Ciao r16,ecco il report,ed i log da te richiesti. ho disinstallato virit perchè ad ogni avvio si presenta con la scansione ed anche quando combofix a riavviato il pc si era aperto nel programma.
adesso ti auguro la buona notte
Emilia
ComboFix 08-11-04.02 - www 2008-11-06 0.00.06.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1040.18.676 [GMT 1:00]
Eseguito da: c:\documents and settings\www\Desktop\ComboFix.exe
* Creato nuovo punto di ripristino
ATENÇÃO - ESTA MAQUINA NAO TEM A CONSOLE DE RECUPERAÇÃO INSTALADA !!.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\MSINET.oca
.
((((((((((((((((((((((((((((((((((((((( Driver/Servizi )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_ASC3550P
-------\Service_NPF
((((((((((((((((((((((((( Files Creati Da 2008-10-05 al 2008-11-05 )))))))))))))))))))))))))))))))))))
.
2008-11-04 11:16 . 2008-11-04 11:16 <DIR> d-------- c:\programmi\Malwarebytes' Anti-Malware
2008-11-04 11:16 . 2008-11-04 11:16 <DIR> d-------- c:\documents and settings\www\Dati applicazioni\Malwarebytes
2008-11-04 11:16 . 2008-11-04 11:16 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\Malwarebytes
2008-11-04 11:16 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-04 11:16 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-11-04 09:56 . 2008-11-04 09:59 <DIR> d-------- C:\BackUpMSNCleaner
2008-11-03 20:19 . 2008-11-03 20:19 <DIR> d-------- c:\programmi\MSXML 4.0
2008-11-03 20:17 . 2003-02-28 16:34 313,856 --a------ c:\windows\system32\dx3j.dll
2008-11-03 20:17 . 2003-02-28 18:26 171,280 --a------ c:\windows\system32\jit.dll
2008-11-03 20:17 . 2003-02-28 18:26 139,536 --a------ c:\windows\system32\javaee.dll
2008-11-03 20:17 . 2003-02-28 18:26 46,352 --a------ c:\windows\setdebug.exe
2008-11-03 20:17 . 2003-02-28 16:54 7,315 --a------ c:\windows\system32\javasup.vxd
2008-11-03 20:17 . 2003-02-28 16:35 6,550 --a------ c:\windows\jautoexp.dat
2008-11-03 20:15 . 2008-08-14 14:42 2,184,064 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2008-11-03 20:15 . 2008-08-14 14:42 2,139,648 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-11-03 20:15 . 2008-08-14 14:42 2,061,440 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-11-03 20:15 . 2008-08-14 14:42 2,019,328 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
2008-11-03 20:11 . 2008-06-14 18:59 272,768 --------- c:\windows\system32\drivers\bthport.sys
2008-11-03 20:11 . 2008-06-14 18:59 272,768 -----c--- c:\windows\system32\dllcache\bthport.sys
2008-11-02 17:47 . 2008-11-02 17:48 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\Farm Frenzy
2008-11-02 11:52 . 2008-11-02 11:52 <DIR> d-------- c:\programmi\CDBurnerXP
2008-11-01 21:44 . 2008-11-01 21:44 <DIR> d-------- c:\documents and settings\www\Dati applicazioni\Canneverbe_Limited
2008-11-01 21:34 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll
2008-11-01 21:31 . 2008-07-06 13:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll
2008-11-01 21:31 . 2008-07-06 13:06 1,676,288 -----c--- c:\windows\system32\dllcache\xpssvcs.dll
2008-11-01 21:31 . 2008-07-06 11:50 597,504 -----c--- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2008-11-01 21:31 . 2008-07-06 13:06 575,488 --------- c:\windows\system32\xpsshhdr.dll
2008-11-01 21:31 . 2008-07-06 13:06 575,488 -----c--- c:\windows\system32\dllcache\xpsshhdr.dll
2008-11-01 21:31 . 2008-07-06 13:06 117,760 --------- c:\windows\system32\prntvpt.dll
2008-11-01 21:31 . 2008-07-06 13:06 89,088 -----c--- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2008-11-01 21:28 . 2008-11-01 21:28 <DIR> d-------- c:\programmi\MSXML 6.0
2008-10-25 15:19 . 2008-10-25 15:22 <DIR> d-------- c:\documents and settings\www\Dati applicazioni\DeepBurner
