Credo avere BAGLE

[raffius]

Non mi funzionano più l'antivirus e vari programmi di rimozione virus.
Qualcuno mi può aiutare?
Questo è il log di combofix

ComboFix 09-08-04.01 - Raffaele 04/08/2009 19.04.05.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.39.1040.18.3067.2189 [GMT 2:00]
Eseguito da: c:\virus\ComboFix.exe
AV: F-Secure Client Security 8.01 *On-access scanning enabled* (Updated) {E7512ED5-4245-4B4D-AF3A-382D3F313F15}
FW: F-Secure Client Security 8.01 *enabled* {D4747503-0346-49EB-9262-997542F79BF4}

ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\InfoSat.txt
C:\Muestras
c:\programmi\Hewlett-Packard\IAM\bin\brand.dll
c:\windows\Installer\00193120.msi
c:\windows\system32\ftx32.dll
c:\windows\system32\system_euroe.dll

.
((((((((((((((((((((((((((((((((((((((( Driver/Servizi )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_111111S1RO1S1A
-------\Legacy_SK9OU0S
-------\Service_sK9Ou0s


((((((((((((((((((((((((( Files Creati Da 2009-07-04 al 2009-08-04 )))))))))))))))))))))))))))))))))))
.

Nessun nuovo file creato in questo arco di tempo

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-04 17:30 . 2009-07-17 14:30 -------- d-----w- c:\documents and settings\Raffaele\Dati applicazioni\Desktop Sidebar
2009-08-04 17:28 . 2009-04-24 16:47 -------- d-----w- c:\documents and settings\Raffaele\Dati applicazioni\stickies
2009-08-04 17:22 . 2009-04-24 16:48 -------- d-----w- c:\documents and settings\Raffaele\Dati applicazioni\Skype
2009-08-04 17:18 . 2009-04-29 11:46 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\VMware
2009-08-04 16:52 . 2009-08-04 08:45 -------- d-----w- c:\programmi\Stellar Phoenix File Recovery
2009-08-04 15:23 . 2009-08-04 10:16 80660 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-08-04 15:23 . 2009-08-04 10:16 6613024 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-08-04 14:38 . 2009-08-04 14:36 -------- d-----w- c:\programmi\EsetOnlineScanner
2009-08-04 14:14 . 2009-04-24 16:48 -------- d-----w- c:\documents and settings\Raffaele\Dati applicazioni\skypePM
2009-08-04 09:17 . 2009-08-04 09:17 -------- d-----w- c:\programmi\Trend Micro
2009-08-04 08:46 . 2009-08-04 08:46 4 ----a-w- c:\windows\vx86036.dat
2009-08-04 07:19 . 2009-04-27 09:15 -------- d-----w- c:\programmi\F-Secure
2009-08-03 18:12 . 2009-08-03 18:12 -------- d-----w- c:\programmi\FinalData
2009-08-03 17:30 . 2009-04-27 08:57 -------- d-----w- c:\programmi\UltraVNC
2009-08-03 07:13 . 2009-04-26 14:32 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Google Updater
2009-07-31 08:42 . 2009-04-24 12:40 -------- d-----w- c:\documents and settings\Raffaele\Dati applicazioni\ntr
2009-07-29 17:31 . 2009-05-20 12:43 -------- d-----w- c:\programmi\vanBasco's Karaoke Player
2009-07-27 21:20 . 2009-07-27 21:20 -------- d-----w- c:\documents and settings\Raffaele\Dati applicazioni\InterVideo
2009-07-25 01:36 . 2009-07-25 01:29 -------- d-----w- c:\documents and settings\Raffaele\Dati applicazioni\Any Video Converter
2009-07-25 01:29 . 2009-07-25 01:29 -------- d-----w- c:\programmi\Any Video Converter
2009-07-21 12:41 . 2009-04-29 12:45 -------- d-----w- c:\documents and settings\Raffaele\Dati applicazioni\VMware
2009-07-21 12:37 . 2006-03-02 11:00 580930 ----a-w- c:\windows\system32\perfh010.dat
2009-07-21 12:37 . 2006-03-02 11:00 120346 ----a-w- c:\windows\system32\perfc010.dat
2009-07-20 21:07 . 2009-04-23 08:41 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Microsoft Help
2009-07-20 12:31 . 2009-04-24 17:09 -------- d-----w- c:\documents and settings\Raffaele\Dati applicazioni\FileZilla
2009-07-17 14:30 . 2009-07-17 14:30 -------- d-----w- c:\programmi\Desktop Sidebar
2009-07-17 14:29 . 2009-04-28 13:29 -------- d-----w- c:\programmi\Windows Sidebar
2009-07-15 10:30 . 2009-07-15 10:30 -------- d-----w- c:\programmi\Merge eFilm
2009-07-09 06:21 . 2009-04-27 09:16 33920 ----a-w- c:\windows\system32\drivers\fsbts.sys
2009-07-03 13:29 . 2009-04-24 16:25 -------- d-----w- c:\programmi\JobControl
2009-06-29 15:55 . 2006-03-02 11:00 827392 ----a-w- c:\windows\system32\wininet.dll
2009-06-29 15:55 . 2006-03-02 11:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-06-29 15:54 . 2006-03-02 11:00 17408 ----a-w- c:\windows\system32\corpol.dll
2009-06-26 13:38 . 2009-04-23 07:43 98008 ----a-w- c:\documents and settings\Raffaele\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2009-06-22 16:49 . 2009-05-01 16:20 -------- d-----w- c:\documents and settings\Raffaele\Dati applicazioni\Nero
2009-06-22 13:22 . 2009-06-22 13:22 -------- d-----w- c:\programmi\HiT Software
2009-06-22 07:41 . 2009-06-08 08:14 -------- d-----w- c:\programmi\Sistemi
2009-06-22 07:27 . 2009-06-22 07:27 -------- d-----w- c:\programmi\Fortinet
2009-06-18 13:26 . 2009-06-18 13:23 -------- d-----w- c:\documents and settings\Raffaele\Dati applicazioni\U3
