ComboFix 12-09-24.03 - Win XP 25/09/2012 12.32.56.1.1 - x86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.39.1040.18.959.644 [GMT 2:00] Eseguito da: c:\documents and settings\Win XP\Desktop\ComboFix.exe AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D} FW: avast! Antivirus *Disabled* {7591DB91-41F0-48A3-B128-1A293FD8233D} . ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !! . . ((((((((((((((((((((((((((((((((((((( Altre eliminazioni ))))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\documents and settings\Win XP\Dati applicazioni\PropMgrAsync c:\documents and settings\Win XP\Dati applicazioni\PropMgrAsync\PropMgrAsync.cfg c:\documents and settings\Win XP\Dati applicazioni\PropMgrAsync\PropMgrAsync.log c:\documents and settings\Win XP\Dati applicazioni\Toolbar4 c:\documents and settings\Win XP\Dati applicazioni\Toolbar4\{C86FF9FA-AEED-451B-A9CC-39A53173AE2E}\gf_icon3.png c:\documents and settings\Win XP\Dati applicazioni\Toolbar4\{C86FF9FA-AEED-451B-A9CC-39A53173AE2E}\goonews_ema.png c:\documents and settings\Win XP\Dati applicazioni\Toolbar4\{C86FF9FA-AEED-451B-A9CC-39A53173AE2E}\gsearch_ema.png c:\windows\IsUn0410.exe . . ((((((((((((((((((((((((( Files Creati Da 2012-08-25 al 2012-09-25 ))))))))))))))))))))))))))))))))))) . . 2012-09-24 13:47 . 2012-09-24 13:47 73696 ----a-w- c:\programmi\Mozilla Firefox\breakpadinjector.dll 2012-09-22 11:57 . 2012-09-25 07:56 -------- d-----w- c:\programmi\MVM 2005 - Imperivm - Le Grandi Battaglie di Roma . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-08-30 20:28 . 2008-04-14 12:00 81920 ----a-w- c:\windows\system32\ieencode.dll 2012-08-30 20:28 . 2008-04-14 12:00 669696 ----a-w- c:\windows\system32\wininet.dll 2012-08-30 20:28 . 2008-04-14 12:00 61952 ----a-w- c:\windows\system32\tdc.ocx 2012-08-30 20:27 . 2008-04-14 12:00 371200 ----a-w- c:\windows\system32\html.iec 2012-08-21 09:13 . 2011-07-12 19:55 729752 ----a-w- c:\windows\system32\drivers\aswSnx.sys 2012-08-21 09:13 . 2011-01-28 18:51 355632 ----a-w- c:\windows\system32\drivers\aswSP.sys 2012-08-21 09:13 . 2011-01-28 18:51 54232 ----a-w- c:\windows\system32\drivers\aswTdi.sys 2012-08-21 09:13 . 2012-04-18 05:03 18544 ----a-w- c:\windows\system32\drivers\aswKbd.sys 2012-08-21 09:13 . 2011-01-28 18:51 35928 ----a-w- c:\windows\system32\drivers\aswRdr.sys 2012-08-21 09:13 . 2011-01-28 18:51 97608 ----a-w- c:\windows\system32\drivers\aswmon2.sys 2012-08-21 09:13 . 2011-01-28 18:51 89624 ----a-w- c:\windows\system32\drivers\aswmon.sys 2012-08-21 09:13 . 2011-01-28 18:51 21256 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys 2012-08-21 09:13 . 2011-01-28 18:51 25256 ----a-w- c:\windows\system32\drivers\aavmker4.sys 2012-08-21 09:12 . 2011-01-28 18:51 41224 ----a-w- c:\windows\avastSS.scr 2012-08-21 09:12 . 2011-01-28 18:51 227648 ----a-w- c:\windows\system32\aswBoot.exe 2012-07-06 13:59 . 2008-04-14 12:00 78336 ----a-w- c:\windows\system32\browser.dll 2012-07-04 14:05 . 2011-01-28 17:40 139784 ----a-w- c:\windows\system32\drivers\rdpwd.sys 2012-07-03 18:26 . 2008-04-14 12:00 1866112 ----a-w- c:\windows\system32\win32k.sys 2012-09-24 13:47 . 2012-08-23 21:54 266720 ----a-w- c:\programmi\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Punti Reg Caricati )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* i valori vuoti & legittimi/default non sono visualizzati. REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}] 2012-08-21 09:12 121528 ----a-w- c:\programmi\Alwil Software\Avast5\ashShell.