((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Users\mammo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Videos.url
C:\Users\mammo\FAVORI~1\Videos.url
C:\Users\mammo\Favorites\Videos.url
.
((((((((((((((((((((((((( Files Creati Da 2008-07-23 al 2008-08-23 )))))))))))))))))))))))))))))))))))
.
Nessun nuovo file creato in questo arco di tempo
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-23 23:34 81,984 ----a-w C:\Windows\System32\bdod.bin
2008-08-23 23:34 --------- d-----w C:\Users\mammo\AppData\Roaming\DNA
2008-08-23 23:16 --------- d-----w C:\Users\mammo\AppData\Roaming\uTorrent
2008-08-23 22:59 --------- d-----w C:\ProgramData\avg8
2008-08-23 21:07 --------- d-----w C:\ProgramData\.clamwin
2008-08-23 06:32 --------- d-----w C:\Users\mammo\AppData\Roaming\Roxio
2008-08-23 02:42 147,456 --sh--w C:\Users\mammo\ppxcs.exe
2008-08-23 02:42 134,144 --sh--w C:\Users\mammo\intelOP.exe
2008-08-23 02:42 103,424 --sh--w C:\Users\mammo\css.exe
2008-08-23 02:41 103,936 --sh--w C:\Users\mammo\sccs.exe
2008-08-22 20:02 --------- d-----w C:\ProgramData\eMule
2008-08-22 20:01 --------- d-----w C:\Program Files\eMule
2008-08-22 17:55 27,335 ----a-w C:\Users\mammo\AppData\Roaming\nvModes.dat
2008-08-22 09:33 --------- d-----w C:\ProgramData\Kaspersky Lab
2008-08-21 20:56 --------- d-----w C:\ProgramData\Nero
2008-08-21 20:56 --------- d-----w C:\Program Files\Common Files\Nero
2008-08-19 14:59 --------- d-----w C:\Program Files\ilcorsaronero
2008-08-19 14:59 --------- d-----w C:\Program Files\Conduit
2008-08-19 14:58 2,560 ----a-w C:\Windows\_MSRSTRT.EXE
2008-08-19 14:47 --------- d-----w C:\Program Files\The_Pirate_Bay
2008-08-19 14:35 --------- d---a-w C:\ProgramData\TEMP
2008-08-18 16:48 --------- d-----w C:\ProgramData\Microsoft Help
2008-08-17 07:37 --------- d-----w C:\Users\mammo\AppData\Roaming\Hewlett-Packard
2008-08-15 17:07 --------- d-----w C:\Program Files\Microsoft Works
2008-08-15 12:36 --------- d-----w C:\Program Files\Windows Mail
2008-08-15 12:25 --------- d-----w C:\ProgramData\FLEXnet
2008-08-15 06:23 --------- d-----w C:\Program Files\Trend Micro
2008-08-12 13:21 --------- d-----w C:\ProgramData\Office Genuine Advantage
2008-08-11 19:44 --------- d-----w C:\Program Files\Windows Live
2008-08-11 07:43 --------- d-----w C:\Users\mammo\AppData\Roaming\NeroDCTemplates
2008-08-10 15:07 0 ----a-w C:\Users\mammo\AppData\Roaming\wklnhst.dat
2008-08-10 11:15 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-08-10 10:42 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
2008-08-10 10:38 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-08-10 10:37 --------- d-----w C:\Program Files\Windows Live Favorites
2008-08-10 10:32 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-08-10 10:25 --------- d-----w C:\ProgramData\WLInstaller
2008-08-08 10:57 --------- d-----w C:\ProgramData\services
2008-08-07 14:12 --------- d-----w C:\Program Files\AVG
2008-08-07 11:08 64,362 ----a-w C:\Windows\System32\szevnzwujsnrb.exe
2008-08-07 11:07 --------- d-----w C:\ProgramData\SoftLand Ltd
2008-08-02 17:58 --------- d-----w C:\Users\mammo\AppData\Roaming\JLC's Software
2008-08-02 17:52 --------- d-----w C:\Program Files\JLC's Software
2008-07-28 19:51 --------- d-----w C:\Program Files\Lavalys
2008-07-27 12:27 --------- d-----w C:\ProgramData\HP Easy Internet
2008-07-27 12:27 --------- d-----w C:\Program Files\HP Easy Internet
2008-07-18 18:38 586,752 ----a-w C:\Windows\WLXPGSS.SCR
2008-07-15 23:48 2,048 ----a-w C:\Windows\System32\tzres.dll
2008-07-12 20:31 --------- d-----w C:\ProgramData\Yahoo! Companion
2008-07-09 13:32 174 --sha-w C:\Program Files\desktop.ini
2008-07-05 05:33 --------- d-----w C:\Users\mammo\AppData\Roaming\SUPERAntiSpyware.com
2008-07-05 05:33 --------- d-----w C:\ProgramData\SUPERAntiSpyware.com
2008-07-05 05:33 --------- d-----w C:\Program Files\SUPERAntiSpyware
2008-07-05 05:32 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-07-04 10:36 --------- d-----w C:\Program Files\Yahoo!
