errore all'avvio di windows "ntos.exe"

[il_folklorista]

ciao, ho un problema, all'avvio di windows xp mi compare subito un messaggio di errore che riguarda ntos.exe e una memoria nn trovata! ho provato a seguire dei procedimenti ma arrivo ad un punto dove devo trovare il seguente passaggio [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe]
soltanto che la cartella explorer.exe non c'è l'ho e quindi non so più cosa fare...
e modificando c:\windows\system32\userinit.exe,
premendo F5 mi ritorna c:\windows\system32\userinit.exe, "C:\WINDOWS\system32\ntos.exe"

se qualcuna mi sa dire come posso procedere...grazie! ciaoo

[Deifobe]

esegui una scansione con Kaspersky_virusscanner (devi collegare anche eventuali pen e HD esterni), fai una scansione, salva e posta il rapporto.

mi dici anche se visualizzi i files nascosti?

ciao

[il_folklorista]

adesso sto facendo la scansione avanzata di "critical areas", mi sa ci vorrà molto perchè ho 150 Gb di spazio occupato. Appena finisce ti posto il risultato e faccio le altre scansioni...ciao

[il_folklorista]

ho fatto tutte le scansioni con l'opzione visualizza file e cartelle nascosta, ma non ho capito bene se intendevi quello. Cmq i risultati sono questi:

sezione "critical areas":

C:\WINDOWS\Debug\oakley.log
C:\WINDOWS\Debug\PASSWD.LOG
C:\WINDOWS\Internet Logs\fwdbglog.txt
C:\WINDOWS\Internet Logs\fwpktlog.txt
C:\WINDOWS\Internet Logs\IAMDB.RDB
C:\WINDOWS\Internet Logs\MARRA-ZB72F3N67.ldb
C:\WINDOWS\Internet Logs\tvDebug.log
C:\WINDOWS\SchedLgU.Txt
C:\WINDOWS\SoftwareDistribution\EventCache\{5986D3 A9-F68C-4D1C-8328-2449B9F8D979}.bin
C:\WINDOWS\SoftwareDistribution\ReportingEvents.lo g
C:\WINDOWS\Sti_Trace.log
C:\WINDOWS\system32\config\Antivirus.Evt
C:\WINDOWS\system32\config\AppEvent.Evt
C:\WINDOWS\system32\config\default
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\SAM
C:\WINDOWS\system32\config\SAM.LOG
C:\WINDOWS\system32\config\SecEvent.Evt
C:\WINDOWS\system32\config\SECURITY
C:\WINDOWS\system32\config\SECURITY.LOG
C:\WINDOWS\system32\config\software
C:\WINDOWS\system32\config\software.LOG
C:\WINDOWS\system32\config\SysEvent.Evt
C:\WINDOWS\system32\config\system
C:\WINDOWS\system32\config\system.LOG
C:\WINDOWS\system32\config\systemprofile\Cookies\i ndex.dat
C:\WINDOWS\system32\config\systemprofile\Impostazi oni locali\Cronologia\History.IE5\index.dat
C:\WINDOWS\system32\config\systemprofile\Impostazi oni locali\Temporary Internet Files\Content.IE5\index.dat
C:\WINDOWS\system32\drivers\atapi.sys
C:\WINDOWS\system32\h323log.txt
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DAT A
C:\WINDOWS\Temp\Perflib_Perfdata_650.dat
C:\WINDOWS\Temp\ZLT04044.TMP
C:\WINDOWS\wiadebug.log
C:\WINDOWS\wiaservc.log
C:\WINDOWS\WindowsUpdate.log
C:\WINDOWS\winsyn32.dll Infected: Trojan.Win32.Inject.afk

Scan process completed.

sezione "Memory" pulita

sezione "My computer" :

