scarica CCleaner e SystemScan

Disconnetti il pc da internet

da hjt fixa:
R3 - URLSearchHook: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
R3 - URLSearchHook: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: 192.10.10.1 as400
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)
O2 - BHO: (no name) - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {FAFC3FDD-D9E8-4770-843D-F105F0D7E409} - (no file)
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
O4 - HKLM\..\Run: [Client Access Service] "C:\Programmi\IBM\Client Access\cwbsvstr.exe"
O4 - HKLM\..\Run: [Client Access Help Update] "C:\Programmi\IBM\Client Access\cwbinhlp.exe"
O4 - HKLM\..\Run: [Client Access Check Version] "C:\Programmi\IBM\Client Access\cwbckver.exe" LOGIN
O4 - HKLM\..\Run: [Client Access Express Welcome] "C:\Programmi\IBM\Client Access\cwbwlwiz.exe"
O4 - HKLM\..\Run: [Easy-PrintToolBox] "C:\Programmi\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" /logon
O4 - HKLM\..\Run: [Stupid Data Dart Wave] C:\Documents and Settings\All Users\Dati applicazioni\flag ace stupid data\creative fast.exe
O4 - HKCU\..\Run: [Readme Cake] C:\DOCUME~1\UTENTE\DATIAP~1\BALLTI~1\antitick.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [SRUUninstall ] "C:\WINDOWS\System32\msiexec.exe" /L*v C:\WINDOWS\TEMP\SND532unin.txt /x {6AF90EF6-F7F9........
O4 - HKUS\.DEFAULT\..\RunOnce: [SRUUninstall ] "C:\WINDOWS\System32\msiexec.exe" /L*v C:\WINDOWS\TEMP\SND532unin.txt /x {6AF90EF6-F7F9-..........
O16 - DPF: {F5192746-22D6-41BD-9D2D-1E75D14FBD3C} - http ://download.rfwnad.com/cab/crack.CAB
O24 - Desktop Component 0: (no name) - file: ///C:/DOCUME~1/UTENTE/ IMPOST~1/Temp/msohtml1/01/clip_image001.jpg


rimuovi le cartelle:
C:\Documents and Settings\All Users\Dati applicazioni\flag ace stupid data
C:\DOCUME~1\UTENTE\DATIAP~1\BALLTI~1

Esegui CCleaner e ripulisci i file temporanei e i cookie (eseguilo 2 volte)

Disattiva l'antivirus => esegui systemscan => clicca su "unselect all" => spunta le opzioni:
- Recent files
- Registry Run Keys
- Scheduled jobs
- Hidden objects
- Master Boot Record
- Include HOSTS file
- Suspicious Files
- Include Hijackthis log
=> clicca su "Scan Now". Finita la scansione, riattiva l'antivirus, carica il rapporto che trovi in C:\Suspectfile su Freefilehosting e posta il link ottenuto.

cerca questo file e dimmi dove si trova:
O4 - HKCU\..\Run: [WinSwitch] "C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\winswitch.exe "
O4 - Global Startup: winswitch.exe

che programma è questo? Se non lo usi/conosci, fixa le voci:
O9 - Extra button: (no name) - {4B30061A-5D22-11D3-80F8-0090276F843F} - f:\programmi\pgsoft \agent\pgweb.exe
O9 - Extra 'Tools' menuitem: Cerca con pgweb - {4B30061A-5D22-11D3-80F8-0090276F843F} - f:\programmi\pgsoft\agent\pgweb.exe
O9 - Extra button: PGWeb - {4B30061A-5D23-11D3-80F8-0090276F843F} - f:\programmi\pgsoft\agent\pgweb.exe