Benvenuto Ospite Cerca | Topic Attivi | Utenti | | Log In | Registra

...qualcuno può controllarmi il log? grazie! Opzioni
juliettehasagun191
Inviato: Tuesday, July 27, 2010 2:58:22 PM
Rank: Member

Iscritto dal : 7/27/2010
Posts: 19
credo di essermi presa uno spyware... d'oh!


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:55:58, on 27/07/2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Sony\VAIO Care\VAIOCareService.exe
C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe
C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Program Files\Sony\PMB\PMBVolumeWatcher.exe
C:\Program Files\Sony\Marketing Tools\MarketingTools.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Sony\VAIO Care\VCsystray.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Best Spyware Scanner\BestSpywareScanner.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtblfs.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Users\Stella\Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://sony.msn.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sony.msn.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\ievkbd.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Guida per l'accesso a Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ISBMgr.exe] "C:\Program Files\Sony\ISB Utility\ISBMgr.exe"
O4 - HKLM\..\Run: [PMBVolumeWatcher] C:\Program Files\Sony\PMB\PMBVolumeWatcher.exe
O4 - HKLM\..\Run: [MarketingTools] C:\Program Files\Sony\Marketing Tools\MarketingTools.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe"
O4 - HKLM\..\Run: [BestSpywareScanner.exe] C:\Program Files\Best Spyware Scanner\BestSpywareScanner.exe
O4 - HKLM\..\Run: [BSSHelper.exe] C:\Program Files\Best Spyware Scanner\BSSHelper.exe -0
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVIZIO DI RETE')
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: Aggiungi ad Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\ie_banner_deny.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Inserisci blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: Inserisci &blog in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: I&nvia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: &Tastiera Virtuale - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: C&ontrollo URL - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Servizio Kaspersky Anti-Virus (AVP) - Kaspersky Lab ZAO - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: PMBDeviceInfoProvider - Sony Corporation - C:\Program Files\Sony\PMB\PMBDeviceInfoProvider.exe
O23 - Service: Intel(R) Sample Collector (SampleCollector) - Intel Corporation - C:\Program Files\Sony\VAIO Care\collsvc.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: VAIO Media plus Content Importer (SOHCImp) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\SOHLib\SOHCImp.exe
O23 - Service: VAIO Media plus Database Manager (SOHDBSvr) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe
O23 - Service: VAIO Media plus Digital Media Server (SOHDms) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\SOHLib\SOHDms.exe
O23 - Service: VAIO Media plus Device Searcher (SOHDs) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\SOHLib\SOHDs.exe
O23 - Service: VAIO Media plus Playlist Manager (SOHPlMgr) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Power Management - Sony Corporation - C:\Program Files\Sony\VAIO Power Management\SPMService.exe
O23 - Service: VAIO Content Folder Watcher (VCFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe
O23 - Service: VAIO Content Metadata Intelligent Analyzing Manager (VcmIAlzMgr) - Sony Corporation - C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
O23 - Service: VAIO Content Metadata Intelligent Network Service Manager (VcmINSMgr) - Sony Corporation - C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe
O23 - Service: VAIO Content Metadata XML Interface (VcmXmlIfHelper) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe
O23 - Service: VSNService - Sony Corporation - C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
O23 - Service: VUAgent - Sony Corporation - C:\Program Files\Sony\VAIO Update 5\VUAgent.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe

--
End of file - 11072 bytes
Sponsor
Inviato: Tuesday, July 27, 2010 2:58:22 PM

 
shapiro
Inviato: Tuesday, July 27, 2010 5:17:33 PM

Rank: AiutAmico

Iscritto dal : 8/24/2008
Posts: 4,164
ciao

ci sono delle voci poco sicure, ma prima di fixare quello che ''potrebbe essere'' facciamo un controllo

disattiva il tuo antivirus

scarica combofix da QUI

(non installare la recovery console)
Lascia lavorare il programma senza interferire
Allega il rapporto C:\ComboFix.txt nella tua risposta.

non usare il pc durante la scansione, nemmeno il mouse!


guida all'uso di combofix
juliettehasagun191
Inviato: Tuesday, July 27, 2010 6:41:23 PM
Rank: Member

Iscritto dal : 7/27/2010
Posts: 19
ok, questo è il log di ComboFix:
ComboFix 10-07-26.04 - Stella 27/07/2010 18:04:58.2.2 - x86
Microsoft Windows 7 Starter 6.1.7600.0.1252.39.1040.18.1013.296 [GMT 2:00]
Eseguito da: c:\users\Stella\Downloads\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Stella\AppData\Roaming\.#

.
((((((((((((((((((((((((((((((((((((((( Driver/Servizi )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_RKHIT
-------\Service_RkHit


((((((((((((((((((((((((( Files Creati Da 2010-06-27 al 2010-07-27 )))))))))))))))))))))))))))))))))))
.