2009-06-16 14:36 . 2006-03-02 11:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2006-03-02 11:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-10 16:01 . 2009-04-27 07:31 -------- d-----w- c:\programmi\Windows Desktop Search
2009-06-08 14:24 . 2009-06-08 08:28 243195 ----a-w- C:\DS_RAFFAELE-HP.ZIP
2009-06-08 08:11 . 2009-06-08 08:10 -------- d-----w- c:\programmi\File comuni\Pervasive Software Shared
2009-06-06 09:12 . 2009-06-06 09:12 -------- d-----w- c:\programmi\Replay Converter 3
2009-06-03 19:09 . 2006-03-02 11:00 1296384 ----a-w- c:\windows\system32\quartz.dll
2009-06-02 15:30 . 2009-06-02 15:30 137 ----a-w- c:\documents and settings\Raffaele\Impostazioni locali\Dati applicazioni\fusioncache.dat
2009-05-26 09:07 . 2009-05-26 09:07 84952 ----a-w- c:\windows\system32\OnlineScannerUninstaller.exe
2009-05-26 09:07 . 2009-05-26 09:07 117912 ----a-w- c:\windows\system32\OnlineScannerLang.dll
2009-05-26 09:07 . 2009-05-26 09:07 262112 ----a-w- c:\windows\system32\OnlineScannerDLLA.dll
2009-05-26 09:07 . 2009-05-26 09:07 245632 ----a-w- c:\windows\system32\OnlineScannerDLLW.dll
2009-05-26 09:07 . 2009-05-26 09:07 146752 ----a-w- c:\windows\system32\lnod32umc.dll
2009-05-26 09:07 . 2009-05-26 09:07 113792 ----a-w- c:\windows\system32\lnod32upd.dll
2009-05-26 09:07 . 2009-05-26 09:07 233352 ----a-w- c:\windows\system32\lnod32apiW.dll
2009-05-26 09:07 . 2009-05-26 09:07 204512 ----a-w- c:\windows\system32\lnod32apiA.dll
2009-05-24 22:24 . 2008-05-26 20:18 350208 ----a-w- c:\windows\system32\mssph.dll
2009-05-12 13:12 . 2009-04-22 09:57 26144 ----a-w- c:\windows\system32\spupdsvc.exe
2009-05-07 15:32 . 2006-03-02 11:00 347648 ----a-w- c:\windows\system32\localspl.dll
2008-04-13 17:14 . 2006-03-02 11:00 362625 --sh--r- c:\windows\system32\jvjrvt.exe
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\programmi\File comuni\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]
"MoneyAgent"="c:\programmi\Microsoft Money\System\Money Express.exe" [1999-08-03 122944]
"Google Update"="c:\documents and settings\Raffaele\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe" [2009-04-26 133104]
"swg"="c:\programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-04-26 39408]
"Skype"="c:\programmi\Skype\Phone\Skype.exe" [2009-04-21 24264488]
"SIDEBAR"="c:\programmi\Desktop Sidebar\dsidebar.exe" [2006-07-09 1777664]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FRYMXINS"="c:\programmi\ATI Technologies\Fire GL 3D Studio Max\atiimxgl" [X]
"picon"="c:\programmi\File comuni\Intel\Privacy Icon\PrivacyIconClient.exe" [2008-06-02 367128]
"AccelerometerSysTrayApplet"="c:\windows\system32\AccelerometerSt.Exe" [2008-06-18 82224]
"StartCCC"="c:\programmi\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"IAAnotif"="c:\programmi\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-06-20 178712]
"snuvcdsm"="c:\windows\snuvcdsm.exe" [2008-10-09 27176]
"SynTPEnh"="c:\programmi\Synaptics\SynTP\SynTPEnh.exe" [2008-03-27 1040384]
"accrdsub"="c:\programmi\ActivIdentity\ActivClient\accrdsub.exe" [2007-05-15 293168]
"PTHOSTTR"="c:\programmi\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2008-07-08 238896]
"CognizanceTS"="c:\progra~1\HEWLET~1\IAM\Bin\ASTSVCC.dll" [2008-06-18 24848]
"QlbCtrl.exe"="c:\programmi\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-06-03 177456]
"Cpqset"="c:\programmi\Hewlett-Packard\Default Settings\cpqset.exe" [2008-06-03 65536]
"hpWirelessAssistant"="c:\programmi\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
"WatchDog"="c:\programmi\InterVideo\DVD Check\DVDCheck.exe" [2008-05-23 197904]
"SunJavaUpdateSched"="c:\programmi\Java\jre6\bin\jusched.exe" [2009-04-23 148888]
"GrooveMonitor"="c:\programmi\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"SoundMAXPnP"="c:\programmi\Analog Devices\Core\smax4pnp.exe" [2008-10-16 1044480]
"Client Access Service"="c:\programmi\IBM\Client Access\cwbsvstr.exe" [2005-10-19 20531]
"AdobeCS4ServiceManager"="c:\programmi\File comuni\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"Adobe Acrobat Speed Launcher"="c:\programmi\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232]
"Acrobat Assistant 8.0"="c:\programmi\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-11 640376]
"F-Secure Manager"="c:\programmi\F-Secure\Common\FSM32.EXE" [2009-08-04 182936]
"F-Secure TNB"="c:\programmi\F-Secure\FSGUI\TNBUtil.exe" [2009-08-04 1182304]
"VMware hqtray"="c:\programmi\VMware\VMware Player\hqtray.exe" [2009-03-26 64048]
"EpsonAPD4SV"="c:\programmi\EPSON\EPSON Advanced Printer Driver 4\Tools\EAPSV\EAPSV.EXE" [2008-09-16 210304]
"QuickTime Task"="c:\programmi\QuickTime\qttask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\programmi\iTunes\iTunesHelper.exe" [2009-04-02 342312]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

