Help: la posta continua ricevere spam con MITTENTE il mio
nome.cognome@dominio.it.....
per velocizzare la diagnosi, vi dico che uso abitualmente:
- ccleaner
- spyboot s&d
- superantispyware
- spywareblaster
Come antivirus uso NOD32
Mi ritenevo abbastanza "immune" da trojan & C., ma tant'è....la posta è veramente piena!
Ho guardato gli ultimi post di questo forum...e ho fatto queste 2 cose:
- eseguito MalwareBytes
- eseguito ComboFix
Ecco i rispettivi log:
Malwarebytes' Anti-Malware 1.41
Versione del database: 2861
Windows 5.1.2600 Service Pack 3
26/09/2009 8.08.54
mbam-log-2009-09-26 (08-08-54).txt
________________________________________________
C'è qualche cosa che posso fare?
Grazie
Tipo di scansione: Scansione completa (C:\|D:\|)
Elementi scansionati: 222805
Tempo trascorso: 57 minute(s), 46 second(s)
Processi delle memoria infetti: 0
Moduli della memoria infetti: 0
Chiavi di registro infette: 0
Valori di registro infetti: 0
Elementi dato del registro infetti: 0
Cartelle infette: 0
File infetti: 0
Processi delle memoria infetti:
(Nessun elemento malevolo rilevato)
Moduli della memoria infetti:
(Nessun elemento malevolo rilevato)
Chiavi di registro infette:
(Nessun elemento malevolo rilevato)
Valori di registro infetti:
(Nessun elemento malevolo rilevato)
Elementi dato del registro infetti:
(Nessun elemento malevolo rilevato)
Cartelle infette:
(Nessun elemento malevolo rilevato)
File infetti:
(Nessun elemento malevolo rilevato)
______________________________________
ComboFix 09-09-25.01 - XXXXX.XXXXX 26/09/2009 8.19.11.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.39.1040.18.2038.1346 [GMT 2:00]
Eseguito da: c:\documents and settings\XXXXX.XXXXX\Desktop\ComboFix.exe
AV: Sistema Antivirus NOD32 2.70 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Resident AV is active
ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\XXXXX.XXXXX\Dati applicazioni\Microsoft\Clip Organizer\mstore10.mgc
c:\documents and settings\XXXXX.XXXXX\Dati applicazioni\Microsoft\Clip Organizer\Offic10.MGC
c:\documents and settings\XXXXX\Dati applicazioni\Microsoft\Clip Organizer\mstore10.mgc
c:\documents and settings\XXXXX\Dati applicazioni\Microsoft\Clip Organizer\Offic10.MGC
c:\programmi\WinPCap
c:\programmi\WinPCap\daemon_mgm.exe
c:\programmi\WinPCap\npf_mgm.exe
c:\programmi\WinPCap\rpcapd.exe
c:\windows\Installer\9bb2c.msi
c:\windows\system32\drivers\npf.sys
c:\windows\system32\Packet.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\WanPacket.dll
c:\windows\system32\wpcap.dll
D:\AUTORUN.INF
.
((((((((((((((((((((((((((((((((((((((( Driver/Servizi )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_NPF
-------\Service_NPF
((((((((((((((((((((((((( Files Creati Da 2009-08-26 al 2009-09-26 )))))))))))))))))))))))))))))))))))
.
