ComboFix 10-03-15.05 - Fabrizio 16/03/2010 14.11.22.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.39.1040.18.1015.689 [GMT 1:00]
Eseguito da: c:\documents and settings\Administrator.YOUR-XZN8F0GBL0\Desktop\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {7C925FAC-FBF8-7FFD-6830-250000000000}
AV: Norton Internet Security *On-access scanning disabled* (Outdated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
* Resident AV is active
ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\recycler\S-1-5-21-1644491937-963894560-515967899-1003
c:\windows\system32\Thumbs.db
La copia infetta di c:\windows\system32\drivers\iaStor.sys è stata trovata e disinfettata
ipristinata copia da - Kitty ate it :p
.
((((((((((((((((((((((((( Files Creati Da 2010-02-16 al 2010-03-16 )))))))))))))))))))))))))))))))))))
.
2010-03-16 12:05 . 2010-03-16 12:05 -------- d-----w- c:\documents and settings\Administrator.YOUR-XZN8F0GBL0\Dati applicazioni\U3
2010-03-16 10:08 . 2010-03-16 10:08 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Malwarebytes
2010-03-16 10:08 . 2010-01-07 14:17 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-16 09:55 . 2009-11-25 10:19 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-03-16 09:55 . 2009-03-30 08:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-03-16 09:55 . 2009-02-13 10:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-03-16 09:55 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2010-03-16 09:55 . 2010-03-16 09:55 -------- d-----w- c:\programmi\Avira
2010-03-16 09:55 . 2010-03-16 09:55 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Avira
2010-03-16 09:45 . 2010-03-16 09:45 -------- d-----w- c:\documents and settings\Administrator.YOUR-XZN8F0GBL0\Impostazioni locali\Dati applicazioni\Mozilla
2010-03-16 09:41 . 2010-03-16 09:41 -------- d-----w- c:\windows\system32\wbem\Repository
2010-03-16 09:40 . 2010-03-16 09:40 -------- d-----w- c:\programmi\Symantec
2010-03-16 09:40 . 2010-03-16 09:40 -------- d-----w- c:\windows\system32\drivers\NIS
2010-03-16 09:40 . 2010-03-16 09:40 -------- d-----w- c:\programmi\Windows Sidebar
2010-03-16 09:39 . 2010-03-16 09:40 -------- d-----w- c:\programmi\File comuni\Symantec Shared
2010-03-16 09:39 . 2010-03-16 09:40 -------- d-----w- c:\programmi\NortonInstaller
2010-03-16 09:33 . 2009-08-25 12:19 38760 ----a-w- c:\documents and settings\Administrator\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2010-03-16 09:33 . 2010-03-16 09:39 -------- d-----w- c:\documents and settings\Administrator\Preferiti
2010-03-16 09:33 . 2010-03-16 09:39 -------- d-----w- c:\documents and settings\Administrator\Modelli
2010-03-16 09:33 . 2010-03-16 09:39 -------- d-----w- c:\documents and settings\Administrator\Impostazioni locali\Dati applicazioni\Microsoft
2010-03-16 09:33 . 2010-03-16 09:39 -------- d-----w- c:\documents and settings\Administrator\Impostazioni locali
2010-03-16 09:33 . 2010-03-16 09:39 -------- d-----w- c:\documents and settings\Administrator\Dati applicazioni
2010-03-16 09:33 . 2009-08-25 12:01 -------- d-----w- c:\documents and settings\Administrator\IETldCache
2010-03-16 09:33 . 2009-08-25 11:40 -------- d-----w- c:\documents and settings\Administrator\Impostazioni locali\Dati applicazioni\Adobe
2010-03-16 09:33 . 2010-03-16 09:39 -------- d-s---w- c:\documents and settings\Administrator
2010-03-15 17:03 . 2010-03-15 17:03 -------- d-----w- c:\programmi\VideoLAN
2010-03-13 23:41 . 2010-02-12 16:41 558448 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\components\coFFPlgn.dll
2010-03-13 23:41 . 2010-02-01 18:20 165240 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll
2010-03-13 02:31 . 2010-03-16 10:32 -------- d---a-w- c:\documents and settings\All Users\Dati applicazioni\TEMP
