Grazie..provvedo e riposto il tutto..

l'infezione non e' stata eliminata

lo script deve essere eseguito dal desktop, attendi le istruzioni che ti dara' r16


ComboFix 12-07-13.03 - utente 14/07/2012 22.29.33.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.39.1040.18.2046.1200 [GMT 2:00]
Eseguito da: c:\users\utente\Downloads\ComboFix.exe
Opzioni usate :: c:\users\utente\Downloads\CFScript.txt
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

Grazie..ho rifatto tutta la procedura..ecco il Log finale:

ComboFix 12-07-14.01 - utente 15/07/2012 16.19.08.3.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.39.1040.18.2046.1124 [GMT 2:00]
Eseguito da: c:\users\utente\Desktop\ComboFix.exe
Opzioni usate :: c:\users\utente\Desktop\CFScript.txt.txt
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\users\utente\AppData\Roaming\hhsjerq.dll"
.
.
((((((((((((((((((((((((( Files Creati Da 2012-06-15 al 2012-07-15 )))))))))))))))))))))))))))))))))))
.
.
2012-07-15 14:24 . 2012-07-15 14:25 -------- d-----w- c:\users\utente\AppData\Local\temp
2012-07-15 14:24 . 2012-07-15 14:24 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-07-14 19:53 . 2012-07-14 19:53 -------- d-----w- c:\users\Default\AppData\Roaming\Intel
2012-07-14 19:53 . 2012-07-14 19:53 -------- d-----w- c:\users\utente\Roaming
2012-07-14 19:53 . 2012-07-14 19:53 -------- d-----w- c:\users\Public\Roaming
2012-07-14 19:53 . 2012-07-14 19:53 -------- d-----w- c:\users\Default\Roaming
2012-07-14 19:52 . 2012-07-14 19:52 -------- d-----w- c:\program files\Cisco
2012-07-14 19:52 . 2012-07-14 19:52 -------- d-----w- c:\program files\Common Files\Intel
2012-07-14 19:52 . 2012-07-14 19:52 -------- d-----w- c:\programdata\Intel
2012-07-14 13:16 . 2012-07-14 13:32 -------- d-----w- c:\program files\stinger
2012-07-13 17:23 . 2012-05-31 03:41 6762896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{423594A1-0D0A-411D-9BCE-7D7A495A1F1C}\mpengine.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 153136]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"Acer Tour Reminder"="" [BU]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-05-09 865840]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-04-25 457216]
"eAudio"="c:\acer\Empowering Technology\eAudio\eAudio.exe" [2007-06-11 1286144]
"RtHDVCpl"="RtHDVCpl.exe" [2007-09-04 4702208]
"PLFSet"="c:\windows\PLFSet.dll" [2007-04-25 45056]
"LManager"="c:\progra~1\LAUNCH~1\QtZgAcer.EXE" [2007-07-31 707080]
"PlayMovie"="c:\program files\Acer Arcade Deluxe\Play Movie\PMVService.exe" [2007-05-24 206952]
"Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-08-01 151552]
"WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-02-12 174872]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-09 153136]
"NSLauncher"="c:\program files\Nokia\Nokia Software Launcher\NSLauncher.exe" [2007-03-07 2957312]
"ContentTransferWMDetector.exe"="c:\program files\Sony\Content Transfer\ContentTransferWMDetector.exe" [2008-07-11 423200]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-05-27 413696]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-06-26 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-26 8433664]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-06-26 81920]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
Contenuto della cartella 'Scheduled Tasks'
.
2012-07-15 c:\windows\Tasks\User_Feed_Synchronization-{04B8337E-5412-4C23-B45C-D8ACF95CFFFA}.job
- c:\windows\system32\msfeedssync.exe [2011-06-17 04:32]
.
.
------- Scansione supplementare -------
.
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = hxxp://it.intl.acer.yahoo.com
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-07-15 16:25
Windows 6.0.6001 Service Pack 1 NTFS
.
scansione processi nascosti ...
.
scansione entrate autostart nascoste ...
.
Scansione files nascosti ...
.
Scansione completata con successo
Files nascosti: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files\Acer Arcade Deluxe\Play Movie\000.fcl"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\asibisag]
"ServiceDll"="c:\users\utente\AppData\Roaming\hhsjerq.dll"
--
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\nabqra]
"ServiceDll"="c:\users\utente\AppData\Roaming\hhsjerq.dll"
--
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wbztsu]
"ServiceDll"="c:\users\utente\AppData\Roaming\hhsjerq.dll"
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\windows\system32\WLANExt.exe
c:\acer\ALaunch\ALaunchSvc.exe
c:\windows\system32\SupportAppXL\cdrom_mon.exe
c:\acer\Empowering Technology\eDataSecurity\eDSService.exe
c:\acer\Empowering Technology\eLock\Service\eLockServ.exe
c:\acer\Empowering Technology\eNet\eNet Service.exe
c:\program files\Intel\WiFi\bin\EvtEng.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\acer\Mobility Center\MobilityService.exe
c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\acer\Empowering Technology\eRecovery\eRecoveryService.exe
c:\acer\Empowering Technology\eSettings\Service\capuserv.exe
c:\acer\Empowering Technology\ePower\ePowerSvc.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\conime.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
c:\program files\Windows Media Player\wmpnscfg.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Ora fine scansione: 2012-07-15 16:30:06 - Il pc è stato riavviato
ComboFix-quarantined-files.txt 2012-07-15 14:30
ComboFix2.txt 2012-07-15 14:07
.
Pre-Run: 20.570.300.416 byte disponibili
Post-Run: 20.535.369.728 byte disponibili
.
- - End Of File - - FF7DDC53C1D000A1659175B06B9E697F

