Ciao a tutti, Come da titolo ho l'ennesimo problema con il PC fisso (che usa al 95% mia mamma, e secondo me è questa la causa principale di tutti i suoi mali ): comunque, da alcuni giorni, tutto d'un tratto, appena acceso compare la finestra intitolata 'Windows Defender User Interface ha smesso di funzionare'; non solo, Adobe Reader non stampa più nessuna pagina, i programmi di Office non si aprono nemmeno, l'antivirus spesso smette di funzionare, ma qui viene il bello: oggi mi sono fatto dare da mio fratello il cd di McAfee 2012 e arrivato al momento di installare il programma, sempre tutto d'un tratto, esce la solita schermata 'McAfee ha smesso di funzionare' e l'antivirus non lo installa più. Di antivirus ora c'è su Kaspersky ma a giorni (3) scade la licenza. Cos'è successo? C'è un virus vero? Ho letto un po' su internet e ho letto che probabilmente è uno spyware. Come faccio a toglierlo se l'antivirus un po' più potente non me lo fa installare? Kaspersky è quello base che non protegge dagli spyware. Vi ringrazio in anticipo per le vostre esperte risposte!
Sicuro che riesco ad installarlo però? Infatti ci ho provato e compare la solita finestra 'Il programma ha smesso di funzionare'. Ho provato anche dalla modalità provvisoria e niente!
Prova con questo http://www.combofix.org/ Se te lo fa avviare, segui le istruzioni.. sarà una cosa lunghina, ma in molti casi risolve, o perlomeno aiuya a risolvere
Per ora va. Quando finisce ti posso postare cosa mi dice? Ti ringrazio Scrondo /emoticons/wink@2x.png 2x" width="20" height="20">
ComboFix 11-11-10.03 - Michele 10/11/2011 22.47.29.1.2 - x86 Eseguito da: c:\users\Michele\Downloads\ComboFix.exe AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C} SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681} . . ((((((((((((((((((((((((((((((((((((( Altre eliminazioni ))))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\windows\system32\AutoRun.inf I:\Autorun.inf . La copia infetta di c:\windows\System32\wscript.exe è stata trovata e disinfettata ipristinata copia da - c:\windows\winsxs\x86_microsoft-windows-scripting_31bf3856ad364e35_6.0.6001.18068_none_482f75de008363d9\wscript.exe . . ((((((((((((((((((((((((( Files Creati Da 2011-10-10 al 2011-11-10 ))))))))))))))))))))))))))))))))))) . . 2011-11-10 21:53 . 2011-11-10 21:53 -------- d-----w- c:\users\Default\AppData\Local\temp 2011-11-09 20:15 . 2011-10-17 11:41 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat 2011-11-09 20:15 . 2011-09-20 21:02 905088 ----a-w- c:\windows\system32\drivers\tcpip.sys 2011-11-09 20:15 . 2011-09-30 15:57 707584 ----a-w- c:\program files\Common Files\System\wab32.dll 2011-11-09 16:43 . 2011-11-09 16:43 -------- d-----w- c:\programdata\McAfee 2011-11-06 22:43 . 2011-11-06 22:43 -------- d-----w- c:\program files\Microsoft Silverlight 2011-11-06 10:45 . 2011-11-06 10:45 -------- d-----w- C:\found.001 2011-11-06 10:38 . 2011-11-07 08:38 -------- d-----w- c:\users\Michele\AppData\Local\Solid State Networks 2011-10-31 20:04 . 2011-10-31 20:04 -------- d-----w- c:\program files\VideoLAN 2011-10-31 20:04 . 2011-10-31 20:04 -------- d-----w- c:\users\Michele\AppData\Roaming\Babylon 2011-10-31 20:04 . 2011-10-31 20:04 -------- d-----w- c:\users\Michele\AppData\Local\Babylon 2011-10-31 20:04 . 