log combo fix
ComboFix 10-01-13.0C - Paola 14/01/2010 17.46.40.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.39.1040.18.512.291 [GMT 1:00]
Eseguito da: c:\documents and settings\Paola\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1356 [VPS 100114-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: PC Tools Firewall Plus *enabled* {ABBD5028-5A95-4B6D-996E-98D64AE88D52}
ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\docume~1\Paola\IMPOST~1\Temp\install_flash_player.exe
c:\documents and settings\Paola\Dati applicazioni\Desktopicon
c:\documents and settings\Paola\Impostazioni locali\Dati applicazioni\gwqeoac.dat
c:\documents and settings\Paola\Impostazioni locali\Dati applicazioni\gwqeoac_nav.dat
c:\documents and settings\Paola\Impostazioni locali\Dati applicazioni\gwqeoac_navps.dat
c:\windows\TEMP\logishrd\LVPrcInj03.dll
.
((((((((((((((((((((((((( Files Creati Da 2009-12-14 al 2010-01-14 )))))))))))))))))))))))))))))))))))
.
2010-01-13 14:34 . 2009-11-21 15:54 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2010-01-03 20:23 . 2010-01-03 20:23 -------- d-----w- c:\documents and settings\Francesco\Impostazioni locali\Dati applicazioni\Temp
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-14 17:00 . 2008-11-28 16:19 -------- d---a-w- c:\documents and settings\All Users\Dati applicazioni\TEMP
2010-01-14 16:17 . 2009-02-06 17:12 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Google Updater
2010-01-08 16:01 . 2009-04-02 11:54 -------- d-----w- c:\programmi\Malwarebytes' Anti-Malware
2010-01-08 16:01 . 2009-05-11 16:02 5115824 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-01-07 15:07 . 2009-04-02 11:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 15:07 . 2009-04-02 11:54 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-23 13:45 . 2008-12-21 21:28 20 ---h--w- c:\documents and settings\All Users\Dati applicazioni\PKP_DLdu.DAT
2009-12-10 08:06 . 2006-03-02 12:00 81206 ----a-w- c:\windows\system32\perfc010.dat
2009-12-10 08:06 . 2006-03-02 12:00 483286 ----a-w- c:\windows\system32\perfh010.dat
2009-12-09 17:43 . 2009-01-27 19:15 -------- d-----w- c:\documents and settings\Paola\Dati applicazioni\Canon
2009-11-21 15:54 . 2006-03-02 12:00 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-11-21 12:52 . 2009-11-21 12:52 -------- d-----w- c:\documents and settings\Francesco\Dati applicazioni\Malwarebytes
2009-10-29 07:42 . 2006-03-02 12:00 832512 ----a-w- c:\windows\system32\wininet.dll
2009-10-29 07:42 . 2006-03-02 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-10-29 07:42 . 2006-03-02 12:00 17408 ----a-w- c:\windows\system32\corpol.dll
2009-10-21 05:38 . 2006-03-02 12:00 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2006-03-02 12:00 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2006-03-02 12:00 265728 ----a-w- c:\windows\system32\drivers\http.sys
2009-10-19 11:25 . 2009-08-21 06:44 308160 ----a-w- c:\programmi\avast_home_setup.exe
2009-10-19 11:23 . 2008-11-28 16:29 50832 ----a-w- c:\documents and settings\Paola\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2009-10-18 17:17 . 2009-10-18 17:17 39079849 ----a-w- c:\programmi\finaldraft8.zip
2009-10-09 17:56 . 2009-10-09 17:55 93074728 ----a-w- c:\programmi\iTunesSetup.exe
2009-04-02 11:53 . 2009-04-02 11:53 2882679 ----a-w- c:\programmi\Malwarebytes.zip
2009-04-02 11:37 . 2009-04-02 11:37 911723 ----a-w- c:\programmi\ccleaner.zip
2009-04-02 07:14 . 2009-04-02 07:13 812344 ----a-w- c:\programmi\HJTInstall.exe
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"L08IXLRD_8918390"="c:\programmi\Microsoft Student\Microsoft Encarta 2008 - Premium + Student DVD\EDICT.EXE" [2007-06-12 351000]
"swg"="c:\programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-02-06 39408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"00PCTFW"="c:\programmi\PC Tools Firewall Plus\FirewallGUI.exe" [2008-08-05 2611096]
"CnxDslTaskBar"="c:\programmi\digicomt\Michelangelo USB ADSL\CnxDslTb.exe" [2003-10-29 462848]
"ATIPTA"="c:\programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-06-05 335872]
"CanonSolutionMenu"="c:\programmi\Canon\SolutionMenu\CNSLMAIN.exe" [2007-04-03 644696]
"CanonMyPrinter"="c:\programmi\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 1603152]
"SSBkgdUpdate"="c:\programmi\File comuni\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"OpwareSE4"="c:\programmi\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400]
"LogitechCommunicationsManager"="c:\programmi\File comuni\LogiShrd\LComMgr\Communications_Helper.exe" [2008-08-14 565008]
"LogitechQuickCamRibbon"="c:\programmi\Logitech\QuickCam\Quickcam.exe" [2008-08-14 2407184]
"TkBellExe"="c:\programmi\File comuni\Real\Update_OB\realsched.exe" [2008-11-30 185872]
"UnlockerAssistant"="c:\programmi\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872]
"SunJavaUpdateSched"="c:\programmi\Java\j2re1.4.2_12\bin\jusched.exe" [2006-05-09 32881]