2010-07-27 16:23 . 2010-07-27 16:23 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-07-26 16:07 . 2009-06-30 07:37 28552 ----a-w- c:\windows\system32\drivers\pavboot.sys
2010-07-26 09:00 . 2010-07-26 09:00 -------- d-----w- c:\programdata\Overlook
2010-07-26 07:42 . 2009-05-07 07:04 157712 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2010-07-20 08:28 . 2010-07-20 08:28 88760 ----a-w- c:\programdata\Kaspersky Lab\AVP11\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav11\11.0.0.232\libola.dll
2010-07-20 08:28 . 2010-07-20 08:28 387768 ----a-w- c:\programdata\Kaspersky Lab\AVP11\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav11\11.0.0.232\ksn_client.dll
2010-07-20 08:28 . 2010-07-20 08:28 264888 ----a-w- c:\programdata\Kaspersky Lab\AVP11\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav11\11.0.0.232\esmgr.dll
2010-07-20 08:28 . 2010-07-20 08:28 191160 ----a-w- c:\programdata\Kaspersky Lab\AVP11\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav11\11.0.0.232\klwtbbho.dll
2010-07-20 08:26 . 2010-07-20 08:26 88760 ----a-w- c:\programdata\Kaspersky Lab\AVP11\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav11\11.0.0.232\libola.dll
2010-07-20 08:25 . 2010-07-20 08:26 387768 ----a-w- c:\programdata\Kaspersky Lab\AVP11\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav11\11.0.0.232\ksn_client.dll
2010-07-20 08:24 . 2010-07-20 08:25 191160 ----a-w- c:\programdata\Kaspersky Lab\AVP11\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav11\11.0.0.232\klwtbbho.dll
2010-07-20 08:24 . 2010-07-20 08:24 264888 ----a-w- c:\programdata\Kaspersky Lab\AVP11\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav11\11.0.0.232\esmgr.dll
2010-07-20 08:21 . 2010-07-20 08:21 1037648 ----a-w- c:\programdata\Kaspersky Lab\AVP11\Data\Updater\Temporary Files\temporaryFolder\bases\sw2\klavasyswatch.dll
2010-07-20 07:58 . 2010-07-20 07:58 275792 ----a-w- c:\programdata\Kaspersky Lab\AVP11\Data\Updater\Temporary Files\temporaryFolder\bases\av\kdb\i386\win\avengine.dll
2010-07-20 07:39 . 2010-07-20 07:39 97549 ----a-w- c:\windows\system32\drivers\klick.dat
2010-07-20 07:39 . 2010-07-20 07:39 113933 ----a-w- c:\windows\system32\drivers\klin.dat
2010-07-20 07:36 . 2010-07-20 07:36 -------- d-----w- c:\program files\Kaspersky Lab
2010-07-20 07:36 . 2010-07-27 16:28 -------- d-----w- c:\programdata\Kaspersky Lab
2010-07-20 07:25 . 2010-07-20 07:25 -------- d-----w- c:\programdata\Kaspersky Lab Setup Files
2010-07-20 07:21 . 2010-07-20 07:21 -------- d-----w- c:\windows\Internet Logs
2010-07-16 15:06 . 2010-07-20 07:14 -------- d-----w- c:\programdata\SecTaskMan
2010-07-14 08:02 . 2010-07-27 07:53 -------- d-----w- C:\6803de288a2309fa0b
2010-07-13 15:55 . 2010-07-13 15:55 -------- d-----w- c:\programdata\ParetoLogic Anti-Spyware
2010-07-13 06:48 . 2009-12-08 11:32 292864 ----a-w- c:\windows\system32\apphelp.dll
2010-07-12 21:27 . 2010-07-27 08:57 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-07-12 21:20 . 2010-07-12 21:24 -------- d-----w- c:\programdata\Symantec
2010-07-12 21:20 . 2010-07-12 21:20 -------- d-----w- c:\programdata\Norton
2010-07-12 21:20 . 2010-07-12 21:20 -------- d-----w- c:\windows\system32\drivers\NSS
2010-07-12 21:20 . 2010-07-12 21:20 -------- d-----w- c:\program files\Norton Security Scan
2010-07-12 21:20 . 2010-07-12 21:20 -------- d-----w- c:\program files\NortonInstaller
2010-07-12 21:20 . 2010-07-12 21:20 -------- d-----w- c:\programdata\NortonInstaller
2010-07-03 11:24 . 2010-07-22 08:05 -------- d-----w- c:\users\Stella\AppData\Roaming\QuickScan
2010-07-03 11:23 . 2010-05-31 14:34 702120 ----a-w- c:\users\Stella\AppData\Roaming\Mozilla\Firefox\Profiles\3ed0cove.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
2010-07-03 11:23 . 2010-05-31 14:34 868456 ----a-w- c:\users\Stella\AppData\Roaming\Mozilla\Firefox\Profiles\3ed0cove.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
2010-07-01 12:46 . 2010-04-01 16:36 33160 ----a-w- c:\windows\zllsputility_loc0410.dll
2010-07-01 12:46 . 2010-04-01 16:36 7048 ----a-w- c:\windows\system32\imslsp_install_loc0410.dll
2010-07-01 12:46 . 2010-04-01 16:36 10632 ----a-w- c:\windows\system32\imsinstall_loc0410.dll
2010-06-28 12:59 . 2010-07-27 14:00 -------- d-----w- c:\users\Stella\AppData\Roaming\skypePM
2010-06-28 12:50 . 2010-07-27 11:24 -------- d-----w- c:\users\Stella\AppData\Roaming\Skype
2010-06-27 17:09 . 2010-07-26 16:05 -------- d-----w- c:\program files\Panda Security

