Newsgroup: it.hobby.fai-da-te
Titolo: Help! Caccia al Dialer

Sto cercando di aiutare una mia amica che è stata avvisata da telecom
che gli stanno per recapitare la classica bolletta astronomica causa
dialer a ripulire il suo pc.
In attesa che installi l'antivirus che ha ordinato, ha installato
adaware di cui di seguito incollo il report che mi ha inviato.
Non mi sembra che adaware abbia trovato nulla collegato a dialer.
Ci sono un po' di alexa ma penso siano abbastanza innocui e sono
semplici data miner.
Qualcuno riesce ad aiutarmi a vedere se si puo' scovare il dialer dai
processi attivi?
segue il report:
13-04-2005 11.16.11 - Scan started. (Full System Scan)
 MRU List Object Recognized!
    Location:          : C:\Documents and Settings\1\recent
    Description        : list of recently opened documents
 MRU List Object Recognized!
    Location:          :
S-1-5-21-299502267-839522115-854245398-1004\software\microsoft\search
assistant\acmru
    Description        : list of recent search terms used with the
search
assistant
 MRU List Object Recognized!
    Location:          :
S-1-5-21-299502267-839522115-854245398-1004\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru
    Description        : list of recently saved files, stored
according to
file extension
 MRU List Object Recognized!
    Location:          :
S-1-5-21-299502267-839522115-854245398-1004\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru
    Description        : list of recent programs opened
 MRU List Object Recognized!
    Location:          :
S-1-5-21-299502267-839522115-854245398-1004\software\microsoft\windows\currentversion\explorer\recentdocs
    Description        : list of recent documents opened
 MRU List Object Recognized!
    Location:          :
S-1-5-21-299502267-839522115-854245398-1004\software\microsoft\office\9.0\excel\recent
files
    Description        : list of recent files used by microsoft excel
 MRU List Object Recognized!
    Location:          :
S-1-5-21-299502267-839522115-854245398-1004\software\microsoft\mediaplayer\player\recentfilelist
    Description        : list of recently used files in microsoft
windows
media player
 MRU List Object Recognized!
    Location:          :
S-1-5-21-299502267-839522115-854245398-1004\software\microsoft\internet
explorer\main
    Description        : last save directory used in microsoft
internet explorer
 MRU List Object Recognized!
    Location:          :
S-1-5-21-299502267-839522115-854245398-1004\software\microsoft\internet
explorer
    Description        : last download directory used in microsoft
internet
explorer
 MRU List Object Recognized!
    Location:          :
software\microsoft\directdraw\mostrecentapplication
    Description        : most recent application to use microsoft
directdraw
 MRU List Object Recognized!
    Location:          :
S-1-5-21-299502267-839522115-854245398-1004\software\microsoft\microsoft
management console\recent file list
    Description        : list of recent snap-ins used in the microsoft
management
console
 MRU List Object Recognized!
    Location:          :
S-1-5-21-299502267-839522115-854245398-1004\software\adobe\acrobat
reader\5.0\avgeneral\crecentfiles
    Description        : list of recently used files in adobe reader
 MRU List Object Recognized!
    Location:          :
S-1-5-21-299502267-839522115-854245398-1004\software\microsoft\directinput\mostrecentapplication
    Description        : most recent application to use microsoft
directinput
 MRU List Object Recognized!
    Location:          :
S-1-5-21-299502267-839522115-854245398-1004\software\microsoft\mediaplayer\player\settings
    Description        : last open directory used in jasc paint shop
pro
 MRU List Object Recognized!
    Location:          :
software\microsoft\direct3d\mostrecentapplication
    Description        : most recent application to use microsoft
direct3d
 MRU List Object Recognized!
    Location:          :
S-1-5-21-299502267-839522115-854245398-1004\software\microsoft\mediaplayer\preferences
    Description        : last playlist index loaded in microsoft
windows
media player
 MRU List Object Recognized!
    Location:          :
S-1-5-21-299502267-839522115-854245398-1004\software\microsoft\windows\currentversion\applets\regedit
    Description        : last key accessed using the microsoft
registry editor
 MRU List Object Recognized!
    Location:          :
S-1-5-21-299502267-839522115-854245398-1004\software\microsoft\frontpage\explorer\frontpage
explorer\recent web list
    Description        : list of recently used webs in microsoft
frontpage
 MRU List Object Recognized!
    Location:          :
S-1-5-21-299502267-839522115-854245398-1004\software\microsoft\directinput\mostrecentapplication
