Newsgroup: it.comp.sicurezza.windows
Titolo: Il Mio Logfile of HijackThis

Chi mi aiuta a cancellare qualcosa....ho il pc che su internet praticamente
va da solo ...... si aprono e si chiudono pagine web di siti senza il mio
volere.
Grazie
Logfile of HijackThis v1.99.1
Scan saved at 16.04.12, on 29/05/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Programmi\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programmi\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\System32\rundll32.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Programmi\Samsung\Digimax Viewer 2.1\STImgBrowser.exe
C:\Programmi\Reality Fusion\Reality Fusion GameCam SE\Program\RFTRay.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\TinMessenger\c6Messenger.exe
C:\Programmi\Alice ti aiuta\bin\mpbtn.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Passepartout.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Alex\Impostazioni locali\Temp\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://g.msn.it/0SEITIT/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://www.virgilio.it/free
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak =
http://www.libero.it/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft
Internet Explorer fornito da Tin.it
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Programmi\MSN
Apps\ST\01.02.0002.1001\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} -
C:\Programmi\MSN Apps\MSN Toolbar\01.02.2001.0001\it\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} -
C:\Programmi\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} -
C:\Programmi\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} -
C:\Programmi\MSN Apps\MSN Toolbar\01.02.2001.0001\it\msntb.dll
O3 - Toolbar: Virgilio Toolbar - {D3403F28-7D39-435F-A8CB-45016C29E48E} -
C:\Programmi\Virgilio Toolbar\VirgilioBand.dll
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Programmi\File comuni\Roxio
Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Programmi\Roxio\Easy CD Creator
6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Programmi\Roxio\Easy CD Creator
6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec
Shared\ccApp.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [EPSON Stylus C64 Series]
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus
C64 Series" /O6 "USB001" /M "Stylus C64"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [QuickTime Task]
"C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [msnappau] "C:\Programmi\MSN
Apps\Updater\01.02.0002.1001\it\msnappau.exe"
O4 - HKLM\..\Run: [Microsoft Update] muamgrd.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE
C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CnxTrApp] rundll32.exe "C:\Programmi\Pirelli\Access
Gateway USB Network\CnxTrApp.dll",AppEntry -REG "Pirelli\Access Gateway USB"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [FASTTRACKPassepartout] C:\WINDOWS\Passepartout.exe -A
O4 - HKLM\..\RunServices: [Microsoft Update] muamgrd.exe
O4 - HKCU\..\Run: [System Update] C:\WINDOWS\System\services.exe
O4 - HKCU\..\Run: [Updater] C:\Programmi\Carpe
Diem\ParisVoyeur\CDUpdater.exe CD_UPDATER
O4 - HKCU\..\Run: [OEM32 Tools] sres32.exe
O4 - HKCU\..\Run: [NVIDIA Video drivers] video_32sD.exe
O4 - HKCU\..\Run: [FASTTRACKPassepartout] C:\WINDOWS\Passepartout.exe -A
O4 - Startup: C6 Messenger.lnk = C:\TinMessenger\c6Messenger.exe
O4 - Global Startup: Alice ti aiuta.lnk = C:\Programmi\Alice ti
aiuta\bin\matcli.exe
O4 - Global Startup: Digimax Viewer 2.1.lnk = ?
O4 - Global Startup: Reality Fusion GameCam SE.lnk = ?
O9 - Extra button: Organizzatore ricerche -
{9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Programmi\File comuni\Microsoft
Shared\Encarta Researcher\EROProj.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no
file)
O9 - Extra button: Umail - {765D3639-7563-4ABE-A1CC-4F3338767226} -
http://www.umail.it
 (file missing) (HKCU)
O12 - Plugin for .mp3: C:\Programmi\Internet
Explorer\PLUGINS\npqtplugin4.dll
O14 - IERESET.INF: START_PAGE_URL=
http://www.virgilio.it/free
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1148827932968
O16 - DPF: {DB893839-10F0-4AF9-92FA-B23528F530AF} -
http://deposito.trafficredlight.net/10335-23.exe
O17 -
HKLM\System\CCS\Services\Tcpip\..\{0D4A449F-DA8B-4213-9E24-FA8B5A6CCFB5}:
NameServer = 85.37.17.11 85.38.28.69
O17 -
HKLM\System\CS1\Services\Tcpip\..\{0D4A449F-DA8B-4213-9E24-FA8B5A6CCFB5}:
NameServer = 85.37.17.11 85.38.28.69
O21 - SSODL: ACBDEHEG - {26BC45FC-3992-28BE-03A5-271B57EB0CD6} -
C:\WINDOWS\System32\Bbdclbdh.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation -
C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec
Corporation - C:\Programmi\File comuni\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation -
C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe
O23 - Service: Windows Update Service (muamgrd) - Unknown owner -
C:\WINDOWS\System32\muamgrd.exe (file missing)
O23 - Service: Servizio Norton AntiVirus Auto-Protect (navapsvc) - Symantec
Corporation - C:\Programmi\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -
C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware -
C:\Programmi\SiSoftware\SiSoftware Sandra Lite 2005\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware -
C:\Programmi\SiSoftware\SiSoftware Sandra Lite 2005\RpcSandraSrv.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Programmi\Norton
AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation -
C:\PROGRA~1\FILECO~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SmartLinkService (SLService) -   -
C:\WINDOWS\SYSTEM32\slserv.exe

