Ciao Shapiro ecco i report da te richiesti se ci sono errori dimmelo senza problemi :
questo il primo post C:\Programmi\Softonic_Italia\tbSof1.dll
Informazioni addizionali
File size: 1881112 bytes
MD5...: f9b508bc69d1ee43a09dfbcae6c42e04
SHA1..: f31b07e34538a43fef46847cd29a001069780d19
SHA256: b755356503232df79de9b08c116e870ef03ac1f6b1b3bdb77b7afbe06c12cfcf
SHA512: d9b9b4b111db21fc0989576d22756a406634722abaae044677615684925521a1
c89d5e7c099c97723b9cd88cd0996ca1a3ebf20730157c5c69fef6e034535dee
ssdeep: 24576:tS7xQcB+fGWuUNWUEkw4Xs+a7W/4dI6U2prKGa40BcVg9SSXJ6gelveCFi
B65df9:tOOGWDUhibTpW463fHzVQ6tLT
PEiD..: -
TrID..: File type identification
Windows OCX File (71.0%)
Win32 Executable MS Visual C++ (generic) (21.6%)
Win32 Executable Generic (4.9%)
Generic Win/DOS Executable (1.1%)
DOS Executable Generic (1.1%)
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0xde15a
timedatestamp.....: 0x4975cd8f (Tue Jan 20 13:11:43 2009)
machinetype.......: 0x14c (I386)
( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x10da12 0x10dc00 6.56 7c135281188d610ed638c7234c241966
.rdata 0x10f000 0x55d7f 0x55e00 4.51 7c6252c1f58f4dc55afde9bb9efae496
.data 0x165000 0x6260 0x4200 4.84 17d3e694c044f25072850637c050a8e0
.rsrc 0x16c000 0x4c170 0x4c200 5.65 488b4a71ffb64bf677b82c6e58d78564
.reloc 0x1b9000 0x16442 0x16600 5.90 e4eb470fb6941fbbb82b6942efa51b1b
( 19 imports )
> COMCTL32.dll: ImageList_ReplaceIcon, CreatePropertySheetPageW, PropertySheetW, CreateToolbarEx, InitCommonControlsEx, _TrackMouseEvent, ImageList_Create
> WININET.dll: DeleteUrlCacheEntry, FindNextUrlCacheEntryA, FindFirstUrlCacheEntryA, InternetCanonicalizeUrlW, InternetCrackUrlW, InternetCloseHandle, InternetSetOptionA, InternetCanonicalizeUrlA, FindCloseUrlCache, InternetSetOptionExA, InternetConnectA, InternetGetLastResponseInfoA, HttpSendRequestA, HttpQueryInfoA, InternetOpenA, InternetCrackUrlA, InternetOpenW, InternetSetOptionW, InternetOpenUrlW, InternetReadFile, InternetGetConnectedState, HttpOpenRequestA, GetUrlCacheEntryInfoW, InternetQueryOptionA
> SHLWAPI.dll: PathFileExistsW
> WSOCK32.dll: -, -, -, -, -, -, -, -, -, -, -, -, -, -
> VERSION.dll: GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
> MSIMG32.dll: GradientFill
> urlmon.dll: ObtainUserAgentString, URLDownloadToFileW
> CRYPT32.dll: CryptMsgClose, CryptProtectData, CryptUnprotectData, CryptQueryObject, CryptMsgGetParam, CertFindCertificateInStore, CertGetNameStringW, CertFreeCertificateContext, CertCloseStore, CertGetNameStringA
> WINMM.dll: PlaySoundW, sndPlaySoundW, PlaySoundA, timeGetTime
> KERNEL32.dll: GetVersionExA, GetLocalTime, GetModuleHandleW, GetLongPathNameW, GetModuleFileNameA, GetCurrentThreadId, lstrcpyA, GetTickCount, GetThreadLocale, SetEndOfFile, WriteConsoleW, GetConsoleOutputCP, WriteConsoleA, CreateFileA, SetStdHandle, GetLocaleInfoA, FlushFileBuffers, SetFilePointer, GetConsoleMode, GetConsoleCP, GetStringTypeW, GetStringTypeA, QueryPerformanceCounter, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsA, GetStartupInfoA, GetFileType, SetHandleCount, HeapSize, LCMapStringW, LCMapStringA, GetOEMCP, GetACP, GetCPInfo, GetStdHandle, WriteFile, ExitProcess, VirtualFree, HeapCreate, HeapDestroy, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, InterlockedIncrement, TlsFree, TlsSetValue, TlsAlloc, TlsGetValue, VirtualAlloc, MoveFileW, GetProcessHeap, GetCommandLineA, ResumeThread, ExitThread, RaiseException, GetSystemTimeAsFileTime, HeapReAlloc, HeapAlloc, HeapFree, RtlUnwind, ReleaseSemaphore, CreateSemaphoreW, InterlockedExchange, GetCurrentThread, SetThreadPriority, GetComputerNameW, MoveFileExW, RemoveDirectoryW, TerminateProcess, CreateToolhelp32Snapshot, Thread32First, Thread32Next, OpenProcess, LocalAlloc, InterlockedDecrement, OutputDebugStringW, LeaveCriticalSection, EnterCriticalSection, DeleteCriticalSection, InitializeCriticalSection, MulDiv, LoadLibraryA, CreateFileW, GetFileSize, ReadFile, SizeofResource, GlobalAlloc, GlobalLock, GlobalUnlock, GlobalFree, WideCharToMultiByte, GetModuleHandleA, GetLastError, GetModuleFileNameW, CloseHandle, ReleaseMutex, CreateMutexW, GetCurrentProcess, FlushInstructionCache, VirtualProtect, Sleep, ExpandEnvironmentStringsW, CreateProcessW, GetLocaleInfoW, LoadLibraryW, GetProcAddress, FreeLibrary, CreateDirectoryW, Beep, GetDateFormatW, GetTimeFormatW, FindResourceW, LoadResource, LockResource, FreeResource, GetFileAttributesW, WaitForSingleObject, SetLastError, CreateThread, GetExitCodeThread, TerminateThread, FindFirstFileW, DeleteFileW, FindNextFileW, FindClose, MultiByteToWideChar, CopyFileW, GetCurrentProcessId, lstrlenW, lstrcpyW, LocalFree
