ComboFix 09-07-14.08 - _Marco_ 2009-07-30 0:34.7.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1040.18.1535.1150 [GMT 2:00]
Eseguito da: c:\documents and settings\_Marco_\Desktop\Programmi\virus\ComboFix.exe
Opzioni usate :: D:\CFScript.txt
FW: Panda Antivirus Platinum 7 *disabled* {4570FB70-5C9E-47E9-B16C-A3A6A06C4BF0}
.
- MODALITÀ CON FUNZIONALITÀ RIDOTTE -
FILE ::
"C:\a8936f5cab14bca244"
"c:\documents and settings\All Users.WINDOWS\Dati applicazioni\F-Secure"
.
((((((((((((((((((((((((( Files Creati Da 2009-06-28 al 2009-07-29 )))))))))))))))))))))))))))))))))))
.
2009-07-27 19:43 . 2009-07-27 19:43 1052 ----a-w- C:\prgmonsp.bin
2009-07-27 19:31 . 2009-03-07 10:53 41728 ----a-w- c:\windows\system32\drivers\VIRAGTLT.SYS
2009-07-27 19:31 . 2009-07-27 21:19 -------- d-----w- C:\VEXPLITE
2009-07-17 14:00 . 2009-07-17 14:00 -------- d-----w- C:\VundoFix Backups
2009-07-16 07:50 . 2009-07-16 07:50 -------- d-----w- C:\a8936f5cab14bca244
2009-07-14 20:00 . 2009-07-14 20:00 3775175 ----a-w- c:\documents and settings\All Users.WINDOWS\Dati applicazioni\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-29 20:19 . 2006-12-21 17:42 -------- d-----w- c:\programmi\F-Secure
2009-07-29 19:55 . 2007-10-25 20:52 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Dati applicazioni\F-Secure
2009-07-29 19:55 . 2004-08-19 12:00 48806 ----a-w- c:\windows\system32\perfc010.dat
2009-07-29 19:55 . 2004-08-19 12:00 347626 ----a-w- c:\windows\system32\perfh010.dat
2009-07-29 19:51 . 2007-06-14 22:20 -------- d-----w- c:\programmi\Java
2009-07-25 23:39 . 2007-06-29 19:41 -------- d---a-w- c:\documents and settings\All Users.WINDOWS\Dati applicazioni\TEMP
2009-07-14 20:00 . 2009-03-12 14:57 -------- d-----w- c:\programmi\Malwarebytes' Anti-Malware
2009-07-14 19:59 . 2008-10-25 07:29 -------- d-----w- c:\programmi\TeaTimer (Spybot - Search & Destroy)
2009-07-13 11:36 . 2009-03-12 14:58 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-13 11:36 . 2009-03-12 14:58 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-30 21:55 . 2006-02-12 10:45 21520 ----a-w- c:\documents and settings\_Marco_\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2009-06-16 14:36 . 2004-08-19 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2004-08-19 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-03 19:09 . 2004-08-19 12:00 1296384 ----a-w- c:\windows\system32\quartz.dll
2009-06-02 20:20 . 2006-04-26 15:52 -------- d-----w- c:\programmi\Robin Hood
2009-05-07 15:32 . 2004-08-19 12:00 347648 ----a-w- c:\windows\system32\localspl.dll
.
(((((((((((((((((((((((((((((
SnapShot@2009-07-16_18.07.42 )))))))))))))))))))))))))))))))))))))))))
.
