MegaLab.it

ComboFix 09-08-24.06 - PC 14/09/2009 13.33.38.1.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.39.1040.18.255.107 [GMT 2:00]
Eseguito da: c:\documents and settings\PC\Desktop\ComboFix.exe
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: Online Armor Firewall *disabled* {B797DAA0-7E2E-4711-8BB3-D12744F1922A}

ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.
- MODALITÀ CON FUNZIONALITÀ RIDOTTE -
.

((((((((((((((((((((((((( Files Creati Da 2009-08-14 al 2009-09-14 )))))))))))))))))))))))))))))))))))
.

2009-09-13 16:15 . 2009-09-13 16:15 -------- d-s---w- c:\documents and settings\PC\UserData
2009-09-13 16:03 . 2009-09-13 16:03 -------- d-----w- c:\documents and settings\PC\Dati applicazioni\FSL
2009-09-13 16:03 . 2009-09-13 16:03 76512 ----a-w- c:\documents and settings\PC\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2009-09-13 16:01 . 2009-09-13 16:01 -------- d-----w- c:\programmi\FSL
2009-09-13 12:06 . 2007-05-24 17:27 -------- d--h--w- c:\documents and settings\PC\Risorse di stampa
2009-09-13 12:06 . 2007-05-24 17:27 -------- d--h--w- c:\documents and settings\PC\Risorse di rete
2009-09-13 12:06 . 2007-05-24 17:27 -------- d-----r- c:\documents and settings\PC\Menu Avvio
2009-09-13 12:06 . 2007-05-24 15:53 -------- d--h--w- c:\documents and settings\PC\Modelli
2009-09-12 22:47 . 2009-09-12 22:47 -------- d-----w- c:\programmi\ESET
2009-09-12 22:47 . 2009-09-12 22:47 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\ESET
2009-09-12 22:05 . 2009-09-12 22:06 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\avg8
2009-09-12 21:51 . 2009-09-12 21:51 -------- d-----w- C:\AVGTemp
2009-09-12 19:47 . 2009-09-12 19:47 -------- d-----w- C:\Nuova cartella
2009-09-12 19:32 . 2009-09-12 19:32 -------- d-----w- c:\programmi\Black List Software
2009-09-12 18:08 . 2009-09-13 12:02 -------- d-----w- c:\documents and settings\ADMIN\Dati applicazioni\Comodo
2009-09-12 18:07 . 2009-09-12 18:07 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Comodo
2009-09-12 18:07 . 2009-09-13 12:38 -------- d-----w- c:\programmi\COMODO
2009-09-12 17:48 . 2009-09-12 17:54 -------- d-----w- C:\FindyKill
2009-09-10 16:37 . 2009-09-10 16:37 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\SUPERAntiSpyware.com
2009-09-10 16:37 . 2009-09-12 17:46 -------- d-----w- c:\documents and settings\ADMIN\Dati applicazioni\SUPERAntiSpyware.com
2009-09-10 16:37 . 2009-09-12 17:44 -------- d-----w- c:\programmi\SUPERAntiSpyware
2009-09-07 20:32 . 2009-09-07 22:45 -------- d-----w- c:\documents and settings\ADMIN\DoctorWeb
2009-09-07 18:29 . 2009-09-09 16:19 -------- d-----w- c:\programmi\Sophos
2009-09-06 18:04 . 2009-09-06 18:04 -------- d-----w- c:\documents and settings\LocalService\Dati applicazioni\ArcaBit
2009-09-06 16:55 . 2009-09-06 16:55 -------- d-----w- c:\documents and settings\ADMIN\Dati applicazioni\Simply Super Software
2009-09-03 23:49 . 2009-09-03 23:49 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Kaspersky Lab
2009-09-03 21:45 . 2008-12-11 06:38 159600 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
2009-09-03 21:45 . 2009-08-24 12:05 206256 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2009-09-03 21:45 . 2009-08-19 09:01 86888 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2009-09-03 21:44 . 2009-09-03 21:44 -------- d-----w- c:\programmi\File comuni\PC Tools
2009-09-03 21:44 . 2008-12-10 09:36 64392 ----a-w- c:\windows\system32\drivers\pctplsg.sys
2009-09-03 21:44 . 2009-09-13 12:40 -------- d-----w- c:\programmi\Spyware Doctor
2009-09-03 21:44 . 2009-09-03 21:44 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\PC Tools
2009-09-03 21:44 . 2009-09-03 21:44 -------- d-----w- c:\documents and settings\Administrator\Dati applicazioni\PC Tools
2009-09-03 21:44 . 2009-09-14 11:27 -------- d---a-w- c:\documents and settings\All Users\Dati applicazioni\TEMP
2009-09-03 20:51 . 2009-09-12 17:44 -------- d-----w- c:\programmi\File comuni\Wise Installation Wizard
2009-09-03 20:06 . 2009-09-03 20:06 -------- d-----w- c:\documents and settings\ADMIN\Dati applicazioni\Malwarebytes
2009-09-03 19:17 . 2009-09-03 19:17 -------- d-----w- c:\documents and settings\Administrator\Dati applicazioni\Malwarebytes
2009-09-03 19:17 . 2008-12-03 17:52 15504 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-03 19:17 . 2008-12-03 17:52 38496 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-03 19:17 . 2009-09-03 19:17 -------- d-----w- c:\programmi\Malwarebytes' Anti-Malware
2009-09-03 19:17 . 2009-09-03 19:17 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Malwarebytes
2009-09-03 19:04 . 2009-09-07 17:14 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\OnlineArmor
2009-09-03 19:04 . 2009-09-03 19:04 -------- d-----w- c:\documents and settings\ADMIN\Dati applicazioni\OnlineArmor
2009-09-03 18:38 . 2009-07-11 03:59 29776 ----a-w- c:\windows\system32\drivers\OAnet.sys
2009-09-03 18:38 . 2009-07-11 03:17 24656 ----a-w- c:\windows\system32\drivers\OAmon.sys
2009-09-03 18:38 . 2009-07-11 03:17 200784 ----a-w- c:\windows\system32\drivers\OADriver.sys
2009-09-03 18:38 . 2009-09-03 18:38 -------- d-----w- c:\programmi\Tall Emu
2009-09-03 18:36 . 2009-09-03 19:00 -------- d-----w- c:\programmi\a-squared Free