> USER32.dll: GetDlgCtrlID, GetClientRect, SetWindowTextW, SetWindowTextA, wsprintfW, CallWindowProcA, InvalidateRect, GetWindow, GetClassInfoExW, RegisterClassExW, CopyRect, UpdateWindow, GetLastInputInfo, MonitorFromRect, LoadImageW, IsWindow, GetDlgItem, SendMessageA, ClientToScreen, GetParent, GetWindowLongW, SetCursor, LoadCursorA, PostMessageA, ShowWindow, SetWindowLongW, DialogBoxParamW, DialogBoxParamA, CreateDialogParamA, CreateDialogParamW, ReleaseDC, IsWindowEnabled, GetDlgItemTextA, FrameRect, DrawFrameControl, MessageBoxA, GetWindowThreadProcessId, AllowSetForegroundWindow, IsWindowUnicode, GetDesktopWindow, MsgWaitForMultipleObjects, EndDialog, GetDlgItemTextW, GetScrollInfo, IsMenu, GetMenuInfo, SetMenuInfo, GetMenuItemID, GetMenuState, CheckMenuItem, TrackPopupMenu, GetMonitorInfoW, CreatePopupMenu, DestroyMenu, SetClassLongA, SetLayeredWindowAttributes, IsIconic, SetForegroundWindow, PostThreadMessageA, SetWindowRgn, SetWindowPos, EnableWindow, IsDlgButtonChecked, CallWindowProcW, GetMenuItemCount, InsertMenuItemW, SetMenuItemInfoW, GetMenuItemInfoW, DeleteMenu, EnableMenuItem, EndMenu, CheckDlgButton, GetAsyncKeyState, SetActiveWindow, TranslateMessage, GetMessageA, ReleaseCapture, GetCapture, DispatchMessageA, SetCapture, GetCursorPos, BeginPaint, EndPaint, GetUpdateRect, ScreenToClient, SetDlgItemTextW, GetMonitorInfoA, DrawIconEx, GetIconInfo, DestroyIcon, FillRect, GetSysColor, PeekMessageA, MessageBoxW, DefWindowProcW, GetWindowTextW, SendMessageW, GetWindowTextLengthW, SystemParametersInfoW, FindWindowW, IsWindowVisible, SetWindowsHookExA, UnhookWindowsHookEx, GetMenuItemInfoA, CallNextHookEx, GetClassInfoW, RegisterClassW, CreateWindowExW, GetSystemMetrics, KillTimer, GetWindowLongA, SetTimer, UnregisterClassA, GetClassNameW, SetWindowLongA, DefWindowProcA, DestroyWindow, GetFocus, IsChild, SetFocus, PostMessageW, PtInRect, FindWindowExW, RegisterWindowMessageW, GetWindowRect, GetDC, DrawTextW, MoveWindow
> GDI32.dll: GetDeviceCaps, GetTextColor, GetBkColor, GetBkMode, SetTextAlign, TextOutW, ExcludeClipRect, RoundRect, CreateRectRgn, CombineRgn, GetPixel, BitBlt, Polygon, GdiFlush, SetPixel, GetObjectA, GetTextAlign, GetTextExtentPoint32W, Rectangle, SetBkColor, CreateSolidBrush, CreateFontIndirectW, GetLayout, CreateCompatibleDC, CreateCompatibleBitmap, PlgBlt, DeleteDC, CreatePen, SelectObject, MoveToEx, LineTo, DeleteObject, GetWindowOrgEx, SetWindowOrgEx, SetBkMode, SetTextColor, GetStockObject
> comdlg32.dll: GetOpenFileNameW
> ADVAPI32.dll: RegOpenKeyExW, RegSetValueExW, RegCreateKeyExW, RegDeleteKeyW, RegQueryValueExW, CryptAcquireContextA, CryptReleaseContext, OpenProcessToken, GetTokenInformation, GetSidSubAuthorityCount, GetSidSubAuthority, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, ConvertStringSecurityDescriptorToSecurityDescriptorA, GetSecurityDescriptorSacl, SetSecurityDescriptorSacl, RegEnumValueW, RegEnumKeyExW, RegDeleteValueW, RegOpenKeyW, RegEnumKeyW, RegCreateKeyW, RegQueryInfoKeyW, RegCloseKey
> SHELL32.dll: ShellExecuteW, SHGetFolderPathW, SHCreateDirectoryExW, ShellExecuteExW
> ole32.dll: CoGetMalloc, StringFromIID, CoCreateInstance, IIDFromString, CreateStreamOnHGlobal, CLSIDFromString, CoUninitialize, CoInitialize
> OLEAUT32.dll: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -
> PSAPI.DLL: GetModuleFileNameExW, EnumProcessModules, GetProcessMemoryInfo
> DNSAPI.dll: DnsQuery_A
( 11 exports )
