Ecco il log di Combifix.
Come mai dopo l'esecuzione Combofix mi ha cambiato alcune cose tipo lo sfondo?
Ok aspetto il tuo responso e speriamo bene...!!ComboFix 09-06-03.04 - Angelo 04/06/2009 19.08.41.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.39.1040.18.1918.1235 [GMT 2:00]
Eseguito da: c:\users\Angelo\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1229 [VPS 081126-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: avast! antivirus 4.8.1229 [VPS 081126-0] *enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\users\Angelo\AppData\Roaming\drivers\downld
c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
c:\windows\system32\drivers\Msft_User_PCCSWpdDriver_01_05_00.Wdf
c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
D:\Desktop.ini
.
((((((((((((((((((((((((( Files Creati Da 2009-05-04 al 2009-06-04 )))))))))))))))))))))))))))))))))))
.
2009-06-04 16:01 . 2009-06-04 16:01 -------- d-----w- c:\program files\Trend Micro
2009-06-04 14:00 . 2009-06-04 14:00 -------- d-----w- c:\users\Angelo\AppData\Roaming\Malwarebytes
2009-06-04 13:59 . 2009-05-26 11:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-04 13:59 . 2009-06-04 13:59 -------- d-----w- c:\programdata\Malwarebytes
2009-06-04 13:59 . 2009-06-04 14:00 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-04 13:59 . 2009-05-26 11:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-03 15:48 . 2009-06-03 15:59 -------- d-----w- c:\users\Angelo\.housecall6.6
2009-06-02 18:31 . 2008-08-28 03:40 712704 ----a-w- c:\windows\system32\WindowsCodecs.dll
2009-06-02 18:31 . 2008-08-28 03:40 347136 ----a-w- c:\windows\system32\WindowsCodecsExt.dll
2009-06-02 18:31 . 2008-08-28 03:40 425472 ----a-w- c:\windows\system32\PhotoMetadataHandler.dll
2009-06-02 18:31 . 2008-09-18 04:56 125952 ----a-w- c:\windows\system32\wersvc.dll
2009-06-02 18:31 . 2008-09-18 04:56 147456 ----a-w- c:\windows\system32\Faultrep.dll
2009-06-02 18:31 . 2008-10-22 03:57 241152 ----a-w- c:\windows\system32\PortableDeviceApi.dll
2009-06-02 18:31 . 2008-10-21 05:25 1645568 ----a-w- c:\windows\system32\connect.dll
2009-05-24 08:08 . 2009-05-24 08:08 -------- d-----w- c:\users\Angelo\AppData\Roaming\vlc
2009-05-17 21:10 . 2009-05-17 21:10 -------- d-----w- c:\windows\Sun
2009-05-17 09:03 . 2009-05-17 09:03 -------- d-----w- c:\program files\JRE
2009-05-16 16:23 . 2006-10-02 10:38 10368 ----a-w- c:\windows\system32\drivers\pfc.sys
2009-05-16 16:23 . 2009-05-16 16:23 -------- d-----w- c:\program files\MemoriesOnTV4
2009-05-16 13:56 . 2006-07-24 14:05 5632 ----a-w- c:\windows\system32\drivers\StarOpen.sys
2009-05-16 13:43 . 2009-05-16 14:58 -------- d-----w- c:\windows\system32\Samsung_USB_Drivers
2009-05-16 10:14 . 2008-06-11 08:47 9022288 ----a-w- c:\users\Angelo\AppData\Roaming\TomTom\HOME\Profiles\w68vht7g.default\extensions\Navcore.8.010.9369@tomtom.com\8-010-9369-1.dll
2009-05-16 10:07 . 2009-05-16 10:07 19165248 ----a-w- c:\users\Angelo\AppData\Roaming\TomTom\HOME\Profiles\w68vht7g.default\Updates\v2_6_2_1586_win.exe
2009-05-15 15:44 . 2009-05-15 15:44 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-05-13 16:38 . 2009-06-04 17:10 -------- d--h--w- c:\users\Angelo\AppData\Roaming\drivers
2009-05-07 14:17 . 2009-05-07 14:21 -------- d-----w- c:\users\Angelo\AppData\Roaming\VoipCheapCom
2009-05-06 16:51 . 2009-05-29 22:20 -------- d-----w- c:\users\Angelo\AppData\Roaming\skypePM
2009-05-06 16:49 . 2009-05-29 23:21 -------- d-----w- c:\users\Angelo\AppData\Roaming\Skype
2009-05-06 16:48 . 2009-05-06 16:48 -------- d-----w- c:\program files\Common Files\Skype
2009-05-06 16:48 . 2009-05-06 16:48 -------- d-----r- c:\program files\Skype
2009-05-06 16:48 . 2009-05-06 16:48 -------- d-----w- c:\programdata\Skype
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-04 17:06 . 2008-03-19 18:05 662608 ----a-w- c:\windows\system32\perfh010.dat
