finalmente sono riscito ad avere il report
ComboFix 10-02-24.03 - Utente PC 25/02/2010 16.28.30.4.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.39.1040.18.2047.1481 [GMT 1:00]
Eseguito da: c:\documents and settings\Utente PC\Desktop\ComboFix.exe
Opzioni usate :: c:\documents and settings\Utente PC\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1368 [VPS 100224-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
--------------- FCopy ---------------
c:\windows\ServicePackFiles\i386\ctfmon.exe --> c:\windows\System32\ctfmon.exe
.
((((((((((((((((((((((((( Files Creati Da 2010-01-25 al 2010-02-25 )))))))))))))))))))))))))))))))))))
.
2010-02-25 15:28 . 2008-04-14 02:14 15360 -c--a-w- c:\windows\system32\dllcache\ctfmon.exe
2010-02-25 15:28 . 2008-04-14 02:14 15360 ----a-w- c:\windows\system32\ctfmon.exe
2010-02-25 13:37 . 2010-02-25 13:38 -------- d-----w- c:\documents and settings\Utente PC\.calme
2010-02-25 13:37 . 2010-02-25 13:37 -------- d-----w- c:\programmi\Calme 2010
2010-02-25 11:51 . 2010-02-25 11:51 -------- d--h--w- c:\windows\PIF
2010-02-25 11:33 . 2010-02-25 11:33 -------- d-----w- c:\programmi\File comuni\Java
2010-02-25 11:31 . 2010-02-25 11:31 79488 ----a-w- c:\documents and settings\Utente PC\Dati applicazioni\Sun\Java\jre1.6.0_18\gtapi.dll
2010-02-25 11:31 . 2010-02-25 11:31 152576 ----a-w- c:\documents and settings\Utente PC\Dati applicazioni\Sun\Java\jre1.6.0_18\lzma.dll
2010-02-25 10:28 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-25 10:28 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-25 10:18 . 2010-02-25 10:18 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\TEMP
2010-02-25 10:18 . 2010-02-25 10:22 -------- d-----w- c:\programmi\SpywareBlaster
2010-02-24 21:36 . 2010-02-24 21:36 348160 ----a-w- c:\documents and settings\Utente PC\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-25a81c8e-n\msvcr71.dll
2010-02-24 21:36 . 2010-02-24 21:36 503808 ----a-w- c:\documents and settings\Utente PC\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-25a81c8e-n\msvcp71.dll
2010-02-24 21:36 . 2010-02-24 21:36 499712 ----a-w- c:\documents and settings\Utente PC\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-25a81c8e-n\jmc.dll
2010-02-24 21:36 . 2010-02-24 21:36 61440 ----a-w- c:\documents and settings\Utente PC\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-50df9eca-n\decora-sse.dll
2010-02-24 21:36 . 2010-02-24 21:36 12800 ----a-w- c:\documents and settings\Utente PC\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-50df9eca-n\decora-d3d.dll
2010-02-24 21:36 . 2010-02-25 11:32 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-02-24 14:57 . 2010-02-25 12:46 -------- d-----w- c:\programmi\a-squared Anti-Malware
2010-02-24 14:34 . 2010-02-24 14:34 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-02-24 11:27 . 2010-02-24 11:27 -------- d-----w- c:\documents and settings\Administrator\Dati applicazioni\Malwarebytes