DllCanUnloadNow, DllGetClassObject, DllOnUninstall, DllOnUpdateFinish, DllOpenUninstallPage, DllRegisterServer, DllShowTB, DllShowToolbar, DllShowToolbarWithIE, DllUnregisterServer, DllUpdate
questo è il secondo post C:\Programmi\BS.Player ControlBar\BSToolbar.dll
Informazioni addizionali
File size: 757192 bytes
MD5...: 065019683405c3fdbe398f6e5c48241a
SHA1..: d2e78a28f114169afc7083b8b025c001c26be95a
SHA256: 98ad7bc6afead2b63201ea67b18af2b8feafcd225c00893228252b2b0a337a18
SHA512: 1a837300a6b97f6d82bf96ef6917ef94bfda7c13d435aa632be37736f8282c33
cda3b040d66abbc1c4787d36f363824c9b00c13ac2522ca35456b521e42d2ad6
ssdeep: 12288:AWD5tN4k3Gua3PD0wtmFdApqU7DJ5ANeqoIagvo+Fm4g2nK:Agb4k2N3PP
wEZDJ8/oIagvo+42K
PEiD..: -
TrID..: File type identification
DirectShow filter (52.6%)
Windows OCX File (32.2%)
Win32 Executable MS Visual C++ (generic) (9.8%)
Win32 Executable Generic (2.2%)
Win32 Dynamic Link Library (generic) (1.9%)
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x60775
timedatestamp.....: 0x48a29a69 (Wed Aug 13 08:25:13 2008)
machinetype.......: 0x14c (I386)
( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x8cd3e 0x8d000 6.68 775cfadbcd911aaa62cb0a8cab4d2b08
.rdata 0x8e000 0x1bbf5 0x1c000 4.98 e565086ededcc93881fc4c27aeddb79b
.data 0xaa000 0x6604 0x4000 4.55 3c88397fa0d0f61c7e520ccf71e97430
.rsrc 0xb1000 0x1b04 0x2000 4.68 b3ed369cd24dfde2b85d126c7f8c3971
.reloc 0xb3000 0x7246 0x8000 6.30 f917d2afb2649bcb6d3ada644110be38
( 12 imports )
> WININET.dll: DeleteUrlCacheEntryW, InternetCloseHandle, InternetReadFile, HttpQueryInfoW, HttpSendRequestA, HttpOpenRequestW, InternetConnectW, InternetOpenW
> urlmon.dll: URLDownloadToFileW
> iphlpapi.dll: GetAdaptersInfo
> KERNEL32.dll: lstrcmpiW, LoadLibraryExW, SizeofResource, LoadResource, FindResourceW, WideCharToMultiByte, PulseEvent, ReleaseMutex, WaitForSingleObject, WaitForMultipleObjects, CreateMutexW, CreateEventW, TerminateThread, SetEvent, CloseHandle, GetTempFileNameW, DeleteFileW, CreateDirectoryW, SetFileAttributesW, SetCurrentDirectoryW, GetLocaleInfoA, GetUserDefaultLCID, MulDiv, GlobalFree, LockResource, FreeResource, GlobalAlloc, ReadFile, GetFileSize, CreateFileW, SetFilePointer, GetFileType, DuplicateHandle, DosDateTimeToFileTime, SystemTimeToFileTime, GetCurrentDirectoryW, SetFileTime, WriteFile, FreeEnvironmentStringsA, FlushFileBuffers, GetConsoleMode, GetConsoleCP, GetStartupInfoA, SetHandleCount, IsValidCodePage, GetOEMCP, GetModuleFileNameA, GetStdHandle, DeleteCriticalSection, HeapCreate, HeapDestroy, FatalAppExitA, GetCurrentThread, TlsFree, TlsSetValue, TlsAlloc, TlsGetValue, ExitProcess, GetStringTypeW, GetStringTypeA, GetCPInfo, LCMapStringW, LCMapStringA, GetCommandLineA, FindNextFileA, FindFirstFileA, FileTimeToLocalFileTime, FileTimeToSystemTime, FindClose, MoveFileW, GetSystemTimeAsFileTime, CreateThread, ExitThread, HeapReAlloc, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, TerminateProcess, RtlUnwind, Sleep, GetThreadLocale, GetACP, InterlockedExchange, GetVersionExA, VirtualAlloc, VirtualFree, IsProcessorFeaturePresent, HeapAlloc, GetProcessHeap, HeapFree, InterlockedCompareExchange, InitializeCriticalSection, LocalAlloc, LocalFree, InterlockedIncrement, GetCurrentThreadId, FreeLibrary, OutputDebugStringA, GetModuleFileNameW, SetLastError, GetLastError, GetCurrentProcess, FlushInstructionCache, LeaveCriticalSection, EnterCriticalSection, RaiseException, GetVersion, GetFileAttributesW, GetEnvironmentStringsW, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetTimeFormatA, GetDateFormatA, EnumSystemLocalesA, IsValidLocale, SetConsoleCtrlHandler, GetLocaleInfoW, GetProcAddress, GetModuleHandleW, GetModuleHandleA, LoadLibraryW, LoadLibraryA, GlobalLock, GlobalUnlock, lstrlenA, lstrlenW, InterlockedDecrement, MultiByteToWideChar, GetConsoleOutputCP, WriteConsoleW, SetStdHandle, GetTimeZoneInformation, CreateFileA, SetEndOfFile, CompareStringA, CompareStringW, SetEnvironmentVariableA, GetEnvironmentStrings, HeapSize, FreeEnvironmentStringsW, WriteConsoleA
