lentezza nel caricamento di pagine di internet explorer

ciao...ultimamente il pc è lento nell'aprire pagine di internet expolrer praticamnete quando riaccendo il pc e entro su IE dopo poco avast mi trova infezioni nel file system e se provo a fare una scansione me li trova nel system e nel system volume information...a volte mi si aprono pagine dal nulla...alcune pagine mi carica ope un monte e non mi si aprono...ho provato a cambiare antivirus antispyware e firewelled ma nulla...vi posso il log di hijackthis....grazie a tutti per l'impegno...


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21.17.59, on 16/02/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programmi\Bonjour\mDNSResponder.exe
C:\Programmi\COMODO\COMODO Internet Security\cmdagent.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
c:\Programmi\File comuni\Symantec Shared\Security Center\SymWSC.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hphmon06.exe
C:\WINDOWS\system32\keyhook.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\ps2.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Programmi\Trust\Trust MD3100 USB ADSL MODEM\CnxDslTb.exe
C:\Programmi\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Programmi\PowerISO\PWRISOVM.EXE
C:\Programmi\ATI Technologies\ATI.ACE\cli.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\Programmi\QuickTime\QTTask.exe
C:\Programmi\iTunes\iTunesHelper.exe
C:\Programmi\COMODO\COMODO Internet Security\cfp.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\DAEMON Tools\daemon.exe
C:\Programmi\Electronic Arts\EADM\Core.exe
C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\Programmi\HP\Digital Imaging\bin\hpqimzone.exe
c:\Programmi\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Programmi\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Programmi\ATI Technologies\ATI.ACE\cli.exe
C:\Programmi\ATI Technologies\ATI.ACE\cli.exe
C:\Programmi\HiJackThis\HijackThis.exe
C:\Programmi\TuneUp Utilities 2007\SystemOptimizer.exe
C:\Programmi\TuneUp Utilities 2007\RegistryCleaner.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=IT_IT&c=Q404&bd=pavilion&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=IT_IT&c=Q404&bd=pavilion&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=IT_IT&c=Q404&bd=pavilion&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=IT_IT&c=Q404&bd=pavilion&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=IT_IT&c=Q404&bd=pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=IT_IT&c=Q404&bd=pavilion&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {27D5E619-B5F8-4950-9D1D-B309CC7F4E1B} - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Programmi\Windows Live\Messenger\wlchtc.dll
O2 - BHO: (no name) - {7371760F-B8CF-E61F-EEB9-B06E8A9E9ABC} - (no file)
O2 - BHO: (no name) - {77AB5974-55A3-4737-9FD5-B93C64307F78} - C:\WINDOWS\system32\gidwqfay.dll
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {cc9b2423-4487-4cba-9e28-3bb2eb2f7919} - (no file)
O2 - BHO: (no name) - {F55BF3A0-9F3C-48A8-BD84-2B0B4DF204A5} - (no file)
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Programmi\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Programmi\Trust\Trust MD3100 USB ADSL MODEM\CnxDslTb.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programmi\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Programmi\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Programmi\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Programmi\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [CPMe70a221e] Rundll32.exe "c:\windows\system32\dimoburi.dll",a
O4 - HKLM\..\Run: [kuwetuvoje] Rundll32.exe "C:\WINDOWS\system32\wonanola.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Programmi\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [EA Core] C:\Programmi\Electronic Arts\EADM\Core.exe -silent
O4 - HKCU\..\Policies\Explorer\Run: [NT Printing Services6] dllhosts.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [kuwetuvoje] Rundll32.exe "C:\WINDOWS\system32\wonanola.dll",s (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - Global Startup: Avvio rapido di HP Image Zone.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Tasto di scelta rapida per l'avvio di AutoCAD.lnk = C:\Programmi\File comuni\Autodesk Shared\acstart17.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Inserisci blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programmi\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: Inserisci &blog in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programmi\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab_srl.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4BFD075D-C36E-4F28-BB0A-5D472795197A} (PowerLoader Class) - http://powersoccer.giocaregratis.it/applet/PowerLoader.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/IT-IT/a-UNO1/GAME_UNO1.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
O16 - DPF: {B2BE75F3-9197-11CF-ABF4-08000996E931} (Autodesk WHIP! Control) - ftp://ftp.autodesk.com/pub/whip/english/whip.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game06.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://gamenextit.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll c:\windows\system32\dimoburi.dll,C:\WINDOWS\system32\wisegava.dll
O20 - Winlogon Notify: hggdbcy - hggdbcy.dll (file missing)
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\dimoburi.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\dimoburi.dll
O23 - Service: Norton 2009 Reset (.norton2009Reset) - Unknown owner - C:\Documents and Settings\All Users\Dati applicazioni\Norton\Norton2009Reset.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Programmi\File comuni\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Programmi\Bonjour\mDNSResponder.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - C:\Programmi\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Programmi\File comuni\Symantec Shared\Security Center\SymWSC.exe

--
End of file - 13683 bytes
cosa ne pensate?

Ciao e ben arrivato/a esofunnyhouse,

effettivamente il tuo pc é infetto, fai cosi;

* Scarica e installa Ccleaner
(Quando lo installi ricordati che se lasci le spunte di defaut ,verrà installata anche la toolbar yahoo)

* Disconnetti completamente da Internet (cavo tirato o modem spento)

* Assicurati di avere accesso a file e cartelle nascosti
(Pannello di controllo-> Opzioni Cartella-> Visualizzazione)
1) metti la spunta su: Visualizza file e cartelle nascoste
2) Disattiva: nascondi file protetti di sistema

Avvia in modalità provvisoria
(F8 all'avvio del sistema)

* Avvia hijackthis, metti la spunta alle voci che andro ad elencarti e con tutte le applicazioni chiuse premi su fix checked (Ovviamente se qualcuna la conosci trascurala)
O2 - BHO: (no name) - {27D5E619-B5F8-4950-9D1D-B309CC7F4E1B} - (no file)
O2 - BHO: (no name) - {7371760F-B8CF-E61F-EEB9-B06E8A9E9ABC} - (no file)
O2 - BHO: (no name) - {77AB5974-55A3-4737-9FD5-B93C64307F78} - C:\WINDOWS\system32\gidwqfay.dll
O2 - BHO: (no name) - {cc9b2423-4487-4cba-9e28-3bb2eb2f7919} - (no file)
O2 - BHO: (no name) - {F55BF3A0-9F3C-48A8-BD84-2B0B4DF204A5} - (no file)
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [CPMe70a221e] Rundll32.exe "c:\windows\system32\dimoburi.dll",a
O4 - HKLM\..\Run: [kuwetuvoje] Rundll32.exe "C:\WINDOWS\system32\wonanola.dll",s
O4 - HKCU\..\Policies\Explorer\Run: [NT Printing Services6] dllhosts.exe
O4 - HKUS\S-1-5-19\..\Run: [kuwetuvoje] Rundll32.exe "C:\WINDOWS\system32\wonanola.dll",s (User 'SERVIZIO LOCALE')
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://gamenextit.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab
O20 - Winlogon Notify: hggdbcy - hggdbcy.dll (file missing)
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\dimoburi.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\dimoburi.dll
O23 - Service: Norton 2009 Reset (.norton2009Reset) - Unknown owner - C:\Documents and Settings\All Users\Dati applicazioni\Norton\Norton2009Reset.exe

