r16 ha scritto:Ciao lauraz .
Sei fortemente infettata.
Assicurati di avere accesso a file e cartelle nascosti
(Pannello di controllo-> Opzioni Cartella-> Visualizzazione)
1) Metti la spunta su: Visualizza file e cartelle nascoste
2) Togli la spunta: nascondi file protetti di sistema
Disattiva il ripristino configurazione di sistema, e tienilo disattivato, fino alla soluzione del problema
http://guide.aiutamici.com/guide?C1=7&C2=68&ID=80121Se non sai "fixare"le voci,segui questa guida dettagliata:
http://www.aiutaamici.com/software?ID=11175Avvia in modalità provvisoria
http://guide.aiutamici.com/guide?C1=7&C2=68&ID=80122Avvia hijackthis, metti la spunta alle voci che andrò ad elencarti e con tutte le applicazioni chiuse e disconnesso da Internet,premi su fix checked
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {f250d521-225d-4d6b-8829-e064f944e180} - C:\WINDOWS\system32\fdaa.dll
TUTTE le 018 (non sono pericolose,ma inutili)
O20 - AppInit_DLLs: pushow19.dll
O20 - Winlogon Notify: Run - C:\WINDOWS\
O23 - Service: DirectX Service (DirectLixx) - Unknown owner - C:\WINDOWS\system32\directx.exe (file missing)
Trova e cancella i file in rosso:
C:\WINDOWS\system32\
fdaa.dllScarica VIRIT :
http://www.tgsoft.it/italy/download.htm lo aggiorni (cliccando sulla parabola in alto) e fai la scansione in
Modalità Provvisoria (è molto importante).
Scarica Norman Malware Cleaner
http://download.norman.no/public/Norman_Malware_Cleaner.exe e salvalo sul
desktop Avvia in MODALITA PROVVISORIA
Si avvia
si accetta la licenza
si clicca Start Scan
si attende la fine della scansione
Viene generato un log sul desktop,
postalo qui.
In alcuni casi Norman Malware Cleaner potrebbe richiedere il riavvio del computer per rimuovere completamente l'infezione, in
questo caso è raccomandata una seconda esecuzione del programma dopo aver riavviato il PC per garantire la completa rimozione di tutti i files infetti.
Dai una pulita (registro compreso)con CCleaner
http://www.aiutaamici.com/software?ID=11223Riavvia il computer.
*********************************************************************************************************
Poi:
Importante: Disabilita il tuo antivirus e chiudi TUTTI i programmi aperti,e dopo aver scaricato COMBOFIX, chiudi la connessione.
Scarica Combofix
http://download.bleepingcomputer.com/sUBs/ComboFix.exeSalvalo sul desktop.
Doppio click su combofix.exe (comparirà una videata.)
Digita
1, premi
Invio e segui le indicazioni.
Al termine, verrà creato un file log chiamato C:\ComboFix.txt.
Postalo qui.
Durante l'operazione di scansione
è importante non usare il PC e attendere pazientemente la fine delle operazioni.
Posta un nuovo log di HijackThis .
Sempre qui.
ComboFix non funziona in modalità provvisoriaSe vuoi disistallare combofix fai in questo modo:(
Non disistallarlo prima di avermi postato il suo log.)
Start
Esegui
nella finestra di dialogo, digita (oppure, copia ed incolla) questo comando:
Combofix /u e premi
invio poi cancella le cartelle in "C" di combofix (qoobox)
Per quanto riguarda quel programma (Speedupmypc) mi dispiace, ma non lo conosco.
