Sistema lento, programmi lenti, finestre popup

[mjolneer]

Ciao. Ho seguito i passi indicati nel manuale. Questo che segue è il log di ht. Grazie e buona serata.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23.34.35, on 21/12/2012
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16982)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\SiS VGA Utilities\SiSTray.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\CyberLink\MagicSports\Kernel\MagicSports\MSP Mirage.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Lexmark X1100 Series\LXBKbmgr.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Users\Public\Documents\AppData\PoApp\PService.e xe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://it.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.findeer.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyServer = http=127.0.0.1:56847
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: uTorrentBar_IT Toolbar - {4ae0c3d6-f713-4eed-bc65-25dc3ffdaac1} - C:\Program Files\uTorrentBar_IT\prxtbuTor.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: uTorrentBar_IT - {4ae0c3d6-f713-4eed-bc65-25dc3ffdaac1} - C:\Program Files\uTorrentBar_IT\prxtbuTor.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: SearchToolbar.ShowToolbarBHO - {86a3cdaa-9b25-480e-b73f-c2d359b87966} - mscoree.dll (file missing)
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7529.1424\s wg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google\Google_BAE\BAE.dll
O3 - Toolbar: uTorrentBar_IT Toolbar - {4ae0c3d6-f713-4eed-bc65-25dc3ffdaac1} - C:\Program Files\uTorrentBar_IT\prxtbuTor.dll
O3 - Toolbar: SearchToolbar - {691ca8ec-7205-4aa9-bdd6-15493d16f835} - mscoree.dll (file missing)
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SiSTray] %ProgramFiles%\SiS VGA Utilities\SiSTray.exe
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [MSPService] C:\Program Files\CyberLink\MagicSports\Kernel\MagicSports\MSP Mirage.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [lxbkbmgr.exe] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [USB2Check] RUNDLL32.EXE "C:\Windows\system32\PCLECoInst.dll",CheckUSBContr oller
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [PosService] C:\Users\Public\Documents\AppData\PoApp\PLauncher. exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKCU\..\Run: [SmpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [USB Safely Remove] C:\Users\Anna\Desktop\USBSafelyRemove\Appdata\USBS afelyRemove.exe /startup
O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [PosService] C:\Users\Public\Documents\AppData\PoApp\PLauncher. exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [PosService] C:\Users\Public\Documents\AppData\PoApp\PLauncher. exe (User 'Default user')
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Free YouTube Download - C:\Users\Anna\AppData\Roaming\DVDVideoSoftIEHelper s\freeytvdownloader.htm
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Anna\AppData\Roaming\DVDVideoSoftIEHelper s\freeyoutubetomp3converter.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: I&nvia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {75AA409D-05F9-4F27-BD53-C7339D4B1D0A} (IBM Lotus iNotes 8.5 Control) - https://wmrm01.sistinf.it/dwa85W.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3a539854-6a70-11db-887c-806e6f6e6963}: NameServer = 176.31.229.24,176.31.229.25
O17 - HKLM\System\CCS\Services\Tcpip\..\{9E2CAAF8-4E6C-4FEC-A73A-C1E345331B16}: NameServer = 176.31.229.24,176.31.229.25
O17 - HKLM\System\CCS\Services\Tcpip\..\{FAB2DED7-A12D-491A-80EF-9DCB4E51D459}: NameServer = 176.31.229.24,176.31.229.25
O17 - HKLM\System\CS1\Services\Tcpip\..\{3a539854-6a70-11db-887c-806e6f6e6963}: NameServer = 176.31.229.24,176.31.229.25
O17 - HKLM\System\CS2\Services\Tcpip\..\{3a539854-6a70-11db-887c-806e6f6e6963}: NameServer = 176.31.229.24,176.31.229.25
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpda teService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Google Desktop Manager 5.9.1005.12335 (GoogleDesktopManager-051210-111108) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Servizio di Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Servizio Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: lxbk_device - - C:\Windows\system32\lxbkcoms.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: OfferBox update service - Aedge Performance BCN SL - C:\Program Files\OfferBox\OfferBoxUpdateService.exe
O23 - Service: Pos Service (PowerOffer Service) - PowerOfferService - C:\Users\Anna\AppData\Local\PosService\Pos.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: Serv Updater (ServUpdater) - ServiceUpd - C:\Users\Anna\AppData\Local\ServUpdater\ServiceUpd .exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: Software Upd (SoftwareUpd) - SoftwareUpdService - C:\Users\Anna\AppData\Local\SoftwareUpdater\Softwa reUpdService.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

--
End of file - 12268 bytes

[menatwork]

ciao hai delle infezioni fai queste scansioni

scarica adwcleaner usa solo l'opzione delete/ elimina e alleg ail log

Scarica OTL e salvalo sul desktop

Metti la spunta su SCAN ALL USERS.

