Esegui 
![[:)]](http://www.megalab.it/forum/images/smilies/smile.gif "Smile")
Arrivo subito al dunque..
Premetto di navigare con il browser Opera (con le estensioni WOT e opera adblock) e da parecchi giorni, quando faccio ricerche su google, appena clicco sul link del risultato molto spesso vengo reinderizzato al seguente sito: http://www.twseoencrk.com/?search=hijackers&n=1339791258 (ovviamente dopo search c'è il termine che io cercavo su google).. tutto questo succede a random e quando capito in quel sito c'è solamente una pagina bianca che non viene nemmeno segnalata da WOT.. Inoltre a volte non vengo reinderizzato solo in quel sito ma anche in altri due o tre, i quali non sono a loro volta segnalati da wot.
Ecco le cose che ho già provato a fare, premettendo che come antivirus attivi ho Avira premium e Malwarebytes.
-Scansione con Hijackthis (vi posto il log)
-scansione completa con Avira (non ho trovato niente)
-scansione completa con Malwarebytes (non ho trovato niente)
-scansione con Kaspersky rescue cd 10 (trovato niente)
-scansione con combofix in modalità normale (Vi posto il log)
Per il resto il pc funziona ababstanza bene anche se è un po' vecchiotto... però ho notato un notevole rallentamento quando guardo dei video su youtube o qualsiasi filmato o flusso audio in streaming.. aprendo il taskmanager noto che il processo di opera occupa praticamente il 100% della cpu e infatti se provo a fare dell'altro all'interno di opera, l'audio si sente a scatti... eppure settimana scorsa filava tutto liscio...
Ah e dimenticavo.. sono reduce dal rootkit zero access che mi aveva beccato circa un mese fa, ma che grazie a combofix e a TDSSKiller sono riuscito a cancellare.. che siano rimaste tracce??
Per il momento vi ringrazio moltissimo per tutte le news e il lavoro che fate.. e speriamo di risolvere sto fastidioso problema...
ecco i log:
Hijackthis:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22.24.37, on 15/06/2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Programmi\USB Safely Remove\USBSRService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Sandboxie\SbieSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Avira\AntiVir Desktop\avguard.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Programmi\Bonjour\mDNSResponder.exe
C:\Programmi\LogMeIn Hamachi\hamachi-2.exe
C:\Programmi\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe
C:\Programmi\Malwarebytes' Anti-Malware\mbamservice.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\TomTom HOME 2\TomTomHOMEService.exe
C:\Programmi\File comuni\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Programmi\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Programmi\LogMeIn Hamachi\hamachi-2-ui.exe
C:\Programmi\File comuni\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Programmi\Avira\AntiVir Desktop\avshadow.exe
C:\Programmi\Avira\AntiVir Desktop\avmailc.exe
C:\Programmi\Avira\AntiVir Desktop\AVWEBGRD.EXE
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Programmi\Unlocker\UnlockerAssistant.exe
C:\Programmi\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Programmi\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Programmi\UsbBoost\TurboHddUsb.exe
C:\Programmi\Avira\AntiVir Desktop\avgnt.exe
C:\Documents and Settings\Tommy\Desktop\Utilità\desktop ok\DesktopOK.exe
C:\Programmi\LClock\lclock.exe
C:\Programmi\RocketDock\RocketDock.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\USB Safely Remove\USBSafelyRemove.exe
C:\Programmi\Phlox\Phlox.exe
C:\Programmi\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Documents and Settings\Tommy\Dati applicazioni\IMVUClient\IMVUQualityAgent.exe
C:\Documents and Settings\Tommy\Dati applicazioni\IMVUClient\IMVUClient.exe
C:\Programmi\Opera\opera.exe
C:\Documents and Settings\Tommy\Desktop\rootkit\RootkitRevealer.exe
C:\DOCUME~1\Tommy\IMPOST~1\Temp\YJVUZMS.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Tommy\Desktop\Utilità\HiJackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~4\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmi\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Programmi\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Programmi\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Programmi\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Programmi\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [UsbBoost] C:\Programmi\UsbBoost\TurboHddUsb.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programmi\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [DesktopOK] "C:\Documents and Settings\Tommy\Desktop\Utilità\desktop ok\DesktopOK.exe" -bg -startup
O4 - HKCU\..\Run: [LClock] C:\Programmi\LClock\lclock.exe
O4 - HKCU\..\Run: [RocketDock] "C:\Programmi\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Programmi\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [USB Safely Remove] C:\Programmi\USB Safely Remove\USBSafelyRemove.exe /startup
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Phlox.lnk = C:\Programmi\Phlox\Phlox.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office14\EXCEL.EXE/3000
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 4428136265
O17 - HKLM\System\CCS\Services\Tcpip\..\{332E1582-1B3A-4AD7-96DF-9E3A6864747A}: NameServer = 8.8.8.8,8.8.4.4
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programmi\File comuni\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Avira Mail Protection (AntiVirMailService) - Avira Operations GmbH & Co. KG - C:\Programmi\Avira\AntiVir Desktop\avmailc.exe
O23 - Service: Avira Scheduler (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Programmi\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira Realtime Protection (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Programmi\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Avira Web Protection (AntiVirWebService) - Avira Operations GmbH & Co. KG - C:\Programmi\Avira\AntiVir Desktop\AVWEBGRD.EXE
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Servizio Bonjour (Bonjour Service) - Apple Inc. - C:\Programmi\Bonjour\mDNSResponder.exe
O23 - Service: LogMeIn Hamachi Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Programmi\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Programmi\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Programmi\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Programmi\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programmi\File comuni\Ahead\Lib\NMIndexingService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Sandboxie Service (SbieSvc) - SANDBOXIE L.T.D - C:\Programmi\Sandboxie\SbieSvc.exe
O23 - Service: ServiceLayer - Nokia - C:\Programmi\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Programmi\Skype\Updater\Updater.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Programmi\File comuni\Steam\SteamService.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Programmi\TomTom HOME 2\TomTomHOMEService.exe
O23 - Service: USB Safely Remove Assistant (USBSafelyRemoveService) - Unknown owner - C:\Programmi\USB Safely Remove\USBSRService.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Programmi\Yahoo!\SoftwareUpdate\YahooAUService.exe
O23 - Service: YJVUZMS - Sysinternals - www.sysinternals.com - C:\DOCUME~1\Tommy\IMPOST~1\Temp\YJVUZMS.exe
--
End of file - 8855 bytes
Scan saved at 22.24.37, on 15/06/2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Programmi\USB Safely Remove\USBSRService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Sandboxie\SbieSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Avira\AntiVir Desktop\avguard.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Programmi\Bonjour\mDNSResponder.exe
C:\Programmi\LogMeIn Hamachi\hamachi-2.exe