2010-03-13 01:42 . 2010-03-16 09:40 -------- d-----w- c:\programmi\a-squared Free
2010-03-11 22:32 . 2010-03-11 22:32 -------- d-----w- c:\documents and settings\Fabrizio\Dati applicazioni\StealthBot
2010-03-11 22:32 . 2010-03-11 22:32 7358 ----a-r- c:\documents and settings\Fabrizio\Dati applicazioni\Microsoft\Installer\{C05DEB30-501D-4106-958D-C5E147D2BF7E}\_7a653c12.exe
2010-03-11 22:32 . 2010-03-11 22:32 7358 ----a-r- c:\documents and settings\Fabrizio\Dati applicazioni\Microsoft\Installer\{C05DEB30-501D-4106-958D-C5E147D2BF7E}\_3c6a7f4.exe
2010-03-11 22:31 . 2010-03-16 09:40 -------- d-----w- c:\programmi\StealthBot 2.7
2010-03-08 14:44 . 2005-07-03 03:30 1295582 ----a-w- c:\documents and settings\Fabrizio\cygwin1.dll
2010-03-08 14:36 . 2010-03-08 14:43 -------- d-----w- c:\documents and settings\Fabrizio\jtr
2010-03-08 14:35 . 2010-03-08 14:36 -------- d-----w- c:\documents and settings\Fabrizio\pwdump
2010-03-03 08:12 . 2010-03-03 08:12 -------- d-----w- c:\documents and settings\Fabrizio\Dati applicazioni\Logia
2010-03-03 00:06 . 2010-03-03 00:06 -------- d-----w- c:\programmi\Logia
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-16 12:58 . 2009-11-14 03:03 -------- d-----w- c:\programmi\CCleaner
2010-03-16 12:04 . 2010-03-16 12:04 -------- d-----w- c:\documents and settings\Administrator.YOUR-XZN8F0GBL0\Dati applicazioni\InstallShield
2010-03-16 12:04 . 2010-03-16 10:08 -------- d-----w- c:\programmi\Malwarebytes' Anti-Malware
2010-03-16 11:55 . 2010-03-16 11:55 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-03-16 10:09 . 2010-03-16 10:09 -------- d-----w- c:\documents and settings\Administrator.YOUR-XZN8F0GBL0\Dati applicazioni\Malwarebytes
2010-03-16 09:46 . 2009-08-25 11:05 -------- d--h--w- c:\programmi\InstallShield Installation Information
2010-03-16 09:45 . 2010-03-16 09:43 274144 ----a-w- c:\documents and settings\Administrator.YOUR-XZN8F0GBL0\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2010-03-16 09:40 . 2009-12-14 21:51 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Norton
2010-03-16 09:39 . 2009-08-25 11:52 -------- d-----w- c:\programmi\Norton Internet Security
2010-03-12 17:24 . 2009-11-18 14:20 -------- d-----w- c:\documents and settings\Fabrizio\Dati applicazioni\U3
2010-03-12 02:05 . 2009-08-25 11:55 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Microsoft Help
2010-03-11 22:24 . 2009-11-14 16:55 274144 ----a-w- c:\documents and settings\Fabrizio\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2010-02-14 16:22 . 2009-11-28 23:14 -------- d-----w- c:\documents and settings\Fabrizio\Dati applicazioni\BitTorrent
2010-02-10 22:26 . 2010-02-10 22:24 -------- d-----w- c:\programmi\File comuni\Real
2010-02-10 22:25 . 2010-02-10 22:25 -------- d-----w- c:\programmi\File comuni\xing shared
2010-02-10 22:24 . 2009-12-01 22:52 348160 ----a-w- c:\windows\system32\msvcr71.dll
2010-02-10 22:24 . 2009-12-01 22:52 499712 ----a-w- c:\windows\system32\msvcp71.dll
2010-02-10 22:24 . 2010-02-10 22:24 -------- d-----w- c:\programmi\Real
2010-02-08 15:39 . 2010-02-08 15:37 -------- d-----w- c:\programmi\QuickTime
2010-02-08 15:37 . 2010-02-08 15:37 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Apple Computer
2010-02-08 15:36 . 2010-02-08 15:36 -------- d-----w- c:\programmi\File comuni\Apple
2010-02-08 15:36 . 2010-02-08 15:36 -------- d-----w- c:\programmi\Apple Software Update
2010-02-08 15:36 . 2010-02-08 15:36 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Apple
2010-02-05 21:48 . 2010-02-05 21:48 503808 ----a-w- c:\documents and settings\Silvia\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-21e7f440-n\msvcp71.dll
2010-02-05 21:48 . 2010-02-05 21:48 499712 ----a-w- c:\documents and settings\Silvia\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-21e7f440-n\jmc.dll
