Aiutamici Forum
Benvenuto Ospite Cerca | Topic Attivi | Utenti | | Log In | Registra

richiesta analisi log di hijack Opzioni
Kalachado
Inviato: Wednesday, November 19, 2008 12:48:21 PM
Rank: AiutAmico

Iscritto dal : 3/23/2005
Posts: 63
ciao ragazzi, i problemi che son questi:
1 - pc lentissimo
2 - non mi aggiorna gli antivirus
3 - non mi permette di installare programmi, o comunque ho sempre intoppi di vario tipo

allego il log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12.39.28, on 19/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\File comuni\EPSON\EBAPI\eEBSVC.exe
C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
C:\Programmi\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programmi\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.00\SiSWLSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Programmi\ClamWin\bin\ClamTray.exe
C:\Programmi\Eset\nod32kui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.00\WlanCU.exe
C:\WINDOWS\system32\msiexec.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe
C:\Programmi\Internet Explorer\iexplore.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [CmUsbSound] RunDll32 cmcnfgu.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [ClamWin] "C:\Programmi\ClamWin\bin\ClamTray.exe" --logon
O4 - HKLM\..\Run: [nod32kui] "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Wireless Configuration Utility HW.32.lnk = ?
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Programmi\File comuni\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmi\Eset\nod32krn.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SiS WirelessLan Service (SiSWLSvc) - Unknown owner - C:\Programmi\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.00\SiSWLSvc.exe

--
End of file - 3940 bytes
Sponsor
Inviato: Wednesday, November 19, 2008 12:48:21 PM

 
r16
Inviato: Wednesday, November 19, 2008 5:42:46 PM
Rank: AiutAmico

Iscritto dal : 8/7/2007
Posts: 11,016
Hai scaricato file da E-Mule?
Riesci a entrare in Modalità Provvisoria?
I sintomi sono del Beagle.
Scarica elibagla : http://www.zonavirus.com/datos/descargas/95/elibagla.asp scorri a fondo pagina e clicca su "descargar elibagla".Salva il file sul desktop
IMPORTANTE: Disconnettiti da internet e disattiva il tuo antivirus.
Doppio click sull'icona Elibagla.exe per avviare il programma.
Assicurati che la casella "Eliminar Ficheros Automaticamente" sia spuntata.
Usa Elibagla in modalità provvisoria,se funziona.Altrimenti usa la Modalità Normale.
Al termine della scansione DEVI RIAVVIARE il pc,e postare il log che si trova in: C:\InfoSat.txt
Kalachado
Inviato: Thursday, November 20, 2008 7:00:53 PM
Rank: AiutAmico

Iscritto dal : 3/23/2005
Posts: 63
grazie r16...ho fatto tutto! ora vi posto il log quanto prima!!! mi stà facendo impazzire stò coso......
ciao
Kalachado
Inviato: Thursday, November 20, 2008 7:08:28 PM
Rank: AiutAmico

Iscritto dal : 3/23/2005
Posts: 63
CIAO R16...
ECCO IL LOG GENERATO DA ELIBAGLA!
COSA ALTRO DEVO FARE?? ATTENDO TUA RISPOSTA....
CIAO E GRAZIE IN ANTICIPO..


Thu Nov 20 18:36:07 2008
EliBagle v11.97 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 17 de Noviembre del 2008)

Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\BAN_LIST.TXT --> Eliminado Bagle
C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Bagle (rootkit) Acceso Denegado.
C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Bagle.dldr Acceso Denegado.
C:\DOCUMENTS AND SETTINGS\PCMF.MF-CAKSV2APT278\DATI APPLICAZIONI\M\FLEC006.EXE --> Bagle.dldr Acceso Denegado.
C:\DOCUMENTS AND SETTINGS\PCMF.MF-CAKSV2APT278\DATI APPLICAZIONI\M\LIST.OCT --> Eliminado Bagle
Restaurada Clave: "SafeBoot\Minimal y Network"
Reinicie para Completar la Limpieza.

Thu Nov 20 18:36:32 2008
EliBagle v11.97 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 17 de Noviembre del 2008)

Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Bagle (rootkit) Acceso Denegado.
C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Bagle.dldr Acceso Denegado.
C:\DOCUMENTS AND SETTINGS\PCMF.MF-CAKSV2APT278\DATI APPLICAZIONI\M\FLEC006.EXE --> Bagle.dldr Acceso Denegado.
Restaurada Clave: "SafeBoot\Minimal y Network"
Reinicie para Completar la Limpieza.

Thu Nov 20 18:41:39 2008
EliBagle v11.97 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 17 de Noviembre del 2008)

Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Eliminado Bagle (rootkit)
C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Eliminado Bagle.dldr
C:\DOCUMENTS AND SETTINGS\PCMF.MF-CAKSV2APT278\DATI APPLICAZIONI\M\FLEC006.EXE --> Eliminado Bagle.dldr
Restaurada Clave: "SafeBoot\Minimal y Network"

Thu Nov 20 18:42:41 2008
EliBagle v11.97 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 17 de Noviembre del 2008)

Lista de Acciones (por Exploración):
Explorando Unidad C:\
C:\Programmi\Google\GoogleToolbarNotifier\GOOGLETOOLBARNOTIFIER.EXE --> Eliminado Bagle.dldr
C:\WINDOWS\system32\SOUNDMAN.EXE --> Eliminado Bagle.dldr
C:\WINDOWS\system32\drivers\MDELK.EXE --> Eliminado Bagle.dldr

Nº Total de Directorios: 5849
Nº Total de Ficheros: 144377
Nº de Ficheros Analizados: 10695
Nº de Ficheros Infectados: 3
Nº de Ficheros Limpiados: 3
r16
Inviato: Thursday, November 20, 2008 11:18:33 PM
Rank: AiutAmico

Iscritto dal : 8/7/2007
Posts: 11,016
Scarica questo:Avenger, scompatta Avenger all'interno di una apposita cartella
http://swandog46.geekstogo.com/avenger.zip

Avvia AVENGER
Clicca Ok
Inserisci queste righe (fai capia-incolla) nel riquadro bianco: (quelle in rosso)


Files to delete:
C:\WINDOWS\system32\drivers\srosa.sys
C:\WINDOWS\system32\wintems.exe
C:\WINDOWS\system32\drivers\hldrrr.exe
C:\WINDOWS\system32\drivers\mdelk.exe
C:\WINDOWS\system32\mdelk.exe
C:\WINDOWS\SYSTEM32\BAN_LIST.TXT

registry keys to delete:
HKLM\SYSTEM\CurrentControlSet\Services\srosa
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
HKLM\SYSTEM\ControlSet001\Services\srosa
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA
HKLM\SYSTEM\ControlSet003\Services\srosa
HKLM\SYSTEM\ControlSet003\Enum\Root\LEGACY_SROSA
HKLM\SYSTEM\CurrentControlSet\Services\pci32
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32
HKLM\SYSTEM\ControlSet001\Services\pci32
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_PCI32
HKLM\SYSTEM\ControlSet003\Services\pci32
HKLM\SYSTEM\ControlSet003\Enum\Root\LEGACY_PCI32
HKLM\SYSTEM\CurrentControlSet\Services\rosa
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ROSA
HKLM\SYSTEM\ControlSet001\Services\rosa
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_ROSA
HKLM\SYSTEM\ControlSet003\Services\rosa
HKLM\SYSTEM\ControlSet003\Enum\Root\LEGACY_ROSA
HKLM\SYSTEM\CurrentControlSet\Services\m_hook
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_M_HOOK
HKLM\SYSTEM\ControlSet001\Services\m_hook
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_M_HOOK
HKLM\SYSTEM\ControlSet003\Services\m_hook
HKLM\SYSTEM\ControlSet003\Enum\Root\LEGACY_M_HOOK

registry values to delete:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run | drvsyskit
HKLM\Software\Microsoft\Windows\CurrentVersion\Run | mule_st_key


Clicca su Execute e attendi....
Il pc dovrebbe riavviarsi, se così non fosse, riavvialo tu.
Al termine dell'operazione, posta qui il risultato di Avenger .

*********************************************************************************************************


Importante: Disabilita il tuo antivirus e chiudi TUTTI i programmi aperti,e dopo aver scaricato COMBOFIX, chiudi la connessione.

Scarica Combofix
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Salvalo sul desktop.
Doppio click su combofix.exe (comparirà una videata.)
Digita 1 premi Invio e segui le indicazioni.
Al termine, verrà creato un file log chiamato C:\ComboFix.txt. Postalo qui.
Durante l'operazione di scansione è importante non usare il PC e attendere pazientemente la fine delle operazioni.
Posta un nuovo log di HijackThis .Sempre in questo topic.
Dimenticavo:
Hai eliminato i CRACK che hai scaricato da E-Mule ?
Altrimenti facciamo tutto per niente, il virus si rigenerebbe.
Kalachado
Inviato: Friday, November 21, 2008 12:44:49 AM
Rank: AiutAmico

Iscritto dal : 3/23/2005
Posts: 63
benissimo...
domani proverò il tutto e ti terrò informato!!
ciao notte..
Kalachado
Inviato: Friday, November 21, 2008 4:52:37 PM
Rank: AiutAmico

Iscritto dal : 3/23/2005
Posts: 63
ciao r16..eccomi qua col log di AVENGER come mi hai chiesto....


//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 2)
Fri Nov 21 16:45:39 2008

16:45:32: Warning: Skipping potentially dangerous line:
"HKLM\SYSTEM\CurrentControlSet\Services\rosa" (Registry key deletion mode)
16:45:39: Error: Execution aborted by user!


//////////////////////////////////////////


Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error: file "C:\WINDOWS\system32\drivers\srosa.sys" not found!
Deletion of file "C:\WINDOWS\system32\drivers\srosa.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\system32\wintems.exe" not found!
Deletion of file "C:\WINDOWS\system32\wintems.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\system32\drivers\hldrrr.exe" not found!
Deletion of file "C:\WINDOWS\system32\drivers\hldrrr.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\system32\drivers\mdelk.exe" not found!
Deletion of file "C:\WINDOWS\system32\drivers\mdelk.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\system32\mdelk.exe" not found!
Deletion of file "C:\WINDOWS\system32\mdelk.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\SYSTEM32\BAN_LIST.TXT" not found!
Deletion of file "C:\WINDOWS\SYSTEM32\BAN_LIST.TXT" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "HKLM\SYSTEM\CurrentControlSet\Services\srosa" not found!
Deletion of registry key "HKLM\SYSTEM\CurrentControlSet\Services\srosa" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

Registry key "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA" deleted successfully.

Error: registry key "HKLM\SYSTEM\ControlSet001\Services\srosa" not found!
Deletion of registry key "HKLM\SYSTEM\ControlSet001\Services\srosa" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA" not found!
Deletion of registry key "HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "HKLM\SYSTEM\ControlSet003\Services\srosa" not found!
Deletion of registry key "HKLM\SYSTEM\ControlSet003\Services\srosa" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "HKLM\SYSTEM\ControlSet003\Enum\Root\LEGACY_SROSA" not found!
Deletion of registry key "HKLM\SYSTEM\ControlSet003\Enum\Root\LEGACY_SROSA" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "HKLM\SYSTEM\CurrentControlSet\Services\pci32" not found!
Deletion of registry key "HKLM\SYSTEM\CurrentControlSet\Services\pci32" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32" not found!
Deletion of registry key "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "HKLM\SYSTEM\ControlSet001\Services\pci32" not found!
Deletion of registry key "HKLM\SYSTEM\ControlSet001\Services\pci32" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_PCI32" not found!
Deletion of registry key "HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_PCI32" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "HKLM\SYSTEM\ControlSet003\Services\pci32" not found!
Deletion of registry key "HKLM\SYSTEM\ControlSet003\Services\pci32" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "HKLM\SYSTEM\ControlSet003\Enum\Root\LEGACY_PCI32" not found!
Deletion of registry key "HKLM\SYSTEM\ControlSet003\Enum\Root\LEGACY_PCI32" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "HKLM\SYSTEM\CurrentControlSet\Services\rosa" not found!
Deletion of registry key "HKLM\SYSTEM\CurrentControlSet\Services\rosa" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ROSA" not found!
Deletion of registry key "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ROSA" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "HKLM\SYSTEM\ControlSet001\Services\rosa" not found!
Deletion of registry key "HKLM\SYSTEM\ControlSet001\Services\rosa" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_ROSA" not found!
Deletion of registry key "HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_ROSA" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "HKLM\SYSTEM\ControlSet003\Services\rosa" not found!
Deletion of registry key "HKLM\SYSTEM\ControlSet003\Services\rosa" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "HKLM\SYSTEM\ControlSet003\Enum\Root\LEGACY_ROSA" not found!
Deletion of registry key "HKLM\SYSTEM\ControlSet003\Enum\Root\LEGACY_ROSA" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "HKLM\SYSTEM\CurrentControlSet\Services\m_hook" not found!
Deletion of registry key "HKLM\SYSTEM\CurrentControlSet\Services\m_hook" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_M_HOOK" not found!
Deletion of registry key "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_M_HOOK" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "HKLM\SYSTEM\ControlSet001\Services\m_hook" not found!
Deletion of registry key "HKLM\SYSTEM\ControlSet001\Services\m_hook" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_M_HOOK" not found!
Deletion of registry key "HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_M_HOOK" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "HKLM\SYSTEM\ControlSet003\Services\m_hook" not found!
Deletion of registry key "HKLM\SYSTEM\ControlSet003\Services\m_hook" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "HKLM\SYSTEM\ControlSet003\Enum\Root\LEGACY_M_HOOK" not found!
Deletion of registry key "HKLM\SYSTEM\ControlSet003\Enum\Root\LEGACY_M_HOOK" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: could not delete registry value "HKLM\Software\Microsoft\Windows\CurrentVersion\Run|drvsyskit"
Deletion of registry value "HKLM\Software\Microsoft\Windows\CurrentVersion\Run|drvsyskit" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: could not delete registry value "HKLM\Software\Microsoft\Windows\CurrentVersion\Run|mule_st_key"
Deletion of registry value "HKLM\Software\Microsoft\Windows\CurrentVersion\Run|mule_st_key" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Completed script processing.

*******************

Finished! Terminate.

..più tardi ti mando quello di COMBOFIX come mi hai indicato tu!! a dopo...
Kalachado
Inviato: Friday, November 21, 2008 5:25:22 PM
Rank: AiutAmico

Iscritto dal : 3/23/2005
Posts: 63
...ed ecco il log di COMBOFIX e a seguire quello di hijack!!!!