    Description        : most recent application to use microsoft
directinput
 MRU List Object Recognized!
    Location:          :
.DEFAULT\software\microsoft\mediaplayer\preferences
    Description        : last playlist loaded in microsoft windows
media
player
 MRU List Object Recognized!
    Location:          :
S-1-5-18\software\microsoft\mediaplayer\preferences
    Description        : last playlist loaded in microsoft windows
media
player
 MRU List Object Recognized!
    Location:          :
S-1-5-19\software\microsoft\mediaplayer\preferences
    Description        : last playlist loaded in microsoft windows
media
player
 MRU List Object Recognized!
    Location:          :
S-1-5-20\software\microsoft\mediaplayer\preferences
    Description        : last playlist loaded in microsoft windows
media
player
 MRU List Object Recognized!
    Location:          :
S-1-5-21-299502267-839522115-854245398-1004\software\microsoft\mediaplayer\preferences
    Description        : last playlist loaded in microsoft windows
media
player
 MRU List Object Recognized!
    Location:          :
S-1-5-21-299502267-839522115-854245398-1004\software\microsoft\frontpage\explorer\frontpage
explorer\recent page list
    Description        : list of recently used pages in microsoft
frontpage
 MRU List Object Recognized!
    Location:          :
S-1-5-21-299502267-839522115-854245398-1004\software\microsoft\mediaplayer\player\recenturllist
    Description        : list of recently used web addresses in
microsoft
windows media player
 MRU List Object Recognized!
    Location:          :
S-1-5-21-299502267-839522115-854245398-1004\software\microsoft\mediaplayer\preferences
    Description        : last search path used in microsoft windows
media
player
 MRU List Object Recognized!
    Location:          :
S-1-5-21-299502267-839522115-854245398-1004\software\microsoft\frontpage\explorer\frontpage
explorer\recent file list
    Description        : list of recently used files in microsoft
frontpage
 MRU List Object Recognized!
    Location:          :
S-1-5-21-299502267-839522115-854245398-1004\software\microsoft\mediaplayer\medialibraryui
    Description        : last selected node in the microsoft windows
media
player media library
 MRU List Object Recognized!
    Location:          :
software\microsoft\direct3d\mostrecentapplication
    Description        : most recent application to use microsoft
direct
X
 MRU List Object Recognized!
    Location:          : .DEFAULT\software\microsoft\windows
media\wmsdk\general
    Description        : windows media sdk 
 MRU List Object Recognized!
    Location:          : S-1-5-18\software\microsoft\windows
media\wmsdk\general
    Description        : windows media sdk 
 MRU List Object Recognized!
    Location:          :
S-1-5-21-299502267-839522115-854245398-1004\software\microsoft\windows
media\wmsdk\general
    Description        : windows media sdk 
Listing running processes
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
#:1 [smss.exe]
    FilePath           : \SystemRoot\System32\
    ProcessID          : 264
    ThreadCreationTime : 13-04-2005 7.17.37
    BasePriority       : Normal
#:2 [csrss.exe]
    FilePath           : \??\C:\WINDOWS\system32\
    ProcessID          : 312
    ThreadCreationTime : 13-04-2005 7.17.38
    BasePriority       : Normal
#:3 [winlogon.exe]
    FilePath           : \??\C:\WINDOWS\system32\
    ProcessID          : 340
    ThreadCreationTime : 13-04-2005 7.17.41
    BasePriority       : High
#:4 [services.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 384
    ThreadCreationTime : 13-04-2005 7.17.41
    BasePriority       : Normal
    FileVersion        : 5.1.2600.0 (xpclient.010817-1148)
    ProductVersion     : 5.1.2600.0
    ProductName        : Sistema operativo Microsoft® Windows®
    CompanyName        : Microsoft Corporation
    FileDescription    : Applicazione Servizi e Controller
    InternalName       : services.exe
    LegalCopyright     : © Microsoft Corporation. Tutti i diritti
riservati.
    OriginalFilename   : services.exe
#:5 [lsass.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 396
    ThreadCreationTime : 13-04-2005 7.17.41
    BasePriority       : Normal
    FileVersion        : 5.1.2600.0 (xpclient.010817-1148)
    ProductVersion     : 5.1.2600.0
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : LSA Shell (Export Version)
    InternalName       : lsass.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : lsass.exe
#:6 [svchost.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 624
    ThreadCreationTime : 13-04-2005 7.17.41
    BasePriority       : Normal
    FileVersion        : 5.1.2600.0 (xpclient.010817-1148)
    ProductVersion     : 5.1.2600.0
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe
#:7 [svchost.exe]
