Buonasera al forum
copio e incollo quello che ho letto poc'anzi sul sito di Repubblica

TERNET
"Lasciate Explorer, non è sicuro"
Allarme dell'Autorità tedesca
L'uso del browser più diffuso del mondo "sconsigliabile" a causa di una falla nella sicurezza. Preferibile usare browser alternativi finché il problema non sarà risoltodal corrispondente ANDREA TARQUINI

BERLINO ? Un allarme sui pericoli dell?uso di internet Explorer è stato lanciato oggi in Germania. Secondo Spiegel online, l?edizione digitale dell?autorevole settimanale di Amburgo, il Bundesamt fuer Sicherheit in der Informationstechnik, BSI, cioè l?Autorità federale per la sicurezza nella tecnologia dell?informazione, ha avvertito che l?uso del browser più diffuso nel mondo è sconsigliabile, ed è preferibile usare browser alternativi, finché il problema non verrà risolto.

C?è un punto debole in internet explorer, avverte la fonte ufficiale tedesca citata da Spiegel online. Sarebbe una ?falla? nella sua sicurezza che ?permette di lanciare attacchi e installare programmi ostili in un computer che funziona con Windows, attraverso un codice manipolato di un sito. Le versioni di internet explorer esposte a rischio sono la 6, la 7 e la 8 sui sistemi Windows XP, Vista e 7.

Al momento, continua il reportage di Spiegel online sempre citando l?autorità federale per la sicurezza IT, non è disponibile un?a ttualizzazione del software. ?L?autorità federale prevede che il punto debole, la falla di explorer verrà utilizzata a breve per attacchi su internet?, e consiglia quindi l?uso al momento di altri browser. Consiglia sistemi che chiama per nome, come Firefox, Opera, Chrome o Safari. L?uso di internet explorer in modo protetto può rendere gli assalti più difficili, ma non impedirli, nota il monito ufficiale.

L?avvertimento del Bsi è posto in relazione con gli attacchi di hacker condotti negli ultimi giorni contro i sistemi informatici di alcune aziende americane. E probabilmente il pericolo è quello di attacchi mirati contro alcune imprese, non contro l?uso privato di internet explorer. Ma presto la realtà potrebbe cambiare e il pericolo riguarderebbe molti più utenti. Non è la prima volta che internet explorer è oggetto di tentativi di attacco del genere: essendo il browser più diffuso nel mondo è bersaglio privilegiato della ?cybercriminalità?.Microsoft stessa consiglia di usare explorer, almeno per il monento solo in protected mode e con i massimi livelli di sicurezza.

Ciao.
Và beh....aspettiamo .....
Grazie.

vabbè....buonanotte.....se devo girare per il web in cerca di allarmi sulle falle meglio che chiuda baracca e burattini e che mi dia all'uncinetto.
Finiamola di farci del male a tutti i costi.............

visto che (fortunatamente) nano ghiacciato permettendo
per ora in italia c'e' ancora liberta' di epressione
mi limitavo solo a citare l'articolo su Repubblica senza creare allarmismi
Tutto qui! Poi ognuno e' libero di usare il browser che meglio
gli aggrada

Vuoi fare una scansione con Combofix, per verificare delle cose, che a quel tempo non erano note?

se vuoi passo su xp e vediamo......dimmi tu

riavviato .....4 minuti e 20 secondi....dimmi

ComboFix 10-01-15.01 - Luigi 15/01/2010 23.50.45.2.2 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1252.39.1040.18.2046.1664 [GMT 1:00]
Eseguito da: c:\documents and settings\Luigi\Desktop\ComboFix.exe
AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Thumbs.db
c:\windows\system32\autorun.ini
c:\windows\system32\dbexpmysql.dll
c:\windows\system32\IsaprocSer49.dll.dll
c:\windows\system32\Thumbs.db

.
((((((((((((((((((((((((( Files Creati Da 2009-12-15 al 2010-01-15 )))))))))))))))))))))))))))))))))))
.

