Spyware insistente

[ferrari599gtb]

Salve,
vorrei porre alla vostra attenzione il seguente log emesso da hijack:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17.58.01, on 12/10/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
E:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
F2 - REG:system.ini: Shell=Explorer.exe csrcs.exe
O1 - Hosts: 89.149.249.196 www.google.com
O1 - Hosts: 89.149.249.196 www.google.de
O1 - Hosts: 89.149.249.196 www.google.fr
O1 - Hosts: 89.149.249.196 www.google.co.uk
O1 - Hosts: 89.149.249.196 www.google.com.br
O1 - Hosts: 89.149.249.196 www.google.it
O1 - Hosts: 89.149.249.196 www.google.es
O1 - Hosts: 89.149.249.196 www.google.co.jp
O1 - Hosts: 89.149.249.196 www.google.com.mx
O1 - Hosts: 89.149.249.196 www.google.ca
O1 - Hosts: 89.149.249.196 www.google.com.au
O1 - Hosts: 89.149.249.196 www.google.nl
O1 - Hosts: 89.149.249.196 www.google.co.za
O1 - Hosts: 89.149.249.196 www.google.be
O1 - Hosts: 89.149.249.196 www.google.gr
O1 - Hosts: 89.149.249.196 www.google.at
O1 - Hosts: 89.149.249.196 www.google.se
O1 - Hosts: 89.149.249.196 www.google.ch
O1 - Hosts: 89.149.249.196 www.google.pt
O1 - Hosts: 89.149.249.196 www.google.dk
O1 - Hosts: 89.149.249.196 www.google.fi
O1 - Hosts: 89.149.249.196 www.google.ie
O1 - Hosts: 89.149.249.196 www.google.no
O1 - Hosts: 89.149.249.196 search.yahoo.com
O1 - Hosts: 89.149.249.196 us.search.yahoo.com
O1 - Hosts: 89.149.249.196 uk.search.yahoo.com
O1 - Hosts: 89.149.249.196 www.google.com
O1 - Hosts: 89.149.249.196 www.google.de
O1 - Hosts: 89.149.249.196 www.google.fr
O1 - Hosts: 89.149.249.196 www.google.co.uk
O1 - Hosts: 89.149.249.196 www.google.com.br
O1 - Hosts: 89.149.249.196 www.google.it
O1 - Hosts: 89.149.249.196 www.google.es
O1 - Hosts: 89.149.249.196 www.google.co.jp
O1 - Hosts: 89.149.249.196 www.google.com.mx
O1 - Hosts: 89.149.249.196 www.google.ca
O1 - Hosts: 89.149.249.196 www.google.com.au
O1 - Hosts: 89.149.249.196 www.google.nl
O1 - Hosts: 89.149.249.196 www.google.co.za
O1 - Hosts: 89.149.249.196 www.google.be
O1 - Hosts: 89.149.249.196 www.google.gr
O1 - Hosts: 89.149.249.196 www.google.at
O1 - Hosts: 89.149.249.196 www.google.se
O1 - Hosts: 89.149.249.196 www.google.ch
O1 - Hosts: 89.149.249.196 www.google.pt
O1 - Hosts: 89.149.249.196 www.google.dk
O1 - Hosts: 89.149.249.196 www.google.fi
O1 - Hosts: 89.149.249.196 www.google.ie
O1 - Hosts: 89.149.249.196 www.google.no
O1 - Hosts: 89.149.249.196 search.yahoo.com
O1 - Hosts: 89.149.249.196 us.search.yahoo.com
O1 - Hosts: 89.149.249.196 uk.search.yahoo.com
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmi\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [Adobe ARM] "C:\Programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKLM\..\Policies\Explorer\Run: [ahb9z] C:\DOCUME~1\REGION~1\IMPOST~1\Temp\zfd3mig.exe
O4 - HKLM\..\Policies\Explorer\Run: [zhswcl] C:\DOCUME~1\REGION~1\IMPOST~1\Temp\rcx7tc.exe
O4 - HKLM\..\Policies\Explorer\Run: [mslivemsn] C:\Program Files\Windows NT\Accessories\svchost.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {0a454840-7232-11d5-b63d-00c04faedb18} -
O17 - HKLM\System\CCS\Services\Tcpip\..\{164044BA-31D0-43CF-9E21-435DFC51C010}: NameServer = 10.160.7.253,10.160.16.200
O17 - HKLM\System\CCS\Services\Tcpip\..\{D6F9E730-6D6F-4811-AEBF-E886AD8D7C66}: NameServer = 85.37.17.11 85.38.28.69
O20 - AppInit_DLLs: C:\DOCUME~1\REGION~1\DATIAP~1\Opera\UPLCRT~1\msftldr.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Programmi\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: CAF - C:\Programmi\CA\DSM\Bin\cfwlogon.dll
O20 - Winlogon Notify: rcHostExt - C:\Programmi\CA\DSM\Bin\rcLoginExt.dll
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

--
End of file - 6329 bytes
Da ieri ho cominciato a notare strani comportamenti del pc che mi hanno fatto pensare ad uno spyware, e anche hijack sembrerebbe confermarlo.
I sintomi sono: pagina google "fake", programmi antivirus e antispyware non attivabili, regedit non disponibile, programmi ad esecuzione automatica che si ricreano ad ogni avvio nonostante levi la spunta, etc...

Ho già provato con l'antivirus, con superantispyware (modalità normale e provvisoria), ma nulla...

Cosa mi consigliate di fare? Grazie!

[Chill-Out]

Ciao ! Segui la Guida alla disinfezione (http://www.hwupgrade.it/forum/showthread.php?t=1599737) allegando tutti i log prodotti in un'unico post secondo le sottoindicate modalità, grazie per la collaborazione.

Modalità di pubblicazione dei log:

Ogni singolo log, esclusivamente in formato .txt a parte SynInspector .xml, deve essere hostato nell'ordine indicato in Guida su uno dei server remoti elencati nelle Regole di sezione (http://www.hwupgrade.it/forum/showthread.php?t=1751598).