* Cerca ed elimina;
C:\WINDOWS\system32\gidwqfay.dll
c:\windows\system32\dimoburi.dll

* Dai una ripulita a cookie,cache e prefetch con Ccleaner
(prima di usarlo vai in Opzioni/avanzate e togli la spunta da :Elimina file temp di Windows solo se piu vecchi di 48 ore)

* Svuota la cartella C:\Windows\Tasks

* Ritorna in modalità normale

* Ri-connettiti ad internet

* Scarica e installa MalwareBytes Antimalware
http://www.majorgeeks.com/downloadget.php?id=5756&file=15&evp=693ee0b20204960edfd909666f809b26
aggiornalo, fai uno scan completo del sistema ed elimina quello che trova
Posta il suo log insieme ad un log aggiornato hijackthis

_____________________________________________
Alla fine delle procedure di pulizia è fondamentale :
1) ri-nascondere i file e le cartelle di sistema
2) Disattivare / Riattivare il ripristino configurazione di sistema (XP / ME / Vista)
3) Creare un nuovo punto di ripristino

allora ho fatto quello che mi avevi detto anche se il file gidwqfay.dll non l'ho trovato mentre dimoburi.dll l'ho eliminato con AGVPFIX perchè me lo aveva trovato avast,l'ho spostato e rinominato e eliminato con il programma che ti ho detto..poi ho notato che quando accendo il pc mi appare questo avviso...impossibile trovare il modulo specificato riferito a dimoduri.dll....mentra facevi questi processi avast mi ha trovato altri virus e me li ha spostati e rinominati in una cartella in modo che con AGVPFIX li possa eliminare anche se ancora non l'ho fatto...cmq ti posto il log di MalwareBytes Antimalware anche se è parziale perchè mi è mancato tempo e volevo fartelo intanto vedere e il log di hijackthis fatto dopo....



Malwarebytes' Anti-Malware 1.34
Versione del database: 1771
Windows 5.1.2600 Service Pack 3

18/02/2009 0.49.59
mbam-log-2009-02-18 (00-49-59).txt

Tipo di scansione: Scansione completa (C:\|D:\|)
Elementi scansionati: 98131
Tempo trascorso: 58 minute(s), 28 second(s)

Processi delle memoria infetti: 0
Moduli della memoria infetti: 0
Chiavi di registro infette: 1
Valori di registro infetti: 4
Elementi dato del registro infetti: 0
Cartelle infette: 0
File infetti: 4

Processi delle memoria infetti:
(Nessun elemento malevolo rilevato)

Moduli della memoria infetti:
(Nessun elemento malevolo rilevato)

Chiavi di registro infette:
HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> Quarantined and deleted successfully.

Valori di registro infetti:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpme70a221e (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{e908a6a7-026c-4fbe-93a9-96020beead53} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.BHO) -> Quarantined and deleted successfully.

Elementi dato del registro infetti:
(Nessun elemento malevolo rilevato)

Cartelle infette:
(Nessun elemento malevolo rilevato)

File infetti:
C:\WINDOWS\system32\rafahupu.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\upuhafar.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\veketaha.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ahatekev.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.

mi tocca a fare due post perchè mi dice che la risposta è troppo lunga

questo è il log di hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 0.51.29, on 18/02/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hphmon06.exe
C:\WINDOWS\system32\keyhook.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\ps2.exe
C:\Programmi\Trust\Trust MD3100 USB ADSL MODEM\CnxDslTb.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programmi\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Programmi\PowerISO\PWRISOVM.EXE
C:\Programmi\Bonjour\mDNSResponder.exe
C:\Programmi\COMODO\COMODO Internet Security\cmdagent.exe
C:\Programmi\ATI Technologies\ATI.ACE\cli.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\Programmi\QuickTime\QTTask.exe
C:\Programmi\iTunes\iTunesHelper.exe
C:\Programmi\COMODO\COMODO Internet Security\cfp.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\DAEMON Tools\daemon.exe
C:\Programmi\Electronic Arts\EADM\Core.exe
C:\WINDOWS\system32\svchost.exe
c:\Programmi\File comuni\Symantec Shared\Security Center\SymWSC.exe
C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
C:\Programmi\HP\Digital Imaging\bin\hpqimzone.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\Programmi\iPod\bin\iPodService.exe
c:\Programmi\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Programmi\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Programmi\ATI Technologies\ATI.ACE\cli.exe
C:\Programmi\ATI Technologies\ATI.ACE\cli.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Programmi\HiJackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=IT_IT&c=Q404&bd=pavilion&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=IT_IT&c=Q404&bd=pavilion&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=IT_IT&c=Q404&bd=pavilion&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=IT_IT&c=Q404&bd=pavilion&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=IT_IT&c=Q404&bd=pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=IT_IT&c=Q404&bd=pavilion&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Programmi\Windows Live\Messenger\wlchtc.dll
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {cc9b2423-4487-4cba-9e28-3bb2eb2f7919} - (no file)
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Programmi\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Programmi\Trust\Trust MD3100 USB ADSL MODEM\CnxDslTb.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programmi\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Programmi\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Programmi\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Programmi\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Programmi\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Programmi\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [EA Core] C:\Programmi\Electronic Arts\EADM\Core.exe -silent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [kuwetuvoje] Rundll32.exe "C:\WINDOWS\system32\wonanola.dll",s (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - Global Startup: Avvio rapido di HP Image Zone.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Tasto di scelta rapida per l'avvio di AutoCAD.lnk = C:\Programmi\File comuni\Autodesk Shared\acstart17.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Inserisci blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programmi\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: Inserisci &blog in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programmi\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab_srl.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4BFD075D-C36E-4F28-BB0A-5D472795197A} (PowerLoader Class) - http://powersoccer.giocaregratis.it/applet/PowerLoader.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/IT-IT/a-UNO1/GAME_UNO1.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
O16 - DPF: {B2BE75F3-9197-11CF-ABF4-08000996E931} (Autodesk WHIP! Control) - ftp://ftp.autodesk.com/pub/whip/english/whip.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game06.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5F5B7B62-B5F5-4E98-93CA-F3D4FD5099BB}: NameServer = 193.70.152.15 193.70.152.25
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll C:\WINDOWS\system32\wisegava.dll c:\windows\system32\dimoburi.dll
O23 - Service: Norton 2009 Reset (.norton2009Reset) - Unknown owner - C:\Documents and Settings\All Users\Dati applicazioni\Norton\Norton2009Reset.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Programmi\File comuni\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Programmi\Bonjour\mDNSResponder.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - C:\Programmi\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Programmi\File comuni\Symantec Shared\Security Center\SymWSC.exe

--
End of file - 12842 bytes

ciao esofunnyhouse,

il computer é ancora infetto, fai cosi;
(mi raccomando la procedura é da seguire alla lettera)

Consigli..
- Disinstalla Avast e installa Antivir
- Vedo che hai Comodo Internet Security ,il quale comprende anche Antivirus e Firewall, quindi Comodo e Avast in questo caso creano solo problemi.