2010-01-15 22:37 . 2009-10-28 22:37 343088 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100112.001\IDSvix86.sys
2010-01-15 22:37 . 2009-10-28 22:37 329592 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100112.001\IDSXpx86.sys
2010-01-15 22:37 . 2009-10-28 22:37 811896 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100112.001\Scxpx86.dll
2010-01-15 22:37 . 2009-10-28 22:37 488312 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100112.001\IDSxpx86.dll
2010-01-15 22:37 . 2009-10-28 22:37 466992 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100112.001\IDSviA64.sys
2010-01-15 22:36 . 2009-12-23 18:36 2747440 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100115.019\CCERASER.DLL
2010-01-15 22:36 . 2009-12-23 18:36 259440 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100115.019\ECMSVR32.DLL
2010-01-15 22:36 . 2009-08-29 09:00 84912 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100115.019\NAVENG.SYS
2010-01-15 22:36 . 2009-08-29 09:00 371248 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100115.019\EECTRL.SYS
2010-01-15 22:36 . 2009-08-29 09:00 177520 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100115.019\NAVENG32.DLL
2010-01-15 22:36 . 2009-08-29 09:00 1647984 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100115.019\NAVEX32A.DLL
2010-01-15 22:36 . 2009-08-29 09:00 1323568 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100115.019\NAVEX15.SYS
2010-01-15 22:36 . 2009-08-29 09:00 102448 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100115.019\ERASER.SYS
2010-01-08 20:36 . 2009-10-28 22:37 343088 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100106.001\IDSvix86.sys
2010-01-08 20:36 . 2009-10-28 22:37 329592 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100106.001\IDSXpx86.sys
2010-01-08 20:36 . 2009-10-28 22:37 811896 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100106.001\Scxpx86.dll
2010-01-08 20:36 . 2009-10-28 22:37 488312 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100106.001\IDSxpx86.dll
2010-01-08 20:36 . 2009-10-28 22:37 466992 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100106.001\IDSviA64.sys
2010-01-06 20:32 . 2010-01-06 20:32 -------- d-----w- c:\programmi\Lottobit.com
2009-12-23 18:36 . 2009-12-05 04:54 668720 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20091205.001\BHDrvx64.sys
2009-12-23 18:36 . 2009-12-05 04:54 610704 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20091205.001\bbRGen.dll
2009-12-23 18:36 . 2009-12-05 04:54 529456 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20091205.001\BHDrvx86.sys
2009-12-23 18:36 . 2009-12-05 04:54 201616 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20091205.001\BHRules.dll
2009-12-23 18:36 . 2009-12-05 04:54 1405840 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20091205.001\BHEngine.dll
2009-12-23 18:22 . 2009-10-29 02:31 784752 ----a-r- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\coFFPlgn\components\coFFPlgn.dll
2009-12-23 18:22 . 2009-08-30 00:16 164216 ----a-r- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\IPSFFPlgn\components\IPSFFPl.dll
2009-12-23 18:19 . 2009-08-26 22:13 900464 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\OCS\hsplayer.dll
2009-12-23 18:19 . 2009-09-01 08:27 892272 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\CLT\cltLMSx.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-23 18:19 . 2008-10-24 17:45 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
2009-12-23 18:19 . 2008-10-24 17:45 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2009-12-23 18:19 . 2007-10-25 17:52 805 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF
2009-12-23 18:19 . 2007-10-25 17:52 7443 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2009-12-23 18:12 . 2006-08-30 23:13 85070 ----a-w- c:\windows\system32\perfc010.dat
2009-12-23 18:12 . 2006-08-30 23:13 490898 ----a-w- c:\windows\system32\perfh010.dat
2009-11-21 15:54 . 2004-09-07 19:00 471552 ----a-w- c:\windows\AppPatch\AcLayers.dll
2009-11-20 10:59 . 2009-11-20 10:59 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\WEBREG
2009-11-20 10:58 . 2009-11-20 10:43 204674 ----a-w- c:\windows\hpoins39.dat
2009-11-20 10:58 . 2009-11-20 10:58 -------- d-----w- c:\documents and settings\Luigi\Dati applicazioni\HP
2009-11-20 10:52 . 2009-11-20 10:52 -------- d-----w- c:\programmi\File comuni\HP
2009-11-20 10:51 . 2009-11-20 10:51 -------- d-----w- c:\programmi\File comuni\Hewlett-Packard
2009-11-20 10:51 . 2009-11-20 10:51 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\HP
2009-11-20 10:46 . 2009-11-20 10:46 -------- d-----w- c:\programmi\HP
2009-11-15 09:29 . 2009-11-15 09:28 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-11-02 19:42 . 2009-10-10 13:21 195456 ------w- c:\windows\system32\MpSigStub.exe
2009-10-29 07:40 . 2006-01-09 18:59 916480 ----a-w- c:\windows\system32\wininet.dll
2009-10-28 22:37 . 2009-10-28 22:37 343088 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\BinHub\IDSvix86.sys
2009-10-28 22:37 . 2009-10-28 22:37 329592 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\BinHub\IDSXpx86.sys
