Virus nel Pc, ma non so di che cosa si tratti... - Sicurezza VIRUS

Benvenuto Ospite

Aiutamici Forum » FORUM - Istruzioni e Guide » Sicurezza VIRUS » Virus nel Pc, ma non so di che cosa si tratti...

4 pages: 1 [2] 3 4

Virus nel Pc, ma non so di che cosa si tratti...

Opzioni

Topic Precedente · Topic Sucessivo

icollaboratore

Inviato: Thursday, November 19, 2009 10:02:30 PM

Rank: AiutAmico

Iscritto dal : 5/19/2007
Posts: 50

GMER 1.0.15.15227 - http://www.gmer.net
Rootkit scan 2009-11-19 22:00:36
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\PIERLU~1\IMPOST~1\Temp\kwlyypoc.sys

---- System - GMER 1.0.15 ----

SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwCreateKey [0xF78DF87E]
SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwSetValueKey [0xF78DFBFE]
SSDT \??\C:\Programmi\SUPERAntiSpyware\SASKUTIL.sys (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com) ZwTerminateProcess [0xEE25C0B0]

---- Kernel code sections - GMER 1.0.15 ----

.text ntoskrnl.exe!_abnormal_termination + 451 804E2AAD 3 Bytes [C0, 25, EE]

---- User code sections - GMER 1.0.15 ----

.text C:\Programmi\Mozilla Firefox 3.6 Beta 1\firefox.exe[2884] ntdll.dll!LdrLoadDll 7C9263C3 5 Bytes JMP 004013F0 C:\Programmi\Mozilla Firefox 3.6 Beta 1\firefox.exe (Firefox/Mozilla Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 EABFiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Company)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 EABFiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Company)
AttachedDevice \Driver\Tcpip \Device\Tcp Lbd.sys (Boot Driver/Lavasoft AB)

