Vanno in crash tutti i prodotti Microsoft

[jonni125]

Salve ragazzi , credo di aver preso un virus : questo virus mi fa andare in crash i prodotti microsoft e come ad esempio messenger o internet explorer , mi fa andare in crash anche i programmi istallatori di questi programmi! è un virus o solo un errore si sistema? come lo risolvo?

[stevens]

ciao

puoi postare un log di hijackthis?

http://www.trendsecure.com/portal/en-US ... kthis.php#

lancia il programma cliccando l’eseguibile e avvia la scansione, scegliendo la voce "Do a system scan and save a logfile"

Ricordati di mettere HIJACKTHIS in una cartella a lui dedicata (in Programmi o Documenti), l'importante è che non si trovi sul desktop o in cartelle temporanee è importante se vuoi salvare i backup

Posta il log che ti rilascia

[jonni125]

ecco quì il log :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17.23.50, on 15/03/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18372)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\RTHDCPL.EXE
D:\WINDOWS\system32\RUNDLL32.EXE
D:\Programmi\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
D:\Programmi\DAEMON Tools Lite\daemon.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Programmi\Vtune\TBPanel.exe
D:\Programmi\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\Programmi\Raxco\PerfectDisk2008\PD91Agent.exe
D:\WINDOWS\system32\wscntfy.exe
D:\Programmi\Raxco\PerfectDisk2008\PerfectDisk.exe
D:\Programmi\Raxco\PerfectDisk2008\PD91Engine.exe
D:\Programmi\Raxco\PerfectDisk2008\PD91Scanner.exe
D:\Programmi\Messenger\msmsgs.exe
D:\Programmi\Mozilla Firefox\firefox.exe
D:\Documents and Settings\giuliano\Desktop\Nuova cartella\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - D:\Programmi\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVP] "D:\Programmi\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKCU\..\Run: [MsnMsgr] "D:\Programmi\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\Programmi\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TBPanel] D:\Programmi\Vtune\TBPanel.exe /A
O4 - HKCU\..\Run: [DWQueuedReporting] "D:\PROGRA~1\FILECO~1\MICROS~1\DW\dwtrig20.exe" -t
O4 - HKCU\..\Run: [MSMSGS] "D:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-21-1957994488-879983540-839522115-1003\..\Run: [MsnMsgr] "D:\Programmi\Windows Live\Messenger\MsnMsgr.Exe" /background (User '?')
O4 - HKUS\S-1-5-21-1957994488-879983540-839522115-1003\..\Run: [TBPanel] D:\Programmi\Vtune\TBPanel.exe /A (User '?')
O4 - HKUS\S-1-5-21-1957994488-879983540-839522115-1003\..\Run: [DWQueuedReporting] "D:\PROGRA~1\FILECO~1\MICROS~1\DW\dwtrig20.exe" -t (User '?')
O4 - HKUS\S-1-5-21-1957994488-879983540-839522115-1003\..\Run: [MSMSGS] "D:\Programmi\Messenger\msmsgs.exe" /background (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Aggiungi al banner Blocco pubblicità - D:\Programmi\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O9 - Extra button: Statistiche sulla protezione del traffico Web - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - D:\Programmi\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDow ... eqlab3.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 7112572625
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDow ... rtScan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{60048EA2-5565-4B87-BA58-40D4268C45AF}: NameServer = 85.37.17.50 85.38.28.76
O20 - AppInit_DLLs: D:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,D:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,D:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - D:\Programmi\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - D:\Programmi\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PD91Agent - Raxco Software, Inc. - D:\Programmi\Raxco\PerfectDisk2008\PD91Agent.exe
O23 - Service: PD91Engine - Raxco Software, Inc. - D:\Programmi\Raxco\PerfectDisk2008\PD91Engine.exe

--
End of file - 5876 bytes

[ste_95]

Il log è pulito.

Scarica ComboFix ed esegui una scansione, le istruzioni le trovi in fondo a questo articolo.

[jonni125]

ecco il log:

ComboFix 09-03-14.01 - giuliano 2009-03-15 18.10.10.1 - NTFSx86
Eseguito da: d:\documents and settings\giuliano\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

d:\windows\system32\pthreadGC2.dll

.
((((((((((((((((((((((((( Files Creati Da 2009-02-15 al 2009-03-15 )))))))))))))))))))))))))))))))))))
.