 C:\WINDOWS\System32\muamgrd.exe (file missing)
*Fix*
*Istruzioni*
Chiudi tutte le applicazioni, lancia di nuovo Hijackthis e seleziona con
attenzione solo le caselle di controllo a lato di ogni singola voce sopra
indicata, quindi premi
il pulsante _Fix checked_.
Lascia che HJT esegua la pulizia, se non riesce del tutto, riavvia il
computer, lancia ancora una volta HJT, seleziona le stesse caselle di
controllo o quelle rimanenti rispetto alla precedente scansione e premi di
nuovo il pulsante _Fix checked_.
Una volta terminata l'operazione di disinfezione di Hijackthis, apri
Pannello di controllo -> Opzioni internet -> Programmi -> premi il pulsante
"Ripristina impostazioni web" -> OK.
Riavvia Internet Explorer.
Poi segui il Punto 1, qui:
http://www.microsoft.com/italy/technet/community/mvp/editoriali/spyware.mspx#E5C
Usa anche CCleaner 
http://www.ccleaner.com/
 e Free History Eraser
http://smartprotector.com/eraser/free-history-eraser.htm
Attenzione: il computer è infettato /alla grande/, quindi segui con cura le
istruzioni e leggi i documenti ai link che ti ho indicato.
Se il problema non si risolve devi seguire qui:
http://www.microsoft.com/italy/technet/community/mvp/editoriali/spyware.mspx
-- 
Vincenzo Di Russo
Microsoft® MVP - Most Valuable Professional
Windows - Internet Explorer since 2003
My home: 
http://mvp.support.microsoft.com/
My Blog:  
http://blogs.dotnethell.it/vincent/

 Gli aggiornamenti in Windows Update quando li fai? <eg>
L'ho sto effettuando ora...... ti faccio presente che č il pc di mia sorella
che solo ora riesce a funzionare e  gli ho configurato la posta
elettronica.... ti rimando il nuovo log....
Logfile of HijackThis v1.99.1
Scan saved at 18.11.15, on 12/08/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Programmi\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\System32\rundll32.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Programmi\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
C:\Programmi\Samsung\Digimax Viewer 2.1\STImgBrowser.exe
C:\Programmi\Reality Fusion\Reality Fusion GameCam SE\Program\RFTRay.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\SoftwareDistribution\Download\7915ca6866cbb46ca11b392f0fc8c9d7\up
date\update.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Alex\Impostazioni locali\Temp\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://g.msn.it/0SEITIT/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://www.virgilio.it/free
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak =
http://www.libero.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
Collegamenti
O1 - Hosts: 207.44.196.219 
auto.search.msn.com
 #NETVISION