---- Files - GMER 1.0.15 ----

File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\Internet Explorer 0 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\Internet Explorer\brndlog.bak 141 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\Internet Explorer\brndlog.txt 11041 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\Internet Explorer\Desktop.htt 2722 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\Internet Explorer\Quick Launch 0 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\Internet Explorer\Quick Launch\Ad-Aware.lnk 870 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\Internet Explorer\Quick Launch\Collegamento a firefox.lnk 893 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\Internet Explorer\Quick Launch\desktop.ini 181 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\Internet Explorer\Quick Launch\Mostra Desktop.scf 79 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox 3.6 Beta 1.lnk 1694 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk 787 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\AddIns 0 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\Address Book 0 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\Address Book\Pier Luigi.wab 176602 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\Address Book\Pier Luigi.wab~ 176602 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\Clip Organizer 0 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\Clip Organizer\mstore10.mgc 197688 bytes executable
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\Clip Organizer\Offic10.MGC 148512 bytes executable
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CLR Security Config 0 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CLR Security Config\v1.1.4322 0 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CLR Security Config\v1.1.4322\security.config 21918 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CLR Security Config\v1.1.4322\security.config.cch 21942 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CLR Security Config\v2.0.50727.42 0 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CLR Security Config\v2.0.50727.42\security.config.cch 2038 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\Credentials 0 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\Credentials\S-1-5-21-790525478-764733703-854245398-1004 0 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache 0 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\Content 0 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\Content\087486FD43937B4695C52643C96BB94D 574 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\Content\0897206B35294097C3660E62BCDB227C 2202 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\Content\0EBB3788D77094423275558212CCE7B1 727 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\Content\1E65712B327A68645BB1B8967203F708 1576 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 18 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\Content\303572DF538EDD8B1D606185F1D559B8 341 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\Content\3130B1871A126520A8C47861EFE3ED4D 552 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\Content\33ECCD4EC2899E5F6A7E306662596E0F 1184 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\Content\33EF5DC954745FDB1C94EDBF02CDC43B 471 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\Content\3C19F8F5C2A69BEC912EF5B953293907 1294 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\Content\3C83474D61E624A4F9844DF935AFE217 569 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\Content\486CC6AFD08942336C61FCD401C4A1D1 65170 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\Content\5209B26A762CFE608406374019066239 1220 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\Content\5553AF14BD4C3B1DE599145FD14950E0 574 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\Content\A8FABA189DB7D25FBA7CAC806625FD30 95179 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\Content\B2F4B1D39F0694C6CDB433BC3CCF1418 1764 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\Content\B69D763EB21649DA26F20618312DEE70 18388 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\Content\C571B417AAF1F617555A0486AB3F5361 555 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\Content\CFC456E7E410D69E2C6F3E2DB75C7DB3 1039 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\Content\D9446DF6FD9BABE04CC252D4F0FB3D01 1852 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\Content\E04822AD18D472EA5B582E6E6F8C6B9A 531 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\Content\E6024EAC88E6B6165D49FE3C95ADD735 558 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\Content\FAC4103904B3A44F8012EFF5A7EB160D 557 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\Content\FB788E090BC1F3AA2FBC9E8FB2859601 785 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\Content\60E31627FDA0A46932B0E5948949F2A5 898 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\Content\696F3DE637E6DE85B458996D49D759AD 781 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\Content\71644221AC231DBD2359C18EBB2118DC 541 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\Content\74BFD122C0875EC75DBE5C6DB4C59019 452842 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\Content\79841F8EF00FBA86D33CC5A47696F165 413 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9 552 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\Content\904590238400AD963F77FAAAADC9BAB5 571 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 27455 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\Content\A1377F7115F1F126A15360369B165211 552 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\Content\A44F4E7CB3133FF765C39A53AD8FCFDD 558 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\MetaData 0 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\MetaData\087486FD43937B4695C52643C96BB94D 202 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\MetaData\0897206B35294097C3660E62BCDB227C 194 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\MetaData\0EBB3788D77094423275558212CCE7B1 138 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\MetaData\1E65712B327A68645BB1B8967203F708 134 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 216 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\MetaData\303572DF538EDD8B1D606185F1D559B8 126 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\MetaData\3130B1871A126520A8C47861EFE3ED4D 132 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\MetaData\33ECCD4EC2899E5F6A7E306662596E0F 140 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\MetaData\33EF5DC954745FDB1C94EDBF02CDC43B 134 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\MetaData\3C19F8F5C2A69BEC912EF5B953293907 126 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\MetaData\3C83474D61E624A4F9844DF935AFE217 142 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\MetaData\486CC6AFD08942336C61FCD401C4A1D1 120 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\MetaData\5209B26A762CFE608406374019066239 142 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\MetaData\5553AF14BD4C3B1DE599145FD14950E0 206 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\MetaData\A8FABA189DB7D25FBA7CAC806625FD30 124 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\MetaData\B2F4B1D39F0694C6CDB433BC3CCF1418 194 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\MetaData\B69D763EB21649DA26F20618312DEE70 128 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\MetaData\C571B417AAF1F617555A0486AB3F5361 146 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\MetaData\CFC456E7E410D69E2C6F3E2DB75C7DB3 126 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\MetaData\D9446DF6FD9BABE04CC252D4F0FB3D01 194 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\MetaData\E04822AD18D472EA5B582E6E6F8C6B9A 140 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\MetaData\E6024EAC88E6B6165D49FE3C95ADD735 144 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\MetaData\FAC4103904B3A44F8012EFF5A7EB160D 166 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\MetaData\FB788E090BC1F3AA2FBC9E8FB2859601 134 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\MetaData\60E31627FDA0A46932B0E5948949F2A5 94 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\MetaData\696F3DE637E6DE85B458996D49D759AD 156 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\MetaData\71644221AC231DBD2359C18EBB2118DC 148 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\MetaData\74BFD122C0875EC75DBE5C6DB4C59019 124 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\MetaData\79841F8EF00FBA86D33CC5A47696F165 98 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9 132 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\MetaData\904590238400AD963F77FAAAADC9BAB5 136 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 216 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\MetaData\A1377F7115F1F126A15360369B165211 142 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\CryptnetUrlCache\MetaData\A44F4E7CB3133FF765C39A53AD8FCFDD 146 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\Crypto 0 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\Crypto\RSA 0 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\Crypto\RSA\S-1-5-21-790525478-764733703-854245398-1004 0 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\Crypto\RSA\S-1-5-21-790525478-764733703-854245398-1004\83aa4cc77f591dfc2374580bbd95f6ba_f49233b1-2599-4984-9faa-840489e79b6f 45 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\Crypto\RSA\S-1-5-21-790525478-764733703-854245398-1004\be279072b81623d016604ba1b9833b04_f49233b1-2599-4984-9faa-840489e79b6f 51 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\Excel 0 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\Excel\Excel11.xlb 17674 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\Excel\XLSTART 0 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\HTML Help 0 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\HTML Help\hh.dat 9420 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\IdentityCRL 0 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\IdentityCRL\Production 0 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\InfoPath 0 bytes
File C:\Documents and Settings\Pier Luigi\Dati applicazioni\Microsoft\InfoPath\infopath.tbs 1067 bytes

---- EOF - GMER 1.0.15 ----

Torna in alto

icollaboratore

Inviato: Thursday, November 19, 2009 10:04:53 PM

Rank: AiutAmico

Iscritto dal : 5/19/2007
Posts: 50

Torna in alto

shapiro

Inviato: Friday, November 20, 2009 10:20:13 AM

Rank: AiutAmico

Iscritto dal : 8/24/2008
Posts: 4,164

ilcollaboratore

hai avuto dei riavvii durante la scansione? sono uscite delle voci in rosso? sembra che abbia trovato qualcosa

mi sta' venendo un dubbio....ma hai fatto la scansione completa con kaspersky???