ciao r16 non ha funzionato perche' lo ha salvato con doppia estensione

Opzioni usate :: c:\users\utente\Desktop\CFScript.txt.txt

Buona sra,scusate se mi intrometto,io ho risolto con combofix in modalità provvisoria e non sto più avendo problemi

un saluto a tutti e scusatemi se mi intrometto anche perchè di siti porno me ne intendo ;O)))))

avvia in modalità provvisoria F8

start ... esegui .... msconfig .... avvio e togli la spunta su una voce dove compare O_o o cosa simile spegni e riaccendi sempre in modalità provvisoria fai una sansione con malware .... o con combofix in modalità normale

ricordati .... opzioni predefinite di internet e poi la pagina predefinita .....

saluti :O)

---

Ciao giovane.
Non ti piacerà la risposta.
Ma ti ho risposto.

Avvia OTL.

Sotto "Custom Scans\Fixes" copia-incolla questo codice:



Clicca sul pulsante RUN FIX.
Lascia fare la scansione senza interferire.
Il pc si riavvierà da solo.
Posta il log

Ciao Ragazzi, anche io ho contratto il virus della Polizia di stato, utilizzando ComboFix ed attendendo tutta la procedura al nuovo riavvio sembra che sia tutto OK ... (nel senso non mi compare + la schermata di blocco) ma posso fidarmi ? Siamo sicuri che non ci sia qualcosa dormiente o qualche altra cosa che possa carpire i miei dati sensibili ?
Vi allego il Log in modo da capire se realmente ci sono ulteriori minacce :

