Windows - Disco non presente

[Capo]

Buongiorno a tutti. Chiedo un aiuto per risolvere un problema che credo appartenga alla famiglia dei virus informatici.
Dopo l'avvio di windows xp mi compare una finestra con scritto:
Windows - Disco non presente
Exception Processing Message c0000013 Parameters 75b1bf7c 4 75.............
Annulla - Riprova - Continua
Cliccando su "Annulla" o "Continua" la finestra sparisce ma ricompare al successivo riavvio di Windows. Ho fatto scansioni con Avast, Malwarebytes, Spybot - Search and Destroy, che non hanno rilevato alcuna infezione. Grazie

[menatwork]

scarica hijackthis
1) crea una cartella dedicata e scompattalo al suo interno
2) lancia il programma
3) nel menu' di destra clicca su "do a system scan and save a log file"
4) il programma ti rilascerà un file di report in formato txt, salvalo e postalo sul forum

[Capo]

Ecco il Log HijackThis,


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:40:00, on 11/09/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\hphmon04.exe
C:\Programmi\Windows Defender\MSASCui.exe
D:\Programmi\hpgs2wnd.exe
C:\Programmi\File comuni\ACD Systems\EN\DevDetect.exe
D:\Programmi\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe
C:\Programmi\File comuni\InstallShield\UpdateService\issch.exe
C:\Programmi\File comuni\Java\Java Update\jusched.exe
C:\Programmi\Alwil Software\Avast5\avastUI.exe
D:\Programmi\hpgs2wnf.exe
C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Programmi\Adobe Bridge CS4\Bridge.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
C:\Programmi\Samsung\Kies\KiesTrayAgent.exe
C:\Programmi\Samsung\Kies\External\FirmwareUpdate\ KiesPDLR.exe
C:\Programmi\Hamlet\Common\RaUI.exe
C:\Programmi\Windows Desktop Search\WindowsSearch.exe
D:\Programmi\WinZip\WZQKPICK.EXE
C:\WINDOWS\system32\FsUsbExService.Exe
C:\Programmi\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Programmi\File comuni\Ahead\Lib\NMIndexingService.exe
C:\Programmi\File comuni\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\msiexec.exe
C:\Programmi\Hijackthis\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.aeci.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programmi\Alwil Software\Avast5\aswWebRepIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmi\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugi n.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programmi\Alwil Software\Avast5\aswWebRepIE.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb0 5.exe
O4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\system32\hphmon04.exe
O4 - HKLM\..\Run: [HPHUPD04] "C:\Programmi\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmi\File comuni\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Programmi\File comuni\Adobe\CS4ServiceManager\CS4ServiceManager.e xe" -launchedbylogin
O4 - HKLM\..\Run: [Windows Defender] "C:\Programmi\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] D:\Programmi\hpgs2wnd.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Device Detector] DevDetect.exe -autorun
O4 - HKLM\..\Run: [QuickTime Task] "D:\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ROUTE66Sync] D:\Programmi\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe -runinbackground
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FILECO~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Programmi\File comuni\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\File comuni\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [avast] "C:\Programmi\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [AdobeBridge] "D:\Programmi\Adobe Bridge CS4\Bridge.exe" -stealth
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Amministratore\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [KiesHelper] C:\Programmi\Samsung\Kies\KiesHelper.exe /s
O4 - HKCU\..\Run: [KiesTrayAgent] C:\Programmi\Samsung\Kies\KiesTrayAgent.exe
O4 - HKCU\..\Run: [KiesPDLR] C:\Programmi\Samsung\Kies\External\FirmwareUpdate\ KiesPDLR.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Hamlet HNW300NU2.lnk = C:\Programmi\Hamlet\Common\RaUI.exe
O4 - Global Startup: Windows Search.lnk = C:\Programmi\Windows Desktop Search\WindowsSearch.exe
O4 - Global Startup: WinZip Quick Pick.lnk = D:\Programmi\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite....x/qtplugin.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://mail.partesa.it/iNotes6W.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://download.bitdefender.com/reso...an8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1260263281765
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Programmi\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Programmi\File comuni\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FsUsbExService - Teruten - C:\WINDOWS\system32\FsUsbExService.Exe
O23 - Service: Google Update Service (gupdate1c98c4420927f0a) (gupdate1c98c4420927f0a) - Google Inc. - C:\Programmi\Google\Update\GoogleUpdate.exe
O23 - Service: Servizio Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Programmi\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmi\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Programmi\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programmi\File comuni\Ahead\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\system32\HPHipm11.exe

