|
| |||||||
 |
 |
| | Thread Tools |
|
#11
16 settembre 2008, 15:28
| |||
| |||
| ComboFix 08-09-15.02 - Tom Stratman 2008-09-16 16:53:08.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.184 [GMT -5:00] Eseguito da: C: \ Documents and Settings \ Tom Stratman \ Desktop \ ComboFix.exe * Creato un nuovo punto di ripristino AVVERTENZA-Questa macchina NON HANNO IL RECUPERO CONSOLE INSTALLED! . Altri ((((((((((((((((((((((((((((((((((((((( Deletions ))))))))) )))))))))))))))))))))))))))))))))))))))) . C: \ Documents and Settings \ Tom Stratman \ Dati applicazioni \ FNTS ~ 1 C: \ Documents and Settings \ Tom Stratman \ Dati applicazioni \ FNTS ~ 1 \ F? Nts \ C: \ Documents and Settings \ Tom Stratman \ Dati applicazioni \ SSTEM ~ 1 C: \ Temp \ 1cb C: \ Temp \ 1cb \ syscheck.log C: \ Temp \ fse C: \ Temp \ fse \ tmpZTF.log C: \ prova.txt C: \ WINDOWS \ system32 \ MSINET.oca C: \ WINDOWS \ SYSTEM32 \ rqtwa.bak1 C: \ WINDOWS \ SYSTEM32 \ rqtwa.bak2 C: \ WINDOWS \ SYSTEM32 \ rqtwa.ini C: \ WINDOWS \ system32 \ wnstsiit32.exe C: \ WINDOWS \ SYSTEM32 \ wyadd.bak1 C: \ WINDOWS \ SYSTEM32 \ wyadd.bak2 C: \ WINDOWS \ SYSTEM32 \ wyadd.ini C: \ WINDOWS \ SYSTEM32 \ wyadd.ini2 C: \ WINDOWS \ SYSTEM32 \ wyadd.tmp . ((((((((((((((((((((((((((((((((((((((( Driver / Servizi )))))))) ))))))))))))))))))))))))))))))))))))))))) . ------- \ Legacy_DOMAINSERVICE ((((((((((((((((((((((((( I file creati dal 2008/08/16 al 2008/09/16 ))))))))))) )))))))))))))))))))) . 2008-09-16 06:36. 2008-09-16 06:36 <DIR> d -------- C: \ Program Files \ Trend Micro 2008-09-15 21:25. 2008-09-15 21:27 <DIR> d -------- C: \ Program Files \ Malwarebytes 'Anti-Malware 2008-09-15 21:25. 2008-09-15 21:25 <DIR> d -------- C: \ Documents and Settings \ Tom Stratman \ Dati applicazioni \ Malwarebytes 2008-09-15 21:25. 2008-09-15 21:25 <DIR> d -------- C: \ Documents and Settings \ All Users \ Dati applicazioni \ Malwarebytes 2008-09-15 21:25. 2008/09/10 00:04 38528 - a ------ C: \ WINDOWS \ SYSTEM32 \ DRIVERS \ mbamswissarmy.sys 2008-09-15 21:25. 2008/09/10 00:03 17200 - a ------ C: \ WINDOWS \ SYSTEM32 \ DRIVERS \ mbam.sys 2008-09-14 11:13. 2008/09/14 11:13 107888 - a ------ C: \ WINDOWS \ SYSTEM32 \ CmdLineExt.dll 2008-09-10 13:37. 2008-09-10 13:38 <DIR> d -------- C: \ Program Files \ iTunes 2008-09-10 13:37. 2008-09-10 13:38 <DIR> d -------- C: \ Documents and Settings \ All Users \ Application Data \ () 3276BE95_AF08_429F_A64F_CA64CB79BCF6 2008-09-10 13:35. 2008-09-10 13:35 <DIR> d -------- C: \ Program Files \ Bonjour 2008-09-10 13:29. 2008/09/05 22:16 1900544 - a ------ C: \ WINDOWS \ SYSTEM32 \ usbaaplrc.dll 2008-09-06 15:09. 2008/09/06 15:09 90112 - a ------ C: \ WINDOWS \ SYSTEM32 \ QuickTimeVR.qtx 2008-09-06 15:09. 2008/09/06 15:09 57344 - a ------ C: \ WINDOWS \ SYSTEM32 \ QuickTime.qts 2008-08-29 10:18. 2008/08/29 10:18 87336 - a ------ C: \ WINDOWS \ SYSTEM32 \ dns-sd.exe 2008-08-29 09:53. 