ComboFix 09-01-11.04 - sfarrito 2009-01-13 15:14:37.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1040.18.2047.1662 [GMT 1:00]
Eseguito da: d:\documents and settings\sfarrito\Desktop\ciao.exe
AV: avast! antivirus 4.8.1296 [VPS 090111-1] *On-access scanning disabled* (Outdated)
AV: Spyware Doctor with AntiVirus *On-access scanning disabled* (Outdated)
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
d:\documents and settings\All Users.WINDOWS\Dati applicazioni\Microsoft\Network\Downloader\qmgr0.dat
d:\documents and settings\All Users.WINDOWS\Dati applicazioni\Microsoft\Network\Downloader\qmgr1.dat
d:\documents and settings\sfarrito\Dati applicazioni\Microsoft\Windows\lsass.exe
d:\programmi\DAEMON Tools Lite\daemon.exe
d:\programmi\File comuni\{10C7D~1
d:\programmi\File comuni\{30C7D~1
d:\programmi\File comuni\sogou pxp
d:\programmi\iMeshBar
d:\programmi\iMeshBar\bar\Cache\
000B38AE
d:\programmi\iMeshBar\bar\Cache\
0044FE0C.bin
d:\programmi\iMeshBar\bar\Cache\
0045001F.bmp
d:\programmi\iMeshBar\bar\Cache\
004502BF.bmp
d:\programmi\iMeshBar\bar\Cache\files.ini
d:\programmi\iMeshBar\bar\History\search
d:\programmi\iMeshBar\bar\Settings\prevcfg.htm
d:\programmi\INSTALL.LOG
d:\windows\IE4 Error Log.txt
d:\windows\struct~.ini
d:\windows\system32\divx.dll
d:\windows\system32\NTSpool.exe
d:\windows\system32\WinSecure.exe
----- BITS: Sites possivelmente infetados -----
hxxp://updateserver.info.
((((((((((((((((((((((((((((((((((((((( Driver/Servizi )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_XLASHSRV
((((((((((((((((((((((((( Files Creati Da 2008-12-13 al 2009-01-13 )))))))))))))))))))))))))))))))))))
.
2010-01-07 16:17 . 2010-01-07 16:18 <DIR> d-------- d:\documents and settings\sfarrito\Dati applicazioni\U3
2010-01-07 14:56 . 2010-01-07 14:56 <DIR> d-------- d:\documents and settings\All Users.WINDOWS\Dati applicazioni\Sony Ericsson
2010-01-07 14:56 . 2010-01-07 14:56 <DIR> d-------- d:\documents and settings\All Users.WINDOWS\Dati applicazioni\BVRP Software
2009-01-13 14:34 . 2009-01-13 15:00 <DIR> d-------- d:\programmi\FindyKill
2009-01-13 07:25 . 2009-01-13 14:35 <DIR> d-------- d:\programmi\Spyware Doctor
2009-01-13 07:25 . 2009-01-13 07:25 <DIR> d-------- d:\programmi\File comuni\PC Tools
2009-01-13 07:25 . 2009-01-13 07:25 <DIR> d-------- d:\documents and settings\sfarrito\Dati applicazioni\PC Tools
2009-01-13 07:25 . 2009-01-13 07:25 <DIR> d-------- d:\documents and settings\All Users.WINDOWS\Dati applicazioni\PC Tools
2009-01-13 07:25 . 2009-01-13 07:28 160,792 --a------ d:\windows\system32\drivers\pctfw2.sys
2009-01-13 07:25 . 2007-12-10 14:53 81,288 --a------ d:\windows\system32\drivers\iksyssec.sys
2009-01-13 07:25 . 2007-12-10 14:53 66,952 --a------ d:\windows\system32\drivers\iksysflt.sys
2009-01-13 07:25 . 2009-01-13 07:29 42,376 --a------ d:\windows\system32\drivers\ikfilesec.sys