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-13 12:40 . 2009-09-13 12:07 -------- d-----w- c:\documents and settings\PC\Dati applicazioni\OnlineArmor
2009-09-13 12:04 . 2008-02-08 15:26 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Lavasoft
2009-09-13 12:04 . 2008-02-08 15:26 -------- d-----w- c:\programmi\Lavasoft
2009-09-12 19:30 . 2004-08-19 12:00 73024 ----a-w- c:\windows\system32\perfc010.dat
2009-09-12 19:30 . 2004-08-19 12:00 444444 ----a-w- c:\windows\system32\perfh010.dat
2009-09-12 08:28 . 2008-12-01 22:12 -------- d-----w- c:\programmi\Yahoo!
2009-09-12 08:24 . 2008-08-22 11:10 -------- d-----w- c:\programmi\Google
2009-09-10 16:09 . 2008-11-04 18:28 -------- d-----w- c:\programmi\Windows Live
2009-09-06 16:59 . 2008-11-26 18:24 1632 ----a-w- c:\windows\system32\d3d8caps.dat
2009-08-26 15:23 . 2007-09-06 10:17 1744 ----a-w- c:\windows\system32\d3d9caps.dat
2009-08-25 17:23 . 2008-11-04 18:34 -------- d-----w- c:\programmi\Windows Live Toolbar
2009-08-24 13:18 . 2007-07-22 20:36 -------- d-----w- c:\documents and settings\ADMIN\Dati applicazioni\uTorrent
2009-08-22 07:14 . 2009-02-01 12:00 -------- d-----w- c:\programmi\eMule
2009-08-14 04:58 . 2009-09-03 21:45 7396 ----a-w- c:\windows\system32\drivers\pctcore.cat
2009-08-06 08:52 . 2008-07-30 17:11 20 ---h--w- c:\documents and settings\All Users\Dati applicazioni\PKP_DLdw.DAT
2009-08-06 08:51 . 2008-07-30 17:09 20 ---h--w- c:\documents and settings\All Users\Dati applicazioni\PKP_DLdu.DAT
2009-08-05 09:05 . 2004-08-19 12:00 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-27 13:04 . 2009-05-18 16:09 -------- d-----w- c:\programmi\Metin2_Italiano
2009-07-17 18:56 . 2004-08-19 12:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-13 21:43 . 2004-08-19 12:00 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-06-26 16:17 . 2004-08-19 12:00 662016 ----a-w- c:\windows\system32\wininet.dll
2009-06-26 16:16 . 2004-08-19 12:00 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-06-25 18:34 . 2004-08-19 12:00 95744 ----a-w- c:\windows\system32\mqsec.dll
2009-06-25 18:34 . 2004-08-19 12:00 519168 ----a-w- c:\windows\system32\mqutil.dll
2009-06-25 18:34 . 2004-08-19 12:00 517120 ----a-w- c:\windows\system32\mqsnap.dll
2009-06-25 18:34 . 2004-08-19 12:00 48640 ----a-w- c:\windows\system32\mqupgrd.dll
2009-06-25 18:34 . 2004-08-19 12:00 186880 ----a-w- c:\windows\system32\mqtrig.dll
2009-06-25 18:34 . 2004-08-19 12:00 123392 ----a-w- c:\windows\system32\mqrtdep.dll
2009-06-25 18:34 . 2004-08-19 12:00 661504 ----a-w- c:\windows\system32\mqqm.dll
2009-06-25 18:34 . 2004-08-19 12:00 47104 ----a-w- c:\windows\system32\mqdscli.dll
2009-06-25 18:34 . 2004-08-19 12:00 225280 ----a-w- c:\windows\system32\mqoa.dll
2009-06-25 18:34 . 2004-08-19 12:00 177152 ----a-w- c:\windows\system32\mqrt.dll
2009-06-25 18:34 . 2004-08-19 12:00 16896 ----a-w- c:\windows\system32\mqise.dll
2009-06-25 18:34 . 2004-08-19 12:00 138240 ----a-w- c:\windows\system32\mqad.dll
2009-06-22 11:49 . 2004-08-19 12:00 19968 ----a-w- c:\windows\system32\mqbkup.exe
2009-06-22 11:49 . 2004-08-19 12:00 117248 ----a-w- c:\windows\system32\mqtgsvc.exe
2009-06-22 11:49 . 2004-08-19 12:00 4608 ----a-w- c:\windows\system32\mqsvc.exe
2009-06-22 11:48 . 2004-08-19 12:00 91776 ----a-w- c:\windows\system32\drivers\mqac.sys
2009-06-16 14:53 . 2004-08-19 12:00 82432 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:53 . 2004-08-19 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2008-01-30 12:27 . 2007-12-23 10:49 123788 --sha-w- c:\windows\system32\ehggh.ini2
2007-09-22 09:51 . 2007-09-22 09:51 6440 --sha-w- c:\windows\system32\fffhk.bak1
2007-09-23 14:38 . 2007-09-23 14:38 6754 --sha-w- c:\windows\system32\fffhk.bak2
2007-10-03 21:46 . 2007-10-03 21:46 6363 --sha-w- c:\windows\system32\llnpo.bak1
2007-10-06 08:08 . 2007-10-04 14:15 18298 --sha-w- c:\windows\system32\llnpo.bak2
2007-09-20 07:05 . 2007-09-20 07:05 6440 --sha-w- c:\windows\system32\rtvyb.bak1
2007-09-26 06:02 . 2007-09-23 16:34 6480 --sha-w- c:\windows\system32\rtvyb.bak2
2007-09-19 16:01 . 2007-09-19 16:01 6480 --sha-w- c:\windows\system32\twxbc.bak1
2007-09-19 06:20 . 2007-09-18 16:40 6801 --sha-w- c:\windows\system32\vuvwa.bak2
.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-05-25 10:27 . 2007-05-25 10:27 416256 c:\programmi\Grisoft\AVG7\bak\avgcc.exe