C:\Programmi\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe
C:\Programmi\Malwarebytes' Anti-Malware\mbamservice.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\TomTom HOME 2\TomTomHOMEService.exe
C:\Programmi\File comuni\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Programmi\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Programmi\LogMeIn Hamachi\hamachi-2-ui.exe
C:\Programmi\File comuni\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Programmi\Avira\AntiVir Desktop\avshadow.exe
C:\Programmi\Avira\AntiVir Desktop\avmailc.exe
C:\Programmi\Avira\AntiVir Desktop\AVWEBGRD.EXE
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Programmi\Unlocker\UnlockerAssistant.exe
C:\Programmi\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Programmi\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Programmi\UsbBoost\TurboHddUsb.exe
C:\Programmi\Avira\AntiVir Desktop\avgnt.exe
C:\Documents and Settings\Tommy\Desktop\Utilità\desktop ok\DesktopOK.exe
C:\Programmi\LClock\lclock.exe
C:\Programmi\RocketDock\RocketDock.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\USB Safely Remove\USBSafelyRemove.exe
C:\Programmi\Phlox\Phlox.exe
C:\Programmi\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Documents and Settings\Tommy\Dati applicazioni\IMVUClient\IMVUQualityAgent.exe
C:\Documents and Settings\Tommy\Dati applicazioni\IMVUClient\IMVUClient.exe
C:\Programmi\Opera\opera.exe
C:\Documents and Settings\Tommy\Desktop\rootkit\RootkitRevealer.exe
C:\DOCUME~1\Tommy\IMPOST~1\Temp\YJVUZMS.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Tommy\Desktop\Utilità\HiJackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~4\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmi\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Programmi\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Programmi\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Programmi\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Programmi\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [UsbBoost] C:\Programmi\UsbBoost\TurboHddUsb.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programmi\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [DesktopOK] "C:\Documents and Settings\Tommy\Desktop\Utilità\desktop ok\DesktopOK.exe" -bg -startup
O4 - HKCU\..\Run: [LClock] C:\Programmi\LClock\lclock.exe
O4 - HKCU\..\Run: [RocketDock] "C:\Programmi\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Programmi\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [USB Safely Remove] C:\Programmi\USB Safely Remove\USBSafelyRemove.exe /startup
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Phlox.lnk = C:\Programmi\Phlox\Phlox.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office14\EXCEL.EXE/3000
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 4428136265
O17 - HKLM\System\CCS\Services\Tcpip\..\{332E1582-1B3A-4AD7-96DF-9E3A6864747A}: NameServer = 8.8.8.8,8.8.4.4
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programmi\File comuni\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Avira Mail Protection (AntiVirMailService) - Avira Operations GmbH & Co. KG - C:\Programmi\Avira\AntiVir Desktop\avmailc.exe
O23 - Service: Avira Scheduler (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Programmi\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira Realtime Protection (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Programmi\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Avira Web Protection (AntiVirWebService) - Avira Operations GmbH & Co. KG - C:\Programmi\Avira\AntiVir Desktop\AVWEBGRD.EXE
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Servizio Bonjour (Bonjour Service) - Apple Inc. - C:\Programmi\Bonjour\mDNSResponder.exe
O23 - Service: LogMeIn Hamachi Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Programmi\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Programmi\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Programmi\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Programmi\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programmi\File comuni\Ahead\Lib\NMIndexingService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Sandboxie Service (SbieSvc) - SANDBOXIE L.T.D - C:\Programmi\Sandboxie\SbieSvc.exe
O23 - Service: ServiceLayer - Nokia - C:\Programmi\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Programmi\Skype\Updater\Updater.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Programmi\File comuni\Steam\SteamService.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Programmi\TomTom HOME 2\TomTomHOMEService.exe
O23 - Service: USB Safely Remove Assistant (USBSafelyRemoveService) - Unknown owner - C:\Programmi\USB Safely Remove\USBSRService.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Programmi\Yahoo!\SoftwareUpdate\YahooAUService.exe
O23 - Service: YJVUZMS - Sysinternals - www.sysinternals.com - C:\DOCUME~1\Tommy\IMPOST~1\Temp\YJVUZMS.exe
--
End of file - 8855 bytes
Combofix:
ComboFix 12-06-11.04 - Tommy 12/06/2012 5.34.02.3.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.39.1040.18.2047.1437 [GMT 2:00]
Eseguito da: c:\documents and settings\Tommy\Desktop\Utilità\ComboFix.exe
AV: Avira Desktop *Enabled/Updated* {00000000-0715-0000-08F2-12003094807C}
.
.
((((((((((((((((((((((((( Files Creati Da 2012-05-12 al 2012-06-12 )))))))))))))))))))))))))))))))))))
.
.
2012-06-11 20:08 . 2012-06-11 20:09 -------- d-----w- c:\programmi\Codemasters
2012-06-11 19:05 . 2012-06-11 19:05 -------- d-----w- c:\programmi\Techland
2012-06-11 17:29 . 2012-06-11 17:29 21840 ----a-w- c:\windows\system32\SIntfNT.dll
2012-06-11 17:29 . 2012-06-11 17:29 17212 ----a-w- c:\windows\system32\SIntf32.dll
2012-06-11 17:29 . 2012-06-11 17:29 12067 ----a-w- c:\windows\system32\SIntf16.dll
2012-06-11 17:27 . 2012-06-11 17:27 -------- d-----r- c:\documents and settings\LocalService\Preferiti
2012-06-11 17:08 . 1999-04-23 20:22 151552 ----a-w- c:\windows\system32\MSOSS.DLL
2012-06-10 12:59 . 2012-06-10 13:00 -------- d-----w- c:\documents and settings\Tommy\Impostazioni locali\Dati applicazioni\Tool by gbcnet.net_v_5
2012-06-10 12:43 . 2012-06-10 12:43 -------- d-----w- c:\programmi\TomTom HOME 2
2012-06-10 12:30 . 2012-06-10 12:30 -------- d-----w- c:\documents and settings\Tommy\Impostazioni locali\Dati applicazioni\TomTom
2012-06-10 12:30 . 2012-06-10 12:30 -------- d-----w- c:\documents and settings\Tommy\Dati applicazioni\TomTom
2012-06-10 12:27 . 2012-06-10 12:27 -------- d-----w- c:\programmi\TomTom International B.V
2012-06-10 12:06 . 2012-06-10 12:06 388096 ----a-r- c:\documents and settings\Tommy\Dati applicazioni\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2012-06-10 12:06 . 2012-06-10 12:06 -------- d-----w- c:\programmi\Trend Micro
2012-06-10 10:49 . 2012-06-10 10:49 -------- d-----w- c:\documents and settings\Tommy\Impostazioni locali\Dati applicazioni\Sun
2012-06-10 10:46 . 2012-06-10 10:47 -------- d-----w- c:\documents and settings\Tommy\Impostazioni locali\Dati applicazioni\Tool by gbcnet.net_v4_beta
2012-06-09 20:39 . 2012-06-09 20:39 -------- d-----w- c:\programmi\File comuni\Java
2012-06-09 20:39 . 2012-06-09 20:39 -------- d-----w- c:\programmi\Oracle
2012-06-09 20:39 . 2012-06-09 20:39 -------- d-----w- c:\documents and settings\Tommy\Dati applicazioni\Oracle
2012-06-09 20:39 . 2012-04-04 16:47 772504 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-06-09 14:30 . 2012-06-09 20:35 -------- d-----w- c:\documents and settings\Tommy\Dati applicazioni\Yahoo!
2012-06-09 14:29 . 2012-06-09 14:30 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Yahoo!
2012-06-09 14:24 . 2012-06-09 20:35 -------- d-----w- c:\programmi\Yahoo!