Sotto output, metti la spunta su minimal output

Clicca sulla freccettina di File Age e seleziona 60 Days

Metti la spunta a LOP Check e Purity Check.

Clicca su RUN SCAN

Lascia fare la scansione senza interferire.

Al termine della scansione trovi 2 log sul desktop. OTL.txt ed Extras.txt, salvali e caricali su Wikisend,

[mjolneer]

i file li ho messi su free file hosting:
http://www.freefilehosting.net/extras_20
http://www.freefilehosting.net/otl_27

ecco il log di adwcleaner. lo spezzo perché dice che è troppo lungo. Grazie.

# AdwCleaner v2.101 - Logfile creato il 22/12/2012 alle 00:01:32
# Aggiornamento 16/12/2012 by Xplode
# Sistema Operativo : Windows Vista (TM) Home Premium (32 bits)
# Utente : Anna - PC-ANNA
# Modalità Avvio : Modalità Normale
# Eseguito da : C:\Users\Anna\Downloads\adwcleaner.exe
# Opzioni [Elimina]


***** [Servizi] *****

Fermato & Eliminato : Offerbox update service

***** [File / Cartelle] *****

Cartella Eliminato : C:\Program Files\Conduit
Cartella Eliminato : C:\Program Files\OfferBox
Cartella Eliminato : C:\Program Files\uTorrentBar_IT
Cartella Eliminato : C:\ProgramData\Trymedia
Cartella Eliminato : C:\Users\Anna\AppData\Local\Temp\CT2851640
Cartella Eliminato : C:\Users\Anna\AppData\Local\Temp\Iminent
Cartella Eliminato : C:\Users\Anna\AppData\LocalLow\Conduit
Cartella Eliminato : C:\Users\Anna\AppData\LocalLow\PriceGong
Cartella Eliminato : C:\Users\Anna\AppData\LocalLow\uTorrentBar_IT
Cartella Eliminato : C:\Users\Anna\AppData\Roaming\Mozilla\Firefox\Prof iles\bfl9hx03.default\ConduitCommon
Cartella Eliminato : C:\Users\Anna\AppData\Roaming\Mozilla\Firefox\Prof iles\bfl9hx03.default\CT2851640
Cartella Eliminato : C:\Users\Anna\AppData\Roaming\Mozilla\Firefox\Prof iles\bfl9hx03.default\extensions\{4ae0c3d6-f713-4eed-bc65-25dc3ffdaac1}
Cartella Eliminato : C:\Users\Anna\AppData\Roaming\OfferBox
File Eliminato : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Offerbox.lnk