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-27 16:26 . 2010-06-26 12:52 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-07-27 15:33 . 2010-06-26 12:52 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-07-26 08:44 . 2010-01-16 10:31 689472 ----a-w- c:\windows\system32\perfh010.dat
2010-07-26 08:44 . 2010-01-16 10:31 124626 ----a-w- c:\windows\system32\perfc010.dat
2010-07-26 03:03 . 2010-04-30 16:21 -------- d-----w- c:\program files\Common Files\Real
2010-07-25 21:30 . 2010-04-26 14:51 85608 ----a-w- c:\users\Stella\AppData\Local\GDIPFONTCACHEV1.DAT
2010-07-25 20:08 . 2010-04-30 16:26 -------- d-----w- c:\program files\Common Files\Adobe
2010-07-25 19:06 . 2010-04-30 16:48 -------- d-----w- c:\program files\Common Files\PX Storage Engine
2010-07-21 08:27 . 2010-05-01 10:49 -------- d-----w- c:\program files\OpenOffice.org 3
2010-07-20 08:33 . 2010-05-20 06:02 1037648 ----a-w- c:\programdata\Kaspersky Lab\AVP11\Bases\klavasyswatch.dll
2010-07-20 08:28 . 2010-05-18 11:44 275792 ----a-w- c:\programdata\Kaspersky Lab\AVP11\Bases\avengine.dll
2010-07-20 07:22 . 2010-06-27 13:37 1 ----a-w- c:\users\Stella\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-07-20 07:18 . 2010-04-29 13:09 -------- d-----w- c:\program files\CheckPoint
2010-07-03 11:12 . 2010-05-17 20:56 -------- d-----w- c:\program files\CCleaner
2010-07-03 10:54 . 2010-06-19 17:37 -------- d-----w- c:\users\Stella\AppData\Roaming\Facebook
2010-07-01 12:33 . 2010-04-29 13:09 -------- d-----w- c:\users\Stella\AppData\Roaming\CheckPoint
2010-06-28 12:59 . 2010-06-28 12:59 56 ---ha-w- c:\programdata\ezsidmv.dat
2010-06-27 13:37 . 2010-06-27 13:37 -------- d-----w- c:\users\Stella\AppData\Roaming\OpenOffice.org
2010-06-26 16:37 . 2010-04-30 16:49 -------- d-----w- c:\users\Stella\AppData\Roaming\DivX
2010-06-26 13:06 . 2010-04-26 14:50 -------- d-----w- c:\users\Stella\AppData\Roaming\Sony Corporation
2010-06-23 14:05 . 2010-06-23 14:02 -------- d-----w- c:\programdata\NOS
2010-06-23 14:02 . 2010-01-16 01:49 -------- d-----w- c:\programdata\McAfee
2010-06-23 14:02 . 2010-06-23 14:02 -------- d-----w- c:\program files\NOS
2010-06-10 10:06 . 2010-01-16 02:07 -------- d-----w- c:\programdata\Microsoft Help
2010-06-10 09:57 . 2010-01-16 02:42 -------- d-----w- c:\program files\Microsoft
2010-06-09 08:06 . 2010-06-09 08:06 976832 ----a-w- c:\programdata\Adobe\Reader\9.2\ARM\ARM Update\AdobeARM.exe
2010-06-09 08:06 . 2010-06-09 08:06 70584 ----a-w- c:\programdata\Adobe\Reader\9.2\ARM\ARM Update\AdobeExtractFiles.dll
2010-06-09 08:06 . 2010-06-09 08:06 331176 ----a-w- c:\programdata\Adobe\Reader\9.2\ARM\ARM Update\ReaderUpdater.exe
2010-06-09 08:06 . 2010-06-09 08:06 331176 ----a-w- c:\programdata\Adobe\Reader\9.2\ARM\ARM Update\AcrobatUpdater.exe
2010-06-04 08:22 . 2010-05-12 20:06 -------- d-----w- c:\program files\Microsoft Silverlight
2010-06-01 18:16 . 2010-06-01 18:16 226592 ----a-w- c:\windows\system32\RaCoInst.dll
2010-06-01 18:16 . 2010-06-01 18:16 720672 ----a-w- c:\windows\system32\drivers\netr28.sys
2010-06-01 18:15 . 2010-06-01 18:15 130672 ----a-w- c:\windows\system32\drivers\jmcr.sys
2010-06-01 18:14 . 2010-01-16 01:46 -------- d-----w- c:\program files\Sony
2010-06-01 18:14 . 2010-01-16 01:39 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-06-01 17:42 . 2010-01-16 01:46 -------- d-----w- c:\program files\Common Files\Sony Shared
2010-06-01 17:41 . 2010-01-16 02:21 -------- d-----w- c:\programdata\Sony Corporation
2010-06-01 17:40 . 2010-06-01 17:40 -------- d-----w- c:\users\Stella\AppData\Roaming\InstallShield
2010-06-01 17:40 . 2010-06-01 17:40 -------- d-----w- c:\program files\Trend Micro
2010-06-01 17:40 . 2010-01-16 02:35 -------- d-----w- c:\program files\Sony Corporation
2010-05-30 20:51 . 2010-04-30 20:42 443912 ----a-w- c:\users\Stella\AppData\Roaming\Real\Update\setup3.10\setup.exe
2010-05-27 07:24 . 2010-06-10 09:50 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-05-27 03:49 . 2010-06-10 09:50 293888 ----a-w- c:\windows\system32\atmfd.dll
2010-05-21 12:14 . 2010-04-29 13:31 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-05-21 05:18 . 2010-06-10 09:49 977920 ----a-w- c:\windows\system32\wininet.dll
2010-05-20 17:51 . 2010-05-20 17:51 247120 ----a-w- c:\programdata\Kaspersky Lab\AVP11\Bases\uds.dll
2010-05-20 17:51 . 2010-05-20 17:51 132432 ----a-w- c:\programdata\Kaspersky Lab\AVP11\Bases\dns_client.dll
2010-05-20 17:51 . 2010-05-20 17:51 272984 ----a-w- c:\programdata\Kaspersky Lab\AVP11\Bases\sys_critical_obj.dll
2010-05-20 16:00 . 2010-05-20 16:00 68256 ----a-w- c:\programdata\Kaspersky Lab Setup Files\Kaspersky Internet Security 2011 11.0.0.232\Italian\setup.exe
2010-05-16 10:42 . 2010-05-16 10:42 21284336 ----a-w- c:\users\Stella\AppData\Roaming\Real\Update\setup3.10\rp\RealPlayerSPGold_it.exe
2010-05-09 09:14 . 2010-06-23 20:33 641536 ----a-w- c:\windows\system32\CPFilters.dll
2010-05-07 10:37 . 2010-05-07 10:37 228024 ----a-w- c:\windows\system32\klogon.dll
