Newsgroup: it.comp.aiuto
Titolo: aiuto virus

navigando in rete credo di aver beccato un virus che mi ha disattivato avast 
e mi impedisce di collegarmi in rete
Il pc infatti non vede la scheda di rete ,,è  come se fosse stata rimossa.
In gestione periferice le voci shceda di rete e le varie miniport WAN sono 
gialle con un punto esclamativo.
inoltre avast mi riporta l'errore 10054 in cui è impossibile proteggere il 
pc sia per la posta inviata che ricevuta.
ho lanciato combofix ,ma niente
Riporto il report di combofix magari qualcuno può aiutarmi:
ComboFix 09-08-10.06 - Mamma 13/08/2009 17.05.20.1.2 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.3.1252.39.1040.18.511.206 [GMT 
2:00]
Eseguito da: F:\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090812-0] *On-access scanning disabled* 
(Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA 
INSTALLATA !!
.
(((((((((((((((((((((((((((((((((((((   Altre 
iminazioni   )))))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Mamma\Dati applicazioni\wiaserva.log
c:\documents and settings\Mamma\Menu Avvio\Programmi\Esecuzione 
automatica\ikowin32.exe
c:\windows\install.exe
.
(((((((((((((((((((((((((   Files Creati Da 2009-07-13 al 
009-08-13  )))))))))))))))))))))))))))))))))))
.
2009-08-08 16:17 . 2009-08-08 16:17 -------- d--h--w- c:\windows\PIF
2009-08-03 12:36 . 2009-08-03 14:07 -------- d-----w- c:\documents and 
settings\Mamma\Dati applicazioni\EyeballChatUserData
2009-08-03 12:18 . 2009-08-03 12:18 4086 ----a-r- c:\documents and 
settings\Mamma\Dati 
applicazioni\Microsoft\Installer\{9C4C0D18-B07D-4670-B13E-D65ABBD8F014}\_AEC97B2A21DC7D088FBFD7.exe
2009-08-03 12:18 . 2009-08-03 12:18 4086 ----a-r- c:\documents and 
settings\Mamma\Dati 
applicazioni\Microsoft\Installer\{9C4C0D18-B07D-4670-B13E-D65ABBD8F014}\_6FEFF9B68218417F98F549.exe
2009-08-03 12:18 . 2009-08-03 12:18 4086 ----a-r- c:\documents and 
settings\Mamma\Dati 
applicazioni\Microsoft\Installer\{9C4C0D18-B07D-4670-B13E-D65ABBD8F014}\_3BF480366CEDCF00F391B2.exe
2009-08-03 12:18 . 2009-08-03 12:18 1078 ----a-r- c:\documents and 
settings\Mamma\Dati 
applicazioni\Microsoft\Installer\{9C4C0D18-B07D-4670-B13E-D65ABBD8F014}\_505728EAF68D4A23E29BD2.exe
2009-08-03 12:17 . 2009-08-03 12:17 -------- d-----w- c:\programmi\Eyeball 
Networks
2009-07-24 19:36 . 2009-07-24 19:36 -------- d-----w- c:\programmi\Audacity
.
((((((((((((((((((((((((((((((((((((((((   Find3M 
port   )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-13 15:01 . 2009-06-25 17:48 -------- d-----w- c:\documents and 
settings\Mamma\Dati applicazioni\U3
2009-08-01 08:12 . 2009-05-21 01:26 -------- d-----w- c:\programmi\Microsoft 
Silverlight
2009-07-17 23:35 . 2006-01-20 16:24 -------- d-----w- c:\documents and 
settings\Mamma\Dati applicazioni\Skype
2009-06-29 15:55 . 2004-08-19 13:39 827392 ----a-w- 
c:\windows\system32\wininet.dll
2009-06-29 15:55 . 2004-08-19 13:39 78336 ----a-w- 
c:\windows\system32\ieencode.dll
2009-06-29 15:54 . 2004-08-19 13:39 17408 ------w- 
c:\windows\system32\corpol.dll
2009-06-24 12:34 . 2006-01-12 18:58 90112 ----a-w- c:\windows\DUMP453c.tmp
2009-06-18 14:01 . 2006-01-12 18:58 98304 ----a-w- c:\windows\DUMP10de.tmp
2009-06-18 08:04 . 2006-01-12 18:59 -------- d-----w- c:\programmi\Spybot - 
Search & Destroy
2009-06-16 14:36 . 2004-08-19 13:39 119808 ----a-w- 
c:\windows\system32\t2embed.dll
2009-06-16 14:36 . 2001-08-31 11:00 81920 ----a-w- 
c:\windows\system32\fontsub.dll
2009-06-16 11:55 . 2006-09-28 19:24 -------- d-----w- c:\documents and 
settings\All Users\Dati applicazioni\Yahoo!
2009-06-03 19:09 . 2004-08-19 13:39 1296384 ----a-w- 
c:\windows\system32\quartz.dll
2009-06-02 02:14 . 2006-01-12 18:58 90112 ----a-w- c:\windows\DUMPe317.tmp
2009-06-01 18:32 . 2006-01-12 18:58 90112 ----a-w- c:\windows\DUMP6591.tmp
2009-05-26 19:35 . 2009-06-16 11:55 607472 ----a-w- c:\documents and 
settings\All Users\Dati applicazioni\Yahoo!\YUpdater\yupdater.exe
.
(((((((((((((((((((((((((((((((((((((   Punti Reg 
ricati   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{0A94B116-4504-4e26-AB05-E61E474AA38B}"= 
"c:\programmi\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL" [2007-06-17 61440]
[HKEY_CLASSES_ROOT\clsid\{0a94b116-4504-4e26-ab05-e61e474aa38b}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\programmi\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 
3885408]
"swg"="c:\programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" 
[2009-02-14 39408]
"SpybotSD TeaTimer"="c:\programmi\Spybot - Search & Destroy\TeaTimer.exe" 
[2009-03-05 2260480]
"Messenger (Yahoo!)"="c:\programmi\Yahoo!\Messenger\YahooMessenger.exe" 
[2009-05-26 4351216]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"Motive SmartBridge"="c:\progra~1\ALICET~1\SMARTB~1\MotiveSB.exe" 
