ComboFix 10-01-11.01 - UTENTE 11/01/2010 23.18.17.6.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.39.1040.18.2047.701 [GMT 1:00]
Eseguito da: c:\documents and settings\UTENTE\Desktop\Aiutamici\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 100111-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: AVG Anti-Virus *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: Online Armor Firewall *enabled* {B797DAA0-7E2E-4711-8BB3-D12744F1922A}
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\TEMP\logishrd\LVPrcInj01.dll
.
((((((((((((((((((((((((( Files Creati Da 2009-12-11 al 2010-01-11 )))))))))))))))))))))))))))))))))))
.
2010-01-09 11:02 . 2010-01-09 11:02 -------- d-----w- c:\programmi\CCleaner
2010-01-08 19:38 . 2010-01-08 19:38 -------- d-----w- c:\programmi\Windows Installer Clean Up
2010-01-08 15:51 . 2010-01-11 05:40 -------- d-----w- C:\Aiutamici
2010-01-07 21:10 . 2010-01-11 15:06 -------- d-----w- C:\Parcelle Tecnobit
2010-01-07 20:50 . 2010-01-07 20:51 -------- d-----w- C:\Windows installer cleanup
2009-12-28 18:39 . 2009-12-28 18:39 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\SSScanAppDataDir
2009-12-28 18:39 . 2009-12-28 18:39 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\MSScanAppDataDir
2009-12-17 09:35 . 2009-12-17 09:35 179 ----a-w- C:\handle.dat
2009-12-17 09:34 . 2009-12-17 09:34 -------- d-----w- c:\programmi\File comuni\Sonic Shared
2009-12-17 09:33 . 2009-12-17 09:34 -------- d-----w- c:\programmi\File comuni\HP
2009-12-17 09:30 . 2006-03-08 02:33 173 ------w- c:\windows\hpgmdl13.dat
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-11 22:25 . 2009-03-13 20:28 0 ----a-w- c:\windows\system32\drivers\lvuvc.hs
2010-01-11 22:25 . 2009-03-13 20:28 0 ----a-w- c:\windows\system32\drivers\logiflt.iad
2010-01-11 22:14 . 2009-03-04 18:58 -------- d-----w- c:\documents and settings\UTENTE\Dati applicazioni\Skype
2010-01-11 22:12 . 2009-03-04 19:02 -------- d-----w- c:\documents and settings\UTENTE\Dati applicazioni\skypePM
2010-01-11 13:43 . 2006-10-22 06:23 -------- d-----w- c:\programmi\Java
2010-01-09 15:10 . 2009-11-21 21:24 -------- d-----w- c:\programmi\OFFICE11
2010-01-09 15:04 . 2001-08-31 11:00 82698 ----a-w- c:\windows\system32\perfc010.dat
2010-01-09 15:04 . 2001-08-31 11:00 485418 ----a-w- c:\windows\system32\perfh010.dat
2010-01-08 19:38 . 2010-01-08 19:38 3584 ----a-r- c:\documents and settings\UTENTE\Dati applicazioni\Microsoft\Installer\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}\Icon386ED4E3.exe
2010-01-08 19:37 . 2009-09-02 13:15 -------- d-----w- c:\programmi\MSECACHE
2010-01-07 21:15 . 2006-10-18 20:19 -------- d--h--w- c:\programmi\InstallShield Installation Information
2010-01-07 15:07 . 2009-09-19 06:21 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 15:07 . 2009-09-19 06:21 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-06 20:18 . 2009-11-21 13:24 -------- d-----w- c:\programmi\XoftSpySE
2009-12-30 16:27 . 2006-10-22 08:42 -------- d-----w- c:\programmi\Tecnobit
2009-12-17 09:35 . 2006-11-29 18:31 102637 ----a-w- c:\windows\hpgins13.dat
2009-12-17 09:35 . 2006-10-18 20:04 130568 ----a-w- c:\documents and settings\UTENTE\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2009-12-17 09:32 . 2006-10-24 05:30 -------- d-----w- c:\programmi\Hewlett-Packard
2009-12-17 09:32 . 2006-11-29 19:12 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\HP
