Here below the log of Combo Fix (note that I had NAV running during the combo fix scanning and he detected some Combo Fix script as viruses: to allow Combo fix to finish the scanning activity I set the NAV to allow Combo Fix script to be run anyway. is it correct ???) :
ComboFix 07-09-18.4 - "Utente1" 2007-09-19 5.00.49.1 -
FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.39.1040.18.372 [GMT 2:00]
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\drivers\npf.sys
C:\WINDOWS\system32\packet.dll
C:\WINDOWS\system32\pthreadVC.dll
C:\WINDOWS\system32\wanpacket.dll
C:\WINDOWS\system32\wpcap.dll
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
——-\LEGACY_NPF
——-\NPF
((((((((((((((((((((((((( Files Created from 2007-08-19 to 2007-09-19 )))))))))))))))))))))))))))))))
.
2007-09-19 04:59 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-09-18 23:15 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-09-18 14:31 52,255 –a—— C:\MfkajHH.exe
2007-09-17 17:55 95,608 –a—— C:\WINDOWS\system32\AvastSS.scr
2007-09-17 17:55 94,416 –a—— C:\WINDOWS\system32\drivers\aswmon2.sys
2007-09-17 17:55 92,848 –a—— C:\WINDOWS\system32\drivers\aswmon.sys
2007-09-17 17:55 801,144 –a—— C:\WINDOWS\system32\aswBoot.exe
2007-09-17 17:55 42,912 –a—— C:\WINDOWS\system32\drivers\aswTdi.sys
2007-09-17 17:55 26,624 –a—— C:\WINDOWS\system32\drivers\aavmker4.sys
2007-09-17 17:55 23,152 –a—— C:\WINDOWS\system32\drivers\aswRdr.sys
2007-09-17 14:31 52,255 –a—— C:\sillyh0r.exe
2007-09-17 10:15 52,255 –a—— C:\OnHfa.exe
2007-09-17 10:14 29,429 -r-hs—- C:\WINDOWS\WinBool32.exe
2007-09-16 19:33 52,255 –a—— C:\LfjJGb.exe
2007-09-16 11:48 52,255 –a—— C:\naabb.exe
2007-09-15 18:33 52,255 –a—— C:\Wintemp_01.exe
2007-09-15 15:43 22,756 -r-hs—- C:\WINDOWS\winfp.exe
2007-09-14 22:30 d——– C:\Programmi\CCleaner
2007-09-14 21:19 212,480 –a—— C:\WINDOWS\pcdlib32.dll
2007-09-14 21:19 163,840 –a—— C:\WINDOWS\system32\PhotoImpression Screen Saver.scr
2007-09-14 21:18 708,696 –a—— C:\WINDOWS\system32\python21.dll
2007-09-14 21:18 57,344 –a—— C:\WINDOWS\system32\PyWinTypes21.dll
2007-09-14 21:18 290,919 –a—— C:\WINDOWS\system32\pythoncom21.dll
2007-09-14 21:18 d——– C:\Programmi\File comuni\Python
2007-09-14 21:15 96,768 –a—— C:\WINDOWS\SlantAdj.dll
2007-09-14 21:15 73,216 –a—— C:\WINDOWS\ADE.DLL
2007-09-14 21:15 3,136 –a—— C:\WINDOWS\Ade001.bin
2007-09-14 21:14 86,016 –a—— C:\WINDOWS\system32\Epfb5cpl.dll
2007-09-14 17:10 d——– C:\DOCUME~1\Utente1\DATIAP~1\Publish Providers
2007-09-14 17:08 d——– C:\DOCUME~1\Utente1\DATIAP~1\Sony
2007-09-14 17:02 d——– C:\Programmi\Sony
2007-09-14 17:01 d——– C:\Programmi\Vstplugins
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-15 21:12 318 –a—— C:\delete.bat
2007-09-08 17:33 737280 –a—— C:\WINDOWS\iun6002.exe
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\dllcache\cdm.dll
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\dllcache\wuapi.dll
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\dllcache\wuauclt.exe
2007-07-30 19:19 43352 –a—— C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\dllcache\wucltui.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\dllcache\wuweb.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\dllcache\wuaueng.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\wups.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\dllcache\wups.dll
