ComboFix 13-02-02.05 - xxx 02/02/2013 13.51.08.3.4 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.39.1040.18.2043.1382 [GMT 1:00]
Eseguito da: c:\documents and settings\xxx\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
FW: COMODO Firewall *Enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
.
.
((((((((((((((((((((((((( Files Creati Da 2013-01-02 al 2013-02-02 )))))))))))))))))))))))))))))))))))
.
.
2013-02-02 12:50 . 2013-01-08 04:57 6991832 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Microsoft\Microsoft Antimalware\Definition Updates\{8370BB8E-FFC8-49BF-912F-53BCAD0E9BAD}\mpengine.dll
2013-02-01 18:47 . 2013-02-01 18:47 -------- d-----w- c:\documents and settings\Administrator\Dati applicazioni\Malwarebytes
2013-02-01 12:24 . 2013-01-08 04:57 6991832 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-01-29 18:38 . 2013-01-29 18:38 -------- d-----w- c:\programmi\SafeNet Sentinel
2013-01-29 18:38 . 2013-01-29 18:38 -------- d-----w- c:\programmi\File comuni\SafeNet Sentinel
2013-01-29 18:32 . 2013-01-29 18:33 -------- d-----w- c:\programmi\ArtCAM Pro 9
2013-01-24 18:22 . 2013-01-24 18:22 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\PDF Architect
2013-01-11 21:38 . 2013-01-11 21:38 -------- d-----w- c:\programmi\Visual Color Picker 2
2013-01-11 13:32 . 2013-01-11 13:32 53248 ----a-r- c:\documents and settings\xxx\Dati applicazioni\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2013-01-11 13:32 . 2013-01-11 13:32 -------- d-----w- c:\documents and settings\xxx\Impostazioni locali\Dati applicazioni\Logishrd
2013-01-11 13:32 . 2013-01-11 13:32 16400 ----a-w- c:\windows\system32\drivers\LNonPnP.sys
2013-01-11 13:32 . 2013-01-11 13:32 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Logishrd
2013-01-11 13:13 . 2013-01-11 13:13 -------- d-----w- c:\documents and settings\xxx\Dati applicazioni\Logishrd
2013-01-11 12:44 . 2013-01-11 13:13 -------- d-----w- c:\documents and settings\xxx\Dati applicazioni\Logitech
2013-01-11 12:44 . 2013-01-11 12:44 -------- d-----w- c:\documents and settings\xxx\Dati applicazioni\Leadertech
2013-01-11 12:43 . 2012-09-18 09:32 12216 ----a-w- c:\windows\system32\drivers\LBeepKE.sys
2013-01-11 12:41 . 2013-01-11 13:32 -------- d-----w- c:\programmi\File comuni\Logishrd
2013-01-11 12:41 . 2013-01-11 13:32 -------- d-----w- c:\programmi\Logitech
2013-01-09 18:47 . 2013-01-09 18:47 -------- d-----w- c:\documents and settings\Default User\Impostazioni locali\Dati applicazioni\Microsoft Help
2013-01-09 14:53 . 2013-01-09 14:54 16369160 ----a-w- c:\windows\system32\FlashPlayerInstaller.exe
2013-01-05 20:51 . 2013-01-05 20:51 -------- d-----w- c:\documents and settings\xxx\Dati applicazioni\PDF Architect
2013-01-03 12:58 . 2013-01-03 12:58 -------- d-----w- c:\documents and settings\LocalService\Dati applicazioni\APP_NAME_NON_STRING
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-02-02 12:38 . 2010-12-12 13:50 17488 ----a-w- c:\windows\gdrv.sys
2013-01-30 10:53 . 2010-12-12 15:26 232336 ------w- c:\windows\system32\MpSigStub.exe
2013-01-09 14:54 . 2012-04-26 11:36 697864 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-01-09 14:54 . 2011-06-02 19:14 74248 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-12-16 12:23 . 2006-03-02 12:00 290560 ----a-w- c:\windows\system32\atmfd.dll