2010-02-05 21:48 . 2010-02-05 21:48 348160 ----a-w- c:\documents and settings\Silvia\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-21e7f440-n\msvcr71.dll
2010-02-05 21:48 . 2010-02-05 21:48 61440 ----a-w- c:\documents and settings\Silvia\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-5e3531ac-n\decora-sse.dll
2010-02-05 21:48 . 2010-02-05 21:48 12800 ----a-w- c:\documents and settings\Silvia\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-5e3531ac-n\decora-d3d.dll
2010-02-05 16:14 . 2009-12-02 00:58 -------- d-----w- c:\documents and settings\Fabrizio\Dati applicazioni\Orbit
2010-02-05 15:08 . 2010-01-07 03:47 -------- d-----w- c:\documents and settings\Silvia\Dati applicazioni\Orbit
2010-02-05 15:04 . 2009-11-13 20:09 274144 ----a-w- c:\documents and settings\Silvia\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2010-01-26 16:15 . 2009-11-18 11:27 -------- d-----w- c:\programmi\Warcraft III
2010-01-23 14:40 . 2009-11-13 20:43 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\NOS
2010-01-22 23:16 . 2010-01-22 23:16 -------- d-----w- c:\programmi\File comuni\Java
2010-01-22 23:15 . 2010-01-22 23:15 503808 ----a-w- c:\documents and settings\Fabrizio\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-4740cb4b-n\msvcp71.dll
2010-01-22 23:15 . 2010-01-22 23:15 499712 ----a-w- c:\documents and settings\Fabrizio\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-4740cb4b-n\jmc.dll
2010-01-22 23:15 . 2010-01-22 23:15 348160 ----a-w- c:\documents and settings\Fabrizio\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-4740cb4b-n\msvcr71.dll
2010-01-22 23:15 . 2010-01-22 23:15 61440 ----a-w- c:\documents and settings\Fabrizio\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-2d899cd7-n\decora-sse.dll
2010-01-22 23:15 . 2010-01-22 23:15 12800 ----a-w- c:\documents and settings\Fabrizio\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-2d899cd7-n\decora-d3d.dll
2010-01-22 23:15 . 2009-11-13 20:22 -------- d-----w- c:\programmi\Java
2010-01-22 23:10 . 2009-11-13 20:43 1956528 ----a-w- c:\documents and settings\All Users\Dati applicazioni\NOS\Adobe_Downloads\install_flash_player_ax.exe
2010-01-20 14:43 . 2009-11-26 22:09 -------- d-----w- c:\programmi\Microsoft Silverlight
2010-01-07 14:17 . 2010-03-16 10:08 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-31 16:50 . 2009-08-25 11:24 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-22 17:45 . 2009-12-22 17:45 12862 -c--a-r- c:\documents and settings\Fabrizio\Dati applicazioni\Microsoft\Installer\{0E2B767B-EA6A-489B-BF83-8083FE1DB661}\_1EEFFF72773535163E4216.exe
2009-12-21 19:06 . 2009-08-25 11:24 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-19 08:15 . 2009-12-18 22:28 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
2009-12-19 08:15 . 2009-12-18 22:28 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2009-12-18 22:28 . 2009-12-18 22:28 1294680 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\SyKnAppS\SyKnAppS.dll
2009-12-18 22:28 . 2009-12-18 22:28 136840 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\SyKnAppS\patch25.dll
2009-12-18 22:28 . 2009-12-18 22:28 791920 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\CLT\cltLMSx.dll
2009-12-18 22:28 . 2009-12-18 22:28 288104 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\CPDOEM\CPDOEM.dll
2009-12-17 16:14 . 2009-11-13 20:22 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-12-17 07:40 . 2009-08-25 09:34 346112 ----a-w- c:\windows\system32\mspaint.exe
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B530A9A4-1722-4D16-AAD6-AA85E3AD2ADE}]
