Trojan horse

[asterix]

  Ciao a tutti  , ho una domanda da porvi , ogni volta che inserisco chiavette appartenenti ad un carissimo amico , il Nod mi dice che contiene Trojan horse (come vedete nell ' img ) e li mette in quarantena . Quindi  disinfetto la chiavetta e la riconsegno al padrone . Come mi riporta questa o un ' altra mi sucede lo stesso problema . Cosa puo' essere ? Grazie a tutti in anticipo ...

P.S. Questo amico ha pure lui installato Nod 32 come antivirus.

 

[crazy.cat]

Che versione ha di nod?

Prova a dirgli di fare una scansione con combofix e postarne qui il log.

[asterix]

Che versione ha di nod?

Prova a dirgli di fare una scansione con combofix e postarne qui il log.

Questi i risultati ...

ComboFix 09-08-24.06 - Michy 25/08/2009 13.50.52.1.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1252.39.1040.18.502.259 [GMT 2:00]
Eseguito da: i:\softuer\combofix\ComboFix.exe
 * Resident AV is active

.
ADS - WINDOWS: deleted 72 bytes in 1 streams.

(((((((((((((((((((((((((((((((((((((   Altre eliminazioni   )))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\28b6ry9r.exe
C:\abk.bat
C:\autorun.inf
C:\cahpcg.cmd
c:\documents and settings\Michy\Dati applicazioni\inst.exe
C:\eyt.exe
C:\fsaht.cmd
C:\hkn6k.bat
C:\q9.cmd
C:\sm.exe
C:\sv8c2bjw.bat
c:\windows\AhnRpta.exe
c:\windows\system32\AutoRun.inf
c:\windows\system32\e8main0.dll
c:\windows\system32\gasretyw0.dll
c:\windows\system32\kamsoft.exe
c:\windows\system32\nmdfgds0.dll
c:\windows\system32\nmdfgds1.dll
c:\windows\system32\olhrwef.exe
C:\xdglur.bat
C:\ysep1.exe
D:\28b6ry9r.exe
D:\abk.bat
D:\autorun.inf
D:\cahpcg.cmd
D:\eyt.exe
D:\fsaht.cmd
D:\hkn6k.bat
D:\q9.cmd
D:\sm.exe
D:\sv8c2bjw.bat
D:\xdglur.bat
D:\ysep1.exe
G:\28b6ry9r.exe
G:\abk.bat
G:\autorun.inf
G:\cahpcg.cmd
G:\eyt.exe
G:\fsaht.cmd
G:\hkn6k.bat
G:\q9.cmd
G:\sm.exe
G:\sv8c2bjw.bat
G:\xdglur.bat
G:\ysep1.exe
H:\28b6ry9r.exe
H:\abk.bat
H:\autorun.inf
H:\cahpcg.cmd
H:\eyt.exe
H:\fsaht.cmd
H:\hkn6k.bat
H:\q9.cmd
H:\sm.exe
H:\sv8c2bjw.bat
H:\xdglur.bat
H:\ysep1.exe
I:\abk.bat
I:\Autorun.inf
I:\cahpcg.cmd
L:\28b6ry9r.exe
L:\abk.bat
L:\autorun.inf
L:\cahpcg.cmd
L:\eyt.exe
L:\fsaht.cmd
L:\hkn6k.bat
L:\q9.cmd
L:\sm.exe
L:\sv8c2bjw.bat
L:\xdglur.bat
L:\ysep1.exe
M:\28b6ry9r.exe
M:\abk.bat
M:\autorun.inf
M:\cahpcg.cmd
M:\eyt.exe
M:\fsaht.cmd
M:\hkn6k.bat
M:\q9.cmd
M:\sm.exe
M:\sv8c2bjw.bat
M:\xdglur.bat
M:\ysep1.exe
O:\28b6ry9r.exe
O:\abk.bat
O:\autorun.inf
O:\cahpcg.cmd
O:\eyt.exe
O:\fsaht.cmd
O:\hkn6k.bat
O:\q9.cmd
O:\sm.exe
O:\sv8c2bjw.bat
O:\xdglur.bat
O:\ysep1.exe

.
(((((((((((((((((((((((((((((((((((((((   Driver/Servizi   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_KAVSYS
-------\Service_AVPsys


(((((((((((((((((((((((((   Files Creati Da 2009-07-25 al 2009-08-25  )))))))))))))))))))))))))))))))))))
.

2009-08-25 11:58 . 2009-08-25 11:58   --------   d-----w-   c:\windows\system32\wbem\snmp
2009-08-25 11:58 . 2009-08-25 11:58   --------   d-----w-   c:\windows\system32\xircom
2009-08-25 11:58 . 2009-08-25 11:58   --------   d-----w-   c:\windows\srchasst
2009-08-25 11:58 . 2009-08-25 11:58   --------   d-----w-   c:\programmi\microsoft frontpage
2009-07-26 19:11 . 2009-07-26 19:11   --------   d-----w-   c:\documents and settings\Michy\Dati applicazioni\BlackBean
2009-07-26 19:06 . 2008-03-05 14:03   479752   ----a-w-   c:\windows\system32\XAudio2_0.dll
2009-07-26 19:06 . 2008-03-05 14:03   238088   ----a-w-   c:\windows\system32\xactengine3_0.dll
2009-07-26 19:06 . 2008-03-05 14:00   25608   ----a-w-   c:\windows\system32\X3DAudio1_3.dll
2009-07-26 19:06 . 2008-03-05 13:56   1420824   ----a-w-   c:\windows\system32\D3DCompiler_37.dll
2009-07-26 19:06 . 2008-02-05 21:07   462864   ----a-w-   c:\windows\system32\d3dx10_37.dll
2009-07-26 19:06 . 2008-03-05 13:56   3786760   ----a-w-   c:\windows\system32\D3DX9_37.dll

