ComboFix 10-03-17.07 - 6750 18/03/2010 23.30.29.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.39.1040.18.2038.1103 [GMT 1:00]
Eseguito da: c:\documents and settings\6750\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\att114.pdf
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\foto10(03-18-21-47-59).gif
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\foto10.gif
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\foto10.jpg
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\foto11(03-18-21-37-04).jpg
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\foto11(03-18-21-47-59).jpg
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\foto11.jpg
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\foto12(03-18-21-47-59).jpg
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\foto12.jpg
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\foto13(03-18-21-47-59).jpg
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\foto13.jpg
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\foto14(03-18-21-47-59).jpg
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\foto14.jpg
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\foto8.gif
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\foto9.jpg
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\leftbg(03-18-20-15-01).gif
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\leftbg(03-18-20-15-43).gif
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\leftbg(1).gif
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\leftbg.gif
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\Programma Escursioni CAI 2010.jpg
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\rightbg(03-18-20-15-01).gif
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\rightbg(03-18-20-15-43).gif
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\rightbg.gif
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\scrollbar.css
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\toppic(03-18-20-15-01).gif
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\toppic(03-18-20-15-43).gif
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\toppic.gif
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\unknown(03-18-18-30-16).htm
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\unknown(03-18-18-30-31).htm
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\unknown(03-18-19-50-40).htm
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\unknown(03-18-19-50-52).htm
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\unknown(03-18-19-50-55).htm
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\unknown(03-18-19-50-58).htm
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\unknown(03-18-19-51-14).htm
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\unknown(03-18-19-52-03).htm
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\unknown(03-18-19-58-11).htm
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\unknown(03-18-19-58-22).htm
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\unknown(03-18-20-15-01).htm
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\unknown(03-18-20-15-43).htm
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\unknown(03-18-20-21-19).htm
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\unknown(03-18-20-32-53).htm
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\unknown(03-18-20-32-55).htm
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\unknown(03-18-20-36-11).htm
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\unknown(03-18-21-02-49).htm
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\unknown(03-18-21-03-22).htm
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\unknown(03-18-21-17-58).htm
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\unknown(03-18-21-19-56).htm
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\unknown(03-18-21-32-10).htm
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\unknown(03-18-21-33-19).htm
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\unknown(03-18-21-37-04).htm
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\unknown(03-18-21-47-58).htm
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\unknown(03-18-21-47-59)(1).htm
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\unknown(03-18-21-47-59)(2).htm
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\unknown(03-18-21-47-59).htm
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\unknown(03-18-21-48-00).htm
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\unknown(03-18-21-48-04).htm
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\unknown(03-18-21-50-13).htm
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\unknown(03-18-22-48-00).htm
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\unknown(03-18-23-00-36).htm
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\unknown.htm
c:\documents and settings\6750\Impostazioni locali\Temporary Internet Files\unknown.jpg
.
((((((((((((((((((((((((( Files Creati Da 2010-02-18 al 2010-03-18 )))))))))))))))))))))))))))))))))))
.
