8 replies to this topic

[No Fat Clips!!!]

Thanks to my ISP (and my stupidity in trusting it) I've been connected to the Internet bypassing the Firewall, leading to a trojan feast.
I've removed some of them, and setup a connection using the Windows dialer, but something is still lurking and getting in my way when I surf.
The main symptom is the appearing of some popups (leading to errorsafe, windowsantiviruspro and similar sites) in Internet Explorer, even though Firefox is set up as the default browser. But sometimes, an attempt to run some trojans (examples: Win32:Trojan-gen., Win32:VBStat-C, Win32:BHO-BG) is made, but hopefully avast blocks them. Some of them, at least.
An other syndrome: at startup, a couple of minutes is required for avast to start (it shows a red sign on it) and in those minutes I cannot open the dial up application; some unrequested services are appearing in the running processes, like dllhost, mmc and msdtc, but that could be due to the Windows Updates.

Hijackthis log follows:

Logfile of HijackThis v1.99.1
Scan saved at 12.22.06, on 09/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
D:\media\software\PV\PrcView.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\dllhost.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Programmi\JGsoft\EditPadLite\EditPadLite.exe
D:\Programmi\mmm\Magic.exe
D:\Programmi\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [2chkdsk] rundll32.exe "C:\WINDOWS\system32\penxawip.dll",setvm
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O11 - Options group: [INTERNATIONAL] International*
O17 - HKLM\System\CCS\Services\Tcpip\..\{B37B7B3D-7BC8-4DB6-B4CC-7950C5DDC4E6}: NameServer = 85.37.17.11 151.99.125.1
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

[LDTate]

Hello and welcome to the forum.

You may want to print out these instructions for reference, since you will have to restart your computer during the fix.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.


Please do not delete anything unless instructed to.


Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

O4 - HKLM\..\Run: [2chkdsk] rundll32.exe "C:\WINDOWS\system32\penxawip.dll",setvm

Close ALL windows and browsers except HijackThis and click "Fix checked"


Delete these Files if listed:
C:\WINDOWS\system32\penxawip.dll




Please download FixWareout from one of these sites:
http://downloads.sub.../Fixwareout.exe
http://www.bleepingc.../Fixwareout.exe

Save it to your desktop and run it. Click Next, then Install, make sure "Run fixit" is checked and click Finish.
The fix will begin; follow the prompts.
You will be asked to reboot your computer; please do so.
Your system may take longer than usual to load; this is normal.

Once the desktop loads a text that will open (report.txt) Please save this file, you'll need to post it with a new HijackThis log.



Next:
Click Start> Run> type in CMD tap enter key
Copy/Paste: ipconfig /flushdns <-- Note the space between g /f. It needs to be there.


Now lets check some settings on your system.
Enter your Control Panel and double-click on Network Connections

Then right click on your Default Connection
Usually Local Area Connection for Cable and DSL
Left click on Properties
Double-Click on the Internet Protocol (TCP/IP) item
Select the radio dial that says Obtain DNS Servers Automatically
Press OK twice to get out of the properties screen and reboot if it asks


Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two


Reboot and "copy/paste" the text file (report.txt) and a new Hijackthis log

Also please describe how your computer behaves at the moment.

[No Fat Clips!!!]

Hi, thanks for the answer.
Anyway, reading another topic, I've found out that some malwares hide from HiJackThis so I've made a new scan renaming it.
I've found the typical traces of Vundo infection and removed with VundoFix.
I've removed the penxawip voice at startup as well and moved the file.
(I haven't posted this informations cause it is advised to not reply to own messages.)

At the moment, there are no popups and no attempt to install unrequested software.
But the computer still locks at startup (about at the moment when winlogon.exe is executed) I can open explorer windows, run HJT

Also, I tried to install Comodo to replace Windows Firewall, but its components don't start. The program suggests to repeat installation, but it obviously hadn't be of any help.