2007-07-27 20:07 ——— d——– C:\Programmi\SmartMusic 9
2007-07-23 14:47 48640 –a—— C:\WINDOWS\system32\SKCA32.dll
2007-07-23 14:47 104960 –a—— C:\WINDOWS\system32\KEYLIB32.dll
2007-07-19 08:53 3583488 –a—— C:\WINDOWS\system32\dllcache\mshtml.dll
2007-07-13 01:30 765952 –a—— C:\WINDOWS\system32\dllcache\vgx.dll
2007-06-27 15:48 318464 –a—— C:\WINDOWS\system32\dllcache\unregmp2.exe
2007-06-27 15:23 823808 –a—— C:\WINDOWS\system32\dllcache\wininet.dll
2007-06-27 15:23 232960 ——— C:\WINDOWS\system32\dllcache\webcheck.dll
2007-06-27 15:22 671232 –a—— C:\WINDOWS\system32\dllcache\mstime.dll
2007-06-27 15:22 6058496 ——— C:\WINDOWS\system32\dllcache\ieframe.dll
2007-06-27 15:22 52224 ——— C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-06-27 15:22 477696 –a—— C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-06-27 15:22 459264 ——— C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-06-27 15:22 44544 ——— C:\WINDOWS\system32\dllcache\iernonce.dll
2007-06-27 15:22 27648 –a—— C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-06-27 15:22 267776 ——— C:\WINDOWS\system32\dllcache\iertutil.dll
2007-06-27 15:22 193024 –a—— C:\WINDOWS\system32\dllcache\msrating.dll
2007-06-27 15:22 1152000 –a—— C:\WINDOWS\system32\dllcache\urlmon.dll
2007-06-27 15:22 105984 ——— C:\WINDOWS\system32\dllcache\url.dll
2007-06-27 15:22 102400 ——— C:\WINDOWS\system32\dllcache\occache.dll
2007-06-27 15:21 384512 ——— C:\WINDOWS\system32\dllcache\iedkcs32.dll
2007-06-27 15:21 383488 ——— C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-06-27 15:21 230400 ——— C:\WINDOWS\system32\dllcache\ieaksie.dll
2007-06-27 15:21 153088 ——— C:\WINDOWS\system32\dllcache\ieakeng.dll
2007-06-27 15:21 132608 –a—— C:\WINDOWS\system32\dllcache\extmgr.dll
2007-06-27 15:21 124928 ——— C:\WINDOWS\system32\dllcache\advpack.dll
2007-06-27 10:28 625152 ——— C:\WINDOWS\system32\dllcache\iexplore.exe
2007-06-27 10:27 63488 ——— C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-06-27 10:27 13824 ——— C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-06-27 09:00 161792 –a—— C:\WINDOWS\system32\dllcache\ieakui.dll
2007-06-26 18:03 73216 –a—— C:\WINDOWS\ST6UNST.EXE
2007-06-26 18:03 294912 ——— C:\WINDOWS\Setup1.exe
2007-06-26 08:08 1104896 –a—— C:\WINDOWS\system32\msxml3.dll
2007-06-26 08:08 1104896 ——— C:\WINDOWS\system32\dllcache\msxml3.dll
2007-06-19 15:30 282112 –a—— C:\WINDOWS\system32\gdi32.dll
2007-06-19 15:30 282112 ——— C:\WINDOWS\system32\dllcache\gdi32.dll
2004-11-05 21:52:38 56 –sh–r C:\WINDOWS\system32\2D7C85C35C.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"zBrowser Launcher"="C:\Program Files\Logitech\iTouch\iTouch.exe" [2002-02-25 01:59]
"Cmaudio"="cmicnfg.cpl" []
"ATIPTA"="C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 12:52]
"o2cd"="C:\Programmi\O2Micro\AudioDJ\o2cd.exe" [2003-01-06 20:45]
"ccApp"="C:\Programmi\File comuni\Symantec Shared\ccApp.exe" [2006-04-04 12:02]
"Logitech Utility"="Logi_MwX.Exe" [2003-12-17 19:50 C:\WINDOWS\LOGI_MWX.EXE]
"mmtask"="c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe" []
"InCD"="C:\Programmi\Ahead\InCD\InCD.exe" [2003-12-05 11:25]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50]
"Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2005-08-09 20:45]
"SSBkgdUpdate"="C:\Programmi\File comuni\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-09-29 16:00]