2009-10-28 22:37 . 2009-10-28 22:37 811896 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\BinHub\Scxpx86.dll
2009-10-28 22:37 . 2009-10-28 22:37 488312 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\BinHub\IDSxpx86.dll
2009-10-28 22:37 . 2009-10-28 22:37 466992 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\BinHub\IDSviA64.sys
2009-10-26 18:59 . 2009-10-26 18:59 25992 ----a-w- c:\windows\system32\pgdfgsvc.exe
2009-10-25 23:10 . 2009-10-25 23:10 0 ----a-w- c:\documents and settings\All Users\Dati applicazioni\ISxF.tmp
2009-10-25 22:02 . 2007-02-14 11:26 126400 ----a-w- c:\documents and settings\Luigi\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2009-10-21 05:38 . 2004-09-07 19:00 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2004-09-07 19:00 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-09-07 19:00 265728 ----a-w- c:\windows\system32\drivers\http.sys
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" [X]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-19 7581696]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2006-07-20 593920]
"AzMixerSel"="c:\programmi\Realtek\InstallShield\AzMixerSel.exe" [2005-12-21 53248]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-28 16248320]
"SynTPEnh"="c:\programmi\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 761946]
"NvMediaCenter"="NvMCTray.dll" [2006-07-19 86016]
"nwiz"="nwiz.exe" [2006-07-19 1519616]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\FILECO~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"igfxpers"=c:\windows\system32\igfxpers.exe
"igfxtray"=c:\windows\system32\igfxtray.exe
"LogitechVideo[inspector]"=c:\programmi\Acer\OrbiCam\InstallHelper.exe /inspect
"Windows Defender"="c:\programmi\Windows Defender\MSASCui.exe" -hide
"igfxhkcmd"=c:\windows\system32\hkcmd.exe
"MSPY2002"=c:\windows\system32\IME\PINTLGNT\ImScInst.exe /SYNC
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
"ehTray"=c:\windows\ehome\ehtray.exe
"eRecoveryService"=c:\acer\Empowering Technology\eRecovery\Monitor.exe
"LVCOMSX"=c:\windows\system32\LVCOMSX.EXE
"nwiz"=nwiz.exe /install
"SkyTel"=SkyTel.EXE
"BluetoothAuthenticationAgent"=rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
"NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
"SunJavaUpdateSched"="c:\programmi\Java\jre6\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Acer\\Empowering Technology\\empower.exe"=
"c:\\Programmi\\uTorrent\\utorrent.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Programmi\\eMule\\emule.exe"=
"c:\\WINDOWS\\System32\\dpvsetup.exe"=
"c:\\Programmi\\Messenger\\msmsgs.exe"=
"c:\\Programmi\\Foxit Software\\PDF Editor\\PDFEdit.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\MSN Messenger\\msnmsgr.exe"=
"c:\\Programmi\\MSN Messenger\\livecall.exe"=
"f:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"4661:TCP"= 4661:TCP:*:Disabled:emule
"4671:UDP"= 4671:UDP:*:Disabled:emule
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1101000.013\SymDS.sys [24/12/2009 10.22.41 Luigi 328752]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1101000.013\SymEFA.sys [24/12/2009 10.22.41 Luigi 171056]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20091205.001\BHDrvx86.sys [23/12/2009 19.36.20 Luigi 529456]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1101000.013\cchpx86.sys [24/12/2009 10.22.41 Luigi 501888]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1101000.013\Ironx86.sys [24/12/2009 10.22.41 Luigi 114736]
R2 NIS;Norton Internet Security;c:\programmi\Norton Internet Security\Engine\17.1.0.19\ccSvcHst.exe [24/12/2009 10.22.32 Luigi 126392]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\programmi\File comuni\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [19/01/2009 12.34.10 Luigi 102448]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100112.001\IDSXpx86.sys [15/01/2010 23.37.14 Luigi 329592]
R3 lv321av;Logitech USB PC Camera (VC0321);c:\windows\system32\drivers\lv321av.sys [19/06/2006 12.20.24 Luigi 1097728]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [21/03/2007 18.42.40 Luigi 646392]
S2 eusk2par;EUTRON SmartKey Parallel Driver;c:\windows\system32\drivers\eusk2par.sys [26/10/2009 21.47.43 Luigi 16695]
S3 ACSSCR;ACR38 Smart Card Reader;c:\windows\system32\drivers\a38usbxp.sys [11/02/2008 22.29.45 Luigi 24832]
S3 FXDRV;FXDRV;\??\e:\fxdrv.sys --> e:\Fxdrv.sys [?]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\3.tmp --> c:\windows\system32\3.tmp [?]
S3 Network WanMiniport First Position;Network WanMiniport First Position;c:\programmi\Telecom Italia\WanMiniport1st\srvany.exe [18/05/2008 18.12.06 Luigi 8192]
S3 OCSCryptolibService;Oberthur Cryptolib Service;c:\windows\OCSCryptolib_Server.exe [11/02/2008 22.30.53 Luigi 139264]
S3 WinDefend;Windows Defender;c:\programmi\Windows Defender\MsMpEng.exe [03/11/2006 18.19.58 Luigi 13592]
S4 Utilità di pianificazione di LiveUpdate automatico;Utilità di pianificazione di LiveUpdate automatico; [x]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contenuto della cartella 'Scheduled Tasks'