2010-05-06 22:19 . 2010-05-06 22:19 132184 ----a-w- c:\windows\system32\drivers\kl2.sys
2010-05-06 22:19 . 2010-05-06 22:19 132184 ----a-w- c:\windows\system32\drivers\kl1.sys
2010-05-01 14:49 . 2010-06-10 09:48 2326528 ----a-w- c:\windows\system32\win32k.sys
2010-05-01 07:43 . 2010-05-01 07:43 8405312 ----a-w- c:\users\Stella\AppData\Roaming\Real\Update\setup3.10\gtb\GOOGLE_TOOLBAR\GoogleToolbarInstaller.exe
2010-05-01 07:42 . 2010-05-01 07:42 149000 ----a-w- c:\users\Stella\AppData\Roaming\Real\Update\setup3.10\chr_helper\LaunchHelper.exe
2010-05-01 07:42 . 2010-05-01 07:42 10309448 ----a-w- c:\users\Stella\AppData\Roaming\Real\Update\setup3.10\chr\ChromeInstaller.exe
2010-05-01 07:41 . 2010-05-01 07:41 79368 ----a-w- c:\users\Stella\AppData\Roaming\Real\Update\setup3.10\RUP\vista.exe
2010-05-01 07:41 . 2010-05-01 07:41 64000 ----a-w- c:\users\Stella\AppData\Roaming\Real\Update\setup3.10\RUP\inst_config\gcapi_dll.dll
2010-05-01 07:41 . 2010-05-01 07:41 52288 ----a-w- c:\users\Stella\AppData\Roaming\Real\Update\setup3.10\RUP\inst_config\gtapi.dll
2010-05-01 07:41 . 2010-05-01 07:41 50688 ----a-w- c:\users\Stella\AppData\Roaming\Real\Update\setup3.10\RUP\inst_config\fftbapi.dll
2010-05-01 07:41 . 2010-05-01 07:41 49152 ----a-w- c:\users\Stella\AppData\Roaming\Real\Update\setup3.10\RUP\inst_config\CarboniteCompatibility.dll
2010-05-01 07:41 . 2010-05-01 07:41 118784 ----a-w- c:\users\Stella\AppData\Roaming\Real\Update\setup3.10\RUP\inst_config\compat.dll
2010-04-30 19:25 . 2010-04-30 19:25 57344 ----a-w- c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-04-30 16:50 . 2010-04-30 16:50 56766 ----a-w- c:\programdata\DivX\DivXPlusShortcuts\Uninstaller.exe
2010-04-30 16:50 . 2010-04-30 16:50 56978 ----a-w- c:\programdata\DivX\WebPlayer\Uninstaller.exe
2010-04-30 16:50 . 2010-04-30 16:50 53600 ----a-w- c:\programdata\DivX\Update\Uninstaller.exe
2010-04-30 16:50 . 2010-04-30 16:50 57679 ----a-w- c:\programdata\DivX\Player\Uninstaller.exe
2010-04-30 16:48 . 2010-04-30 16:48 84040 ----a-w- c:\programdata\DivX\TransferWizard\Uninstaller.exe
2010-04-30 16:48 . 2010-04-30 16:48 57609 ----a-w- c:\programdata\DivX\MFComponents\Uninstaller.exe
2010-04-30 16:48 . 2010-04-30 16:48 57054 ----a-w- c:\programdata\DivX\DSDesktopComponents\Uninstaller.exe
2010-04-30 16:48 . 2010-04-30 16:48 54166 ----a-w- c:\programdata\DivX\DSAVCDecoder\Uninstaller.exe
2010-04-30 16:48 . 2010-04-30 16:48 57532 ----a-w- c:\programdata\DivX\DSASPDecoder\Uninstaller.exe
2010-04-30 16:48 . 2010-04-30 16:48 56458 ----a-w- c:\programdata\DivX\DivXDecoderShortcut\Uninstaller.exe
2010-04-30 16:48 . 2010-04-30 16:48 54174 ----a-w- c:\programdata\DivX\DSAACDecoder\Uninstaller.exe
2010-04-30 16:48 . 2010-04-30 16:48 54153 ----a-w- c:\programdata\DivX\DFXPlugin\Uninstaller.exe
2010-04-30 16:48 . 2010-04-30 16:48 54128 ----a-w- c:\programdata\DivX\Converter\Uninstaller.exe
2010-04-30 16:48 . 2010-04-30 16:48 54629 ----a-w- c:\programdata\DivX\TranscodeEngine\Uninstaller.exe
2010-04-30 16:47 . 2010-04-30 16:47 54101 ----a-w- c:\programdata\DivX\MPEG2Plugin\Uninstaller.exe
2010-04-30 16:47 . 2010-04-30 16:47 57409 ----a-w- c:\programdata\DivX\ControlPanel\Uninstaller.exe
2010-04-30 16:47 . 2010-04-30 16:47 52963 ----a-w- c:\programdata\DivX\MSVC80CRTRedist\Uninstaller.exe
2010-04-30 16:47 . 2010-04-30 16:47 54073 ----a-w- c:\programdata\DivX\Qt4.5\Uninstaller.exe
2010-04-30 16:47 . 2010-04-30 16:47 56969 ----a-w- c:\programdata\DivX\ASPEncoder\Uninstaller.exe
2010-04-30 16:35 . 2010-04-30 16:35 144696 ----a-w- c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.exe
2010-04-30 16:35 . 2010-04-30 16:50 754984 ----a-w- c:\programdata\DivX\Setup\Resource.dll
2010-04-30 16:34 . 2010-04-30 16:50 1180952 ----a-w- c:\programdata\DivX\Setup\DivXSetup.exe
2010-04-30 16:21 . 2003-03-18 19:14 499712 ----a-w- c:\windows\system32\msvcp71.dll
2010-04-30 16:21 . 2003-02-21 03:42 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-10-09 25623336]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-12-23 8120864]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-11-26 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-11-26 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-11-26 150552]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-12-23 1578280]
"ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2009-08-26 320880]
"PMBVolumeWatcher"="c:\program files\Sony\PMB\PMBVolumeWatcher.exe" [2009-10-24 597792]
"MarketingTools"="c:\program files\Sony\Marketing Tools\MarketingTools.exe" [2010-01-16 26624]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-04-12 1135912]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe" [2010-05-07 344736]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2009-11-30 18:20 98304 ----a-w- c:\windows\System32\VESWinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\mzvkbd3.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