per quello che riguarda la cartella windows installer, vorrei andarci con i piedi di piombo, meglio controllare bene, anche se sembra che ci siano dei file infetti

per maggior sicurezza, esegui questa scansione

scarica sul desktop questo programmino

http://www.simplysupersoft.com/download/dl/trjsetup681.exe

prima di iniziare la scansione aggiornalo, e' molto importante

lancialo premendo ''scan'' - dai ok se te lo chiede durante i passaggi
alla fine della scansione, vai su ''file''>>> wiew logfile - salva il report e postalo

Torna in alto

shapiro

Inviato: Friday, November 20, 2009 7:54:07 PM

Rank: AiutAmico

Iscritto dal : 8/24/2008
Posts: 4,164

allora ilcollaboratore

ho controllato i file nella cartella windows installer ma sembra che sono legittimi di windows- purtroppo hanno lo stesso identico nome di alcuni malware, ma non credo sia il tuo caso

credo invece di doverti dare una notizia per niente buona

dai sintomi che lamenti, probabilmente sei infettato dal virus piu' temibile(oltre al famoso virut) che negli ultimi tempi ha infettato diverse decine di migliaia di macchine - hai il worm conficker

pertanto ti chiedo la massima collaborazione e soprattutto la massima calma....vedremo di eliminarlo

inizia subito con disattivare il ripristino, te lo avevo indicato anche ieri - se non sai come fare, ti seguo passo passo

un volta disattivato, scarica da questi link questi due programmi e vai in modalita' provvisoria

inizia col primo, rilasciato da Microsoft ed eseguilo

http://www.microsoft.com/downloads/details.aspx?amp%3Bdisplaylang=en&familyid=ad724ae0-e72d-4f54-9ab3-75b8eb148356&displaylang=it

per il download clicca su ''scarica''

scarica anche questo della symantec e lascialo sul desktop, lo eseguirai appena finito col primo

http://www.symantec.com/content/en/us/global/removal_tool/threat_writeups/D.exe

vai anche su questo sito, e salva il programma di bitdefender, sembra uno dei migliori per ''schiodarlo''

http://news.wintricks.it/web/dal-web/28848/rimuovere-conficker-gratis/

ovviamente le operazioni che ho indicato nel precedente post sono annullate

Torna in alto

icollaboratore

Inviato: Friday, November 20, 2009 10:14:31 PM

Rank: AiutAmico

Iscritto dal : 5/19/2007
Posts: 50

Ciao,

ho provato tutti e quattro i tool (compreso il primo che poi hai annullato) nessun risultato :(
Vuoi che ti posti i report?

Torna in alto

icollaboratore

Inviato: Friday, November 20, 2009 10:17:29 PM

Rank: AiutAmico

Iscritto dal : 5/19/2007
Posts: 50

***** NORMAL SCAN FOR ACTIVE MALWARE *****
Trojan Remover Ver 6.8.1.2591. For information, email support@simplysup.com
[Unregistered version]
Scan started at: 21.06.58 20 nov 2009
Using Database v7425
Operating System: Windows XP Home Edition (SP3) [Build: 5.1.2600]
File System: NTFS
UserData directory: C:\Documents and Settings\Pier Luigi\Dati applicazioni\Simply Super Software\Trojan Remover\
Database directory: C:\Documents and Settings\All Users\Dati applicazioni\Simply Super Software\Trojan Remover\Data\
Logfile directory: d:\\Simply Super Software\Trojan Remover Logfiles\
Program directory: C:\Programmi\Trojan Remover\
Running with Administrator privileges
[Alerts will be shown on Malware files AND files not found]

************************************************************
PC appears to be in SAFE MODE.

************************************************************

************************************************************
21.06.58: ----- SCANNING FOR ROOTKIT SERVICES -----
No hidden Services were detected.

************************************************************
21.06.59: Scanning -----WINDOWS REGISTRY-----

Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon

Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
This key's "Shell" value calls the following program(s):
Key value: [Explorer.exe]
File: Explorer.exe
C:\WINDOWS\Explorer.exe
1036288 bytes
Created: 08/04/2003 20.00
Modified: 14/04/2008 3.14
Company: Microsoft Corporation

This key's "Userinit" value calls the following program(s):
Key value: [C:\WINDOWS\system32\userinit.exe,]
File: C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\userinit.exe
26624 bytes
Created: 08/04/2003 20.00
Modified: 14/04/2008 3.14
Company: Microsoft Corporation

This key's "System" value appears to be blank

This key's "UIHost" value calls the following program:
Key value: [logonui.exe]
File: logonui.exe
C:\WINDOWS\system32\logonui.exe
515584 bytes
Created: 08/04/2003 20.00
Modified: 14/04/2008 3.14
Company: Microsoft Corporation

Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows

Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows

Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: SynTPLpr
Value Data: C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
98304 bytes
Created: 30/12/2007 16.45
Modified: 27/05/2004 1.15
Company: Synaptics, Inc.