C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\g6ylzh7x.def ault\cert8.db
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\g6ylzh7x.def ault\history.dat
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\g6ylzh7x.def ault\key3.db
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\g6ylzh7x.def ault\parent.lock
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\g6ylzh7x.def ault\search.sqlite
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\g6ylzh7x.def ault\urlclassifier2.sqlite
C:\Documents and Settings\Administrator\Impostazioni locali\Cronologia\History.IE5\index.dat
C:\Documents and Settings\Administrator\Impostazioni locali\Cronologia\History.IE5\MSHist01200803252008 0326\index.dat
C:\Documents and Settings\Administrator\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat
C:\Documents and Settings\Administrator\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG
C:\Documents and Settings\Administrator\Impostazioni locali\Dati applicazioni\Mozilla\Firefox\Profiles\g6ylzh7x.def ault\Cache\_CACHE_001_
C:\Documents and Settings\Administrator\Impostazioni locali\Dati applicazioni\Mozilla\Firefox\Profiles\g6ylzh7x.def ault\Cache\_CACHE_002_
C:\Documents and Settings\Administrator\Impostazioni locali\Dati applicazioni\Mozilla\Firefox\Profiles\g6ylzh7x.def ault\Cache\_CACHE_003_
C:\Documents and Settings\Administrator\Impostazioni locali\Dati applicazioni\Mozilla\Firefox\Profiles\g6ylzh7x.def ault\Cache\_CACHE_MAP_
C:\Documents and Settings\Administrator\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat
C:\Documents and Settings\Administrator\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Administrator\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr0.da t
C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr1.da t
C:\Documents and Settings\LocalService\Cookies\index.dat
C:\Documents and Settings\LocalService\Impostazioni locali\Cronologia\History.IE5\index.dat
C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat
C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG
C:\Documents and Settings\LocalService\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat
C:\Documents and Settings\LocalService\NTUSER.DAT
C:\Documents and Settings\LocalService\ntuser.dat.LOG
C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat
C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG
C:\Documents and Settings\NetworkService\NTUSER.DAT
C:\Documents and Settings\NetworkService\ntuser.dat.LOG
C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616
C:\Programmi\Alwil Software\Avast4\DATA\aswResp.dat
C:\Programmi\Alwil Software\Avast4\DATA\Avast4.db
C:\Programmi\Alwil Software\Avast4\DATA\integ\avast.int
C:\Programmi\Alwil Software\Avast4\DATA\log\nshield.log
C:\System Volume Information\_restore{83D164C8-BFE9-498C-8543-CEBC0BE8BDA0}\RP177\change.log
C:\WINDOWS\Debug\oakley.log
C:\WINDOWS\Debug\PASSWD.LOG
C:\WINDOWS\Internet Logs\fwdbglog.txt
C:\WINDOWS\Internet Logs\fwpktlog.txt
C:\WINDOWS\Internet Logs\IAMDB.RDB
C:\WINDOWS\Internet Logs\MARRA-ZB72F3N67.ldb
C:\WINDOWS\Internet Logs\tvDebug.log
C:\WINDOWS\SchedLgU.Txt
C:\WINDOWS\SoftwareDistribution\EventCache\{5986D3 A9-F68C-4D1C-8328-2449B9F8D979}.bin
C:\WINDOWS\SoftwareDistribution\ReportingEvents.lo g
C:\WINDOWS\Sti_Trace.log
C:\WINDOWS\system32\config\Antivirus.Evt
C:\WINDOWS\system32\config\AppEvent.Evt
C:\WINDOWS\system32\config\default
C:\WINDOWS\system32\config\default.LOG
C:\WINDOWS\system32\config\SAM
C:\WINDOWS\system32\config\SAM.LOG
C:\WINDOWS\system32\config\SecEvent.Evt
C:\WINDOWS\system32\config\SECURITY
C:\WINDOWS\system32\config\SECURITY.LOG
C:\WINDOWS\system32\config\software
C:\WINDOWS\system32\config\software.LOG
C:\WINDOWS\system32\config\SysEvent.Evt
C:\WINDOWS\system32\config\system
C:\WINDOWS\system32\config\system.LOG
C:\WINDOWS\system32\config\systemprofile\Cookies\i ndex.dat
C:\WINDOWS\system32\config\systemprofile\Impostazi oni locali\Cronologia\History.IE5\index.dat
C:\WINDOWS\system32\config\systemprofile\Impostazi oni locali\Temporary Internet Files\Content.IE5\index.dat
C:\WINDOWS\system32\drivers\atapi.sys
C:\WINDOWS\system32\h323log.txt
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DAT A
C:\WINDOWS\Temp\Perflib_Perfdata_650.dat
C:\WINDOWS\Temp\ZLT04044.TMP
C:\WINDOWS\wiadebug.log
C:\WINDOWS\wiaservc.log
C:\WINDOWS\WindowsUpdate.log
C:\WINDOWS\winsyn32.dll Infected: Trojan.Win32.Inject.afk
D:\System Volume Information\MountPointManagerRemoteDatabase
D:\System Volume Information\_restore{0A801C06-8A18-4135-9F8A-D55506BF7EE2}\RP120\A0046635.exe/data0001.bin Infected: not-a-virus:Client-IRC.Win32.mIRC.616
D:\System Volume Information\_restore{0A801C06-8A18-4135-9F8A-D55506BF7EE2}\RP120\A0046635.exe mIRC: infected - 1
D:\System Volume Information\_restore{8841B62B-4C7C-4F51-9D9D-9A2673B02A8D}\RP122\A0039323.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616
J:\Programmi .exe\mirc616.rar/mirc616.exe/data0001.bin Infected: not-a-virus:Client-IRC.Win32.mIRC.616
J:\Programmi .exe\mirc616.rar/mirc616.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616
J:\Programmi .exe\mirc616.rar RAR: infected - 2