* Avvia hijackthis, metti la spunta alle voci che andro ad elencarti e con tutte le applicazioni chiuse premi su fix checked (Ovviamente se qualcuna la conosci trascurala)
O2 - BHO: (no name) - {cc9b2423-4487-4cba-9e28-3bb2eb2f7919} - (no file)
O4 - HKUS\S-1-5-19\..\Run: [kuwetuvoje] Rundll32.exe "C:\WINDOWS\system32\wonanola.dll",s (User 'SERVIZIO LOCALE')
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll C:\WINDOWS\system32\wisegava.dll c:\windows\system32\dimoburi.dll
O23 - Service: Norton 2009 Reset (.norton2009Reset) - Unknown owner - C:\Documents and Settings\All Users\Dati applicazioni\Norton\Norton2009Reset.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Programmi\File comuni\Symantec Shared\Security Center\SymWSC.exe

* Cerca ed elimina ;
C:\WINDOWS\system32\wisegava.dll
c:\windows\system32\dimoburi.dll

* Fai anche uno scan online Kaspersky e posta il suo log

* Si dovrebbe sfoltire anche quella marea di applicazioni in avvio automatico

comodo c'è l'ho solo antifirewelled...li devo fare in modalità provvisoria vero?

allora esofunnyhouse,

due firewall e due antivirus residenti non si installano per nessun motivo, creano solo problemi....

per la procedura di fix delle voci ed eliminazione dei file , si devi avviare in modalità provvisoria

durante la procedura non ho trovato queste voci:
-O4 - HKUS\S-1-5-19\..\Run: [kuwetuvoje] Rundll32.exe "C:\WINDOWS\system32\wonanola.dll",s (User 'SERVIZIO LOCALE')
-C:\WINDOWS\system32\wisegava.dll
-c:\windows\system32\dimoburi.dll
ora sto provando a fare la scansione on line anche se non mi riesce mai finirla perchè arrivo a un punto in cui mi si blocca e non mi va più avanti....che devo fare?...ci riprovo a scansionare on-line?

ricapitoliamo,

le voci hijackthis vedi se appaiono dalla modalità normale, se si fixale

per i due file, sicuro di aver attivato la visualizzazione dei file nascosti?

comunque faigirare combofix come spiiegato qu e posta il suo log.
http://www.steven.altervista.org/files/tools.html#tools1

l'ho fatto in modalità normale e ho trovato e fixato queste:
O4 - HKUS\S-1-5-19\..\Run: [kuwetuvoje] Rundll32.exe "C:\WINDOWS\system32\wonanola.dll",s (User 'SERVIZIO LOCALE')
O23 - Service: Norton 2009 Reset (.norton2009Reset) - Unknown owner - C:\Documents and Settings\All Users\Dati applicazioni\Norton\Norton2009Reset.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Programmi\File comuni\Symantec Shared\Security Center\SymWSC.exe

anche se non ho trovato:
-C:\WINDOWS\system32\wisegava.dll
-c:\windows\system32\dimoburi.dll
ora provo a vedere con combofix

dopo aver aperto combofix e cliccato su esegui mi aapre una pagina di blocco note con scritto:

SDFix has been extracted to %systemdrive%\SDFix\
(Drive that contains the Windows directory - typically C:\SDFix)

Open the SDFix folder in Safe Mode and double click the RunThis.bat file to start the fixtool
If RunThis.bat is started in Normal Mode, options to download and run Anti-Virus command line scanners are displayed

Catchme.exe Stealth Malware Detector by GMER is also included in the SDFix folder

Additional SDFix Instructions & screen shots can be found here - http://www.bleepingcomputer.com/forums/topic131299.html

che devo fare?...altra cosa quei file 023 non possono essere dovuti agli aggionamenti di windows automatici?
cioè li ci sono due metodi quello in modalità normale che non mi parte e quello in modalità provvisoria che si capisce un po meglio...quale dei due devo fare?....il grazie per tutto quello che stai facendo è scontato

quei due 023 sono legati a vecchie installazioni del norton...

tu hai scaricato SDFix e non Combofix

segui questo link e aspetta che la tua pagina si sia caricata completamente
http://www.steven.altervista.org/files/tools.html#tools1

questo è il log di combofix

ComboFix 09-02-18.01 - HP_Proprietario 2009-02-19 15.25.53.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1040.18.511.211 [GMT 1:00]
Eseguito da: c:\documents and settings\HP_Proprietario\Documenti\programmi da installare\ComboFix.exe
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)
FW: COMODO Firewall *disabled*
* Creato nuovo punto di ripristino
.
ADS - system32: deleted 2307 bytes in 1 streams.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\check_LSA7.txt
c:\documents and settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\HP_Proprietario\Documenti\MBOLS~1
c:\documents and settings\HP_Proprietario\Documenti\MBOLS~1\??mbols\
c:\programmi\appatc~1
c:\windows\system32\arotevew.ini
c:\windows\system32\asemlxjj.ini
c:\windows\system32\awupetuy.ini
c:\windows\system32\azitoher.ini
c:\windows\system32\balinoto.dll.tmp
c:\windows\system32\bojitoya.dll
c:\windows\system32\cimxhcsw.ini
c:\windows\system32\dubavalu.dll
c:\windows\system32\eduvahum.ini
c:\windows\system32\ehepegop.ini
c:\windows\system32\ehhkj.bak1
c:\windows\system32\ehhkj.bak2
c:\windows\system32\ehhkj.ini
c:\windows\system32\ehhkj.ini2
c:\windows\system32\ehotoyum.ini
c:\windows\system32\enaguler.ini
c:\windows\system32\estthmos.ini
c:\windows\system32\fkxpnker.ini
c:\windows\system32\gakrcybe.ini
c:\windows\system32\igokbcnq.ini
c:\windows\system32\ipesihat.ini
c:\windows\system32\ipoyiduw.ini
c:\windows\system32\itiwedil.ini
c:\windows\system32\iwasakig.ini
c:\windows\system32\ixqbrvmc.ini
c:\windows\system32\jegugose.dll.tmp
c:\windows\system32\kjkmoesc.ini
c:\windows\system32\krhkquev.ini
c:\windows\system32\kudegovu.dll.tmp
c:\windows\system32\lpqtkhet.ini
c:\windows\system32\lupeyoyu.dll
c:\windows\system32\mcrh.tmp
c:\windows\system32\mWabcccf.ini
c:\windows\system32\mWabcccf.ini2
c:\windows\system32\oicegnrg.ini
c:\windows\system32\ojpphkvu.ini
c:\windows\system32\ovividon.ini
c:\windows\system32\oyojavur.ini
c:\windows\system32\pmxcjelc.ini
c:\windows\system32\rtyhpltj.ini
c:\windows\system32\ugivuteh.ini
c:\windows\system32\ukenisoy.ini
c:\windows\system32\unihomif.ini
c:\windows\system32\voganojo.dll
c:\windows\system32\wkxybiwr.ini
c:\windows\system32\wwaknayb.ini
c:\windows\system32\xtlikplh.ini
c:\windows\system32\yhsyplur.ini
c:\windows\system32\ypforlkt.ini
D:\Autorun.inf

----- BITS: Possibili siti infetti -----

hxxp://77.74.48.105
.
((((((((((((((((((((((((((((((((((((((( Driver/Servizi )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_DOMAINSERVICE


((((((((((((((((((((((((( Files Creati Da 2009-01-19 al 2009-02-19 )))))))))))))))))))))))))))))))))))
.