2009-06-04 17:06 . 2008-03-19 18:05 120120 ----a-w- c:\windows\system32\perfc010.dat
2009-06-03 21:36 . 2008-11-14 15:44 1 ----a-w- c:\users\Angelo\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-06-03 16:17 . 2008-06-03 14:59 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2009-05-28 21:35 . 2008-05-31 09:57 -------- d-----w- c:\users\Angelo\AppData\Roaming\Canon
2009-05-17 20:39 . 2008-05-24 18:27 79856 ----a-w- c:\users\Angelo\AppData\Local\GDIPFONTCACHEV1.DAT
2009-05-17 09:27 . 2008-11-14 15:41 -------- d-----w- c:\program files\OpenOffice.org 3
2009-05-16 14:55 . 2008-03-19 10:24 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-16 14:05 . 2008-10-13 15:08 -------- d-----w- c:\users\Angelo\AppData\Roaming\dvdcss
2009-05-13 16:42 . 2008-03-19 10:19 -------- d-----w- c:\programdata\NVIDIA
2009-04-29 15:46 . 2009-04-29 15:30 -------- d-----w- c:\program files\StreamerOne
2009-04-14 17:55 . 2008-05-24 22:57 3414 ----a-w- c:\users\Angelo\AppData\Roaming\wklnhst.dat
2009-03-24 15:09 . 2009-03-24 15:08 19131752 ----a-w- c:\users\Angelo\AppData\Roaming\TomTom\HOME\Profiles\w68vht7g.default\Updates\v2_6_1_1549_win.exe
2009-03-17 03:38 . 2009-04-15 14:56 13824 ----a-w- c:\windows\system32\apilogen.dll
2009-03-17 03:38 . 2009-04-15 14:56 24064 ----a-w- c:\windows\system32\amxread.dll
2009-03-14 14:05 . 2009-01-16 17:45 130424 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2009-03-09 04:19 . 2008-12-16 10:15 410984 ----a-w- c:\windows\system32\deploytk.dll
2008-05-31 09:56 . 2008-05-31 09:56 22 --sha-w- c:\windows\SMINST\HPCD.sys
2008-03-19 18:46 . 2008-03-19 18:07 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-06-16 221184]
"IncrediMail"="c:\program files\IncrediMail\bin\IncMail.exe" [2009-01-27 251264]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\HOMERunner.exe" [2008-09-26 206184]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-12-03 1205760]
"Google Update"="c:\users\Angelo\AppData\Local\Google\Update\GoogleUpdate.exe" [2009-03-06 133104]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536]
"OsdMaestro"="c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 118784]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"SunJavaUpdateReg"="c:\windows\system32\jureg.exe" [2007-04-07 54936]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 81920]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-12-12 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-12 8497696]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-12 81920]
"00PCTFW"="c:\program files\PC Tools Firewall Plus\FirewallGUI.exe" [2009-02-24 2652056]
"AliceRV_McciTrayApp"="c:\program files\Alice ti aiuta\McciTrayApp.exe" [2007-01-23 1001472]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-01-15 4874240]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3387747320-1401262192-1851602387-1000]
"EnableNotificationsRef"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{FD233EC6-ABBC-4B7B-A1B4-296DC0DD6ECE}"= c:\program files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{F1248671-6819-488E-A362-CBD76299F18C}"= Disabled:UDP:c:\program files\IncrediMail\bin\ImpCnt.exe:IncrediMail
"{356A1957-3ECD-4182-A79D-0374F8F3C5C7}"= Disabled:TCP:c:\program files\IncrediMail\bin\ImpCnt.exe:IncrediMail
"{D93D1452-5C84-42F0-A044-4A3898752627}"= Disabled:UDP:c:\program files\IncrediMail\bin\ImpCnt.exe:IncrediMail
"{642F6BCA-8EAB-4AA3-89AC-D5DC848FF931}"= Disabled:TCP:c:\program files\IncrediMail\bin\ImpCnt.exe:IncrediMail
"{921B2287-CA16-4354-BA6A-EEC515606171}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{D3C59F35-4DEC-4A5E-BA43-C14A20862AFC}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{04635BE4-5B4E-4885-8E7B-629F83F0954A}"= UDP:c:\program files\VoipCheapCom\VoipCheapCom.exe:VoipCheapCom