2010-03-17 21:25 . 2009-12-28 21:21 12288 ----a-w- c:\windows\system32\netset.exe
2010-03-17 21:18 . 2010-03-17 21:18 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\FreeRIP
2010-03-15 20:54 . 2010-03-15 20:54 -------- d-----w- c:\documents and settings\NetworkService\Impostazioni locali\Dati applicazioni\Google
2010-03-15 20:50 . 2010-03-15 20:50 -------- d-----w- c:\documents and settings\LocalService\Impostazioni locali\Dati applicazioni\Google
2010-03-15 20:49 . 2010-03-15 20:50 -------- d-----w- c:\programmi\Google
2010-03-14 12:47 . 2010-03-14 12:47 -------- d-----w- c:\documents and settings\6750\Impostazioni locali\Dati applicazioni\Winamp Toolbar
2010-03-12 15:14 . 2010-03-12 15:17 -------- d-----w- c:\documents and settings\6750\Dati applicazioni\Synthesia
2010-03-12 15:11 . 2010-03-12 15:11 -------- d-----w- c:\programmi\Synthesia
2010-03-11 16:53 . 2010-03-11 16:53 540568 ----a-w- c:\documents and settings\LocalService\Impostazioni locali\Dati applicazioni\FontCache3.0.0.0.dat
2010-03-10 20:55 . 2010-03-10 20:55 -------- d-----w- c:\programmi\Winamp Toolbar
2010-03-10 20:55 . 2010-03-10 20:55 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Winamp Toolbar
2010-03-10 19:13 . 2004-01-25 16:18 217088 ----a-w- c:\windows\system32\yv12vfw.dll
2010-03-10 19:13 . 2009-05-29 21:37 205824 ----a-w- c:\windows\system32\xvidvfw.dll
2010-03-10 19:13 . 2009-05-29 21:31 881664 ----a-w- c:\windows\system32\xvidcore.dll
2010-03-10 19:13 . 2010-02-02 18:00 85504 ----a-w- c:\windows\system32\ff_vfw.dll
2010-03-10 19:12 . 2010-03-10 19:16 -------- d-----w- c:\programmi\K-Lite Codec Pack
2010-03-09 22:06 . 2010-03-09 22:06 -------- d-----w- c:\programmi\Lame for Audacity
2010-03-09 19:10 . 2010-03-09 19:10 -------- d-----w- C:\MAGIX
2010-03-09 17:32 . 2010-03-11 13:44 -------- d-----w- c:\documents and settings\6750\Dati applicazioni\Audacity
2010-03-09 17:32 . 2010-03-09 17:32 -------- d-----w- c:\programmi\Audacity 1.3 Beta (Unicode)
2010-03-07 22:58 . 2010-03-07 22:58 -------- d-----w- c:\documents and settings\6750\Impostazioni locali\Dati applicazioni\Phase_One
2010-03-07 22:42 . 2010-03-07 22:42 -------- d-----w- c:\programmi\DIFX
2010-03-07 22:42 . 2010-03-07 22:42 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Phase One
2010-03-07 22:42 . 2010-03-07 22:47 -------- d-----w- c:\documents and settings\6750\Impostazioni locali\Dati applicazioni\CaptureOne
2010-03-05 18:31 . 2010-03-07 19:11 -------- d-----w- c:\programmi\File comuni\Symantec Shared
2010-03-05 18:27 . 2010-03-07 19:11 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Norton
2010-03-05 18:27 . 2010-03-05 18:27 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Symantec
2010-03-05 18:27 . 2010-03-05 18:27 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\NortonInstaller
2010-03-03 14:52 . 2010-03-03 14:52 -------- dc-h--w- c:\documents and settings\All Users\Dati applicazioni\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
2010-03-02 22:38 . 2010-03-02 22:44 -------- d-----w- c:\documents and settings\6750\Dati applicazioni\Trellian
2010-03-02 22:38 . 2010-03-02 22:40 -------- d-----w- c:\documents and settings\6750\Impostazioni locali\Dati applicazioni\WebPage
2010-03-02 22:36 . 2007-09-07 22:43 512000 ----a-w- c:\windows\system32\Achroma2.dll
2010-03-02 22:36 . 2010-03-18 17:42 -------- d-----w- c:\programmi\Trellian
2010-03-02 22:22 . 2010-03-02 22:22 -------- d-----w- c:\programmi\HTML TableFactory
2010-03-02 17:29 . 2010-03-02 17:29 -------- d-----w- c:\programmi\MPC HomeCinema
2010-03-02 17:26 . 2010-03-02 17:26 -------- d-----w- c:\programmi\File comuni\Adobe AIR