2009-03-15 18:14 . 2009-03-15 18:14 <DIR> d--h----- d:\documents and settings\TEMP\Impostazioni locali
2009-03-15 18:14 . 2009-03-15 18:14 <DIR> d-------- d:\documents and settings\TEMP\Dati applicazioni
2009-03-15 18:14 . 2009-03-15 18:14 <DIR> d--hs---- d:\documents and settings\TEMP
2009-03-15 17:39 . 2009-03-15 17:39 <DIR> d-------- d:\documents and settings\giuliano\Dati applicazioni\Malwarebytes
2009-03-15 17:39 . 2009-03-15 17:39 <DIR> d-------- d:\documents and settings\All Users\Dati applicazioni\Malwarebytes
2009-03-15 17:33 . 2009-03-15 17:34 <DIR> d-------- D:\32788R22FWJFW.0.tmp
2009-03-15 16:03 . 2008-10-16 14:06 268,648 --a------ d:\windows\system32\mucltui.dll
2009-03-15 16:03 . 2008-10-16 14:06 27,496 --a------ d:\windows\system32\mucltui.dll.mui
2009-03-15 12:45 . 2009-03-15 12:45 <DIR> d-------- d:\programmi\File comuni\Windows Live
2009-03-15 12:14 . 2009-03-15 12:14 <DIR> d-------- d:\programmi\Kaspersky Lab
2009-03-15 12:14 . 2009-03-15 18:15 <DIR> d-------- d:\documents and settings\All Users\Dati applicazioni\Kaspersky Lab
2009-03-15 12:14 . 2009-03-15 18:14 1,125,408 --ahs---- d:\windows\system32\drivers\fidbox.dat
2009-03-15 12:14 . 2009-03-15 18:14 237,600 --ahs---- d:\windows\system32\drivers\fidbox2.dat
2009-03-15 12:14 . 2009-03-15 12:28 101,287 --a------ d:\windows\system32\drivers\klin.dat
2009-03-15 12:14 . 2009-03-15 12:28 89,601 --a------ d:\windows\system32\drivers\klick.dat
2009-03-15 12:14 . 2009-03-15 18:14 9,872 --ahs---- d:\windows\system32\drivers\fidbox.idx
2009-03-15 12:14 . 2009-03-15 18:14 1,892 --ahs---- d:\windows\system32\drivers\fidbox2.idx
2009-03-15 11:30 . 2009-03-15 11:30 <DIR> d-------- d:\windows\system32\AGEIA
2009-03-15 11:30 . 2009-03-15 11:30 <DIR> d-------- d:\programmi\AGEIA Technologies
2009-03-15 11:29 . 2009-03-15 11:29 <DIR> d-------- d:\programmi\File comuni\Wise Installation Wizard
2009-03-15 11:28 . 2009-03-15 12:06 <DIR> d-------- d:\windows\NV37682812.TMP
2009-03-15 11:19 . 2009-03-15 11:19 <DIR> d-------- d:\programmi\SystemRequirementsLab
2009-03-15 11:17 . 2009-03-15 11:17 <DIR> d--hs---- d:\documents and settings\giuliano\IECompatCache
2009-03-15 11:16 . 2009-03-15 11:16 <DIR> d--hs---- d:\documents and settings\giuliano\PrivacIE
2009-03-15 11:16 . 2009-03-15 11:16 <DIR> d--hs---- d:\documents and settings\giuliano\IETldCache
2009-03-15 11:11 . 2001-08-31 16:00 809,974 --a--c--- d:\windows\system32\dllcache\NT5IIS.CAT
2009-03-15 11:10 . 2009-02-18 14:44 212,711 --a------ d:\windows\system32\nvapps.nvb
2009-03-15 11:06 . 2009-03-15 11:14 <DIR> d-------- d:\programmi\Vtune
2009-03-15 11:06 . 2007-03-16 10:11 12,256 --a------ d:\windows\system32\drivers\TBPanel.sys
2009-03-14 20:22 . 2009-03-14 20:22 <DIR> d-------- d:\programmi\Electronic Arts