2009-01-13 07:25 . 2007-12-10 14:53 29,576 --a------ d:\windows\system32\drivers\kcom.sys
2009-01-12 23:45 . 2009-01-12 23:44 66,048 --a------ D:\mbr.exe
2009-01-12 23:09 . 2009-01-12 23:09 250 --a------ d:\windows\gmer.ini
2009-01-12 23:06 . 2009-01-12 23:07 <DIR> d-------- d:\programmi\BHODemon 2
2009-01-12 22:56 . 2009-01-12 22:56 <DIR> d-------- d:\programmi\Gargaroz
2009-01-12 22:56 . 2004-12-06 12:22 178,889 --a------ d:\windows\system32\FraPlus1.ocx
2009-01-12 22:56 . 1998-06-13 22:53 44,544 --a------ d:\windows\system32\GIF89.DLL
2009-01-12 22:46 . 2009-01-12 22:46 <DIR> d-------- d:\programmi\Uniblue
2009-01-12 22:46 . 2009-01-12 22:46 <DIR> d-------- d:\documents and settings\sfarrito\Dati applicazioni\Uniblue
2009-01-12 22:45 . 2009-01-12 22:46 <DIR> d--h-c--- d:\documents and settings\All Users.WINDOWS\Dati applicazioni\{B46E1EF5-0B37-4DB4-A4E2-9F2B41036185}
2009-01-12 22:25 . 2009-01-13 14:35 <DIR> d-a------ d:\documents and settings\All Users.WINDOWS\Dati applicazioni\TEMP
2009-01-12 22:25 . 2009-01-12 22:25 37,888 --a------ d:\windows\system32\rar.exe
2009-01-12 22:04 . 2009-01-12 22:04 <DIR> d-------- d:\programmi\AMUST
2009-01-12 22:04 . 2008-04-16 14:24 165,368 --a------ d:\windows\system32\RegCompact.dll
2009-01-12 21:31 . 2008-04-29 11:33 16,952 --a------ d:\windows\system32\drivers\RkPavproc1.sys
2009-01-12 21:10 . 2009-01-12 21:10 <DIR> d-------- d:\documents and settings\sfarrito\Dati applicazioni\AVGTOOLBAR
2009-01-12 21:05 . 2009-01-12 22:41 <DIR> d-------- D:\csscod
2009-01-12 16:22 . 2009-01-12 16:22 <DIR> d-------- d:\programmi\Panda Security
2009-01-12 16:20 . 2009-01-12 21:29 <DIR> d-------- d:\documents and settings\sfarrito\.housecall6.6
2009-01-12 16:18 . 2003-04-14 12:02 55,808 --a------ d:\windows\unSpySweeper.exe
2009-01-12 15:19 . 2009-01-12 15:19 <DIR> d-------- d:\programmi\Trend Micro
2009-01-12 14:37 . 2009-01-12 14:37 <DIR> d-------- d:\documents and settings\sfarrito\Dati applicazioni\ProxyCap
2009-01-11 21:51 . 2008-12-14 12:24 26,112 --ahs---- d:\windows\system32\mss.dll
2009-01-11 20:59 . 2009-01-11 20:59 <DIR> d-------- d:\programmi\Proxy Labs
2009-01-11 20:55 . 2009-01-11 20:55 <DIR> d-------- d:\programmi\Your Freedom
2009-01-11 14:21 . 2009-01-11 14:21 <DIR> d-------- D:\Nexon
2009-01-11 14:21 . 2009-01-12 15:37 <DIR> d-------- d:\documents and settings\All Users.WINDOWS\Dati applicazioni\NexonUS
2009-01-10 15:22 . 2009-01-10 15:22 <DIR> d-------- d:\documents and settings\All Users.WINDOWS\Dati applicazioni\NexonEU
2009-01-08 20:30 . 2009-01-08 20:30 <DIR> d-------- d:\programmi\recfree
2009-01-08 20:30 . 2009-01-08 20:30 <DIR> d-------- d:\programmi\EasySearch
2009-01-08 20:30 . 2009-01-08 20:30 <DIR> d-------- d:\programmi\Conduit
2009-01-08 14:10 . 2009-01-08 14:10 <DIR> d-------- d:\documents and settings\sfarrito\.Tiffy