Scan process completed.

sezione "My Email" pulita

grazie per l'aiuto, spero di aver fatto correttamente, ciao

[Deifobe]

così come l'hai fatta e' incompleta. Cortesemente, dovresti rieseguirla e ti indico come:

vai su Kaspersky_virusscanner
clicca su "kaspersky online scanner"
clicca su "accept"
--- verrà eseguito il download dei componenti necessari alla scansione
quando è terminato clicca su "next"
=> clicca su "my computer" (così non ti limiti solo a fare una scansione delle aree critiche ma fai analizzare tutto il pc, pen compresa)
clicca su "scan settings"

[il_folklorista]

scusa, ma io ho già fatto la scansione di my computer come mi hai detto tu e il risultato è questo:


C:\Documents and Settings\Administrator\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\g6ylzh7x.def ault\cert8.db Object is locked skipped
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\g6ylzh7x.def ault\history.dat Object is locked skipped
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\g6ylzh7x.def ault\key3.db Object is locked skipped
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\g6ylzh7x.def ault\parent.lock Object is locked skipped
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\g6ylzh7x.def ault\search.sqlite Object is locked skipped
C:\Documents and Settings\Administrator\Dati applicazioni\Mozilla\Firefox\Profiles\g6ylzh7x.def ault\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\Administrator\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Impostazioni locali\Cronologia\History.IE5\MSHist01200803252008 0326\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Administrator\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Administrator\Impostazioni locali\Dati applicazioni\Mozilla\Firefox\Profiles\g6ylzh7x.def ault\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\Administrator\Impostazioni locali\Dati applicazioni\Mozilla\Firefox\Profiles\g6ylzh7x.def ault\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\Administrator\Impostazioni locali\Dati applicazioni\Mozilla\Firefox\Profiles\g6ylzh7x.def ault\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\Administrator\Impostazioni locali\Dati applicazioni\Mozilla\Firefox\Profiles\g6ylzh7x.def ault\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\Administrator\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Administrator\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr0.da t Object is locked skipped
C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr1.da t Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped
C:\Programmi\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped
C:\Programmi\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped
C:\Programmi\Alwil Software\Avast4\DATA\integ\avast.int Object is locked skipped
C:\Programmi\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped
C:\System Volume Information\_restore{83D164C8-BFE9-498C-8543-CEBC0BE8BDA0}\RP177\change.log Object is locked skipped
C:\WINDOWS\Debug\oakley.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped
C:\WINDOWS\Internet Logs\MARRA-ZB72F3N67.ldb Object is locked skipped
C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{5986D3 A9-F68C-4D1C-8328-2449B9F8D979}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.lo g Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\config\systemprofile\Cookies\i ndex.dat Object is locked skipped
C:\WINDOWS\system32\config\systemprofile\Impostazi oni locali\Cronologia\History.IE5\index.dat Object is locked skipped
C:\WINDOWS\system32\config\systemprofile\Impostazi oni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\WINDOWS\system32\drivers\atapi.sys Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DAT A Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_650.dat Object is locked skipped