2009-03-14 20:19 . 2009-03-14 20:19 <DIR> dr-h----- d:\documents and settings\giuliano\Dati applicazioni\SecuROM
2009-03-14 20:18 . 2009-03-14 20:18 107,888 --a------ d:\windows\system32\CmdLineExt.dll
2009-03-14 18:30 . 2009-03-14 18:30 311 --a------ d:\windows\game.ini
2009-03-14 18:26 . 2009-03-14 18:26 <DIR> d-------- d:\programmi\Activision
2009-03-14 18:19 . 2009-03-14 18:19 268 --ah----- D:\sqmdata02.sqm
2009-03-14 18:19 . 2009-03-14 18:19 244 --ah----- D:\sqmnoopt02.sqm
2009-03-14 18:12 . 2009-03-14 18:12 <DIR> d--hs---- d:\windows\ftpcache
2009-03-14 18:11 . 2009-03-14 18:11 <DIR> d-------- d:\documents and settings\giuliano\Dati applicazioni\DAEMON Tools Pro
2009-03-14 18:11 . 2009-03-14 18:11 <DIR> d-------- d:\documents and settings\giuliano\Dati applicazioni\DAEMON Tools
2009-03-14 18:10 . 2009-03-14 18:10 <DIR> d-------- d:\programmi\DAEMON Tools Lite
2009-03-14 18:10 . 2009-03-14 18:10 <DIR> d-------- d:\documents and settings\All Users\Dati applicazioni\DAEMON Tools Lite
2009-03-14 18:08 . 2009-03-14 18:12 <DIR> d-------- d:\documents and settings\giuliano\Dati applicazioni\DAEMON Tools Lite
2009-03-14 18:08 . 2009-03-14 18:08 717,296 --a------ d:\windows\system32\drivers\sptd.sys
2009-03-14 18:08 . 2009-03-14 18:08 268 --ah----- D:\sqmdata01.sqm
2009-03-14 18:08 . 2009-03-14 18:08 244 --ah----- D:\sqmnoopt01.sqm
2009-03-14 18:01 . 2009-03-14 18:01 268 --ah----- D:\sqmdata00.sqm
2009-03-14 18:01 . 2009-03-14 18:01 244 --ah----- D:\sqmnoopt00.sqm
2009-03-14 17:53 . 2009-03-14 17:53 <DIR> d-------- d:\documents and settings\All Users\Dati applicazioni\Raxco
2009-03-14 17:53 . 2008-05-15 09:45 71,184 -ra------ d:\windows\system32\drivers\DefragFS.sys
2009-03-14 17:51 . 2009-03-14 17:53 <DIR> d-------- d:\programmi\Raxco
2009-03-14 17:43 . 2009-03-14 18:24 <DIR> d-------- d:\documents and settings\giuliano\Contacts
2009-03-14 17:39 . 2009-03-14 17:41 <DIR> d--hsc--- d:\programmi\File comuni\WindowsLiveInstaller
2009-03-14 17:39 . 2009-03-14 17:39 <DIR> d-------- d:\documents and settings\All Users\Dati applicazioni\WLInstaller
2009-03-14 17:36 . 2009-03-14 17:36 385 --a------ d:\windows\system32\%LocalXml%
2009-03-14 17:06 . 2009-03-14 17:06 <DIR> d-------- d:\windows\ie8updates
2009-03-14 17:04 . 2009-03-14 17:06 <DIR> d--h-c--- d:\windows\ie8
2009-03-14 17:03 . 2009-01-11 06:00 79,360 -----c--- d:\windows\system32\dllcache\iecompat.dll
2009-03-14 17:00 . 2008-09-24 19:41 839,680 --a------ d:\windows\system32\lameACM.acm
2009-03-14 17:00 . 2007-09-21 01:52 118,784 --a------ d:\windows\system32\ac3acm.acm
2009-03-14 17:00 . 2007-07-10 17:10 547 --a------ d:\windows\system32\ff_vfw.dll.manifest
2009-03-14 17:00 . 2008-10-03 13:30 414 --a------ d:\windows\system32\lame_acm.xml

