Ecco il report di combofix:ComboFix 10-01-14.06 - SCD 15/01/2010 16.09.47.1.4 - x86 NETWORK
Microsoft Windows XP Professional 5.1.2600.3.1252.39.1040.18.2048.1632 [GMT 1:00]
Eseguito da: c:\documents and settings\SCD\Desktop\abc.exe
ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\recycler\S-1-5-21-2994078457-2644090094-2179002112-500
c:\windows\system32\bjdkeljg.dll
c:\windows\system32\drivers\aynmvriz.sys
c:\windows\system32\drivers\pthtowug.sys
c:\windows\system32\pwygkeb.dll
c:\windows\system32\twain_32.dll
c:\windows\system32\xijvrlj.dll
.
((((((((((((((((((((((((((((((((((((((( Driver/Servizi )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_PTHTOWUG
-------\Legacy_QSYIVYAO
-------\Service_pthtowug
-------\Service_qsyivyao
((((((((((((((((((((((((( Files Creati Da 2009-12-15 al 2010-01-15 )))))))))))))))))))))))))))))))))))
.
2010-01-15 14:37 . 2010-01-15 15:00 -------- d-----w- C:\ComboFix
2010-01-15 14:06 . 2010-01-15 14:09 -------- d-----w- C:\!KillBox
2010-01-15 10:49 . 2010-01-15 11:08 -------- d-----w- C:\VundoFix Backups
2010-01-15 08:27 . 2010-01-15 08:27 -------- d-----w- c:\documents and settings\SCD\Impostazioni locali\Dati applicazioni\Identities
2010-01-14 16:50 . 2010-01-14 16:50 -------- d-----w- c:\documents and settings\SCD\Dati applicazioni\Malwarebytes
2010-01-14 16:50 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-14 16:50 . 2010-01-14 16:50 -------- d-----w- c:\programmi\Malwarebytes' Anti-Malware
2010-01-14 16:50 . 2010-01-14 16:50 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Malwarebytes
2010-01-14 16:50 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-14 15:51 . 2010-01-14 16:15 -------- d-----w- c:\windows\BDOSCAN8
2010-01-13 18:17 . 2010-01-13 18:17 -------- d-----w- c:\documents and settings\LocalService\Impostazioni locali\Dati applicazioni\ESET
2010-01-13 14:40 . 2010-01-13 14:40 -------- d-----w- c:\documents and settings\SCD\Impostazioni locali\Dati applicazioni\ESET
2010-01-13 14:30 . 2010-01-13 14:30 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\ESET
2010-01-13 08:04 . 2010-01-13 08:04 -------- d-sh--w- c:\documents and settings\Guest\IETldCache
2010-01-11 08:25 . 2010-01-11 08:25 -------- d-----r- c:\documents and settings\NetworkService\Preferiti
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-15 15:09 . 2004-08-27 17:26 84910 ----a-w- c:\windows\system32\perfc010.dat
2010-01-15 15:09 . 2004-08-27 17:26 459114 ----a-w- c:\windows\system32\perfh010.dat
2010-01-15 11:47 . 2008-10-06 07:18 -------- d-----w- c:\programmi\DNA
2010-01-15 11:47 . 2008-10-06 07:18 -------- d-----w- c:\documents and settings\SCD\Dati applicazioni\DNA
2010-01-14 17:54 . 2008-11-20 11:15 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Spybot - Search & Destroy
2010-01-11 18:04 . 2009-11-05 08:01 798232 ----a-w- c:\documents and settings\LocalService\Impostazioni locali\Dati applicazioni\FontCache3.0.0.0.dat
2009-12-10 10:41 . 2008-09-03 13:07 -------- d-----w- c:\documents and settings\SCD\Dati applicazioni\Nero
2009-12-10 10:39 . 2008-09-03 13:31 -------- d-----w- c:\programmi\File comuni\Nero
2009-12-10 10:38 . 2008-09-03 13:04 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Nero
2009-12-04 15:52 . 2009-12-04 15:52 -------- d-----w- c:\programmi\Trend Micro
2009-11-23 08:04 . 2008-09-02 15:13 160480 ----a-w- c:\documents and settings\SCD\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2009-11-17 14:45 . 2009-11-17 14:45 -------- d-----w- c:\windows\Fonts\100 Top Design Fonts
2009-11-17 14:43 . 2009-11-17 14:43 -------- d-----w- c:\windows\Fonts\The.hand.Picked Font.Pack\Helvetica
2009-11-17 14:43 . 2009-11-17 14:43 -------- d-----w- c:\windows\Fonts\The.hand.Picked Font.Pack
2009-11-17 14:43 . 2009-11-17 14:43 -------- d-----w- c:\windows\Fonts\The.hand.Picked Font.Pack\SF Automation
2009-10-29 07:40 . 2004-08-19 22:39 916480 ----a-w- c:\windows\system32\wininet.dll