ComboFix 08-11-20.02 - pcmf 2008-11-21 16.57.39.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1040.18.999 [GMT 1:00]
Eseguito da: c:\documents and settings\pcmf.MF-CAKSV2APT278\Desktop\ComboFix.exe
* Creato nuovo punto di ripristino
* Resident AV is active


ATENÇÃO - ESTA MAQUINA NAO TEM A CONSOLE DE RECUPERAÇÃO INSTALADA !!
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\pcmf.MF-CAKSV2APT278\Dati applicazioni\inst.exe
c:\documents and settings\pcmf.MF-CAKSV2APT278\Dati applicazioni\m
c:\documents and settings\pcmf.MF-CAKSV2APT278\Dati applicazioni\m\shared\Dhaatu
C:\InfoSat.txt
c:\windows\system32\_000055_.tmp.dll
c:\windows\system32\_000062_.tmp.dll
c:\windows\system32\_000073_.tmp.dll
c:\windows\system32\_003890_.tmp.dll
c:\windows\system32\_003893_.tmp.dll
c:\windows\system32\_003896_.tmp.dll
c:\windows\system32\_004064_.tmp.dll
c:\windows\system32\_004065_.tmp.dll
c:\windows\system32\_004066_.tmp.dll
c:\windows\system32\_004067_.tmp.dll
c:\windows\system32\_004069_.tmp.dll
c:\windows\system32\_004070_.tmp.dll
c:\windows\system32\_004073_.tmp.dll
c:\windows\system32\_004074_.tmp.dll
c:\windows\system32\_004076_.tmp.dll
c:\windows\system32\_004077_.tmp.dll
c:\windows\system32\_004078_.tmp.dll
c:\windows\system32\_004080_.tmp.dll
c:\windows\system32\_004081_.tmp.dll
c:\windows\system32\_004083_.tmp.dll
c:\windows\system32\_004087_.tmp.dll
c:\windows\system32\_004088_.tmp.dll
c:\windows\system32\_004090_.tmp.dll
c:\windows\system32\_004091_.tmp.dll
c:\windows\system32\_004093_.tmp.dll
c:\windows\system32\_004095_.tmp.dll
c:\windows\system32\_004096_.tmp.dll
c:\windows\system32\_004097_.tmp.dll
c:\windows\system32\_004098_.tmp.dll
c:\windows\system32\_004099_.tmp.dll
c:\windows\system32\_004102_.tmp.dll
c:\windows\system32\_004104_.tmp.dll
c:\windows\system32\_004105_.tmp.dll
c:\windows\system32\_004106_.tmp.dll
c:\windows\system32\_004110_.tmp.dll
c:\windows\system32\drivers\downld
c:\windows\system32\drivers\downld\100000.exe
c:\windows\system32\drivers\downld\100140.exe
c:\windows\system32\drivers\downld\100890.exe
c:\windows\system32\drivers\downld\1013296.exe
c:\windows\system32\drivers\downld\101343.exe
c:\windows\system32\drivers\downld\101390.exe
c:\windows\system32\drivers\downld\10179625.exe
c:\windows\system32\drivers\downld\10180375.exe
c:\windows\system32\drivers\downld\10222765.exe
c:\windows\system32\drivers\downld\10223671.exe
c:\windows\system32\drivers\downld\102531.exe
c:\windows\system32\drivers\downld\102546.exe
c:\windows\system32\drivers\downld\1026718.exe
c:\windows\system32\drivers\downld\102750.exe
c:\windows\system32\drivers\downld\102841140.exe
c:\windows\system32\drivers\downld\102842593.exe
c:\windows\system32\drivers\downld\102892718.exe
c:\windows\system32\drivers\downld\102896406.exe
c:\windows\system32\drivers\downld\102900406.exe
c:\windows\system32\drivers\downld\102947796.exe
c:\windows\system32\drivers\downld\102992437.exe
c:\windows\system32\drivers\downld\103009750.exe
c:\windows\system32\drivers\downld\103011875.exe
c:\windows\system32\drivers\downld\1031671.exe
c:\windows\system32\drivers\downld\103312.exe
c:\windows\system32\drivers\downld\10398781.exe
c:\windows\system32\drivers\downld\10399515.exe
c:\windows\system32\drivers\downld\104031.exe
c:\windows\system32\drivers\downld\10418406.exe
c:\windows\system32\drivers\downld\104187.exe
c:\windows\system32\drivers\downld\10424578.exe
c:\windows\system32\drivers\downld\104828.exe
c:\windows\system32\drivers\downld\105093.exe
c:\windows\system32\drivers\downld\10521812.exe
c:\windows\system32\drivers\downld\10533531.exe
c:\windows\system32\drivers\downld\10534359.exe
c:\windows\system32\drivers\downld\10539828.exe
c:\windows\system32\drivers\downld\105765.exe
c:\windows\system32\drivers\downld\10593203.exe
c:\windows\system32\drivers\downld\10596734.exe
c:\windows\system32\drivers\downld\10600421.exe
c:\windows\system32\drivers\downld\106093.exe
c:\windows\system32\drivers\downld\106125.exe
c:\windows\system32\drivers\downld\10641125.exe
c:\windows\system32\drivers\downld\106687.exe
c:\windows\system32\drivers\downld\106750.exe
c:\windows\system32\drivers\downld\10682906.exe
c:\windows\system32\drivers\downld\10691000.exe
c:\windows\system32\drivers\downld\106984.exe
c:\windows\system32\drivers\downld\107078.exe
c:\windows\system32\drivers\downld\107125.exe
c:\windows\system32\drivers\downld\107296.exe
c:\windows\system32\drivers\downld\107562.exe
c:\windows\system32\drivers\downld\107625.exe
c:\windows\system32\drivers\downld\107984.exe
c:\windows\system32\drivers\downld\108078.exe
c:\windows\system32\drivers\downld\108125.exe
c:\windows\system32\drivers\downld\108281.exe
c:\windows\system32\drivers\downld\108578.exe
c:\windows\system32\drivers\downld\108734.exe
c:\windows\system32\drivers\downld\108781.exe
c:\windows\system32\drivers\downld\108875.exe
c:\windows\system32\drivers\downld\109406.exe
c:\windows\system32\drivers\downld\109500.exe
c:\windows\system32\drivers\downld\109890.exe
c:\windows\system32\drivers\downld\109953.exe
c:\windows\system32\drivers\downld\110093.exe
c:\windows\system32\drivers\downld\110328.exe
c:\windows\system32\drivers\downld\110406.exe
c:\windows\system32\drivers\downld\110625.exe
c:\windows\system32\drivers\downld\110984.exe
c:\windows\system32\drivers\downld\111296.exe
c:\windows\system32\drivers\downld\111468.exe
c:\windows\system32\drivers\downld\111500.exe
c:\windows\system32\drivers\downld\112046.exe
c:\windows\system32\drivers\downld\112187.exe
c:\windows\system32\drivers\downld\112218.exe
c:\windows\system32\drivers\downld\112390.exe
c:\windows\system32\drivers\downld\112531.exe
c:\windows\system32\drivers\downld\112734.exe
c:\windows\system32\drivers\downld\112890.exe
c:\windows\system32\drivers\downld\112921.exe
c:\windows\system32\drivers\downld\112968.exe
c:\windows\system32\drivers\downld\113062.exe
c:\windows\system32\drivers\downld\1131734.exe
c:\windows\system32\drivers\downld\113468.exe
c:\windows\system32\drivers\downld\1136875.exe
c:\windows\system32\drivers\downld\1137625.exe
c:\windows\system32\drivers\downld\113843.exe
c:\windows\system32\drivers\downld\114046.exe
c:\windows\system32\drivers\downld\114156.exe
c:\windows\system32\drivers\downld\114406.exe
c:\windows\system32\drivers\downld\114750.exe
c:\windows\system32\drivers\downld\114953.exe
c:\windows\system32\drivers\downld\115109.exe
c:\windows\system32\drivers\downld\115406.exe
c:\windows\system32\drivers\downld\115421.exe
c:\windows\system32\drivers\downld\115515.exe
c:\windows\system32\drivers\downld\115531.exe
c:\windows\system32\drivers\downld\115593.exe
c:\windows\system32\drivers\downld\115703.exe
c:\windows\system32\drivers\downld\115828.exe
c:\windows\system32\drivers\downld\1165187.exe
c:\windows\system32\drivers\downld\1167734.exe
c:\windows\system32\drivers\downld\117171.exe
c:\windows\system32\drivers\downld\117234.exe
c:\windows\system32\drivers\downld\117445328.exe
c:\windows\system32\drivers\downld\117446453.exe
c:\windows\system32\drivers\downld\117472156.exe
c:\windows\system32\drivers\downld\117476453.exe
c:\windows\system32\drivers\downld\117480156.exe
c:\windows\system32\drivers\downld\117525390.exe
c:\windows\system32\drivers\downld\117577156.exe
c:\windows\system32\drivers\downld\117586312.exe
c:\windows\system32\drivers\downld\117588171.exe
c:\windows\system32\drivers\downld\117828.exe
c:\windows\system32\drivers\downld\117906.exe
c:\windows\system32\drivers\downld\118062.exe
c:\windows\system32\drivers\downld\118781.exe
c:\windows\system32\drivers\downld\119671.exe
c:\windows\system32\drivers\downld\119703.exe
c:\windows\system32\drivers\downld\119796.exe
c:\windows\system32\drivers\downld\120343.exe
c:\windows\system32\drivers\downld\120546.exe
c:\windows\system32\drivers\downld\120718.exe
c:\windows\system32\drivers\downld\121140.exe
c:\windows\system32\drivers\downld\121734.exe
c:\windows\system32\drivers\downld\1218156.exe
c:\windows\system32\drivers\downld\121843.exe
c:\windows\system32\drivers\downld\122859.exe
c:\windows\system32\drivers\downld\123093.exe
c:\windows\system32\drivers\downld\123343.exe
c:\windows\system32\drivers\downld\123531.exe
c:\windows\system32\drivers\downld\12408062.exe
c:\windows\system32\drivers\downld\12409250.exe
c:\windows\system32\drivers\downld\12434328.exe
c:\windows\system32\drivers\downld\12436687.exe
c:\windows\system32\drivers\downld\1246218.exe
c:\windows\system32\drivers\downld\12471953.exe
c:\windows\system32\drivers\downld\12472781.exe
c:\windows\system32\drivers\downld\12475656.exe
c:\windows\system32\drivers\downld\12487062.exe
c:\windows\system32\drivers\downld\12492437.exe
c:\windows\system32\drivers\downld\12493906.exe
c:\windows\system32\drivers\downld\125578.exe
c:\windows\system32\drivers\downld\125718.exe
c:\windows\system32\drivers\downld\125734.exe
c:\windows\system32\drivers\downld\12606484.exe
c:\windows\system32\drivers\downld\12607218.exe
c:\windows\system32\drivers\downld\126187.exe
c:\windows\system32\drivers\downld\12624359.exe
c:\windows\system32\drivers\downld\126328.exe
c:\windows\system32\drivers\downld\126828.exe
c:\windows\system32\drivers\downld\126843.exe
c:\windows\system32\drivers\downld\12694500.exe
c:\windows\system32\drivers\downld\12695218.exe
c:\windows\system32\drivers\downld\127078.exe
c:\windows\system32\drivers\downld\12735859.exe
c:\windows\system32\drivers\downld\12741625.exe
c:\windows\system32\drivers\downld\127421.exe
c:\windows\system32\drivers\downld\127687.exe
c:\windows\system32\drivers\downld\1276937.exe
c:\windows\system32\drivers\downld\127828.exe
c:\windows\system32\drivers\downld\1278468.exe
c:\windows\system32\drivers\downld\12842765.exe
c:\windows\system32\drivers\downld\12849921.exe
c:\windows\system32\drivers\downld\128500.exe
c:\windows\system32\drivers\downld\128750.exe
c:\windows\system32\drivers\downld\129000.exe
c:\windows\system32\drivers\downld\129093.exe
c:\windows\system32\drivers\downld\129593.exe
c:\windows\system32\drivers\downld\129656.exe
c:\windows\system32\drivers\downld\12987015.exe
c:\windows\system32\drivers\downld\12987750.exe
c:\windows\system32\drivers\downld\129921.exe
c:\windows\system32\drivers\downld\130265.exe
c:\windows\system32\drivers\downld\13034531.exe
c:\windows\system32\drivers\downld\13035218.exe
c:\windows\system32\drivers\downld\130640.exe
c:\windows\system32\drivers\downld\130906.exe
c:\windows\system32\drivers\downld\131390.exe
c:\windows\system32\drivers\downld\131484.exe
c:\windows\system32\drivers\downld\131500.exe
c:\windows\system32\drivers\downld\131562.exe
c:\windows\system32\drivers\downld\132025312.exe
c:\windows\system32\drivers\downld\132026500.exe
c:\windows\system32\drivers\downld\132050328.exe
c:\windows\system32\drivers\downld\132055968.exe
c:\windows\system32\drivers\downld\132064921.exe
c:\windows\system32\drivers\downld\132160781.exe
c:\windows\system32\drivers\downld\132170250.exe
c:\windows\system32\drivers\downld\132171984.exe
c:\windows\system32\drivers\downld\132328.exe
c:\windows\system32\drivers\downld\132390.exe
c:\windows\system32\drivers\downld\132578.exe
c:\windows\system32\drivers\downld\132687.exe
c:\windows\system32\drivers\downld\132781.exe
c:\windows\system32\drivers\downld\132796.exe
c:\windows\system32\drivers\downld\133046.exe
c:\windows\system32\drivers\downld\133078.exe
c:\windows\system32\drivers\downld\133218.exe
c:\windows\system32\drivers\downld\133906.exe
c:\windows\system32\drivers\downld\133984.exe
c:\windows\system32\drivers\downld\134062.exe
c:\windows\system32\drivers\downld\134093.exe
c:\windows\system32\drivers\downld\134140.exe
c:\windows\system32\drivers\downld\13425953.exe
c:\windows\system32\drivers\downld\134265.exe
c:\windows\system32\drivers\downld\13426687.exe
c:\windows\system32\drivers\downld\134640.exe
c:\windows\system32\drivers\downld\13477062.exe
c:\windows\system32\drivers\downld\13478671.exe
c:\windows\system32\drivers\downld\135046.exe
c:\windows\system32\drivers\downld\135218.exe
c:\windows\system32\drivers\downld\135234.exe
c:\windows\system32\drivers\downld\135328.exe
c:\windows\system32\drivers\downld\135406.exe
c:\windows\system32\drivers\downld\135687.exe
c:\windows\system32\drivers\downld\135703.exe
c:\windows\system32\drivers\downld\135765.exe
c:\windows\system32\drivers\downld\135781.exe
c:\windows\system32\drivers\downld\135953.exe
c:\windows\system32\drivers\downld\136468.exe
c:\windows\system32\drivers\downld\136484.exe
c:\windows\system32\drivers\downld\136515.exe
c:\windows\system32\drivers\downld\136671.exe
c:\windows\system32\drivers\downld\136843.exe
c:\windows\system32\drivers\downld\137296.exe
c:\windows\system32\drivers\downld\137796.exe
c:\windows\system32\drivers\downld\138421.exe
c:\windows\system32\drivers\downld\139937.exe
c:\windows\system32\drivers\downld\140125.exe
c:\windows\system32\drivers\downld\140328.exe
c:\windows\system32\drivers\downld\140718.exe
c:\windows\system32\drivers\downld\140781.exe
c:\windows\system32\drivers\downld\141890.exe
c:\windows\system32\drivers\downld\142796.exe
c:\windows\system32\drivers\downld\142968.exe
c:\windows\system32\drivers\downld\143171.exe
c:\windows\system32\drivers\downld\143328.exe
c:\windows\system32\drivers\downld\143890.exe
c:\windows\system32\drivers\downld\144000.exe
c:\windows\system32\drivers\downld\144531.exe
c:\windows\system32\drivers\downld\144796.exe
c:\windows\system32\drivers\downld\145406.exe
c:\windows\system32\drivers\downld\145515.exe
c:\windows\system32\drivers\downld\145828.exe
c:\windows\system32\drivers\downld\14587703.exe
c:\windows\system32\drivers\downld\14589093.exe
c:\windows\system32\drivers\downld\14596656.exe
c:\windows\system32\drivers\downld\14597437.exe
c:\windows\system32\drivers\downld\14599703.exe
c:\windows\system32\drivers\downld\14608109.exe
c:\windows\system32\drivers\downld\14608890.exe
c:\windows\system32\drivers\downld\14623968.exe
c:\windows\system32\drivers\downld\14624984.exe
c:\windows\system32\drivers\downld\14631562.exe
c:\windows\system32\drivers\downld\14632328.exe
c:\windows\system32\drivers\downld\14632937.exe
c:\windows\system32\drivers\downld\14635609.exe
c:\windows\system32\drivers\downld\14638171.exe
c:\windows\system32\drivers\downld\14640296.exe
c:\windows\system32\drivers\downld\146406.exe
c:\windows\system32\drivers\downld\14644531.exe
c:\windows\system32\drivers\downld\14646250.exe
c:\windows\system32\drivers\downld\14646859.exe
c:\windows\system32\drivers\downld\14648734.exe
c:\windows\system32\drivers\downld\14650453.exe
c:\windows\system32\drivers\downld\14651156.exe
c:\windows\system32\drivers\downld\14651234.exe
c:\windows\system32\drivers\downld\14651265.exe
c:\windows\system32\drivers\downld\14652000.exe
c:\windows\system32\drivers\downld\146594578.exe
c:\windows\system32\drivers\downld\146596609.exe
c:\windows\system32\drivers\downld\14660140.exe
c:\windows\system32\drivers\downld\14662562.exe
c:\windows\system32\drivers\downld\146657125.exe
c:\windows\system32\drivers\downld\146662796.exe
c:\windows\system32\drivers\downld\146666375.exe
c:\windows\system32\drivers\downld\146722750.exe
c:\windows\system32\drivers\downld\14673796.exe
c:\windows\system32\drivers\downld\14674625.exe
c:\windows\system32\drivers\downld\146766437.exe
c:\windows\system32\drivers\downld\14676906.exe
c:\windows\system32\drivers\downld\146776250.exe
c:\windows\system32\drivers\downld\146777937.exe
c:\windows\system32\drivers\downld\14680031.exe
c:\windows\system32\drivers\downld\14682640.exe
c:\windows\system32\drivers\downld\14683390.exe
c:\windows\system32\drivers\downld\14685734.exe
c:\windows\system32\drivers\downld\14686078.exe
c:\windows\system32\drivers\downld\14692437.exe
c:\windows\system32\drivers\downld\14693093.exe
c:\windows\system32\drivers\downld\14699500.exe
c:\windows\system32\drivers\downld\14699687.exe
c:\windows\system32\drivers\downld\14700453.exe
c:\windows\system32\drivers\downld\14702531.exe
c:\windows\system32\drivers\downld\14704421.exe
c:\windows\system32\drivers\downld\14706218.exe
c:\windows\system32\drivers\downld\14707562.exe
c:\windows\system32\drivers\downld\14707921.exe
c:\windows\system32\drivers\downld\14710734.exe
c:\windows\system32\drivers\downld\14710859.exe
c:\windows\system32\drivers\downld\14712265.exe
c:\windows\system32\drivers\downld\14719593.exe
c:\windows\system32\drivers\downld\147218.exe
c:\windows\system32\drivers\downld\14724500.exe
c:\windows\system32\drivers\downld\14725296.exe
c:\windows\system32\drivers\downld\14728171.exe
c:\windows\system32\drivers\downld\14732140.exe
c:\windows\system32\drivers\downld\14732921.exe
c:\windows\system32\drivers\downld\14734656.exe
c:\windows\system32\drivers\downld\14739875.exe
c:\windows\system32\drivers\downld\147437.exe
c:\windows\system32\drivers\downld\14746359.exe
c:\windows\system32\drivers\downld\14746421.exe
c:\windows\system32\drivers\downld\14746687.exe
c:\windows\system32\drivers\downld\14748828.exe
c:\windows\system32\drivers\downld\14751234.exe
c:\windows\system32\drivers\downld\14756640.exe
c:\windows\system32\drivers\downld\14762296.exe
c:\windows\system32\drivers\downld\14766421.exe
c:\windows\system32\drivers\downld\14770796.exe
c:\windows\system32\drivers\downld\14771218.exe
c:\windows\system32\drivers\downld\14772062.exe
c:\windows\system32\drivers\downld\14778406.exe
c:\windows\system32\drivers\downld\14778734.exe
c:\windows\system32\drivers\downld\14779796.exe
c:\windows\system32\drivers\downld\14779890.exe
c:\windows\system32\drivers\downld\14781812.exe
c:\windows\system32\drivers\downld\14783015.exe
c:\windows\system32\drivers\downld\14785750.exe
c:\windows\system32\drivers\downld\14797953.exe
c:\windows\system32\drivers\downld\148000.exe
c:\windows\system32\drivers\downld\14802140.exe
c:\windows\system32\drivers\downld\148046.exe
c:\windows\system32\drivers\downld\148078.exe
c:\windows\system32\drivers\downld\14809218.exe
c:\windows\system32\drivers\downld\14811937.exe
c:\windows\system32\drivers\downld\14812937.exe
c:\windows\system32\drivers\downld\14817078.exe
c:\windows\system32\drivers\downld\148234.exe
c:\windows\system32\drivers\downld\14824109.exe
c:\windows\system32\drivers\downld\148250.exe
c:\windows\system32\drivers\downld\148296.exe
c:\windows\system32\drivers\downld\14836515.exe
c:\windows\system32\drivers\downld\14839093.exe
c:\windows\system32\drivers\downld\14839843.exe
c:\windows\system32\drivers\downld\14840156.exe
c:\windows\system32\drivers\downld\14842234.exe
c:\windows\system32\drivers\downld\14843953.exe
c:\windows\system32\drivers\downld\14845890.exe
c:\windows\system32\drivers\downld\14846734.exe
c:\windows\system32\drivers\downld\14849453.exe
c:\windows\system32\drivers\downld\14856468.exe
c:\windows\system32\drivers\downld\14856968.exe
c:\windows\system32\drivers\downld\148609.exe
c:\windows\system32\drivers\downld\148640.exe
c:\windows\system32\drivers\downld\14871562.exe
c:\windows\system32\drivers\downld\14876546.exe
c:\windows\system32\drivers\downld\14892937.exe
c:\windows\system32\drivers\downld\14895968.exe
c:\windows\system32\drivers\downld\14912546.exe
c:\windows\system32\drivers\downld\149203.exe
c:\windows\system32\drivers\downld\14971687.exe
c:\windows\system32\drivers\downld\149750.exe
c:\windows\system32\drivers\downld\14976390.exe
c:\windows\system32\drivers\downld\14991609.exe
c:\windows\system32\drivers\downld\15000125.exe
c:\windows\system32\drivers\downld\150015.exe
c:\windows\system32\drivers\downld\15019859.exe
c:\windows\system32\drivers\downld\15038843.exe
c:\windows\system32\drivers\downld\150625.exe
c:\windows\system32\drivers\downld\150703.exe
c:\windows\system32\drivers\downld\15084875.exe
c:\windows\system32\drivers\downld\15098843.exe
c:\windows\system32\drivers\downld\151109.exe
c:\windows\system32\drivers\downld\15139578.exe
c:\windows\system32\drivers\downld\151546.exe
c:\windows\system32\drivers\downld\151593.exe
c:\windows\system32\drivers\downld\152187.exe
c:\windows\system32\drivers\downld\15231109.exe
c:\windows\system32\drivers\downld\152312.exe
c:\windows\system32\drivers\downld\15232375.exe
c:\windows\system32\drivers\downld\15260421.exe
c:\windows\system32\drivers\downld\15261328.exe
c:\windows\system32\drivers\downld\152656.exe
c:\windows\system32\drivers\downld\15281500.exe
c:\windows\system32\drivers\downld\15283046.exe
c:\windows\system32\drivers\downld\15283531.exe
c:\windows\system32\drivers\downld\15284281.exe
c:\windows\system32\drivers\downld\15294343.exe
c:\windows\system32\drivers\downld\152953.exe
c:\windows\system32\drivers\downld\15297328.exe
c:\windows\system32\drivers\downld\153203.exe
c:\windows\system32\drivers\downld\15323406.exe