2009-01-08 14:05 . 2009-01-08 14:05 <DIR> d-------- d:\windows\Sun
2009-01-08 14:04 . 2009-01-08 14:04 410,984 --a------ d:\windows\system32\deploytk.dll
2009-01-08 14:04 . 2009-01-08 14:04 73,728 --a------ d:\windows\system32\javacpl.cpl
2009-01-06 18:05 . 2009-01-06 18:05 <DIR> d-------- d:\documents and settings\sfarrito\Dati applicazioni\vlc
2009-01-06 14:47 . 2009-01-06 14:47 <DIR> d-------- d:\documents and settings\All Users.WINDOWS\Dati applicazioni\TVU Networks
2009-01-06 14:07 . 2009-01-06 15:45 <DIR> d-------- d:\programmi\uusee
2009-01-06 14:07 . 2009-01-06 15:43 <DIR> d-------- d:\programmi\File comuni\uusee
2009-01-06 14:05 . 2009-01-06 14:06 <DIR> d-------- d:\programmi\TVAnts
2009-01-06 14:03 . 2009-01-06 14:03 <DIR> d-------- d:\programmi\TVUPlayer
2009-01-06 14:03 . 2009-01-06 14:03 <DIR> d-------- d:\documents and settings\sfarrito\LocalLow
2009-01-02 15:09 . 2009-01-02 15:09 <DIR> d-------- d:\programmi\MP3 Player Utilities 4.17
2009-01-02 15:09 . 2009-01-02 15:09 <DIR> d-------- d:\documents and settings\sfarrito\WINDOWS
2009-01-02 15:09 . 1998-01-23 12:22 304,128 --a------ d:\windows\IsUninst.exe
2009-01-01 13:56 . 2009-01-13 14:35 664 --a------ d:\windows\system32\d3d9caps.dat
2009-01-01 13:19 . 2009-01-01 13:19 <DIR> d-------- d:\windows\system32\xlive
2009-01-01 13:19 . 2009-01-01 14:02 <DIR> d-------- d:\programmi\Microsoft Games for Windows - LIVE
2008-12-30 11:54 . 2008-12-30 11:54 <DIR> dr-h----- d:\documents and settings\sfarrito\Dati applicazioni\SecuROM
2008-12-30 11:51 . 2008-12-30 11:51 107,888 --a------ d:\windows\system32\CmdLineExt.dll
2008-12-30 11:49 . 2008-05-30 14:11 3,850,760 --a------ d:\windows\system32\D3DX9_38.dll
2008-12-30 11:49 . 2008-05-30 14:11 1,491,992 --a------ d:\windows\system32\D3DCompiler_38.dll
2008-12-30 11:49 . 2008-05-30 14:19 507,400 --a------ d:\windows\system32\XAudio2_1.dll
2008-12-30 11:49 . 2008-05-30 14:11 467,984 --a------ d:\windows\system32\d3dx10_38.dll
2008-12-30 11:49 . 2008-05-30 14:18 238,088 --a------ d:\windows\system32\xactengine3_1.dll
2008-12-30 11:49 . 2008-05-30 14:17 65,032 --a------ d:\windows\system32\XAPOFX1_0.dll
2008-12-30 11:49 . 2008-05-30 14:17 25,608 --a------ d:\windows\system32\X3DAudio1_4.dll
2008-12-30 11:48 . 2008-12-30 11:48 <DIR> d-------- d:\windows\system32\LogFiles
2008-12-30 11:48 . 2008-12-30 11:48 <DIR> d-------- d:\windows\system32\drivers\umdf
2008-12-30 11:48 . 2008-12-30 11:48 <DIR> d-------- d:\windows\Logs
2008-12-30 11:03 . 2008-04-13 18:52 2,973,696 -----c--- d:\windows\system32\dllcache\wmploc.dll
2008-12-30 11:02 . 2006-12-28 12:01 19,569 --a------ d:\windows\
006300_.tmp
2008-12-30 11:02 . 2008-04-13 11:40 10,240 --------- d:\windows\system32\drivers\sffp_mmc.sys
2008-12-29 11:45 . 2004-09-03 00:00 124,688 --a------ d:\windows\system32\MSWINSCK.OCX
2008-12-29 11:24 . 2008-12-29 11:24 <DIR> d-------- d:\windows\system32\URTTEMP