C:\WINDOWS\Temp\ZLT04044.TMP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
C:\WINDOWS\winsyn32.dll Infected: Trojan.Win32.Inject.afk skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
D:\System Volume Information\_restore{0A801C06-8A18-4135-9F8A-D55506BF7EE2}\RP120\A0046635.exe/data0001.bin Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped
D:\System Volume Information\_restore{0A801C06-8A18-4135-9F8A-D55506BF7EE2}\RP120\A0046635.exe mIRC: infected - 1 skipped
D:\System Volume Information\_restore{8841B62B-4C7C-4F51-9D9D-9A2673B02A8D}\RP122\A0039323.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped
J:\Programmi .exe\mirc616.rar/mirc616.exe/data0001.bin Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped
J:\Programmi .exe\mirc616.rar/mirc616.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped
J:\Programmi .exe\mirc616.rar RAR: infected - 2 skipped

Scan process completed.

spero di non essermi sbagliato...

[Deifobe]

eccetto 2 punti di ripristino, è pulito: MIrc credo ti serva... e mirc616.rar dovrebbe essere forse il programma zippato, da installare.
Non c'è nessuna traccia nè di ntos nè di amvo.

Scarica Hijackthis e mettilo in un cartella dedicata (tipo: c:\programmi\Hijackthis).
Eseguilo e clicca sul tasto "Do a system scan and save a log file". Posta il file di testo ottenuto.

e C:\WINDOWS\winsyn32.dll eliminalo

[il_folklorista]

ho eliminato il file che mi hai detto, Mirc è un programma che uso ma vorrei capire se è meglio levarlo o meno...

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Executive Software\DiskeeperLite\DKService.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programmi\RFA\rfagent.exe
C:\Programmi\MSN Messenger\msnmsgr.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\Programmi\MSN Messenger\usnsvc.exe
C:\Programmi\MSN Messenger\msnmsgr.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Programmi\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\PCHealth\HelpCtr\System\panels\blank.ht m
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Yahoo! Toolbar con blocco Pop-Up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDO WS\System32\ntos.exe,
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Zone Labs Client] C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [rfagent] "C:\Programmi\RFA\rfagent.exe"
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Programmi\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmi\MSN Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programmi\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Programmi\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NBService - Nero AG - C:\Programmi\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

grazie ancora!

[Deifobe]

ok, eccetto ntos non vedo altro, quindi esegui la procedura per rimuoverlo.
Non so quale discussione hai seguito, magari non lo avevo indicato in quei passaggi, ma prima di iniziare disattiva il ripristino configurazione di sistema: (start -> pannello di controllo -> sistema -> ripristino configurazione di sistema -> spunta "disattiva ripristino configuraz. di sistema").

fatto questo, esegui la modifica (stando attento a lasciare intatto: c:\windows\system32\userinit.exe, (virgola compresa)

fammi sapere come va..

[il_folklorista]

ho levato il ripristino configurazione di sistema, ma una volta che vado a modificare Userinit ho cancellato la seconda parte con ntos.exe, dopo aver dato l'ok si sistema nel modo corretto, soltanto che facendo F5 o cmq chuidendo la finestra mi ritorna ancora con la seconda parte dopo la ,....magari non so come confermare la modifica. spero di essermi spiegato bene