Ciao r16 eccomi quà, ti posto il log di combofix, e grazie del tuo aiuto!!
ComboFix 09-10-01.05 - Daniela & Tony 03/10/2009 23.55.41.1.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.39.1040.18.511.338 [GMT 2:00]
Eseguito da: c:\documents and settings\Daniela & Tony\Desktop\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {00000002-0002-0000-7C25-9E7C08000A00}
AV: Avira AntiVir PersonalEdition *On-access scanning enabled* (Outdated) {00000000-F0B8-0012-00E9-917C0802927C}
ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Daniela & Tony\Dati applicazioni\Desktopicon
.
((((((((((((((((((((((((( Files Creati Da 2009-09-03 al 2009-10-03 )))))))))))))))))))))))))))))))))))
.
2009-10-01 11:28 . 2009-03-30 08:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-10-01 11:28 . 2009-02-13 10:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-10-01 11:28 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-10-01 11:28 . 2009-10-01 11:28 -------- d-----w- c:\programmi\Avira
2009-09-30 22:57 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-30 22:57 . 2009-09-30 22:58 -------- d-----w- c:\programmi\Malwarebytes' Anti-Malware
2009-09-30 22:57 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-28 22:58 . 2009-09-28 22:58 -------- d-----w- c:\windows\system32\wbem\Repository
2009-09-25 21:31 . 2009-09-25 21:31 -------- d-----w- c:\documents and settings\Administrator\IETldCache
2009-09-25 21:31 . 2009-09-28 22:58 -------- d-----w- c:\documents and settings\Administrator\Modelli
2009-09-25 21:31 . 2009-09-28 22:58 -------- d-----w- c:\documents and settings\Administrator\Impostazioni locali\Dati applicazioni\Microsoft
2009-09-25 21:31 . 2009-09-28 22:58 -------- d-----w- c:\documents and settings\Administrator\Impostazioni locali
2009-09-25 21:31 . 2009-09-28 22:58 -------- d-----w- c:\documents and settings\Administrator\Dati applicazioni
2009-09-25 21:31 . 2009-09-28 22:58 -------- d-s---w- c:\documents and settings\Administrator
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-01 11:28 . 2009-01-11 23:20 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Avira
2009-09-30 23:03 . 2008-12-19 00:30 -------- d-----w- c:\programmi\eMule
2009-09-23 22:56 . 2009-08-22 23:03 -------- d-----w- c:\programmi\Google
2009-09-23 21:36 . 2002-09-10 13:00 47592 ----a-w- c:\windows\system32\perfc010.dat
2009-09-23 21:36 . 2002-09-10 13:00 345010 ----a-w- c:\windows\system32\perfh010.dat
2009-08-06 17:24 . 2008-12-18 21:22 327896 ----a-w- c:\windows\system32\wucltui.dll
2009-08-06 17:24 . 2008-12-18 21:22 209632 ----a-w- c:\windows\system32\wuweb.dll
2009-08-06 17:24 . 2008-12-18 21:22 35552 ----a-w- c:\windows\system32\wups.dll
2009-08-06 17:24 . 2008-10-16 13:09 44768 ----a-w- c:\windows\system32\wups2.dll
2009-08-06 17:24 . 2008-12-18 21:22 53472 ----a-w- c:\windows\system32\wuauclt.exe
2009-08-06 17:24 . 2004-08-19 13:39 96480 ----a-w- c:\windows\system32\cdm.dll
2009-08-06 17:23 . 2008-12-18 21:22 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-08-06 17:23 . 2008-12-18 21:22 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-08-05 08:59 . 2004-08-19 13:39 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-28 14:34 . 2009-04-30 23:47 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-07-17 19:01 . 2004-08-19 13:39 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-12 10:21 . 2004-08-19 13:39 233472 ----a-w- c:\windows\system32\wmpdxm.dll
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"avgnt"="c:\programmi\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"Malwarebytes Anti-Malware (reboot)"="c:\programmi\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmi\\uTorrent\\uTorrent.exe"=
"c:\\Programmi\\eMule\\emule.exe"=
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contenuto della cartella 'Scheduled Tasks'
2009-10-03 c:\windows\Tasks\User_Feed_Synchronization-{291B1ABD-BF5E-4F9B-82C0-ECADA89E5794}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-10-03 23:58
Windows 5.1.2600 Service Pack 3 NTFS
scansione processi nascosti ...
scansione entrate autostart nascoste ...
Scansione files nascosti ...
Scansione completata con successo
Files nascosti: 0
**************************************************************************
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------
- - - - - - - > 'explorer.exe'(3532)
c:\windows\system32\WININET.dll
c:\windows\system32\webcheck.dll
.
Ora fine scansione: 2009-10-03 23.59.10
ComboFix-quarantined-files.txt 2009-10-03 21:59
Pre-Run: 73.033.506.816 byte disponibili
Post-Run: 73.003.229.184 byte disponibili
100 --- E O F --- 2009-09-12 15:46