2008-10-25 15:18 . 2008-10-25 15:52 <DIR> d-------- c:\programmi\Astonsoft
2008-10-11 19:10 . 2008-10-31 12:17 54,156 --ah----- c:\windows\QTFont.qfn
2008-10-11 19:10 . 2008-10-11 19:10 1,409 --a------ c:\windows\QTFont.for
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-05 23:06 29,094,944 --sha-w c:\windows\system32\drivers\fidbox.dat
2008-11-05 23:04 865,824 --sha-w c:\windows\system32\drivers\fidbox2.dat
2008-11-05 23:02 83,216 --sha-w c:\windows\system32\drivers\fidbox2.idx
2008-11-05 23:02 392,708 --sha-w c:\windows\system32\drivers\fidbox.idx
2008-11-05 22:52 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Kaspersky Lab
2008-11-04 09:37 321,066 ----a-w c:\programmi\HiJackThis.zip
2008-11-04 07:26 --------- d-----w c:\programmi\Yahoo!
2008-11-02 17:48 --------- d-----w c:\programmi\Zylom Games
2008-11-02 16:47 --------- d-----w c:\documents and settings\www\Dati applicazioni\Zylom
2008-11-02 08:27 --------- d---a-w c:\documents and settings\All Users\Dati applicazioni\TEMP
2008-11-02 08:27 --------- d-----w c:\programmi\SpywareBlaster
2008-11-01 19:02 --------- d-----w c:\programmi\Java
2008-10-08 21:55 --------- d-----w c:\programmi\Oberon Media
2008-10-08 21:53 --------- d-----w c:\programmi\Shockwave.com
2008-10-06 07:55 --------- d-----w c:\programmi\Google
2008-10-05 18:35 --------- d-----w c:\programmi\Spybot - Search & Destroy
2008-10-05 18:22 --------- d-----w c:\documents and settings\www\Dati applicazioni\uTorrent
2008-10-03 21:53 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Intenium
2008-10-01 13:07 --------- d-----w c:\programmi\Windows Live Safety Center
2008-09-23 21:26 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\DivoGames
2008-09-21 22:15 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\JollyBear
2008-09-15 15:38 1,846,016 ----a-w c:\windows\system32\win32k.sys
2008-09-11 23:31 --------- d-----w c:\documents and settings\www\Dati applicazioni\Skype
2008-09-11 17:12 --------- d-----w c:\documents and settings\www\Dati applicazioni\skypePM
2008-09-09 11:23 --------- d-----w c:\documents and settings\www\Dati applicazioni\Total Eclipse
2008-08-20 05:35 662,016 ----a-w c:\windows\system32\wininet.dll
2008-08-14 13:42 2,139,648 ----a-w c:\windows\system32\ntoskrnl.exe
2008-08-14 13:42 2,019,328 ----a-w c:\windows\system32\ntkrnlpa.exe
2008-05-04 13:43 1,495,112 ----a-w c:\programmi\install_flash_player(4).exe
2008-05-04 13:41 1,495,112 ----a-w c:\programmi\install_flash_player(3).exe
2008-04-11 20:45 4,585,912 ----a-w c:\programmi\Shockwave_Installer_Slim(2).exe
2008-04-08 18:14 33,806,768 ----a-w c:\programmi\kis7.0.1.325it.exe
2008-04-03 19:00 17,817 ----a-w c:\programmi\Emanuele Inglese Live at Cocorico su M2o Diabolika.torrent
2008-04-03 18:55 78,975 ----a-w c:\programmi\Articolo 31 - Strade di Citta.torrent
2008-03-28 20:15 2,754,600 ----a-w c:\programmi\isobuster_all_lang.exe
2008-03-28 19:48 2,605,245 ----a-w c:\programmi\CDBurnerXP.zip
2008-03-28 19:36 6,538,689 ----a-w c:\programmi\AWCSetup.zip
2008-03-28 19:29 9,696,483 ----a-w c:\programmi\spybotsd15.zip
2008-03-28 19:27 707,809 ----a-w c:\programmi\utorrent.zip
2008-03-18 08:13 2,647,316 ----a-w c:\programmi\spywareblaster.zip
2008-03-11 22:23 2,838,440 ----a-w c:\programmi\Shockwave_Installer_Slim.exe
2008-03-05 11:03 1,491,592 ----a-w c:\programmi\install_flash_player(2).exe
2008-02-12 07:44 8,499,200 ----a-w c:\programmi\cbSetup.exe
2008-02-08 18:11 1,491,592 ----a-w c:\programmi\install_flash_player.exe
2007-11-20 21:14 32 ----a-w c:\documents and settings\All Users\Dati applicazioni\ezsid.dat
2007-08-08 14:07 774,144 ----a-w c:\programmi\RngInterstitial.dll
2006-07-30 22:20 959 --sha-r c:\windows\system32\autorun.bin
2005-10-01 09:23 1,182,720 --sha-r c:\windows\system32\autorun.exe
.