R1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [2010-05-06 132184]
R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2009-12-28 43944]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
R3 SampleCollector;Intel(R) Sample Collector;c:\program files\Sony\VAIO Care\collsvc.exe [2009-09-16 122880]
R3 SOHCImp;VAIO Media plus Content Importer;c:\program files\Common Files\Sony Shared\SOHLib\SOHCImp.exe [2009-10-15 120104]
R3 SOHDBSvr;VAIO Media plus Database Manager;c:\program files\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe [2009-10-15 70952]
R3 SOHDms;VAIO Media plus Digital Media Server;c:\program files\Common Files\Sony Shared\SOHLib\SOHDms.exe [2009-10-15 427304]
R3 SOHDs;VAIO Media plus Device Searcher;c:\program files\Common Files\Sony Shared\SOHLib\SOHDs.exe [2009-10-15 75048]
R3 SOHPlMgr;VAIO Media plus Playlist Manager;c:\program files\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe [2009-10-15 91432]
R3 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe [2009-12-16 513392]
R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe [2010-02-19 91504]
R3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update 5\VUAgent.exe [2010-04-09 722288]
S0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-06-30 28552]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2010-04-22 22104]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files\Sony\PMB\PMBDeviceInfoProvider.exe [2009-10-24 360224]
S2 VCFw;VAIO Content Folder Watcher;c:\program files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2009-09-14 642416]
S2 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2010-02-19 529776]
S2 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [2010-02-19 386416]
S2 VSNService;VSNService;c:\program files\Sony\VAIO Smart Network\VSNService.exe [2010-01-29 696320]
S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [2010-06-01 130672]
S3 JME;JMicron Ethernet Adapter NDIS6.20 Driver;c:\windows\system32\DRIVERS\JME.sys [2009-12-17 92272]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2009-11-02 19984]
S3 netr28;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28.sys [2010-06-01 720672]
S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\drivers\SFEP.sys [2009-12-01 9344]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS FontCache fdrespub AppIDSvc QWAVE wcncsvc
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contenuto della cartella 'Scheduled Tasks'