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-25 08:37 . 2009-02-12 16:37   --------   d-----w-   c:\documents and settings\All Users\Dati applicazioni\Google Updater
2009-08-13 16:58 . 2009-01-25 14:54   --------   d-----w-   c:\documents and settings\Michy\Dati applicazioni\uTorrent
2009-08-11 14:30 . 2009-05-24 18:00   --------   d-----w-   c:\documents and settings\Michy\Dati applicazioni\Vso
2009-07-26 18:59 . 2008-12-06 17:26   --------   d--h--w-   c:\programmi\InstallShield Installation Information
2009-07-07 12:33 . 2009-02-18 20:22   --------   d-----w-   c:\documents and settings\Michy\Dati applicazioni\dvdcss
2009-06-08 18:49 . 2009-06-08 18:49   766   ----a-r-   c:\documents and settings\Michy\Dati applicazioni\Microsoft\Installer\{7784A172-61F1-445E-8368-601607E0DD22}\_294823.exe
2009-06-08 18:49 . 2009-06-08 18:49   2238   ----a-r-   c:\documents and settings\Michy\Dati applicazioni\Microsoft\Installer\{7784A172-61F1-445E-8368-601607E0DD22}\_4ae13d6c.exe
2009-06-08 18:49 . 2009-06-08 18:49   1518   ----a-r-   c:\documents and settings\Michy\Dati applicazioni\Microsoft\Installer\{7784A172-61F1-445E-8368-601607E0DD22}\_69525f90.exe
2009-06-08 18:49 . 2009-06-08 18:49   1078   ----a-r-   c:\documents and settings\Michy\Dati applicazioni\Microsoft\Installer\{7784A172-61F1-445E-8368-601607E0DD22}\_2cd672ae.exe
2009-06-08 18:49 . 2009-06-08 18:49   1078   ----a-r-   c:\documents and settings\Michy\Dati applicazioni\Microsoft\Installer\{7784A172-61F1-445E-8368-601607E0DD22}\_18be6784.exe
2009-03-05 14:40 . 2009-03-05 14:40   91136   --sha-r-   c:\windows\system32\hztdlql.dll
.

------- Sigcheck -------

[-] 2008-06-20 10:45   360320   2A5554FC5B1E04E131230E3CE035C3F9   c:\windows\SoftwareDistribution\Download\2f751deff4c9646c9a2883fbe2a60450\SP2GDR\tcpip.sys
[-] 2008-06-20 10:44   360960   744E57C99232201AE98C49168B918F48   c:\windows\SoftwareDistribution\Download\2f751deff4c9646c9a2883fbe2a60450\SP2QFE\tcpip.sys
[-] 2008-06-20 11:51   361600   9AEFA14BD6B182D61E3119FA5F436D3D   c:\windows\SoftwareDistribution\Download\2f751deff4c9646c9a2883fbe2a60450\SP3GDR\tcpip.sys
[-] 2008-06-20 11:59   361600   AD978A1B783B5719720CFF204B666C8E   c:\windows\SoftwareDistribution\Download\2f751deff4c9646c9a2883fbe2a60450\SP3QFE\tcpip.sys
[-] 2007-12-01 14:24   360704   409B44CE625776DB74EAA63F24E9D4E4   c:\windows\system32\drivers\tcpip.sys

[-] 2007-11-24 14:23   2443136   2B10C17B579667B17AA9856B9B08C668   c:\windows\system32\ntoskrnl.exe

[-] 2007-11-24 12:42   1554432   FB8A222C2828375F2F75758CAEDC0120   c:\windows\explorer.exe


c:\windows\system32\wscntfy.exe ... è mancante !!
.
(((((((((((((((((((((((((((((((((((((   Punti Reg Caricati   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\programmi\File comuni\Nero\Lib\NMBgMonitor.exe" [2007-10-23 202024]
"AnyDVD"="d:\doc ciby\any\AnyDVD\AnyDVDtray.exe" [2009-02-01 2259904]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\programmi\File comuni\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
"SunJavaUpdateSched"="c:\programmi\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-24 132496]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-02-08 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-02-08 126976]
"egui"="c:\programmi\ESET\ESET NOD32 Antivirus\egui.exe" [2008-04-23 1443072]
"HP Software Update"="c:\programmi\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"GrooveMonitor"="c:\programmi\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"CnxTrApp"="c:\programmi\Aethra\ADSL EB1070 USB\CnxTrApp.dll" [2004-04-20 247296]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
"nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2007-12-01 123904]

c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Alice ti aiuta.lnk - c:\programmi\Alice ti aiuta\bin\matcli.exe [2009-6-13 212992]
HP Digital Imaging Monitor.lnk - c:\programmi\HP\Digital Imaging\bin\hpqtra08.exe [2007-3-11 210520]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute   REG_MULTI_SZ      PDBoot.exe\0autocheck autochk *

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"l:\\Ciby\\utorrent1\\uTorrent.exe"=
"c:\\Programmi\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Programmi\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Programmi\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Programmi\\Nero\\Nero8\\Nero Home\\NeroHome.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"40486:TCP"= 40486:TCP:PatchGoogle IntelInternet
"23470:UDP"= 23470:UDP:PatchGoogle NewWeb
"62318:TCP"= 62318:TCP:PatchGoogle HelpPackages
"20408:UDP"= 20408:UDP:PatchGoogle AdobeFiles
"63911:TCP"= 63911:TCP:PatchGoogle VisualMovie
"22323:UDP"= 22323:UDP:PatchGoogle CommonUS
"63463:TCP"= 63463:TCP:PatchGoogle VisualDefinitions
"16360:UDP"= 16360:UDP:PatchGoogle OfflineResources
"7973:TCP"= 7973:TCP:PatchGoogle registrationProfiles
"34171:UDP"= 34171:UDP:PatchGoogle PolicyOffice
"61155:TCP"= 61155:TCP:PatchGoogle ResourcesDefender
"38127:UDP"= 38127:UDP:PatchGoogle L2SLive

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [23/04/2008 15.00.48 33800]
R2 ekrn;Eset Service;c:\programmi\ESET\ESET NOD32 Antivirus\ekrn.exe [23/04/2008 14.58.30 472320]
R2 Network WanMiniport First Position;Network WanMiniport First Position;c:\programmi\Telecom Italia\WanMiniport1st\srvany.exe [05/02/2009 21.29.58 8192]
S2 Netsrv;Server Trusted;c:\windows\system32\svchost.exe -k netsvcs [19/08/2004 16.39.46 14336]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12   REG_MULTI_SZ      Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt   REG_MULTI_SZ      hpqcxs08 hpqddsvc