Code:<pre>
-c--a-w 18,464,720 2004-12-13 22:55:34 c:\documents and settings\Administrator\Documenti\Chicken Invaders 2\Chicken Invaders 2.60 Christmas Edition EXTENDED .exe
-c--a-w 18,464,720 2004-12-13 22:55:34 c:\documents and settings\www\Desktop\Giochi Emilia\Chicken Invaders 2\Chicken Invaders 2.60 Christmas Edition EXTENDED .exe
</pre>
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTSyncU.exe"="c:\programmi\Creative\Sync Manager Unicode\CTSyncU.exe" [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update"="c:\programmi\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 49152]
"PinnacleDriverCheck"="c:\windows\system32\\PSDrvCheck.exe" [2004-03-11 406016]
"SunJavaUpdateSched"="c:\programmi\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"VIRIT LITE MONITOR"="c:\vexplite\MONLITE.EXE" [2008-11-05 249856]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360]
c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
HP Digital Imaging Monitor.lnk - c:\programmi\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 282624]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.xvid"= xvid.dll
"VIDC.MJPG"= Pvmjpg30.dll
"VIDC.PIM1"= pclepim1.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^BlueSoleil.lnk]
path=c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\BlueSoleil.lnk
backup=c:\windows\pss\BlueSoleil.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^Digisoft AntiDialer.lnk]
path=c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\Digisoft AntiDialer.lnk
backup=c:\windows\pss\Digisoft AntiDialer.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^Exif Launcher.lnk]
path=c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\Exif Launcher.lnk
backup=c:\windows\pss\Exif Launcher.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^Picture Package Menu.lnk]
path=c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\Picture Package Menu.lnk
backup=c:\windows\pss\Picture Package Menu.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^Picture Package VCD Maker.lnk]
path=c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\Picture Package VCD Maker.lnk
backup=c:\windows\pss\Picture Package VCD Maker.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2007-10-10 19:51 39792 c:\programmi\Adobe\Reader 8.0\Reader\Reader_SL.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
-ra------ 2007-03-01 10:37 2321600 c:\programmi\File comuni\Adobe\Updater5\AdobeUpdater.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
--a------ 2004-09-21 20:10 344064 c:\programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BigDogPath]
--a------ 2003-01-21 08:19 40960 c:\windows\VM_STI.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2004-08-19 14:39 15360 c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ioCentre]
--a------ 2007-05-31 19:16 61440 c:\genius\ioCentre\gTaskBar.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
c:\windows\system32\NeroCheck.exe [N/A]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PinnacleDriverCheck]
--a--c--- 2004-03-11 00:26 406016 c:\windows\system32\PSDrvCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a--c--- 2006-05-10 10:00 98304 c:\programmi\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\REGSHAVE]
--a--c--- 2002-02-04 21:32 53248 c:\programmi\REGSHAVE\Regshave.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2007-11-12 15:48 21760296 c:\programmi\Skype\Phone\Skype.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