2010-02-24 11:21 . 2010-02-24 11:21 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2010-02-23 20:53 . 2010-02-23 20:53 -------- d-----w- c:\documents and settings\Utente PC\Dati applicazioni\Malwarebytes
2010-02-23 20:53 . 2010-02-23 20:53 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Malwarebytes
2010-02-23 20:53 . 2010-02-25 10:44 -------- d-----w- c:\programmi\Malwarebytes' Anti-Malware
2010-02-23 00:22 . 2010-02-23 00:23 -------- d-----w- c:\documents and settings\Utente PC\Dati applicazioni\java
2010-02-23 00:22 . 2010-02-23 00:22 49152 ---ha-w- c:\documents and settings\Utente PC\Dati applicazioni\java\msnmsgs.exe
2010-02-23 00:22 . 2010-02-23 00:22 49152 ----a-w- c:\documents and settings\Utente PC\Dati applicazioni\msnmsgs.exe
2010-02-05 11:28 . 2010-02-05 11:28 -------- d-----w- c:\programmi\DownloadToolz
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-25 15:29 . 2002-09-10 13:00 93414 ----a-w- c:\windows\system32\perfc010.dat
2010-02-25 15:29 . 2002-09-10 13:00 515148 ----a-w- c:\windows\system32\perfh010.dat
2010-02-25 13:48 . 2008-12-15 12:12 -------- d-----w- c:\programmi\CCleaner
2010-02-25 12:46 . 2008-09-04 17:29 -------- d-----w- c:\programmi\Bit Che
2010-02-25 11:32 . 2008-02-07 10:03 -------- d-----w- c:\programmi\Java
2010-02-25 10:52 . 2007-10-15 20:48 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Spybot - Search & Destroy
2010-02-24 18:46 . 2007-10-07 21:32 -------- d-----w- c:\programmi\DustBuster
2010-02-24 12:47 . 2009-04-07 14:53 -------- d-----w- c:\programmi\File comuni\Apple
2010-02-23 10:26 . 2008-07-26 21:39 -------- d-----w- c:\documents and settings\Utente PC\Dati applicazioni\uTorrent
2010-02-23 00:22 . 2007-10-07 03:12 76960 ----a-w- c:\documents and settings\Utente PC\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2010-02-22 21:55 . 2009-05-25 17:48 -------- d-----w- c:\programmi\KeyText
2010-02-22 21:55 . 2007-10-16 12:40 -------- d-----w- c:\programmi\eMule
2010-02-22 21:47 . 2009-11-27 14:13 -------- d-----w- c:\programmi\QuickTime
2010-02-20 21:24 . 2009-05-28 12:40 -------- d-----w- c:\programmi\Burraconline
2010-02-19 14:16 . 2008-02-27 00:32 -------- d-----w- c:\programmi\Microsoft Silverlight
2010-02-05 10:44 . 2009-11-17 22:09 -------- d-----w- c:\programmi\vixy.net
2010-01-28 23:21 . 2008-12-12 17:02 -------- d-----w- c:\programmi\Google
2010-01-28 14:19 . 2008-02-07 15:03 -------- d-----w- c:\documents and settings\Utente PC\Dati applicazioni\Skype
2010-01-28 14:13 . 2008-02-07 15:08 -------- d-----w- c:\documents and settings\Utente PC\Dati applicazioni\skypePM
2010-01-22 15:57 . 2008-09-11 15:01 -------- d-----w- c:\programmi\File comuni\Adobe
2010-01-14 10:12 . 2009-10-16 16:30 181120 ------w- c:\windows\system32\MpSigStub.exe
2009-12-18 13:37 . 2009-12-18 13:37 20299200 ----a-w- c:\documents and settings\Utente PC\Dati applicazioni\TomTom\HOME\Profiles\d2fwwasx.default\Updates\v2_7_3_1894_win.exe
.