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-15 11:28 33,808 ----a-w d:\windows\system32\drivers\klbg.sys
2009-03-14 17:58 --------- d--h--w d:\programmi\InstallShield Installation Information
2009-03-14 16:01 --------- d-----w d:\programmi\K-Lite Codec Pack
2009-03-14 15:57 --------- d-----w d:\programmi\Windows Media Connect 2
2009-03-14 15:35 --------- d-----w d:\programmi\Realtek
2009-03-14 15:25 --------- d-----w d:\programmi\AMD
2009-03-14 15:25 --------- d-----w d:\documents and settings\giuliano\Dati applicazioni\InstallShield
2009-03-14 15:23 --------- d-----w d:\programmi\File comuni\Adobe
2009-03-14 15:22 --------- d-----w d:\programmi\NOS
2009-03-14 15:22 --------- d-----w d:\documents and settings\All Users\Dati applicazioni\NOS
2009-03-14 15:09 --------- d-----w d:\programmi\CCleaner
2009-03-14 15:01 --------- d-----w d:\documents and settings\All Users\Dati applicazioni\Kaspersky Lab Setup Files
2009-03-14 15:00 --------- d-----w d:\documents and settings\All Users\Dati applicazioni\Office Genuine Advantage
2009-03-14 14:54 --------- d-----w d:\programmi\File comuni\InstallShield
2009-03-14 14:38 --------- d-----w d:\programmi\microsoft frontpage
2009-03-14 14:37 --------- d-----w d:\programmi\Servizi in linea
2009-02-16 22:17 453,152 ----a-w d:\windows\system32\NVUNINST.EXE
2009-02-09 18:56 67,584 ----a-w d:\windows\system32\ff_vfw.dll
2009-02-09 14:56 1,846,272 ----a-w d:\windows\system32\win32k.sys
2009-02-03 16:32 18,085,888 ----a-w d:\windows\RTHDCPL.EXE
2009-02-03 16:22 5,030,912 ----a-w d:\windows\system32\drivers\RtkHDAud.sys
2009-02-03 15:35 35,840 ----a-w d:\windows\system32\RtkCoInstXP.dll
2009-01-21 14:54 1,206,816 ----a-w d:\windows\RtlUpd.exe
2009-01-16 17:24 70,936 ----a-w d:\windows\system32\PhysXLoader.dll
2009-01-15 01:05 911,872 ----a-w d:\windows\system32\wininet.dll
2009-01-15 01:05 43,008 ----a-w d:\windows\system32\licmgr10.dll
2009-01-15 01:04 18,944 ----a-w d:\windows\system32\corpol.dll
2009-01-15 01:03 72,704 ----a-w d:\windows\system32\admparse.dll
2009-01-15 01:03 71,680 ----a-w d:\windows\system32\iesetup.dll
2009-01-15 01:03 420,352 ----a-w d:\windows\system32\vbscript.dll
2009-01-15 01:01 34,304 ----a-w d:\windows\system32\imgutil.dll
2009-01-15 01:00 48,128 ----a-w d:\windows\system32\mshtmler.dll
2009-01-15 01:00 45,568 ----a-w d:\windows\system32\mshta.exe
2009-01-15 00:50 156,160 ----a-w d:\windows\system32\msls31.dll
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="d:\programmi\DAEMON Tools Lite\daemon.exe" [2008-12-29 687560]
"ctfmon.exe"="d:\windows\system32\ctfmon.exe" [2004-08-19 15360]
"TBPanel"="d:\programmi\Vtune\TBPanel.exe" [2008-07-03 2150400]
"MSMSGS"="d:\programmi\Messenger\msmsgs.exe" [2004-10-13 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="d:\windows\system32\NvCpl.dll" [2009-02-18 13680640]
"Adobe Reader Speed Launcher"="d:\programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"NvMediaCenter"="d:\windows\system32\NvMcTray.dll" [2009-02-18 86016]
"AVP"="d:\programmi\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-03-15 201992]
"nwiz"="nwiz.exe" [2009-02-18 d:\windows\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2009-02-03 d:\windows\RTHDCPL.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\system32\CTFMON.EXE" [2004-08-19 15360]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ PDBoot.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Documents and Settings\\All Users\\Dati applicazioni\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 2009\\Italian\\setup.exe"=

