ComboFix 08-11-04.02 - Proprietario 2008-11-05 21:51:37.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1040.18.1646 [GMT 1:00]
Eseguito da: c:\documents and settings\Proprietario\Desktop\hughes.exe
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\programmi\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
c:\programmi\HP\Digital Imaging\bin\backupnotify.exe
c:\windows\Downloaded Program Files\setup.inf
c:\windows\system32\dao350.dll
.
((((((((((((((((((((((((( Files Creati Da 2008-10-05 al 2008-11-05 )))))))))))))))))))))))))))))))))))
.
2008-11-05 20:44 . 2008-11-05 20:44 <DIR> d-------- C:\pincopallino
2008-11-04 22:38 . 2008-11-05 21:50 <DIR> d-------- c:\programmi\FindyKill
2008-10-25 16:19 . 2008-10-25 16:19 <DIR> d-------- c:\programmi\Seagate
2008-10-24 12:32 . 2008-10-15 17:36 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll
2008-10-24 11:51 . 2008-10-24 11:51 <DIR> d-------- c:\windows\Gary Grigsby's World at War A World Divided
2008-10-23 23:20 . 2008-10-23 23:20 <DIR> d-------- c:\documents and settings\Proprietario\Dati applicazioni\Malwarebytes
2008-10-23 23:19 . 2008-10-23 23:21 <DIR> d-------- c:\programmi\Malwarebytes' Anti-Malware
2008-10-23 23:19 . 2008-10-23 23:19 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\Malwarebytes
2008-10-23 23:19 . 2008-10-22 15:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-10-23 23:19 . 2008-10-22 15:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-10-15 19:00 . 2008-09-08 11:41 333,824 -----c--- c:\windows\system32\dllcache\srv.sys
2008-10-15 18:58 . 2008-08-14 14:22 2,192,896 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2008-10-15 18:58 . 2008-08-14 14:22 2,148,864 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-10-15 18:58 . 2008-08-14 14:22 2,069,760 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-10-15 18:58 . 2008-08-14 14:22 2,027,520 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
2008-10-15 18:58 . 2008-09-15 16:24 1,846,400 -----c--- c:\windows\system32\dllcache\win32k.sys
2008-10-12 23:01 . 2008-10-12 23:01 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\nView_Profiles
2008-10-12 22:58 . 2008-04-30 16:27 442,368 --a------ c:\windows\system32\NVUNINST.EXE
2008-10-12 22:57 . 2008-10-12 22:57 <DIR> d-------- C:\NVIDIA
2008-10-12 22:57 . 2003-12-05 19:50 1,007,616 --a------ c:\windows\system32\nviewimg.dll
2008-10-12 22:57 . 2008-05-03 04:46 442,368 --a------ c:\windows\system32\nvudisp.exe
2008-10-12 22:57 . 2008-05-03 04:46 18,070 --a------ c:\windows\system32\nvdisp.nvu
2008-10-12 14:27 . 2008-10-12 14:27 23,600 --a------ c:\windows\system32\drivers\TVICHW32.SYS
2008-10-12 08:54 . 2008-10-16 18:04 <DIR> d-------- c:\programmi\eMule AdunanzA
2008-10-12 08:54 . 2008-10-12 08:54 <DIR> d-------- c:\documents and settings\Proprietario\Dati applicazioni\eMule AdunanzA
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-05 20:46 --------- d-----w c:\documents and settings\LocalService\Dati applicazioni\VMware
2008-11-05 20:46 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\VMware
2008-11-05 20:45 3,189,056 --sha-w c:\windows\system32\drivers\fidbox.idx
2008-11-05 20:45 271,773,728 --sha-w c:\windows\system32\drivers\fidbox.dat
2008-11-02 15:17 32,768 ----a-w c:\windows\system32\instlsp.exe
2008-11-02 13:52 --------- d-----w c:\programmi\McAfee
2008-11-01 12:47 --------- d-----w c:\programmi\iArt
2008-10-29 23:08 --------- d-----w c:\documents and settings\LocalService\Dati applicazioni\SACore
2008-10-26 12:59 --------- d--h--w c:\programmi\InstallShield Installation Information
2008-10-09 14:50 --------- d-----w c:\documents and settings\Proprietario\Dati applicazioni\VMware
