Newsgroup: it.comp.sicurezza.varie
Titolo: mi triplica le icone:invasione

ciao a tutti.
Da qualche giorno APPENA accendo il pc mi trovo tutte le icone che ho 
sul desktop triplicate come minimo,lo stesso avviene nella cartella 
immagini e in altre cartelle.
Ho fatto scansioni con NOD32, adaware,spybot,hijackthis ma tutto è ok.
Eppure non appena lo riaccendo si ritriplicano.
qualcuno sa cosa puo' essere?!
Ho trovato un processo chiamato KHALMNPR.EXE su google dicono sia 
qualcosa della logitech è che è innocuo(prima pero' mi sembrava non ci 
fosse,e in effetto ho tastiera e mouse logitech)
ps allego scansione di hijachthis se puo' servire.
grazie mille.
Logfile of HijackThis v1.99.1
Scan saved at 1.50.46, on 12/02/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\cFosSpeed\spd.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Programmi\Executive Software\Diskeeper\DkService.exe
C:\Programmi\Eset\nod32krn.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Programmi\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\Programmi\D-Tools\daemon.exe
C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
C:\Programmi\cFosSpeed\cfos_speed.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Programmi\MessengerPlus! 3\MsgPlus.exe
C:\Programmi\Logitech\MediaLife\MediaLifeService.exe
C:\Programmi\iTunes\iTunesHelper.exe
C:\Programmi\Eset\nod32kui.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
C:\Programmi\CyberLink\PowerDVD\PDVDServ.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Program Files\Logitech\Desktop 
Messenger\8876480\Program\BackWeb-8876480.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\eMule\emule.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\DOCUME~1\lorepc\IMPOST~1\Temp\KeyGen.exe
C:\Programmi\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
Collegamenti
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - 
C:\DOCUME~1\lorepc\IMPOST~1\Temp\IDMIECC.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - 
C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [CTSysVol] C:\Programmi\Creative\SB Live! 
24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programmi\D-Tools\daemon.exe" 
  -lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] 
C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [cFosSpeed] C:\Programmi\cFosSpeed\cfos_speed.exe
O4 - HKLM\..\Run: [ABIT uGuru] C:\Programmi\ABIT\ABIT uGuru\uGuru.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programmi\MessengerPlus! 
3\MsgPlus.exe"
O4 - HKLM\..\Run: [PCMService] 
"C:\Programmi\Logitech\MediaLife\MediaLifeService.exe"
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Programmi\Executive 
Software\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] 
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON 
Stylus Photo RX420 Series" /O6 "USB001" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" 
-atboottime
O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] 
C:\Programmi\Corel\Corel Graphics 
12\Languages\EN\Programs\Registration.exe /title="CorelDRAW Graphics 
Suite 12" /date=022006 serial=DR12WRD-5808712-JLK lang=EN
O4 - HKLM\..\Run: [RemoteControl] 
C:\Programmi\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop 
Messenger\8876480\Program\BackWeb-8876480.exe
O4 - Startup: Adobe Gamma.lnk = C:\Programmi\File 
comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Diskeeper 9 Professional Edition Registration.lnk = 
C:\Programmi\Executive Software\Diskeeper\ESIRegister.exe
O4 - Startup: HDDlife.lnk = C:\Programmi\BinarySense\HDDlife\HDDlifePro.exe
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = 
C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech SetPoint.lnk = 
C:\Programmi\Logitech\SetPoint\KEM.exe
O8 - Extra context menu item: Download All Links with IDM - 
C:\DOCUME~1\lorepc\IMPOST~1\Temp\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - 
C:\DOCUME~1\lorepc\IMPOST~1\Temp\IEExt.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - 
res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - 
C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - 
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - 
C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - 
C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - 
C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - 
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - 
http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1136981848390
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - 
http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136981837703
O17 - 
HKLM\System\CCS\Services\Tcpip\..\{38BDA991-1620-4327-B2CC-38286BBE9DA7}: 
NameServer = 192.168.0.1
O17 - 
HKLM\System\CCS\Services\Tcpip\..\{5969CAF1-A04A-42A1-A63C-7229BF200120}: 
NameServer = 192.168.0.1
O17 - 
HKLM\System\CCS\Services\Tcpip\..\{8A00A629-55C1-484B-91BB-FFB06B1E1E5C}: 
NameServer = 85.37.17.5 85.38.28.77
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - 
"C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File 
comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - 
C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - 
C:\Programmi\Canon\CAL\CALMAIN.exe
O23 - Service: cFosSpeed System Service (cFosSpeedS) - Unknown owner - 
C:\Programmi\cFosSpeed\spd.exe" -service (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology 
Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - 
C:\Programmi\Executive Software\Diskeeper\DkService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision 
Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 
32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - 
C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - 
C:\Programmi\Eset\nod32krn.exe
O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate 
Technologies, Inc. - C:\Programmi\Sygate\SPF\smc.exe

 Ho fatto scansioni con NOD32, adaware,spybot,hijackthis ma tutto è ok.
Le icone in questione per caso sono tutte .dll?
Per caso ti e mai successo di leggere in una finestra di dialogo la seguente 
frase?  " I love dll " ? 

 
no no sono risorse di rete,cartelle,file jpg,file exe, di tutto..