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Facebook Update"="c:\documents and settings\Win XP\Impostazioni locali\Dati applicazioni\Facebook\Update\FacebookUpdate.exe" [2012-07-12 138096] "MyTomTomSA.exe"="c:\programmi\MyTomTom 3\MyTomTomSA.exe" [2012-05-18 434168] "Skype"="c:\programmi\Skype\Phone\Skype.exe" [2012-07-13 17418928] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "GrooveMonitor"="c:\programmi\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040] "Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-07-31 38872] "Adobe ARM"="c:\programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-11 919008] "APSDaemon"="c:\programmi\File comuni\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240] "iTunesHelper"="c:\programmi\iTunes\iTunesHelper.exe" [2012-03-06 421736] "avast"="c:\programmi\Alwil Software\Avast5\avastUI.exe" [2012-08-21 4282728] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] . [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^WinZip Quick Pick.lnk] path=c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\WinZip Quick Pick.lnk backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2012-07-11 19:00 919008 ----a-r- c:\programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2012-07-31 11:20 38872 ----a-w- c:\programmi\Adobe\Reader 9.0\Reader\reader_sl.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] 2008-04-14 12:00 15360 ----a-w- c:\windows\system32\ctfmon.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate] 2010-09-16 20:04 1164584 -c--a-w- c:\programmi\DivX\DivX Update\DivXUpdate.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] 2009-02-26 17:36 30040 ----a-w- c:\programmi\Microsoft Office\Office12\GrooveMonitor.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] 2001-07-09 10:50 155648 -c--a-w- c:\windows\system32\NeroCheck.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] 2004-11-02 19:24 32768 -c--a-w- c:\programmi\CyberLink\PowerDVD\PDVDServ.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] 2004-11-15 10:20 77824 -c--a-r- c:\windows\SOUNDMAN.EXE . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2010-05-14 10:44 248552 -c--a-w- c:\programmi\File comuni\Java\Java Update\jusched.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTimer] 2005-03-08 02:33 53248 -c--a-w- c:\windows\system32\VTTimer.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTrayp] 2006-03-23 15:02 176128 -c--a-w- c:\windows\system32\VTTrayp.exe . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Programmi\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Programmi\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Programmi\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Programmi\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Programmi\\eMule\\emule.exe"= "c:\\Documents and Settings\\All Users\\Dati applicazioni\\NexonEU\\NGM\\NGM.exe"= "c:\\Documents and Settings\\Win XP\\Impostazioni locali\\Dati applicazioni\\Facebook\\Video\\Skype\\FacebookVideoCalling.exe"= "c:\\Programmi\\File comuni\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"= "c:\\Programmi\\Bonjour\\mDNSResponder.exe"= "c:\\Programmi\\iTunes\\iTunes.exe"= "c:\\Programmi\\Skype\\Phone\\Skype.exe"= . R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [09/03/2011 12.52.36 691696] R1 aswKbd;aswKbd;c:\windows\system32\drivers\aswKbd.sys [18/04/2012 7.03.47 18544] R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [12/07/2011 21.55.19 729752] R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [28/01/2011 20.51.58 355632] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [28/01/2011 20.51.58 21256] S2 gupdate;Servizio di Google Update (gupdate);c:\programmi\Google\Update\GoogleUpdate.exe [19/04/2011 15.42.43 136176] S2 Skype C2C Service;Skype C2C Service;c:\documents and settings\All Users\Dati applicazioni\Skype\Toolbars\Skype C2C Service\c2c_service.exe [13/08/2012 13.33.30 3064000] S2 SkypeUpdate;Skype Updater;c:\programmi\Skype\Updater\Updater.exe [13/07/2012 13.28.36 160944] S3 EagleXNt;EagleXNt;\??\c:\windows\system32\drivers\EagleXNt.sys --> c:\windows\system32\drivers\EagleXNt.sys [?] S3 gupdatem;Servizio Google Update (gupdatem);c:\programmi\Google\Update\GoogleUpdate.exe [19/04/2011 15.42.43 136176] S3 MozillaMaintenance;Mozilla Maintenance Service;c:\programmi\Mozilla Maintenance Service\maintenanceservice.exe [07/05/2012 12.02.06 114144] . Contenuto della cartella 'Scheduled Tasks' . 