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
Netsrv
UxTuneUp
.
Contenuto della cartella 'Scheduled Tasks'

2009-08-25 c:\windows\Tasks\1-Click Maintenance.job
- d:\programmi\TuneUp Utilities 2008\OneClickStarter.exe [2008-04-16 07:59]

2009-08-25 c:\windows\Tasks\Google Software Updater.job
- c:\programmi\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-12 16:37]

2009-08-25 c:\windows\Tasks\WebReg Deskjet F4100 series.job
- c:\programmi\HP\Digital Imaging\bin\hpqwrg.exe [2007-03-11 20:27]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
uInternet Settings,ProxyOverride = 127.0.0.1
IE: Add to AMV Convert Tool... - o:\softuer\AMVConverter\grab.html
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: MediaManager tool grab multimedia file - o:\softuer\MediaManager\grab.html
TCP: {61E9377D-B362-45F5-A1C2-D0D4E66271C2} = xx.xx.xx.xx xx.xx.xx.xx
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
FF - ProfilePath - c:\documents and settings\Michy\Dati applicazioni\Mozilla\Firefox\Profiles\0ef56n17.default\
FF - prefs.js: browser.search.selectedEngine - Wikipedia (it)
FF - prefs.js: browser.startup.homepage - hxxp://www.google.it/
FF - plugin: c:\programmi\Google\Google Updater\2.4.1487.6512\npCIDetect13.dll

---- FIREFOX POLICIES ----
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota",      5120);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\programmi\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\programmi\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history",     true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata",    true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords",   false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads",   true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies",     true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache",       true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions",    true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history",                 true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata",                true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords",               false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads",               true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies",                 true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache",                   true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions",                true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps",             false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings",            false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs",    false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-25 13:59
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Netsrv]
"ServiceDll"="c:\windows\system32\hztdlql.dll"
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------

- - - - - - - > 'winlogon.exe'(692)
c:\windows\system32\SETUPAPI.dll

- - - - - - - > 'lsass.exe'(752)
c:\windows\system32\SETUPAPI.dll

- - - - - - - > 'explorer.exe'(1752)
c:\windows\system32\NETSHELL.dll
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\programmi\Nero\Nero8\Nero BackItUp\NBService.exe
c:\programmi\Raxco\PerfectDisk\PDAgent.exe
c:\programmi\Telecom Italia\WanMiniport1st\WanMiniport1st_srv.exe
c:\progra~1\ALICET~1\vendors\AliceRE\content\template\DRIVEN~1\syncer\MCCITR~1.EXE
c:\programmi\Raxco\PerfectDisk\PDEngine.exe
c:\programmi\File comuni\Nero\Lib\NMIndexingService.exe
c:\programmi\File comuni\Nero\Lib\NMIndexStoreSvr.exe
c:\programmi\Alice ti aiuta\bin\mpbtn.exe
c:\programmi\HP\Digital Imaging\bin\hpqste08.exe
.
**************************************************************************
.
Ora fine scansione: 2009-08-25 14.02.35 - Il pc è stato riavviato
ComboFix-quarantined-files.txt  2009-08-25 12:02

Pre-Run: 7.239.589.888 byte disponibili
Post-Run: 7.175.380.992 byte disponibili

WindowsXP-KB310994-SP2-Pro-BootDisk-ITA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

334


Attendo notizie ...

[ambarambacicicoco]

se ha un qualcosa che non va sul suo pc, ogni volta che inserisce la chiavetta la reinfetta! pulire prima la causa!

[ridethesnake]

... P.S. Questo amico ha pure lui installato Nod 32 come antivirus...

forse è ora di cambiare antivirus 

SDFix é stato creato da AndyManchesta e si occupa di eliminare numerosi files infetti oltre che a ripulire il sitema da processi e servizi infetti collegati a malware e infezioni varie.

 Inoltre permette di;
   

• identificare alcuni rotkits
• listare file e processi nascosti
• ripristinare i parametri del sistema alterati dal malware stesso

 http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

 Licenza : Freeware
 OS suppportati: 2000/XP

 Una volta scaricato,doppio click su SDFix.exe per lanciare l'installazione
 Cliccate su Install (verrà creata una cartella alla radice dell'HD dal nome SDFix)
 Finita l'installazione riavviate il sistema in modalità provvisoria (indispensabile per fare in modo che il tool agisca correttamente)
 Una volta in modalità provvisoria;   

• fate un doppio click sul file RunThis.bat
• selezionate Y
• premete il tasto ENTER della vostra tastiera per lanciare la pulizia.

   Pazientate qualche attimo e il tool vi chiederà di premere un tasto per riavviare.
 Al riavvio SDFix porterà a termine la procedura e visualizzerà un messaggio nel quale indica la fine della pulizia e l'opzione per visualizzare il log.
 (SDFIx ha anche altre opzioni ma non è il caso di elencarle)

vedi se è rimasto qualcosa da levare

fate entrambi una scansione anche con http://normanasa.vo.llnwd.net/o29/public/Norman_Malware_Cleaner.exe giusto per ulteriore sicurezza 

[asterix]

.....
fate entrambi una scansione anche con http://normanasa.vo.llnwd.net/o29/public/Norman_Malware_Cleaner.exe giusto per ulteriore sicurezza 

Ma devo farla pure io ? Perche' ? A me non mi da' problemi ....... o e' un problema pure mio adesso ?

[ridethesnake]

.....
fate entrambi una scansione anche con http://normanasa.vo.llnwd.net/o29/public/Norman_Malware_Cleaner.exe giusto per ulteriore sicurezza 

Ma devo farla pure io ? Perche' ? A me non mi da' problemi ....... o e' un problema pure mio adesso ?

giusto per sentirti più sicuro... non si va dal dottore per sentirsi dire di essere malato ma per sentirsi dire di essere sano 

[ambarambacicicoco]

.....
fate entrambi una scansione anche con http://normanasa.vo.llnwd.net/o29/public/Norman_Malware_Cleaner.exe giusto per ulteriore sicurezza 

Ma devo farla pure io ? Perche' ? A me non mi da' problemi ....... o e' un problema pure mio adesso ?