2011-10-31 20:04 -------- d-----w- c:\programdata\Babylon 2011-10-29 11:53 . 2011-11-09 20:00 -------- d-----w- c:\programdata\Microsoft Help 2011-10-29 11:53 . 2011-10-29 11:53 -------- d-----w- c:\users\Michele\AppData\Local\Microsoft Help 2011-10-29 09:55 . 2011-10-29 09:55 159744 ----a-w- c:\program files\Internet Explorer\Plugin\npqtplugin7.dll 2011-10-29 09:55 . 2011-10-29 09:55 159744 ----a-w- c:\program files\Internet Explorer\Plugin\npqtplugin6.dll 2011-10-29 09:55 . 2011-10-29 09:55 159744 ----a-w- c:\program files\Internet Explorer\Plugin\npqtplugin5.dll 2011-10-29 09:55 . 2011-10-29 09:55 159744 ----a-w- c:\program files\Internet Explorer\Plugin\npqtplugin4.dll 2011-10-29 09:55 . 2011-10-29 09:55 159744 ----a-w- c:\program files\Internet Explorer\Plugin\npqtplugin3.dll 2011-10-29 09:55 . 2011-10-29 09:55 159744 ----a-w- c:\program files\Internet Explorer\Plugin\npqtplugin2.dll 2011-10-29 09:55 . 2011-10-29 09:55 159744 ----a-w- c:\program files\Internet Explorer\Plugin\npqtplugin.dll 2011-10-29 09:05 . 2011-10-29 09:05 -------- d-----w- c:\users\Michele\AppData\Local\HP 2011-10-29 07:35 . 2011-10-29 07:35 -------- d-----w- C:\found.000 2011-10-28 07:20 . 2011-09-06 20:36 20568 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys 2011-10-28 07:20 . 2011-09-06 20:37 320856 ----a-w- c:\windows\system32\drivers\aswSP.sys 2011-10-28 07:20 . 2011-09-06 20:36 34392 ----a-w- c:\windows\system32\drivers\aswRdr.sys 2011-10-28 07:20 . 2011-09-06 20:36 52568 ----a-w- c:\windows\system32\drivers\aswTdi.sys 2011-10-28 07:20 . 2011-09-06 20:38 442200 ----a-w- c:\windows\system32\drivers\aswSnx.sys 2011-10-28 07:20 . 2011-09-06 20:36 54616 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys 2011-10-28 07:20 . 2011-09-06 20:45 41184 ----a-w- c:\windows\avastSS.scr 2011-10-28 07:20 . 2011-09-06 20:45 199304 ----a-w- c:\windows\system32\aswBoot.exe 2011-10-28 07:20 . 2011-10-28 07:20 -------- d-----w- c:\programdata\AVAST Software 2011-10-28 07:20 . 2011-10-28 07:20 -------- d-----w- c:\program files\AVAST Software 2011-10-25 12:45 . 2011-10-25 12:45 -------- d-----w- c:\program files\Microsoft.NET 2011-10-24 12:29 . 2011-10-24 12:29 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx 2011-10-24 12:29 . 2011-10-24 12:29 69632 ----a-w- c:\windows\system32\QuickTime.qts 2011-10-21 07:13 . 2011-10-21 07:13 -------- d-----w- C:\AMD 2011-10-21 07:13 . 2011-10-21 07:13 -------- d-----w- c:\programdata\ATI 2011-10-21 07:12 . 2011-10-21 07:12 -------- d-----w- c:\program files\AMD APP 2011-10-15 13:54 . 2011-10-15 14:43 -------- d-----w- c:\users\Michele\AppData\Local\Microsoft Games 2011-10-15 10:07 . 2011-10-15 10:07 -------- d-----w- c:\users\Michele\AppData\Roaming\FLEXnet 2011-10-15 10:01 . 2011-10-15 10:01 -------- d-----w- c:\users\Michele\AppData\Roaming\Vodafone 2011-10-15 10:00 . 2009-07-23 09:57 112128 ----a-w- c:\windows\system32\drivers\ewusbnet.sys 2011-10-15 10:00 . 2009-07-23 09:57 102912 ----a-w- c:\windows\system32\drivers\ewusbmdm.sys 2011-10-15 10:00 . 2011-10-15 10:00 -------- d-----w- c:\programdata\Vodafone 2011-10-15 09:59 . 2011-10-15 09:59 -------- d-----w- c:\programdata\FLEXnet 2011-10-15 09:59 . 