c:\documents and settings\Raffaele\Menu Avvio\Programmi\Esecuzione automatica\
Ritaglio schermata e avvio di OneNote 2007.lnk - c:\programmi\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-7 101440]
Stickies.lnk - c:\programmi\Stickies\stickies.exe [2008-8-28 765952]

c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
BTTray.lnk - c:\programmi\WIDCOMM\Bluetooth Software\BTTray.exe [2008-5-12 576104]
DVD Check.lnk - c:\programmi\InterVideo\DVD Check\DVDCheck.exe [2009-4-22 197904]
Pervasive.SQL Workgroup Engine.lnk - c:\pvsw\Bin\w3dbsmgr.exe [2009-6-8 106546]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\programmi\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ackpbsc]
2007-05-15 14:08 112640 ----a-w- c:\windows\system32\ackpbsc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\acunlock]
2007-05-15 14:08 281088 ----a-w- c:\programmi\ActivIdentity\ActivClient\acunlock.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard]
2008-06-18 12:05 126736 ----a-w- c:\programmi\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DeviceNP]
2008-04-21 09:48 69632 ----a-w- c:\windows\system32\DeviceNP.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\APSHook.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli ASWLNPkg

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmi\\File comuni\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Programmi\\File comuni\\Adobe\\Adobe Version Cue CS4\\Server\\bin\\VersionCueCS4.exe"=
"c:\\Programmi\\eMule\\emule.exe"=
"c:\\Programmi\\VMware\\VMware Player\\vmware-authd.exe"=
"c:\\Programmi\\Pinnacle\\Studio 11\\programs\\RM.exe"=
"c:\\Programmi\\Pinnacle\\Studio 11\\programs\\Studio.exe"=
"c:\\Programmi\\Pinnacle\\Studio 11\\programs\\PMSRegisterFile.exe"=
"c:\\Programmi\\Pinnacle\\Studio 11\\programs\\umi.exe"=
"c:\\Programmi\\Skype\\Phone\\Skype.exe"=
"c:\\Programmi\\ZyXEL\\ZyWALL VPN Client\\IreIKE.exe"=
"c:\programmi\ZyXEL\ZyWALL VPN Client\ViewLog.exe"= c:\programmi\ZyXEL\ZyWALL VPN Client\ViewLog.exe:127.0.0.1/255.255.255.255:Enabled:ViewLog
"c:\programmi\ZyXEL\ZyWALL VPN Client\CmonApp.exe"= c:\programmi\ZyXEL\ZyWALL VPN Client\CmonApp.exe:127.0.0.1/255.255.255.255:Enabled:CMonApp
"c:\programmi\ZyXEL\ZyWALL VPN Client\vpn.exe"= c:\programmi\ZyXEL\ZyWALL VPN Client\vpn.exe:127.0.0.1/255.255.255.255:Enabled:VPN Connection Manager

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"3703:TCP"= 3703:TCP:Adobe Version Cue CS4 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS4 Server
"51000:TCP"= 51000:TCP:Adobe Version Cue CS4 Server
"51001:TCP"= 51001:TCP:Adobe Version Cue CS4 Server