Io ti consiglio un C:\format 

[Druidosan]

.....
fate entrambi una scansione anche con http://normanasa.vo.llnwd.net/o29/public/Norman_Malware_Cleaner.exe giusto per ulteriore sicurezza 

Ma devo farla pure io ? Perche' ? A me non mi da' problemi ....... o e' un problema pure mio adesso ?

Io ti consiglio un C:\format 

Asterix se lo vuoi pulito apri il case del tuo pc e ci butti una secchiata d'acqua con un pò di detersivo, vedrai che splendore 

[crazy.cat]

Questi i risultati ...

Se leggi le voci "Altre eliminazioni" combofix è riuscito a fare una strage.
Praticamente erano infette tutte le partizioni di quel pc.

Occhio comunque a reinserire le chiavette, Ninjia potrebbe essere una buona soluzione per proteggersi

	http://www.megalab.it/4100/ninja-protegge-dai-virus-i-dispositivi-di-memoria-usb

Comunque un controllo anche del tuo pc andrebbe fatto sempre con combofix, nod si è "dimenticato" troppe cose sull'altro.

[ridethesnake]

Occhio comunque a reinserire le chiavette...

tengo una "vecchia" TwinMOS da 2gb con la linguetta di protezione dalla scrittura come i vecchi floppy... purtroppo i produttori di  pennine oltra a farle  sempre più fragili non le dotano (qualcuna si) di questo piccolo e poco costoso "interruttore" che di questi tempi, passando da un pc all'altro, risulta estremamente efficace sia per la sicurezza dei dati che per limitare la diffusione di monnezzaware.

[asterix]

Questi i miei risultati ...

ComboFix 09-08-28.05 - Utente1 29/08/2009 17.13.31.1.2 - NTFSx86
Microsoft Windows XP Home Edition  5.1.2600.3.1252.39.1040.18.3327.2855 [GMT 2:00]
Eseguito da: l:\windows xp\programmini\ComboFix.exe
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.
ADS - WINDOWS: deleted 72 bytes in 1 streams.

(((((((((((((((((((((((((((((((((((((   Altre eliminazioni   )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-1784679431-2641084430-984598118-1000
c:\documents and settings\Utente1\Dati applicazioni\inst.exe
c:\documents and settings\Utente1\Impostazioni locali\Dati applicazioni\ffmmll.dat
c:\documents and settings\Utente1\Impostazioni locali\Dati applicazioni\ffmmll_nav.dat
c:\documents and settings\Utente1\Impostazioni locali\Dati applicazioni\ffmmll_navps.dat
c:\documents and settings\Utente1\Impostazioni locali\Dati applicazioni\osmoa.dat
c:\documents and settings\Utente1\Impostazioni locali\Dati applicazioni\osmoa_nav.dat
c:\documents and settings\Utente1\Impostazioni locali\Dati applicazioni\osmoa_navps.dat
c:\documents and settings\Utente1\Impostazioni locali\Dati applicazioni\wmkgoki.dat
c:\documents and settings\Utente1\Impostazioni locali\Dati applicazioni\wmkgoki.exe
c:\documents and settings\Utente1\Impostazioni locali\Dati applicazioni\wmkgoki_nav.dat
c:\documents and settings\Utente1\Impostazioni locali\Dati applicazioni\wmkgoki_navps.dat
c:\documents and settings\Utente1\Impostazioni locali\Dati applicazioni\ykqgs.dat
c:\documents and settings\Utente1\Impostazioni locali\Dati applicazioni\ykqgs_navps.dat
c:\programmi\Norton2009Reset.exe
c:\programmi\RelevantKnowledge
c:\programmi\RelevantKnowledge\rlservice.exe
c:\windows\Installer\1ba9a6f.msp
c:\windows\Installer\1ba9a70.msp
c:\windows\Installer\1ba9a71.msp
c:\windows\Installer\1ba9a72.msp
c:\windows\Installer\1ba9a73.msp
c:\windows\Installer\1ba9a74.msp
c:\windows\Installer\1ba9a75.msp
c:\windows\Installer\1ba9a76.msp
c:\windows\Installer\1ba9a77.msp
c:\windows\Installer\1bc9432.msp
c:\windows\Installer\1bc9433.msp
c:\windows\Installer\1bc9434.msp
c:\windows\Installer\1bc9435.msp
c:\windows\Installer\1bc9436.msp
c:\windows\Installer\1bc9437.msp
c:\windows\Installer\1bc9438.msp
c:\windows\Installer\1bc9439.msp
c:\windows\Installer\1bc943a.msp
c:\windows\Installer\1bc943b.msp
c:\windows\Installer\1bd2a6d.msp
c:\windows\Installer\1bd2a78.msp
c:\windows\Installer\1bd2a84.msp
c:\windows\Installer\e95d8.msp

.
(((((((((((((((((((((((((((((((((((((((   Driver/Servizi   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_.norton2009Reset


(((((((((((((((((((((((((   Files Creati Da 2009-07-28 al 2009-08-29  )))))))))))))))))))))))))))))))))))
.