2008-06-27 03:54 826,368 ----a-w C:\Windows\System32\wininet.dll
2008-06-27 03:54 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-06-27 03:54 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-06-27 03:54 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-06-26 00:34 7,964,672 ----a-w C:\Windows\System32\NlsLexicons0024.dll
2008-06-26 00:33 9,892,864 ----a-w C:\Windows\System32\NlsLexicons000a.dll
2008-06-19 03:25 61,440 ----a-w C:\Windows\System32\winipsec.dll
2008-06-19 03:25 361,984 ----a-w C:\Windows\System32\IPSECSVC.DLL
2008-06-19 03:25 28,672 ----a-w C:\Windows\System32\FwRemoteSvr.dll
2008-06-19 03:25 272,896 ----a-w C:\Windows\System32\polstore.dll
2008-06-11 12:41 21,248 ----a-w C:\Windows\Help\OEM\scripts\HPScript.exe
2008-04-13 05:00 32 ----a-w C:\Users\All Users\ezsid.dat
2008-04-13 05:00 32 ----a-w C:\ProgramData\ezsid.dat
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-04-13 04:11 1232896]
"LightScribe Control Panel"="C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-04-19 13:26 484904]
"ISUSPM"="C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe" [2007-03-29 15:41 222128]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 14:35 125440]
"BitTorrent DNA"="C:\Users\mammo\Program Files\DNA\btdna.exe" [2008-05-13 11:59 289088]
"uTorrent"="C:\Users\mammo\Program Files\uTorrent\uTorrent.exe" [2008-08-16 00:18 267056]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2008-02-29 09:14 4670704]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-05-28 10:33 1506544]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-13 05:36 827392]
"QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2007-04-23 18:11 176128]
"HP Health Check Scheduler"="C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-03-12 11:54 50696]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0\bin\jusched.exe" [2007-08-18 12:23 77824]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 07:00 33648]
"Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-01-11 19:54 623992]
"BDMCon"="C:\Program Files\Softwin\BitDefender10\bdmcon.exe" [2007-04-02 16:48 290816]
"BDAgent"="C:\Program Files\Softwin\BitDefender10\bdagent.exe" [2007-03-26 15:49 69632]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-07-09 04:57 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-07-09 04:57 8433664]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-07-09 04:57 81920]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 10:13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{ADDD198D-8918-4B82-98EC-6A23CCA2CBDA}"= C:\Program Files\HP\QuickPlay\QP.exe:Quick Play
"{BD4D7ABC-E9B0-4EB5-9BF8-1DB9A0577704}"= C:\Program Files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{79E65E0B-F59B-4AD7-BD59-42C603B07411}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{9ECF8212-EAD7-4926-8361-84B8D2E05294}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{1F829208-0B45-4B7F-B6BB-2E4EC22D9F84}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{22AC33D6-0E33-40D0-92AE-530D542BF48D}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{D0F5FE1E-5B4D-4D63-9911-2080C9174D73}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{FC0F331C-D518-4553-B1FF-B12312C41B98}"= UDP:C:\Program Files\Skype\Phone\Skype.exe:Skype
"{FCE11569-97C3-44B6-B7B1-AA58B4DC1E34}"= TCP:C:\Program Files\Skype\Phone\Skype.exe:Skype
"{C9D9A26D-E98A-4905-9E85-5BBB4FCE01BE}"= UDP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{648D01A7-AED2-4011-AACF-932056782953}"= TCP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{1A957E11-A6A4-4CF4-80B3-60F52CF2DE87}"= UDP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{5C094016-B68F-49E8-91BF-72E2E156F3A3}"= TCP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{F2F31C5A-4903-4074-A49A-8CEE78D7F66C}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"{E063CC8B-5101-4D5F-892D-3798CCC7948B}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"{2897DF93-BBB8-44BD-8000-04FCA2DB9576}"= UDP:C:\Program Files\BitTorrent_DNA\dna.exe:BitTorrent DNA
"{0EE2569F-4158-4943-AAA8-DE7D6B851F3F}"= TCP:C:\Program Files\BitTorrent_DNA\dna.exe:BitTorrent DNA
"{B92EA189-1FD7-4352-80D0-A6BBCDF1BED2}"= UDP:C:\Program Files\DNA\btdna.exe:DNA
"{EEAF4200-555D-4BD1-8746-2D92A010543A}"= TCP:C:\Program Files\DNA\btdna.exe:DNA
"{4CC08326-17E9-46FC-B53F-B20E64977294}"= UDP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent
"{436A5DE6-F095-42BB-9583-DCDCBEFA9423}"= TCP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent
"TCP Query User{7743762A-B5FF-407C-A9CD-A6C3914FCC53}C:\\users\\mammo\\program files\\dna\\btdna.exe"= UDP:C:\users\mammo\program files\dna\btdna.exe:btdna.exe
"UDP Query User{D85851E3-BD54-4F31-9941-17CE90F96CBE}C:\\users\\mammo\\program files\\dna\\btdna.exe"= TCP:C:\users\mammo\program files\dna\btdna.exe:btdna.exe
"TCP Query User{6CDA0449-5B1C-490D-A7E6-5091C79BD09D}C:\\users\\mammo\\program files\\utorrent\\utorrent.exe"= UDP:C:\users\mammo\program files\utorrent\utorrent.exe:utorrent.exe
"UDP Query User{14436924-6CDF-4902-815D-C2083C42F00F}C:\\users\\mammo\\program files\\utorrent\\utorrent.exe"= TCP:C:\users\mammo\program files\utorrent\utorrent.exe:utorrent.exe
"TCP Query User{4B68D636-42AC-4916-B504-CC00775D08DA}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule Plus
"UDP Query User{FC810AB0-D58F-455F-A92D-0AC3E8E4F948}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule Plus
"TCP Query User{659BC667-F461-42D2-AAAB-EEF60E2158CA}C:\\users\\mammo\\appdata\\local\\temp\\rar$ex00.626\\emule.exe"= UDP:C:\users\mammo\appdata\local\temp\rar$ex00.626\emule.exe:emule.exe
"UDP Query User{6D7B46F4-9F17-4807-9F20-85D388E10265}C:\\users\\mammo\\appdata\\local\\temp\\rar$ex00.626\\emule.exe"= TCP:C:\users\mammo\appdata\local\temp\rar$ex00.626\emule.exe:emule.exe
"{D14EBCD1-9F2A-4081-A442-33F407A48A67}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{DBD043CE-F68C-4A4E-99D0-729A26909A4A}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{65078C9B-C0D9-4212-B9DE-CB0456DF068C}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"{1691F4D9-0843-4DE7-9E00-F53E0514FCD2}"= UDP:C:\Users\mammo\Program Files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{24B89F79-A16C-4ED8-9A84-CC45D04BF9EE}"= TCP:C:\Users\mammo\Program Files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"TCP Query User{C2146692-7554-4DCD-9566-DF300C51DAA9}C:\\users\\mammo\\downloads\\[pc-multi] dreammatchtennispro2.08\\dream match tennis pro.exe"= UDP:C:\users\mammo\downloads\[pc-multi] dreammatchtennispro2.08\dream match tennis pro.exe:dream match tennis pro.exe
