ecco il log
ComboFix 12-10-16.02 - Utente 17/10/12 19.58.03.5.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.39.1040.18.3070.2391 [GMT 2:00]
Eseguito da: c:\documents and settings\Utente\Desktop\ComboFix.exe
Opzioni usate :: c:\documents and settings\Utente\Desktop\CFScript.txt
AV: Quick Heal AntiVirus Pro 12.00 *Disabled/Updated* {05C1329D-F0E0-4B19-9D15-54F9BC3ADE87}
FW: Quick Heal Firewall *Enabled* {0B0BF67A-8F20-4279-BAB2-9A72A26C76BF}
.
FILE ::
"c:\windows\system32\drivers\exwwmdvf.sys"
.
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Dati applicazioni\TEMP
.
.
((((((((((((((((((((((((((((((((((((((( Driver/Servizi )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_EB75365745D54207
-------\Service_eb75365745d54207
-------\Service_wxwjxflv
.
.
((((((((((((((((((((((((( Files Creati Da 2012-09-17 al 2012-10-17 )))))))))))))))))))))))))))))))))))
.
.
2012-10-17 15:35 . 2012-10-17 15:35 -------- d-----w- c:\windows\LastGood.Tmp
2012-10-06 07:48 . 2012-10-06 07:48 -------- d-----w- c:\programmi\DVDInfoPro
2012-10-06 07:40 . 2012-10-06 07:40 -------- d-----w- c:\programmi\DVD Identifier
2012-10-06 06:54 . 2012-10-06 06:59 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\DVD Shrink
2012-10-06 06:54 . 2012-10-06 06:54 -------- d-----w- c:\programmi\DVD Shrink
2012-10-01 18:00 . 2005-03-25 05:00 8704 ----a-w- c:\windows\system32\CNMVS75.DLL
2012-10-01 18:00 . 2005-03-25 05:00 59392 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\CNMPP75.DLL
2012-10-01 18:00 . 2005-03-25 05:00 20992 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\CNMPD75.DLL
2012-10-01 17:59 . 2005-03-25 05:10 139776 ----a-w- c:\windows\system32\CNMLM75.DLL
2012-10-01 17:59 . 2005-03-08 18:17 90112 ----a-r- c:\windows\system32\CNMCP75.exe
2012-10-01 17:59 . 2012-10-01 17:59 -------- d--h--w- c:\documents and settings\All Users\Dati applicazioni\CanonBJ
2012-09-22 16:22 . 2012-09-22 16:22 -------- d-----w- c:\programmi\Temp
2012-09-22 16:21 . 2012-09-22 16:21 -------- d-----w- c:\documents and settings\Utente\Impostazioni locali\Dati applicazioni\Wondershare
2012-09-22 16:20 . 2012-09-22 16:20 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Wondershare
2012-09-22 16:20 . 2012-09-22 16:20 -------- d--h--w- c:\programmi\Dr.Fone_Temp
2012-09-22 16:20 . 2012-09-22 16:20 -------- d-----w- c:\programmi\Wondershare
2012-09-22 15:16 . 2012-09-22 16:19 -------- d-----w- c:\documents and settings\Utente\Dati applicazioni\GetRightToGo
2012-09-21 18:17 . 2012-09-21 18:17 -------- d-----w- c:\programmi\iPod
2012-09-21 18:16 . 2012-09-21 18:18 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\188F1432-103A-4ffb-80F1-36B633C5C9E1
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-29 20:49 . 2012-03-31 07:05 696240 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-09-29 20:49 . 2011-11-16 17:05 73136 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-07 15:04 . 2011-03-27 20:48 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-08-28 15:05 . 2009-03-30 09:37 916992 ----a-w- c:\windows\system32\wininet.dll
2012-08-28 15:05 . 2009-03-30 09:37 43520 ------w- c:\windows\system32\licmgr10.dll
2012-08-28 15:05 . 2009-03-30 09:37 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-08-28 12:07 . 2009-03-30 09:37 385024 ------w- c:\windows\system32\html.iec
2012-08-24 13:53 . 2008-04-13 17:13 177664 ----a-w- c:\windows\system32\wintrust.dll
2012-08-23 06:27 . 2008-04-13 16:54 2152448 ------w- c:\windows\system32\ntoskrnl.exe
2012-08-23 06:27 . 2008-04-13 18:55 2031104 ------w- c:\windows\system32\ntkrnlpa.exe
2012-08-21 11:01 . 2011-02-20 12:58 26840 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2012-08-21 11:01 . 2011-02-20 12:58 106928 ----a-w- c:\windows\system32\GEARAspi.dll
2012-07-31 10:42 . 2012-09-02 10:04 83168 ----a-w- c:\windows\system32\drivers\ssudbus.sys
2012-07-31 10:42 . 2012-09-02 10:04 181344 ----a-w- c:\windows\system32\drivers\ssudmdm.sys
2012-07-30 07:47 . 2010-11-06 12:11 67680 ----a-w- c:\windows\system32\libusb0.dll
2012-07-30 07:47 . 2010-11-06 12:11 42592 ----a-w- c:\windows\system32\drivers\libusb0.sys
2011-03-18 18:01 . 2011-03-25 14:12 142296 ----a-w- c:\programmi\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\documents and settings\All Users\Dati applicazioni\188F1432-103A-4ffb-80F1-36B633C5C9E1 ----
.
