Login Esegui login | Non sei registrato? Iscriviti ora (è gratuito!)
Username: Password:
  • Annuncio Pubblicitario

popup pubblicitari, a causa di un servizio

Un virus si è intromesso nel tuo computer? Vuoi navigare in tutta sicurezza? Sono sicure le transazione online? Come impedire a malintenzionati di intromettersi nel tuo pc? Come proteggere i tuoi dati? Qui trovi le risposte a queste ed altre domande

popup pubblicitari, a causa di un servizio

Messaggioda alexzappaladra » mer lug 08, 2009 6:52 am

da qualche giorno, mi son beccato sto schifo.
Spybot, doctor spyware e superantispyware già fatti girare, e hanno già ripulito.

Alla fine mi son trovato (accorto) di un servizio, un certo iyysieo.exe che oltre a mangiarmi una valangata di ram (70Mb) è la causa dei miei fastidi.
Su google non ho trovato nulla, mi piacerebbe capire da dove arriva sto infame di un processo, e magari contattare chi l'ha fatto o denunciarlo (chiedo troppo vero :D )

comeprocedo alla pulizia, a vostro avvisto?
son niubbo!
Avatar utente
alexzappaladra
Aficionado
Aficionado
 
Messaggi: 103
Iscritto il: mar mar 15, 2005 4:33 pm

Re: popup pubblicitari, a causa di un servizio

Messaggioda ste_95 » mer lug 08, 2009 6:53 am

[ciao]
Scarica ComboFix , salvandolo sul desktop con un nome di fantasia, ed esegui la scansione seguendo queste istruzioni (giù in fondo). Al termine della scansione verrà creato il file di report C:\combofix.txt, copia qui il suo contenuto inserendolo tra i tag LOG, in questo modo:
Codice: Seleziona tutto
[LOG]qui va inserito il log[/LOG]
«A volte è meglio tacere e sembrare stupidi che aprir bocca e togliere ogni dubbio.» Oscar Wilde
Avatar utente
ste_95
Membro Ufficiale (Gold)
Membro Ufficiale (Gold)
 
Messaggi: 17271
Iscritto il: lun ago 06, 2007 11:19 am

Re: popup pubblicitari, a causa di un servizio

Messaggioda alexzappaladra » mer lug 08, 2009 11:12 am

ok, fatto tutto!!!!

però per correttezza di avviso che ho localizzato il file strano (.exe) e l'ho cancellato (prima ne ho fatto una copia e zippato, magari che qualcuno lo vuole analizzare) fatto questo, navigando, il problema non mi si presenta più.

Ad ogni modo ,combofix l'ho fatto girare, e ti allego il log
Spero non vi siano cose personali :D

ComboFix 09-07-07.A4 - cybermod 08/07/2009 10.19.26.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.39.1040.18.3063.1753 [GMT 2:00]
Eseguito da: c:\documents and settings\cybermod\Desktop\!!! PROGRAMMI\Anti Spyware\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\npf.sys
c:\windows\system32\Ijl11.dll
c:\windows\system32\msconfig.exe
c:\windows\system32\Packet.dll
c:\windows\system32\WanPacket.dll
c:\windows\system32\wpcap.dll

.
((((((((((((((((((((((((((((((((((((((( Driver/Servizi )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF
-------\Service_NPF


((((((((((((((((((((((((( Files Creati Da 2009-06-08 al 2009-07-08 )))))))))))))))))))))))))))))))))))
.