2010-02-14 14:48 54272 ----a-w- c:\programmi\Logia\eSnipsDownloader\eSnipsBHO.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\programmi\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]
"msnmsgr"="c:\programmi\MSN Messenger\msnmsgr.exe" [2009-09-16 5674352]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-12-19 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-12-19 159744]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-12-19 131072]
"AsusACPIServer"="c:\programmi\EeePC\ACPI\AsAcpiSvr.exe" [2009-04-16 630784]
"AsusEPCMonitor"="c:\programmi\EeePC\ACPI\AsEPCMon.exe" [2009-03-13 98304]
"AsusTray"="c:\programmi\EeePC\ACPI\AsTray.exe" [2009-04-16 118784]
"SynTPEnh"="c:\programmi\Synaptics\SynTP\SynTPEnh.exe" [2009-04-09 1512744]
"SynAsusAcpi"="c:\programmi\Synaptics\SynTP\SynAsusAcpi.exe" [2009-04-09 79144]
"LiveUpdate"="c:\programmi\Asus\LiveUpdate\LiveUpdate.exe" [2009-06-25 712704]
"SunJavaUpdateSched"="c:\programmi\File comuni\Java\Java Update\jusched.exe" [2010-01-11 246504]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-14 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-14 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"RTHDCPL"="RTHDCPL.EXE" [2009-04-27 17881088]
"QuickTime Task"="c:\programmi\QuickTime\QTTask.exe" [2009-11-10 417792]
"TkBellExe"="c:\programmi\File comuni\Real\Update_OB\realsched.exe" [2010-02-10 198160]
"eSnips_Downloader"="c:\programmi\Logia\eSnipsDownloader\eSnips_Downloader.exe" [2010-02-14 1231872]
"avgnt"="c:\programmi\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
SuperHybridEngine.lnk - c:\programmi\ASUS\EeePC\Super Hybrid Engine\SuperHybridEngine.exe [2009-8-25 376832]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Eee Docking]
2009-07-27 14:58 397312 ----a-w- c:\programmi\ASUS\Eee Docking\Eee Docking.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Programmi\\Skype\\Phone\\Skype.exe"=
"c:\\Programmi\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Programmi\\Java\\jre6\\bin\\java.exe"=
"c:\\Programmi\\Warcraft III\\Warcraft III.exe"=
"c:\\Programmi\\BitTorrent\\bittorrent.exe"=
"c:\\Programmi\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe"=
"c:\\Programmi\\Orbitdownloader\\orbitdm.exe"=
"c:\\Programmi\\Orbitdownloader\\orbitnet.exe"=
"c:\\Programmi\\Mozilla Firefox\\firefox.exe"=
"c:\\Programmi\\Messenger\\msmsgs.exe"=
"c:\\Programmi\\eMule\\emule.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programmi\\MSN Messenger\\msnmsgr.exe"=
"c:\\Programmi\\MSN Messenger\\livecall.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"48063:TCP"= 48063:TCP:bittorrent48063
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1008000.029\SymEFA.sys [03/02/2010 5.11.46 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\NIS\1008000.029\BHDrvx86.sys [03/02/2010 5.11.46 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1008000.029\cchpx86.sys [03/02/2010 5.11.02 482432]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Dati applicazioni\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100210.001\IDSXpx86.sys [13/02/2010 4.20.04 329592]
R2 a2free;a-squared Free Service;c:\programmi\a-squared Free\a2service.exe [13/03/2010 2.42.52 1858144]
R2 Norton Internet Security;Norton Internet Security;c:\programmi\Norton Internet Security\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe [03/02/2010 5.11.17 117640]
R3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1c51x86.sys [18/08/2009 22.44.33 38912]
R3 RT80x86;Ralink 802.11n Wireless Driver;c:\windows\system32\drivers\rt2860.sys [25/08/2009 12.08.18 1015424]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [25/08/2009 12.05.30 1684736]
S3 uvclf;uvclf;c:\windows\system32\drivers\uvclf.sys [12/08/2009 7.57.17 39040]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [18/11/2009 15.31.38 691696]
.
