompleteRequest] [F779E04A] sptd.sys
IAT atapi.sys[ntoskrnl.exe!IoConnectInterrupt] [F77888F2] sptd.sys
IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [F777BAD2] sptd.sys
IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [F777BC0E] sptd.sys
IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [F777BB96] sptd.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [F777C76C] sptd.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [F777C642] sptd.sys
IAT aha154x.sys[SCSIPORT.SYS!ScsiPortGetPhysicalAddress] [F7766FE4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT aha154x.sys[SCSIPORT.SYS!ScsiPortLogError] [F7766ECC] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT aha154x.sys[SCSIPORT.SYS!ScsiPortStallExecution] [F77670D4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT aha154x.sys[SCSIPORT.SYS!ScsiPortGetDeviceBase] [F7762AFA] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT aha154x.sys[SCSIPORT.SYS!ScsiPortConvertUlongToPhysicalAddress] [F77670AE] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT aha154x.sys[SCSIPORT.SYS!ScsiPortGetBusData] [F7763416] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT aha154x.sys[SCSIPORT.SYS!ScsiPortFreeDeviceBase] [F7762C28] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT aha154x.sys[SCSIPORT.SYS!ScsiPortNotification] [F77670E6] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT aha154x.sys[SCSIPORT.SYS!ScsiPortGetLogicalUnit] [F7766DE2] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT aha154x.sys[SCSIPORT.SYS!ScsiPortGetVirtualAddress] [F7767068] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT aha154x.sys[SCSIPORT.SYS!ScsiPortMoveMemory] [F7766F4C] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT aha154x.sys[SCSIPORT.SYS!ScsiPortCompleteRequest] [F776746A] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT aha154x.sys[SCSIPORT.SYS!ScsiPortGetUncachedExtension] [F7763508] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT aha154x.sys[SCSIPORT.SYS!ScsiPortInitialize] [F776DE0E] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT aic78xx.sys[SCSIPORT.SYS!ScsiPortGetDeviceBase] [F7762AFA] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT aic78xx.sys[SCSIPORT.SYS!ScsiPortFreeDeviceBase] [F7762C28] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT aic78xx.sys[SCSIPORT.SYS!ScsiPortGetPhysicalAddress] [F7766FE4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT aic78xx.sys[SCSIPORT.SYS!ScsiPortNotification] [F77670E6] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT aic78xx.sys[SCSIPORT.SYS!ScsiPortGetBusData] [F7763416] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT aic78xx.sys[SCSIPORT.SYS!ScsiPortSetBusDataByOffset] [F7762CF4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT aic78xx.sys[SCSIPORT.SYS!ScsiPortGetLogicalUnit] [F7766DE2] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT aic78xx.sys[SCSIPORT.SYS!ScsiPortLogError] [F7766ECC] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT aic78xx.sys[SCSIPORT.SYS!ScsiPortStallExecution] [F77670D4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT aic78xx.sys[SCSIPORT.SYS!ScsiPortGetUncachedExtension] [F7763508] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT aic78xx.sys[SCSIPORT.SYS!ScsiPortInitialize] [F776DE0E] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT dac960nt.sys[SCSIPORT.SYS!ScsiPortStallExecution] [F77670D4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT dac960nt.sys[SCSIPORT.SYS!ScsiPortGetPhysicalAddress] [F7766FE4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT dac960nt.sys[SCSIPORT.SYS!ScsiPortLogError] [F7766ECC] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT dac960nt.sys[SCSIPORT.SYS!ScsiPortNotification] [F77670E6] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT dac960nt.sys[SCSIPORT.SYS!ScsiPortGetUncachedExtension] [F7763508] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT dac960nt.sys[SCSIPORT.SYS!ScsiPortFreeDeviceBase] [F7762C28] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT dac960nt.sys[SCSIPORT.SYS!ScsiPortGetDeviceBase] [F7762AFA] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT dac960nt.sys[SCSIPORT.SYS!ScsiPortConvertUlongToPhysicalAddress] [F77670AE] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT dac960nt.sys[SCSIPORT.SYS!ScsiPortSetBusDataByOffset] [F7762CF4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT dac960nt.sys[SCSIPORT.SYS!ScsiPortGetBusData] [F7763416] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT dac960nt.sys[SCSIPORT.SYS!ScsiPortInitialize] [F776DE0E] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ql10wnt.sys[SCSIPORT.SYS!ScsiPortLogError] [F7766ECC] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ql10wnt.sys[SCSIPORT.SYS!ScsiPortNotification] [F77670E6] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ql10wnt.sys[SCSIPORT.SYS!ScsiPortStallExecution] [F77670D4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ql10wnt.sys[SCSIPORT.SYS!ScsiPortGetPhysicalAddress] [F7766FE4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ql10wnt.sys[SCSIPORT.SYS!ScsiPortSetBusDataByOffset] [F7762CF4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ql10wnt.sys[SCSIPORT.SYS!ScsiPortGetBusData] [F7763416] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ql10wnt.sys[SCSIPORT.SYS!ScsiPortGetLogicalUnit] [F7766DE2] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ql10wnt.sys[SCSIPORT.SYS!ScsiPortMoveMemory] [F7766F4C] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ql10wnt.sys[SCSIPORT.SYS!ScsiPortGetUncachedExtension] [F7763508] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ql10wnt.sys[SCSIPORT.SYS!ScsiPortFreeDeviceBase] [F7762C28] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ql10wnt.sys[SCSIPORT.SYS!ScsiPortGetDeviceBase] [F7762AFA] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ql10wnt.sys[SCSIPORT.SYS!ScsiPortInitialize] [F776DE0E] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT amsint.sys[SCSIPORT.SYS!ScsiPortCompleteRequest] [F776746A] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT amsint.sys[SCSIPORT.SYS!ScsiPortGetLogicalUnit] [F7766DE2] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT amsint.sys[SCSIPORT.SYS!ScsiPortNotification] [F77670E6] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT amsint.sys[SCSIPORT.SYS!ScsiPortGetSrb] [F7766F9E] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT amsint.sys[SCSIPORT.SYS!ScsiPortLogError] [F7766ECC] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT amsint.sys[SCSIPORT.SYS!ScsiPortSetBusDataByOffset] [F7762CF4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT amsint.sys[SCSIPORT.SYS!ScsiPortGetBusData] [F7763416] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT amsint.sys[SCSIPORT.SYS!ScsiPortGetDeviceBase] [F7762AFA] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT amsint.sys[SCSIPORT.SYS!ScsiPortStallExecution] [F77670D4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT amsint.sys[SCSIPORT.SYS!ScsiPortGetPhysicalAddress] [F7766FE4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT amsint.sys[SCSIPORT.SYS!ScsiPortGetUncachedExtension] [F7763508] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT amsint.sys[SCSIPORT.SYS!ScsiPortValidateRange] [F77670A4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT amsint.sys[SCSIPORT.SYS!ScsiPortGetVirtualAddress] [F7767068] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT amsint.sys[SCSIPORT.SYS!ScsiPortInitialize] [F776DE0E] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT i2omp.sys[SCSIPORT.SYS!ScsiPortInitialize] [F776DE0E] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT i2omp.sys[SCSIPORT.SYS!ScsiPortGetDeviceBase] [F7762AFA] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT i2omp.sys[SCSIPORT.SYS!ScsiPortGetUncachedExtension] [F7763508] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT i2omp.sys[SCSIPORT.SYS!ScsiPortCompleteRequest] [F776746A] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT i2omp.sys[SCSIPORT.SYS!ScsiPortGetBusData] [F7763416] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT i2omp.sys[SCSIPORT.SYS!ScsiPortLogError] [F7766ECC] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT i2omp.sys[SCSIPORT.SYS!ScsiPortNotification] [F77670E6] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT i2omp.sys[SCSIPORT.SYS!ScsiPortMoveMemory] [F7766F4C] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT i2omp.sys[SCSIPORT.SYS!ScsiPortGetPhysicalAddress] [F7766FE4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT i2omp.sys[SCSIPORT.SYS!ScsiPortStallExecution] [F77670D4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ini910u.sys[SCSIPORT.SYS!ScsiPortStallExecution] [F77670D4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ini910u.sys[SCSIPORT.SYS!ScsiPortNotification] [F77670E6] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ini910u.sys[SCSIPORT.SYS!ScsiPortGetPhysicalAddress] [F7766FE4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ini910u.sys[SCSIPORT.SYS!ScsiDebugPrint] [F7766F98] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ini910u.sys[SCSIPORT.SYS!ScsiPortCompleteRequest] [F776746A] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ini910u.sys[SCSIPORT.SYS!ScsiPortGetSrb] [F7766F9E] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ini910u.sys[SCSIPORT.SYS!ScsiPortGetDeviceBase] [F7762AFA] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ini910u.sys[SCSIPORT.SYS!ScsiPortValidateRange] [F77670A4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ini910u.sys[SCSIPORT.SYS!ScsiPortInitialize] [F776DE0E] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ql1240.sys[SCSIPORT.SYS!ScsiPortLogError] [F7766ECC] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ql1240.sys[SCSIPORT.SYS!ScsiPortNotification] [F77670E6] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ql1240.sys[SCSIPORT.SYS!ScsiPortStallExecution] [F77670D4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ql1240.sys[SCSIPORT.SYS!ScsiPortGetPhysicalAddress] [F7766FE4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ql1240.sys[SCSIPORT.SYS!ScsiPortSetBusDataByOffset] [F7762CF4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ql1240.sys[SCSIPORT.SYS!ScsiPortGetBusData] [F7763416] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ql1240.sys[SCSIPORT.SYS!ScsiPortMoveMemory] [F7766F4C] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ql1240.sys[SCSIPORT.SYS!ScsiPortFreeDeviceBase] [F7762C28] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ql1240.sys[SCSIPORT.SYS!ScsiPortGetUncachedExtension] [F7763508] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ql1240.sys[SCSIPORT.SYS!ScsiPortGetDeviceBase] [F7762AFA] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ql1240.sys[SCSIPORT.SYS!ScsiPortInitialize] [F776DE0E] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT aic78u2.sys[SCSIPORT.SYS!ScsiPortGetDeviceBase] [F7762AFA] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT aic78u2.sys[SCSIPORT.SYS!ScsiPortFreeDeviceBase] [F7762C28] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT aic78u2.sys[SCSIPORT.SYS!ScsiPortGetPhysicalAddress] [F7766FE4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT aic78u2.sys[SCSIPORT.SYS!ScsiPortNotification] [F77670E6] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT aic78u2.sys[SCSIPORT.SYS!ScsiPortGetBusData] [F7763416] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT aic78u2.sys[SCSIPORT.SYS!ScsiPortSetBusDataByOffset] [F7762CF4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT aic78u2.sys[SCSIPORT.SYS!ScsiPortGetLogicalUnit] [F7766DE2] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT aic78u2.sys[SCSIPORT.SYS!ScsiPortLogError] [F7766ECC] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT aic78u2.sys[SCSIPORT.SYS!ScsiPortStallExecution] [F77670D4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT aic78u2.sys[SCSIPORT.SYS!ScsiPortGetUncachedExtension] [F7763508] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT aic78u2.sys[SCSIPORT.SYS!ScsiPortInitialize] [F776DE0E] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ABP480N5.SYS[SCSIPORT.SYS!ScsiPortFreeDeviceBase] [F7762C28] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ABP480N5.SYS[SCSIPORT.SYS!ScsiPortGetDeviceBase] [F7762AFA] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ABP480N5.SYS[SCSIPORT.SYS!ScsiPortValidateRange] [F77670A4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ABP480N5.SYS[SCSIPORT.SYS!ScsiPortConvertUlongToPhysicalAddress] [F77670AE] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ABP480N5.SYS[SCSIPORT.SYS!ScsiPortGetBusData] [F7763416] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ABP480N5.SYS[SCSIPORT.SYS!ScsiPortNotification] [F77670E6] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ABP480N5.SYS[SCSIPORT.SYS!ScsiPortStallExecution] [F77670D4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ABP480N5.SYS[SCSIPORT.SYS!ScsiPortGetPhysicalAddress] [F7766FE4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ABP480N5.SYS[SCSIPORT.SYS!ScsiPortSetBusDataByOffset] [F7762CF4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ABP480N5.SYS[SCSIPORT.SYS!ScsiPortCompleteRequest] [F776746A] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ABP480N5.SYS[SCSIPORT.SYS!ScsiPortGetUncachedExtension] [F7763508] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT ABP480N5.SYS[SCSIPORT.SYS!ScsiPortInitialize] [F776DE0E] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT asc3350p.sys[SCSIPORT.SYS!ScsiPortNotification] [F77670E6] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT asc3350p.sys[SCSIPORT.SYS!ScsiPortGetPhysicalAddress] [F7766FE4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT asc3350p.sys[SCSIPORT.SYS!ScsiPortStallExecution] [F77670D4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT asc3350p.sys[SCSIPORT.SYS!ScsiPortCompleteRequest] [F776746A] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT asc3350p.sys[SCSIPORT.SYS!ScsiPortGetUncachedExtension] [F7763508] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT asc3350p.sys[SCSIPORT.SYS!ScsiPortValidateRange] [F77670A4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT asc3350p.sys[SCSIPORT.SYS!ScsiPortGetDeviceBase] [F7762AFA] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT asc3350p.sys[SCSIPORT.SYS!ScsiPortConvertUlongToPhysicalAddress] [F77670AE] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT asc3350p.sys[SCSIPORT.SYS!ScsiPortInitialize] [F776DE0E] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT cd20xrnt.sys[SCSIPORT.SYS!ScsiPortNotification] [F77670E6] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT cd20xrnt.sys[SCSIPORT.SYS!ScsiPortCompleteRequest] [F776746A] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT cd20xrnt.sys[SCSIPORT.SYS!ScsiDebugPrint] [F7766F98] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT cd20xrnt.sys[SCSIPORT.SYS!ScsiPortGetDeviceBase] [F7762AFA] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT cd20xrnt.sys[SCSIPORT.SYS!ScsiPortInitialize] [F776DE0E] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT adpu160m.sys[SCSIPORT.SYS!ScsiPortGetDeviceBase] [F7762AFA] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT adpu160m.sys[SCSIPORT.SYS!ScsiPortFreeDeviceBase] [F7762C28] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT adpu160m.sys[SCSIPORT.SYS!ScsiPortGetPhysicalAddress] [F7766FE4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT adpu160m.sys[SCSIPORT.SYS!ScsiPortNotification] [F77670E6] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT adpu160m.sys[SCSIPORT.SYS!ScsiPortGetBusData] [F7763416] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT adpu160m.sys[SCSIPORT.SYS!ScsiPortSetBusDataByOffset] [F7762CF4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT adpu160m.sys[SCSIPORT.SYS!ScsiPortStallExecution] [F77670D4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT adpu160m.sys[SCSIPORT.SYS!ScsiPortGetLogicalUnit] [F7766DE2] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT adpu160m.sys[SCSIPORT.SYS!ScsiPortLogError] [F7766ECC] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT adpu160m.sys[SCSIPORT.SYS!ScsiPortGetUncachedExtension] [F7763508] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT adpu160m.sys[SCSIPORT.SYS!ScsiPortInitialize] [F776DE0E] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT dpti2o.sys[SCSIPORT.SYS!ScsiPortGetPhysicalAddress] [F7766FE4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT dpti2o.sys[SCSIPORT.SYS!ScsiPortNotification] [F77670E6] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT dpti2o.sys[SCSIPORT.SYS!ScsiPortMoveMemory] [F7766F4C] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT dpti2o.sys[SCSIPORT.SYS!ScsiPortGetDeviceBase] [F7762AFA] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT dpti2o.sys[SCSIPORT.SYS!ScsiPortConvertUlongToPhysicalAddress] [F77670AE] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT dpti2o.sys[SCSIPORT.SYS!ScsiPortStallExecution] [F77670D4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT dpti2o.sys[SCSIPORT.SYS!ScsiPortGetVirtualAddress] [F7767068] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT dpti2o.sys[SCSIPORT.SYS!ScsiPortLogError] [F7766ECC] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT dpti2o.sys[SCSIPORT.SYS!ScsiPortGetUncachedExtension] [F7763508] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT dpti2o.sys[SCSIPORT.SYS!ScsiPortValidateRange] [F77670A4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT dpti2o.sys[SCSIPORT.SYS!ScsiPortSetBusDataByOffset] [F7762CF4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT dpti2o.sys[SCSIPORT.SYS!ScsiPortGetBusData] [F7763416] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT dpti2o.sys[SCSIPORT.SYS!ScsiPortInitialize] [F776DE0E] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT perc2.sys[SCSIPORT.SYS!ScsiPortGetPhysicalAddress] [F7766FE4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT perc2.sys[SCSIPORT.SYS!ScsiPortNotification] [F77670E6] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT perc2.sys[SCSIPORT.SYS!ScsiPortMoveMemory] [F7766F4C] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT perc2.sys[SCSIPORT.SYS!ScsiPortCompleteRequest] [F776746A] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT perc2.sys[SCSIPORT.SYS!ScsiPortLogError] [F7766ECC] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT perc2.sys[SCSIPORT.SYS!ScsiPortGetDeviceBase] [F7762AFA] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT perc2.sys[SCSIPORT.SYS!ScsiPortGetBusData] [F7763416] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT perc2.sys[SCSIPORT.SYS!ScsiPortInitialize] [F776DE0E] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT perc2.sys[SCSIPORT.SYS!ScsiPortGetUncachedExtension] [F7763508] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT perc2.sys[SCSIPORT.SYS!ScsiPortStallExecution] [F77670D4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT perc2hib.sys[ntoskrnl.exe!IofCompleteRequest] [F779E04A] sptd.sys
IAT hpn.sys[SCSIPORT.SYS!ScsiPortGetPhysicalAddress] [F7766FE4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT hpn.sys[SCSIPORT.SYS!ScsiPortNotification] [F77670E6] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT hpn.sys[SCSIPORT.SYS!ScsiPortMoveMemory] [F7766F4C] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT hpn.sys[SCSIPORT.SYS!ScsiPortCompleteRequest] [F776746A] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT hpn.sys[SCSIPORT.SYS!ScsiPortLogError] [F7766ECC] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT hpn.sys[SCSIPORT.SYS!ScsiPortGetDeviceBase] [F7762AFA] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT hpn.sys[SCSIPORT.SYS!ScsiPortGetBusData] [F7763416] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT hpn.sys[SCSIPORT.SYS!ScsiPortInitialize] [F776DE0E] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT hpn.sys[SCSIPORT.SYS!ScsiPortGetUncachedExtension] [F7763508] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT hpn.sys[SCSIPORT.SYS!ScsiPortStallExecution] [F77670D4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT cbidf2k.sys[SCSIPORT.SYS!ScsiPortMoveMemory] [F7766F4C] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT cbidf2k.sys[SCSIPORT.SYS!ScsiPortStallExecution] [F77670D4] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT cbidf2k.sys[SCSIPORT.SYS!ScsiPortLogError] [F7766ECC] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT cbidf2k.sys[SCSIPORT.SYS!ScsiPortNotification] [F77670E6] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT cbidf2k.sys[SCSIPORT.SYS!ScsiPortFreeDeviceBase] [F7762C28] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT cbidf2k.sys[SCSIPORT.SYS!ScsiPortConvertUlongToPhysicalAddress] [F77670AE] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT cbidf2k.sys[SCSIPORT.SYS!ScsiPortGetDeviceBase] [F7762AFA] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT cbidf2k.sys[SCSIPORT.SYS!ScsiPortCompleteRequest] [F776746A] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT cbidf2k.sys[SCSIPORT.SYS!ScsiPortInitialize] [F776DE0E] \WINDOWS\System32\Drivers\SPTD5453.SYS
IAT disk.sys[ntoskrnl.exe!IoReadPartitionTable] [F7B670AA] MDPMGRNT.sys (Mediafour MacDrive Partition Manager/Mediafour Corporation)
IAT disk.sys[ntoskrnl.exe!IoReadPartitionTableEx] [F7B67C98] MDPMGRNT.sys (Mediafour MacDrive Partition Manager/Mediafour Corporation)
IAT disk.sys[ntoskrnl.exe!IoWritePartitionTableEx] [F7B67F90] MDPMGRNT.sys (Mediafour MacDrive Partition Manager/Mediafour Corporation)
IAT disk.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F779EE4A] sptd.sys
IAT \WINDOWS\System32\DRIVERS\CLASSPNP.SYS[ntoskrnl.exe!IoDetachDevice] [F778D8C6] sptd.sys
IAT \SystemRoot\System32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [F779E056] sptd.sys
IAT \SystemRoot\System32\DRIVERS\cdrom.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F779EE4A] sptd.sys
IAT \SystemRoot\System32\DRIVERS\USBPORT.SYS[ntoskrnl.exe!IofCompleteRequest] [F779E04A] sptd.sys
IAT \SystemRoot\System32\DRIVERS\rdbss.sys[ntoskrnl.exe!IofCallDriver] [F7788CC6] sptd.sys
IAT \SystemRoot\System32\DRIVERS\mrxsmb.sys[ntoskrnl.exe!IofCallDriver] [F7788CC6] sptd.sys