"UDP Query User{381A6C89-814A-4154-B924-6957BEC79765}C:\\users\\mammo\\downloads\\[pc-multi] dreammatchtennispro2.08\\dream match tennis pro.exe"= TCP:C:\users\mammo\downloads\[pc-multi] dreammatchtennispro2.08\dream match tennis pro.exe:dream match tennis pro.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Program Files\\BitTorrent\\bittorrent.exe"= C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
S2 NOD32FiXTemDono;Eset Nod32 Boot;C:\Windows\system32\regedt32.exe [2006-11-02 11:45]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0ddadd62-11eb-11dd-b690-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0f4954f4-6ac9-11dd-807d-001a73ca406a}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0f4954f5-6ac9-11dd-807d-001a73ca406a}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{12ba5799-1056-11dd-9573-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{12ba579a-1056-11dd-9573-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1b8cf2fb-13aa-11dd-8b84-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1b8cf2fc-13aa-11dd-8b84-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{20b5ba45-10e2-11dd-8e24-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{20b5ba46-10e2-11dd-8e24-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{31197ae4-1c3a-11dd-8ea3-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{31197aee-1c3a-11dd-8ea3-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{332ceefb-0876-11dd-83f2-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{332cef12-0876-11dd-83f2-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ae6db748-109a-11dd-9709-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ae6db74f-109a-11dd-9709-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ae6db75c-109a-11dd-9709-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ae6db763-109a-11dd-9709-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dbc27e95-11dc-11dd-9eec-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dbc27ea8-11dc-11dd-9eec-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dbc27ec1-11dc-11dd-9eec-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dbc27ec2-11dc-11dd-9eec-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f63c2e33-11c3-11dd-8abd-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f63c2e37-11c3-11dd-8abd-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f63c2e38-11c3-11dd-8abd-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fac955d1-14e9-11dd-9f43-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fac955d8-14e9-11dd-9f43-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fac955eb-14e9-11dd-9f43-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fac955f2-14e9-11dd-9f43-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fac95605-14e9-11dd-9f43-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fac9560c-14e9-11dd-9f43-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
Contenuto della cartella 'Scheduled Tasks'
2008-08-23 C:\Windows\Tasks\User_Feed_Synchronization-{2831D117-3C39-4A3A-970E-D1163BC1AF52}.job
- C:\Windows\system32\msfeedssync.exe [2006-11-02 11:45]
2008-08-10 C:\Windows\Tasks\Verifica aggiornamenti per Windows Live Toolbar.job
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]
.
- - - - ORFÃOS REMOVIDOS - - - -
BHO-{862225c5-971b-0af5-0c96-ea32dc608ec2} - C:\Windows\system32\xenxniwvem.dll
HKCU-Run-IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
HKCU-Run-E07IXLRD_285013 - C:\Program Files\Microsoft Encarta\Microsoft Encarta 2007 - Premium DVD\EDICT.EXE
HKCU-Run-LphantAutoRun - C:\Program Files\Lphant\eLePhantClient.exe
HKLM-Run-NBKeyScan - C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
HKLM-Run-{952064a9-6722-3784-6018-dc888cd590b0} - C:\Windows\system32\xenxniwvem.dll
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://it.yahoo.com/
R0 -: HKLM-Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=IT_IT&c=73&bd=Pavilion&pf=laptop
R1 -: HKCU-SearchURL,(Default) = hxxp://it.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://it.search.yahoo.com
O8 -: &Windows Live Search - C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 -: Add to Windows &Live Favorites -
http://favorites.live.com/quickadd.aspxO8 -: Aggiungi a PDF esistente - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 -: Converti destinazione link in Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 -: Converti destinazione link in file PDF esistente - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 -: Converti i link selezionati in Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 -: Converti i link selezionati in file PDF esistente - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 -: Converti in Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 -: Converti selezione in Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 -: Converti selezione in file PDF esistente - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 -: E&sporta in Microsoft Excel - C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-08-24 01:38:19
Windows 6.0.6000 NTFS
scansione processi nascosti ...
scansione entrate autostart nascoste ...
Scansione files nascosti ...
Scansione completata con successo
Files nascosti: 0
**************************************************************************
.
Ora fine scansione: 2008-08-24 1:40:45
ComboFix-quarantined-files.txt 2008-08-23 23:40:28
Pre-Run: Impossibile trovare il testo del messaggio per il numero di messaggio 0x2379 nel file di messaggio per Application.
Post-Run: 28,835,287,040 byte disponibili
283 --- E O F --- 2008-08-21 19:19:00
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Users\mammo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Videos.url
C:\Users\mammo\FAVORI~1\Videos.url
C:\Users\mammo\Favorites\Videos.url
.
((((((((((((((((((((((((( Files Creati Da 2008-07-23 al 2008-08-23 )))))))))))))))))))))))))))))))))))
.