ComboFix 12-07-19.02 - EZIO1 20/07/2012 0:28.1.4 - x64 MINIMAL
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.39.1040.18.4023.2938 [GMT 2:00]
Eseguito da: c:\users\EZIO1\Desktop\abc.exe
Opzioni usate :: /killall
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Creato nuovo punto di ripristino
.
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Common Files\Acer GameZone online.ico
c:\programdata\CB588B2647.sys
c:\users\EZIO1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
c:\windows\SysWow64\DEBUG.log
c:\windows\SysWow64\muzapp.exe
c:\windows\vspc1000.exe
c:\windows\vspc1300.exe
c:\windows\XSxS
.
.
((((((((((((((((((((((((( Files Creati Da 2012-06-20 al 2012-07-20 )))))))))))))))))))))))))))))))))))
.
.
2012-07-19 22:37 . 2012-07-19 22:37 -------- d-----w- c:\users\Simona\AppData\Local\temp
2012-07-19 22:37 . 2012-07-19 22:37 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-07-19 22:06 . 2012-07-16 00:40 9133488 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F295BE2C-98D6-4F38-A07B-52F4855A5032}\mpengine.dll
2012-07-19 21:25 . 2012-07-19 21:25 -------- d-----w- c:\users\Salvo\AppData\Local\IomegaStorageManager
2012-07-15 16:12 . 2012-06-12 03:08 3148800 ----a-w- c:\windows\system32\win32k.sys
2012-07-15 16:03 . 2012-06-02 11:57 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2012-07-15 16:03 . 2012-06-02 08:16 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb
2012-07-15 16:03 . 2012-06-02 12:52 174200 ----a-w- c:\program files\Internet Explorer\sqmapi.dll
2012-07-15 16:03 . 2012-06-02 12:04 237056 ----a-w- c:\windows\system32\url.dll
2012-07-15 16:03 . 2012-06-02 11:57 96768 ----a-w- c:\windows\system32\mshtmled.dll
2012-07-15 16:03 . 2012-06-02 09:08 140920 ----a-w- c:\program files (x86)\Internet Explorer\sqmapi.dll
2012-07-15 16:03 . 2012-06-02 08:22 194560 ----a-w- c:\program files (x86)\Internet Explorer\ieproxy.dll
2012-07-15 16:00 . 2012-06-09 05:43 14172672 ----a-w- c:\windows\system32\shell32.dll
2012-06-29 12:47 . 2012-06-29 12:47 -------- d-----w- c:\users\EZIO1\AppData\Roaming\skypePM
2012-06-27 22:12 . 2012-06-27 22:12 -------- d-----w- c:\windows\it
2012-06-27 22:07 . 2012-03-08 16:40 48488 ----a-w- c:\windows\system32\drivers\fssfltr.sys
2012-06-27 22:07 . 2012-06-27 22:07 19736 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2012-06-27 22:04 . 2012-06-27 22:04 -------- d-----w- c:\program files (x86)\Microsoft
2012-06-27 22:03 . 2012-06-27 22:03 7450888 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\a29638df1cd54b00d\bingbarsetup.exe
2012-06-27 22:02 . 2012-05-04 11:06 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-06-27 22:02 . 2012-05-04 10:03 3913072 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2012-06-27 22:02 . 2012-05-04 10:03 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-06-27 22:02 . 2012-04-26 05:41 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-06-27 22:02 . 2012-04-26 05:41 77312 ----a-w- c:\windows\system32\rdpwsx.dll
2012-06-27 22:02 . 2012-04-26 05:34 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-06-27 22:02 . 2012-06-27 22:02 15712 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\8f622f611cd54b00b\MeshBetaRemover.exe
2012-06-27 22:02 . 2012-06-27 22:02 537432 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\8aa550a41cd54b00a\DXSETUP.exe
2012-06-27 22:02 . 2012-06-27 22:02 1801048 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\8aa550a41cd54b00a\dsetup32.dll
2012-06-27 22:02 . 2012-06-27 22:02 89944 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\8aa550a41cd54b00a\DSETUP.dll
2012-06-27 22:02 . 2012-04-28 03:55 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-06-27 21:57 . 2012-06-27 21:57 -------- d-----w- c:\users\EZIO1\AppData\Local\Windows Live
2012-06-27 21:56 . 2012-06-27 21:56 -------- d-----w- c:\users\EZIO1\Tracing
2012-06-24 13:24 . 2012-06-24 13:24 -------- d-----w- c:\users\EZIO1\AppData\Local\IomegaStorageManager
2012-06-24 13:24 . 2012-06-24 13:24 -------- d-----w- c:\program files\Iomega
2012-06-24 13:23 . 2012-06-24 13:23 -------- d-----w- c:\programdata\twonkyserver
2012-06-24 13:22 . 2012-06-24 13:24 -------- d-----w- c:\program files (x86)\Iomega Storage Manager
2012-06-24 10:45 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-24 10:45 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll
2012-06-24 10:45 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll
2012-06-24 10:45 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-24 10:45 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll
2012-06-24 10:45 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll
2012-06-24 10:45 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll
2012-06-24 10:45 . 2012-06-02 13:19 186752 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-24 10:45 . 2012-06-02 13:15 36864 ----a-w- c:\windows\system32\wuapp.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-19 22:04 . 2010-09-08 19:18 59701280 ----a-w- c:\windows\system32\MRT.exe
