AIUTO log SuperAntySpyware

[mitrha]

Ecco il log di TDSS

18:23:43.0906 2372 TDSS rootkit removing tool 2.6.14.0 Oct 28 2011 11:11:01
18:23:44.0015 2372 ============================================================
18:23:44.0015 2372 Current date / time: 2011/11/01 18:23:44.0015
18:23:44.0015 2372 SystemInfo:
18:23:44.0015 2372
18:23:44.0015 2372 OS Version: 5.1.2600 ServicePack: 3.0
18:23:44.0015 2372 Product type: Workstation
18:23:44.0015 2372 ComputerName: E774BAE2
18:23:44.0015 2372 UserName: Fabio
18:23:44.0015 2372 Windows directory: C:\WINDOWS
18:23:44.0015 2372 System windows directory: C:\WINDOWS
18:23:44.0015 2372 Processor architecture: Intel x86
18:23:44.0015 2372 Number of processors: 1
18:23:44.0015 2372 Page size: 0x1000
18:23:44.0015 2372 Boot type: Normal boot
18:23:44.0015 2372 ============================================================
18:23:46.0984 2372 Initialize success
18:23:53.0796 3960 ============================================================
18:23:53.0796 3960 Scan started
18:23:53.0796 3960 Mode: Manual;
18:23:53.0796 3960 ============================================================
18:23:55.0562 3960 27670171 (7dd41b7ac1fbb1dbf20bb1f4e4fbe58c) C:\WINDOWS\system32\DRIVERS\27670171.sys
18:23:55.0562 3960 27670171 - ok
18:23:55.0859 3960 27670172 (a305fad3719c5db0c13d1c2bfd08a04d) C:\WINDOWS\system32\DRIVERS\27670172.sys
18:23:55.0875 3960 27670172 - ok
18:23:55.0953 3960 38155281 (8a7eb032d8700f8e51d64c32301eb2dc) C:\WINDOWS\system32\DRIVERS\38155281.sys
18:23:55.0953 3960 38155281 - ok
18:23:56.0062 3960 38155282 (a305fad3719c5db0c13d1c2bfd08a04d) C:\WINDOWS\system32\DRIVERS\38155282.sys
18:23:56.0062 3960 38155282 - ok
18:23:56.0156 3960 44449211 (7dd41b7ac1fbb1dbf20bb1f4e4fbe58c) C:\WINDOWS\system32\DRIVERS\44449211.sys
18:23:56.0171 3960 44449211 - ok
18:23:56.0265 3960 44449212 (a305fad3719c5db0c13d1c2bfd08a04d) C:\WINDOWS\system32\DRIVERS\44449212.sys
18:23:56.0265 3960 44449212 - ok
18:23:56.0343 3960 Abiosdsk - ok
18:23:56.0359 3960 abp480n5 - ok
18:23:56.0421 3960 ACPI (d766e636187b8f240bbfbabcd51eb2c6) C:\WINDOWS\system32\DRIVERS\ACPI.sys
18:23:56.0421 3960 ACPI - ok
18:23:56.0515 3960 ACPIEC (49ac5cd87fbdda62f3e25190019e7627) C:\WINDOWS\system32\drivers\ACPIEC.sys
18:23:56.0515 3960 ACPIEC - ok
18:23:56.0593 3960 adpu160m - ok
18:23:56.0640 3960 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
18:23:56.0671 3960 aec - ok
18:23:56.0765 3960 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
18:23:56.0765 3960 AFD - ok
18:23:56.0828 3960 Aha154x - ok
18:23:56.0843 3960 aic78u2 - ok
18:23:56.0859 3960 aic78xx - ok
18:23:57.0031 3960 ALCXWDM (dd8520280304b6145a6be31008748c7c) C:\WINDOWS\system32\drivers\ALCXWDM.SYS
18:23:57.0140 3960 ALCXWDM - ok
18:23:57.0312 3960 AliIde - ok
18:23:57.0328 3960 amsint - ok
18:23:57.0406 3960 ANIO (920298c7aef97d8168d219d35975d295) C:\WINDOWS\system32\ANIO.SYS
18:23:57.0406 3960 ANIO - ok
18:23:57.0484 3960 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
18:23:57.0484 3960 Arp1394 - ok
18:23:57.0562 3960 asc - ok
18:23:57.0578 3960 asc3350p - ok
18:23:57.0593 3960 asc3550 - ok
18:23:57.0656 3960 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
18:23:57.0656 3960 AsyncMac - ok
18:23:57.0750 3960 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
18:23:57.0750 3960 atapi - ok
18:23:57.0812 3960 Atdisk - ok
18:23:57.0890 3960 ati2mtag (26fa97bba8105f5ce7ece5111216a22e) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
18:23:57.0937 3960 ati2mtag - ok
18:23:58.0093 3960 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