2010-07-27 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2010-04-30 16:14]

2010-07-26 c:\windows\Tasks\Norton Security Scan for Stella.job
- c:\program files\Norton Security Scan\Engine\2.7.3.34\Nss.exe [2010-07-12 22:51]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://sony.msn.com
mStart Page = about:blank
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Aggiungi ad Anti-Banner - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2011\ie_banner_deny.htm
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Stella\AppData\Roaming\Mozilla\Firefox\Profiles\3ed0cove.default\
FF - component: c:\program files\Mozilla Firefox\extensions\KavAntiBanner@Kaspersky.ru\components\abhelperxpcom.dll
FF - component: c:\program files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\components\kavlinkfilter.dll
FF - component: c:\users\Stella\AppData\Roaming\Mozilla\Firefox\Profiles\3ed0cove.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1908.5032\npCIDetect14.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\users\Stella\AppData\Roaming\Mozilla\Firefox\Profiles\3ed0cove.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - plugin: c:\users\Stella\AppData\Roaming\Mozilla\Firefox\Profiles\3ed0cove.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - CHIAVI ORFANE RIMOSSE - - - -

SafeBoot-mcmscsvc
SafeBoot-MCODS



[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SampleCollector]
"ImagePath"="\"c:\program files\Sony\VAIO Care\collsvc.exe\" \"/service\" \"/counter=\Processor(_Total)\% Processor Time:5\" \"/counter=\PhysicalDisk(_Total)\Disk Bytes/sec:5\" \"/counter=\Network Interface(*)\Bytes Total/sec:5\" \"/directory=inteldata\""
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Sony\VAIO Event Service\VESMgr.exe
c:\windows\system32\taskhost.exe
c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
c:\windows\system32\DllHost.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Sony\VAIO Care\VAIOCareService.exe
c:\program files\Sony\VAIO Event Service\VESMgrSub.exe
c:\program files\Sony\VAIO Update 5\VAIOUpdt.exe
c:\program files\Sony\VAIO Smart Network\VSNClient.exe
c:\windows\system32\conhost.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Sony\VAIO Care\VCsystray.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
c:\program files\Windows Live\Contacts\wlcomm.exe
c:\windows\servicing\TrustedInstaller.exe
c:\program files\Internet Explorer\IELowutil.exe
.
**************************************************************************
.
Ora fine scansione: 2010-07-27 18:37:27 - Il pc è stato riavviato
ComboFix-quarantined-files.txt 2010-07-27 16:37

Pre-Run: 207.769.186.304 byte disponibili
Post-Run: 207.639.883.776 byte disponibili

- - End Of File - - EE0237E1930BE83795E265FE15F97AD5
shapiro
Inviato: Tuesday, July 27, 2010 8:31:18 PM

Rank: AiutAmico

Iscritto dal : 8/24/2008
Posts: 4,164


McAfee

Kaspersky

Norton


quale di questi antivirus usi?