--
End of file - 9047 bytes

[menatwork]

che programmi ha i installato di recente

questo da quanto tempo e' nel pc

O4 - HKLM\..\Run: [ROUTE66Sync] D:\Programmi\ROUTE 66 \ROUTE 66 Sync\Sync9Loader.exe -runinbackground

[Capo]

il ROUTE 66 è un programma di navigazione GPS che ho installato sullo smartpnone e ce l'ho da gennaio 2011. Altri programmi recentemente non mi risulta di avere installato....

[menatwork]

scarica questi programmi e mettili sul desktop

malwarebytes


combofix


avvia malwarebytes

Aggiornalo: clicca sulla scheda "aggiornamenti" => "controlla aggiornamenti"
Esegui una "scansione completa" (seleziona l'opzione)
A scansione completa, fai clic su OK => Mostra i Risultati.
Assicurarti che tutto sia selezionato e clicca clic su Rimuovi selezionati.
Se ti chiede di riavviare, riavvia per completare il processo di pulizia.


lancia combofix


alla richiesta se vuoi installare la recovery console clicca su NO

esegui ComboFix.exe

segui le instruzioni

finita la scansione portati in C:\ e allega nella tua prossima risposta, il contenuto del file di testo Combofix.txt


come usare correttamente combofix

[Capo]

Buongiorno, eccomi qui dopo una assenza forzata.....causa lavoro.
Riepilogo quanto fatto: Scansione completa con malwarebyte che non ha prodotto nessun effetto e scansione con Combofix che ho dovuto fare in modalità provvisoria in quanto prima di terminare mi spegneva tutto e riavviava di nuovo windows.
Ecco il file log:
----------------------------------------------------------------------------------------

