ecco il log di combofix :
ComboFix 10-03-29.04 - Mauro 30/03/2010 22.58.55.9.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.39.1040.18.2046.1548 [GMT 2:00]
Eseguito da: c:\documents and settings\Mauro\Desktop\ComboFix.exe
AV: Sistema Antivirus NOD32 2.70 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: PC Tools Firewall Plus *disabled* {ABBD5028-5A95-4B6D-996E-98D64AE88D52}
* Creato nuovo punto di ripristino
ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\data
c:\data\ProgAT\NavDX.Ovl
c:\data\ProgNEC\NavDX.Ovl
c:\windows\eSellerateEngine.dll
c:\windows\system32\Chip.dll
.
((((((((((((((((((((((((( Files Creati Da 2010-02-28 al 2010-03-30 )))))))))))))))))))))))))))))))))))
.
2010-03-14 12:21 . 2010-03-14 12:21 503808 ----a-w- c:\documents and settings\ff\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-6e3ed55f-n\msvcp71.dll
2010-03-14 12:21 . 2010-03-14 12:21 348160 ----a-w- c:\documents and settings\ff\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-6e3ed55f-n\msvcr71.dll
2010-03-14 12:21 . 2010-03-14 12:21 499712 ----a-w- c:\documents and settings\ff\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-6e3ed55f-n\jmc.dll
2010-03-14 12:21 . 2010-03-14 12:21 61440 ----a-w- c:\documents and settings\ff\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-7b022e6f-n\decora-sse.dll
2010-03-14 12:21 . 2010-03-14 12:21 12800 ----a-w- c:\documents and settings\ff\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-7b022e6f-n\decora-d3d.dll
2010-03-13 08:41 . 2010-03-13 08:41 503808 ----a-w- c:\documents and settings\Flavio Massimo.OK\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-326f4a56-n\msvcp71.dll
2010-03-13 08:41 . 2010-03-13 08:41 499712 ----a-w- c:\documents and settings\Flavio Massimo.OK\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-326f4a56-n\jmc.dll
2010-03-13 08:41 . 2010-03-13 08:41 348160 ----a-w- c:\documents and settings\Flavio Massimo.OK\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-326f4a56-n\msvcr71.dll
2010-03-13 08:41 . 2010-03-13 08:41 61440 ----a-w- c:\documents and settings\Flavio Massimo.OK\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-34ace9c8-n\decora-sse.dll
2010-03-13 08:41 . 2010-03-13 08:41 12800 ----a-w- c:\documents and settings\Flavio Massimo.OK\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-34ace9c8-n\decora-d3d.dll
2010-03-12 22:34 . 2010-03-12 22:34 -------- d-----w- c:\programmi\File comuni\Java
2010-03-12 22:34 . 2010-03-12 22:34 503808 ----a-w- c:\documents and settings\Mauro\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-65d6cc23-n\msvcp71.dll
2010-03-12 22:34 . 2010-03-12 22:34 499712 ----a-w- c:\documents and settings\Mauro\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-65d6cc23-n\jmc.dll
2010-03-12 22:34 . 2010-03-12 22:34 348160 ----a-w- c:\documents and settings\Mauro\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-65d6cc23-n\msvcr71.dll
2010-03-12 22:34 . 2010-03-12 22:34 61440 ----a-w- c:\documents and settings\Mauro\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-669aea29-n\decora-sse.dll
2010-03-12 22:34 . 2010-03-12 22:34 12800 ----a-w- c:\documents and settings\Mauro\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-669aea29-n\decora-d3d.dll
2010-03-10 13:57 . 2009-10-23 15:28 3558912 -c----w- c:\windows\system32\dllcache\moviemk.exe
2010-03-10 13:57 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2010-03-09 17:37 . 2010-03-09 17:37 -------- d-----w- c:\documents and settings\ff\Dati applicazioni\Ahead
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-30 20:56 . 2010-01-06 20:26 -------- d-----w- c:\programmi\Crawler
2010-03-30 20:54 . 2008-01-31 18:43 -------- d---a-w- c:\documents and settings\All Users\Dati applicazioni\TEMP
2010-03-30 19:44 . 2008-11-04 18:23 -------- d-----w- c:\programmi\Malwarebytes' Anti-Malware
2010-03-30 19:43 . 2007-02-26 23:10 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Spybot - Search & Destroy
2010-03-30 19:43 . 2008-06-25 16:24 -------- d-----w- c:\programmi\SpywareBlaster
2010-03-30 19:42 . 2008-12-04 17:07 5918776 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-03-30 19:40 . 2008-11-05 14:24 -------- d-----w- c:\programmi\SUPERAntiSpyware
2010-03-30 19:39 . 2009-03-12 20:22 117760 ----a-w- c:\documents and settings\Mauro\Dati applicazioni\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-03-30 19:34 . 2008-11-13 20:33 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Spyware Terminator