scarica malwarebytes

1) lo installi
2) lo aggiorni
3) fai una scansione scegliendo la modalità completa
4) NON eliminare per ora le ventuali minacce che rileva
5) finita la scansione seleziona il tabellino log, apri il file di testo e postalo sul forum
juliettehasagun191
Inviato: Wednesday, July 28, 2010 7:00:52 AM
Rank: Member

Iscritto dal : 7/27/2010
Posts: 19
Buongiorno, questo è il log di Mbam:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Versione database: 4359

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

28/07/2010 06:55:27
mbam-log-2010-07-28 (06-55-27).txt

Tipo di scansione: Scansione completa (C:\|)
Elementi esaminati: 199879
Tempo trascorso: 6 ore, 54 minuti, 7 secondi

Processi infetti in memoria: 0
Moduli di memoria infetti: 0
Chiavi di registro infette: 0
Valori di registro infetti: 0
Voci infette nei dati di registro: 0
Cartelle infette: 0
File infetti: 2

Processi infetti in memoria:
(Non sono stati rilevati elementi nocivi)

Moduli di memoria infetti:
(Non sono stati rilevati elementi nocivi)

Chiavi di registro infette:
(Non sono stati rilevati elementi nocivi)

Valori di registro infetti:
(Non sono stati rilevati elementi nocivi)

Voci infette nei dati di registro:
(Non sono stati rilevati elementi nocivi)

Cartelle infette:
(Non sono stati rilevati elementi nocivi)

File infetti:
C:\Users\Stella\Downloads\BestSpywareScanner_Setup(2).exe (Rogue.BestSpywareScanner) -> No action taken.
C:\Users\Stella\Downloads\BestSpywareScanner_Setup.exe (Rogue.BestSpywareScanner) -> No action taken.


...procedo con la rimozione dei file infetti?
juliettehasagun191
Inviato: Wednesday, July 28, 2010 7:03:07 AM
Rank: Member

Iscritto dal : 7/27/2010
Posts: 19
Ah dimenticavo, uso Kaspersky Internet Security 2011!
fdaccc
Inviato: Wednesday, July 28, 2010 10:51:40 AM

Rank: AiutAmico

Iscritto dal : 12/12/2009
Posts: 2,114
Julietta, elimina dalla QUARANTENA di Malwarebytes gli elementi infetti, erano due installazioni di FALSI Antivirus che avrebbero peggiorato ancora di più la situazione del tuo PC.


@shapiro:
questa voce mi incute timore :o)

O4 - HKLM\..\Run: [BestSpywareScanner.exe] C:\Program Files\Best Spyware Scanner\BestSpywareScanner.exe
shapiro
Inviato: Wednesday, July 28, 2010 12:22:22 PM

Rank: AiutAmico

Iscritto dal : 8/24/2008
Posts: 4,164
togli quello che malwarebytes ha trovato

rimuovi i rimasugli del norton con Norton Removal Tool

vai qui e fai una scansione completa del pc usando il browser I.E.

finite le operazioni, posta anche un log aggiornato di hijackthis
juliettehasagun191
Inviato: Wednesday, July 28, 2010 1:53:12 PM
Rank: Member

Iscritto dal : 7/27/2010
Posts: 19
Allora...dopo aver usato Norton Tool, ho provato a fare la scansione con BitDefender su IE ma non ci son riuscita, non mi parte proprio...boh
l'ho fatta su Mozilla Firefox e non ha rilevato infezioni di alcun genere...

questo è il log aggiornato di Hijackthis:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:52:25, on 28/07/2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Program Files\Sony\PMB\PMBVolumeWatcher.exe
C:\Program Files\Sony\Marketing Tools\MarketingTools.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtblfs.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Users\Stella\Downloads\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sony.msn.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\ievkbd.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Guida per l'accesso a Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ISBMgr.exe] "C:\Program Files\Sony\ISB Utility\ISBMgr.exe"
O4 - HKLM\..\Run: [PMBVolumeWatcher] C:\Program Files\Sony\PMB\PMBVolumeWatcher.exe
O4 - HKLM\..\Run: [MarketingTools] C:\Program Files\Sony\Marketing Tools\MarketingTools.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: Aggiungi ad Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\ie_banner_deny.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Inserisci blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: Inserisci &blog in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: I&nvia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: &Tastiera Virtuale - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: C&ontrollo URL - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Servizio Kaspersky Anti-Virus (AVP) - Kaspersky Lab ZAO - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: PMBDeviceInfoProvider - Sony Corporation - C:\Program Files\Sony\PMB\PMBDeviceInfoProvider.exe
O23 - Service: Intel(R) Sample Collector (SampleCollector) - Intel Corporation - C:\Program Files\Sony\VAIO Care\collsvc.exe
O23 - Service: VAIO Media plus Content Importer (SOHCImp) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\SOHLib\SOHCImp.exe
O23 - Service: VAIO Media plus Database Manager (SOHDBSvr) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe
O23 - Service: VAIO Media plus Digital Media Server (SOHDms) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\SOHLib\SOHDms.exe
O23 - Service: VAIO Media plus Device Searcher (SOHDs) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\SOHLib\SOHDs.exe
O23 - Service: VAIO Media plus Playlist Manager (SOHPlMgr) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Power Management - Sony Corporation - C:\Program Files\Sony\VAIO Power Management\SPMService.exe
O23 - Service: VAIO Content Folder Watcher (VCFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe
O23 - Service: VAIO Content Metadata Intelligent Analyzing Manager (VcmIAlzMgr) - Sony Corporation - C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
O23 - Service: VAIO Content Metadata Intelligent Network Service Manager (VcmINSMgr) - Sony Corporation - C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe
O23 - Service: VAIO Content Metadata XML Interface (VcmXmlIfHelper) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe
O23 - Service: VSNService - Sony Corporation - C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
O23 - Service: VUAgent - Sony Corporation - C:\Program Files\Sony\VAIO Update 5\VUAgent.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe

--
End of file - 9140 bytes



juliettehasagun191
Inviato: Wednesday, July 28, 2010 2:32:46 PM
Rank: Member

Iscritto dal : 7/27/2010
Posts: 19
Ah poi una cosa, kaspersky ha rilevato "pdm.keylogger"...la cosa assurda è che l'ho trovato in un programma originale del Vaio(Vaio Gate), com'è possibile? O.o
fdaccc
Inviato: Wednesday, July 28, 2010 2:34:19 PM

Rank: AiutAmico

Iscritto dal : 12/12/2009
Posts: 2,114
Sarà certamente un falso positivo.
shapiro
Inviato: Wednesday, July 28, 2010 6:13:16 PM

Rank: AiutAmico

Iscritto dal : 8/24/2008
Posts: 4,164
a parte questa voce da fixare con hjt non vedo niente di pericoloso

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)


riguardo il rilevamento di kaspersky prova a leggere cosa dicono qui




a proposito, dovresti scaricare nuovamente hijackthis e metterlo in Programmi o documenti se vuoi salvare i back up


rimuovi combofix con OTC by OldTimer

eseguilo
Clicca su CleanUp.
Alla richiesta di riavvio clicca SI


Installa Ccleaner da qui



durante l’installazione deseleziona l’opzione per la barra di Yahoo, lo apri, vai in Opzioni>Avanzate, togli la spunta a “Cancella file temp diwindows solo se più vecchi di 48 ore”, poi avvialo, seleziona "Analizza" ed alla fine dell'analisi premi "Avvia pulizia''


clicca su Registro, nella pagina successiva clicca Trova problemi, poi al termine dello scan clicca su Ripara selezionati , risposndi di sì alla richiesta di salvare il backup (salvalo in una cartella a piacimento) poi ripara tutti gli elementi trovati.

scarica atf cleaner

non ha bisogno di installazione

Avvia ATF Cleaner.exe con un doppio click
- clicca sul menu main
- seleziona la casella Select All
- clicca sul pulsante Empty selected
- aspetta l'avviso Done Cleaning.
(se non vuoi eliminare le password togli la spunta)
(se usi opera o firefox,spunta anche le loro sezioni)


Scarica e installa l'ultima versione di adobe reader

scarica la versione aggiornata di java sun


controlla se hai ancora qualche problema col pc





juliettehasagun191
Inviato: Wednesday, July 28, 2010 8:04:45 PM
Rank: Member

Iscritto dal : 7/27/2010
Posts: 19
fatto...il pc sembra non avere altri problemi...grazie mille! Dancing
juliettehasagun191
Inviato: Wednesday, July 28, 2010 9:23:24 PM
Rank: Member

Iscritto dal : 7/27/2010
Posts: 19
Anzi shapiro, visto che ci sono un'altra cosa te la vorrei chiedere:
guardando il mio Log di Hijackthis, vedi qualcosa di "strano"? Tipo connessioni remote e/o simili?
grazie per la pazienza! :)
Utenti presenti in questo topic
Guest


Salta al Forum
Aggiunta nuovi Topic disabilitata in questo forum.
Risposte disabilitate in questo forum.
Eliminazione tuoi Post disabilitata in questo forum.
Modifica dei tuoi post disabilitata in questo forum.
Creazione Sondaggi disabilitata in questo forum.
Voto ai sondaggi disabilitato in questo forum.

Main Forum RSS : RSS

Aiutamici Theme
Powered by Yet Another Forum.net versione 1.9.1.8 (NET v2.0) - 3/29/2008
Copyright © 2003-2008 Yet Another Forum.net. All rights reserved.