2012-12-14 15:49 . 2010-12-12 15:32 21104 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-11-22 20:26 . 2012-11-22 20:26 388096 ----a-r- c:\documents and settings\xxx\Dati applicazioni\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2012-11-13 11:55 . 2006-03-02 12:00 1866368 ----a-w- c:\windows\system32\win32k.sys
2012-11-07 23:38 . 2011-10-07 17:48 99080 ----a-w- c:\windows\system32\drivers\inspect.sys
2012-11-07 23:38 . 2011-10-07 17:48 32640 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2012-11-07 23:38 . 2011-10-07 17:48 497952 ----a-w- c:\windows\system32\drivers\cmdGuard.sys
2012-11-07 23:38 . 2011-10-07 17:48 18096 ----a-w- c:\windows\system32\drivers\cmderd.sys
2012-11-07 23:37 . 2011-10-07 17:47 34024 ----a-w- c:\windows\system32\cmdcsr.dll
2012-11-07 23:37 . 2011-10-07 17:47 301264 ----a-w- c:\windows\system32\guard32.dll
2012-11-06 02:01 . 2009-08-19 16:07 1371648 ------w- c:\windows\system32\msxml6.dll
2013-01-19 14:31 . 2013-01-19 14:30 262552 ----a-w- c:\programmi\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BCU"="c:\programmi\DeviceVM\Browser Configuration Utility\BCU.exe" [2009-10-15 375000]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2010-01-19 43632]
"36X Raid Configurer"="c:\windows\system32\xRaidSetup.exe" [2010-01-19 1976944]
"RTHDCPL"="RTHDCPL.EXE" [2010-03-26 19522592]
"NUSB3MON"="c:\program files\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2009-10-21 106496]
"ISUSPM Startup"="c:\progra~1\FILECO~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-17 221184]
"ISUSScheduler"="c:\programmi\File comuni\InstallShield\UpdateService\issch.exe" [2005-02-17 81920]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-07-29 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-07-29 13923432]
"SSBkgdUpdate"="c:\programmi\File comuni\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"WrtMon.exe"="c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe" [2006-09-20 20480]
"COMODO Internet Security"="c:\programmi\COMODO\COMODO Internet Security\cfp.exe" [2012-11-07 6756048]
"MSC"="c:\programmi\Microsoft Security Client\msseces.exe" [2012-09-12 947176]
"SunJavaUpdateSched"="c:\programmi\File comuni\Java\Java Update\jusched.exe" [2012-09-17 254896]
"EvtMgr6"="c:\programmi\Logitech\SetPointP\SetPoint.exe" [2012-11-04 1851192]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\FILECO~1\MICROS~1\DW\dwtrig20.exe" [2011-07-27 434080]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2012-10-01 07:22 66360 ----a-w- c:\programmi\File comuni\Logishrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\guard32.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^Tasto di scelta rapida per l'avvio di AutoCAD.lnk]
path=c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\Tasto di scelta rapida per l'avvio di AutoCAD.lnk
backup=c:\windows\pss\Tasto di scelta rapida per l'avvio di AutoCAD.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^xxx^Menu Avvio^Programmi^Esecuzione automatica^Logitech . Registrazione prodotti.lnk]
path=c:\documents and settings\xxx\Menu Avvio\Programmi\Esecuzione automatica\Logitech . Registrazione prodotti.lnk
backup=c:\windows\pss\Logitech . Registrazione prodotti.lnkStartup
.