2009-12-06 20:24 . 2009-10-30 18:19 -------- d-----w- c:\documents and settings\UTENTE\Dati applicazioni\Profis
2009-12-06 19:45 . 2009-11-21 21:23 -------- d-----w- c:\programmi\Hilti
2009-12-05 06:46 . 2009-03-04 18:58 -------- d-----r- c:\programmi\Skype
2009-12-05 06:45 . 2009-12-05 06:45 -------- d-----w- c:\programmi\File comuni\Skype
2009-12-05 06:45 . 2009-03-04 18:58 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Skype
2009-12-03 05:46 . 2008-08-10 06:59 -------- d-----w- c:\programmi\IZArc
2009-12-01 17:41 . 2006-10-22 06:59 -------- d-----w- c:\programmi\AutoCAD LT 2000
2009-11-26 05:21 . 2006-10-23 13:48 -------- d-----w- c:\programmi\File comuni\Logitech
2009-11-24 23:54 . 2009-11-22 18:10 1280480 ----a-w- c:\windows\system32\aswBoot.exe
2009-11-24 23:51 . 2009-11-22 18:10 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-11-24 23:49 . 2009-11-22 18:10 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-11-24 23:48 . 2009-11-22 18:10 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-11-24 23:47 . 2009-11-22 18:10 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-11-24 23:47 . 2009-11-22 18:10 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-11-24 15:14 . 2009-10-22 14:53 1 ----a-w- c:\documents and settings\UTENTE\Dati applicazioni\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-11-23 20:01 . 2006-10-19 06:28 -------- d-----w- c:\programmi\File comuni\Adobe
2009-11-22 17:48 . 2007-01-19 07:13 -------- d-----w- c:\programmi\Microsoft ActiveSync
2009-11-22 17:40 . 2006-10-19 06:17 -------- d-----w- c:\programmi\Microsoft Works
2009-11-22 17:40 . 2009-11-21 21:24 -------- d-----w- c:\programmi\MEDIA
2009-11-22 17:40 . 2009-11-21 21:17 -------- d-----w- c:\programmi\CLIPART
2009-11-22 17:39 . 2009-03-12 15:53 -------- d-----w- c:\programmi\MSBuild
2009-11-22 17:39 . 2009-11-22 17:03 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Microsoft Help
2009-11-22 14:22 . 2009-11-22 14:22 -------- d-----w- c:\programmi\Photoshop
2009-11-22 14:11 . 2009-11-22 14:11 -------- d-----w- c:\programmi\Burn masterizzatore
2009-11-22 14:06 . 2006-10-19 05:28 -------- d-----w- c:\programmi\Google
2009-11-22 07:03 . 2006-10-22 06:26 -------- d-----w- c:\programmi\Graphisoft
2009-11-21 21:27 . 2009-11-21 21:27 -------- d-----w- c:\programmi\Templates
2009-11-21 21:26 . 2009-11-21 21:26 -------- d-----w- c:\programmi\Print-server
2009-11-21 18:39 . 2009-11-21 18:39 -------- d-----w- c:\programmi\Alwil Software
2009-11-21 13:05 . 2006-10-19 05:35 -------- d-----w- c:\documents and settings\UTENTE\Dati applicazioni\Lavasoft
2009-11-21 13:03 . 2007-04-07 16:11 -------- d-----w- c:\documents and settings\UTENTE\Dati applicazioni\Acubix PicoBackup Outlook Express Edition
2009-11-18 15:46 . 2008-03-31 14:20 -------- d-----w- c:\programmi\Strutture Tecnobit
2009-11-18 09:50 . 2009-09-19 20:03 17383456 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-11-07 12:45 . 2009-11-07 12:45 152576 ----a-w- c:\documents and settings\UTENTE\Dati applicazioni\Sun\Java\jre1.6.0_17\lzma.dll
2009-05-04 15:23 . 2009-05-04 15:23 270978 ----a-w- c:\programmi\La direzione dei lavori.zip
2009-03-26 11:28 . 2009-11-21 21:27 901120 ----a-w- c:\programmi\DEI_ScuoleEcocompatibili.exe
2008-08-10 06:57 . 2008-08-10 06:57 3723454 ----a-w- c:\programmi\IZArc_Setup.exe
2008-07-17 18:59 . 2008-07-17 19:01 3536683 ----a-w- c:\programmi\PicoBackupOESetup.exe
.