ComboFix 11-09-13.03 - Administrator 16/09/2011 17.23.20.9.1 - x86 MINIMAL
Microsoft Windows XP Home Edition 5.1.2600.3.1252.39.1040.18.1023.777 [GMT 2:00]
Eseguito da: c:\documents and settings\All Users\Menu Avvio\Programmi\Accessori\UtilitÓ di sistema\Antivirus\ComboFix.exe
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.
.
((((((((((((((((((((((((( Files Creati Da 2011-08-16 al 2011-09-16 )))))))))))))))))))))))))))))))))))
.
.
2011-09-16 12:03 . 2011-08-16 06:48 7152464 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Microsoft\Windows Defender\Definition Updates\{3C10B8D0-0C77-4087-B9CA-4B72BD396DC6}\mpengine.dll
2011-09-11 18:33 . 2011-09-11 18:33 388096 ----a-r- c:\documents and settings\Amministratore\Dati applicazioni\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-09-11 13:35 . 2011-06-21 09:24 32768 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2011-09-11 11:32 . 2011-09-11 11:32 -------- d-----w- c:\documents and settings\Administrator\Dati applicazioni\Windows Search
2011-09-11 11:27 . 2011-09-11 11:27 -------- d-----w- c:\documents and settings\Administrator\Dati applicazioni\Malwarebytes
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) )
.
2011-09-09 09:12 . 2008-04-13 17:13 603136 ----a-w- c:\windows\system32\crypt32.dll
2011-09-06 20:45 . 2010-07-01 19:52 41184 ----a-w- c:\windows\avastSS.scr
2011-09-06 20:45 . 2008-12-11 18:50 199304 ----a-w- c:\windows\system32\aswBoot.exe
2011-09-06 20:38 . 2011-03-13 10:08 442200 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-09-06 20:37 . 2008-12-11 18:51 320856 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-09-06 20:36 . 2008-12-11 18:51 34392 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-09-06 20:36 . 2008-12-11 18:51 52568 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-09-06 20:36 . 2008-12-11 18:51 110552 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-09-06 20:36 . 2008-12-11 18:51 104536 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-09-06 20:36 . 2008-12-11 18:51 20568 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-09-06 20:33 . 2008-12-11 18:51 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-09-02 11:20 . 2011-05-20 19:26 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-08-31 15:00 . 2011-03-13 09:51 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-16 06:48 . 2009-10-03 19:24 7152464 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2011-07-15 13:29 . 2008-04-13 10:17 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-12 10:17 . 2011-07-12 10:17 0 ---ha-w- c:\documents and settings\Amministratore\Impostazioni locali\Dati applicazioni\BITE.tmp
2011-07-08 14:02 . 2008-04-13 09:57 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2011-06-24 14:10 . 2008-12-11 15:17 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-23 18:30 . 2008-04-13 17:13 916480 ----a-w- c:\windows\system32\wininet.dll
2011-06-23 18:30 . 2008-04-13 17:14 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2011-06-23 18:30 . 2008-04-13 17:13 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-06-23 12:05 . 2008-04-13 16:50 385024 ----a-w- c:\windows\system32\html.iec
2011-06-20 17:44 . 2008-04-13 17:13 293888 ----a-w- c:\windows\system32\winsrv.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-09-16_11.42.59 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-04-13 17:13 . 2011-09-09 09:12 603136 c:\windows\system32\dllcache\crypt32.dll
- 2008-04-13 17:13 . 2011-09-03 10:17 603136 c:\windows\system32\dllcache\crypt32.dll
+ 2008-12-15 10:53 . 2011-09-16 12:05 46249416 c:\windows\system32\MRT.exe
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\explorer\shelliconoverlayidentifiers\00 avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-09-06 20:45 122512 ----a-w- c:\programmi\Alwil Software\Avast5\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"Device Detector"="DevDetect.exe -autorun" [X]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86 \3\hpztsb05.exe" [2002-05-24 188416]
"HPHmon04"="c:\windows\system32\hphmon04.exe" [2002-06-20 339968]
"HPHUPD04"="c:\programmi\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe" [2002-05-24 49152]
"NeroFilterCheck"="c:\programmi\File comuni\Ahead\Lib\NeroCheck.exe" [2008-05-28 570664]
"AdobeCS4ServiceManager"="c:\programmi\File comuni\Adobe\CS4ServiceManager\CS4ServiceManager.e xe" [2008-08-14 611712]
"Share-to-Web Namespace Daemon"="d:\programmi\hpgs2wnd.exe" [2002-04-17 69632]
"Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"QuickTime Task"="d:\quicktime\qttask.exe" [2010-08-10 421888]
"ROUTE66Sync"="d:\programmi\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe" [2010-12-15 168448]
"ISUSPM Startup"="c:\progra~1\FILECO~1\INSTAL~1\UPDATE~1\I SUSPM.exe" [2004-08-09 221184]