2010-02-28 19:52 . 2010-02-28 19:52 -------- d-----w- c:\documents and settings\6750\Dati applicazioni\freeTVRadio
2010-02-28 17:09 . 2010-03-18 17:46 -------- d-----w- c:\documents and settings\6750\Dati applicazioni\OfferBox
2010-02-22 19:10 . 2010-02-22 19:10 -------- d-----w- c:\documents and settings\6750\Dati applicazioni\Facebook
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-18 22:26 . 2009-04-16 22:37 -------- d-----w- c:\documents and settings\6750\Dati applicazioni\FileZilla
2010-03-18 17:52 . 2009-10-19 16:37 -------- d-----w- c:\programmi\File comuni\DVDVideoSoft
2010-03-18 17:48 . 2009-04-08 21:04 -------- d--h--w- c:\programmi\InstallShield Installation Information
2010-03-18 17:48 . 2009-04-08 21:10 3907616 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2010-03-18 17:45 . 2009-05-07 18:59 -------- d-----w- c:\programmi\RipTiger
2010-03-18 17:43 . 2009-12-30 12:50 -------- d-----w- c:\programmi\eBay
2010-03-18 17:10 . 2009-04-08 21:10 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Kaspersky Lab
2010-03-18 17:07 . 2009-04-08 21:10 107564 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2010-03-18 17:07 . 2009-04-08 21:10 29449760 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-03-18 17:07 . 2009-04-08 21:10 293960 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-03-18 16:48 . 2009-08-28 22:31 -------- d-----w- c:\programmi\PHPNukeIT
2010-03-17 21:15 . 2009-08-08 14:53 -------- d-----w- c:\programmi\FLVPlayer4Free
2010-03-17 17:56 . 2009-08-02 16:09 -------- d-----w- c:\programmi\Malwarebytes' Anti-Malware
2010-03-16 23:17 . 2009-05-10 19:38 -------- d-----w- c:\documents and settings\6750\Dati applicazioni\uTorrent
2010-03-16 23:02 . 2009-05-13 14:06 -------- d-----w- c:\programmi\Direct MIDI to MP3 Converter
2010-03-16 23:01 . 2009-04-08 22:21 -------- d-----w- c:\programmi\eMule
2010-03-16 23:00 . 2009-10-01 13:50 -------- d-----w- c:\programmi\e107 Theme Creator Beta
2010-03-16 23:00 . 2009-10-01 13:52 -------- d-----w- c:\programmi\e107 Tool
2010-03-16 23:00 . 2010-01-12 21:51 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\AppSoft
2010-03-11 16:40 . 2009-05-23 16:20 -------- d-----w- c:\documents and settings\6750\Dati applicazioni\muvee Technologies
2010-03-11 08:58 . 2009-04-16 15:11 79776 ----a-w- c:\documents and settings\6750\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2010-03-11 08:57 . 2009-05-23 14:58 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\muvee Technologies
2010-03-11 08:56 . 2009-05-23 14:59 -------- d-----w- c:\programmi\File comuni\muvee Technologies
2010-03-11 08:56 . 2009-11-16 15:53 79776 ----a-w- c:\documents and settings\LocalService\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2010-03-11 08:56 . 2009-05-23 14:59 -------- d-----w- c:\programmi\muvee Technologies
2010-03-11 08:12 . 2010-01-11 16:20 -------- d-----w- c:\programmi\File comuni\Nikon
2010-03-11 08:11 . 2010-01-11 16:18 20 ---h--w- c:\documents and settings\All Users\Dati applicazioni\PKP_DLbx.DAT
2010-03-10 20:57 . 2009-11-19 18:58 -------- d-----w- c:\documents and settings\6750\Dati applicazioni\Winamp
2010-03-10 20:56 . 2009-11-19 18:58 -------- d-----w- c:\programmi\Winamp
2010-03-10 19:10 . 2009-04-21 21:25 -------- d-----w- c:\documents and settings\6750\Dati applicazioni\DivX
2010-03-06 20:29 . 2010-01-11 16:34 20 ---h--w- c:\documents and settings\All Users\Dati applicazioni\PKP_DLdu.DAT
2010-03-04 07:36 . 2009-07-27 21:49 -------- d-----w- c:\programmi\Microsoft ActiveSync
2010-03-03 14:56 . 2009-10-29 09:27 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-03-03 14:56 . 2009-05-17 07:03 15880 ----a-w- c:\windows\system32\lsdelete.exe
