Ecco il log di combo fix
ComboFix 09-01-16.03 - CHRISTIAN 2009-01-17 9.22.53.1 -
FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1040.18.1023.646 [GMT 1:00]
Eseguito da: c:\documents and settings\CHRISTIAN\Desktop\ComboFix.exe
FW: Sunbelt Kerio Personal Firewall *disabled*
* Creato nuovo punto di ripristino
ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((((( Driver/Servizi )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_VFILT
((((((((((((((((((((((((( Files Creati Da 2008-12-17 al 2009-01-17 )))))))))))))))))))))))))))))))))))
.
2009-01-17 09:14 . 2009-01-17 09:14 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\Avg8
2009-01-16 15:29 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-01-16 15:28 . 2009-01-16 15:29 <DIR> d-------- c:\programmi\Malwarebytes' Anti-Malware
2009-01-16 15:28 . 2009-01-16 15:29 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\Malwarebytes
2009-01-16 15:28 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-13 06:36 3,593,216 ----a-w c:\windows\system32\dllcache\mshtml.dll
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys
2008-11-28 09:48 141,312 ----a-w c:\windows\system32\drivers\sp_rsdrv2.sys
2008-11-28 09:48 --------- d-----w c:\programmi\Spyware Terminator
2008-11-28 09:48 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Spyware Terminator
2008-11-28 09:40 --------- d-----w c:\programmi\VDOWNLOADER
2008-10-24 11:21 455,296 ------w c:\windows\system32\dllcache\mrxsmb.sys
2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-23 12:36 286,720 ------w c:\windows\system32\dllcache\gdi32.dll
2005-09-24 16:19 5,018 --sha-w c:\windows\system32\KGyGaAvL.sys
2005-02-10 16:30 56 --sh--r c:\windows\system32\1D4B1D3ABD.sys
2008-10-11 13:21 32,768 --sha-w c:\windows\system32\config\systemprofile\Impostazioni locali\Cronologia\History.IE5\MSHist012008101120081012\index.dat
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-12-10 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-12-10 7311360]
"EPSON Stylus CX3200"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE" [2002-07-01 74752]
"SunJavaUpdateSched"="c:\programmi\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"SpywareTerminator"="c:\programmi\Spyware Terminator\SpywareTerminatorShield.exe" [2008-11-28 1783808]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\FILECO~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.VP40"= vp4vfw.dll
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FASTTRACKPassepartout
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\System32\\USMT\\migwiz.exe"=
"c:\\WINDOWS\\System32\\FxsClnt.exe"=
"c:\\Programmi\\Sunbelt Software\\Personal Firewall\\kpf4gui.exe"=
"c:\\Programmi\\Bonjour\\mDNSResponder.exe"=
"c:\\Programmi\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmi\\uTorrent\\uTorrent.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"16525:UDP"= 16525:UDP:*:Disabled:Rosso Alice UDP
R1 fwdrv;Firewall Driver;c:\windows\system32\drivers\fwdrv.sys [2006-07-18 284184]
R1 khips;Kerio HIPS Driver;c:\windows\system32\drivers\khips.sys [2006-07-18 91672]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2008-11-28 141312]
R3 CnxEtP;Conexant AccessRunner USB ADSL WAN Adapter Filter Driver;c:\windows\system32\drivers\CnxEtP.sys [2005-02-08 60288]
R3 CnxEtU;Conexant AccessRunner USB ADSL Interface Device Driver;c:\windows\system32\drivers\CnxEtU.sys [2005-02-08 646784]
R3 CnxTgN;Conexant AccessRunner USB ADSL WAN Adapter Driver;c:\windows\system32\drivers\CnxTgN.sys [2005-02-08 108675]
R4 WinDefend;Windows Defender;c:\programmi\Windows Defender\MsMpEng.exe [2006-11-03 13592]
S3 gkmixern;gkmixern; [x]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\4.tmp --> c:\windows\system32\4.tmp [?]
S3 MTK;Media Technology Kernel Driver;c:\windows\system32\drivers\FIDE.SYS [2003-11-14 14601]
S3 SIWIO;SIW low-level I/O driver;\??\c:\windows\TEMP\SiwIo.sys --> c:\windows\TEMP\SiwIo.sys [?]
S4 GF0003;GASIA GF0003 Filter Driver;c:\windows\system32\drivers\GF0003.sys [2007-11-15 9216]
.
Contenuto della cartella 'Scheduled Tasks'
2009-01-17 c:\windows\Tasks\MP Scheduled Scan.job
- c:\programmi\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]
.
- - - - CHIAVI ORFANE RIMOSSE - - - -
HKU-Default-Run-swg - c:\programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
MSConfigStartUp-PCSuiteTrayApplication - c:\progra~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
MSConfigStartUp-PcSync - c:\programmi\Nokia\Nokia PC Suite 6\PcSync2.exe
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/ig?hl=it
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-01-17 09:29:43
Windows 5.1.2600 Service Pack 3 FAT NTAPI
scansione processi nascosti ...
scansione entrate autostart nascoste ...
Scansione files nascosti ...
Scansione completata con successo
Files nascosti: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\4.tmp"
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="DirectX"
"ComponentGUID"="{44BBA855-CC51-11CF-AAFA-00AA00B6015C}"
"Version"=dword:00040009
"Sub-Version"=dword:00000386
"ExceptionInfName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\\dxxp.inf"
"ExceptionCatalogName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\\dxxp.cat"
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{AA936DF4-2B08-4B1F-B071-72192E287704}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="DirectX BDA"
"ComponentGUID"="{AA936DF4-2B08-4B1F-B071-72192E287704}"
"Version"=dword:00040009
"Sub-Version"=dword:00000386
"ExceptionInfName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{AA936DF4-2B08-4B1F-B071-72192E287704}\\dxbda.inf"
"ExceptionCatalogName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{AA936DF4-2B08-4B1F-B071-72192E287704}\\dx9bda.cat"
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\programmi\LAVASOFT\AD-AWARE\AAWSERVICE.EXE
c:\programmi\BONJOUR\MDNSRESPONDER.EXE
c:\programmi\FILE COMUNI\EPSON\EBAPI\EEBSVC.EXE
c:\programmi\FILE COMUNI\EPSON\EBAPI\SAGENT2.EXE
c:\windows\SYSTEM32\DRIVERS\KODAKCCS.EXE
c:\programmi\SUNBELT SOFTWARE\PERSONAL FIREWALL\KPF4SS.EXE
c:\programmi\CDBURNERXP\NMSACCESSU.EXE
c:\windows\SYSTEM32\NVSVC32.EXE
c:\windows\SYSTEM32\SCSIACCESS.EXE
c:\programmi\ANALOG DEVICES\SOUNDMAX\SMAGENT.EXE
c:\programmi\SPYWARE TERMINATOR\SP_RSSER.EXE
c:\programmi\SUNBELT SOFTWARE\PERSONAL FIREWALL\KPF4GUI.EXE
c:\windows\SYSTEM32\WDFMGR.EXE
c:\windows\system32\wscntfy.exe
c:\programmi\SUNBELT SOFTWARE\PERSONAL FIREWALL\KPF4GUI.EXE
.
**************************************************************************
.
Ora fine scansione: 2009-01-17 9:32:50 - Il pc è stato riavviato
ComboFix-quarantined-files.txt 2009-01-17 08:32:46
Pre-Run: 50.946.113.536 byte disponibili
Post-Run: 51,244,990,464 byte disponibili
154 --- E O F --- 2009-01-15 08:10:35