ComboFix 10-03-23.04 - Paola 24/03/2010 18.29.06.7.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.39.1040.18.512.250 [GMT 1:00]
Eseguito da: c:\documents and settings\Paola\Desktop\ComboFix.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: Outpost Firewall *disabled* {8A20CA2A-9E02-4A64-923B-0A38208EB7FD}
ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\docume~1\Paola\IMPOST~1\Temp\mia6.tmp\mia.lib
c:\docume~1\Paola\IMPOST~1\Temp\mia6.tmp\vnlt6616.exe
c:\documents and settings\Paola\Impostazioni locali\temp\mia6.tmp\mia.lib
c:\documents and settings\Paola\Impostazioni locali\temp\mia6.tmp\vnlt6616.exe
c:\windows\TEMP\logishrd\LVPrcInj01.dll
.
---- Esecuzione precedente -------
.
c:\windows\TEMP\logishrd\LVPrcInj01.dll
.
((((((((((((((((((((((((( Files Creati Da 2010-02-24 al 2010-03-24 )))))))))))))))))))))))))))))))))))
.
2010-03-24 17:09 . 2010-03-24 17:09 -------- dc-h--w- c:\documents and settings\All Users\Dati applicazioni\{8306CC25-89B8-404F-ACAF-868FC1CF8CEA}
2010-03-24 16:59 . 2010-03-24 16:59 -------- d-----w- c:\documents and settings\Paola\Impostazioni locali\Dati applicazioni\PackageAware
2010-03-22 19:24 . 2010-03-22 19:24 -------- d-----w- c:\documents and settings\NetworkService\Impostazioni locali\Dati applicazioni\Search_USA
2010-03-22 18:17 . 2010-03-22 18:17 339968 ----a-w- c:\documents and settings\Paola\Impostazioni locali\Dati applicazioni\amzfr.exe
2010-03-22 18:10 . 2010-03-22 18:10 311296 ----a-w- c:\documents and settings\Paola\Impostazioni locali\Dati applicazioni\jdzbplo.exe
2010-03-20 11:49 . 2010-03-20 11:49 -------- d-----w- c:\programmi\eMule
2010-03-20 11:49 . 2010-03-24 14:39 -------- d-----w- c:\documents and settings\Paola\Impostazioni locali\Dati applicazioni\Search_USA
2010-03-20 11:07 . 2010-03-20 11:07 -------- d-----w- c:\programmi\DsNET Corp
2010-03-13 14:04 . 2010-03-13 14:04 -------- d-----w- c:\documents and settings\LocalService\Dati applicazioni\McAfee
2010-03-11 18:13 . 2009-04-06 10:37 704384 ----a-w- c:\windows\system32\drivers\SandBox.sys
2010-03-11 18:13 . 2009-02-10 15:15 257432 ----a-w- c:\windows\system32\drivers\afwcore.sys
2010-03-11 18:11 . 2009-02-18 16:30 31128 ----a-w- c:\windows\system32\drivers\afw.sys
2010-03-11 18:11 . 2010-03-11 18:11 -------- d-----w- c:\programmi\Agnitum
2010-03-11 18:11 . 2010-03-11 18:11 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Agnitum
2010-03-11 15:35 . 2010-03-11 15:35 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-03-11 12:23 . 2010-03-11 12:23 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\McAfee
2010-03-10 20:05 . 2010-03-09 11:08 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-03-10 20:05 . 2010-03-09 11:12 162640 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-03-10 20:05 . 2010-03-09 11:09 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-03-10 20:05 . 2010-03-09 11:12 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-03-10 20:05 . 2010-03-09 11:08 100432 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-03-10 20:05 . 2010-03-09 11:08 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-03-10 20:05 . 2010-03-09 11:08 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-03-10 20:04 . 2010-03-09 11:24 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-03-10 20:04 . 2010-03-09 11:24 153184 ----a-w- c:\windows\system32\aswBoot.exe
2010-03-10 20:04 . 2010-03-10 20:04 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Alwil Software
2010-03-10 19:02 . 2010-03-10 19:02 -------- d-----w- c:\programmi\File comuni\Java
2010-03-10 19:02 . 2010-03-10 19:01 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-03-09 19:42 . 2010-03-09 19:42 -------- d-----w- c:\programmi\Microsoft Silverlight
2010-03-06 13:04 . 2010-03-06 13:04 -------- d-----w- c:\documents and settings\LocalService\Impostazioni locali\Dati applicazioni\ESET
2010-03-03 20:58 . 2010-03-03 20:58 -------- d-----w- c:\documents and settings\Paola\Impostazioni locali\Dati applicazioni\ESET
2010-03-03 19:05 . 2010-03-03 19:05 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\ESET
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-24 14:39 . 2009-02-06 17:12 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Google Updater