2010-03-03 14:52 . 2009-05-16 13:44 -------- d-----w- c:\programmi\Lavasoft
2010-02-27 07:58 . 2009-04-21 21:13 -------- d-----w- c:\documents and settings\6750\Dati applicazioni\Any Video Converter
2010-02-25 18:41 . 2009-05-01 14:07 -------- d-----w- c:\programmi\FileZilla FTP Client
2010-02-24 08:48 . 2009-11-30 15:51 66 ----a-w- c:\documents and settings\6750\Dati applicazioni\isfree4_1.tmp
2010-02-18 07:37 . 2010-01-21 22:51 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\DVD Shrink
2010-02-16 21:28 . 2009-04-18 13:34 -------- d-----w- c:\documents and settings\6750\Dati applicazioni\U3
2010-02-16 21:23 . 2010-01-05 12:21 -------- d-----w- c:\programmi\CA VMN Anti-Spyware
2010-02-14 18:46 . 2009-04-08 20:45 -------- d-----w- c:\programmi\microsoft frontpage
2010-02-14 15:15 . 2009-04-08 21:27 -------- d-----w- c:\programmi\Notepad++
2010-02-14 15:15 . 2009-04-08 21:27 -------- d-----w- c:\documents and settings\6750\Dati applicazioni\Notepad++
2010-02-10 21:49 . 2010-02-10 21:49 -------- d-----w- c:\programmi\STEARsoft
2010-02-10 19:22 . 2009-12-16 19:29 798 ----a-w- c:\windows\unins000.dat
2010-02-10 10:12 . 2009-06-08 21:13 -------- d-----w- c:\programmi\MSECache
2010-02-07 23:02 . 2009-04-28 15:36 -------- d---a-w- c:\documents and settings\All Users\Dati applicazioni\TEMP
2010-02-06 08:30 . 2010-02-06 08:25 -------- d-----w- c:\programmi\Grammatica32SG
2010-02-06 08:25 . 2009-05-13 14:19 253952 ------w- c:\windows\Setup1.exe
2010-02-06 08:23 . 2010-02-06 08:22 -------- d-----w- c:\programmi\linguavox
2010-02-06 08:22 . 2009-04-21 22:10 74752 ------w- c:\windows\ST6UNST.EXE
2010-02-04 15:53 . 2009-05-16 13:47 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2010-02-03 14:47 . 2009-12-01 12:41 -------- d-----w- c:\documents and settings\6750\Dati applicazioni\QuickScan
2010-01-31 12:21 . 2010-01-31 12:10 -------- d-----w- c:\programmi\Esplorando 3 Matematica per le medie inferiori
2010-01-31 12:10 . 2010-01-31 12:10 -------- d-----w- c:\programmi\Finson Live Update
2010-01-28 22:21 . 2009-06-22 18:12 -------- d-----w- c:\programmi\Paltalk Messenger
2010-01-26 16:36 . 2010-01-26 16:34 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Cakewalk
2010-01-26 16:36 . 2010-01-26 16:34 -------- d-----w- c:\programmi\Cakewalk
2010-01-26 16:33 . 2010-01-26 16:33 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Ableton
2010-01-26 16:33 . 2010-01-26 16:33 -------- d-----w- c:\documents and settings\6750\Dati applicazioni\Ableton
2010-01-26 15:54 . 2010-01-26 15:54 -------- d-----w- c:\programmi\Ableton
2010-01-25 17:26 . 2010-01-25 17:26 -------- d-----w- c:\programmi\Oversoft
2010-01-24 22:27 . 2009-12-22 12:53 -------- d-----w- c:\documents and settings\6750\Dati applicazioni\ACAMPREF
2010-01-23 19:32 . 2010-01-23 19:30 -------- d-----w- c:\programmi\EMC
2010-01-22 19:49 . 2009-04-24 19:24 -------- d-----w- c:\programmi\CyberLink
2010-01-22 12:11 . 2009-12-30 12:50 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\eBay
2010-01-22 12:11 . 2009-12-30 12:50 -------- d-----w- c:\documents and settings\6750\Dati applicazioni\eBay
2010-01-21 22:51 . 2010-01-21 22:51 -------- d-----w- c:\programmi\DVD Shrink
2010-01-21 22:15 . 2010-01-21 22:15 -------- d-----w- c:\programmi\DVD Decrypter
2010-01-20 16:45 . 2009-04-30 15:49 -------- d-----w- c:\programmi\Microsoft Silverlight
2010-01-18 23:35 . 2010-01-18 23:34 -------- d-----w- c:\programmi\MagicDisc
2010-01-11 17:04 . 2010-01-11 17:00 20 ---h--w- c:\documents and settings\All Users\Dati applicazioni\PKP_DLdw.DAT
2010-01-11 16:25 . 2010-01-11 16:25 20 ---h--w- c:\documents and settings\All Users\Dati applicazioni\PKP_DLck.DAT
