ComboFix 08-10-25.01 - Andrea 2008-11-02 11.52.08.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1040.18.2583 [GMT 1:00]
Eseguito da: C:\Documents and Settings\Andrea\Desktop\ComboFix.exe
* Creato nuovo punto di ripristino
* Resident AV is active
ATENÇÃO - ESTA MAQUINA NAO TEM A CONSOLE DE RECUPERAÇÃO INSTALADA !!.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Papà\Impostazioni locali\Dati applicazioni\aocpdx.dat
C:\Documents and Settings\Papà\Impostazioni locali\Dati applicazioni\aocpdx.exe
C:\Documents and Settings\Papà\Impostazioni locali\Dati applicazioni\aocpdx_nav.dat
C:\Documents and Settings\Papà\Impostazioni locali\Dati applicazioni\aocpdx_navps.dat
C:\WINDOWS\jestertb.dll
C:\WINDOWS\system32\Cache
.
((((((((((((((((((((((((( Files Creati Da 2008-10-02 al 2008-11-02 )))))))))))))))))))))))))))))))))))
.
2008-11-02 11:53 . 2008-11-02 11:53 <DIR> d-------- C:\WINDOWS\system32\xircom
2008-11-02 11:53 . 2008-11-02 11:53 <DIR> d-------- C:\Programmi\microsoft frontpage
2008-11-02 11:50 . 2008-11-02 11:51 <DIR> d-------- C:\pincopallino
2008-11-01 15:50 . 2008-11-01 15:50 <DIR> d-------- C:\Programmi\Hamachi
2008-11-01 15:50 . 2008-11-01 17:05 <DIR> d-------- C:\Documents and Settings\Andrea\Dati applicazioni\Hamachi
2008-11-01 15:50 . 2008-11-01 15:50 25,280 --a------ C:\WINDOWS\system32\drivers\hamachi.sys
2008-10-31 18:03 . 2002-11-11 16:08 323,624 --a------ C:\WINDOWS\system32\wiaaut.dll
2008-10-29 09:20 . 2008-10-29 09:20 <DIR> d-------- C:\Documents and Settings\Andrea\Dati applicazioni\InstallShield Installation Information
2008-10-29 09:11 . 2008-10-29 09:11 <DIR> d-------- C:\WINDOWS\system32\AGEIA
2008-10-29 09:11 . 2008-10-29 09:11 <DIR> d-------- C:\Programmi\File comuni\Wise Installation Wizard
2008-10-29 09:11 . 2008-10-29 09:11 <DIR> d-------- C:\Programmi\AGEIA Technologies
2008-10-27 17:55 . 2008-10-27 17:55 <DIR> d-------- C:\Documents and Settings\Andrea\Dati applicazioni\Thunderbird
2008-10-26 10:46 . 1997-07-19 17:00 315,585 --a------ C:\WINDOWS\system32\COMCTL32.ocx
2008-10-26 10:46 . 1997-07-19 17:01 118,781 --a------ C:\WINDOWS\system32\TABCTL32.ocx
2008-10-26 10:46 . 1998-01-24 03:39 110,725 --a------ C:\WINDOWS\system32\RICHTX32.ocx
2008-10-26 10:46 . 1995-07-26 01:00 98,588 --a------ C:\WINDOWS\system32\THREED32.ocx
2008-10-26 10:46 . 2005-11-13 22:40 89,360 --a------ C:\WINDOWS\system32\VB5DB.DLL
2008-10-26 10:46 . 1995-07-26 01:00 48,640 --a------ C:\WINDOWS\system32\GRID32.ocx
2008-10-26 10:46 . 1997-01-16 10:11 44,831 --a------ C:\WINDOWS\system32\PICCLP32.ocx
2008-10-26 10:46 . 1995-07-26 01:00 43,502 --a------ C:\WINDOWS\system32\MSOUTL32.ocx
2008-10-22 10:18 . 2008-10-23 16:10 <DIR> d-------- C:\Programmi\QuickTime
2008-10-20 16:27 . 2008-11-01 14:43 <DIR> d-------- C:\Documents and Settings\Andrea\Dati applicazioni\gtk-2.0