2010-01-15 c:\windows\Tasks\MP Scheduled Scan.job
- c:\programmi\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]
.
.
------- Scansione supplementare -------
.
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uStart Page = hxxp://it.acer.yahoo.com/
uInternet Connection Wizard,ShellNext = hxxp://it.intl.acer.yahoo.com/
uSearchURL,(Default) = hxxp://it.rd.yahoo.com/customize/ycomp/defaults/su/*http://it.yahoo.com
IE: c:\programmi\WIDCOMM\Software Bluetooth\btsendto_ie_ctx.htm
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-15 23:54
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NIS]
"ImagePath"="\"c:\programmi\Norton Internet Security\Engine\17.1.0.19\ccSvcHst.exe\" /s \"NIS\" /m \"c:\programmi\Norton Internet Security\Engine\17.1.0.19\diMaster.dll\" /prefetch:1"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\3.tmp"
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------

[HKEY_USERS\S-1-5-21-669107838-1188101148-748768976-1005\Software\Local AppWizard-Generated Applications\Launch Tool]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5AAC1CAC-3D87-0098-aeaf-e183facaf59f}\InprocServer32*]
"Class"=hex:49,fe,c0,43,52,59,dc,b5,c6,2b,bf,42,04,2c,87,ec,3b,ea,eb,d5,fe,4d,
de,0c,3b,ea,eb,d5,fe,4d,de,0c,3b,ea,eb,d5,fe,4d,de,0c,3b,ea,eb,d5,fe,4d,de,\
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5AAC1CAC-3D87-71e4-d8c1-d4d2facaf59f}\InprocServer32*]
"Class"=hex:4c,40,95,f0,dd,ae,5e,a5,1c,8f,35,78,f9,f9,43,e6,17,6e,24,cc,5c,88,
06,00,17,6e,24,cc,5c,88,06,00,17,6e,24,cc,5c,88,06,00,17,6e,24,cc,5c,88,06,\
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5AAC1CAC-3D87-8fad-6bd3-04d2facaf59f}\InprocServer32*]
"Class"=hex:98,1e,e1,ac,dc,d3,d1,91,74,75,fc,0b,20,2a,0b,d2,fd,fa,ab,2c,1e,07,
22,40,fd,fa,ab,2c,1e,07,22,40,fd,fa,ab,2c,1e,07,22,40,fd,fa,ab,2c,1e,07,22,\
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5AAC1CAC-3D87-9356-f82c-2d16facaf59f}\InprocServer32*]
"Class"=hex:d3,b3,17,65,1a,72,ba,b9,8e,3a,d1,40,c4,e1,58,1b,8e,9d,f5,d2,e5,0f,
9d,1f,8e,9d,f5,d2,e5,0f,9d,1f,8e,9d,f5,d2,e5,0f,9d,1f,8e,9d,f5,d2,e5,0f,9d,\
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5AAC1CAC-3D87-c07a-dbca-1eeffacaf59f}\InprocServer32*]
"Class"=hex:52,01,2b,df,3c,d3,e1,c4,f0,2f,23,65,be,89,14,e9,e3,a9,94,b6,d4,96,
cf,77,e3,a9,94,b6,d4,96,cf,77,e3,a9,94,b6,d4,96,cf,77,e3,a9,94,b6,d4,96,cf,\
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5AAC1CAC-3D87-d844-b1e9-d5effacaf59f}\InprocServer32*]
"Class"=hex:b3,45,b8,8a,50,5a,b7,9d,de,24,c1,4e,ac,99,cd,a3,a3,a0,f8,79,a5,d8,
65,6a,a3,a0,f8,79,a5,d8,65,6a,a3,a0,f8,79,a5,d8,65,6a,a3,a0,f8,79,a5,d8,65,\
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5AAC1CAC-3D87-ed77-1b21-9000facaf59f}\InprocServer32*]
"Class"=hex:b7,37,c5,a0,1b,f6,10,62,d5,cb,96,e2,79,5c,39,13,ed,a9,12,02,e8,d0,
bc,62,ed,a9,12,02,e8,d0,bc,62,ed,a9,12,02,e8,d0,bc,62,ed,a9,12,02,e8,d0,bc,\
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"

[HKEY_LOCAL_MACHINE\software\Microsoft\Advanced INF Setup\IEHomePageInfo\RegBackup]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\services]
@DACL=(02 0000)
@SACL=
"NoServices"=dword:00000000