18:23:58.0093 3960 Atmarpc - ok
18:23:58.0187 3960 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
18:23:58.0187 3960 audstub - ok
18:23:58.0281 3960 avgio (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Programmi\Avira\AntiVir Desktop\avgio.sys
18:23:58.0281 3960 avgio - ok
18:23:58.0375 3960 avgntflt (1e4114685de1ffa9675e09c6a1fb3f4b) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
18:23:58.0375 3960 avgntflt - ok
18:23:58.0437 3960 avipbb (0f78d3dae6dedd99ae54c9491c62adf2) C:\WINDOWS\system32\DRIVERS\avipbb.sys
18:23:58.0437 3960 avipbb - ok
18:23:58.0546 3960 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
18:23:58.0546 3960 Beep - ok
18:23:58.0625 3960 CAM1210 (c3c2f59695742cfadba9ee561249e27c) C:\WINDOWS\system32\Drivers\cam1210.sys
18:23:58.0625 3960 CAM1210 - ok
18:23:58.0703 3960 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
18:23:58.0703 3960 cbidf2k - ok
18:23:58.0765 3960 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
18:23:58.0765 3960 CCDECODE - ok
18:23:58.0781 3960 cd20xrnt - ok
18:23:58.0828 3960 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
18:23:58.0828 3960 Cdaudio - ok
18:23:58.0906 3960 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
18:23:58.0906 3960 Cdfs - ok
18:23:58.0984 3960 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
18:23:58.0984 3960 Cdrom - ok
18:23:59.0046 3960 Changer - ok
18:23:59.0078 3960 CmdIde - ok
18:23:59.0093 3960 Cpqarray - ok
18:23:59.0203 3960 CTMFLT (11e870356b43d2241ea04b75a62b09a3) C:\WINDOWS\system32\drivers\CTMFLT.sys
18:23:59.0250 3960 CTMFLT - ok
18:23:59.0421 3960 CTMMOUNT (6da40556d17dd58a84b00b6ddaa96b36) C:\WINDOWS\system32\drivers\CTMMOUNT.sys
18:23:59.0468 3960 CTMMOUNT - ok
18:23:59.0640 3960 CTMSHD (aeeda83d0d29359d3d8fb6b1bf038cc1) C:\WINDOWS\system32\drivers\CTMSHD.sys
18:23:59.0687 3960 CTMSHD - ok
18:23:59.0781 3960 dac2w2k - ok
18:23:59.0796 3960 dac960nt - ok
18:23:59.0843 3960 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
18:23:59.0843 3960 Disk - ok
18:23:59.0937 3960 dmio (e959ddc0ea7ac11ee5e5602e2a364310) C:\WINDOWS\system32\drivers\dmio.sys
18:23:59.0953 3960 dmio - ok
18:24:00.0062 3960 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
18:24:00.0062 3960 dmload - ok
18:24:00.0140 3960 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
18:24:00.0140 3960 DMusic - ok
18:24:00.0171 3960 dpti2o - ok
18:24:00.0218 3960 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
18:24:00.0218 3960 drmkaud - ok
18:24:00.0312 3960 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
18:24:00.0312 3960 Fastfat - ok
18:24:00.0406 3960 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
18:24:00.0406 3960 Fdc - ok
18:24:00.0515 3960 Fips (2cfea3326981a18c6baf2bd9be76225b) C:\WINDOWS\system32\drivers\Fips.sys
18:24:00.0515 3960 Fips - ok
18:24:00.0640 3960 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
18:24:00.0640 3960 Flpydisk - ok
18:24:00.0718 3960 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
18:24:00.0734 3960 FltMgr - ok
18:24:00.0812 3960 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
18:24:00.0812 3960 Fs_Rec - ok
18:24:00.0890 3960 Ftdisk (f3269a6ee547ea87b949a1cea4816b38) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
18:24:00.0890 3960 Ftdisk - ok
18:24:00.0984 3960 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
18:24:00.0984 3960 Gpc - ok
18:24:01.0078 3960 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
18:24:01.0078 3960 HidUsb - ok
18:24:01.0140 3960 hpn - ok