2012-06-09 14:15 . 2012-06-11 17:27 -------- d-----w- c:\windows\system32\NtmsData
2012-06-09 13:25 . 2012-06-09 13:25 126976 --sha-r- c:\windows\system32\openfiles5.dll
2012-06-08 19:46 . 2012-06-08 19:46 770384 ----a-w- c:\programmi\Mozilla Firefox\msvcr100.dll
2012-06-08 19:46 . 2012-06-08 19:46 421200 ----a-w- c:\programmi\Mozilla Firefox\msvcp100.dll
2012-06-08 17:26 . 2012-06-08 17:27 -------- d-----w- c:\documents and settings\All Users\CyberLink
2012-06-08 17:25 . 2012-06-08 17:26 -------- d-----w- c:\documents and settings\Tommy\Dati applicazioni\CyberLink
2012-06-08 17:21 . 2012-06-08 18:07 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\CyberLink
2012-06-08 17:19 . 2012-06-08 19:00 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\SmartSound Software Inc
2012-06-08 17:12 . 2012-06-08 19:26 -------- d-----w- c:\programmi\CyberLink
2012-06-07 20:46 . 2012-01-18 13:55 922184 ----a-w- c:\windows\system32\pwNative.exe
2012-06-07 20:46 . 2012-01-18 13:55 16472 ------w- c:\windows\system32\pwdrvio.sys
2012-06-07 20:46 . 2012-01-18 13:55 11104 ------w- c:\windows\system32\pwdspio.sys
2012-06-07 20:46 . 2012-06-07 20:46 -------- d-----w- c:\programmi\MiniTool Partition Wizard Home Edition 7.1
2012-06-06 14:36 . 2012-06-06 14:36 -------- d-----w- c:\documents and settings\Tommy\Dati applicazioni\Unity
2012-06-06 14:33 . 2012-06-06 14:33 -------- d-----w- c:\documents and settings\Tommy\Impostazioni locali\Dati applicazioni\Unity
2012-06-03 14:11 . 2012-06-03 14:11 -------- d-----w- c:\programmi\File comuni\EZB Systems
2012-06-03 14:11 . 2012-06-03 14:11 -------- d-----w- c:\programmi\UltraISO
2012-06-02 11:04 . 2012-06-02 11:04 -------- d--h--r- c:\documents and settings\Tommy\Dati applicazioni\SecuROM
2012-06-02 11:04 . 2012-06-02 11:04 98304 ----a-w- c:\windows\system32CmdLineExt.dll
2012-06-02 10:37 . 2012-06-02 10:37 -------- d-----w- c:\programmi\Saitek
2012-06-02 10:33 . 2012-06-02 10:33 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Saitek
2012-05-30 15:23 . 2008-04-13 09:45 26112 ----a-w- c:\windows\system32\drivers\usbser.sys
2012-05-30 15:22 . 2008-11-07 16:55 16928 ------w- c:\windows\system32\spmsgXP_2k3.dll
2012-05-30 15:21 . 2012-05-30 15:22 -------- d-----w- c:\documents and settings\Tommy\Impostazioni locali\Dati applicazioni\Nokia
2012-05-30 15:21 . 2012-05-30 15:21 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\PC Suite
2012-05-30 15:21 . 2012-05-30 15:25 -------- d-----w- c:\documents and settings\Tommy\Dati applicazioni\PC Suite
2012-05-30 15:15 . 2012-05-30 15:15 -------- d-----w- c:\documents and settings\Tommy\Dati applicazioni\Garmin
2012-05-30 15:15 . 2012-05-30 15:19 -------- d-----w- c:\programmi\DIFX
2012-05-30 15:15 . 2012-05-30 15:15 -------- d-----w- c:\programmi\Garmin
2012-05-25 17:13 . 2012-05-25 17:13 -------- d-----w- c:\programmi\Ashampoo
2012-05-20 14:00 . 2012-05-20 14:00 -------- d-----w- c:\documents and settings\Tommy\Impostazioni locali\Dati applicazioni\Identities
2012-05-19 14:48 . 2012-05-19 14:49 -------- d-----w- C:\BMW M3 Challenge
2012-05-19 08:07 . 2012-05-19 08:07 159744 ----a-w- c:\programmi\Internet Explorer\Plugin\npqtplugin7.dll
2012-05-19 08:07 . 2012-05-19 08:07 159744 ----a-w- c:\programmi\Internet Explorer\Plugin\npqtplugin6.dll
2012-05-19 08:07 . 2012-05-19 08:07 159744 ----a-w- c:\programmi\Internet Explorer\Plugin\npqtplugin5.dll
2012-05-19 08:07 . 2012-05-19 08:07 159744 ----a-w- c:\programmi\Internet Explorer\Plugin\npqtplugin4.dll
2012-05-19 08:07 . 2012-05-19 08:07 159744 ----a-w- c:\programmi\Internet Explorer\Plugin\npqtplugin3.dll
2012-05-19 08:07 . 2012-05-19 08:07 159744 ----a-w- c:\programmi\Internet Explorer\Plugin\npqtplugin2.dll
2012-05-19 08:07 . 2012-05-19 08:07 159744 ----a-w- c:\programmi\Internet Explorer\Plugin\npqtplugin.dll
2012-05-19 08:06 . 2012-05-19 08:07 -------- d-----w- c:\programmi\QuickTime
2012-05-18 19:42 . 2012-05-18 19:42 -------- d-----w- c:\documents and settings\Tommy\Dati applicazioni\Avira
2012-05-18 19:37 . 2012-05-18 19:37 -------- d-----w- c:\documents and settings\LocalService\Menu Avvio
2012-05-18 19:36 . 2012-02-03 13:35 74640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2012-05-18 19:36 . 2012-02-03 13:35 36000 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2012-05-18 19:36 . 2012-02-03 13:35 137416 ----a-w- c:\windows\system32\drivers\avipbb.sys
2012-05-18 19:36 . 2012-05-18 19:36 -------- d-----w- c:\programmi\Avira
2012-05-15 16:20 . 2012-05-15 16:20 -------- d-----w- c:\programmi\My 190
2012-05-15 16:09 . 2012-05-15 16:09 -------- d-----w- c:\documents and settings\Tommy\Dati applicazioni\it.vodafone.desktopwidget.75C5D0AC8E830B80BD4FBC0B32A23F0123E8C097.1
2012-05-15 14:19 . 2008-04-13 17:13 221184 ----a-w- c:\windows\system32\wmpns.dll
2012-05-15 14:19 . 2012-05-15 14:19 -------- d-----w- c:\documents and settings\Administrator
2012-05-14 17:02 . 2012-05-14 17:02 -------- d-----w- c:\documents and settings\Tommy\dwhelper
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-11 07:47 . 2012-04-15 08:40 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-06-11 07:47 . 2012-04-15 08:40 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-06-09 20:38 . 2012-04-15 13:12 143872 ----a-w- c:\windows\system32\javacpl.cpl
2012-05-31 13:21 . 2008-04-13 17:13 603136 ----a-w- c:\windows\system32\crypt32.dll
2012-05-04 15:16 . 2009-08-18 09:30 564632 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Microsoft\IdentityCRL\production\wlidui.dll
2012-05-04 15:16 . 2009-08-18 09:24 19352 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2012-04-30 17:24 . 2012-04-26 15:26 413696 ----a-w- c:\windows\system32\wrap_oal.dll
2012-04-30 17:24 . 2012-04-26 15:26 110592 ----a-w- c:\windows\system32\OpenAL32.dll
2012-04-25 09:27 . 2012-04-25 09:27 7936 ----a-w- c:\windows\system32\drivers\FNETURPX.SYS
2012-04-25 09:27 . 2012-04-25 09:27 23680 ----a-w- c:\windows\system32\drivers\FNETTBOH.SYS
2012-04-22 09:49 . 2012-04-14 17:44 58368 ----a-w- c:\windows\system32\drivers\redbook.sys
2012-04-21 16:26 . 2012-04-16 17:32 477240 ----a-w- c:\windows\system32\drivers\sptd.sys
2012-04-21 16:25 . 2012-04-21 16:25 242240 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2012-04-18 18:56 . 2012-04-18 18:56 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2012-04-18 18:56 . 2012-04-18 18:56 69632 ----a-w- c:\windows\system32\QuickTime.qts
2012-04-18 14:02 . 2012-04-15 10:14 138520 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2012-04-18 14:02 . 2012-04-15 10:12 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2012-04-18 13:59 . 2012-04-15 10:14 234536 ----a-w- c:\windows\system32\PnkBstrB.exe
2012-04-17 15:25 . 2012-04-15 10:14 22328 ----a-w- c:\documents and settings\Tommy\Dati applicazioni\PnkBstrK.sys
2012-04-16 20:33 . 2012-04-16 20:33 234536 ----a-w- c:\windows\system32\PnkBstrB.xtr