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{077ACEC7-979C-40AB-9835-435BA1511E0D}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="Windows Media Files"
"ComponentGUID"="{077ACEC7-979C-40AB-9835-435BA1511E0D}"
"Version"=dword:000a0000
"Sub-Version"=dword:000010ec
"ExceptionInfName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{077ACEC7-979C-40AB-9835-435BA1511E0D}\\MPPRE10.inf"
"ExceptionCatalogName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{077ACEC7-979C-40AB-9835-435BA1511E0D}\\mppre10.cat"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{30C7234B-6482-4A55-A11D-ECD9030313F2}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="Windows Media Files"
"ComponentGUID"="{30C7234B-6482-4A55-A11D-ECD9030313F2}"
"Version"=dword:000a0000
"Sub-Version"=dword:000010ec
"ExceptionInfName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{30C7234B-6482-4A55-A11D-ECD9030313F2}\\WMDM10.inf"
"ExceptionCatalogName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{30C7234B-6482-4A55-A11D-ECD9030313F2}\\wmdm10.cat"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{981FB688-E76B-4246-987B-92083185B90A}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="Windows Media Files"
"ComponentGUID"="{981FB688-E76B-4246-987B-92083185B90A}"
"Version"=dword:000a0000
"Sub-Version"=dword:000010ec
"ExceptionInfName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{981FB688-E76B-4246-987B-92083185B90A}\\WPD10.inf"
"ExceptionCatalogName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{981FB688-E76B-4246-987B-92083185B90A}\\wpd10.cat"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{A47B3654-48EE-48A5-B629-97D70175E58F}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="Windows Media Files"
"ComponentGUID"="{A47B3654-48EE-48A5-B629-97D70175E58F}"
"Version"=dword:000a0000
"Sub-Version"=dword:000010ec
"ExceptionInfName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{A47B3654-48EE-48A5-B629-97D70175E58F}\\codecs10.inf"
"ExceptionCatalogName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{A47B3654-48EE-48A5-B629-97D70175E58F}\\codecs10.cat"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="Windows Media Files"
"ComponentGUID"="{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}"
"Version"=dword:000a0000
"Sub-Version"=dword:000010ec
"ExceptionInfName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\\WMFSDK10.inf"
"ExceptionCatalogName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\\wmfsdk10.cat"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="Windows Media Files"
"ComponentGUID"="{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}"
"Version"=dword:000a0000
"Sub-Version"=dword:000010ec
"ExceptionInfName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}\\DRM10.inf"
"ExceptionCatalogName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}\\drm10.cat"

[HKEY_LOCAL_MACHINE\software\muvee Technologies\030625]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\muvee Technologies\muvee SDK - NTI_5]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Realtek Semiconductor Corp.\Realtek High Definition Audio Driver]
@DACL=(02 0000)
@SACL=
.
Ora fine scansione: 2010-01-15 23:56:20
ComboFix-quarantined-files.txt 2010-01-15 22:56

Pre-Run: 5.266.554.880 byte disponibili
Post-Run: 5.404.098.560 byte disponibili

- - End Of File - - E4DA2DCC93ED2C60DD3797D492DD4586

ComboFix 10-01-15.01 - Luigi 16/01/2010 14.19.43.3.2 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1252.39.1040.18.2046.1578 [GMT 1:00]
Eseguito da: c:\documents and settings\Luigi\Desktop\ComboFix.exe
Opzioni usate :: c:\documents and settings\Luigi\Desktop\CFScript.txt
AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!

FILE ::
"c:\windows\system32\3.tmp"
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Driver/Servizi )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_FXDRV
-------\Legacy_MEMSWEEP2
-------\Service_FXDRV


((((((((((((((((((((((((( Files Creati Da 2009-12-16 al 2010-01-16 )))))))))))))))))))))))))))))))))))
.