2009-09-26 05:09 . 2009-09-26 05:09 -------- d-----w- c:\documents and settings\XXXXX.XXXXX\Dati applicazioni\Malwarebytes
2009-09-26 05:09 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-26 05:09 . 2009-09-26 05:09 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Malwarebytes
2009-09-26 05:09 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-26 05:09 . 2009-09-26 05:09 -------- d-----w- c:\programmi\Malwarebytes' Anti-Malware
2009-09-14 10:41 . 2009-09-14 10:41 -------- d-----w- c:\programmi\iPod
2009-09-14 10:41 . 2009-09-14 10:43 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-09-10 06:18 . 2009-06-21 21:47 153088 ------w- c:\windows\system32\dllcache\triedit.dll
2009-08-31 13:35 . 2009-08-31 13:35 -------- d-----w- c:\documents and settings\XXXXX.XXXXX\Dati applicazioni\ArcSoft
2009-08-31 13:31 . 2009-08-31 13:31 921632 ----a-w- C:\PA207.DAT
2009-08-31 13:18 . 2005-02-23 12:58 11776 ----a-w- c:\windows\system32\drivers\afc.sys
2009-08-31 13:18 . 1995-08-01 02:44 212480 ----a-w- c:\windows\PCDLIB32.DLL
2009-08-31 13:16 . 2006-11-03 08:59 48128 ----a-w- c:\windows\system32\Remove.exe
2009-08-31 13:16 . 2009-08-31 13:16 -------- d-----w- c:\windows\PixArt
2009-08-31 13:16 . 2009-08-31 13:16 -------- d-----w- c:\programmi\File comuni\PAC207
2009-08-31 13:16 . 2009-08-31 13:16 -------- d-----w- c:\programmi\Trust
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-26 06:28 . 2008-02-27 11:47 -------- d-----w- c:\documents and settings\XXXXX.XXXXX\Dati applicazioni\Skype
2009-09-26 04:23 . 2008-05-02 21:36 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Spybot - Search & Destroy
2009-09-26 04:13 . 2008-02-27 11:50 -------- d-----w- c:\documents and settings\XXXXX.XXXXX\Dati applicazioni\skypePM
2009-09-26 04:13 . 2009-02-11 14:00 -------- d-----w- c:\programmi\Microsoft Silverlight
2009-09-25 12:55 . 2008-05-02 21:32 -------- d-----w- c:\programmi\SUPERAntiSpyware
2009-09-25 11:31 . 2008-05-02 21:48 -------- d---a-w- c:\documents and settings\All Users\Dati applicazioni\TEMP
2009-09-25 11:31 . 2008-05-02 21:48 -------- d-----w- c:\programmi\SpywareBlaster
2009-09-23 05:28 . 2008-06-02 21:21 -------- d-----w- c:\documents and settings\XXXXX.XXXXX\Dati applicazioni\BitTorrent
2009-09-14 11:01 . 2008-04-13 08:18 -------- d-----w- c:\documents and settings\XXXXX.XXXXX\Dati applicazioni\Apple Computer
2009-09-14 10:43 . 2009-03-17 08:11 -------- d-----w- c:\programmi\iTunes
2009-09-14 10:41 . 2008-04-13 08:17 -------- d-----w- c:\programmi\File comuni\Apple
2009-09-14 10:38 . 2008-04-13 08:18 -------- d-----w- c:\programmi\QuickTime
2009-09-05 13:23 . 2009-01-07 21:07 -------- d-----w- c:\documents and settings\XXXXX.XXXXX\Dati applicazioni\LaParola
2009-09-05 13:23 . 2009-01-07 21:07 -------- d-----w- c:\programmi\LaParola
2009-08-31 13:36 . 2007-08-09 17:49 -------- d--h--w- c:\programmi\InstallShield Installation Information
2009-08-26 13:46 . 2009-08-26 13:45 -------- d-----r- c:\programmi\Skype
2009-08-26 13:46 . 2009-08-26 13:46 -------- d-----w- c:\programmi\File comuni\Skype
2009-08-26 13:45 . 2008-02-27 11:47 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Skype
2009-08-23 12:36 . 2008-04-30 20:27 -------- d--h--r- c:\programmi\rnamfler
2009-08-22 21:16 . 2008-05-02 21:36 -------- d-----w- c:\programmi\Spybot - Search & Destroy
2009-08-05 08:59 . 2004-08-19 18:00 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-17 19:01 . 2004-08-19 18:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-13 21:43 . 2004-08-19 18:00 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-06-29 15:55 . 2007-04-18 12:32 827392 ----a-w- c:\windows\system32\wininet.dll