---- Devices - GMER 1.0.14 ----

Device \FileSystem\Ntfs \Ntfs 83F8AC78

AttachedDevice \FileSystem\Ntfs \Ntfs avg7rsw.sys (AVG Resident Shield Unload Helper/GRISOFT, s.r.o.)

Device \FileSystem\Fastfat \FatCdrom 839ED650
Device \Driver\00000052 \Device\0000008e sptd.sys
Device \Driver\Tcpip \Device\Ip avgtdi.sys (AVG Network connection watcher/GRISOFT, s.r.o.)
Device \Driver\MDPMGRNT \Device\MacDrivePartitionManager 83FD3350
Device \Driver\Tcpip \Device\Tcp avgtdi.sys (AVG Network connection watcher/GRISOFT, s.r.o.)
Device \Driver\prodrv06 \Device\ProDrv06 E19803A0
Device \Driver\Ftdisk \Device\HarddiskVolume1 83F8D0E8
Device \Driver\Ftdisk \Device\HarddiskVolume2 83F8D0E8
Device \FileSystem\Rdbss \Device\FsWrap 83C10DA0
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\atapi \Device\Ide\IdePort0 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\atapi \Device\Ide\IdePort1 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\prohlp02 \Device\ProHlp02 E1923320
Device \Driver\NetBT \Device\NetBt_Wins_Export 83C12EB0
Device \Driver\NetBT \Device\NetbiosSmb 83C12EB0
Device \Driver\BTHUSB \Device\000000b8 bthport.sys (Driver bus Bluetooth/Microsoft Corporation)
Device \Driver\NetBT \Device\NetBT_Tcpip_{37784D64-20C3-4542-879E-3C8C09433E88} 83C12EB0
Device \Driver\Tcpip \Device\Udp avgtdi.sys (AVG Network connection watcher/GRISOFT, s.r.o.)
Device \Driver\Disk \Device\Harddisk0\DR0 83F8AEB0
Device \Driver\Tcpip \Device\RawIp avgtdi.sys (AVG Network connection watcher/GRISOFT, s.r.o.)
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 83DC3DC8
Device \Driver\Tcpip \Device\IPMULTICAST avgtdi.sys (AVG Network connection watcher/GRISOFT, s.r.o.)
Device \FileSystem\MRxSmb \Device\LanmanRedirector 83DC3DC8
Device \Driver\BTHUSB \Device\000000ba bthport.sys (Driver bus Bluetooth/Microsoft Corporation)
Device \FileSystem\Npfs \Device\NamedPipe 83A620E8
Device \Driver\Ftdisk \Device\FtControl 83F8D0E8
Device \FileSystem\Msfs \Device\Mailslot 83DC5C78
Device \Driver\NetBT \Device\NetBT_Tcpip_{78F772E5-7807-4A69-897D-A9ED66E0144E} 83C12EB0
Device \Driver\vcsmpdrv \Device\Scsi\vcsmpdrv1Port2Path0Target2Lun0 83D51DE0
Device \Driver\vcsmpdrv \Device\Scsi\vcsmpdrv1Port2Path0Target2Lun0 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\vcsmpdrv \Device\Scsi\vcsmpdrv1Port2Path0Target1Lun0 83D51DE0
Device \Driver\vcsmpdrv \Device\Scsi\vcsmpdrv1Port2Path0Target1Lun0 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\vcsmpdrv \Device\Scsi\vcsmpdrv1 83D51DE0
Device \Driver\vcsmpdrv \Device\Scsi\vcsmpdrv1 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\dtscsi \Device\Scsi\dtscsi1 83D61390
Device \Driver\dtscsi \Device\Scsi\dtscsi1 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\vcsmpdrv \Device\Scsi\vcsmpdrv1Port2Path0Target0Lun0 83D51DE0
Device \Driver\vcsmpdrv \Device\Scsi\vcsmpdrv1Port2Path0Target0Lun0 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\dtscsi \Device\Scsi\dtscsi1Port3Path0Target0Lun0 83D61390
Device \Driver\dtscsi \Device\Scsi\dtscsi1Port3Path0Target0Lun0 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \FileSystem\Fastfat \Fat 839ED650

AttachedDevice \FileSystem\Fastfat \Fat avg7rsw.sys (AVG Resident Shield Unload Helper/GRISOFT, s.r.o.)

Device \FileSystem\Cdfs \Cdfs 839C2EB0

---- Registry - GMER 1.0.14 ----

Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programmi\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x8D 0x05 0x68 0x8F ...
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x18 0x2B 0x27 0xB9 ...
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x6E 0xE6 0xBE 0xA1 ...
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\0009dd50277a
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\0009dd50277a@00119fbfc9ff 0x6B 0x83 0x19 0xAA ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programmi\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x3D 0x5B 0x09 0x2F ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x18 0x2B 0x27 0xB9 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x9F 0xC1 0x62 0x36 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0009dd50277a
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0009dd50277a@00119fbfc9ff 0x6B 0x83 0x19 0xAA ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0009dd50277a@001baf869c98 0xB2 0xF7 0x15 0xD2 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0009dd50277a@00125617577e 0x2F 0x41 0xFA 0x1E ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s0 -851790310
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 -49382257
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 -1912778951
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programmi\DAEMON Tools\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x3D 0x5B 0x09 0x2F ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x18 0x2B 0x27 0xB9 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x45 0xE1 0x39 0xB4 ...
Reg HKLM\SYSTEM\ControlSet004\Services\BTHPORT\Parameters\Keys\0009dd50277a
Reg HKLM\SYSTEM\ControlSet004\Services\BTHPORT\Parameters\Keys\0009dd50277a@00119fbfc9ff 0x6B 0x83 0x19 0xAA ...
Reg HKLM\SYSTEM\ControlSet004\Services\BTHPORT\Parameters\Keys\0009dd50277a@001baf869c98 0xB2 0xF7 0x15 0xD2 ...
Reg HKLM\SYSTEM\ControlSet004\Services\BTHPORT\Parameters\Keys\0009dd50277a@00125617577e 0x2F 0x41 0xFA 0x1E ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programmi\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x3D 0x5B 0x09 0x2F ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x18 0x2B 0x27 0xB9 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x45 0xE1 0x39 0xB4 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers@H: MSOpenFolder???????
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers@H: MSTakeNoAction???????
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers@H: MSOpenFolder???????
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers@H: MSTakeNoAction???????

