Per r16,
ti posto il log di combo fix. era il blocco degli script non disattuvato.Involontariamente ho toccato il mause, dimmi se debbo rifarlo. Grazie e spetto la tua risposta.
ComboFix 09-10-23.01 - carrefour 24/10/2009 18.10.41.1.2 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.39.1040.18.511.139 [GMT 2:00]
Eseguito da: c:\documents and settings\carrefour\Desktop\ComboFix.exe
AV: Norton AntiVirus *On-access scanning disabled* (Updated) {B5510F6F-87E1-47F7-A411-360BC453007C}
ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\carrefour\Impostazioni locali\Dati applicazioni\feogg.dat
c:\documents and settings\carrefour\Impostazioni locali\Dati applicazioni\feogg_nav.dat
c:\documents and settings\carrefour\Impostazioni locali\Dati applicazioni\feogg_navps.dat
c:\documents and settings\carrefour\Impostazioni locali\Dati applicazioni\hbcdp.dat
c:\documents and settings\carrefour\Impostazioni locali\Dati applicazioni\hbcdp.exe
c:\documents and settings\carrefour\Impostazioni locali\Dati applicazioni\hbcdp_nav.dat
c:\documents and settings\carrefour\Impostazioni locali\Dati applicazioni\hbcdp_navps.dat
c:\programmi\QUAD Utilities
C:\test.txt
c:\windows\system\msvbvm60.dll
c:\windows\system32\E95THK16.EXE
c:\windows\system32\encapi32.dll
c:\windows\system32\select.dll
c:\windows\system32\SySInfo.ocx
c:\windows\system32\zip32.dll
c:\windows\winhelp.ini
.
((((((((((((((((((((((((( Files Creati Da 2009-09-24 al 2009-10-24 )))))))))))))))))))))))))))))))))))
.
2009-10-23 16:51 . 2009-10-23 16:51 -------- d-----w- c:\documents and settings\carrefour\Dati applicazioni\Windows Search
2009-10-21 15:38 . 2009-10-21 15:38 -------- d-----w- c:\programmi\File comuni\Windows Live
2009-10-21 15:37 . 2009-10-21 15:37 -------- d-----w- c:\programmi\Microsoft
2009-10-21 15:35 . 2008-03-07 17:02 98304 ------w- c:\windows\system32\dllcache\nlhtml.dll
2009-10-21 15:35 . 2008-03-07 17:02 29696 ------w- c:\windows\system32\dllcache\mimefilt.dll
2009-10-21 15:35 . 2008-03-07 17:02 192000 ------w- c:\windows\system32\dllcache\offfilt.dll
2009-10-20 10:21 . 2009-10-20 10:21 -------- d-----w- c:\windows\SQLTools9_KB970892_ENU
2009-10-20 10:17 . 2009-10-20 10:17 -------- d-----w- c:\windows\SQL9_KB970892_ENU
2009-10-16 18:32 . 2009-10-16 18:32 -------- d-----w- c:\documents and settings\Default User\Impostazioni locali
2009-10-11 17:21 . 2009-10-11 17:21 -------- d-----w- c:\windows\SQLTools9_KB960089_ENU
2009-10-11 17:17 . 2009-10-11 17:17 -------- d-----w- c:\windows\SQL9_KB960089_ENU
2009-10-11 09:55 . 2009-10-11 09:55 -------- d-----w- c:\documents and settings\NetworkService\Impostazioni locali\Dati applicazioni\PCHealth
2009-10-10 14:57 . 2009-10-10 14:57 -------- d-----w- c:\documents and settings\carrefour\Impostazioni locali\Dati applicazioni\PCHealth
2009-10-10 14:53 . 2009-10-10 14:53 -------- d-----w- c:\programmi\Microsoft CAPICOM 2.1.0.2
2009-10-10 13:27 . 2009-08-06 17:23 274288 ----a-w- c:\windows\system32\mucltui.dll
2009-10-10 13:27 . 2009-08-06 17:23 215920 ----a-w- c:\windows\system32\muweb.dll
2009-10-08 16:41 . 2009-10-08 16:41 -------- d-----w- c:\programmi\Microsoft Silverlight
2009-10-03 13:24 . 2009-10-03 13:24 48640 ----a-w- c:\windows\grwprocs.dll
2009-10-03 13:24 . 2009-10-03 13:24 481614 ----a-w- c:\windows\alice.dat
2009-10-03 13:24 . 2009-10-03 13:24 405504 ----a-w- c:\windows\alice.scr
2009-10-02 15:48 . 2009-10-01 08:29 195440 ------w- c:\windows\system32\MpSigStub.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-11 16:10 . 2006-01-24 16:11 14 ----a-w- c:\windows\popcinfo.dat
2009-10-11 14:09 . 2003-10-18 12:18 105512 ----a-w- c:\documents and settings\carrefour\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2009-09-11 14:17 . 2002-09-10 10:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-10 12:54 . 2009-09-05 16:45 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-10 12:53 . 2009-09-05 16:45 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-06 16:15 . 2009-09-06 16:15 -------- d-----w- c:\programmi\Trend Micro