2010-01-16 13:08 . 2009-08-29 09:00 177520 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100115.050\NAVENG32.DLL
2010-01-16 13:08 . 2009-08-29 09:00 1647984 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100115.050\NAVEX32A.DLL
2010-01-16 13:08 . 2009-08-29 09:00 1323568 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100115.050\NAVEX15.SYS
2010-01-16 13:08 . 2009-12-23 18:36 2747440 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100115.050\CCERASER.DLL
2010-01-16 13:08 . 2009-12-23 18:36 259440 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100115.050\ECMSVR32.DLL
2010-01-16 13:08 . 2009-08-29 09:00 84912 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100115.050\NAVENG.SYS
2010-01-16 13:08 . 2009-08-29 09:00 371248 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100115.050\EECTRL.SYS
2010-01-16 13:08 . 2009-08-29 09:00 102448 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100115.050\ERASER.SYS
2010-01-15 22:37 . 2009-10-28 22:37 343088 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100112.001\IDSvix86.sys
2010-01-15 22:37 . 2009-10-28 22:37 329592 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100112.001\IDSXpx86.sys
2010-01-15 22:37 . 2009-10-28 22:37 811896 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100112.001\Scxpx86.dll
2010-01-15 22:37 . 2009-10-28 22:37 488312 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100112.001\IDSxpx86.dll
2010-01-15 22:37 . 2009-10-28 22:37 466992 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100112.001\IDSviA64.sys
2010-01-08 20:36 . 2009-10-28 22:37 343088 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100106.001\IDSvix86.sys
2010-01-08 20:36 . 2009-10-28 22:37 329592 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100106.001\IDSXpx86.sys
2010-01-08 20:36 . 2009-10-28 22:37 811896 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100106.001\Scxpx86.dll
2010-01-08 20:36 . 2009-10-28 22:37 488312 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100106.001\IDSxpx86.dll
2010-01-08 20:36 . 2009-10-28 22:37 466992 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100106.001\IDSviA64.sys
2010-01-06 20:32 . 2010-01-06 20:32 -------- d-----w- c:\programmi\Lottobit.com
2009-12-23 18:36 . 2009-12-05 04:54 668720 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20091205.001\BHDrvx64.sys
2009-12-23 18:36 . 2009-12-05 04:54 610704 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20091205.001\bbRGen.dll
2009-12-23 18:36 . 2009-12-05 04:54 529456 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20091205.001\BHDrvx86.sys
2009-12-23 18:36 . 2009-12-05 04:54 201616 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20091205.001\BHRules.dll
2009-12-23 18:36 . 2009-12-05 04:54 1405840 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20091205.001\BHEngine.dll
2009-12-23 18:22 . 2009-10-29 02:31 784752 ----a-r- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\coFFPlgn\components\coFFPlgn.dll
2009-12-23 18:22 . 2009-08-30 00:16 164216 ----a-r- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\IPSFFPlgn\components\IPSFFPl.dll
2009-12-23 18:19 . 2009-08-26 22:13 900464 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\OCS\hsplayer.dll
2009-12-23 18:19 . 2009-09-01 08:27 892272 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\CLT\cltLMSx.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-23 18:19 . 2008-10-24 17:45 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
2009-12-23 18:19 . 2008-10-24 17:45 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2009-12-23 18:19 . 2007-10-25 17:52 805 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF
2009-12-23 18:19 . 2007-10-25 17:52 7443 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2009-12-23 18:12 . 2006-08-30 23:13 85070 ----a-w- c:\windows\system32\perfc010.dat
2009-12-23 18:12 . 2006-08-30 23:13 490898 ----a-w- c:\windows\system32\perfh010.dat
2009-11-21 15:54 . 2004-09-07 19:00 471552 ----a-w- c:\windows\AppPatch\AcLayers.dll
2009-11-20 10:59 . 2009-11-20 10:59 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\WEBREG
2009-11-20 10:58 . 2009-11-20 10:43 204674 ----a-w- c:\windows\hpoins39.dat
2009-11-20 10:58 . 2009-11-20 10:58 -------- d-----w- c:\documents and settings\Luigi\Dati applicazioni\HP
2009-11-20 10:52 . 2009-11-20 10:52 -------- d-----w- c:\programmi\File comuni\HP
2009-11-20 10:51 . 2009-11-20 10:51 -------- d-----w- c:\programmi\File comuni\Hewlett-Packard
2009-11-20 10:51 . 2009-11-20 10:51 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\HP
2009-11-20 10:46 . 2009-11-20 10:46 -------- d-----w- c:\programmi\HP
2009-11-15 09:29 . 2009-11-15 09:28 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-11-02 19:42 . 2009-10-10 13:21 195456 ------w- c:\windows\system32\MpSigStub.exe
2009-10-29 07:40 . 2006-01-09 18:59 916480 ------w- c:\windows\system32\wininet.dll
2009-10-28 22:37 . 2009-10-28 22:37 343088 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\BinHub\IDSvix86.sys
2009-10-28 22:37 . 2009-10-28 22:37 329592 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\BinHub\IDSXpx86.sys
2009-10-28 22:37 . 2009-10-28 22:37 811896 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\BinHub\Scxpx86.dll
2009-10-28 22:37 . 2009-10-28 22:37 488312 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\BinHub\IDSxpx86.dll
2009-10-28 22:37 . 2009-10-28 22:37 466992 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\BinHub\IDSviA64.sys
2009-10-26 18:59 . 2009-10-26 18:59 25992 ----a-w- c:\windows\system32\pgdfgsvc.exe
2009-10-25 23:10 . 2009-10-25 23:10 0 ----a-w- c:\documents and settings\All Users\Dati applicazioni\ISxF.tmp
2009-10-25 22:02 . 2007-02-14 11:26 126400 ----a-w- c:\documents and settings\Luigi\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2009-10-21 05:38 . 2004-09-07 19:00 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2004-09-07 19:00 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-09-07 19:00 265728 ----a-w- c:\windows\system32\drivers\http.sys
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" [X]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-19 7581696]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2006-07-20 593920]
"AzMixerSel"="c:\programmi\Realtek\InstallShield\AzMixerSel.exe" [2005-12-21 53248]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-28 16248320]
"SynTPEnh"="c:\programmi\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 761946]
"NvMediaCenter"="NvMCTray.dll" [2006-07-19 86016]
"nwiz"="nwiz.exe" [2006-07-19 1519616]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\FILECO~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"igfxpers"=c:\windows\system32\igfxpers.exe
"igfxtray"=c:\windows\system32\igfxtray.exe
"LogitechVideo[inspector]"=c:\programmi\Acer\OrbiCam\InstallHelper.exe /inspect
"Windows Defender"="c:\programmi\Windows Defender\MSASCui.exe" -hide
"igfxhkcmd"=c:\windows\system32\hkcmd.exe
"MSPY2002"=c:\windows\system32\IME\PINTLGNT\ImScInst.exe /SYNC
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
"ehTray"=c:\windows\ehome\ehtray.exe
"eRecoveryService"=c:\acer\Empowering Technology\eRecovery\Monitor.exe
"LVCOMSX"=c:\windows\system32\LVCOMSX.EXE
"nwiz"=nwiz.exe /install
"SkyTel"=SkyTel.EXE
"BluetoothAuthenticationAgent"=rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
"NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
"SunJavaUpdateSched"="c:\programmi\Java\jre6\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Acer\\Empowering Technology\\empower.exe"=
"c:\\Programmi\\uTorrent\\utorrent.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Programmi\\eMule\\emule.exe"=
"c:\\WINDOWS\\System32\\dpvsetup.exe"=
"c:\\Programmi\\Messenger\\msmsgs.exe"=
"c:\\Programmi\\Foxit Software\\PDF Editor\\PDFEdit.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\MSN Messenger\\msnmsgr.exe"=
"c:\\Programmi\\MSN Messenger\\livecall.exe"=
"f:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"4661:TCP"= 4661:TCP:*:Disabled:emule
"4671:UDP"= 4671:UDP:*:Disabled:emule
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [21/03/2007 18.42.40 Luigi 646392]
R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1101000.013\SymDS.sys [24/12/2009 10.22.41 Luigi 328752]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1101000.013\SymEFA.sys [24/12/2009 10.22.41 Luigi 171056]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20091205.001\BHDrvx86.sys [23/12/2009 19.36.20 Luigi 529456]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1101000.013\cchpx86.sys [24/12/2009 10.22.41 Luigi 501888]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1101000.013\Ironx86.sys [24/12/2009 10.22.41 Luigi 114736]
R2 NIS;Norton Internet Security;c:\programmi\Norton Internet Security\Engine\17.1.0.19\ccSvcHst.exe [24/12/2009 10.22.32 Luigi 126392]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\programmi\File comuni\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [19/01/2009 12.34.10 Luigi 102448]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100112.001\IDSXpx86.sys [15/01/2010 23.37.14 Luigi 329592]
R3 lv321av;Logitech USB PC Camera (VC0321);c:\windows\system32\drivers\lv321av.sys [19/06/2006 12.20.24 Luigi 1097728]
S2 eusk2par;EUTRON SmartKey Parallel Driver;c:\windows\system32\drivers\eusk2par.sys [26/10/2009 21.47.43 Luigi 16695]
S3 ACSSCR;ACR38 Smart Card Reader;c:\windows\system32\drivers\a38usbxp.sys [11/02/2008 22.29.45 Luigi 24832]
S3 Network WanMiniport First Position;Network WanMiniport First Position;c:\programmi\Telecom Italia\WanMiniport1st\srvany.exe [18/05/2008 18.12.06 Luigi 8192]
S3 OCSCryptolibService;Oberthur Cryptolib Service;c:\windows\OCSCryptolib_Server.exe [11/02/2008 22.30.53 Luigi 139264]
S3 WinDefend;Windows Defender;c:\programmi\Windows Defender\MsMpEng.exe [03/11/2006 18.19.58 Luigi 13592]
S4 Utilità di pianificazione di LiveUpdate automatico;Utilità di pianificazione di LiveUpdate automatico; [x]