    FilePath           : C:\WINDOWS\System32\
    ProcessID          : 664
    ThreadCreationTime : 13-04-2005 7.17.41
    BasePriority       : Normal
    FileVersion        : 5.1.2600.0 (xpclient.010817-1148)
    ProductVersion     : 5.1.2600.0
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe
#:8 [svchost.exe]
    FilePath           : C:\WINDOWS\System32\
    ProcessID          : 736
    ThreadCreationTime : 13-04-2005 7.17.42
    BasePriority       : Normal
    FileVersion        : 5.1.2600.0 (xpclient.010817-1148)
    ProductVersion     : 5.1.2600.0
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe
#:9 [logonui.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 748
    ThreadCreationTime : 13-04-2005 7.17.42
    BasePriority       : Normal
    FileVersion        : 6.00.2600.0000 (xpclient.010817-1148)
    ProductVersion     : 6.00.2600.0000
    ProductName        : Sistema operativo Microsoft® Windows®
    CompanyName        : Microsoft Corporation
    FileDescription    : Windows Logon UI
    InternalName       : LOGONUI
    LegalCopyright     : © Microsoft Corporation. Tutti i diritti
riservati.
    OriginalFilename   : LOGONUI.EXE
#:10 [svchost.exe]
    FilePath           : C:\WINDOWS\System32\
    ProcessID          : 792
    ThreadCreationTime : 13-04-2005 7.17.42
    BasePriority       : Normal
    FileVersion        : 5.1.2600.0 (xpclient.010817-1148)
    ProductVersion     : 5.1.2600.0
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe
#:11 [spoolsv.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 908
    ThreadCreationTime : 13-04-2005 7.17.43
    BasePriority       : Normal
    FileVersion        : 5.1.2600.0 (XPClient.010817-1148)
    ProductVersion     : 5.1.2600.0
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Spooler SubSystem App
    InternalName       : spoolsv.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : spoolsv.exe
#:12 [svchost.exe]
    FilePath           : C:\WINDOWS\System32\
    ProcessID          : 1148
    ThreadCreationTime : 13-04-2005 7.17.45
    BasePriority       : Normal
    FileVersion        : 5.1.2600.0 (xpclient.010817-1148)
    ProductVersion     : 5.1.2600.0
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe
#:13 [wdfmgr.exe]
    FilePath           : C:\WINDOWS\System32\
    ProcessID          : 1184
    ThreadCreationTime : 13-04-2005 7.17.45
    BasePriority       : Normal
    FileVersion        : 5.2.3790.1230 built by: DNSRV(bld4act)
    ProductVersion     : 5.2.3790.1230
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Windows User Mode Driver Manager
    InternalName       : WdfMgr
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : WdfMgr.exe
#:14 [explorer.exe]
    FilePath           : C:\WINDOWS\
    ProcessID          : 1640
    ThreadCreationTime : 13-04-2005 7.17.49
    BasePriority       : Normal
    FileVersion        : 6.00.2600.0000 (xpclient.010817-1148)
    ProductVersion     : 6.00.2600.0000
    ProductName        : Sistema operativo Microsoft® Windows®
    CompanyName        : Microsoft Corporation
    FileDescription    : Esplora risorse
    InternalName       : explorer
    LegalCopyright     : © Microsoft Corporation. Tutti i diritti
riservati.
    OriginalFilename   : EXPLORER.EXE
#:15 [incd.exe]
    FilePath           : C:\Programmi\ahead\InCD\
    ProcessID          : 1720
    ThreadCreationTime : 13-04-2005 7.17.54
    BasePriority       : Normal
    FileVersion        : 2.27.0
    ProductVersion     : 2.27.0
    ProductName        : InCD
    CompanyName        : Copyright (C) ahead software gmbh and its
licensors
    FileDescription    : InCD CD-RW UDF Tools
    InternalName       : InCD
    LegalCopyright     : Copyright (C) ahead software gmbh and its
licensors
    OriginalFilename   : InCD.EXE
    Comments           : CD-RW UDF Tools
#:16 [ccapp.exe]
    FilePath           : C:\WINDOWS\
    ProcessID          : 1772
    ThreadCreationTime : 13-04-2005 7.17.55
    BasePriority       : Normal
#:17 [nerocheck.exe]
    FilePath           : C:\WINDOWS\
    ProcessID          : 1796
    ThreadCreationTime : 13-04-2005 7.17.56
    BasePriority       : Normal
#:18 [qtsks.exe]
    FilePath           : C:\WINDOWS\
    ProcessID          : 1816
    ThreadCreationTime : 13-04-2005 7.17.56
    BasePriority       : Normal
#:19 [qtsk.exe]
    FilePath           : C:\WINDOWS\
    ProcessID          : 1888
    ThreadCreationTime : 13-04-2005 7.17.57
    BasePriority       : Normal
#:20 [ctfmon.exe]
    FilePath           : C:\WINDOWS\System32\
    ProcessID          : 1900
    ThreadCreationTime : 13-04-2005 7.17.57
    BasePriority       : Normal
    FileVersion        : 5.1.2600.0 (xpclient.010817-1148)
    ProductVersion     : 5.1.2600.0
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : CTF Loader