Ciao,allora,Virit si ferma x un errore sia in provvisoria che normale e Hijackthis non riesce a togliere
O2[/color] - BHO: (no name) - {f250d521-225d-4d6b-8829-e064f944e180} - C:\WINDOWS\system32\fdaa.dll
Log di Hijackthis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10.28.49, on 27/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmi\File comuni\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\QuickTime\qttask.exe
C:\Programmi\SlySoft\CloneCD\CloneCDTray.exe
C:\Programmi\Spamihilator\spamihilator.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe
C:\Programmi\NETGEAR\WPN111\wpn111.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\Programmi\File comuni\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.google.it/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CloneCDTray] "C:\Programmi\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [Spamihilator] "C:\Programmi\Spamihilator\spamihilator.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Programmi\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: NETGEAR WPN111 Smart Wizard.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://C:\Programmi\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites -
http://favorites.live.com/quickadd.aspxO8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Inserisci blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programmi\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: Inserisci &blog in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programmi\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: Xß -
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: DirectX Service (DirectLixx) - Unknown owner - C:\WINDOWS\system32\directx.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Nero AG - C:\Programmi\Ahead\InCD\InCDsrv.exe
O23 - Service: Sentinel Protection Server (SentinelProtectionServer) - SafeNet, Inc - C:\Programmi\File comuni\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
NORMAN--
End of file - 5320 bytes
Norman Malware Cleaner
Copyright © 1990 - 2008, Norman ASA. Built 2008/07/17 18:58:30
Norman Scanner Engine Version: 5.93.01
Nvcbin.def Version: 5.93.00, Date: 2008/07/17 18:58:30, Variants: 1892446
Running pre-scan cleanup routine:
Operating System: Microsoft Windows XP Professional 5.1.2600(Safe mode) Service Pack 2
Logged on user: TRAVERSA-08110C\Massimo
Set registry value: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe" -> "Explorer.exe"
Scan started: 27/07/2008 09:54:49
Scanning running processes and process memory...
Number of processes/threads found: 576
Number of processes/threads scanned: 576
Number of processes/threads not scanned: 0
Number of infected processes/threads terminated: 0
Total scanning time: 29s
Scanning file system...
Scanning: C:\*.*
Scanning: I:\*.*
I:\DOCOMENTI\Carrie the Caregiver.rar/STM (Error whilst scanning file: I/O Error)
I:\DOCOMENTI\Carrie the Caregiver.rar/ACL (Error whilst scanning file: I/O Error)
I:\DOCOMENTI\Carrie the Caregiver.rar/ACL (Error whilst scanning file: I/O Error)
I:\DOCOMENTI\Carrie the Caregiver.rar/ACL (Error whilst scanning file: I/O Error)
I:\DOCOMENTI\Carrie the Caregiver.rar/AV (Error whilst scanning file: I/O Error)
I:\DOCOMENTI\Carrie the Caregiver.rar/RR (Error whilst scanning file: I/O Error)
I:\DOCOMENTI\guida e software - setool free - sblocco_unlock LG U8110\SETool Free.rar/CMT (Error whilst scanning file: I/O Error)
I:\DOCOMENTI\tutto quello che c'era nel computer nero\[PC App ITA] Nero Vision Express 3.0.1.27 + Crack.rar/CMT (Error whilst scanning file: I/O Error)
I:\DOCOMENTI\tutto quello che c'era nel computer nero\Federico Angelucci\[ALBUM MUSICALI] Jesse McCartney - Beautiful Soul (2005).rar/CMT (Error whilst scanning file: I/O Error)