2010-03-30 19:34 . 2008-11-13 20:33 -------- d-----w- c:\programmi\Spyware Terminator
2010-03-30 19:33 . 2008-11-13 20:33 -------- d-----w- c:\documents and settings\Mauro\Dati applicazioni\Spyware Terminator
2010-03-30 13:51 . 2008-11-15 09:19 -------- d-----w- c:\documents and settings\ff\Dati applicazioni\Spyware Terminator
2010-03-29 22:46 . 2008-11-04 18:23 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-29 22:45 . 2008-11-04 18:23 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-29 19:09 . 2008-11-14 13:54 -------- d-----w- c:\documents and settings\Flavio Massimo.OK\Dati applicazioni\Spyware Terminator
2010-03-29 19:07 . 2009-03-18 19:07 117760 ----a-w- c:\documents and settings\Flavio Massimo.OK\Dati applicazioni\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-03-29 19:05 . 2008-02-29 19:30 -------- d-----w- c:\programmi\ESET
2010-03-29 18:37 . 2008-11-07 20:47 512096 ----a-w- c:\windows\system32\drivers\amon.sys
2010-03-29 18:37 . 2008-11-07 20:47 298104 ----a-w- c:\windows\system32\imon.dll
2010-03-29 18:37 . 2008-11-07 20:47 15424 ----a-w- c:\windows\system32\drivers\nod32drv.sys
2010-03-28 08:45 . 2001-08-31 11:00 73904 ----a-w- c:\windows\system32\perfc010.dat
2010-03-28 08:45 . 2001-08-31 11:00 448176 ----a-w- c:\windows\system32\perfh010.dat
2010-03-27 22:00 . 2009-03-20 19:03 117760 ----a-w- c:\documents and settings\ff\Dati applicazioni\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-03-23 20:34 . 2007-02-26 23:10 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\DVD Shrink
2010-03-12 22:34 . 2009-12-13 21:58 -------- d-----w- c:\programmi\Java
2010-03-04 21:10 . 2007-02-26 23:42 -------- d-----w- c:\programmi\File comuni\Adobe
2010-03-03 17:20 . 2008-01-17 19:41 -------- d-----w- c:\programmi\Windows Live Safety Center
2010-02-25 20:56 . 2008-09-11 19:13 -------- d-----w- c:\programmi\CCleaner
2010-02-11 19:38 . 2009-04-15 19:20 117760 ----a-w- c:\documents and settings\mamma\Dati applicazioni\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-02-04 13:48 . 2007-02-26 23:10 -------- d-----w- c:\programmi\eMule
2010-01-27 20:44 . 2010-01-27 20:44 43646 ----a-r- c:\documents and settings\Mauro\Dati applicazioni\Microsoft\Installer\{EB85CC54-5E9A-4D33-B319-593B82291ABC}\_F4B1F5D95883DF032043AB.exe
2010-01-27 20:44 . 2010-01-27 20:44 43646 ----a-r- c:\documents and settings\Mauro\Dati applicazioni\Microsoft\Installer\{EB85CC54-5E9A-4D33-B319-593B82291ABC}\_D707CE1C009F1381803C2C.exe
2010-01-27 20:44 . 2010-01-27 20:44 43646 ----a-r- c:\documents and settings\Mauro\Dati applicazioni\Microsoft\Installer\{EB85CC54-5E9A-4D33-B319-593B82291ABC}\_60F6DE46B7963C9F49DE91.exe
2010-01-27 20:44 . 2010-01-27 20:44 43646 ----a-r- c:\documents and settings\Mauro\Dati applicazioni\Microsoft\Installer\{EB85CC54-5E9A-4D33-B319-593B82291ABC}\_21F3885A18D238E15AAE81.exe
2010-01-27 20:44 . 2010-01-27 20:44 29926 ----a-r- c:\documents and settings\Mauro\Dati applicazioni\Microsoft\Installer\{EB85CC54-5E9A-4D33-B319-593B82291ABC}\_68330598A56E6C9A3EC6DC.exe
2010-01-27 20:44 . 2010-01-27 20:44 109534 ----a-r- c:\documents and settings\Mauro\Dati applicazioni\Microsoft\Installer\{EB85CC54-5E9A-4D33-B319-593B82291ABC}\_6FEFF9B68218417F98F549.exe
2010-01-21 16:20 . 2010-01-21 16:49 15328 ----a-w- c:\windows\system32\drivers\pssnap.sys
2010-01-21 16:20 . 2010-01-21 16:49 32736 ----a-w- c:\windows\system32\drivers\psmounter.sys
2010-01-12 21:42 . 2009-12-20 20:27 52224 ----a-w- c:\documents and settings\Mauro\Dati applicazioni\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-01-11 17:29 . 2009-12-24 15:58 52224 ----a-w- c:\documents and settings\Flavio Massimo.OK\Dati applicazioni\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-01-06 20:40 . 2010-01-06 20:40 52224 ----a-w- c:\documents and settings\mamma\Dati applicazioni\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-01-05 19:19 . 2009-12-26 09:43 52224 ----a-w- c:\documents and settings\ff\Dati applicazioni\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-01-05 09:53 . 2002-09-09 12:51 832512 ----a-w- c:\windows\system32\wininet.dll
2010-01-05 09:53 . 2007-02-26 23:34 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-01-05 09:53 . 2001-08-31 11:00 17408 ----a-w- c:\windows\system32\corpol.dll
2009-12-31 16:50 . 2001-08-31 11:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-13 110592]