2009-08-27 21:44 . 2009-08-28 07:53   --------   d-sh--w-   C:\Boot
2009-08-27 21:07 . 2009-06-13 17:54   1663488   ----a-w-   c:\windows\system32\BootMan.exe
2009-08-27 21:07 . 2009-04-22 12:28   8704   ----a-w-   c:\windows\system32\epmntdrv.sys
2009-08-27 21:07 . 2009-04-22 12:28   86408   ----a-w-   c:\windows\system32\setupempdrv03.exe
2009-08-27 21:07 . 2009-04-22 12:28   3072   ----a-w-   c:\windows\system32\EuGdiDrv.sys
2009-08-27 21:07 . 2009-04-22 12:27   14848   ----a-w-   c:\windows\system32\EuEpmGdi.dll
2009-08-27 21:07 . 2009-08-27 21:07   --------   d-----w-   c:\programmi\EASEUS
2009-08-27 20:39 . 2009-08-27 20:39   --------   d-----w-   c:\windows\system32\wbem\Repository
2009-08-27 19:57 . 2009-08-27 20:37   --------   d-----w-   c:\programmi\Acronis(2)
2009-08-20 16:32 . 2008-04-13 17:13   54784   -c--a-w-   c:\windows\system32\dllcache\vfwwdm32.dll
2009-08-20 16:32 . 2008-04-13 17:13   54784   ----a-w-   c:\windows\system32\vfwwdm32.dll
2009-08-20 16:32 . 2008-04-13 09:46   121984   -c--a-w-   c:\windows\system32\dllcache\usbvideo.sys
2009-08-20 16:32 . 2008-04-13 09:46   121984   ----a-w-   c:\windows\system32\drivers\usbvideo.sys
2009-08-12 11:01 . 2009-08-12 11:01   --------   d-----w-   c:\windows\system32\3Planesoft
2009-08-12 11:01 . 2009-08-12 11:01   --------   d-----w-   c:\programmi\3Planesoft Screensaver Manager
2009-08-11 20:37 . 2009-08-11 20:37   --------   d-----w-   c:\programmi\CCleaner
2009-08-11 20:30 . 2003-05-27 11:55   1438   ----a-w-   C:\cleanxp.bat
2009-08-11 20:30 . 2003-05-27 11:51   438   ----a-w-   C:\xp.cmd
2009-08-10 18:02 . 2009-08-21 15:51   --------   d-----w-   c:\documents and settings\All Users\Dati applicazioni\Test Drive Unlimited
2009-08-10 17:36 . 2009-08-10 17:36   49152   ----a-r-   c:\documents and settings\Utente1\Dati applicazioni\Microsoft\Installer\{C37A0BC1-52EE-4F97-8223-5CA9FC0357B0}\ARPPRODUCTICON.exe
2009-08-09 22:27 . 2009-08-09 22:28   --------   d-----w-   C:\d73329ec3a6da4ac931989ed98c1d2eb
2009-08-09 22:27 . 2008-07-06 12:06   89088   -c----w-   c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-08-09 22:27 . 2008-07-06 12:06   575488   -c----w-   c:\windows\system32\dllcache\xpsshhdr.dll
2009-08-09 22:27 . 2008-07-06 12:06   575488   ------w-   c:\windows\system32\xpsshhdr.dll
2009-08-09 22:27 . 2008-07-06 12:06   1676288   -c----w-   c:\windows\system32\dllcache\xpssvcs.dll
2009-08-09 22:27 . 2008-07-06 12:06   1676288   ------w-   c:\windows\system32\xpssvcs.dll
2009-08-09 22:27 . 2008-07-06 12:06   117760   ------w-   c:\windows\system32\prntvpt.dll
2009-08-09 22:27 . 2008-07-06 10:50   597504   -c----w-   c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-08-09 21:30 . 2009-08-09 21:30   --------   d-----w-   c:\documents and settings\All Users\Dati applicazioni\nView_Profiles
2009-08-09 21:10 . 2009-08-09 21:10   --------   d-----w-   c:\documents and settings\Utente1\Dati applicazioni\Desktopicon
2009-08-09 21:01 . 2009-08-09 21:01   --------   d-----w-   c:\documents and settings\All Users\Dati applicazioni\DAEMON Tools Lite
2009-08-09 20:54 . 2009-08-09 20:54   --------   d-----w-   c:\windows\DED53B0BB67C4244AE6AD6FD3C28D1EF.TMP
2009-08-09 20:51 . 2009-08-09 20:51   --------   d--h--r-   C:\AHCache
2009-08-08 17:32 . 2009-08-09 22:28   --------   d-----w-   c:\windows\system32\XPSViewer
2009-08-08 17:32 . 2009-08-08 17:32   --------   d-----w-   c:\programmi\Reference Assemblies
2009-08-04 18:18 . 2009-08-04 18:18   --------   d-----w-   c:\documents and settings\All Users\Dati applicazioni\McAfee
2009-08-04 18:17 . 2009-08-04 18:17   152576   ----a-w-   c:\documents and settings\Utente1\Dati applicazioni\Sun\Java\jre1.6.0_14\lzma.dll
2009-08-01 19:54 . 2009-08-01 19:54   --------   d-----w-   c:\documents and settings\Utente1\Dati applicazioni\Image Zone Express