R0 fsbts;fsbts;c:\windows\system32\drivers\fsbts.sys [27/04/2009 11.16.42 33920]
R0 SafeBoot;SafeBoot;c:\windows\system32\drivers\SafeBoot.sys [11/07/2008 14.50.18 109184]
R0 SbAlg;SbAlg;c:\windows\system32\drivers\SbAlg.sys [11/07/2008 14.50.26 51376]
R0 SbFsLock;SbFsLock;c:\windows\system32\drivers\SbFsLock.sys [11/07/2008 14.50.22 12928]
R0 SFAUDIO;Sonic Focus DSP Driver;c:\windows\system32\drivers\sfaudio.sys [22/04/2009 11.57.58 24064]
R1 F-Secure HIPS;F-Secure HIPS Driver;c:\programmi\F-Secure\HIPS\drivers\fshs.sys [27/04/2009 11.16.26 67808]
R1 IPSECDRV;SafeNet IPSec Plugin;c:\windows\system32\drivers\IpSecDrv.sys [22/05/2009 10.36.21 136760]
R1 RsvLock;RsvLock;c:\windows\system32\drivers\rsvlock.sys [11/07/2008 14.50.20 12496]
R2 accoca;ActivClient Middleware Service;c:\programmi\ActivIdentity\ActivClient\accoca.exe [15/05/2007 16.08.40 182576]
R2 ASChannel;Canale di comunicazione locale;c:\windows\System32\svchost.exe -k Cognizance [02/03/2006 13.00.00 14336]
R2 ATService;AuthenTec Fingerprint Service;c:\programmi\Fingerprint Sensor\AtService.exe [12/06/2008 12.21.06 1164536]
R2 Crypto;Crypto;c:\windows\system32\drivers\Crypto.sys [22/05/2009 10.36.19 536634]
R2 EpsonPOSLog;Epson Point of Service Log Service;c:\programmi\EPSON\EPSON Advanced Printer Driver 4\EpsonPHLog.exe [24/01/2009 1.23.50 290816]
R2 EpsonPOSPort;Epson Point of Service Port Handler;c:\programmi\EPSON\EPSON Advanced Printer Driver 4\EpsonPH.exe [07/05/2009 16.17.17 376832]
R2 FortiSslvpnDaemon;FortiClient SSL VPN;c:\windows\system32\FortiSSLVPNdaemon.exe [09/03/2009 16.07.18 518688]
R2 HP ProtectTools Service;HP ProtectTools Service;c:\programmi\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe [08/07/2008 18.18.32 19968]
R2 HpFkCryptService;Drive Encryption Service;c:\programmi\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [11/07/2008 14.49.40 256512]
R2 NgVpnMgr;Aventail VPN Client;c:\windows\system32\ngvpnmgr.exe [01/08/2007 18.04.34 203843]
R2 UNS;Intel(R) Active Management Technology User Notification Service;c:\programmi\File comuni\Intel\Privacy Icon\UNS\UNS.EXE [22/04/2009 12.03.40 2058776]
R2 vmci;VMware vmci;c:\windows\system32\drivers\vmci.sys [26/03/2009 22.58.38 54960]
R3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [22/04/2009 12.01.03 93696]
R3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\system32\drivers\ATSwpWDF.sys [12/06/2008 14.40.50 477696]
R3 Com4QLBEx;Com4QLBEx;c:\programmi\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [22/04/2009 12.19.25 193840]
R3 DniVap;SafeNet WAN Miniport (VA);c:\windows\system32\drivers\vap.sys [22/05/2009 10.14.42 36188]
R3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [22/04/2009 12.14.47 243856]
R3 NgLog;Aventail VPN Logging;c:\windows\system32\drivers\nglog.sys [01/08/2007 18.02.22 25240]
R3 NgVpn;Aventail VPN Adapter;c:\windows\system32\drivers\ngvpn.sys [01/08/2007 18.03.40 76440]
R3 pppop;PPPoP WAN Adapter;c:\windows\system32\drivers\pppop.sys [03/02/2009 12.43.38 36384]
R3 rismc32;RICOH Smart Card Reader;c:\windows\system32\drivers\rismc32.sys [22/04/2009 12.14.10 47616]
S0 nxemkdvo;nxemkdvo;c:\windows\system32\drivers\dcpwgm.sys c:\windows\system32\drivers\dcpwgm.sys
S2 ASBroker;Logon Session Broker;c:\windows\System32\svchost.exe -k Cognizance [02/03/2006 13.00.00 14336]
S2 gupdate1c9c67c6e3d6432;Servizio di Google Update (gupdate1c9c67c6e3d6432);c:\programmi\Google\Update\GoogleUpdate.exe [26/04/2009 16.36.47 133104]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\programmi\File comuni\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [15/08/2008 5.46.20 284016]
S3 DAMDrv;DAMDrv;c:\windows\system32\drivers\DAMDrv.sys [22/04/2009 13.58.38 32256]
S3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\programmi\F-Secure\Anti-Virus\minifilter\fsgk.sys [27/04/2009 11.16.18 99960]
S3 FLCDLOCK;Controllo/blocco dispositivi HP ProtectTools;c:\windows\system32\flcdlock.exe [21/04/2008 13.27.58 349432]
S3 FSORSPClient;F-Secure ORSP Client;c:\programmi\F-Secure\ORSP Client\fsorsp.exe [27/04/2009 11.16.26 55904]
S3 NgFilter;Aventail VPN Filter;c:\windows\system32\drivers\ngfilter.sys [01/08/2007 18.03.46 20632]
S3 NgWfp;Aventail VPN Callout;c:\windows\system32\drivers\ngwfp.sys [01/08/2007 18.03.52 21656]
S3 RoxMediaDB10;RoxMediaDB10;c:\programmi\File comuni\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [08/04/2008 14.12.50 1112560]
S3 TMUSB;EPSON USB Device Driver for TM/BA/EU Printers;c:\windows\system32\drivers\TMUSBXP.sys [07/05/2009 16.17.32 48384]
S4 F-Secure Filter;F-Secure File System Filter;c:\programmi\F-Secure\Anti-Virus\win2k\fsfilter.sys [27/04/2009 11.16.18 39776]
S4 F-Secure Recognizer;F-Secure File System Recognizer;c:\programmi\F-Secure\Anti-Virus\win2k\fsrec.sys [27/04/2009 11.16.18 25184]
S4 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [27/04/2009 11.16.35 79936]

--- Altri Servizi/Drivers In Memoria ---

*NewlyCreated* - WUDFPF
*NewlyCreated* - WUDFSVC

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Cognizance REG_MULTI_SZ ASBroker ASChannel

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\programmi\File comuni\LightScribe\LSRunOnce.exe"
.
Contenuto della cartella 'Scheduled Tasks'

