ecco finalmente log di combofix....
ole...'!!!
ComboFix 09-06-03.04 - sergio 04/06/2009 19.29.50.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.39.1040.18.511.226 [GMT 2:00]
Eseguito da: c:\documents and settings\sergio\Desktop\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {00000000-0000-0015-0000-000000000000}
AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {00000002-0002-0000-7C25-9E7C08000A00}
ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Esecuzione precedente -------
.
c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
.
((((((((((((((((((((((((( Files Creati Da 2009-05-04 al 2009-06-04 )))))))))))))))))))))))))))))))))))
.
2009-06-04 10:54 . 2009-06-04 10:54 -------- d-----w- c:\programmi\Trend Micro
2009-06-03 11:05 . 2009-06-03 11:05 -------- d-----w- c:\documents and settings\sergio\Dati applicazioni\Malwarebytes
2009-06-03 11:04 . 2009-05-26 11:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-03 11:04 . 2009-06-03 11:05 -------- d-----w- c:\programmi\Malwarebytes' Anti-Malware
2009-06-03 11:04 . 2009-06-03 11:04 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Malwarebytes
2009-06-03 11:04 . 2009-05-26 11:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-01 16:16 . 2009-06-04 16:15 -------- d-----w- c:\programmi\avenger
2009-05-31 19:17 . 2009-03-30 08:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-05-31 19:17 . 2009-03-24 14:08 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-05-31 19:17 . 2009-02-13 10:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-05-31 19:17 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-05-31 19:17 . 2009-05-31 19:17 -------- d-----w- c:\programmi\Avira
2009-05-31 19:17 . 2009-05-31 19:17 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Avira
2009-05-31 18:44 . 2009-06-04 10:45 -------- d-----w- c:\programmi\CCleaner
2009-05-27 09:51 . 2009-05-27 09:56 -------- d-----w- c:\programmi\AutoCAD 2008
2009-05-25 17:15 . 2009-05-25 17:16 -------- dc-h--w- C:\$AVG8.VAULT$
2009-05-22 07:53 . 2009-05-27 10:52 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\avg8
2009-05-11 15:42 . 2009-05-11 15:42 1011844 ----a-w- c:\programmi\SetupPoigpsGo.zip
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-04 17:27 . 2002-10-01 17:08 716744 ----a-w- c:\windows\system32\perfc010.dat
2009-06-04 17:27 . 2002-10-01 17:08 1284460 ----a-w- c:\windows\system32\perfh010.dat
2009-05-31 09:06 . 2005-02-16 14:22 -------- d-----w- c:\programmi\Spybot - Search & Destroy
2009-05-31 08:55 . 2005-02-16 14:22 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Spybot - Search & Destroy
2009-05-27 11:16 . 2004-12-19 15:46 114976 ----a-w- c:\documents and settings\sergio\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2009-05-27 09:56 . 2004-11-12 20:48 -------- d-----w- c:\programmi\File comuni\Autodesk Shared
2009-05-22 07:53 . 2005-06-09 12:12 -------- d-----w- c:\programmi\AVG
2009-05-04 16:39 . 2007-11-06 20:28 60 ----a-w- c:\windows\wpd99.drv
2009-05-04 16:39 . 2007-11-06 20:28 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\pdf995
2009-04-15 09:28 . 2007-11-06 20:28 51716 ----a-w- c:\windows\system32\pdf995mon.dll
2009-04-15 09:28 . 2007-11-06 20:28 249856 ----a-w- c:\windows\system32\pdfmona.dll
2009-04-15 09:25 . 2009-04-15 09:24 5801368 ----a-w- c:\programmi\ps2pdf995.exe
2009-04-14 15:32 . 2008-10-21 10:36 -------- d-----w- c:\documents and settings\sergio\Dati applicazioni\Nokia Multimedia Player
2009-02-05 14:48 . 2009-04-15 09:21 8945438 ----a-w- c:\programmi\Stampante PDF.rar
2008-12-05 17:41 . 2008-12-05 17:38 128992670 ----a-w- c:\programmi\rh40eval_it_20080827.exe
2008-07-04 15:57 . 2008-07-04 15:56 7726360 ----a-w- c:\programmi\Google_Earth_CZXV.exe
2006-12-30 14:32 . 2006-12-30 14:32 3124686 -c--a-w- c:\programmi\arrip20.exe
2006-12-30 14:08 . 2006-12-30 14:08 36808256 ----a-w- c:\programmi\iTunesSetup.exe
2006-03-14 22:50 . 2006-03-14 22:50 758296 ----a-w- c:\programmi\CMWsetup.exe
2006-03-12 15:03 . 2006-03-12 15:03 3957216 ----a-w- c:\programmi\MSASYNC.EXE
2005-05-06 03:20 . 2006-10-13 19:47 6410240 ----a-w- c:\programmi\virtualdj.exe
2004-12-01 20:56 . 2004-12-01 20:56 544 ----a-w- c:\programmi\changelog.txt
2004-11-30 20:28 . 2004-11-30 20:28 2423682 ----a-w- c:\programmi\DivX_Total_Pack2.0.exe
2005-01-29 10:31 . 2004-11-22 21:43 56 --sh--r- c:\windows\system32\E784F277D9.sys
2005-01-29 10:31 . 2004-11-22 21:43 11270 --sha-w- c:\windows\system32\KGyGaAvL.sys
.