***** [Registro] *****

Chiave Eliminata : HKCU\Software\AppDataLow\Software\Conduit
Chiave Eliminata : HKCU\Software\AppDataLow\Software\PriceGong
Chiave Eliminata : HKCU\Software\AppDataLow\Software\SmartBar
Chiave Eliminata : HKCU\Software\AppDataLow\Software\uTorrentBar_IT
Chiave Eliminata : HKCU\Software\AppDataLow\Toolbar
Chiave Eliminata : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}
Chiave Eliminata : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Chiave Eliminata : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext \Stats\{4AE0C3D6-F713-4EED-BC65-25DC3FFDAAC1}
Chiave Eliminata : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext \Stats\{854145C6-B95A-408D-BE86-367DC393A219}
Chiave Eliminata : HKCU\Software\Offerbox
Chiave Eliminata : HKCU\Software\Softonic
Chiave Eliminata : HKLM\SOFTWARE\Classes\CLSID\{0EE02110-967B-4256-ACA6-BC8AC7CB7E61}
Chiave Eliminata : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Chiave Eliminata : HKLM\SOFTWARE\Classes\CLSID\{4AE0C3D6-F713-4EED-BC65-25DC3FFDAAC1}
Chiave Eliminata : HKLM\SOFTWARE\Classes\CLSID\{854145C6-B95A-408D-BE86-367DC393A219}
Chiave Eliminata : HKLM\SOFTWARE\Classes\CLSID\{C5D1D828-B1DC-4924-91EB-AC21CC94B0AA}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{8216BD4A-4DC2-4DCE-9AFF-C86C5ACC6757}
Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{D4D390BE-98E6-4633-AD1B-B18B54BE5E76}
Chiave Eliminata : HKLM\SOFTWARE\Classes\OfferBoxUI.TheBoxCtrl
Chiave Eliminata : HKLM\SOFTWARE\Classes\OfferBoxUI.TheBoxCtrl.1
Chiave Eliminata : HKLM\SOFTWARE\Classes\Toolbar.CT2851640
Chiave Eliminata : HKLM\SOFTWARE\Classes\TypeLib\{8ABB9FA2-0740-4AD9-8F54-1192254B3CF4}
Chiave Eliminata : HKLM\Software\Conduit
Chiave Eliminata : HKLM\Software\Iminent
Chiave Eliminata : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{412BFD4F-7459-445A-9A92-04CF322A1CDE}
Chiave Eliminata : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FABFA1A2-5727-4B37-A7D4-036DFC24685E}
Chiave Eliminata : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Chiave Eliminata : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects\{4AE0C3D6-F713-4EED-BC65-25DC3FFDAAC1}
Chiave Eliminata : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext \PreApproved\{0EE02110-967B-4256-ACA6-BC8AC7CB7E61}
Chiave Eliminata : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext \PreApproved\{854145C6-B95A-408D-BE86-367DC393A219}
Chiave Eliminata : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext \PreApproved\ForceRenive
Chiave Eliminata : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uni nstall\Offerbox
Chiave Eliminata : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uni nstall\uTorrentBar_IT Toolbar
Chiave Eliminata : HKLM\Software\Offerbox
Chiave Eliminata : HKLM\Software\uTorrentBar_IT
Valore Eliminata : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{4AE0C3D6-F713-4EED-BC65-25DC3FFDAAC1}]
Valore Eliminata : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{4AE0C3D6-F713-4EED-BC65-25DC3FFDAAC1}]
Valore Eliminata : HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings [ProxyServer = hxxp=127.0.0.1:56847]
Valore Eliminata : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{4AE0C3D6-F713-4EED-BC65-25DC3FFDAAC1}]
Valore Eliminata : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{4AE0C3D6-F713-4EED-BC65-25DC3FFDAAC1}]

***** [Browser Internet] *****

-\\ Internet Explorer v7.0.6000.16982

[OK] Registro Pulito.

-\\ Mozilla Firefox v17.0.1 (it)

Nome Profilo : default
File : C:\Users\Anna\AppData\Roaming\Mozilla\Firefox\Prof iles\bfl9hx03.default\prefs.js