> USER32.dll: SetTimer, GetWindowDC, CreatePopupMenu, InsertMenuItemW, DestroyMenu, GetDC, ReleaseDC, GetActiveWindow, FillRect, GetSystemMetrics, EnableScrollBar, SetScrollPos, wsprintfW, ScreenToClient, SetScrollInfo, GetScrollInfo, GetCursorPos, MessageBoxW, IsWindowVisible, CreateDialogParamW, EndDialog, IsWindowEnabled, DialogBoxParamW, SystemParametersInfoW, MapWindowPoints, SetWindowPos, EnableWindow, InvalidateRect, UpdateWindow, PostMessageW, PeekMessageW, GetSysColor, ShowCaret, HideCaret, DrawTextW, GetDlgItem, ShowWindow, CharNextW, GetCursor, SetCursor, SetCapture, EndPaint, BeginPaint, ReleaseCapture, LoadImageW, GetIconInfo, CreateWindowExW, GetClassInfoExW, RegisterClassExW, TrackPopupMenu, ClientToScreen, LoadStringW, CopyRect, GetParent, LoadCursorW, IsWindow, KillTimer, GetClientRect, MoveWindow, DestroyWindow, GetWindow, DrawIconEx, DestroyIcon, GetKeyState, TranslateMessage, DispatchMessageW, SetWindowTextA, GetWindowLongW, SetWindowLongW, CallWindowProcW, DefWindowProcW, GetFocus, SetFocus, GetWindowRect, GetWindowTextLengthW, GetWindowTextW, SetWindowTextW, SendMessageW, UnregisterClassA, ShowScrollBar
> GDI32.dll: MoveToEx, LineTo, GetStockObject, GetObjectW, CreatePen, SelectObject, DeleteDC, DeleteObject, GetTextMetricsW, GetTextExtentPoint32W, SetBkMode, BitBlt, CreateFontW, CreateFontIndirectW, GetDeviceCaps, DPtoLP, LPtoDP, SetMapMode, GetMapMode, GdiFlush, CreateDIBSection, CreateSolidBrush, CreateCompatibleDC, SetTextColor, TextOutW
> ADVAPI32.dll: RegEnumKeyExW, RegQueryValueExW, RegSetValueExW, RegOpenKeyExW, RegCreateKeyExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, UnregisterTraceGuids, RegisterTraceGuidsW, GetTraceLoggerHandle, GetTraceEnableLevel, GetTraceEnableFlags, TraceEvent, RegQueryInfoKeyW
> SHELL32.dll: ShellExecuteW, DragQueryFileW, SHGetFolderPathW
> ole32.dll: ReleaseStgMedium, RegisterDragDrop, CreateStreamOnHGlobal, CoInitialize, CoTaskMemAlloc, CoTaskMemRealloc, CoTaskMemFree, CoCreateInstance, StringFromGUID2, CoUninitialize
> OLEAUT32.dll: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -
> SHLWAPI.dll: PathAppendW, PathFileExistsW
> MSIMG32.dll: TransparentBlt
( 4 exports )
DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer
ThreatExpert info:
http://www.threatexpert.com/report.aspx?md5=065019683405c3fdbe398f6e5c48241aCWSandbox info:
http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=065019683405c3fdbe398f6e5c48241aquesto è il post dopo navifix:
Navipromo Removal version 3.7.3 started on 13/02/2009 at 20.47.47,57
Fix running from C:\Programmi\navilog1
Actual User Account : "Administrator"
Updated on 13.02.2009 at 18h00 by IL-MAFIOSO
Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) 4 CPU 3.40GHz )
BIOS : Phoenix ROM BIOS PLUS Version 1.10 A05
USER : Administrator ( Administrator )
BOOT : Fail-safe boot
Antivirus : Avira AntiVir PersonalEdition 8.0.1.27 (Activated)
Firewall : Kaspersky Anti-Virus 8.0.0.357 (Not Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:149 Go (Free:117 Go)
D:\ (CD or DVD)
E:\ (CD or DVD)
F:\ (Local Disk) - NTFS - Total:149 Go (Free:139 Go)
Manual Removal
Typed filename : okgyu
Cleanning stage done in safe mode
*** Searching, making backups and deleting files ***
* Deletion in "C:\WINDOWS\system32" *
C:\WINDOWS\prefetch\okgyu*.pf found !
Copy C:\WINDOWS\prefetch\okgyu*.pf done !
C:\WINDOWS\prefetch\okgyu*.pf deleted !
* Deletion in "C:\Documents and Settings\Administrator\impost~1\datiap~1" *
*** Deleting folders in "C:\WINDOWS" ***
*** Deleting folders in "C:\Programmi" ***
*** Deleting folders in "C:\Documents and Settings\All Users\menuav~1\progra~1" ***
*** Deleting folders in "C:\Documents and Settings\All Users\menuav~1" ***
*** Deleting folders in "c:\docume~1\alluse~1\datiap~1" ***
*** Deleting folders in "C:\Documents and Settings\Administrator\datiap~1" ***
*** Deleting folders in "C:\Documents and Settings\Administrator\impost~1\datiap~1" ***
*** Deleting folders in "C:\Documents and Settings\Administrator\menuav~1\progra~1" ***
*** Deleting files ***
*** Deleting temporary files ***
Cleaning of C:\WINDOWS\Temp done !
