PROBLEMA RISOLTO......si era (e non sò come sia accaduto) cambiata la data del pc..... anno 2047 (invece di 2008). nessun virus. Adesso sono "infestato" da almeno 7 antivirus.
Giò! grazie per l'aiuto.
Buon proseguimento.

Fatto sta che non riesco a collegarmi alla vpn ceck point e qualcosa mi cambia le password memorizzate sia di msn messanger sia di dada..... inoltre non riesco più ad aprire i files per ascoltare musica da stazioni radio online .... nè a fare update microsoft. Cosa posso fare ancora?

gio!............... aiutoooooo

non riesco a postare l'intero url .... ma credo di capisca

spero di non aver sbagliato nulla
sendmefile.com/00647335

sendmefile.com/00647335

provvedo...... come si disattiva l'AV??? ho inserito tanti di quegli antivirus che non ci capisco più nulla. il files CNAB4RPK.EXE era associato all'installazione di una stampante canon che ho provveduto a disinstallare.

aggiungo inoltre che ho provveduto ad eliminare MSN MESSANGER poichè ogni qualvolta accedo mi dice che la password non è corretta. Ed anche se la cambio dopo qualche accesso il problema risorge.

nel frattempo ho utilizzato AVAST! e mi ha trovato un worm. ho ritenuto utile adesso rifare il log che allego.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21.52.09, on 07/09/2047
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\WINNT\System32\tcpsvcs.exe
C:\VIRUSfighter\Bin\Zanda.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Programmi\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Programmi\CheckPoint\SecuRemote\bin\SR_Service.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\WINNT\system32\CNAB4RPK.EXE
C:\WINNT\Explorer.EXE
C:\Programmi\CheckPoint\SecuRemote\bin\SR_GUI.exe
C:\VIRUSfighter\bin\ZLH.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\Programmi\MSN Messenger\msnmsgr.exe
C:\WINNT\system32\taskmgr.exe
C:\Programmi\Outlook Express\MSIMN.EXE
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings--\Desktop\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM..\Run: [Norman ZANDA] C:\VIRUSfighter\bin\ZLH.EXE /LOAD /SPLASH
O4 - HKLM..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKUS.DEFAULT..\Run: [internat.exe] internat.exe (User 'Default user')
O4 - HKUS.DEFAULT..\RunOnce: [^SetupICWDesktop] C:\Programmi\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O17 - HKLM\System\CCS\Services\Tcpip..{27ECA100-F0ED-4A61-98BA-FE4E12CB44B1}: NameServer = 88.149.128.12,88.149.128.22
O17 - HKLM\System\CS1\Services\Tcpip..{27ECA100-F0ED-4A61-98BA-FE4E12CB44B1}: NameServer = 88.149.128.12,88.149.128.22
O17 - HKLM\System\CS2\Services\Tcpip..{27ECA100-F0ED-4A61-98BA-FE4E12CB44B1}: NameServer = 88.149.128.12,88.149.128.22
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Servizio amministrativo di Gestione disco logico (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Norman NJeeves - Unknown owner - C:\VIRUSfighter\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Unknown owner - C:\VIRUSfighter\Bin\Zanda.exe
O23 - Service: Check Point SecuRemote Service (SR_Service) - Check Point Software Technologies - C:\Programmi\CheckPoint\SecuRemote\bin\SR_Service.exe
O23 - Service: Check Point SecuRemote WatchDog (SR_WatchDog) - Check Point Software Technologies - C:\Programmi\CheckPoint\SecuRemote\bin\SR_WatchDog.exe

End of file - 3882 bytes

sPERO DI NON AVER SBAGLIATO...... qualke operazione.