2009-08-04 c:\windows\Tasks\Google Software Updater.job
- c:\programmi\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-04-26 14:32]
.
.
------- Scansione supplementare -------
.
uInternet Settings,ProxyServer = socks=169.0.0.19:1080
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Aggiungi a PDF esistente - c:\programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Aggiungi destinazione link a PDF esistente - c:\programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Converti destinazione link in Adobe PDF - c:\programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Converti in Adobe PDF - c:\programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Invia a Bluetooth - c:\programmi\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: Invia a periferica &Bluetooth... - c:\programmi\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
LSP: c:\programmi\F-Secure\FSPS\program\FSLSP.DLL
LSP: c:\programmi\VMware\VMware Player\vsocklib.dll
Trusted Zone: oggisposifelici.it\www
Trusted Zone: profisaz.it
Trusted Zone: profisweb.it
Trusted Zone: sistemi.com
Trusted Zone: sistemi.net
TCP: {6C40F3EA-D297-40D5-A2C2-C58F891E6EED} = 10.99.99.118,10.99.99.111,10.0.0.123
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-04 19:19
Windows 5.1.2600 Service Pack 3 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\programmi\Hewlett-Packard\Default Settings\cpqset.exe? ?????????????????????????|?M?|?????M?|??@

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,7e,20,1a,e5,0f,
20,8d,98,2e,e8,e1,00,eb,16,2b,de,89,d0,e5,4e,1a,52,94,02,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,54,79,54,8a,c0,
e3,08,f5,46,47,15,b0,92,4b,c7,ef,2b,10,43,57,f9,41,53,67,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:25,da,ec,7e,55,20,c9,26,c9,75,91,61,8f,
2e,cb,62,7a,45,05,fd,91,e8,6f,31,b2,bc,0f,63,5e,a9,19,62,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:3e,1e,9e,e0,57,5a,93,61,aa,4a,f7,48,39,
97,57,d7,6b,65,49,6a,7e,99,74,f7,08,81,17,66,76,b6,45,32,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:cd,44,cd,b9,a6,33,6c,cd,c3,6a,47,67,6d,
1e,81,24,e9,02,6c,fa,fb,1d,47,57,6c,d8,c6,b1,a1,40,2e,2f,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:df,20,58,62,78,6b,cf,c8,90,c3,bc,fe,a0,
97,65,6d,50,93,e5,ab,ec,6a,4e,ab,8e,1b,c6,48,b7,da,94,bb,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:fb,a7,78,e6,12,2f,9a,ea,f3,f1,5b,87,48,
26,94,35,97,20,4e,9a,c7,f1,35,ee,a7,b5,a5,1e,4b,5f,93,43,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:83,6c,56,8b,a0,85,96,ab,2f,b1,8e,7f,fa,
3a,68,74,aa,52,c6,00,84,3c,26,64,68,db,8e,e7,35,a0,2d,10,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,d3,8d,05,a9,c9,
bd,86,14,b2,46,9a,e2,1b,fe,1b,94,2d,61,0c,9d,b1,80,4c,78,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:3d,ce,ea,26,2d,45,aa,78,63,5a,0f,9c,1d,
9f,1a,17,37,a4,aa,c3,a6,15,56,0a,63,65,ea,b6,dd,93,ee,e4,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:2a,b7,cc,b5,b9,7f,41,e7,e0,a7,e9,1d,63,
9f,e6,40,f8,31,0f,a9,5f,a0,ec,fb,2c,b9,7f,cf,02,78,26,5e,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,64,62,81,47,46,
c0,0f,f1,05,73,21,dd,54,d8,4a,c5,ba,b8,03,c6,1e,b5,b4,8c,6c,43,2d,1e,aa,22,\

[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,79,00,73,00,\
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------