"ISUSScheduler"="c:\programmi\File comuni\InstallShield\UpdateService\issch.exe" [2004-08-09 81920]
"SunJavaUpdateSched"="c:\programmi\File comuni\Java\Java Update\jusched.exe" [2011-04-08 254696]
"avast"="c:\programmi\Alwil Software\Avast5\avastUI.exe" [2011-09-06 3722416]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]
.
c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Hamlet HNW300NU2.lnk - c:\programmi\Hamlet\Common\RaUI.exe [2011-3-19 1515520]
Windows Search.lnk - c:\programmi\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
WinZip Quick Pick.lnk - d:\programmi\WinZip\WZQKPICK.EXE [2008-9-10 525664]
.
[hkey_local_machine\software\microsoft\windows\curr entversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\programmi\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\WinDefend]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^Amministratore^Menu Avvio^Programmi^Esecuzione automatica^OpenOffice.org 3.0.lnk]
backup=c:\windows\pss\OpenOffice.org 3.0.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-12-22 00:57 35760 ----a-w- c:\programmi\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Programmi\\eMule\\emule.exe"=
"c:\\Programmi\\File comuni\\Ahead\\Nero Web\\SetupX.exe"=
"c:\\Programmi\\Google\\Google Earth\\client\\googleearth.exe"=
"d:\\Programmi\\ROUTE 66\\ROUTE 66 Sync\\ROUTE66Sync.exe"=
"d:\\Programmi\\ROUTE 66\\ROUTE 66 Sync\\Sync9Loader.exe"=
"c:\\Programmi\\Google\\Google Earth\\plugin\\geplugin.exe"=
.
R2 WinDefend;Windows Defender;c:\programmi\Windows Defender\MsMpEng.exe [03/11/2006 19.19.58 13592]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.s ys [13/03/2011 12.08.40 442200]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [11/12/2008 20.51.09 320856]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswF sBlk.sys [11/12/2008 20.51.09 20568]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\ FsUsbExService.Exe [13/08/2010 18.17.34 222568]
S2 gupdate1c98c4420927f0a;Google Update Service (gupdate1c98c4420927f0a);c:\programmi\Google\Updat e\GoogleUpdate.exe [11/02/2009 14.27.36 133104]
S3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgde rdrv.sys [08/01/2011 14.49.25 18120]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbE xDisk.Sys [13/08/2010 18.17.35 42112]
S3 gupdatem;Servizio Google Update (gupdatem);c:\programmi\Google\Update\GoogleUpdate .exe [11/02/2009 14.27.36 133104]
S3 sscebus;SAMSUNG USB Composite Device V2 driver (WDM);c:\windows\system32\drivers\sscebus.sys [13/08/2010 18.15.08 98560]
S3 sscemdfl;SAMSUNG Mobile Modem V2 Filter;c:\windows\system32\drivers\sscemdfl.sys [13/08/2010 18.15.09 14848]
S3 sscemdm;SAMSUNG Mobile Modem V2 Drivers;c:\windows\system32\drivers\sscemdm.sys [13/08/2010 18.15.09 123648]
.
Contenuto della cartella 'Scheduled Tasks'
.
2011-09-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2009-02-11 12:27]
.
2011-09-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2009-02-11 12:27]
.
2011-09-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-920026266-1177238915-1004Core.job
- c:\documents and settings\Amministratore\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe [2010-06-06 13:04]
.
2011-09-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-920026266-1177238915-1004UA.job
- c:\documents and settings\Amministratore\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe [2010-06-06 13:04]
.
2011-09-16 c:\windows\Tasks\MP Scheduled Scan.job
- c:\programmi\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]
.
2011-09-16 c:\windows\Tasks\User_Feed_Synchronization-{6384B8A3-16D9-4826-93EE-D582DC8310EC}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Scansione supplementare -------
.
FF - ProfilePath - c:\documents and settings\Amministratore\Dati applicazioni\Mozilla\Firefox\Profiles\4bldfbcj.def ault\
FF - prefs.js: browser.startup.homepage - hxxp://www.fivu.it
.
.
************************************************** ************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-16 17:31
Windows 5.1.2600 Service Pack 3 NTFS
.
scansione processi nascosti ...
.
scansione entrate autostart nascoste ...
.
Scansione files nascosti ...
.
Scansione completata con successo
Files nascosti: 0
.
************************************************** ************************
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------
.
- - - - - - - > 'winlogon.exe'(212)
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(1268)
c:\windows\system32\WININET.dll
.
Ora fine scansione: 2011-09-16 17:34:06
ComboFix-quarantined-files.txt 2011-09-16 15:34
ComboFix2.txt 2011-09-16 11:46
.
Pre-Run: 52.770.205.696 byte disponibili
Post-Run: 52.758.380.544 byte disponibili
.
- - End Of File - - 3280BD1BE7D44618503BDD906213D4A5