2009-02-19 14:32 . 2008-11-06 02:03 <DIR> d-------- C:\SDFix
2009-02-18 21:45 . 2009-02-18 21:45 410,984 --a------ c:\windows\system32\deploytk.dll
2009-02-18 21:45 . 2009-02-18 21:45 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-02-17 23:48 . 2009-02-17 23:48 <DIR> d-------- c:\documents and settings\HP_Proprietario\Dati applicazioni\Malwarebytes
2009-02-17 23:48 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-17 23:47 . 2009-02-18 00:49 <DIR> d-------- c:\programmi\Malwarebytes' Anti-Malware
2009-02-17 23:47 . 2009-02-17 23:47 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\Malwarebytes
2009-02-17 23:47 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-06 19:07 . 2009-02-06 19:07 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\Avg8
2009-02-04 19:21 . 2009-02-04 19:21 2,745 ---hs---- c:\windows\system32\fokivilo.dll
2009-02-04 00:10 . 2009-02-04 00:10 10,520 --------- c:\windows\system32\avgrsstx.dll.install_backup
2009-02-04 00:01 . 2009-02-04 00:01 <DIR> d-------- C:\00000082
2009-02-03 09:34 . 2009-02-03 09:34 120 ---hs---- c:\windows\system32\obogarip.tmp
2009-02-02 20:25 . 2009-02-02 20:25 2,745 ---hs---- c:\windows\system32\yafajawo.dll
2009-02-01 18:22 . 2009-02-01 18:22 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\NortonSystemWorks
2009-02-01 16:53 . 2009-02-03 23:56 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\Norton
2009-02-01 16:51 . 2009-02-01 16:52 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\NortonInstaller
2009-01-25 20:32 . 2009-01-25 20:32 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\Kaspersky Lab Setup Files
2009-01-22 00:07 . 2008-10-27 18:37 4,499,280 --a------ c:\windows\system32\D3dx9d_40.dll
2009-01-22 00:07 . 2008-10-27 18:37 3,796,816 --a------ c:\windows\system32\d3dx9d_33.dll
2009-01-22 00:07 . 2008-10-27 18:37 3,084,624 --a------ c:\windows\system32\d3d9d.dll
2009-01-22 00:07 . 2008-10-27 18:37 906,576 --a------ c:\windows\system32\xaudioD2_3.dll
2009-01-22 00:07 . 2008-10-27 18:36 496,464 --a------ c:\windows\system32\D3DX10d_40.dll
2009-01-22 00:07 . 2008-10-27 18:39 360,784 --a------ c:\windows\system32\XactEngineA3_3.dll
2009-01-22 00:07 . 2008-10-27 18:39 359,760 --a------ c:\windows\system32\dinput8d.dll
2009-01-22 00:07 . 2008-10-27 18:39 349,520 --a------ c:\windows\system32\d3dref9.dll
2009-01-22 00:07 . 2008-10-27 18:39 286,032 --a------ c:\windows\system32\XactEngineD3_3.dll
2009-01-22 00:07 . 2008-10-27 18:39 123,216 --a------ c:\windows\system32\XAPOFXD1_2.dll
2009-01-22 00:07 . 2008-10-27 18:38 47,440 --a------ c:\windows\system32\X3DAudioD1_5.dll
2009-01-22 00:03 . 2009-01-22 00:07 <DIR> d-------- c:\programmi\Microsoft DirectX SDK (November 2008)
2009-01-22 00:01 . 2009-01-22 00:01 119,120 --a------ c:\windows\dxsdkuninst.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-18 20:44 --------- d-----w c:\programmi\Java
2009-02-18 20:19 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Avira
2009-02-17 08:48 --------- d-----w c:\programmi\CCleaner
2009-02-16 23:09 --------- d-----w c:\documents and settings\HP_Proprietario\Dati applicazioni\skypePM
2009-02-16 22:58 --------- d-----w c:\documents and settings\HP_Proprietario\Dati applicazioni\Skype
2009-02-16 18:16 --------- d-----w c:\programmi\Sports Interactive
2009-02-10 22:18 --------- d-----w c:\documents and settings\HP_Proprietario\Dati applicazioni\Sports Interactive
2009-02-04 18:28 --------- d-----w c:\programmi\alaplaya
2009-02-03 22:56 --------- d-----w c:\programmi\File comuni\Symantec Shared
2009-02-01 19:48 --------- d-----w c:\documents and settings\HP_Proprietario\Dati applicazioni\uTorrent
2009-02-01 16:01 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Symantec
2009-02-01 15:22 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Sports Interactive
2009-01-25 19:28 --------- d--h--w c:\programmi\InstallShield Installation Information
2009-01-19 13:41 --------- d-----w c:\programmi\Safari
2009-01-12 12:00 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\comodo
2009-01-12 11:35 31,504 ----a-w c:\windows\system32\drivers\cmdhlp.sys
2009-01-12 11:35 101,776 ----a-w c:\windows\system32\drivers\cmdguard.sys
2009-01-11 17:09 --------- d-----w c:\programmi\COMODO
2009-01-11 17:00 --------- d-----w c:\programmi\Avira
2009-01-11 16:42 --------- d-----w c:\programmi\Spybot - Search & Destroy
2009-01-11 16:42 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Spybot - Search & Destroy
2009-01-09 21:57 --------- d-----w c:\programmi\Windows Live
2009-01-09 21:57 --------- d-----w c:\programmi\Microsoft
2009-01-09 21:54 --------- d-----w c:\programmi\Windows Live SkyDrive
2009-01-08 20:32 --------- d-----w c:\documents and settings\HP_Proprietario\Dati applicazioni\Babylon
2009-01-08 20:32 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Babylon
2009-01-08 20:29 --------- d-----w c:\programmi\eMule
2009-01-08 20:12 --------- d-----w c:\documents and settings\HP_Proprietario\Dati applicazioni\ValuSoft
2009-01-07 20:31 --------- d-----w c:\programmi\THQ
2009-01-07 19:33 --------- d-----w c:\programmi\SystemRequirementsLab
2009-01-07 16:41 --------- d-----w c:\programmi\Olimpiadi
2009-01-06 17:42 --------- d-----w c:\programmi\Google
2009-01-06 16:39 --------- d-----w c:\documents and settings\HP_Proprietario\Dati applicazioni\U3
2008-12-29 23:01 --------- d-----w c:\programmi\TuneUp Utilities 2007
2008-12-29 13:03 --------- d-----w c:\programmi\Windows Live Safety Center
2008-12-29 12:34 --------- d-----w c:\programmi\Bonjour
2008-12-29 12:32 --------- d-----w c:\programmi\iTunes
2008-12-29 12:32 --------- d-----w c:\programmi\iPod
2008-12-29 12:32 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-29 12:29 --------- d-----w c:\programmi\QuickTime
2008-12-29 12:28 --------- d-----w c:\programmi\File comuni\Apple
2008-12-25 16:51 --------- d-----w c:\programmi\AVIConverter
2008-12-25 11:18 --------- d-----w c:\documents and settings\HP_Proprietario\Dati applicazioni\Sonic
2008-12-25 11:17 --------- d-----w c:\documents and settings\HP_Proprietario\Dati applicazioni\Leadertech
2008-12-23 12:05 --------- d-----w c:\programmi\PC Wizard 2008
2008-11-17 23:46 72,704 ----a-w c:\documents and settings\HP_Proprietario\Dati applicazioni\GDIPFONTCACHEV1.DAT
2008-03-24 20:40 32 ----a-w c:\documents and settings\All Users\Dati applicazioni\ezsid.dat
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"DAEMON Tools"="c:\programmi\DAEMON Tools\daemon.exe" [2007-11-17 171464]
"EA Core"="c:\programmi\Electronic Arts\EADM\Core.exe" [2008-07-21 2752512]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"HPHUPD06"="c:\programmi\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-07 49152]
"HPHmon06"="c:\windows\system32\hphmon06.exe" [2004-06-07 659456]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2004-04-14 233472]
"SiS Windows KeyHook"="c:\windows\system32\keyhook.exe" [2004-05-20 249856]
"PS2"="c:\windows\system32\ps2.exe" [2002-10-16 81920]
"ATIPTA"="c:\programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-06-24 339968]
"CnxDslTaskBar"="c:\programmi\Trust\Trust MD3100 USB ADSL MODEM\CnxDslTb.exe" [2007-09-24 462848]
"Adobe Photo Downloader"="c:\programmi\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-22 63712]
"PWRISOVM.EXE"="c:\programmi\PowerISO\PWRISOVM.EXE" [2007-08-07 200704]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"ATICCC"="c:\programmi\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"TkBellExe"="c:\programmi\File comuni\Real\Update_OB\realsched.exe" [2008-03-16 185896]
"AppleSyncNotifier"="c:\programmi\File comuni\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936]
"Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"QuickTime Task"="c:\programmi\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\programmi\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"COMODO Internet Security"="c:\programmi\COMODO\COMODO Internet Security\cfp.exe" [2009-01-12 1797880]
"avgnt"="c:\programmi\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"SunJavaUpdateSched"="c:\programmi\Java\jre6\bin\jusched.exe" [2009-02-18 148888]
"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 c:\windows\AGRSMMSG.exe]