2009-07-08 08:30 . 2009-07-08 08:30 -------- d-----w- c:\windows\system32\xircom
2009-07-08 08:30 . 2009-07-08 08:30 -------- d-----w- c:\windows\system32\wbem\snmp
2009-07-08 08:30 . 2009-07-08 08:30 -------- d-----w- c:\windows\srchasst
2009-07-08 08:30 . 2009-07-08 08:30 -------- d-----w- c:\programmi\microsoft frontpage
2009-07-07 21:25 . 2009-07-07 22:20 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Spybot - Search & Destroy
2009-07-07 21:25 . 2009-07-07 21:26 -------- d-----w- c:\programmi\Spybot - Search & Destroy
2009-07-07 21:20 . 2009-07-07 21:20 117760 ----a-w- c:\documents and settings\cybermod\Dati applicazioni\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-07-07 21:19 . 2009-07-07 21:19 -------- d-----w- c:\documents and settings\cybermod\Dati applicazioni\SUPERAntiSpyware.com
2009-07-07 18:19 . 2009-07-07 18:19 117760 ----a-w- c:\documents and settings\Administrator\Dati applicazioni\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-07-07 18:18 . 2009-07-07 18:18 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\SUPERAntiSpyware.com
2009-07-07 18:18 . 2009-07-07 21:19 -------- d-----w- c:\programmi\SUPERAntiSpyware
2009-07-07 18:18 . 2009-07-07 18:18 -------- d-----w- c:\documents and settings\Administrator\Dati applicazioni\SUPERAntiSpyware.com
2009-07-07 18:17 . 2009-07-07 18:17 -------- d-----w- c:\programmi\File comuni\Wise Installation Wizard
2009-07-07 18:06 . 2008-12-11 06:38 159600 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
2009-07-07 18:05 . 2009-04-03 09:18 130936 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2009-07-07 18:05 . 2008-12-18 10:16 73840 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2009-07-07 18:05 . 2009-07-07 18:07 -------- d-----w- c:\programmi\File comuni\PC Tools
2009-07-07 18:05 . 2008-12-10 09:36 64392 ----a-w- c:\windows\system32\drivers\pctplsg.sys
2009-07-07 18:05 . 2009-07-07 18:09 -------- d-----w- c:\programmi\Spyware Doctor
2009-07-07 18:05 . 2009-07-07 18:05 -------- d-----w- c:\documents and settings\cybermod\Dati applicazioni\PC Tools
2009-07-07 18:05 . 2009-07-07 18:05 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\PC Tools
2009-07-07 12:29 . 2009-07-07 12:29 -------- d-----w- c:\programmi\FileZilla Server
2009-07-06 14:02 . 2009-07-06 14:08 -------- d-----w- c:\windows\system32\FxsTmp
2009-07-05 23:23 . 2009-07-05 23:28 -------- d-----w- c:\documents and settings\cybermod\Dati applicazioni\albumart
2009-07-05 23:23 . 2009-07-05 23:23 -------- d-----w- c:\programmi\Album Cover Art Downloader
2009-07-04 09:54 . 2009-07-04 09:54 -------- d-----w- c:\programmi\Nsasoft
2009-07-04 07:12 . 2009-07-04 07:12 -------- d-----r- c:\documents and settings\LocalService\Preferiti
2009-07-04 07:12 . 2009-07-04 07:12 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-07-04 06:26 . 2009-07-04 06:26 -------- d-----w- c:\documents and settings\cybermod\Dati applicazioni\Alt-N
2009-07-04 06:26 . 2009-07-04 06:26 -------- d-----w- c:\programmi\Alt-N Technologies
2009-07-03 07:58 . 2009-07-03 07:59 -------- d-----w- c:\programmi\Alice MOBILE E169
2009-07-02 11:02 . 2009-07-07 21:42 -------- d---a-w- c:\documents and settings\All Users\Dati applicazioni\TEMP
2009-07-02 11:02 . 2009-07-02 11:02 -------- d-----w- c:\programmi\ZAR
2009-07-02 10:59 . 2009-07-02 10:59 -------- d-----w- c:\programmi\Runtime Software
2009-07-02 10:46 . 2009-07-02 10:46 -------- d-----w- c:\programmi\Ontrack
2009-07-02 10:43 . 2009-07-02 10:43 -------- d-----w- c:\programmi\Drive Rescue
2009-07-02 08:34 . 2009-07-02 08:34 131584 ----a-w- c:\windows\system32\SpoonUninstall.exe
2009-07-02 08:34 . 2009-07-02 08:36 -------- d-----w- c:\programmi\DualServer
2009-07-01 17:46 . 2009-07-04 07:09 -------- d-----w- c:\documents and settings\cybermod\Dati applicazioni\GoodSync
2009-07-01 17:46 . 2009-07-01 17:46 -------- d-----w- c:\programmi\Siber Systems
2009-06-29 22:00 . 2009-06-29 22:00 -------- d-----w- c:\documents and settings\cybermod\Impostazioni locali\Dati applicazioni\DeviceRemover
2009-06-29 22:00 . 2009-06-29 22:00 -------- d-----w- c:\programmi\Device Remover
2009-06-29 21:23 . 2008-04-13 16:13 21504 ----a-w- c:\windows\system32\hidserv.dll
2009-06-28 16:51 . 2009-06-28 16:51 -------- d-----w- c:\programmi\File comuni\PCSuite
2009-06-28 16:51 . 2009-06-28 16:51 -------- d-----w- c:\programmi\File comuni\Nokia
2009-06-28 16:50 . 2008-08-26 08:26 18816 ----a-w- c:\windows\system32\drivers\pccsmcfd.sys
2009-06-28 16:50 . 2009-06-28 16:50 -------- d-----w- c:\programmi\PC Connectivity Solution
2009-06-28 16:49 . 2009-06-28 16:49 33705352 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Installations\{55495E65-7C5B-48E4-BC7D-DE54F3DE5ED6}\Nokia_PC_Suite_7_1_30_8_ita.exe
2009-06-28 16:49 . 2009-06-28 16:49 95232 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Installations\{55495E65-7C5B-48E4-BC7D-DE54F3DE5ED6}\Installer\CommonCustomActions\pcswpcsi.exe
2009-06-28 16:49 . 2009-06-28 16:49 8192 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Installations\{55495E65-7C5B-48E4-BC7D-DE54F3DE5ED6}\Installer\CommonCustomActions\UninstCCD.exe
2009-06-28 16:49 . 2009-06-28 16:49 61440 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Installations\{55495E65-7C5B-48E4-BC7D-DE54F3DE5ED6}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2009-06-28 16:49 . 2009-06-28 16:49 10240 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Installations\{55495E65-7C5B-48E4-BC7D-DE54F3DE5ED6}\Installer\CommonCustomActions\UninstPCS.exe