A new log follows:

Logfile of HijackThis v1.99.1
Scan saved at 23.34.41, on 09/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmi\mozilla.org\Mozilla\mozilla.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Programmi\eMule\emule.exe
C:\WINDOWS\System32\svchost.exe
D:\Programmi\mmm\Magic.exe
D:\Programmi\HijackThis\HiThisisJack.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O11 - Options group: [INTERNATIONAL] International*
O17 - HKLM\System\CCS\Services\Tcpip\..\{B37B7B3D-7BC8-4DB6-B4CC-7950C5DDC4E6}: NameServer = 85.37.17.11 151.99.125.1
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

[LDTate]

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.


(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

Next:

Download AVG Anti-Spyware from HERE and save that file to your
desktop.
This is a 30 day trial of the program

• Once you have downloaded AVG Anti-Spyware, locate the icon on the desktop
  and double-click it to launch the set up program.
• Once the setup is complete you will need run ewido and update the definition
  files.
• On the main screen select the icon "Update" then select the "
  Update now" link.
  • Next select the "Start Update" button, the update will start and a
    progress bar will show the updates being installed.
• Once the update has completed select the "Scanner" icon at the top of
  the screen, then select the "Settings" tab.
• Once in the Settings screen click on "Recommended actions" and then
  select " "Quarantine" .".
• Under "Reports"
  • Select "Automatically generate report after every scan"
  • Un-Select "Only if threats were found"

Close AVG Anti-Spyware, Do Not run a scan just yet, we will shortly.

• Reboot your computer into SafeMode. You can do this by restarting
  your computer and continually tapping the F8 key until a menu appears.
  
  Use your up arrow key to highlight SafeMode then hit enter.
  IMPORTANT: Do not open any other windows or
  programs while AVG Anti-Spyware is scanning, it may interfere with the scanning proccess:
• Lauch AVG Anti-Spyware by double-clicking the icon on your desktop.
• Select the "Scanner" icon at the top and then the "Scan" tab
  then click on "Complete System Scan".
• ewido will now begin the scanning process, be patient this may take a little
  time.
  Once the scan is complete do the following:
• If you have any infections you will prompted, then select "Apply all
  actions"
• Next select the "Reports" icon at the top.
• Select the "Save report as" button in the lower left hand of the
  screen and save it to a text file on your system (make sure to remember where
  you saved that file, this is important).
• Close AVG Anti-Spyware and reboot your system back into Normal Mode and post the
  results of the AVG Anti-Spyware report scan along with a new HijackThis log.

[No Fat Clips!!!]

Sorry, I fell asleep while AVG was working...
The reports follow.
Here's a brief Italian-English dictionary:

Ripulito = Cleaned
Ripulito con backup = Cleaned and made a backup
in quarantena = quarantined

--

---------------------------------------------------------
AVG Anti-Spyware - Rapporto scansione
---------------------------------------------------------

+ Creato alle: 10.01.54 10/03/2007

+ Risultato scansione:



