ComboFix 10-08-08.01 - Admin 09/08/2010 21.09.39.1.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.39.1040.18.1022.693 [GMT 2:00] Eseguito da: c:\documents and settings\Admin\desktop\combofix.exe Opzioni usate :: /killall AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {00000002-0002-0000-7C25-9E7C08000A00} ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !! . ((((((((((((((((((((((((((((((((((((( Altre eliminazioni ))))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\midimap.dll . . . è infetto!! . ((((((((((((((((((((((((( Files Creati Da 2010-07-09 al 2010-08-09 ))))))))))))))))))))))))))))))))))) . 2010-08-09 19:13 . 2010-08-09 19:13 -------- d-----w- c:\windows\system32\xircom 2010-08-09 19:13 . 2010-08-09 19:13 -------- d-----w- c:\windows\system32\wbem\snmp 2010-08-09 19:13 . 2010-08-09 19:13 -------- d-----w- c:\windows\srchasst 2010-08-08 21:16 . 2010-08-08 21:16 -------- d-----r- c:\documents and settings\LocalService\Preferiti 2010-07-12 16:26 . 2010-07-12 16:26 -------- d-----w- c:\documents and settings\Admin\Impostazioni locali\Dati applicazioni\Western Digital 1601-01-01 00:00 . 1601-01-01 00:00 -------- d-----w- c:\windows\LastGood.Tmp . (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-08-09 19:13 . 2010-08-09 19:13 -------- d-----w- c:\programmi\microsoft frontpage 2010-08-09 17:15 . 2010-03-06 14:02 -------- d-----w- c:\programmi\QuickTime 2010-08-08 21:09 . 2010-03-06 14:03 -------- d-----w- c:\programmi\iTunes 2010-08-01 16:24 . 2010-03-05 20:09 -------- d-----w- c:\documents and settings\Admin\Dati applicazioni\vlc 2010-07-12 10:52 . 2010-03-05 19:19 -------- d-----w- c:\programmi\Microsoft Silverlight 2010-06-15 01:03 . 2010-06-15 01:03 -------- d-----w- c:\programmi\Filmoovie 2010-05-25 17:22 . 2010-05-25 17:22 503808 ----a-w- c:\documents and settings\Admin\Dati applicazioni\Sun\Java\Deployment\cache\6.0\46\f84c6ae-1df16f38-n\msvcp71.dll 2010-05-25 17:22 . 2010-05-25 17:22 499712 ----a-w- c:\documents and settings\Admin\Dati applicazioni\Sun\Java\Deployment\cache\6.0\46\f84c6ae-1df16f38-n\jmc.dll 2010-05-25 17:22 . 2010-05-25 17:22 348160 ----a-w- c:\documents and settings\Admin\Dati applicazioni\Sun\Java\Deployment\cache\6.0\46\f84c6ae-1df16f38-n\msvcr71.dll . ------- Sigcheck ------- [-] 2009-07-30 . B5B1080D35974C0E718D64280761BCD5 . 182912 . . [5.1.2600.5588] . . c:\windows\system32\drivers\ndis.sys [-] 2009-03-23 . AE8CAD8F28DB13B515A68510A539B0B8 . 576512 . . [5.1.2600.5782] . . c:\windows\system32\drivers\ntfs.sys [-] 2009-07-30 . 15293481DA03E0E8EA043E12EAF9035D . 361600 . . [5.1.2600.5649] . . c:\windows\system32\drivers\tcpip.sys [-] 2009-07-30 . F6F023282059A9B191F1CE2C67F93126 . 78336 . . [5.1.2600.5574] . . c:\windows\system32\browser.dll [-] 2009-07-30 . 00228372A0056A0E7210F12D54BDE98D . 408576 . . [6.7.2600.5796] . . c:\windows\system32\qmgr.dll [-] 2009-07-30 . 00228372A0056A0E7210F12D54BDE98D . 408576 . . [6.7.2600.5796] . . c:\windows\system32\bits\qmgr.dll [-] 2009-07-30 . 91F797DFBC1416FCEA76AD76FE07DA89 . 401408 . . [5.1.2600.5755] . . c:\windows\system32\rpcss.dll [-] 2009-07-30 . C79FEAE2F68982259907AB52B0F2676F . 111104 . . [5.1.2600.5755] . . c:\windows\system32\services.exe [-] 2009-06-28 . 3F64983D1B1ED0C6704B1A19B0708B4B . 551424 . . [5.1.2600.5788] . . c:\windows\system32\winlogon.exe [-] 2009-06-28 . 6B00176C49AD983527346A0CB3B29BD1 . 643072 . . [5.82] . . c:\windows\system32\comctl32.dll [-] 2009-07-30 13:00 . EA518D0002F4338DB0E7D83370D61845 . 253952 . . [2001.12.4414.706] . . c:\windows\system32\es.dll [-] 2009-07-30 . A3A365C46057532F6638D57E4C0B66B8 . 1035776 . . [5.1.2600.5781] . . c:\windows\system32\kernel32.dll [-] 2009-07-30 . 4181A3736816681829B5E241DB7BB271 . 