[menatwork]

mentre do un'occhiata al rapporto fatti una sana lettura

fai anche un po' di pulizia

scarica ccleaner
Importante:
In fase d’installazione togli la spunta altrimenti viene installata Yahoo Tollbar.
Avvialo e clicca su:
- Opzioni Avanzate
Togli la spunta da:
- Elimina file solo se più vecchi di 48 ore
Clicca i tasti:
- Pulizia (il primo in alto a Sinistra)
- Analizza ( Pulsante in basso Centrale)
- Avvia Pulizia (Pulsante in basso a Destra)

Correzione errori File di Registro
CCleaner
Clicca i tasti:
- Registro (Secondo tasto in alto a Sinistra)
- Trova Problemi (Pulsante in basso Centrale)
- Ripara selezionati Pulsante in basso a Destra
- alla domanda:
- Vuoi eseguire il Backup delle modifiche del Registro”
- clicca:
- SI


- Scarica ATF-Cleaner (Non richiede installazione):
http://majorgeeks.com/downloadget.ph...a5bc34c89d005a
Spunta la voce:
- Select all
Premi il tasto:
- Empty Select


vedi se il problema persiste

[Capo]

Ciao
Mi sono accorto adesso che questa scansione di Combofix non ti è stata recapitata in quanto più lunga di 13.000 caratteri che ora ti mando tagliata proprio per quel motivo, lasciandoti la prima parte.
Mi sembra di capire nella mia ignoranza, che qualcosa di infetto è riuscito a togliere.
Ho nel frattempo riavviato ripetutamente il pc e pare che il problema non si stia ripresentando
Dammi per favore la tua opinione grazie.