Value Name: SynTPEnh
Value Data: C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
1015808 bytes
Created: 30/12/2007 16.45
Modified: 15/09/2007 2.27
Company: Synaptics, Inc.

Value Name: SynTPStart
Value Data: C:\Programmi\Synaptics\SynTP\SynTPStart.exe
C:\Programmi\Synaptics\SynTP\SynTPStart.exe
102400 bytes
Created: 15/09/2007 2.29
Modified: 15/09/2007 2.29
Company: Synaptics, Inc.

Value Name: VirusKeeper
Value Data: C:\Programmi\AxBx\VirusKeeper 2009 Pro Trial\VirusKeeper.exe
C:\Programmi\AxBx\VirusKeeper 2009 Pro Trial\VirusKeeper.exe
3748728 bytes
Created: 01/07/2009 12.29
Modified: 01/07/2009 12.29
Company: AxBx

Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty

Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
This Registry Key appears to be empty

Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
This Registry Key appears to be empty

Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
This Registry Key appears to be empty

Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Run
This Registry Key appears to be empty

Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty

Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
This Registry Key appears to be empty

Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
This Registry Key appears to be empty

Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
This Registry Key appears to be empty

************************************************************
21.07.01: Scanning -----SHELLEXECUTEHOOKS-----
ValueName: {AEB6717E-7E19-11d0-97EE-00C04FD91972}
File: shell32.dll - this file is expected and has been left in place

ValueName: {56F9679E-7826-4C84-81F3-532071A8BCC5}
File: C:\Programmi\Windows Desktop Search\MSNLNamespaceMgr.dll
C:\Programmi\Windows Desktop Search\MSNLNamespaceMgr.dll
304128 bytes
Created: 26/05/2008 21.19
Modified: 24/05/2009 21.41
Company: Microsoft Corporation

************************************************************
21.07.02: Scanning -----HIDDEN REGISTRY ENTRIES-----
Taskdir check completed

No Hidden File-loading Registry Entries found

************************************************************
21.07.04: Scanning -----ACTIVE SCREENSAVER-----
No active ScreenSaver found to scan.

************************************************************
21.07.04: Scanning ----- REGISTRY ACTIVE SETUP KEYS -----
Key: {44BBA840-CC51-11CF-AAFA-00AA00B6015C}
Path: "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
C:\Programmi\Outlook Express\setup50.exe
73728 bytes
Created: 30/12/2007 16.32
Modified: 14/04/2008 3.14
Company: Microsoft Corporation

Key: {7790769C-0471-11d2-AF11-00C04FA35D02}
Path: "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
C:\Programmi\Outlook Express\setup50.exe
73728 bytes
Created: 30/12/2007 16.32
Modified: 14/04/2008 3.14
Company: Microsoft Corporation

************************************************************
21.07.04: Scanning ----- SERVICEDLL REGISTRY KEYS -----
Key: AppMgmt
%SystemRoot%\System32\appmgmts.dll - file is globally excluded (file cannot be found)

Key: HidServ
%SystemRoot%\System32\hidserv.dll - file is globally excluded (file cannot be found)

Key: srservice
Path: %SystemRoot%\system32\srsvc.dll
C:\WINDOWS\system32\srsvc.dll
171520 bytes
Created: 30/12/2007 16.32
Modified: 14/04/2008 3.13
Company: Microsoft Corporation

************************************************************
21.07.05: Scanning ----- SERVICES REGISTRY KEYS -----
Key: Adobe LM Service
ImagePath: "C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe"
C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
72704 bytes
Created: 31/12/2007 13.12
Modified: 31/12/2007 13.12
Company: Adobe Systems

Key: CAMCAUD
ImagePath: system32\drivers\camcaud.sys
C:\WINDOWS\system32\drivers\camcaud.sys
293120 bytes
Created: 30/12/2007 16.44
Modified: 23/11/2004 14.57
Company: Conexant Systems Inc.

Key: CAMCHALA
ImagePath: system32\drivers\camchal.sys
C:\WINDOWS\system32\drivers\camchal.sys
280192 bytes
Created: 30/12/2007 16.44
Modified: 23/11/2004 14.57
Company: Conexant Systems Inc.