2008/08/29 09:53 61440 - a ------ C: \ WINDOWS \ SYSTEM32 \ dnssd.dll 2008-08-27 02:30. 2008-08-27 02:56 <DIR> d -------- C: \ WINDOWS \ SYSTEM32 \ CatRoot_bak 2008-08-25 19:08. 2008-08-25 19:08 <DIR> d -------- C: \ Program Files \ AviSynth 2,5 2008-08-25 19:07. 2008-08-25 19:07 <DIR> d -------- C: \ Program Files \ Red Kawa . (((((((((((((((((((((((((((((((((((((((( Find3M Relazione )))))))) )))))))))))))))))))))))))))))))))))))))))))) . 2008-09-16 21:40 --------- d ----- w C: \ Documents and Settings \ Tom Stratman \ Dati applicazioni \ uTorrent 2008-09-16 06:42 --------- d ----- w C: \ Documents and Settings \ All Users \ Dati applicazioni \ Google Updater 2008-09-15 20:53 --------- d - h - w C: \ Program Files \ InstallShield Installation Information 2008-09-15 20:53 --------- d ----- w C: \ Program Files \ Electronic Arts 2008-09-10 18:38 --------- d ----- w C: \ Program Files \ iPod 2008-09-10 18:34 --------- d ----- w C: \ Program Files \ QuickTime 2008-09-10 18:33 --------- d ----- w C: \ Program Files \ Common Files \ Apple 2008/09/06 03:16 36.864 ---- aw C: \ WINDOWS \ system32 \ drivers \ USBAAPL.SYS 2008-08-21 21:36 --------- d ----- w C: \ Programmi \ Apple Software Update 2008-08-11 21:22 --------- d ----- w C: \ Program Files \ Microsoft Silverlight 2008-08-07 16:37 --------- d ----- w C: \ Program Files \ Google 2008/03/01 20:28 75.496-c - aw C: \ Documents and Settings \ Tom Stratman \ Dati applicazioni \ GDIPFONTCACHEV1.DAT 2007/09/26 01:26 45.422-c - aw C: \ Documents and Settings \ Tom Stratman \ Dati applicazioni \ wklnhst.dat 2007/06/28 21:37 7.248-c - aw C: \ Documents and Settings \ All Users \ Dati applicazioni \ ypinfo.bin 2007-04-15 04:54 32-c - ar C: \ Documents and Settings \ All Users \ hash.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))) )))))))))))))))))))))))))))))))))))))))) . . * Nota * vuoto voci & legit default voci non vengono visualizzate REGEDIT4 [HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Windows \ Curre ntVersion \ Run] "DellSupport" = "C: \ Program Files \ DellSupport \ DSAgnt.exe" [2007-03-15 460784] "LDM" = "C: \ Program Files \ Logitech \ Desktop Messenger \ 8876480 \ Programmi \ LogitechDesktopMessenger. Exe" [2007-02-23 67128] "MSMSGS" = "C: \ Program Files \ Messenger \ msmsgs.exe" [2004-10-13 1694208] "CTFMON.EXE" = "C: \ Program Files \ Dell Support Center \ bin \ sprtcmd.exe" [2007-11-15 202544] [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ Run] "SunJavaUpdateSched" = "C: \ Program Files \ Dell \ Media Experience \ PCMService.exe" [2004-04-11 290816] "SynTPEnh" = "C: \ Program Files \ CyberLink \ PowerDVD \ SynTPEnh.exe" [2004-08-23 57344] "dla" = "C: \ WINDOWS \ system32 \ dla \ tfswctrl.exe" [2004-08-13 122939] "CTFMON.EXE" = "C: \ WINDOWS \ system32 \ igfxtray.exe" [2005-09-20 94208] "iTunesHelper" = "C: \ WINDOWS \ system32 \ hkcmd.exe" [2005-09-20 77824] "SunJavaUpdateSched" = "C: \ WINDOWS \ system32 \ hkcmd.exe" [2005-09-20 114688] "CanonMyPrinter" = "C: \ Program Files \ Canon \ MyPrinter \ BJMyPrt.exe" [2006-03-21 1191936] "SSBkgdUpdate" = "C: \ Programmi \ File comuni \ Scansoft Shared \ SSBkgdUpdate \ SSBkgdupdate.exe" [2003-09-30 155648] "OpwareSE4" = "C: \ Program Files \ ScanSoft \ OmniPageSE4.0 \ OpwareSE4.exe" [2006-03-21 69632] "IMJPMIG8.1" = "C: \ WINDOWS \ IME \ imjp8_1 \ IMJPMIG.E XE" [2004-08-04 208952] "MSPY2002" = "C: \ WINDOWS \ system32 \ IME \ PINTLGNT \ ImScI nst.exe" [2004-08-04 59392] "PHIME2002ASync" = "C: \ WINDOWS \ system32 \ IME \ TINTLGNT \ TINTSETP.EXE" [2004-08-04 455168] "PHIME2002A" = "C: \ WINDOWS \ system32 \ IME \ TINTLGNT \ TIN TSETP.EXE" [2004-08-04 455168] "CcApp" = "C: \ Program Files \ Analog Devices \ Core \ smax4pnp.exe" [2004-10-14 1404928] "Adobe Reader Speed Launcher" = "C: \ Program Files \ Adobe \ Reader 8.0 \ Reader \ Reader_sl.exe" [2008-01-11 39792] "dscactivate" = "C: \ Program Files \ Dell Support Center \ gs_agent \ custom \ dsca.exe" [2007-11-15 16384] "CTFMON.EXE" = "C: \ Program Files \ Dell Support Center \ bin \ sprtcmd.exe" [2007-11-15 202544] "QuickTime Task" = "C: \ Program Files \ QuickTime \ QTTask.exe" [2008-09-06 413696] "SunJavaUpdateSched" = "C: \ Programmi \ File comuni \ Apple \ Mobile Device Support \ bin \ jusched.exe" [2008-09-03 111936] "Software Update" = "C: \ Program Files \ iTunes \ iTunesHelper.exe" [2008-09-08 289576] "Logitech Hardware Abstraction Layer" = "SOUNDMAN.EXE" [2008/02/29 C: \ WINDOWS \ SOUNDMAN.EXE] "Kernel and Hardware Abstraction Layer" = "SOUNDMAN.EXE" [2008/02/29 C: \ WINDOWS \ SOUNDMAN.EXE] [HKEY_USERS \. DEFAULT \ Software \ Microsoft \ Windows \ Cur rentVersion \ Run] "DWQueuedReporting" = "C: \ PROGRA ~ 1 \ COMUNE ~ 1 \ micros ~ 1 \ DW \ dwtrig20.exe" [2007-03-13 39264] C: \ Documents and Settings \ Tom Stratman \ Menu Avvio \ Programmi \ Startup \ SpywareGuard.lnk - C: \ Program Files \ SpywareGuard \ sgmain.exe [2003-08-29 360448] C: \ Documents and Settings \ All Users \ Menu Avvio \ Programmi \ Startup \ Logitech Desktop Messenger.lnk - C: \ Program Files \ Logitech \ Desktop Messenger \ 8876480 \ Programmi \ LogitechDesktopMessenger. Exe [2007-02-23 67128] Logitech SetPoint.lnk - C: \ Program Files \ Logitech \ SetPoint \ SetPoint.exe [2008-08-09 805392] Microsoft Office.lnk - C: \ Program Files \ Microsoft Office \ Office10 \ Osa.exe [2001-02-13 83360] WinZip Quick Pick.lnk - C: \ Program Files \ WinZip \ WZQKPICK.EXE [2005-02-11 118784] [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon \ Notify \ LBTWlgn] 2008-05-02 02:42 72208 c: \ Program Files \ Common Files \ Logitech \ Bluetooth \ LBTWLgn.dll [HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Contro l \ SafeBoot \ Minimal \ WdfLoadGroup] @ = "" [HKLM \ ~ \ Services \ SharedAccess \ Parameters \ firewallpo licy \ standardprofile \ AuthorizedApplications \ List] "% windir% \ \ system32 \ \ sessmgr.exe" = "C: \ \ Program Files \ \ Windows Media Player \ wmplayer.exe" = "C: \ Program Files \ \ Common Files \ \ AOL \ \ Loader \ \ aolload.exe" = "C: \ \ Program Files \ \ PopCap Games \ \ Bookworm Deluxe \ \ BookWorm.exe" = "C: \ Program Files \ \ AIM \ \ aim.exe" = "C: \ Program Files \ \ AIM6 \ \ aim6.exe" = "C: \ Program Files \ \ Logitech \ Desktop Messenger \ \ 8876480 \ \ Programmi \ \ LogitechDesktopMessen ger.exe" = "C: \ Program Files \ \ uTorrent \ \ uTorrent.exe" = "C: \ Program Files \ \ Bonjour \ \ mDNSResponder.exe" = "C: \ Program Files \ \ iTunes \ \ iTunes.exe" = [HKLM \ ~ \ Services \ SharedAccess \ Parameters \ firewallpo licy \ standardprofile \ GloballyOpenPorts \ List] "17770: TCP" = 17770: TCP: BitComet 17770 TCP "17770: UDP" = 17770: UDP: BitComet 17770 UDP R1 aswSP; avast! Self Protection; C: \ WINDOWS \ system32 \ drivers \ aswSP.sys [2008-07-19 78416] R2 aswFsBlk; aswFsBlk; C: \ WINDOWS \ system32 \ drivers \ aswF sBlk.sys [2008-07-19 20560] Npkcmsvc R2; npkcmsvc; C: \ Nexon \ Mabinogi \ npkcmsvc.exe [2007-08-02 80528] R2 Viewpoint Manager Service; Viewpoint Manager Service; C: \ Program Files \ Viewpoint \ Common \ ViewpointService.exe [2007-01-04 24652] S2 DP1112, DP1112; C: \ WINDOWS \ system32 \ drivers \ DP.sys [] S3 FTD2XX; Outlaw Audio Model 990 Device Driver; C: \ WINDOWS \ system32 \ drivers \ FTD2XX.sys [2003-01-24 24197] S3 XDva020; XDva020; C: \ WINDOWS \ system32 \ XDva020.sys [] . Indice dell ' "Operazioni pianificate' cartella . - - - - ORFANI REMOVED - - - -- HKCU-Run-updateMgr - C: \ Program Files \ Adobe \ Acrobat 7.0 \ Reader \ AdobeUpdateManager.exe HKCU-Run-Aim6 - (no file) . ------- ------- Supplementari Scan . FireFox -: Profile - C: \ Documents and Settings \ Tom Stratman \ Dati applicazioni \ Mozilla \ Firefox \ Profiles \ e41ez35c.default \ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp: / / dsl.sbc.yahoo.com / . ************************************************** ************************ catchme 0.3.1361 W2K/XP/Vista - rootkit / stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-16 17:01:58 5/1/2600 Windows Service Pack 2 NTFS scansione processi nascosti ... scansione entrate autostart nascoste ... scansione di file nascosti ... scansione completata con successo i file nascosti: 0 ************************************************** ************************ . ------------------------ Altri processi in esecuzione ----------------------- -- . C: \ Program Files \ Windows Defender \ MsMpEng.exe C: \ Program Files \ Alwil Software \ Avast4 \ aswUpdSv.exe C: \ Program Files \ Alwil Software \ Avast4 \ ashServ.exe C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe C: \ Program Files \ Bonjour \ mDNSResponder.exe C: \ Program Files \ Google \ Common \ Google Updater \ GoogleUpdaterService.exe C: \ Program Files \ Dell Support Center \ bin \ sprtsvc.exe C: \ PROGRA ~ 1 \ WinZip \ WZQKPICK.EXE C: \ Program Files \ Alwil Software \ Avast4 \ ashMaiSv.exe C: \ Program Files \ Alwil Software \ Avast4 \ ashWebSv.exe C: \ Programmi \ File comuni \ Logishrd \ KHAL2 \ SOUNDMAN.EXE C: \ Program Files \ iPod \ bin \ iPodService.exe . ************************************************** ************************ . Ora fine: 2008-09-16 17:13:41 - macchina è stato riavviato ComboFix-quarantined-files.txt 2008-09-16 22:13:22 Pre-Run: 263.151.616 bytes free Post-Run: 674.275.328 bytes free 180 --- EOF --- 2008-09-16 11:27:11 ============= END FOX COMBO ================================== Logfile di Trend Micro HijackThis v2.0.2 Scan saved at 5:26:48, il 9/16/2008 Piattaforma: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Processi in esecuzione: C: \ WINDOWS \ System32 \ smss.exe C: \ WINDOWS \ system32 \ winlogon.exe C: \ WINDOWS \ system32 \ services.exe C: \ WINDOWS \ system32 \ lsass.exe C: \ WINDOWS \ system32 \ svchost.exe C: \ Program Files \ Windows Defender \ MsMpEng.exe C: \ WINDOWS \ System32 \ svchost.exe C: \ Program Files \ Alwil Software \ Avast4 \ aswUpdSv.exe C: \ Program Files \ Alwil Software \ Avast4 \ ashServ.exe C: \ WINDOWS \ system32 \ spoolsv.exe C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe C: \ Program Files \ Bonjour \ mDNSResponder.exe C: \ Program Files \ Google \ Common \ Google Updater \ GoogleUpdaterService.exe C: \ Nexon \ Mabinogi \ npkcmsvc.exe C: \ Program Files \ Dell \ Media Experience \ PCMService.exe C: \ Program Files \ CyberLink \ PowerDVD \ DVDLauncher.exe C: \ WINDOWS \ system32 \ dla \ tfswctrl.exe C: \ WINDOWS \ system32 \ hkcmd.exe C: \ WINDOWS \ system32 \ igfxpers.exe C: \ Program Files \ Canon \ MyPrinter \ BJMyPrt.exe C: \ Program Files \ ScanSoft \ OmniPageSE4.0 \ OpwareSE4.exe C: \ Program Files \ Dell Support Center \ bin \ sprtsvc.exe C: \ WINDOWS \ system32 \ svchost.exe C: \ Program Files \ Analog Devices \ Core \ smax4pnp.exe C: \ Program Files \ Viewpoint \ Common \ ViewpointService.exe C: \ Program Files \ Dell Support Center \ bin \ sprtcmd.exe C: \ Program Files \ QuickTime \ QTTask.exe C: \ Program Files \ iTunes \ iTunesHelper.exe C: \ Program Files \ DellSupport \ DSAgnt.exe C: \ Program Files \ Logitech \ Desktop Messenger \ 8876480 \ Programmi \ LogitechDesktopMessenger. Exe C: \ Program Files \ Messenger \ msmsgs.exe C: \ Program Files \ Logitech \ setpoint \ SetPoint.exe C: \ Program Files \ WinZip \ WZQKPICK.EXE C: \ Program Files \ SpywareGuard \ sgmain.exe C: \ Program Files \ Alwil Software \ Avast4 \ ashMaiSv.exe C: \ Program Files \ Alwil Software \ Avast4 \ ashWebSv.exe C: \ Program Files \ Common Files \ Logishrd \ KHAL2 \ KHALMNPR.EXE C: \ Program Files \ iPod \ bin \ iPodService.exe C: \ WINDOWS \ system32 \ Wuauclt.exe C: \ WINDOWS \ explorer.exe C: \ Program Files \ Mozilla Firefox \ firefox.exe C: \ Program Files \ Trend Micro \ HijackThis \ HijackThis.exe R0 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://dsl.sbc.yahoo.com/ R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://www.dell4me.com/mywaybiz - R1 HKLM \ Software \ Microsoft \ Windows \ CurrentVersion \ Int ernet Settings, ProxyServer = 0.0.0.0 R1 - HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Int Ethernet Impostazioni, ProxyOverride = *. locali R3 - URLSearchHook: Yahoo! Toolbar - (EF99BD32-C1FB-11D2-892F-0090271D4F88) - (no file) O2 - BHO: Adobe PDF Reader Link Helper - (06849E9F-C8D7-4D59-B87D-784B7D6BE0B3) - C: \ Program Files \ Common Files \ Adobe \ Acrobat \ ActiveX \ AcroIEHelper.dll O2 - BHO: Google Toolbar Notifier BHO - (AF69DE43-7D58-4638-B6FA-CE66B5AD205D) - C: \ Program Files \ Google \ GoogleToolbarNotifier \ 2.1.1119.1736 \ s wg.dll O3 - Toolbar: (no name) - (BA52B914-B692-46c4-B683-905236F6F655) - (no file) O3 - Toolbar: (no name) - (E0E899AB-F487-11D5-8D29-0050BA6940E3) - (no file) O4 - HKLM \ .. \ Run: [PCMService] "C: \ Program Files \ Dell \ Media Experience \ PCMService.exe" O4 - HKLM \ .. \ Run: [DVDLauncher] "C: \ Program Files \ CyberLink \ PowerDVD \ DVDLauncher.exe" O4 - HKLM \ .. \ Run: [dla] C: \ WINDOWS \ system32 \ dla \ tfswctrl.exe O4 - HKLM \ .. \ Run: [igfxtray] C: \ WINDOWS \ system32 \ igfxtray.exe O4 - HKLM \ .. \ Run: [igfxhkcmd] C: \ WINDOWS \ system32 \ hkcmd.exe O4 - HKLM \ .. \ Run: [igfxpers] C: \ WINDOWS \ system32 \ igfxpers.exe O4 - HKLM \ .. \ Run: [CanonMyPrinter] "C: \ Program Files \ Canon \ MyPrinter \ BJMyPrt.exe / logon O4 - HKLM \ .. \ Run: [SSBkgdUpdate] "C: \ Program Files \ Common Files \ Scansoft Shared \ SSBkgdUpdate \ SSBkgdupdate.exe"-Embedding-boot O4 - HKLM \ .. \ Run: [OpwareSE4] "C: \ Program Files \ ScanSoft \ OmniPageSE4.0 \ OpwareSE4.exe" O4 - HKLM \ .. \ Run: [IMJPMIG8.1] "C: \ WINDOWS \ IME \ imjp8_1 \ IMJPMIG.EXE" / Spoil / RemAdvDef / Migration32 O4 - HKLM \ .. \ Run: [MSPY2002] C: \ WINDOWS \ system32 \ IME \ PINTLGNT \ ImScInst.exe / SYNC O4 - HKLM \ .. \ Run: [PHIME2002ASync] C: \ WINDOWS \ system32 \ IME \ TINTLGNT \ TINTSETP.EXE / SYNC O4 - HKLM \ .. \ Run: [PHIME2002A] C: \ WINDOWS \ system32 \ IME \ TINTLGNT \ TINTSETP.EXE / IMEName O4 - HKLM \ .. \ Run: [SoundMAXPnP] C: \ Program Files \ Analog Devices \ Core \ smax4pnp.exe O4 - HKLM \ .. \ Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM \ .. \ Run: [Kernel e Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM \ .. \ Run: [Adobe Reader Speed Launcher] "C: \ Program Files \ Adobe \ Reader 8.0 \ Reader \ Reader_sl.exe" O4 - HKLM \ .. \ Run: [dscactivate] "C: \ Program Files \ Dell Support Center \ gs_agent \ custom \ dsca.exe" O4 - HKLM \ .. \ Run: [DellSupportCenter] "C: \ Program Files \ Dell Support Center \ bin \ sprtcmd.exe" / P DellSupportCenter O4 - HKLM \ .. \ Run: [QuickTime Task] "C: \ Program Files \ QuickTime \ QTTask.exe"-atboottime O4 - HKLM \ .. \ Run: [AppleSyncNotifier] C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleSyncNotifier.exe O4 - HKLM \ .. \ Run: [iTunesHelper] "C: \ Program Files \ iTunes \ iTunesHelper.exe" O4 - HKCU \ .. \ Run: [DellSupport] "C: \ Program Files \ DellSupport \ DSAgnt.exe" / startup O4 - HKCU \ .. \ Run: [LDM] C: \ Program Files \ Logitech \ Desktop Messenger \ 8876480 \ Programmi \ LogitechDesktopMessenger. Exe O4 - HKCU \ .. \ Run: [MSMSGS] "C: \ Program Files \ Messenger \ msmsgs.exe" / background O4 - HKCU \ .. \ Run: [DellSupportCenter] "C: \ Program Files \ Dell Support Center \ bin \ sprtcmd.exe" / P DellSupportCenter O4 - HKUS \ S-1-5-18 \ .. \ Run: [DWQueuedReporting] "C: \ PROGRA ~ 1 \ COMUNE ~ 1 \ micros ~ 1 \ DW \ dwtrig20.exe"-t (User 'SYSTEM') O4 - HKUS \. DEFAULT \ .. \ Run: [DWQueuedReporting] "C: \ PROGRA ~ 1 \ COMUNE ~ 1 \ micros ~ 1 \ DW \ dwtrig20.exe"-t (User 'Default user') O4 - Startup: SpywareGuard.lnk = C: \ Program Files \ SpywareGuard \ sgmain.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = C: \ Program Files \ Logitech \ Desktop Messenger \ 8876480 \ Programmi \ LogitechDesktopMessenger. Exe O4 - Global Startup: Logitech SetPoint.lnk = C: \ Program Files \ Logitech \ setpoint \ SetPoint.exe O4 - Global Startup: Microsoft Office.lnk = C: \ Program Files \ Microsoft Office \ Office10 \ OSA.EXE O4 - Global Startup: WinZip Quick Pick.lnk = C: \ Program Files \ WinZip \ WZQKPICK.EXE O6 - HKCU \ Software \ Policies \ Microsoft \ Internet Explorer \ Pannello di controllo presenti O8 - Extra contesto voce di menu: & AIM Ricerca - res: / / C: \ Program Files \ AIM Toolbar \ AIMBar.dll / aimsearch.htm O9 - Extra button: (no name) - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Program Files \ Java \ jre1.6.0_01 \ bin \ ssv.dll (file missing) O9 - Extra 'Tools' menuitem: Sun Java Console - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Program Files \ Java \ jre1.6.0_01 \ bin \ ssv.dll (file missing) O9 - Extra pulsante: AIM - (AC9E2541-2814-11d5-BC6D-00B0D0A1DE45) - C: \ Program Files \ AIM \ aim.exe O9 - Extra pulsante: MUSICMATCH MX Web Player - (d81ca86b-ef63-42af-bee3-4502d9a03c2d) -- http://wwws.musicmatch.com/mmz/openWebRadio.html (file mancanti) O9 - Extra pulsante: Messenger - (FB5F1910-F110-11d2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - (FB5F1910-F110-11d2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs.exe O16 - DPF: (149E45D8-163E-4189-86FC-45022AB2B6C9) (SpinTop DRM Control) - file: / / C: \ Program Files \ SCRABBLE \ Images \ stg_drm.ocx Ø16 - DPF: (17492023-C23A-453E-A040-C7C580BBF700) (Windows Genuine Advantage Validation