2010-01-07 15:07 . 2009-08-02 16:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 15:07 . 2009-08-02 16:09 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-06 17:33 . 2010-01-06 17:33 295424 ----a-w- c:\windows\system32\bwmedia1.dll
2010-01-06 17:33 . 2010-01-06 17:33 150016 ----a-w- c:\windows\system32\bwmedia.dll
2010-01-05 13:42 . 2001-08-31 12:00 80946 ----a-w- c:\windows\system32\perfc010.dat
2010-01-05 13:42 . 2001-08-31 12:00 481680 ----a-w- c:\windows\system32\perfh010.dat
2010-01-01 14:18 . 2010-01-01 14:18 44544 ------w- c:\windows\AWuninstall.exe
2009-12-31 16:50 . 2008-04-13 10:15 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-23 17:30 . 2010-01-26 15:57 368640 ----a-w- c:\windows\system32\ReWire.dll
2009-12-23 17:30 . 2010-01-26 15:57 233472 ----a-w- c:\windows\system32\REX Shared Library.dll
2009-12-22 16:05 . 2009-12-22 12:52 724 ----a-w- c:\windows\wacam.TMP
2009-12-22 12:52 . 2009-12-22 12:52 1409 ----a-w- c:\windows\Fonts\SToccata.fot
2009-12-21 19:06 . 2008-05-08 16:27 916480 ------w- c:\windows\system32\wininet.dll
2009-09-23 16:47 . 2009-09-23 16:47 28488 ----a-w- c:\programmi\mozilla firefox\plugins\atgpcdec.dll
2009-09-23 16:47 . 2009-09-23 16:47 185240 ----a-w- c:\programmi\mozilla firefox\plugins\atgpcext.dll
2009-09-23 16:50 . 2009-09-23 16:50 46408 ----a-w- c:\programmi\mozilla firefox\plugins\atmccli.dll
2009-09-23 16:47 . 2009-09-23 16:47 99224 ----a-w- c:\programmi\mozilla firefox\plugins\ieatgpc.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\programmi\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\programmi\mozilla firefox\plugins\ssldivx.dll
.
------- Sigcheck -------
[-] 2008-05-08 . 4ED067D8270174E777286A26FECDB3E8 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
(((((((((((((((((((((((((((((
SnapShot@2010-03-18_17.09.01 )))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-8287-79A187E26987}]
2007-09-24 14:26 2022912 ----a-w- c:\programmi\vmntoolbar\vmntoolbar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{A057A204-BACC-4D26-8287-79A187E26987}"= "c:\programmi\vmntoolbar\vmntoolbar.dll" [2007-09-24 2022912]
[HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-8287-79a187e26987}]
[HKEY_CLASSES_ROOT\vmntoolbar.VMNTOOLBAR]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{A057A204-BACC-4D26-8287-79A187E26987}"= "c:\programmi\vmntoolbar\vmntoolbar.dll" [2007-09-24 2022912]
[HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-8287-79a187e26987}]
[HKEY_CLASSES_ROOT\vmntoolbar.VMNTOOLBAR]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-04-20 162584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-04-20 138008]
"RTHDCPL"="RTHDCPL.EXE" [2007-04-10 16126464]
"NeroFilterCheck"="c:\programmi\File comuni\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"AVP"="c:\programmi\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-05-02 201992]
"Ad-Watch"="c:\programmi\Lavasoft\Ad-Aware\AAWTray.exe" [2010-03-18 818256]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-04-20 142104]
"MaxBlastMonitor.exe"="c:\programmi\Maxtor\MaxBlast\MaxBlastMonitor.exe" [2007-08-30 1190760]
"AcronisTimounterMonitor"="c:\programmi\Maxtor\MaxBlast\TimounterMonitor.exe" [2007-08-30 1966376]
"Acronis Scheduler2 Service"="c:\programmi\File comuni\Maxtor\Schedule2\schedhlp.exe" [2007-08-30 148760]
"UnlockerAssistant"="c:\programmi\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872]
"CAPON"="c:\windows\system32\Spool\Drivers\w32x86\3\CAPONN.EXE" [2000-04-20 22528]
"Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-14 39792]
"AdobeCS4ServiceManager"="c:\programmi\File comuni\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"SunJavaUpdateSched"="c:\programmi\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"Nikon Transfer Monitor"="c:\programmi\File comuni\Nikon\Monitor\NkMonitor.exe" [2009-05-29 479232]