2008-12-29 00:59 . 2009-01-13 15:21 <DIR> d-------- d:\programmi\DNA
2008-12-29 00:59 . 2008-12-29 00:59 <DIR> d-------- d:\programmi\AskSearch
2008-12-29 00:59 . 2009-01-13 15:21 <DIR> d-------- d:\documents and settings\sfarrito\Dati applicazioni\DNA
2008-12-29 00:59 . 2008-12-29 15:11 <DIR> d-------- d:\documents and settings\sfarrito\Dati applicazioni\BitTorrent
2008-12-28 12:26 . 2008-12-28 12:29 <DIR> d-------- d:\documents and settings\sfarrito\Dati applicazioni\Xfire
2008-12-28 12:24 . 2008-12-28 12:29 43,520 --a------ d:\windows\system32\CmdLineExt03.dll
2008-12-27 13:45 . 2005-05-03 11:43 69,632 -r------- d:\windows\Alcmtr.exe
2008-12-26 17:00 . 2010-01-07 16:17 69 --a------ d:\windows\NeroDigital.ini
2008-12-26 12:31 . 2007-12-17 12:30 269,824 --a------ d:\windows\system32\drivers\RTL8187.sys
2008-12-26 12:31 . 2008-12-26 12:31 21,035 --a------ d:\windows\system32\drivers\AegisP.sys
2008-12-26 12:30 . 2008-12-26 12:36 <DIR> d-------- d:\programmi\ASRock WiFi-802.11g
2008-12-26 12:30 . 2006-06-23 09:35 13,532 --a------ d:\windows\system32\drivers\SjyPkt.sys
2008-12-25 13:16 . 2008-12-25 13:16 <DIR> d-------- d:\programmi\FastWeb Login
2008-12-25 13:16 . 2008-12-25 13:16 286,720 --a------ d:\windows\iun507.exe
2008-12-25 11:37 . 2008-12-31 12:48 <DIR> d-------- d:\windows\system32\it-IT
2008-12-25 11:36 . 2008-12-29 11:36 <DIR> d-------- d:\windows\system32\XPSViewer
2008-12-25 11:35 . 2006-06-29 13:07 14,048 --------- d:\windows\system32\spmsg2.dll
2008-12-24 18:34 . 2008-08-14 14:22 2,192,896 -----c--- d:\windows\system32\dllcache\ntoskrnl.exe
2008-12-24 18:34 . 2008-08-14 14:22 2,148,864 -----c--- d:\windows\system32\dllcache\ntkrnlmp.exe
2008-12-24 18:34 . 2008-08-14 14:22 2,069,760 -----c--- d:\windows\system32\dllcache\ntkrnlpa.exe
2008-12-24 18:34 . 2008-08-14 14:22 2,027,520 -----c--- d:\windows\system32\dllcache\ntkrpamp.exe
2008-12-24 18:34 . 2008-04-11 20:04 691,712 -----c--- d:\windows\system32\dllcache\inetcomm.dll
2008-12-24 18:34 . 2008-10-15 17:36 337,408 -----c--- d:\windows\system32\dllcache\netapi32.dll
2008-12-24 18:34 . 2008-05-01 15:34 331,776 -----c--- d:\windows\system32\dllcache\msadce.dll
2008-12-24 18:33 . 2008-12-13 07:36 3,593,216 -----c--- d:\windows\system32\dllcache\mshtml.dll
2008-12-24 18:33 . 2008-09-15 16:24 1,846,400 -----c--- d:\windows\system32\dllcache\win32k.sys
2008-12-24 18:33 . 2008-10-16 02:00 1,499,648 -----c--- d:\windows\system32\dllcache\shdocvw.dll
2008-12-24 18:33 . 2008-10-16 21:04 1,160,192 -----c--- d:\windows\system32\dllcache\urlmon.dll
2008-12-24 18:33 . 2008-10-16 21:04 826,368 -----c--- d:\windows\system32\dllcache\wininet.dll
2008-12-24 18:33 . 2008-09-08 11:41 333,824 -----c--- d:\windows\system32\dllcache\srv.sys
2008-12-24 18:33 . 2008-06-14 18:32 272,768 -----c--- d:\windows\system32\dllcache\bthport.sys