C:\WINDOWS\system32\algs.exe -> Backdoor.Rbot.bnz : Ripulito con backup (in quarantena)
D:\media\images\Pagine\russo\cirillico.html -> Not-A-Virus.Exploit.JS.ActiveXComponent : Ripulito con backup (in quarantena)
C:\System Volume Information\_restore{9175AC0D-8643-4FFD-9B00-72CDC75055ED}\RP1\A0001075.exe -> Proxy.Ranky : Ripulito con backup (in quarantena)
:mozilla.162:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.2o7 : Ripulito.
:mozilla.163:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.2o7 : Ripulito.
:mozilla.164:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.2o7 : Ripulito.
:mozilla.165:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.2o7 : Ripulito.
:mozilla.166:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.2o7 : Ripulito.
:mozilla.167:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.2o7 : Ripulito.
:mozilla.168:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.2o7 : Ripulito.
:mozilla.169:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.2o7 : Ripulito.
:mozilla.179:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.2o7 : Ripulito.
:mozilla.180:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.2o7 : Ripulito.
:mozilla.181:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.2o7 : Ripulito.
:mozilla.268:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.2o7 : Ripulito.
:mozilla.193:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Adbrite : Ripulito.
:mozilla.194:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Adbrite : Ripulito.
:mozilla.195:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Adbrite : Ripulito.
:mozilla.201:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Adbrite : Ripulito.
:mozilla.203:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Adbrite : Ripulito.
:mozilla.208:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Adbrite : Ripulito.
:mozilla.209:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Adbrite : Ripulito.
:mozilla.210:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Adbrite : Ripulito.
:mozilla.286:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Adbrite : Ripulito.
:mozilla.53:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Adbrite : Ripulito.
:mozilla.54:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Adbrite : Ripulito.
:mozilla.55:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Adbrite : Ripulito.
:mozilla.56:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Adbrite : Ripulito.
:mozilla.574:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Adbrite : Ripulito.
:mozilla.575:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Adbrite : Ripulito.
:mozilla.57:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Adbrite : Ripulito.
:mozilla.58:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Adbrite : Ripulito.
:mozilla.59:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Adbrite : Ripulito.
:mozilla.255:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Addynamix : Ripulito.
:mozilla.256:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Addynamix : Ripulito.
:mozilla.322:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Adjuggler : Ripulito.
:mozilla.323:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Adjuggler : Ripulito.
:mozilla.213:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Adrevolver : Ripulito.
:mozilla.214:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Adrevolver : Ripulito.
:mozilla.215:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Adrevolver : Ripulito.
:mozilla.176:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Advertising : Ripulito.
:mozilla.177:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Advertising : Ripulito.
:mozilla.62:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Advertising : Ripulito.
:mozilla.63:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Advertising : Ripulito.
:mozilla.64:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Advertising : Ripulito.
:mozilla.128:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Atdmt : Ripulito.
:mozilla.407:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Atdmt : Ripulito.
:mozilla.507:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Burstnet : Ripulito.
:mozilla.524:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Casalemedia : Ripulito.
:mozilla.525:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Casalemedia : Ripulito.
:mozilla.526:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Casalemedia : Ripulito.
:mozilla.161:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Co : Ripulito.
:mozilla.130:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Doubleclick : Ripulito.
:mozilla.80:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Doubleclick : Ripulito.
:mozilla.147:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Falkag : Ripulito.
:mozilla.148:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Falkag : Ripulito.
:mozilla.149:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Falkag : Ripulito.
:mozilla.150:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Falkag : Ripulito.
:mozilla.151:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Falkag : Ripulito.
:mozilla.261:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Falkag : Ripulito.
:mozilla.262:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Falkag : Ripulito.
:mozilla.263:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Falkag : Ripulito.
:mozilla.264:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Falkag : Ripulito.
:mozilla.124:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Fastclick : Ripulito.
:mozilla.125:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Fastclick : Ripulito.
:mozilla.126:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Fastclick : Ripulito.
:mozilla.127:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Fastclick : Ripulito.
:mozilla.521:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Fastclick : Ripulito.
:mozilla.522:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Fastclick : Ripulito.
:mozilla.523:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Fastclick : Ripulito.
:mozilla.364:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Googleadservices : Ripulito.
:mozilla.133:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Hitbox : Ripulito.
:mozilla.134:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Hitbox : Ripulito.
:mozilla.135:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Hitbox : Ripulito.
:mozilla.361:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Hitbox : Ripulito.
:mozilla.362:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Hitbox : Ripulito.
:mozilla.363:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Hitbox : Ripulito.
:mozilla.405:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Hitbox : Ripulito.
:mozilla.427:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Hitbox : Ripulito.
:mozilla.487:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Hitbox : Ripulito.
:mozilla.305:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Kmpads : Ripulito.
:mozilla.184:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Liveperson : Ripulito.
:mozilla.185:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Liveperson : Ripulito.
:mozilla.186:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Liveperson : Ripulito.
:mozilla.352:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Liveperson : Ripulito.
:mozilla.353:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Liveperson : Ripulito.
:mozilla.196:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Masterstats : Ripulito.
:mozilla.128:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Mediaplex : Ripulito.
:mozilla.460:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Onestat : Ripulito.
:mozilla.471:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Onestat : Ripulito.