"SpamTerminator"="C:\Programmi\Spam Terminator\terminator.exe" [2007-03-07 10:59]
"EPSON Stylus Photo R220 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIE.exe" [2005-03-09 06:00]
"QuickTime Task"="C:\Programmi\QuickTime\qttask.exe" [2006-09-09 11:01]
"TkBellExe"="C:\Programmi\File comuni\Real\Update_OB\realsched.exe" [2006-09-12 11:17]
"ATICCC"="C:\Programmi\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 11:12]
"SunJavaUpdateSched"="C:\Programmi\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"Audio Device Manager"="winfp.exe" [2007-09-15 13:42 C:\WINDOWS\winfp.exe]
"Windows Bool Service"="WinBool32.exe" [2007-09-17 10:14 C:\WINDOWS\WinBool32.exe]
"avast!"="H:\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OM_Monitor"="C:\Programmi\OLYMPUS\OLYMPUS Master\Monitor.exe" [2005-10-20 10:21]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 00:39]
"swg"="C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-23 15:30]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Spyware Doctor"="C:\Programmi\Spyware Doctor\swdoctor.exe" /Q
R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\WINDOWS\system32\drivers\sfsync03.sys
R0 Stealth;Stealth;C:\WINDOWS\system32\DRIVERS\stealth.sys
R1 NPPTNT;NPPTNT;\??\C:\WINDOWS\System32\npptNT.sys
R1 o2adj;o2adj;C:\WINDOWS\system32\drivers\o2adj.sys
R1 papycpu;papycpu;C:\WINDOWS\system32\drivers\papycpu.sys
R1 papyjoy;papyjoy;C:\WINDOWS\system32\drivers\papyjoy.sys
R1 VIAPFD;VIAPFD;C:\WINDOWS\system32\Drivers\VIAPFD.SYS
R2 CVPND;Cisco Systems, Inc. VPN Service;"C:\Programmi\Cisco Systems\VPN Client\cvpnd.exe"
R2 CVPNDRVA;Cisco Systems Inc. IPSec Driver;\??\C:\WINDOWS\system32\Drivers\CVPNDRVA.sys
R2 IOSLINK;IOSLINK;\??\C:\WINDOWS\system32\drivers\IosLink.sys
R3 DNE;Deterministic Network Enhancer Miniport;C:\WINDOWS\system32\DRIVERS\dne2000.sys
R3 itchfltr;iTouch Keyboard Filter;C:\WINDOWS\system32\DRIVERS\itchfltr.sys
R3 usbscan;Driver scanner USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys
R3 USBSTOR;Driver archiviazione di massa USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
S3 CVirtA;Cisco Systems VPN Adapter;C:\WINDOWS\system32\DRIVERS\CVirtA.sys
S3 MSIRCOMM;Microsoft IR Communications Driver;C:\WINDOWS\system32\DRIVERS\MSIRCOMM.sys
S3 PhilCam8116;Logitech QuickCam Pro 3000(PID_08B0);C:\WINDOWS\system32\DRIVERS\CamDrL21.sys
S3 StMp3Rec;Player Recovery Device Control Driver;C:\WINDOWS\system32\Drivers\StMp3Rec.sys
S3 TIACXLN;U.S. Robotics 22Mbps Wireless Lan Adapter;C:\WINDOWS\system32\DRIVERS\tiacxln.sys
S3 ZD1211U(Acer);Acer WLAN 11g USB adapter(Acer);C:\WINDOWS\system32\DRIVERS\zd1211u.sys
S3 ZDPNDIS5;ZDPNDIS5 NDIS Protocol Driver;\??\C:\WINDOWS\system32\ZDPNDIS5.SYS
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I]
AutoRun\command- I:\aow2Installer.exe
.
Contents of the 'Scheduled Tasks' folder
"2007-09-14 18:01:06 C:\WINDOWS\Tasks\Norton AntiVirus - Scansione del computer - Utente1.job"
- C:\PROGRA~1\NORTON~1\Navw32.exe
"2007-09-18 20:40:22 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Programmi\Symantec\LiveUpdate\NDETECT.EXE
.
**************************************************************************
catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2007-09-19 05:07:41
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-09-19 5:20:20 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-09-19 05:20
.