Nessun nuovo file creato in questo arco di tempo
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-23 23:34 81,984 ----a-w C:\Windows\System32\bdod.bin
2008-08-23 23:34 --------- d-----w C:\Users\mammo\AppData\Roaming\DNA
2008-08-23 23:16 --------- d-----w C:\Users\mammo\AppData\Roaming\uTorrent
2008-08-23 22:59 --------- d-----w C:\ProgramData\avg8
2008-08-23 21:07 --------- d-----w C:\ProgramData\.clamwin
2008-08-23 06:32 --------- d-----w C:\Users\mammo\AppData\Roaming\Roxio
2008-08-23 02:42 147,456 --sh--w C:\Users\mammo\ppxcs.exe
2008-08-23 02:42 134,144 --sh--w C:\Users\mammo\intelOP.exe
2008-08-23 02:42 103,424 --sh--w C:\Users\mammo\css.exe
2008-08-23 02:41 103,936 --sh--w C:\Users\mammo\sccs.exe
2008-08-22 20:02 --------- d-----w C:\ProgramData\eMule
2008-08-22 20:01 --------- d-----w C:\Program Files\eMule
2008-08-22 17:55 27,335 ----a-w C:\Users\mammo\AppData\Roaming\nvModes.dat
2008-08-22 09:33 --------- d-----w C:\ProgramData\Kaspersky Lab
2008-08-21 20:56 --------- d-----w C:\ProgramData\Nero
2008-08-21 20:56 --------- d-----w C:\Program Files\Common Files\Nero
2008-08-19 14:59 --------- d-----w C:\Program Files\ilcorsaronero
2008-08-19 14:59 --------- d-----w C:\Program Files\Conduit
2008-08-19 14:58 2,560 ----a-w C:\Windows\_MSRSTRT.EXE
2008-08-19 14:47 --------- d-----w C:\Program Files\The_Pirate_Bay
2008-08-19 14:35 --------- d---a-w C:\ProgramData\TEMP
2008-08-18 16:48 --------- d-----w C:\ProgramData\Microsoft Help
2008-08-17 07:37 --------- d-----w C:\Users\mammo\AppData\Roaming\Hewlett-Packard
2008-08-15 17:07 --------- d-----w C:\Program Files\Microsoft Works
2008-08-15 12:36 --------- d-----w C:\Program Files\Windows Mail
2008-08-15 12:25 --------- d-----w C:\ProgramData\FLEXnet
2008-08-15 06:23 --------- d-----w C:\Program Files\Trend Micro
2008-08-12 13:21 --------- d-----w C:\ProgramData\Office Genuine Advantage
2008-08-11 19:44 --------- d-----w C:\Program Files\Windows Live
2008-08-11 07:43 --------- d-----w C:\Users\mammo\AppData\Roaming\NeroDCTemplates
2008-08-10 15:07 0 ----a-w C:\Users\mammo\AppData\Roaming\wklnhst.dat
2008-08-10 11:15 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-08-10 10:42 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
2008-08-10 10:38 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-08-10 10:37 --------- d-----w C:\Program Files\Windows Live Favorites
2008-08-10 10:32 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-08-10 10:25 --------- d-----w C:\ProgramData\WLInstaller
2008-08-08 10:57 --------- d-----w C:\ProgramData\services
2008-08-07 14:12 --------- d-----w C:\Program Files\AVG
2008-08-07 11:08 64,362 ----a-w C:\Windows\System32\szevnzwujsnrb.exe
2008-08-07 11:07 --------- d-----w C:\ProgramData\SoftLand Ltd
2008-08-02 17:58 --------- d-----w C:\Users\mammo\AppData\Roaming\JLC's Software
2008-08-02 17:52 --------- d-----w C:\Program Files\JLC's Software
2008-07-28 19:51 --------- d-----w C:\Program Files\Lavalys
2008-07-27 12:27 --------- d-----w C:\ProgramData\HP Easy Internet
2008-07-27 12:27 --------- d-----w C:\Program Files\HP Easy Internet
2008-07-18 18:38 586,752 ----a-w C:\Windows\WLXPGSS.SCR
2008-07-15 23:48 2,048 ----a-w C:\Windows\System32\tzres.dll
2008-07-12 20:31 --------- d-----w C:\ProgramData\Yahoo! Companion
2008-07-09 13:32 174 --sha-w C:\Program Files\desktop.ini
2008-07-05 05:33 --------- d-----w C:\Users\mammo\AppData\Roaming\SUPERAntiSpyware.com
2008-07-05 05:33 --------- d-----w C:\ProgramData\SUPERAntiSpyware.com
2008-07-05 05:33 --------- d-----w C:\Program Files\SUPERAntiSpyware
2008-07-05 05:32 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-07-04 10:36 --------- d-----w C:\Program Files\Yahoo!
2008-06-27 03:54 826,368 ----a-w C:\Windows\System32\wininet.dll
2008-06-27 03:54 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-06-27 03:54 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-06-27 03:54 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-06-26 00:34 7,964,672 ----a-w C:\Windows\System32\NlsLexicons0024.dll
2008-06-26 00:33 9,892,864 ----a-w C:\Windows\System32\NlsLexicons000a.dll
2008-06-19 03:25 61,440 ----a-w C:\Windows\System32\winipsec.dll
2008-06-19 03:25 361,984 ----a-w C:\Windows\System32\IPSECSVC.DLL
2008-06-19 03:25 28,672 ----a-w C:\Windows\System32\FwRemoteSvr.dll
2008-06-19 03:25 272,896 ----a-w C:\Windows\System32\polstore.dll
2008-06-11 12:41 21,248 ----a-w C:\Windows\Help\OEM\scripts\HPScript.exe
2008-04-13 05:00 32 ----a-w C:\Users\All Users\ezsid.dat
2008-04-13 05:00 32 ----a-w C:\ProgramData\ezsid.dat
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-04-13 04:11 1232896]
"LightScribe Control Panel"="C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-04-19 13:26 484904]
"ISUSPM"="C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe" [2007-03-29 15:41 222128]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 14:35 125440]
"BitTorrent DNA"="C:\Users\mammo\Program Files\DNA\btdna.exe" [2008-05-13 11:59 289088]
"uTorrent"="C:\Users\mammo\Program Files\uTorrent\uTorrent.exe" [2008-08-16 00:18 267056]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2008-02-29 09:14 4670704]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-05-28 10:33 1506544]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-13 05:36 827392]
"QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2007-04-23 18:11 176128]
"HP Health Check Scheduler"="C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-03-12 11:54 50696]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0\bin\jusched.exe" [2007-08-18 12:23 77824]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 07:00 33648]
"Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-01-11 19:54 623992]
"BDMCon"="C:\Program Files\Softwin\BitDefender10\bdmcon.exe" [2007-04-02 16:48 290816]
"BDAgent"="C:\Program Files\Softwin\BitDefender10\bdagent.exe" [2007-03-26 15:49 69632]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-07-09 04:57 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-07-09 04:57 8433664]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-07-09 04:57 81920]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 10:13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{ADDD198D-8918-4B82-98EC-6A23CCA2CBDA}"= C:\Program Files\HP\QuickPlay\QP.exe:Quick Play
"{BD4D7ABC-E9B0-4EB5-9BF8-1DB9A0577704}"= C:\Program Files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{79E65E0B-F59B-4AD7-BD59-42C603B07411}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{9ECF8212-EAD7-4926-8361-84B8D2E05294}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{1F829208-0B45-4B7F-B6BB-2E4EC22D9F84}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{22AC33D6-0E33-40D0-92AE-530D542BF48D}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{D0F5FE1E-5B4D-4D63-9911-2080C9174D73}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{FC0F331C-D518-4553-B1FF-B12312C41B98}"= UDP:C:\Program Files\Skype\Phone\Skype.exe:Skype