+ 2004-08-19 12:00 . 2009-07-29 19:55 41206 c:\windows\system32\perfc009.dat
+ 2004-08-19 12:00 . 2004-08-19 12:00 15360 c:\windows\system32\ctfmon.exe
- 2004-08-19 12:00 . 2008-04-14 02:14 15360 c:\windows\system32\ctfmon.exe
- 2006-02-11 17:45 . 2009-07-16 17:53 32768 c:\windows\system32\config\systemprofile\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat
+ 2006-02-11 17:45 . 2009-07-27 19:40 32768 c:\windows\system32\config\systemprofile\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat
- 2006-02-11 17:45 . 2009-07-16 17:53 32768 c:\windows\system32\config\systemprofile\Impostazioni locali\Cronologia\History.IE5\index.dat
+ 2006-02-11 17:45 . 2009-07-27 19:40 32768 c:\windows\system32\config\systemprofile\Impostazioni locali\Cronologia\History.IE5\index.dat
+ 2006-02-11 17:45 . 2009-07-27 19:40 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2006-02-11 17:45 . 2009-07-16 17:53 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2004-08-19 12:00 . 2009-07-29 19:55 314220 c:\windows\system32\perfh009.dat
+ 2006-05-03 17:05 . 2001-07-09 00:50 155648 c:\windows\system32\NeroCheck.exe
+ 2006-03-02 20:48 . 2009-07-07 06:10 24539592 c:\windows\system32\MRT.exe
- 2006-03-02 20:48 . 2009-07-07 15:10 24539592 c:\windows\system32\MRT.exe
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="c:\programmi\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-19 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360]
"DWQueuedReporting"="c:\progra~1\FILECO~1\MICROS~1\DW\dwtrig20.exe" [2003-07-15 34880]
c:\documents and settings\All Users.WINDOWS\Menu Avvio\Programmi\Esecuzione automatica\
Microsoft Office.lnk - c:\programmi\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKLM\~\startupfolder\C:^Documents and Settings^_Marco_^Menu Avvio^Programmi^Esecuzione automatica^PowerReg Scheduler V3.exe]
path=c:\documents and settings\_Marco_\Menu Avvio\Programmi\Esecuzione automatica\PowerReg Scheduler V3.exe
backup=c:\windows\pss\PowerReg Scheduler V3.exeStartup
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\PandaAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\PandaFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Programmi\\Messenger\\msmsgs.exe"=
"c:\\Programmi\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
R0 VIRAGTLT;VIRAGTLT;c:\windows\system32\drivers\VIRAGTLT.SYS [2009-07-27 41728]
R2 viritsvclite;Virit eXplorer Lite;c:\vexplite\viritsvc.exe [2007-10-10 57344]
R2 WinDefend;Windows Defender;c:\programmi\Windows Defender\MsMpEng.exe [2006-11-03 13592]
S0 qdptmmqx;qdptmmqx;c:\windows\system32\drivers\ldksbehs.sys --> c:\windows\system32\drivers\ldksbehs.sys [?]
S2 CoachCap;FUJIFILM EX-10/EX-20 PC V1.00;c:\windows\system32\drivers\coachcap.sys [2002-03-03 93068]
S2 havpvhv;havpvhv;c:\windows\system32\drivers\rfzi.sys --> c:\windows\system32\drivers\rfzi.sys [?]
S4 SrvKhm;SrvKhm;"\\?\c:\programmi\Windows NT\com7.exe" --> \\?\c:\programmi\Windows NT\com7.exe [?]
S4 SrvWff;SrvWff;"\\?\c:\programmi\File comuni\Services\lpt5.exe" --> \\?\c:\programmi\File comuni\Services\lpt5.exe [?]
.
Contenuto della cartella 'Scheduled Tasks'
2009-07-29 c:\windows\Tasks\MP Scheduled Scan.job
- c:\programmi\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]
.
.
------- Scansione supplementare -------
.
uStart Page =
https://login.yahoo.com/config/mail?.intl=it&.src=ymuSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uSearchURL,(Default) = hxxp://it.rd.yahoo.com/customize/ie/defaults/su/msgr7/*http://it.search.yahoo.com
IE: &Clean Traces - c:\programmi\DAP\Privacy Package\dapcleanerie.htm
IE: &Download with &DAP - c:\programmi\DAP\dapextie.htm
IE: Download &all with DAP - c:\programmi\DAP\dapextie2.htm
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
Name-Space Handler: ftp\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - c:\progra~1\DAP\dapie.dll
Name-Space Handler: http\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - c:\progra~1\DAP\dapie.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-07-30 00:35
Windows 5.1.2600 Service Pack 3 NTFS
scansione processi nascosti ...
scansione entrate autostart nascoste ...
Scansione files nascosti ...
Scansione completata con successo
Files nascosti: 0
**************************************************************************
.
Ora fine scansione: 2009-07-29 0:39
ComboFix-quarantined-files.txt 2009-07-29 22:39
ComboFix2.txt 2009-07-29 22:15
ComboFix3.txt 2009-07-29 19:41
ComboFix4.txt 2009-07-16 18:11
ComboFix5.txt 2009-07-29 22:34
Pre-Run: 76,731,805,696 byte disponibili
Post-Run: 76,693,696,512 byte disponibili
130 --- E O F --- 2009-07-27 21:20