343040 . . [7.0.2600.5701] . . c:\windows\system32\msvcrt.dll [-] 2009-07-30 . E69B1B2EB3D485F8B54AB7BCB7ADA14B . 247296 . . [5.1.2600.5649] . . c:\windows\system32\mswsock.dll [-] 2009-07-30 . 341ED9B8D91418DC5CB5D54A2E51F4BA . 407552 . . [5.1.2600.5755] . . c:\windows\system32\netlogon.dll [-] 2009-07-30 . 67E38B4A549833E02D4D1617B5DBC318 . 14848 . . [5.1.2600.5689] . . c:\windows\system32\svchost.exe [-] 2009-07-30 . 41C3BB54AD1392C05B501799AFF0DB33 . 249856 . . [5.1.2600.5654] . . c:\windows\system32\tapisrv.dll [-] 2009-06-28 . 25C84559481AEC7E19D17683C5845FDE . 579584 . . [5.1.2600.5577] . . c:\windows\system32\user32.dll [-] 2009-06-28 . 3FF7B561AB60B277A8A7E94FAFC8B8B0 . 1543168 . . [6.00.2900.5634] . . c:\windows\explorer.exe [-] 2009-06-28 . B012D45295253B131F0EDDA9257573ED . 1313280 . . [5.1.2600.5692] . . c:\windows\system32\ole32.dll [-] 2009-06-28 . 7F4C43F75EBF781352DB3B5EF6BF8230 . 40448 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe [-] 2009-05-10 . 62EA9B8982EFE4C2EA2ED65FAA7CAAB5 . 290816 . . [5.1.2600.5512] . . c:\windows\system32\termsrv.dll [-] 2009-07-30 13:01 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\mspmsnsv.dll [-] 2009-07-30 . 8097A22951F00E48991662718B3F3BF3 . 1689088 . . [5.03.2600.5601] . . c:\windows\system32\d3d9.dll . ((((((((((((((((((((((((((((((((((((( Punti Reg Caricati )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* i valori vuoti & legittimi/default non sono visualizzati. REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="c:\programmi\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2009-06-28 40448] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avgnt"="c:\programmi\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153] "SoundMAXPnP"="c:\programmi\Analog Devices\Core\smax4pnp.exe" [2006-12-18 868352] "SunJavaUpdateSched"="c:\programmi\Java\jre6\bin\jusched.exe" [2009-10-11 149280] "TrueImageMonitor.exe"="c:\programmi\Acronis\TrueImageHome\TrueImageMonitor.exe" [2009-10-31 5106808] "Acronis Scheduler2 Service"="c:\programmi\File comuni\Acronis\Schedule2\schedhlp.exe" [2009-10-31 361568] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-27 86016] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-27 13684736] "iTunesHelper"="c:\programmi\iTunes\iTunesHelper.exe" [2010-02-15 141608] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "_nltide_3"="advpack.dll" [2009-07-30 128512] [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "ForceClassicControlPanel"= 1 (0x1) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Programmi\\Bonjour\\mDNSResponder.exe"= "c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 R0 tdrpman258;Acronis Try&Decide and Restore Points filter (build 258);c:\windows\system32\drivers\tdrpm258.sys [05/03/2010 23.39.18 911680] R2 afcdpsrv;Acronis Nonstop Backup service;c:\programmi\File comuni\Acronis\CDP\afcdpsrv.exe [05/03/2010 23.39.22 2480048] R3 afcdp;afcdp;c:\windows\system32\drivers\afcdp.sys [05/03/2010 23.39.24 160288] . Contenuto della cartella 'Scheduled Tasks' 2010-08-09 c:\windows\Tasks\OGADaily.job - c:\windows\system32\OGAVerify.exe [2008-12-31 16:04] 2010-08-09 c:\windows\Tasks\OGALogon.job - c:\windows\system32\OGAVerify.exe [2008-12-31 16:04] . . ------- Scansione supplementare ------- . uStart Page = hxxp://search.findeer.it uInternet Settings,ProxyOverride = *.local IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Admin\Dati applicazioni\Mozilla\Firefox\Profiles\3clgf4op.