2009-10-21 05:38 . 2004-08-19 22:39 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2004-08-19 22:39 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-04 06:00 265728 ----a-w- c:\windows\system32\drivers\http.sys
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-16 68856]
"SpybotSD TeaTimer"="c:\utility\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"LDM"="c:\programmi\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2008-09-03 20480]
"BitTorrent DNA"="c:\programmi\DNA\btdna.exe" [2009-11-13 323392]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\programmi\File comuni\Nero\Lib\NMBgMonitor.exe" [2007-09-20 202024]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Smapp"="c:\programmi\Analog Devices\SoundMAX\SMTray.exe" [2003-05-05 143360]
"QuickTime Task"="c:\grafica\QuickTime\qttask.exe" [2007-06-29 286720]
"PDF Complete"="c:\programmi\PDF Complete\pdfsty.exe" [2005-03-06 276480]
"nwiz"="nwiz.exe" [2006-01-24 1519616]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-01-24 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-01-24 7397376]
"NeroFilterCheck"="c:\programmi\File comuni\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
"NBKeyScan"="c:\masterizzazione\Nero 8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 1836328]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-10-21 29696]
"ISUSScheduler"="c:\programmi\File comuni\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"ISUSPM Startup"="c:\progra~1\FILECO~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"DrvLsnr"="c:\programmi\Analog Devices\SoundMAX\DrvLsnr.exe" [2003-05-08 69632]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2005-02-25 127037]
"Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"UnlockerAssistant"="c:\utility\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
APC UPS Status.lnk - c:\programmi\APC\APC PowerChute Personal Edition\Display.exe [2008-9-2 221295]
EPSON Status Monitor 3 Environment Check 2.lnk - c:\windows\system32\spool\drivers\w32x86\3\E_SRCV02.EXE [2008-9-2 136192]
Logitech Desktop Messenger.lnk - c:\programmi\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2008-9-3 450560]
Logitech SetPoint.lnk - c:\programmi\Logitech\SetPoint\KEM.exe [2008-9-3 581632]
Sonic CinePlayer Quick Launch.lnk - c:\programmi\File comuni\Sonic Shared\CineTray.exe [2005-4-25 114688]
Start 3DxWare.lnk - c:\programmi\3Dconnexion\3Dconnexion 3DxSoftware\3DxWare\3dxsrv.exe [2009-9-25 119296]
WinZip Quick Pick.lnk - c:\utility\WinZip\WZQKPICK.EXE [2008-9-2 389120]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyPictures"= 0 (0x0)
"NoStartMenuMyMusic"= 0 (0x0)
"NoRecentDocsNetHood"= 0 (0x0)
"NoSimpleStartMenu"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyPictures"= 0 (0x0)
"NoStartMenuMyMusic"= 0 (0x0)
"NoRecentDocsNetHood"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Internet\\eMule\\emule.exe"=
"c:\\Grafica\\Autodesk\\3ds Max 2009\\3dsmax.exe"=
"c:\\Programmi\\DCPFLICS\\DCPFLICS_tools.exe"=
"c:\\Programmi\\Bonjour\\mDNSResponder.exe"=
"c:\\Programmi\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe"=
"c:\\Grafica\\Autodesk\\3ds Max 9\\3dsmax.exe"=
"c:\\Grafica\\Autodesk\\Backburner\\monitor.exe"=
"c:\\Grafica\\Autodesk\\Backburner\\manager.exe"=
"c:\\Grafica\\Autodesk\\Backburner\\server.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Grafica\\Next Limit\\RealFlow4\\realflow.exe"=
"c:\\Internet\\FTP Commander\\ftpcomm.exe"=
"c:\\Programmi\\DNA\\btdna.exe"=
"c:\\Internet\\BitTorrent\\bittorrent.exe"=
"c:\\Programmi\\Winamp Remote\\bin\\Orb.exe"=
"c:\\Programmi\\Winamp Remote\\bin\\OrbTray.exe"=
"c:\\Programmi\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [03/09/2008 9.35.59 685816]
S2 mi-raysat_3dsMax2009_32;mental ray 3.6 Satellite for Autodesk 3ds Max 2009 32-bit 32-bit;c:\grafica\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe [09/03/2008 23.04.52 65536]
S2 pdfcDispatcher;PDF Document Manager;c:\programmi\PDF Complete\pdfsvc.exe [02/09/2008 9.52.26 476160]
--- Altri Servizi/Drivers In Memoria ---
*NewlyCreated* - PTHTOWUG
*Deregistered* - pthtowug
.