"{B18FFB14-4620-49F9-BC94-453128569AAA}"= TCP:c:\program files\VoipCheapCom\VoipCheapCom.exe:VoipCheapCom
"{4A173A0F-9EF0-411E-BA6B-41DC42F06CA4}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{CC43CF35-4FD8-46A4-AE32-0AA19D6E45BC}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{BC6AC0EB-0D7C-4BC9-8A32-414334C927CA}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{F060AC09-AC84-48DC-A3F1-6AABB03E2EEA}"= Disabled:UDP:c:\program files\IncrediMail\bin\IncMail.exe:IncrediMail
"{A58524F9-44F2-430D-826A-F720A8F14026}"= Disabled:TCP:c:\program files\IncrediMail\bin\IncMail.exe:IncrediMail
"{A365366A-6241-4B2C-BA24-58849FFFCCE0}"= Disabled:UDP:c:\program files\IncrediMail\bin\ImApp.exe:IncrediMail
"{E450CA8B-8FC2-45D3-868F-E4CC33D3765F}"= Disabled:TCP:c:\program files\IncrediMail\bin\ImApp.exe:IncrediMail
"{571261DE-0A96-465F-A5B7-14D91FD7BE1D}"= Disabled:UDP:c:\program files\IncrediMail\bin\IncMail.exe:IncrediMail
"{31011537-CD2C-4B4E-BB45-05A6C62C941C}"= Disabled:TCP:c:\program files\IncrediMail\bin\IncMail.exe:IncrediMail
"{90230350-EE67-45DA-A760-C4FE041A5085}"= Disabled:UDP:c:\program files\IncrediMail\bin\ImApp.exe:IncrediMail
"{BB052240-5EF9-4D59-B008-CA1E20D52C41}"= Disabled:TCP:c:\program files\IncrediMail\bin\ImApp.exe:IncrediMail
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [28/05/2008 1.01.26 114768]
R1 pctgntdi;pctgntdi;c:\windows\System32\drivers\pctgntdi.sys [16/01/2009 19.45.13 159600]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [28/05/2008 1.01.26 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [28/05/2008 1.01.18 51792]
R2 PCTAppEvent;PCTAppEvent Driver;c:\windows\System32\drivers\PCTAppEvent.sys [16/01/2009 19.45.15 73840]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [03/06/2008 16.59.45 810320]
R3 pctplfw;pctplfw;c:\windows\System32\drivers\pctplfw.sys [16/01/2009 19.44.49 95640]
.
Contenuto della cartella 'Scheduled Tasks'
2009-05-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3387747320-1401262192-1851602387-1000.job
- c:\users\Angelo\AppData\Local\Google\Update\GoogleUpdate.exe [2009-03-06 19:12]
2009-06-04 c:\windows\Tasks\User_Feed_Synchronization-{926B20C0-F68D-481F-B48F-1A170A11CA2B}.job
- c:\windows\system32\msfeedssync.exe [2008-06-06 07:33]
.
- - - - CHIAVI ORFANE RIMOSSE - - - -
HKLM-Run-HP Health Check Scheduler - [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
SafeBoot-procexp90.Sys
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=it_it&c=81&bd=Presario&pf=desktop
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Angelo\AppData\Roaming\Mozilla\Firefox\Profiles\d3svod4f.default\
FF - prefs.js: browser.search.selectedEngine - MyStart Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.it/
FF - prefs.js: keyword.URL - hxxp://mystart.incredimail.com/?loc=ff_address_bar&search=
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\users\Angelo\AppData\Local\Google\Update\1.2.145.5\npGoogleOneClick8.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-06-04 19:11
Windows 6.0.6001 Service Pack 1 NTFS
scansione processi nascosti ...
scansione entrate autostart nascoste ...
Scansione files nascosti ...
Scansione completata con successo
Files nascosti: 0
**************************************************************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="FirefoxHTML"
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="FirefoxHTML"
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="FirefoxHTML"
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="FirefoxHTML"
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="FirefoxHTML"
.
Ora fine scansione: 2009-06-04 19.12.39
ComboFix-quarantined-files.txt 2009-06-04 17:12
Pre-Run: 109.775.659.008 byte disponibili
Post-Run: 109.765.120.000 byte disponibili
206 --- E O F --- 2009-06-02 18:32