18:24:01.0218 3960 HSFHWBS2 (1821032e9ee6a72f10448824befc5deb) C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys
18:24:01.0234 3960 HSFHWBS2 - ok
18:24:01.0359 3960 HSF_DP (607edabfd9ca9c864f3d07b159a9ec19) C:\WINDOWS\system32\DRIVERS\HSF_DP.sys
18:24:01.0375 3960 HSF_DP - ok
18:24:01.0500 3960 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
18:24:01.0515 3960 HTTP - ok
18:24:01.0578 3960 i2omgmt - ok
18:24:01.0593 3960 i2omp - ok
18:24:01.0640 3960 i8042prt (610726e28af55b95043c5c35a727e320) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
18:24:01.0640 3960 i8042prt - ok
18:24:01.0703 3960 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
18:24:01.0703 3960 Imapi - ok
18:24:01.0734 3960 ini910u - ok
18:24:01.0750 3960 IntelIde - ok
18:24:01.0796 3960 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
18:24:01.0796 3960 Ip6Fw - ok
18:24:01.0843 3960 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
18:24:01.0843 3960 IpFilterDriver - ok
18:24:01.0921 3960 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
18:24:01.0921 3960 IpInIp - ok
18:24:02.0000 3960 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
18:24:02.0015 3960 IpNat - ok
18:24:02.0093 3960 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
18:24:02.0093 3960 IPSec - ok
18:24:02.0156 3960 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
18:24:02.0156 3960 IRENUM - ok
18:24:02.0218 3960 isapnp (0953594beb81cc72fcc62d37921b25a6) C:\WINDOWS\system32\DRIVERS\isapnp.sys
18:24:02.0218 3960 isapnp - ok
18:24:02.0281 3960 Kbdclass (28b6eace513ca7eaba3b809ad4bc274d) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
18:24:02.0281 3960 Kbdclass - ok
18:24:02.0359 3960 kbdhid (4c61c226bdda2ef1672b2c5f4e56625e) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
18:24:02.0359 3960 kbdhid - ok
18:24:02.0421 3960 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
18:24:02.0421 3960 kmixer - ok
18:24:02.0515 3960 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
18:24:02.0515 3960 KSecDD - ok
18:24:02.0578 3960 lbrtfdc - ok
18:24:02.0625 3960 mdmxsdk (195741aee20369980796b557358cd774) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
18:24:02.0625 3960 mdmxsdk - ok
18:24:02.0718 3960 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
18:24:02.0718 3960 mnmdd - ok
18:24:02.0781 3960 Modem (8cb6636806d76b85fafaee94d75f5129) C:\WINDOWS\system32\drivers\Modem.sys
18:24:02.0781 3960 Modem - ok
18:24:02.0828 3960 Mouclass (e904ebed608055a2bfb824c07f59766c) C:\WINDOWS\system32\DRIVERS\mouclass.sys
18:24:02.0828 3960 Mouclass - ok
18:24:02.0906 3960 mouhid (d7662f0cf5b77bbbe3202716f5bd5318) C:\WINDOWS\system32\DRIVERS\mouhid.sys
18:24:02.0921 3960 mouhid - ok
18:24:03.0015 3960 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
18:24:03.0015 3960 MountMgr - ok
18:24:03.0046 3960 mraid35x - ok
18:24:03.0093 3960 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
18:24:03.0093 3960 MRxDAV - ok
18:24:03.0218 3960 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
18:24:03.0234 3960 MRxSmb - ok
18:24:03.0328 3960 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
18:24:03.0328 3960 Msfs - ok
18:24:03.0406 3960 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
18:24:03.0406 3960 MSKSSRV - ok
18:24:03.0468 3960 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
18:24:03.0468 3960 MSPCLOCK - ok
18:24:03.0546 3960 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
18:24:03.0562 3960 MSPQM - ok
18:24:03.0671 3960 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
