ComboFix 11-08-29.01 - Vincenzo 29/08/2011 21:43:54.3.1 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.39.1033.18.959.374 [GMT 2:00]
Eseguito da: c:\users\Vincenzo\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
FW: COMODO Firewall *Enabled* {4D6F75E0-14AF-2E9E-AACD-24CDCF08AA2A}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: COMODO Defense+ *Enabled/Updated* {CE351521-78FA-2048-BB22-B68A4A5CA7EC}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Creati Da 2011-07-28 al 2011-08-29 )))))))))))))))))))))))))))))))))))
.
.
2011-08-29 20:04 . 2011-08-29 20:04 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-08-29 14:28 . 2011-08-29 14:28 -------- d-----w- c:\program files\COMODO
2011-08-29 14:20 . 2011-08-29 15:02 -------- d-----w- c:\programdata\Comodo
2011-08-29 14:18 . 2011-08-29 14:20 -------- d-----w- c:\programdata\Comodo Downloader
2011-08-29 14:10 . 2011-08-29 14:10 -------- d-----w- c:\program files\Common Files\McAfee
2011-08-29 14:09 . 2011-08-29 19:27 -------- d-----w- c:\program files\McAfee
2011-08-29 12:22 . 2010-11-09 12:56 98392 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-08-29 12:22 . 2010-11-09 12:56 27984 ----a-w- c:\windows\system32\sbbd.exe
2011-08-29 12:21 . 2011-08-29 16:51 -------- d-----w- C:\VIPRERESCUE
2011-08-29 09:59 . 2011-08-29 09:59 -------- d-----w- c:\users\Vincenzo\DoctorWeb
2011-08-29 09:41 . 2011-08-29 09:41 23624 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2011-08-29 09:41 . 2011-08-29 09:41 -------- d-----w- c:\program files\Hitman Pro 3.5
2011-08-29 09:40 . 2011-08-29 09:40 -------- d-----w- c:\programdata\Hitman Pro
2011-08-27 00:34 . 2011-08-12 02:44 7152464 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{BA8CEC63-413A-44E0-A334-8F2697AF174A}\mpengine.dll
2011-08-26 17:06 . 2011-08-26 17:06 388096 ----a-r- c:\users\Vincenzo\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-08-26 17:05 . 2011-08-26 17:05 -------- d-----w- c:\program files\Trend Micro
2011-08-26 17:05 . 2011-07-01 13:36 767952 ----a-w- c:\windows\BDTSupport.dll
2011-08-26 17:05 . 2011-07-01 13:36 149456 ----a-w- c:\windows\SGDetectionTool.dll
2011-08-26 17:05 . 2011-07-01 13:36 2029520 ----a-w- c:\windows\PCTBDCore.dll
2011-08-26 17:05 . 2011-07-01 13:36 1533904 ----a-w- c:\windows\PCTBDRes.dll
2011-08-26 16:50 . 2011-08-29 19:26 -------- d-----w- c:\program files\Common Files\PC Tools
2011-08-26 16:50 . 2011-08-29 19:26 -------- d-----w- c:\program files\PC Tools Security
2011-08-26 16:44 . 2011-08-29 14:16 -------- d-----w- c:\programdata\PC Tools
2011-08-25 10:47 . 2011-08-25 13:50 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2011-08-25 10:47 . 2011-08-25 10:54 -------- d-----w- c:\program files\Spybot - Search & Destroy
2011-08-25 00:52 . 2011-08-25 00:52 -------- d-----w- c:\users\Vincenzo\AppData\Roaming\Avira
2011-08-24 12:38 . 2011-08-24 12:38 -------- d-----w- c:\users\Vincenzo\AppData\Roaming\Malwarebytes
2011-08-24 12:38 . 2011-07-06 17:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-24 12:37 . 2011-08-24 12:37 -------- d-----w- c:\programdata\Malwarebytes
2011-08-24 12:37 . 2011-07-06 17:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-24 12:37 . 2011-08-24 12:38 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-24 09:47 . 2011-07-09 04:29 2048 ----a-w- c:\windows\system32\tzres.dll
2011-08-23 19:27 . 2011-08-23 19:27 -------- d-----w- c:\program files\iPod
2011-08-10 19:48 . 2011-08-10 19:48 -------- d-----w- c:\windows\it
2011-08-10 19:28 . 2011-08-10 19:28 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-08-10 19:21 . 2011-08-10 19:21 15712 ----a-w- c:\program files\Common Files\Windows Live\.cache\b164483c1cc579201\MeshBetaRemover.exe
2011-08-10 06:07 . 2011-08-10 06:07 -------- d-----w- c:\windows\system32\SPReview
2011-08-09 17:23 . 2011-06-23 04:33 3912576 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-08-09 17:23 . 2011-06-23 04:33 3967872 ----a-w- c:\windows\system32\ntkrnlpa.exe
2011-08-07 20:06 . 2011-08-23 02:11 -------- d-----w- c:\users\Vincenzo\AppData\Local\Windows Live Writer
2011-08-07 20:06 . 2011-08-07 20:06 -------- d-----w- c:\users\Vincenzo\AppData\Roaming\Windows Live Writer
2011-08-01 23:30 . 2011-08-01 23:31 -------- d-----w- c:\program files\TuneUpMedia
2011-07-31 18:19 . 2011-07-31 18:19 -------- d-----w- c:\program files\Bonjour
2011-07-31 10:28 . 2011-07-31 10:28 -------- d-----w- c:\program files\Apple Software Update
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-12 16:17 . 2011-06-23 09:43 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-08-10 06:22 . 2009-07-14 02:05 152576 ----a-w- c:\windows\system32\msclmd.dll
2011-07-20 09:34 . 2010-01-02 23:46 61960 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-07-20 09:34 . 2010-01-02 23:46 137656 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-07-12 09:20 . 2011-07-12 09:20 83816 ----a-w- c:\windows\system32\dns-sd.exe
