Ecco il risultato della scansione aspetto la sentenza
ComboFix 12-07-05.03 - ALESSANDRO 05/07/2012 20.39.21.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.39.1040.18.1535.1034 [GMT 2:00]
Eseguito da: c:\documents and settings\ALESSANDRO.CASA-02E51C5D4B\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 3.0 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.
ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\ALESSANDRO.CASA-02E51C5D4B\Dati applicazioni\OfferBox
c:\documents and settings\ALESSANDRO.CASA-02E51C5D4B\Dati applicazioni\OfferBox\config.dat
c:\documents and settings\ALESSANDRO.CASA-02E51C5D4B\Dati applicazioni\OfferBox\config.xml
c:\documents and settings\ALESSANDRO.CASA-02E51C5D4B\zoegbjis.exe
c:\documents and settings\ALESSANDRO\WINDOWS
c:\documents and settings\All Users.WINDOWS\Menu Avvio\Programmi\Esecuzione automatica\Adobe Gamma Loader.exe.lnk
c:\documents and settings\Default User\WINDOWS
c:\documents and settings\Proprietario\WINDOWS
c:\programmi\Conference
c:\programmi\Conference\Conference.exe
c:\windows\IsUn0410.exe
c:\windows\system32\config\systemprofile\WINDOWS
.
.
((((((((((((((((((((((((( Files Creati Da 2012-06-05 al 2012-07-05 )))))))))))))))))))))))))))))))))))
.
.
2012-07-02 23:45 . 2012-07-02 23:45 -------- d-----w- C:\b10e40d7b2ad6bfdd9ba
2012-07-02 20:37 . 2012-07-02 20:37 388096 ----a-r- c:\documents and settings\ALESSANDRO.CASA-02E51C5D4B\Dati applicazioni\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2012-07-02 20:37 . 2012-07-02 20:37 -------- d-----w- c:\programmi\Trend Micro
2012-07-02 13:39 . 2012-07-04 01:20 -------- d-----w- c:\documents and settings\ALESSANDRO.CASA-02E51C5D4B\Dati applicazioni\vlc
2012-07-01 09:59 . 2012-07-01 09:59 -------- d-----w- c:\documents and settings\ALESSANDRO.CASA-02E51C5D4B\Impostazioni locali\Dati applicazioni\Sun
2012-06-29 12:10 . 2012-06-29 12:10 -------- d-----w- c:\documents and settings\ALESSANDRO.CASA-02E51C5D4B\Impostazioni locali\Dati applicazioni\Temp
2012-06-28 17:14 . 2012-06-28 17:14 -------- d-----w- c:\programmi\Oracle
2012-06-28 17:14 . 2012-06-28 17:14 -------- d-----w- c:\documents and settings\ALESSANDRO.CASA-02E51C5D4B\Dati applicazioni\Oracle
2012-06-16 14:28 . 2012-05-04 17:29 772504 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-06-16 14:25 . 2012-05-04 17:29 143872 ----a-w- c:\windows\system32\javacpl.cpl
2012-06-16 11:58 . 2012-06-14 22:19 85472 ----a-w- c:\programmi\Mozilla Firefox\components\browsercomps.dll
2012-06-13 21:12 . 2012-05-11 14:40 521728 -c----w- c:\windows\system32\dllcache\jsdbgui.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-23 19:01 . 2012-04-03 12:05 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-06-23 19:01 . 2011-05-18 07:26 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-06-02 13:19 . 2008-05-09 12:58 329240 ----a-w- c:\windows\system32\wucltui.dll
2012-06-02 13:19 . 2008-05-09 12:58 219160 ----a-w- c:\windows\system32\wuaucpl.cpl
2012-06-02 13:19 . 2008-05-09 12:58 210968 ----a-w- c:\windows\system32\wuweb.dll
2012-06-02 13:19 . 2008-05-09 12:58 35864 ----a-w- c:\windows\system32\wups.dll
2012-06-02 13:19 . 2008-05-09 12:58 53784 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-02 13:19 . 2007-07-30 17:19 45080 ----a-w- c:\windows\system32\wups2.dll
2012-06-02 13:19 . 2004-08-30 20:00 97304 ----a-w- c:\windows\system32\cdm.dll
2012-06-02 13:19 . 2007-07-30 17:20 15896 ----a-w- c:\windows\system32\wuapi.dll.mui
2012-06-02 13:19 . 2008-05-09 12:58 577048 ----a-w- c:\windows\system32\wuapi.dll
