eccolo qui il log, c'è il verme

[marinaseal]

ho trovato la cartella Backups che mi dicevi, non c'è nessun riferimento a Hijack ma le date coincidono, dovrebbe essere quella. Come fò a ripristinare solo il file sano?
ciao marinaseal

[Luke57]

In effetti, se la apri ci trovi le voci fissata, ma capire quella da ripristinare... procedi nell'altro modo che ti ho descritto, cliccando "view the list of backups"

[Luke57]

Marina, ho detto una cavolata, apri i file all'interno della cartella con il blocco note e leggi la descrizione. Dovresti trovarlo.

[marinaseal]

ne ho trovati 2, il 1° è questo:
; Sample INF file for WEBSCAN.DLL
[version]
; version signature (same for both NT and Win95) do not remove
signature="$CHICAGO$"
AdvancedINF=2.0

[Add.Code]
webscan.dll=webscan.dll
arclib.dll=arclib.dll

; needed DLL
[webscan.dll]
file-win32-x86=thiscab
clsid={7B297BFD-85E4-4092-B2AF-16A91B2EA103}
RegisterServer=yes
FileVersion=1,1,0,1045

[arclib.dll]
file-win32-x86=thiscab
FileVersion=7,2,0,17
RegisterServer=No
DestDir=10

; end of INF file

e il 2° è:

;INF file for PPSDKActiveXScanner.ocx
;DestDir can be 10 for Windows directory, 11 for Windows\System(32) directory, or left blank for the Occache directory.

[version]
signature="$CHICAGO$"
AdvancedINF=2.0

[DefaultInstall]
CopyFiles=install.files
RegisterOCXs=RegisterFiles
AddReg=AddToRegistry

[RInstallApplicationFiles]
CopyFiles=install.files
RegisterOCXs=RegisterFiles
AddReg=AddToRegistry
[DestinationDirs]
install.files=11

[SourceDisksNames]
1=%DiskName%,PPSDKActiveXScanner.CAB,1

[Add.Code]
PPSDKActiveXScanner.ocx=PPSDKActiveXScanner.ocx
MSCOMCTL.OCX=MSCOMCTL.OCX
msvbvm60.dll=msvbvm60.dll

[install.files]
PPSDKActiveXScanner.ocx=PPSDKActiveXScanner.ocx
MSCOMCTL.OCX=MSCOMCTL.OCX
msvbvm60.DLL=msvbvm60.DLL

[SourceDisksFiles]
PPSDKActiveXScanner.ocx=1
MSCOMCTL.OCX=1
msvbvm60.dll=1

[PPSDKActiveXScanner.ocx]
file-win32-x86=thiscab
RegisterServer=yes
clsid={2FC9A21E-2069-4E47-8235-36318989DB13}
DestDir=
FileVersion=1,5,0,5

[MSCOMCTL.OCX]
file-win32-x86=thiscab
RegisterServer=yes
clsid={1EFB6596-857C-11D1-B16A-00C0F0283628}
DestDir=11
FileVersion=6,0,88,62

[msvbvm60.dll]
file-win32-x86=thiscab
RegisterServer=no
DestDir=11
FileVersion=6,0,89,64

[Setup Hooks]
AddToRegHook=AddToRegHook

[AddToRegHook]
InfSection=DefaultInstall2

[DefaultInstall2]
AddReg=AddToRegistry

[AddToRegistry]
HKLM,"SOFTWARE\Classes\CLSID\{2FC9A21E-2069-4E47-8235-36318989DB13}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}"
HKLM,"SOFTWARE\Classes\CLSID\{2FC9A21E-2069-4E47-8235-36318989DB13}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}"
HKCR,"Licenses",,,"Licensing: Copying the keys may be a violation of established copyrights."

[RegisterFiles]
%11%\MSCOMCTL.OCX
%11%\PPSDKActiveXScanner.ocx

Quale dei due Luke?

[marinaseal]

ciao
tento la procedura "view the list of backups" e "restore". Provo e faccio il log per vedere se ha funzionato, grazie Luke!!!! sei davvero un'ottima persona, ora che ho risanato il pc mi dispiace quasi...
marinaseally

[Luke57]

Troppo buona....

[marinaseal]

hooops... non volevo metterti in imbarazzo ma ringraziarti!!!
il restore ha funzionato, e ho risolto i problemi segnalati da CCleaner (penso, spero...) poi magari faccio una passatina con l'utility RegCleaner. Segnalo a tutti (da windows 2000 in su) microsoft antispyware e SP2, e l'update microsoft dopo aver fatto una scansione free on line con F-secure (http://www.f-secure.com) che trova virus, dialer e quant'altro (non li elimina ma poi si può intervenire con Hijack)
ciao marinaseal

...e questo è l'ultimo log:
Logfile of HijackThis v1.99.1
Scan saved at 0.11.00, on 07/01/06
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\ATI2PLXX.EXE
C:\WINDOWS\SYSTEM\INETSRV\INETINFO.EXE
C:\PROGRAMMI\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
c:\windows\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\MSDTCW.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\ATIPTAXX.EXE
C:\WINDOWS\SYSTEM\ATI2CWXX.EXE
C:\WINDOWS\SYSTEM\PWSTRAY.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAMMI\A-DATA\USB FLASH DISK UTILITY\PLBKMON.EXE
C:\PROGRAMMI\ALWIL SOFTWARE\AVAST4\ASHWEBSV.EXE
C:\PROGRAMMI\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAMMI\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fornito da Infostrada LIBERO
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.libero.it:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe
O4 - HKLM\..\Run: [Ati2cwxx] Ati2cwxx.exe
O4 - HKLM\..\Run: [PWSTray] PwsTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [ADATA_PLUtil] C:\Programmi\A-DATA\USB Flash Disk Utility\PLBkMon.exe
O4 - HKLM\..\Run: [avast! Web Scanner] C:\PROGRA~1\ALWILS~1\AVAST4\ASHWEBSV.EXE
O4 - HKLM\..\Run: [CriticalUpdate] c:\windows\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\AVAST4\ashmaisv.exe
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [ATIPOLAB] ati2plxx.exe
O4 - HKLM\..\RunServices: [MSDTC] msdtcw -start
O4 - HKLM\..\RunServices: [inetinfo.exe] C:\WINDOWS\SYSTEM\inetsrv\inetinfo.exe -e w3svc
O4 - HKLM\..\RunServices: [avast!] C:\Programmi\Alwil Software\Avast4\ashServ.exe
O4 - HKLM\..\RunServices: [KB891711] c:\windows\SYSTEM\KB891711\KB891711.EXE
O4 - Startup: Vodafone Mobile Connect Card.lnk = C:\Programmi\Vodafone\VodafoneMobileConnectCard\VodafoneMobileConnectCard.exe
O10 - Broken Internet access because of LSP provider 'c:\programmi\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll' missing
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by105fd.bay105.hotmail.msn.com/r ... nPUpld.cab
O16 - DPF: {94EB57FE-2720-496C-B33F-D9353C6E23F7} (F-Secure Online Scanner 2.1) - http://support.f-secure.com/ols/fscax.cab