---- EOF - GMER 1.0.14 ----

[christiancek]

quello di kapersky lo posterò il prima possibile

[Tommy81]

Ti consiglio anche di dare una passata al tuo pc con spybot. Puoi scaricarlo qui è freeware:
http://www.safer-networking.org/it/mirrors/index.html
Esegui pure l'immunizzazione oltre che lo scan.

[murack83pa]

Ti consiglio anche di dare una passata al tuo pc con spybot. Puoi scaricarlo qui è freeware:
http://www.safer-networking.org/it/mirrors/index.html
Esegui pure l'immunizzazione oltre che lo scan.

nn c'è motivo, per due ordini di ragioni:

1- di programmi, già ne ha installati a sufficienza

2- spybot è scarso come antispyware

@ christiancek:

il log di asquared è illeggibile

i log vanno allegato oppure caricati su FileUp (http://www.fileup.itadib.com/index.php), copiando qui i link x il download

aspetto ancora i risultati di virustotal su questi file:
C:\Documents and Settings\All Users\Dati applicazioni\meet tray default settings\stupid media.exe
C:\DOCUME~1\CHRIST~1\DATIAP~1\UPMEMO~1\drv web title.exe

in particolare l'ultimo è molto sospetto...

attendiamo il log di kaspersky, salva la pagina in html, grazie

[christiancek]

nn c'è motivo, per due ordini di ragioni:

1- di programmi, già ne ha installati a sufficienza

2- spybot è scarso come antispyware

@ christiancek:

il log di asquared è illeggibile

i log vanno allegato oppure caricati su FileUp (http://www.fileup.itadib.com/index.php), copiando qui i link x il download

aspetto ancora i risultati di virustotal su questi file:


in particolare l'ultimo è molto sospetto...

attendiamo il log di kaspersky, salva la pagina in html, grazie

QUEI FILE NON SO PERCHè NON LI TROVA!!! SONO COME NASCOSTI! ENTRO NELLA CARTELLA COL SITO MA NON TROVA IL .EXE!!!!

[xcdegasp]

QUEI FILE NON SO PERCHè NON LI TROVA!!! SONO COME NASCOSTI! ENTRO NELLA CARTELLA COL SITO MA NON TROVA IL .EXE!!!!

quel'è il motivo che ti spinge a scrivere come se tu stessi urlando?
il maiuscolo equivale ad urlare quindi in una comunicazione dai toni pacati e assolutamente innocente non va' usato!

le buone maniere prima di ogni cosa e con chiunque a prescindere.. prossima volta si prende provvedimenti :)

[murack83pa]

QUEI FILE NON SO PERCHè NON LI TROVA!!! SONO COME NASCOSTI! ENTRO NELLA CARTELLA COL SITO MA NON TROVA IL .EXE!!!!

news?

log di asquared, log di kaspersky? dove sono?

riguardo quei due file, posta un nuovo log di hijackthis

[christiancek]

log asquared
http://www.fileup.itadib.com/download.php?id=JjGVCMT9K8a0l8IsMbCG

log hijackthis
http://www.fileup.itadib.com/download.php?id=gj98VNIlHG3NwECikntU

log kapersky entro stasera lo metterò...

scusatemi inoltre per aver inserito quel post in maiuscolo

[christiancek]

non riesco ad avviare la scansione online di kapersky....

[murack83pa]

non riesco ad avviare la scansione online di kapersky....

ok,andiamoci in un altro modo rispetto alla guida standard:

1- il ripristino di sistema controlla che sia disattivato

2- scarica questo programma: DOWNLOAD (http://downloads5.kaspersky-labs.com/devbuilds/AVPTool/)

Installa KASPERSKY VIRUS REMOVAL TOOL
● verrà creata una apposta cartella sul Desktop
● all’interno della cartella è presente la classica icona (una K) di Kapsersky
● clicca sull’icona per lanciare il tool
● imposta le aree che intendi scansionare (Startup Objects e Disk boot sector sono impostate di default)
● al termine della scansione sarà possibile rimuovere e/o mettere in quarantena i file infetti rilevati
salva il log che verrà rilasciato e postalo qui

[xcdegasp]

io fixerei:

HKLM\..\Run: [default settings support the] C:\Documents and Settings\All Users\Dati applicazioni\meet tray default settings\stupid media.exe
HKCU\..\Run: [browseabout] C:\DOCUME~1\CHRIST~1\DATIAP~1\UPMEMO~1\drv web title.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\it.htm
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programmi\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://christiancek.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/IT-IT/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1160897138515
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://mariavergine-christian.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab55762.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab55579.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab55200.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab


:p

[christiancek]

io fixerei:

HKLM\..\Run: [default settings support the] C:\Documents and Settings\All Users\Dati applicazioni\meet tray default settings\stupid media.exe
HKCU\..\Run: [browseabout] C:\DOCUME~1\CHRIST~1\DATIAP~1\UPMEMO~1\drv web title.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\it.htm
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programmi\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://christiancek.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/IT-IT/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1160897138515
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://mariavergine-christian.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab55762.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab55579.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab55200.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab


:p

sicuro o no? non vado a creare danni?

[murack83pa]

per il momento, lascia stare

le fixiamo dopo

usa il tool che ti ho indicato e posta il log e vediamo cosa ha trovato...