2012-04-16 19:51 . 2012-04-16 19:51 34064 ----a-w- c:\windows\system32\lhacm.acm
2012-04-15 10:14 . 2012-04-15 10:14 189248 ----a-w- c:\windows\system32\PnkBstrB.ex0
2012-04-11 13:51 . 2008-04-13 18:55 2072832 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-04-11 13:51 . 2008-04-13 16:50 1862272 ----a-w- c:\windows\system32\win32k.sys
2012-04-11 13:51 . 2008-04-13 16:55 2196352 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-04-04 16:47 . 2012-04-15 13:12 687504 ----a-w- c:\windows\system32\deployJava1.dll
2012-04-04 13:56 . 2012-04-22 08:16 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-06-08 19:46 . 2012-04-15 08:43 85472 ----a-w- c:\programmi\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2012-06-10_11.56.08 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-06-11 07:47 . 2012-06-11 07:47 686280 c:\windows\system32\Macromed\Flash\FlashUtil32_11_3_300_257_Plugin.exe
+ 2012-04-15 08:40 . 2012-06-11 07:47 257224 c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
+ 2012-05-19 07:11 . 2012-06-12 02:58 279744 c:\windows\system32\FNTCACHE.DAT
+ 2012-06-10 12:27 . 2012-06-10 12:27 146944 c:\windows\Installer\50f8d6.msi
+ 2012-06-11 07:47 . 2012-06-11 07:47 9459912 c:\windows\system32\Macromed\Flash\NPSWF32_11_3_300_257.dll
+ 2012-06-10 12:06 . 2012-06-10 12:06 1094656 c:\windows\Installer\3d3ae0.msi
+ 2012-06-11 19:12 . 2012-06-11 19:12 14816256 c:\windows\Installer\28b9871.msi
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DesktopOK"="c:\documents and settings\Tommy\Desktop\Utilità\desktop ok\DesktopOK.exe" [2012-05-05 136192]
"LClock"="c:\programmi\LClock\lclock.exe" [2004-09-19 65536]
"RocketDock"="c:\programmi\RocketDock\RocketDock.exe" [2007-09-02 495616]
"DAEMON Tools Lite"="c:\programmi\DAEMON Tools Lite\DTLite.exe" [2012-04-11 3672384]
"USB Safely Remove"="c:\programmi\USB Safely Remove\USBSafelyRemove.exe" [2012-01-31 6061056]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\programmi\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-02-10 61440]
"UnlockerAssistant"="c:\programmi\Unlocker\UnlockerAssistant.exe" [2010-07-04 17408]
"LogMeIn Hamachi Ui"="c:\programmi\LogMeIn Hamachi\hamachi-2-ui.exe" [2012-02-28 1987976]
"Malwarebytes' Anti-Malware"="c:\programmi\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
"UsbBoost"="c:\programmi\UsbBoost\TurboHddUsb.exe" [2012-04-25 3788800]
"avgnt"="c:\programmi\Avira\AntiVir Desktop\avgnt.exe" [2012-02-03 258512]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]
.
c:\documents and settings\Tommy\Menu Avvio\Programmi\Esecuzione automatica\
Phlox.lnk - c:\programmi\Phlox\Phlox.exe [2008-9-16 218783]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2012-01-31 19:30 87424 ----a-w- c:\windows\system32\LMIinit.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\Opera\\opera.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Programmi\\uTorrent\\uTorrent.exe"=
"c:\\Programmi\\File comuni\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Programmi\\Bonjour\\mDNSResponder.exe"=
"c:\\Programmi\\iTunes\\iTunes.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programmi\\TeamViewer\\Version7\\TeamViewer.exe"=
"c:\\Programmi\\TeamViewer\\Version7\\TeamViewer_Service.exe"=
"c:\\Programmi\\Garena Plus\\room\\garena_room.exe"=
"c:\\Documents and Settings\\Tommy\\Desktop\\Giochi\\teamspeak3-server_win32\\ts3server_win32.exe"=
"c:\\Programmi\\Xfire\\xfire.exe"=
"c:\\Programmi\\Teamspeak2_RC2\\server_windows.exe"=
"c:\\Programmi\\Microsoft Office\\Office14\\GROOVE.EXE"=
"c:\\Documents and Settings\\Tommy\\Desktop\\iphone\\tinyumbrella-5.10.10.exe"=
"c:\\Programmi\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Programmi\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
.
R0 sptd;sptd;\SystemRoot\\SystemRoot\System32\Drivers\sptd.sys
\SystemRoot\\SystemRoot\System32\Drivers\sptd.sys ![[?]](http://www.megalab.it/forum/images/smilies/confused.gif "Confuso")
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [18/05/2012 21.36.50 36000]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [21/04/2012 18.25.48 242240]
R1 FNETURPX;FNETURPX;c:\windows\system32\drivers\FNETURPX.SYS [25/04/2012 11.27.58 7936]
R2 Abrosoft: Abrosoft FantaMorph update permissions manager. 12810.;Abrosoft: Abrosoft FantaMorph update permissions manager. 12810.;c:\programmi\Abrosoft\FantaMorph5\FantaUp.exe -PermissionManagerRun c:\programmi\Abrosoft\FantaMorph5\FantaUp.exe -PermissionManagerRun
R2 AntiVirMailService;Avira Mail Protection;c:\programmi\Avira\AntiVir Desktop\avmailc.exe [18/05/2012 21.36.50 342480]
R2 AntiVirSchedulerService;Avira Scheduler;c:\programmi\Avira\AntiVir Desktop\sched.exe [18/05/2012 21.36.53 86224]
R2 AntiVirWebService;Avira Web Protection;c:\programmi\Avira\AntiVir Desktop\avwebgrd.exe [18/05/2012 21.36.50 463824]
R2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\programmi\LogMeIn Hamachi\hamachi-2.exe [28/02/2012 17.38.52 1373576]
R2 MBAMService;MBAMService;c:\programmi\Malwarebytes' Anti-Malware\mbamservice.exe [22/04/2012 10.16.39 654408]
R2 TomTomHOMEService;TomTomHOMEService;c:\programmi\TomTom HOME 2\TomTomHOMEService.exe [10/12/2010 14.29.00 92008]
R2 USBSafelyRemoveService;USB Safely Remove Assistant;c:\programmi\USB Safely Remove\USBSRService.exe [15/04/2012 14.39.48 742744]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [22/04/2012 10.16.38 22344]
R3 PAC207;Trust WB-1400T Webcam;c:\windows\system32\drivers\PFC027.sys [24/02/2005 12.29.14 162176]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18/03/2010 13.16.28 130384]
S2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\programmi\LogMeIn\x86\RaInfo.sys c:\programmi\LogMeIn\x86\RaInfo.sys
S2 SkypeUpdate;Skype Updater;c:\programmi\Skype\Updater\Updater.exe [05/06/2012 15.17.44 160944]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [15/04/2012 10.40.55 257224]
S3 FNETTBOH;FNETTBOH;c:\windows\system32\drivers\FNETTBOH.SYS [25/04/2012 11.27.58 23680]
S3 GGSAFERDriver;GGSAFER Driver;\??\c:\programmi\Garena Plus\Room\safedrv.sys c:\programmi\Garena Plus\Room\safedrv.sys
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\programmi\Microsoft Office\Office14\GROOVE.EXE [12/06/2011 11.15.00 31125880]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\programmi\Mozilla Maintenance Service\maintenanceservice.exe [01/05/2012 12.25.25 113120]
S3 osppsvc;Office Software Protection Platform;c:\programmi\File comuni\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [09/01/2010 21.37.50 4640000]
S3 pbfilter;pbfilter;c:\programmi\PeerBlock\pbfilter.sys [20/04/2012 21.38.35 19056]
S3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [07/06/2012 22.46.16 16472]
S3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [07/06/2012 22.46.16 11104]
S3 SaiH0461;SaiH0461;c:\windows\system32\drivers\SaiH0461.sys [01/05/2007 15.33.34 132232]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18/03/2010 13.16.28 753504]
.