2008-10-03 07:01 --------- d-----w c:\programmi\iTunes
2008-10-03 07:01 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-03 07:00 --------- d-----w c:\programmi\iPod
2008-10-03 05:37 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\SiteAdvisor
2008-10-01 19:14 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\McAfee
2008-10-01 11:01 32,000 ----a-w c:\windows\system32\drivers\usbaapl.sys
2008-09-27 11:06 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\NOS
2008-09-26 17:04 --------- d-----w c:\programmi\File comuni\Adobe
2008-09-19 18:55 --------- d-----w c:\programmi\FCM
2008-09-19 18:20 --------- d-----w c:\programmi\File comuni\ACD Systems
2008-09-19 18:20 --------- d-----w c:\documents and settings\Proprietario\Dati applicazioni\ACD Systems
2008-09-19 18:19 --------- d-----w c:\programmi\ACD Systems
2008-09-19 18:19 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\ACD Systems
2008-09-17 18:48 --------- d-----w c:\programmi\Trillian
2008-09-15 15:24 1,846,400 ----a-w c:\windows\system32\win32k.sys
2008-09-13 15:02 --------- d-----w c:\programmi\BreezeSys
2008-09-12 06:57 --------- d-----w c:\programmi\QuickTime
2008-09-12 06:57 --------- d-----w c:\programmi\Bonjour
2008-09-12 06:56 --------- d-----w c:\programmi\File comuni\Apple
2008-09-09 18:09 --------- d-----w c:\programmi\File comuni\VMware
2008-09-08 10:41 333,824 ----a-w c:\windows\system32\drivers\srv.sys
2008-09-07 17:11 --------- d-----w c:\programmi\PoigpsGo
2008-09-06 13:48 --------- d-----w c:\programmi\Realtek
2008-09-06 13:47 --------- d-----w c:\documents and settings\Proprietario\Dati applicazioni\InstallShield
2008-08-29 08:18 87,336 ----a-w c:\windows\system32\dns-sd.exe
2008-08-29 07:53 61,440 ----a-w c:\windows\system32\dnssd.dll
2008-08-26 07:57 826,368 ----a-w c:\windows\system32\wininet.dll
2008-08-25 14:10 748 ----a-w c:\programmi\rarycf.txt
2008-08-14 13:22 2,148,864 ----a-w c:\windows\system32\ntoskrnl.exe
2008-08-14 13:22 2,027,520 ----a-w c:\windows\system32\ntkrnlpa.exe
2008-08-08 14:26 436,784 ----a-w c:\windows\system32\vnetlib.dll
2008-08-08 14:26 121,392 ----a-w c:\windows\system32\vmnetdhcp.exe
2008-08-08 14:25 150,064 ----a-w c:\windows\system32\vmnat.exe
2008-08-08 13:49 50,992 ----a-r c:\windows\system32\vmnetbridge.dll
2008-08-08 13:49 13,104 ----a-r c:\windows\system32\vnetinst.dll
2008-08-08 13:14 219,696 ----a-w c:\windows\system32\vmnc.dll
2004-08-19 22:39 73,728 --sha-w c:\windows\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}$BACKUP$\System\wmplayer.exe
2008-05-09 12:54 32,768 --sha-w c:\windows\system32\config\systemprofile\Impostazioni locali\Cronologia\History.IE5\MSHist012008050920080510\index.dat
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"pdfSaver3"="c:\programmi\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe" [2004-09-05 380928]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\programmi\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"HPHmon05"="c:\windows\System32\hphmon05.exe" [2003-08-21 483328]
"UpdateManager"="c:\programmi\File comuni\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2003-11-03 221184]
"Sunkist2k"="c:\programmi\Multimedia Card Reader\shwicon2k.exe" [2003-10-29 135168]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]
"mcagent_exe"="c:\programmi\McAfee.com\Agent\mcagent.exe" [2008-11-05 641208]
"VMware hqtray"="e:\vmware player\hqtray.exe" [2008-08-08 55856]
"QuickTime Task"="c:\programmi\QuickTime\QTTask.exe" [2008-09-06 413696]
"AppleSyncNotifier"="c:\programmi\File comuni\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936]
"Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"DAEMON Tools"="c:\programmi\DAEMON Tools\daemon.exe" [2005-12-10 133016]