"QuickTime Task"="c:\programmi\QuickTime\qttask.exe" [2009-11-10 417792]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
c:\documents and settings\6750\Menu Avvio\Programmi\Esecuzione automatica\
Collegamento a html2pop3.exe (2).lnk - c:\documents and settings\6750\Desktop\html2pop3232win32\html2pop3.exe [2009-4-8 111104]
FastFX Trader.lnk - c:\programmi\FastFX Trader\terminal.exe [2009-5-14 2765520]
ibfx42l.exe.lnk - c:\programmi\Interbank42\terminal.exe [2009-7-10 2765520]
c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Adobe Gamma Loader.lnk - c:\programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe [2009-4-25 113664]
Finestra di stato di Canon LBP-800.LNK - c:\windows\system32\spool\drivers\w32x86\3\CAPPSWK.EXE [2009-4-14 113664]
Microsoft Office.lnk - c:\programmi\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
PalTalk.lnk - c:\programmi\Paltalk Messenger\paltalk.exe [2009-12-23 11552768]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Advanced SystemCare 3]
2009-06-30 07:55 2329224 ----a-w- c:\programmi\IObit\Advanced SystemCare 3\AWC.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"QuickTime Task"="c:\programmi\QuickTime\QTTask.exe" -atboottime
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\livecall.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\IncrediMail\\bin\\IncMail.exe"=
"c:\\Programmi\\IncrediMail\\bin\\ImApp.exe"=
"c:\\Programmi\\IncrediMail\\bin\\ImpCnt.exe"=
"c:\\Programmi\\Skype\\Phone\\Skype.exe"=
"c:\\Programmi\\uTorrent\\uTorrent.exe"=
"c:\programmi\Microsoft ActiveSync\rapimgr.exe"= c:\programmi\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\programmi\Microsoft ActiveSync\wcescomm.exe"= c:\programmi\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\programmi\Microsoft ActiveSync\WCESMgr.exe"= c:\programmi\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Programmi\\Bonjour\\mDNSResponder.exe"=
"c:\\Programmi\\File comuni\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Programmi\\Opera\\opera.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"5353:TCP"= 5353:TCP:Adobe CSI CS4
R0 hotcore3;hc3ServiceName;c:\windows\system32\drivers\hotcore3.sys [14/04/2009 16.58.59 40464]
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 17.29.38 33808]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [16/05/2009 14.47.50 64288]
R0 PzWDM;PzWDM;c:\windows\system32\drivers\PzWDM.sys [23/05/2009 16.50.46 15172]
R2 Apache2.2;Apache2.2;c:\xampp\apache\bin\apache.exe [14/06/2008 18.02.12 17408]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\programmi\Lavasoft\Ad-Aware\AAWService.exe [04/02/2010 16.52.57 1263728]
R2 RapidPort;RapidPort;c:\windows\system32\drivers\CAPLPTN.SYS [20/10/2009 20.36.34 23008]
R3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\l151x86.sys [08/04/2009 22.06.14 39424]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [13/03/2008 18.02.46 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [13/12/2007 12.28.40 24592]
S2 FlexService;Remote Connections Service;c:\programmi\RapidBIT\cisvc.exe [17/05/2009 5.16.24 41984]
S2 gupdate;Google Update Service (gupdate);c:\programmi\Google\Update\GoogleUpdate.exe [15/03/2010 21.49.44 135664]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\programmi\MAGIX\Common\Database\bin\fbserver.exe [22/12/2009 12.17.45 1527900]
S3 JTVNCProxy_10.0;JTVNCProxy;c:\programmi\Freedom Scientific\JAWS\10.0\JTVNCProxy.exe [22/10/2008 23.22.00 17176]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [22/05/2008 0.57.38 34576]
.