2009-09-05 16:45 . 2009-09-05 16:45 -------- d-----w- c:\documents and settings\carrefour\Dati applicazioni\Malwarebytes
2009-09-05 16:45 . 2009-09-05 16:45 -------- d-----w- c:\programmi\Malwarebytes' Anti-Malware
2009-09-05 16:45 . 2009-09-05 16:45 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Malwarebytes
2009-09-04 21:03 . 2002-09-10 10:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 07:56 . 2004-08-23 18:35 916480 ----a-w- c:\windows\system32\wininet.dll
2009-08-26 08:00 . 2002-09-10 10:00 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-20 13:09 . 2009-08-20 13:09 1193832 ----a-w- c:\windows\system32\FM20.DLL
2009-08-06 17:24 . 2004-08-03 11:59 209632 ----a-w- c:\windows\system32\wuweb.dll
2009-08-06 17:24 . 2004-08-03 11:58 327896 ----a-w- c:\windows\system32\wucltui.dll
2009-08-06 17:24 . 2005-05-26 02:16 44768 ----a-w- c:\windows\system32\wups2.dll
2009-08-06 17:24 . 2004-08-03 11:59 35552 ----a-w- c:\windows\system32\wups.dll
2009-08-06 17:24 . 2003-09-04 12:21 53472 ----a-w- c:\windows\system32\wuauclt.exe
2009-08-06 17:24 . 2002-09-10 10:00 96480 ----a-w- c:\windows\system32\cdm.dll
2009-08-06 17:23 . 2004-08-03 12:00 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-08-06 17:23 . 2003-09-04 12:21 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-08-05 08:59 . 2004-02-28 16:34 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-04 17:26 . 2002-09-10 10:00 2148864 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-08-04 17:26 . 2002-09-09 11:34 2027520 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-08-04 10:04 . 2009-08-04 10:04 3942048 ----a-w- c:\programmi\malwarebytesAnti_malwar_-setup.exe
2009-03-25 08:27 . 2009-03-25 08:27 5649472 ----a-w- c:\programmi\gusetup.exe
2008-07-18 16:16 . 2008-07-18 16:16 5244440 ----a-w- c:\programmi\TVUPlayer2.3.7.1.exe
2008-03-28 13:51 . 2008-03-28 13:51 3199108 ----a-w- c:\programmi\Setup-SopCast-3.0.1-2008-3-28.exe
2008-01-21 20:22 . 2008-01-21 20:22 9739116 ----a-w- c:\programmi\InstSocr.exe
2008-01-15 18:57 . 2008-01-15 18:57 20907376 ----a-w- c:\programmi\aaw2007.exe
2007-08-09 06:17 . 2007-08-09 06:17 1563724 ----a-w- c:\programmi\icarbonsetup.exe
2007-03-11 10:14 . 2007-03-11 10:14 112 ----a-w- c:\programmi\Config.ini
2007-02-14 14:02 . 2007-02-14 14:02 4732416 ----a-w- c:\programmi\OnLineLiveSetup.msi
2006-10-31 15:48 . 2006-10-31 15:48 34698 ----a-w- c:\programmi\rojadirecta
2006-09-21 15:46 . 2006-09-21 15:46 1156042 ----a-w- c:\programmi\IEPrivacyKeeperSetup.exe
2006-08-04 16:19 . 2006-08-04 16:19 6227687 ----a-w- c:\programmi\Setup TvuPlayer.exe
2006-04-09 16:43 . 2006-04-09 16:43 516608 ----a-w- c:\programmi\Starter.exe
2006-01-30 16:11 . 2006-01-30 16:11 1082742 ----a-w- c:\programmi\WRar351it.exe
2005-04-28 15:21 . 2005-04-28 15:44 606666 ----a-w- c:\programmi\WinPlayer.exe
2005-04-13 15:27 . 2005-04-13 15:27 11760072 ----a-w- c:\programmi\Alice_ti_aiuta.exe
2003-04-27 13:24 . 2003-04-27 13:24 383254 ----a-w- c:\programmi\CDEX.HLP
2003-04-27 13:24 . 2003-04-27 13:24 96768 ----a-w- c:\programmi\libsndfile.dll
2003-04-27 13:23 . 2003-04-27 13:23 83456 ----a-w- c:\programmi\CDRip.dll
2003-04-27 13:23 . 2003-04-27 13:23 7051 ----a-w- c:\programmi\CDex.cnt
2003-03-24 19:25 . 2003-03-24 19:25 21652 ----a-w- c:\programmi\Changes.txt
2003-02-04 19:35 . 2003-02-04 19:35 4320 ----a-w- c:\programmi\ReadMe.txt
2002-08-07 20:07 . 2002-08-07 20:07 71680 ----a-w- c:\programmi\MACDll.dll
2002-07-06 11:25 . 2002-07-06 11:25 1007 ----a-w- c:\programmi\CDex.ini
2002-05-09 14:22 . 2002-05-09 14:22 537 ----a-w- c:\programmi\CDex.exe.manifest
2002-04-20 11:07 . 2002-04-20 11:07 69632 ----a-w- c:\programmi\WMA8Connect.dll
2001-03-10 11:18 . 2001-03-10 11:18 1044168 ----a-w- c:\programmi\vbrun60sp5.exe