2007-06-03 17:55 . 2007-06-03 17:55 98304 c:\programmi\QuickTime\bak\qttask.exe
2007-06-29 04:24 . 2007-06-29 04:24 286720 c:\programmi\QuickTime\QTTask.exe

2004-08-19 12:00 . 2004-08-19 12:00 15360 c:\windows\system32\bak\ctfmon.exe
2004-08-19 12:00 . 2004-08-19 12:00 15360 c:\windows\system32\ctfmon.exe

.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\programmi\QuickTime\QTTask.exe" [2007-06-29 286720]
"SpeedTouch USB Diagnostics"="c:\programmi\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 866816]
"RemoteControl"="c:\programmi\CyberLink\PowerDVD\PDVDServ.exe" [2007-02-07 71216]
"LanguageShortcut"="c:\programmi\CyberLink\PowerDVD\Language\Language.exe" [2007-02-07 54832]
"PWRISOVM.EXE"="c:\programmi\PowerISO\PWRISOVM.EXE" [2007-04-09 200704]
"avgnt"="c:\programmi\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-19 266497]
"CanonSolutionMenu"="c:\programmi\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 644696]
"CanonMyPrinter"="c:\programmi\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 1603152]
"SSBkgdUpdate"="c:\programmi\File comuni\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"OpwareSE4"="c:\programmi\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400]
"@OnlineArmor GUI"="c:\programmi\Tall Emu\Online Armor\OAui.exe" [2009-07-11 2121416]
"ISTray"="c:\programmi\Spyware Doctor\pctsTray.exe" [2009-07-22 1181064]
"COMODO Internet Security"="c:\programmi\COMODO\COMODO Internet Security\cfp.exe" [N/A]
"egui"="c:\programmi\ESET\ESET NOD32 Antivirus\egui.exe" [2008-10-08 1451264]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{4F07DA45-8170-4859-9B5F-037EF2970034}"= "c:\progra~1\TALLEM~1\ONLINE~1\oaevent.dll" [2009-07-11 336584]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\utorrent\\utorrent.exe"=
"c:\\Programmi\\CyberLink\\PowerDVD\\PowerDVD.exe"=
"c:\\Programmi\\eMule\\emule.exe"=
"c:\\Programmi\\Messenger\\msmsgs.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"50000:TCP"= 50000:TCP:ArcaVir CommunicationPort (A)
"50001:TCP"= 50001:TCP:ArcaVir CommunicationPort (S)