R3 Ambfilt;Ambfilt;d:\windows\system32\drivers\Ambfilt.sys [2008-08-05 1684736]
R3 getPlus(R) Helper;getPlus(R) Helper;d:\programmi\NOS\bin\getPlus_HelperSvc.exe [2009-03-03 33176]
R3 PD91Engine;PD91Engine;d:\programmi\Raxco\PerfectDisk2008\PD91Engine.exe [2008-07-18 910600]
S0 klbg;Kaspersky Lab Boot Guard Driver;d:\windows\system32\drivers\klbg.sys [2009-03-15 33808]
S2 PD91Agent;PD91Agent;d:\programmi\Raxco\PerfectDisk2008\PD91Agent.exe [2008-07-18 693512]
S3 KLFLTDEV;Kaspersky Lab KLFltDev;d:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;d:\windows\system32\DRIVERS\klim5.sys [2008-03-25 24592]


--- Altri Servizi/Drivers In Memoria ---

*Deregistered* - AFD
*Deregistered* - ALG
*Deregistered* - AudioSrv
*Deregistered* - audstub
*Deregistered* - AVP
*Deregistered* - Beep
*Deregistered* - BITS
*Deregistered* - Browser
*Deregistered* - Cdfs
*Deregistered* - CryptSvc
*Deregistered* - DcomLaunch
*Deregistered* - DefragFS
*Deregistered* - Dhcp
*Deregistered* - dmio
*Deregistered* - dmload
*Deregistered* - dmserver
*Deregistered* - ERSvc
*Deregistered* - EventSystem
*Deregistered* - Fastfat
*Deregistered* - FastUserSwitchingCompatibility
*Deregistered* - Fips
*Deregistered* - FltMgr
*Deregistered* - Ftdisk
*Deregistered* - Gpc
*Deregistered* - helpsvc
*Deregistered* - HidServ
*Deregistered* - HTTP
*Deregistered* - ImapiService
*Deregistered* - IpNat
*Deregistered* - IPSec
*Deregistered* - kl1
*Deregistered* - klbg
*Deregistered* - KLIF
*Deregistered* - klim5
*Deregistered* - KSecDD
*Deregistered* - lanmanserver
*Deregistered* - lanmanworkstation
*Deregistered* - LmHosts
*Deregistered* - mnmdd
*Deregistered* - MountMgr
*Deregistered* - MRxDAV
*Deregistered* - MRxSmb
*Deregistered* - Msfs
*Deregistered* - mssmbios
*Deregistered* - Mup
*Deregistered* - NDIS
*Deregistered* - NdisTapi
*Deregistered* - Ndisuio
*Deregistered* - NdisWan
*Deregistered* - NDProxy
*Deregistered* - NetBIOS
*Deregistered* - NetBT
*Deregistered* - Netman
*Deregistered* - Nla
*Deregistered* - Npfs
*Deregistered* - Ntfs
*Deregistered* - Null
*Deregistered* - NVSvc
*Deregistered* - PartMgr
*Deregistered* - ParVdm
*Deregistered* - PD91Agent
*Deregistered* - PD91Engine
*Deregistered* - PolicyAgent
*Deregistered* - PptpMiniport
*Deregistered* - ProtectedStorage
*Deregistered* - PSched
*Deregistered* - RasAcd
*Deregistered* - Rasl2tp
*Deregistered* - RasMan
*Deregistered* - RasPppoe
*Deregistered* - Raspti
*Deregistered* - Rdbss
*Deregistered* - RDPCDD
*Deregistered* - rdpdr
*Deregistered* - RemoteRegistry
*Deregistered* - RpcSs
*Deregistered* - SamSs
*Deregistered* - Schedule
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - Spooler
*Deregistered* - sptd
*Deregistered* - sr
*Deregistered* - srservice
*Deregistered* - Srv
*Deregistered* - SSDPSRV
*Deregistered* - swenum
*Deregistered* - TapiSrv
*Deregistered* - TBPanel
*Deregistered* - Tcpip
*Deregistered* - TermDD
*Deregistered* - TermService
*Deregistered* - Themes
*Deregistered* - TrkWks
*Deregistered* - Update
*Deregistered* - VgaSave
*Deregistered* - VolSnap
*Deregistered* - W32Time
*Deregistered* - Wanarp
*Deregistered* - WebClient
*Deregistered* - winmgmt
*Deregistered* - wscsvc
*Deregistered* - wuauserv
*Deregistered* - WZCSVC

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"d:\windows\system32\rundll32.exe" "d:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
- - - - CHIAVI ORFANE RIMOSSE - - - -

HKCU-Run-MsnMsgr - d:\programmi\Windows Live\Messenger\MsnMsgr.Exe
HKCU-Run-DWQueuedReporting - d:\progra~1\FILECO~1\MICROS~1\DW\dwtrig20.exe


.
------- Scansione supplementare -------
.
IE: Aggiungi al banner Blocco pubblicità - d:\programmi\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
FF - ProfilePath - d:\documents and settings\giuliano\Dati applicazioni\Mozilla\Firefox\Profiles\x1ufbv58.default\
FF - plugin: d:\programmi\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: d:\programmi\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
.

[ste_95]

Il log è pulito, quindi escludo i malware come causa del problema.
Hai installato qualcosa di recente?

[jonni125]

no niente di particolare...ma se può servire ti posso dire che sto problema è sorto nel momento che ho fatto l' aggiornamento a windows, ho installato tutti gli aggiornamenti disponibili fin ora da scaricare perché mi ero formattato il pc...