2008-12-24 18:33 . 2008-08-14 11:04 138,496 -----c--- d:\windows\system32\dllcache\afd.sys
2008-12-24 18:32 . 2008-10-24 12:21 455,296 -----c--- d:\windows\system32\dllcache\mrxsmb.sys
2008-12-24 18:32 . 2008-05-08 15:02 203,136 -----c--- d:\windows\system32\dllcache\rmcast.sys
2008-12-24 16:57 . 2008-09-04 18:15 1,106,944 -----c--- d:\windows\system32\dllcache\msxml3.dll
2008-12-24 16:53 . 2007-04-25 15:18 465,408 --------- d:\windows\system32\imapi2fs.dll
2008-12-24 16:53 . 2007-04-25 15:18 465,408 -----c--- d:\windows\system32\dllcache\imapi2fs.dll
2008-12-24 16:53 . 2007-04-25 15:18 318,464 --------- d:\windows\system32\imapi2.dll
2008-12-24 16:53 . 2007-04-25 15:18 318,464 -----c--- d:\windows\system32\dllcache\imapi2.dll
2008-12-24 16:53 . 2008-04-13 19:13 7,168 --------- d:\windows\system32\bitsprx4.dll
2008-12-24 16:51 . 2008-12-24 16:51 <DIR> d-------- d:\programmi\MSECache
2008-12-24 16:51 . 2008-12-24 16:51 <DIR> d-------- d:\programmi\Microsoft CAPICOM 2.1.0.2
2008-12-24 16:48 . 2008-12-24 16:48 <DIR> d-------- d:\programmi\Microsoft
2008-12-24 16:42 . 2006-12-14 14:45 981,760 -----c--- d:\windows\system32\dllcache\mfc42u.dll
2008-12-24 16:40 . 2008-12-30 11:05 <DIR> d-------- d:\windows\l2schemas
2008-12-24 16:40 . 2008-04-13 19:13 69,120 --------- d:\windows\system32\wlanapi.dll
2008-12-24 16:39 . 2006-11-08 09:51 62,336 --------- d:\windows\system32\drivers\rspndr.sys
2008-12-24 16:39 . 2006-11-08 09:51 10,752 --------- d:\windows\system32\rspndr.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-07 13:56 --------- d-----w d:\programmi\Avanquest update
2009-01-13 14:16 --------- d-----w d:\programmi\DAEMON Tools Lite
2009-01-12 20:14 --------- d-----w d:\programmi\Spfybhgfdotyt - Searfch & Desftroy
2009-01-08 13:04 --------- d-----w d:\programmi\Java
2009-01-06 13:08 --------- d-----w d:\programmi\SopCast
2009-01-06 13:07 --------- d-----w d:\programmi\MSN Messenger
2008-12-30 13:39 --------- d-----w d:\programmi\Steam
2008-12-30 10:26 --------- d--h--w d:\programmi\InstallShield Installation Information
2008-12-28 23:59 --------- d-----w d:\programmi\BitTorrent
2008-12-25 10:27 --------- d--h--w d:\programmi\eMule
2008-12-24 13:39 --------- d-----w d:\programmi\Nokia
2008-12-24 12:57 --------- d-----w d:\programmi\PC Connectivity Solution
2008-12-24 12:57 --------- d-----w d:\programmi\File comuni\Nokia
2008-12-20 14:50 --------- d-----w d:\programmi\Messenger Plus! Live
2008-12-20 12:31 --------- d-----w d:\programmi\Microsoft Works
2008-12-19 21:46 --------- d-----w d:\programmi\File comuni\Adobe
2008-12-19 21:45 --------- d-----w d:\programmi\AdunanzA
2008-12-18 19:28 --------- d-----w d:\programmi\ESET
2008-12-18 19:25 --------- d-----w d:\programmi\File comuni\Wise Installation Wizard
2008-12-02 22:11 6,209,536 ----a-w d:\windows\system32\drivers\nv4_mini.sys
2008-11-23 12:05 --------- d-----w c:\documents and settings\Administrator\Dati applicazioni\Orbit