2012-09-21 18:18 . 2012-09-21 18:18 3982 ----a-w- c:\documents and settings\All Users\Dati applicazioni\188F1432-103A-4ffb-80F1-36B633C5C9E1\x86\DIFxInstallLog.txt
2012-08-21 11:01 . 2012-08-21 11:01 1977816 ----a-w- c:\documents and settings\All Users\Dati applicazioni\188F1432-103A-4ffb-80F1-36B633C5C9E1\GEARDIFx.exe
2012-08-21 11:01 . 2012-08-21 11:01 323464 ----a-w- c:\documents and settings\All Users\Dati applicazioni\188F1432-103A-4ffb-80F1-36B633C5C9E1\x86\DIFxAPI.dll
2012-08-21 11:01 . 2012-08-21 11:01 115672 ----a-w- c:\documents and settings\All Users\Dati applicazioni\188F1432-103A-4ffb-80F1-36B633C5C9E1\x86\DifXInst32.exe
2012-08-21 11:01 . 2012-08-21 11:01 106928 ----a-w- c:\documents and settings\All Users\Dati applicazioni\188F1432-103A-4ffb-80F1-36B633C5C9E1\x86\GEARAspi.dll
2012-08-21 11:01 . 2012-08-21 11:01 2704 ----a-w- c:\documents and settings\All Users\Dati applicazioni\188F1432-103A-4ffb-80F1-36B633C5C9E1\x86\GEARAspiWDM.inf
2012-08-21 11:01 . 2012-08-21 11:01 7587 ----a-w- c:\documents and settings\All Users\Dati applicazioni\188F1432-103A-4ffb-80F1-36B633C5C9E1\x86\gearaspiwdmx86.cat
2012-08-21 11:01 . 2012-08-21 11:01 26840 ----a-w- c:\documents and settings\All Users\Dati applicazioni\188F1432-103A-4ffb-80F1-36B633C5C9E1\x86\x86\GEARAspiWDM.sys
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2009-03-30 . 3316C8A8EC07A9D4C0BE10310809A9E5 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Utente\Dati applicazioni\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Utente\Dati applicazioni\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Utente\Dati applicazioni\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Utente\Dati applicazioni\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\programmi\Synaptics\SynTP\SynTPEnh.exe" [2008-08-14 1343488]
"Quick Heal Core UI"="c:\programmi\Quick Heal\Quick Heal AntiVirus Pro\strtupap.exe" [2011-04-19 125896]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^Alice ti aiuta.lnk]
path=c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\Alice ti aiuta.lnk
backup=c:\windows\pss\Alice ti aiuta.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^Avvio veloce di Adobe Acrobat.lnk]
backup=c:\windows\pss\Avvio veloce di Adobe Acrobat.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^Bluetooth Monitor.lnk]
backup=c:\windows\pss\Bluetooth Monitor.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^HP Digital Imaging Monitor.lnk]
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Utente^Menu Avvio^Programmi^Esecuzione automatica^Adobe Gamma.lnk]
backup=c:\windows\pss\Adobe Gamma.lnkStartup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Utente^Menu Avvio^Programmi^Esecuzione automatica^Dropbox.lnk]
backup=c:\windows\pss\Dropbox.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]
2008-04-23 00:08 483328 ----a-w- c:\programmi\Adobe\Acrobat 7.0\Distillr\acrotray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-03 07:37 843712 ----a-w- c:\programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2012-04-04 05:53 35736 ----a-w- c:\programmi\Adobe\Reader 10.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
2010-03-06 02:44 500208 ------w- c:\programmi\File comuni\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]
2010-02-22 03:57 406992 ----a-w- c:\programmi\File comuni\Adobe\CS5ServiceManager\CS5ServiceManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Advanced SystemCare 5]
2012-05-28 13:56 288128 ----a-w- c:\programmi\IObit\Advanced SystemCare 5\ASCTray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AliceRE_McciTrayApp]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