Key: catchme
ImagePath: \??\C:\DOCUME~1\PIERLU~1\IMPOST~1\Temp\catchme.sys - this file is globally excluded

Key: eabfiltr
ImagePath: \??\C:\WINDOWS\System32\drivers\EABFiltr.sys
C:\WINDOWS\System32\drivers\EABFiltr.sys
-R- 7080 bytes
Created: 30/12/2007 16.56
Modified: 18/08/2003 21.57
Company: Hewlett-Packard Company

Key: eabusb
ImagePath: \??\C:\WINDOWS\system32\drivers\eabusb.sys
C:\WINDOWS\system32\drivers\eabusb.sys
-R- 5220 bytes
Created: 30/12/2007 16.56
Modified: 06/06/2003 20.46
Company: Hewlett-Packard Company

Key: hpqwmi
ImagePath: C:\Programmi\HPQ\SHARED\HPQWMI.exe
C:\Programmi\HPQ\SHARED\HPQWMI.exe
94208 bytes
Created: 30/12/2007 16.56
Modified: 02/05/2004 22.38
Company: Hewlett Packard Company

Key: HSFHWICH
ImagePath: System32\DRIVERS\HSFHWICH.sys
C:\WINDOWS\System32\DRIVERS\HSFHWICH.sys
207232 bytes
Created: 30/12/2007 16.44
Modified: 15/12/2004 15.18
Company: Conexant Systems, Inc.

Key: HWiNFO32
ImagePath: \??\C:\Programmi\HWiNFO32\HWiNFO32.SYS
C:\Programmi\HWiNFO32\HWiNFO32.SYS
8192 bytes
Created: 31/12/2007 12.33
Modified: 14/09/2007 13.15
Company: REALiX(tm)

Key: ImapiService
ImagePath: %systemroot%\system32\imapi.exe
C:\WINDOWS\system32\imapi.exe
150528 bytes
Created: 08/04/2003 20.00
Modified: 14/04/2008 3.14
Company: Microsoft Corporation

Key: is-IJ3KPdrv
ImagePath: system32\DRIVERS\36779824.sys
C:\WINDOWS\system32\DRIVERS\36779824.sys
148496 bytes
Created: 18/11/2009 23.33
Modified: 08/07/2008 13.54
Company: Kaspersky Lab

Key: Lavasoft Ad-Aware Service
ImagePath: "C:\Programmi\Lavasoft\Ad-Aware\AAWService.exe"
C:\Programmi\Lavasoft\Ad-Aware\AAWService.exe
1179232 bytes
Created: 24/09/2009 12.17
Modified: 18/11/2009 0.43
Company: Lavasoft

Key: massfilter
ImagePath: system32\DRIVERS\massfilter.sys
C:\WINDOWS\system32\DRIVERS\massfilter.sys
-R- 7680 bytes
Created: 07/08/2009 16.10
Modified: 08/12/2008 16.21
Company: ZTE Incorporated

Key: MBAMSwissArmy
ImagePath: \??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys
C:\WINDOWS\system32\drivers\mbamswissarmy.sys
38224 bytes
Created: 10/11/2009 20.19
Modified: 10/09/2009 14.54
Company: Malwarebytes Corporation

Key: MDM
ImagePath: "C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE"
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
322120 bytes
Created: 19/06/2003 23.25
Modified: 19/06/2003 23.25
Company: Microsoft Corporation

Key: MpFilter
ImagePath: system32\DRIVERS\MpFilter.sys
C:\WINDOWS\system32\DRIVERS\MpFilter.sys
142832 bytes
Created: 18/06/2009 17.48
Modified: 18/06/2009 17.48
Company: Microsoft Corporation

Key: ose
ImagePath: "C:\Programmi\File comuni\Microsoft Shared\Source Engine\OSE.EXE"
C:\Programmi\File comuni\Microsoft Shared\Source Engine\OSE.EXE
89136 bytes
Created: 28/07/2003 20.28
Modified: 28/07/2003 20.28
Company: Microsoft Corporation

Key: RTL8023
ImagePath: System32\DRIVERS\Rtlnic51.sys
C:\WINDOWS\System32\DRIVERS\Rtlnic51.sys
69504 bytes
Created: 30/12/2007 16.45
Modified: 27/04/2004 23.03
Company: Realtek Semiconductor Corporation

Key: SASDIFSV
ImagePath: \??\C:\Programmi\SUPERAntiSpyware\SASDIFSV.SYS
C:\Programmi\SUPERAntiSpyware\SASDIFSV.SYS
9968 bytes
Created: 11/11/2009 10.44
Modified: 11/11/2009 10.44
Company: SUPERAdBlocker.com and SUPERAntiSpyware.com