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\programmi\Messenger\msmsgs.exe" [2008-04-14 1695232]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2004-12-29 155648]
"Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-14 39792]
"ccApp"="c:\programmi\File comuni\Symantec Shared\ccApp.exe" [2006-04-04 71304]
"SunJavaUpdateSched"="c:\programmi\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"Malwarebytes Anti-Malware (reboot)"="c:\programmi\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"QuickTime Task"="c:\programmi\QuickTime\qttask.exe" [2007-02-15 77824]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\FILECO~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"QuickTime Task"="c:\programmi\QuickTime\qttask.exe" -atboottime
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\Messenger\\MSMSGS.EXE"=
"c:\\Programmi\\SopCast\\SopCast.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\carrefour\\Dati applicazioni\\SopCast\\adv\\SopAdver.exe"=
"c:\\Programmi\\TVAnts\\Tvants.exe"=
"c:\\Programmi\\SopCast\\adv\\SopAdver.exe"=
"c:\\Programmi\\SopCast\\sopvod.exe"=
"c:\\Programmi\\TVUPlayer\\TVUPlayer.exe"=
R2 MSSQL$VLSOLE24EXPRESS;SQL Server (VLSOLE24EXPRESS);c:\programmi\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [27/05/2009 3.27.04 29262680]
R2 Utilità di pianificazione di LiveUpdate automatico;Utilità di pianificazione di LiveUpdate automatico;c:\programmi\Symantec\LiveUpdate\AluSchedulerSvc.exe [24/10/2008 19.04.00 100032]
R2 WinDefend;Windows Defender;c:\programmi\Windows Defender\MsMpEng.exe [03/11/2006 18.19.58 13592]
S2 Network WanMiniport First Position;Network WanMiniport First Position;c:\programmi\Telecom Italia\WanMiniport1st\srvany.exe [17/04/2008 16.56.10 8192]
S2 wlidsvc;Windows Live ID Sign-in Assistant;c:\programmi\File comuni\Microsoft Shared\Windows Live\WLIDSVC.EXE [30/03/2009 16.28.36 1533808]
.
Contenuto della cartella 'Scheduled Tasks'
2009-10-24 c:\windows\Tasks\MP Scheduled Scan.job
- c:\programmi\Windows Defender\MpCmdRun.exe [2006-11-03 16:20]
2009-10-16 c:\windows\Tasks\Norton AntiVirus - Scansione del computer.job
- c:\progra~1\NORTON~1\Navw32.exe [2003-08-22 19:14]
2009-10-24 c:\windows\Tasks\GlaryInitialize.job
- c:\programmi\Glary Utilities\initialize.exe [2009-02-17 17:27]
2009-10-24 c:\windows\Tasks\User_Feed_Synchronization-{EB99D812-E6C0-40EE-9A81-3FF831D3F6A9}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.ansa.it/index.shtml
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uInternet Settings,ProxyOverride = 127.0.0.1
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Ricerca AltaVista - file://c:\documents and settings\carrefour\Dati applicazioni\ALTAVISTA\SelectedContextSearch_Ricerca AltaVista.htm
IE: Traduci - file://c:\documents and settings\carrefour\Dati applicazioni\ALTAVISTA\SelectedContextTranslation.htm
.
- - - - CHIAVI ORFANE RIMOSSE - - - -
WebBrowser-{3041D03E-FD4B-44E0-B742-2D9B88305F98} - (no file)
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-10-24 18:16
Windows 5.1.2600 Service Pack 3 FAT NTAPI
scansione processi nascosti ...
scansione entrate autostart nascoste ...
Scansione files nascosti ...
Scansione completata con successo
Files nascosti: 0
**************************************************************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
[HKEY_LOCAL_MACHINE\software\Realtek\AC97 Audio]
@DACL=(02 0000)
@SACL=
"SpoutPage"=hex:01
[HKEY_LOCAL_MACHINE\software\Sensaura\Environment]
@DACL=(02 0000)
@SACL=
[HKEY_LOCAL_MACHINE\software\Sensaura\Speaker]
@DACL=(02 0000)
@SACL=
"ChannelConfig"=dword:00000003
"SpeakerGeometry"=dword:0000000a
.
Ora fine scansione: 2009-10-24 18.18.12
ComboFix-quarantined-files.txt 2009-10-24 16:18
Pre-Run: 67.292.626.944 byte disponibili
Post-Run: 67.297.181.696 byte disponibili
- - End Of File - - 58D94806251CF941C9D398B81DE9E2B1