2012-07-14 14:03 . 2010-09-13 19:33 2828 --sha-w- c:\programdata\KGyGaAvL.sys
2012-07-03 16:21 . 2012-02-26 16:08 54072 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2012-07-03 16:21 . 2011-03-16 18:14 958400 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-07-03 16:21 . 2010-09-08 19:26 71064 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2012-07-03 16:21 . 2010-09-08 19:26 59728 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-07-03 16:21 . 2010-09-08 19:26 355856 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-07-03 16:21 . 2010-09-08 19:26 25232 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-07-03 16:21 . 2010-09-08 19:25 41224 ----a-w- c:\windows\avastSS.scr
2012-07-03 16:21 . 2010-09-08 19:25 227648 ----a-w- c:\windows\SysWow64\aswBoot.exe
2012-07-03 16:21 . 2011-01-21 19:22 285328 ----a-w- c:\windows\system32\aswBoot.exe
2012-06-17 18:08 . 2012-04-05 16:56 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-06-17 18:08 . 2011-05-21 16:15 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-05-31 10:25 . 2010-02-05 05:00 279656 ------w- c:\windows\system32\MpSigStub.exe
2012-05-11 05:20 . 2011-01-20 20:17 20048 ----a-w- c:\windows\system32\drivers\vNICdrv.sys
.
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-09-10 13:41 120104 ----a-w- c:\program files (x86)\EgisTec\MyWinLocker 3\x86\PSDProtect.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-02-05 39408]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"MobileDocuments"="c:\program files (x86)\Common Files\Apple\Internet Services\ubd.exe" [2012-02-23 59240]
"Facebook Update"="c:\users\EZIO1\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-07-12 138096]
"GoogleDriveSync"="c:\program files (x86)\Google\Drive\googledrivesync.exe" [2012-06-20 12163848]
"TomTomHOME.exe"="c:\program files (x86)\TomTom HOME 2\TomTomHOMERunner.exe" [2012-04-20 247728]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Hotkey Utility"="c:\program files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe" [2009-11-25 469536]
"EgisTecLiveUpdate"="c:\program files (x86)\EgisTec Egis Software Update\EgisUpdate.exe" [2009-08-04 199464]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-10-19 98304]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-18 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-06-07 421776]
.
c:\users\EZIO1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
EvernoteClipper.lnk - c:\program files (x86)\Evernote\Evernote\EvernoteClipper.exe [2012-1-23 1014112]
Facebook Messenger.lnk - c:\users\EZIO1\AppData\Local\Facebook\Messenger\2.1.4570.0\FacebookMessenger.exe [2012-7-6 217536]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Iomega Storage Manager.lnk - c:\program files (x86)\Iomega Storage Manager\IomegaStorageManager.exe [2012-5-11 2295376]
Twonky Tray Control.lnk - c:\program files (x86)\TwonkyMedia\twonkymediaserverconfig.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Servizio di Google Update (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-08 135664]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-04-01 183560]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2011-10-27 95928]
R3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [2010-10-25 20552]
R3 gupdatem;Servizio Google Update (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-08 135664]
R3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys [2010-09-09 82816]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2011-10-27 203320]
R3 TFsExDisk;TFsExDisk;c:\windows\System32\Drivers\TFsExDisk.sys [2011-01-04 16392]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-02-15 52736]
R3 vNICdrv;Iomega Virtual Miniport;c:\windows\system32\DRIVERS\vNICdrv.sys [2012-05-11 20048]
R3 WatAdminSvc;Servizio Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2010-09-26 1255736]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2010-07-12 55856]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2009-06-02 22576]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2009-06-02 20016]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2009-06-02 60464]
S2 {1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC};Power Control [2010/09/08 23:18];c:\program files (x86)\CyberLink\PowerDVD10\NavFilter\000.fcl [2010-04-02 07:11 146928]
S2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};Power Control [2010/09/08 20:41];c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\000.fcl [2009-12-22 17:11 146928]
S2 AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8;c:\program files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [2009-09-18 169312]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-10-19 202752]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2012-07-03 71064]
S2 Greg_Service;GRegService;c:\program files (x86)\Acer\Registration\GregHSRW.exe [2009-08-28 1150496]