"{FCE11569-97C3-44B6-B7B1-AA58B4DC1E34}"= TCP:C:\Program Files\Skype\Phone\Skype.exe:Skype
"{C9D9A26D-E98A-4905-9E85-5BBB4FCE01BE}"= UDP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{648D01A7-AED2-4011-AACF-932056782953}"= TCP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{1A957E11-A6A4-4CF4-80B3-60F52CF2DE87}"= UDP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{5C094016-B68F-49E8-91BF-72E2E156F3A3}"= TCP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{F2F31C5A-4903-4074-A49A-8CEE78D7F66C}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"{E063CC8B-5101-4D5F-892D-3798CCC7948B}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"{2897DF93-BBB8-44BD-8000-04FCA2DB9576}"= UDP:C:\Program Files\BitTorrent_DNA\dna.exe:BitTorrent DNA
"{0EE2569F-4158-4943-AAA8-DE7D6B851F3F}"= TCP:C:\Program Files\BitTorrent_DNA\dna.exe:BitTorrent DNA
"{B92EA189-1FD7-4352-80D0-A6BBCDF1BED2}"= UDP:C:\Program Files\DNA\btdna.exe:DNA
"{EEAF4200-555D-4BD1-8746-2D92A010543A}"= TCP:C:\Program Files\DNA\btdna.exe:DNA
"{4CC08326-17E9-46FC-B53F-B20E64977294}"= UDP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent
"{436A5DE6-F095-42BB-9583-DCDCBEFA9423}"= TCP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent
"TCP Query User{7743762A-B5FF-407C-A9CD-A6C3914FCC53}C:\\users\\mammo\\program files\\dna\\btdna.exe"= UDP:C:\users\mammo\program files\dna\btdna.exe:btdna.exe
"UDP Query User{D85851E3-BD54-4F31-9941-17CE90F96CBE}C:\\users\\mammo\\program files\\dna\\btdna.exe"= TCP:C:\users\mammo\program files\dna\btdna.exe:btdna.exe
"TCP Query User{6CDA0449-5B1C-490D-A7E6-5091C79BD09D}C:\\users\\mammo\\program files\\utorrent\\utorrent.exe"= UDP:C:\users\mammo\program files\utorrent\utorrent.exe:utorrent.exe
"UDP Query User{14436924-6CDF-4902-815D-C2083C42F00F}C:\\users\\mammo\\program files\\utorrent\\utorrent.exe"= TCP:C:\users\mammo\program files\utorrent\utorrent.exe:utorrent.exe
"TCP Query User{4B68D636-42AC-4916-B504-CC00775D08DA}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule Plus
"UDP Query User{FC810AB0-D58F-455F-A92D-0AC3E8E4F948}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule Plus
"TCP Query User{659BC667-F461-42D2-AAAB-EEF60E2158CA}C:\\users\\mammo\\appdata\\local\\temp\\rar$ex00.626\\emule.exe"= UDP:C:\users\mammo\appdata\local\temp\rar$ex00.626\emule.exe:emule.exe
"UDP Query User{6D7B46F4-9F17-4807-9F20-85D388E10265}C:\\users\\mammo\\appdata\\local\\temp\\rar$ex00.626\\emule.exe"= TCP:C:\users\mammo\appdata\local\temp\rar$ex00.626\emule.exe:emule.exe
"{D14EBCD1-9F2A-4081-A442-33F407A48A67}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{DBD043CE-F68C-4A4E-99D0-729A26909A4A}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{65078C9B-C0D9-4212-B9DE-CB0456DF068C}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"{1691F4D9-0843-4DE7-9E00-F53E0514FCD2}"= UDP:C:\Users\mammo\Program Files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{24B89F79-A16C-4ED8-9A84-CC45D04BF9EE}"= TCP:C:\Users\mammo\Program Files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"TCP Query User{C2146692-7554-4DCD-9566-DF300C51DAA9}C:\\users\\mammo\\downloads\\[pc-multi] dreammatchtennispro2.08\\dream match tennis pro.exe"= UDP:C:\users\mammo\downloads\[pc-multi] dreammatchtennispro2.08\dream match tennis pro.exe:dream match tennis pro.exe
"UDP Query User{381A6C89-814A-4154-B924-6957BEC79765}C:\\users\\mammo\\downloads\\[pc-multi] dreammatchtennispro2.08\\dream match tennis pro.exe"= TCP:C:\users\mammo\downloads\[pc-multi] dreammatchtennispro2.08\dream match tennis pro.exe:dream match tennis pro.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Program Files\\BitTorrent\\bittorrent.exe"= C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
S2 NOD32FiXTemDono;Eset Nod32 Boot;C:\Windows\system32\regedt32.exe [2006-11-02 11:45]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0ddadd62-11eb-11dd-b690-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0f4954f4-6ac9-11dd-807d-001a73ca406a}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0f4954f5-6ac9-11dd-807d-001a73ca406a}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{12ba5799-1056-11dd-9573-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{12ba579a-1056-11dd-9573-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1b8cf2fb-13aa-11dd-8b84-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1b8cf2fc-13aa-11dd-8b84-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{20b5ba45-10e2-11dd-8e24-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{20b5ba46-10e2-11dd-8e24-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{31197ae4-1c3a-11dd-8ea3-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{31197aee-1c3a-11dd-8ea3-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{332ceefb-0876-11dd-83f2-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{332cef12-0876-11dd-83f2-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ae6db748-109a-11dd-9709-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ae6db74f-109a-11dd-9709-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ae6db75c-109a-11dd-9709-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ae6db763-109a-11dd-9709-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dbc27e95-11dc-11dd-9eec-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dbc27ea8-11dc-11dd-9eec-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dbc27ec1-11dc-11dd-9eec-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dbc27ec2-11dc-11dd-9eec-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f63c2e33-11c3-11dd-8abd-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f63c2e37-11c3-11dd-8abd-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f63c2e38-11c3-11dd-8abd-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fac955d1-14e9-11dd-9f43-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fac955d8-14e9-11dd-9f43-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fac955eb-14e9-11dd-9f43-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fac955f2-14e9-11dd-9f43-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fac95605-14e9-11dd-9f43-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fac9560c-14e9-11dd-9f43-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
Contenuto della cartella 'Scheduled Tasks'
2008-08-23 C:\Windows\Tasks\User_Feed_Synchronization-{2831D117-3C39-4A3A-970E-D1163BC1AF52}.job
- C:\Windows\system32\msfeedssync.exe [2006-11-02 11:45]
2008-08-10 C:\Windows\Tasks\Verifica aggiornamenti per Windows Live Toolbar.job
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]
.