Cleaning of C:\Documents and Settings\Administrator\impost~1\Temp done !
*** Complementary Search ***
(Search specific files)
1)Deletion with backups new Instant Access files:
2)Heuristic search and deletion with backups :
* In "C:\WINDOWS\system32" *
* In "C:\Documents and Settings\Administrator\impost~1\datiap~1" *
*** Copy Registry to Safebackup folder ***
Backing up Registry done !
*** Cleaning Registry ***
Registry cleaned
*** Certificates ***
Egroup Certificate not found !
Electronic-Group Certificate not found !
Montorgueil Certificate not found !
OOO-Favorit Certificate not found !
Sunny-Day-Design-Ltd Certificate not found !
*** Search others known folders and files ***
*** Cleaning stage complete on 13/02/2009 at 20.49.59,32 ***
questo è il report Malwarebytes:
Malwarebytes' Anti-Malware 1.33
Versione del database: 1654
Windows 5.1.2600 Service Pack 3
13/02/2009 21.25.17
mbam-log-2009-02-13 (21-25-16).txt
Tipo di scansione: Scansione completa (C:\|F:\|)
Elementi scansionati: 104232
Tempo trascorso: 27 minute(s), 41 second(s)
Processi delle memoria infetti: 0
Moduli della memoria infetti: 0
Chiavi di registro infette: 0
Valori di registro infetti: 0
Elementi dato del registro infetti: 0
Cartelle infette: 0
File infetti: 0
Processi delle memoria infetti:
(Nessun elemento malevolo rilevato)
Moduli della memoria infetti:
(Nessun elemento malevolo rilevato)
Chiavi di registro infette:
(Nessun elemento malevolo rilevato)
Valori di registro infetti:
(Nessun elemento malevolo rilevato)
Elementi dato del registro infetti:
(Nessun elemento malevolo rilevato)
Cartelle infette:
(Nessun elemento malevolo rilevato)
File infetti:
(Nessun elemento malevolo rilevato)
questo è il report lopsd
--------------------\\ Lop S&D 4.2.5-0 XP/Vista
Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) 4 CPU 3.40GHz )
BIOS : Phoenix ROM BIOS PLUS Version 1.10 A05
USER : Administrator ( Administrator )
BOOT : Normal boot
Antivirus : Avira AntiVir PersonalEdition 8.0.1.27 (Activated)
Firewall : Kaspersky Anti-Virus 8.0.0.357 (Not Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:149 Go (Free:117 Go)
D:\ (CD or DVD)
E:\ (CD or DVD)
F:\ (Local Disk) - NTFS - Total:149 Go (Free:139 Go)
"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [2] ( 13/02/2009|21.37 )
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ FIX
Deleted! - C:\DOCUME~1\ALLUSE~1\DATIAP~1\INTERNET SPAM SUPPORT AUDIO
-
[ Hosts file ] .. Restored!
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
--------------------\\ Listing folders in DATIAP~1
[25/08/2008|18.19] C:\DOCUME~1\ADMINI~1\DATIAP~1\Adobe
[25/08/2008|16.29] C:\DOCUME~1\ADMINI~1\DATIAP~1\Auslogics
[18/09/2008|00.52] C:\DOCUME~1\ADMINI~1\DATIAP~1\BSplayer
[18/09/2008|00.50] C:\DOCUME~1\ADMINI~1\DATIAP~1\BSplayer Pro
[26/08/2008|01.14] C:\DOCUME~1\ADMINI~1\DATIAP~1\Comodo
[25/08/2008|00.21] C:\DOCUME~1\ADMINI~1\DATIAP~1\Creative
[10/09/2008|22.07] C:\DOCUME~1\ADMINI~1\DATIAP~1\FMZilla
[10/02/2009|13.28] C:\DOCUME~1\ADMINI~1\DATIAP~1\Foxit
[15/12/2008|02.28] C:\DOCUME~1\ADMINI~1\DATIAP~1\GlarySoft
[01/11/2008|19.41] C:\DOCUME~1\ADMINI~1\DATIAP~1\Google
[10/09/2008|22.10] C:\DOCUME~1\ADMINI~1\DATIAP~1\GrabPro
[26/08/2008|21.32] C:\DOCUME~1\ADMINI~1\DATIAP~1\Help
[24/08/2008|23.28] C:\DOCUME~1\ADMINI~1\DATIAP~1\Identities
[08/09/2008|20.26] C:\DOCUME~1\ADMINI~1\DATIAP~1\InstallShield
[24/08/2008|23.46] C:\DOCUME~1\ADMINI~1\DATIAP~1\Macromedia
[29/10/2008|09.54] C:\DOCUME~1\ADMINI~1\DATIAP~1\Malwarebytes
[22/09/2008|20.03] C:\DOCUME~1\ADMINI~1\DATIAP~1\Media Player Classic
[12/02/2009|23.15] C:\DOCUME~1\ADMINI~1\DATIAP~1\Microsoft