c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Avvio rapido di HP Image Zone.lnk - c:\programmi\HP\Digital Imaging\bin\hpqthb08.exe [2005-05-11 73728]
HP Digital Imaging Monitor.lnk - c:\programmi\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 282624]
Microsoft Office.lnk - c:\programmi\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
Tasto di scelta rapida per l'avvio di AutoCAD.lnk - c:\programmi\File comuni\Autodesk Shared\acstart17.exe [2006-03-05 11000]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Packard Bell Data Secure"=c:\programmi\Packard Bell Data Secure\PBDataSecure.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"KBD"=c:\hp\KBD\KBD.EXE
"SunJavaUpdateSched"="c:\programmi\Java\j2re1.4.2_03\bin\jusched.exe"
"QuickTime Task"="c:\programmi\QuickTime\QTTask.exe" -atboottime
"VirtualCloneDrive"="c:\programmi\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmi\\uTorrent\\uTorrent.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Programmi\\Sports Interactive\\Football Manager 2008\\fm.exe"=
"c:\\Programmi\\eMule\\emule.exe"=
"c:\\Programmi\\Firefly Studios\\Stronghold 2\\Stronghold2.exe"=
"c:\\Programmi\\Patrician III - Impero dei Mari\\Patrician3.exe"=
"c:\\Programmi\\Electronic Arts\\La Battaglia per la Terra di Mezzo II\\game.dat"=
"c:\\Programmi\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Programmi\\Microsoft Games\\Rise of Nations\\rise.exe"=
"c:\\Programmi\\Microsoft Games\\Rise of Nations\\nations.exe"=
"c:\\Programmi\\Microsoft Games\\Rise of Nations\\thrones.exe"=
"c:\\Programmi\\Microsoft Games\\Rise of Nations\\patriots.exe"=
"c:\\Programmi\\alaplaya\\ComeOnBaby\\ComeOnBaby.exe"=
"c:\\Programmi\\iTunes\\iTunes.exe"=
"c:\\Programmi\\Bonjour\\mDNSResponder.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Documents and Settings\\All Users\\Dati applicazioni\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 2009\\Italian\\setup.exe"=
"c:\\Programmi\\File comuni\\Apple\\Mobile Device Support\\bin\\AppleMobileDeviceService.exe"=
"c:\\Programmi\\File comuni\\Microsoft Shared\\VS7Debug\\mdm.exe"=
"c:\\Programmi\\File comuni\\Symantec Shared\\Security Center\\SymWSC.exe"=
"c:\\WINDOWS\\system32\\hphmon06.exe"=
"c:\\Programmi\\QuickTime\\QTTask.exe"=
"c:\\WINDOWS\\system32\\spoolsv.exe"=
"c:\\Programmi\\iPod\\bin\\iPodService.exe"=
"c:\\WINDOWS\\system32\\Keyhook.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\Product Assistant\\bin\\hprblog.exe"=
"c:\\Programmi\\DAEMON Tools\\daemon.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqimzone.exe"=
"c:\\Programmi\\Skype\\Phone\\Skype.exe"=

R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [2009-01-11 101776]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2009-01-11 31504]
S2 .norton2009Reset;Norton 2009 Reset;c:\documents and settings\All Users\Dati applicazioni\Norton\Norton2009Reset.exe [2009-02-01 280833]
S3 CnxEtP;Trust MD3100 USB ADSL MODEM LAN Adapter Filter Driver;c:\windows\system32\drivers\CnxEtP.sys [2007-09-24 60288]
S3 CnxEtU;Trust MD3100 USB ADSL MODEM Loader;c:\windows\system32\drivers\CnxEtU.sys [2007-09-24 646400]
S3 CnxTgN;Trust MD3100 USB ADSL MODEM LAN Adapter Driver;c:\windows\system32\drivers\CnxTgN.sys [2007-09-24 108771]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{65de0bce-b45d-11dc-85e3-00112fa2ccb9}]
\shell\Auto\command - K:\hvNrtID.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{50C413FA-25F9-4C54-EB6C-03AE71A313CE}]
c:\windows\system32:svchost.exe
.
Contenuto della cartella 'Scheduled Tasks'