((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2006-03-30 14:45 . 2006-03-30 14:45 313472 c:\programmi\Adobe\Acrobat 7.0\Reader\bak\AdobeUpdateManager.exe
2006-10-18 20:23 . 2003-05-05 06:57 143360 c:\programmi\Analog Devices\SoundMAX\bak\SMTray.exe
2006-10-19 05:16 . 2004-06-10 19:10 339968 c:\programmi\ATI Technologies\ATI Control Panel\bak\atiptaxx.exe
2006-10-23 13:43 . 2004-05-10 14:54 49152 c:\programmi\Brother\Brmfl04c\bak\BrStDvPt.exe
2009-08-10 13:39 . 2004-05-10 14:54 49152 c:\programmi\Brother\Brmfl04c\BrStDvPt.exe
2003-09-29 23:14 . 2003-09-29 23:14 155648 c:\programmi\File comuni\ScanSoft Shared\SSBkgdUpdate\bak\SSBkgdupdate.exe
2007-01-27 18:16 . 2007-01-27 18:16 171448 c:\programmi\Google\GoogleToolbarNotifier\1.2.1128.5462\bak\GoogleToolbarNotifier.exe
2006-02-19 01:41 . 2006-02-19 01:41 49152 c:\programmi\HP\HP Software Update\bak\HPWuSchd2.exe
2006-02-19 01:41 . 2006-02-19 01:41 49152 c:\programmi\HP\HP Software Update\hpwuSchd2.exe
2006-06-15 07:43 . 2006-06-15 07:43 49152 c:\programmi\HP\ToolboxFX\bin\bak\HPTLBXFX.exe
2009-08-10 13:39 . 2006-06-15 07:43 49152 c:\programmi\HP\ToolboxFX\bin\HPTLBXFX.exe
2006-10-22 06:23 . 2005-11-10 11:03 36975 c:\programmi\Java\jre1.5.0_06\bin\bak\jusched.exe
2007-12-11 15:21 . 2007-09-25 00:11 132496 c:\programmi\Java\jre1.6.0_03\bin\bak\jusched.exe
2006-10-23 13:48 . 2003-12-01 09:38 892928 c:\programmi\Logitech\iTouch\bak\iTouch.exe
2006-10-23 16:30 . 2003-07-29 22:37 332288 c:\programmi\MemoRex\bak\MemoRexStart.exe
2009-08-10 13:39 . 2003-07-29 22:37 332288 c:\programmi\MemoRex\MemoRexStart.exe
2006-06-21 02:52 . 2006-06-21 02:52 1211176 c:\programmi\Microsoft ActiveSync\bak\wcescomm.exe
2006-06-21 02:52 . 2006-06-21 02:52 1211176 c:\programmi\Microsoft ActiveSync\wcescomm.exe
2006-09-01 14:57 . 2006-09-01 14:57 282624 c:\programmi\QuickTime\bak\qttask.exe
2009-08-10 13:39 . 2006-09-01 14:57 282624 c:\programmi\QuickTime\qttask.exe
2005-06-17 13:52 . 2005-06-17 13:52 1129472 c:\programmi\Salvataggio outlook express\PicoBackupOE\bak\PicoBackupAgent.exe
2001-08-31 11:00 . 2004-08-19 13:39 15360 c:\windows\system32\bak\ctfmon.exe
2001-08-31 11:00 . 2008-04-13 17:14 15360 c:\windows\system32\ctfmon.exe
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\programmi\Skype\\Phone\Skype.exe" [2009-10-09 25623336]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"zzzHPSETUP"="d:\setup.exe \RESET" [X]
"Logitech Utility"="Logi_MwX.Exe" [2003-11-07 19968]
"HPUsageTracking"="c:\programmi\HP\HP UT\bin\hppusg.exe" [2006-06-14 36864]
"LogitechQuickCamRibbon"="c:\programmi\Logitech\QuickCam\Quickcam.exe" [2008-02-13 2196240]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"Acrobat Assistant 7.0"="c:\programmi\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 483328]
"HP Software Update"="c:\programmi\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"QuickTime Task"="c:\programmi\QuickTime\qttask.exe" [2006-09-01 282624]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-13 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"WUAppSetup"="c:\programmi\File comuni\logishrd\WUApp32.exe" [2008-12-17 443664]
c:\documents and settings\UTENTE\Menu Avvio\Programmi\Esecuzione automatica\
Printkey.lnk - C:\Printkey.exe [2006-10-22 514560]
c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Alice ti aiuta.lnk - c:\programmi\Alice ti aiuta\bin\matcli.exe [2006-10-23 212992]
Avvio rapido HP Photosmart Premier.lnk - c:\programmi\HP\Digital Imaging\bin\hpqthb08.exe [2006-2-10 73728]
Avvio veloce di Adobe Acrobat.lnk - c:\windows\Installer\{AC76BA86-1034-4700-7760-000000000002}\SC_Acrobat.exe [2009-11-23 25214]
Logitech Desktop Messenger.lnk - c:\programmi\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2009-3-24 66864]
Status Monitor.lnk - c:\programmi\Brother\Brmfcmon\BrMfcWnd.exe [2006-10-23 819200]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /r \??\H:\0autocheck autochk *