2012-08-27 19:32 59280 ----a-w- c:\programmi\File comuni\Apple\Apple Application Support\APSDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync]
2010-03-13 13:54 91520 ----a-w- c:\programmi\Microsoft Office\Office14\BCSSync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
2008-04-13 17:14 110592 ------w- c:\windows\system32\bthprops.cpl
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2012-04-11 09:54 3672384 ----a-w- c:\programmi\DAEMON Tools Lite\DTLite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2011-12-10 23:31 136176 ----atw- c:\documents and settings\Utente\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2005-05-11 22:12 49152 ----a-w- c:\programmi\HP\HP Software Update\hpwuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD08]
2005-06-01 16:35 49152 ----a-w- c:\programmi\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2012-09-09 21:30 421776 ----a-w- c:\programmi\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPDLR]
2012-08-31 00:52 21432 ----a-w- c:\programmi\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPreload]
2012-08-31 00:52 964024 ----a-w- c:\programmi\Samsung\Kies\Kies.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesTrayAgent]
2012-08-31 00:52 3524536 ----a-w- c:\programmi\Samsung\Kies\KiesTrayAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)]
2012-09-07 15:04 981656 ----a-w- c:\programmi\Malwarebytes' Anti-Malware\mbam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge]
2006-04-21 13:41 438359 ----a-w- c:\progra~1\ALICET~1\SMARTB~1\MotiveSB.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSConfig]
2008-04-13 17:14 172032 ----a-w- c:\windows\pchealth\helpctr\binaries\msconfig.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2006-01-12 15:40 155648 ----a-w- c:\programmi\File comuni\Ahead\Lib\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
2012-03-26 09:24 1516600 ----a-w- c:\programmi\Nokia\Nokia PC Suite 7\PCSuite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDF4 Registry Controller]
2007-01-16 18:42 46632 ----a-w- c:\programmi\ScanSoft\PDF Professional 4.0\RegistryController.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PinnacleDriverCheck]
2004-03-10 23:26 406016 ------w- c:\windows\system32\PSDrvCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2012-04-18 18:56 421888 ----a-w- c:\programmi\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ScanSoft PDF Professional 4-reminder]
2006-11-16 09:01 35368 ----a-w- c:\programmi\ScanSoft\PDF Professional 4.0\Ereg\Ereg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2006-10-25 07:03 210472 ----a-w- c:\programmi\File comuni\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2008-01-21 11:17 61440 ----a-w- c:\programmi\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SwitchBoard]
2010-02-19 12:37 517096 ----a-w- c:\programmi\File comuni\Adobe\SwitchBoard\SwitchBoard.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USBToolTip]
2007-02-20 10:07 199752 ----a-w- c:\progra~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VZOchat]
2009-11-27 18:33 2201600 ----a-w- c:\programmi\VZOchat\VZOchat.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SwitchBoard"=3 (0x3)
"StarWindService"=2 (0x2)
"ServiceLayer"=3 (0x3)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"QuickTime Task"="c:\programmi\QuickTime\qttask.exe" -atboottime
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\iTunes\\iTunes.exe"=
"c:\\Programmi\\eMule\\emule.exe"=
"c:\\Programmi\\Winamp\\winamp.exe"=
"c:\\Programmi\\Pinnacle\\Studio 15\\Programs\\Studio.exe"=
.
