Problema con trojan proxy

[dario_oooo]

Ciao a tutti,
è da più di un mese che sono alle prese con un trojan.
Il trojan viene rilevato da AVG,messo in quarantena,ma ricompare puntualmente.
Ho effettuato una scansione con Malwarebytes' Anti-Malware e in ultimo ho eseguito una scansione online con Eset. Ecco il report della scansione online

C:\Documents and Settings\Amministratore\Dati applicazioni\cisvc.exe a variant of Win32/TrojanDownloader.Agent.PMB trojan
C:\Documents and Settings\Amministratore\Dati applicazioni\logman.exe a variant of Win32/TrojanDownloader.Agent.PMB trojan
C:\Documents and Settings\Amministratore\Dati applicazioni\mstinit.exe a variant of Win32/TrojanDownloader.Agent.PMB trojan
C:\Documents and Settings\Amministratore\Dati applicazioni\Microsoft\clipsrv.exe a variant of Win32/TrojanDownloader.Agent.PMB trojan
C:\Documents and Settings\Amministratore\Dati applicazioni\Microsoft\cmstp.exe a variant of Win32/TrojanDownloader.Agent.PMB trojan
C:\Documents and Settings\Amministratore\Dati applicazioni\Microsoft\ieudinit.exe a variant of Win32/TrojanDownloader.Agent.PMB trojan
C:\WINDOWS\clipsrv.exe a variant of Win32/TrojanDownloader.Agent.PMB trojan
C:\WINDOWS\dllhst3g.exe a variant of Win32/TrojanDownloader.Agent.PMB trojan
C:\WINDOWS\ieudinit.exe a variant of Win32/TrojanDownloader.Agent.PMB trojan
C:\WINDOWS\logman.exe a variant of Win32/TrojanDownloader.Agent.PMB trojan
C:\WINDOWS\system\cmstp.exe a variant of Win32/TrojanDownloader.Agent.PMB trojan
C:\WINDOWS\system\sessmgr.exe a variant of Win32/TrojanDownloader.Agent.PMB trojan
C:\WINDOWS\system32\drivers\clipsrv.exe a variant of Win32/TrojanDownloader.Agent.PMB trojan
C:\WINDOWS\system32\drivers\ieudinit.exe a variant of Win32/TrojanDownloader.Agent.PMB trojan
Operating memory a variant of Win32/TrojanDownloader.Agent.PMB trojan





Potreste aiutarmi?

Grazie

[darksoullight88]

Ciao,hai eliminato le voci segnate?
leggi anche la guida alla rimozione dei virus!

[dario_oooo]

Per eliminare intendi spostarli nel cestino?

[dario_oooo]

con regedit non riesco a trovarli

[Conetti]

Originariamente inviato da dario_oooo
Ciao a tutti,
è da più di un mese che sono alle prese con un trojan.
Il trojan viene rilevato da AVG,messo in quarantena,ma ricompare puntualmente.
Ho effettuato una scansione con Malwarebytes' Anti-Malware e in ultimo ho eseguito una scansione online con Eset. Ecco il report della scansione online

C:\Documents and Settings\Amministratore\Dati applicazioni\cisvc.exe a variant of Win32/TrojanDownloader.Agent.PMB trojan
C:\Documents and Settings\Amministratore\Dati applicazioni\logman.exe a variant of Win32/TrojanDownloader.Agent.PMB trojan
C:\Documents and Settings\Amministratore\Dati applicazioni\mstinit.exe a variant of Win32/TrojanDownloader.Agent.PMB trojan
C:\Documents and Settings\Amministratore\Dati applicazioni\Microsoft\clipsrv.exe a variant of Win32/TrojanDownloader.Agent.PMB trojan
C:\Documents and Settings\Amministratore\Dati applicazioni\Microsoft\cmstp.exe a variant of Win32/TrojanDownloader.Agent.PMB trojan
C:\Documents and Settings\Amministratore\Dati applicazioni\Microsoft\ieudinit.exe a variant of Win32/TrojanDownloader.Agent.PMB trojan
C:\WINDOWS\clipsrv.exe a variant of Win32/TrojanDownloader.Agent.PMB trojan
C:\WINDOWS\dllhst3g.exe a variant of Win32/TrojanDownloader.Agent.PMB trojan
C:\WINDOWS\ieudinit.exe a variant of Win32/TrojanDownloader.Agent.PMB trojan
C:\WINDOWS\logman.exe a variant of Win32/TrojanDownloader.Agent.PMB trojan
C:\WINDOWS\system\cmstp.exe a variant of Win32/TrojanDownloader.Agent.PMB trojan
C:\WINDOWS\system\sessmgr.exe a variant of Win32/TrojanDownloader.Agent.PMB trojan
C:\WINDOWS\system32\drivers\clipsrv.exe a variant of Win32/TrojanDownloader.Agent.PMB trojan
C:\WINDOWS\system32\drivers\ieudinit.exe a variant of Win32/TrojanDownloader.Agent.PMB trojan
Operating memory a variant of Win32/TrojanDownloader.Agent.PMB trojan





Potreste aiutarmi?