[christiancek]

per il momento, lascia stare

le fixiamo dopo

usa il tool che ti ho indicato e posta il log e vediamo cosa ha trovato...

sto scansionando...appena posso lo metto...:read:

[christiancek]

log kaspersky virus removal tool
http://www.fileup.itadib.com/download.php?id=uvCw3TTGF5NR42KnlUlH

[murack83pa]

log kaspersky virus removal tool
http://www.fileup.itadib.com/download.php?id=uvCw3TTGF5NR42KnlUlH

ottimo, fai queste operazioni d pulizia:

1- Provvedi a svuotare del suo contenuto la cartella Prefetch procedendo in questa maniera:
● clicca su Risorse del Computer
● clicca su Disco locale C:
● cerca, all’interno delle cartelle che verranno visualizzate la cartella Windows, aprila ed, al suo interno, cerca la cartella Prefetch, la apri ed elimini tutte le voci conservate al suo interno (mi raccomando, non eliminare la cartella)

2- svuota la cache di JAVASUN:
● Start
● Panello di Controllo (se non viene visualizzato in modalità classica, in alto a sinistra clicca sulla voce passa alla visualizzazione classica)
● clicca sulla icona Java per accedere al Pannello di controllo
● clicca sulla scheda Generale
● vai all'ultima sezione File temporanei Internet
● clicca sul pulsante Impostazioni
● clicca sul pulsante Elimina file e poi conferma con OK

3- Scarica CCLEANER: DOWNLOAD (http://download.piriform.com/ccsetup201.exe)
una volta installato, lancia il programma, nel menu di sinistra portati alla voce Opzioni e nella finestra successiva clicca su:
● Impostazioni, e spunta la voce Cancellazione sicura (lenta)
poi su:
● Avanzate, togli la spunta alla voce Cancella solo file più vecchi di 48 ore
● alla voce Pulizia, spunta tutte le voci comprese nella sezione Avanzate
● nel menu a sinistra, clicca sulla voce Pulizia, clicca su tasto Avvia Pulizia per eseguire la scansione
● sempre nel menu a sinistra, clicca sulla voce Registro, spunta tutte le voci comprese nella sezione, clicca sul tasto Trova problemi ed avvia una scansione; al termine della scansione clicca sulla voce Ripara selezionati e prosegui

4- nuovo log di hijackthis e vediamo cosa fixare

5- poi ti dico come disinstallare il tool della kaspersky

[Riverside]

Detected
--------
Status Object
------ ------
detected: Trojan program Trojan-Downloader.Java.OpenConnection.ap File: C:\Documents and Settings\CHRISTIAN\Dati applicazioni\Sun\Java\Deployment\cache\6.0\0\3c7450c0-38a85dee/HiPointInstallShieldRT.class
detected: Trojan program Trojan-Downloader.Java.OpenConnection.ap File: C:\Documents and Settings\CHRISTIAN\Dati applicazioni\Sun\Java\Deployment\cache\6.0\41\32226769-4f726616/HiPointInstallShieldRT.class
detected: Trojan program Trojan-Downloader.Java.OpenConnection.ap File: C:\Documents and Settings\CHRISTIAN\Dati applicazioni\Sun\Java\Deployment\cache\6.0\62\1bd8a6be-6ec83e1a/HiPointInstallShieldRT.class
detected: Trojan program Trojan-Downloader.Java.OpenConnection.ap File: C:\Documents and Settings\CHRISTIAN\Dati applicazioni\Sun\Java\Deployment\cache\6.0\9\6da54089-34d5fba8/HiPointInstallShieldRT.class
detected: Trojan program Trojan-Downloader.Java.OpenConnection.ap File: C:\Documents and Settings\CHRISTIAN\Dati applicazioni\Sun\Java\Deployment\cache\javapi\v1.0\jar\eRT.jar-4d53972-71e3fa8a.zip/HiPointInstallShieldRT.class
detected: Trojan program Trojan-Downloader.Java.OpenConnection.ap File: C:\Documents and Settings\CHRISTIAN\Dati applicazioni\Sun\Java\Deployment\cache\javapi\v1.0\jar\itrRT.jar-152bf9f9-5cd2b26b.zip/HiPointInstallShieldRT.class
detected: Trojan program Trojan-Downloader.Java.OpenConnection.ap File: C:\Documents and Settings\CHRISTIAN\Dati applicazioni\Sun\Java\Deployment\cache\javapi\v1.0\jar\itrRT.jar-3978e8d9-7027c3f1.zip/HiPointInstallShieldRT.class
detected: Trojan program Trojan-Downloader.Java.OpenConnection.ap File: C:\Documents and Settings\CHRISTIAN\Dati applicazioni\Sun\Java\Deployment\cache\javapi\v1.0\jar\itrRT.jar-567de1b6-7a2d1865.zip
detected: Trojan program Trojan-Downloader.Java.OpenConnection.ap File: C:\Documents and Settings\CHRISTIAN\Dati applicazioni\Sun\Java\Deployment\cache\6.0\41\32226769-4f726616
detected: Trojan program Trojan-Downloader.Java.OpenConnection.ap File: C:\Documents and Settings\CHRISTIAN\Dati applicazioni\Sun\Java\Deployment\cache\javapi\v1.0\jar\eRT.jar-4d53972-71e3fa8a.zip
detected: Trojan program Trojan-Downloader.Java.OpenConnection.ap File: C:\Documents and Settings\CHRISTIAN\Dati applicazioni\Sun\Java\Deployment\cache\javapi\v1.0\jar\itrRT.jar-152bf9f9-5cd2b26b.zip
detected: Trojan program Trojan-Downloader.Java.OpenConnection.ap File: C:\Documents and Settings\CHRISTIAN\Dati applicazioni\Sun\Java\Deployment\cache\javapi\v1.0\jar\itrRT.jar-3978e8d9-7027c3f1.zip
ottimo, fai queste operazioni d pulizia:
2- svuota la cache di JAVASUN:
● Start
● Panello di Controllo (se non viene visualizzato in modalità classica, in alto a sinistra clicca sulla voce passa alla visualizzazione classica)
● clicca sulla icona Java per accedere al Pannello di controllo
● clicca sulla scheda Generale
● vai all'ultima sezione File temporanei Internet
● clicca sul pulsante Impostazioni
● clicca sul pulsante Elimina file e poi conferma con OK
Visto quello che ha spazzato via Kaspersky (sto tool è sorprendente, trova tutto .... chissà perchè ;) ) mi sembra la prima cosa da fare.
Ciao Murack.