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [03/09/2009 23.45.04 206256]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [08/10/2008 8.50.14 34312]
R1 OADevice;OADriver;c:\windows\system32\drivers\OADriver.sys [03/09/2009 20.38.24 200784]
R1 OAmon;OAmon;c:\windows\system32\drivers\OAmon.sys [03/09/2009 20.38.24 24656]
R1 OAnet;OAnet;c:\windows\system32\drivers\OAnet.sys [03/09/2009 20.38.24 29776]
R2 ekrn;Eset Service;c:\programmi\ESET\ESET NOD32 Antivirus\ekrn.exe [08/10/2008 8.47.58 468224]
R2 OAcat;Online Armor Helper Service;c:\programmi\Tall Emu\Online Armor\oacat.exe [03/09/2009 20.38.23 362184]
R2 sdAuxService;PC Tools Auxiliary Service;c:\programmi\Spyware Doctor\pctsAuxs.exe [03/09/2009 23.44.41 348752]
R2 SvcOnlineArmor;Online Armor;c:\programmi\Tall Emu\Online Armor\oasrv.exe [03/09/2009 20.38.23 3142344]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys c:\windows\system32\DRIVERS\cmdguard.sys
S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys c:\windows\system32\DRIVERS\cmdhlp.sys
S2 AVTasks2;ArcaBit Tasks Service;c:\progra~1\ArcaBit\Common\ARCATA~1.EXE c:\progra~1\ArcaBit\Common\ARCATA~1.EXE
S3 009A;009A;\??\c:\windows\system32\009A.sys c:\windows\system32\009A.sys
S3 2cc6;2cc6;\??\c:\windows\system32\2cc6.sys c:\windows\system32\2cc6.sys
S3 46c8;46c8;\??\c:\windows\system32\46c8.sys c:\windows\system32\46c8.sys
S3 95f4;95f4;\??\c:\windows\system32\95f4.sys c:\windows\system32\95f4.sys
S3 97c3;97c3;\??\c:\windows\system32\97c3.sys c:\windows\system32\97c3.sys
S3 c067;c067;\??\c:\windows\system32\c067.sys c:\windows\system32\c067.sys
S3 caaC;caaC;\??\c:\windows\system32\caaC.sys c:\windows\system32\caaC.sys
S3 e552;e552;\??\c:\windows\system32\e552.sys c:\windows\system32\e552.sys
S3 fecB;fecB;\??\c:\windows\system32\fecB.sys c:\windows\system32\fecB.sys
S3 phaudlwr;Philips Audio Filter;c:\windows\system32\drivers\phaudlwr.sys [29/11/2008 22.41.25 88704]
S3 SPC530;Philips SPC530NC PC Camera;c:\windows\system32\drivers\SPC530.sys [29/11/2008 22.45.33 486912]
S3 SPC530m;Philips SPC530NC PC Cameram;c:\windows\system32\drivers\SPC530m.sys [29/11/2008 22.45.33 7680]
S4 assert update;assert update;c:\windows\system32\wildday.exe c:\windows\system32\wildday.exe
.
Contenuto della cartella 'Scheduled Tasks'

2009-09-12 c:\windows\Tasks\OGADaily.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 16:04]

2009-09-14 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 16:04]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: {{40525A66-DB98-480D-BCF9-7AF88C1AF438} - {40525A66-DB98-480D-BCF9-7AF88C1AF438} - c:\programmi\ArcaBit\WebExtensions\ie\ArcaIEExt.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-14 13:35
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
"ImagePath"="\??\c:\programmi\CyberLink\PowerDVD\000.fcl"
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•Ñw*]
"0140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------

- - - - - - - > 'explorer.exe'(492)
c:\programmi\Tall Emu\Online Armor\OAwatch.dll
c:\programmi\ESET\ESET NOD32 Antivirus\eplgHooks.dll
c:\programmi\ScanSoft\OmniPageSE4\OpHookSE4.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Ora fine scansione: 2009-09-14 13.41.48
ComboFix-quarantined-files.txt 2009-09-14 11:41

Pre-Run: 71.920.852.992 byte disponibili
Post-Run: 75.704.512.512 byte disponibili

232