R0 CLBStor;CyberLink InstantBurn UDF Reader Help Driver;c:\windows\system32\drivers\CLBStor.sys [14/03/11 22.31.53 10368]
R0 pssnap;Paramount Software Snapshot Filter;c:\windows\system32\drivers\pssnap.sys [20/02/12 20.38.10 16024]
R0 Vax347s;Vax347s;c:\windows\system32\drivers\Vax347s.sys [20/02/11 15.37.52 5248]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [15/04/12 14.02.57 242240]
R1 ggc;ggc;c:\windows\system32\drivers\ggc.sys [28/09/11 12.47.16 46664]
R2 AdvancedSystemCareService5;Advanced SystemCare Service 5;c:\programmi\IObit\Advanced SystemCare 5\ASCService.exe [11/03/12 11.13.08 913792]
R2 catflt;catflt;c:\windows\system32\drivers\catflt.sys [19/04/11 13.35.46 110024]
R2 CLBUDFR;CyberLink UDF Filesystem;c:\windows\system32\drivers\CLBUDFR.sys [14/03/11 22.31.53 180352]
R2 Core Mail Protection;Core Mail Protection;c:\programmi\Quick Heal\Quick Heal AntiVirus Pro\EMLPROXY.EXE [19/04/11 13.35.46 28104]
R2 Core Scanning Server;Core Scanning Server;c:\programmi\Quick Heal\Quick Heal AntiVirus Pro\SAPISSVC.EXE [19/04/11 13.35.46 205768]
R2 EMLSS;EMLSS;c:\windows\system32\drivers\EMLTDI.SYS [28/09/11 12.50.37 29384]
R2 Network WanMiniport First Position;Network WanMiniport First Position;c:\programmi\Telecom Italia\WanMiniport1st\srvany.exe [31/05/12 21.26.20 8192]
R2 Quick Update Service;Quick Update Service;c:\programmi\Quick Heal\Quick Heal AntiVirus Pro\QUHLPSVC.EXE [19/04/11 13.35.46 90568]
R2 ReflectService.exe;Macrium Reflect Image Mounting Service;c:\programmi\Macrium\Reflect\ReflectService.exe [20/02/12 20.38.10 224920]
R3 wsnfmp;Network Filter Miniport;c:\windows\system32\drivers\wsnf.sys [19/04/11 13.35.48 27464]
S0 mscank;mscank;c:\windows\system32\drivers\mscank.sys [28/09/11 12.50.40 34112]
S2 Core Scanning ServerEx;Core Scanning ServerEx;c:\programmi\Quick Heal\Quick Heal AntiVirus Pro\SAPISSVC.EXE [19/04/11 13.35.46 205768]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [31/03/12 9.05.27 250288]
S3 ALSysIO;ALSysIO;\??\c:\docume~1\Utente\IMPOST~1\Temp\ALSysIO.sys --> c:\docume~1\Utente\IMPOST~1\Temp\ALSysIO.sys [?]
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\drivers\ssudbus.sys [02/09/12 12.04.09 83168]
S3 IstSer;IstSer;c:\documents and settings\Utente\Impostazioni locali\Dati applicazioni\IstSer\IstSer.exe [15/11/11 20.20.04 19968]
S3 libusb0;LibUsb-Win32 - Kernel Driver 09/17/2010, 1.2.1.0;c:\windows\system32\drivers\libusb0.sys [06/11/10 14.11.12 42592]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\programmi\Microsoft Office\Office14\GROOVE.EXE [12/06/11 11.15.00 31125880]
S3 osppsvc;Office Software Protection Platform;c:\programmi\File comuni\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [09/01/10 22.37.50 4640000]
S3 PROCEXP151;PROCEXP151;\??\c:\windows\system32\Drivers\PROCEXP151.SYS --> c:\windows\system32\Drivers\PROCEXP151.SYS [?]
S3 PSMounter;Macrium Reflect Image Explorer Service;c:\windows\system32\drivers\psmounter.sys [20/02/12 20.38.10 47256]
S3 PSVolAcc;PSVolAcc;c:\windows\system32\drivers\PSVolAcc.sys [20/02/12 20.38.10 12952]
S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\drivers\ssudmdm.sys [02/09/12 12.04.09 181344]
S3 wimmount;wimmount;c:\windows\system32\drivers\wimmount.sys [13/07/09 19.20.54 19024]
S3 wsnf;Network Filter Service;c:\windows\system32\drivers\wsnf.sys [19/04/11 13.35.48 27464]
S4 Online Protection System;Online Protection System;c:\programmi\Quick Heal\Quick Heal AntiVirus Pro\OPSSVC.EXE [19/04/11 13.35.46 22472]
S4 SwitchBoard;SwitchBoard;c:\programmi\File comuni\Adobe\SwitchBoard\SwitchBoard.exe [19/02/10 14.37.14 517096]
S4 Vax347b;Vax347b;c:\windows\system32\drivers\Vax347b.sys [20/02/11 15.37.52 159616]
.
Contenuto della cartella 'Scheduled Tasks'
.
2012-09-29 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-31 20:49]
.
2012-07-02 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programmi\Apple Software Update\SoftwareUpdate.exe [2009-10-22 16:57]
.
2012-07-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-842925246-1844823847-1801674531-1003Core.job
- c:\documents and settings\Utente\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe [2011-12-10 23:31]
.