Contenuto della cartella 'Scheduled Tasks'
.
2012-06-12 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-15 07:47]
.
2012-06-12 c:\windows\Tasks\AutoKMS.job
- c:\windows\AutoKMS\AutoKMS.exe [2012-04-17 18:27]
.
2012-06-12 c:\windows\Tasks\pucinu.job
- c:\windows\system32\openfiles5.dll [2012-06-09 13:25]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
uInternet Settings,ProxyOverride = *.local
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~4\Office14\EXCEL.EXE/3000
LSP: c:\programmi\Avira\AntiVir Desktop\avsda.dll
TCP: Interfaces\{332E1582-1B3A-4AD7-96DF-9E3A6864747A}: NameServer = 192.168.1.1,0.0.0.0
FF - ProfilePath - c:\documents and settings\Tommy\Dati applicazioni\Mozilla\Firefox\Profiles\004vzbut.default\
FF - prefs.js: browser.search.selectedEngine - WR English-Italian
FF - prefs.js: browser.startup.homepage - hxxp://www.google.it/
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&o ... &gfns=1&q=
FF - prefs.js: network.proxy.ftp - 81.168.92.66
FF - prefs.js: network.proxy.ftp_port - 8080
FF - prefs.js: network.proxy.gopher - 81.168.92.66
FF - prefs.js: network.proxy.gopher_port - 8080
FF - prefs.js: network.proxy.http - 81.168.92.66
FF - prefs.js: network.proxy.http_port - 8080
FF - prefs.js: network.proxy.socks - 81.168.92.66
FF - prefs.js: network.proxy.socks_port - 8080
FF - prefs.js: network.proxy.ssl - 81.168.92.66
FF - prefs.js: network.proxy.ssl_port - 8080
FF - prefs.js: network.proxy.type - 0
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-06-12 05:46
Windows 5.1.2600 Service Pack 3 NTFS
.
scansione processi nascosti ...
.
scansione entrate autostart nascoste ...
.
Scansione files nascosti ...
.
Scansione completata con successo
Files nascosti: 0
.
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\abp480n5]
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Abrosoft: Abrosoft FantaMorph update permissions manager. 12810.]
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
.
[HKEY_USERS\S-1-5-21-1644491937-1757981266-1177238915-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-1644491937-1757981266-1177238915-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:bc,64,81,35,e9,8d,35,0e,0d,1e,6a,8c,f6,df,4b,be,1f,da,fc,a0,10,a5,ce,
03,ef,2d,de,aa,dd,31,0c,81,ff,41,57,ca,00,0a,b2,f2,8c,09,fd,3d,24,ab,42,b9,\
"??"=hex:b5,5e,67,b3,49,08,72,ad,41,a9,3a,9c,e3,bb,58,83
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------
.
- - - - - - - > 'winlogon.exe'(756)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\LMIinit.dll
.
- - - - - - - > 'lsass.exe'(812)
c:\programmi\Avira\AntiVir Desktop\avsda.dll
.
- - - - - - - > 'explorer.exe'(1292)
c:\windows\system32\WININET.dll
c:\progra~1\FILECO~1\MICROS~1\OFFICE14\Cultures\office.odf
c:\progra~1\MICROS~4\Office14\1040\GrooveIntlResource.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\programmi\LClock\LC.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Ora fine scansione: 2012-06-12 05:48:53
ComboFix-quarantined-files.txt 2012-06-12 03:48
ComboFix2.txt 2012-06-10 12:01
.
Pre-Run: 22.998.278.144 byte disponibili
Post-Run: 23.049.109.504 byte disponibili
.
- - End Of File - - 25398D2EB1A606DEAC71420F54E1673C
Microsoft Windows XP Professional 5.1.2600.3.1252.39.1040.18.2047.1437 [GMT 2:00]
Eseguito da: c:\documents and settings\Tommy\Desktop\Utilità\ComboFix.exe
AV: Avira Desktop *Enabled/Updated* {00000000-0715-0000-08F2-12003094807C}
.
.
((((((((((((((((((((((((( Files Creati Da 2012-05-12 al 2012-06-12 )))))))))))))))))))))))))))))))))))
.
.
2012-06-11 20:08 . 2012-06-11 20:09 -------- d-----w- c:\programmi\Codemasters
2012-06-11 19:05 . 2012-06-11 19:05 -------- d-----w- c:\programmi\Techland
2012-06-11 17:29 . 2012-06-11 17:29 21840 ----a-w- c:\windows\system32\SIntfNT.dll
2012-06-11 17:29 . 2012-06-11 17:29 17212 ----a-w- c:\windows\system32\SIntf32.dll
2012-06-11 17:29 . 2012-06-11 17:29 12067 ----a-w- c:\windows\system32\SIntf16.dll
2012-06-11 17:27 . 2012-06-11 17:27 -------- d-----r- c:\documents and settings\LocalService\Preferiti
2012-06-11 17:08 . 1999-04-23 20:22 151552 ----a-w- c:\windows\system32\MSOSS.DLL
2012-06-10 12:59 . 2012-06-10 13:00 -------- d-----w- c:\documents and settings\Tommy\Impostazioni locali\Dati applicazioni\Tool by gbcnet.net_v_5
2012-06-10 12:43 . 2012-06-10 12:43 -------- d-----w- c:\programmi\TomTom HOME 2
2012-06-10 12:30 . 2012-06-10 12:30 -------- d-----w- c:\documents and settings\Tommy\Impostazioni locali\Dati applicazioni\TomTom
2012-06-10 12:30 . 2012-06-10 12:30 -------- d-----w- c:\documents and settings\Tommy\Dati applicazioni\TomTom
2012-06-10 12:27 . 2012-06-10 12:27 -------- d-----w- c:\programmi\TomTom International B.V
2012-06-10 12:06 . 2012-06-10 12:06 388096 ----a-r- c:\documents and settings\Tommy\Dati applicazioni\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2012-06-10 12:06 . 2012-06-10 12:06 -------- d-----w- c:\programmi\Trend Micro
2012-06-10 10:49 . 2012-06-10 10:49 -------- d-----w- c:\documents and settings\Tommy\Impostazioni locali\Dati applicazioni\Sun
2012-06-10 10:46 . 2012-06-10 10:47 -------- d-----w- c:\documents and settings\Tommy\Impostazioni locali\Dati applicazioni\Tool by gbcnet.net_v4_beta
2012-06-09 20:39 . 2012-06-09 20:39 -------- d-----w- c:\programmi\File comuni\Java
2012-06-09 20:39 . 2012-06-09 20:39 -------- d-----w- c:\programmi\Oracle
2012-06-09 20:39 . 2012-06-09 20:39 -------- d-----w- c:\documents and settings\Tommy\Dati applicazioni\Oracle
2012-06-09 20:39 . 2012-04-04 16:47 772504 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-06-09 14:30 . 2012-06-09 20:35 -------- d-----w- c:\documents and settings\Tommy\Dati applicazioni\Yahoo!