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-29 15:13 . 2008-04-14 12:00   563564   ----a-w-   c:\windows\system32\perfh010.dat
2009-08-29 15:13 . 2008-04-14 12:00   109272   ----a-w-   c:\windows\system32\perfc010.dat
2009-08-29 15:09 . 2008-11-26 21:12   69224   ----a-w-   c:\documents and settings\Utente1\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2009-08-27 17:16 . 2008-11-24 18:31   --------   d--h--w-   c:\programmi\InstallShield Installation Information
2009-08-12 12:07 . 2009-04-06 17:39   --------   d-----w-   c:\documents and settings\All Users\Dati applicazioni\Microsoft Help
2009-08-11 20:41 . 2009-05-07 19:59   --------   d-----w-   c:\documents and settings\All Users\Dati applicazioni\Spybot - Search & Destroy
2009-08-09 21:31 . 2009-07-10 18:46   --------   d-----w-   c:\programmi\Electronic Arts
2009-08-09 21:10 . 2009-07-01 18:52   --------   d-----w-   c:\programmi\Thoosje Vista Sidebar
2009-08-09 21:01 . 2009-06-28 08:09   --------   d-----w-   c:\documents and settings\Utente1\Dati applicazioni\DAEMON Tools Lite
2009-08-09 20:21 . 2009-04-23 20:11   --------   d-----w-   c:\programmi\Styler
2009-08-09 20:20 . 2009-01-02 19:59   --------   d-----w-   c:\programmi\TuneUp Utilities 2009
2009-08-09 20:15 . 2009-06-06 08:57   --------   d-----w-   c:\programmi\RocketDock
2009-08-09 20:10 . 2009-03-19 19:24   --------   d-----w-   c:\programmi\DVDFab Platinum 4
2009-08-09 19:43 . 2009-06-08 19:32   --------   d-----w-   c:\programmi\TrueTransparency
2009-08-05 08:59 . 2008-04-14 12:00   205312   ----a-w-   c:\windows\system32\mswebdvd.dll
2009-08-04 18:18 . 2009-01-30 20:54   --------   d-----w-   c:\programmi\Java
2009-08-02 17:51 . 2009-05-15 17:59   --------   d-----w-   c:\documents and settings\Utente1\Dati applicazioni\BlackBean
2009-08-02 17:28 . 2009-05-15 17:50   --------   d-----w-   c:\programmi\BlackBeanGames
2009-08-01 19:57 . 2008-11-28 08:04   140520   ----a-w-   c:\windows\hpoins12.dat
2009-07-17 19:01 . 2008-04-14 12:00   58880   ----a-w-   c:\windows\system32\atl.dll
2009-07-13 21:43 . 2008-04-14 12:00   286208   ----a-w-   c:\windows\system32\wmpdxm.dll
2009-07-10 18:46 . 2008-11-26 22:05   2456   ----a-w-   c:\windows\system32\ealregsnapshot1.reg
2009-07-01 18:03 . 2009-03-19 19:25   --------   d-----w-   c:\documents and settings\Utente1\Dati applicazioni\Vso
2009-06-29 15:55 . 2008-04-14 12:00   827392   ----a-w-   c:\windows\system32\wininet.dll
2009-06-29 15:55 . 2008-04-14 12:00   78336   ----a-w-   c:\windows\system32\ieencode.dll
2009-06-29 15:54 . 2008-04-14 12:00   17408   ----a-w-   c:\windows\system32\corpol.dll
2009-06-28 08:09 . 2009-06-28 08:09   721904   ----a-w-   c:\windows\system32\drivers\sptd.sys
2009-06-16 14:36 . 2008-04-14 12:00   81920   ----a-w-   c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2008-04-14 12:00   119808   ----a-w-   c:\windows\system32\t2embed.dll
2009-06-15 10:43 . 2008-04-14 12:00   78336   ----a-w-   c:\windows\system32\telnet.exe
2009-06-10 14:13 . 2008-04-14 12:00   85504   ----a-w-   c:\windows\system32\avifil32.dll
2009-06-10 07:19 . 2008-11-24 17:21   2066432   ----a-w-   c:\windows\system32\mstscax.dll
2009-06-10 06:14 . 2008-04-14 12:00   132096   ----a-w-   c:\windows\system32\wkssvc.dll
2009-06-03 19:09 . 2008-04-14 12:00   1296384   ----a-w-   c:\windows\system32\quartz.dll
2009-03-21 17:50 . 2009-03-21 16:50   103131812   ----a-w-   c:\programmi\Cai2_by_ouralisev3.rar
2009-03-04 12:39 . 2009-03-04 11:46   150000000   ----a-w-   c:\programmi\I.Love.Shopping.2009.MD.TS.XviD-MASA.part2.rar
2009-03-01 06:32 . 2009-02-28 19:53   102400000   ----a-w-   c:\programmi\Photoshop_cs2_keygen_STANLEZZ.part2.rar
2009-03-01 06:17 . 2009-02-28 19:53   102400000   ----a-w-   c:\programmi\Photoshop_cs2_keygen_STANLEZZ.part1.rar
2009-03-01 06:15 . 2009-02-28 19:53   102400000   ----a-w-   c:\programmi\Photoshop_cs2_keygen_STANLEZZ.part3.rar
2009-02-28 22:02 . 2009-02-28 19:53   36720851   ----a-w-   c:\programmi\Photoshop_cs2_keygen_STANLEZZ.part4.rar
2009-02-27 12:44 . 2009-02-27 12:43   50385384   ----a-w-   c:\programmi\Adobe_Photoshop__CS3__Extended___Crack.part1.rar.part
2009-02-27 12:44 . 2009-02-27 12:43   50612588   ----a-w-   c:\programmi\Adobe_Photoshop__CS3__Extended___Crack.part3.rar.part
2009-02-27 12:44 . 2009-02-27 12:43   50684488   ----a-w-   c:\programmi\Adobe_Photoshop__CS3__Extended___Crack.part4.rar.part
2009-02-27 12:44 . 2009-02-27 12:43   51134582   ----a-w-   c:\programmi\Adobe_Photoshop__CS3__Extended___Crack.part2.rar.part
2009-02-27 12:44 . 2009-02-27 12:43   50350872   ----a-w-   c:\programmi\Adobe_Photoshop__CS3__Extended___Crack.part5.rar.part
2009-02-05 21:21 . 2009-02-05 21:19   19599556   ----a-w-   c:\programmi\Wallpapers_2_QoopC.rar
2007-09-21 16:07 . 2009-01-14 18:00   2590   ---h--w-   c:\programmi\Descript.ion
2007-09-20 17:34 . 2009-01-27 19:33   129536   ----a-w-   c:\programmi\RarExt.dll
2007-09-05 21:10 . 2009-01-27 19:33   17171   ------w-   c:\programmi\Novità.Txt
2007-09-05 10:26 . 2009-01-27 19:33   11352   ------w-   c:\programmi\NoteTecniche.Txt
2007-04-19 21:11 . 2009-01-27 19:33   2235   ------w-   c:\programmi\Leggimi.Txt
2007-04-03 22:08 . 2009-01-27 19:33   7480   ------w-   c:\programmi\Licenza.Txt
2007-01-10 21:34 . 2009-01-27 19:33   611   ------w-   c:\programmi\Uninstall.Lst
2007-01-10 21:32 . 2009-01-27 19:33   7784   ------w-   c:\programmi\Ordina.htm
2007-01-10 21:32 . 2009-01-27 19:33   7784   ------w-   c:\programmi\Ordin.htm
2006-12-23 16:37 . 2009-01-27 19:33   44032   ----a-w-   c:\programmi\RarExtLoader.exe
2006-12-11 01:14 . 2009-01-27 19:33   43008   ----a-w-   c:\programmi\RarExt64.dll
2006-04-28 22:47 . 2009-01-27 19:33   1373   ------w-   c:\programmi\RarFiles.Lst
2005-06-08 20:43 . 2009-01-27 19:33   244   ------w-   c:\programmi\SorgUnRAR.Txt
.