- - - - ORFÃOS REMOVIDOS - - - -
BHO-{862225c5-971b-0af5-0c96-ea32dc608ec2} - C:\Windows\system32\xenxniwvem.dll
HKCU-Run-IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
HKCU-Run-E07IXLRD_285013 - C:\Program Files\Microsoft Encarta\Microsoft Encarta 2007 - Premium DVD\EDICT.EXE
HKCU-Run-LphantAutoRun - C:\Program Files\Lphant\eLePhantClient.exe
HKLM-Run-NBKeyScan - C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
HKLM-Run-{952064a9-6722-3784-6018-dc888cd590b0} - C:\Windows\system32\xenxniwvem.dll
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://it.yahoo.com/
R0 -: HKLM-Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=IT_IT&c=73&bd=Pavilion&pf=laptop
R1 -: HKCU-SearchURL,(Default) = hxxp://it.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://it.search.yahoo.com
O8 -: &Windows Live Search - C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 -: Add to Windows &Live Favorites -
http://favorites.live.com/quickadd.aspxO8 -: Aggiungi a PDF esistente - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 -: Converti destinazione link in Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 -: Converti destinazione link in file PDF esistente - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 -: Converti i link selezionati in Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 -: Converti i link selezionati in file PDF esistente - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 -: Converti in Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 -: Converti selezione in Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 -: Converti selezione in file PDF esistente - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 -: E&sporta in Microsoft Excel - C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-08-24 01:38:19
Windows 6.0.6000 NTFS
scansione processi nascosti ...
scansione entrate autostart nascoste ...
Scansione files nascosti ...
Scansione completata con successo
Files nascosti: 0
**************************************************************************
.
Ora fine scansione: 2008-08-24 1:40:45
ComboFix-quarantined-files.txt 2008-08-23 23:40:28
Pre-Run: Impossibile trovare il testo del messaggio per il numero di messaggio 0x2379 nel file di messaggio per Application.
Post-Run: 28,835,287,040 byte disponibili
283 --- E O F --- 2008-08-21 19:19:00
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Users\mammo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Videos.url
C:\Users\mammo\FAVORI~1\Videos.url
C:\Users\mammo\Favorites\Videos.url
.
((((((((((((((((((((((((( Files Creati Da 2008-07-23 al 2008-08-23 )))))))))))))))))))))))))))))))))))
.
Nessun nuovo file creato in questo arco di tempo
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-23 23:34 81,984 ----a-w C:\Windows\System32\bdod.bin
2008-08-23 23:34 --------- d-----w C:\Users\mammo\AppData\Roaming\DNA
2008-08-23 23:16 --------- d-----w C:\Users\mammo\AppData\Roaming\uTorrent
2008-08-23 22:59 --------- d-----w C:\ProgramData\avg8
2008-08-23 21:07 --------- d-----w C:\ProgramData\.clamwin
2008-08-23 06:32 --------- d-----w C:\Users\mammo\AppData\Roaming\Roxio
2008-08-23 02:42 147,456 --sh--w C:\Users\mammo\ppxcs.exe
2008-08-23 02:42 134,144 --sh--w C:\Users\mammo\intelOP.exe
2008-08-23 02:42 103,424 --sh--w C:\Users\mammo\css.exe
2008-08-23 02:41 103,936 --sh--w C:\Users\mammo\sccs.exe
2008-08-22 20:02 --------- d-----w C:\ProgramData\eMule
2008-08-22 20:01 --------- d-----w C:\Program Files\eMule
2008-08-22 17:55 27,335 ----a-w C:\Users\mammo\AppData\Roaming\nvModes.dat
2008-08-22 09:33 --------- d-----w C:\ProgramData\Kaspersky Lab
2008-08-21 20:56 --------- d-----w C:\ProgramData\Nero
2008-08-21 20:56 --------- d-----w C:\Program Files\Common Files\Nero
2008-08-19 14:59 --------- d-----w C:\Program Files\ilcorsaronero
2008-08-19 14:59 --------- d-----w C:\Program Files\Conduit
2008-08-19 14:58 2,560 ----a-w C:\Windows\_MSRSTRT.EXE
2008-08-19 14:47 --------- d-----w C:\Program Files\The_Pirate_Bay
2008-08-19 14:35 --------- d---a-w C:\ProgramData\TEMP
2008-08-18 16:48 --------- d-----w C:\ProgramData\Microsoft Help
2008-08-17 07:37 --------- d-----w C:\Users\mammo\AppData\Roaming\Hewlett-Packard
2008-08-15 17:07 --------- d-----w C:\Program Files\Microsoft Works
2008-08-15 12:36 --------- d-----w C:\Program Files\Windows Mail
2008-08-15 12:25 --------- d-----w C:\ProgramData\FLEXnet
2008-08-15 06:23 --------- d-----w C:\Program Files\Trend Micro
2008-08-12 13:21 --------- d-----w C:\ProgramData\Office Genuine Advantage
2008-08-11 19:44 --------- d-----w C:\Program Files\Windows Live
2008-08-11 07:43 --------- d-----w C:\Users\mammo\AppData\Roaming\NeroDCTemplates
2008-08-10 15:07 0 ----a-w C:\Users\mammo\AppData\Roaming\wklnhst.dat
2008-08-10 11:15 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-08-10 10:42 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
2008-08-10 10:38 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-08-10 10:37 --------- d-----w C:\Program Files\Windows Live Favorites
2008-08-10 10:32 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-08-10 10:25 --------- d-----w C:\ProgramData\WLInstaller
2008-08-08 10:57 --------- d-----w C:\ProgramData\services
2008-08-07 14:12 --------- d-----w C:\Program Files\AVG
2008-08-07 11:08 64,362 ----a-w C:\Windows\System32\szevnzwujsnrb.exe
2008-08-07 11:07 --------- d-----w C:\ProgramData\SoftLand Ltd
2008-08-02 17:58 --------- d-----w C:\Users\mammo\AppData\Roaming\JLC's Software
2008-08-02 17:52 --------- d-----w C:\Program Files\JLC's Software
2008-07-28 19:51 --------- d-----w C:\Program Files\Lavalys
2008-07-27 12:27 --------- d-----w C:\ProgramData\HP Easy Internet
2008-07-27 12:27 --------- d-----w C:\Program Files\HP Easy Internet
2008-07-18 18:38 586,752 ----a-w C:\Windows\WLXPGSS.SCR
2008-07-15 23:48 2,048 ----a-w C:\Windows\System32\tzres.dll
2008-07-12 20:31 --------- d-----w C:\ProgramData\Yahoo! Companion
2008-07-09 13:32 174 --sha-w C:\Program Files\desktop.ini
2008-07-05 05:33 --------- d-----w C:\Users\mammo\AppData\Roaming\SUPERAntiSpyware.com
2008-07-05 05:33 --------- d-----w C:\ProgramData\SUPERAntiSpyware.com
2008-07-05 05:33 --------- d-----w C:\Program Files\SUPERAntiSpyware
2008-07-05 05:32 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-07-04 10:36 --------- d-----w C:\Program Files\Yahoo!