[xcdegasp]

le 016 non creano mai problemi gli altri due intanto li puoi sempre far scansionare su www.virustotal.com e/o su http://virusscan.jotti.org/ :)

[christiancek]

dopo aver seguito le istruzioni ecco il log hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14.24.53, on 09/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\a-squared Free\a2service.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe
C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
C:\Programmi\PrevxCSI\PrevxCSI.exe
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Programmi\Java\jre1.6.0_05\bin\jusched.exe
C:\Programmi\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\File comuni\Mediafour\MACVNTFY.EXE
C:\Programmi\Philips\Philips Device Manager\Bin\DeviceManager.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Programmi\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Virtual CD v4 SDK\system\vcssecs.exe
C:\Programmi\PrevxCSI\prevxcsi.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Macrogaming\SweetIM\SweetIM.exe
C:\Programmi\RamCleaner\RamCleaner.exe
C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Programmi\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [MediafourGettingStartedWithMacDrive6] "C:\Programmi\Mediafour\MacDrive\MacDrive.exe" /runonce
O4 - HKLM\..\Run: [Mediafour Mac Volume Notifications] "C:\Programmi\File comuni\Mediafour\MACVNTFY.EXE" /auto
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Programmi\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PhilipsDM] C:\Programmi\Philips\Philips Device Manager\Bin\DeviceManager.exe OS_STARTUP
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [default settings support the] C:\Documents and Settings\All Users\Dati applicazioni\meet tray default settings\stupid media.exe
O4 - HKLM\..\Run: [AVP] "C:\Documents and Settings\All Users\Desktop\Kaspersky Lab Tool\setup_7.0.0.180_08.04.2008_17-39.exe"
O4 - HKLM\..\Run: [PrevxCSI] "C:\Programmi\PrevxCSI\prevxcsi.exe" /bootupreg
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SweetIM] C:\Programmi\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [RamCleaner] C:\Programmi\RamCleaner\RamCleaner.exe
O4 - HKCU\..\Run: [NBJ] "C:\Programmi\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programmi\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [Philips Intelligent Agent] "C:\Programmi\Philips Intelligent Agent\Philips Intelligent Agent.exe" /SILENT
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [browseabout] C:\DOCUME~1\CHRIST~1\DATIAP~1\UPMEMO~1\drv web title.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &eBay Search - res://C:\Programmi\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: Aggiungi all'elenco di stampa Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Anteprima Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Invia a &Bluetooth - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie_ctx.htm
O8 - Extra context menu item: Stampa ad alta velocità Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Stampa Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Crea preferito portatile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Organizzatore ricerche - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Programmi\File comuni\Microsoft Shared\Encarta Researcher\EROProj.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\it.htm
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programmi\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://christiancek.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/IT-IT/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1160897138515
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://mariavergine-christian.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab55762.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab55579.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab55200.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: MacDrive-iTunes compatibility - C:\Programmi\File comuni\Mediafour\MacDriveiTunesPatch.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Programmi\a-squared Free\a2service.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
O23 - Service: CSIScanner - Prevx - C:\Programmi\PrevxCSI\\PrevxCSI.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programmi\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: setup_7.0.0.180_08.04.2008_17-39 - Kaspersky Lab - C:\Documents and Settings\All Users\Desktop\Kaspersky Lab Tool\setup_7.0.0.180_08.04.2008_17-39.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Programmi\Virtual CD v4 SDK\system\vcssecs.exe

--
End of file - 12274 bytes

[murack83pa]

fixa queste voci in hijackthis ovvero:

rilancia hijackthis, e gli dici "do a system scan only", a fine scansione seleziona le seguenti voci dall'elenco:


O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Mediafour Mac Volume Notifications] "C:\Programmi\File comuni\Mediafour\MACVNTFY.EXE" /auto
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Programmi\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
04 - HKLM\..\Run: [PhilipsDM] C:\Programmi\Philips\Philips Device Manager\Bin\DeviceManager.exe OS_STARTUP
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [SweetIM] C:\Programmi\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programmi\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [Philips Intelligent Agent] "C:\Programmi\Philips Intelligent Agent\Philips Intelligent Agent.exe" /SILENT
O4 - Startup: Adobe Gamma.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe


le voci 016 le puoi anche selezionare tutte e poi clicca su "fix checked"

riguardo la disinstallazione di kaspersky:

PROCEDURA DI DISINSTALLAZIONE DI KASPERSKY VIRUS REMOVAL TOOL:

● clicca sull’icona per lanciare il tool
● nella finestra principale, in basso, clicca sulla voce Complete Virus Protection
● verrà visualizzato un messaggio: clicca su Ok
● chiudi la pagina web che verrà aperta
● nel messaggio successivo, clicca su SI per avviare la disinstallazione
● al termine, verrà richiesto di riavviare il P.C.

una volta disinstallato il tool, riavvia il pc, fai una nuova passata con ccleaner e posta un nuovo log di hijackthis, per eliminare le voci che si riferiscono al tool di kaspersky

[xcdegasp]

questa è meglio di no:
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_05\bin\jusched.exe"

è l'autoaggiornamento di JAVA che è sempre utile :)

[christiancek]

fatto tutto ma la pagina all'avvio del pc pesite ancora....sono 3 pagine con indirizzo click.vnn.bz
ecco il log di hijackthis
http://www.fileup.itadib.com/download.php?id=UTufleN6pXo8DIXyzpuf

[murack83pa]

fatto tutto ma la pagina all'avvio del pc pesite ancora....sono 3 pagine con indirizzo click.vnn.bz
ecco il log di hijackthis
http://www.fileup.itadib.com/download.php?id=UTufleN6pXo8DIXyzpuf

mi son dimenticato di questo particolare x la fretta:

devi far analizzare questi due file su www.virustotal.com


C:\Documents and Settings\All Users\Dati applicazioni\meet tray default settings\stupid media.exe
C:\DOCUME~1\CHRIST~1\DATIAP~1\UPMEMO~1\drv web title.exe


devi abilitare la visualizzazione dei file nascosti e di sistema

se nn sai come fare, leggi qui: LINK (http://generazionenet.itadib.com/tips-tricks-per-windows-f75/mostra-nascondi-file-nascosti-e-di-sistema-link-veloce-t230.html)

sono convinto che la causa del tuo problema siano questi due file

attendo i log di questi due file

[christiancek]

mi son dimenticato di questo particolare x la fretta:

devi far analizzare questi due file su www.virustotal.com



devi abilitare la visualizzazione dei file nascosti e di sistema

se nn sai come fare, leggi qui: LINK (http://generazionenet.itadib.com/tips-tricks-per-windows-f75/mostra-nascondi-file-nascosti-e-di-sistema-link-veloce-t230.html)

sono convinto che la causa del tuo problema siano questi due file

attendo i log di questi due file

niente....seguito la guida ma non trovo nessun file....

[Chill-Out]

niente....seguito la guida ma non trovo nessun file....

Prova col metodo classico

Clicca su una cartella qualsiasi clicca su Strumenti - Opzioni cartella - Visualizzazione - metti il segno di spunta in Visualizza cartelle e file nascosti - togli il segno di spunta da Nascondi i file protetti di sistema - Applica e OK

[murack83pa]

niente....seguito la guida ma non trovo nessun file....

il metodo classico è scritto anche li...;)

[christiancek]

il metodo classico è scritto anche li...;)
la casella è sempre rimasta spuntata e non si vede nessun file....allroa io li fixo....che ne dite? fixo questi 2???....
C:\Documents and Settings\All Users\Dati applicazioni\meet tray default settings\stupid media.exe
C:\DOCUME~1\CHRIST~1\DATIAP~1\UPMEMO~1\drv web title.exe

[Chill-Out]

Christian sono due le caselle controlla bene per favore

http://www.hwupgrade.it/forum/showpost.php?p=21938104&postcount=36

[christiancek]

niente....tutto come dite voi....eppure non si vede nessun file...