(((((((((((((((((((((((((((((
SnapShot@2009-06-04_17.15.28 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-06-04 17:24 . 2009-06-04 17:24 16384 c:\windows\Temp\Perflib_Perfdata_7cc.dat
+ 2002-10-01 17:07 . 2009-06-04 17:27 648742 c:\windows\system32\perfc009.dat
+ 2002-10-01 17:07 . 2009-06-04 17:27 1199858 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"H/PC Connection Agent"="c:\programmi\Microsoft ActiveSync\WCESCOMM.EXE" [2004-02-24 401491]
"swg"="c:\programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-01 68856]
"MSMSGS"="c:\programmi\Messenger\msmsgs.exe" [2008-04-14 1695232]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-05-15 339968]
"SunJavaUpdateSched"="c:\programmi\Java\jre6\bin\jusched.exe" [2009-02-12 136600]
"iTunesHelper"="c:\programmi\iTunes\iTunesHelper.exe" [2007-06-01 257088]
"QuickTime Task"="c:\programmi\QuickTime\qttask.exe" [2007-04-27 282624]
"HP Software Update"="c:\programmi\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"TkBellExe"="c:\programmi\File comuni\Real\Update_OB\realsched.exe" [2008-08-27 185896]
"NSLauncher"="c:\programmi\Nokia\Nokia Software Launcher\NSLauncher.exe" [2007-09-07 3100672]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"CnxDslTaskBar"="c:\programmi\digicomt\Michelangelo USB ADSL\CnxDslTb.exe" [2003-10-29 462848]
"SPTMouse"="c:\programmi\Tilt-Wheel Mouse\Tilt-Wheel Mouse Software\1.0\SPTMouse.exe" [2008-01-07 502272]
"avgnt"="c:\programmi\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2004-06-18 67584]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Adobe Gamma Loader.exe.lnk - c:\programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe [2004-11-12 113664]
Avvio veloce di Adobe Reader.lnk - c:\programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave1"= serwvdrv.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\Microsoft ActiveSync\\wcescomm.exe"=
"c:\\Programmi\\Microsoft ActiveSync\\WCESMgr.exe"=
"c:\\Programmi\\itunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmi\\Autodesk\\3dsMax8\\3dsmax.exe"=
"c:\\Programmi\\Autodesk\\backburner\\monitor.exe"=
"c:\\Programmi\\Autodesk\\backburner\\manager.exe"=
"c:\\Programmi\\Autodesk\\backburner\\server.exe"=
"c:\\Programmi\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\Programmi\\File comuni\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Programmi\\skype\\Phone\\Skype.exe"=
R2 cpwnt;cpwnt;c:\windows\system32\drivers\Cpwnt.sys [17/11/2004 16.01.43 21824]
R3 CONAN;CONAN;c:\windows\system32\drivers\o2mmb.sys [08/10/2004 11.31.25 190465]
R3 MbxStby;MbxStby;c:\windows\system32\drivers\MbxStby.sys [08/10/2004 11.31.25 5817]
R3 PRISM_A00;PRISM 802.11 Driver;c:\windows\system32\drivers\PRISMA00.sys [08/10/2004 11.34.04 388448]
S2 KeyP;KeyP;c:\windows\system32\DRIVERS\KeyP.sys --> c:\windows\system32\DRIVERS\KeyP.sys [?]