2010-03-13 14:07 . 2008-11-28 16:29 50832 ----a-w- c:\documents and settings\Paola\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2010-03-11 13:14 . 2010-02-18 07:32 -------- d-----w- c:\programmi\FlashCAD
2010-03-10 20:04 . 2009-06-21 09:05 -------- d-----w- c:\programmi\Alwil Software
2010-03-10 19:01 . 2009-07-19 07:41 -------- d-----w- c:\programmi\Java
2010-03-04 16:20 . 2008-11-28 16:19 -------- d-----w- c:\programmi\PC Tools Firewall Plus
2010-03-03 21:01 . 2008-12-18 19:16 -------- d-----w- c:\programmi\Unlocker
2010-03-03 19:31 . 2009-02-06 17:11 -------- d-----w- c:\programmi\Google
2010-03-03 18:55 . 2008-11-28 16:19 -------- d---a-w- c:\documents and settings\All Users\Dati applicazioni\TEMP
2010-02-15 14:50 . 2008-12-21 21:28 20 ---h--w- c:\documents and settings\All Users\Dati applicazioni\PKP_DLdu.DAT
2010-01-07 15:07 . 2009-04-02 11:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 15:07 . 2009-04-02 11:54 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-05 09:53 . 2006-03-02 12:00 832512 ------w- c:\windows\system32\wininet.dll
2010-01-05 09:53 . 2006-03-02 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-01-05 09:53 . 2006-03-02 12:00 17408 ----a-w- c:\windows\system32\corpol.dll
2009-12-31 16:50 . 2006-03-02 12:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-10-18 17:17 . 2009-10-18 17:17 39079849 ----a-w- c:\programmi\finaldraft8.zip
2009-10-09 17:56 . 2009-10-09 17:55 93074728 ----a-w- c:\programmi\iTunesSetup.exe
2009-04-02 11:53 . 2009-04-02 11:53 2882679 ----a-w- c:\programmi\Malwarebytes.zip
2009-04-02 11:37 . 2009-04-02 11:37 911723 ----a-w- c:\programmi\ccleaner.zip
2009-04-02 07:14 . 2009-04-02 07:13 812344 ----a-w- c:\programmi\HJTInstall.exe
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"L08IXLRD_8918390"="c:\programmi\Microsoft Student\Microsoft Encarta 2008 - Premium + Student DVD\EDICT.EXE" [2007-06-12 351000]
"swg"="c:\programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-02-06 39408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CnxDslTaskBar"="c:\programmi\digicomt\Michelangelo USB ADSL\CnxDslTb.exe" [2003-10-29 462848]
"ATIPTA"="c:\programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-06-05 335872]
"CanonSolutionMenu"="c:\programmi\Canon\SolutionMenu\CNSLMAIN.exe" [2007-04-03 644696]
"CanonMyPrinter"="c:\programmi\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 1603152]
"SSBkgdUpdate"="c:\programmi\File comuni\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"OpwareSE4"="c:\programmi\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400]
"LogitechCommunicationsManager"="c:\programmi\File comuni\LogiShrd\LComMgr\Communications_Helper.exe" [2008-08-14 565008]
"LogitechQuickCamRibbon"="c:\programmi\Logitech\QuickCam\Quickcam.exe" [2008-08-14 2407184]
"TkBellExe"="c:\programmi\File comuni\Real\Update_OB\realsched.exe" [2008-11-30 185872]
"UnlockerAssistant"="c:\programmi\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872]
"QuickTime Task"="c:\programmi\QuickTime\qttask.exe" [2009-09-04 417792]
"iTunesHelper"="c:\programmi\iTunes\iTunesHelper.exe" [2009-09-21 305440]
"SunJavaUpdateSched"="c:\programmi\File comuni\Java\Java Update\jusched.exe" [2010-01-11 246504]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-03-09 2769336]
"OutpostMonitor"="c:\progra~1\Agnitum\OUTPOS~1\op_mon.exe" [2009-04-28 2374464]
"OutpostFeedBack"="c:\programmi\Agnitum\Outpost Firewall\feedback.exe" [2009-04-28 428032]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Adobe Gamma Loader.lnk - c:\programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe [2009-2-2 113664]
Logitech Desktop Messenger.lnk - c:\programmi\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2008-11-28 66864]
Microsoft Office.lnk - c:\programmi\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
Nikon Monitor.lnk - c:\programmi\File comuni\Nikon\Monitor\NkMonitor.exe [2007-10-18 479232]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"wave1"=sb16snd.dll
"MIDI1"=sb16snd.dll
"aux1"=sb16snd.dll