2009-06-27 23:51 . 2009-06-27 23:51 -------- d-----w- C:\Sandbox
2009-06-27 23:41 . 2009-06-27 23:41 -------- d-----w- c:\programmi\Sandboxie
2009-06-27 20:41 . 2009-06-27 20:42 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-06-27 02:23 . 2009-06-27 02:23 -------- d-----w- c:\programmi\Rainbow Folders
2009-06-27 02:14 . 2009-06-27 02:15 -------- d-----w- c:\programmi\FreeCommander
2009-06-25 23:00 . 2009-06-25 23:00 -------- d-----w- c:\documents and settings\cybermod\Dati applicazioni\HandBrake
2009-06-25 22:59 . 2009-06-25 22:59 -------- d-----w- c:\documents and settings\cybermod\Impostazioni locali\Dati applicazioni\HandBrake
2009-06-25 22:49 . 2009-06-25 22:49 -------- d-----w- c:\programmi\HandBrake
2009-06-25 22:12 . 2009-06-23 09:06 245408 ----a-w- c:\documents and settings\cybermod\Dati applicazioni\Mozilla\Firefox\Profiles\yfmvjflt.default\extensions\LogMeInClient@logmein.com\plugins\unicows.dll
2009-06-25 22:12 . 2009-04-05 12:26 8784 ----a-w- c:\documents and settings\cybermod\Dati applicazioni\Mozilla\Firefox\Profiles\yfmvjflt.default\extensions\LogMeInClient@logmein.com\plugins\ractrlkeyhook.dll
2009-06-25 22:12 . 2009-04-05 12:26 71248 ----a-w- c:\documents and settings\cybermod\Dati applicazioni\Mozilla\Firefox\Profiles\yfmvjflt.default\extensions\LogMeInClient@logmein.com\plugins\LMIProxyHelper.exe
2009-06-25 22:12 . 2009-02-19 09:38 2633728 ----a-w- c:\documents and settings\cybermod\Dati applicazioni\Mozilla\Firefox\Profiles\yfmvjflt.default\extensions\LogMeInClient@logmein.com\plugins\npRACtrl.dll
2009-06-24 05:50 . 2009-06-24 05:50 -------- d-----w- c:\programmi\FormatFactory
2009-06-15 15:38 . 2001-10-28 15:42 116224 ----a-w- c:\windows\system32\pdfcmnnt.dll
2009-06-15 15:38 . 1998-08-05 06:45 122128 ----a-w- c:\windows\system32\VB6IT.DLL
2009-06-15 15:38 . 1998-08-05 06:45 150528 ----a-w- c:\windows\system32\MSCMCIT.DLL
2009-06-15 15:38 . 2009-06-15 15:38 -------- d-----w- c:\programmi\PDFCreator
2009-06-15 15:38 . 1998-08-05 06:45 63488 ----a-w- c:\windows\system32\MSCC2IT.DLL
2009-06-15 15:38 . 1998-07-05 23:00 23552 ----a-w- c:\windows\system32\MSMPIDE.DLL
2009-06-15 14:35 . 2009-06-15 14:35 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Hewlett-Packard
2009-06-15 14:35 . 2008-04-04 19:00 147456 ----a-w- c:\windows\system32\hpcpn5r1.dll
2009-06-15 14:32 . 2007-03-28 08:04 344064 ----a-w- c:\windows\system32\hpbicoin.dll
2009-06-14 11:52 . 2009-06-14 11:59 -------- d-----w- c:\programmi\KDE
2009-06-14 11:52 . 2009-06-14 11:52 -------- d-----w- c:\documents and settings\cybermod\Dati applicazioni\KDE
2009-06-14 10:33 . 2009-06-17 11:51 -------- d-----w- c:\programmi\PoigpsGo
2009-06-14 00:56 . 2009-06-08 12:00 110592 ----a-w- c:\documents and settings\cybermod\Dati applicazioni\Mozilla\Firefox\Profiles\yfmvjflt.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}\components\XpcomOpusConnector.dll
2009-06-12 21:34 . 2009-06-12 21:34 -------- d-----w- c:\documents and settings\NetworkService\Impostazioni locali\Dati applicazioni\Apple
2009-06-12 10:09 . 2009-06-12 10:09 -------- d-----w- c:\documents and settings\cybermod\Dati applicazioni\Kerio
2009-06-12 10:09 . 2009-06-12 10:09 -------- d-----w- c:\programmi\Kerio
2009-06-11 14:23 . 2004-03-02 15:37 125184 ------w- c:\windows\system32\drivers\imagesrv.sys
2009-06-11 14:23 . 2004-03-02 15:37 5504 ------w- c:\windows\system32\drivers\imagedrv.sys
2009-06-11 14:23 . 2004-07-26 15:16 476320 ------w- c:\windows\system32\ImagXpr7.dll
2009-06-11 14:23 . 2004-07-26 15:16 471040 ------w- c:\windows\system32\ImagXRA7.dll
2009-06-11 14:23 . 2004-07-26 15:16 262144 ------w- c:\windows\system32\ImagXR7.dll
2009-06-11 14:23 . 2004-07-26 15:16 1568768 ------w- c:\windows\system32\ImagX7.dll
2009-06-11 14:23 . 2001-07-09 09:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe
2009-06-11 14:23 . 2000-06-26 09:45 106496 ----a-w- c:\windows\system32\TwnLib20.dll
2009-06-11 14:23 . 2009-06-11 14:23 -------- d-----w- c:\programmi\Ahead
2009-06-11 14:23 . 2009-06-11 14:23 -------- d-----w- c:\programmi\File comuni\Ahead
2009-06-10 21:48 . 2009-06-18 09:18 135168 ----a-w- c:\documents and settings\LocalService\Impostazioni locali\Dati applicazioni\FontCache3.0.0.0.dat
2009-06-10 15:01 . 2009-06-10 15:01 -------- d-----w- c:\programmi\Makayama Interactive
2009-06-10 14:03 . 2009-04-30 21:13 12800 ------w- c:\windows\system32\dllcache\xpshims.dll
2009-06-10 14:03 . 2009-04-30 21:13 246272 ------w- c:\windows\system32\dllcache\ieproxy.dll
2009-06-10 07:31 . 2009-06-12 16:33 -------- d-----w- c:\programmi\ABF software
2009-06-09 12:24 . 2009-06-09 12:24 -------- d-----w- c:\programmi\Free iPod Video Converter
2009-06-09 12:19 . 2009-06-09 12:26 -------- d-----w- c:\documents and settings\cybermod\Impostazioni locali\Dati applicazioni\dcunningham.net
2009-06-09 12:17 . 2009-06-28 22:59 -------- d-----w- c:\documents and settings\cybermod\Dati applicazioni\gtk-2.0
2009-06-09 12:05 . 2009-06-23 18:18 -------- d-----w- c:\documents and settings\cybermod\Dati applicazioni\avidemux
2009-06-09 12:04 . 2009-06-28 22:58 -------- d-----w- c:\programmi\Avidemux 2.4
2009-06-09 11:56 . 2009-06-09 11:56 -------- d-----w- c:\programmi\AviSynth 2.5