Eliminata : user_pref("CT2851640..clientLogIsEnabled", false);
Eliminata : user_pref("CT2851640..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]
Eliminata : user_pref("CT2851640..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]
Eliminata : user_pref("CT2851640.ALLOW_SHOWING_HIDDEN_TOOLBAR" , false);
Eliminata : user_pref("CT2851640.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Eliminata : user_pref("CT2851640.CTID", "CT2851640");
Eliminata : user_pref("CT2851640.CurrentServerDate", "22-12-2012");
Eliminata : user_pref("CT2851640.DSInstall", false);
Eliminata : user_pref("CT2851640.DialogsAlignMode", "LTR");
Eliminata : user_pref("CT2851640.DialogsGetterLastCheckTime", "Wed Dec 19 2012 22:21:53 GMT+0100 (ora solare Eur[...]
Eliminata : user_pref("CT2851640.DownloadReferralCookieData", "");
Eliminata : user_pref("CT2851640.EMailNotifierPollDate", "Fri Dec 21 2012 23:35:48 GMT+0100 (ora solare Europa o[...]
Eliminata : user_pref("CT2851640.FeedLastCount6743962842994482 530", 501);
Eliminata : user_pref("CT2851640.FeedPollDate24291568121866499 77", "Fri Dec 21 2012 23:35:50 GMT+0100 (ora solar[...]
Eliminata : user_pref("CT2851640.FeedPollDate24291568130408235 46", "Fri Dec 21 2012 23:35:49 GMT+0100 (ora solar[...]
Eliminata : user_pref("CT2851640.FeedPollDate24291568131300958 66", "Fri Dec 21 2012 23:35:49 GMT+0100 (ora solar[...]
Eliminata : user_pref("CT2851640.FeedPollDate24291568132242036 13", "Fri Dec 21 2012 23:35:49 GMT+0100 (ora solar[...]
Eliminata : user_pref("CT2851640.FeedPollDate24291568132308372 51", "Fri Dec 21 2012 23:35:49 GMT+0100 (ora solar[...]
Eliminata : user_pref("CT2851640.FeedPollDate24291568134542917 35", "Fri Dec 21 2012 23:35:49 GMT+0100 (ora solar[...]
Eliminata : user_pref("CT2851640.FeedPollDate24291568137298348 76", "Fri Dec 21 2012 23:35:49 GMT+0100 (ora solar[...]
Eliminata : user_pref("CT2851640.FeedPollDate24291568138608700 21", "Fri Dec 21 2012 23:35:50 GMT+0100 (ora solar[...]
Eliminata : user_pref("CT2851640.FeedPollDate24291568142646817 93", "Fri Dec 21 2012 23:35:49 GMT+0100 (ora solar[...]
Eliminata : user_pref("CT2851640.FeedPollDate24291568148630753 66", "Fri Dec 21 2012 23:35:49 GMT+0100 (ora solar[...]
Eliminata : user_pref("CT2851640.FeedPollDate24291568152577610 81", "Fri Dec 21 2012 23:35:49 GMT+0100 (ora solar[...]
Eliminata : user_pref("CT2851640.FeedTTL2429156813040823546", 15);
Eliminata : user_pref("CT2851640.FeedTTL2429156813130095866", 10);
Eliminata : user_pref("CT2851640.FeedTTL2429156813454291735", 5);
Eliminata : user_pref("CT2851640.FeedTTL2429156814264681793", 5);
Eliminata : user_pref("CT2851640.FirstServerDate", "27-5-2012");
Eliminata : user_pref("CT2851640.FirstTime", true);
Eliminata : user_pref("CT2851640.FirstTimeFF3", true);
Eliminata : user_pref("CT2851640.FixPageNotFoundErrors", true);
Eliminata : user_pref("CT2851640.GroupingServerCheckInterval", 1440);
Eliminata : user_pref("CT2851640.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Eliminata : user_pref("CT2851640.HPInstall", false);
Eliminata : user_pref("CT2851640.HasUserGlobalKeys", true);
Eliminata : user_pref("CT2851640.HomePageProtectorEnabled", false);
Eliminata : user_pref("CT2851640.HomepageBeforeUnload", "");
Eliminata : user_pref("CT2851640.Initialize", true);
Eliminata : user_pref("CT2851640.InitializeCommonPrefs", true);
Eliminata : user_pref("CT2851640.InstallationAndCookieDataSent Count", 3);
Eliminata : user_pref("CT2851640.InstallationId", "fftADA3.tmp.exe");
Eliminata : user_pref("CT2851640.InstallationType", "XPE");
Eliminata : user_pref("CT2851640.InstalledDate", "Sun May 27 2012 00:22:11 GMT+0200 (ora legale Europa occidenta[...]

[mjolneer]