2009-06-29 15:55 . 2004-08-19 18:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-06-29 15:54 . 2004-08-19 18:00 17408 ------w- c:\windows\system32\corpol.dll
2008-06-13 08:18 . 2008-06-13 08:18 15251 ----a-w- c:\programmi\settings.dat
2008-03-01 23:38 . 2008-05-02 21:40 2671816 ----a-w- c:\programmi\spywareblastersetup40.exe
2008-01-29 20:45 . 2008-05-02 21:32 9722720 ----a-w- c:\programmi\spybotsd152.exe
2007-12-09 14:19 . 2008-05-02 21:40 2531 ----a-w- c:\programmi\LEGGIMI2.htm
2007-12-09 14:19 . 2008-05-02 21:32 2531 ----a-w- c:\programmi\LEGGIMI.htm
2006-10-19 14:30 . 2008-06-09 14:52 533574 ----a-w- c:\programmi\pllangs.exe
2006-10-19 14:28 . 2008-06-09 14:51 2855080 ----a-w- c:\programmi\aawsepersonal.exe
2009-02-24 19:34 . 2009-02-24 19:34 1044480 ----a-w- c:\programmi\mozilla firefox\plugins\libdivx.dll
2009-02-24 19:34 . 2009-02-24 19:34 200704 ----a-w- c:\programmi\mozilla firefox\plugins\ssldivx.dll
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"\\Pc-sottoscala\EPSON Stylus DX4000 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE" [2006-09-21 139264]
"PMCLoader"="c:\programmi\Pinnacle\TVCenter Pro\PMCLoader.exe" [2008-01-24 644368]
"EyeDefender"="c:\programmi\EyeDefender\EyeDefender.exe" [2008-09-12 185856]
"Skype"="c:\programmi\Skype\Phone\Skype.exe" [2009-07-16 25604904]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"preload"="c:\windows\RUNXMLPL.exe" [2007-04-21 20480]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-01-08 52256]
"Acer ePresentation HPD"="c:\acer\Empowering Technology\ePresentation\ePresentation.exe" [2007-03-02 208896]
"nod32kui"="c:\programmi\Eset\nod32kui.exe" [2008-02-25 949376]
"ePower_DMC"="c:\acer\Empowering Technology\ePower\ePower_DMC.exe" [2007-07-04 475136]
"Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"AppleSyncNotifier"="c:\programmi\File comuni\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"Synchronization Manager"="c:\windows\system32\mobsync.exe" [2008-04-14 143872]
"QuickTime Task"="c:\programmi\QuickTime\QTTask.exe" [2009-09-04 417792]
"iTunesHelper"="c:\programmi\iTunes\iTunesHelper.exe" [2009-09-08 305440]
c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
DATE.lnk - c:\documents and settings\XXXXX.XXXXX\Desktop\download\USB\Utility e installazioni\Date\DATE.EXE [2008-4-17 394240]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"DisablePersonalDirChange"= 1 (0x1)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\programmi\SUPERAntiSpyware\SASSEH.DLL" [2008-11-30 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-25 12:55 548352 ----a-w- c:\programmi\SUPERAntiSpyware\SASWINLO.DLL
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-3354870832-3788894492-1362349887-1124\Scripts\Logoff\0\0]
"Script"=end.bat
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-3354870832-3788894492-1362349887-1124\Scripts\Logon\0\0]
"Script"=start.bat
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Boot"=c:\acer\Empowering Technology\ePower\Boot.exe
"IgfxTray"=c:\windows\system32\igfxtray.exe
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
"Motive SmartBridge"=c:\progra~1\ALICET~1\SMARTB~1\MotiveSB.exe
"MSPY2002"=c:\windows\system32\IME\PINTLGNT\ImScInst.exe /SYNC
"Persistence"=c:\windows\system32\igfxpers.exe
"PHIME2002A"=c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
"PHIME2002ASync"=c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
"QuickTime Task"="c:\programmi\QuickTime\qttask.exe" -atboottime
"SunJavaUpdateSched"="c:\programmi\Java\jre1.6.0_07\bin\jusched.exe"
"SynTPEnh"=c:\programmi\Synaptics\SynTP\SynTPEnh.exe