O4 - HKLM\..\Run: [Microsoft Update] muamgrd.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE
C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CnxTrApp] rundll32.exe "C:\Programmi\Pirelli\Access
Gateway USB Network\CnxTrApp.dll",AppEntry -REG "Pirelli\Access Gateway USB"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [NVIDIA Video drivers] video_32sD.exe
O4 - Global Startup: Digimax Viewer 2.1.lnk = ?
O4 - Global Startup: Reality Fusion GameCam SE.lnk = ?
O9 - Extra button: Organizzatore ricerche -
{9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Programmi\File comuni\Microsoft
Shared\Encarta Researcher\EROProj.dll
O9 - Extra button: Umail - {765D3639-7563-4ABE-A1CC-4F3338767226} -
http://www.umail.it
 (file missing) (HKCU)
O12 - Plugin for .mp3: C:\Programmi\Internet
Explorer\PLUGINS\npqtplugin4.dll
O14 - IERESET.INF: START_PAGE_URL=
http://www.virgilio.it/free
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_
site.cab?1148827932968
O17 -
HKLM\System\CCS\Services\Tcpip\..\{0D4A449F-DA8B-4213-9E24-FA8B5A6CCFB5}:
NameServer = 85.37.17.11 85.38.28.69
O17 -
HKLM\System\CS1\Services\Tcpip\..\{0D4A449F-DA8B-4213-9E24-FA8B5A6CCFB5}:
NameServer = 85.37.17.11 85.38.28.69
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation -
C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec
Corporation - C:\Programmi\File comuni\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation -
C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe
O23 - Service: Windows Update Service (muamgrd) - Unknown owner -
C:\WINDOWS\System32\muamgrd.exe (file missing)


 C:\WINDOWS\System32\muamgrd.exe (file missing)
*Fix*
Segui le stesse istruzioni di cui alla mia precedente risposta.


 Antonietta wrote:
Cut.
Ho  effettuato le cancellazioni da te indicate in più ho cancellato Msn
Norton e umail.
er quanto riguarda l'aggiornamento non è stato possibile in quanto come al
solito la versione di win xp non è originale..... il pc l'ha assemblato un
collega di ufficio di mia sorella la quale domani chiederà spiegazioni del
fatto.
Questo è il nuovo log:
Logfile of HijackThis v1.99.1
Scan saved at 11.45.05, on 13/08/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Programmi\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\WINDOWS\System32\RUNDLL32.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Programmi\Samsung\Digimax Viewer 2.1\STImgBrowser.exe
C:\Programmi\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Alex\Impostazioni locali\Temp\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://g.msn.it/0SEITIT/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.google.it/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Programmi\File comuni\Roxio
Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Programmi\Roxio\Easy CD Creator
6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Programmi\Roxio\Easy CD Creator
6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [EPSON Stylus C64 Series]
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus
C64 Series" /O6 "USB001" /M "Stylus C64"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [QuickTime Task]
"C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE
C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [NVIDIA Video drivers] video_32sD.exe
O4 - Global Startup: Digimax Viewer 2.1.lnk = ?
O9 - Extra button: Organizzatore ricerche -
{9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Programmi\File comuni\Microsoft
Shared\Encarta Researcher\EROProj.dll
O12 - Plugin for .mp3: C:\Programmi\Internet
Explorer\PLUGINS\npqtplugin4.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_
site.cab?1148827932968
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Windows Update Service (muamgrd) - Unknown owner -
C:\WINDOWS\System32\muamgrd.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -
C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware -
C:\Programmi\SiSoftware\SiSoftware Sandra Lite 2005\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware -
C:\Programmi\SiSoftware\SiSoftware Sandra Lite 2005\RpcSandraSrv.exe
O23 - Service: SmartLinkService (SLService) -   -
C:\WINDOWS\SYSTEM32\slserv.exe
L'unico che non riesco a cancellare dopo svariati tentativi è O23 - Service:
Windows Update Service (muamgrd) - Unknown owner -
C:\WINDOWS\System32\muamgrd.exe (file missing)....... che mi consigli di
fare?
Un dubbio mi sorge con il  O4 - HKLM\..\Run: [nwiz] nwiz.exe
/install............ a che serve?
Ti ringrazio tanto per il tuoi preziosi consigli

 Ti ringrazio tanto per il tuoi preziosi consigli
Prego.


 ha scritto nel messaggio
news:4k93deF...@individual.net...


 eseguibile C:\WINDOWS\System32\muamgrd.exe; tipo di avvio automatico;
[...]
Da services.msc modifica lo stato del servizio da "Automatico" a
"Disabilitato", poi eliminalo con sc delete.


 Ed è questo che devi eliminare con sc.exe delete.
[...]
Se non te la senti di eseguire l'operazione, prova a lanciare questi Removal
Tools (che rimuovono tutte le varianti di Agobot/Gaobot):
http://www.symantec.com/enterprise/security_response/writeup.jsp?docid=2004-011316-4140-99
http://www.microsoft.com/italy/security/malwareremove/default.mspx