[19/10/2008|20.31] C:\DOCUME~1\ADMINI~1\DATIAP~1\mIRC
[25/08/2008|00.15] C:\DOCUME~1\ADMINI~1\DATIAP~1\Motive
[13/02/2009|17.46] C:\DOCUME~1\ADMINI~1\DATIAP~1\Mozilla
[25/08/2008|15.40] C:\DOCUME~1\ADMINI~1\DATIAP~1\Nero
[30/10/2008|20.27] C:\DOCUME~1\ADMINI~1\DATIAP~1\OpenOffice.org
[03/10/2008|00.09] C:\DOCUME~1\ADMINI~1\DATIAP~1\Orbit
[23/10/2008|22.27] C:\DOCUME~1\ADMINI~1\DATIAP~1\Safer Networking
[26/11/2008|01.31] C:\DOCUME~1\ADMINI~1\DATIAP~1\Softvision
[01/09/2008|17.47] C:\DOCUME~1\ADMINI~1\DATIAP~1\Sun
[25/08/2008|15.06] C:\DOCUME~1\ADMINI~1\DATIAP~1\Thunderbird
[29/08/2008|13.21] C:\DOCUME~1\ADMINI~1\DATIAP~1\TVU Networks
[12/02/2009|16.22] C:\DOCUME~1\ADMINI~1\DATIAP~1\uTorrent
[13/02/2009|18.09] C:\DOCUME~1\ADMINI~1\DATIAP~1\vghd
[01/12/2008|18.53] C:\DOCUME~1\ADMINI~1\DATIAP~1\vlc
[21/10/2008|18.00] C:\DOCUME~1\ADMINI~1\DATIAP~1\Winamp
[12/02/2009|23.27] C:\DOCUME~1\ADMINI~1\DATIAP~1\Windows Live Writer
[25/08/2008|00.33] C:\DOCUME~1\ADMINI~1\DATIAP~1\WinRAR
[0|File] C:\DOCUME~1\ADMINI~1\DATIAP~1\byte
[37|Directory] C:\DOCUME~1\ADMINI~1\DATIAP~1\byte disponibili
[12/02/2009|16.21] C:\DOCUME~1\ALLUSE~1\DATIAP~1\80ckVB
[18/01/2009|12.51] C:\DOCUME~1\ALLUSE~1\DATIAP~1\Adobe
[29/10/2008|12.40] C:\DOCUME~1\ALLUSE~1\DATIAP~1\Avira
[23/09/2008|00.16] C:\DOCUME~1\ALLUSE~1\DATIAP~1\AVS4YOU
[25/08/2008|00.21] C:\DOCUME~1\ALLUSE~1\DATIAP~1\Creative
[21/09/2008|23.41] C:\DOCUME~1\ALLUSE~1\DATIAP~1\GiocoDigitale
[04/11/2008|01.25] C:\DOCUME~1\ALLUSE~1\DATIAP~1\Google
[08/09/2008|20.26] C:\DOCUME~1\ALLUSE~1\DATIAP~1\InstallShield
[13/02/2009|20.52] C:\DOCUME~1\ALLUSE~1\DATIAP~1\Kaspersky Lab
[29/10/2008|13.01] C:\DOCUME~1\ALLUSE~1\DATIAP~1\Kaspersky Lab Setup Files
[31/10/2008|00.05] C:\DOCUME~1\ALLUSE~1\DATIAP~1\Lavasoft
[29/10/2008|09.54] C:\DOCUME~1\ALLUSE~1\DATIAP~1\Malwarebytes
[13/02/2009|01.40] C:\DOCUME~1\ALLUSE~1\DATIAP~1\Messenger Plus!
[12/02/2009|22.44] C:\DOCUME~1\ALLUSE~1\DATIAP~1\Microsoft
[30/10/2008|17.05] C:\DOCUME~1\ALLUSE~1\DATIAP~1\Microsoft Help
[25/08/2008|15.38] C:\DOCUME~1\ALLUSE~1\DATIAP~1\Nero
[27/08/2008|14.52] C:\DOCUME~1\ALLUSE~1\DATIAP~1\Office Genuine Advantage
[25/08/2008|12.42] C:\DOCUME~1\ALLUSE~1\DATIAP~1\PC Drivers HeadQuarters
[27/08/2008|14.53] C:\DOCUME~1\ALLUSE~1\DATIAP~1\SecTaskMan
[13/02/2009|21.26] C:\DOCUME~1\ALLUSE~1\DATIAP~1\Spybot - Search & Destroy
[29/08/2008|13.21] C:\DOCUME~1\ALLUSE~1\DATIAP~1\TVU Networks
[29/10/2008|14.32] C:\DOCUME~1\ALLUSE~1\DATIAP~1\Windows Genuine Advantage
[25/08/2008|00.31] C:\DOCUME~1\ALLUSE~1\DATIAP~1\WinZip
[25/08/2008|16.51] C:\DOCUME~1\ALLUSE~1\DATIAP~1\WLInstaller
[0|File] C:\DOCUME~1\ALLUSE~1\DATIAP~1\byte
[26|Directory] C:\DOCUME~1\ALLUSE~1\DATIAP~1\byte disponibili
[24/08/2008|23.19] C:\DOCUME~1\DEFAUL~1\DATIAP~1\Microsoft
[0|File] C:\DOCUME~1\DEFAUL~1\DATIAP~1\byte
[3|Directory] C:\DOCUME~1\DEFAUL~1\DATIAP~1\byte disponibili
[24/08/2008|23.19] C:\DOCUME~1\LOCALS~1\DATIAP~1\Microsoft
[0|File] C:\DOCUME~1\LOCALS~1\DATIAP~1\byte
[3|Directory] C:\DOCUME~1\LOCALS~1\DATIAP~1\byte disponibili
[24/08/2008|23.19] C:\DOCUME~1\NETWOR~1\DATIAP~1\Microsoft
[0|File] C:\DOCUME~1\NETWOR~1\DATIAP~1\byte
[3|Directory] C:\DOCUME~1\NETWOR~1\DATIAP~1\byte disponibili
--------------------\\ Scheduled Tasks located in C:\WINDOWS\Tasks
[13/02/2009 20.51][--a------] C:\WINDOWS\tasks\GlaryInitialize.job
[13/02/2009 15.49][--a------] C:\WINDOWS\tasks\OGADaily.job
[13/02/2009 20.51][--a------] C:\WINDOWS\tasks\OGALogon.job
[13/02/2009 20.51][--ah-----] C:\WINDOWS\tasks\SA.DAT
[31/08/2001 18.00][-r-h-----] C:\WINDOWS\tasks\desktop.ini