I:\DOCOMENTI\tutto quello che c'era nel computer nero\GIOCHI KIARA\Carrie the Caregiver.rar/STM (Error whilst scanning file: I/O Error)
I:\DOCOMENTI\tutto quello che c'era nel computer nero\GIOCHI KIARA\Carrie the Caregiver.rar/ACL (Error whilst scanning file: I/O Error)
I:\DOCOMENTI\tutto quello che c'era nel computer nero\GIOCHI KIARA\Carrie the Caregiver.rar/ACL (Error whilst scanning file: I/O Error)
I:\DOCOMENTI\tutto quello che c'era nel computer nero\GIOCHI KIARA\Carrie the Caregiver.rar/ACL (Error whilst scanning file: I/O Error)
I:\DOCOMENTI\tutto quello che c'era nel computer nero\GIOCHI KIARA\Carrie the Caregiver.rar/AV (Error whilst scanning file: I/O Error)
I:\DOCOMENTI\tutto quello che c'era nel computer nero\GIOCHI KIARA\Carrie the Caregiver.rar/RR (Error whilst scanning file: I/O Error)
I:\IMMAGINI\GIOCHI KIARA\Carrie the Caregiver.rar/STM (Error whilst scanning file: I/O Error)
I:\IMMAGINI\GIOCHI KIARA\Carrie the Caregiver.rar/ACL (Error whilst scanning file: I/O Error)
I:\IMMAGINI\GIOCHI KIARA\Carrie the Caregiver.rar/ACL (Error whilst scanning file: I/O Error)
I:\IMMAGINI\GIOCHI KIARA\Carrie the Caregiver.rar/ACL (Error whilst scanning file: I/O Error)
I:\IMMAGINI\GIOCHI KIARA\Carrie the Caregiver.rar/AV (Error whilst scanning file: I/O Error)
I:\IMMAGINI\GIOCHI KIARA\Carrie the Caregiver.rar/RR (Error whilst scanning file: I/O Error)
Running post-scan cleanup routine:
Number of files found: 21958
Number of archives unpacked: 141
Number of files scanned: 21911
Number of files not scanned: 47
Number of files skipped due to exclude list: 0
Number of infected files found: 0
Number of infected files repaired/deleted: 0
Number of infections removed: 0
Total scanning time: 11m 24s
COMBOFIX:
ComboFix 08-07-26.1 - Massimo 2008-07-27 10.14.04.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1040.18.680 [GMT 2:00]
Eseguito da: C:\Documents and Settings\Massimo\Desktop\ComboFix.exe
* Creato nuovo punto di ripristino
ATENÇÃO - ESTA MAQUINA NAO TEM A CONSOLE DE RECUPERAÇÃO INSTALADA !!.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\All Users\Dati applicazioni\WinAntiVirus Pro 2006
C:\Documents and Settings\LocalService\Dati applicazioni\NetMon
C:\Documents and Settings\LocalService\Dati applicazioni\NetMon\domains.txt
C:\Documents and Settings\LocalService\Dati applicazioni\NetMon\log.txt
C:\Documents and Settings\Massimo\Dati applicazioni\WinAntiVirus Pro 2006
C:\Documents and Settings\Massimo\Dati applicazioni\WinAntiVirus Pro 2006\Logs\update.log
C:\uniq
C:\WINDOWS\drsmartload2.dat
C:\WINDOWS\keyboard1.dat
C:\WINDOWS\msvrc20.dll
C:\WINDOWS\newname.dat
C:\WINDOWS\system32\stera.job
C:\WINDOWS\user32.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_VSPF
((((((((((((((((((((((((( Files Creati Da 2008-06-27 al 2008-07-27 )))))))))))))))))))))))))))))))))))
.
2008-07-27 09:28 . 2008-03-17 19:23 39,808 --a------ C:\WINDOWS\system32\drivers\VIRAGTLT.SYS
2008-07-27 09:27 . 2008-07-27 10:17 <DIR> d-------- C:\VEXPLITE
2008-07-25 21:28 . 2008-07-25 21:28 <DIR> d-------- C:\Programmi\Trend Micro
2008-07-25 13:56 . 2008-07-25 13:56 <DIR> d-------- C:\Programmi\ewido
2008-07-25 13:47 . 2008-07-25 13:49 <DIR> d-------- C:\Programmi\ScanSpyware v3.8.0.1
2008-07-19 09:34 . 2008-07-19 09:34 268 --ah----- C:\sqmdata00.sqm
2008-07-19 09:34 . 2008-07-19 09:34 244 --ah----- C:\sqmnoopt00.sqm
2008-07-19 09:34 . 2008-07-19 09:34 172 --ah----- C:\sqmnoopt02.sqm
2008-07-19 09:34 . 2008-07-19 09:34 172 --ah----- C:\sqmnoopt01.sqm
2008-07-19 09:34 . 2008-07-19 09:34 172 --ah----- C:\sqmdata02.sqm