2011-10-15 09:59 -------- d-----w- c:\program files\Vodafone 2011-10-15 09:59 . 2011-10-15 09:59 -------- d-----w- c:\users\Michele\AppData\Local\{4D4E02EE-0904-4442-8E6A-B77395E9B072} 2011-10-13 08:17 . 2011-09-06 13:30 2043392 ----a-w- c:\windows\system32\win32k.sys 2011-10-13 08:17 . 2011-07-29 16:01 293376 ----a-w- c:\windows\system32\psisdecd.dll 2011-10-13 08:17 . 2011-07-29 16:01 217088 ----a-w- c:\windows\system32\psisrndr.ax 2011-10-13 08:17 . 2011-07-29 16:00 57856 ----a-w- c:\windows\system32\MSDvbNP.ax 2011-10-13 08:17 . 2011-07-29 16:00 69632 ----a-w- c:\windows\system32\Mpeg2Data.ax 2011-10-13 08:17 . 2011-08-25 16:15 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll 2011-10-13 08:17 . 2011-08-25 16:14 563712 ----a-w- c:\windows\system32\oleaut32.dll 2011-10-13 08:17 . 2011-08-25 16:14 238080 ----a-w- c:\windows\system32\oleacc.dll 2011-10-13 08:17 . 2011-08-25 13:31 4096 ----a-w- c:\windows\system32\oleaccrc.dll 2011-10-12 08:58 . 2009-05-18 11:17 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys 2011-10-12 08:58 . 2008-04-17 10:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll 2011-10-12 08:57 . 2011-10-12 08:57 -------- d-----w- c:\program files\iPod 2011-10-12 08:57 . 2011-10-12 08:58 -------- d-----w- c:\program files\iTunes 2011-10-12 08:52 . 2011-10-12 08:52 -------- d-----w- c:\program files\Bonjour . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-10-03 03:06 . 2011-09-12 16:19 472808 ----a-w- c:\windows\system32\deployJava1.dll 2011-09-28 09:48 . 2011-09-28 09:48 445016 ----a-w- c:\windows\system32\wrap_oal.dll 2011-09-28 09:48 . 2011-09-28 09:48 109144 ----a-w- c:\windows\system32\OpenAL32.dll 2011-09-16 07:11 . 2011-09-16 07:11 86528 ----a-w- c:\windows\system32\iesysprep.dll 2011-09-16 07:11 . 2011-09-16 07:11 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe 2011-09-16 07:11 . 2011-09-16 07:11 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe 2011-09-16 07:11 . 2011-09-16 07:11 63488 ----a-w- c:\windows\system32\tdc.ocx 2011-09-16 07:11 . 2011-09-16 07:11 48640 ----a-w- c:\windows\system32\mshtmler.dll 2011-09-16 07:11 . 2011-09-16 07:11 161792 ----a-w- c:\windows\system32\msls31.dll 2011-09-16 07:10 . 2011-09-16 07:10 367104 ----a-w- c:\windows\system32\html.iec 2011-09-16 07:10 . 2011-09-16 07:10 74752 ----a-w- c:\windows\system32\iesetup.dll 2011-09-16 07:10 . 2011-09-16 07:10 420864 ----a-w- c:\windows\system32\vbscript.dll 2011-09-16 07:10 . 2011-09-16 07:10 35840 ----a-w- c:\windows\system32\imgutil.dll 2011-09-16 07:10 . 2011-09-16 07:10 23552 ----a-w- c:\windows\system32\licmgr10.dll 2011-09-16 07:10 . 2011-09-16 07:10 152064 ----a-w- c:\windows\system32\wextract.exe 2011-09-16 07:10 . 2011-09-16 07:10 150528 ----a-w- c:\windows\system32\iexpress.exe 2011-09-16 07:10 . 2011-09-16 07:10 142848 ----a-w- c:\windows\system32\ieUnatt.exe 2011-09-16 07:10 . 2011-09-16 07:10 1427456 ----a-w- c:\windows\system32\inetcpl.cpl 2011-09-16 07:10 . 2011-09-16 07:10 11776 ----a-w- c:\windows\system32\mshta.exe 2011-09-16 07:10 . 2011-09-16 07:10 101888 ----a-w- c:\windows\system32\admparse.dll 2011-09-16 07:10 . 2011-09-16 07:10 110592 ----a-w- c:\windows\system32\IEAdvpack.dll 2011-09-14 09:47 . 2011-09-14 09:47 53760 ----a-w- c:\windows\system32\OVDecode.dll 2011-09-14 09:46 . 