2008-11-08 12:19 326 ----a-w D:\sccfg.sys
2008-01-22 06:03 3,854,336 ----a-w d:\programmi\Registration Tool.exe
2008-01-22 06:03 24,543,232 ----a-w d:\programmi\GuitarRig 2.exe
2008-01-22 06:03 2,975 ----a-w d:\programmi\Readme.txt
2008-01-13 12:46 339,944 ----a-w d:\programmi\UNWISE.EXE
2007-12-17 15:20 4,879,313 ----a-w d:\programmi\Allok Video to FLV Converter.zip
2005-10-21 12:26 945,345 ----a-w d:\programmi\Rig Kontrol 2 Driver Setup.exe
2003-07-09 08:45 40 ----a-w d:\programmi\mtachat.txt
2002-11-19 14:01 28,672 ----a-w d:\programmi\opera\program\plugins\PlugDef.dll
2008-10-19 09:58 49,152 ----a-w d:\programmi\mozilla firefox\components\SiteVacuumXPCOM.dll
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{15c93148-34fe-47e6-88e5-37607a3002f3}"= "d:\programmi\recfree\tbrecf.dll" [2008-09-15 1784856]
[HKEY_CLASSES_ROOT\clsid\{15c93148-34fe-47e6-88e5-37607a3002f3}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{15c93148-34fe-47e6-88e5-37607a3002f3}]
2008-09-15 06:47 1784856 --a------ d:\programmi\recfree\tbrecf.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{15c93148-34fe-47e6-88e5-37607a3002f3}"= "d:\programmi\recfree\tbrecf.dll" [2008-09-15 1784856]
[HKEY_CLASSES_ROOT\clsid\{15c93148-34fe-47e6-88e5-37607a3002f3}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{15C93148-34FE-47E6-88E5-37607A3002F3}"= "d:\programmi\recfree\tbrecf.dll" [2008-09-15 1784856]
[HKEY_CLASSES_ROOT\clsid\{15c93148-34fe-47e6-88e5-37607a3002f3}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"AlcoholAutomount"="d:\programmi\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-12-22 221568]
"MsnMsgr"="d:\programmi\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"PC Suite Tray"="d:\programmi\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-12-03 1205760]
"BitTorrent DNA"="d:\programmi\DNA\btdna.exe" [2008-12-29 342848]
"RGSC"="c:\gtaiv\Rockstar Games Social Club\RGSCLauncher.exe" [2008-12-30 306088]
"Sony Ericsson PC Suite"="d:\programmi\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-07-02 393216]
"Uniblue RegistryBooster 2009"="d:\programmi\Uniblue\RegistryBooster\RegistryBooster.exe" [2008-08-26 2019624]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="d:\windows\system32\NvCpl.dll" [2008-12-02 13680640]
"avast!"="d:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-01-12 81000]
"SmcService"="d:\progra~1\Sygate\SPF\smc.exe" [2009-01-12 2532576]
"Adobe Reader Speed Launcher"="d:\programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"PowerMenu"="d:\programmi\PowerMenu\PowerMenu.exe" [2002-12-20 57344]
"CoolSwitch"="d:\windows\system32\taskswitch.exe" [2002-03-19 45632]
"NvMediaCenter"="d:\windows\system32\NvMcTray.dll" [2008-12-02 86016]
"SunJavaUpdateSched"="d:\programmi\Java\jre6\bin\jusched.exe" [2009-01-08 136600]