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-08 08:31 . 2009-04-24 18:41 -------- d-----w- c:\documents and settings\LocalService\Dati applicazioni\VMware
2009-07-08 08:31 . 2009-04-24 18:40 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\VMware
2009-07-08 06:05 . 2004-08-19 13:00 86836 ----a-w- c:\windows\system32\perfc010.dat
2009-07-08 06:05 . 2004-08-19 13:00 495828 ----a-w- c:\windows\system32\perfh010.dat
2009-07-07 21:25 . 2009-04-25 15:12 -------- d-----w- c:\documents and settings\cybermod\Dati applicazioni\Hamachi
2009-07-06 23:00 . 2009-05-14 22:15 -------- d-----w- c:\documents and settings\cybermod\Dati applicazioni\vlc
2009-07-04 09:49 . 2009-07-04 09:49 0 ---ha-w- c:\windows\system32\drivers\Msft_User_PCCSWpdDriver_01_07_00.Wdf
2009-07-04 09:49 . 2009-07-04 09:49 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_user_01_07_00.Wdf
2009-07-04 07:36 . 2009-04-24 22:52 -------- d-----w- c:\documents and settings\cybermod\Dati applicazioni\VMware
2009-07-01 17:39 . 2009-04-25 13:20 -------- d-----w- c:\documents and settings\cybermod\Dati applicazioni\FileZilla
2009-06-30 22:51 . 2009-04-25 13:43 -------- d-----w- c:\documents and settings\cybermod\Dati applicazioni\.purple
2009-06-30 15:28 . 2009-04-28 22:35 -------- d-----w- c:\documents and settings\cybermod\Dati applicazioni\dvdcss
2009-06-30 14:54 . 2009-04-28 09:33 -------- d-----w- c:\programmi\Foxit Software
2009-06-29 06:47 . 2009-04-25 17:10 -------- d-----w- c:\documents and settings\cybermod\Dati applicazioni\Nokia
2009-06-28 16:51 . 2009-04-25 17:08 -------- d-----w- c:\programmi\Nokia
2009-06-28 16:50 . 2009-04-25 17:08 -------- d-----w- c:\programmi\DIFX
2009-06-28 16:49 . 2009-04-25 17:07 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Installations
2009-06-27 16:47 . 2009-04-26 22:26 -------- d-----w- c:\documents and settings\cybermod\Dati applicazioni\Apple Computer
2009-06-26 05:32 . 2009-04-27 18:08 -------- d-----w- c:\documents and settings\cybermod\Dati applicazioni\uTorrent
2009-06-18 10:28 . 2009-04-24 21:35 53968 ----a-w- c:\documents and settings\cybermod\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2009-06-17 13:06 . 2009-04-27 18:08 -------- d-----w- c:\programmi\uTorrent
2009-06-12 12:31 . 2009-05-30 10:00 -------- d-----w- c:\programmi\KeePass Password Safe 2
2009-06-10 14:15 . 2009-05-03 07:52 -------- d-----w- c:\programmi\nLite
2009-06-10 14:13 . 2009-04-24 19:12 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Microsoft Help
2009-06-05 14:41 . 2009-06-05 14:11 -------- d-----w- c:\programmi\BT CONNECTION MANAGER
2009-06-05 14:40 . 2009-06-05 14:40 -------- d-----w- c:\programmi\Advanced IP Scanner
2009-06-05 14:11 . 2009-04-24 17:43 -------- d--h--w- c:\programmi\InstallShield Installation Information
2009-06-04 22:37 . 2009-06-04 22:37 2141 ----a-w- c:\documents and settings\cybermod\Dati applicazioni\.purple\certificates\x509\tls_peers\omega.contacts.msn.com
2009-06-04 21:26 . 2009-06-04 21:26 -------- d-----w- c:\documents and settings\cybermod\Dati applicazioni\Vodafone
2009-06-04 21:26 . 2009-06-04 21:26 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\InstallShield
2009-06-04 21:26 . 2009-06-04 21:26 -------- d-----w- c:\documents and settings\LocalService\Dati applicazioni\Vodafone
2009-06-04 21:26 . 2009-06-04 21:26 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Vodafone
2009-06-04 21:26 . 2009-06-04 21:26 -------- d-----w- c:\programmi\Vodafone
2009-06-04 21:26 . 2009-04-24 17:43 -------- d-----w- c:\programmi\File comuni\InstallShield
2009-06-04 07:21 . 2009-04-24 19:18 -------- d-----w- c:\programmi\File comuni\Acronis
2009-06-04 07:21 . 2009-04-24 19:18 -------- d-----w- c:\programmi\Acronis
2009-06-03 22:40 . 2009-05-31 01:03 -------- d-----w- c:\programmi\AdvancedRemoteInfo
2009-06-02 22:49 . 2009-06-02 22:49 -------- d-----w- c:\documents and settings\cybermod\Dati applicazioni\Conviva
2009-06-02 09:46 . 2009-06-02 09:46 -------- d-----w- c:\programmi\iTunes
2009-06-02 09:46 . 2009-06-02 09:46 -------- d-----w- c:\programmi\iPod
2009-06-02 09:46 . 2009-04-26 22:24 -------- d-----w- c:\programmi\File comuni\Apple
2009-06-02 09:44 . 2009-06-02 09:44 -------- d-----w- c:\programmi\QuickTime
2009-06-02 09:38 . 2009-06-02 09:38 75048 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-06-02 01:01 . 2009-06-02 01:01 -------- d-----w- c:\documents and settings\cybermod\Dati applicazioni\SharePod
2009-06-02 00:54 . 2009-06-02 00:54 -------- d-----w- c:\programmi\EyeDefender
2009-06-02 00:26 . 2009-06-02 00:26 2165 ----a-w- c:\documents and settings\cybermod\Dati applicazioni\.purple\certificates\x509\tls_peers\rsi.hotmail.com
2009-05-31 12:36 . 2009-05-31 01:29 -------- d-----w- c:\programmi\lg_fwupdate
2009-05-30 16:07 . 2009-05-30 16:07 -------- d-----w- c:\programmi\BatteryBar
2009-05-30 16:07 . 2009-05-30 16:07 -------- d-----w- c:\documents and settings\cybermod\Dati applicazioni\BatteryBar
2009-05-30 15:47 . 2009-05-30 15:47 -------- d-----w- c:\programmi\Power Meter Plus
2009-05-30 10:05 . 2009-05-30 10:05 -------- d-----w- c:\documents and settings\cybermod\Dati applicazioni\KeePass
2009-05-29 15:06 . 2009-05-29 15:06 -------- d-----w- c:\programmi\File comuni\Intel
2009-05-29 15:06 . 2009-04-24 17:36 -------- d-----w- c:\programmi\Intel
2009-05-29 14:36 . 2009-05-29 14:36 -------- d-----w- c:\documents and settings\NetworkService\Dati applicazioni\Intel
2009-05-29 14:36 . 2009-05-29 14:36 -------- d-----w- c:\documents and settings\LocalService\Dati applicazioni\Intel
2009-05-29 14:36 . 2009-05-29 14:36 -------- d-----w- c:\documents and settings\Default User\Dati applicazioni\Intel
2009-05-29 14:36 . 2009-05-29 14:36 -------- d-----w- c:\documents and settings\cybermod\Dati applicazioni\Intel
2009-05-29 14:36 . 2009-05-29 14:36 -------- d-----w- c:\documents and settings\Administrator\Dati applicazioni\Intel
2009-05-29 14:36 . 2009-05-29 14:36 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Intel
2009-05-28 23:41 . 2009-05-28 23:41 -------- d-----w- c:\programmi\D-Link AirPlus G+ Access Point
2009-05-28 17:43 . 2009-05-28 17:43 -------- d-----w- c:\programmi\Network Stumbler
2009-05-28 11:18 . 2009-05-28 11:18 -------- d-----w- c:\documents and settings\cybermod\Dati applicazioni\Canneverbe_Limited
2009-05-28 11:18 . 2009-05-28 11:18 -------- d-----w- c:\programmi\CDBurnerXP
2009-05-27 16:24 . 2009-04-24 17:37 -------- d-----w- c:\programmi\Hewlett-Packard
2009-05-27 15:12 . 2009-05-27 15:12 137 ----a-w- c:\documents and settings\cybermod\Impostazioni locali\Dati applicazioni\fusioncache.dat
2009-05-21 22:59 . 2009-05-21 22:59 -------- d-----w- c:\programmi\Universal Extractor
2009-05-21 22:37 . 2009-04-24 18:40 -------- d-----w- c:\programmi\VMware
2009-05-20 20:14 . 2009-05-20 20:14 -------- d-----w- c:\programmi\Microsoft Windows 7 Upgrade Advisor
2009-05-18 17:30 . 2009-04-25 13:13 -------- d-----w- c:\documents and settings\cybermod\Dati applicazioni\TrueCrypt
2009-05-13 13:21 . 2009-05-13 13:21 -------- d-----w- c:\programmi\DrayTek Router Tools V4.1.0
2009-05-13 05:02 . 2008-12-20 23:31 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-11 10:47 . 2009-05-11 10:47 1302600 ----a-w- c:\windows\system32\WUDFUpdate_01007.dll
2009-05-10 15:27 . 2009-04-25 13:56 -------- d-----w- c:\programmi\Cobian Backup 9
2009-05-10 13:06 . 2009-05-10 13:06 -------- d-----w- c:\programmi\HDDGURU LLF Tool
2009-05-10 11:23 . 2009-05-10 11:22 -------- d-----w- c:\programmi\FlashBoot
2009-05-07 22:10 . 2009-05-07 22:10 2145 ----a-w- c:\documents and settings\cybermod\Dati applicazioni\.purple\certificates\x509\tls_peers\ows.messenger.msn.com
2009-05-07 15:15 . 2008-04-13 19:13 348160 ----a-w- c:\windows\system32\localspl.dll
2009-04-27 22:25 . 2009-04-24 18:54 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-04-27 22:25 . 2009-04-24 18:54 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-04-26 18:46 . 2009-04-26 18:46 2099 ----a-w- c:\documents and settings\cybermod\Dati applicazioni\.purple\certificates\x509\tls_peers\login.live.com
2009-04-25 17:13 . 2009-04-25 17:13 8192 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Installations\{7694EC32-CB0E-4B35-9088-7B320CB1F4FE}\Installer\CommonCustomActions\UninstCCD.exe
2009-04-25 17:13 . 2009-04-25 17:13 61440 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Installations\{7694EC32-CB0E-4B35-9088-7B320CB1F4FE}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2009-04-25 17:13 . 2009-04-25 17:13 10240 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Installations\{7694EC32-CB0E-4B35-9088-7B320CB1F4FE}\Installer\CommonCustomActions\UninstPCS.exe
2009-04-25 17:12 . 2009-04-25 17:13 34447128 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Installations\{7694EC32-CB0E-4B35-9088-7B320CB1F4FE}\Nokia_PC_Suite_7_1_26_0_ita.exe
2009-04-25 17:07 . 2009-04-25 17:07 8192 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Installer\CommonCustomActions\UninstCCD.exe
2009-04-25 17:07 . 2009-04-25 17:07 61440 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2009-04-25 17:07 . 2009-04-25 17:07 10240 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Installer\CommonCustomActions\UninstPCS.exe
2009-04-25 16:50 . 2009-04-25 17:08 33753272 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Nokia_PC_Suite_7_1_18_0_ita_web(2).exe
2009-04-25 15:37 . 2009-04-25 15:37 0 ----a-w- c:\windows\nsreg.dat
2009-04-25 15:12 . 2009-04-25 15:12 25280 ----a-w- c:\windows\system32\drivers\hamachi.sys
2009-04-25 13:14 . 2009-04-25 13:14 223424 ----a-w- c:\windows\system32\drivers\truecrypt.sys
2009-04-24 19:43 . 2009-04-24 18:46 53968 ----a-w- c:\documents and settings\Administrator\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2009-04-24 19:19 . 2009-04-24 19:19 44384 ----a-w- c:\windows\system32\drivers\tifsfilt.sys
2009-04-24 19:19 . 2009-04-24 19:19 441760 ----a-w- c:\windows\system32\drivers\timntr.sys
2009-04-24 19:19 . 2009-04-24 19:19 132352 ----a-w- c:\windows\system32\drivers\snapman.sys
2009-04-24 18:58 . 2009-04-24 18:58 262144 ----a-w- c:\windows\system32\default_user_class.dat
2009-04-24 18:51 . 2009-04-24 18:52 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-04-24 18:44 . 2009-04-24 18:44 25214 ----a-r- c:\documents and settings\Administrator\Dati applicazioni\Microsoft\Installer\{FF77941A-2BFA-4A18-BE2E-69B9498E4D55}\_294823.exe
2009-04-24 18:37 . 2009-04-24 18:37 318 ----a-r- c:\documents and settings\Administrator\Dati applicazioni\Microsoft\Installer\{A7050037-F0EA-4BAB-BCD5-FC05507D6147}\ARPPRODUCTICON.exe
2009-04-24 18:36 . 2009-04-24 18:36 142 ----a-w- c:\documents and settings\Administrator\Impostazioni locali\Dati applicazioni\fusioncache.dat
.