File CNAB4RPK.EXE ricevuto il 2008.07.16 18:51:10 (CET)
AntivirusVersioneUltimo aggiornamentoRisultatoAhnLab-V32008.7.16.02008.07.16-AntiVir7.8.0.682008.07.16-Authentium5.1.0.42008.07.15-Avast4.8.1195.02008.07.16-AVG7.5.0.5162008.07.16-BitDefender7.22008.07.16-CAT-QuickHeal9.502008.07.16-ClamAV0.93.12008.07.16-DrWeb4.44.0.091702008.07.16-eSafe7.0.17.02008.07.16-eTrust-Vet31.6.59592008.07.16-Ewido4.02008.07.16-F-Prot4.4.4.562008.07.15-F-Secure7.60.13501.02008.07.16-Fortinet3.14.0.02008.07.16-GData2.0.7306.10232008.07.16-IkarusT3.1.1.26.02008.07.16-Kaspersky7.0.0.1252008.07.16-McAfee53392008.07.15-Microsoft1.37042008.07.16-NOD32v232722008.07.16-Norman5.80.022008.07.16-Panda9.0.0.42008.07.16-Prevx1V22008.07.16-Rising20.53.22.002008.07.16-Sophos4.31.02008.07.16-Sunbelt3.1.1536.12008.07.15-Symantec102008.07.16-TheHacker6.2.96.3812008.07.16-TrendMicro8.700.0.10042008.07.16-VBA323.12.8.02008.07.16-VirusBuster4.5.11.02008.07.16-Webwasher-Gateway6.6.22008.07.16-
Informazioni addizionaliFile size: 57344 bytesMD5...: b0c2c7180063782c5dd6f84b9c1b359aSHA1..: b9dfe432f507e934e7286d40352bf6c98ba5d8c7SHA256: 491005372fd077bfdcdc5eb89256683f18b74b5d77b48edba7f3fd4dd18b5358SHA512: 8df799bfcf699c54076a71b021f3383f21062c517b625021684c87a49de2454a<BR>e3f984256060fb262e1b57ec967531c4d7406c41479cacdca29005f01ad15542PEiD..: Armadillo v1.71PEInfo: PE Structure information<BR><BR>( base data )<BR>entrypointaddress.: 0x403393<BR>timedatestamp.....: 0x42394a7b (Thu Mar 17 09:14:35 2005)<BR>machinetype.......: 0x14c (I386)<BR><BR>( 4 sections )<BR>name viradd virsiz rawdsiz ntrpy md5<BR>.text 0x1000 0x5e3a 0x6000 6.47 946f9c00b523b947995414f8ebbecb6e<BR>.rdata 0x7000 0x12ac 0x2000 3.70 7ab1fecd9e9755ede6cd48987ca8629c<BR>.data 0x9000 0x38e0 0x4000 1.09 228901592c49c22f9d5e8be376d5487f<BR>.rsrc 0xd000 0x3b8 0x1000 0.99 8f1ca7bd0a78d4ccab3547f89a97c985<BR><BR>( 4 imports ) <BR>> KERNEL32.dll: GetLastError, CreateMutexW, WaitForSingleObject, TerminateThread, GetExitCodeThread, CreateThread, WaitForMultipleObjects, CloseHandle, CreateFileMappingW, HeapAlloc, GetProcessHeap, HeapFree, ReleaseMutex, GetVersionExW, MapViewOfFile, UnmapViewOfFile, lstrlenW, lstrcmpW, lstrcmpiW, lstrcatW, lstrcpyW, OpenEventW, Sleep, InitializeCriticalSection, GetStringTypeW, GetStringTypeA, LCMapStringA, MultiByteToWideChar, LCMapStringW, InterlockedDecrement, LoadLibraryA, InterlockedIncrement, GetOEMCP, GetACP, GetProcAddress, WriteFile, GetCPInfo, TlsGetValue, EnterCriticalSection, RtlUnwind, GetModuleHandleA, GetStartupInfoA, GetCommandLineA, GetVersion, ExitProcess, GetModuleFileNameA, GetEnvironmentVariableA, GetVersionExA, HeapDestroy, HeapCreate, VirtualFree, VirtualAlloc, HeapReAlloc, SetLastError, WideCharToMultiByte, GetEnvironmentStrings, LeaveCriticalSection, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, FreeEnvironmentStringsA, FreeEnvironmentStringsW, GetFileType, GetEnvironmentStringsW, SetHandleCount, GetStdHandle, TlsAlloc, GetCurrentThreadId, TlsSetValue<BR>> USER32.dll: SendMessageW, CharNextW, wsprintfW<BR>> ADVAPI32.dll: InitializeSecurityDescriptor, InitializeAcl, AddAccessAllowedAce, SetSecurityDescriptorDacl, InitializeSid, RegEnumKeyExW, RegCreateKeyExW, RegQueryInfoKeyW, RegOpenKeyExW, RegQueryValueExW, RegSetValueExW, RegCloseKey<BR>> RPCRT4.dll: RpcNetworkIsProtseqValidW, RpcServerUseProtseqEpW, RpcEpRegisterW, RpcBindingVectorFree, RpcServerListen, RpcEpUnregister, NdrFullPointerXlatInit, RpcServerInqBindings, RpcMgmtStopServerListening, NdrConformantArrayBufferSize, NdrConformantArrayUnmarshall, NdrPointerUnmarshall, NdrPointerFree, NdrConformantArrayMarshall, NdrPointerMarshall, NdrConvert, NdrFullPointerXlatFree, NdrServerInitializeNew, I_RpcGetBuffer, NdrConformantStringUnmarshall, RpcRaiseException, RpcServerRegisterIf, RpcServerUseProtseqW<BR><BR>( 0 exports ) <BR>