:mozilla.83:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Onestat : Ripulito.
:mozilla.84:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Onestat : Ripulito.
:mozilla.310:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Overture : Ripulito.
:mozilla.623:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Overture : Ripulito.
:mozilla.497:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Pointroll : Ripulito.
:mozilla.498:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Pointroll : Ripulito.
:mozilla.499:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Pointroll : Ripulito.
:mozilla.500:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Pointroll : Ripulito.
:mozilla.393:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Questionmarket : Ripulito.
:mozilla.394:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Questionmarket : Ripulito.
:mozilla.479:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Realmedia : Ripulito.
:mozilla.369:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Reliablestats : Ripulito.
:mozilla.370:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Reliablestats : Ripulito.
:mozilla.371:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Reliablestats : Ripulito.
:mozilla.372:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Reliablestats : Ripulito.
:mozilla.155:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Revsci : Ripulito.
:mozilla.156:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Revsci : Ripulito.
:mozilla.157:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Revsci : Ripulito.
:mozilla.158:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Revsci : Ripulito.
:mozilla.159:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Revsci : Ripulito.
:mozilla.160:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Revsci : Ripulito.
:mozilla.339:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Revsci : Ripulito.
:mozilla.387:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Serving-sys : Ripulito.
:mozilla.388:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Serving-sys : Ripulito.
:mozilla.389:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Serving-sys : Ripulito.
:mozilla.390:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Serving-sys : Ripulito.
:mozilla.391:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Serving-sys : Ripulito.
:mozilla.392:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Serving-sys : Ripulito.
:mozilla.153:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Specificclick : Ripulito.
:mozilla.154:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Specificclick : Ripulito.
:mozilla.155:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Specificclick : Ripulito.
:mozilla.161:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Specificclick : Ripulito.
:mozilla.170:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Specificclick : Ripulito.
:mozilla.171:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Specificclick : Ripulito.
:mozilla.172:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Specificclick : Ripulito.
:mozilla.100:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Statcounter : Ripulito.
:mozilla.79:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Statcounter : Ripulito.
:mozilla.80:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Statcounter : Ripulito.
:mozilla.81:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Statcounter : Ripulito.
:mozilla.82:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Statcounter : Ripulito.
:mozilla.87:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Statcounter : Ripulito.
:mozilla.88:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Statcounter : Ripulito.
:mozilla.89:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Statcounter : Ripulito.
:mozilla.90:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Statcounter : Ripulito.
:mozilla.91:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Statcounter : Ripulito.
:mozilla.92:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Statcounter : Ripulito.
:mozilla.93:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Statcounter : Ripulito.
:mozilla.94:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Statcounter : Ripulito.
:mozilla.95:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Statcounter : Ripulito.
:mozilla.96:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Statcounter : Ripulito.
:mozilla.97:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Statcounter : Ripulito.
:mozilla.98:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Statcounter : Ripulito.
:mozilla.99:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Statcounter : Ripulito.
:mozilla.102:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Tacoda : Ripulito.
:mozilla.103:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Tacoda : Ripulito.
:mozilla.104:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Tacoda : Ripulito.
:mozilla.105:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Tacoda : Ripulito.
:mozilla.494:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Tacoda : Ripulito.
:mozilla.495:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Tacoda : Ripulito.
:mozilla.496:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Tacoda : Ripulito.
:mozilla.443:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Tradedoubler : Ripulito.
:mozilla.444:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Tradedoubler : Ripulito.
:mozilla.518:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Trafic : Ripulito.
:mozilla.112:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Tribalfusion : Ripulito.
:mozilla.178:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Tribalfusion : Ripulito.
:mozilla.442:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Webtrendslive : Ripulito.
:mozilla.152:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Yieldmanager : Ripulito.
:mozilla.156:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Yieldmanager : Ripulito.
:mozilla.157:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Yieldmanager : Ripulito.
:mozilla.158:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Yieldmanager : Ripulito.
:mozilla.159:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Yieldmanager : Ripulito.
:mozilla.160:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Yieldmanager : Ripulito.
:mozilla.197:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Yieldmanager : Ripulito.
:mozilla.198:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Yieldmanager : Ripulito.
:mozilla.199:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Yieldmanager : Ripulito.
:mozilla.200:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Yieldmanager : Ripulito.
:mozilla.111:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Zedo : Ripulito.
:mozilla.112:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Zedo : Ripulito.
:mozilla.113:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Zedo : Ripulito.
:mozilla.114:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Zedo : Ripulito.
:mozilla.115:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Profiles\default\z85kqrcu.slt\cookies.txt -> TrackingCookie.Zedo : Ripulito.
:mozilla.173:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Zedo : Ripulito.
:mozilla.174:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Zedo : Ripulito.
:mozilla.175:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Zedo : Ripulito.
:mozilla.176:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Zedo : Ripulito.
:mozilla.177:C:\Documents and Settings\master\Dati applicazioni\Mozilla\Firefox\Profiles\yx5rpm0m.default\cookies.txt -> TrackingCookie.Zedo : Ripulito.
C:\WINDOWS\system32\spoolsvc.exe -> Trojan.Pakes : Ripulito con backup (in quarantena)