[christiancek]

up!

[murack83pa]

allora, visto che nn si puo sapere realmete cosa sono quei due file...tu nn ne hai idea,vero?

ti chiedo: presenti ancora problemi?

se è si, vediamo di eliminarli (al limite c'è il backup di avenger):

scarica avenger (forse devi disattivare momentaneamente l'antivirus)
DOWNLOAD (http://swandog46.geekstogo.com/avenger2/download.php)
Estrailo in una sua cartella dedicata (nella stessa partizione in cui è presente il sistema operativo), avvialo ed incollare il seguente script e cliccare su "Execute":

files to delete:
C:\Documents and Settings\All Users\Dati applicazioni\meet tray default settings\stupid media.exe
C:\DOCUME~1\CHRIST~1\DATIAP~1\UPMEMO~1\drv web title.exe

posta il log di avenger, al riavvio del pc e un nuovo log di hijackthis...e vediamo...

[christiancek]

non so proprio cosa siano...mai installato cose del genere.....
cmq si presento ancora i problemi all'avvio

[murack83pa]

non so proprio cosa siano...mai installato cose del genere.....

hai ancora problemi al pc? ancora pagine?


se è si, fai quello che ti ho detto io e vediamo se si risolve....incrociamo le dita....

[christiancek]

scusa....non ho capito bene come fare con avenger.....scusami...

[murack83pa]

scusa....non ho capito bene come fare con avenger.....scusami...

ti scarichi il file zip contenente avenger, gli dici estrai in, e crei una sua cartella dove posizionare avenger, questa cartella puo benissimo essere nel desktop

fatto questo, lo avvii, nel box bianco c incolli lo script che ti ho indicato, tutto quello che si trova nel quote, a partire da files to delete.....

http://www.megalab.it/immagini/articoli/the_avenger_un_tool/The_avenger_v2_1A.JPG

una volta incollato, premi su execute e lo lasci lavorare, si riavviera il pc e dovrebbe darti un log, lo salvi e lo pubblichi qui

[christiancek]

ho risolto tutto fixando i 2 file con hijackthis e avenger....ma ora ad ogni avvio mi si apre openoffice writer con una scrittura ascii di avenger...

[murack83pa]

ho risolto tutto fixando i 2 file con hijackthis e avenger....ma ora ad ogni avvio mi si apre openoffice writer con una scrittura ascii di avenger...

posta il log di avenger e un nuovo log di hijackthis

[christiancek]

avenger mi produce solo questa cosa:
L#o#g#f#i#l#e# #o#f# #T#h#e# #A#v#e#n#g#e#r# #V#e#r#s#i#o#n# #2#.#0#,# #(#c#)# #b#y# #S#w#a#n#d#o#g#4#6#

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20.44.31, on 13/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\a-squared Free\a2service.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe
C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
C:\Programmi\PrevxCSI\PrevxCSI.exe
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Programmi\Java\jre1.6.0_05\bin\jusched.exe
C:\Programmi\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Programmi\Virtual CD v4 SDK\system\vcssecs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\RamCleaner\RamCleaner.exe
C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
C:\Programmi\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Programmi\PrevxCSI\PrevxCSI.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Programmi\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [MediafourGettingStartedWithMacDrive6] "C:\Programmi\Mediafour\MacDrive\MacDrive.exe" /runonce
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Programmi\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RamCleaner] C:\Programmi\RamCleaner\RamCleaner.exe
O4 - HKCU\..\Run: [NBJ] "C:\Programmi\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programmi\Microsoft ActiveSync\wcescomm.exe"
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &eBay Search - res://C:\Programmi\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: Aggiungi all'elenco di stampa Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Anteprima Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Invia a &Bluetooth - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie_ctx.htm
O8 - Extra context menu item: Stampa ad alta velocità Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Stampa Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Crea preferito portatile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Organizzatore ricerche - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Programmi\File comuni\Microsoft Shared\Encarta Researcher\EROProj.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\it.htm
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programmi\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://christiancek.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/IT-IT/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1160897138515
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://mariavergine-christian.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab55762.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab55579.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab55200.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: MacDrive-iTunes compatibility - C:\Programmi\File comuni\Mediafour\MacDriveiTunesPatch.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Programmi\a-squared Free\a2service.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
O23 - Service: CSIScanner - Prevx - C:\Programmi\PrevxCSI\\PrevxCSI.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programmi\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Programmi\Virtual CD v4 SDK\system\vcssecs.exe

--
End of file - 10731 bytes

[murack83pa]

i file notepad li apri con openwriter?

imposta l'apertura dei file di testo con il blocco note di windows, nn con open office...

fatto ciò, fai una scansione del pc e del registro con ccleaner, svuota la cartella prefetch procedendo in questa maniera:
● clicca su Risorse del Computer
● clicca su Disco locale C:
● cerca, all’interno delle cartelle che verranno visualizzate la cartella Windows, aprila ed, al suo interno, cerca la cartella Prefetch, la apri ed elimini tutte le voci conservate al suo interno (mi raccomando, non eliminare la cartella)

riavvia il pc e vediamo cosa succede... dal log di hijackthis nn risulta nulla...

[christiancek]

i file notepad li apri con openwriter?

imposta l'apertura dei file di testo con il blocco note di windows, nn con open office...

il problema è che non so come mai ma è già da un'annetto che non ho più il blocco note....e tutti gli accessori di windows(blocco note, paint) e i giochi (pinball ecc) non li ho più....cmq adexo pulirò il pc con ccleaner

[murack83pa]

senti, intanto fixa questa voce in hijackthis, che nn l'avevo vista:

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presen

fatto questo, scarica COMBOFIX: DOWNLOAD (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)

Doppio click su combofix.exe e segui le istruzioni
Allegare il log C:\combofix.txt
N.B.: Durante la scansione verranno creati alcuni file sul desktop e poi eliminati - spariranno tutte le icone del desktop - il firewall potrebbe avvisare che verranno rimossi alcuni driver (consentire)
ComboFix deve essere eseguito a macchina dedicata - disconnessi dalla rete, disabilitando momentaneamente i realtime dei software di sicurezza

[christiancek]

ok....ora lo faccio
grazie intanto

[christiancek]

non riesco a scaricare combofix

[murack83pa]

non riesco a scaricare combofix

da me funziona....ricontrolla

[christiancek]

ora si....:muro: :muro: :muro: :muro: :muro: