Windows XP Restore

[ws23]

Ciao a tutti,
il mio PC è stato infettato da Windows XP Restore. Il collegamento ad Internet non funziona, il desktop appare completamente nero senza le cartelle ed i file soliti. Appare la finestra di questo falso software di diagnostica che indica di aver trovato diversi errori.
Ho provato a fare una scansione completa con Malwarebytes e successivamente ad usare unhider.exe ma ad ogni riavvio riappare il solito problema.
Potreste indicarmi come fare a liberarmi di questo malware?

Copio il file di log della scansione completa di Malwarebytes:

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Versione database: 6705

Windows 5.1.2600 Service Pack 2 (Safe Mode)
Internet Explorer 7.0.5730.11

14/06/2011 14.30.12
mbam-log-2011-06-14 (14-30-10).txt

Tipo di scansione: Scansione completa (C:\|D:\|)
Elementi esaminati: 431876
Tempo impiegato: 1 ore, 29 minuti, 5 secondi

Processi infetti in memoria: 0
Moduli di memoria infetti: 0
Chiavi di registro infette: 0
Valori di registro infetti: 0
Voci infette nei dati di registro: 2
Cartelle infette: 0
File infetti: 1

Processi infetti in memoria:
(Non sono stati rilevati elementi nocivi)

Moduli di memoria infetti:
(Non sono stati rilevati elementi nocivi)

Chiavi di registro infette:
(Non sono stati rilevati elementi nocivi)

Valori di registro infetti:
(Non sono stati rilevati elementi nocivi)

Voci infette nei dati di registro:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Policies\ActiveDesktop\NoChangingWallPap er (PUM.Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Policies\Explorer\NoDesktop (PUM.Hidden.Desktop) -> Bad: (1) Good: (0) -> No action taken.

Cartelle infette:
(Non sono stati rilevati elementi nocivi)

File infetti:
c:\documents and settings\all users\dati applicazioni\16703268.exe (Trojan.Agent) -> No action taken.

[marcosx86]

Ok, non ha fatto niente in questo caso malwarebytes, fai così.

fai la stessa cosa, quindi scansione completa dalla modalità provvisoria.

[ws23]

Ciao Marco,
il report si riferisce alla scansione completa fatta già in modalità provvisoria..... suggerimenti?

[R16]

Ciao.
Scarica TDSSKiller.zip sul desktop:
http://support.kaspersky.com/viruses...?qid=208280684
Estrai i dati in una cartella e fai doppio clik su TDSSKiller.exe
clicca su "Start Scan"
Se trova qualche infezione di default avrai l'opzione "Cure" per cui, clicca su "Continue".
Se un file sospetto viene trovato,l'azione di default sarà skip,clicca su "Continue".
Se è richiesto il riavvio,(Reboot) acconsenti. (per eliminare l'infezione è necessario riavviare il pc)
Se nessun riavvio è richiesto clicca su report e salva il contenuto in un file di testo.
Il log lo trovi in C:\
Postalo qui.

Poi rifai la scansione con Malwarebytes. (in Modalità Normale)
Elimina quello che trova.
Posta il log.

Poi:
scarica questo tooll sul desktop:
http://download.bleepingcomputer.com/grinler/unhide.exe

Doppio click sull'icona Unhide.exe .
Finita la scansione,ti esce una finestra in cui ti dice, che i file sono visibili, (Your files should now be visible )clicca ok, e chiudi il programma.
Riavvia il pc.

Dovresti visualizzare di nuovo il desktop.

[ws23]

Purtroppo dopo ogni scansione e riavvio ritrovo il desktop nero, le icone nascoste e la finestra di XP Restore che riappare.
posto il log di TDSSKILLER e posto quello di Mbam ma penso che non abbiano effetto:



Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Versione database: 6705

Windows 5.1.2600 Service Pack 2 (Safe Mode)
Internet Explorer 7.0.5730.11

14/06/2011 21.05.49
mbam-log-2011-06-14 (21-05-42).txt

Tipo di scansione: Scansione completa (C:\|D:\|)
Elementi esaminati: 431893
Tempo impiegato: 1 ore, 29 minuti, 31 secondi

Processi infetti in memoria: 0
Moduli di memoria infetti: 0
Chiavi di registro infette: 0
Valori di registro infetti: 0
Voci infette nei dati di registro: 2
Cartelle infette: 0
File infetti: 1

Processi infetti in memoria:
(Non sono stati rilevati elementi nocivi)

Moduli di memoria infetti:
(Non sono stati rilevati elementi nocivi)

Chiavi di registro infette:
(Non sono stati rilevati elementi nocivi)

Valori di registro infetti:
(Non sono stati rilevati elementi nocivi)

Voci infette nei dati di registro:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Policies\ActiveDesktop\NoChangingWallPap er (PUM.Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Policies\Explorer\NoDesktop (PUM.Hidden.Desktop) -> Bad: (1) Good: (0) -> No action taken.

Cartelle infette:
(Non sono stati rilevati elementi nocivi)

File infetti:
c:\documents and settings\all users\dati applicazioni\16703268.exe (Trojan.Agent) -> No action taken.

[ws23]

TDSKILLER

2011/06/15 08:09:14.0890 1024 TDSS rootkit removing tool 2.5.4.0 Jun 7 2011 17:31:48
2011/06/15 08:09:14.0968 1024 ================================================== ==============================
2011/06/15 08:09:14.0968 1024 SystemInfo:
2011/06/15 08:09:14.0968 1024
2011/06/15 08:09:14.0968 1024 OS Version: 5.1.2600 ServicePack: 2.0
2011/06/15 08:09:14.0968 1024 Product type: Workstation
2011/06/15 08:09:14.0968 1024 ComputerName: EUDORA
2011/06/15 08:09:14.0968 1024 UserName: desktop
2011/06/15 08:09:14.0968 1024 Windows directory: C:\WINDOWS
2011/06/15 08:09:14.0968 1024 System windows directory: C:\WINDOWS
2011/06/15 08:09:14.0968 1024 Processor architecture: Intel x86
2011/06/15 08:09:14.0968 1024 Number of processors: 2
2011/06/15 08:09:14.0968 1024 Page size: 0x1000
2011/06/15 08:09:14.0968 1024 Boot type: Safe boot
2011/06/15 08:09:14.0968 1024 ================================================== ==============================
2011/06/15 08:09:18.0281 1024 Initialize success
2011/06/15 08:09:19.0906 1040 ================================================== ==============================
2011/06/15 08:09:19.0906 1040 Scan started
2011/06/15 08:09:19.0906 1040 Mode: Manual;
2011/06/15 08:09:19.0906 1040 ================================================== ==============================
2011/06/15 08:09:22.0140 1040 ACPI (ad825cb3397c837d1fb91d566d78de04) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/06/15 08:09:22.0406 1040 ACPIEC (49ac5cd87fbdda62f3e25190019e7627) C:\WINDOWS\system32\drivers\ACPIEC.sys
2011/06/15 08:09:22.0640 1040 ActivHidSerMini (092542818ccd17b659e17e4dcb427bad) C:\WINDOWS\system32\DRIVERS\activhidsermini.sys
2011/06/15 08:09:23.0093 1040 aec (1ee7b434ba961ef845de136224c30fec) C:\WINDOWS\system32\drivers\aec.sys
2011/06/15 08:09:23.0390 1040 AFD (55e6e1c51b6d30e54335750955453702) C:\WINDOWS\System32\drivers\afd.sys
2011/06/15 08:09:25.0328 1040 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/06/15 08:09:25.0562 1040 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/06/15 08:09:26.0406 1040 ati2mtag (f5fc6ac1e7bc776871361d463fc86be2) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
2011/06/15 08:09:27.0093 1040 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/06/15 08:09:27.0343 1040 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/06/15 08:09:27.0437 1040 avgio (594d25ef73f381fd508b8ee04883f90f) C:\Programmi\Avira\AntiVir Desktop\avgio.sys
2011/06/15 08:09:27.0703 1040 avgntflt (14fe36d8f2c6a2435275338d061a0b66) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
2011/06/15 08:09:27.0937 1040 avipbb (33e08f43071e4a4ff6fcfb6758f85a27) C:\WINDOWS\system32\DRIVERS\avipbb.sys
2011/06/15 08:09:28.0171 1040 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/06/15 08:09:28.0406 1040 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/06/15 08:09:28.0796 1040 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/06/15 08:09:29.0078 1040 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/06/15 08:09:29.0328 1040 Cdrom (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/06/15 08:09:30.0593 1040 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/06/15 08:09:31.0031 1040 dmboot (6570b4c952f0d8fee4c6ef2ff5e10c08) C:\WINDOWS\system32\drivers\dmboot.sys
2011/06/15 08:09:31.0468 1040 dmio (c57d35621782c7f40770f3e5ca20a182) C:\WINDOWS\system32\drivers\dmio.sys
2011/06/15 08:09:31.0734 1040 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/06/15 08:09:32.0000 1040 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys
2011/06/15 08:09:32.0437 1040 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/06/15 08:09:32.0671 1040 EAPPkt (efacd8d57a42a93e244a0dbd357e8cb8) C:\WINDOWS\system32\DRIVERS\EAPPkt.sys
2011/06/15 08:09:32.0984 1040 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/06/15 08:09:33.0250 1040 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\DRIVERS\fdc.sys
2011/06/15 08:09:33.0484 1040 Fips (333fbbc71bdcbb46c58a3b51b3d51184) C:\WINDOWS\system32\drivers\Fips.sys
2011/06/15 08:09:33.0718 1040 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
2011/06/15 08:09:33.0984 1040 FltMgr (3d234fb6d6ee875eb009864a299bea29) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
2011/06/15 08:09:34.0234 1040 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/06/15 08:09:34.0453 1040 Ftdisk (f3269a6ee547ea87b949a1cea4816b38) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/06/15 08:09:34.0718 1040 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/06/15 08:09:34.0984 1040 HDAudBus (3fcc124b6e08ee0e9351f717dd136939) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
2011/06/15 08:09:35.0203 1040 HidUsb (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/06/15 08:09:35.0671 1040 HTTP (9f8b0f4276f618964fd118be4289b7cd) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/06/15 08:09:36.0406 1040 i8042prt (30e64dfa4efaacc8142ea07766181fb4) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/06/15 08:09:36.0671 1040 Imapi (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/06/15 08:09:38.0843 1040 IntcAzAudAddService (909d03b3b7fb7c830b74f74f4d0ea7ce) C:\WINDOWS\system32\drivers\RtkHDAud.sys
2011/06/15 08:09:40.0421 1040 intelppm (ebc07787034bbe312020d30198a9f362) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2011/06/15 08:09:40.0640 1040 Ip6Fw (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
2011/06/15 08:09:40.0875 1040 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/06/15 08:09:41.0078 1040 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/06/15 08:09:41.0312 1040 IpNat (e2168cbc7098ffe963c6f23f472a3593) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/06/15 08:09:41.0593 1040 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/06/15 08:09:41.0828 1040 irda (86c204836feec22510d434982d4221b8) C:\WINDOWS\system32\DRIVERS\irda.sys
2011/06/15 08:09:42.0125 1040 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/06/15 08:09:42.0343 1040 irsir (0501f0b9ab08425f8c0eacbdcc04aa32) C:\WINDOWS\system32\DRIVERS\irsir.sys
2011/06/15 08:09:42.0562 1040 isapnp (ea3245a8e8758d6b84de189a5caaa75e) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/06/15 08:09:42.0812 1040 Kbdclass (e883ae6ea0b313e659225aa32e449ce9) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/06/15 08:09:43.0015 1040 kbdhid (24f4d51e89822c349044c28be255c8a5) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2011/06/15 08:09:43.0281 1040 kmixer (ba5deda4d934e6288c2f66caf58d2562) C:\WINDOWS\system32\drivers\kmixer.sys
2011/06/15 08:09:43.0546 1040 KSecDD (674d3e5a593475915dc6643317192403) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/06/15 08:09:44.0031 1040 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/06/15 08:09:44.0296 1040 Modem (b30d2db351e3191bd71232036cfe711a) C:\WINDOWS\system32\drivers\Modem.sys
2011/06/15 08:09:44.0500 1040 MODEMCSA (1992e0d143b09653ab0f9c5e04b0fd65) C:\WINDOWS\system32\drivers\MODEMCSA.sys
2011/06/15 08:09:44.0703 1040 Mouclass (c458e314b8722253897c94a714c2e0c0) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/06/15 08:09:44.0890 1040 mouhid (d7662f0cf5b77bbbe3202716f5bd5318) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/06/15 08:09:45.0125 1040 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/06/15 08:09:45.0578 1040 MRxDAV (29414447eb5bde2f8397dc965dbb3156) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/06/15 08:09:45.0953 1040 MRxSmb (fb6c89bb3ce282b08bdb1e3c179e1c39) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/06/15 08:09:46.0281 1040 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys
2011/06/15 08:09:46.0515 1040 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/06/15 08:09:46.0703 1040 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/06/15 08:09:46.0968 1040 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/06/15 08:09:47.0171 1040 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/06/15 08:09:47.0421 1040 Mtlmnt5 (c53775780148884ac87c455489a0c070) C:\WINDOWS\system32\DRIVERS\Mtlmnt5.sys
2011/06/15 08:09:48.0000 1040 Mtlstrm (54886a652bf5685192141df304e923fd) C:\WINDOWS\system32\DRIVERS\Mtlstrm.sys
2011/06/15 08:09:48.0578 1040 Mup (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINDOWS\system32\drivers\Mup.sys
2011/06/15 08:09:48.0906 1040 NDIS (558635d3af1c7546d26067d5d9b6959e) C:\WINDOWS\system32\drivers\NDIS.sys
2011/06/15 08:09:49.0140 1040 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/06/15 08:09:49.0359 1040 Ndisuio (34d6cd56409da9a7ed573e1c90a308bf) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/06/15 08:09:49.0562 1040 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/06/15 08:09:49.0781 1040 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/06/15 08:09:50.0000 1040 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/06/15 08:09:50.0265 1040 NetBT (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/06/15 08:09:50.0578 1040 Nokia USB Generic (5abb6b2461c4eb0afdf1bf7f03963d59) C:\WINDOWS\system32\drivers\nmwcdc.sys
2011/06/15 08:09:50.0859 1040 Nokia USB Modem (353c16d21eec1f11306270040b3713c1) C:\WINDOWS\system32\drivers\nmwcdcm.sys
2011/06/15 08:09:51.0109 1040 Nokia USB Phone Parent (f5b1200c75b160c81e7e48cc0489aa5e) C:\WINDOWS\system32\drivers\nmwcd.sys
2011/06/15 08:09:51.0359 1040 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys
2011/06/15 08:09:51.0718 1040 Ntfs (19a811ef5f1ed5c926a028ce107ff1af) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/06/15 08:09:52.0156 1040 NtMtlFax (576b34ceae5b7e5d9fd2775e93b3db53) C:\WINDOWS\system32\DRIVERS\NtMtlFax.sys
2011/06/15 08:09:52.0406 1040 Null (73c1e1f395918bc2c6dd67af7591a3ad)

[ws23]

C:\WINDOWS\system32\drivers\Null.sys
2011/06/15 08:09:52.0625 1040 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/06/15 08:09:52.0875 1040 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/06/15 08:09:53.0125 1040 Parport (3490ead0612bfd0e7c1b864ee24e6a4a) C:\WINDOWS\system32\DRIVERS\parport.sys
2011/06/15 08:09:53.0343 1040 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/06/15 08:09:53.0546 1040 ParVdm (0dabef655a444cb1e193626fb1d24b9f) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/06/15 08:09:53.0765 1040 pavboot (210a628a0d7b3f45257850efbff27538) C:\WINDOWS\system32\drivers\pavboot.sys
2011/06/15 08:09:53.0984 1040 PCI (91fc1d483d900b1c0600a08b871c39d5) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/06/15 08:09:54.0406 1040 PCIIde (b2df00d650fd6c4ee781740ed3c8e67f) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/06/15 08:09:54.0640 1040 Pcmcia (28f3538a2091993a03506311a05053e8) C:\WINDOWS\system32\drivers\Pcmcia.sys
2011/06/15 08:09:56.0234 1040 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/06/15 08:09:56.0437 1040 prmvmouse (20a45d4fdfcc079265816e8f46acb1ae) C:\WINDOWS\system32\DRIVERS\activmouse.sys
2011/06/15 08:09:56.0671 1040 PSched (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/06/15 08:09:56.0890 1040 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/06/15 08:09:57.0109 1040 PxHelp20 (86724469cd077901706854974cd13c3e) C:\WINDOWS\system32\Drivers\PxHelp20.sys
2011/06/15 08:09:58.0250 1040 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/06/15 08:09:58.0484 1040 Rasirda (0207d26ddf796a193ccd9f83047bb5fc) C:\WINDOWS\system32\DRIVERS\rasirda.sys
2011/06/15 08:09:58.0671 1040 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/06/15 08:09:58.0890 1040 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/06/15 08:09:59.0109 1040 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/06/15 08:09:59.0359 1040 Rdbss (03b965b1ca47f6ef60eb5e51cb50e0af) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/06/15 08:09:59.0656 1040 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/06/15 08:09:59.0921 1040 rdpdr (a2cae2c60bc37e0751ef9dda7ceaf4ad) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2011/06/15 08:10:00.0234 1040 RDPWD (b54cd38a9ebfbf2b3561426e3fe26f62) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/06/15 08:10:00.0484 1040 RecAgent (e9aaa0092d74a9d371659c4c38882e12) C:\WINDOWS\system32\DRIVERS\RecAgent.sys
2011/06/15 08:10:00.0703 1040 redbook (a8eee004a16af1d583d9de9f6de250e0) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/06/15 08:10:00.0984 1040 RTL8023xp (d6e1b1bd04fad422af17fc4b810cb9af) C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys
2011/06/15 08:10:01.0250 1040 RTLWUSB (463b8ac0130adf01a85daebf646b3db3) C:\WINDOWS\system32\DRIVERS\wg111v2.sys
2011/06/15 08:10:01.0531 1040 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/06/15 08:10:01.0812 1040 serenum (a2d868aeeff612e70e213c451a70cafb) C:\WINDOWS\system32\DRIVERS\serenum.sys
2011/06/15 08:10:02.0046 1040 Serial (dbab3260e7eb3398cb87267d1410fad4) C:\WINDOWS\system32\DRIVERS\serial.sys
2011/06/15 08:10:02.0296 1040 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/06/15 08:10:02.0718 1040 SjyPkt (3d7ef286e806f9bd9339aa52e28dcd67) C:\WINDOWS\System32\Drivers\SjyPkt.sys
2011/06/15 08:10:03.0046 1040 Slntamr (2c1779c0feb1f4a6033600305eba623a) C:\WINDOWS\system32\DRIVERS\slntamr.sys
2011/06/15 08:10:03.0375 1040 SlNtHal (f9b8e30e82ee95cf3e1d3e495599b99c) C:\WINDOWS\system32\DRIVERS\Slnthal.sys