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\programmi\Microsoft ActiveSync\rapimgr.exe"= c:\programmi\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\programmi\Microsoft ActiveSync\wcescomm.exe"= c:\programmi\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\programmi\Microsoft ActiveSync\WCESMgr.exe"= c:\programmi\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Programmi\\Graphisoft\\ArchiCAD 11\\ArchiCAD.exe"=
"c:\\Programmi\\Mozilla Firefox\\firefox.exe"=
"c:\\Programmi\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Programmi\\Adobe\\Acrobat 7.0\\Acrobat\\Acrobat.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmi\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Programmi\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"9633:TCP"= 9633:TCP:gyira
"3389:TCP"= 3389:TCP:Remote Desktop
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [22/11/2009 19.10.45 114768]
R1 OADevice;OADriver;c:\windows\system32\drivers\OADriver.sys [21/09/2009 16.08.32 200784]
R1 OAmon;OAmon;c:\windows\system32\drivers\OAmon.sys [21/09/2009 16.08.32 24656]
R1 OAnet;OAnet;c:\windows\system32\drivers\OAnet.sys [21/09/2009 16.08.32 29776]
R2 ACCAKeyServer;ACCA Key Server v.2.00;c:\acca\ACCAKeyServer\ACCAKeyService.EXE [15/03/2009 18.35.13 528896]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [22/11/2009 19.10.45 20560]
R2 CPUSB;CPUsb.Sys driver;c:\windows\system32\drivers\CPUSB.sys [22/10/2006 9.09.26 17080]
R2 cpwnt;cpwnt;c:\windows\system32\drivers\CPWNT.SYS [21/10/2006 19.08.06 21824]
S1 SASKUTIL;SASKUTIL;\??\f:\programmi\SuperantiSpyware\SASKUTIL.sys --> f:\programmi\SuperantiSpyware\SASKUTIL.sys [?]
S1 soqwx32;soqwx32;\??\c:\windows\system32\drivers\soqwx32.sys --> c:\windows\system32\drivers\soqwx32.sys [?]
S2 OAcat;Online Armor Helper Service;"f:\programmi\Firewall Armor\Online Armor\OAcat.exe" --> f:\programmi\Firewall Armor\Online Armor\OAcat.exe [?]
S2 SvcOnlineArmor;Online Armor;f:\programmi\Firewall Armor\Online Armor\oasrv.exe --> f:\programmi\Firewall Armor\Online Armor\oasrv.exe [?]
S3 MSHUSBVideo;NX6000/NX3000/VX5000/VX5500/VX7000 Filter Driver;c:\windows\system32\drivers\nx6000.sys [12/03/2009 17.33.32 33808]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
gzemr
ejivo
.
Contenuto della cartella 'Scheduled Tasks'
2010-01-11 c:\windows\Tasks\XoftSpySE 2.job
- c:\programmi\XoftSpySE\XoftSpy.exe [2009-11-21 16:34]
2010-01-11 c:\windows\Tasks\XoftSpySE.job
- c:\programmi\XoftSpySE\XoftSpy.exe [2009-11-21 16:34]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.virgilio.it/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mStart Page = hxxp://www.virgilio.it/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = 127.0.0.1
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Converti destinazione link in Adobe PDF - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Converti destinazione link in file PDF esistente - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Converti i link selezionati in Adobe PDF - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Converti i link selezionati in file PDF esistente - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Converti in Adobe PDF - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Converti nel file PDF esistente - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Converti selezione in Adobe PDF - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Converti selezione in file PDF esistente - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: E&sporta in Microsoft Excel - c:\progra~1\Office12\EXCEL.EXE/3000
TCP: {667CCFE0-179F-4596-86C5-C5967CC876D0} = 151.99.125.2,151.99.125.3
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\programmi\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\UTENTE\Dati applicazioni\Mozilla\Firefox\Profiles\1awbkkbc.default\
FF - prefs.js: browser.startup.homepage - hxxp://VIRGILIO.IT
.