"mixer1"=sb16snd.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmi\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Programmi\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"c:\\Programmi\\FileZilla Client\\filezilla.exe"=
"c:\\Programmi\\Macromedia\\Dreamweaver MX\\Dreamweaver.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Programmi\\Bonjour\\mDNSResponder.exe"=
"c:\\Programmi\\iTunes\\iTunes.exe"=
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [10/03/2010 21.05.19 162640]
R1 SandBox;SandBox;c:\windows\system32\drivers\SandBox.sys [11/03/2010 19.13.35 704384]
R2 acssrv;Agnitum Client Security Service;c:\progra~1\Agnitum\OUTPOS~1\acs.exe [11/03/2010 19.11.33 1195008]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [10/03/2010 21.05.20 19024]
R3 afw;Agnitum firewall driver;c:\windows\system32\drivers\afw.sys [11/03/2010 19.11.47 31128]
R3 afwcore;afwcore;c:\windows\system32\drivers\afwcore.sys [11/03/2010 19.13.25 257432]
R3 CnxEtP;Conexant AccessRunner USB ADSL WAN Adapter Filter Driver;c:\windows\system32\drivers\CnxEtP.sys [28/11/2008 17.26.47 60288]
R3 CnxEtU;Conexant AccessRunner USB ADSL Interface Device Driver;c:\windows\system32\drivers\CnxEtU.sys [28/11/2008 17.26.47 646784]
R3 CnxTgN;Conexant AccessRunner USB ADSL WAN Adapter Driver;c:\windows\system32\drivers\CnxTgN.sys [28/11/2008 17.26.47 108675]
S2 gupdate1c9887e47a616b6;Google Update Service (gupdate1c9887e47a616b6);c:\programmi\Google\Update\GoogleUpdate.exe [06/02/2009 18.13.45 133104]
S2 spd3ssl;Spyware-Process-Detector v3.15.3;\??\c:\programmi\Spyware Process Detector\spd315.sys --> c:\programmi\Spyware Process Detector\spd315.sys [?]
.
Contenuto della cartella 'Scheduled Tasks'
2010-03-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programmi\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
2010-03-24 c:\windows\Tasks\Google Software Updater.job
- c:\programmi\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-06 20:56]
2010-03-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2009-02-06 17:13]
2010-03-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2009-02-06 17:13]
2010-03-24 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-03-25 21:18]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\programmi\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
.
- - - - CHIAVI ORFANE RIMOSSE - - - -
HKCU-Run-FlashCAD - c:\programmi\FlashCAD\FlashCAD.exe
HKCU-Run-haatuvh - c:\documents and settings\paola\impostazioni locali\dati applicazioni\haatuvh.exe
AddRemove-haatuvh - c:\documents and settings\paola\impostazioni locali\dati applicazioni\haatuvh.exe
AddRemove-Search_USA Toolbar - c:\progra~1\SEARCH~1\UNWISE.EXE
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2010-03-24 18:39
Windows 5.1.2600 Service Pack 3 NTFS
scansione processi nascosti ...
scansione entrate autostart nascoste ...
Scansione files nascosti ...
Scansione completata con successo
Files nascosti: 0
**************************************************************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•9~*]
"0140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------
- - - - - - - > 'explorer.exe'(7276)
c:\windows\system32\WININET.dll
c:\windows\TEMP\logishrd\LVPrcInj01.dll
c:\programmi\ScanSoft\OmniPageSE4\OpHookSE4.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\programmi\Alwil Software\Avast5\AvastSvc.exe
c:\programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\programmi\Bonjour\mDNSResponder.exe
c:\programmi\Java\jre6\bin\jqs.exe
c:\programmi\File comuni\LogiShrd\LVCOMSER\LVComSer.exe
c:\programmi\File comuni\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\programmi\Analog Devices\SoundMAX\SMAgent.exe
c:\windows\system32\fxssvc.exe
c:\programmi\File comuni\LogiShrd\LVCOMSER\LVComSer.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\programmi\iPod\bin\iPodService.exe
c:\programmi\File comuni\Logishrd\LQCVFX\COCIManager.exe
c:\windows\system32\logon.scr
.
**************************************************************************
.
Ora fine scansione: 2010-03-24 18:52:03 - Il pc è stato riavviato
ComboFix-quarantined-files.txt 2010-03-24 17:51
Pre-Run: 101.731.495.936 byte disponibili
Post-Run: 101.764.239.360 byte disponibili
- - End Of File - - 40D882B1F9040BEBFDE60328B40DFDFF