2012-06-02 13:19 . 2007-07-30 17:20 15896 ----a-w- c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 13:19 . 2007-07-30 17:19 24088 ----a-w- c:\windows\system32\wucltui.dll.mui
2012-06-02 13:19 . 2007-07-30 17:18 18968 ----a-w- c:\windows\system32\wuaueng.dll.mui
2012-06-02 13:19 . 2008-05-09 12:58 1933848 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-02 13:18 . 2008-05-10 12:58 18672 ----a-w- c:\windows\system32\mucltui.dll.mui
2012-06-02 13:18 . 2008-05-10 12:58 275696 ----a-w- c:\windows\system32\mucltui.dll
2012-06-02 13:18 . 2007-07-30 17:18 214256 ----a-w- c:\windows\system32\muweb.dll
2012-05-31 13:21 . 2004-08-30 20:00 603136 ----a-w- c:\windows\system32\crypt32.dll
2012-05-16 15:06 . 2004-08-30 20:00 916992 ----a-w- c:\windows\system32\wininet.dll
2012-05-15 13:56 . 2004-08-30 20:00 1863168 ----a-w- c:\windows\system32\win32k.sys
2012-05-11 14:40 . 2004-08-30 20:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2012-05-11 14:40 . 2004-08-30 20:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-05-11 11:38 . 2004-08-30 20:00 385024 ----a-w- c:\windows\system32\html.iec
2012-05-05 03:14 . 2004-08-19 15:34 2072832 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-05-05 03:14 . 2004-08-30 20:00 2196352 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-05-04 17:29 . 2010-05-05 01:13 687504 ----a-w- c:\windows\system32\deployJava1.dll
2012-05-02 13:46 . 2008-05-09 12:56 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-04-11 13:51 . 2004-08-30 20:00 1862272 ----a-w- c:\windows\system32\win32k(2).sys
2012-06-14 22:19 . 2012-06-16 11:58 85472 ----a-w- c:\programmi\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PnPUI Registrator"="c:\programmi\Common Files\Sitecom Shared\PnP Universal Installer\PnPUIReg.exe" [2004-11-22 163840]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Motive SmartBridge"="c:\progra~1\ALICET~1\SMARTB~1\MotiveSB.exe" [2006-04-21 438359]
"AudioDeck"="c:\programmi\VIA\VIAudioi\SBADeck\ADeck.exe" [2006-11-02 528384]
"LWBMOUSE"="c:\programmi\Browser Mouse\Browser Mouse\1.0\lwbwheel.exe" [2001-03-26 429568]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"egui"="c:\programmi\ESET\ESET NOD32 Antivirus\egui.exe" [2008-10-08 1451264]
"Samsung Multimedia Keyboard"="c:\programmi\Samsung\Samsung Multimedia Keyboard\HCM.exe" [2002-06-17 1830912]
"EEventManager"="c:\programmi\Epson Software\Event Manager\EEventManager.exe" [2010-08-30 979328]
"SunJavaUpdateSched"="c:\programmi\File comuni\Java\Java Update\jusched.exe" [2012-01-17 252296]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users.WINDOWS\Menu Avvio\Programmi\Esecuzione automatica\
Image Transfer.lnk - c:\programmi\Sony Corporation\Image Transfer\SonyTray.exe [2008-8-24 73728]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\muzapp.exe"=
"c:\\Programmi\\uTorrent\\uTorrent.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programmi\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Documents and Settings\\ALESSANDRO.CASA-02E51C5D4B\\Impostazioni locali\\Dati applicazioni\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Programmi\\Epson Software\\Event Manager\\EEventManager.exe"=
"c:\\Programmi\\Skype\\Phone\\Skype.exe"=
"c:\\Documents and Settings\\ALESSANDRO.CASA-02E51C5D4B\\Impostazioni locali\\Dati applicazioni\\TVLC\\Sandbox\\2009.12.14T00.29\\Virtual\\STUBEXE\\@PROGRAMFILES@\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Programmi\\VideoLAN\\VLC\\vlc.exe"=
.