[HKLM\~\startupfolder\C:^Documents and Settings^xxx^Menu Avvio^Programmi^Esecuzione automatica^Ritaglio schermata e avvio di OneNote 2007.lnk]
path=c:\documents and settings\xxx\Menu Avvio\Programmi\Esecuzione automatica\Ritaglio schermata e avvio di OneNote 2007.lnk
backup=c:\windows\pss\Ritaglio schermata e avvio di OneNote 2007.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Borra Disinstallazione di Patrician III - Impero dei Mari]
command [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
c:\programmi\File comuni\Nokia\MPlatform\NokiaMServer [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
2008-08-14 06:58 611712 ----a-w- c:\programmi\File comuni\Adobe\CS4ServiceManager\CS4ServiceManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2011-04-20 10:48 58656 ----a-w- c:\programmi\File comuni\Apple\Mobile Device Support\AppleSyncNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
2012-10-11 20:56 59280 ----a-w- c:\programmi\File comuni\Apple\Apple Application Support\APSDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2007-04-03 16:50 1603152 ----a-w- c:\programmi\Canon\MyPrinter\BJMYPRT.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenu]
2007-05-14 16:01 644696 ----a-w- c:\programmi\Canon\SolutionMenu\CNSLMAIN.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2012-01-24 13:19 3478336 ----a-w- c:\programmi\DAEMON Tools Lite\DTLite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyTuneVI]
2007-07-26 14:05 20480 ----a-w- c:\programmi\Gigabyte\ET6\ETcall.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2009-02-26 17:36 30040 ----a-w- c:\programmi\Microsoft Office\Office12\GrooveMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE4]
2007-02-04 11:02 79400 ----a-w- c:\programmi\ScanSoft\OmniPageSE4\OpWareSE4.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2012-10-25 02:12 421888 ----a-w- c:\programmi\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 15:07 2260480 --sha-r- c:\programmi\Spybot - Search & Destroy\TeaTimer.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TBPanel]
2010-07-30 14:11 2158592 ----a-w- c:\programmi\Vtune\TBPANEL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ulead Memory Card Detector]
2002-09-11 10:36 40960 ------w- c:\programmi\Ulead Systems\Ulead Photo Explorer 7.0\Monitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WTClient]
2009-08-19 16:24 32768 ----a-w- c:\windows\system32\WTClient.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmi\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Programmi\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Programmi\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Programmi\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx9.exe"=
"c:\\Programmi\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx10.exe"=
"c:\\Programmi\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Launcher.exe"=
"c:\\Programmi\\File comuni\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Programmi\\eMule\\emule.exe"=
"c:\\Programmi\\Skype\\Phone\\Skype.exe"=
"c:\\Programmi\\File comuni\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4
.
R1 AppleCharger;AppleCharger;c:\windows\system32\drivers\AppleCharger.sys [12/12/2010 14.20.28 19496]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [07/10/2011 18.48.02 497952]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [07/10/2011 18.48.02 32640]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [02/02/2012 17.16.17 242240]
R2 BCUService;Browser Configuration Utility Service;c:\programmi\DeviceVM\Browser Configuration Utility\BCUService.exe [15/10/2009 14.06.46 223464]
R2 DES2 Service;DES2 Service for Energy Saving.;c:\programmi\Gigabyte\EnergySaver2\des2svr.exe [12/12/2010 14.22.31 68136]
R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [11/01/2013 13.43.00 12216]
R2 PDF Architect Helper Service;PDF Architect Helper Service;c:\programmi\PDF Architect\HelperService.exe [22/11/2012 16.58.14 1522312]
R2 PDF Architect Service;PDF Architect Service;c:\programmi\PDF Architect\ConversionService.exe [22/11/2012 16.56.10 905864]
R2 Smart TimeLock;Smart TimeLock Service;c:\programmi\Gigabyte\smart6\timelock\TimeMgmtDaemon.exe [12/12/2010 14.22.18 114688]
R3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys [26/10/2009 16.19.00 58240]
R3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys [26/10/2009 16.19.02 136704]
R3 PAC207;CamMaestro 3.01 DU PC Camera;c:\windows\system32\drivers\PFC027.sys [27/05/2005 14.57.16 162304]
R3 PTSimBus;PenTablet Bus Enumerator;c:\windows\system32\drivers\PTSimBus.sys [22/06/2009 8.58.06 23208]
S1 hqbyftfx;hqbyftfx;\??\c:\windows\system32\drivers\hqbyftfx.sys --> c:\windows\system32\drivers\hqbyftfx.sys [?]
S2 Skype C2C Service;Skype C2C Service;c:\documents and settings\All Users\Dati applicazioni\Skype\Toolbars\Skype C2C Service\c2c_service.exe [22/11/2012 10.29.16 3290304]
S2 SkypeUpdate;Skype Updater;c:\programmi\Skype\Updater\Updater.exe [13/07/2012 12.28.36 160944]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [12/12/2010 14.18.35 1691480]
S3 AppleChargerSrv;AppleChargerSrv;system32\AppleChargerSrv.exe --> system32\AppleChargerSrv.exe [?]