S3 CnxEtP;Conexant AccessRunner USB ADSL WAN Adapter Filter Driver;c:\windows\system32\drivers\CnxEtP.sys [25/12/2008 16.13.15 60288]
S3 CnxEtU;Conexant AccessRunner USB ADSL Interface Device Driver;c:\windows\system32\drivers\CnxEtU.sys [25/12/2008 16.13.15 646784]
S3 CnxTgN;Conexant AccessRunner USB ADSL WAN Adapter Driver;c:\windows\system32\drivers\CnxTgN.sys [25/12/2008 16.13.14 108675]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [22/01/2009 12.57.04 138112]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [22/01/2009 12.57.04 8320]
.
Contenuto della cartella 'Scheduled Tasks'
2009-03-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programmi\Apple Software Update\SoftwareUpdate.exe [2007-01-10 13:42]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.msn.it/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Google Search - c:\programmi\Google\GoogleToolbar1.dll/cmsearch.html
IE: Backward &Links - c:\programmi\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cac&hed Snapshot of Page - c:\programmi\Google\GoogleToolbar1.dll/cmcache.html
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
IE: Si&milar Pages - c:\programmi\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate into English - c:\programmi\Google\GoogleToolbar1.dll/cmtrans.html
TCP: {4132FEEA-2767-4033-B1F7-2FCB06C63BF0} = 151.99.125.1
DPF: {E61135DF-716D-49A7-B29B-8287A1CD072C} - hxxp://welcome2.immanens.com/it/widelook/widelookX.cab
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-06-04 19:35
Windows 5.1.2600 Service Pack 3 NTFS
scansione processi nascosti ...
scansione entrate autostart nascoste ...
Scansione files nascosti ...
Scansione completata con successo
Files nascosti: 0
**************************************************************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
[HKEY_USERS\S-1-5-21-3116029348-4207113801-411729504-1007\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fpx\OpenWithProgids]
@DACL=(02 0000)
@SACL=
"Microsoft.Picture.It.Document.9"=hex(0):
[HKEY_USERS\S-1-5-21-3116029348-4207113801-411729504-1007\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mix\OpenWithProgids]
@DACL=(02 0000)
@SACL=
"Microsoft.Picture.It.Document.9"=hex(0):
"mix"=hex(0):
[HKEY_USERS\S-1-5-21-3116029348-4207113801-411729504-1007\Software\Microsoft\Windows\CurrentVersion\Explorer\Streams\Desktop]
@DACL=(02 0000)
@SACL=
"Toolbars"=hex:11,00,00,00,00,00,00,00
"TaskbarWinXP"=hex:0c,00,00,00,08,00,00,00,03,00,00,00,00,00,00,00,b0,e2,2b,d8,
64,57,d0,11,a9,6e,00,c0,4f,d7,05,a2,22,00,1c,00,0a,11,00,00,1a,00,00,00,01,\
"Upgrade"=dword:00000001
[HKEY_USERS\S-1-5-21-3116029348-4207113801-411729504-1007\Software\Microsoft\Works Suite\2004]
@DACL=(02 0000)
@SACL=
[HKEY_LOCAL_MACHINE\software\Classes\TypeLib\{57A0E746-3863-4D20-A811-950C84F1DB9B}\1.0]
@DACL=(02 0000)
@SACL=
@="FlashAccessibility"
[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\DependentComponents]
@DACL=(02 0000)
@SACL=
"AvRack"="AvRack"
"PowerDVD"="PowerDVD"
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="DirectX"
"ComponentGUID"="{44BBA855-CC51-11CF-AAFA-00AA00B6015C}"
"Version"=dword:00040009
"Sub-Version"=dword:00000386
"ExceptionInfName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\\dxxp.inf"
"ExceptionCatalogName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\\dxxp.cat"
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{AA936DF4-2B08-4B1F-B071-72192E287704}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="DirectX BDA"
"ComponentGUID"="{AA936DF4-2B08-4B1F-B071-72192E287704}"
"Version"=dword:00040009
"Sub-Version"=dword:00000386
"ExceptionInfName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{AA936DF4-2B08-4B1F-B071-72192E287704}\\dxbda.inf"
"ExceptionCatalogName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{AA936DF4-2B08-4B1F-B071-72192E287704}\\dx9bda.cat"
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\OptionalComponents\SwDir]
@DACL=(02 0000)
@SACL=
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\OptionalComponents\SwFlash]
@DACL=(02 0000)
@SACL=
"Installed"="1"
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------
- - - - - - - > 'winlogon.exe'(828)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(3776)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Ora fine scansione: 2009-06-04 19.40.11
ComboFix-quarantined-files.txt 2009-06-04 17:40
Pre-Run: 37.283.237.888 byte disponibili
Post-Run: 37.282.656.256 byte disponibili
229 --- E O F --- 2009-05-13 11:51