Key: SASENUM
ImagePath: \??\C:\Programmi\SUPERAntiSpyware\SASENUM.SYS
C:\Programmi\SUPERAntiSpyware\SASENUM.SYS
-R- 7408 bytes
Created: 11/11/2009 10.44
Modified: 11/11/2009 10.44
Company: SUPERAdBlocker.com and SUPERAntiSpyware.com

Key: SASKUTIL
ImagePath: \??\C:\Programmi\SUPERAntiSpyware\SASKUTIL.sys
C:\Programmi\SUPERAntiSpyware\SASKUTIL.sys
74480 bytes
Created: 11/11/2009 10.44
Modified: 11/11/2009 10.44
Company: SUPERAdBlocker.com and SUPERAntiSpyware.com

Key: sr
ImagePath: \SystemRoot\System32\DRIVERS\sr.sys
C:\WINDOWS\System32\DRIVERS\sr.sys
73472 bytes
Created: 30/12/2007 16.32
Modified: 14/04/2008 2.56
Company: Microsoft Corporation

Key: SwPrv
ImagePath: C:\WINDOWS\System32\dllhost.exe /Processid:{7C263597-21F4-4350-A466-AEAFA975CB9B}
C:\WINDOWS\System32\dllhost.exe
5120 bytes
Created: 08/04/2003 20.00
Modified: 14/04/2008 3.14
Company: Microsoft Corporation

Key: SynTP
ImagePath: System32\DRIVERS\SynTP.sys
C:\WINDOWS\System32\DRIVERS\SynTP.sys
213696 bytes
Created: 30/12/2007 16.45
Modified: 15/09/2007 2.09
Company: Synaptics, Inc.

Key: vkservice
ImagePath: C:\Programmi\AxBx\VirusKeeper 2009 Pro Trial\vk_service.exe
C:\Programmi\AxBx\VirusKeeper 2009 Pro Trial\vk_service.exe
1119584 bytes
Created: 26/09/2008 10.10
Modified: 26/09/2008 10.10
Company: AxBx

Key: w29n51
ImagePath: system32\DRIVERS\w29n51.sys
C:\WINDOWS\system32\DRIVERS\w29n51.sys
2210048 bytes
Created: 30/06/2006 2.49
Modified: 26/07/2007 0.44
Company: Intel® Corporation

Key: WMPNetworkSvc
ImagePath: "C:\Programmi\Windows Media Player\WMPNetwk.exe"
C:\Programmi\Windows Media Player\WMPNetwk.exe
918528 bytes
Created: 02/11/2006 22.56
Modified: 02/11/2006 22.56
Company: Microsoft Corporation

Key: WpdUsb
ImagePath: system32\DRIVERS\wpdusb.sys
C:\WINDOWS\system32\DRIVERS\wpdusb.sys
38528 bytes
Created: 18/10/2006 20.00
Modified: 18/10/2006 20.00
Company: Microsoft Corporation

Key: ZTEusbmdm6k
ImagePath: system32\DRIVERS\ZTEusbmdm6k.sys
C:\WINDOWS\system32\DRIVERS\ZTEusbmdm6k.sys
-R- 104960 bytes
Created: 07/08/2009 16.11
Modified: 08/12/2008 16.21
Company: ZTE Incorporated

Key: ZTEusbnet
ImagePath: system32\DRIVERS\ZTEusbnet.sys
C:\WINDOWS\system32\DRIVERS\ZTEusbnet.sys
-R- 110080 bytes
Created: 07/08/2009 16.11
Modified: 08/12/2008 16.21
Company: ZTE Corporation

Key: ZTEusbnmea
ImagePath: system32\DRIVERS\ZTEusbnmea.sys
C:\WINDOWS\system32\DRIVERS\ZTEusbnmea.sys
-R- 105344 bytes
Created: 07/08/2009 16.11
Modified: 08/12/2008 16.21
Company: ZTE Incorporated

Key: ZTEusbser6k
ImagePath: system32\DRIVERS\ZTEusbser6k.sys
C:\WINDOWS\system32\DRIVERS\ZTEusbser6k.sys
-R- 104960 bytes
Created: 07/08/2009 16.10
Modified: 08/12/2008 16.21
Company: ZTE Incorporated

Key: ZTEusbvoice
ImagePath: system32\DRIVERS\ZTEusbvoice.sys
C:\WINDOWS\system32\DRIVERS\ZTEusbvoice.sys
-R- 104960 bytes
Created: 07/08/2009 16.11
Modified: 08/12/2008 16.21
Company: ZTE Incorporated

Key: {E2B953A6-195A-44F9-9BA3-3D5F4E32BB55}
ImagePath: system32\drivers\wA301a.sys
C:\WINDOWS\system32\drivers\wA301a.sys
33847 bytes
Created: 30/12/2007 16.46
Modified: 07/11/2003 11.45
Company: Intel Corporation