Contenuto della cartella 'Scheduled Tasks'
2010-03-18 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\programmi\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-02-04 09:27]
2010-02-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programmi\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
2010-03-18 c:\windows\Tasks\GlaryInitialize.job
- c:\programmi\Glary Utilities\initialize.exe [2009-08-24 14:09]
2010-03-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2010-03-15 20:49]
2010-03-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2010-03-15 20:49]
2010-03-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1220945662-1580818891-1801674531-1003Core.job
- c:\documents and settings\6750\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe [2009-09-17 19:18]
2010-03-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1220945662-1580818891-1801674531-1003UA.job
- c:\documents and settings\6750\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe [2009-09-17 19:18]
2010-03-18 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 14:07]
2010-03-18 c:\windows\Tasks\User_Feed_Synchronization-{BEB02B75-5635-4488-9403-B5782412E6A5}.job
- c:\windows\system32\msfeedssync.exe [2001-08-31 03:31]
2010-03-18 c:\windows\Tasks\User_Feed_Synchronization-{F10321DB-C234-4692-8587-F00FC7DCB7DF}.job
- c:\windows\system32\msfeedssync.exe [2001-08-31 03:31]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.igoogle.it/
uInternet Connection Wizard,ShellNext = hxxp://www.incredimail.com/app/?tag=page_app_welcome&lang=16&version=5853823&setup_id=16000002&aff_id=1&addon=IncrediMail
IE: &BOM hinzufügen - c:\\PROGRA~1\\BID-O-~1\\\\AddToBOM.hta
IE: Aggiungi al banner Blocco pubblicità - c:\programmi\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
IE: Converti destinazione link in file PDF esistente - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Converti i link selezionati in Adobe PDF - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Converti i link selezionati in file PDF esistente - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Converti nel file PDF esistente - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Converti selezione in file PDF esistente - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Ricerca - c:\programmi\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
IE: Sothink SWF Catcher - c:\programmi\File comuni\SourceTec\SWF Catcher\InternetExplorer.htm
TCP: {6B4864BE-E218-4265-A013-AD9896B69D39} = 151.99.125.1,195.110.128.1
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
FF - ProfilePath - c:\documents and settings\6750\Dati applicazioni\Mozilla\Firefox\Profiles\n5stigdk.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=19&q=
FF - prefs.js: browser.search.selectedEngine - Fast Browser Search
FF - prefs.js: browser.startup.homepage -
www.igoogle.itFF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - component: c:\documents and settings\6750\Dati applicazioni\Mozilla\Firefox\Profiles\n5stigdk.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll
FF - component: c:\documents and settings\6750\Dati applicazioni\Mozilla\Firefox\Profiles\n5stigdk.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
FF - component: c:\programmi\Google\Google Gears\Firefox\lib\ff30\gears.dll
FF - plugin: c:\documents and settings\6750\Dati applicazioni\Facebook\npfbplugin_1_0_1.dll
FF - plugin: c:\documents and settings\6750\Dati applicazioni\Mozilla\Firefox\Profiles\n5stigdk.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - plugin: c:\programmi\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\programmi\Mozilla Firefox\plugins\npatgpc.dll
FF - plugin: c:\programmi\Mozilla Firefox\plugins\NPMyrMus.dll
FF - plugin: c:\programmi\Musicnotes\GuitarGuru\npmusicn.dll
FF - plugin: c:\programmi\Opera\program\plugins\NPMyrMus.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
FF - user.js: browser.cache.memory.capacity - 65536
FF - user.js: browser.chrome.favicons - fales
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: content.interrupt.parsing - true
FF - user.js: content.max.tokenizing.time - 2250000
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 750000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 750000
FF - user.js: network.http.max-connections - 48
FF - user.js: network.http.max-connections-per-server - 16
FF - user.js: network.http.max-persistent-connections-per-proxy - 16
FF - user.js: network.http.max-persistent-connections-per-server - 8
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.firstrequest - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 0
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
FF - user.js: browser.sessionstore.resume_from_crash - false
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2010-03-18 23:41
Windows 5.1.2600 Service Pack 3 NTFS
scansione processi nascosti ...
scansione entrate autostart nascoste ...