Contenuto della cartella 'Scheduled Tasks'
2010-03-15 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programmi\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
2010-03-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2009-12-07 15:15]
2010-03-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2009-12-07 15:15]
.
.
------- Scansione supplementare -------
.
uStart Page =
hxxp://www.google.it/mStart Page =
hxxp://eis.esnips.com/page/search/?clie ... fde8d1391dIE: &Download by Orbit - c:\programmi\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\programmi\Orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - c:\programmi\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\programmi\Orbitdownloader\orbitmxt.dll/202
IE: Invia a Bluetooth - c:\programmi\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: Invia a periferica &Bluetooth... - c:\programmi\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
FF - ProfilePath - c:\documents and settings\Fabrizio\Dati applicazioni\Mozilla\Firefox\Profiles\msp3y9ph.default\
FF - prefs.js: browser.startup.homepage -
www.google.itFF - component: c:\programmi\Logia\eSnipsDownloader\ext\components\eSnipsXPCOM.dll
FF - plugin: c:\programmi\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\programmi\Google\Update\1.2.183.17\npGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\programmi\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\programmi\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - CHIAVI ORFANE RIMOSSE - - - -
MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe
MSConfigStartUp-MsnMsgr - c:\program files\Windows Live\Messenger\MsnMsgr.Exe
**************************************************************************
scansione processi nascosti ...
scansione entrate autostart nascoste ...
Scansione files nascosti ...
Scansione completata con successo
Files nascosti:
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Norton Internet Security]
"ImagePath"="\"c:\programmi\Norton Internet Security\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\programmi\Norton Internet Security\Norton Internet Security\Engine\16.8.0.41\diMaster.dll\" /prefetch:1"
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------
- - - - - - - > 'explorer.exe'(1760)
c:\windows\system32\WININET.dll
c:\programmi\File comuni\Adobe\Acrobat\ActiveX\PDFShell.dll
c:\programmi\File comuni\Adobe\Acrobat\ActiveX\PDFShell.ITA
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\programmi\Avira\AntiVir Desktop\sched.exe
c:\programmi\Avira\AntiVir Desktop\avguard.exe
c:\programmi\Java\jre6\bin\jqs.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\system32\igfxext.exe
c:\windows\RTHDCPL.EXE
c:\programmi\Orbitdownloader\orbitdm.exe
c:\programmi\Orbitdownloader\orbitnet.exe
.
**************************************************************************
.
Ora fine scansione: 2010-03-16 14:32:28 - Il pc è stato riavviato
ComboFix-quarantined-files.txt 2010-03-16 13:32
Pre-Run: 1.672.155.136 byte disponibili
Post-Run: 1.655.508.992 byte disponibili
- - End Of File - - 172F4FD4FB8AC6A98C1ACDAE24D09C55