2008-06-27 03:54 826,368 ----a-w C:\Windows\System32\wininet.dll
2008-06-27 03:54 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-06-27 03:54 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-06-27 03:54 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-06-26 00:34 7,964,672 ----a-w C:\Windows\System32\NlsLexicons0024.dll
2008-06-26 00:33 9,892,864 ----a-w C:\Windows\System32\NlsLexicons000a.dll
2008-06-19 03:25 61,440 ----a-w C:\Windows\System32\winipsec.dll
2008-06-19 03:25 361,984 ----a-w C:\Windows\System32\IPSECSVC.DLL
2008-06-19 03:25 28,672 ----a-w C:\Windows\System32\FwRemoteSvr.dll
2008-06-19 03:25 272,896 ----a-w C:\Windows\System32\polstore.dll
2008-06-11 12:41 21,248 ----a-w C:\Windows\Help\OEM\scripts\HPScript.exe
2008-04-13 05:00 32 ----a-w C:\Users\All Users\ezsid.dat
2008-04-13 05:00 32 ----a-w C:\ProgramData\ezsid.dat
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-04-13 04:11 1232896]
"LightScribe Control Panel"="C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-04-19 13:26 484904]
"ISUSPM"="C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe" [2007-03-29 15:41 222128]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 14:35 125440]
"BitTorrent DNA"="C:\Users\mammo\Program Files\DNA\btdna.exe" [2008-05-13 11:59 289088]
"uTorrent"="C:\Users\mammo\Program Files\uTorrent\uTorrent.exe" [2008-08-16 00:18 267056]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2008-02-29 09:14 4670704]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-05-28 10:33 1506544]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-13 05:36 827392]
"QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2007-04-23 18:11 176128]
"HP Health Check Scheduler"="C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-03-12 11:54 50696]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0\bin\jusched.exe" [2007-08-18 12:23 77824]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 07:00 33648]
"Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-01-11 19:54 623992]
"BDMCon"="C:\Program Files\Softwin\BitDefender10\bdmcon.exe" [2007-04-02 16:48 290816]
"BDAgent"="C:\Program Files\Softwin\BitDefender10\bdagent.exe" [2007-03-26 15:49 69632]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-07-09 04:57 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-07-09 04:57 8433664]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-07-09 04:57 81920]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 10:13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{ADDD198D-8918-4B82-98EC-6A23CCA2CBDA}"= C:\Program Files\HP\QuickPlay\QP.exe:Quick Play
"{BD4D7ABC-E9B0-4EB5-9BF8-1DB9A0577704}"= C:\Program Files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{79E65E0B-F59B-4AD7-BD59-42C603B07411}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{9ECF8212-EAD7-4926-8361-84B8D2E05294}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{1F829208-0B45-4B7F-B6BB-2E4EC22D9F84}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{22AC33D6-0E33-40D0-92AE-530D542BF48D}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{D0F5FE1E-5B4D-4D63-9911-2080C9174D73}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{FC0F331C-D518-4553-B1FF-B12312C41B98}"= UDP:C:\Program Files\Skype\Phone\Skype.exe:Skype
"{FCE11569-97C3-44B6-B7B1-AA58B4DC1E34}"= TCP:C:\Program Files\Skype\Phone\Skype.exe:Skype
"{C9D9A26D-E98A-4905-9E85-5BBB4FCE01BE}"= UDP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{648D01A7-AED2-4011-AACF-932056782953}"= TCP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{1A957E11-A6A4-4CF4-80B3-60F52CF2DE87}"= UDP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{5C094016-B68F-49E8-91BF-72E2E156F3A3}"= TCP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{F2F31C5A-4903-4074-A49A-8CEE78D7F66C}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"{E063CC8B-5101-4D5F-892D-3798CCC7948B}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"{2897DF93-BBB8-44BD-8000-04FCA2DB9576}"= UDP:C:\Program Files\BitTorrent_DNA\dna.exe:BitTorrent DNA
"{0EE2569F-4158-4943-AAA8-DE7D6B851F3F}"= TCP:C:\Program Files\BitTorrent_DNA\dna.exe:BitTorrent DNA
"{B92EA189-1FD7-4352-80D0-A6BBCDF1BED2}"= UDP:C:\Program Files\DNA\btdna.exe:DNA
"{EEAF4200-555D-4BD1-8746-2D92A010543A}"= TCP:C:\Program Files\DNA\btdna.exe:DNA
"{4CC08326-17E9-46FC-B53F-B20E64977294}"= UDP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent
"{436A5DE6-F095-42BB-9583-DCDCBEFA9423}"= TCP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent
"TCP Query User{7743762A-B5FF-407C-A9CD-A6C3914FCC53}C:\\users\\mammo\\program files\\dna\\btdna.exe"= UDP:C:\users\mammo\program files\dna\btdna.exe:btdna.exe
"UDP Query User{D85851E3-BD54-4F31-9941-17CE90F96CBE}C:\\users\\mammo\\program files\\dna\\btdna.exe"= TCP:C:\users\mammo\program files\dna\btdna.exe:btdna.exe
"TCP Query User{6CDA0449-5B1C-490D-A7E6-5091C79BD09D}C:\\users\\mammo\\program files\\utorrent\\utorrent.exe"= UDP:C:\users\mammo\program files\utorrent\utorrent.exe:utorrent.exe
"UDP Query User{14436924-6CDF-4902-815D-C2083C42F00F}C:\\users\\mammo\\program files\\utorrent\\utorrent.exe"= TCP:C:\users\mammo\program files\utorrent\utorrent.exe:utorrent.exe
"TCP Query User{4B68D636-42AC-4916-B504-CC00775D08DA}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule Plus
"UDP Query User{FC810AB0-D58F-455F-A92D-0AC3E8E4F948}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule Plus
"TCP Query User{659BC667-F461-42D2-AAAB-EEF60E2158CA}C:\\users\\mammo\\appdata\\local\\temp\\rar$ex00.626\\emule.exe"= UDP:C:\users\mammo\appdata\local\temp\rar$ex00.626\emule.exe:emule.exe
"UDP Query User{6D7B46F4-9F17-4807-9F20-85D388E10265}C:\\users\\mammo\\appdata\\local\\temp\\rar$ex00.626\\emule.exe"= TCP:C:\users\mammo\appdata\local\temp\rar$ex00.626\emule.exe:emule.exe