    InternalName       : CTFMON
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : CTFMON.EXE
#:21 [magickey.exe]
    FilePath           : C:\Programmi\Desktop senza fili Labtech\
    ProcessID          : 1968
    ThreadCreationTime : 13-04-2005 7.17.58
    BasePriority       : Normal
    FileVersion        : 1, 0, 0, 1
    ProductVersion     : 1, 0, 0, 1
    ProductName        : Versato Application
    FileDescription    : Versato MFC Application
    InternalName       : Versato
    LegalCopyright     : Copyright (C) 2003
    OriginalFilename   : Versato.EXE
#:22 [mulmouse.exe]
    FilePath           : C:\Programmi\Desktop senza fili Labtech\
    ProcessID          : 2012
    ThreadCreationTime : 13-04-2005 7.17.59
    BasePriority       : Normal
#:23 [osd.exe]
    FilePath           : C:\Programmi\Desktop senza fili Labtech\
    ProcessID          : 132
    ThreadCreationTime : 13-04-2005 7.18.03
    BasePriority       : Normal
    FileVersion        : 2, 0, 0, 0
    ProductVersion     : 1, 0, 0, 0
    ProductName        : WAYTECH OSD
    CompanyName        : WayTech Development, Inc.
    FileDescription    : OSD
    InternalName       : OSD
    LegalCopyright     : (C)1998-2000 WayTech Development, Inc.
    OriginalFilename   : OSD.exe
#:24 [wuauclt.exe]
    FilePath           : C:\WINDOWS\System32\
    ProcessID          : 744
    ThreadCreationTime : 13-04-2005 7.18.48
    BasePriority       : Normal
    FileVersion        : 5.4.3790.2182 built by: srv03_rtm(ntvbl04)
    ProductVersion     : 5.4.3790.2182
    ProductName        : Sistema operativo Microsoft® Windows®
    CompanyName        : Microsoft Corporation
    FileDescription    : Aggiornamenti automatici
    InternalName       : wuauclt.exe
    LegalCopyright     : © Microsoft Corporation. Tutti i diritti
riservati.
    OriginalFilename   : wuauclt.exe
#:25 [ad-aware.exe]
    FilePath           : C:\Programmi\Lavasoft\Ad-Aware SE Personal\
    ProcessID          : 816
    ThreadCreationTime : 13-04-2005 9.16.03
    BasePriority       : Normal
    FileVersion        : 6.2.0.206
    ProductVersion     : VI.Second Edition
    ProductName        : Lavasoft Ad-Aware SE
    CompanyName        : Lavasoft Sweden
    FileDescription    : Ad-Aware SE Core application
    InternalName       : Ad-Aware.exe
    LegalCopyright     : Copyright © Lavasoft Sweden
    OriginalFilename   : Ad-Aware.exe
    Comments           : All Rights Reserved
Memory scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 33
Started registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 Alexa Object Recognized!
    Type               : Regkey
    Data               : 
    Category           : Data Miner
    Comment            : 
    Rootkey            : HKEY_LOCAL_MACHINE
    Object             : software\microsoft\internet
explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}
 Alexa Object Recognized!
    Type               : RegValue
    Data               : 
    Category           : Data Miner
    Comment            : 
    Rootkey            : HKEY_LOCAL_MACHINE
    Object             : software\microsoft\internet
explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}
    Value              : MenuText
 Alexa Object Recognized!
    Type               : RegValue
    Data               : 
    Category           : Data Miner
    Comment            : 
    Rootkey            : HKEY_LOCAL_MACHINE
    Object             : software\microsoft\internet
explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}
    Value              : MenuStatusBar
 Alexa Object Recognized!
    Type               : RegValue
    Data               : 
    Category           : Data Miner
    Comment            : 
    Rootkey            : HKEY_LOCAL_MACHINE
    Object             : software\microsoft\internet
explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}
    Value              : Script
 Alexa Object Recognized!
    Type               : RegValue
    Data               : 
    Category           : Data Miner
    Comment            : 
    Rootkey            : HKEY_LOCAL_MACHINE
    Object             : software\microsoft\internet
explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}
    Value              : clsid
 Alexa Object Recognized!
    Type               : RegValue
    Data               : 
    Category           : Data Miner
    Comment            : 
    Rootkey            : HKEY_LOCAL_MACHINE
    Object             : software\microsoft\internet
explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}
    Value              : Icon
 Alexa Object Recognized!
    Type               : RegValue
    Data               : 
    Category           : Data Miner
    Comment            : 
    Rootkey            : HKEY_LOCAL_MACHINE