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [08/10/2008 8.50.14 34312]
R2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\programmi\File comuni\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [14/05/2009 18.07.14 759048]
R2 ekrn;Eset Service;c:\programmi\ESET\ESET NOD32 Antivirus\ekrn.exe [08/10/2008 8.47.58 468224]
S0 eeeuh;eeeuh;c:\windows\system32\drivers\jgvwtdba.sys --> c:\windows\system32\drivers\jgvwtdba.sys [?]
S1 aswSP;avast! Self Protection; [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys --> c:\windows\system32\DRIVERS\aswFsBlk.sys [?]
S2 Network WanMiniport First Position;Network WanMiniport First Position;c:\programmi\Telecom Italia\WanMiniport1st\srvany.exe [29/07/2008 23.26.40 8192]
S2 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe [30/08/2004 22.00.00 3584]
S2 SkypeUpdate;Skype Updater;c:\programmi\Skype\Updater\Updater.exe [07/06/2012 19.12.14 160944]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [03/04/2012 14.05.02 250056]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\programmi\Mozilla Maintenance Service\maintenanceservice.exe [04/02/2012 2.03.22 113096]
.
Contenuto della cartella 'Scheduled Tasks'
.
2012-07-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-03 19:01]
.
2012-06-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-616249376-839522115-1003Core.job
- c:\documents and settings\ALESSANDRO.CASA-02E51C5D4B\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe [2011-06-24 21:17]
.
2012-07-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-616249376-839522115-1003UA.job
- c:\documents and settings\ALESSANDRO.CASA-02E51C5D4B\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe [2011-06-24 21:17]
.
2012-07-05 c:\windows\Tasks\User_Feed_Synchronization-{789B6CAC-6732-4C36-816A-D5BDE75079D3}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = 127.0.0.1
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\ALESSANDRO.CASA-02E51C5D4B\Dati applicazioni\Mozilla\Firefox\Profiles\rg7wzlqv.default\
FF - prefs.js: browser.search.selectedEngine - Cerca...
FF - prefs.js: browser.startup.homepage - hxxps://www.google.it/
.
- - - - CHIAVI ORFANE RIMOSSE - - - -
.
WebBrowser-{A057A204-BACC-4D26-8087-36EE87E26986} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKCU-Run-ABBYY Screenshot Reader Bonus - (no file)
SafeBoot-WudfPf
SafeBoot-WudfRd
AddRemove-Adobe Acrobat 5.0 - c:\windows\ISUN0410.EXE
AddRemove-Adobe Photoshop 6.0 - c:\windows\ISUN0410.EXE
AddRemove-InstallShield_{C20CE592-B0F8-4D20-BF31-0151CA6331A6} - c:\programmi\InstallShield Installation Information\{C20CE592-B0F8-4D20-BF31-0151CA6331A6}\setup.exe
AddRemove-Manuale dell'utente di Creative WebCam NX Italian - c:\windows\IsUn0410.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2012-07-05 20:48
Windows 5.1.2600 Service Pack 3 NTFS
.
scansione processi nascosti ...
.
scansione entrate autostart nascoste ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
AudioDeck = c:\programmi\VIA\VIAudioi\SBADeck\ADeck.exe 1????????????????????????????????????????????
.
Scansione files nascosti ...
.
Scansione completata con successo
Files nascosti: 0
.
**************************************************************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•9~*]
"0140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
Ora fine scansione: 2012-07-05 20:51:55
ComboFix-quarantined-files.txt 2012-07-05 18:51
.
Pre-Run: 4.062.175.232 byte disponibili
Post-Run: 6.329.917.440 byte disponibili
.
- - End Of File - - 166BB78B1E32D092D35D32A6C8891D1C