--------- 2008-08-18 17:41 1832272 c:\programmi\Spybot - Search & Destroy\TeaTimer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminator]
c:\programmi\Spyware Terminator\SpywareTerminatorShield.exe [N/A]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
c:\programmi\Java\jre1.6.0_03\bin\jusched.exe [N/A]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USB2Check]
--a--c--- 2004-09-21 11:22 73728 c:\windows\system32\PCLECoInst.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USBToolTip]
--a------ 2005-06-13 02:30 192512 c:\programmi\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VIRIT LITE MONITOR]
--a------ 2008-11-05 21:59 249856 c:\vexplite\MONLITE.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CHotkey]
--a--c--- 2002-07-29 10:54 473088 c:\windows\mHotkey.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cmaudio]
cmicnfg.cpl [N/A]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Collegamento alla pagina delle proprietà di High Definition Audio]
--a--c--- 2005-01-07 16:07 61952 c:\windows\system32\HdAShCut.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ledpointer]
--a--c--- 2002-10-04 08:05 532992 c:\windows\CNYHKey.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"viritsvclite"=2 (0x2)
"ATI Smart"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)
"aawservice"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\Pinnacle\\Studio 10\\programs\\RM.exe"=
"c:\\Programmi\\Pinnacle\\Studio 10\\programs\\Studio.exe"=
"c:\\Programmi\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe"=
"c:\\Programmi\\Pinnacle\\Studio 10\\programs\\umi.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"c:\\Programmi\\Download Express\\dep.exe"=
"c:\\Programmi\\Messenger\\msmsgs.exe"=
"c:\\Programmi\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"c:\\Programmi\\MSN Messenger\\msnmsgr.exe"=
"c:\\Programmi\\MSN Messenger\\livecall.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"c:\\Programmi\\uTorrent\\uTorrent.exe"=
"c:\\Programmi\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
R0 VIRAGTLT;VIRAGTLT;c:\windows\system32\drivers\VIRAGTLT.SYS [2008-08-30 40960]
R2 NMSAccessU;NMSAccessU;c:\programmi\CDBurnerXP\NMSAccessU.exe [2008-06-15 71096]
R2 viritsvclite;Virit eXplorer Lite;c:\vexplite\viritsvc.exe [2008-11-05 57344]
R3 cmudax;C-Media High Definition Audio Interface;c:\windows\system32\drivers\cmudax.sys [2005-05-11 1287296]
R3 gHidPnp;USB Device Enhanced Function Driver;c:\windows\system32\Drivers\gHidPnp.Sys [2007-07-19 16384]
R3 gMouUsb;USB Mouse Device Drv;c:\windows\system32\DRIVERS\gMouUsb.sys [2007-07-20 9856]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2007-12-13 24592]
S1 sp_rsdrv2;Spyware Terminator Driver 2;c:\documents and settings\All Users\Dati applicazioni\Spyware Terminator\sp_rsdrv2.sys [ ]
S3 gMouPS2;PS2 Scroll Mouse Device;c:\windows\system32\DRIVERS\gMouPS2.sys [2006-07-12 17408]
S3 ids00026;ids00026;c:\documents and settings\All Users\Dati applicazioni\Kaspersky Anti-Virus Personal\5.0\bases\ids00026.sys [ ]
S3 lgusbsmodem;LGE Mobile USB Modem;c:\windows\system32\DRIVERS\lgusbsmodem.sys [2006-02-07 42436]
S3 SIS163u;SiS 163 usb Wireless LAN Adapter Driver;c:\windows\system32\DRIVERS\sis163u.sys [2004-10-01 162304]
S3 ZSMC302;USB PC Camera 302;c:\windows\system32\Drivers\usbvm302.sys [2004-04-26 90581]
.
.
------- Supplementare di scansione -------
.