c:\windows\system32\drivers\downld\15330156.exe
c:\windows\system32\drivers\downld\15331000.exe
c:\windows\system32\drivers\downld\15337875.exe
c:\windows\system32\drivers\downld\153531.exe
c:\windows\system32\drivers\downld\153546.exe
c:\windows\system32\drivers\downld\153562.exe
c:\windows\system32\drivers\downld\15370781.exe
c:\windows\system32\drivers\downld\15376421.exe
c:\windows\system32\drivers\downld\15379812.exe
c:\windows\system32\drivers\downld\15381562.exe
c:\windows\system32\drivers\downld\15391468.exe
c:\windows\system32\drivers\downld\153921.exe
c:\windows\system32\drivers\downld\15400218.exe
c:\windows\system32\drivers\downld\15401765.exe
c:\windows\system32\drivers\downld\154046.exe
c:\windows\system32\drivers\downld\154484.exe
c:\windows\system32\drivers\downld\154578.exe
c:\windows\system32\drivers\downld\154593.exe
c:\windows\system32\drivers\downld\15466125.exe
c:\windows\system32\drivers\downld\154671.exe
c:\windows\system32\drivers\downld\15468234.exe
c:\windows\system32\drivers\downld\15481109.exe
c:\windows\system32\drivers\downld\154812.exe
c:\windows\system32\drivers\downld\15500875.exe
c:\windows\system32\drivers\downld\15504109.exe
c:\windows\system32\drivers\downld\15508859.exe
c:\windows\system32\drivers\downld\15510671.exe
c:\windows\system32\drivers\downld\155140.exe
c:\windows\system32\drivers\downld\155812.exe
c:\windows\system32\drivers\downld\15609078.exe
c:\windows\system32\drivers\downld\15619859.exe
c:\windows\system32\drivers\downld\156203.exe
c:\windows\system32\drivers\downld\156328.exe
c:\windows\system32\drivers\downld\156375.exe
c:\windows\system32\drivers\downld\157078.exe
c:\windows\system32\drivers\downld\157625.exe
c:\windows\system32\drivers\downld\157734.exe
c:\windows\system32\drivers\downld\157781.exe
c:\windows\system32\drivers\downld\157984.exe
c:\windows\system32\drivers\downld\158281.exe
c:\windows\system32\drivers\downld\158328.exe
c:\windows\system32\drivers\downld\158750.exe
c:\windows\system32\drivers\downld\158968.exe
c:\windows\system32\drivers\downld\159406.exe
c:\windows\system32\drivers\downld\159531.exe
c:\windows\system32\drivers\downld\159578.exe
c:\windows\system32\drivers\downld\159640.exe
c:\windows\system32\drivers\downld\160015.exe
c:\windows\system32\drivers\downld\160328.exe
c:\windows\system32\drivers\downld\160437.exe
c:\windows\system32\drivers\downld\160968.exe
c:\windows\system32\drivers\downld\161031.exe
c:\windows\system32\drivers\downld\161237765.exe
c:\windows\system32\drivers\downld\161239140.exe
c:\windows\system32\drivers\downld\161273859.exe
c:\windows\system32\drivers\downld\161277078.exe
c:\windows\system32\drivers\downld\161281093.exe
c:\windows\system32\drivers\downld\161334546.exe
c:\windows\system32\drivers\downld\161395203.exe
c:\windows\system32\drivers\downld\161411031.exe
c:\windows\system32\drivers\downld\161418671.exe
c:\windows\system32\drivers\downld\161453.exe
c:\windows\system32\drivers\downld\161562.exe
c:\windows\system32\drivers\downld\161578.exe
c:\windows\system32\drivers\downld\161796.exe
c:\windows\system32\drivers\downld\161812.exe
c:\windows\system32\drivers\downld\162140.exe
c:\windows\system32\drivers\downld\162187.exe
c:\windows\system32\drivers\downld\162218.exe
c:\windows\system32\drivers\downld\162734.exe
c:\windows\system32\drivers\downld\162968.exe
c:\windows\system32\drivers\downld\163031.exe
c:\windows\system32\drivers\downld\163046.exe
c:\windows\system32\drivers\downld\163171.exe
c:\windows\system32\drivers\downld\163703.exe
c:\windows\system32\drivers\downld\163765.exe
c:\windows\system32\drivers\downld\163843.exe
c:\windows\system32\drivers\downld\163906.exe
c:\windows\system32\drivers\downld\163953.exe
c:\windows\system32\drivers\downld\163984.exe
c:\windows\system32\drivers\downld\164421.exe
c:\windows\system32\drivers\downld\164500.exe
c:\windows\system32\drivers\downld\164515.exe
c:\windows\system32\drivers\downld\164656.exe
c:\windows\system32\drivers\downld\165140.exe
c:\windows\system32\drivers\downld\1655296.exe
c:\windows\system32\drivers\downld\1656250.exe
c:\windows\system32\drivers\downld\165984.exe
c:\windows\system32\drivers\downld\166625.exe
c:\windows\system32\drivers\downld\166843.exe
c:\windows\system32\drivers\downld\166984.exe
c:\windows\system32\drivers\downld\167109.exe
c:\windows\system32\drivers\downld\167203.exe
c:\windows\system32\drivers\downld\168015.exe
c:\windows\system32\drivers\downld\168093.exe
c:\windows\system32\drivers\downld\168187.exe
c:\windows\system32\drivers\downld\168390.exe
c:\windows\system32\drivers\downld\168921.exe
c:\windows\system32\drivers\downld\169031.exe
c:\windows\system32\drivers\downld\169515.exe
c:\windows\system32\drivers\downld\169609.exe
c:\windows\system32\drivers\downld\169968.exe
c:\windows\system32\drivers\downld\170031.exe
c:\windows\system32\drivers\downld\170265.exe
c:\windows\system32\drivers\downld\170281.exe
c:\windows\system32\drivers\downld\170312.exe
c:\windows\system32\drivers\downld\170531.exe
c:\windows\system32\drivers\downld\170906.exe
c:\windows\system32\drivers\downld\171046.exe
c:\windows\system32\drivers\downld\171093.exe
c:\windows\system32\drivers\downld\171140.exe
c:\windows\system32\drivers\downld\171593.exe
c:\windows\system32\drivers\downld\171671.exe
c:\windows\system32\drivers\downld\171718.exe
c:\windows\system32\drivers\downld\172312.exe
c:\windows\system32\drivers\downld\172484.exe
c:\windows\system32\drivers\downld\172625.exe
c:\windows\system32\drivers\downld\173312.exe
c:\windows\system32\drivers\downld\173406.exe
c:\windows\system32\drivers\downld\173437.exe
c:\windows\system32\drivers\downld\174218.exe
c:\windows\system32\drivers\downld\175328.exe
c:\windows\system32\drivers\downld\175718.exe
c:\windows\system32\drivers\downld\176687.exe
c:\windows\system32\drivers\downld\176828.exe
c:\windows\system32\drivers\downld\177000.exe
c:\windows\system32\drivers\downld\177453.exe
c:\windows\system32\drivers\downld\178250.exe
c:\windows\system32\drivers\downld\178406.exe
c:\windows\system32\drivers\downld\179078.exe
c:\windows\system32\drivers\downld\179421.exe
c:\windows\system32\drivers\downld\179546.exe
c:\windows\system32\drivers\downld\179593.exe
c:\windows\system32\drivers\downld\179890.exe
c:\windows\system32\drivers\downld\180343.exe
c:\windows\system32\drivers\downld\180625.exe
c:\windows\system32\drivers\downld\181843.exe
c:\windows\system32\drivers\downld\1818890.exe
c:\windows\system32\drivers\downld\181906.exe
c:\windows\system32\drivers\downld\181937.exe
c:\windows\system32\drivers\downld\1821000.exe
c:\windows\system32\drivers\downld\182171.exe
c:\windows\system32\drivers\downld\182343.exe
c:\windows\system32\drivers\downld\182468.exe
c:\windows\system32\drivers\downld\182687.exe
c:\windows\system32\drivers\downld\182703.exe
c:\windows\system32\drivers\downld\182812.exe
c:\windows\system32\drivers\downld\18281281.exe
c:\windows\system32\drivers\downld\18284937.exe
c:\windows\system32\drivers\downld\182984.exe
c:\windows\system32\drivers\downld\18324406.exe
c:\windows\system32\drivers\downld\18330343.exe
c:\windows\system32\drivers\downld\184078.exe
c:\windows\system32\drivers\downld\18457218.exe
c:\windows\system32\drivers\downld\18466156.exe
c:\windows\system32\drivers\downld\184671.exe
c:\windows\system32\drivers\downld\184718.exe
c:\windows\system32\drivers\downld\184781.exe
c:\windows\system32\drivers\downld\184859.exe
c:\windows\system32\drivers\downld\184875.exe
c:\windows\system32\drivers\downld\18496859.exe
c:\windows\system32\drivers\downld\184984.exe
c:\windows\system32\drivers\downld\185078.exe
c:\windows\system32\drivers\downld\1852265.exe
c:\windows\system32\drivers\downld\185312.exe
c:\windows\system32\drivers\downld\185921.exe
c:\windows\system32\drivers\downld\1859578.exe
c:\windows\system32\drivers\downld\186390.exe
c:\windows\system32\drivers\downld\186968.exe
c:\windows\system32\drivers\downld\187203.exe
c:\windows\system32\drivers\downld\187218.exe
c:\windows\system32\drivers\downld\187234.exe
c:\windows\system32\drivers\downld\188031.exe
c:\windows\system32\drivers\downld\188453.exe
c:\windows\system32\drivers\downld\188859.exe
c:\windows\system32\drivers\downld\1890171.exe
c:\windows\system32\drivers\downld\189062.exe
c:\windows\system32\drivers\downld\1890921.exe
c:\windows\system32\drivers\downld\189234.exe
c:\windows\system32\drivers\downld\189406.exe
c:\windows\system32\drivers\downld\189453.exe
c:\windows\system32\drivers\downld\189718.exe
c:\windows\system32\drivers\downld\189781.exe
c:\windows\system32\drivers\downld\189937.exe
c:\windows\system32\drivers\downld\1901093.exe
c:\windows\system32\drivers\downld\191234.exe
c:\windows\system32\drivers\downld\191953.exe
c:\windows\system32\drivers\downld\1922500.exe
c:\windows\system32\drivers\downld\1925453.exe
c:\windows\system32\drivers\downld\192671.exe
c:\windows\system32\drivers\downld\192890.exe
c:\windows\system32\drivers\downld\193359.exe
c:\windows\system32\drivers\downld\193468.exe
c:\windows\system32\drivers\downld\1937015.exe
c:\windows\system32\drivers\downld\193734.exe
c:\windows\system32\drivers\downld\194312.exe
c:\windows\system32\drivers\downld\1953750.exe
c:\windows\system32\drivers\downld\195531.exe
c:\windows\system32\drivers\downld\195546.exe
c:\windows\system32\drivers\downld\195906.exe
c:\windows\system32\drivers\downld\196093.exe
c:\windows\system32\drivers\downld\196234.exe
c:\windows\system32\drivers\downld\196781.exe
c:\windows\system32\drivers\downld\197296.exe
c:\windows\system32\drivers\downld\197453.exe
c:\windows\system32\drivers\downld\197937.exe
c:\windows\system32\drivers\downld\19831468.exe
c:\windows\system32\drivers\downld\19839812.exe
c:\windows\system32\drivers\downld\19840937.exe
c:\windows\system32\drivers\downld\19897796.exe
c:\windows\system32\drivers\downld\19905359.exe
c:\windows\system32\drivers\downld\19908406.exe
c:\windows\system32\drivers\downld\1995406.exe
c:\windows\system32\drivers\downld\19955828.exe
c:\windows\system32\drivers\downld\19995375.exe
c:\windows\system32\drivers\downld\20008265.exe
c:\windows\system32\drivers\downld\200140.exe
c:\windows\system32\drivers\downld\2002406.exe
c:\windows\system32\drivers\downld\200468.exe
c:\windows\system32\drivers\downld\200484.exe
c:\windows\system32\drivers\downld\200812.exe
c:\windows\system32\drivers\downld\201375.exe
c:\windows\system32\drivers\downld\202015.exe
c:\windows\system32\drivers\downld\202093.exe
c:\windows\system32\drivers\downld\202250.exe
c:\windows\system32\drivers\downld\203046.exe
c:\windows\system32\drivers\downld\203296.exe
c:\windows\system32\drivers\downld\203562.exe
c:\windows\system32\drivers\downld\203734.exe
c:\windows\system32\drivers\downld\204046.exe
c:\windows\system32\drivers\downld\204421.exe
c:\windows\system32\drivers\downld\204609.exe
c:\windows\system32\drivers\downld\204875.exe
c:\windows\system32\drivers\downld\205265.exe
c:\windows\system32\drivers\downld\205578.exe
c:\windows\system32\drivers\downld\205875.exe
c:\windows\system32\drivers\downld\205890.exe
c:\windows\system32\drivers\downld\205937.exe
c:\windows\system32\drivers\downld\206515.exe
c:\windows\system32\drivers\downld\206640.exe
c:\windows\system32\drivers\downld\207234.exe
c:\windows\system32\drivers\downld\207484.exe
c:\windows\system32\drivers\downld\207812.exe
c:\windows\system32\drivers\downld\208000.exe
c:\windows\system32\drivers\downld\208218.exe
c:\windows\system32\drivers\downld\208250.exe
c:\windows\system32\drivers\downld\208406.exe
c:\windows\system32\drivers\downld\209750.exe
c:\windows\system32\drivers\downld\210187.exe
c:\windows\system32\drivers\downld\210437.exe
c:\windows\system32\drivers\downld\210453.exe
c:\windows\system32\drivers\downld\211093.exe
c:\windows\system32\drivers\downld\212343.exe
c:\windows\system32\drivers\downld\212531.exe
c:\windows\system32\drivers\downld\213390.exe
c:\windows\system32\drivers\downld\214703.exe
c:\windows\system32\drivers\downld\215125.exe
c:\windows\system32\drivers\downld\215156.exe
c:\windows\system32\drivers\downld\215484.exe
c:\windows\system32\drivers\downld\216609.exe
c:\windows\system32\drivers\downld\216718.exe
c:\windows\system32\drivers\downld\217187.exe
c:\windows\system32\drivers\downld\217437.exe
c:\windows\system32\drivers\downld\218218.exe
c:\windows\system32\drivers\downld\219468.exe
c:\windows\system32\drivers\downld\219984.exe
c:\windows\system32\drivers\downld\220312.exe
c:\windows\system32\drivers\downld\220390.exe
c:\windows\system32\drivers\downld\220984.exe
c:\windows\system32\drivers\downld\221609.exe
c:\windows\system32\drivers\downld\221843.exe
c:\windows\system32\drivers\downld\222234.exe
c:\windows\system32\drivers\downld\222437.exe
c:\windows\system32\drivers\downld\223468.exe
c:\windows\system32\drivers\downld\225406.exe
c:\windows\system32\drivers\downld\225750.exe
c:\windows\system32\drivers\downld\226312.exe
c:\windows\system32\drivers\downld\226406.exe
c:\windows\system32\drivers\downld\226546.exe
c:\windows\system32\drivers\downld\226750.exe
c:\windows\system32\drivers\downld\226906.exe
c:\windows\system32\drivers\downld\227046.exe
c:\windows\system32\drivers\downld\227734.exe
c:\windows\system32\drivers\downld\227875.exe
c:\windows\system32\drivers\downld\228156.exe
c:\windows\system32\drivers\downld\228437.exe
c:\windows\system32\drivers\downld\229750.exe
c:\windows\system32\drivers\downld\229843.exe
c:\windows\system32\drivers\downld\230484.exe
c:\windows\system32\drivers\downld\231375.exe
c:\windows\system32\drivers\downld\231750.exe
c:\windows\system32\drivers\downld\233250.exe
c:\windows\system32\drivers\downld\233796.exe
c:\windows\system32\drivers\downld\233828.exe
c:\windows\system32\drivers\downld\233859.exe
c:\windows\system32\drivers\downld\234312.exe
c:\windows\system32\drivers\downld\234437.exe
c:\windows\system32\drivers\downld\235031.exe
c:\windows\system32\drivers\downld\235093.exe
c:\windows\system32\drivers\downld\235140.exe
c:\windows\system32\drivers\downld\235468.exe
c:\windows\system32\drivers\downld\235515.exe
c:\windows\system32\drivers\downld\235937.exe
c:\windows\system32\drivers\downld\236468.exe
c:\windows\system32\drivers\downld\237078.exe
c:\windows\system32\drivers\downld\237093.exe
c:\windows\system32\drivers\downld\237156.exe
c:\windows\system32\drivers\downld\238328.exe
c:\windows\system32\drivers\downld\239125.exe
c:\windows\system32\drivers\downld\239406.exe
c:\windows\system32\drivers\downld\239468.exe
c:\windows\system32\drivers\downld\240593.exe
c:\windows\system32\drivers\downld\241218.exe
c:\windows\system32\drivers\downld\241968.exe
c:\windows\system32\drivers\downld\242281.exe
c:\windows\system32\drivers\downld\242296.exe
c:\windows\system32\drivers\downld\242906.exe
c:\windows\system32\drivers\downld\243109.exe
c:\windows\system32\drivers\downld\243484.exe
c:\windows\system32\drivers\downld\244015.exe
c:\windows\system32\drivers\downld\244343.exe
c:\windows\system32\drivers\downld\244937.exe
c:\windows\system32\drivers\downld\245500.exe
c:\windows\system32\drivers\downld\245750.exe
c:\windows\system32\drivers\downld\246484.exe
c:\windows\system32\drivers\downld\247250.exe
c:\windows\system32\drivers\downld\248218.exe
c:\windows\system32\drivers\downld\248453.exe
c:\windows\system32\drivers\downld\248718.exe
c:\windows\system32\drivers\downld\250218.exe
c:\windows\system32\drivers\downld\250484.exe
c:\windows\system32\drivers\downld\251031.exe
c:\windows\system32\drivers\downld\251578.exe
c:\windows\system32\drivers\downld\251687.exe
c:\windows\system32\drivers\downld\252218.exe
c:\windows\system32\drivers\downld\252921.exe
c:\windows\system32\drivers\downld\252968.exe
c:\windows\system32\drivers\downld\254281.exe
c:\windows\system32\drivers\downld\254953.exe
c:\windows\system32\drivers\downld\255953.exe
c:\windows\system32\drivers\downld\256125.exe
c:\windows\system32\drivers\downld\256859.exe
c:\windows\system32\drivers\downld\256906.exe
c:\windows\system32\drivers\downld\257296.exe
c:\windows\system32\drivers\downld\258984.exe
c:\windows\system32\drivers\downld\259765.exe
c:\windows\system32\drivers\downld\260171.exe
c:\windows\system32\drivers\downld\260937.exe
c:\windows\system32\drivers\downld\261500.exe
c:\windows\system32\drivers\downld\262515.exe
c:\windows\system32\drivers\downld\262546.exe
c:\windows\system32\drivers\downld\262750.exe
c:\windows\system32\drivers\downld\264718.exe
c:\windows\system32\drivers\downld\264734.exe
c:\windows\system32\drivers\downld\265750.exe
c:\windows\system32\drivers\downld\266625.exe
c:\windows\system32\drivers\downld\266781.exe
c:\windows\system32\drivers\downld\266859.exe
c:\windows\system32\drivers\downld\267593.exe
c:\windows\system32\drivers\downld\267890.exe
c:\windows\system32\drivers\downld\269171.exe
c:\windows\system32\drivers\downld\269671.exe
c:\windows\system32\drivers\downld\270843.exe
c:\windows\system32\drivers\downld\272156.exe
c:\windows\system32\drivers\downld\273921.exe
c:\windows\system32\drivers\downld\274187.exe
c:\windows\system32\drivers\downld\274750.exe
c:\windows\system32\drivers\downld\274984.exe
c:\windows\system32\drivers\downld\275609.exe
c:\windows\system32\drivers\downld\276593.exe
c:\windows\system32\drivers\downld\276953.exe
c:\windows\system32\drivers\downld\277406.exe
c:\windows\system32\drivers\downld\277875.exe
c:\windows\system32\drivers\downld\279500.exe
c:\windows\system32\drivers\downld\279546.exe
c:\windows\system32\drivers\downld\280562.exe
c:\windows\system32\drivers\downld\283296.exe
c:\windows\system32\drivers\downld\283359.exe
c:\windows\system32\drivers\downld\283500.exe
c:\windows\system32\drivers\downld\283921.exe
c:\windows\system32\drivers\downld\286171.exe
c:\windows\system32\drivers\downld\287937.exe
c:\windows\system32\drivers\downld\288234.exe
c:\windows\system32\drivers\downld\290406.exe
c:\windows\system32\drivers\downld\291343.exe
c:\windows\system32\drivers\downld\29256812.exe
c:\windows\system32\drivers\downld\29265531.exe
c:\windows\system32\drivers\downld\29312781.exe
c:\windows\system32\drivers\downld\29314937.exe
c:\windows\system32\drivers\downld\29342750.exe
c:\windows\system32\drivers\downld\29347875.exe
c:\windows\system32\drivers\downld\29352484.exe
c:\windows\system32\drivers\downld\29358265.exe
c:\windows\system32\drivers\downld\293609.exe
c:\windows\system32\drivers\downld\29368421.exe
c:\windows\system32\drivers\downld\29393000.exe
c:\windows\system32\drivers\downld\29409265.exe
c:\windows\system32\drivers\downld\29457593.exe
c:\windows\system32\drivers\downld\29466421.exe
c:\windows\system32\drivers\downld\29469015.exe
c:\windows\system32\drivers\downld\295093.exe
c:\windows\system32\drivers\downld\29522281.exe
c:\windows\system32\drivers\downld\29523640.exe
c:\windows\system32\drivers\downld\29526656.exe
c:\windows\system32\drivers\downld\29602593.exe
c:\windows\system32\drivers\downld\29602953.exe
c:\windows\system32\drivers\downld\29607968.exe
c:\windows\system32\drivers\downld\29610265.exe
c:\windows\system32\drivers\downld\29648281.exe
c:\windows\system32\drivers\downld\29649015.exe
c:\windows\system32\drivers\downld\29650000.exe
c:\windows\system32\drivers\downld\29658078.exe
c:\windows\system32\drivers\downld\29659328.exe
c:\windows\system32\drivers\downld\29698390.exe
c:\windows\system32\drivers\downld\297078.exe
c:\windows\system32\drivers\downld\29713281.exe
c:\windows\system32\drivers\downld\29730296.exe
c:\windows\system32\drivers\downld\29767421.exe
c:\windows\system32\drivers\downld\29785203.exe
c:\windows\system32\drivers\downld\29813703.exe
c:\windows\system32\drivers\downld\29822593.exe
c:\windows\system32\drivers\downld\29825593.exe
c:\windows\system32\drivers\downld\298343.exe
c:\windows\system32\drivers\downld\29854734.exe
c:\windows\system32\drivers\downld\29858546.exe
c:\windows\system32\drivers\downld\29890734.exe
c:\windows\system32\drivers\downld\29904921.exe
c:\windows\system32\drivers\downld\29922781.exe
c:\windows\system32\drivers\downld\29933828.exe
c:\windows\system32\drivers\downld\29934734.exe
c:\windows\system32\drivers\downld\29946109.exe
c:\windows\system32\drivers\downld\29957921.exe
c:\windows\system32\drivers\downld\29960734.exe
c:\windows\system32\drivers\downld\29962171.exe
c:\windows\system32\drivers\downld\29963906.exe
c:\windows\system32\drivers\downld\29966937.exe
c:\windows\system32\drivers\downld\29973015.exe
c:\windows\system32\drivers\downld\30003515.exe
c:\windows\system32\drivers\downld\300421.exe
c:\windows\system32\drivers\downld\30069593.exe
c:\windows\system32\drivers\downld\30086921.exe
c:\windows\system32\drivers\downld\304375.exe
c:\windows\system32\drivers\downld\304812.exe
c:\windows\system32\drivers\downld\305421.exe