S2 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [2009-09-10 305448]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2009-11-17 255744]
S2 PCloudd;PCloudd;c:\program files (x86)\Iomega Storage Manager\pCloudd.exe [2012-05-11 213504]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe [2012-04-20 92592]
S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2009-07-04 240160]
S3 phaudlwr;Philips Audio Filter;c:\windows\system32\DRIVERS\phaudlwr.sys [2009-10-20 114608]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-11-05 291328]
S3 SPC1000;USB2.0 PC Camera (SPC1000);c:\windows\system32\DRIVERS\spc1000.sys [2007-12-04 3249024]
.
.
Contenuto della cartella 'Scheduled Tasks'
.
2012-07-19 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-436970907-2420890953-1754088570-1008Core.job
- c:\users\EZIO1\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-04-12 20:39]
.
2012-07-20 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-436970907-2420890953-1754088570-1008UA.job
- c:\users\EZIO1\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-04-12 20:39]
.
2012-07-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-08 19:19]
.
2012-07-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-08 19:19]
.
2012-07-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-436970907-2420890953-1754088570-1001Core.job
- c:\users\Simona\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-13 19:19]
.
2012-07-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-436970907-2420890953-1754088570-1001UA.job
- c:\users\Simona\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-13 19:19]
.
2012-07-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-436970907-2420890953-1754088570-1005Core.job
- c:\users\Salvo\AppData\Local\Google\Update\GoogleUpdate.exe [2011-01-22 16:24]
.
2012-07-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-436970907-2420890953-1754088570-1005UA.job
- c:\users\Salvo\AppData\Local\Google\Update\GoogleUpdate.exe [2011-01-22 16:24]
.
2012-07-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-436970907-2420890953-1754088570-1008Core.job
- c:\users\EZIO1\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-12 16:30]
.
2012-07-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-436970907-2420890953-1754088570-1008UA.job
- c:\users\EZIO1\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-12 16:30]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-07-03 16:21 133400 ----a-w- c:\program files\Alwil Software\Avast5\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-09-10 13:44 137512 ----a-w- c:\program files (x86)\EgisTec\MyWinLocker 3\x64\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2012-06-20 17:02 755224 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2012-06-20 17:02 755224 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2012-06-20 17:02 755224 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2012-06-20 17:02 755224 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-11-17 9608224]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x1
"AppInit_DLLs"=c:\windows\System32\acaptuser64.dll
.
------- Scansione supplementare -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0410&m=aspire_m3870&r=173609100706pe475v105w45i1v356
mLocal Page = c:\windows\SysWOW64\blank.htm
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Evernote 4.0 - c:\program files (x86)\Evernote\Evernote\EvernoteIE.dll/204
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Aggiungi a PDF esistente - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Aggiungi destinazione link a PDF esistente - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Converti destinazione link in Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Converti in Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&sporta in Microsoft Excel - c:\progra~2\MIF5BA~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
.
- - - - CHIAVI ORFANE RIMOSSE - - - -
.
Toolbar-Locked - (no file)
SafeBoot-mcmscsvc
SafeBoot-MCODS
Toolbar-Locked - (no file)
HKLM-Run-spc1000 - c:\windows\vspc1000.exe
AddRemove-{BB8AE808-F003-4C7F-B56B-8C80EEAFFE23} - c:\program files (x86)\InstallShield Installation Information\{BB8AE808-F003-4C7F-B56B-8C80EEAFFE23}\setup.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC}]
"ImagePath"="\??\c:\program files (x86)\CyberLink\PowerDVD10\NavFilter\000.fcl"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\000.fcl"
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe
c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files (x86)\Cyberlink\Shared files\RichVideo.exe
c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE
.
**************************************************************************
.
Ora fine scansione: 2012-07-20 06:33:35 - Il pc è stato riavviato
ComboFix-quarantined-files.txt 2012-07-20 04:33
.
Pre-Run: 75.925.508.096 byte disponibili
Post-Run: 78.578.352.128 byte disponibili
.
- - End Of File - - 29CC4AD0B233D5351F0F83F7ACE98512

Ciao e Grazie in anticipo a chi risponderà !!!!