2009-12-19 c:\windows\Tasks\User_Feed_Synchronization-{019D41E0-5B65-4AB5-936D-B51F57425E33}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 10:58]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.yahoo.it/
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=IT_IT&c=Q404&bd=pavilion&pf=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=IT_IT&c=Q404&bd=pavilion&pf=desktop
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=IT_IT&c=Q404&bd=pavilion&pf=desktop
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
DPF: {4BFD075D-C36E-4F28-BB0A-5D472795197A} - hxxp://powersoccer.giocaregratis.it/applet/PowerLoader.cab
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game06.zylom.com/activex/zylomgamesplayer.cab
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-19 15:38:18
Windows 5.1.2600 Service Pack 3 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------

[HKEY_USERS\S-1-5-21-570585280-1927010965-896284621-1007\Software\SecuROM\License information*]
"datasecu"=hex:11,09,b1,0e,ce,df,0a,5c,61,93,0e,13,8e,f2,ae,f2,70,e6,91,f5,94,
4f,bb,5b,e2,cd,8e,b5,7c,58,0e,d4,3a,26,c1,a0,3a,6e,21,ef,d9,4a,aa,bd,5c,86,\
"rkeysecu"=hex:aa,c3,38,ca,b3,c9,0b,e9,d2,40,67,c7,97,08,06,4f
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------

- - - - - - - > 'winlogon.exe'(580)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\programmi\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\windows\system32\ati2evxx.exe
c:\programmi\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\programmi\Bonjour\mDNSResponder.exe
c:\programmi\COMODO\COMODO Internet Security\cmdagent.exe
c:\programmi\Java\jre6\bin\jqs.exe
c:\programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
c:\programmi\File comuni\Symantec Shared\Security Center\SymWSC.exe
c:\programmi\iPod\bin\iPodService.exe
c:\windows\system32\wscntfy.exe
c:\programmi\HP\Digital Imaging\bin\hpqimzone.exe
c:\programmi\HP\Digital Imaging\bin\hpqste08.exe
c:\programmi\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
.
**************************************************************************
.
Ora fine scansione: 2009-02-19 15:44:51 - Il pc è stato riavviato
ComboFix-quarantined-files.txt 2009-02-19 14:44:47

Pre-Run: 29.407.596.544 byte disponibili
Post-Run: 30,215,581,696 byte disponibili

323 --- E O F --- 2008-12-18 23:13:04

esofunnyhouse, il tuo pc oltre ad essere un nido di malware, é anche pieno zeppo di programmi e di resti di programmi di sicurezza che sicuramente creeranno non pochi problemi...

COMODO Internet Security
AntiVir PersonalEdition Classic
Spybot - Search & Destroy
Malwarebytes' Anti-Malware
Kaspersky Internet Security 2009
Avg8
Norton

comunuque fai cosi;

apri una pagina del blocco note e copia incolla quanto segue;

killAll
file::
c:\windows\system32\fokivilo.dll
c:\windows\system32\yafajawo.dll
c:\windows\system32\obogarip.tmp
c:\documents and settings\All Users\Dati applicazioni\ezsid.dat
K:\hvNrtID.exe

registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{65de0bce-b45d-11dc-85e3-00112fa2ccb9}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]

salva la pagina nominandola obligatoriamente in CFScript.txt
a questo punto trascina il file CFScript.txt sull'icona di combofix e lascialo lavorare fino alla fine, riposta il suo log e dicci come va...

ComboFix 09-02-18.01 - HP_Proprietario 2009-02-19 19.57.53.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1040.18.511.156 [GMT 1:00]
Eseguito da: c:\documents and settings\HP_Proprietario\Documenti\programmi da installare\ComboFix.exe
Opzioni usate :: c:\documents and settings\HP_Proprietario\Documenti\programmi da installare\CFScript.txt
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)
FW: COMODO Firewall *disabled*
* Creato nuovo punto di ripristino

FILE ::
c:\documents and settings\All Users\Dati applicazioni\ezsid.dat
c:\windows\system32\fokivilo.dll
c:\windows\system32\obogarip.tmp
c:\windows\system32\yafajawo.dll
K:\hvNrtID.exe
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Dati applicazioni\ezsid.dat
c:\windows\system32\fokivilo.dll
c:\windows\system32\obogarip.tmp
c:\windows\system32\yafajawo.dll

.
((((((((((((((((((((((((( Files Creati Da 2009-01-19 al 2009-02-19 )))))))))))))))))))))))))))))))))))
.