c:\windows\system32\drivers\downld\305453.exe
c:\windows\system32\drivers\downld\305765.exe
c:\windows\system32\drivers\downld\306578.exe
c:\windows\system32\drivers\downld\307890.exe
c:\windows\system32\drivers\downld\308828.exe
c:\windows\system32\drivers\downld\308953.exe
c:\windows\system32\drivers\downld\309796.exe
c:\windows\system32\drivers\downld\312921.exe
c:\windows\system32\drivers\downld\314015.exe
c:\windows\system32\drivers\downld\314125.exe
c:\windows\system32\drivers\downld\314343.exe
c:\windows\system32\drivers\downld\319859.exe
c:\windows\system32\drivers\downld\325250.exe
c:\windows\system32\drivers\downld\325828.exe
c:\windows\system32\drivers\downld\327921.exe
c:\windows\system32\drivers\downld\32975984.exe
c:\windows\system32\drivers\downld\32977031.exe
c:\windows\system32\drivers\downld\33020265.exe
c:\windows\system32\drivers\downld\33025703.exe
c:\windows\system32\drivers\downld\33099578.exe
c:\windows\system32\drivers\downld\33103750.exe
c:\windows\system32\drivers\downld\33109406.exe
c:\windows\system32\drivers\downld\331166687.exe
c:\windows\system32\drivers\downld\331167859.exe
c:\windows\system32\drivers\downld\331176078.exe
c:\windows\system32\drivers\downld\331185906.exe
c:\windows\system32\drivers\downld\331195500.exe
c:\windows\system32\drivers\downld\331199921.exe
c:\windows\system32\drivers\downld\331245953.exe
c:\windows\system32\drivers\downld\331266234.exe
c:\windows\system32\drivers\downld\331275140.exe
c:\windows\system32\drivers\downld\333507250.exe
c:\windows\system32\drivers\downld\333511546.exe
c:\windows\system32\drivers\downld\333595234.exe
c:\windows\system32\drivers\downld\333612500.exe
c:\windows\system32\drivers\downld\333624796.exe
c:\windows\system32\drivers\downld\333707406.exe
c:\windows\system32\drivers\downld\333765828.exe
c:\windows\system32\drivers\downld\333805531.exe
c:\windows\system32\drivers\downld\335303875.exe
c:\windows\system32\drivers\downld\335308703.exe
c:\windows\system32\drivers\downld\335354109.exe
c:\windows\system32\drivers\downld\335357546.exe
c:\windows\system32\drivers\downld\335407109.exe
c:\windows\system32\drivers\downld\335437703.exe
c:\windows\system32\drivers\downld\335456031.exe
c:\windows\system32\drivers\downld\337062.exe
c:\windows\system32\drivers\downld\338593.exe
c:\windows\system32\drivers\downld\339968.exe
c:\windows\system32\drivers\downld\343390.exe
c:\windows\system32\drivers\downld\34421515.exe
c:\windows\system32\drivers\downld\34429531.exe
c:\windows\system32\drivers\downld\34430937.exe
c:\windows\system32\drivers\downld\34492515.exe
c:\windows\system32\drivers\downld\34509609.exe
c:\windows\system32\drivers\downld\34516140.exe
c:\windows\system32\drivers\downld\34558062.exe
c:\windows\system32\drivers\downld\34615703.exe
c:\windows\system32\drivers\downld\34628531.exe
c:\windows\system32\drivers\downld\347031.exe
c:\windows\system32\drivers\downld\348187.exe
c:\windows\system32\drivers\downld\348718.exe
c:\windows\system32\drivers\downld\351546.exe
c:\windows\system32\drivers\downld\353937.exe
c:\windows\system32\drivers\downld\356109.exe
c:\windows\system32\drivers\downld\357796.exe
c:\windows\system32\drivers\downld\360859.exe
c:\windows\system32\drivers\downld\3732031.exe
c:\windows\system32\drivers\downld\3734984.exe
c:\windows\system32\drivers\downld\3783734.exe
c:\windows\system32\drivers\downld\3785234.exe
c:\windows\system32\drivers\downld\3794000.exe
c:\windows\system32\drivers\downld\381312.exe
c:\windows\system32\drivers\downld\382328.exe
c:\windows\system32\drivers\downld\385437.exe
c:\windows\system32\drivers\downld\387921.exe
c:\windows\system32\drivers\downld\388671.exe
c:\windows\system32\drivers\downld\391343.exe
c:\windows\system32\drivers\downld\39141656.exe
c:\windows\system32\drivers\downld\39143531.exe
c:\windows\system32\drivers\downld\39248578.exe
c:\windows\system32\drivers\downld\39255859.exe
c:\windows\system32\drivers\downld\392734.exe
c:\windows\system32\drivers\downld\393453.exe
c:\windows\system32\drivers\downld\39383250.exe
c:\windows\system32\drivers\downld\39411734.exe
c:\windows\system32\drivers\downld\40507281.exe
c:\windows\system32\drivers\downld\40508875.exe
c:\windows\system32\drivers\downld\40549796.exe
c:\windows\system32\drivers\downld\40558328.exe
c:\windows\system32\drivers\downld\40561671.exe
c:\windows\system32\drivers\downld\40614078.exe
c:\windows\system32\drivers\downld\40652078.exe
c:\windows\system32\drivers\downld\40665406.exe
c:\windows\system32\drivers\downld\415281.exe
c:\windows\system32\drivers\downld\418703.exe
c:\windows\system32\drivers\downld\426015.exe
c:\windows\system32\drivers\downld\427203.exe
c:\windows\system32\drivers\downld\434843.exe
c:\windows\system32\drivers\downld\436359.exe
c:\windows\system32\drivers\downld\43898765.exe
c:\windows\system32\drivers\downld\43901031.exe
c:\windows\system32\drivers\downld\43927125.exe
c:\windows\system32\drivers\downld\43931765.exe
c:\windows\system32\drivers\downld\43935703.exe
c:\windows\system32\drivers\downld\44030718.exe
c:\windows\system32\drivers\downld\44039890.exe
c:\windows\system32\drivers\downld\44041734.exe
c:\windows\system32\drivers\downld\44155000.exe
c:\windows\system32\drivers\downld\44163296.exe
c:\windows\system32\drivers\downld\44291781.exe
c:\windows\system32\drivers\downld\44310156.exe
c:\windows\system32\drivers\downld\44392375.exe
c:\windows\system32\drivers\downld\44393453.exe
c:\windows\system32\drivers\downld\44416906.exe
c:\windows\system32\drivers\downld\44420093.exe
c:\windows\system32\drivers\downld\44426593.exe
c:\windows\system32\drivers\downld\44429468.exe
c:\windows\system32\drivers\downld\44436312.exe
c:\windows\system32\drivers\downld\44439718.exe
c:\windows\system32\drivers\downld\44454515.exe
c:\windows\system32\drivers\downld\44472781.exe
c:\windows\system32\drivers\downld\44483968.exe
c:\windows\system32\drivers\downld\44492218.exe
c:\windows\system32\drivers\downld\44500359.exe
c:\windows\system32\drivers\downld\44500718.exe
c:\windows\system32\drivers\downld\44523390.exe
c:\windows\system32\drivers\downld\44524062.exe
c:\windows\system32\drivers\downld\44532218.exe
c:\windows\system32\drivers\downld\44532265.exe
c:\windows\system32\drivers\downld\44533687.exe
c:\windows\system32\drivers\downld\44549906.exe
c:\windows\system32\drivers\downld\44594937.exe
c:\windows\system32\drivers\downld\44620562.exe
c:\windows\system32\drivers\downld\44656296.exe
c:\windows\system32\drivers\downld\44672250.exe
c:\windows\system32\drivers\downld\44787453.exe
c:\windows\system32\drivers\downld\44872968.exe
c:\windows\system32\drivers\downld\44927328.exe
c:\windows\system32\drivers\downld\4558546.exe
c:\windows\system32\drivers\downld\4559375.exe
c:\windows\system32\drivers\downld\4579906.exe
c:\windows\system32\drivers\downld\4585203.exe
c:\windows\system32\drivers\downld\464421.exe
c:\windows\system32\drivers\downld\467625.exe
c:\windows\system32\drivers\downld\4686609.exe
c:\windows\system32\drivers\downld\470078.exe
c:\windows\system32\drivers\downld\4707984.exe
c:\windows\system32\drivers\downld\4773781.exe
c:\windows\system32\drivers\downld\4774750.exe
c:\windows\system32\drivers\downld\4796781.exe
c:\windows\system32\drivers\downld\4797515.exe
c:\windows\system32\drivers\downld\4843906.exe
c:\windows\system32\drivers\downld\4844687.exe
c:\windows\system32\drivers\downld\485421.exe
c:\windows\system32\drivers\downld\486171.exe
c:\windows\system32\drivers\downld\4867375.exe
c:\windows\system32\drivers\downld\4872750.exe
c:\windows\system32\drivers\downld\4997156.exe
c:\windows\system32\drivers\downld\5007343.exe
c:\windows\system32\drivers\downld\516953.exe
c:\windows\system32\drivers\downld\520187.exe
c:\windows\system32\drivers\downld\522750.exe
c:\windows\system32\drivers\downld\5270125.exe
c:\windows\system32\drivers\downld\5271750.exe
c:\windows\system32\drivers\downld\5306046.exe
c:\windows\system32\drivers\downld\5309578.exe
c:\windows\system32\drivers\downld\5312359.exe
c:\windows\system32\drivers\downld\5358140.exe
c:\windows\system32\drivers\downld\538625.exe
c:\windows\system32\drivers\downld\5388359.exe
c:\windows\system32\drivers\downld\5389218.exe
c:\windows\system32\drivers\downld\54020609.exe
c:\windows\system32\drivers\downld\54026968.exe
c:\windows\system32\drivers\downld\5410718.exe
c:\windows\system32\drivers\downld\54149921.exe
c:\windows\system32\drivers\downld\54166046.exe
c:\windows\system32\drivers\downld\54181437.exe
c:\windows\system32\drivers\downld\5419265.exe
c:\windows\system32\drivers\downld\5433781.exe
c:\windows\system32\drivers\downld\54378437.exe
c:\windows\system32\drivers\downld\5439359.exe
c:\windows\system32\drivers\downld\54420937.exe
c:\windows\system32\drivers\downld\547218.exe
c:\windows\system32\drivers\downld\5480187.exe
c:\windows\system32\drivers\downld\5515218.exe
c:\windows\system32\drivers\downld\5524937.exe
c:\windows\system32\drivers\downld\5566640.exe
c:\windows\system32\drivers\downld\5567515.exe
c:\windows\system32\drivers\downld\558671.exe
c:\windows\system32\drivers\downld\5608031.exe
c:\windows\system32\drivers\downld\5611750.exe
c:\windows\system32\drivers\downld\5614515.exe
c:\windows\system32\drivers\downld\5654968.exe
c:\windows\system32\drivers\downld\5693359.exe
c:\windows\system32\drivers\downld\58452421.exe
c:\windows\system32\drivers\downld\58472781.exe
c:\windows\system32\drivers\downld\58474390.exe
c:\windows\system32\drivers\downld\58503031.exe
c:\windows\system32\drivers\downld\58506093.exe
c:\windows\system32\drivers\downld\58508875.exe
c:\windows\system32\drivers\downld\58593750.exe
c:\windows\system32\drivers\downld\58607203.exe
c:\windows\system32\drivers\downld\58614140.exe
c:\windows\system32\drivers\downld\59011500.exe
c:\windows\system32\drivers\downld\59012937.exe
c:\windows\system32\drivers\downld\59023875.exe
c:\windows\system32\drivers\downld\59038625.exe
c:\windows\system32\drivers\downld\59042765.exe
c:\windows\system32\drivers\downld\59070125.exe
c:\windows\system32\drivers\downld\59073062.exe
c:\windows\system32\drivers\downld\59094625.exe
c:\windows\system32\drivers\downld\59096562.exe
c:\windows\system32\drivers\downld\59098218.exe
c:\windows\system32\drivers\downld\59132140.exe
c:\windows\system32\drivers\downld\59145218.exe
c:\windows\system32\drivers\downld\59152281.exe
c:\windows\system32\drivers\downld\59153187.exe
c:\windows\system32\drivers\downld\59155984.exe
c:\windows\system32\drivers\downld\59161718.exe
c:\windows\system32\drivers\downld\59162125.exe
c:\windows\system32\drivers\downld\59163750.exe
c:\windows\system32\drivers\downld\59172640.exe
c:\windows\system32\drivers\downld\59223859.exe
c:\windows\system32\drivers\downld\59272515.exe
c:\windows\system32\drivers\downld\59276593.exe
c:\windows\system32\drivers\downld\59295656.exe
c:\windows\system32\drivers\downld\59298531.exe
c:\windows\system32\drivers\downld\59409921.exe
c:\windows\system32\drivers\downld\59411390.exe
c:\windows\system32\drivers\downld\59421015.exe
c:\windows\system32\drivers\downld\594312.exe
c:\windows\system32\drivers\downld\59462671.exe
c:\windows\system32\drivers\downld\59466093.exe
c:\windows\system32\drivers\downld\60062703.exe
c:\windows\system32\drivers\downld\60076453.exe
c:\windows\system32\drivers\downld\60084109.exe
c:\windows\system32\drivers\downld\602750.exe
c:\windows\system32\drivers\downld\6136843.exe
c:\windows\system32\drivers\downld\6139515.exe
c:\windows\system32\drivers\downld\6180843.exe
c:\windows\system32\drivers\downld\6193125.exe
c:\windows\system32\drivers\downld\6238703.exe
c:\windows\system32\drivers\downld\6262984.exe
c:\windows\system32\drivers\downld\6271921.exe
c:\windows\system32\drivers\downld\6288531.exe
c:\windows\system32\drivers\downld\6364765.exe
c:\windows\system32\drivers\downld\6366156.exe
c:\windows\system32\drivers\downld\641375.exe
c:\windows\system32\drivers\downld\642968.exe
c:\windows\system32\drivers\downld\6451343.exe
c:\windows\system32\drivers\downld\6452109.exe
c:\windows\system32\drivers\downld\6482953.exe
c:\windows\system32\drivers\downld\6488234.exe
c:\windows\system32\drivers\downld\6585593.exe
c:\windows\system32\drivers\downld\6591187.exe
c:\windows\system32\drivers\downld\68998406.exe
c:\windows\system32\drivers\downld\69006062.exe
c:\windows\system32\drivers\downld\69127218.exe
c:\windows\system32\drivers\downld\69142078.exe
c:\windows\system32\drivers\downld\69342000.exe
c:\windows\system32\drivers\downld\69376734.exe
c:\windows\system32\drivers\downld\71593.exe
c:\windows\system32\drivers\downld\71687.exe
c:\windows\system32\drivers\downld\7202656.exe
c:\windows\system32\drivers\downld\7203421.exe
c:\windows\system32\drivers\downld\7233656.exe
c:\windows\system32\drivers\downld\7234406.exe
c:\windows\system32\drivers\downld\72734.exe
c:\windows\system32\drivers\downld\72859.exe
c:\windows\system32\drivers\downld\73032468.exe
c:\windows\system32\drivers\downld\73034328.exe
c:\windows\system32\drivers\downld\73074234.exe
c:\windows\system32\drivers\downld\73078500.exe
c:\windows\system32\drivers\downld\73082578.exe
c:\windows\system32\drivers\downld\73202828.exe
c:\windows\system32\drivers\downld\73216937.exe
c:\windows\system32\drivers\downld\73222687.exe
c:\windows\system32\drivers\downld\73578.exe
c:\windows\system32\drivers\downld\73587265.exe
c:\windows\system32\drivers\downld\73589750.exe
c:\windows\system32\drivers\downld\73645734.exe
c:\windows\system32\drivers\downld\73658187.exe
c:\windows\system32\drivers\downld\73663281.exe
c:\windows\system32\drivers\downld\73726375.exe
c:\windows\system32\drivers\downld\73766734.exe
c:\windows\system32\drivers\downld\73771328.exe
c:\windows\system32\drivers\downld\73771468.exe
c:\windows\system32\drivers\downld\73785937.exe
c:\windows\system32\drivers\downld\73846296.exe
c:\windows\system32\drivers\downld\73853640.exe
c:\windows\system32\drivers\downld\73862843.exe
c:\windows\system32\drivers\downld\73875.exe
c:\windows\system32\drivers\downld\73974578.exe
c:\windows\system32\drivers\downld\73997843.exe
c:\windows\system32\drivers\downld\74501218.exe
c:\windows\system32\drivers\downld\74543484.exe
c:\windows\system32\drivers\downld\74554875.exe
c:\windows\system32\drivers\downld\74694156.exe
c:\windows\system32\drivers\downld\74710125.exe
c:\windows\system32\drivers\downld\74827171.exe
c:\windows\system32\drivers\downld\74913312.exe
c:\windows\system32\drivers\downld\74966265.exe
c:\windows\system32\drivers\downld\749828.exe
c:\windows\system32\drivers\downld\758859.exe
c:\windows\system32\drivers\downld\76046.exe
c:\windows\system32\drivers\downld\76437.exe
c:\windows\system32\drivers\downld\767890.exe
c:\windows\system32\drivers\downld\77234.exe
c:\windows\system32\drivers\downld\77515.exe
c:\windows\system32\drivers\downld\77625.exe
c:\windows\system32\drivers\downld\77718.exe
c:\windows\system32\drivers\downld\77734.exe
c:\windows\system32\drivers\downld\78531.exe
c:\windows\system32\drivers\downld\798453.exe
c:\windows\system32\drivers\downld\80359.exe
c:\windows\system32\drivers\downld\806687.exe
c:\windows\system32\drivers\downld\808093.exe
c:\windows\system32\drivers\downld\81125.exe
c:\windows\system32\drivers\downld\816015.exe
c:\windows\system32\drivers\downld\82078.exe
c:\windows\system32\drivers\downld\821218.exe
c:\windows\system32\drivers\downld\824328.exe
c:\windows\system32\drivers\downld\82671.exe
c:\windows\system32\drivers\downld\829734.exe
c:\windows\system32\drivers\downld\832062.exe
c:\windows\system32\drivers\downld\83218.exe
c:\windows\system32\drivers\downld\83484.exe
c:\windows\system32\drivers\downld\8348703.exe
c:\windows\system32\drivers\downld\8349484.exe
c:\windows\system32\drivers\downld\83863156.exe
c:\windows\system32\drivers\downld\83864062.exe
c:\windows\system32\drivers\downld\83909671.exe
c:\windows\system32\drivers\downld\83913125.exe
c:\windows\system32\drivers\downld\83968.exe
c:\windows\system32\drivers\downld\84029062.exe
c:\windows\system32\drivers\downld\8405421.exe
c:\windows\system32\drivers\downld\8406812.exe
c:\windows\system32\drivers\downld\8435437.exe
c:\windows\system32\drivers\downld\8436890.exe
c:\windows\system32\drivers\downld\847687.exe
c:\windows\system32\drivers\downld\8485343.exe
c:\windows\system32\drivers\downld\84859.exe
c:\windows\system32\drivers\downld\8486109.exe
c:\windows\system32\drivers\downld\85312.exe
c:\windows\system32\drivers\downld\855921.exe
c:\windows\system32\drivers\downld\85796.exe
c:\windows\system32\drivers\downld\86015.exe
c:\windows\system32\drivers\downld\861640.exe
c:\windows\system32\drivers\downld\86390.exe
c:\windows\system32\drivers\downld\86406.exe
c:\windows\system32\drivers\downld\868000.exe
c:\windows\system32\drivers\downld\86828.exe
c:\windows\system32\drivers\downld\87015.exe
c:\windows\system32\drivers\downld\872359.exe
c:\windows\system32\drivers\downld\87421.exe
c:\windows\system32\drivers\downld\87468.exe
c:\windows\system32\drivers\downld\87672156.exe
c:\windows\system32\drivers\downld\87674046.exe
c:\windows\system32\drivers\downld\87723046.exe
c:\windows\system32\drivers\downld\87729593.exe
c:\windows\system32\drivers\downld\87734234.exe
c:\windows\system32\drivers\downld\87832015.exe
c:\windows\system32\drivers\downld\87870718.exe
c:\windows\system32\drivers\downld\87890.exe
c:\windows\system32\drivers\downld\87890703.exe
c:\windows\system32\drivers\downld\87968.exe
c:\windows\system32\drivers\downld\87984.exe
c:\windows\system32\drivers\downld\880203.exe
c:\windows\system32\drivers\downld\881343.exe
c:\windows\system32\drivers\downld\882203.exe
c:\windows\system32\drivers\downld\88239453.exe
c:\windows\system32\drivers\downld\88240984.exe
c:\windows\system32\drivers\downld\88272468.exe
c:\windows\system32\drivers\downld\88277171.exe
c:\windows\system32\drivers\downld\88282921.exe
c:\windows\system32\drivers\downld\88335562.exe
c:\windows\system32\drivers\downld\88390531.exe
c:\windows\system32\drivers\downld\88410687.exe
c:\windows\system32\drivers\downld\88413625.exe
c:\windows\system32\drivers\downld\88546.exe
c:\windows\system32\drivers\downld\88640.exe
c:\windows\system32\drivers\downld\88859.exe
c:\windows\system32\drivers\downld\88984.exe
c:\windows\system32\drivers\downld\890062.exe
c:\windows\system32\drivers\downld\89443859.exe
c:\windows\system32\drivers\downld\89453359.exe
c:\windows\system32\drivers\downld\89454781.exe
c:\windows\system32\drivers\downld\89534671.exe
c:\windows\system32\drivers\downld\89546406.exe
c:\windows\system32\drivers\downld\89607406.exe
c:\windows\system32\drivers\downld\89674750.exe
c:\windows\system32\drivers\downld\89718.exe
c:\windows\system32\drivers\downld\89743984.exe
c:\windows\system32\drivers\downld\90140.exe
c:\windows\system32\drivers\downld\90296.exe
c:\windows\system32\drivers\downld\90625.exe
c:\windows\system32\drivers\downld\907390.exe
c:\windows\system32\drivers\downld\91453.exe
c:\windows\system32\drivers\downld\917843.exe
c:\windows\system32\drivers\downld\91859.exe
c:\windows\system32\drivers\downld\91937.exe
c:\windows\system32\drivers\downld\91953.exe
c:\windows\system32\drivers\downld\92718.exe
c:\windows\system32\drivers\downld\92796.exe
c:\windows\system32\drivers\downld\92812.exe
c:\windows\system32\drivers\downld\93484.exe
c:\windows\system32\drivers\downld\93671.exe
c:\windows\system32\drivers\downld\93703.exe
c:\windows\system32\drivers\downld\93890.exe
c:\windows\system32\drivers\downld\93953.exe
c:\windows\system32\drivers\downld\94015.exe
c:\windows\system32\drivers\downld\94265.exe
c:\windows\system32\drivers\downld\95000.exe
c:\windows\system32\drivers\downld\95093.exe
c:\windows\system32\drivers\downld\95140.exe
c:\windows\system32\drivers\downld\95234.exe
c:\windows\system32\drivers\downld\95828.exe
c:\windows\system32\drivers\downld\95875.exe
c:\windows\system32\drivers\downld\96109.exe
c:\windows\system32\drivers\downld\96218.exe
c:\windows\system32\drivers\downld\96453.exe
c:\windows\system32\drivers\downld\96468.exe
c:\windows\system32\drivers\downld\97000.exe
c:\windows\system32\drivers\downld\97843.exe
c:\windows\system32\drivers\downld\97890.exe
c:\windows\system32\drivers\downld\97906.exe
c:\windows\system32\drivers\downld\98406.exe
c:\windows\system32\drivers\downld\98452843.exe
c:\windows\system32\drivers\downld\98454000.exe
c:\windows\system32\drivers\downld\98500875.exe
c:\windows\system32\drivers\downld\98504328.exe
c:\windows\system32\drivers\downld\98592343.exe
c:\windows\system32\drivers\downld\98599781.exe
c:\windows\system32\drivers\downld\98687.exe
c:\windows\system32\drivers\downld\99046.exe
c:\windows\system32\drivers\downld\99515.exe
c:\windows\system32\drivers\srosa2.sys