------- Sigcheck -------

[-] 2009-03-02 00:33 588800 3DBD6DC6D74C517D55A1B3AECA88EF48 c:\windows\system32\user32.dll

[-] 2009-04-24 18:21 549888 B93931EA1B7E9ACCA65C131B5FB5E4CA c:\windows\system32\winlogon.exe

[-] 2009-03-21 01:01 1554432 94E6AE0CA24B2D84286DDEA8666A4E40 c:\windows\explorer.exe

[-] 2009-03-02 00:34 25088 91B6AAC828F8BBE1796275424E44DFB0 c:\windows\system32\ctfmon.exe

[-] 2009-03-01 23:42 1571840 3316C8A8EC07A9D4C0BE10310809A9E5 c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2009-03-02 25088]
"LClock"="c:\programmi\LClock\lclock.exe" [2004-09-19 65536]
"Sidebar"="c:\programmi\Windows Sidebar\sidebar.exe" [2009-02-25 1555456]
"SandboxieControl"="c:\programmi\Sandboxie\SbieCtrl.exe" [2009-05-28 380416]
"PC Suite Tray"="c:\programmi\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-06-12 1414144]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IFXSPMGT"="c:\windows\system32\ifxspmgt.exe" [2007-07-24 677144]
"CognizanceTS"="c:\progra~1\HEWLET~1\IAM\Bin\ASTSVCC.dll" [2003-12-22 17920]
"PTHOSTTR"="c:\programmi\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2007-01-09 145184]
"QlbCtrl.exe"="c:\programmi\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-06-03 177456]
"AcronisTimounterMonitor"="c:\programmi\Acronis\TrueImageEchoEnterpriseServer\TimounterMonitor.exe" [2008-06-23 884696]
"TrueImageMonitor.exe"="c:\programmi\Acronis\TrueImageEchoEnterpriseServer\TrueImageMonitor.exe" [2008-06-23 1274800]
"avgnt"="c:\programmi\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"SunJavaUpdateSched"="c:\programmi\Java\jre6\bin\jusched.exe" [2009-04-24 148888]
"Windows Defender"="c:\programmi\Windows Defender\MSASCui.exe" [2006-11-03 866584]
"vmware-tray"="c:\programmi\VMware\VMware Workstation\vmware-tray.exe" [2009-03-26 96816]
"CoolSwitch"="c:\windows\system32\taskswitch.exe" [2002-03-19 45632]
"SoundMAXPnP"="c:\programmi\Analog Devices\Core\smax4pnp.exe" [2007-01-05 872448]
"SynTPEnh"="c:\programmi\Synaptics\SynTP\SynTPEnh.exe" [2008-01-18 1028096]
"AccelerometerSysTrayApplet"="c:\windows\system32\AccelerometerSt.exe" [2007-01-24 124928]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-15 131072]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-15 159744]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-15 135168]
"Cobian Backup 9 interface"="c:\programmi\Cobian Backup 9\cbInterface.exe" [2009-01-22 2749952]
"IntelZeroConfig"="c:\programmi\Intel\WiFi\bin\ZCfgSvc.exe" [2008-10-02 1368064]
"IntelWireless"="c:\programmi\File comuni\Intel\WirelessCommon\iFrmewrk.exe" [2008-10-02 1191936]
"QuickTime Task"="c:\programmi\QuickTime\qttask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\programmi\iTunes\iTunesHelper.exe" [2009-05-30 292136]
"MobileConnect"="c:\programmi\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe" [2008-07-04 2072576]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Kerio VPN Client"="c:\programmi\Kerio\VPN Client\kvpncgui.exe" [2009-03-24 4982632]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2009-03-02 25088]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_2"="shell32" [X]
"_nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2009-03-08 128512]