"nod32kui"="c:\programmi\Eset\nod32kui.exe" [2010-03-29 949376]
"SpywareTerminator"="c:\programmi\Spyware Terminator\SpywareTerminatorShield.exe" [2008-11-13 1783808]
"00PCTFW"="c:\programmi\PC Tools Firewall Plus\FirewallGUI.exe" [2009-12-11 2652056]
"QuickTime Task"="c:\programmi\QuickTime\qttask.exe" [2007-02-26 98304]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-13 15360]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\programmi\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-08 18:55 548352 ----a-w- c:\programmi\SUPERAntiSpyware\SASWINLO.DLL
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]
c:\windows\system32\dumprep 0 -u [X]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2009-12-11 14:57 948672 ----a-r- c:\programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-12-22 00:57 35760 ----a-w- c:\programmi\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2005-09-03 14:18 94208 ----a-w- c:\programmi\File comuni\Ahead\Lib\NMBgMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrowserChoice]
2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2007-02-26 23:19 98304 ----a-w- c:\programmi\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 10:43 248040 ----a-w- c:\programmi\File comuni\Java\Java Update\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"JavaQuickStarterService"=2 (0x2)
"gusvc"=3 (0x3)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\eMule\\emule.exe"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programmi\\Messenger\\msmsgs.exe"=
R0 pssnap;Paramount Software Snapshot Filter;c:\windows\system32\drivers\pssnap.sys [21/01/2010 18.49.17 15328]
R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [07/11/2008 22.47.14 15424]
R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [11/12/2009 23.11.33 159600]
R1 SASDIFSV;SASDIFSV;c:\programmi\SUPERAntiSpyware\SASDIFSV.SYS [03/09/2008 15.07.14 12872]
R1 SASKUTIL;SASKUTIL;c:\programmi\SUPERAntiSpyware\SASKUTIL.SYS [03/09/2008 15.07.12 66632]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [13/11/2008 22.33.12 141312]
R2 PCTAppEvent;PCTAppEvent Driver;c:\windows\system32\drivers\PCTAppEvent.sys [11/12/2009 23.11.35 73840]
R2 PMJ151NM;Panasonic DVC Web Camera;c:\windows\system32\drivers\PMJ151NM.sys [27/02/2007 1.55.44 14848]
R2 ReflectService;Macrium Reflect Image Mounting Service;c:\programmi\Macrium\Reflect\ReflectService.exe [21/01/2010 18.49.19 220128]
R3 pctplfw;pctplfw;c:\windows\system32\drivers\pctplfw.sys [11/12/2009 23.11.10 95640]
S3 ActionReplayDS;ActionReplayDS;c:\windows\system32\drivers\ActionReplayDS.sys [03/09/2009 13.28.52 29184]
S3 MovRVDrv32;MovRVDrv32;c:\windows\system32\drivers\MovRVDrv32.sys [30/01/2008 20.18.25 3768]
S3 SASENUM;SASENUM;c:\programmi\SUPERAntiSpyware\SASENUM.SYS [03/09/2008 15.07.16 12872]
S3 SDTHOOK;SDTHOOK;c:\windows\system32\drivers\SDTHOOK.SYS [02/03/2008 10.48.54 44928]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [03/05/2007 22.34.29 639224]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
IE: Crawler Search - tbr:iemenu
TCP: {5296BEBE-FB2F-47A6-BADA-0DA237AD820F} = 212.216.112.112,212.216.172.62
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\programmi\Crawler\ctbr.dll
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
- - - - CHIAVI ORFANE RIMOSSE - - - -
AddRemove-HijackThis - k:\sicurezza\tools\HijackThis.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2010-03-30 23:02
Windows 5.1.2600 Service Pack 3 NTFS
scansione processi nascosti ...
scansione entrate autostart nascoste ...
Scansione files nascosti ...
Scansione completata con successo
Files nascosti: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PMJ151LA]
"ImagePath"="%SystemRoot%\PMJ151LA.BIN"
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
[HKEY_LOCAL_MACHINE\software\Microsoft\Environment*]
"Licence0"="04F0D21-79D8-7A25-D702-433F"
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•9~*]
"0140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------
- - - - - - - > 'winlogon.exe'(984)
c:\programmi\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
c:\windows\system32\Ati2evxx.dll
.
Ora fine scansione: 2010-03-30 23:04:07
ComboFix-quarantined-files.txt 2010-03-30 21:04
Pre-Run: 62.253.305.856 byte disponibili
Post-Run: 62.874.505.216 byte disponibili
Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - FA7950A74B609CED8F76C14085C634A3
attendo notizie