"TkBellExe"="c:\programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
"AzMixerSel"=c:\programmi\Realtek\InstallShield\AzMixerSel.exe
"eDataSecurity Loader"=c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
"ePower_DMC"=c:\acer\Empowering Technology\ePower\ePower_DMC.exe
"eRecoveryService"=c:\acer\Empowering Technology\eRecovery\eRAgent.exe
"HotKeysCmds"=c:\windows\system32\hkcmd.exe
"IAAnotif"="c:\programmi\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
"LManager"=c:\progra~1\LAUNCH~1\LManager.exe
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe"
"RTHDCPL"=RTHDCPL.EXE
"Monitor"=c:\windows\PixArt\PAC207\Monitor.exe
"Alcmtr"=ALCMTR.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"=
"c:\\Programmi\\Alt-N Technologies\\ComAgent\\ComAgent.exe"=
"c:\\Programmi\\Mozilla Firefox\\firefox.exe"=
"c:\\Programmi\\DNA\\btdna.exe"=
"c:\\Programmi\\BitTorrent\\bittorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmi\\Real\\RealPlayer\\realplay.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"=
"c:\\Programmi\\SUPERAntiSpyware\\SUPERAntiSpyware.exe"=
"c:\\Programmi\\Bonjour\\mDNSResponder.exe"=
"c:\documents and settings\XXXXX.XXXXX\Dati applicazioni\Facebook\facebook.exe"= c:\documents and settings\XXXXX.XXXXX\Dati applicazioni\Facebook\facebook.exe:127.0.0.1/255.255.255.255:Enabled:Facebook
"c:\\Programmi\\iTunes\\iTunes.exe"=
"c:\\Programmi\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"16030:TCP"= 16030:TCP:bittorrent
R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [25/02/2008 17.40.02 15424]
R1 SASDIFSV;SASDIFSV;c:\programmi\SUPERAntiSpyware\SASDIFSV.SYS [29/02/2008 16.03.48 9968]
R1 SASKUTIL;SASKUTIL;c:\programmi\SUPERAntiSpyware\SASKUTIL.SYS [29/02/2008 16.03.46 74480]
S3 Ltn_stk7070P;PCTV based TV tuner device;c:\windows\system32\drivers\Ltn_stk7070P.sys [21/05/2008 1.38.37 466048]
S3 Ltn_stkrc;PCTV Infrared Receiver;c:\windows\system32\drivers\Ltn_stkrc.sys [21/05/2008 1.38.38 13440]
S3 PAC207;Trust WB-1400T Webcam;c:\windows\system32\drivers\PFC027.SYS [14/05/2007 10.26.10 508288]
S3 SASENUM;SASENUM;c:\programmi\SUPERAntiSpyware\SASENUM.SYS [16/02/2006 16.51.08 4096]
.
Contenuto della cartella 'Scheduled Tasks'
2009-09-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programmi\Apple Software Update\SoftwareUpdate.exe [2008-04-11 11:34]
2009-09-26 c:\windows\Tasks\{F897AA24-BDC3-11D1-B85B-00C04FB93981}_XXXXX.XXXXX_XXXXX.XXXXX.job
- c:\windows\system32\mobsync.exe [2004-08-19 02:14]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uInternet Settings,ProxyOverride = *.local
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
LSP: c:\windows\system32\imon.dll
TCP: {C411A8F6-1BDE-4008-95E7-1F256BF2296D} = 192.168.1.1,212.216.112.112
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
FF - ProfilePath - c:\documents and settings\XXXXX.XXXXX\Dati applicazioni\Mozilla\Firefox\Profiles\6o0me9la.default\
FF - prefs.js: browser.startup.homepage - hxxp://antefatto.ilcannocchiale.it/
FF - plugin: c:\programmi\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\programmi\Mozilla Firefox\plugins\npbittorrent.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - CHIAVI ORFANE RIMOSSE - - - -
HKCU-Run-PMCRemote - (no file)
AddRemove-{F38ADCA4-AF7C-4C73-9021-6F1EA15D15EA} - c:\programmi\InstallShield Installation Information\{F38ADCA4-AF7C-4C73-9021-6F1EA15D15EA}\Setup.exeUNINSTALL
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-09-26 08:27
Windows 5.1.2600 Service Pack 3 NTFS
scansione processi nascosti ...
scansione entrate autostart nascoste ...
Scansione files nascosti ...
