ho fatto una scansione con COMBOFIX....
ecco il log....!!!
FATEMI SAPERE QUALCOSA...grazie mille...!!!
ComboFix 11-05-29.01 - sergio 30/05/2011 10.35.03.6.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.39.1040.18.511.136 [GMT 2:00]
Eseguito da: c:\documents and settings\sergio\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Outdated* {00000000-0000-0015-0000-000000000000}
AV: AntiVir Desktop *Enabled/Updated* {00000002-0002-0000-7C25-9E7C08000A00}
.
ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Default User\WINDOWS
c:\documents and settings\sergio\WINDOWS
C:\DSC01168.JPG
C:\DSC01170.JPG
C:\DSC01173.JPG
c:\windows\system32\config\systemprofile\WINDOWS
.
.
((((((((((((((((((((((((( Files Creati Da 2011-04-28 al 2011-05-30 )))))))))))))))))))))))))))))))))))
.
.
2011-05-29 19:16 . 2011-05-30 08:34 -------- d-----w- c:\windows\system32\CatRoot2
2011-05-27 15:36 . 2011-05-27 15:13 441344 ----a-w- c:\programmi\cleanup.exe
2011-05-27 15:05 . 2011-05-27 15:05 1852 ----a-w- c:\programmi\cc_20110527_170500.reg
2011-05-26 14:17 . 2011-05-26 14:17 -------- d-----w- c:\documents and settings\sergio\Impostazioni locali\Dati applicazioni\Western Digital
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-14 10:16 . 2011-04-14 10:16 17748242 ----a-w- c:\programmi\solarc-3-setup.exe
2011-03-10 11:00 . 2006-07-11 16:35 348160 ----a-w- c:\windows\system32\msvcr71.dll
2011-03-07 05:33 . 2004-06-07 12:19 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-03-04 06:36 . 2002-10-01 17:08 420864 ----a-w- c:\windows\system32\vbscript.dll
2011-03-03 13:53 . 2002-10-01 17:08 1857920 ----a-w- c:\windows\system32\win32k.sys
2011-02-11 17:26 . 2011-02-11 17:25 129030 ----a-w- c:\programmi\cc_20110211_182536.reg
2010-09-16 17:07 . 2010-09-16 16:53 153061304 ----a-w- c:\programmi\OOo_3.2.1_Win_x86_install-wJRE_it.exe
2009-04-15 09:25 . 2009-04-15 09:24 5801368 ----a-w- c:\programmi\ps2pdf995.exe
2008-12-05 17:41 . 2008-12-05 17:38 128992670 ----a-w- c:\programmi\rh40eval_it_20080827.exe
2008-07-04 15:57 . 2008-07-04 15:56 7726360 ----a-w- c:\programmi\Google_Earth_CZXV.exe
2006-12-30 14:32 . 2006-12-30 14:32 3124686 -c--a-w- c:\programmi\arrip20.exe
2006-12-30 14:08 . 2006-12-30 14:08 36808256 ----a-w- c:\programmi\iTunesSetup.exe
2006-03-14 22:50 . 2006-03-14 22:50 758296 ----a-w- c:\programmi\CMWsetup.exe
2006-03-12 15:03 . 2006-03-12 15:03 3957216 ----a-w- c:\programmi\MSASYNC.EXE
2005-05-06 03:20 . 2006-10-13 19:47 6410240 ----a-w- c:\programmi\virtualdj.exe
2004-11-30 20:28 . 2004-11-30 20:28 2423682 ----a-w- c:\programmi\DivX_Total_Pack2.0.exe
.