2012-06-09 14:29 . 2012-06-09 14:30 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Yahoo!
2012-06-09 14:24 . 2012-06-09 20:35 -------- d-----w- c:\programmi\Yahoo!
2012-06-09 14:15 . 2012-06-11 17:27 -------- d-----w- c:\windows\system32\NtmsData
2012-06-09 13:25 . 2012-06-09 13:25 126976 --sha-r- c:\windows\system32\openfiles5.dll
2012-06-08 19:46 . 2012-06-08 19:46 770384 ----a-w- c:\programmi\Mozilla Firefox\msvcr100.dll
2012-06-08 19:46 . 2012-06-08 19:46 421200 ----a-w- c:\programmi\Mozilla Firefox\msvcp100.dll
2012-06-08 17:26 . 2012-06-08 17:27 -------- d-----w- c:\documents and settings\All Users\CyberLink
2012-06-08 17:25 . 2012-06-08 17:26 -------- d-----w- c:\documents and settings\Tommy\Dati applicazioni\CyberLink
2012-06-08 17:21 . 2012-06-08 18:07 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\CyberLink
2012-06-08 17:19 . 2012-06-08 19:00 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\SmartSound Software Inc
2012-06-08 17:12 . 2012-06-08 19:26 -------- d-----w- c:\programmi\CyberLink
2012-06-07 20:46 . 2012-01-18 13:55 922184 ----a-w- c:\windows\system32\pwNative.exe
2012-06-07 20:46 . 2012-01-18 13:55 16472 ------w- c:\windows\system32\pwdrvio.sys
2012-06-07 20:46 . 2012-01-18 13:55 11104 ------w- c:\windows\system32\pwdspio.sys
2012-06-07 20:46 . 2012-06-07 20:46 -------- d-----w- c:\programmi\MiniTool Partition Wizard Home Edition 7.1
2012-06-06 14:36 . 2012-06-06 14:36 -------- d-----w- c:\documents and settings\Tommy\Dati applicazioni\Unity
2012-06-06 14:33 . 2012-06-06 14:33 -------- d-----w- c:\documents and settings\Tommy\Impostazioni locali\Dati applicazioni\Unity
2012-06-03 14:11 . 2012-06-03 14:11 -------- d-----w- c:\programmi\File comuni\EZB Systems
2012-06-03 14:11 . 2012-06-03 14:11 -------- d-----w- c:\programmi\UltraISO
2012-06-02 11:04 . 2012-06-02 11:04 -------- d--h--r- c:\documents and settings\Tommy\Dati applicazioni\SecuROM
2012-06-02 11:04 . 2012-06-02 11:04 98304 ----a-w- c:\windows\system32CmdLineExt.dll
2012-06-02 10:37 . 2012-06-02 10:37 -------- d-----w- c:\programmi\Saitek
2012-06-02 10:33 . 2012-06-02 10:33 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Saitek
2012-05-30 15:23 . 2008-04-13 09:45 26112 ----a-w- c:\windows\system32\drivers\usbser.sys
2012-05-30 15:22 . 2008-11-07 16:55 16928 ------w- c:\windows\system32\spmsgXP_2k3.dll
2012-05-30 15:21 . 2012-05-30 15:22 -------- d-----w- c:\documents and settings\Tommy\Impostazioni locali\Dati applicazioni\Nokia
2012-05-30 15:21 . 2012-05-30 15:21 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\PC Suite
2012-05-30 15:21 . 2012-05-30 15:25 -------- d-----w- c:\documents and settings\Tommy\Dati applicazioni\PC Suite
2012-05-30 15:15 . 2012-05-30 15:15 -------- d-----w- c:\documents and settings\Tommy\Dati applicazioni\Garmin
2012-05-30 15:15 . 2012-05-30 15:19 -------- d-----w- c:\programmi\DIFX
2012-05-30 15:15 . 2012-05-30 15:15 -------- d-----w- c:\programmi\Garmin
2012-05-25 17:13 . 2012-05-25 17:13 -------- d-----w- c:\programmi\Ashampoo
2012-05-20 14:00 . 2012-05-20 14:00 -------- d-----w- c:\documents and settings\Tommy\Impostazioni locali\Dati applicazioni\Identities
2012-05-19 14:48 . 2012-05-19 14:49 -------- d-----w- C:\BMW M3 Challenge
2012-05-19 08:07 . 2012-05-19 08:07 159744 ----a-w- c:\programmi\Internet Explorer\Plugin\npqtplugin7.dll
2012-05-19 08:07 . 2012-05-19 08:07 159744 ----a-w- c:\programmi\Internet Explorer\Plugin\npqtplugin6.dll
2012-05-19 08:07 . 2012-05-19 08:07 159744 ----a-w- c:\programmi\Internet Explorer\Plugin\npqtplugin5.dll
2012-05-19 08:07 . 2012-05-19 08:07 159744 ----a-w- c:\programmi\Internet Explorer\Plugin\npqtplugin4.dll
2012-05-19 08:07 . 2012-05-19 08:07 159744 ----a-w- c:\programmi\Internet Explorer\Plugin\npqtplugin3.dll
2012-05-19 08:07 . 2012-05-19 08:07 159744 ----a-w- c:\programmi\Internet Explorer\Plugin\npqtplugin2.dll
2012-05-19 08:07 . 2012-05-19 08:07 159744 ----a-w- c:\programmi\Internet Explorer\Plugin\npqtplugin.dll
2012-05-19 08:06 . 2012-05-19 08:07 -------- d-----w- c:\programmi\QuickTime
2012-05-18 19:42 . 2012-05-18 19:42 -------- d-----w- c:\documents and settings\Tommy\Dati applicazioni\Avira
2012-05-18 19:37 . 2012-05-18 19:37 -------- d-----w- c:\documents and settings\LocalService\Menu Avvio
2012-05-18 19:36 . 2012-02-03 13:35 74640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2012-05-18 19:36 . 2012-02-03 13:35 36000 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2012-05-18 19:36 . 2012-02-03 13:35 137416 ----a-w- c:\windows\system32\drivers\avipbb.sys
2012-05-18 19:36 . 2012-05-18 19:36 -------- d-----w- c:\programmi\Avira
2012-05-15 16:20 . 2012-05-15 16:20 -------- d-----w- c:\programmi\My 190
2012-05-15 16:09 . 2012-05-15 16:09 -------- d-----w- c:\documents and settings\Tommy\Dati applicazioni\it.vodafone.desktopwidget.75C5D0AC8E830B80BD4FBC0B32A23F0123E8C097.1
2012-05-15 14:19 . 2008-04-13 17:13 221184 ----a-w- c:\windows\system32\wmpns.dll
2012-05-15 14:19 . 2012-05-15 14:19 -------- d-----w- c:\documents and settings\Administrator
2012-05-14 17:02 . 2012-05-14 17:02 -------- d-----w- c:\documents and settings\Tommy\dwhelper
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-11 07:47 . 2012-04-15 08:40 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-06-11 07:47 . 2012-04-15 08:40 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-06-09 20:38 . 2012-04-15 13:12 143872 ----a-w- c:\windows\system32\javacpl.cpl