------- Sigcheck -------

[-] 2008-04-14 12:00   579584   3E163C943AC3ECC44826954A579E0F87   c:\windows\system32\user32.dll
[-] 2008-04-14 12:00   579584   3E163C943AC3ECC44826954A579E0F87   c:\windows\system32\dllcache\user32.dll

[-] 2008-04-14 12:00   549888   6DC43081C760EEC1130D2C8C145DF375   c:\windows\system32\winlogon.exe
[-] 2008-04-14 12:00   549888   6DC43081C760EEC1130D2C8C145DF375   c:\windows\system32\dllcache\winlogon.exe

[7] 2009-02-09 11:14   2069888   FF69166080436A31A3EAC9CC7C3F1847   c:\windows\$hf_mig$\KB956572\SP3QFE\ntkrnlpa.exe
[7] 2008-08-14 18:25   2069760   C812D8551FD3B6ACDBF7EB6B18B1B992   c:\windows\$hf_mig$\KB956841\SP3QFE\ntkrnlpa.exe
[7] 2008-08-14 13:22   2027520   BC8D2FF46D42B76655F443EF1386930F   c:\windows\$NtUninstallKB956572$\ntkrnlpa.exe
[7] 2008-04-14 12:00   2027520   FE93732DE7D6EA191E2FF816341D6FFF   c:\windows\$NtUninstallKB956841$\ntkrnlpa.exe
[7] 2009-02-10 17:02   2069760   310B4DD8E34D9281D609B5EBDFDE34A7   c:\windows\Driver Cache\i386\ntkrnlpa.exe
[-] 2009-02-09 11:23   2188800   58067AE0C38014627F3B5AF32E0E7C2B   c:\windows\system32\ntkrnlpa.exe
[-] 2009-02-09 11:23   2188800   58067AE0C38014627F3B5AF32E0E7C2B   c:\windows\system32\dllcache\ntkrnlpa.exe

[7] 2009-02-10 17:14   2192896   3B5928FCD0DD3E10DEB1C13CA35201F6   c:\windows\$hf_mig$\KB956572\SP3QFE\ntoskrnl.exe
[7] 2008-08-14 18:25   2192896   0EE73494680235D59F4E57301D7AD580   c:\windows\$hf_mig$\KB956841\SP3QFE\ntoskrnl.exe
[7] 2008-08-14 13:22   2148864   15315CDC4A67DCBBAE59967F08129499   c:\windows\$NtUninstallKB956572$\ntoskrnl.exe
[7] 2008-04-14 12:00   2148864   85B6D05F83DFBAFEF5F58836CE39586C   c:\windows\$NtUninstallKB956841$\ntoskrnl.exe
[7] 2009-02-09 11:23   2192768   AAC0F03E70F066D2E13FA2BA534BB2A8   c:\windows\Driver Cache\i386\ntoskrnl.exe
[-] 2009-02-09 11:22   2310144   B330561E515AA626F81407978AB5C72C   c:\windows\system32\ntoskrnl.exe
[-] 2009-02-09 11:22   2310144   B330561E515AA626F81407978AB5C72C   c:\windows\system32\dllcache\ntoskrnl.exe

[-] 2008-04-14 12:00   1543168   889676A942A232F349C9F8177CD9B782   c:\windows\explorer.exe
[-] 2008-04-14 12:00   1543168   889676A942A232F349C9F8177CD9B782   c:\windows\system32\dllcache\explorer.exe

[-] 2008-04-14 12:00   40448   7F4C43F75EBF781352DB3B5EF6BF8230   c:\windows\system32\ctfmon.exe
[-] 2008-04-14 12:00   40448   7F4C43F75EBF781352DB3B5EF6BF8230   c:\windows\system32\dllcache\ctfmon.exe

[-] 2008-04-14 12:00   1547264   4A4DB364EFEC67E730BC587DE11D0F89   c:\windows\system32\comres.dll
[-] 2008-04-14 12:00   1547264   4A4DB364EFEC67E730BC587DE11D0F89   c:\windows\system32\dllcache\comres.dll

[-] 2008-04-14 12:00   643072   6B00176C49AD983527346A0CB3B29BD1   c:\windows\system32\comctl32.dll
[-] 2008-04-14 12:00   643072   6B00176C49AD983527346A0CB3B29BD1   c:\windows\system32\dllcache\comctl32.dll
[7] 2008-04-14 12:00   921088   AEF3D788DBF40C7C4D204EA45EB0C505   c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll
[7] 2008-04-14 12:00   1054208   9530E35D9033ACED20CDA2509A21073A   c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
.
(((((((((((((((((((((((((((((((((((((   Punti Reg Caricati   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="c:\programmi\RocketDock\RocketDock.exe" [2007-09-02 495616]
"Eset GUI"="c:\programmi\ESET\ESET NOD32 Antivirus\egui.exe" [2008-09-24 1447168]
"msnmsgr"="c:\programmi\Windows Live\Messenger\msnmsgr.exe" [2008-12-02 3882312]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-11-12 13672448]
"egui"="c:\programmi\ESET\ESET NOD32 Antivirus\egui.exe" [2008-09-24 1447168]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 40448]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Utente1^Menu Avvio^Programmi^Esecuzione automatica^Adobe Gamma.lnk]
path=c:\documents and settings\Utente1\Menu Avvio\Programmi\Esecuzione automatica\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"EA Core"=c:\programmi\Electronic Arts\EADM\Core.exe -silent
"Mobile Partner"="c:\programmi\Yahoo!\Yahoo!.exe"
"msnmsgr"="c:\programmi\Windows Live\Messenger\msnmsgr.exe" /background
"Microsoft Office Outlook"=c:\progra~1\MI1933~1\Office12\OUTLOOK.EXE /recycle

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\Codemasters\\GRID\\GRID.exe"=
"c:\\Programmi\\Messenger\\msmsgs.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programmi\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Programmi\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Programmi\\Java\\jre6\\launch4j-tmp\\JDownloader.exe"=
"c:\\Programmi\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Programmi\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Programmi\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\WINDOWS\\system32\\java.exe"=
"c:\\Programmi\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Programmi\\Java\\jre6\\bin\\java.exe"=

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [24/09/2008 15.53.52 34312]
R3 L1e;Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1e51x86.sys [24/11/2008 20.32.02 36864]
S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [27/08/2009 23.07.43 8704]
S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [27/08/2009 23.07.43 3072]
S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys --> c:\windows\system32\drivers\massfilter.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12   REG_MULTI_SZ      Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt   REG_MULTI_SZ      hpqcxs08 hpqddsvc