2012-09-25 c:\windows\Tasks\avast! Emergency Update.job - c:\programmi\Alwil Software\Avast5\AvastEmUpdate.exe [2012-08-05 09:12] . 2012-09-24 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1844237615-725345543-1801674531-1004Core.job - c:\documents and settings\Win XP\Impostazioni locali\Dati applicazioni\Facebook\Update\FacebookUpdate.exe [2011-10-11 20:00] . 2012-09-25 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1844237615-725345543-1801674531-1004UA.job - c:\documents and settings\Win XP\Impostazioni locali\Dati applicazioni\Facebook\Update\FacebookUpdate.exe [2011-10-11 20:00] . 2012-09-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\programmi\Google\Update\GoogleUpdate.exe [2011-04-19 13:42] . 2012-09-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\programmi\Google\Update\GoogleUpdate.exe [2011-04-19 13:42] . . ------- Scansione supplementare ------- . uStart Page = hxxp://www.google.it/ uInternet Settings,ProxyOverride = *.local IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.1.1 FF - ProfilePath - c:\documents and settings\Win XP\Dati applicazioni\Mozilla\Firefox\Profiles\5mdl6atr.default\ FF - prefs.js: browser.search.selectedEngine - Search the web (Babylon) FF - prefs.js: browser.startup.homepage - hxxp://www.google.it/ FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?affID=10588&tl=gbn269661&babsrc=KW_def&mntrId=3c5ee72d00000000000074ea3a923db2&q= FF - prefs.js: network.proxy.type - 0 FF - user.js: network.cookie.cookieBehavior - 0 FF - user.js: privacy.clearOnShutdown.cookies - false FF - user.js: security.warn_viewing_mixed - false FF - user.js: security.warn_viewing_mixed.show_once - false FF - user.js: security.warn_submit_insecure - false FF - user.js: security.warn_submit_insecure.show_once - false FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=10588&tl=gbn269661 FF - user.js: extensions.BabylonToolbar_i.babExt - FF - user.js: extensions.BabylonToolbar_i.srcExt - def FF - user.js: extensions.BabylonToolbar_i.id - 3c5ee72d00000000000074ea3a923db2 FF - user.js: extensions.BabylonToolbar_i.hardId - 3c5ee72d00000000000074ea3a923db2 FF - user.js: extensions.BabylonToolbar_i.instlDay - 15441 FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1720:22 FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar FF - user.js: extensions.BabylonToolbar_i.aflt - babclient FF - user.js: extensions.BabylonToolbar_i.smplGrp - none FF - user.js: extensions.BabylonToolbar_i.tlbrId - base FF - user.js: extensions.BabylonToolbar_i.instlRef - std FF - user.js: extentions.y2layers.installId - eac9421c-0e97-41e7-8e8f-0091867fd43e FF - user.js: extentions.y2layers.defaultEnableAppsList - DropDownDeals,ezLooker,pagerage,buzzdock,toprelatedtopics FF - user.js: extensions.autoDisableScopes - 14 . - - - - CHIAVI ORFANE RIMOSSE - - - - . MSConfigStartUp-QuickTime Task - c:\programmi\QuickTime\QTTask.exe . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2012-09-25 12:42 Windows 5.1.2600 Service Pack 3 NTFS . scansione processi nascosti ... . scansione entrate autostart nascoste ... . Scansione files nascosti ... . Scansione completata con successo Files nascosti: 0 . ************************************************************************** . --------------------- CHIAVI DI REGISTRO BLOCCATE --------------------- . [HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*] @="?????????????????? v1" . [HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID] @="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}" . [HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*] @="?????????????????? v2" . [HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID] @="{9BE31822-FDAD-461B-AD51-BE1D1C159921}" . Ora fine scansione: 2012-09-25 12:45:26 ComboFix-quarantined-files.txt 2012-09-25 10:45 . Pre-Run: 120.983.207.936 byte disponibili Post-Run: 121.491.177.472 byte disponibili . - - End Of File - - 2CCD74F06DA0B7DA70DF75D1CF39DC2A