"QuickTime Task"="c:\programmi\QuickTime\qttask.exe" [2009-09-04 417792]
"iTunesHelper"="c:\programmi\iTunes\iTunesHelper.exe" [2009-09-21 305440]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-09-15 81000]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Adobe Gamma Loader.lnk - c:\programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe [2009-2-2 113664]
Logitech Desktop Messenger.lnk - c:\programmi\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2008-11-28 66864]
Microsoft Office.lnk - c:\programmi\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
Nikon Monitor.lnk - c:\programmi\File comuni\Nikon\Monitor\NkMonitor.exe [2007-10-18 479232]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"wave1"=sb16snd.dll
"MIDI1"=sb16snd.dll
"aux1"=sb16snd.dll
"mixer1"=sb16snd.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmi\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Programmi\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"c:\\Programmi\\FileZilla Client\\filezilla.exe"=
"c:\\Programmi\\Macromedia\\Dreamweaver MX\\Dreamweaver.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Programmi\\eMule\\emule.exe"=
"c:\\Programmi\\Bonjour\\mDNSResponder.exe"=
"c:\\Programmi\\iTunes\\iTunes.exe"=
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [19/10/2009 12.43.12 114768]
R1 pctfw2;pctfw2;c:\windows\system32\drivers\pctfw2.sys [28/11/2008 17.19.03 160792]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [19/10/2009 12.43.12 20560]
R3 CnxEtP;Conexant AccessRunner USB ADSL WAN Adapter Filter Driver;c:\windows\system32\drivers\CnxEtP.sys [28/11/2008 17.26.47 60288]
R3 CnxEtU;Conexant AccessRunner USB ADSL Interface Device Driver;c:\windows\system32\drivers\CnxEtU.sys [28/11/2008 17.26.47 646784]
R3 CnxTgN;Conexant AccessRunner USB ADSL WAN Adapter Driver;c:\windows\system32\drivers\CnxTgN.sys [28/11/2008 17.26.47 108675]
R3 FWAuth;FWAuth Driver;c:\windows\system32\drivers\FWAuthdriver.sys [28/11/2008 17.19.02 58136]
S2 gupdate1c9887e47a616b6;Google Update Service (gupdate1c9887e47a616b6);c:\programmi\Google\Update\GoogleUpdate.exe [06/02/2009 18.13.45 133104]
S2 spd3ssl;Spyware-Process-Detector v3.15.3;\??\c:\programmi\Spyware Process Detector\spd315.sys --> c:\programmi\Spyware Process Detector\spd315.sys [?]
S3 sb16snd;sb16snd;c:\windows\system32\drivers\sb16snd.sys [29/11/2008 9.26.11 70672]
.
Contenuto della cartella 'Scheduled Tasks'
2009-11-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programmi\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
2010-01-14 c:\windows\Tasks\Google Software Updater.job
- c:\programmi\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-06 20:56]
2010-01-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2009-02-06 17:13]
2010-01-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2009-02-06 17:13]
2010-01-14 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-03-25 21:18]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\programmi\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
.
- - - - CHIAVI ORFANE RIMOSSE - - - -
WebBrowser-{3041D03E-FD4B-44E0-B742-2D9B88305F98} - (no file)
HKCU-Run-msnmsgr - c:\programmi\Windows Live\Messenger\msnmsgr.exe
AddRemove-gwqeoac - c:\documents and settings\paola\impostazioni locali\dati applicazioni\gwqeoac.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2010-01-14 18:00
Windows 5.1.2600 Service Pack 3 NTFS
scansione processi nascosti ...
scansione entrate autostart nascoste ...
Scansione files nascosti ...
Scansione completata con successo
Files nascosti: 0
**************************************************************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•9~*]
"0140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------
- - - - - - - > 'explorer.exe'(6416)
c:\windows\system32\WININET.dll
c:\windows\TEMP\logishrd\LVPrcInj01.dll
c:\programmi\Unlocker\UnlockerHook.dll
c:\programmi\ScanSoft\OmniPageSE4\OpHookSE4.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\programmi\Alwil Software\Avast4\aswUpdSv.exe
c:\programmi\Alwil Software\Avast4\ashServ.exe
c:\programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\programmi\Bonjour\mDNSResponder.exe
c:\programmi\File comuni\LogiShrd\LVCOMSER\LVComSer.exe
c:\programmi\File comuni\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\programmi\PC Tools Firewall Plus\FWService.exe
c:\programmi\Analog Devices\SoundMAX\SMAgent.exe
c:\windows\system32\fxssvc.exe
c:\programmi\File comuni\LogiShrd\LVCOMSER\LVComSer.exe
c:\windows\system32\wscntfy.exe
c:\programmi\File comuni\Logishrd\LQCVFX\COCIManager.exe
c:\programmi\iPod\bin\iPodService.exe
.
**************************************************************************
.
Ora fine scansione: 2010-01-14 18:11:25 - Il pc è stato riavviato
ComboFix-quarantined-files.txt 2010-01-14 17:11
Pre-Run: 97.043.832.832 byte disponibili
Post-Run: 98.018.856.960 byte disponibili
- - End Of File - - 24D27135357521948E3297F436638911