.
((((((((((((((((((((((((( Files Creati Da 2008-10-21 al 2008-11-21 )))))))))))))))))))))))))))))))))))
.

2008-11-20 20:09 . 2008-11-20 20:09 512,096 --a------ c:\windows\system32\drivers\amon.sys
2008-11-20 20:09 . 2008-11-20 20:09 298,104 --a------ c:\windows\system32\imon.dll
2008-11-20 20:09 . 2008-11-20 20:09 15,424 --a------ c:\windows\system32\drivers\nod32drv.sys
2008-11-20 18:05 . 2008-11-20 18:05 <DIR> d-------- c:\programmi\Trend Micro
2008-11-20 17:39 . 2008-11-20 18:00 <DIR> d-------- C:\RegCleaner
2008-11-20 17:38 . 2008-11-20 17:38 <DIR> d-------- c:\programmi\RegCleaner
2008-11-20 13:38 . 2008-11-20 18:07 1,474,908,160 --a------ c:\windows\MEMORY.DMP
2008-11-20 13:32 . 2008-11-20 13:32 <DIR> d-------- c:\programmi\CCleaner
2008-11-20 13:18 . 2004-08-19 13:00 571,392 --a--c--- c:\windows\system32\dllcache\tintlgnt.ime
2008-11-20 13:17 . 2004-08-19 13:00 1,875,968 --a--c--- c:\windows\system32\dllcache\msir3jp.lex
2008-11-20 13:16 . 2004-08-19 13:00 13,463,552 --a--c--- c:\windows\system32\dllcache\hwxjpn.dll
2008-11-20 13:15 . 2004-08-19 13:00 1,677,824 --a--c--- c:\windows\system32\dllcache\chsbrkr.dll
2008-11-20 13:14 . 2004-05-13 00:39 876,653 --a--c--- c:\windows\system32\dllcache\fp4awel.dll
2008-11-20 13:11 . 2008-11-20 13:11 488 -rah----- c:\windows\system32\logonui.exe.manifest
2008-11-20 13:10 . 2008-11-20 13:10 749 -rah----- c:\windows\WindowsShell.Manifest
2008-11-20 13:10 . 2008-11-20 13:10 749 -rah----- c:\windows\system32\wuaucpl.cpl.manifest
2008-11-20 13:10 . 2008-11-20 13:10 749 -rah----- c:\windows\system32\sapi.cpl.manifest
2008-11-20 13:10 . 2008-11-20 13:10 749 -rah----- c:\windows\system32\nwc.cpl.manifest
2008-11-20 13:10 . 2008-11-20 13:10 749 -rah----- c:\windows\system32\ncpa.cpl.manifest
2008-11-20 12:53 . 2004-08-19 13:00 1,908,586 --a--c--- c:\windows\system32\dllcache\NT5.CAT
2008-11-20 10:00 . 2007-07-12 13:49 178,872 -ra------ c:\windows\system32\drivers\PavProc.sys
2008-11-20 10:00 . 2007-05-23 15:40 38,968 -ra------ c:\windows\system32\drivers\ShlDrv51.sys
2008-11-18 12:28 . 2008-11-18 12:28 0 --a------ c:\windows\nsreg.dat
2008-11-18 12:08 . 2008-11-18 12:08 <DIR> d-------- c:\programmi\ClamWin
2008-11-18 12:08 . 2008-11-18 12:08 <DIR> d-------- c:\documents and settings\All Users.WINDOWS\.clamwin
2008-11-18 09:52 . 2008-11-18 12:28 <DIR> d-------- c:\programmi\Spyware Doctor
2008-11-18 09:52 . 2008-11-18 09:52 <DIR> d-------- c:\documents and settings\pcmf.MF-CAKSV2APT278\Dati applicazioni\PC Tools
2008-11-18 09:50 . 2008-11-18 09:50 <DIR> d-------- c:\temp\google
2008-11-18 09:50 . 2008-11-18 09:50 <DIR> d-------- C:\temp
2008-11-18 09:49 . 2008-11-21 15:00 <DIR> d-------- c:\programmi\Norton Security Scan
2008-11-17 18:28 . 2008-11-21 10:41 <DIR> d-------- c:\programmi\Eset
2008-11-15 11:25 . 2008-11-15 12:02 <DIR> d-------- C:\windows installer +agg
2008-11-14 11:18 . 2008-11-14 11:18 <DIR> d-------- c:\windows\system32\PAV
2008-11-14 11:18 . 2007-06-06 10:43 83,640 --a------ c:\windows\system32\drivers\pavdrv51.sys
2008-11-14 11:17 . 2007-07-12 08:42 292,144 --a------ c:\windows\system32\PavSHook.dll
2008-11-14 11:17 . 2007-03-13 18:01 161,328 --a------ c:\windows\system32\TpUtil.dll
2008-11-14 11:17 . 2006-06-27 19:36 101,888 --a------ c:\windows\system32\SYSTOOLS.DLL
2008-11-14 11:17 . 2007-02-28 18:04 63,024 --a------ c:\windows\system32\pavipc.dll
2008-11-14 11:17 . 2007-06-08 08:44 24,760 --a------ c:\windows\system32\drivers\cpoint.sys
2008-11-10 17:54 . 2007-03-06 17:33 12,336 --a------ c:\windows\system32\PGUNNT.EXE
2008-11-10 13:24 . 2008-11-13 17:56 624,081 --a------ c:\windows\system32\EPSTP32U.CAB
2008-11-10 13:24 . 2008-11-10 13:24 471,802 --a------ c:\windows\system32\EPSETUP.CAB
2008-11-10 13:24 . 2008-11-10 13:24 292,395 --a------ c:\windows\system32\EPPRTDRV.CAB
2008-11-10 13:24 . 2003-11-17 23:00 6,328 --a------ c:\windows\system32\EPSTP32U.DAT
2008-11-07 18:37 . 2008-11-07 18:37 <DIR> d-------- c:\programmi\Webroot
2008-11-07 18:37 . 2008-11-07 18:37 <DIR> d-------- c:\documents and settings\pcmf.MF-CAKSV2APT278\Dati applicazioni\Webroot
2008-11-07 18:37 . 2008-11-07 18:37 <DIR> d-------- c:\documents and settings\All Users.WINDOWS\Dati applicazioni\Webroot
2008-11-07 18:37 . 2008-01-04 20:56 1,526,640 --a------ c:\windows\WRSetup.dll
2008-11-07 11:14 . 2008-11-07 11:14 <DIR> d--h-c--- c:\documents and settings\All Users.WINDOWS\Dati applicazioni\{B46E1EF5-0B37-4DB4-A4E2-9F2B41036185}
2008-11-03 20:21 . 2008-11-03 20:21 <DIR> d-------- C:\Inetpub
2008-11-03 19:53 . 2008-11-03 19:56 60,800 --a------ c:\windows\system32\S32EVNT1.DLL
2008-11-03 18:32 . 2008-11-03 18:32 <DIR> d-------- c:\programmi\Microsoft Silverlight
2008-11-03 12:44 . 2008-11-10 17:52 46,640 --a------ c:\windows\system32\msln.exe
2008-10-29 18:23 . 2008-10-29 18:23 <DIR> d-------- c:\programmi\Microsoft Works