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-01 68856]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-05-15 339968]
"SoundMan"="SOUNDMAN.EXE" [2004-06-18 67584]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"SunJavaUpdateSched"="c:\programmi\File comuni\Java\Java Update\jusched.exe" [2010-02-18 248040]
"TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2011-03-10 273544]
"QuickTime Task"="c:\programmi\QuickTime\QTTask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\programmi\iTunes\iTunesHelper.exe" [2011-03-07 421160]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^sergio^Menu Avvio^Programmi^Esecuzione automatica^OpenOffice.org 3.2.lnk]
path=c:\documents and settings\sergio\Menu Avvio\Programmi\Esecuzione automatica\OpenOffice.org 3.2.lnk
backup=c:\windows\pss\OpenOffice.org 3.2.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
c:\programmi\File comuni\Nokia\MPlatform\NokiaMServer [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\Microsoft ActiveSync\\wcescomm.exe"=
"c:\\Programmi\\Microsoft ActiveSync\\WCESMgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmi\\Autodesk\\3dsMax8\\3dsmax.exe"=
"c:\\Programmi\\Autodesk\\backburner\\monitor.exe"=
"c:\\Programmi\\Autodesk\\backburner\\manager.exe"=
"c:\\Programmi\\Autodesk\\backburner\\server.exe"=
"c:\\Programmi\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\Programmi\\File comuni\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Programmi\\skype\\Phone\\Skype.exe"=
"c:\\Programmi\\Nokia\\Nokia Ovi Suite\\NokiaOviSuite.exe"=
"c:\\Programmi\\iTunes\\iTunes.exe"=
.
R2 cpwnt;cpwnt;c:\windows\system32\drivers\Cpwnt.sys [17/11/2004 16.01.43 21824]
R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [09/10/2007 14.13.00 38144]
R3 CONAN;CONAN;c:\windows\system32\drivers\o2mmb.sys [08/10/2004 11.31.25 190465]
R3 MbxStby;MbxStby;c:\windows\system32\drivers\MbxStby.sys [08/10/2004 11.31.25 5817]
R3 PRISM_A00;PRISM 802.11 Driver;c:\windows\system32\drivers\PRISMA00.sys [08/10/2004 11.34.04 388448]
S2 gupdate;Servizio di Google Update (gupdate);c:\programmi\Google\Update\GoogleUpdate.exe [03/02/2010 20.35.41 135664]
S2 KeyP;KeyP;c:\windows\system32\DRIVERS\KeyP.sys --> c:\windows\system32\DRIVERS\KeyP.sys [?]
S3 CnxEtP;Conexant AccessRunner USB ADSL WAN Adapter Filter Driver;c:\windows\system32\drivers\CnxEtP.sys [25/12/2008 16.13.15 60288]
S3 CnxEtU;Conexant AccessRunner USB ADSL Interface Device Driver;c:\windows\system32\drivers\CnxEtU.sys [25/12/2008 16.13.15 646784]
S3 CnxTgN;Conexant AccessRunner USB ADSL WAN Adapter Driver;c:\windows\system32\drivers\CnxTgN.sys [25/12/2008 16.13.14 108675]
S3 gupdatem;Servizio Google Update (gupdatem);c:\programmi\Google\Update\GoogleUpdate.exe [03/02/2010 20.35.41 135664]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [04/08/2010 12.42.47 137344]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [04/08/2010 12.42.48 8320]
S3 RTL8187B;NETGEAR WG111v3 54Mbps Wireless USB 2.0 Adapter Vista Driver;c:\windows\system32\drivers\wg111v3.sys [28/12/2007 16.02.12 287232]
.
Contenuto della cartella 'Scheduled Tasks'
.
2011-04-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programmi\Apple Software Update\SoftwareUpdate.exe [2009-10-22 09:50]
.
2011-05-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2010-02-03 18:35]
.
2011-05-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2010-02-03 18:35]
.
2011-05-30 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-3116029348-4207113801-411729504-1007.job
- c:\programmi\Real\RealUpgrade\realupgrade.exe [2011-01-24 13:25]
.
2011-05-30 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-3116029348-4207113801-411729504-1007.job
- c:\programmi\Real\RealUpgrade\realupgrade.exe [2011-01-24 13:25]
.
.