"nwiz"="nwiz.exe" [2008-12-02 d:\windows\system32\nwiz.exe]
"Run StartupMonitor"="StartupMonitor.exe" [2000-05-20 d:\windows\StartupMonitor.exe]
"RTHDCPL"="RTHDCPL.EXE" [2007-12-12 d:\windows\RTHDCPL.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\System32\CTFMON.EXE" [2008-04-13 15360]
d:\documents and settings\sfarrito\Menu Avvio\Programmi\Esecuzione automatica\
BHODemon 2.0.lnk - d:\programmi\BHODemon 2\BHODemon.exe [2005-06-19 946176]
d:\documents and settings\All Users.WINDOWS\Menu Avvio\Programmi\Esecuzione automatica\
ASRock WiFi-802.11g.lnk - d:\programmi\ASRock WiFi-802.11g\RtWLan.exe [2008-12-26 978944]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.X264"= x264vfw.dll
"VIDC.3iv2"= 3ivxVfWCodec.dll
"VIDC.VP31"= vp31vfw.dll
"msacm.l3fhg"= mp3fhg.acm
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Programmi\\eMule AdunanzA\\eMule_AdnzA.exe"=
"c:\\pes2009\\pes2009.exe"=
"d:\\Programmi\\DNA\\btdna.exe"=
"d:\\Programmi\\BitTorrent\\bittorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\GTAIV\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"c:\\GTAIVPC\\Grand Theft Auto IV\\LaunchGTAIV.exe"=
"d:\\Programmi\\MSN Messenger\\msnmsgr.exe"=
"d:\\Programmi\\MSN Messenger\\livecall.exe"=
"d:\\Programmi\\uusee\\UUSeePlayer.exe"=
"d:\\Documents and Settings\\All Users.WINDOWS\\Dati applicazioni\\NexonEU\\NGM\\NGM.exe"=
"d:\\Documents and Settings\\All Users.WINDOWS\\Dati applicazioni\\NexonUS\\NGM\\NGM.exe"=
"c:\combat arms\CombatArms.exe"= c:\combat arms\CombatArms.exe:*Enabled:CombatArms.exe
"c:\combat arms\Engine.exe"= c:\combat arms\Engine.exe:*Enabled:Engine.exe
R0 avgntmgr;avgntmgr;d:\windows\system32\drivers\avgntmgr.sys [2008-12-18 22336]
R1 avgntdd;avgntdd;d:\windows\system32\drivers\avgntdd.sys [2008-12-18 45376]
R1 pctfw2;pctfw2;d:\windows\system32\drivers\pctfw2.sys [2009-01-13 160792]
S1 aswSP;avast! Self Protection; [x]
S3 getPlus(R) Helper;getPlus(R) Helper;d:\programmi\NOS\bin\getPlus_HelperSvc.exe [2008-12-19 33752]
S3 RTLWUSB;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;d:\windows\system32\drivers\RTL8187.sys [2008-12-26 269824]
S3 sdAuxService;PC Tools Auxiliary Service;d:\programmi\Spyware Doctor\pctsAuxs.exe [2009-01-13 337800]
S3 SjyPkt;SjyPkt;d:\windows\system32\drivers\SjyPkt.sys [2008-12-26 13532]
S4 aswFsBlk;aswFsBlk;d:\windows\system32\DRIVERS\aswFsBlk.sys
d:\windows\system32\DRIVERS\aswFsBlk.sys
![[?]](http://www.megalab.it/forum/images/smilies/confused.gif "Confuso")
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
\Shell\AutoRun\command - J:\LaunchU3.exe -a
.
Contenuto della cartella 'Scheduled Tasks'
2009-01-12 d:\windows\Tasks\sfarrito backup.job
- D:\ [2009-01-13 15:19]
2009-01-12 d:\windows\Tasks\sfarrito scan and fix.job
- D:\ [2009-01-13 15:19]
.
- - - - ORFÃOS REMOVIDOS - - - -
HKCU-Run-DAEMON Tools Lite - d:\programmi\DAEMON Tools Lite\daemon.exe
.