2012-07-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-842925246-1844823847-1801674531-1003UA.job
- c:\documents and settings\Utente\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe [2011-12-10 23:31]
.
2012-10-17 c:\windows\Tasks\User_Feed_Synchronization-{C3C598BE-462C-4F7A-8D1D-D61184857414}.job
- c:\windows\system32\msfeedssync.exe [2009-03-30 03:31]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.libero.it/
uInternet Settings,ProxyOverride = 127.0.0.1
IE: Apri con ScanSoft PDF Converter 4.1 - c:\programmi\ScanSoft\PDF Professional 4.0\cnvres_ita.dll /100
IE: Converti destinazione link in Adobe PDF - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Converti destinazione link in file PDF esistente - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Converti i link selezionati in Adobe PDF - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Converti i link selezionati in file PDF esistente - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Converti in Adobe PDF - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Converti nel file PDF esistente - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Converti selezione in Adobe PDF - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Converti selezione in file PDF esistente - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
Trusted Zone: telecomitalia.it\ecomm.adsl
Trusted Zone: telecomitalia.it\www
Trusted Zone: tim.it\www
Trusted Zone: unisalute.it\www
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Utente\Dati applicazioni\Mozilla\Firefox\Profiles\cbzztfev.default\
FF - prefs.js: browser.search.selectedEngine - Cerca...
FF - prefs.js: browser.startup.homepage - hxxp://search.findeer.com/
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2012-10-17 20:10
Windows 5.1.2600 Service Pack 3 NTFS
.
scansione processi nascosti ...
.
scansione entrate autostart nascoste ...
.
Scansione files nascosti ...
.
Scansione completata con successo
Files nascosti: 0
.
**************************************************************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
.
[HKEY_USERS\S-1-5-21-842925246-1844823847-1801674531-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_278_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_278_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Environment*]
"v5Licence0"="15-66SU-NXAU-1BDZ-3VZY-S8DR-ZRH41Q5"
"Activated"="Y"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•9~*]
"AB141C35E9F4BF344B9FC010BB17F68A"="02:\\Software\\Adobe\\FeatureSubscriptions\\DVAAdobeDocMeta\\{53C141BA-4F9E-43FB-B4F9-0C01BB716FA8}\\Registered"
.
[HKEY_LOCAL_MACHINE\software\Wondershare\Wondershare Helper Compact\1936026741\QTJAVA=c:\programmi\Java\jre6\lib\ext\QTJava.zip*SESSIONNAME=Console*SystemDrive=C:*SystemRoot=c:\windows*temp=c:\DOCUME~1\Utente\IMPOST~1\Temp*TMP=c:\docume~1\Utente\IMPOST~1\Temp*USERDOMAIN=UTENTE-2B22613E*USERNAME=Utente*USERPROFILE=C:\Documents and S]
"JoinUserExperience"=dword:00000001
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------
.
- - - - - - - > 'winlogon.exe'(1328)
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(8060)
c:\windows\system32\WININET.dll
c:\documents and settings\Utente\Dati applicazioni\Dropbox\bin\DropboxExt.14.dll
c:\progra~1\FILECO~1\MICROS~1\OFFICE14\Cultures\office.odf
c:\progra~1\MICROS~2\Office14\1040\GrooveIntlResource.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\programmi\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\programmi\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\programmi\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_ita.nlr
c:\programmi\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\msi.dll
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\agrsmsvc.exe
c:\programmi\File comuni\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\programmi\Java\jre6\bin\jqs.exe
c:\programmi\Common Files\Motive\McciCMService.exe
c:\programmi\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
c:\programmi\Telecom Italia\WanMiniport1st\WanMiniport1st_srv.exe
c:\programmi\Quick Heal\Quick Heal AntiVirus Pro\SCANWSCS.EXE
c:\programmi\Quick Heal\Quick Heal AntiVirus Pro\onlinent.exe
c:\programmi\Quick Heal\Quick Heal AntiVirus Pro\SCANMSG.EXE
c:\programmi\Quick Heal\Quick Heal AntiVirus Pro\UPSCHD.EXE
c:\programmi\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Ora fine scansione: 2012-10-17 20:14:28 - Il pc è stato riavviato
ComboFix-quarantined-files.txt 2012-10-17 18:14
ComboFix2.txt 2012-10-16 21:40
.
Pre-Run: 132.322.934.784 byte disponibili
Post-Run: 132.351.221.760 byte disponibili
.
- - End Of File - - AB73FF7839175BC6E78F35D25969A5D6