- - - - - - - > 'winlogon.exe'(380)
c:\programmi\Hewlett-Packard\IAM\bin\ocgina.dll
c:\programmi\Hewlett-Packard\IAM\bin\ItMsg.dll
c:\programmi\Hewlett-Packard\IAM\bin\ITA\ocgina.dll
c:\programmi\Hewlett-Packard\IAM\bin\ITA\ItMsg.dll
c:\programmi\Hewlett-Packard\IAM\Bin\HPPlugIn.dll
c:\windows\system32\sxs.dll
c:\programmi\Hewlett-Packard\HP ProtectTools Security Manager\PTHostServices.dll
c:\windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
c:\windows\assembly\GAC_MSIL\System.Xml.resources\2.0.0.0_it_b77a5c561934e089\System.Xml.resources.dll
c:\programmi\Hewlett-Packard\HP ProtectTools Security Manager\Interop.HPQWMIEXLib.dll
c:\windows\system32\msi.dll
c:\programmi\Hewlett-Packard\HP ProtectTools Security Manager\Interop.PTHstServsLib.dll
c:\programmi\Hewlett-Packard\HP ProtectTools Security Manager\PTHstServs.dll
c:\programmi\Hewlett-Packard\HP ProtectTools Security Manager\BIOSDomain.dll
c:\programmi\Hewlett-Packard\HP ProtectTools Security Manager\Interop.PTPluginLib.dll
c:\programmi\Hewlett-Packard\HP ProtectTools Security Manager\PTStrings.dll
c:\programmi\F-Secure\FSPS\program\FSLSP.DLL
c:\programmi\Hewlett-Packard\Drive Encryption\Languages\0010\SbHpFve.lng
c:\programmi\Hewlett-Packard\HP ProtectTools Security Manager\HPjCard.dll
c:\windows\system32\acomx.dll
c:\windows\system32\aclog.dll
c:\windows\system32\asphat32.dll
c:\windows\system32\ackpbsc.dll
c:\windows\system32\ACLIBEAY.dll
c:\windows\system32\acerrmes.dll
c:\windows\system32\acevtsub.dll
c:\windows\system32\aspcom.dll
c:\programmi\ActivIdentity\ActivClient\Resources\Merged\acerrmrc.dll
c:\programmi\ActivIdentity\ActivClient\Resources\Merged\asphatrc.dll
c:\windows\system32\acbsi21.dll
c:\programmi\Hewlett-Packard\DeviceAccessManager\0010\PTDMLiteResource.dll
c:\windows\system32\flcdlmsg.dll
c:\programmi\Hewlett-Packard\IAM\Bin\AsChnl.dll
c:\programmi\Hewlett-Packard\IAM\Bin\ItVCClient.dll
c:\programmi\Hewlett-Packard\IAM\Bin\ItReports.DLL
c:\programmi\Hewlett-Packard\IAM\Bin\ItVCard.dll
c:\programmi\Hewlett-Packard\IAM\bin\ITA\NetAdmin.dll
c:\programmi\Hewlett-Packard\IAM\bin\ItTal.dll
c:\windows\system32\Ati2evxx.dll
c:\programmi\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll
c:\programmi\Hewlett-Packard\IAM\Bin\TrayIcon.dll
c:\programmi\Hewlett-Packard\IAM\Bin\ItDac.DLL
c:\programmi\Hewlett-Packard\IAM\Bin\STEngine.dll
c:\programmi\Hewlett-Packard\IAM\Bin\BioAuth.dll
c:\programmi\Hewlett-Packard\IAM\Bin\ItClient.dll
c:\programmi\Hewlett-Packard\IAM\bin\ITA\BioAuth.dll
c:\programmi\Hewlett-Packard\IAM\Bin\ASBioATFSS.dll
c:\programmi\Hewlett-Packard\IAM\bin\ITA\ASBioATFSS.dll
c:\programmi\Hewlett-Packard\IAM\Bin\ittalsnap.dll
c:\programmi\Hewlett-Packard\IAM\bin\ITA\ittalsnap.dll
c:\programmi\Bonjour\mdnsNSP.dll
c:\programmi\Hewlett-Packard\IAM\Bin\AuthWiz.dll
c:\programmi\Hewlett-Packard\IAM\bin\ITA\AuthWiz.dll
c:\programmi\Hewlett-Packard\IAM\Bin\TpmAuth.dll
c:\programmi\Hewlett-Packard\IAM\bin\ITA\TpmAuth.dll
c:\programmi\Hewlett-Packard\IAM\Bin\TokenAuth.dll
c:\programmi\Hewlett-Packard\IAM\bin\ITA\TokenAuth.dll
c:\programmi\Hewlett-Packard\IAM\Bin\ItAuth.dll
c:\windows\system32\xenroll.dll
c:\windows\system32\WININET.dll
c:\programmi\ActivIdentity\ActivClient\acunlock.dll
c:\windows\system32\aipingui.dll
c:\programmi\ActivIdentity\ActivClient\Resources\Merged\aipinguirc.dll
c:\programmi\ActivIdentity\ActivClient\resources\acCobAPIrc.dll
c:\programmi\ActivIdentity\ActivClient\Resources\Merged\acunlockrc.dll
c:\windows\system32\DeviceNP.dll
c:\windows\system32\SSREGLIB.dll
c:\programmi\File comuni\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
c:\programmi\Hewlett-Packard\IAM\Bin\ItAPS.dll
c:\programmi\Hewlett-Packard\IAM\bin\ITA\ItAPS.dll
c:\windows\system32\APSHook.dll

- - - - - - - > 'lsass.exe'(436)
c:\programmi\Hewlett-Packard\IAM\bin\ASWLNPkg.dll
c:\programmi\Hewlett-Packard\IAM\bin\ItMsg.dll
c:\programmi\F-Secure\FSPS\program\FSLSP.DLL
c:\programmi\Bonjour\mdnsNSP.dll
c:\programmi\File comuni\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll

- - - - - - - > 'Explorer.exe'(2108)
c:\windows\system32\WININET.dll
c:\windows\system32\APSHook.dll
c:\programmi\Hewlett-Packard\IAM\Bin\ItClient.dll
c:\windows\system32\btmmhook.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\msi.dll
c:\programmi\File comuni\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\programmi\Microsoft Virtual PC\VPCShExH.DLL
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\programmi\WIDCOMM\Bluetooth Software\btkeyind.dll
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\programmi\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\programmi\ZyXEL\ZyWALL VPN Client\IPSecMon.exe
c:\programmi\ZyXEL\ZyWALL VPN Client\IreIKE.exe
c:\windows\system32\scardsvr.exe
c:\windows\system32\agrsmsvc.exe
c:\programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\programmi\ActiveXperts\Network Monitor\AxsNmSvc.exe
c:\programmi\Bonjour\mDNSResponder.exe
c:\windows\system32\Crypserv.exe
c:\programmi\F-Secure\common\FSMA32.EXE
c:\programmi\F-Secure\common\FSMB32.EXE
c:\programmi\F-Secure\common\FCH32.EXE
c:\programmi\Intel\Intel Matrix Storage Manager\IAANTMON.EXE
c:\programmi\File comuni\InterVideo\RegMgr\iviRegMgr.exe
c:\programmi\Java\jre6\bin\jqs.exe
c:\programmi\F-Secure\Anti-Virus\fsqh.exe
c:\programmi\F-Secure\common\FAMEH32.EXE
c:\programmi\File comuni\LightScribe\LSSrvc.exe
c:\programmi\Google\Update\1.2.183.7\GoogleCrashHandler.exe
c:\programmi\Intel\AMT\LMS.EXE
c:\programmi\File comuni\Microsoft Shared\VS7DEBUG\mdm.exe
c:\programmi\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
c:\programmi\File comuni\Nero\Nero BackItUp 4\NBService.exe
c:\programmi\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\programmi\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\windows\system32\vmnat.exe
c:\windows\system32\searchindexer.exe
c:\windows\system32\vmnetdhcp.exe
c:\programmi\Hewlett-Packard\Shared\hpqWmiEx.exe
c:\programmi\F-Secure\common\FNRB32.exe
c:\programmi\F-Secure\common\FIH32.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\programmi\ActivIdentity\ActivClient\acevents.exe
c:\programmi\Hewlett-Packard\IAM\Bin\asghost.exe
c:\programmi\ActivIdentity\ActivClient\acevents.exe
c:\programmi\Hewlett-Packard\Shared\HpqToaster.exe
c:\programmi\iPod\bin\iPodService.exe
c:\programmi\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\programmi\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\windows\system32\taskmgr.exe
c:\windows\system32\WudfHost.exe
.
**************************************************************************
.
Ora fine scansione: 2009-08-04 19.32.31 - Il pc è stato riavviato
ComboFix-quarantined-files.txt 2009-08-04 17:32