    Object             : software\microsoft\internet
explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}
    Value              : HotIcon
 Alexa Object Recognized!
    Type               : RegValue
    Data               : 
    Category           : Data Miner
    Comment            : 
    Rootkey            : HKEY_LOCAL_MACHINE
    Object             : software\microsoft\internet
explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}
    Value              : ButtonText
 Alexa Object Recognized!
    Type               : RegValue
    Data               : 
    Category           : Data Miner
    Comment            : "{c95fe080-8f5d-11d2-a20b-00aa003c157a}"
    Rootkey            : HKEY_USERS
    Object             : .DEFAULT\software\microsoft\internet
explorer\extensions\cmdmapping
    Value              : {c95fe080-8f5d-11d2-a20b-00aa003c157a}
 Alexa Object Recognized!
    Type               : RegValue
    Data               : 
    Category           : Data Miner
    Comment            : "{c95fe080-8f5d-11d2-a20b-00aa003c157a}"
    Rootkey            : HKEY_USERS
    Object             : S-1-5-18\software\microsoft\internet
explorer\extensions\cmdmapping
    Value              : {c95fe080-8f5d-11d2-a20b-00aa003c157a}
 Alexa Object Recognized!
    Type               : RegValue
    Data               : 
    Category           : Data Miner
    Comment            : "{c95fe080-8f5d-11d2-a20b-00aa003c157a}"
    Rootkey            : HKEY_USERS
    Object             :
S-1-5-21-299502267-839522115-854245398-1004\software\microsoft\internet
explorer\extensions\cmdmapping
    Value              : {c95fe080-8f5d-11d2-a20b-00aa003c157a}
Registry Scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 11
Objects found so far: 44
Started deep registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Deep registry scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 44
Started Tracking Cookie scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 Tracking Cookie Object Recognized!
    Type               : IECache Entry
    Data               : 1...@promo.match[2].txt
    Category           : Data Miner
    Comment            : Hits:4
    Value              : 
Cookie:1...@promo.match.com/
    Expires            : 14-04-2005 17.24.34
    LastSync           : Hits:4
    UseCount           : 0
    Hits               : 4
 Tracking Cookie Object Recognized!
    Type               : IECache Entry
    Data               : 1@tradedoubler[1].txt
    Category           : Data Miner
    Comment            : Hits:18
    Value              : 
Cookie:1...@tradedoubler.com/
    Expires            : 06-04-2025 17.26.50
    LastSync           : Hits:18
    UseCount           : 0
    Hits               : 18
 Tracking Cookie Object Recognized!
    Type               : IECache Entry
    Data               : 1@valueclick[2].txt
    Category           : Data Miner
    Comment            : Hits:3
    Value              : 
Cookie:1...@valueclick.com/
    Expires            : 02-04-2030 23.10.30
    LastSync           : Hits:3
    UseCount           : 0
    Hits               : 3
 Tracking Cookie Object Recognized!
    Type               : IECache Entry
    Data               : 1@cgi-bin[1].txt
    Category           : Data Miner
    Comment            : Hits:18
    Value              : 
Cookie:1...@imrworldwide.com/cgi-bin
    Expires            : 19-01-2009 1.00.00
    LastSync           : Hits:18
    UseCount           : 0
    Hits               : 18
 Tracking Cookie Object Recognized!
    Type               : IECache Entry
    Data               : 1@cgi-bin[2].txt
    Category           : Data Miner
    Comment            : Hits:7
    Value              : 
Cookie:1...@www.addfreestats.com/cgi-bin
    Expires            : 28-02-2015 2.00.00
    LastSync           : Hits:7
    UseCount           : 0
    Hits               : 7
Tracking cookie scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 5
Objects found so far: 49
Deep scanning and examining files (C:)
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Disk Scan Result for C:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 49
Scanning Hosts file......
Hosts file location:"C:\WINDOWS\system32\drivers\etc\hosts".
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Hosts file scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
1 entries scanned.
New critical objects:0
Objects found so far: 49
Performing conditional scans...
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Conditional scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 49
11.20.43 Scan Complete
Summary Of This Scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Total scanning time:00.04.32.221
Objects scanned:83158
Objects identified:16
Objects ignored:0
New critical objects:16