::Fine rapporto

--

Logfile of HijackThis v1.99.1
Scan saved at 10.14.25, on 10/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
D:\media\software\PV\PrcView.exe
C:\Programmi\JGsoft\EditPadLite\EditPadLite.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\Programmi\Mozilla Firefox\firefox.exe
D:\Programmi\mmm\Magic.exe
C:\WINDOWS\system32\wuauclt.exe
D:\Programmi\HijackThis\HiThisisJack.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O11 - Options group: [INTERNATIONAL] International*
O17 - HKLM\System\CCS\Services\Tcpip\..\{B37B7B3D-7BC8-4DB6-B4CC-7950C5DDC4E6}: NameServer = 85.37.17.11 151.99.125.1
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\guard.exe

[LDTate]

With AVG Anti-Spyware, if you click on the Infections icon, then it will show you all the items in Quarrantine and you can remove them that way. Just click Select All (if all of the items in quarrantine need removing) then Remove Finally


You can remove any programs I had you install. Use Add/Remove Programs to remove if listed there:

Log looks good


You need to create a new Clean restore point.

Note: This will remove all previous Restore Points

Turn off System Restore:

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

Restart your computer, turn it back on.

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Remove the Check Turn off System Restore.
Click Apply, and then click OK.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Check "Hide file extensions for known file types."
Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
Check "Hide protected operating system files."
Click Apply, and then click OK.



If you dont have any programs like these, I would recommend that you get them.
Spywareblaster,
Spywareguard.


Also get a FREE FIREWALL and FREE ANTI VIRUS if you need one.

Only run one Anti-Virus and Firewall program.

It is critical to have both a firewall and anti virus to protect your system.

Keep your system up to date and run Adaware & Spybot, once a week works, and hopefully you will be ok from here on. Both are available below.

Do not use Ad-aware if you have McAfee's VirusScan and AntiSpyware


Safe Surfing.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein

[No Fat Clips!!!]

I tried to install Comodo, but its services won't start. I disabled both Windows Firewall and avast Net Protection but it keep saying to try installing the program again. (I've re-enabled Windows firewall before connecting.) I don't like Zone Alarm too much, so I'd like to try this new one out. Any guess?

[LDTate]

I see quite a few posts of those having problems with the
Comodo firewall; for a few yrs I have used Sygate Personal
firewall, which was bought by Symantec, then abandoned.
However, it has no "conflicts" with any other program, based
on my experience .

I use this one:
http://www.filehippo...sonal_firewall/

[LDTate]

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoy...showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php