2011/06/15 08:10:03.0609 1040 SlWdmSup (db56bb2c55723815cf549d7fc50cfceb) C:\WINDOWS\system32\DRIVERS\SlWdmSup.sys
2011/06/15 08:10:04.0125 1040 splitter (0ce218578fff5f4f7e4201539c45c78f) C:\WINDOWS\system32\drivers\splitter.sys
2011/06/15 08:10:04.0359 1040 sr (896f566afc498077172eae8a50e8baf8) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/06/15 08:10:04.0687 1040 Srv (7a4f147cc6b133f905f6e65e2f8669fb) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/06/15 08:10:05.0015 1040 ssmdrv (7b69466075b4da427c5ecd10e1eab72a) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
2011/06/15 08:10:05.0250 1040 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/06/15 08:10:05.0468 1040 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys
2011/06/15 08:10:06.0515 1040 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/06/15 08:10:06.0843 1040 Tcpip (2a5554fc5b1e04e131230e3ce035c3f9) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/06/15 08:10:07.0140 1040 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/06/15 08:10:07.0343 1040 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/06/15 08:10:07.0562 1040 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/06/15 08:10:08.0046 1040 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys
2011/06/15 08:10:08.0546 1040 Update (ced744117e91bdc0beb810f7d8608183) C:\WINDOWS\system32\DRIVERS\update.sys
2011/06/15 08:10:08.0953 1040 usbccgp (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/06/15 08:10:09.0171 1040 usbehci (15e993ba2f6946b2bfbbfcd30398621e) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/06/15 08:10:09.0406 1040 usbhub (c72f40947f92cea56a8fb532edf025f1) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/06/15 08:10:09.0640 1040 usbprint (a42369b7cd8886cd7c70f33da6fcbcf5) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2011/06/15 08:10:09.0859 1040 usbscan (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2011/06/15 08:10:10.0093 1040 USBSTOR (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/06/15 08:10:10.0359 1040 usbuhci (f8fd1400092e23c8f2f31406ef06167b) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/06/15 08:10:10.0578 1040 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys
2011/06/15 08:10:11.0046 1040 vmm (817da66b1b889fad1dbf669e0e2f3228) C:\WINDOWS\system32\Drivers\vmm.sys
2011/06/15 08:10:11.0515 1040 VolSnap (698869e82c57169f2140c04a272bf12b) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/06/15 08:10:11.0750 1040 VPCNetS2 (2abe8281db609d8bb1bd1b2f93800d5f) C:\WINDOWS\system32\DRIVERS\VMNetSrv.sys
2011/06/15 08:10:12.0000 1040 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/06/15 08:10:12.0421 1040 wdmaud (efd235ca22b57c81118c1aeb4798f1c1) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/06/15 08:10:12.0828 1040 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
2011/06/15 08:10:13.0078 1040 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
2011/06/15 08:10:13.0312 1040 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
2011/06/15 08:10:13.0437 1040 MBR (0x1B8) (828e02d5c4a4fbe53441ee9dbee51f43) \Device\Harddisk0\DR0
2011/06/15 08:10:13.0593 1040 ================================================== ==============================
2011/06/15 08:10:13.0593 1040 Scan finished
2011/06/15 08:10:13.0593 1040 ================================================== ==============================
2011/06/15 08:10:13.0625 1032 Detected object count: 0
2011/06/15 08:10:13.0625 1032 Actual detected object count: 0
2011/06/15 08:18:45.0890 1020 Deinitialize success