************************************************************
21.07.17: Scanning -----VXD ENTRIES-----

************************************************************
21.07.17: Scanning ----- WINLOGON\NOTIFY DLLS -----
Key : !SASWinLogon
DLLName: C:\Programmi\SUPERAntiSpyware\SASWINLO.dll
C:\Programmi\SUPERAntiSpyware\SASWINLO.dll
548352 bytes
Created: 03/09/2009 14.21
Modified: 03/09/2009 14.21
Company: SUPERAntiSpyware.com

************************************************************
21.07.17: Scanning ----- CONTEXTMENUHANDLERS -----
Key: LavasoftShellExt
CLSID: {DCE027F7-16A4-4BEE-9BE7-74F80EE3738F}
Path: C:\Programmi\Lavasoft\Ad-Aware\ShellExt.dll
C:\Programmi\Lavasoft\Ad-Aware\ShellExt.dll
163728 bytes
Created: 23/09/2009 14.19
Modified: 18/11/2009 0.47
Company:

Key: ShellExtension
CLSID: [empty]

Key: {CA8ACAFA-5FBB-467B-B348-90DD488DE003}
Path: C:\Programmi\SUPERAntiSpyware\SASCTXMN.DLL
C:\Programmi\SUPERAntiSpyware\SASCTXMN.DLL
61440 bytes
Created: 27/02/2007 11.39
Modified: 27/02/2007 11.39
Company: SUPERAntiSpyware.com

************************************************************
21.07.18: Scanning ----- FOLDER\COLUMNHANDLERS -----
Key: {F9DB5320-233E-11D1-9F84-707F02C10627}
File: C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\PDFShell.dll
C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\PDFShell.dll
378200 bytes
Created: 27/02/2009 12.16
Modified: 27/02/2009 12.16
Company: Adobe Systems, Inc.

************************************************************
21.07.18: Scanning ----- BROWSER HELPER OBJECTS -----

************************************************************
21.07.18: Scanning ----- SHELLSERVICEOBJECTS -----
Key: SysTray
CLSID: {35CEC8A3-2BE6-11D2-8773-92E220524153}
Path: %systemroot%\system32\stobject.dll
C:\WINDOWS\system32\stobject.dll
122368 bytes
Created: 08/04/2003 20.00
Modified: 14/04/2008 3.13
Company: Microsoft Corporation

************************************************************
21.07.18: Scanning ----- SHAREDTASKSCHEDULER ENTRIES -----

************************************************************
21.07.18: Scanning ----- IMAGEFILE DEBUGGERS -----
No "Debugger" entries found.

************************************************************
21.07.18: Scanning ----- APPINIT_DLLS -----
No APPINIT_DLLS value found to check

************************************************************
21.07.19: Scanning ----- SECURITY PROVIDER DLLS -----

************************************************************
21.07.19: Scanning ------ COMMON STARTUP GROUP ------
[C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica]
The Common Startup Group attempts to load the following file(s) at boot time:
C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\desktop.ini
-HS- 84 bytes
Created: 30/12/2007 16.24
Modified: 30/12/2007 16.34
Company: [no info]

************************************************************
No User Startup Groups were located to check

************************************************************
21.07.19: Scanning ----- SCHEDULED TASKS -----
Scheduled Tasks not scanned: running in SAFE mode so Task Scheduler service not running

************************************************************
21.07.19: Scanning ----- SHELLICONOVERLAYIDENTIFIERS -----

************************************************************
21.07.19: Scanning ----- DEVICE DRIVER ENTRIES -----
Value: vidc.DIVX
File: DivX.dll
C:\WINDOWS\system32\DivX.dll
685056 bytes
Created: 01/05/2009 22.02
Modified: 01/05/2009 22.02
Company: DivX, Inc.

Value: vidc.yv12
File: DivX.dll
C:\WINDOWS\system32\DivX.dll - file already scanned

************************************************************
21.07.20: ----- ADDITIONAL CHECKS -----
PE386 rootkit checks completed

Winlogon registry rootkit checks completed

Heuristic checks for hidden files/drivers completed

Layered Service Provider entries checks completed

Windows Explorer Policies checks completed

Desktop Wallpaper: C:\Documents and Settings\Pier Luigi\Impostazioni locali\Dati applicazioni\Microsoft\Wallpaper1.bmp
C:\Documents and Settings\Pier Luigi\Impostazioni locali\Dati applicazioni\Microsoft\Wallpaper1.bmp
1440054 bytes
Created: 31/12/2007 14.10
Modified: 30/09/2008 21.09
Company: [no info]