"{D14EBCD1-9F2A-4081-A442-33F407A48A67}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{DBD043CE-F68C-4A4E-99D0-729A26909A4A}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{65078C9B-C0D9-4212-B9DE-CB0456DF068C}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"{1691F4D9-0843-4DE7-9E00-F53E0514FCD2}"= UDP:C:\Users\mammo\Program Files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{24B89F79-A16C-4ED8-9A84-CC45D04BF9EE}"= TCP:C:\Users\mammo\Program Files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"TCP Query User{C2146692-7554-4DCD-9566-DF300C51DAA9}C:\\users\\mammo\\downloads\\[pc-multi] dreammatchtennispro2.08\\dream match tennis pro.exe"= UDP:C:\users\mammo\downloads\[pc-multi] dreammatchtennispro2.08\dream match tennis pro.exe:dream match tennis pro.exe
"UDP Query User{381A6C89-814A-4154-B924-6957BEC79765}C:\\users\\mammo\\downloads\\[pc-multi] dreammatchtennispro2.08\\dream match tennis pro.exe"= TCP:C:\users\mammo\downloads\[pc-multi] dreammatchtennispro2.08\dream match tennis pro.exe:dream match tennis pro.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Program Files\\BitTorrent\\bittorrent.exe"= C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
S2 NOD32FiXTemDono;Eset Nod32 Boot;C:\Windows\system32\regedt32.exe [2006-11-02 11:45]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0ddadd62-11eb-11dd-b690-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0f4954f4-6ac9-11dd-807d-001a73ca406a}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0f4954f5-6ac9-11dd-807d-001a73ca406a}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{12ba5799-1056-11dd-9573-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{12ba579a-1056-11dd-9573-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1b8cf2fb-13aa-11dd-8b84-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1b8cf2fc-13aa-11dd-8b84-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{20b5ba45-10e2-11dd-8e24-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{20b5ba46-10e2-11dd-8e24-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{31197ae4-1c3a-11dd-8ea3-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{31197aee-1c3a-11dd-8ea3-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{332ceefb-0876-11dd-83f2-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{332cef12-0876-11dd-83f2-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ae6db748-109a-11dd-9709-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ae6db74f-109a-11dd-9709-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ae6db75c-109a-11dd-9709-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ae6db763-109a-11dd-9709-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dbc27e95-11dc-11dd-9eec-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dbc27ea8-11dc-11dd-9eec-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dbc27ec1-11dc-11dd-9eec-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dbc27ec2-11dc-11dd-9eec-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f63c2e33-11c3-11dd-8abd-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f63c2e37-11c3-11dd-8abd-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f63c2e38-11c3-11dd-8abd-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fac955d1-14e9-11dd-9f43-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fac955d8-14e9-11dd-9f43-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fac955eb-14e9-11dd-9f43-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fac955f2-14e9-11dd-9f43-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fac95605-14e9-11dd-9f43-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fac9560c-14e9-11dd-9f43-001b24d3d21d}]
\shell\AutoRun\command - F:\StartVMCLite.exe
*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
Contenuto della cartella 'Scheduled Tasks'
2008-08-23 C:\Windows\Tasks\User_Feed_Synchronization-{2831D117-3C39-4A3A-970E-D1163BC1AF52}.job
- C:\Windows\system32\msfeedssync.exe [2006-11-02 11:45]
2008-08-10 C:\Windows\Tasks\Verifica aggiornamenti per Windows Live Toolbar.job
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]
.
- - - - ORFÃOS REMOVIDOS - - - -
BHO-{862225c5-971b-0af5-0c96-ea32dc608ec2} - C:\Windows\system32\xenxniwvem.dll
HKCU-Run-IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
HKCU-Run-E07IXLRD_285013 - C:\Program Files\Microsoft Encarta\Microsoft Encarta 2007 - Premium DVD\EDICT.EXE
HKCU-Run-LphantAutoRun - C:\Program Files\Lphant\eLePhantClient.exe
HKLM-Run-NBKeyScan - C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
HKLM-Run-{952064a9-6722-3784-6018-dc888cd590b0} - C:\Windows\system32\xenxniwvem.dll
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://it.yahoo.com/
R0 -: HKLM-Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=IT_IT&c=73&bd=Pavilion&pf=laptop
R1 -: HKCU-SearchURL,(Default) = hxxp://it.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://it.search.yahoo.com
O8 -: &Windows Live Search - C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 -: Add to Windows &Live Favorites -
http://favorites.live.com/quickadd.aspxO8 -: Aggiungi a PDF esistente - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 -: Converti destinazione link in Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 -: Converti destinazione link in file PDF esistente - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 -: Converti i link selezionati in Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 -: Converti i link selezionati in file PDF esistente - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 -: Converti in Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 -: Converti selezione in Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 -: Converti selezione in file PDF esistente - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 -: E&sporta in Microsoft Excel - C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-08-24 01:38:19
Windows 6.0.6000 NTFS
scansione processi nascosti ...
scansione entrate autostart nascoste ...
Scansione files nascosti ...
Scansione completata con successo
Files nascosti: 0
**************************************************************************
.
Ora fine scansione: 2008-08-24 1:40:45
ComboFix-quarantined-files.txt 2008-08-23 23:40:28
Pre-Run: Impossibile trovare il testo del messaggio per il numero di messaggio 0x2379 nel file di messaggio per Application.
Post-Run: 28,835,287,040 byte disponibili
283 --- E O F --- 2008-08-21 19:19:00