18:24:03.0671 3960 mssmbios - ok
18:24:03.0703 3960 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
18:24:03.0703 3960 MSTEE - ok
18:24:03.0812 3960 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
18:24:03.0812 3960 Mup - ok
18:24:03.0937 3960 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
18:24:03.0937 3960 NABTSFEC - ok
18:24:04.0000 3960 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
18:24:04.0000 3960 NDIS - ok
18:24:04.0093 3960 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
18:24:04.0093 3960 NdisIP - ok
18:24:04.0156 3960 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
18:24:04.0156 3960 NdisTapi - ok
18:24:04.0250 3960 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
18:24:04.0250 3960 Ndisuio - ok
18:24:04.0296 3960 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
18:24:04.0296 3960 NdisWan - ok
18:24:04.0359 3960 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
18:24:04.0359 3960 NDProxy - ok
18:24:04.0406 3960 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
18:24:04.0406 3960 NetBIOS - ok
18:24:04.0468 3960 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
18:24:04.0468 3960 NetBT - ok
18:24:04.0593 3960 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
18:24:04.0593 3960 NIC1394 - ok
18:24:04.0687 3960 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
18:24:04.0687 3960 Npfs - ok
18:24:04.0765 3960 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
18:24:04.0781 3960 Ntfs - ok
18:24:04.0937 3960 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
18:24:04.0937 3960 Null - ok
18:24:05.0015 3960 nvatabus (c8daa008f9e390b9da504c1cd0da1ee9) C:\WINDOWS\system32\DRIVERS\nvatabus.sys
18:24:05.0015 3960 nvatabus - ok
18:24:05.0125 3960 NVENETFD (0f432994ca6bafd97321bfa86296f435) C:\WINDOWS\system32\DRIVERS\NVENETFD.sys
18:24:05.0140 3960 NVENETFD - ok
18:24:05.0203 3960 nvnetbus (cae6911f13850b56cb6c96f6bda70d9b) C:\WINDOWS\system32\DRIVERS\nvnetbus.sys
18:24:05.0203 3960 nvnetbus - ok
18:24:05.0250 3960 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
18:24:05.0250 3960 NwlnkFlt - ok
18:24:05.0328 3960 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
18:24:05.0328 3960 NwlnkFwd - ok
18:24:05.0390 3960 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
18:24:05.0390 3960 ohci1394 - ok
18:24:05.0484 3960 ovt519 - ok
18:24:05.0515 3960 Parport (4e9408a178b2d955871c2cdd278de3c3) C:\WINDOWS\system32\DRIVERS\parport.sys
18:24:05.0515 3960 Parport - ok
18:24:05.0609 3960 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
18:24:05.0609 3960 PartMgr - ok
18:24:05.0687 3960 ParVdm (0dabef655a444cb1e193626fb1d24b9f) C:\WINDOWS\system32\drivers\ParVdm.sys
18:24:05.0687 3960 ParVdm - ok
18:24:05.0718 3960 pccsmcfd - ok
18:24:05.0765 3960 PCI (f40a46892afebb0314536b849d57c11e) C:\WINDOWS\system32\DRIVERS\pci.sys
18:24:05.0765 3960 PCI - ok
18:24:05.0828 3960 PCIDump - ok
18:24:05.0906 3960 PCIIde (b2df00d650fd6c4ee781740ed3c8e67f) C:\WINDOWS\system32\DRIVERS\pciide.sys
18:24:05.0906 3960 PCIIde - ok
18:24:05.0968 3960 Pcmcia (815c50f2b1d1562800bdce8be895000e) C:\WINDOWS\system32\drivers\Pcmcia.sys
18:24:05.0968 3960 Pcmcia - ok
18:24:06.0031 3960 PDCOMP - ok
18:24:06.0031 3960 PDFRAME - ok
18:24:06.0046 3960 PDRELI - ok
18:24:06.0062 3960 PDRFRAME - ok
18:24:06.0078 3960 perc2 - ok
18:24:06.0093 3960 perc2hib - ok
18:24:06.0156 3960 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
18:24:06.0156 3960 PptpMiniport - ok
18:24:06.0234 3960 Processor (b479f50e883b2297a5f7f212aaee6f6c) C:\WINDOWS\system32\DRIVERS\processr.sys