2011-09-14 09:46 13625856 ----a-w- c:\windows\system32\amdocl.dll 2011-09-14 09:38 . 2011-09-14 09:38 37376 ----a-w- c:\windows\system32\amdoclcl.dll 2011-09-14 07:32 . 2011-09-14 07:32 232512 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys 2011-09-13 17:55 . 2011-09-12 09:24 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-09-13 08:56 . 2006-11-02 10:32 101888 ----a-w- c:\windows\system32\ifxcardm.dll 2011-09-13 08:56 . 2006-11-02 10:32 82432 ----a-w- c:\windows\system32\axaltocm.dll 2011-09-12 09:28 . 2011-09-12 09:28 319456 ----a-w- c:\windows\DIFxAPI.dll 2011-09-12 09:28 . 2011-09-12 09:28 315392 ----a-w- c:\windows\HideWin.exe 2011-09-12 09:27 . 2011-09-12 09:28 532480 ----a-w- c:\windows\system32\RTSndMgr.cpl 2011-09-12 09:27 . 2011-09-12 09:28 339968 ----a-w- c:\windows\system32\SRSTSXT.dll 2011-09-12 09:27 . 2011-09-12 09:28 185776 ----a-w- c:\windows\system32\SRSTSHD.dll 2011-09-12 09:27 . 2011-09-12 09:28 1826816 ----a-w- c:\windows\SkyTel.exe 2011-09-12 09:27 . 2011-09-12 09:28 167936 ----a-w- c:\windows\system32\SRSHP360.dll 2011-09-12 09:27 . 2011-09-12 09:28 135168 ----a-w- c:\windows\system32\SRSWOW.dll 2011-09-12 09:27 . 2011-09-12 09:28 1191936 ----a-w- c:\windows\RtlUpd.exe 2011-09-12 09:27 . 2011-09-12 09:28 98304 ----a-w- c:\windows\RTKAUDIOSERVICE.EXE 2011-09-12 09:27 . 2011-09-12 09:28 582656 ----a-w- c:\windows\system32\RtkPgExt.dll 2011-09-12 09:27 . 2011-09-12 09:28 4718592 ----a-w- c:\windows\RtHDVCpl.exe 2011-09-12 09:27 . 2011-09-12 09:28 29184 ----a-w- c:\windows\system32\RtkCoInst.dll 2011-09-12 09:27 . 2011-09-12 09:28 266240 ----a-w- c:\windows\system32\RtkApoApi.dll 2011-09-12 09:27 . 2011-09-12 09:28 2101248 ----a-w- c:\windows\system32\RtkAPO.dll 2011-09-12 09:27 . 2011-09-12 09:28 2032280 ----a-w- c:\windows\system32\drivers\RTKVHDA.sys 2011-09-12 09:27 . 2011-09-12 09:28 126976 ----a-w- c:\windows\system32\maxxaudioapo.dll 2011-09-12 09:27 . 2011-09-12 09:28 520192 ----a-w- c:\windows\RtlExUpd.dll 2011-09-12 09:15 . 2011-09-12 09:15 172032 ----a-w- c:\windows\system32\wintrust.dll 2011-09-12 09:14 . 2011-09-12 09:14 98304 ----a-w- c:\windows\system32\cabview.dll 2011-09-12 09:10 . 2011-09-12 09:10 53472 ----a-w- c:\windows\system32\wuauclt.exe 2011-09-12 09:10 . 2011-09-12 09:10 44768 ----a-w- c:\windows\system32\wups2.dll 2011-09-12 09:10 . 2011-09-12 09:10 2421760 ----a-w- c:\windows\system32\wucltux.dll 2011-09-12 09:10 . 2011-09-12 09:10 1929952 ----a-w- c:\windows\system32\wuaueng.dll 2011-09-12 09:09 . 2011-09-12 09:09 87552 ----a-w- c:\windows\system32\wudriver.dll 2011-09-12 09:09 . 2011-09-12 09:09 575704 ----a-w- c:\windows\system32\wuapi.dll 2011-09-12 09:09 . 2011-09-12 09:09 35552 ----a-w- c:\windows\system32\wups.dll 2011-09-12 09:09 . 2011-09-12 09:09 33792 ----a-w- c:\windows\system32\wuapp.exe 2011-09-12 09:09 . 2011-09-12 09:09 171608 ----a-w- c:\windows\system32\wuwebv.dll 2011-09-08 18:26 . 2011-09-08 18:26 8606208 ----a-w- c:\windows\system32\drivers\atikmdag.sys 2011-09-08 17:39 . 2011-09-08 17:39 18534912 ----a-w- c:\windows\system32\atioglxx.dll 2011-09-08 17:34 . 2011-09-08 17:34 151552 ----a-w- c:\windows\system32\atiapfxx.exe 2011-09-08 17:34 . 