2012-05-31 13:21 . 2008-04-13 17:13 603136 ----a-w- c:\windows\system32\crypt32.dll
2012-05-04 15:16 . 2009-08-18 09:30 564632 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Microsoft\IdentityCRL\production\wlidui.dll
2012-05-04 15:16 . 2009-08-18 09:24 19352 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2012-04-30 17:24 . 2012-04-26 15:26 413696 ----a-w- c:\windows\system32\wrap_oal.dll
2012-04-30 17:24 . 2012-04-26 15:26 110592 ----a-w- c:\windows\system32\OpenAL32.dll
2012-04-25 09:27 . 2012-04-25 09:27 7936 ----a-w- c:\windows\system32\drivers\FNETURPX.SYS
2012-04-25 09:27 . 2012-04-25 09:27 23680 ----a-w- c:\windows\system32\drivers\FNETTBOH.SYS
2012-04-22 09:49 . 2012-04-14 17:44 58368 ----a-w- c:\windows\system32\drivers\redbook.sys
2012-04-21 16:26 . 2012-04-16 17:32 477240 ----a-w- c:\windows\system32\drivers\sptd.sys
2012-04-21 16:25 . 2012-04-21 16:25 242240 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2012-04-18 18:56 . 2012-04-18 18:56 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2012-04-18 18:56 . 2012-04-18 18:56 69632 ----a-w- c:\windows\system32\QuickTime.qts
2012-04-18 14:02 . 2012-04-15 10:14 138520 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2012-04-18 14:02 . 2012-04-15 10:12 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2012-04-18 13:59 . 2012-04-15 10:14 234536 ----a-w- c:\windows\system32\PnkBstrB.exe
2012-04-17 15:25 . 2012-04-15 10:14 22328 ----a-w- c:\documents and settings\Tommy\Dati applicazioni\PnkBstrK.sys
2012-04-16 20:33 . 2012-04-16 20:33 234536 ----a-w- c:\windows\system32\PnkBstrB.xtr
2012-04-16 19:51 . 2012-04-16 19:51 34064 ----a-w- c:\windows\system32\lhacm.acm
2012-04-15 10:14 . 2012-04-15 10:14 189248 ----a-w- c:\windows\system32\PnkBstrB.ex0
2012-04-11 13:51 . 2008-04-13 18:55 2072832 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-04-11 13:51 . 2008-04-13 16:50 1862272 ----a-w- c:\windows\system32\win32k.sys
2012-04-11 13:51 . 2008-04-13 16:55 2196352 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-04-04 16:47 . 2012-04-15 13:12 687504 ----a-w- c:\windows\system32\deployJava1.dll
2012-04-04 13:56 . 2012-04-22 08:16 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-06-08 19:46 . 2012-04-15 08:43 85472 ----a-w- c:\programmi\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2012-06-10_11.56.08 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-06-11 07:47 . 2012-06-11 07:47 686280 c:\windows\system32\Macromed\Flash\FlashUtil32_11_3_300_257_Plugin.exe
+ 2012-04-15 08:40 . 2012-06-11 07:47 257224 c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
+ 2012-05-19 07:11 . 2012-06-12 02:58 279744 c:\windows\system32\FNTCACHE.DAT
+ 2012-06-10 12:27 . 2012-06-10 12:27 146944 c:\windows\Installer\50f8d6.msi
+ 2012-06-11 07:47 . 2012-06-11 07:47 9459912 c:\windows\system32\Macromed\Flash\NPSWF32_11_3_300_257.dll
+ 2012-06-10 12:06 . 2012-06-10 12:06 1094656 c:\windows\Installer\3d3ae0.msi
+ 2012-06-11 19:12 . 2012-06-11 19:12 14816256 c:\windows\Installer\28b9871.msi
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DesktopOK"="c:\documents and settings\Tommy\Desktop\Utilità\desktop ok\DesktopOK.exe" [2012-05-05 136192]
"LClock"="c:\programmi\LClock\lclock.exe" [2004-09-19 65536]
"RocketDock"="c:\programmi\RocketDock\RocketDock.exe" [2007-09-02 495616]
"DAEMON Tools Lite"="c:\programmi\DAEMON Tools Lite\DTLite.exe" [2012-04-11 3672384]
"USB Safely Remove"="c:\programmi\USB Safely Remove\USBSafelyRemove.exe" [2012-01-31 6061056]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\programmi\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-02-10 61440]
"UnlockerAssistant"="c:\programmi\Unlocker\UnlockerAssistant.exe" [2010-07-04 17408]
"LogMeIn Hamachi Ui"="c:\programmi\LogMeIn Hamachi\hamachi-2-ui.exe" [2012-02-28 1987976]
"Malwarebytes' Anti-Malware"="c:\programmi\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
"UsbBoost"="c:\programmi\UsbBoost\TurboHddUsb.exe" [2012-04-25 3788800]
"avgnt"="c:\programmi\Avira\AntiVir Desktop\avgnt.exe" [2012-02-03 258512]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]
.
c:\documents and settings\Tommy\Menu Avvio\Programmi\Esecuzione automatica\
Phlox.lnk - c:\programmi\Phlox\Phlox.exe [2008-9-16 218783]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2012-01-31 19:30 87424 ----a-w- c:\windows\system32\LMIinit.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\Opera\\opera.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Programmi\\uTorrent\\uTorrent.exe"=
"c:\\Programmi\\File comuni\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Programmi\\Bonjour\\mDNSResponder.exe"=
"c:\\Programmi\\iTunes\\iTunes.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programmi\\TeamViewer\\Version7\\TeamViewer.exe"=
"c:\\Programmi\\TeamViewer\\Version7\\TeamViewer_Service.exe"=
"c:\\Programmi\\Garena Plus\\room\\garena_room.exe"=
"c:\\Documents and Settings\\Tommy\\Desktop\\Giochi\\teamspeak3-server_win32\\ts3server_win32.exe"=
"c:\\Programmi\\Xfire\\xfire.exe"=
"c:\\Programmi\\Teamspeak2_RC2\\server_windows.exe"=
"c:\\Programmi\\Microsoft Office\\Office14\\GROOVE.EXE"=
"c:\\Documents and Settings\\Tommy\\Desktop\\iphone\\tinyumbrella-5.10.10.exe"=
"c:\\Programmi\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Programmi\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
.