c:\documents and settings\cybermod\Menu Avvio\Programmi\Esecuzione automatica\
Nuovo Documento di testo.txt [2009-7-4 424]
Ritaglio schermata e avvio di OneNote 2007.lnk - c:\programmi\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\programmi\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 10:05 356352 ----a-w- c:\programmi\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard]
2007-03-14 04:03 74752 ----a-r- c:\programmi\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\APSHook.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli ASWLNPkg

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\VMware\\VMware Workstation\\vmware-authd.exe"=
"c:\\Programmi\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Programmi\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Programmi\\Acronis\\TrueImageEchoEnterpriseServer\\TrueImage.exe"=
"c:\\Programmi\\Bonjour\\mDNSResponder.exe"=
"c:\\Programmi\\uTorrent\\uTorrent.exe"=
"c:\\Programmi\\eMule\\eMule.exe"=
"c:\\Programmi\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\system32\\rserver30\\rserver3.exe"=
"c:\\Programmi\\Mozilla Firefox\\firefox.exe"=
"c:\\WINDOWS\\system32\\mstsc.exe"=
"c:\\WINDOWS\\system32\\ftp.exe"=
"c:\\Programmi\\Hamachi\\hamachi.exe"=
"c:\\Programmi\\Foxit Software\\Editor\\PDFEdit_en.exe"=
"c:\\Documents and Settings\\cybermod\\temp\\TeamViewer3\\TeamViewer.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 iastor78;iastor78;c:\windows\system32\drivers\iastor78.sys [02/03/2009 2.44.33 308248]
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [07/07/2009 20.05.57 130936]
R1 PersonalSecureDrive;PersonalSecureDrive;c:\windows\system32\drivers\psd.sys [24/07/2007 8.21.52 38816]
R1 raddrvv3;raddrvv3;c:\windows\system32\rserver30\raddrvv3.sys [24/04/2008 7.49.26 45848]
R1 SASDIFSV;SASDIFSV;c:\programmi\SUPERAntiSpyware\sasdifsv.sys [23/06/2009 11.01.40 9968]
R1 SASKUTIL;SASKUTIL;c:\programmi\SUPERAntiSpyware\SASKUTIL.SYS [23/06/2009 11.01.40 72944]
R1 vcdrom;Virtual CD-ROM Device Driver;c:\programmi\System\CPL Bonus\vcdrom.sys [24/04/2009 19.21.29 8576]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\programmi\Avira\AntiVir Desktop\sched.exe [24/04/2009 20.54.56 108289]
R2 ASBroker;Operatore della sessione di accesso;c:\windows\System32\svchost.exe -k Cognizance [13/04/2008 21.14.22 14336]
R2 ASChannel;Canale di comunicazione locale;c:\windows\System32\svchost.exe -k Cognizance [13/04/2008 21.14.22 14336]
R2 CobianBackupAmanita;Cobian Backup 9 servizio;c:\programmi\Cobian Backup 9\cbService.exe [25/04/2009 15.56.52 583168]
R2 KVPNCSvc;Kerio VPN Client Service;c:\programmi\Kerio\VPN Client\kvpncsvc.exe [24/03/2009 16.00.00 968552]
R2 RServer3;Radmin Server V3;c:\windows\system32\rserver30\rserver3.exe [08/11/2008 16.11.10 1238344]
R2 vmci;VMware vmci;c:\windows\system32\drivers\vmci.sys [26/03/2009 23.05.36 54960]
R2 VMCService;Vodafone Mobile Connect Service;c:\programmi\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [04/07/2008 12.52.18 14336]
R2 WinDefend;Windows Defender;c:\programmi\Windows Defender\MsMpEng.exe [03/11/2006 19.19.58 13592]
R3 Com4QLBEx;Com4QLBEx;c:\programmi\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [25/04/2009 18.29.13 193840]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [23/07/2008 11.31.38 44800]
R3 kvnet;Kerio Virtual Network Adapter;c:\windows\system32\drivers\kvnet.sys [23/03/2009 10.25.30 29696]
R3 mirrorv3;mirrorv3;c:\windows\system32\drivers\rminiv3.sys [01/11/2006 5.01.56 3328]
R3 SbieDrv;SbieDrv;c:\programmi\Sandboxie\SbieDrv.sys [28/05/2009 15.32.24 108032]
S3 EL3C574;Driver di periferica FE574B-3Com 10/100 LAN PCCard;c:\windows\system32\drivers\el574nd4.sys [29/05/2009 10.28.52 24653]
S3 HP24X;HP PC Card Smart Card Reader;c:\windows\system32\drivers\HP24X.sys [24/04/2009 19.45.41 35072]
S3 ONDAusbmdm6k;ONDA Proprietary USB Driver;c:\windows\system32\drivers\ONDAusbmdm6k.sys [05/06/2009 16.11.23 100352]
S3 ONDAusbnet;ONDA USB-NDIS miniport;c:\windows\system32\drivers\ONDAusbnet.sys [05/06/2009 16.11.23 87552]
S3 ONDAusbser6k;ONDA Diagnostic Port;c:\windows\system32\drivers\ONDAusbser6k.sys [05/06/2009 16.11.23 100352]
S3 SASENUM;SASENUM;c:\programmi\SUPERAntiSpyware\SASENUM.SYS [23/06/2009 11.01.42 7408]
S3 sdAuxService;PC Tools Auxiliary Service;c:\programmi\Spyware Doctor\pctsAuxs.exe [07/07/2009 20.05.43 348752]
S3 Slnt7554;USB Soft Modem Driver;c:\windows\system32\drivers\slnt7554.sys [14/05/2009 11.27.50 129535]
S3 VirtualDK;VirtualDK;\??\c:\documents and settings\cybermod\Desktop\XP da Usb\TecnoPen2\Pre-packed\usb_prep8\vdk.sys --> c:\documents and settings\cybermod\Desktop\XP da Usb\TecnoPen2\Pre-packed\usb_prep8\vdk.sys [?]