Scansione completata con successo
Files nascosti: 0
**************************************************************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,8b,01,e7,7f,60,
4e,c7,d4,c8,28,51,af,b0,29,a3,98,d5,dc,4b,58,90,cb,9d,6c,e2,63,26,f1,3f,c8,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:71,3b,04,66,8b,46,0d,96,9b,10,e1,9c,cf,
f9,3c,f0,71,3b,04,66,8b,46,0d,96,ad,76,b1,d7,5f,6f,89,30,6a,9c,d6,61,af,45,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:7a,45,05,fd,91,e8,6f,31,8a,f1,75,8a,ae,
f3,00,74,25,da,ec,7e,55,20,c9,26,6f,b4,13,29,79,ab,92,d9,ff,7c,85,e0,43,d4,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:6b,65,49,6a,7e,99,74,f7,b4,df,96,16,1f,
53,45,4b,3e,1e,9e,e0,57,5a,93,61,8d,3d,3c,e8,ff,a3,a2,3f,86,8c,21,01,be,91,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:e9,02,6c,fa,fb,1d,47,57,cc,06,4c,58,2d,
51,fb,53,cd,44,cd,b9,a6,33,6c,cd,25,5b,a7,d2,e1,b7,92,82,f5,1d,4d,73,a8,13,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:50,93,e5,ab,ec,6a,4e,ab,28,19,75,8c,5f,
bd,91,18,b0,18,ed,a7,3f,8d,37,a4,b5,24,2f,dd,4b,17,11,d0,df,20,58,62,78,6b,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:fb,a7,78,e6,12,2f,9a,ea,f8,d3,68,3a,f5,
0b,96,fb,31,77,e1,ba,b1,f8,68,02,c2,b5,a2,54,de,96,95,c9,fb,a7,78,e6,12,2f,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:83,6c,56,8b,a0,85,96,ab,0b,03,ba,ac,56,
e5,ee,80,83,6c,56,8b,a0,85,96,ab,30,35,f5,c1,10,40,2b,53,01,3a,48,fc,e8,04,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:51,fa,6e,91,28,9e,14,cc,bf,7c,27,df,19,
14,b2,51,51,fa,6e,91,28,9e,14,cc,fc,3e,5d,df,06,8b,e6,1a,f6,0f,4e,58,98,5b,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,7e,4c,ad,d1,d6,
1a,89,26,b1,cd,45,5a,a8,c4,f8,b9,09,e8,a6,8a,4e,a6,48,17,3d,ce,ea,26,2d,45,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,98,0b,6f,9c,27,
c8,46,1c,e3,0e,66,d5,eb,bc,2f,6b,16,3f,00,e9,0b,61,f4,92,2a,b7,cc,b5,b9,7f,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:fa,ea,66,7f,d4,3b,6b,70,6b,76,d0,06,cc,
ec,56,69,fa,ea,66,7f,d4,3b,6b,70,43,8b,52,23,8f,6e,3d,44,6c,43,2d,1e,aa,22,\
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------
- - - - - - - > 'winlogon.exe'(856)
c:\programmi\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
- - - - - - - > 'lsass.exe'(912)
c:\windows\system32\imon.dll
c:\programmi\Eset\pr_imon.dll
- - - - - - - > 'explorer.exe'(3384)
c:\windows\system32\WININET.dll
c:\progra~1\FILECO~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
c:\programmi\File comuni\Microsoft Shared\Web Components\11\1040\OWCI11.DLL
c:\progra~1\FILECO~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
c:\programmi\File comuni\Microsoft Shared\Web Components\10\1040\OWCI10.DLL
c:\acer\Empowering Technology\ePower\SysHook.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\msls31.dll
c:\windows\system32\imon.dll
c:\programmi\Eset\pr_imon.dll
c:\windows\system32\WPDShServiceObj.dll
c:\programmi\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\programmi\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\programmi\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_ita.nlr
c:\programmi\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\programmi\Intel\Wireless\Bin\S24EvMon.exe
c:\programmi\Lavasoft\Ad-Aware\aawservice.exe
c:\progra~1\ALICET~1\vendors\AliceRE\content\template\DRIVEN~1\syncer\MCCITR~1.EXE
c:\programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\programmi\Bonjour\mDNSResponder.exe
c:\programmi\Intel\Wireless\Bin\EvtEng.exe
c:\programmi\Intel\Intel Matrix Storage Manager\IAANTmon.exe
c:\programmi\File comuni\LightScribe\LSSrvc.exe
c:\programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\programmi\ESET\nod32krn.exe
c:\programmi\Intel\Wireless\Bin\RegSrvc.exe
c:\programmi\CyberLink\Shared Files\RichVideo.exe
c:\acer\Empowering Technology\eLock\Service\eLockServ.exe
c:\programmi\iPod\bin\iPodService.exe
c:\windows\system32\wbem\unsecapp.exe
.
**************************************************************************
.
Ora fine scansione: 2009-09-26 8.32.09 - Il pc è stato riavviato
ComboFix-quarantined-files.txt 2009-09-26 06:32
Pre-Run: 7.853.617.152 byte disponibili
Post-Run: 8.047.173.632 byte disponibili
327 --- E O F --- 2009-09-10 06:24
_____________________________________
GRAZIE cmq se avete un qualsiasi consiglio...anche solo un'OCCHIATA AL LOG