Eliminata : user_pref("CT2851640.IsAlertDBUpdated", true);
Eliminata : user_pref("CT2851640.IsGrouping", false);
Eliminata : user_pref("CT2851640.IsInitSetupIni", true);
Eliminata : user_pref("CT2851640.IsMulticommunity", false);
Eliminata : user_pref("CT2851640.IsOpenThankYouPage", true);
Eliminata : user_pref("CT2851640.IsOpenUninstallPage", false);
Eliminata : user_pref("CT2851640.LanguagePackLastCheckTime", "Fri Dec 21 2012 22:55:51 GMT+0100 (ora solare Euro[...]
Eliminata : user_pref("CT2851640.LanguagePackReloadIntervalMM" , 1440);
Eliminata : user_pref("CT2851640.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Eliminata : user_pref("CT2851640.LastLogin_3.12.0.8", "Sun May 27 2012 23:17:03 GMT+0200 (ora legale Europa occi[...]
Eliminata : user_pref("CT2851640.LastLogin_3.12.2.3", "Wed May 30 2012 21:47:43 GMT+0200 (ora legale Europa occi[...]
Eliminata : user_pref("CT2851640.LastLogin_3.13.0.6", "Mon Jul 16 2012 23:12:17 GMT+0200 (ora legale Europa occi[...]
Eliminata : user_pref("CT2851640.LastLogin_3.14.1.0", "Sun Sep 09 2012 19:17:28 GMT+0200 (ora legale Europa occi[...]
Eliminata : user_pref("CT2851640.LastLogin_3.15.1.0", "Wed Nov 07 2012 22:19:08 GMT+0100 (ora solare Europa occi[...]
Eliminata : user_pref("CT2851640.LastLogin_3.16.0.3", "Fri Dec 21 2012 22:32:19 GMT+0100 (ora solare Europa occi[...]
Eliminata : user_pref("CT2851640.LatestVersion", "3.16.0.3");
Eliminata : user_pref("CT2851640.Locale", "it");
Eliminata : user_pref("CT2851640.MCDetectTooltipHeight", "83");
Eliminata : user_pref("CT2851640.MCDetectTooltipShow", false);
Eliminata : user_pref("CT2851640.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Eliminata : user_pref("CT2851640.MCDetectTooltipWidth", "295");
Eliminata : user_pref("CT2851640.MyStuffEnabledAtInstallation" , true);
Eliminata : user_pref("CT2851640.OriginalFirstVersion", "3.12.0.8");
Eliminata : user_pref("CT2851640.SHRINK_TOOLBAR", 1);
Eliminata : user_pref("CT2851640.SearchCaption", "uTorrentBar_IT Customized Web Search");
Eliminata : user_pref("CT2851640.SearchEngineBeforeUnload", "chrome://browser-region/locale/region.properties");
Eliminata : user_pref("CT2851640.SearchFromAddressBarIsInit", true);
Eliminata : user_pref("CT2851640.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT285[...]
Eliminata : user_pref("CT2851640.SearchInNewTabEnabled", true);
Eliminata : user_pref("CT2851640.SearchInNewTabIntervalMM", 1440);
Eliminata : user_pref("CT2851640.SearchInNewTabLastCheckTime", "Fri Dec 21 2012 22:55:37 GMT+0100 (ora solare Eu[...]
Eliminata : user_pref("CT2851640.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]
Eliminata : user_pref("CT2851640.SearchProtectorEnabled", false);
Eliminata : user_pref("CT2851640.SearchProtectorToolbarDisable d", false);
Eliminata : user_pref("CT2851640.SendProtectorDataViaLogin", true);
Eliminata : user_pref("CT2851640.ServiceMapLastCheckTime", "Fri Dec 21 2012 22:55:49 GMT+0100 (ora solare Europa[...]
Eliminata : user_pref("CT2851640.SettingsLastCheckTime", "Fri Dec 21 2012 22:32:06 GMT+0100 (ora solare Europa o[...]
Eliminata : user_pref("CT2851640.SettingsLastUpdate", "1355910691");
Eliminata : user_pref("CT2851640.TBHomePageUrl", "hxxp://search.conduit.com/?ctid=CT2851640&SearchSource=13");
Eliminata : user_pref("CT2851640.ThirdPartyComponentsInterval" , 504);
Eliminata : user_pref("CT2851640.ThirdPartyComponentsLastCheck ", "Tue Dec 04 2012 21:54:22 GMT+0100 (ora solare [...]
Eliminata : user_pref("CT2851640.ThirdPartyComponentsLastUpdat e", "1331806005");
Eliminata : user_pref("CT2851640.ToolbarShrinkedFromSetup", false);
Eliminata : user_pref("CT2851640.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2851640");
Eliminata : user_pref("CT2851640.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...]
Eliminata : user_pref("CT2851640.UserID", "UN30442189698349049");
Eliminata : user_pref("CT2851640.ValidationData_Search", 1);
Eliminata : user_pref("CT2851640.ValidationData_Toolbar", 2);
Eliminata : user_pref("CT2851640.WeatherNetwork", "");
Eliminata : user_pref("CT2851640.WeatherPollDate", "Fri Dec 21 2012 23:32:33 GMT+0100 (ora solare Europa occiden[...]
Eliminata : user_pref("CT2851640.WeatherUnit", "C");
Eliminata : user_pref("CT2851640.alertChannelId", "1243675");
Eliminata : user_pref("CT2851640.approveUntrustedApps", false);
Eliminata : user_pref("CT2851640.autoDisableScopes", -1);
Eliminata : user_pref("CT2851640.backendstorage.cb_experience_ 000", "3337");
Eliminata : user_pref("CT2851640.backendstorage.cb_firstuse010 0", "31");
Eliminata : user_pref("CT2851640.backendstorage.cb_user_id_000 ", "43423838373637363433313032325F46697265666F78" )[...]
Eliminata : user_pref("CT2851640.backendstorage.cbcountry_000" , "4954");
Eliminata : user_pref("CT2851640.backendstorage.cbcountry_001" , "4954");
Eliminata : user_pref("CT2851640.backendstorage.cbfirsttime", "53756E204D617920323720323031322030303A32373A3 3342[...]
Eliminata : user_pref("CT2851640.backendstorage.cbopenmamsetti ngs", "30");
Eliminata : user_pref("CT2851640.backendstorage.pairingkey", "4436443743314445344135343543363335433336384232414 6[...]
Eliminata : user_pref("CT2851640.backendstorage.scriptsource", "687474703A2F2F3132372E302E302E313A31303030302 F67[...]
Eliminata : user_pref("CT2851640.backendstorage.url_history000 1", "687474703A2F2F7777772E6B6173706572736B792E636[...]
Eliminata : user_pref("CT2851640.backendstorage.uttorrents", "7B226275696C64223A32373132302C226C6162656C223A5B5 D[...]
Eliminata : user_pref("CT2851640.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"soci al.c[...]
Eliminata : user_pref("CT2851640.globalFirstTimeInfoLastCheckT ime", "Thu Dec 20 2012 22:26:39 GMT+0100 (ora sola[...]
Eliminata : user_pref("CT2851640.homepageProtectorEnableByLogi n", true);
Eliminata : user_pref("CT2851640.initDone", true);
Eliminata : user_pref("CT2851640.isAppTrackingManagerOn", false);
Eliminata : user_pref("CT2851640.myStuffEnabled", true);
Eliminata : user_pref("CT2851640.myStuffPublihserMinWidth", 400);
Eliminata : user_pref("CT2851640.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]
Eliminata : user_pref("CT2851640.myStuffServiceIntervalMM", 1440);
Eliminata : user_pref("CT2851640.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Eliminata : user_pref("CT2851640.navigateToUrlOnSearch", false);
Eliminata : user_pref("CT2851640.oldAppsList", "129351530187150545,129351530187463046,1000234,129 791410467997787[...]
Eliminata : user_pref("CT2851640.revertSettingsEnabled", true);
Eliminata : user_pref("CT2851640.searchProtectorDialogDelayInS ec", 10);
Eliminata : user_pref("CT2851640.searchProtectorEnableByLogin" , true);
Eliminata : user_pref("CT2851640.testingCtid", "");
Eliminata : user_pref("CT2851640.toolbarAppMetaDataLastCheckTi me", "Fri Dec 21 2012 22:55:49 GMT+0100 (ora solar[...]
Eliminata : user_pref("CT2851640.usagesFlag", 2);
Eliminata : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT2851640/CT2851640[...]
Eliminata : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1243675/1239348/IT", "\"0\"[...]
Eliminata : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2851640", [...]
Eliminata : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...]
Eliminata : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[...]
Eliminata : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[...]
Eliminata : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.13[...]
Eliminata : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.14[...]
Eliminata : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.15[...]
Eliminata : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.16[...]
Eliminata : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2851640",[...]
Eliminata : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=it", "\"9a9[...]
Eliminata : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Users\\Anna\\AppData\\Roaming\\Mozilla\\Fi[...]
Eliminata : user_pref("CommunityToolbar.LatestToolbarVersionIn stalled", "3.16.0.3");
Eliminata : user_pref("CommunityToolbar.SearchFromAddressBarSa vedUrl", "");
Eliminata : user_pref("CommunityToolbar.ToolbarsList", "CT2851640");
Eliminata : user_pref("CommunityToolbar.ToolbarsList2", "CT2851640");
Eliminata : user_pref("CommunityToolbar.ToolbarsList4", "CT2851640");
Eliminata : user_pref("CommunityToolbar.globalUserId", "c4bf7cb0-486b-4fb3-a3a4-65b77fef2394");
Eliminata : user_pref("CommunityToolbar.isAlertUrlAddedToFeedI temTable", true);
Eliminata : user_pref("CommunityToolbar.isClickActionAddedToFe edItemTable", true);
Eliminata : user_pref("CommunityToolbar.keywordURLSelectedCTID ", "CT2851640");
Eliminata : user_pref("CommunityToolbar.notifications.alertDia logsGetterLastCheckTime", "Mon Dec 17 2012 22:27:2[...]
Eliminata : user_pref("CommunityToolbar.notifications.alertInf oInterval", 1440);
Eliminata : user_pref("CommunityToolbar.notifications.alertInf oLastCheckTime", "Fri Dec 21 2012 22:55:47 GMT+010[...]
Eliminata : user_pref("CommunityToolbar.notifications.clientsS erverUrl", "hxxp://alert.client.conduit.com");
Eliminata : user_pref("CommunityToolbar.notifications.locale", "en");
Eliminata : user_pref("CommunityToolbar.notifications.loginInt ervalMin", 1440);
Eliminata : user_pref("CommunityToolbar.notifications.loginLas tCheckTime", "Fri Dec 21 2012 22:55:40 GMT+0100 (o[...]
Eliminata : user_pref("CommunityToolbar.notifications.loginLas tUpdateTime", "1313487611");
Eliminata : user_pref("CommunityToolbar.notifications.messageS howTimeSec", 20);
Eliminata : user_pref("CommunityToolbar.notifications.services ServerUrl", "hxxp://alert.services.conduit.com");
Eliminata : user_pref("CommunityToolbar.notifications.showTray Icon", false);
Eliminata : user_pref("CommunityToolbar.notifications.userClos eIntervalMin", 300);
Eliminata : user_pref("CommunityToolbar.notifications.userId", "e68dc81f-b87f-49c5-94ec-1de6cf91487a");
Eliminata : user_pref("CommunityToolbar.originalHomepage", "");
Eliminata : user_pref("CommunityToolbar.originalSearchEngine", "chrome://browser-region/locale/region.properties[...]
Eliminata : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2851640&SearchSource=2&q=[...]