Contenuto della cartella 'Scheduled Tasks'
2010-01-15 c:\windows\Tasks\User_Feed_Synchronization-{20C3F40E-1C4A-47E1-9901-BD5F84741949}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 03:31]
.
.
------- Scansione supplementare -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local;localhost
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Winamp Search
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {5AAEC3E6-C58A-4801-ADDE-F2D1E2917C16} = 192.168.1.1
DPF: {4819DFDF-ABC4-488C-A323-919848C51175}
FF - ProfilePath - c:\documents and settings\SCD\Dati applicazioni\Mozilla\Firefox\Profiles\d7v77m79.default\
FF - component: c:\documents and settings\SCD\Dati applicazioni\Mozilla\Firefox\Profiles\d7v77m79.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll
FF - plugin: c:\grafica\QuickTime\Plugins\npqtplugin.dll
FF - plugin: c:\grafica\QuickTime\Plugins\npqtplugin2.dll
FF - plugin: c:\grafica\QuickTime\Plugins\npqtplugin3.dll
FF - plugin: c:\grafica\QuickTime\Plugins\npqtplugin4.dll
FF - plugin: c:\grafica\QuickTime\Plugins\npqtplugin5.dll
FF - plugin: c:\grafica\QuickTime\Plugins\npqtplugin6.dll
FF - plugin: c:\grafica\QuickTime\Plugins\npqtplugin7.dll
FF - plugin: c:\programmi\Java\jre1.5.0\bin\NPJava11.dll
FF - plugin: c:\programmi\Java\jre1.5.0\bin\NPJava12.dll
FF - plugin: c:\programmi\Java\jre1.5.0\bin\NPJava13.dll
FF - plugin: c:\programmi\Java\jre1.5.0\bin\NPJava14.dll
FF - plugin: c:\programmi\Java\jre1.5.0\bin\NPJava32.dll
FF - plugin: c:\programmi\Java\jre1.5.0\bin\NPJPI150.dll
FF - plugin: c:\programmi\Java\jre1.5.0\bin\NPOJI610.dll
FF - plugin: c:\programmi\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\utiltiy\DivX\DivX Player\npDivxPlayerPlugin.dll
FF - plugin: c:\utiltiy\DivX\DivX Web Player\npdivx32.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - CHIAVI ORFANE RIMOSSE - - - -
BHO-{01B39712-3140-4C00-B9AD-2DCBC3240DBd} - c:\windows\system32\bjdkeljg.dll
HKU-Default-RunOnce-3DxAssociateFileExts - c:\programmi\3Dconnexion\3Dconnexion 3DxSoftware\3DxViewer\register.exe
AddRemove-V-Ray for 3dsmax 2009 for x86 - c:\grafica\Chaos Group\V-Ray\3dsmax 2009 for x86\uninstall\wininstaller.exe-uninstall=c:\grafica\Chaos Group\V-Ray\3dsmax 2009 for x86\uninstall\install.log
AddRemove-V-Ray for 3dsmax R9 for x86 - c:\grafica\Chaos Group\V-Ray\3dsmax R9 for x86\uninstall\wininstaller.exe-uninstall=c:\grafica\Chaos Group\V-Ray\3dsmax R9 for x86\uninstall\install.log
AddRemove-Octoshape add-in for Adobe Flash Player - c:\documents and settings\SCD\Dati applicazioni\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2010-01-15 16:17
Windows 5.1.2600 Service Pack 3 NTFS
scansione processi nascosti ...
scansione entrate autostart nascoste ...
Scansione files nascosti ...
Scansione completata con successo
Files nascosti: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer,
http://www.gmer.netdevice: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys sptd.sys >>UNKNOWN [0x8A5BA8AC]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf764bf28
\Driver\ACPI -> ACPI.sys @ 0xf740ccb8
\Driver\atapi -> atapi.sys @ 0xf7832b40
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805e668e
ParseProcedure -> ntoskrnl.exe @ 0x8057b6b1
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805e668e
ParseProcedure -> ntoskrnl.exe @ 0x8057b6b1
NDIS: -> SendCompleteHandler -> 0x0
PacketIndicateHandler -> 0x0
SendHandler -> 0x0
user & kernel MBR OK
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\pdfcDispatcher]
"ImagePath"="c:\programmi\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------
- - - - - - - > 'explorer.exe'(360)
c:\windows\system32\WININET.dll
c:\windows\system32\msi.dll
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\utility\Lavasoft\Ad-Aware\aawservice.exe
.
**************************************************************************
.
Ora fine scansione: 2010-01-15 16:21:48 - Il pc è stato riavviato
ComboFix-quarantined-files.txt 2010-01-15 15:21
Pre-Run: 26.758.639.616 byte disponibili
Post-Run: 30.526.345.216 byte disponibili
- - End Of File - - D28E129762B44F3C1A793B78232E9659