--- Altri Servizi/Drivers In Memoria ---

*NewlyCreated* - HELPSVC
*NewlyCreated* - VCDROM
*Deregistered* - uphcleanhlp

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Cognizance REG_MULTI_SZ ASBroker ASChannel
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\programmi\File comuni\LightScribe\LSRunOnce.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D58F39FF-953E-4F45-898F-59F243B9A523}]
RUNDLL32 advpack.dll,LaunchINFSection Sidebar.inf,Register
.
Contenuto della cartella 'Scheduled Tasks'

2009-07-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programmi\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2009-07-08 c:\windows\Tasks\MP Scheduled Scan.job
- c:\programmi\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]

2009-07-07 c:\windows\Tasks\Security Platform Backup Schedule.job
- c:\programmi\Hewlett-Packard\Embedded Security Software\SpBackupWz.exe [2007-07-24 06:22]

2009-07-08 c:\windows\Tasks\User_Feed_Synchronization-{B5B4737F-E6A0-485C-A351-4C0BE108DC4E}.job
- c:\windows\system32\msfeedssync.exe [2009-03-01 02:31]

2009-07-08 c:\windows\Tasks\User_Feed_Synchronization-{B718261F-41C9-420F-AB88-3BB924348A04}.job
- c:\windows\system32\msfeedssync.exe [2009-03-01 02:31]
.
- - - - CHIAVI ORFANE RIMOSSE - - - -

HKCU-Run-iyysieo - c:\documents and settings\cybermod\impostazioni locali\dati applicazioni\iyysieo.exe
HKLM-Run-LGODDFU - c:\programmi\lg_fwupdate\fwupdate.exe
HKLM-Run-Syslog - (no file)


.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyServer = 192.168.1.5:808
uInternet Settings,ProxyOverride = *.local
IE: E&sporta in Microsoft Excel - c:\progra~1\Microsoft Office\Office12\EXCEL.EXE/3000
IE: Invia a periferica &Bluetooth... - c:\programmi\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
LSP: c:\programmi\VMware\VMware Workstation\vsocklib.dll
FF - ProfilePath - c:\documents and settings\cybermod\Dati applicazioni\Mozilla\Firefox\Profiles\yfmvjflt.default\
FF - component: c:\documents and settings\cybermod\Dati applicazioni\Mozilla\Firefox\Profiles\yfmvjflt.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}\components\XpcomOpusConnector.dll
FF - plugin: c:\documents and settings\cybermod\Dati applicazioni\Mozilla\Firefox\Profiles\yfmvjflt.default\extensions\LogMeInClient@logmein.com\plugins\npRACtrl.dll
FF - plugin: c:\programmi\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\programmi\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\programmi\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.
.
------- Associazioni dei file -------
.
regfile\shell\edit\command=%SystemRoot%\system32\NOTEPAD.EXE %1
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-08 10:32
Windows 5.1.2600 Service Pack 3 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------

- - - - - - - > 'winlogon.exe'(1276)
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\sfc_os.dll
c:\programmi\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
c:\programmi\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll
c:\programmi\Hewlett-Packard\IAM\bin\ItMsg.dll
c:\windows\system32\COMRes.dll
c:\programmi\Hewlett-Packard\IAM\Bin\TrayIcon.dll
c:\programmi\Hewlett-Packard\IAM\bin\HPBrand.dll
c:\programmi\Hewlett-Packard\IAM\bin\ITA\HPBrand.dll
c:\programmi\Hewlett-Packard\IAM\bin\ITA\ItMsg.dll
c:\programmi\Hewlett-Packard\IAM\Bin\ASChnl.dll
c:\programmi\Hewlett-Packard\IAM\Bin\ItDAC.dll
c:\programmi\Hewlett-Packard\IAM\Bin\ItReports.DLL
c:\programmi\Hewlett-Packard\IAM\Bin\BioAuth.dll
c:\programmi\Hewlett-Packard\IAM\bin\ITA\BioAuth.dll
c:\programmi\Hewlett-Packard\IAM\Bin\ASBIoAT.dll
c:\programmi\Hewlett-Packard\IAM\Bin\ittal.dll
c:\programmi\Hewlett-Packard\IAM\Bin\STEngine.dll
c:\programmi\Hewlett-Packard\IAM\Bin\ItVCClient.dll
c:\programmi\Hewlett-Packard\IAM\Bin\AuthWiz.dll
c:\programmi\Hewlett-Packard\IAM\bin\ITA\AuthWiz.dll
c:\programmi\Hewlett-Packard\IAM\Bin\ItVCard.dll
c:\windows\system32\xenroll.dll
c:\programmi\Hewlett-Packard\IAM\Bin\TpmAuth.dll
c:\programmi\Hewlett-Packard\IAM\bin\ITA\TpmAuth.dll
c:\windows\system32\IFXTSP.dll
c:\windows\system32\IfxSpArc.dll
c:\windows\system32\IFXTCSps.dll
c:\windows\system32\IfxSpMgt.dll
c:\programmi\Hewlett-Packard\Embedded Security Software\IfxSpURsIT.dll
c:\windows\system32\IFXTPMCP.dll
c:\programmi\Hewlett-Packard\Embedded Security Software\IfxTRsIT.dll
c:\programmi\Hewlett-Packard\Embedded Security Software\IfxTrsMs.dll
c:\windows\system32\msi.dll
c:\windows\system32\capicom.dll
c:\programmi\Hewlett-Packard\IAM\Bin\TokenAuth.dll
c:\programmi\Hewlett-Packard\IAM\Bin\ittalsnap.DLL
c:\programmi\Hewlett-Packard\IAM\bin\ITA\ittalsnap.DLL
c:\programmi\Hewlett-Packard\IAM\bin\ITA\TokenAuth.dll
c:\programmi\Hewlett-Packard\IAM\Bin\NetAdmin.dll
c:\programmi\Hewlett-Packard\IAM\bin\ITA\NetAdmin.dll
c:\windows\system32\cscui.dll

- - - - - - - > 'lsass.exe'(1336)
c:\windows\system32\relog_ap.dll
c:\windows\system32\setupapi.dll
c:\programmi\Hewlett-Packard\IAM\bin\ASWLNPkg.dll
c:\programmi\Hewlett-Packard\IAM\bin\ItMsg.dll