Scansione files nascosti ...
Scansione completata con successo
Files nascosti: 0
**************************************************************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
[HKEY_USERS\S-1-5-21-1220945662-1580818891-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{102C5F45-D234-D487-A882-766FD7355D49}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"ianflneajplhklenio"=hex:6b,61,62,6d,6b,63,6a,63,66,6c,67,66,69,63,6f,6c,6c,6a,
6c,67,6f,6e,00,00
"hadfenaiglhcjeil"=hex:6b,61,62,6d,6b,63,6a,63,66,6c,67,66,69,63,6f,6c,6c,6a,
6c,67,6f,6e,00,00
[HKEY_USERS\S-1-5-21-1220945662-1580818891-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{63E3B181-2029-37C0-710C-CE66C5C493BD}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"iaelehpfinbloojccn"=hex:69,61,6e,66,69,64,6d,61,64,64,6e,67,6e,6f,6c,6c,6e,6b,
00,00
"haofggdfllbikinc"=hex:69,61,61,67,66,66,64,61,66,63,6f,6a,69,62,62,65,69,65,
00,00
[HKEY_USERS\S-1-5-21-1220945662-1580818891-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{9D34DD8E-61DC-5D24-24D9-13E8ADFE847A}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"oagdkllabmgkpgonbfbihofbfnmigd"=hex:64,61,66,6e,69,70,67,6c,00,85
"oakelkmlkmekgkekmibnlbcljlhboe"=hex:6a,61,66,6e,68,70,65,6a,6b,66,64,6e,63,6d,
6f,6f,64,6f,68,68,00,0f
"naaenkdfhcecpchnebemhfogodll"=hex:6a,61,67,6e,6b,6a,68,63,64,61,69,62,63,6f,
65,6f,67,62,67,62,00,02
"oagdkllabmgkpgonbfbihofbimpgbn"=hex:64,61,66,6e,69,70,69,6c,00,85
"oakelkmlkmekgkekmibnlbclmlebnb"=hex:6a,61,67,6e,6b,6a,68,63,64,61,69,62,63,6f,
65,6f,67,62,67,62,00,02
"naaenkdfhcecpchnebemhfhikehh"=hex:69,61,6e,6d,6c,6b,6c,61,69,6c,6b,61,70,65,
68,6e,68,6f,00,ff
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{63E3B181-2029-37C0-710C-CE66C5C493BD}\InProcServer32*]
"jaclheihnhingopjeofa"=hex:69,61,6e,66,69,64,6d,61,64,64,6e,67,6e,6f,6c,6c,6e,
6b,00,00
"iaclneglbgmbgkfcif"=hex:69,61,61,67,66,66,64,61,66,63,6f,6a,69,62,62,65,69,65,
00,00
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•9~*]
"0140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
"0140210900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\WPAEvents]
@Denied: (Full) (LocalSystem)
"OOBETimer"=hex:ff,d5,71,d6,8b,6a,8d,6f,d5,33,93,fd
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------
- - - - - - - > 'winlogon.exe'(1024)
c:\windows\system32\klogon.dll
c:\programmi\File comuni\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
- - - - - - - > 'lsass.exe'(1444)
c:\windows\system32\relog_ap.dll
.
Ora fine scansione: 2010-03-18 23:48:06
ComboFix-quarantined-files.txt 2010-03-18 22:48
ComboFix2.txt 2010-03-18 17:19
Pre-Run: 76.438.581.248 byte disponibili
Post-Run: 76.396.384.256 byte disponibili
- - End Of File - - 78C491AA2787742B3001B302422EF317