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IEFM1&q= FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - www.google.it FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=IEFM1&q= FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- FIREFOX POLICIES ---- c:\programmi\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\programmi\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true); c:\programmi\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true); c:\programmi\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true); c:\programmi\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); c:\programmi\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); c:\programmi\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true); c:\programmi\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true); c:\programmi\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true); c:\programmi\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\programmi\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5); c:\programmi\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24); c:\programmi\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096); c:\programmi\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45); c:\programmi\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\programmi\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true); c:\programmi\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true); c:\programmi\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\programmi\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\programmi\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true); c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true); c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true); c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true); c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); . - - - - CHIAVI ORFANE RIMOSSE - - - - HKCU-Run-DriverMax - (no file) HKCU-Run-DriverMax_RESTART - (no file) HKLM-Run-Adobe Reader Speed Launcher - c:\programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe HKLM-Run-nwiz - nwiz.exe HKLM-Run-QuickTime Task - c:\programmi\QuickTime\qttask.exe ************************************************************************** scansione processi nascosti ... scansione entrate autostart nascoste ... Scansione files nascosti ... Scansione completata con successo Files nascosti: ************************************************************************** . --------------------- Dlls caricate dai processi in esecuzione --------------------- - - - - - - - > 'winlogon.exe'(1000) c:\windows\system32\SETUPAPI.dll c:\windows\system32\sfc_os.dll c:\windows\system32\COMRes.dll c:\windows\system32\cscui.dll - - - - - - - > 'lsass.exe'(1056) c:\windows\system32\setupapi.dll c:\windows\system32\scecli.dll c:\windows\system32\psbase.dll - - - - - - - > 'explorer.exe'(948) c:\windows\system32\WININET.dll c:\windows\system32\COMRes.dll c:\windows\System32\cscui.dll c:\windows\system32\LINKINFO.dll c:\windows\system32\ntshrui.dll c:\windows\system32\SETUPAPI.dll c:\windows\system32\msi.dll c:\windows\system32\NETSHELL.dll c:\windows\system32\credui.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Altri processi in esecuzione ------------------------ . c:\programmi\Avira\AntiVir Desktop\sched.exe c:\programmi\Avira\AntiVir Desktop\avguard.exe c:\programmi\File comuni\Acronis\Schedule2\schedul2.exe c:\programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\programmi\Bonjour\mDNSResponder.exe c:\programmi\Java\jre6\bin\jqs.exe c:\windows\system32\RUNDLL32.EXE c:\windows\system32\nvsvc32.exe c:\programmi\iPod\bin\iPodService.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Ora fine scansione: 2010-08-09 21:16:19 - Il pc è stato riavviato ComboFix-quarantined-files.txt 2010-08-09 19:16 Pre-Run: 3.730.022.400 byte disponibili Post-Run: 3.856.453.632 byte disponibili - - End Of File - - 950840CDD7D744ED27738173B3104CCD