[POCHO22]

ciao

Scarica ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
scaricalo con internet explorer obbligatoriamente
posizionalo sul Desktop obbligatoriamente
disattiva l'Antivirus in uso
disattiva il Firewall
chiudi la connessione.
lancia ComboFix con doppio clik
segui le istruzioni che verranno rilasciate per eseguire la scansione
verrà richiesta l'installazione della Console di ripristino di emergenza: non la installare
senza eseguire nessuna altra operazione, lascia che completi la scansione non usare ne anche il mouse

se viene rilasciato un messaggio in relazione all'Antivirus in uso: del tipo Combofix cannot run when tuo Antivirus is installed..ecc
prosegui ignorando il messaggio
il firewall potrebbe rilasciare un avviso circa la rimozione di alcuni driver: consenti

Quando ComboFix avrà concluso la scansione:
il sistema verrà riavviato automaticamente: in caso contrario, riavvialo tu
vai in Disco Locale C:, cerca il file di testo dal nome ComboFix.txt ed allegalo

[R16]

@POCHO22
Scusa POCHO22, ma non ho chiesto il tuo aiuto.
E gli interventi già in atto, durante una bonifica,non li vedo di buon occhio.
Specie se mi cambiano la procedura che ho in mente.
Per cui per favore, evita di dare indicazioni per non confodere l'utente.

@ ws23
Vedi se riesci a fare questa scansione:
SYSTEM SCAN

scaricalo sul desktop
http://www.suspectfile.com/systemscan
Aprilo ed assicurati che tutte le opzioni siano spuntate, clicca su "Scan Now"
Finita la scansione verrà rilasciato (sempre sul desktop all'interno della cartella suspectfile)un report.

Collegati ad internet e vai alla pagina WikiSend: http://www.wikisend.com/
Clicca sul bottone "Sfoglia"
Seleziona il file appena salvato
Clicca su Upload file
Dopo qualche secondo, vieni spostato su una nuova pagina con il link in diversi formati:
Download Link / Forum Link
Seleziona Forum Link, copialo e incollalo in un nuovo messaggio per il forum.
Ricordati d'effettuare la scansione senza connessione attiva e con l'antivirus disabilitato salvo poi riattivarlo a scansione terminata.

NB:
la durata della scansione può risultare lunga, potrebbe addirittura sembrare che il programma non stia lavorando, non preoccuparti non è così.
SystemScan viene riconosciuto, erroneamente, da alcuni antivirus come infetto.

[ws23]

Ho provato tutti i vari tentativi ma non riesco a toglierlo. Al riavvio riappare sempre il desktop nero e il problema ritorna. Anche seguendo le indicazioni nella pagina segnalata.

Ora ho provato anche con Systemscan ed ho uploadato il file zip come indicato da Pocho.
Questo è il link:
17_06_2011_15_13_report.zip

Ora che devo fare? possibile che non ci sia soluzione?