- - - - - - - > 'explorer.exe'(2592)
c:\windows\system32\SHDOCVW.dll
c:\windows\system32\WININET.dll
c:\windows\system32\APSHook.dll
c:\programmi\Hewlett-Packard\IAM\bin\ItClient.dll
c:\windows\system32\MSVCP60.dll
c:\windows\system32\COMRes.dll
c:\windows\System32\cscui.dll
c:\programmi\iTunes\iTunesMiniPlayer.dll
c:\programmi\iTunes\iTunesMiniPlayer.Resources\it.lproj\iTunesMiniPlayerLocalized.dll
c:\programmi\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll
c:\programmi\Windows Media Player\wmpband.dll
c:\windows\system32\LINKINFO.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\msi.dll
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
c:\programmi\LClock\LC.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\programmi\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\programmi\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\programmi\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_ita.nlr
c:\programmi\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\programmi\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\programmi\Intel\WiFi\bin\S24EvMon.exe
c:\windows\system32\scardsvr.exe
c:\programmi\File comuni\Acronis\Schedule2\schedul2.exe
c:\windows\system32\agrsmsvc.exe
c:\programmi\Avira\AntiVir Desktop\avguard.exe
c:\programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\programmi\Bonjour\mDNSResponder.exe
c:\programmi\Intel\WiFi\bin\EvtEng.exe
c:\windows\system32\IFXTCS.exe
c:\programmi\iPod Access for Windows\iPAHelper.exe
c:\programmi\Java\jre6\bin\jqs.exe
c:\programmi\File comuni\Microsoft Shared\VS7DEBUG\mdm.exe
c:\windows\system32\msiexec.exe
c:\windows\system32\IfxPsdSv.exe
c:\programmi\File comuni\Intel\WirelessCommon\RegSrvc.exe
c:\programmi\Sandboxie\SbieSvc.exe
c:\programmi\UPHClean\uphclean.exe
c:\windows\system32\vssvc.exe
c:\programmi\Hewlett-Packard\Shared\hpqwmiex.exe
c:\programmi\VMware\VMware Workstation\vmware-authd.exe
c:\windows\system32\vmnetdhcp.exe
c:\programmi\Hewlett-Packard\IAM\Bin\asghost.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\rserver30\FamItrfc.Exe
c:\programmi\Hewlett-Packard\Embedded Security Software\PSDrt.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\system32\wbem\unsecapp.exe
c:\programmi\Notepad++\notepad++.exe
c:\programmi\iPod\bin\iPodService.exe
c:\programmi\PC Connectivity Solution\ServiceLayer.exe
c:\programmi\PC Connectivity Solution\Transports\NclBCBTSrv.exe
c:\progra~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
.
**************************************************************************
.
Ora fine scansione: 2009-07-08 10.36.37 - Il pc è stato riavviato
ComboFix-quarantined-files.txt 2009-07-08 08:36

Pre-Run: 23.660.331.008 byte disponibili
Post-Run: 24.103.313.408 byte disponibili

WindowsXP-KB310994-SP2-Pro-BootDisk-ITA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

588 --- E O F --- 2009-07-07 02:57
son niubbo!
Avatar utente
alexzappaladra
Aficionado
Aficionado
 
Messaggi: 103
Iscritto il: mar mar 15, 2005 4:33 pm


Re: popup pubblicitari, a causa di un servizio

Messaggioda ste_95 » mer lug 08, 2009 11:24 am

Quello che hai eliminato tu era appunto il responsabile dei pop-up, ma ComboFix ha rimosso anche altre schifezze.

alexzappaladra ha scritto:c:\windows\system32\msconfig.exe
c:\windows\system32\Packet.dll
c:\windows\system32\WanPacket.dll
c:\windows\system32\wpcap.dll

Anche se questi mi sembrano legittimi [uhm] [uhm]
«A volte è meglio tacere e sembrare stupidi che aprir bocca e togliere ogni dubbio.» Oscar Wilde
Avatar utente
ste_95
Membro Ufficiale (Gold)
Membro Ufficiale (Gold)
 
Messaggi: 17271
Iscritto il: lun ago 06, 2007 11:19 am

Re: popup pubblicitari, a causa di un servizio

Messaggioda alexzappaladra » mer lug 08, 2009 11:34 am

giusto per capire, come fai a comprendere se sono leggitimi o meno?

nel caso adesso riscontrassi malfunzionamento in qualche applicazione (tra l'altro ho Xp Ice, una versione un po' particolare) cosa posso fare per ripristinare quei file?
son niubbo!
Avatar utente
alexzappaladra
Aficionado
Aficionado
 
Messaggi: 103
Iscritto il: mar mar 15, 2005 4:33 pm

Re: popup pubblicitari, a causa di un servizio

Messaggioda ste_95 » mer lug 08, 2009 11:58 am

alexzappaladra ha scritto:giusto per capire, come fai a comprendere se sono leggitimi o meno?

Esperienza... So che il file msconfig.exe in System32 è legittimo, a meno di modificazioni causate da malware. In questo caso però, ComboFix ha inteso la diversità di msconfig come sintomo di malware, e l'ha cancellato.

nel caso adesso riscontrassi malfunzionamento in qualche applicazione (tra l'altro ho Xp Ice, una versione un po' particolare) cosa posso fare per ripristinare quei file?

Ti basta copiare i file eliminati dalla cartella C:\QooBox a dove erano prima. [;)]
«A volte è meglio tacere e sembrare stupidi che aprir bocca e togliere ogni dubbio.» Oscar Wilde
Avatar utente
ste_95
Membro Ufficiale (Gold)
Membro Ufficiale (Gold)
 
Messaggi: 17271
Iscritto il: lun ago 06, 2007 11:19 am

Re: popup pubblicitari, a causa di un servizio

Messaggioda alexzappaladra » mer lug 08, 2009 1:16 pm

ah perfetto!!!!

allora sono a posto.
ho controllato e ci sono appunto quei file, me li tengo da parte che non si sa mai :D
sarei quasi tentato di ripristinare quel maledetto, giusto per capire se viene scoperto da combofix, ma dai, perché complicarsi la vita [rotolo]

grazie mille della mano!!!
son niubbo!
Avatar utente
alexzappaladra
Aficionado
Aficionado
 
Messaggi: 103
Iscritto il: mar mar 15, 2005 4:33 pm


Torna a Sicurezza

Chi c’è in linea

Visitano il forum: Google [Bot] e 2 ospiti

Powered by phpBB © 2002, 2005, 2007, 2008 phpBB Group
Traduzione Italiana phpBB.it

megalab.it: testata telematica quotidiana registrata al Tribunale di Cosenza n. 22/09 del 13.08.2009, editore Master New Media S.r.l.; © Copyright 2008 Master New Media S.r.l. a socio unico - P.I. 02947530784. GRUPPO EDIZIONI MASTER Spa Tutti i diritti sono riservati. Per la pubblicità: Master Advertising