------- Scansione supplementare -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Google Search - c:\programmi\Google\GoogleToolbar1.dll/cmsearch.html
IE: Backward &Links - c:\programmi\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cac&hed Snapshot of Page - c:\programmi\Google\GoogleToolbar1.dll/cmcache.html
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
IE: Si&milar Pages - c:\programmi\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate into English - c:\programmi\Google\GoogleToolbar1.dll/cmtrans.html
TCP: Interfaces\{4132FEEA-2767-4033-B1F7-2FCB06C63BF0}: NameServer = 151.99.125.1
.
.
------- Associazioni dei file -------
.
.scr=AutoCADScriptFile
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2011-05-30 10:43
Windows 5.1.2600 Service Pack 3 NTFS
.
scansione processi nascosti ...
.
scansione entrate autostart nascoste ...
.
Scansione files nascosti ...
.
Scansione completata con successo
Files nascosti: 0
.
**************************************************************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
.
[HKEY_USERS\S-1-5-21-3116029348-4207113801-411729504-1007\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fpx\OpenWithProgids]
@DACL=(02 0000)
@SACL=
"Microsoft.Picture.It.Document.9"=hex(0):
.
[HKEY_USERS\S-1-5-21-3116029348-4207113801-411729504-1007\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mix\OpenWithProgids]
@DACL=(02 0000)
@SACL=
"Microsoft.Picture.It.Document.9"=hex(0):
"mix"=hex(0):
.
[HKEY_USERS\S-1-5-21-3116029348-4207113801-411729504-1007\Software\Microsoft\Windows\CurrentVersion\Explorer\Streams\Desktop]
@DACL=(02 0000)
@SACL=
"Toolbars"=hex:11,00,00,00,00,00,00,00
"TaskbarWinXP"=hex:0c,00,00,00,08,00,00,00,03,00,00,00,00,00,00,00,b0,e2,2b,d8,
64,57,d0,11,a9,6e,00,c0,4f,d7,05,a2,22,00,1c,00,0a,11,00,00,1a,00,00,00,01,\
"Upgrade"=dword:00000001
.
[HKEY_USERS\S-1-5-21-3116029348-4207113801-411729504-1007\Software\Microsoft\Works Suite\2004]
@DACL=(02 0000)
@SACL=
.
[HKEY_LOCAL_MACHINE\software\Classes\TypeLib\{57A0E746-3863-4D20-A811-950C84F1DB9B}\1.0]
@DACL=(02 0000)
@SACL=
@="FlashAccessibility"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\DependentComponents]
@DACL=(02 0000)
@SACL=
"AvRack"="AvRack"
"PowerDVD"="PowerDVD"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•9~*]
"0140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="DirectX"
"ComponentGUID"="{44BBA855-CC51-11CF-AAFA-00AA00B6015C}"
"Version"=dword:00040009
"Sub-Version"=dword:00000386
"ExceptionInfName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\\dxxp.inf"
"ExceptionCatalogName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\\dxxp.cat"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{AA936DF4-2B08-4B1F-B071-72192E287704}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="DirectX BDA"
"ComponentGUID"="{AA936DF4-2B08-4B1F-B071-72192E287704}"
"Version"=dword:00040009
"Sub-Version"=dword:00000386
"ExceptionInfName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{AA936DF4-2B08-4B1F-B071-72192E287704}\\dxbda.inf"
"ExceptionCatalogName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{AA936DF4-2B08-4B1F-B071-72192E287704}\\dx9bda.cat"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\OptionalComponents\SwDir]
@DACL=(02 0000)
@SACL=
"Installed"="1"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\OptionalComponents\SwFlash]
@DACL=(02 0000)
@SACL=
"Installed"="1"
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------
.
- - - - - - - > 'winlogon.exe'(780)
c:\windows\system32\Ati2evxx.dll
.
Ora fine scansione: 2011-05-30 10:48:52
ComboFix-quarantined-files.txt 2011-05-30 08:48
ComboFix2.txt 2010-08-22 22:52
.
Pre-Run: 17.679.552.512 byte disponibili
Post-Run: 17.685.483.520 byte disponibili
.
- - End Of File - - AE4B33EB20ABB399232789BB6A045610