2008-07-19 09:34 . 2008-07-19 09:34 160 --ah----- C:\sqmdata01.sqm
2008-07-18 16:58 . 2004-08-19 15:39 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2008-07-18 16:58 . 2001-08-30 23:07 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2008-07-14 13:17 . 2008-07-14 13:17 <DIR> d-------- C:\Documents and Settings\Massimo\Dati applicazioni\ViquaSoft
2008-07-13 17:15 . 2008-07-13 17:15 <DIR> d-------- C:\Programmi\GameHouse
2008-07-13 17:15 . 2008-07-13 17:15 <DIR> d-------- C:\Documents and Settings\Massimo\Dati applicazioni\GameHouse
2008-07-12 13:28 . 2008-07-12 13:28 <DIR> d-------- C:\Documents and Settings\Massimo\Dati applicazioni\Playrix Entertainment
2008-07-10 14:15 . 2008-07-10 14:15 <DIR> d-------- C:\Programmi\Spamihilator
2008-07-10 14:15 . 2008-07-26 20:45 <DIR> d-------- C:\Documents and Settings\Massimo\Dati applicazioni\Spamihilator
2008-07-07 22:00 . 2008-07-07 22:00 84,769 --a------ C:\exwfrso.exe
2008-07-07 22:00 . 2008-07-07 22:00 79,750 --a------ C:\sfokuk.exe
2008-07-06 13:24 . 2008-07-06 13:24 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\The Game Equation
2008-07-04 15:43 . 2008-07-04 15:43 <DIR> d-------- C:\Programmi\NETGEAR
2008-07-04 15:43 . 2005-09-26 16:02 362,944 --a------ C:\WINDOWS\system32\drivers\WPN111.sys
2008-07-04 15:43 . 2005-07-27 21:15 149,392 --a------ C:\WINDOWS\system32\drivers\ar5523.bin
2008-07-04 15:43 . 2005-10-06 11:28 15,819 --a------ C:\WINDOWS\system32\drivers\netwpn11.inf
2008-07-04 15:43 . 2005-10-19 05:03 8,263 --a------ C:\WINDOWS\system32\drivers\WPN111.cat
2008-07-03 15:43 . 2008-07-03 15:43 17,801 --a------ C:\WINDOWS\system32\drivers\AegisP.sys
2008-07-03 15:37 . 2004-04-18 16:43 651,264 --a------ C:\WINDOWS\system32\libeay32.dll
2008-07-03 15:37 . 2005-08-05 06:00 192,512 -ra------ C:\WINDOWS\system32\AegisI5.exe
2008-07-03 15:37 . 2004-04-18 16:43 147,456 --a------ C:\WINDOWS\system32\ssleay32.dll
2008-07-03 15:37 . 2003-07-24 12:10 94,208 --a------ C:\WINDOWS\system32\DNIN50.dll
2008-07-03 15:37 . 2003-07-24 12:10 17,149 --a------ C:\WINDOWS\system32\DNINDIS5.sys
2008-07-03 15:37 . 2003-07-25 13:30 15,941 --a------ C:\WINDOWS\system32\DNINDIS3.VXD
2008-06-27 14:52 . 2008-06-27 14:52 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Giulia Passione Stilista
2008-06-27 14:46 . 2008-06-27 14:46 <DIR> d-------- C:\Documents and Settings\Massimo\Dati applicazioni\InstallShield
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-27 07:41 --------- d-----w C:\Programmi\Spybot - Search & Destroy
2008-07-25 19:11 --------- d---a-w C:\Documents and Settings\All Users\Dati applicazioni\TEMP
2008-07-25 12:36 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\Spybot - Search & Destroy
2008-07-25 11:07 --------- d-----w C:\Programmi\eMule
2008-07-20 08:41 --------- d--h--w C:\Programmi\InstallShield Installation Information
2008-07-14 11:17 --------- d-----w C:\Programmi\Oberon Media
2008-07-12 11:27 --------- d-----w C:\Documents and Settings\Massimo\Dati applicazioni\PlayFirst
2008-07-12 11:27 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\PlayFirst
2008-07-07 20:01 79,750 ----a-w C:\wuxlbsl.exe
2008-07-07 20:00 79,750 ----a-w C:\bmuurxfw.exe
2008-07-06 09:54 --------- d-----w C:\Programmi\Windows Live
2008-07-06 09:50 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\WLInstaller
2008-06-27 12:47 --------- d-----w C:\Programmi\Ubisoft
2008-06-27 12:45 --------- d-----w C:\Programmi\EA GAMES
2006-10-06 20:43 78,440 ----a-w C:\Documents and Settings\All Users\Dati applicazioni\firstlsp.reg.dat
2006-04-18 15:22 185,645 --sha-r C:\Programmi\patcher.exe
2001-11-23 04:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\audio3d.dll
.