Code:<pre>
c:\programmi\ClocX\ClocX .exe
c:\windows\system32\dla\tfswctrl .exe
</pre>
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"Windows Defender"="c:\programmi\Windows Defender\MSASCui.exe" [2006-11-03 866584]
"LifeCam"="c:\programmi\Microsoft LifeCam\LifeExp.exe" [2006-10-13 277296]
"VX1000"="c:\windows\vVX1000.exe" [2006-10-13 707376]
"SunJavaUpdateSched"="c:\programmi\File comuni\Java\Java Update\jusched.exe" [2010-01-11 246504]
c:\documents and settings\Utente PC\Menu Avvio\Programmi\Esecuzione automatica\
KeyText.lnk - c:\programmi\KeyText\KeyText.exe [2009-5-25 409600]
c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Nikon Monitor.lnk - c:\programmi\File comuni\Nikon\Monitor\NkMonitor.exe [2007-10-18 479232]
Windows Search.lnk - c:\programmi\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\programmi\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^Lotus Organizer EasyClip.lnk]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^Lotus QuickStart.lnk]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^Lotus SmartCenter.lnk]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^Lotus SuiteStart.lnk]
[HKLM\~\startupfolder\C:^Documents and Settings^Utente PC^Menu Avvio^Programmi^Esecuzione automatica^Registrazione Lotus SmartSuite Versione 9.lnk]
[HKLM\~\startupfolder\C:^Documents and Settings^Utente PC^Menu Avvio^Programmi^Esecuzione automatica^TimeLeft.lnk]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
~c:\programmi\Yahoo!\Messenger\YahooMessenger.exe [N/A]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"TomTomHOME.exe"="c:\programmi\TomTom HOME 2\TomTomHOMERunner.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"iTunesHelper"="c:\programmi\iTunes\iTunesHelper.exe"
"SweetIM"=c:\programmi\SweetIM\Messenger\SweetIM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"QuickTime Task"="c:\programmi\QuickTime\qttask.exe" -atboottime
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\Microsoft LifeCam\\LifeExp.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmi\\Microsoft LifeCam\\LifeCam.exe"=
"c:\\Programmi\\Nero\\Nero 7\\Nero ShowTime\\ShowTime.exe"=
"c:\\Programmi\\eMule\\eMule.exe"=
"c:\\Programmi\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Programmi\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Programmi\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Programmi\\Pinnacle\\Studio 11\\programs\\RM.exe"=
"c:\\Programmi\\Pinnacle\\Studio 11\\programs\\Studio.exe"=
"c:\\Programmi\\Pinnacle\\Studio 11\\programs\\PMSRegisterFile.exe"=
"c:\\Programmi\\Pinnacle\\Studio 11\\programs\\umi.exe"=
"c:\\Programmi\\LimeWire\\LimeWire.exe"=
"c:\\Programmi\\uTorrent\\uTorrent.exe"=
"c:\\Programmi\\Messenger\\msmsgs.exe"=
"c:\\Programmi\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Programmi\\TavoliVerdi\\TavoliVerdi.exe"=
"c:\\Programmi\\TavoliVerdi\\TVControllo.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programmi\\iTunes\\iTunes.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programmi\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Programmi\\Skype\\Phone\\Skype.exe"=
R0 PQV2i;PQV2i;c:\windows\system32\drivers\PQV2i.sys [29/07/2004 2.33.08 138780]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [31/03/2008 14.22.38 114768]
R1 PQIMount;PQIMount;c:\windows\system32\drivers\PQIMount.sys [29/07/2004 3.13.28 46779]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [31/03/2008 14.22.38 20560]
R2 Network WanMiniport First Position;Network WanMiniport First Position;c:\programmi\Telecom Italia\WanMiniport1st\srvany.exe [27/07/2008 20.42.55 8192]
R2 TomTomHOMEService;TomTomHOMEService;c:\programmi\TomTom HOME 2\TomTomHOMEService.exe [13/11/2009 12.31.14 92008]
R2 WinDefend;Windows Defender;c:\programmi\Windows Defender\MsMpEng.exe [03/11/2006 18.19.58 13592]
R3 UsbFltr;WayTech USB Filter Driver;c:\windows\system32\drivers\UsbFltr.sys [21/04/2003 16.58.22 11392]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]
S2 gupdate;Servizio di Google Update (gupdate);c:\programmi\Google\Update\GoogleUpdate.exe [29/01/2010 0.21.59 135664]
.