--- Altri Servizi/Drivers In Memoria ---

*NewlyCreated* - INT15.SYS

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contenuto della cartella 'Scheduled Tasks'

2010-01-15 c:\windows\Tasks\MP Scheduled Scan.job
- c:\programmi\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]
.
.
------- Scansione supplementare -------
.
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uStart Page = hxxp://it.acer.yahoo.com/
uInternet Connection Wizard,ShellNext = hxxp://it.intl.acer.yahoo.com/
uSearchURL,(Default) = hxxp://it.rd.yahoo.com/customize/ycomp/defaults/su/*http://it.yahoo.com
IE: c:\programmi\WIDCOMM\Software Bluetooth\btsendto_ie_ctx.htm
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-16 14:27
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys sptd.sys >>UNKNOWN [0x8A6687B8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xba98cf28
\Driver\ACPI -> ACPI.sys @ 0xba68dcb8
\Driver\atapi -> atapi.sys @ 0xba604b40
IoDeviceObjectType ->\Device\Harddisk0\DR0 ->NDIS: -> SendCompleteHandler -> 0x0
PacketIndicateHandler -> 0x0
SendHandler -> 0x0
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NIS]
"ImagePath"="\"c:\programmi\Norton Internet Security\Engine\17.1.0.19\ccSvcHst.exe\" /s \"NIS\" /m \"c:\programmi\Norton Internet Security\Engine\17.1.0.19\diMaster.dll\" /prefetch:1"
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------