 dialer a ripulire il suo pc.
[CUT]
Prova con 
http://www.safer-networking.org/it/download/index.html
 - scarica
lo SpyBot 1.3 e fagli eseguire il controllo.


già gli avevo dato questo consiglio
io sul mio pc effettuo sempre i controlli con adaware e spybot che
penso siano i miliori spyware e complementari nella ricerca.
Aspetto che mi dia l'esito del controllo.
..intanto stavo dando un'occhiata ai processi per vedere se noto
qualcosa di strano


CUT
A Adaware fagli fare la pulizia di tutto, ricordati di attivare all'avvio
l'Adwatch.
Scarica spywareblaster ed eseguilo, digli di caricare il teatimer all'avvio.
Scarica Hijackthis ed eseguilo. Poi vai sul sito 
http://www.hijackthis.de/it
e da lě apri il file log che hijackthis ha salvato, e lo fai analizzare.
Provvedi in base alla lista che esce come risposta.
---

 Scarica  *Spybot e* spywareblaster ed eseguili, digli di caricare il
teatimer
-
---

il piů potente software che ho provato al riguardo č "ewido" (gira da win
2000 in poi) sradica ogni cosa, peccato essere solo trial (che funziona
benissimo)

 processi attivi?
Non ne ho idea, ma oltre ai consigli degli altri scarica Stop Dialer: è un 
programmino che consente la connessione solo verso il numero impostato ed 
autorizzato. Se un dialer "ci prova", lui blocca tutto e ti avverte.
-- 
Cinghiale 

 processi attivi?
 >[cut]
Quei qstks.exe e qtsk.exe non mi piaciono proprio...mi sa che è lui,ai 
consigli che già ti hanno dato aggiungo di provare a fare le varie 
scansioni (spybot hijackthis ecc..)in modalità provvisoria e di 
impostare esplora risorse in modo da visualizzare anche i file e le 
cartelle nascoste,ovviamente controlla anche tutte le connessioni dialup 
se ce ne sono....potrebbe aver modificato il numero di una connessione 
leggittima...
-- 
Per mandarmi una mail scrivi il nome utente al contrario.
	Diego Russo
 
id...@people.it

 Non mi sembra che adaware abbia trovato nulla collegato a dialer.
infatti non e' un applicativo specifico per trovare i dialer.
Adriano

 #:19 [qtsk.exe]
Esegui in sequenzaa ad-aware e spybot s&d con i file di definizione
aggiornati, e prova anche il programma anti spyware di microsoft.
Prima di eseguirli termina i 2 processi sopra, e poi cancella questi 2 file
se non lo fanno gli anti spyware o l'antivirus.

 processi attivi?
Hai voglia, a volte cambiano il nome del file piu' volte al giorno. 
Scarica StopDialer... blocca tutte le connessioni via modem se non
esplicitamente autorizzate.
Cia'
Max