ComboFix 12-06-11.04 - Ermanno 12/06/2012 8.05.08.9.1 - x86
Microsoft� Windows Vista Home Premium 6.0.6002.2.1252.39.1040.18.3070.2035 [GMT 2:00]
Eseguito da: c:\users\Ermanno\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Common Files\ASPG_icon.ico
c:\program files\OfferBox
c:\users\Ermanno\AppData\Roaming\OfferBox
c:\users\Ermanno\AppData\Roaming\OfferBox\config.xml
.
.
((((((((((((((((((((((((( Files Creati Da 2012-05-12 al 2012-06-12 )))))))))))))))))))))))))))))))))))
.
.
2012-06-12 06:15 . 2012-06-12 06:15 -------- d-----w- c:\users\Ermanno\AppData\Local\temp
2012-06-12 06:15 . 2012-06-12 06:15 -------- d-----w- c:\users\Public\AppData\Local\temp
2012-06-12 06:15 . 2012-06-12 06:15 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-06-12 06:15 . 2012-06-12 06:15 -------- d-----w- c:\users\ADMINI~1\AppData\Local\temp
2012-06-12 05:53 . 2012-05-08 16:40 6737808 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{7646C353-F269-48F6-AF46-CDB191A1CC39}\mpengine.dll
2012-06-11 12:05 . 2012-06-11 12:05 -------- d-----w- c:\program files\Tracker Software
2012-06-04 15:29 . 2012-06-04 15:29 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-05-26 16:17 . 2012-05-26 16:17 -------- d-----w- c:\program files\Common Files\Skype
2012-05-26 16:17 . 2012-05-26 16:17 -------- d-----r- c:\program files\Skype
2012-05-19 17:25 . 2012-03-01 11:01 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
2012-05-18 10:54 . 2012-06-01 17:49 -------- d-----w- c:\program files\uTorrent
2012-05-13 16:39 . 2012-05-13 16:39 -------- d-----w- c:\users\Ermanno\AppData\Roaming\Iminent
2012-05-13 16:39 . 2012-05-13 16:39 -------- d-----w- c:\program files\IMinent Toolbar
2012-05-13 16:39 . 2012-05-13 16:39 -------- d-----w- c:\programdata\Iminent
2012-05-13 16:38 . 2012-05-13 16:38 -------- d-----w- c:\program files\Iminent
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-04 15:29 . 2012-01-05 11:57 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-04-27 08:20 . 2012-03-07 20:57 137928 ----a-w- c:\windows\system32\drivers\avipbb.sys
2012-04-24 22:32 . 2012-03-07 20:57 83392 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2012-04-16 19:18 . 2012-03-07 20:57 36000 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2012-04-04 13:56 . 2011-06-20 13:04 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-04-03 08:16 . 2012-05-09 09:06 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-04-03 08:16 . 2012-05-09 09:06 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-04-02 13:36 . 2012-05-09 09:06 2044928 ----a-w- c:\windows\system32\win32k.sys
2012-03-30 12:39 . 2012-05-09 09:09 905600 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-03-20 23:28 . 2012-05-09 09:09 53120 ----a-w- c:\windows\system32\drivers\partmgr.sys
2010-05-22 20:04 . 2010-05-22 20:04 3099136 ----a-w- c:\program files\openofficeorg32.msi
2008-07-02 03:28 . 2008-07-02 03:28 61440 ----a-w- c:\program files\Common Files\CPInstallAction.dll
.
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ADSMOverlayIcon1]
@="{A8D448F4-0431-45AC-9F5E-E1B434AB2249}"
[HKEY_CLASSES_ROOT\CLSID\{A8D448F4-0431-45AC-9F5E-E1B434AB2249}]
2007-06-02 01:08 143360 ----a-w- c:\program files\ASUS\ASUS Data Security Manager\OverlayIconShlExt1.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-05-01 348624]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"ASUSTPE"="c:\windows\system32\ASUSTPE.exe" [2007-10-12 106496]
"ASUS Screen Saver Protector"="c:\windows\ASScrPro.exe" [2009-02-16 33136]
"ASUS Camera ScreenSaver"="c:\windows\AsScrProlog.exe" [2009-02-16 47672]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"<NO NAME>"= 1
"NoDesk"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EEventManager]
2009-01-12 08:54 669520 ----a-w- c:\progra~1\EPSONS~1\EVENTM~1\EEventManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Samsung PanelMgr]
2010-06-07 10:15 618496 ----a-w- c:\windows\Samsung\PanelMgr\SSMMgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-953317019-35223143-1545133680-1000]
"EnableNotificationsRef"=dword:00000002
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contenuto della cartella 'Scheduled Tasks'
.
2012-06-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-26 10:10]
.
2012-06-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-26 10:10]
.
2010-12-16 c:\windows\Tasks\User_Feed_Synchronization-{5FEEA278-E9E9-494E-A234-C55128FED9FB}.job
- c:\windows\system32\msfeedssync.exe [2012-04-12 08:09]
.
.
------- Scansione supplementare -------
.
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
TCP: DhcpNameServer = 192.168.250.1
FF - ProfilePath - c:\users\Ermanno\AppData\Roaming\Mozilla\Firefox\Profiles\14w32ol1.default\
.
- - - - CHIAVI ORFANE RIMOSSE - - - -
.
WebBrowser-{1D03A978-AC0C-4004-B9FD-9CF361C7BD3F} - (no file)
WebBrowser-{4AE0C3D6-F713-4EED-BC65-25DC3FFDAAC1} - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2012-06-12 08:15
Windows 6.0.6002 Service Pack 2 NTFS
.
scansione processi nascosti ...
.
scansione entrate autostart nascoste ...
.
Scansione files nascosti ...
.
.
C:\ADSM_PData_0150
.
Scansione completata con successo
Files nascosti: 1
.
**************************************************************************
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------
.
- - - - - - - > 'Explorer.exe'(2676)
c:\program files\ASUS\ASUS Data Security Manager\OverlayIconShlExt.dll
c:\program files\ASUS\ASUS Data Security Manager\OverlayIconShlExt1.dll
.
Ora fine scansione: 2012-06-12 08:22:41
ComboFix-quarantined-files.txt 2012-06-12 06:20
ComboFix2.txt 2011-08-16 15:36
ComboFix3.txt 2011-02-18 07:18
ComboFix4.txt 2011-02-13 18:57
.
Pre-Run: 75.362.209.792 byte disponibili
Post-Run: 75.178.004.480 byte disponibili
.
- - End Of File - - B66829437AC10225F98A8186016B464B