--------------------\\ Listing Folders in C:\Programmi
[18/01/2009|12.50] C:\Programmi\Adobe
[29/10/2008|14.36] C:\Programmi\Alice ti aiuta
[25/08/2008|19.16] C:\Programmi\AskSBar
[25/08/2008|00.17] C:\Programmi\ATI Technologies
[25/08/2008|16.29] C:\Programmi\Auslogics
[23/09/2008|00.17] C:\Programmi\AVS4YOU
[18/09/2008|00.50] C:\Programmi\BS.Player ControlBar
[25/08/2008|18.24] C:\Programmi\CCleaner
[03/09/2008|20.16] C:\Programmi\CD_DVD-ROM Generator 1.20
[13/02/2009|00.05] C:\Programmi\Circle Development
[24/08/2008|23.42] C:\Programmi\Common Files
[26/08/2008|01.17] C:\Programmi\COMODO
[24/08/2008|23.15] C:\Programmi\ComPlus Applications
[13/02/2009|00.25] C:\Programmi\Conduit
[26/08/2008|22.17] C:\Programmi\CONEXANT
[26/08/2008|20.16] C:\Programmi\Dell Photo AIO Printer 924
[11/02/2009|16.06] C:\Programmi\DkZ Studio
[04/09/2008|12.05] C:\Programmi\DkZ Update
[25/08/2008|12.59] C:\Programmi\Driver-Soft
[25/08/2008|18.23] C:\Programmi\DustBuster XP
[29/10/2008|14.35] C:\Programmi\EliBagle
[06/10/2008|16.08] C:\Programmi\Everest Poker.net
[12/02/2009|22.01] C:\Programmi\File comuni
[10/02/2009|13.31] C:\Programmi\Foxit Software
[10/09/2008|22.08] C:\Programmi\Free Music Zilla
[07/12/2008|18.25] C:\Programmi\Game Graphic Studio
[23/09/2008|12.43] C:\Programmi\GiocoDigitale
[13/12/2008|18.16] C:\Programmi\Glary Utilities
[04/11/2008|01.25] C:\Programmi\Google
[07/01/2009|19.40] C:\Programmi\GRETECH
[26/08/2008|21.01] C:\Programmi\Idf
[17/11/2008|21.31] C:\Programmi\IKEA HomePlanner
[26/11/2008|01.30] C:\Programmi\InstallShield Installation Information
[25/08/2008|13.56] C:\Programmi\Intel
[12/02/2009|19.30] C:\Programmi\Internet Explorer
[21/12/2008|23.27] C:\Programmi\Java
[08/01/2009|13.32] C:\Programmi\JRE
[29/11/2008|12.01] C:\Programmi\Kaspersky Lab
[31/10/2008|00.03] C:\Programmi\Lavasoft
[13/02/2009|17.25] C:\Programmi\Malwarebytes' Anti-Malware
[23/09/2008|20.41] C:\Programmi\Messenger
[13/02/2009|00.05] C:\Programmi\Messenger Plus! Live
[12/02/2009|22.45] C:\Programmi\Microsoft
[23/09/2008|20.46] C:\Programmi\microsoft frontpage
[12/02/2009|22.43] C:\Programmi\Microsoft SQL Server Compact Edition
[12/02/2009|22.44] C:\Programmi\Microsoft Sync Framework
[08/01/2009|13.13] C:\Programmi\Microsoft.NET
[13/02/2009|18.23] C:\Programmi\MouseRunner.com
[23/09/2008|20.38] C:\Programmi\Movie Maker
[13/02/2009|21.17] C:\Programmi\Mozilla Firefox
[13/02/2009|18.20] C:\Programmi\Mozilla Thunderbird
[07/01/2009|19.34] C:\Programmi\Mplayer
[30/10/2008|17.03] C:\Programmi\MSBuild
[24/08/2008|23.15] C:\Programmi\MSN Gaming Zone
[15/11/2008|02.32] C:\Programmi\MSXML 4.0
[24/08/2008|23.22] C:\Programmi\MSXML 6.0
[13/02/2009|20.49] C:\Programmi\Navilog1
[25/08/2008|15.38] C:\Programmi\Nero
[23/09/2008|20.35] C:\Programmi\NetMeeting
[13/02/2009|14.23] C:\Programmi\NoAds
[08/01/2009|13.32] C:\Programmi\OpenOffice.org 3
[08/01/2009|13.32] C:\Programmi\OpenOffice.org 3.0 (it) Installation Files
[23/09/2008|20.35] C:\Programmi\Outlook Express
[31/10/2008|01.03] C:\Programmi\PeerGuardian2
[26/08/2008|21.00] C:\Programmi\Pirelli
[12/02/2009|13.35] C:\Programmi\Poker Club by Lottomatica
[04/02/2009|12.31] C:\Programmi\PokerStars.IT
[06/10/2008|15.25] C:\Programmi\PokerStars.NET
[25/08/2008|14.38] C:\Programmi\PowerQuest
[13/02/2009|15.03] C:\Programmi\QUAD Utilities
[10/02/2009|00.31] C:\Programmi\Recovery Toolbox for RAR
[24/08/2008|23.23] C:\Programmi\Reference Assemblies
[02/11/2008|23.03] C:\Programmi\RegSeeker
[04/11/2008|01.27] C:\Programmi\RegToy
[07/01/2009|22.55] C:\Programmi\Security Task Manager
[24/08/2008|23.17] C:\Programmi\Servizi in linea