18:24:06.0234 3960 Processor - ok
18:24:06.0312 3960 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
18:24:06.0312 3960 Ptilink - ok
18:24:06.0343 3960 ql1080 - ok
18:24:06.0359 3960 Ql10wnt - ok
18:24:06.0375 3960 ql12160 - ok
18:24:06.0375 3960 ql1240 - ok
18:24:06.0390 3960 ql1280 - ok
18:24:06.0437 3960 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
18:24:06.0437 3960 RasAcd - ok
18:24:06.0515 3960 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
18:24:06.0515 3960 Rasl2tp - ok
18:24:06.0593 3960 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
18:24:06.0593 3960 RasPppoe - ok
18:24:06.0671 3960 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
18:24:06.0671 3960 Raspti - ok
18:24:06.0734 3960 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
18:24:06.0750 3960 Rdbss - ok
18:24:06.0828 3960 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
18:24:06.0828 3960 RDPCDD - ok
18:24:06.0921 3960 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
18:24:06.0937 3960 RDPWD - ok
18:24:07.0031 3960 redbook (393fc252593323b624b230eca6b85e63) C:\WINDOWS\system32\DRIVERS\redbook.sys
18:24:07.0031 3960 redbook - ok
18:24:07.0156 3960 RT73 (c7bcf9808e2a1b4cabe16ff7fbce5fab) C:\WINDOWS\system32\DRIVERS\Dr71WU.sys
18:24:07.0171 3960 RT73 - ok
18:24:07.0250 3960 SASDIFSV (39763504067962108505bff25f024345) C:\Programmi\SUPERAntiSpyware\SASDIFSV.SYS
18:24:07.0250 3960 SASDIFSV - ok
18:24:07.0281 3960 SASKUTIL (77b9fc20084b48408ad3e87570eb4a85) C:\Programmi\SUPERAntiSpyware\SASKUTIL.SYS
18:24:07.0281 3960 SASKUTIL - ok
18:24:07.0328 3960 SbieDrv (2b12749cc05f32d217735770d2eeabe3) C:\Programmi\Sandboxie\SbieDrv.sys
18:24:07.0328 3960 SbieDrv - ok
18:24:07.0453 3960 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
18:24:07.0453 3960 Secdrv - ok
18:24:07.0515 3960 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
18:24:07.0515 3960 serenum - ok
18:24:07.0578 3960 Serial (fdbd9d64e2e03270021d424f0dccf79d) C:\WINDOWS\system32\DRIVERS\serial.sys
18:24:07.0578 3960 Serial - ok
18:24:07.0656 3960 setup_9.0.0.722_22.05.2011_10-14drv (bebd4b6aa84d977b997587897342816c) C:\WINDOWS\system32\DRIVERS\4444921.sys
18:24:07.0656 3960 setup_9.0.0.722_22.05.2011_10-14drv - ok
18:24:07.0750 3960 setup_9.0.0.722_26.05.2011_14-12drv (bebd4b6aa84d977b997587897342816c) C:\WINDOWS\system32\DRIVERS\2767017.sys
18:24:07.0750 3960 setup_9.0.0.722_26.05.2011_14-12drv - ok
18:24:07.0843 3960 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
18:24:07.0843 3960 Sfloppy - ok
18:24:07.0906 3960 Simbad - ok
18:24:08.0000 3960 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
18:24:08.0000 3960 SLIP - ok
18:24:08.0062 3960 SmartDefragDriver (972dea0d8149d73c5b7a2c97b2e749e3) C:\WINDOWS\system32\Drivers\SmartDefragDriver.sys
18:24:08.0062 3960 SmartDefragDriver - ok
18:24:08.0093 3960 Sparrow - ok
18:24:08.0125 3960 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
18:24:08.0125 3960 splitter - ok
18:24:08.0203 3960 sr (618718cae288bf7cbd8fcbab2577d932) C:\WINDOWS\system32\DRIVERS\sr.sys
18:24:08.0203 3960 sr - ok
18:24:08.0296 3960 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
18:24:08.0296 3960 Srv - ok
18:24:08.0406 3960 ssmdrv (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
18:24:08.0406 3960 ssmdrv - ok
18:24:08.0453 3960 StarOpen (f92254b0bcfcd10caac7bccc7cb7f467) C:\WINDOWS\system32\drivers\StarOpen.sys
18:24:08.0453 3960 StarOpen - ok
18:24:08.0531 3960 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
18:24:08.0531 3960 streamip - ok