FireFox -: Profile - c:\documents and settings\www\Dati applicazioni\Mozilla\Firefox\Profiles\erpmptj8.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.tiscali.it/
FF -: plugin - c:\documents and settings\All Users\Dati applicazioni\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF -: plugin - c:\programmi\GoBit Games\BrowserPlugin\npgobitgamesplugin.dll
FF -: plugin - c:\programmi\Mozilla Firefox\plugins\npgobitgamesplugin.dll
FF -: plugin - c:\programmi\Mozilla Firefox\plugins\npracplug.dll
FF -: plugin - c:\programmi\Mozilla Firefox\plugins\npzylomgamesplayer.dll
FF -: plugin - c:\programmi\Real\RealArcade\Plugins\Mozilla\npracplug.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-11-06 00:04:40
Windows 5.1.2600 Service Pack 2 NTFS
scansione processi nascosti ...
scansione entrate autostart nascoste ...
Scansione files nascosti ...
Scansione completata con successo
Files nascosti: 0
**************************************************************************
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\windows\ATKKBService.exe
c:\programmi\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
c:\programmi\IVT Corporation\BlueSoleil\BTNtService.exe
c:\windows\system32\CTSVCCDA.EXE
c:\programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\wdfmgr.exe
c:\programmi\HP\Digital Imaging\bin\hpqste08.exe
.
**************************************************************************
.
Ora fine scansione: 2008-11-06 0:09:29 - macchina è stato riavviato
ComboFix-quarantined-files.txt 2008-11-05 23:09:21
Pre-Run: 22.098.808.832 byte disponibili
Post-Run: 22,020,009,984 byte disponibili
282
VirIT eXplorer Lite Log
[SCANSIONE DELLA MEMORIA]
OK
[SCANSIONE DELLA MEMORIA]
OK
05/11/2008 - 22:08:34
[SCANSIONE DEL REGISTRO]
OK
[A:]
BOOT SECTOR: OK
[C:]
MASTER BOOT RECORD: OK
BOOT SECTOR: OK
[D:]
[E:]
[F:]
MASTER BOOT RECORD: OK
BOOT SECTOR: OK
Chiavi Registro infette: 0.
Files Infetti: 0.
Files Sospetti: 0.
Files Analizzati: 125824.
Files Totali: 125824.
Chiavi Registro rimosse: 0.
Virus Rimossi: 0.
[SCANSIONE DELLA MEMORIA]
[Hidden Services]
vkquwexg - system32\drivers\Combo-Fix.sys
[SCANSIONE DELLA MEMORIA]
[Hidden Services]
vkquwexg - system32\drivers\Combo-Fix.sys
OK
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 0.25.48, on 06/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ATKKBService.exe
C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Programmi\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmi\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\svchost.exe
C:\VEXPLITE\viritsvc.exe
C:\Programmi\HP\HP Software Update\HPWuSchd2.exe
C:\Programmi\Java\jre1.6.0_07\bin\jusched.exe
C:\VEXPLITE\MONLITE.EXE
C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
C:\Programmi\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Programmi\WinRAR\WinRAR.exe
C:\DOCUME~1\www\IMPOST~1\Temp\Rar$EX00.657\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.tiscali.it/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
http://it.rd.yahoo.com/customize/ycomp/defaults/su/*http://it.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar1.dll
O4 - HKLM\..\Run: [HP Software Update] C:\Programmi\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\\PSDrvCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [VIRIT LITE MONITOR] C:\VEXPLITE\MONLITE.EXE
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Programmi\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Aggiungi ad Anti-Banner - C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Scarica con Download &Express - C:\Programmi\Download Express\Add_Url.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: CabBuilder -
http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cabO16 - DPF: {B516CA4E-A5BA-405C-AFCF-A97F08CC7429} (GoBit Games Player) -
http://www.shockwave.com/content/burgershop/sis/GoBitGamesPlayer_v4.cabO16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) -
http://kiw.imgag.com/imgag/cp/install/crusher-kiwen.cabO18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Programmi\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Programmi\CDBurnerXP\NMSAccessU.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Virit eXplorer Lite (viritsvclite) - TG Soft Sas
www.tgsoft.it - C:\VEXPLITE\viritsvc.exe
--
End of file - 6552 bytes