------- Sigcheck -------
2004-08-19 16:39 14336 73955b04f209d8a1c633867841267a96 C:\WINDOWS\system32\svchost.exe
2004-08-19 16:39 14336 73955b04f209d8a1c633867841267a96 C:\WINDOWS\system32\dllcache\svchost.exe
2005-03-02 20:20 578048 488019bfe2b0f9f8cd8394276d5b664a C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll
2004-08-19 16:39 578048 08447bdfce5d1b1956f962602381f5c1 C:\WINDOWS\$NtUninstallKB890859$\user32.dll
2005-03-02 20:10 578048 14b5d6b20467dba209853d65d1f6a124 C:\WINDOWS\system32\user32.dll
2005-03-02 20:10 578048 14b5d6b20467dba209853d65d1f6a124 C:\WINDOWS\system32\dllcache\user32.dll
2004-08-19 16:39 82944 12ead983c875ed9bcc8b90e3f77f2e4a C:\WINDOWS\system32\ws2_32.dll
2004-08-19 16:39 82944 12ead983c875ed9bcc8b90e3f77f2e4a C:\WINDOWS\system32\dllcache\ws2_32.dll
2005-05-25 21:07 359936 63fdfea54eb53de2d863ee454937ce1e C:\WINDOWS\$hf_mig$\KB893066\SP2QFE\tcpip.sys
2006-01-13 19:07 360448 5562cc0a47b2aef06d3417b733f3c195 C:\WINDOWS\$hf_mig$\KB913446\SP2QFE\tcpip.sys
2006-04-20 14:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys
2004-08-04 00:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\$NtUninstallKB893066$\tcpip.sys
2005-05-25 21:04 359808 88763a98a4c26c409741b4aa162720c9 C:\WINDOWS\$NtUninstallKB913446$\tcpip.sys
2006-01-13 04:28 359808 583e063fdc888ca30d05c2724b0d7ef4 C:\WINDOWS\$NtUninstallKB917953$\tcpip.sys
2006-04-20 13:51 359808 1dbf125862891817f374f407626967f4 C:\WINDOWS\system32\dllcache\tcpip.sys
2006-04-20 13:51 359808 1dbf125862891817f374f407626967f4 C:\WINDOWS\system32\drivers\tcpip.sys
2004-08-19 16:39 504832 4166454e2bcfcc20d1b8a5ac9feab243 C:\WINDOWS\system32\winlogon.exe
2004-08-19 16:39 504832 4166454e2bcfcc20d1b8a5ac9feab243 C:\WINDOWS\system32\dllcache\winlogon.exe
2004-08-04 00:14 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\dllcache\ndis.sys
2004-08-04 00:14 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\drivers\ndis.sys
2004-08-04 00:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\dllcache\ip6fw.sys
2004-08-04 00:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\drivers\ip6fw.sys
2005-03-02 20:12 2060672 de16030e8209fd96eeb06d9e3d8c84a8 C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
2004-08-19 16:50 2060544 4dc3a3626b02c39aa69aae6f64bfbc2d C:\WINDOWS\$NtUninstallKB890859$\ntkrnlpa.exe
2005-03-02 20:06 2060544 8f485cf9683f1220ba27d10281052fce C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe
2005-03-02 20:06 2060544 8f485cf9683f1220ba27d10281052fce C:\WINDOWS\system32\ntkrnlpa.exe
2005-03-02 20:12 2183296 c120a33c71e706545cf26d6276bc0344 C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
2004-08-19 16:34 2184704 4591cf1f202181113de2996e79a2905a C:\WINDOWS\$NtUninstallKB890859$\ntoskrnl.exe
2005-03-02 20:07 2183040 84e6643db22c06128576afbf89dfee70 C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe
2005-03-02 20:07 2183040 84e6643db22c06128576afbf89dfee70 C:\WINDOWS\system32\ntoskrnl.exe