[2006-04-21 438359]
"Hazon clic"="c:\programmi\Garzanti Linguistica\Hazon clic\HAZON.EXE" 
[2003-05-22 643072]
"QuickTime Task"="c:\programmi\K-Lite Codec Pack\QuickTime\qttask.exe" 
[2009-01-05 413696]
"iTunesHelper"="c:\programmi\iTunes\iTunesHelper.exe" [2009-03-12 342312]
"SunJavaUpdateSched"="c:\programmi\Java\jre1.6.0_07\bin\jusched.exe" 
[2008-06-10 144784]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"ToniArts EasyCleaner"="c:\programmi\ToniArts\EasyCleaner\EasyClea.exe" 
[2005-01-14 2117632]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\Mamma\Menu Avvio\Programmi\Esecuzione automatica\
OpenOffice.org 3.0.lnk - c:\programmi\OpenOffice.org 
3\program\quickstart.exe [2008-12-15 384000]
c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione 
automatica\
Avvio veloce di Adobe Reader.lnk - c:\programmi\Adobe\Acrobat 
7.0\Reader\reader_sl.exe [2005-9-23 29696]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Recupero Settembre\\eMule\\emule.exe"=
"c:\\Programmi\\Messenger\\msmsgs.exe"=
"c:\\Programmi\\Paltalk Messenger\\paltalk.exe"=
"c:\\Programmi\\IEPro\\MiniDM.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmi\\BitComet\\BitComet.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programmi\\Bonjour\\mDNSResponder.exe"=
"c:\\Programmi\\iTunes\\iTunes.exe"=
"c:\\Programmi\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"23478:TCP"= 23478:TCP:BitComet 23478 TCP
"23478:UDP"= 23478:UDP:BitComet 23478 UDP
"5000:TCP"= 5000:TCP:BitComet 5000 TCP
"5000:UDP"= 5000:UDP:BitComet 5000 UDP
"8194:TCP"= 8194:TCP:BitComet 8194 TCP
"8194:UDP"= 8194:UDP:BitComet 8194 UDP
R3 P1001VID;Creative WebCam (WDM);c:\windows\system32\drivers\P1001Vid.sys 
[12/01/2006 22.06.15 395224]
S1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys 
[12/06/2009 17.24.54 114768]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [12/06/2009 
17.24.54 20560]
S2 gafwload;IPM Datacom USB ADSL 
Loader;c:\windows\system32\drivers\gafwload.sys [12/01/2006 21.54.39 26985]
.
Contenuto della cartella 'Scheduled Tasks'
2009-08-12 c:\windows\Tasks\OGADaily.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 16:04]
2009-08-13 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 16:04]
.
.
------- Scansione supplementare -------
.
uSearchMigratedDefaultURL = 
hxxp://
www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://
www.google.com/search?q=%s
IE: E&sporta in Microsoft Excel - 
c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Scarica con Free Download Manager - file://c:\programmi\Free Download 
Manager\dllink.htm
IE: Scarica selezionati con Free Download Manager - file://c:\programmi\Free 
Download Manager\dlselected.htm
IE: Scarica sito web con Free Download Manager - file://c:\programmi\Free 
Download Manager\dlpage.htm
IE: Scarica tutti i video usando BitComet - 
c:\programmi\BitComet\BitComet.exe/AddVideo.htm
IE: Scarica tutto con Free Download Manager - file://c:\programmi\Free 
Download Manager\dlall.htm
DPF: Microsoft XML Parser for Java - 
file:///C:/WINDOWS/Java/classes/xmldso.cab
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, 
http://www.gmer.net
Rootkit scan 2009-08-13 17:27
Windows 5.1.2600 Service Pack 3 NTFS
scansione processi nascosti ...
scansione entrate autostart nascoste ...
Scansione files nascosti ...
**************************************************************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ •€|ù•9~ *]
"0140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- Dlls caricate dai processi in 
esecuzione ---------------------
- - - - - - - > 'winlogon.exe'(268)
c:\windows\system32\Ati2evxx.dll
.
Ora fine scansione: 2009-08-13 17.37.57
ComboFix-quarantined-files.txt  2009-08-13 15:36
Pre-Run: 1.378.529.280 byte disponibili
Post-Run: 1.881.636.864 byte disponibili
138 --- E O F --- 2009-08-10 09:39

 e mi impedisce di collegarmi in rete
formatformatformatformatformat!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

 Riporto il report di combofix magari qualcuno pu� aiutarmi:
Da un pc "pulito" scarica 
http://www.free-av.com/en/tools/12/avira_antivir_rescue_system.html
 e usalo 
avviando il tuo sistema dal cd che avrai creato.
-- 
Andrea
- - - - - - - - - - - - - - - - - - - - - - - -
www.yoga-kundalini.it
 - 
www.olistic.it
 

 usalo avviando il tuo sistema dal cd che avrai creato.
Ti riferisci al backup? 

 Ti riferisci al backup?
No, mi riferisco al fatto che avviando il sistema da cd (con il cd che ti 
puoi fare con il file che scarichi dalla pagina che ti ho suggerito) puoi 
fare una scansione con un antivirus aggiornato (che molto probabilmente ti 
eliminer� l'infezione che ha dato origine al problema).