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-21 14:01 --------- d-----w c:\programmi\File comuni\Symantec Shared
2008-11-20 11:16 --------- d-----w c:\programmi\Spybot - Search & Destroy
2008-11-20 11:16 --------- d-----w c:\documents and settings\All Users.WINDOWS\Dati applicazioni\Spybot - Search & Destroy
2008-11-19 22:55 --------- d-----w c:\programmi\Microsoft ActiveSync
2008-11-19 17:27 --------- d-----w c:\programmi\eMule
2008-11-18 11:29 --------- d-----w c:\programmi\Windows Media Bonus Pack for Windows XP
2008-11-18 11:19 --------- d-----w c:\programmi\Google
2008-11-18 11:05 --------- d---a-w c:\documents and settings\All Users.WINDOWS\Dati applicazioni\TEMP
2008-11-10 12:24 --------- d-----w c:\documents and settings\All Users.WINDOWS\Dati applicazioni\Skype
2008-11-10 10:03 --------- d--h--w c:\programmi\InstallShield Installation Information
2008-11-10 09:22 --------- d-----w c:\documents and settings\pcmf.MF-CAKSV2APT278\Dati applicazioni\skypePM
2008-11-03 18:56 805 ----a-w c:\windows\system32\drivers\SYMEVENT.INF
2008-11-03 18:56 10,563 ----a-w c:\windows\system32\drivers\SYMEVENT.CAT
2008-11-03 18:53 --------- d-----w c:\documents and settings\All Users.WINDOWS\Dati applicazioni\Symantec
2008-10-16 10:17 --------- d-----w c:\programmi\DFX
2008-10-15 11:17 --------- d-----w c:\programmi\Intel
2008-10-15 11:17 --------- d-----w c:\documents and settings\pcmf.MF-CAKSV2APT278\Dati applicazioni\InstallShield
2008-10-11 11:02 --------- d-----w c:\programmi\Canon
2008-10-11 10:24 --------- d-----w c:\programmi\File comuni\DFX
2008-10-11 10:24 --------- d-----w c:\documents and settings\All Users.WINDOWS\Dati applicazioni\DFX
2008-10-10 15:40 --------- d-----w c:\programmi\Custom Engineering
2008-10-01 11:37 --------- d-----w c:\programmi\Windows Sidebar
2008-09-22 10:01 --------- d-----w c:\documents and settings\All Users.WINDOWS\Dati applicazioni\DVD Shrink
2008-08-22 15:21 47,360 ----a-w c:\documents and settings\pcmf.MF-CAKSV2APT278\Dati applicazioni\pcouffin.sys
2007-02-27 16:20 3,932 -c--a-w c:\documents and settings\pcmf\Dati applicazioni\LMLayout.dat
2007-02-27 16:20 268 -c--a-w c:\documents and settings\pcmf\Dati applicazioni\LMCPaper.dat
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-19 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Samsung PanelMgr"="c:\windows\Samsung\PanelMgr\SSMMgr.exe" [2007-12-14 524288]
"EPSON Stylus C64 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I0C2.EXE" [2003-09-12 99840]
"SunJavaUpdateSched"="c:\programmi\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 49263]
"ATICCC"="c:\programmi\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 45056]
"ClamWin"="c:\programmi\ClamWin\bin\ClamTray.exe" [2008-11-20 86016]
"nod32kui"="c:\programmi\Eset\nod32kui.exe" [2008-11-20 949376]
"SoundMan"="SOUNDMAN.EXE" [2004-01-09 c:\windows\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-19 15360]

c:\documents and settings\pcmf\Menu Avvio\Programmi\Esecuzione automatica\
Desktop Clock.lnk - c:\programmi\Digital Clock\DigitalClock.exe [2007-09-15 2699673]

c:\documents and settings\All Users.WINDOWS\Menu Avvio\Programmi\Esecuzione automatica\
Adobe Reader Speed Launch.lnk - c:\programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Avvio^Programmi^Esecuzione automatica^Kodak EasyShare software.lnk]
path=c:\documents and settings\All Users.WINDOWS\Menu Avvio\Programmi\Esecuzione automatica\Kodak EasyShare software.lnk
backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^pcmf.MF-CAKSV2APT278^Menu Avvio^Programmi^Esecuzione automatica^StarOffice 8.lnk]
path=c:\documents and settings\pcmf.MF-CAKSV2APT278\Menu Avvio\Programmi\Esecuzione automatica\StarOffice 8.lnk
backup=c:\windows\pss\StarOffice 8.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
--a------ 2008-11-20 12:54 51048 c:\programmi\File comuni\Symantec Shared\ccApp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-10-13 17:24 1694208 c:\programmi\Messenger\msmsgs.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\AvRack\\rtlrack.exe"=
"c:\programmi\Microsoft ActiveSync\rapimgr.exe"= c:\programmi\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\programmi\Microsoft ActiveSync\WCESMgr.exe"= c:\programmi\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Programmi\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmi\\Messenger\\msmsgs.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"84:TCP"= 84:TCP:VRS Recording System Web Control Panel
"4672:UDP"= 4672:UDP:*:Disabled:EmuleUDP
"4672:TCP"= 4672:TCP:*:Disabled:EmuleTCP
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R1 ShldDrv;Panda File Shield Driver;c:\windows\system32\DRIVERS\ShlDrv51.sys [2008-11-20 38968]
S2 cpoint;Panda CPoint Driver;c:\windows\system32\Drivers\cpoint.sys [2008-11-14 24760]
S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys []
S3 Di1611VM11;KONICA MINOLTA Di1611;c:\windows\system32\Drivers\Di1611.sys [2001-08-16 13824]
S3 FoxAwdWINFLASH;FoxAwdWINFLASH;\??\c:\programmi\SuperUtility\FoxAwdWINFLASH.SYS [2008-03-31 4380]
S3 FXDRV;FXDRV;\??\c:\programmi\SuperUtility\Fxdrv.sys [2008-03-31 13440]
S3 PAC7311;VGA USB Camera;c:\windows\system32\DRIVERS\PA707UCM.SYS []
S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\DRIVERS\wg111v2.sys [2007-11-28 194304]
S3 SIS163u;SiS 163 usb Wireless LAN Adapter Driver;c:\windows\system32\DRIVERS\sis163u.sys [2006-11-25 162304]
S4 hpt3xx;hpt3xx; []
S4 PavProc;Panda Process Protection Driver;\??\c:\windows\system32\DRIVERS\PavProc.sys [2008-11-20 178872]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0be77a66-af16-11dd-8b59-00155845f4fa}]
\Shell\Auto\command - D:\fun.xls.exe
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL fun.xls.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1375a534-a660-11dd-8b4a-00155845f4fa}]
\Shell\auto\command - Knight.exe open
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Knight.exe open
\Shell\explore\command - Knight.exe open
\Shell\find\command - Knight.exe open
\Shell\install\command - Knight.exe open
\Shell\open\command - Knight.exe open