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
Contenuto della cartella 'Scheduled Tasks'

2009-08-29 c:\windows\Tasks\Manutenzione in 1 clic.job
- c:\programmi\TuneUp Utilities 2009\OneClickStarter.exe [2008-12-04 10:21]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://google.mini20.com
uInternet Connection Wizard,ShellNext = ftp://10.0.0.249/
IE: E&sporta in Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
TCP: {CA954007-5259-478B-BC71-05F26A3F134C} = 151.99.125.2,151.99.125.3
FF - ProfilePath - c:\documents and settings\Utente1\Dati applicazioni\Mozilla\Firefox\Profiles\5b4deyzs.default\
FF - prefs.js: browser.search.selectedEngine - DAEMON Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.it/
FF - plugin: c:\programmi\Windows Live\Photo Gallery\NPWLPG.dll

---- FIREFOX POLICIES ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
FF - user.js: network.http.max-connections-per-server - 8
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota",      5120);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\programmi\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\programmi\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history",     true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata",    true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords",   false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads",   true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies",     true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache",       true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions",    true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history",                 true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata",                true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords",               false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads",               true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies",                 true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache",                   true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions",                true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps",             false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings",            false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs",    false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-29 17:17
Windows 5.1.2600 Service Pack 3 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------

[HKEY_USERS\S-1-5-21-1060284298-1972579041-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
@Denied: (Full) (LocalSystem)

[HKEY_USERS\S-1-5-21-1060284298-1972579041-682003330-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:85,ff,90,db,ba,c3,7f,57,cc,89,7a,0e,ea,8c,f4,f2,98,d0,5f,c2,ea,ce,79,
   01,d2,c7,07,27,5f,77,b9,13,a1,41,5b,d9,ac,26,a0,16,55,ed,35,5c,8b,c2,82,b8,\
"??"=hex:59,e5,97,70,47,08,a5,1e,f6,13,83,cc,52,0d,a6,6c

[HKEY_USERS\S-1-5-21-1060284298-1972579041-682003330-1004\Software\SecuROM\License information*]
"datasecu"=hex:1f,2a,b6,13,8b,b9,66,c4,36,17,2c,eb,e9,99,c4,25,af,0e,e5,8d,11,
   99,48,fb,1a,b9,45,3e,d5,7d,d9,d6,c1,48,38,30,17,4e,b6,2b,f2,62,47,e5,74,71,\
"rkeysecu"=hex:73,e7,07,a2,90,76,de,cc,44,06,70,8d,d7,06,7f,71
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------

- - - - - - - > 'winlogon.exe'(1160)
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\sfc_os.dll
c:\windows\system32\cscui.dll
c:\windows\system32\COMRes.dll

- - - - - - - > 'lsass.exe'(1232)
c:\windows\system32\setupapi.dll
c:\windows\system32\scecli.dll

- - - - - - - > 'explorer.exe'(3348)
c:\windows\system32\WININET.dll
c:\programmi\RocketDock\RocketDock.dll
c:\windows\system32\COMRes.dll
c:\windows\System32\cscui.dll
c:\windows\system32\LINKINFO.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\msi.dll
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
c:\windows\system32\WPDShServiceObj.dll
c:\programmi\Nokia\Nokia PC Suite 6\PhoneBrowser.dll
c:\programmi\Nokia\Nokia PC Suite 6\PCSCM.dll
c:\windows\system32\ConnAPI.DLL
c:\programmi\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_ita.nlr
c:\programmi\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\programmi\ESET\ESET NOD32 Antivirus\ekrn.exe
c:\programmi\Nero\Nero8\Nero BackItUp\NBService.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\IoctlSvc.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\TUProgSt.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\cscript.exe
.
**************************************************************************
.
Ora fine scansione: 2009-08-29 17.19.00 - Il pc è stato riavviato
ComboFix-quarantined-files.txt  2009-08-29 15:18

Pre-Run: 192.635.027.456 byte disponibili
Post-Run: 192.708.775.936 byte disponibili

WindowsXP-KB310994-SP2-Home-BootDisk-ITA.exe
;
;Warning: Boot.ini is used on Windows XP and earlier operating systems.
;Warning: Use BCDEDIT.exe to modify Windows Vista boot options.
;
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /NOEXECUTE=OPTIN /FASTDETECT

390   --- E O F ---   2009-08-28 17:52

[crazy.cat]

Questi i miei risultati ...
(((((((((((((((((((((((((((((((((((((   Altre eliminazioni   )))))))))))))))))))))))))))))))))))))))))))))))))))
c:\documents and settings\Utente1\Impostazioni locali\Dati applicazioni\ffmmll.dat
c:\documents and settings\Utente1\Impostazioni locali\Dati applicazioni\ffmmll_nav.dat
c:\documents and settings\Utente1\Impostazioni locali\Dati applicazioni\ffmmll_navps.dat
c:\documents and settings\Utente1\Impostazioni locali\Dati applicazioni\osmoa.dat
c:\documents and settings\Utente1\Impostazioni locali\Dati applicazioni\osmoa_nav.dat
c:\documents and settings\Utente1\Impostazioni locali\Dati applicazioni\osmoa_navps.dat
c:\documents and settings\Utente1\Impostazioni locali\Dati applicazioni\wmkgoki.dat
c:\documents and settings\Utente1\Impostazioni locali\Dati applicazioni\wmkgoki.exe
c:\documents and settings\Utente1\Impostazioni locali\Dati applicazioni\wmkgoki_nav.dat
c:\documents and settings\Utente1\Impostazioni locali\Dati applicazioni\wmkgoki_navps.dat
c:\documents and settings\Utente1\Impostazioni locali\Dati applicazioni\ykqgs.dat
c:\documents and settings\Utente1\Impostazioni locali\Dati applicazioni\ykqgs_navps.dat

Non vedevi mai delle strane pagine pubblicitarie che si aprivano sempre?
Adesso non vedrai più neanche quelle.

[ridethesnake]

Questi i miei risultati ...

 

[asterix]

L'importante e' che non ci sia niente di grave nel pc ...in effetti non riuscivo a capire come mai mi si aprivano delle finestre ( che rottura ) di pubblicita' nonostante avevo abilitato il blocco pop-up .