[HKEY_USERS\S-1-5-21-669107838-1188101148-748768976-1005\Software\Local AppWizard-Generated Applications\Launch Tool]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5AAC1CAC-3D87-0098-aeaf-e183facaf59f}\InprocServer32*]
"Class"=hex:49,fe,c0,43,52,59,dc,b5,c6,2b,bf,42,04,2c,87,ec,3b,ea,eb,d5,fe,4d,
de,0c,3b,ea,eb,d5,fe,4d,de,0c,3b,ea,eb,d5,fe,4d,de,0c,3b,ea,eb,d5,fe,4d,de,\
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5AAC1CAC-3D87-71e4-d8c1-d4d2facaf59f}\InprocServer32*]
"Class"=hex:4c,40,95,f0,dd,ae,5e,a5,1c,8f,35,78,f9,f9,43,e6,17,6e,24,cc,5c,88,
06,00,17,6e,24,cc,5c,88,06,00,17,6e,24,cc,5c,88,06,00,17,6e,24,cc,5c,88,06,\
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5AAC1CAC-3D87-8fad-6bd3-04d2facaf59f}\InprocServer32*]
"Class"=hex:98,1e,e1,ac,dc,d3,d1,91,74,75,fc,0b,20,2a,0b,d2,fd,fa,ab,2c,1e,07,
22,40,fd,fa,ab,2c,1e,07,22,40,fd,fa,ab,2c,1e,07,22,40,fd,fa,ab,2c,1e,07,22,\
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5AAC1CAC-3D87-9356-f82c-2d16facaf59f}\InprocServer32*]
"Class"=hex:d3,b3,17,65,1a,72,ba,b9,8e,3a,d1,40,c4,e1,58,1b,8e,9d,f5,d2,e5,0f,
9d,1f,8e,9d,f5,d2,e5,0f,9d,1f,8e,9d,f5,d2,e5,0f,9d,1f,8e,9d,f5,d2,e5,0f,9d,\
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5AAC1CAC-3D87-c07a-dbca-1eeffacaf59f}\InprocServer32*]
"Class"=hex:52,01,2b,df,3c,d3,e1,c4,f0,2f,23,65,be,89,14,e9,e3,a9,94,b6,d4,96,
cf,77,e3,a9,94,b6,d4,96,cf,77,e3,a9,94,b6,d4,96,cf,77,e3,a9,94,b6,d4,96,cf,\
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5AAC1CAC-3D87-d844-b1e9-d5effacaf59f}\InprocServer32*]
"Class"=hex:b3,45,b8,8a,50,5a,b7,9d,de,24,c1,4e,ac,99,cd,a3,a3,a0,f8,79,a5,d8,
65,6a,a3,a0,f8,79,a5,d8,65,6a,a3,a0,f8,79,a5,d8,65,6a,a3,a0,f8,79,a5,d8,65,\
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5AAC1CAC-3D87-ed77-1b21-9000facaf59f}\InprocServer32*]
"Class"=hex:b7,37,c5,a0,1b,f6,10,62,d5,cb,96,e2,79,5c,39,13,ed,a9,12,02,e8,d0,
bc,62,ed,a9,12,02,e8,d0,bc,62,ed,a9,12,02,e8,d0,bc,62,ed,a9,12,02,e8,d0,bc,\
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"

[HKEY_LOCAL_MACHINE\software\Microsoft\Advanced INF Setup\IEHomePageInfo\RegBackup]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\services]
@DACL=(02 0000)
@SACL=
"NoServices"=dword:00000000

[HKEY_LOCAL_MACHINE\software\muvee Technologies\030625]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\muvee Technologies\muvee SDK - NTI_5]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Realtek Semiconductor Corp.\Realtek High Definition Audio Driver]
@DACL=(02 0000)
@SACL=
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------

- - - - - - - > 'explorer.exe'(2236)
c:\windows\system32\WININET.dll
c:\windows\system32\nview.dll
c:\windows\system32\NVWRSIT.DLL
c:\windows\system32\nvwddi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\programmi\Intel\Wireless\Bin\EvtEng.exe
c:\programmi\Intel\Wireless\Bin\S24EvMon.exe
c:\windows\system32\dllhost.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\programmi\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\programmi\Intel\Wireless\Bin\RegSrvc.exe
c:\windows\system32\locator.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\rundll32.exe
c:\docume~1\Luigi\IMPOST~1\Temp\RtkBtMnt.exe
.
**************************************************************************
.
Ora fine scansione: 2010-01-16 14:31:50 - Il pc è stato riavviato
ComboFix-quarantined-files.txt 2010-01-16 13:31
ComboFix2.txt 2010-01-15 22:56

Pre-Run: 5.196.316.672 byte disponibili
Post-Run: 5.098.225.664 byte disponibili

- - End Of File - - F600CF6782D1832BA41DF91C162150A6

---

tempo di start: 2 minuti e 45 secondi...

Non quanto speravo.
E d'altronte, non sono state eliminate, tutte le chiavi, che avevo scritto.
Mi fermo qui.
Ciao!