2011-07-12 09:20 . 2011-07-12 09:20 73064 ----a-w- c:\windows\system32\dnssd.dll
2011-07-05 16:37 . 2011-07-05 16:37 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2011-07-05 16:37 . 2011-07-05 16:37 69632 ----a-w- c:\windows\system32\QuickTime.qts
2011-06-30 07:38 . 2011-06-30 07:38 82400 ----a-w- c:\windows\system32\drivers\inspect.sys
2011-06-30 07:38 . 2011-06-30 07:38 37592 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2011-06-30 07:38 . 2011-06-30 07:38 238960 ----a-w- c:\windows\system32\drivers\cmdGuard.sys
2011-06-30 07:38 . 2011-06-30 07:38 19088 ----a-w- c:\windows\system32\drivers\cmderd.sys
2011-06-30 07:37 . 2011-06-30 07:37 285256 ----a-w- c:\windows\system32\guard32.dll
2011-06-11 02:29 . 2011-07-13 08:50 2334208 ----a-w- c:\windows\system32\win32k.sys
2011-08-16 17:42 . 2011-03-24 14:06 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VeohPlugin"="c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" [2010-07-06 2634048]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-04-21 281768]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-12-08 1226608]
"DivX Download Manager"="c:\program files\DivX\DivX Plus Web Player\DDmService.exe" [2010-12-08 63360]
"PlusService"="c:\program files\Yuna Software\Messenger Plus!\PlusService.exe" [2011-05-26 800768]
"PCTools FGuard"="c:\program files\PC Tools Security\BDT\FGuard.exe" [2011-07-01 247760]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2011-06-30 2554696]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\guard32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Skype"="c:\program files\Skype\Phone\Skype.exe" /nosplash /minimized
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" /background
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"SoundMan"=SOUNDMAN.EXE
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
"Monitor"=c:\windows\PixArt\PAC207\Monitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-07-06 366640]
R3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2011-02-28 183560]
R3 DrvAgent32;DrvAgent32;c:\windows\system32\Drivers\DrvAgent32.sys [2010-09-22 23456]
R3 FlashUSB;FlashUSB;c:\windows\system32\DRIVERS\FlashUSB.sys [2009-05-12 16896]
R3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2009-03-31 36608]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 tsusbhub;tsusbhub; [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-11-26 420920]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [2011-06-30 238960]
S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [2011-06-30 37592]
S1 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys [2010-11-09 98392]
S2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\PC Tools Security\BDT\BDTUpdateService.exe [2011-07-01 337872]
S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~2\mcafee\SITEAD~1\mcsacore.exe [2011-08-10 94880]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-07-06 22712]
S3 PAC207;SoC PC-Camera;c:\windows\system32\DRIVERS\PFC027.SYS [2006-12-05 507136]
.
.
Contenuto della cartella 'Scheduled Tasks'
.
2011-08-29 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2010-01-01 15:24]
.
2011-08-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3581558910-1406399024-3161606330-1001Core.job
- c:\users\Vincenzo\AppData\Local\Google\Update\GoogleUpdate.exe [2009-12-31 20:07]
.
2011-08-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3581558910-1406399024-3161606330-1001UA.job
- c:\users\Vincenzo\AppData\Local\Google\Update\GoogleUpdate.exe [2009-12-31 20:07]
.
.
------- Scansione supplementare -------
.
uInternet Settings,ProxyOverride = *.local
IE: Free YouTube to MP3 Converter - c:\users\Vincenzo\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Scarica con Mipony -
file://c:\program files\MiPony\Browser\IEContext.htm
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{4B11CE1F-990B-4E9D-A1B0-25C5425448C4}: NameServer = 156.154.70.25,156.154.71.25
FF - ProfilePath - c:\users\Vincenzo\AppData\Roaming\Mozilla\Firefox\Profiles\rbu99iga.default\
FF - prefs.js: browser.search.defaulturl -
hxxp://search.conduit.com/ResultsExt.as ... ource=3&q={searchTerms}
FF - prefs.js: keyword.URL - chrome://browser-region/locale/region.properties
.
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------
.
- - - - - - - > 'winlogon.exe'(448)
c:\windows\system32\guard32.dll
.
- - - - - - - > 'lsass.exe'(516)
c:\windows\system32\guard32.dll
.
- - - - - - - > 'Explorer.exe'(368)
c:\windows\system32\guard32.dll
c:\windows\system32\NetworkExplorer.dll
.
Ora fine scansione: 2011-08-29 22:13:23
ComboFix-quarantined-files.txt 2011-08-29 20:13
ComboFix2.txt 2011-08-26 18:28
ComboFix3.txt 2011-08-23 03:51
.
Pre-Run: 5.322.596.352 byte disponibili
Post-Run: 6.060.650.496 byte disponibili
.
- - End Of File - - BB5770A0B7E91D01236CC99CCD489225