2008-10-19 14:01 . 2008-10-19 14:01 <DIR> d-------- C:\Documents and Settings\Andrea\X-Firefox
2008-10-19 13:32 . 2008-10-19 13:32 <DIR> d-------- C:\Documents and Settings\Andrea\Dati applicazioni\Media Player Classic
2008-10-17 18:11 . 2008-10-17 18:11 <DIR> d-------- C:\Documents and Settings\Papà\Dati applicazioni\Media Player Classic
2008-10-17 12:54 . 2008-02-11 08:15 360,448 --a------ C:\WINDOWS\Uninstall.exe
2008-10-14 22:18 . 2008-10-14 22:18 <DIR> d-------- C:\Documents and Settings\LocalService\Dati applicazioni\CyberLink
2008-10-14 22:11 . 2008-10-14 22:11 <DIR> d-------- C:\Documents and Settings\Papà\Dati applicazioni\CyberLink
2008-10-14 22:06 . 2008-10-17 12:50 <DIR> d-------- C:\Programmi\Cyberlink
2008-10-14 21:35 . 2008-10-14 21:35 <DIR> d-------- C:\Programmi\DivX
2008-10-14 21:29 . 2008-10-14 21:29 <DIR> d---s---- C:\Documents and Settings\Papà\UserData
2008-10-14 21:29 . 2008-10-14 21:29 <DIR> d---s---- C:\Documents and Settings\Papà\UserData
2008-10-14 21:22 . 2008-10-17 12:54 <DIR> d-------- C:\Programmi\DevGuru
2008-10-14 21:22 . 2006-11-01 23:21 319,456 --a------ C:\WINDOWS\system32\drivers\DIFxAPI.dll
2008-10-08 15:53 . 2008-11-01 15:32 <DIR> d-------- C:\Programmi\Opera
2008-10-05 20:10 . 2008-10-05 20:10 22,368 --a------ C:\Documents and Settings\Andrea\sgvuimzo.exe
2008-10-05 20:10 . 2008-10-05 20:10 22,368 --a------ C:\Documents and Settings\Andrea\ofntikqg.exe
2008-10-05 10:44 . 2008-10-05 10:44 22,368 --a------ C:\Documents and Settings\Andrea\lstomula.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-26 09:46 --------- d--h--w C:\Programmi\InstallShield Installation Information
2008-10-19 12:35 --------- d-----w C:\Programmi\Super
2008-10-18 11:54 --------- d-----w C:\Programmi\Theme Viewer
2008-10-17 10:49 --------- d-----w C:\Programmi\OpenOffice.org 3
2008-09-30 19:27 --------- d-----w C:\Programmi\xVM VirtualBox
2008-09-28 12:02 --------- d-----w C:\Documents and Settings\Andrea\Dati applicazioni\OpenOffice.org
2008-09-26 18:10 --------- d-----w C:\Programmi\Nokia
2008-09-18 08:20 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\DVD Shrink
2008-09-14 08:47 --------- d-----w C:\Documents and Settings\Andrea\Dati applicazioni\Locate32
2008-09-13 15:01 --------- d-----w C:\Programmi\AviSynth 2.5
2008-09-12 20:23 --------- d-----w C:\Programmi\Monkey's Audio
2008-09-12 14:00 95,888 ----a-w C:\WINDOWS\system32\drivers\VBoxDrv.sys
2008-09-12 14:00 41,680 ----a-w C:\WINDOWS\system32\drivers\VBoxUSBMon.sys
2008-09-09 16:53 --------- d-----w C:\Programmi\Alcohol Soft
2008-09-08 10:54 --------- d-----w C:\Documents and Settings\Andrea\Dati applicazioni\S.V. Softwares
2006-06-23 06:48 32,768 ----a-r C:\WINDOWS\inf\UpdateUSB.exe
2006-05-03 09:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
2007-02-21 10:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
2008-03-16 12:30 216,064 --sh--r C:\WINDOWS\system32\nbDX.dll
.