2004-08-19 16:39 1034752 178d42bd8fc34a9837417a6ce1d6bb7b C:\WINDOWS\explorer.exe
2005-11-19 03:11 63488 06b755793967d101212f20ca42334484 C:\WINDOWS\Minidump\explorer.exe
2004-08-19 16:39 1034752 178d42bd8fc34a9837417a6ce1d6bb7b C:\WINDOWS\system32\dllcache\explorer.exe
2004-08-19 16:39 108544 e77f6fa2a15390f1727f4c1c55b69da6 C:\WINDOWS\system32\services.exe
2004-08-19 16:39 108544 e77f6fa2a15390f1727f4c1c55b69da6 C:\WINDOWS\system32\dllcache\services.exe
2004-08-19 16:39 13312 0815e8da286775fa432c7c9ee5e10ba1 C:\WINDOWS\system32\lsass.exe
2004-08-19 16:39 13312 0815e8da286775fa432c7c9ee5e10ba1 C:\WINDOWS\system32\dllcache\lsass.exe
2004-08-19 16:39 15360 5b33b4265966ee063c7fbea28958d9c2 C:\WINDOWS\system32\ctfmon.exe
2004-08-19 16:39 15360 5b33b4265966ee063c7fbea28958d9c2 C:\WINDOWS\system32\dllcache\ctfmon.exe
2005-06-11 02:17 57856 ad3d9d191aea7b5445fe1d82ffbb4788 C:\WINDOWS\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
2004-08-19 16:39 57856 216f8454a9415dd3e451b169dc3121c4 C:\WINDOWS\$NtUninstallKB896423$\spoolsv.exe
2005-06-11 01:53 57856 da81ec57acd4cdc3d4c51cf3d409af9f C:\WINDOWS\system32\spoolsv.exe
2005-06-11 01:53 57856 da81ec57acd4cdc3d4c51cf3d409af9f C:\WINDOWS\system32\dllcache\spoolsv.exe
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 16:39 15360]
"NBJ"="C:\Programmi\Ahead\Nero BackItUp\NBJ.exe" [2004-08-20 12:47 1912832]
"MsnMsgr"="C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="C:\Programmi\QuickTime\qttask.exe" [2006-02-23 16:33 77824]
"CloneCDTray"="C:\Programmi\SlySoft\CloneCD\CloneCDTray.exe" [2006-09-28 21:21 57344]
"Spamihilator"="C:\Programmi\Spamihilator\spamihilator.exe" [2008-04-21 20:00 1081856]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 16:39 15360]
"ATICCC"="C:\Programmi\ATI Technologies\ATI.ACE\cli.exe" [2004-11-03 22:21 32768]
C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
NETGEAR WPN111 Smart Wizard.lnk - C:\Programmi\NETGEAR\WPN111\wpn111.exe [2008-07-04 15:43:12 884838]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\Minidump\\explorer.exe"=
"C:\\Programmi\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"%windir%\\system32\\sessmgr.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017
R2 athsgt;athsgt;C:\WINDOWS\system32\DRIVERS\athsgt.sys [2006-04-15 21:55]
R2 limsgt;limsgt;C:\WINDOWS\system32\DRIVERS\limsgt.sys [2006-04-15 21:55]
S2 DirectLixx;DirectX Service;C:\WINDOWS\system32\directx.exe []
S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;C:\WINDOWS\system32\DNINDIS5.SYS [2003-07-24 12:10]
S3 SetupNTGLM7X;SetupNTGLM7X;E:\NTGLM7X.sys []
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2005-08-30 18:57]
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2005-08-30 18:58]
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2005-08-30 18:59]
S3 WPN111;Wireless USB 2.0 Adapter with RangeMax Service;C:\WINDOWS\system32\DRIVERS\WPN111.sys [2005-09-26 16:02]
.