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1375a535-a660-11dd-8b4a-00155845f4fa}]
\Shell\AutoRun\command - K:\nideiect.com
\Shell\explore\Command - K:\nideiect.com
\Shell\open\Command - K:\nideiect.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{19a4b212-8e0b-11dd-8b0b-00155845f4fa}]
\Shell\Auto\command - eudcojguz.exe
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL eudcojguz.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{25822702-8fde-11dd-8b12-00155845f4fa}]
\Shell\AutoRun\command - F:\nideiect.com
\Shell\explore\Command - F:\nideiect.com
\Shell\open\Command - F:\nideiect.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{533a95f8-6fec-11db-8c88-00179a300101}]
\Shell\AutoRun\command - K:\nideiect.com
\Shell\explore\Command - K:\nideiect.com
\Shell\open\Command - K:\nideiect.com
.
Contenuto della cartella 'Scheduled Tasks'

2008-11-21 c:\windows\Tasks\Norton Security Scan for pcmf.job
- c:\programmi\Norton Security Scan\Nss.exe [2008-09-19 04:18]

2008-11-21 c:\windows\Tasks\OGADaily.job
- c:\windows\system32\OGAVerify.exe [2008-04-23 16:17]

2008-11-21 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAVerify.exe [2008-04-23 16:17]
.
- - - - ORFÃOS REMOVIDOS - - - -

HKLM-Run-APVXDWINazzo - c:\panda antiv\APVXDWIN.EXE
HKU-Default-Run-drvsyskit - c:\windows\system32\drivers\hldrrr.exe
HKU-Default-Run-german.exe - c:\windows\system32\wintems.exe
HKU-Default-Run-mule_st_key - c:\documents and settings\pcmf.MF-CAKSV2APT278\Dati applicazioni\m\flec006.exe
ShellExecuteHooks-{EDB0E980-90BD-11D4-8599-0008C7D3B6F8} - (no file)
Notify-avldr - avldr.dll
Notify-fccbXPFy - fccbXPFy.dll
SafeBoot-sglfb.sys
SafeBoot-tga.sys
SafeBoot-wd.sys
SafeBoot-sacsvr
MSConfigStartUp-ANIWZCS2Service - c:\programmi\ANI\ANIWZCS2 Service\WZCSLDR2.exe
MSConfigStartUp-MSKDetectorExe - c:\programmi\McAfee\SpamKiller\MSKDetct.exe
MSConfigStartUp-SSC Service Utility - c:\programmi\SSC Service x chip epson\ssc_serv.exe
MSConfigStartUp-swg - c:\programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe


.
------- Supplementare di scansione -------
.
FireFox -: Profile - c:\documents and settings\pcmf.MF-CAKSV2APT278\Dati applicazioni\Mozilla\Firefox\Profiles\flapvuwj.default\
FF -: plugin - c:\programmi\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - c:\programmi\Microsoft Silverlight\2.0.31005.0\npctrl.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-21 17:07:30
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

PROCESSO: c:\windows\system32\lsass.exe
-> c:\programmi\Eset\pr_imon.dll
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\programmi\Diskeeper Corporation\Diskeeper\DkService.exe
c:\programmi\Power Translator\LogoMedia TranslateDotNet Server.exe
c:\programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\programmi\Eset\nod32krn.exe
c:\windows\system32\PAStiSvc.exe
.
**************************************************************************
.
Ora fine scansione: 2008-11-21 17:12:33 - macchina è stato riavviato
ComboFix-quarantined-files.txt 2008-11-21 16:12:30

Pre-Run: 53.358.821.376 byte disponibili
Post-Run: 53,381,857,280 byte disponibili

1555 --- E O F --- 2008-11-15 13:16:56


log HIJACK:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17.22.46, on 21/11/08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Programmi\Power Translator\LogoMedia TranslateDotNet Server.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmi\Eset\nod32krn.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0C2.EXE
C:\Programmi\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\explorer.exe
C:\Programmi\Eset\nod32kui.exe
C:\Programmi\internet explorer\iexplore.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://patrick.kolla.de/spybotsd.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: LEC - {1DBAB667-A486-421e-AFE4-CF07DD0088E5} - C:\Programmi\Power Translator\Applications\LEC IE Translation Extension.dll
O4 - HKLM\..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe /autorun
O4 - HKLM\..\Run: [EPSON Stylus C64 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0C2.EXE /P23 "EPSON Stylus C64 Series" /O5 "LPT1:" /M "Stylus C64"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Programmi\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [ClamWin] "C:\Programmi\ClamWin\bin\ClamTray.exe" --logon
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [nod32kui] "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Crea preferito portatile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O15 - Trusted Zone: www.koolynoody.net
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Programmi\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: LEC TranslateDotNet Server - Language Engineering Corporation, LLC - C:\Programmi\Power Translator\LogoMedia TranslateDotNet Server.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmi\Eset\nod32krn.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

--
End of file - 5799 bytes


avevo già eliminato tutte quelle schifezze di emule grazie anche alle scansioni di nod32!!! FAMMI SAPERE....
ciao ciao
r16
Inviato: Friday, November 21, 2008 10:26:30 PM
Rank: AiutAmico

Iscritto dal : 8/7/2007
Posts: 11,016
Ciao.
Nonostante tutto quello che ha eliminato Combofix, sei ancora pieno come un uovo.
Disattiva il ripristino configurazione di sistema, e tienilo disattivato, fino alla soluzione del problema http://guide.aiutamici.com/guide?C1=7&C2=68&ID=80121
Elimina queste voci di HJT:
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://patrick.kolla.de/spybotsd.html
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O15 - Trusted Zone: www.koolynoody.net
Dai una pulita (registro compreso)con CCleaner http://www.aiutaamici.com/software?ID=11223

Provvedi a svuotare del suo contenuto la cartella Prefetch :
clicca su Risorse del Computer
clicca su Disco locale C:
cerca, all’interno delle cartelle che saranno visualizzate la cartella Windows, aprila ed, al suo interno, cerca la cartella Prefetch, la apri ed elimina tutte le voci conservate al suo interno ( non eliminare la cartella)
SVUOTA IL CESTINO

Rifai la scansione con Eligagla,e mi posti il log.

Rifai la scansione con Combofix, mi posti il log.

Scarica VIRIT : Fai 2 scansioni, una in modalità normale.
http://www.tgsoft.it/italy/download.htm lo aggiorni (cliccando sulla parabola in alto) e fai la scansione in Modalità Provvisoria (è molto importante).
Posta anche il log. (lo trovi sull'icona in alto, con raffigurato un block notes ,con una penna)
Riavvia il pc.

scarica ed installa MalwareBytes:
clicca qui per il download : http://www.malwarebytes.org/
esegui una scansione completa del sistema e, una volta terminata la scansione, allega in questo topic il log che verrà rilasciato
Prima di fare la scansione AGGIORNALO.

Hai anche il virus Knight.exe , probabilmente hai chiavette o HD esterni infettati.
Bisogna disattivare momentaneamente il riconoscimento automatico delle periferiche USB;
serve il programma TweakUI scaricabile in questa pagina (lo trovi sulla destra verso metà pagina) e installalo:
http://www.microsoft.com/windowsxp/downloads/powertoys/xppowertoys.mspx
Una volta installato, eseguilo e procedi con questi passaggi:

Espandi la sezione My Computer
Espandi la sottosezione Autoplay
Spostati in Types
Togli il segno di spunta a Enable Autoplay for removable drives
Clicca su Apply
Chiudi TweakUI

N.B: Con Espandi intendo: clicca sul simbolo [+] di fianco alle voci che ti ho indicato
Da questo momento tutti gli apparati USB smetteranno di avviarsi automaticamente.
Inserisci le tue chiavette e fai un una scansione delle stesse con il tuo antivirus.
Quando sei sicuro che tutto è a posto, puoi riabilitare l'avvio automatico, rifacendo lo stesso percorso che ti ho indicato.

Se non ti è chiaro il procedimento :chiedi.
Kalachado
Inviato: Saturday, November 22, 2008 1:39:53 AM
Rank: AiutAmico

Iscritto dal : 3/23/2005
Posts: 63
Mi sembra tutto chiaro, sai spiegarti bene....voglio solo chiederti una cosa: hai indovinato riguardo penne usb e hd esterni, perciò...siccome tutte hanno girato in altri pc, COMPRESO IL MIO DI CASAAA, devo fare tutto questo anche su quei pc???? nod32 è riuscito a pulirmi il mio pc e le chiavette che in effetti erano INFETTI, COSì COME IL MIO PC DI CASA appunto, x sicurezza la mia penna usb personale l'ho svuotata e riformattata!!! Che dici devo fare tutto il procedimento sugli altri pc???
ciao a presto
Kalachado
Inviato: Saturday, November 22, 2008 10:56:29 AM
Rank: AiutAmico

Iscritto dal : 3/23/2005
Posts: 63
buongiorno r16...
ti inizio a postare nuovamente i log di ELIBAGLA e di COMBOFIX....


Sat Nov 22 10:00:50 2008
EliBagle v11.97 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 17 de Noviembre del 2008)

Lista de Acciones (por Acción Directa):

Sat Nov 22 10:00:54 2008
EliBagle v11.97 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 17 de Noviembre del 2008)

Lista de Acciones (por Exploración):
Explorando Unidad C:\

Nº Total de Directorios: 5821
Nº Total de Ficheros: 140293
Nº de Ficheros Analizados: 10725
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0

Sat Nov 22 10:34:19 2008
EliBagle v11.97 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 17 de Noviembre del 2008)

Lista de Acciones (por Exploración):
Explorando Unidad D:\

Nº Total de Directorios: 478
Nº Total de Ficheros: 5149
Nº de Ficheros Analizados: 356
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0



ComboFix 08-11-20.02 - pcmf 2008-11-22 10.41.33.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1040.18.997 [GMT 1:00]
Eseguito da: c:\documents and settings\pcmf.MF-CAKSV2APT278\Desktop\avenger\ComboFix.exe
* Resident AV is active


ATENÇÃO - ESTA MAQUINA NAO TEM A CONSOLE DE RECUPERAÇÃO INSTALADA !!
.

((((((((((((((((((((((((( Files Creati Da 2008-10-22 al 2008-11-22 )))))))))))))))))))))))))))))))))))
.

2008-11-20 20:09 . 2008-11-20 20:09 512,096 --a------ c:\windows\system32\drivers\amon.sys
2008-11-20 20:09 . 2008-11-20 20:09 298,104 --a------ c:\windows\system32\imon.dll
2008-11-20 20:09 . 2008-11-20 20:09 15,424 --a------ c:\windows\system32\drivers\nod32drv.sys
2008-11-20 18:05 . 2008-11-20 18:05 <DIR> d-------- c:\programmi\Trend Micro
2008-11-20 17:39 . 2008-11-20 18:00 <DIR> d-------- C:\RegCleaner
2008-11-20 17:38 . 2008-11-20 17:38 <DIR> d-------- c:\programmi\RegCleaner
2008-11-20 13:32 . 2008-11-20 13:32 <DIR> d-------- c:\programmi\CCleaner
2008-11-20 13:18 . 2004-08-19 13:00 571,392 --a--c--- c:\windows\system32\dllcache\tintlgnt.ime
2008-11-20 13:17 . 2004-08-19 13:00 1,875,968 --a--c--- c:\windows\system32\dllcache\msir3jp.lex
2008-11-20 13:16 . 2004-08-19 13:00 13,463,552 --a--c--- c:\windows\system32\dllcache\hwxjpn.dll
2008-11-20 13:15 . 2004-08-19 13:00 1,677,824 --a--c--- c:\windows\system32\dllcache\chsbrkr.dll
2008-11-20 13:14 . 2004-05-13 00:39 876,653 --a--c--- c:\windows\system32\dllcache\fp4awel.dll
2008-11-20 13:11 . 2008-11-20 13:11 488 -rah----- c:\windows\system32\logonui.exe.manifest
2008-11-20 13:10 . 2008-11-20 13:10 749 -rah----- c:\windows\WindowsShell.Manifest
2008-11-20 13:10 . 2008-11-20 13:10 749 -rah----- c:\windows\system32\wuaucpl.cpl.manifest
2008-11-20 13:10 . 2008-11-20 13:10 749 -rah----- c:\windows\system32\sapi.cpl.manifest
2008-11-20 13:10 . 2008-11-20 13:10 749 -rah----- c:\windows\system32\nwc.cpl.manifest
2008-11-20 13:10 . 2008-11-20 13:10 749 -rah----- c:\windows\system32\ncpa.cpl.manifest
2008-11-20 12:53 . 2004-08-19 13:00 1,908,586 --a--c--- c:\windows\system32\dllcache\NT5.CAT
2008-11-20 10:00 . 2007-07-12 13:49 178,872 -ra------ c:\windows\system32\drivers\PavProc.sys
2008-11-20 10:00 . 2007-05-23 15:40 38,968 -ra------ c:\windows\system32\drivers\ShlDrv51.sys
2008-11-18 12:28 . 2008-11-18 12:28 0 --a------ c:\windows\nsreg.dat
2008-11-18 09:52 . 2008-11-18 12:28 <DIR> d-------- c:\programmi\Spyware Doctor
2008-11-18 09:52 . 2008-11-18 09:52 <DIR> d-------- c:\documents and settings\pcmf.MF-CAKSV2APT278\Dati applicazioni\PC Tools
2008-11-18 09:50 . 2008-11-18 09:50 <DIR> d-------- c:\temp\google
2008-11-18 09:50 . 2008-11-18 09:50 <DIR> d-------- C:\temp
2008-11-18 09:49 . 2008-11-21 15:00 <DIR> d-------- c:\programmi\Norton Security Scan
2008-11-17 18:28 . 2008-11-21 10:41 <DIR> d-------- c:\programmi\Eset
2008-11-15 11:25 . 2008-11-15 12:02 <DIR> d-------- C:\windows installer +agg
2008-11-14 11:18 . 2008-11-14 11:18 <DIR> d-------- c:\windows\system32\PAV
2008-11-14 11:18 . 2007-06-06 10:43 83,640 --a------ c:\windows\system32\drivers\pavdrv51.sys
2008-11-14 11:17 . 2007-07-12 08:42 292,144 --a------ c:\windows\system32\PavSHook.dll
2008-11-14 11:17 . 2007-03-13 18:01 161,328 --a------ c:\windows\system32\TpUtil.dll
2008-11-14 11:17 . 2006-06-27 19:36 101,888 --a------ c:\windows\system32\SYSTOOLS.DLL
2008-11-14 11:17 . 2007-02-28 18:04 63,024 --a------ c:\windows\system32\pavipc.dll
2008-11-14 11:17 . 2007-06-08 08:44 24,760 --a------ c:\windows\system32\drivers\cpoint.sys
2008-11-10 17:54 . 2007-03-06 17:33 12,336 --a------ c:\windows\system32\PGUNNT.EXE
2008-11-10 13:24 . 2008-11-13 17:56 624,081 --a------ c:\windows\system32\EPSTP32U.CAB
2008-11-10 13:24 . 2008-11-10 13:24 471,802 --a------ c:\windows\system32\EPSETUP.CAB
2008-11-10 13:24 . 2008-11-10 13:24 292,395 --a------ c:\windows\system32\EPPRTDRV.CAB
2008-11-10 13:24 . 2003-11-17 23:00 6,328 --a------ c:\windows\system32\EPSTP32U.DAT
2008-11-07 18:37 . 2008-11-07 18:37 <DIR> d-------- c:\programmi\Webroot
2008-11-07 18:37 . 2008-11-07 18:37 <DIR> d-------- c:\documents and settings\pcmf.MF-CAKSV2APT278\Dati applicazioni\Webroot
2008-11-07 18:37 . 2008-11-07 18:37 <DIR> d-------- c:\documents and settings\All Users.WINDOWS\Dati applicazioni\Webroot
2008-11-07 18:37 . 2008-01-04 20:56 1,526,640 --a------ c:\windows\WRSetup.dll
2008-11-07 11:14 . 2008-11-07 11:14 <DIR> d--h-c--- c:\documents and settings\All Users.WINDOWS\Dati applicazioni\{B46E1EF5-0B37-4DB4-A4E2-9F2B41036185}
2008-11-03 20:21 . 2008-11-03 20:21 <DIR> d-------- C:\Inetpub
2008-11-03 19:53 . 2008-11-03 19:56 60,800 --a------ c:\windows\system32\S32EVNT1.DLL
2008-11-03 18:32 . 2008-11-03 18:32 <DIR> d-------- c:\programmi\Microsoft Silverlight
2008-11-03 12:44 . 2008-11-10 17:52 46,640 --a------ c:\windows\system32\msln.exe
2008-10-29 18:23 . 2008-10-29 18:23 <DIR> d-------- c:\programmi\Microsoft Works