18:24:08.0593 3960 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
18:24:08.0593 3960 swenum - ok
18:24:08.0656 3960 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
18:24:08.0656 3960 swmidi - ok
18:24:08.0687 3960 symc810 - ok
18:24:08.0703 3960 symc8xx - ok
18:24:08.0718 3960 sym_hi - ok
18:24:08.0734 3960 sym_u3 - ok
18:24:08.0781 3960 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
18:24:08.0781 3960 sysaudio - ok
18:24:08.0890 3960 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
18:24:08.0890 3960 Tcpip - ok
18:24:09.0015 3960 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
18:24:09.0015 3960 TDPIPE - ok
18:24:09.0078 3960 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
18:24:09.0078 3960 TDTCP - ok
18:24:09.0140 3960 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
18:24:09.0156 3960 TermDD - ok
18:24:09.0187 3960 TosIde - ok
18:24:09.0250 3960 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
18:24:09.0250 3960 Udfs - ok
18:24:09.0312 3960 ultra - ok
18:24:09.0375 3960 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
18:24:09.0390 3960 Update - ok
18:24:09.0468 3960 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
18:24:09.0484 3960 usbaudio - ok
18:24:09.0531 3960 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
18:24:09.0531 3960 usbccgp - ok
18:24:09.0593 3960 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
18:24:09.0593 3960 usbehci - ok
18:24:09.0656 3960 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
18:24:09.0656 3960 usbhub - ok
18:24:09.0718 3960 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys
18:24:09.0734 3960 usbohci - ok
18:24:09.0796 3960 usbstor (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
18:24:09.0796 3960 usbstor - ok
18:24:09.0859 3960 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
18:24:09.0859 3960 VgaSave - ok
18:24:09.0906 3960 ViaIde - ok
18:24:09.0953 3960 VolSnap (e46c1b5a56da7da603d09dfcc79ec59e) C:\WINDOWS\system32\drivers\VolSnap.sys
18:24:09.0953 3960 VolSnap - ok
18:24:10.0031 3960 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
18:24:10.0031 3960 Wanarp - ok
18:24:10.0062 3960 WDICA - ok
18:24:10.0109 3960 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
18:24:10.0109 3960 wdmaud - ok
18:24:10.0234 3960 winachsf (ac89b0fd546d430cc784aee928ba108e) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys
18:24:10.0250 3960 winachsf - ok
18:24:10.0375 3960 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
18:24:10.0375 3960 WpdUsb - ok
18:24:10.0437 3960 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
18:24:10.0437 3960 WS2IFSL - ok
18:24:10.0515 3960 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
18:24:10.0515 3960 WSTCODEC - ok
18:24:10.0578 3960 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
18:24:10.0578 3960 WudfPf - ok
18:24:10.0640 3960 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
18:24:10.0640 3960 WudfRd - ok
18:24:10.0687 3960 MBR (0x1B8) (828e02d5c4a4fbe53441ee9dbee51f43) \Device\Harddisk0\DR0
18:24:10.0750 3960 \Device\Harddisk0\DR0 - ok
18:24:10.0765 3960 Boot (0x1200) (bd1ea0bd47153fa77efc8302847e26c4) \Device\Harddisk0\DR0\Partition0
18:24:10.0765 3960 \Device\Harddisk0\DR0\Partition0 - ok
18:24:10.0765 3960 ============================================================
18:24:10.0765 3960 Scan finished
18:24:10.0765 3960 ============================================================
18:24:10.0781 3968 Detected object count: 0
18:24:10.0781 3968 Actual detected object count: 0
18:26:31.0437 1668 Deinitialize success