*************************

AdwCleaner[S1].txt - [20017 octets] - [22/12/2012 00:01:32]

########## EOF - C:\AdwCleaner[S1].txt - [20078 octets] ##########

[menatwork]

mi serve anche la scansione con otl, non incollarla ma allegala

[mjolneer]

ecco, li avevo messi in testa al log:


http://www.freefilehosting.net/extras_20
http://www.freefilehosting.net/otl_27

[menatwork]

Scarica Combofix
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
(non installare la recovery console)
Lascia lavorare il programma senza interferire
Allega il rapporto C:\ComboFix.txt nella tua risposta.

[mjolneer]

Questo è il log:

http://www.freefilehosting.net/log_75

quando l'ho lanciato non mi ha chiesto nulla in merito a console e altro, ha fatto tutto da solo.

[menatwork]

apri un file di testo e incolla questo codice

file::
c:\users\Public\Documents\AppData\PoApp\PLauncher. exe
c:\users\Anna\AppData\Local\Temp\catchme.dll

folder::
c:\users\Public\Documents\AppData\PoApp

registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"PosService"=-
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run]
"PosService"=-

DDS::
mStart Page = hxxp://search.findeer.com
TCP: Interfaces\{3a539854-6a70-11db-887c-806e6f6e6963}: NameServer = 176.31.229.24,176.31.229.25
TCP: Interfaces\{9E2CAAF8-4E6C-4FEC-A73A-C1E345331B16}: NameServer = 176.31.229.24,176.31.229.25
TCP: Interfaces\{FAB2DED7-A12D-491A-80EF-9DCB4E51D459}: NameServer = 176.31.229.24,176.31.229.25

Salva il file sul Desktop come CFScript.txt

Trascina il file appena creato ovvero CFScript.txt sull'icona di ComboFix

al termine il PC si dovrebbe ravviare, eventualmente riavvia tu manualmente, allega il log che trovi in C:\ComboFix.txt

riesegui anche una scansione con adwcleaner come prima

riesegui anche otl

allega i 3 log

combofix

adwcleaner

otl

[mjolneer]

Ecco i tre log:

http://www.freefilehosting.net/otl_30

http://www.freefilehosting.net/adw

http://www.freefilehosting.net/combo