2011-07-28 21:40 732672 ----a-w- c:\windows\system32\aticfx32.dll 2011-09-08 17:30 . 2011-07-28 21:36 466944 ----a-w- c:\windows\system32\ATIDEMGX.dll 2011-09-08 17:30 . 2011-09-08 17:30 401408 ----a-w- c:\windows\system32\atieclxx.exe 2011-09-08 17:29 . 2011-09-08 17:29 176128 ----a-w- c:\windows\system32\atiesrxx.exe 2011-09-08 17:28 . 2011-09-08 17:28 159744 ----a-w- c:\windows\system32\atitmmxx.dll 2011-09-08 17:28 . 2011-07-28 21:33 356352 ----a-w- c:\windows\system32\atipdlxx.dll 2011-09-08 17:28 . 2011-09-08 17:28 278528 ----a-w- c:\windows\system32\Oemdspif.dll 2011-09-08 17:28 . 2011-09-08 17:28 20992 ----a-w- c:\windows\system32\atimuixx.dll 2011-09-08 17:28 . 2011-09-08 17:28 43520 ----a-w- c:\windows\system32\ati2edxx.dll 2011-09-08 17:24 . 2011-07-28 21:30 4204032 ----a-w- c:\windows\system32\atidxx32.dll 2011-09-08 17:18 . 2011-09-08 17:18 1828864 ----a-w- c:\windows\system32\atiumdmv.dll 2011-09-08 17:09 . 2011-09-08 17:09 46080 ----a-w- c:\windows\system32\aticalrt.dll 2011-09-08 17:09 . 2011-09-08 17:09 44032 ----a-w- c:\windows\system32\aticalcl.dll 2011-09-08 17:08 . 2011-07-28 21:03 4064768 ----a-w- c:\windows\system32\atiumdva.dll 2011-09-08 17:05 . 2011-09-08 17:05 7331840 ----a-w- c:\windows\system32\aticaldd.dll 2011-09-08 17:05 . 2011-07-28 21:09 4289024 ----a-w- c:\windows\system32\atiumdag.dll 2011-09-08 16:59 . 2011-07-28 21:01 52736 ----a-w- c:\windows\system32\coinst.dll 2011-09-08 16:53 . 2011-07-28 20:54 270336 ----a-w- c:\windows\system32\atiadlxx.dll 2011-09-08 16:52 . 2011-09-08 16:52 13312 ----a-w- c:\windows\system32\atiglpxx.dll 2011-09-08 16:52 . 2011-09-08 16:52 32768 ----a-w- c:\windows\system32\atigktxx.dll 2011-09-08 16:52 . 2011-09-08 16:52 248832 ----a-w- c:\windows\system32\drivers\atikmpag.sys 2011-09-08 16:51 . 2011-07-28 20:53 31744 ----a-w- c:\windows\system32\atiuxpag.dll 2011-09-08 16:51 . 2011-07-28 20:53 29184 ----a-w- c:\windows\system32\atiu9pag.dll 2011-09-08 16:51 . 2011-07-28 20:52 37376 ----a-w- c:\windows\system32\atitmpxx.dll 2011-09-08 16:51 . 2011-09-08 16:51 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll 2011-09-08 16:50 . 2011-09-08 16:50 53760 ----a-w- c:\windows\system32\atimpc32.dll 2011-09-08 16:50 . 2011-09-08 16:50 53760 ----a-w- c:\windows\system32\amdpcom32.dll 2011-08-30 21:05 . 2011-08-30 21:05 83816 ----a-w- c:\windows\system32\dns-sd.exe 2011-08-30 21:05 . 2011-08-30 21:05 73064 ----a-w- c:\windows\system32\dnssd.dll 2011-08-30 21:05 . 2011-08-30 21:05 50536 ----a-w- c:\windows\system32\jdns_sd.dll 2011-08-30 21:05 . 2011-08-30 21:05 178536 ----a-w- c:\windows\system32\dnssdX.dll 2011-09-29 07:23 . 2011-09-13 14:23 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
. . ((((((((((((((((((((((((((((((((((((( Punti Reg Caricati )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* i valori vuoti & legittimi/default non sono visualizzati. REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}] 2011-09-06 20:45 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2011-08-02 4910912] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="RtHDVCpl.exe" [2011-09-12 4718592] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-10-09 421736] "MobileConnect"="c:\program files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe" [2009-09-18 2412032] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-09-08 343168] "avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-09-06 3722416] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-3-11 210520] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2362387464-3492667061-1156208243-1000] "EnableNotificationsRef"=dword:00000001 . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 cvhsvc;Client Virtualization Handler;c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-10-20 821664] R2 gupdate;Servizio Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-09-13 136176] R2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [2010-09-14 508264] R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [2009-07-23 112128] R3 gupdatem;Servizio Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2011-09-13 136176] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000] R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504] S1 aswSnx;aswSnx; [x] S1 aswSP;aswSP; [x] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-09-08 176128] S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-09-08 291840] S2 aswFsBlk;aswFsBlk; [x] S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-09-06 54616] S2 VMCService;Vodafone Mobile Connect Service;c:\program files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [2009-09-18 9216] S3 amdiox86;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox86.sys [2010-02-18 37944] S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2011-09-08 8606208] S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2011-09-08 248832] S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdLH3.sys [2011-06-06 81936] S3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-09-14 232512] S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2010-09-14 577384] S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2010-09-14 194408] S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2010-09-14 21864] S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2010-09-14 19304] S3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [2010-09-14 219496] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . Contenuto della cartella 'Scheduled Tasks' . 2011-11-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2011-09-13 17:55] . 2011-11-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2011-09-13 17:55] . . ------- Scansione supplementare ------- . uStart Page = hxxp://www.google.it/ uInternet Settings,ProxyOverride = *.local TCP: DhcpNameServer = 192.168.1.1 192.168.1.1 FF - ProfilePath - c:\users\Michele\AppData\Roaming\Mozilla\Firefox\Profiles\2yg75che.default\ . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2011-11-10 22:55 Windows 6.0.6002 Service Pack 2 NTFS . scansione processi nascosti ... . scansione entrate autostart nascoste ... . Scansione files nascosti ... . Scansione completata con successo Files nascosti: 0 . ************************************************************************** . --------------------- CHIAVI DI REGISTRO BLOCCATE --------------------- . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . ------------------------ Altri processi in esecuzione ------------------------ . c:\windows\system32\atieclxx.exe c:\program files\AVAST Software\Avast\AvastSvc.exe c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE c:\windows\system32\WUDFHost.exe c:\windows\system32\conime.exe c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe c:\windows\RtHDVCpl.exe c:\program files\iPod\bin\iPodService.exe c:\\?\c:\windows\system32\wbem\WMIADAP.EXE . ************************************************************************** . Ora fine scansione: 2011-11-10 22:58:44 - Il pc è stato riavviato ComboFix-quarantined-files.txt 2011-11-10 21:58 . Pre-Run: 168.945.917.952 byte disponibili Post-Run: 170.047.094.784 byte disponibili . - - End Of File - - FB0FF702617FC545BB53FC1D07F3125A Cosa faccio ora? Comunque, ho letto (non capendo nulla) che segna anche degli errori su I:, che è l'Hard Disk esterno. Mah! Ti ringrazio fin da ora per l'aiuto! Buona serata e grazie ancora! /emoticons/wink@2x.png 2x" width="20" height="20">
Dovrebbe aver ripulito un pochino.. Ora me lo leggo bene, e poi ti dico come procedere, nel frattempo se si è riavviato l'antivirus, fai una scansine del disco esterno
da quel che si capisce dal log dovresti essere "pulito", prova a far girare qualche antivirus, magari anche Malwarebytes' Anti-Malware, se nonrilevano nulla sei apposto, se invece beccano qualcosa, posta i log
Ho provato con Avast (l'unico che si installa e che funziona) e non trova minacce né sull'HD esterno né all'interno del pc. Ho provato allora a rimettere il CD di McAfee e nulla, appena inizia ad installarlo chiude il programma e compare che ha smesso di funzionare. I programmi (Word, Adobe Reader, etc.) non vanno come prima! Boh PS_Intanto rep+ /emoticons/wink@2x.png 2x" width="20" height="20">
Mmmmmm.. Non siamo ancora riusciti a capire cosa è il malware.. Dal comportamento sembra una variante di Bagle, ma potrebbe essere anche un rootkit.. Andiamo per esclusione: fai girare questo: http://www.zonavirus.com/descargas/elibagla.asp e poi dimmi se rileva qualcosa..
Prova cosi: 1. disattivare ripristino di windows. 2. appena avvi il pc, premere f8 dopo schermata bios e andare in modalità provvisoria con rete. 3. lanciare rkill http://www.bleepingcomputer.com/download/anti-virus/rkill 4. isntallare malwarebytes e superantispyware, e fare tutti gli aggiornamenti possibili 5. lanciare prima supernatispyware e poi malwarebytes in modalità scansione completa e non veloce 6. se trovano qualcosa posta altrimenti sempre in modalità provvisoria (che sistema operativo - windows - usi?) lanciare il commando sfc /scannow (serve per fare il controllo dei file del sistema e ripristinarli se hanno subito modifiche. 7. se il punto 6 non funziona e se funzionasse scaricare (attensione, tutte le operazioni dalla modalità provvisoria) avira antivir, una volta installato andare nelle impostazioni e abilitare tutto quello che trovi, stassera ti spieghero dove e cosa e fare una scansione, naturalmente agigornato prima. 8. se non funziona e hai un altro cd scaricare e masterizzare un programma live cd chiamato "HIREN", ha un sacco di utility di cui per scansioni, ripristini e molto ancora.
Quando ho un attimo di tempo faccio tutto! Uso Win Vista comunque /emoticons/wink@2x.png 2x" width="20" height="20"> Grazie mille!