"iTunesHelper"="c:\programmi\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13529088]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-03 86016]
"AlcxMonitor"="ALCXMNTR.EXE" [2003-04-03 c:\windows\ALCXMNTR.EXE]
"emMON"="emMON.exe" [2006-05-30 c:\windows\emMON.exe]
"nwiz"="nwiz.exe" [2003-12-05 c:\windows\system32\nwiz.exe]
c:\documents and settings\Default User\Menu Avvio\Programmi\Esecuzione automatica\
AutoTBar.exe [2003-09-30 57344]
c:\documents and settings\Proprietario\Menu Avvio\Programmi\Esecuzione automatica\
Adobe Gamma.lnk - c:\programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"disableregistrytoosl"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.VDOM"= vdowave.drv
"VIDC.TR20"= tr2032.dll
"vidc.vivo"= ivvideo.dll
"VIDC.ACDV"= ACDV.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Programmi\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Programmi\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmi\\Mozilla Firefox\\firefox.exe"=
R1 is-QDCT3drv;is-QDCT3drv;c:\windows\system32\drivers\96573052.sys [2008-03-05 148496]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\programmi\McAfee\SiteAdvisor\McSACore.exe [2008-10-08 203280]
R3 USBSTOR;Driver archiviazione di massa USB;c:\windows\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 USB28xxBGA;USB 2861 Device;c:\windows\system32\DRIVERS\emBDA.sys [2006-09-12 292864]
S3 USB28xxOEM;USB 28xx OEM Filter;c:\windows\system32\DRIVERS\emOEM.sys [2006-08-21 7168]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4a551fe8-2d7a-11dc-8616-000ea6a2c009}]
\Shell\AutoRun\command - winPenPack.exe
*Newly Created Service* - PROCEXP90
.
Contenuto della cartella 'Scheduled Tasks'
2008-10-24 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programmi\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
2008-10-14 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-07-09 17:10]
2008-09-30 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-07-09 17:10]
2008-11-05 c:\windows\Tasks\User_Feed_Synchronization-{AC5494E1-71FE-4DBC-B542-8430A658A20A}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 11:58]
.
- - - - ORFÃOS REMOVIDOS - - - -
HKCU-Run-BackupNotify - c:\programmi\HP\Digital Imaging\bin\backupnotify.exe
HKCU-Run-Uniblue RegistryBooster 2009 - c:\programmi\Uniblue\RegistryBooster\RegistryBooster.exe
HKLM-Run-HPHUPD05 - c:\programmi\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
HKLM-Run-VTTimer - VTTimer.exe
HKLM-Run-NWEReboot - (no file)
HKLM-Run-pdfSaver3 - (no file)
HKLM-Run-AutoTBar - AUTOTBAR.EXE
.
------- Supplementare di scansione -------
.
FireFox -: Profile - c:\documents and settings\Proprietario\Dati applicazioni\Mozilla\Firefox\Profiles\2ykyvk6h.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE -
hxxp://it.blackle.com/FF -: plugin - c:\programmi\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - c:\programmi\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - c:\programmi\Mozilla Firefox\plugins\np_gp.dll
FF -: plugin - c:\programmi\Yahoo!\Common\npyaxmpb.dll
FF -: plugin - c:\programmi\Yahoo!\Shared\npYState.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-11-05 21:54:09
Windows 5.1.2600 Service Pack 3 NTFS
scansione processi nascosti ...
scansione entrate autostart nascoste ...
Scansione files nascosti ...
Scansione completata con successo
Files nascosti: 0
**************************************************************************
.
Ora fine scansione: 2008-11-05 21:56:20
ComboFix-quarantined-files.txt 2008-11-05 20:56:07
Pre-Run: 30,097,149,952 byte disponibili
Post-Run: 30,292,975,616 byte disponibili
197 --- E O F --- 2008-10-24 12:24:34