------- Supplementare di scansione -------
.
uStart Page =
hxxp://www.google.it/IE: Add to AMV Converter... - d:\programmi\MP3 Player Utilities 4.17\AMVConverter\grab.html
IE: E&sporta in Microsoft Excel - d:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
LSP: d:\programmi\File comuni\PC Tools\LSP\PCTLsp.dll
d:\windows\Downloaded Program Files\CONFLICT.1\csswlng.dll - d:\windows\Downloaded Program Files\CONFLICT.1\cssweb.dll
O16 -: {6CCE3920-3183-4B3D-808A-B12EB769DE12}
hxxp://www.commandondemand.com/eval/cod/cabs/cssweb.cabd:\windows\Downloaded Program Files\CONFLICT.1\cssweb.inf
FF - ProfilePath - d:\documents and settings\sfarrito\Dati applicazioni\Mozilla\Firefox\Profiles\dhwhgkff.default\
FF - component: d:\programmi\Mozilla Firefox\components\SiteVacuumXPCOM.dll
FF - component: d:\programmi\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
FF - plugin: d:\documents and settings\All Users.WINDOWS\Dati applicazioni\NexonEU\NGM\npNxGameeu.dll
FF - plugin: d:\documents and settings\All Users.WINDOWS\Dati applicazioni\NexonUS\NGM\npNxGameUS.dll
FF - plugin: d:\documents and settings\sfarrito\Dati applicazioni\Mozilla\Firefox\Profiles\dhwhgkff.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll
FF - plugin: d:\programmi\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: d:\programmi\Mozilla Firefox\plugins\npvideoegg-loader.dll
---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.
.
------- Associazioni di file -------
.
regfile\shell\edit\command=%SystemRoot%\system32\NOTEPAD.EXE %1
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-01-13 15:21:48
Windows 5.1.2600 Service Pack 3 NTFS
scansione processi nascosti ...
scansione entrate autostart nascoste ...
Scansione files nascosti ...
Scansione completata con successo
Files nascosti: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\vsdatant]
"ImagePath"=""
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-117609710-57989841-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:cb,2a,c4,5e,bf,95,bd,e0,d9,08,8c,5c,10,da,d0,c7,c3,e1,d7,c7,60,
d0,0a,ad,dc,a8,72,e8,fe,be,90,fe,8f,4d,50,d5,bb,22,c7,aa,b4,4f,72,1a,ec,8f,\
"rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•9~*]
"0140110900063D11C8EF10054038389C"="D?\\WINDOWS\\system32\\FM20ENU.DLL"
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\WPAEvents]
@Denied: (Full) (LocalSystem)
"OOBETimer"=hex:ff,d5,71,d6,8b,6a,8d,6f,d5,33,93,fd
"LastWPAEventLogged"=hex:d5,07,05,00,06,00,07,00,0f,00,38,00,24,00,fd,02
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------
- - - - - - - > 'lsass.exe'(920)
d:\programmi\File comuni\PC Tools\LSP\PCTLsp.dll
.
------------------------ Altri processi in esecuzione ------------------------
.
d:\programmi\Java\jre6\bin\jqs.exe
d:\programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
d:\programmi\File comuni\Nero\Nero BackItUp 4\NBService.exe
d:\windows\system32\nvsvc32.exe
d:\programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
d:\windows\system32\wbem\wmiapsrv.exe
d:\windows\system32\rundll32.exe
d:\programmi\PC Connectivity Solution\ServiceLayer.exe
d:\programmi\PC Connectivity Solution\Transports\NclUSBSrv.exe
d:\programmi\PC Connectivity Solution\Transports\NclRSSrv.exe
d:\windows\system32\wscntfy.exe
d:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
.
**************************************************************************
.
Ora fine scansione: 2009-01-13 15:26:06 - macchina è stato riavviato [sfarrito]
ComboFix-quarantined-files.txt 2009-01-13 14:26:04
Pre-Run: 2,565,840,896 byte disponibili
Post-Run: 2,502,807,552 byte disponibili
364 --- E O F --- 2009-01-02 12:04:21
Esegui 
![[:)]](http://www.megalab.it/forum/images/smilies/smile.gif "Smile")
![[rotolo]](http://www.megalab.it/forum/images/smilies/rotolbriggin.gif "Rotolo dal ridere")
![[bleh]](http://www.megalab.it/forum/images/smilies/bleh.gif "Linguaccia!")
![[^]](http://www.megalab.it/forum/images/smilies/Oh-yea.gif "Approvazione")
![[rolleyes]](http://www.megalab.it/forum/images/smilies/rolleyes.gif "Rolleyes")