R0 sptd;sptd;\SystemRoot\\SystemRoot\System32\Drivers\sptd.sys
\SystemRoot\\SystemRoot\System32\Drivers\sptd.sys R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [18/05/2012 21.36.50 36000]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [21/04/2012 18.25.48 242240]
R1 FNETURPX;FNETURPX;c:\windows\system32\drivers\FNETURPX.SYS [25/04/2012 11.27.58 7936]
R2 Abrosoft: Abrosoft FantaMorph update permissions manager. 12810.;Abrosoft: Abrosoft FantaMorph update permissions manager. 12810.;c:\programmi\Abrosoft\FantaMorph5\FantaUp.exe -PermissionManagerRun
c:\programmi\Abrosoft\FantaMorph5\FantaUp.exe -PermissionManagerRun R2 AntiVirMailService;Avira Mail Protection;c:\programmi\Avira\AntiVir Desktop\avmailc.exe [18/05/2012 21.36.50 342480]
R2 AntiVirSchedulerService;Avira Scheduler;c:\programmi\Avira\AntiVir Desktop\sched.exe [18/05/2012 21.36.53 86224]
R2 AntiVirWebService;Avira Web Protection;c:\programmi\Avira\AntiVir Desktop\avwebgrd.exe [18/05/2012 21.36.50 463824]
R2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\programmi\LogMeIn Hamachi\hamachi-2.exe [28/02/2012 17.38.52 1373576]
R2 MBAMService;MBAMService;c:\programmi\Malwarebytes' Anti-Malware\mbamservice.exe [22/04/2012 10.16.39 654408]
R2 TomTomHOMEService;TomTomHOMEService;c:\programmi\TomTom HOME 2\TomTomHOMEService.exe [10/12/2010 14.29.00 92008]
R2 USBSafelyRemoveService;USB Safely Remove Assistant;c:\programmi\USB Safely Remove\USBSRService.exe [15/04/2012 14.39.48 742744]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [22/04/2012 10.16.38 22344]
R3 PAC207;Trust WB-1400T Webcam;c:\windows\system32\drivers\PFC027.sys [24/02/2005 12.29.14 162176]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18/03/2010 13.16.28 130384]
S2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\programmi\LogMeIn\x86\RaInfo.sys
c:\programmi\LogMeIn\x86\RaInfo.sys S2 SkypeUpdate;Skype Updater;c:\programmi\Skype\Updater\Updater.exe [05/06/2012 15.17.44 160944]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [15/04/2012 10.40.55 257224]
S3 FNETTBOH;FNETTBOH;c:\windows\system32\drivers\FNETTBOH.SYS [25/04/2012 11.27.58 23680]
S3 GGSAFERDriver;GGSAFER Driver;\??\c:\programmi\Garena Plus\Room\safedrv.sys
c:\programmi\Garena Plus\Room\safedrv.sys S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\programmi\Microsoft Office\Office14\GROOVE.EXE [12/06/2011 11.15.00 31125880]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\programmi\Mozilla Maintenance Service\maintenanceservice.exe [01/05/2012 12.25.25 113120]
S3 osppsvc;Office Software Protection Platform;c:\programmi\File comuni\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [09/01/2010 21.37.50 4640000]
S3 pbfilter;pbfilter;c:\programmi\PeerBlock\pbfilter.sys [20/04/2012 21.38.35 19056]
S3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [07/06/2012 22.46.16 16472]
S3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [07/06/2012 22.46.16 11104]
S3 SaiH0461;SaiH0461;c:\windows\system32\drivers\SaiH0461.sys [01/05/2007 15.33.34 132232]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18/03/2010 13.16.28 753504]
.
Contenuto della cartella 'Scheduled Tasks'
.
2012-06-12 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-15 07:47]
.
2012-06-12 c:\windows\Tasks\AutoKMS.job
- c:\windows\AutoKMS\AutoKMS.exe [2012-04-17 18:27]
.
2012-06-12 c:\windows\Tasks\pucinu.job
- c:\windows\system32\openfiles5.dll [2012-06-09 13:25]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
uInternet Settings,ProxyOverride = *.local
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~4\Office14\EXCEL.EXE/3000
LSP: c:\programmi\Avira\AntiVir Desktop\avsda.dll
TCP: Interfaces\{332E1582-1B3A-4AD7-96DF-9E3A6864747A}: NameServer = 192.168.1.1,0.0.0.0
FF - ProfilePath - c:\documents and settings\Tommy\Dati applicazioni\Mozilla\Firefox\Profiles\004vzbut.default\
FF - prefs.js: browser.search.selectedEngine - WR English-Italian
FF - prefs.js: browser.startup.homepage - hxxp://www.google.it/
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&o ... &gfns=1&q=
FF - prefs.js: network.proxy.ftp - 81.168.92.66
FF - prefs.js: network.proxy.ftp_port - 8080
FF - prefs.js: network.proxy.gopher - 81.168.92.66
FF - prefs.js: network.proxy.gopher_port - 8080
FF - prefs.js: network.proxy.http - 81.168.92.66
FF - prefs.js: network.proxy.http_port - 8080
FF - prefs.js: network.proxy.socks - 81.168.92.66
FF - prefs.js: network.proxy.socks_port - 8080
FF - prefs.js: network.proxy.ssl - 81.168.92.66
FF - prefs.js: network.proxy.ssl_port - 8080
FF - prefs.js: network.proxy.type - 0
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-06-12 05:46
Windows 5.1.2600 Service Pack 3 NTFS
.
scansione processi nascosti ...
.
scansione entrate autostart nascoste ...
.
Scansione files nascosti ...
.
Scansione completata con successo
Files nascosti: 0
.
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\abp480n5]
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Abrosoft: Abrosoft FantaMorph update permissions manager. 12810.]
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
.
[HKEY_USERS\S-1-5-21-1644491937-1757981266-1177238915-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-1644491937-1757981266-1177238915-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:bc,64,81,35,e9,8d,35,0e,0d,1e,6a,8c,f6,df,4b,be,1f,da,fc,a0,10,a5,ce,
03,ef,2d,de,aa,dd,31,0c,81,ff,41,57,ca,00,0a,b2,f2,8c,09,fd,3d,24,ab,42,b9,\
"??"=hex:b5,5e,67,b3,49,08,72,ad,41,a9,3a,9c,e3,bb,58,83
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------
.
- - - - - - - > 'winlogon.exe'(756)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\LMIinit.dll
.
- - - - - - - > 'lsass.exe'(812)
c:\programmi\Avira\AntiVir Desktop\avsda.dll
.
- - - - - - - > 'explorer.exe'(1292)
c:\windows\system32\WININET.dll
c:\progra~1\FILECO~1\MICROS~1\OFFICE14\Cultures\office.odf
c:\progra~1\MICROS~4\Office14\1040\GrooveIntlResource.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\programmi\LClock\LC.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Ora fine scansione: 2012-06-12 05:48:53
ComboFix-quarantined-files.txt 2012-06-12 03:48
ComboFix2.txt 2012-06-10 12:01
.
Pre-Run: 22.998.278.144 byte disponibili
Post-Run: 23.049.109.504 byte disponibili
.
- - End Of File - - 25398D2EB1A606DEAC71420F54E1673C
![[boh]](http://www.megalab.it/forum/images/smilies/dntknw.gif "Boh")
![[;)]](http://www.megalab.it/forum/images/smilies/wink.gif "Occhiolino")
![[^]](http://www.megalab.it/forum/images/smilies/Oh-yea.gif "Approvazione")
![[sh]](http://www.megalab.it/forum/images/smilies/shifty.gif "Shifty")
usi tor?