[Amantide]

C'è una cosa molto strana in questo log, una cosa da me mai vista

--- Altri Servizi/Drivers In Memoria ---

*Deregistered* - AFD
*Deregistered* - ALG
*Deregistered* - AudioSrv
*Deregistered* - audstub
*Deregistered* - AVP
*Deregistered* - Beep
*Deregistered* - BITS
*Deregistered* - Browser
*Deregistered* - Cdfs
*Deregistered* - CryptSvc
*Deregistered* - DcomLaunch
*Deregistered* - DefragFS
*Deregistered* - Dhcp
*Deregistered* - dmio
*Deregistered* - dmload
*Deregistered* - dmserver
*Deregistered* - ERSvc
*Deregistered* - EventSystem
*Deregistered* - Fastfat
*Deregistered* - FastUserSwitchingCompatibility
*Deregistered* - Fips
*Deregistered* - FltMgr
*Deregistered* - Ftdisk
*Deregistered* - Gpc
*Deregistered* - helpsvc
*Deregistered* - HidServ
*Deregistered* - HTTP
*Deregistered* - ImapiService
*Deregistered* - IpNat
*Deregistered* - IPSec
*Deregistered* - kl1
*Deregistered* - klbg
*Deregistered* - KLIF
*Deregistered* - klim5
*Deregistered* - KSecDD
*Deregistered* - lanmanserver
*Deregistered* - lanmanworkstation
*Deregistered* - LmHosts
*Deregistered* - mnmdd
*Deregistered* - MountMgr
*Deregistered* - MRxDAV
*Deregistered* - MRxSmb
*Deregistered* - Msfs
*Deregistered* - mssmbios
*Deregistered* - Mup
*Deregistered* - NDIS
*Deregistered* - NdisTapi
*Deregistered* - Ndisuio
*Deregistered* - NdisWan
*Deregistered* - NDProxy
*Deregistered* - NetBIOS
*Deregistered* - NetBT
*Deregistered* - Netman
*Deregistered* - Nla
*Deregistered* - Npfs
*Deregistered* - Ntfs
*Deregistered* - Null
*Deregistered* - NVSvc
*Deregistered* - PartMgr
*Deregistered* - ParVdm
*Deregistered* - PD91Agent
*Deregistered* - PD91Engine
*Deregistered* - PolicyAgent
*Deregistered* - PptpMiniport
*Deregistered* - ProtectedStorage
*Deregistered* - PSched
*Deregistered* - RasAcd
*Deregistered* - Rasl2tp
*Deregistered* - RasMan
*Deregistered* - RasPppoe
*Deregistered* - Raspti
*Deregistered* - Rdbss
*Deregistered* - RDPCDD
*Deregistered* - rdpdr
*Deregistered* - RemoteRegistry
*Deregistered* - RpcSs
*Deregistered* - SamSs
*Deregistered* - Schedule
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - Spooler
*Deregistered* - sptd
*Deregistered* - sr
*Deregistered* - srservice
*Deregistered* - Srv
*Deregistered* - SSDPSRV
*Deregistered* - swenum
*Deregistered* - TapiSrv
*Deregistered* - TBPanel
*Deregistered* - Tcpip
*Deregistered* - TermDD
*Deregistered* - TermService
*Deregistered* - Themes
*Deregistered* - TrkWks
*Deregistered* - Update
*Deregistered* - VgaSave
*Deregistered* - VolSnap
*Deregistered* - W32Time
*Deregistered* - Wanarp
*Deregistered* - WebClient
*Deregistered* - winmgmt
*Deregistered* - wscsvc
*Deregistered* - wuauserv
*Deregistered* - WZCSVC

Tutti questi servizi hai de-registrato tu?

Se vai su Start>> Esegui>> services.msc tutti questi servizi vedi come sospesi e stoppati?

[jonni125]

sono un po avviati e un po no

[Amantide]

Solo ora me ne sono accorta di questa stringa nel log di Hijackthis:

MSIE: Internet Explorer v8.00 (8.00.6001.18372)

Per caso i problemi sono sorti dopo aver installato la versione beta di IE?

[jonni125]

si,subito dopo ie 8

[Amantide]

si,subito dopo ie 8

E' normale che la versione beta di un qualsiasi software può provocare dei problemi. Intanto disinstalla IE8, fai la pulizia con CCleaner e facci sapere se hai risolto.

[jonni125]

perfetto! ora funziona ! grazie!

[Amantide]

perfetto! ora funziona ! grazie!

Ottimo!

A questo punto direi che la discussione starà meglio nella sezione Sistema Operativo.