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\drivers\ssudbus.sys [13/10/2012 14.48.17 83168]
S3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys --> c:\windows\system32\drivers\dgderdrv.sys [?]
S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [27/11/2011 18.14.16 13192]
S3 etdrv;etdrv;c:\windows\etdrv.sys [12/12/2010 20.33.31 17488]
S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [27/11/2011 18.14.16 8456]
S3 GVTDrv;GVTDrv;c:\windows\system32\drivers\GVTDrv.sys [12/12/2010 14.32.23 24944]
S3 PTSimHid;PenTablet Simulated HID MiniDriver;c:\windows\system32\drivers\PTSimHid.sys [22/06/2009 8.58.22 14504]
S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\drivers\ssudmdm.sys [13/10/2012 14.48.18 181344]
.
Contenuto della cartella 'Scheduled Tasks'
.
2013-02-01 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-26 14:54]
.
2013-01-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programmi\Apple Software Update\SoftwareUpdate.exe [2011-06-01 15:57]
.
2013-02-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2011-09-03 17:25]
.
2013-02-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2011-09-03 17:25]
.
2013-02-02 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job
- c:\programmi\Microsoft Security Client\MpCmdRun.exe [2012-09-12 15:25]
.
.
------- Scansione supplementare -------
.
uInternet Connection Wizard,ShellNext = iexplore
uSearchAssistant = hxxp://www.google.com
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: Interfaces\{2C4AC896-742F-4F00-B559-45AADEFECBB8}: NameServer = 176.31.229.24,176.31.229.25
TCP: Interfaces\{67C116CB-2838-4462-9C39-930FA8318284}: NameServer = 176.31.229.24,176.31.229.25
FF - ProfilePath - c:\documents and settings\xxx\Dati applicazioni\Mozilla\Firefox\Profiles\vbmyablv.default\
FF - prefs.js: browser.startup.homepage - chrome://speeddial/content/speeddial.xul
FF - prefs.js: keyword.URL - hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:7317400059&cof=FORID:11&sa=Search&siteurl=search.linkury.com&q=
FF - ExtSQL: 2012-12-24 16:05;
FFPDFArchitectConverter@pdfarchitect.com; c:\programmi\PDF Architect\FFPDFArchitectExt
.
.
------- Associazioni dei file -------
.
.scr=AutoCADScriptFile
.
- - - - CHIAVI ORFANE RIMOSSE - - - -
.
MSConfigStartUp-KiesAirMessage - c:\programmi\Samsung\Kies\KiesAirMessage.exe
MSConfigStartUp-KiesPDLR - c:\programmi\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
MSConfigStartUp-KiesPreload - c:\programmi\Samsung\Kies\Kies.exe
MSConfigStartUp-KiesTrayAgent - c:\programmi\Samsung\Kies\KiesTrayAgent.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2013-02-02 13:55
Windows 5.1.2600 Service Pack 3 NTFS
.
detected NTDLL code modification:
ZwClose
.
scansione processi nascosti ...
.
scansione entrate autostart nascoste ...
.
Scansione files nascosti ...
.
Scansione completata con successo
Files nascosti: 0
.
**************************************************************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_146_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_146_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------
.
- - - - - - - > 'winlogon.exe'(676)
c:\windows\system32\guard32.dll
c:\programmi\file comuni\logishrd\bluetooth\LBTWlgn.dll
c:\programmi\File comuni\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
- - - - - - - > 'lsass.exe'(732)
c:\windows\system32\guard32.dll
.
- - - - - - - > 'explorer.exe'(2580)
c:\windows\system32\WININET.dll
c:\windows\system32\guard32.dll
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
- - - - - - - > 'csrss.exe'(648)
c:\windows\system32\cmdcsr.dll
.
Ora fine scansione: 2013-02-02 13:56:47
ComboFix-quarantined-files.txt 2013-02-02 12:56
ComboFix2.txt 2012-11-24 11:35
.
Pre-Run: 32.385.417.216 byte disponibili
Post-Run: 32.390.823.936 byte disponibili
.
- - End Of File - - 988EC453DD4C2CCCCD2BEF6DBF159E2E