Contenuto della cartella 'Scheduled Tasks'
2010-02-05 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programmi\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
2010-01-20 c:\windows\Tasks\FRU Task 2003-04-10 00:56ewlett-Packard2003-04-10 00:56p psc 1200 series272A572217594EBCF1CEE215E352B92AD073FDE4253618421.job
- c:\programmi\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-09 15:56]
2010-02-25 c:\windows\Tasks\GlaryInitialize.job
- c:\programmi\Glary Utilities\initialize.exe [2009-04-11 07:49]
2010-02-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2010-01-28 23:21]
2010-02-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2010-01-28 23:21]
2010-02-25 c:\windows\Tasks\MP Scheduled Scan.job
- c:\programmi\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]
2010-02-17 c:\windows\Tasks\WebReg 20100217143005.job
- c:\programmi\Hewlett-Packard\Digital Imaging\Bin\hpqwrg.exe [2003-04-09 16:06]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
uInternet Connection Wizard,ShellNext = hxxp://www.register.epson-europe.com/
uInternet Settings,ProxyOverride = local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\programmi\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: Invia a &Bluetooth - c:\programmi\Belkin\Software Bluetooth\btsendto_ie_ctx.htm
DPF: Microsoft XML Parser for Java
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2010-02-25 16:37
Windows 5.1.2600 Service Pack 3 NTFS
scansione processi nascosti ...
scansione entrate autostart nascoste ...
Scansione files nascosti ...
Scansione completata con successo
Files nascosti: 0
**************************************************************************
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------
- - - - - - - > 'explorer.exe'(1320)
c:\windows\system32\WININET.dll
c:\programmi\Windows Desktop Search\deskbar.dll
c:\programmi\Windows Desktop Search\it-it\dbres.dll.mui
c:\programmi\Windows Desktop Search\dbres.dll
c:\programmi\Windows Desktop Search\wordwheel.dll
c:\programmi\Windows Desktop Search\it-it\msnlExtRes.dll.mui
c:\programmi\Windows Desktop Search\msnlExtRes.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\programmi\Windows Desktop Search\MSNLNamespaceMgr.dll
c:\windows\system32\dla\tfswshx.dll
c:\windows\system32\tfswapi.dll
c:\windows\system32\dla\tfswcres.dll
c:\programmi\Microsoft Office\Office12\1040\GrooveIntlResource.dll
c:\programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
c:\programmi\File comuni\Ahead\Lib\NeroDigitalExt.dll
c:\programmi\File comuni\Adobe\Acrobat\ActiveX\PDFShell.dll
c:\programmi\File comuni\Adobe\Acrobat\ActiveX\PDFShell.ITA
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\programmi\Alwil Software\Avast4\aswUpdSv.exe
c:\programmi\Alwil Software\Avast4\ashServ.exe
c:\programmi\Belkin\Software Bluetooth\bin\btwdins.exe
c:\windows\System32\GEARSec.exe
c:\programmi\Java\jre6\bin\jqs.exe
c:\programmi\Microsoft LifeCam\MSCamS32.exe
c:\programmi\Symantec\Norton Ghost\Agent\PQV2iSvc.exe
c:\programmi\Telecom Italia\WanMiniport1st\WanMiniport1st_srv.exe
c:\windows\system32\SearchIndexer.exe
c:\windows\system32\wscntfy.exe
c:\programmi\Alwil Software\Avast4\ashMaiSv.exe
c:\programmi\Alwil Software\Avast4\ashWebSv.exe
c:\programmi\Burraconline\BurracoClient.exe
c:\windows\system32\SearchProtocolHost.exe
c:\windows\system32\SearchFilterHost.exe
.
**************************************************************************
.
Ora fine scansione: 2010-02-25 16:42:59 - Il pc è stato riavviato
ComboFix-quarantined-files.txt 2010-02-25 15:42
ComboFix2.txt 2010-02-25 15:17
ComboFix3.txt 2010-02-25 15:07
ComboFix4.txt 2010-02-25 13:28
Pre-Run: 76.456.189.952 byte disponibili
Post-Run: 76.411.588.608 byte disponibili
- - End Of File - - B01D95E34A95C74008A8FCE93A79974C