:

[mitrha]

Questo è il log di AVENGER:

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Folder "C:\Documents and Settings\All Users\Dati applicazioni\MFAData" deleted successfully.
Folder "C:\Documents and Settings\Manuel Valori.E774BAE2\Dati applicazioni\Mael" deleted successfully.
File move operation "C:\Windows\System32\drivers\3815528.sys|C:\Documents and Settings\Manuel Valori.E774BAE2\Desktop\driver.sys" completed successfully.
File move operation "C:\Windows\System32\drivers\38155281.sys|C:\Documents and Settings\Manuel Valori.E774BAE2\Desktop\driver1.sys" completed successfully.
File move operation "C:\Windows\System32\drivers\38155282.sys|C:\Documents and Settings\Manuel Valori.E774BAE2\Desktop\driver2.sys" completed successfully.
File move operation "C:\Windows\System32\drivers\4444921.sys|C:\Documents and Settings\Manuel Valori.E774BAE2\Desktop\driver3.sys" completed successfully.
File move operation "C:\Windows\System32\drivers\44449211.sys|C:\Documents and Settings\Manuel Valori.E774BAE2\Desktop\driver3.sys" completed successfully.
File move operation "C:\Windows\System32\drivers\44449212.sys|C:\Documents and Settings\Manuel Valori.E774BAE2\Desktop\driver4.sys" completed successfully.

Completed script processing.

*******************

Finished! Terminate.

Appena si è riavviato mi è apparso un messaggio:"alcuni file sono in attesa di essere scritti su disco",poi mi si è aperta una finestra di:nuova cartella.Sul deckstop sono comparsi alcuni file,li ho aperti e salvato come.txt:

General
Complete name : C:\Documents and Settings\ManuelValori.E774BAE2\Desktop\driver.sys
Format : MZ
Format profile : Executable / Intel i386
File size : 308 KiB
Encoded date : UTC 2009-10-09 19:27:18
Driver4.sys
Descrizione:Kaspersky Lab Boot Guard Driver
Società:KasperskyLab
Version:9.1.0.0

[mitrha]

un'altro è:
Driver3.sys
Descrizione:Kaspersky Unified Driver
Società:KasperskyLab
Vers:6.4.0.11

General
Complete name : C:\Documents and Settings\Manuel Valori.E774BAE2\Desktop\driver3.sys
Format : MZ
Format profile : Executable / Intel i386
File size : 125 KiB
Encoded date : UTC 2009-09-25 13:59:00

Poi c'è:
Driver2.sys
Kaspersky Lab Boot Driver
Societò:KasperskyLab
Vers:9.1.0.0

General
Complete name : C:\Documents and Settings\Manuel Valori.E774BAE2\Desktop\driver3.sys
Format : MZ
Format profile : Executable / Intel i386
File size : 125 KiB
Encoded date : UTC 2009-09-25 13:59:00

Driver1.sys,senza nessun titolo:

General
Complete name : C:\Documents and Settings\Manuel Valori.E774BAE2\Desktop\driver1.sys
Format : MZ
Format profile : Executable / Intel i386
File size : 125 KiB
Encoded date : UTC 2009-09-25 13:59:00

e un'altro senza titolo:Driver.sys

General
Complete name : C:\Documents and Settings\Manuel Valori.E774BAE2\Desktop\driver.sys
Format : MZ
Format profile : Executable / Intel i386
File size : 308 KiB
Encoded date : UTC 2009-10-09 19:27:18

[hashcat]

Hai già "dato in pasto" ad OTL il fix riportato nel mio post precedente? Aspetto l'esito di Virustotal.

[mitrha]

Ecco il log di OTL:

All processes killed
========== OTL ==========
ADS C:\Documents and Settings\All Users\Dati applicazioni\Microsoft:tUt8dKrRGClr3yEF9iH5Es0U4P deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temporary Internet Files folder emptied: 67 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Fabio
->Temp folder emptied: 1201 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 65984 bytes
->Temporary Internet Files folder emptied: 32969 bytes

User: Manuel Valori.E774BAE2
->Temp folder emptied: 9678119 bytes
->Temporary Internet Files folder emptied: 1099598 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 114432264 bytes
->Flash cache emptied: 566 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 131072 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 120.00 mb

Restore points cleared and new OTL Restore Point set!