Contenuto della cartella 'Scheduled Tasks'
2007-04-09 C:\WINDOWS\Tasks\At1.job - s!!C:\WINDOWS\system32\username.exeSYSTEMCreato da NetScheduleJobAdd.0CE e9&8Hx(5[:Djjv4B&0{r54DkUpr []
2007-01-07 C:\WINDOWS\Tasks\At10.job - s!C:\WINDOWS\dr.exeSYSTEMCreato da NetScheduleJobAdd.0@N5JNHUo+d-vx[D $+\e []
2008-07-07 C:\WINDOWS\Tasks\At11.job - s!C:\WINDOWS\user32.exeSYSTEMCreato da NetScheduleJobAdd.0@!e7y>.Lw5Qu*)J$yk,6 @ []
2007-01-07 C:\WINDOWS\Tasks\At12.job - s!C:\WINDOWS\dr.exeSYSTEMCreato da NetScheduleJobAdd.0@@n#w_ppg'ao{KY.r,1Y-4*@g []
2008-07-08 C:\WINDOWS\Tasks\At3.job - s!C:\WINDOWS\system32\smmss.exeSYSTEMCreato da NetScheduleJobAdd.0/sg3gwF >];0`uTI*'vc,J^O_#Rg []
2007-05-07 C:\WINDOWS\Tasks\At5.job - s!"C:\WINDOWS\system32\wudupdate.exeSYSTEMCreato da NetScheduleJobAdd.0@e9ovI%B]8nn.4[&k9GgsVJP []
2008-07-15 C:\WINDOWS\Tasks\At6.job - s!"C:\WINDOWS\system32\wuauclt10.exeSYSTEMCreato da NetScheduleJobAdd.0@:<@`T_C+g b*-R6GY_|U?^e_ []
2006-11-07 C:\WINDOWS\Tasks\At7.job - s!C:\WINDOWS\user32.exeSYSTEMCreato da NetScheduleJobAdd.0@7$jZxwuU!zZ;jCD_ys []
2007-05-07 C:\WINDOWS\Tasks\At8.job - s!C:\WINDOWS\patcher.exeSYSTEMCreato da NetScheduleJobAdd.0@|N3to#Ls`B(Nwi9yc?M*7ei;D&#?U []
2007-05-07 C:\WINDOWS\Tasks\At9.job - s!C:\WINDOWS\widupdate.exeSYSTEMCreato da NetScheduleJobAdd.0@r+_Z^ []
2006-08-22 C:\WINDOWS\Tasks\Laplink Antispyware.job - C:\Programmi\Laplink\PCdefense\LaplinkAsp.exe []
2008-07-27 C:\WINDOWS\Tasks\Verifica aggiornamenti per Windows Live Toolbar.job - .C:\Programmi\Windows Live Toolbar\MSNTBUP.EXEMassimo0< []
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.it/
O8 -: &Windows Live Search - C:\Programmi\Windows Live Toolbar\msntb.dll/search.htm
O8 -: Add to Windows &Live Favorites -
http://favorites.live.com/quickadd.aspxO8 -: E&sporta in Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O16 -: Xß
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-07-27 10:17:55
Windows 5.1.2600 Service Pack 2 NTFS
scansione processi nascosti ...
scansione entrate autostart nascoste ...
Scansione files nascosti ...
Scansione completata con successo
Files nascosti: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\Programmi\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmi\File comuni\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Ora fine scansione: 2008-07-27 10:22:12 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-27 08:22:08
Pre-Run: 40,583,462,912 byte disponibili
Post-Run: 40,589,631,488 byte disponibili
217