Grazie

Scansiona con HiJackThis e posta il log ottenuto

[dario_oooo]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22.21.16, on 03/01/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\AVG\AVG9\avgchsvx.exe
C:\Programmi\AVG\AVG9\avgrsx.exe
C:\Programmi\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\AVG\AVG9\avgwdsvc.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\system32\svchost.exe
C:\DOCUME~1\AMMINI~1\DATIAP~1\logman.exe
C:\Programmi\AVG\AVG9\avgemc.exe
C:\Programmi\AVG\AVG9\avgnsx.exe
C:\Programmi\AVG\AVG9\avgcsrvx.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\Internet Explorer\iexplore.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
F3 - REG:win.ini: load=C:\DOCUME~1\AMMINI~1\DATIAP~1\logman.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programmi\AVG\AVG9\avgssie.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKLM\..\Policies\Explorer\Run: [CmSTP] C:\DOCUME~1\AMMINI~1\DATIAP~1\MICROS~1\cmstp.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [ClipSrv] C:\DOCUME~1\AMMINI~1\DATIAP~1\MICROS~1\clipsrv.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [Cisvc] C:\DOCUME~1\AMMINI~1\DATIAP~1\cisvc.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [DllHst] C:\DOCUME~1\AMMINI~1\DATIAP~1\dllhst3g.exe /waitservice
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [ClipSrv] C:\WINDOWS\clipsrv.exe /waitservice (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [Esent Utl] C:\Documents and Settings\Amministratore\LOCALS~1\APPLIC~1\esentutl .exe /waitservice (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [SessMgr] C:\Documents and Settings\Amministratore\LOCALS~1\APPLIC~1\sessmgr. exe /waitservice (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [ClipSrv] C:\WINDOWS\clipsrv.exe /waitservice (User 'Default user')
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programmi\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Programmi\AVG\AVG9\avgemc.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Programmi\AVG\AVG9\avgwdsvc.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe

--
End of file - 5230 bytes

[Conetti]

Fixa con HiJackThis le seguenti voci:

O4 - HKLM\..\Policies\Explorer\Run: [CmSTP] C:\DOCUME~1\AMMINI~1\DATIAP~1\MICROS~1\cmstp.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [ClipSrv] C:\DOCUME~1\AMMINI~1\DATIAP~1\MICROS~1\clipsrv.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [Cisvc] C:\DOCUME~1\AMMINI~1\DATIAP~1\cisvc.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [DllHst] C:\DOCUME~1\AMMINI~1\DATIAP~1\dllhst3g.exe /waitservice
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [Esent Utl] C:\Documents and Settings\Amministratore\LOCALS~1\APPLIC~1\esentutl .exe /waitservice (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [SessMgr] C:\Documents and Settings\Amministratore\LOCALS~1\APPLIC~1\sessmgr. exe /waitservice (User 'SYSTEM')

Al termine carica questo file (C:\DOCUME~1\AMMINI~1\DATIAP~1\logman.exe) su Virus Total: posta il log generato dal sito a fine analisi.
Successivamente esegui una scansione con l'antivirus e con Spybot Search & Destroy, eliminando eventuali voci rilevate.
Pulisci l'HDD con CCleaner e riavvia il Pc: come procede la situazione?

[dario_oooo]

Ho fixato le voci che mi hai indicato ma ne sono comparse nuove come :
O4 - HKCU\..\Policies\Explorer\Run: [SessMgr] C:\DOCUME~1\AMMINI~1\DATIAP~1\sessmgr.exe /waitservice

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13.53.43, on 04/01/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\AVG\AVG9\avgchsvx.exe
C:\Programmi\AVG\AVG9\avgrsx.exe
C:\Programmi\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Messenger\msmsgs.exe
C:\DOCUME~1\AMMINI~1\DATIAP~1\logman.exe
C:\Programmi\AVG\AVG9\avgwdsvc.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\AVG\AVG9\avgemc.exe
C:\Programmi\AVG\AVG9\avgnsx.exe
C:\Programmi\AVG\AVG9\avgcsrvx.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
F3 - REG:win.ini: load=C:\DOCUME~1\AMMINI~1\DATIAP~1\logman.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programmi\AVG\AVG9\avgssie.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKLM\..\Policies\Explorer\Run: [Spool] C:\DOCUME~1\AMMINI~1\DATIAP~1\MICROS~1\spoolsv.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [rsvp] C:\WINDOWS\System32\drivers\rsvp.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [Logman] C:\DOCUME~1\AMMINI~1\DATIAP~1\MICROS~1\logman.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [IEudinit] C:\Documents and Settings\Amministratore\LOCALS~1\APPLIC~1\ieudinit .exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [SessMgr] C:\DOCUME~1\AMMINI~1\DATIAP~1\sessmgr.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [Mstsc] C:\DOCUME~1\AMMINI~1\DATIAP~1\MICROS~1\mstsc.exe /waitservice
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [ClipSrv] C:\WINDOWS\clipsrv.exe /waitservice (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [ClipSrv] C:\WINDOWS\clipsrv.exe /waitservice (User 'Default user')
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programmi\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Programmi\AVG\AVG9\avgemc.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Programmi\AVG\AVG9\avgwdsvc.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe

--
End of file - 5196 bytes

[dario_oooo]

Ecco i risultati di virustotal
File logman.exe ricevuto il 2010.01.04 12:43:13 (UTC)Antivirus Versione Ultimo aggiornamento Risultato
a-squared 4.5.0.46 2010.01.04 Trojan.Win32.Cosmu!IK
AhnLab-V3 5.0.0.2 2010.01.02 -
AntiVir 7.9.1.122 2009.12.31 TR/Downloader.Gen
Antiy-AVL 2.0.3.7 2010.01.04 -
Authentium 5.2.0.5 2010.01.04 W32/Horst.C.gen!Eldorado
Avast 4.8.1351.0 2010.01.03 -
AVG 8.5.0.430 2010.01.04 -
BitDefender 7.2 2010.01.04 -
CAT-QuickHeal 10.00 2010.01.04 Trojan.Agent.ATV
ClamAV 0.94.1 2010.01.04 -
Comodo 3465 2010.01.04 -
DrWeb 5.0.1.12222 2010.01.04 -
eSafe 7.0.17.0 2010.01.03 -
eTrust-Vet 35.1.7214 2010.01.04 Win32/Alureon.AOO
F-Prot 4.5.1.85 2010.01.03 W32/Horst.C.gen!Eldorado
F-Secure 9.0.15370.0 2010.01.04 Trojan:W32/Cosmu.gen!A
Fortinet 4.0.14.0 2010.01.02 -
GData 19 2010.01.04 -
Ikarus T3.1.1.79.0 2009.12.31 Trojan.Win32.Cosmu
Jiangmin 13.0.900 2010.01.04 -
K7AntiVirus 7.10.936 2010.01.02 -
Kaspersky 7.0.0.125 2010.01.04 -
McAfee 5850 2010.01.03 Downloader-BOW
McAfee+Artemis 5850 2010.01.03 Downloader-BOW
McAfee-GW-Edition 6.8.5 2010.01.04 Heuristic.BehavesLike.Win32.Dropper.H
Microsoft 1.5302 2010.01.04 Trojan:Win32/Rodecap.A
NOD32 4742 2010.01.04 a variant of Win32/TrojanDownloader.Agent.PMB
Norman 6.04.03 2010.01.04 W32/Malware
nProtect 2009.1.8.0 2010.01.04 -
Panda 10.0.2.2 2010.01.03 Trj/Genetic.gen
PCTools 7.0.3.5 2010.01.04 -
Prevx 3.0 2010.01.04 -
Rising 22.29.00.04 2010.01.04 Trojan.DL.Win32.Downloader.GEN
Sophos 4.49.0 2010.01.04 -
Sunbelt 3.2.1858.2 2010.01.03 BehavesLike.Win32.Malware (v)
Symantec 20091.2.0.41 2010.01.04 -
TheHacker 6.5.0.3.131 2010.01.04 -
TrendMicro 9.120.0.1004 2010.01.04 -
VBA32 3.12.12.1 2010.01.04 suspected of Win32.Trojan.Downloader (http://...)
ViRobot 2010.1.4.2120 2010.01.04 -
VirusBuster 5.0.21.0 2010.01.03 Trojan.Cosmu.Gen

[Conetti]

Fixa con HiJackThis le seguenti voci:

C:\DOCUME~1\AMMINI~1\DATIAP~1\logman.exe
F3 - REG:win.ini: load=C:\DOCUME~1\AMMINI~1\DATIAP~1\logman.exe
O4 - HKLM\..\Policies\Explorer\Run: [Spool] C:\DOCUME~1\AMMINI~1\DATIAP~1\MICROS~1\spoolsv.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [rsvp] C:\WINDOWS\System32\drivers\rsvp.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [Logman] C:\DOCUME~1\AMMINI~1\DATIAP~1\MICROS~1\logman.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [IEudinit] C:\Documents and Settings\Amministratore\LOCALS~1\APPLIC~1\ieudinit .exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [SessMgr] C:\DOCUME~1\AMMINI~1\DATIAP~1\sessmgr.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [Mstsc] C:\DOCUME~1\AMMINI~1\DATIAP~1\MICROS~1\mstsc.exe /waitservice
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [ClipSrv] C:\WINDOWS\clipsrv.exe /waitservice (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [ClipSrv] C:\WINDOWS\clipsrv.exe /waitservice (User 'Default user')

Al termine esegui una scansione mediante l'antivirus e Spybot Search & Destroy, eliminando eventuali voci rilevate.
Pulisci il Pc con CCleaner e correggi, tramite la funzione "Registro", eventuali problemi rilevati al Registro Di Sistema.
Riavvia il Pc e fammi sapere come va