Pre-Run: 19.766.722.560 byte disponibili
Post-Run: 19.585.880.064 byte disponibili

475 --- E O F --- 2009-07-31 09:25

[ste_95]

C'è una bella quantità di file dubbi. Fai la scansione online con Kaspersky e posta il log, così sfatiamo ogni dubbio.

[raffius]

questo è il log di Kaspersky
http://www.megaupload.com/?d=8Z22HGRC

[Amantide]

Questi devi eliminare per evitare di riprendere il Bagle, e cerca in futuro di fare la scansione dei file sospetti sul www.virustotal.com prima di eseguirli.

C:\Documents and Settings\Raffaele\Documenti\Documenti_Vecchia Installazione\eMule Downloads\Incoming\Advanced_Access_Repair_1.2.zip Infected: Trojan-Downloader.Win32.Bagle.afn 1

C:\Documents and Settings\Raffaele\Documenti\Documenti_Vecchia Installazione\eMule Downloads\Incoming\Advanced_Access_Repair_1.2_(Patch).zip Infected: Trojan-Downloader.Win32.Bagle.afn 1

C:\Documents and Settings\Raffaele\Documenti\Documenti_Vecchia Installazione\eMule Downloads\Incoming\SCGrid_6.07\SCGrid_6.07.0xe Infected: Trojan-Downloader.Win32.Bagle.abo 1

C:\Documents and Settings\Raffaele\Documenti\Documenti_Vecchia Installazione\eMule Downloads\Incoming\SCGrid_6.07.zip Infected: Trojan-Downloader.Win32.Bagle.abo 1

C:\Programmi\eMule\Incoming\AccessFIX Data Recovery 5.57.zip Infected: Trojan-Downloader.Win32.Bagle.bai 1

C:\Programmi\eMule\Incoming\Stellar Phoenix Deleted File Recovery 3.0.zip Infected: Trojan-Downloader.Win32.Bagle.bai 1

C:\Programmi\eMule\Incoming\ZD Soft Video Recorder 1.0 Crack.zip

Elimina anche questo allegato email:

C:\Documents and Settings\Raffaele\Impostazioni locali\Dati applicazioni\Microsoft\Outlook\archivio raffaele.pst Infected: Trojan-Downloader.Win32.VB.ft 1

Questo programma invece dovrai reinstallare, perché il suo eseguibile è infetto (che è ovviamente da eliminare):

C:\Programmi\File comuni\LightScribe\LightScribeControlPanel.exe

Nel log di Hijackthis si vede comunque un po' di roba strana.
Intanto per i residui di Bagle scarica FindyKill (by Chiquitine29)ed installalo (è in francese però è di facile comprensione).
Una volta installato chiudi tutte le applicazioni attive e disconnettiti dal internet, poi clicca sull'icona di FindyKill e nella finestra dos che si aprirà scrivi 2 e premi Invio. Attendi il termine della scansione e posta qui il log che trovi in C:\FindyKill.txt

Poi reinstalla un decente antivirus, per esempio Avira, ed esegui la scansione completa dalla modalità provvisoria.

[raffius]

Fatto come detto.
Questo è il log di FindyKill.

############################## | FindyKill V5.005 |

# User : Raffaele (Administrators) # RAFFAELE-HP
# Update on 27/07/09 by Chiquitine29
# Start at: 18.45.14 | 06/08/2009
# Website : http://pagesperso-orange.fr/NosTools/index.html

# Processore Intel Pentium III Xeon
# Microsoft Windows XP Professional (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 7.0.5730.13
# Windows Firewall Status : Disabled
# AV : F-Secure Client Security 8.01 8.01 [ Enabled | Updated ]
# FW : F-Secure Client Security 8.01[ Enabled ]8.01

# C:\ # Disco rigido locale # 78,13 Go (18,58 Go free) # NTFS
# D:\ # Disco rigido locale # 97,65 Go (1,29 Go free) # NTFS
# E:\ # Disco rigido locale # 57,09 Go (36,76 Go free) [Volume] # NTFS
# F:\ # Disco CD-ROM
# H:\ # Disco CD-ROM
# S:\ # Connessione di rete
# T:\ # Connessione di rete
# V:\ # Connessione di rete