— E O F —
And here is the new HijackThis log:
Logfile of HijackThis v1.99.1
Scan saved at 5.33.06, on 19/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
H:\Alwil Software\Avast4\aswUpdSv.exe
H:\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe
C:\Programmi\Cisco Systems\VPN Client\cvpnd.exe
C:\Programmi\Ahead\InCD\InCDsrv.exe
C:\Programmi\Norton AntiVirus\navapsvc.exe
C:\Programmi\Norton AntiVirus\SAVScan.exe
C:\Programmi\Spyware Doctor\sdhelp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe
C:\Programmi\File comuni\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Programmi\O2Micro\AudioDJ\o2cd.exe
C:\Programmi\File comuni\Symantec Shared\ccApp.exe
C:\Programmi\Ahead\InCD\InCD.exe
C:\Programmi\Spam Terminator\terminator.exe
C:\Programmi\Logitech\MouseWare\system\em_exec.exe
C:\Programmi\QuickTime\qttask.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\Programmi\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\winfp.exe
C:\WINDOWS\WinBool32.exe
H:\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Programmi\ATI Technologies\ATI.ACE\CLI.EXE
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Fastweb\PrintAndFax\FaxMonitor.exe
C:\Programmi\ATI Technologies\ATI.ACE\cli.exe
C:\Programmi\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Programmi\USR WLAN\USR 22Mbps WLAN Adapter\USRWLAN.EXE
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\anti-spyware\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.virgilio.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar6.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmi\Norton AntiVirus\NavShExt.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmi\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar6.dll
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ATIPTA] C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [o2cd] C:\Programmi\O2Micro\AudioDJ\o2cd.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [InCD] C:\Programmi\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SSBkgdUpdate] C:\Programmi\File comuni\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe -Embedding -boot
O4 - HKLM\..\Run: [SpamTerminator] C:\Programmi\Spam Terminator\terminator.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo R220 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIE.EXE /P30 "EPSON Stylus Photo R220 Series" /O6 "USB002" /M "Stylus Photo R220"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ATICCC] "C:\Programmi\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Audio Device Manager] winfp.exe
O4 - HKLM\..\Run: [Windows Bool Service] WinBool32.exe
O4 - HKLM\..\Run: [avast!] H:\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [OM_Monitor] C:\Programmi\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: U.S.Robotics WLAN Adapter Configuration Utility.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: VPN Client.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: PrintAndFax.lnk = C:\Programmi\Fastweb\PrintAndFax\FaxMonitor.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://global.acer.com/
O16 - DPF: Yahoo! Chess -
http://download.games.yahoo.com/games/clients/y/ct1_x.cab
O16 - DPF: {0D3DA946-2C29-430D-8299-82E235FDDAF2} (Progetto1.UserDocument1) - file://E:\esercizi della guida per i docenti\urldetect.CAB
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://www.lizardtech.com/download/files/w…ntrol_en_US.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {27721C1D-DAFA-4E59-A4DC-2181F7983CA5} (Progetto1.UserControl1) - file://E:\mat_test\Randomize.CAB
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) -
http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
http://moiraghinoonthenet.spaces.live.com/…ad/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) -
http://messenger.zone.msn.com/IT-IT/a-UNO1/GAME_UNO1.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} -
http://a1540.g.akamai.net/7/1540/52/200310…llInstaller.exe
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {79E0C1C0-316D-11D5-A72A-006097BFA1AC} (EPSON Web Printer-SelfTest Control Class) -
http://esupport.epson-europe.com/selftest/…rg/ESTPTest.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) -
http://www.sibelius.com/download/software/…tiveXPlugin.cab
O16 - DPF: {AC41A5D9-F968-4EAC-BC29-2733E5691E40} (Progetto1.UserControl1) - file://E:\esercizi della guida per i docenti\Randomize.CAB
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {DD037015-16C1-40DE-A637-B15C7EB0A312} (Progetto1.UserDocument1) - file://E:\mat_test\urldetect.CAB
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - H:\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - H:\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - H:\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - H:\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Programmi\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - AHEAD Software - C:\Programmi\Ahead\InCD\InCDsrv.exe
O23 - Service: Servizio Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Programmi\Norton AntiVirus\navapsvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SAVScan - Symantec Corporation - C:\Programmi\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FILECO~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Programmi\Spyware Doctor\sdhelp.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\Security Center\SymWSC.exe
:
- ajnvmupko (in a folder that does not exist in the computer !!)
- C:\jblqnuri.exe
- rqfogxcu.exe (in a folder that does not exist in the computer !!)
The problem is that the antivirus can't eliminate them. Can you please help
me! 
Angie
: no more viruses detected by NAV, no more problems with "incd" service, no more system memory allocation growing-up by Windows, I hope no more Adware, Spyware or Malware in there.