2009-02-19 14:32 . 2008-11-06 02:03 <DIR> d-------- C:\SDFix
2009-02-18 21:45 . 2009-02-18 21:45 410,984 --a------ c:\windows\system32\deploytk.dll
2009-02-18 21:45 . 2009-02-18 21:45 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-02-17 23:48 . 2009-02-17 23:48 <DIR> d-------- c:\documents and settings\HP_Proprietario\Dati applicazioni\Malwarebytes
2009-02-17 23:48 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-17 23:47 . 2009-02-18 00:49 <DIR> d-------- c:\programmi\Malwarebytes' Anti-Malware
2009-02-17 23:47 . 2009-02-17 23:47 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\Malwarebytes
2009-02-17 23:47 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-06 19:07 . 2009-02-06 19:07 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\Avg8
2009-02-04 00:10 . 2009-02-04 00:10 10,520 --------- c:\windows\system32\avgrsstx.dll.install_backup
2009-02-04 00:01 . 2009-02-04 00:01 <DIR> d-------- C:\00000082
2009-02-01 18:22 . 2009-02-01 18:22 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\NortonSystemWorks
2009-02-01 16:53 . 2009-02-03 23:56 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\Norton
2009-02-01 16:51 . 2009-02-01 16:52 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\NortonInstaller
2009-01-25 20:32 . 2009-01-25 20:32 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\Kaspersky Lab Setup Files
2009-01-22 00:07 . 2008-10-27 18:37 4,499,280 --a------ c:\windows\system32\D3dx9d_40.dll
2009-01-22 00:07 . 2008-10-27 18:37 3,796,816 --a------ c:\windows\system32\d3dx9d_33.dll
2009-01-22 00:07 . 2008-10-27 18:37 3,084,624 --a------ c:\windows\system32\d3d9d.dll
2009-01-22 00:07 . 2008-10-27 18:37 906,576 --a------ c:\windows\system32\xaudioD2_3.dll
2009-01-22 00:07 . 2008-10-27 18:36 496,464 --a------ c:\windows\system32\D3DX10d_40.dll
2009-01-22 00:07 . 2008-10-27 18:39 360,784 --a------ c:\windows\system32\XactEngineA3_3.dll
2009-01-22 00:07 . 2008-10-27 18:39 359,760 --a------ c:\windows\system32\dinput8d.dll
2009-01-22 00:07 . 2008-10-27 18:39 349,520 --a------ c:\windows\system32\d3dref9.dll
2009-01-22 00:07 . 2008-10-27 18:39 286,032 --a------ c:\windows\system32\XactEngineD3_3.dll
2009-01-22 00:07 . 2008-10-27 18:39 123,216 --a------ c:\windows\system32\XAPOFXD1_2.dll
2009-01-22 00:07 . 2008-10-27 18:38 47,440 --a------ c:\windows\system32\X3DAudioD1_5.dll
2009-01-22 00:03 . 2009-01-22 00:07 <DIR> d-------- c:\programmi\Microsoft DirectX SDK (November 2008)
2009-01-22 00:01 . 2009-01-22 00:01 119,120 --a------ c:\windows\dxsdkuninst.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-18 20:44 --------- d-----w c:\programmi\Java
2009-02-18 20:19 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Avira
2009-02-17 08:48 --------- d-----w c:\programmi\CCleaner
2009-02-16 23:09 --------- d-----w c:\documents and settings\HP_Proprietario\Dati applicazioni\skypePM
2009-02-16 22:58 --------- d-----w c:\documents and settings\HP_Proprietario\Dati applicazioni\Skype
2009-02-16 18:16 --------- d-----w c:\programmi\Sports Interactive
2009-02-10 22:18 --------- d-----w c:\documents and settings\HP_Proprietario\Dati applicazioni\Sports Interactive
2009-02-04 18:28 --------- d-----w c:\programmi\alaplaya
2009-02-03 22:56 --------- d-----w c:\programmi\File comuni\Symantec Shared
2009-02-01 19:48 --------- d-----w c:\documents and settings\HP_Proprietario\Dati applicazioni\uTorrent
2009-02-01 16:01 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Symantec
2009-02-01 15:22 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Sports Interactive
2009-01-25 19:28 --------- d--h--w c:\programmi\InstallShield Installation Information
2009-01-19 13:41 --------- d-----w c:\programmi\Safari
2009-01-12 12:00 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\comodo
2009-01-12 11:35 31,504 ----a-w c:\windows\system32\drivers\cmdhlp.sys
2009-01-12 11:35 101,776 ----a-w c:\windows\system32\drivers\cmdguard.sys
2009-01-11 17:09 --------- d-----w c:\programmi\COMODO
2009-01-11 17:00 --------- d-----w c:\programmi\Avira
2009-01-11 16:42 --------- d-----w c:\programmi\Spybot - Search & Destroy
2009-01-11 16:42 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Spybot - Search & Destroy
2009-01-09 21:57 --------- d-----w c:\programmi\Windows Live
2009-01-09 21:57 --------- d-----w c:\programmi\Microsoft
2009-01-09 21:54 --------- d-----w c:\programmi\Windows Live SkyDrive
2009-01-08 20:32 --------- d-----w c:\documents and settings\HP_Proprietario\Dati applicazioni\Babylon
2009-01-08 20:32 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Babylon
2009-01-08 20:29 --------- d-----w c:\programmi\eMule
2009-01-08 20:12 --------- d-----w c:\documents and settings\HP_Proprietario\Dati applicazioni\ValuSoft
2009-01-07 20:31 --------- d-----w c:\programmi\THQ
2009-01-07 19:33 --------- d-----w c:\programmi\SystemRequirementsLab
2009-01-07 16:41 --------- d-----w c:\programmi\Olimpiadi
2009-01-06 17:42 --------- d-----w c:\programmi\Google
2009-01-06 16:39 --------- d-----w c:\documents and settings\HP_Proprietario\Dati applicazioni\U3
2008-12-29 23:01 --------- d-----w c:\programmi\TuneUp Utilities 2007
2008-12-29 13:03 --------- d-----w c:\programmi\Windows Live Safety Center
2008-12-29 12:34 --------- d-----w c:\programmi\Bonjour
2008-12-29 12:32 --------- d-----w c:\programmi\iTunes
2008-12-29 12:32 --------- d-----w c:\programmi\iPod
2008-12-29 12:32 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-29 12:29 --------- d-----w c:\programmi\QuickTime
2008-12-29 12:28 --------- d-----w c:\programmi\File comuni\Apple
2008-12-25 16:51 --------- d-----w c:\programmi\AVIConverter
2008-12-25 11:18 --------- d-----w c:\documents and settings\HP_Proprietario\Dati applicazioni\Sonic
2008-12-25 11:17 --------- d-----w c:\documents and settings\HP_Proprietario\Dati applicazioni\Leadertech
2008-12-23 12:05 --------- d-----w c:\programmi\PC Wizard 2008
2008-11-17 23:46 72,704 ----a-w c:\documents and settings\HP_Proprietario\Dati applicazioni\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((( SnapShot@2009-02-19_15.43.15.64 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-02-19 19:03:56 16,384 ----atw c:\windows\temp\Perflib_Perfdata_6d4.dat
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"DAEMON Tools"="c:\programmi\DAEMON Tools\daemon.exe" [2007-11-17 171464]
"EA Core"="c:\programmi\Electronic Arts\EADM\Core.exe" [2008-07-21 2752512]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"HPHUPD06"="c:\programmi\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-07 49152]
"HPHmon06"="c:\windows\system32\hphmon06.exe" [2004-06-07 659456]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2004-04-14 233472]
"SiS Windows KeyHook"="c:\windows\system32\keyhook.exe" [2004-05-20 249856]
"PS2"="c:\windows\system32\ps2.exe" [2002-10-16 81920]
"ATIPTA"="c:\programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-06-24 339968]
"CnxDslTaskBar"="c:\programmi\Trust\Trust MD3100 USB ADSL MODEM\CnxDslTb.exe" [2007-09-24 462848]
"Adobe Photo Downloader"="c:\programmi\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-22 63712]
"PWRISOVM.EXE"="c:\programmi\PowerISO\PWRISOVM.EXE" [2007-08-07 200704]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"ATICCC"="c:\programmi\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"TkBellExe"="c:\programmi\File comuni\Real\Update_OB\realsched.exe" [2008-03-16 185896]
"AppleSyncNotifier"="c:\programmi\File comuni\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936]
"Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"QuickTime Task"="c:\programmi\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\programmi\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"COMODO Internet Security"="c:\programmi\COMODO\COMODO Internet Security\cfp.exe" [2009-01-12 1797880]
"avgnt"="c:\programmi\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"SunJavaUpdateSched"="c:\programmi\Java\jre6\bin\jusched.exe" [2009-02-18 148888]
"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 c:\windows\AGRSMMSG.exe]