------- Sigcheck -------
2008-07-24 21:34 361344 68f06fe0021b01e670af37b8c5964fdf C:\WINDOWS\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"TaskSwitchXP"="D:\winPenPack\Sistema\X-TaskSwitchXP\Bin\TaskSwitchXP\TaskSwitchXP.exe" [2006-08-05 62976]
"Nokia.PCSync"="C:\Programmi\Nokia PC Suite\Nokia PC Suite 7\PCSync2.exe" [2008-06-17 1249280]
"PC Suite Tray"="C:\Programmi\Nokia PC Suite\Nokia PC Suite 7\PCSuite.exe" [2008-06-18 1122816]
"AlcoholAutomount"="C:\Programmi\Alcohol Soft\axcmd.exe" [2008-09-09 4608]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Programmi\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"TrueImageMonitor.exe"="C:\Programmi\Acronis True Image Home\TrueImageMonitor.exe" [2008-04-09 2595792]
"AcronisTimounterMonitor"="C:\Programmi\Acronis True Image Home\TimounterMonitor.exe" [2008-04-09 909208]
"Acronis Scheduler2 Service"="C:\Programmi\File comuni\Acronis\Schedule2\schedhlp.exe" [2008-04-09 136472]
"SoundMAXPnP"="C:\Programmi\Analog Devices\Core\smax4pnp.exe" [2008-03-16 1040384]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-02-20 13500416]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-02-20 86016]
"egui"="C:\Programmi\ESET NOD32 Antivirus\egui.exe" [2008-06-10 1447168]
"BrMfcWnd"="C:\Programmi\Brother\Brmfcmon\BrMfcWnd.exe" [2007-03-12 663552]
"ControlCenter3"="C:\Programmi\Brother\ControlCenter3\brctrcen.exe" [2007-01-26 65536]
"PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2004-03-10 406016]
"nwiz"="nwiz.exe" [2008-02-20 C:\WINDOWS\system32\nwiz.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"WIAWizardMenu"="C:\WINDOWS\system32\sti_ci.dll" [2008-04-14 137216]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2008-04-14 C:\WINDOWS\system32\advpack.dll]
C:\Documents and Settings\Andrea\Menu Avvio\Programmi\Esecuzione automatica\
X-Pidgin.lnk - D:\winPenPack\Internet\X-Pidgin\X-Pidgin.exe [2008-10-23 543515]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoDesktopCleanupWizard"= 1 (0x1)
"NoStartMenuEjectPC"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoDesktopCleanupWizard"= 1 (0x1)
"NoRecycleFiles"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoStartMenuEjectPC"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= i420vfw.dll
"VIDC.MJPG"= Pvmjpg21.dll
"VIDC.PIM1"= pclepim1.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"D:\\winPenPack\\Internet\\uTorrent\\utorrent.exe"=
"C:\\Giochi\\Unreal Tournament 3\\Binaries\\UT3.exe"=
R0 tdrpman;Acronis Try&Decide and Restore Points filter;C:\WINDOWS\system32\DRIVERS\tdrpman.sys [2008-07-25 368480]
R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-06-10 34312]
R1 VBoxDrv;VirtualBox Service;C:\WINDOWS\system32\DRIVERS\VBoxDrv.sys [2008-09-12 95888]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver;C:\WINDOWS\system32\DRIVERS\VBoxUSBMon.sys [2008-09-12 41680]
R2 TryAndDecideService;Acronis Try And Decide Service;C:\Programmi\File comuni\Acronis\Fomatik\TrueImageTryStartService.exe [2008-04-09 492896]
R3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);C:\WINDOWS\system32\DRIVERS\A3AB.sys [2006-10-15 472832]
R3 USBSTOR;Driver archiviazione di massa USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S2 NOD32FiXTemDono;Eset Nod32 Boot;C:\WINDOWS\system32\regedt32.exe [2008-04-14 3584]
*Newly Created Service* - HELPSVC
.
.
------- Supplementare di scansione -------
.
R0 -: HKCU-Main,Start Page =
hxxp://www.google.it/R1 -: HKCU-Internet Connection Wizard,ShellNext =
hxxp://www.nvidia.com/content/drivers/r ... sysutilityO8 -: E&sporta in Microsoft Excel - C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-11-02 11:54:18
Windows 5.1.2600 Service Pack 3 NTFS
scansione processi nascosti ...
scansione entrate autostart nascoste ...
Scansione files nascosti ...
Scansione completata con successo
Files nascosti: 0
**************************************************************************
.
------------------------ Altri processi in esecuzione ------------------------
.
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\Brother\ControlCenter3\BrccMCtl.exe
C:\Programmi\Brother\Brmfcmon\BrMfcMon.exe
C:\Programmi\File comuni\Acronis\Schedule2\schedul2.exe
D:\winPenPack\Internet\X-Pidgin\Bin\Pidgin\pidgin.exe
C:\Programmi\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programmi\Alcohol Soft\StarWind\StarWindServiceAE.exe
C:\Programmi\PC Connectivity Solution\ServiceLayer.exe
C:\Programmi\File comuni\Nokia\MPAPI\MPAPI3s.exe
C:\Programmi\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Programmi\PC Connectivity Solution\Transports\NclRSSrv.exe
.
**************************************************************************
.
Ora fine scansione: 2008-11-02 11:55:28 - macchina è stato riavviato [Andrea]
ComboFix-quarantined-files.txt 2008-11-02 10:55:25
Pre-Run: 78.497.812.480 byte disponibili
Post-Run: 78,714,769,408 byte disponibili
190