############################## | Active Processes |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Fingerprint Sensor\AtService.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\ZyXEL\ZyWALL VPN Client\IPSecMon.exe
C:\Programmi\ZyXEL\ZyWALL VPN Client\IreIKE.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ngvpnmgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\SCardSvr.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\ActivIdentity\ActivClient\accoca.exe
C:\WINDOWS\system32\agrsmsvc.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programmi\ActiveXperts\Network Monitor\AxsNmSvc.exe
C:\Programmi\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\crypserv.exe
C:\Programmi\EPSON\EPSON Advanced Printer Driver 4\EpsonPHLog.exe
C:\WINDOWS\system32\FortiSSLVPNdaemon.exe
C:\Programmi\F-Secure\Common\FSMA32.EXE
C:\Programmi\F-Secure\Common\FSMB32.EXE
C:\Programmi\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe
C:\Programmi\F-Secure\Common\FCH32.EXE
C:\Programmi\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Programmi\File comuni\InterVideo\RegMgr\iviRegMgr.exe
C:\Programmi\Java\jre6\bin\jqs.exe
C:\Programmi\F-Secure\Common\FAMEH32.EXE
C:\Programmi\F-Secure\Anti-Virus\fsqh.exe
C:\Programmi\Intel\AMT\LMS.exe
C:\Programmi\Google\Update\GoogleUpdate.exe
C:\Programmi\Google\Update\1.2.183.7\GoogleCrashHandler.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Programmi\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Programmi\File comuni\Nero\Nero BackItUp 4\NBService.exe
C:\Programmi\Microsoft SQL Server\90\Shared\sqlbrowser.exe
C:\Programmi\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\File comuni\Intel\Privacy Icon\UNS\UNS.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Programmi\EPSON\EPSON Advanced Printer Driver 4\EpsonPH.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\Programmi\Hewlett-Packard\Shared\hpqWmiEx.exe
C:\Programmi\F-Secure\Common\FNRB32.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Programmi\F-Secure\Common\FIH32.EXE
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Programmi\ActivIdentity\ActivClient\acevents.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\SearchFilterHost.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Hewlett-Packard\IAM\Bin\AsGHost.exe

################## | C: |


################## | C:\WINDOWS |


################## | C:\WINDOWS\system32 |


################## | C:\WINDOWS\system32\drivers |


################## | C:\Documents and Settings\Raffaele\Dati applicazioni |


################## | C:\Documents and Settings\Administrator\Application Data |


################## | C:\Documents and Settings\Administrator.DATAPROGET\Application Data |


################## | Other ... |


################## | Temporary Internet Files |


################## | Registry / Infected keys |

Deleted ! [HKCU\Software\Local AppWizard-Generated Applications\winupgro]

################## | State / Service / Information |

# Safe boot mode : OK


# Showing of hidden files : OK

# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 )
# EapHost -> Start = 2 ( Good = 2 | Bad = 4 )
# Ip6Fw -> Start = 2 ( Good = 2 | Bad = 4 )
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 )
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 )
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 )


################## | PEH ... |

Corrupted : C:\Programmi\F-Secure\Anti-Virus\fsav32.exe
[Offset = 0000012C - Value = 0x0001]

Corrupted : C:\Programmi\F-Secure\Anti-Virus\fsgk32st.exe
[Offset = 000000EC - Value = 0x0001]

Corrupted : C:\Programmi\F-Secure\common\FSM32.EXE
[Offset = 000000EC - Value = 0x0001]

Corrupted : C:\Programmi\F-Secure\FSAUA\program\VirusNews.exe
[Offset = 000000FC - Value = 0x0001]

Corrupted : C:\Programmi\F-Secure\FSGUI\fsavgui.exe
[Offset = 0000010C - Value = 0x0001]

Corrupted : C:\Programmi\F-Secure\FSGUI\FsDiagUi.exe
[Offset = 000000F4 - Value = 0x0001]

Corrupted : C:\Programmi\F-Secure\FSGUI\fsguidll.exe
[Offset = 000000FC - Value = 0x0001]

Corrupted : C:\Programmi\F-Secure\FSGUI\tnbutil.exe
[Offset = 000000F4 - Value = 0x0001]

Corrupted : C:\Programmi\F-Secure\FSMSI\ILAUNCHR.exe
[Offset = 0000010C - Value = 0x0001]

Corrupted : C:\Programmi\F-Secure\FSMSI\RunSetup.exe
[Offset = 000000E4 - Value = 0x0001]

Corrupted : C:\Programmi\F-Secure\ORSP Client\fsorsp.exe
[Offset = 000000EC - Value = 0x0001]

Corrupted : C:\Programmi\PowerQuest\PartitionMagic 8.0\DOCS\PM8Flash.exe
[Offset = 000000EC - Value = 0x0001]

Corrupted : C:\Programmi\PowerQuest\PartitionMagic 8.0\DrvMap.exe
[Offset = 00000204 - Value = 0x0001]

Corrupted : C:\Programmi\PowerQuest\PartitionMagic 8.0\pqbw.exe
[Offset = 00000114 - Value = 0x0001]

Corrupted : C:\Programmi\Trend Micro\HijackThis\HijackThis.exe
[Offset = 000000C4 - Value = 0x0001]

Corrupted : C:\Virus\avenger.exe
[Offset = 00000084 - Value = 0x0001]


################## | Cracks / Keygens / Serials |


################## | End of Report # FindyKill V5.005 ! |

[Amantide]

I programmi indicati con la voce Corrupted sono quelli danneggiati da Bagle e devono essere reinstallati. Per il resto la situazione sembra essere Ok.

[raffius]

Grazie 1000