- - - - CHIAVI ORFANE RIMOSSE - - - -
BHO-{D187A56B-A33F-4CBE-9D77-459FC0BAE012} - c:\programmi\Burn4Free Toolbar\v3.3.0.3\Burn4Free_Toolbar.dll
Toolbar-{4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - c:\programmi\Burn4Free Toolbar\v3.3.0.3\Burn4Free_Toolbar.dll
WebBrowser-{4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - c:\programmi\Burn4Free Toolbar\v3.3.0.3\Burn4Free_Toolbar.dll
ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - f:\programmi\SuperantiSpyware\SASSEH.DLL
ShellExecuteHooks-{4F07DA45-8170-4859-9B5F-037EF2970034} - f:\progra~1\FIREWA~1\ONLINE~1\oaevent.dll
Notify-!SASWinLogon - f:\programmi\SuperantiSpyware\SASWINLO.dll
Notify-avgrsstarter - avgrsstx.dll
AddRemove-001FFFFFFF10FF00FF1501F08F02F000-R1 - f:\programmi\Graphisoft\ArchiCAD 10\Uninstall.AC\uninstaller.exe
AddRemove-Channel V2.76 - f:\progra~1\Hilti\CHANNE~1\UNWISE.EXE
AddRemove-HijackThis - c:\aiutamici\HijackThis.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2010-01-11 23:36
Windows 5.1.2600 Service Pack 3 NTFS
scansione processi nascosti ...
scansione entrate autostart nascoste ...
Scansione files nascosti ...
Scansione completata con successo
Files nascosti: 0
**************************************************************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
[HKEY_USERS\S-1-5-21-329068152-1343024091-725345543-1003\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\ActiveSync]
"Name"="ActiveSync"
"DisplayName"="Microsoft ActiveSync"
"Param1"="ActiveSync"
"Type"="wellknown"
"Order"=dword:00000001
"State"=dword:0000000b
[HKEY_USERS\S-1-5-21-329068152-1343024091-725345543-1003\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\IESettings]
"Name"="IESettings"
"Type"="IESettings"
"Order"=dword:00000004
"State"=dword:0000000b
[HKEY_USERS\S-1-5-21-329068152-1343024091-725345543-1003\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\MediaFiles]
"Name"="MediaFiles"
"Type"="MediaFiles"
"Order"=dword:00000003
"State"=dword:0000000b
[HKEY_USERS\S-1-5-21-329068152-1343024091-725345543-1003\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\NPW]
"Name"="NPW"
"Param1"="NPW"
"Type"="wellknown"
"Order"=dword:00000002
"State"=dword:0000000b
[HKEY_USERS\S-1-5-21-329068152-1343024091-725345543-1003\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\Outlook]
"Name"="Outlook"
"DisplayName"="Microsoft Outlook"
"Param1"="Outlook"
"Type"="wellknown"
"Order"=dword:00000000
"State"=dword:00000020
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•9~*]
"0140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------
- - - - - - - > 'explorer.exe'(3820)
c:\windows\TEMP\logishrd\LVPrcInj01.dll
c:\programmi\Logitech\MouseWare\System\LgWndHk.dll
c:\progra~1\WINDOW~3\wmpband.dll
c:\programmi\File comuni\Logitech\Scrolling\LgMsgHk.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\programmi\Alwil Software\Avast4\aswUpdSv.exe
c:\programmi\Alwil Software\Avast4\ashServ.exe
c:\windows\system32\brss01a.exe
c:\programmi\File comuni\EPSON\EBAPI\eEBSVC.exe
c:\windows\system32\Brmfrmps.exe
c:\windows\system32\drivers\CDAC11BA.EXE
c:\programmi\File comuni\EPSON\EBAPI\SAgent2.exe
c:\programmi\File comuni\LightScribe\LSSrvc.exe
c:\programmi\File comuni\LogiShrd\LVCOMSER\LVComSer.exe
c:\programmi\File comuni\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\programmi\Analog Devices\SoundMAX\SMAgent.exe
c:\programmi\Alwil Software\Avast4\ashMaiSv.exe
c:\programmi\Alwil Software\Avast4\ashWebSv.exe
c:\windows\system32\wscntfy.exe
c:\programmi\Logitech\MouseWare\system\em_exec.exe
c:\programmi\Microsoft ActiveSync\wcescomm.exe
c:\programmi\Skype\Phone\Skype.exe
c:\progra~1\MI3AA1~1\rapimgr.exe
c:\programmi\File comuni\LogiShrd\LComMgr\Communications_Helper.exe
c:\programmi\File comuni\Logishrd\LQCVFX\COCIManager.exe
c:\programmi\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Ora fine scansione: 2010-01-11 23:46:25 - Il pc è stato riavviato
ComboFix-quarantined-files.txt 2010-01-11 22:46
Pre-Run: 225 087 275 008 byte disponibili
Post-Run: 225 064 079 360 byte disponibili
- - End Of File - - ED71C6951E2EFA7C2BE82B9D0E543947