c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Avvio rapido di HP Image Zone.lnk - c:\programmi\HP\Digital Imaging\bin\hpqthb08.exe [2005-05-11 73728]
HP Digital Imaging Monitor.lnk - c:\programmi\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 282624]
Microsoft Office.lnk - c:\programmi\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
Tasto di scelta rapida per l'avvio di AutoCAD.lnk - c:\programmi\File comuni\Autodesk Shared\acstart17.exe [2006-03-05 11000]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Packard Bell Data Secure"=c:\programmi\Packard Bell Data Secure\PBDataSecure.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"KBD"=c:\hp\KBD\KBD.EXE
"SunJavaUpdateSched"="c:\programmi\Java\j2re1.4.2_03\bin\jusched.exe"
"QuickTime Task"="c:\programmi\QuickTime\QTTask.exe" -atboottime
"VirtualCloneDrive"="c:\programmi\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmi\\uTorrent\\uTorrent.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Programmi\\Sports Interactive\\Football Manager 2008\\fm.exe"=
"c:\\Programmi\\eMule\\emule.exe"=
"c:\\Programmi\\Firefly Studios\\Stronghold 2\\Stronghold2.exe"=
"c:\\Programmi\\Patrician III - Impero dei Mari\\Patrician3.exe"=
"c:\\Programmi\\Electronic Arts\\La Battaglia per la Terra di Mezzo II\\game.dat"=
"c:\\Programmi\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Programmi\\Microsoft Games\\Rise of Nations\\rise.exe"=
"c:\\Programmi\\Microsoft Games\\Rise of Nations\\nations.exe"=
"c:\\Programmi\\Microsoft Games\\Rise of Nations\\thrones.exe"=
"c:\\Programmi\\Microsoft Games\\Rise of Nations\\patriots.exe"=
"c:\\Programmi\\alaplaya\\ComeOnBaby\\ComeOnBaby.exe"=
"c:\\Programmi\\iTunes\\iTunes.exe"=
"c:\\Programmi\\Bonjour\\mDNSResponder.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Documents and Settings\\All Users\\Dati applicazioni\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 2009\\Italian\\setup.exe"=
"c:\\Programmi\\File comuni\\Apple\\Mobile Device Support\\bin\\AppleMobileDeviceService.exe"=
"c:\\Programmi\\File comuni\\Microsoft Shared\\VS7Debug\\mdm.exe"=
"c:\\Programmi\\File comuni\\Symantec Shared\\Security Center\\SymWSC.exe"=
"c:\\WINDOWS\\system32\\hphmon06.exe"=
"c:\\Programmi\\QuickTime\\QTTask.exe"=
"c:\\WINDOWS\\system32\\spoolsv.exe"=
"c:\\Programmi\\iPod\\bin\\iPodService.exe"=
"c:\\WINDOWS\\system32\\Keyhook.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\Product Assistant\\bin\\hprblog.exe"=
"c:\\Programmi\\DAEMON Tools\\daemon.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqimzone.exe"=
"c:\\Programmi\\Skype\\Phone\\Skype.exe"=

R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [2009-01-11 101776]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2009-01-11 31504]
S2 .norton2009Reset;Norton 2009 Reset;c:\documents and settings\All Users\Dati applicazioni\Norton\Norton2009Reset.exe [2009-02-01 280833]
S3 CnxEtP;Trust MD3100 USB ADSL MODEM LAN Adapter Filter Driver;c:\windows\system32\drivers\CnxEtP.sys [2007-09-24 60288]
S3 CnxEtU;Trust MD3100 USB ADSL MODEM Loader;c:\windows\system32\drivers\CnxEtU.sys [2007-09-24 646400]
S3 CnxTgN;Trust MD3100 USB ADSL MODEM LAN Adapter Driver;c:\windows\system32\drivers\CnxTgN.sys [2007-09-24 108771]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{50C413FA-25F9-4C54-EB6C-03AE71A313CE}]
c:\windows\system32:svchost.exe
.
Contenuto della cartella 'Scheduled Tasks'

2009-12-19 c:\windows\Tasks\User_Feed_Synchronization-{019D41E0-5B65-4AB5-936D-B51F57425E33}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 10:58]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.yahoo.it/
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=IT_IT&c=Q404&bd=pavilion&pf=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=IT_IT&c=Q404&bd=pavilion&pf=desktop
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=IT_IT&c=Q404&bd=pavilion&pf=desktop
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
DPF: {4BFD075D-C36E-4F28-BB0A-5D472795197A} - hxxp://powersoccer.giocaregratis.it/applet/PowerLoader.cab
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game06.zylom.com/activex/zylomgamesplayer.cab
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-19 20:11:17
Windows 5.1.2600 Service Pack 3 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------

[HKEY_USERS\S-1-5-21-570585280-1927010965-896284621-1007\Software\SecuROM\License information*]
"datasecu"=hex:11,09,b1,0e,ce,df,0a,5c,61,93,0e,13,8e,f2,ae,f2,70,e6,91,f5,94,
4f,bb,5b,e2,cd,8e,b5,7c,58,0e,d4,3a,26,c1,a0,3a,6e,21,ef,d9,4a,aa,bd,5c,86,\
"rkeysecu"=hex:aa,c3,38,ca,b3,c9,0b,e9,d2,40,67,c7,97,08,06,4f
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------

- - - - - - - > 'winlogon.exe'(576)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\programmi\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\windows\system32\ati2evxx.exe
c:\programmi\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\programmi\Bonjour\mDNSResponder.exe
c:\programmi\COMODO\COMODO Internet Security\cmdagent.exe
c:\programmi\Java\jre6\bin\jqs.exe
c:\programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
c:\programmi\File comuni\Symantec Shared\Security Center\SymWSC.exe
c:\programmi\iPod\bin\iPodService.exe
c:\windows\system32\wscntfy.exe
c:\programmi\HP\Digital Imaging\bin\hpqimzone.exe
c:\programmi\HP\Digital Imaging\bin\hpqste08.exe
c:\programmi\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
.
**************************************************************************
.
Ora fine scansione: 2009-02-19 20:17:07 - Il pc è stato riavviato
ComboFix-quarantined-files.txt 2009-02-19 19:17:02
ComboFix2.txt 2009-02-19 14:44:53

Pre-Run: 30.080.606.208 byte disponibili
Post-Run: 30,116,573,184 byte disponibili

271 --- E O F --- 2008-12-18 23:13:04
appena accendo il pc mi appare l'avviso di accettare la licenza norton security center...io gli dico di no..che devo fare lo devo disinstallare?

devi disinstallare tutto e tenerti solo un antivirus e un firewall insieme a malwarebyte's, nient'altro

poi;

Scarica ed estrai ADSspy
eseguilo
spunta "full scan (all NTFS drivers)" e clicca su "Scan the systems for alternate data streams..".
Se trova l'ADS indicato di seguito, rimuovilo (metti la spunta e clicca su "remove selected streams").
C:\WINDOWS\system32:svchost.exe

non l'ha trovato...ha trovato solo file nella cartella preferiti..cmq poco fa avira mi ha trovato un trojan in system volume information

ciao esofunnyhouse,

se é successo vuol dire che non hai seguito alla lettera la procedura, in quanto io già sopra ti avevo detto di:

Alla fine delle procedure di pulizia è fondamentale :

2) Disattivare / Riattivare il ripristino configurazione di sistema (XP / ME / Vista)
3) Creare un nuovo punto di ripristino

la faccio ora questa cosa o devo rifare tutto?

disattivalo, lo riattivi subito dopo e crei un nuovo punto pulito

la prcedura su come fare é descritta nei link postati sopra..

te lo rimetto di seguito
http://www.steven.altervista.org/vecchio%20sito/files/ripristino.html#

ti dico cosa ho fatto disattiva il punto..provato con ADSspy ma non ho trovato il file....riattivato il punto e l'ho creato uno nuovo....pensi che ora il pc sia pulito?ti devo fare un log con hijackthis?

penso di si, prova a fare comunque uno scan online Kaspersky

ok...vabbè grazie mille per tutto quello che hai fatto...ciao