ComboFix 11-09-13.03 - Administrator 16/09/2011 13.35.12.7.1 - x86 MINIMAL
Microsoft Windows XP Home Edition 5.1.2600.3.1252.39.1040.18.1023.709 [GMT 2:00]
Eseguito da: c:\documents and settings\Amministratore\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))) )
.
.
c:\windows\IsUn0410.exe
c:\windows\system32\muzapp.exe
c:\windows\system32\system32
c:\windows\system32\system32\3DAudio.ax
c:\windows\system32\system32\avrt.dll
c:\windows\system32\system32\cis-2.4.dll
c:\windows\system32\system32\issacapi_bs-2.3.dll
c:\windows\system32\system32\issacapi_pe-2.3.dll
c:\windows\system32\system32\issacapi_se-2.3.dll
c:\windows\system32\system32\MACXMLProto.dll
c:\windows\system32\system32\MaDRM.dll
c:\windows\system32\system32\MaJGUILib.dll
c:\windows\system32\system32\MaJUtilLib.dll
c:\windows\system32\system32\MAMACExtract.dll
c:\windows\system32\system32\MASetupCaller.dll
c:\windows\system32\system32\MASetupCleaner.exe
c:\windows\system32\system32\MaXMLProto.dll
c:\windows\system32\system32\MetaStore2.dll
c:\windows\system32\system32\mfplat.dll
c:\windows\system32\system32\Microsoft.Synchroniza tion.dll
c:\windows\system32\system32\MK_Lyric.dll
c:\windows\system32\system32\MSCLib.dll
c:\windows\system32\system32\MSFLib.dll
c:\windows\system32\system32\MSLUR71.dll
c:\windows\system32\system32\msvcp60.dll
c:\windows\system32\system32\MTTELECHIP.dll
c:\windows\system32\system32\MTXSYNCICON.dll
c:\windows\system32\system32\muzaf1.dll
c:\windows\system32\system32\muzapp.dll
c:\windows\system32\system32\muzapp.exe
c:\windows\system32\system32\muzdecode.ax
c:\windows\system32\system32\muzeffect.ax
c:\windows\system32\system32\muzmp4sp.ax
c:\windows\system32\system32\muzmpgsp.ax
c:\windows\system32\system32\muzoggsp.ax
c:\windows\system32\system32\muzwmts.dll
c:\windows\system32\system32\psapi.dll
c:\windows\system32\system32\Synchronization2.dll
.
.
((((((((((((((((((((((((( Files Creati Da 2011-08-16 al 2011-09-16 )))))))))))))))))))))))))))))))))))
.
.
2011-09-11 18:33 . 2011-09-11 18:33 388096 ----a-r- c:\documents and settings\Amministratore\Dati applicazioni\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-09-11 13:35 . 2011-06-21 09:24 32768 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2011-09-11 11:32 . 2011-09-11 11:32 -------- d-----w- c:\documents and settings\Administrator\Dati applicazioni\Windows Search
2011-09-11 11:27 . 2011-09-11 11:27 -------- d-----w- c:\documents and settings\Administrator\Dati applicazioni\Malwarebytes
2011-09-10 07:00 . 2011-08-16 06:48 7152464 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Microsoft\Windows Defender\Definition Updates\{A59B210B-6BAB-4E1C-8C33-6E28FCF68022}\mpengine.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) )
.
2011-09-06 20:45 . 2010-07-01 19:52 41184 ----a-w- c:\windows\avastSS.scr
2011-09-06 20:45 . 2008-12-11 18:50 199304 ----a-w- c:\windows\system32\aswBoot.exe
2011-09-06 20:38 . 2011-03-13 10:08 442200 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-09-06 20:37 . 2008-12-11 18:51 320856 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-09-06 20:36 . 2008-12-11 18:51 34392 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-09-06 20:36 . 2008-12-11 18:51 52568 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-09-06 20:36 . 2008-12-11 18:51 110552 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-09-06 20:36 . 2008-12-11 18:51 104536 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-09-06 20:36 . 2008-12-11 18:51 20568 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-09-06 20:33 . 2008-12-11 18:51 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-09-03 10:17 . 2008-04-13 17:13 603136 ----a-w- c:\windows\system32\crypt32.dll
2011-09-02 11:20 . 2011-05-20 19:26 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-08-31 15:00 . 2011-03-13 09:51 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-16 06:48 . 2009-10-03 19:24 7152464 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2011-07-15 13:29 . 2008-04-13 10:17 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-12 10:17 . 2011-07-12 10:17 0 ---ha-w- c:\documents and settings\Amministratore\Impostazioni locali\Dati applicazioni\BITE.tmp
2011-07-08 14:02 . 2008-04-13 09:57 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2011-06-24 14:10 . 2008-12-11 15:17 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-23 18:30 . 2008-04-13 17:13 916480 ----a-w- c:\windows\system32\wininet.dll
2011-06-23 18:30 . 2008-04-13 17:14 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2011-06-23 18:30 . 2008-04-13 17:13 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-06-23 12:05 . 2008-04-13 16:50 385024 ----a-w- c:\windows\system32\html.iec
2011-06-20 17:44 . 2008-04-13 17:13 293888 ----a-w- c:\windows\system32\winsrv.dll
.