[26/08/2008|21.37] C:\Programmi\SigmaTel
[08/09/2008|00.55] C:\Programmi\Smart Projects
[05/02/2009|13.51] C:\Programmi\Softonic_Italia
[29/08/2008|13.26] C:\Programmi\SopCast
[31/10/2008|15.55] C:\Programmi\Spybot - Search & Destroy
[24/08/2008|23.40] C:\Programmi\Telecom Italia
[05/11/2008|20.22] C:\Programmi\The KMPlayer
[23/10/2008|22.05] C:\Programmi\Trend Micro
[03/11/2008|18.38] C:\Programmi\TVAnts
[29/08/2008|13.21] C:\Programmi\TVUPlayer
[14/12/2008|17.09] C:\Programmi\uusee
[13/02/2009|17.25] C:\Programmi\vghd
[22/09/2008|21.51] C:\Programmi\VideoLAN
[20/11/2008|20.53] C:\Programmi\VS Revo Group
[18/09/2008|00.50] C:\Programmi\Webteh
[29/10/2008|14.35] C:\Programmi\Winamp
[12/02/2009|22.45] C:\Programmi\Windows Live
[12/02/2009|22.42] C:\Programmi\Windows Live SkyDrive
[24/08/2008|23.15] C:\Programmi\Windows Media Connect 2
[23/09/2008|20.35] C:\Programmi\Windows Media Player
[23/09/2008|20.35] C:\Programmi\Windows NT
[24/08/2008|23.17] C:\Programmi\WindowsUpdate
[25/08/2008|14.42] C:\Programmi\WinRAR
[21/09/2008|22.23] C:\Programmi\wwSms Client
[23/09/2008|20.46] C:\Programmi\xerox
[07/01/2009|19.47] C:\Programmi\XP Codec Pack
[23/10/2008|22.55] C:\Programmi\Yahoo!
[0|File] C:\Programmi\byte
[105|Directory] C:\Programmi\byte disponibili
--------------------\\ Listing Folders in C:\Programmi\File comuni
[18/01/2009|12.51] C:\Programmi\File comuni\Adobe
[23/09/2008|00.17] C:\Programmi\File comuni\AVSMedia
[26/11/2008|23.10] C:\Programmi\File comuni\DESIGNER
[08/09/2008|20.26] C:\Programmi\File comuni\InstallShield
[25/08/2008|16.44] C:\Programmi\File comuni\Java
[12/02/2009|22.42] C:\Programmi\File comuni\Microsoft Shared
[24/08/2008|23.42] C:\Programmi\File comuni\Motive
[24/08/2008|23.17] C:\Programmi\File comuni\MSSoap
[25/08/2008|15.39] C:\Programmi\File comuni\Nero
[25/08/2008|01.10] C:\Programmi\File comuni\ODBC
[25/08/2008|18.25] C:\Programmi\File comuni\Services
[25/08/2008|01.10] C:\Programmi\File comuni\SpeechEngines
[26/11/2008|23.10] C:\Programmi\File comuni\System
[02/11/2008|14.49] C:\Programmi\File comuni\uusee
[12/02/2009|22.01] C:\Programmi\File comuni\Windows Live
[25/08/2008|16.55] C:\Programmi\File comuni\WindowsLiveInstaller
[07/02/2009|22.20] C:\Programmi\File comuni\Wise Installation Wizard
[0|File] C:\Programmi\File comuni\byte
[19|Directory] C:\Programmi\File comuni\byte disponibili
--------------------\\ Process
( 33 Processes )
... OK !
--------------------\\ Searching with S_Lop
No Lop folder found !
--------------------\\ Searching for Lop Files - Folders
No Lop folder found !
--------------------\\ Searching within the Registry
..... OK !
--------------------\\ Checking the Hosts file
Hosts file CLEAN
--------------------\\ Searching for hidden files with Catchme
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net Rootkit scan 2009-02-13 21:40:38
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0
--------------------\\ Searching for other infections
--------------------\\ ROOTKIT !!
Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA]
Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SROSA]
Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Enum\Root\LEGACY_SROSA]
Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA]
[F:3][D:1]-> C:\DOCUME~1\ADMINI~1\IMPOST~1\Temp
[F:2][D:0]-> C:\DOCUME~1\ADMINI~1\Cookies
[F:2][D:0]-> C:\DOCUME~1\ADMINI~1\IMPOST~1\TEMPOR~1\content.IE5
1 - "C:\Lop SD\LopR_1.txt" - 13/02/2009|21.37 - Option : [1]
2 - "C:\Lop SD\LopR_2.txt" - 13/02/2009|21.41 - Option : [2]
--------------------\\ Scan completed at 21.41.41