OTL by OldTimer - Version 3.2.31.0 log created on 11022011_132758

Files\Folders moved on Reboot...
File\Folder C:\WINDOWS\temp\usgthrsvc\Perflib_Perfdata_154.dat not found!

Registry entries deleted on Reboot...

[mitrha]

Il primo File 3201196...è del servizio fax di faxator da allegare alle e-mail per spedire fax.
Il secondo :fusioncache.dat nn lo trovo.
Ecco gli altri:
http://imageshack.us/photo/my-images/7/assezd.jpg/ è pulito ma risulta una controversia ,come il driver4
http://imageshack.us/photo/my-images/85 ... r1sys.jpg/
http://imageshack.us/photo/my-images/40 ... r2sys.jpg/ pulito
http://imageshack.us/photo/my-images/33 ... r3sys.jpg/ pulito
http://imageshack.us/photo/my-images/641/driver4k.jpg/ c'è una controversia ma risulta pulito (2ok,2malware)
http://imageshack.us/photo/my-images/25 ... ersys.jpg/ McAfee lo rileva

[hashcat]

I driver che ora cancellerai sono tutti inerenti a Kaspersky TDSSKiller, non rappresentano un rischio per il computer ma sono inutili.

In ogni caso salva i files driver.sys presenti sul Desktop su di una pennetta (potrebbero servire in caso di problemi).

Mediante The Avenger 2 impartisci il seguente script:

Codice: Seleziona tutto

Drivers to delete:
38155281

Registry keys to delete:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_38155281
HKEY_LOCAL_MACHINE\System\ControlSet002\Enum\Root\LEGACY_38155281
HKEY_LOCAL_MACHINE\System\ControlSet003\Enum\Root\LEGACY_38155281
HKEY_LOCAL_MACHINE\System\ControlSet004\Enum\Root\LEGACY_38155281

Files to delete:
C:\WINDOWS\system32\DRIVERS\27670171.sys
C:\WINDOWS\system32\DRIVERS\27670172.sys
C:\WINDOWS\system32\DRIVERS\38155281.sys
C:\WINDOWS\system32\DRIVERS\38155282.sys
C:\WINDOWS\system32\DRIVERS\44449211.sys
C:\WINDOWS\system32\DRIVERS\44449212.sys

Folders to delete:
C:\Qoobox

*********************************************************************************************************************************************************************************************

Procedura Opzionale (consigliata):

Aggiorna i seguenti programmi:

Sandboxie 3.54 >> Sandboxie 3.60
Java(TM) 6 Update 22 >> Java(TM) 6 Update 29
Screenshot Captor 2.96.02 >> Screenshot Captor 2.102.01
Shockwave Player

Sostituisci questi programmi installati (con quelli consigliati):

OpenOffice.org 3.3 con LibreOffice 3.4.3

Adobe Reader X (10.1.1) con SumatraPDF 1.8

Rimuovi i seguenti programmi:

Spybot - Search & Destroy
AdWare

*********************************************************************************************************************************************************************************************

Dopo aver seguito o meno i passaggi opzionali apri OTL e clicca sul bottone CleanUp. In questo modo verranno rimossi tutti gli strumenti di pulizia ed analisi utilizzati.

Se hai seguito tutti questi passaggi abbiamo finito, non sembrano essere presenti ulteriori infezioni o tracce.

Se riscontri ulteriori problemi continua qui

[mitrha]

Volevo chiederti un consiglio,nel disistallare Adobe Reader x(10.1.1) tolgo anche tutti gli altri componenti Adobe tipo AdobeFlash Player 10 Activex e Adobe Flash Player 11 plugin?

[hashcat]

Disinstalla solo Adobe Reader, controlla se sono presenti aggiornamenti per Flash Player

[mitrha]

Tutto fatto.
Grazie davvero per il tuo aiuto.