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-21 14:01 --------- d-----w c:\programmi\File comuni\Symantec Shared
2008-11-20 11:16 --------- d-----w c:\programmi\Spybot - Search & Destroy
2008-11-20 11:16 --------- d-----w c:\documents and settings\All Users.WINDOWS\Dati applicazioni\Spybot - Search & Destroy
2008-11-19 22:55 --------- d-----w c:\programmi\Microsoft ActiveSync
2008-11-19 17:27 --------- d-----w c:\programmi\eMule
2008-11-18 11:29 --------- d-----w c:\programmi\Windows Media Bonus Pack for Windows XP
2008-11-18 11:19 --------- d-----w c:\programmi\Google
2008-11-18 11:05 --------- d---a-w c:\documents and settings\All Users.WINDOWS\Dati applicazioni\TEMP
2008-11-10 12:24 --------- d-----w c:\documents and settings\All Users.WINDOWS\Dati applicazioni\Skype
2008-11-10 10:03 --------- d--h--w c:\programmi\InstallShield Installation Information
2008-11-10 09:22 --------- d-----w c:\documents and settings\pcmf.MF-CAKSV2APT278\Dati applicazioni\skypePM
2008-11-03 18:56 805 ----a-w c:\windows\system32\drivers\SYMEVENT.INF
2008-11-03 18:56 10,563 ----a-w c:\windows\system32\drivers\SYMEVENT.CAT
2008-11-03 18:53 --------- d-----w c:\documents and settings\All Users.WINDOWS\Dati applicazioni\Symantec
2008-10-16 10:17 --------- d-----w c:\programmi\DFX
2008-10-15 11:17 --------- d-----w c:\programmi\Intel
2008-10-15 11:17 --------- d-----w c:\documents and settings\pcmf.MF-CAKSV2APT278\Dati applicazioni\InstallShield
2008-10-11 11:02 --------- d-----w c:\programmi\Canon
2008-10-11 10:24 --------- d-----w c:\programmi\File comuni\DFX
2008-10-11 10:24 --------- d-----w c:\documents and settings\All Users.WINDOWS\Dati applicazioni\DFX
2008-10-10 15:40 --------- d-----w c:\programmi\Custom Engineering
2008-10-01 11:37 --------- d-----w c:\programmi\Windows Sidebar
2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2008-09-22 10:01 --------- d-----w c:\documents and settings\All Users.WINDOWS\Dati applicazioni\DVD Shrink
2008-08-31 09:04 86,016 ----a-w c:\windows\system32\OpenAL32.dll
2008-08-31 09:04 262,144 ----a-w c:\windows\system32\wrap_oal.dll
2008-08-22 15:21 47,360 ----a-w c:\documents and settings\pcmf.MF-CAKSV2APT278\Dati applicazioni\pcouffin.sys
2007-02-27 16:20 3,932 -c--a-w c:\documents and settings\pcmf\Dati applicazioni\LMLayout.dat
2007-02-27 16:20 268 -c--a-w c:\documents and settings\pcmf\Dati applicazioni\LMCPaper.dat
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-19 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Samsung PanelMgr"="c:\windows\Samsung\PanelMgr\SSMMgr.exe" [2007-12-14 524288]
"EPSON Stylus C64 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I0C2.EXE" [2003-09-12 99840]
"SunJavaUpdateSched"="c:\programmi\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 49263]
"ATICCC"="c:\programmi\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 45056]
"nod32kui"="c:\programmi\Eset\nod32kui.exe" [2008-11-20 949376]
"SoundMan"="SOUNDMAN.EXE" [2004-01-09 c:\windows\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-19 15360]

c:\documents and settings\pcmf\Menu Avvio\Programmi\Esecuzione automatica\
Desktop Clock.lnk - c:\programmi\Digital Clock\DigitalClock.exe [2007-09-15 2699673]

c:\documents and settings\All Users.WINDOWS\Menu Avvio\Programmi\Esecuzione automatica\
Adobe Reader Speed Launch.lnk - c:\programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Avvio^Programmi^Esecuzione automatica^Kodak EasyShare software.lnk]
path=c:\documents and settings\All Users.WINDOWS\Menu Avvio\Programmi\Esecuzione automatica\Kodak EasyShare software.lnk
backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^pcmf.MF-CAKSV2APT278^Menu Avvio^Programmi^Esecuzione automatica^StarOffice 8.lnk]
path=c:\documents and settings\pcmf.MF-CAKSV2APT278\Menu Avvio\Programmi\Esecuzione automatica\StarOffice 8.lnk
backup=c:\windows\pss\StarOffice 8.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
--a------ 2008-11-20 12:54 51048 c:\programmi\File comuni\Symantec Shared\ccApp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-10-13 17:24 1694208 c:\programmi\Messenger\msmsgs.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\AvRack\\rtlrack.exe"=
"c:\programmi\Microsoft ActiveSync\rapimgr.exe"= c:\programmi\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\programmi\Microsoft ActiveSync\WCESMgr.exe"= c:\programmi\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Programmi\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmi\\Messenger\\msmsgs.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"84:TCP"= 84:TCP:VRS Recording System Web Control Panel
"4672:UDP"= 4672:UDP:*:Disabled:EmuleUDP
"4672:TCP"= 4672:TCP:*:Disabled:EmuleTCP
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R1 ShldDrv;Panda File Shield Driver;c:\windows\system32\DRIVERS\ShlDrv51.sys [2008-11-20 38968]
S2 cpoint;Panda CPoint Driver;c:\windows\system32\Drivers\cpoint.sys [2008-11-14 24760]
S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys []
S3 Di1611VM11;KONICA MINOLTA Di1611;c:\windows\system32\Drivers\Di1611.sys [2001-08-16 13824]
S3 FoxAwdWINFLASH;FoxAwdWINFLASH;\??\c:\programmi\SuperUtility\FoxAwdWINFLASH.SYS [2008-03-31 4380]
S3 FXDRV;FXDRV;\??\c:\programmi\SuperUtility\Fxdrv.sys [2008-03-31 13440]
S3 PAC7311;VGA USB Camera;c:\windows\system32\DRIVERS\PA707UCM.SYS []
S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\DRIVERS\wg111v2.sys [2007-11-28 194304]
S3 SIS163u;SiS 163 usb Wireless LAN Adapter Driver;c:\windows\system32\DRIVERS\sis163u.sys [2006-11-25 162304]
S4 hpt3xx;hpt3xx; []
S4 PavProc;Panda Process Protection Driver;\??\c:\windows\system32\DRIVERS\PavProc.sys [2008-11-20 178872]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0be77a66-af16-11dd-8b59-00155845f4fa}]
\Shell\Auto\command - D:\fun.xls.exe
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL fun.xls.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1375a534-a660-11dd-8b4a-00155845f4fa}]
\Shell\auto\command - Knight.exe open
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Knight.exe open
\Shell\explore\command - Knight.exe open
\Shell\find\command - Knight.exe open
\Shell\install\command - Knight.exe open
\Shell\open\command - Knight.exe open

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1375a535-a660-11dd-8b4a-00155845f4fa}]
\Shell\AutoRun\command - K:\nideiect.com
\Shell\explore\Command - K:\nideiect.com
\Shell\open\Command - K:\nideiect.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{19a4b212-8e0b-11dd-8b0b-00155845f4fa}]
\Shell\Auto\command - eudcojguz.exe
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL eudcojguz.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{25822702-8fde-11dd-8b12-00155845f4fa}]
\Shell\AutoRun\command - F:\nideiect.com
\Shell\explore\Command - F:\nideiect.com
\Shell\open\Command - F:\nideiect.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{533a95f8-6fec-11db-8c88-00179a300101}]
\Shell\AutoRun\command - K:\nideiect.com
\Shell\explore\Command - K:\nideiect.com
\Shell\open\Command - K:\nideiect.com
.
Contenuto della cartella 'Scheduled Tasks'

2008-11-21 c:\windows\Tasks\Norton Security Scan for pcmf.job
- c:\programmi\Norton Security Scan\Nss.exe [2008-09-19 04:18]

2008-11-21 c:\windows\Tasks\OGADaily.job
- c:\windows\system32\OGAVerify.exe [2008-04-23 16:17]

2008-11-22 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAVerify.exe [2008-04-23 16:17]
.
.
------- Supplementare di scansione -------
.
FireFox -: Profile - c:\documents and settings\pcmf.MF-CAKSV2APT278\Dati applicazioni\Mozilla\Firefox\Profiles\flapvuwj.default\
FF -: plugin - c:\programmi\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - c:\programmi\Microsoft Silverlight\2.0.31005.0\npctrl.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-22 10:44:35
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...


**************************************************************************
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

PROCESSO: c:\windows\system32\lsass.exe
-> c:\programmi\Eset\pr_imon.dll
.
Ora fine scansione: 2008-11-22 10.48.39
ComboFix-quarantined-files.txt 2008-11-22 09:47:36

Pre-Run: 55.130.071.040 byte disponibili
Post-Run: 55,115,726,848 byte disponibili

204 --- E O F --- 2008-11-15 13:16:56


..a dopo per il resto.... Poi dammi la risposta per quello che ti ho chiesto ieri notte!!
ciao

r16
Inviato: Saturday, November 22, 2008 11:48:40 AM
Rank: AiutAmico

Iscritto dal : 8/7/2007
Posts: 11,016
Ciao.
Se hai fatto girare le penne infette anche in altri pc, è chiaro che hai infettato pure quelli.
Comunque, hai 2 infezioni (Knight.exe open, e Worm Perlovga).
Per facilitarti la soluzione ti posto 2 link:
Questo è per Knight.exe :
http://ppecile.blogspot.com/2007/11/knightexe-il-virus-della-chiavetta.html
E questo per il Worm: (sono 2 pagine)
http://www.megalab.it/2899/
Leggili BENE, con attenzione, e risolverai.
Se sei fortunato è possibile che Virit o Malwarebyres,li elimina, ti dirò di più quando avrò visto i log.
r16
Inviato: Saturday, November 22, 2008 11:55:05 AM
Rank: AiutAmico

Iscritto dal : 8/7/2007
Posts: 11,016
Dimenticavo:
Per favore non saltare nessun passaggio sulle indicazioni che ti ho dato, anche se non sembra, sono tutte importanti.
Kalachado
Inviato: Monday, November 24, 2008 10:37:01 AM
Rank: AiutAmico

Iscritto dal : 3/23/2005
Posts: 63
ho usato i due programmi che mi hai indicato nell'ultimo topic, e sembra tutto ok perche nessuno dei due mi ha rilevato quelle infezioni! comunque ti posto il log di hijack poi vedi tu.... Mi sa pure che dovrò postarti i log di altri due pc che secondo me sono stati infettati e solo parzialmente puliti!! un pò di lavoro per te........
ciao e grazie ancora

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10.36.33, on 24/11/08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Programmi\Power Translator\LogoMedia TranslateDotNet Server.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmi\Eset\nod32krn.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0C2.EXE
C:\Programmi\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programmi\Eset\nod32kui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\ATI Technologies\ATI.ACE\cli.exe
C:\RegCleaner\RegCleanr.exe
C:\RegCleaner\RegCleanr.exe
C:\RegCleaner\RegCleanr.exe
C:\Programmi\internet explorer\iexplore.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: LEC - {1DBAB667-A486-421e-AFE4-CF07DD0088E5} - C:\Programmi\Power Translator\Applications\LEC IE Translation Extension.dll
O4 - HKLM\..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe /autorun
O4 - HKLM\..\Run: [EPSON Stylus C64 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0C2.EXE /P23 "EPSON Stylus C64 Series" /O5 "LPT1:" /M "Stylus C64"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Programmi\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [nod32kui] "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Crea preferito portatile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Programmi\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: LEC TranslateDotNet Server - Language Engineering Corporation, LLC - C:\Programmi\Power Translator\LogoMedia TranslateDotNet Server.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmi\Eset\nod32krn.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

--
End of file - 5588 bytes
r16
Inviato: Monday, November 24, 2008 12:51:06 PM
Rank: AiutAmico

Iscritto dal : 8/7/2007
Posts: 11,016
Ok, il log è pulito, ma fixa lo stesso queste voci di HJT:
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.5.0_09\bin\jusched.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
Dai una pulita (registro compreso)con CCleaner http://www.aiutaamici.com/software?ID=11223

Vai in Installazione Applicazioni, e rimuovi TUTTE le versioni Java che trovi, e installi questa:
http://www.aiutaamici.com/software?ID=11134
Scarica questo programmino(JavaRa) che ti togli tutti i file nascosti delle versioni vecchie di Java:
http://www.friulinews.it/modules.php?op=modload&name=News&file=article&sid=3175&mode=thread&order=0&thold=0
Una volta che ha eseguito il lavoro di pulitura lo puoi eliminare assieme al log che troverai in C:\.
Poi fai:
Start\Esegui\ copia-incolla questo comando: %temp% svuota la cartella TEMP.
Poi svuota anche il cestino.
Eseguile queste operazioni, che servono per tenere pulito un pò decentemente il pc.

Kalachado
Inviato: Wednesday, December 03, 2008 5:20:52 PM
Rank: AiutAmico

Iscritto dal : 3/23/2005
Posts: 63
cia r16..ti scrivo solo ora perchè stavo sistemando i pc che si erano infettati col beagle! quindi ho rifatto tutte le operazioni che avevamo fatto assieme nel primo pc più le ultyime indicazioni che mi avevi dato tu nell'ultimissima risposta! mi è rimasta solo una cosael mio pc di casa la cartella immagini di improvviso nn si apre più, o meglio ci clicco si apre la cartella ma dentro è vuota e il pc sembra impallato e per sbloccare e chiudere la finestra devo fare crtl-alt-canc!! eppure il pc del resto sembra ok... Cosa mi consigli??
ciao a presto....
r16
Inviato: Wednesday, December 03, 2008 5:53:25 PM
Rank: AiutAmico

Iscritto dal : 8/7/2007
Posts: 11,016
Ciao.
Purtroppo la semplice eliminazione di questo virus, non basta, perche si porta nella tomba file legittimi di Windows.
Puoi tentare 2 strade:
1) Se hai il CD originale di Winsows, inseriscilo nel lettore.
Poi fai:Start\Esegui\ e copia-incolla questa stringa: sfc /scannow .
In teoria dovrebbe ripristinare i file corrotti di Windows .
2) Ho visto che hai il Service Pack2.
Prova a installare il SP3 :
http://www.microsoft.com/downloads/details.aspx?displaylang=it&FamilyID=5b33b5a8-5e76-401f-be08-1e1555d4f3d4
Altra cosa:
Se mi posti un log aggiornato (in pratica fai una scansione) di Combofix avresti alcune cosette da sistemare.
Kalachado
Inviato: Thursday, December 04, 2008 4:52:44 PM
Rank: AiutAmico

Iscritto dal : 3/23/2005
Posts: 63
ok..
allora faccio nell'ordine le cose che mi hai indicato e poi come ultima cosa di mando quel log,
tra stanotte e domani provvedo..
Ah giusto per sapere, il log lo vuoi prima o dopo aver fatto quello che mi hai suggerito??
grazie mille
ciao ciao
r16
Inviato: Thursday, December 04, 2008 5:28:01 PM
Rank: AiutAmico

Iscritto dal : 8/7/2007
Posts: 11,016
Ciao.
E' meglio se mi posti il log dopo che hai eseguito le indicazioni che ti ho dato.

Utenti presenti in questo topic
Guest


Salta al Forum
Aggiunta nuovi Topic disabilitata in questo forum.
Risposte disabilitate in questo forum.
Eliminazione tuoi Post disabilitata in questo forum.
Modifica dei tuoi post disabilitata in questo forum.
Creazione Sondaggi disabilitata in questo forum.
Voto ai sondaggi disabilitato in questo forum.

Main Forum RSS : RSS

Aiutamici Theme
Powered by Yet Another Forum.net versione 1.9.1.8 (NET v2.0) - 3/29/2008
Copyright © 2003-2008 Yet Another Forum.net. All rights reserved.