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\explorer\shelliconoverlayidentifiers\00 avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-09-06 20:45 122512 ----a-w- c:\programmi\Alwil Software\Avast5\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"Device Detector"="DevDetect.exe -autorun" [X]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86 \3\hpztsb05.exe" [2002-05-24 188416]
"HPHmon04"="c:\windows\system32\hphmon04.exe" [2002-06-20 339968]
"HPHUPD04"="c:\programmi\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe" [2002-05-24 49152]
"NeroFilterCheck"="c:\programmi\File comuni\Ahead\Lib\NeroCheck.exe" [2008-05-28 570664]
"AdobeCS4ServiceManager"="c:\programmi\File comuni\Adobe\CS4ServiceManager\CS4ServiceManager.e xe" [2008-08-14 611712]
"Share-to-Web Namespace Daemon"="d:\programmi\hpgs2wnd.exe" [2002-04-17 69632]
"Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"QuickTime Task"="d:\quicktime\qttask.exe" [2010-08-10 421888]
"ROUTE66Sync"="d:\programmi\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe" [2010-12-15 168448]
"ISUSPM Startup"="c:\progra~1\FILECO~1\INSTAL~1\UPDATE~1\I SUSPM.exe" [2004-08-09 221184]
"ISUSScheduler"="c:\programmi\File comuni\InstallShield\UpdateService\issch.exe" [2004-08-09 81920]
"SunJavaUpdateSched"="c:\programmi\File comuni\Java\Java Update\jusched.exe" [2011-04-08 254696]
"avast"="c:\programmi\Alwil Software\Avast5\avastUI.exe" [2011-09-06 3722416]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]
.
c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Hamlet HNW300NU2.lnk - c:\programmi\Hamlet\Common\RaUI.exe [2011-3-19 1515520]
Windows Search.lnk - c:\programmi\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
WinZip Quick Pick.lnk - d:\programmi\WinZip\WZQKPICK.EXE [2008-9-10 525664]
.
[hkey_local_machine\software\microsoft\windows\curr entversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\programmi\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\WinDefend]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^Amministratore^Menu Avvio^Programmi^Esecuzione automatica^OpenOffice.org 3.0.lnk]
backup=c:\windows\pss\OpenOffice.org 3.0.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-12-22 00:57 35760 ----a-w- c:\programmi\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Programmi\\eMule\\emule.exe"=
"c:\\Programmi\\File comuni\\Ahead\\Nero Web\\SetupX.exe"=
"c:\\Programmi\\Google\\Google Earth\\client\\googleearth.exe"=
"d:\\Programmi\\ROUTE 66\\ROUTE 66 Sync\\ROUTE66Sync.exe"=
"d:\\Programmi\\ROUTE 66\\ROUTE 66 Sync\\Sync9Loader.exe"=
"c:\\Programmi\\Google\\Google Earth\\plugin\\geplugin.exe"=
.
R2 WinDefend;Windows Defender;c:\programmi\Windows Defender\MsMpEng.exe [03/11/2006 19.19.58 13592]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.s ys [13/03/2011 12.08.40 442200]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [11/12/2008 20.51.09 320856]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswF sBlk.sys [11/12/2008 20.51.09 20568]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\ FsUsbExService.Exe [13/08/2010 18.17.34 222568]
S2 gupdate1c98c4420927f0a;Google Update Service (gupdate1c98c4420927f0a);c:\programmi\Google\Updat e\GoogleUpdate.exe [11/02/2009 14.27.36 133104]
S3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgde rdrv.sys [08/01/2011 14.49.25 18120]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbE xDisk.Sys [13/08/2010 18.17.35 42112]
S3 gupdatem;Servizio Google Update (gupdatem);c:\programmi\Google\Update\GoogleUpdate .exe [11/02/2009 14.27.36 133104]
S3 sscebus;SAMSUNG USB Composite Device V2 driver (WDM);c:\windows\system32\drivers\sscebus.sys [13/08/2010 18.15.08 98560]
S3 sscemdfl;SAMSUNG Mobile Modem V2 Filter;c:\windows\system32\drivers\sscemdfl.sys [13/08/2010 18.15.09 14848]
S3 sscemdm;SAMSUNG Mobile Modem V2 Drivers;c:\windows\system32\drivers\sscemdm.sys [13/08/2010 18.15.09 123648]
.
Contenuto della cartella 'Scheduled Tasks'
.
2011-09-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2009-02-11 12:27]
.
2011-09-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2009-02-11 12:27]
.
2011-09-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-920026266-1177238915-1004Core.job
- c:\documents and settings\Amministratore\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe [2010-06-06 13:04]
.
2011-09-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-920026266-1177238915-1004UA.job
- c:\documents and settings\Amministratore\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe [2010-06-06 13:04]
.
2011-09-16 c:\windows\Tasks\MP Scheduled Scan.job
- c:\programmi\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]
.
2011-09-16 c:\windows\Tasks\User_Feed_Synchronization-{6384B8A3-16D9-4826-93EE-D582DC8310EC}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]

[menatwork]

per non creare confusione allega il log per intero e caricalo su wikisend