Web Desktop Wallpaper: %USERPROFILE%\Impostazioni locali\Dati applicazioni\Microsoft\Wallpaper1.bmp
C:\Documents and Settings\Pier Luigi\Impostazioni locali\Dati applicazioni\Microsoft\Wallpaper1.bmp
1440054 bytes
Created: 31/12/2007 14.10
Modified: 30/09/2008 21.09
Company: [no info]

Checks for rogue DNS NameServers completed

Additional checks completed

************************************************************
21.07.21: Scanning ----- RUNNING PROCESSES -----

C:\WINDOWS\System32\smss.exe
50688 bytes
Created: 08/04/2003 20.00
Modified: 14/04/2008 3.14
Company: Microsoft Corporation

C:\WINDOWS\system32\csrss.exe
6144 bytes
Created: 08/04/2003 20.00
Modified: 14/04/2008 3.14
Company: Microsoft Corporation

C:\WINDOWS\system32\winlogon.exe
510464 bytes
Created: 08/04/2003 20.00
Modified: 14/04/2008 3.14
Company: Microsoft Corporation

C:\WINDOWS\system32\services.exe
111104 bytes
Created: 08/04/2003 20.00
Modified: 09/02/2009 12.22
Company: Microsoft Corporation

C:\WINDOWS\system32\lsass.exe
13312 bytes
Created: 08/04/2003 20.00
Modified: 14/04/2008 3.14
Company: Microsoft Corporation

C:\WINDOWS\system32\svchost.exe
14336 bytes
Created: 08/04/2003 20.00
Modified: 14/04/2008 3.14
Company: Microsoft Corporation

C:\WINDOWS\system32\svchost.exe - file already scanned

C:\WINDOWS\Explorer.EXE - file already scanned

C:\Documents and Settings\Pier Luigi\Desktop\D.exe
2348928 bytes
Created: 20/11/2009 20.12
Modified: 20/11/2009 20.12
Company:

C:\Documents and Settings\Pier Luigi\Dati applicazioni\Simply Super Software\Trojan Remover\lwn30.exe
FileSize: 3101560
[This is a Trojan Remover component]

************************************************************
21.07.27: Checking HOSTS file
No malicious entries were found in the HOSTS file

************************************************************
------ INTERNET EXPLORER HOME/START/SEARCH SETTINGS ------
HKLM\Software\Microsoft\Internet Explorer\Main\"Start Page":
http://go.microsoft.com/fwlink/?LinkId=69157
HKLM\Software\Microsoft\Internet Explorer\Main\"Local Page":
C:\WINDOWS\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main\"Search Page":
http://go.microsoft.com/fwlink/?LinkId=54896
HKLM\Software\Microsoft\Internet Explorer\Main\"Default_Page_URL":
http://go.microsoft.com/fwlink/?LinkId=69157
HKLM\Software\Microsoft\Internet Explorer\Main\"Default_Search_URL":
http://go.microsoft.com/fwlink/?LinkId=54896
HKLM\Software\Microsoft\Internet Explorer\Search\"CustomizeSearch":
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
HKLM\Software\Microsoft\Internet Explorer\Search\"SearchAssistant":
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
HKCU\Software\Microsoft\Internet Explorer\Main\"Start Page":
http://www.google.it/
HKCU\Software\Microsoft\Internet Explorer\Main\"Local Page":
C:\WINDOWS\system32\blank.htm
HKCU\Software\Microsoft\Internet Explorer\Main\"Search Page":
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

************************************************************
=== NO CHANGES HAVE BEEN MADE TO YOUR SYSTEM FILES ===
Scan completed at: 21.07.27 20 nov 2009
Total Scan time: 00.00.29
************************************************************

***** NORMAL SCAN FOR ACTIVE MALWARE *****
Trojan Remover Ver 6.8.1.2591. For information, email support@simplysup.com
[Unregistered version]
Scan started at: 21.05.51 20 nov 2009
Using Database v7425
Operating System: Windows XP Home Edition (SP3) [Build: 5.1.2600]
File System: NTFS
UserData directory: C:\Documents and Settings\Pier Luigi\Dati applicazioni\Simply Super Software\Trojan Remover\
Database directory: C:\Documents and Settings\All Users\Dati applicazioni\Simply Super Software\Trojan Remover\Data\
Logfile directory: d:\\Simply Super Software\Trojan Remover Logfiles\
Program directory: C:\Programmi\Trojan Remover\
Running with Administrator privileges
[Alerts will be shown on Malware files AND files not found]

************************************************************
PC appears to be in SAFE MODE.

************************************************************

************************************************************
21.05.51: ----- SCANNING FOR ROOTKIT SERVICES -----
No hidden Services were detected.

************************************************************
21.05.52: Scanning -----WINDOWS REGISTRY-----