buon pomeriggio.
è la prima volta che partecipo ad un forum di discussione, pertanto abbiate pietà. credo di essermi beccato un virus. da due giorni il mio pc non riesce più a collegarsi ad una vpn nè riesce a collegarsi ad un qualsivoglia sito per acoltare musica da stazioni radio online. mi scuso per il linguaggio poco tecnico ma sono poco esperto di questi marchingegni. ho provato degli antivirus ma nulla di chè così adesso non sò cosa fare. ho pensato bene (credo) di fare hijackthis.logvedendo le vostre discussioni. mi aiutate??

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15.50.55, on 07/09/2047
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\WINNT\System32\tcpsvcs.exe
C:\Programmi\Eset\nod32krn.exe
C:\VIRUSfighter\Bin\Zanda.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Programmi\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Programmi\CheckPoint\SecuRemote\bin\SR_Service.exe
C:\WINNT\Explorer.EXE
C:\Programmi\CheckPoint\SecuRemote\bin\SR_GUI.exe
C:\VIRUSfighter\bin\ZLH.EXE
C:\WINNT\system32\CNAB4RPK.EXE
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings--\Desktop\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM..\Run: [Norman ZANDA] C:\VIRUSfighter\bin\ZLH.EXE /LOAD /SPLASH
O4 - HKUS.DEFAULT..\Run: [internat.exe] internat.exe (User 'Default user')
O4 - HKUS.DEFAULT..\RunOnce: [^SetupICWDesktop] C:\Programmi\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O17 - HKLM\System\CCS\Services\Tcpip..{27ECA100-F0ED-4A61-98BA-FE4E12CB44B1}: NameServer = 88.149.128.12,88.149.128.22
O17 - HKLM\System\CS1\Services\Tcpip..{27ECA100-F0ED-4A61-98BA-FE4E12CB44B1}: NameServer = 88.149.128.12,88.149.128.22
O17 - HKLM\System\CS2\Services\Tcpip..{27ECA100-F0ED-4A61-98BA-FE4E12CB44B1}: NameServer = 88.149.128.12,88.149.128.22
O23 - Service: Servizio amministrativo di Gestione disco logico (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Norman NJeeves - Unknown owner - C:\VIRUSfighter\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Unknown owner - C:\VIRUSfighter\Bin\Zanda.exe
O23 - Service: Check Point SecuRemote Service (SR_Service) - Check Point Software Technologies - C:\Programmi\CheckPoint\SecuRemote\bin\SR_Service.exe
O23 - Service: Check Point SecuRemote WatchDog (SR_WatchDog) - Check Point Software Technologies - C:\Programmi\CheckPoint\SecuRemote\bin\SR_WatchDog.exe

End of file - 3146 bytes