Tool) -- http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: (288C5F13-7E52-4ADA-A32E-F5BF9D125F98) (CR64Loader Object) -- http://miniclip.com/platypus/miniclipGameLoader.dll Ø16 - DPF: (30528230-99f7-4bb4-88d8-fa1d4f56a2ab) (Installation Support) - C: \ Program Files \ Yahoo! \ Common \ Yinsthelper.dll Ø16 - DPF: (406B5949-7190-4245-91A9-30A17DE16AD0) (Snapfish Activia) -- http://photo.walgreens.com/WalgreensActivia.cab Ø16 - DPF: (48884C41-EFAC-433D-958A-9FADAC41408E) (EGamesPlugin Class) -- https: / / www.e-games.com.my/com/EGamesPlugin.cab O16 - DPF: (5F5F9FB8-878E-4455-95E0-F64B2314288A) -- http://gamedownload.ijjimax.com/game...lugin11USA.cab Ø16 - DPF: (5F8469B4-B055-49DD-83F7-62B522420ECC) (Facebook Photo Uploader Control) -- http://upload.facebook.com/controls/...toUploader.cab O16 - DPF: (CC450D71-CC90-424C-8638-1F2DBAC87A54) (ArmHelper Control) - file: / / C: \ Program Files \ SCRABBLE \ Images \ armhelper.ocx O16 - DPF: (CD995117-98E5-4169-9920-6C12D4C0B548) -- http://gamedownload.ijjimax.com/game...Plugin9USA.cab Ø18 - Protocollo: bwfile-8876480 - (9462A756-7B47-47BC-8C80-C34B9B80B32B) - C: \ Program Files \ Logitech \ Desktop Messenger \ 8876480 \ Programmi \ GAPlugProtocol-8876480.dll O23 - Service: Apple Mobile Device - Apple Inc. - C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C: \ Program Files \ Alwil Software \ Avast4 \ aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C: \ Program Files \ Alwil Software \ Avast4 \ ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C: \ Program Files \ Alwil Software \ Avast4 \ ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C: \ Program Files \ Alwil Software \ Avast4 \ ashWebSv.exe O23 - Service: Bonjour Service - Apple Inc. - C: \ Program Files \ Bonjour \ mDNSResponder.exe O23 - Service: DSBrokerService - Sconosciuto proprietario - C: \ Program Files \ DellSupport \ brkrsvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C: \ Program Files \ Google \ Common \ Google Updater \ GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C: \ Program Files \ Common Files \ InstallShield \ Driver \ 11 \ Intel 32 \ IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C: \ Program Files \ iPod \ bin \ iPodService.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C: \ Program Files \ Common Files \ Logitech \ Bluetooth \ LBTServ.exe O23 - Service: Intel NCS netservice (NETSVC) - Intel (R) Corporation - C: \ Program Files \ Intel \ PROSetWired \ NCS \ Sync \ NetSvc.exe O23 - Service: npkcmsvc - INCA Internet Co., Ltd. - C: \ Nexon \ Mabinogi \ npkcmsvc.exe O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C: \ Program Files \ Dell Support Center \ bin \ sprtsvc.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C: \ Program Files \ Viewpoint \ Common \ ViewpointService.exe -- End of file - 10675 bytes |
|
#12
16 settembre 2008, 16:03
| |||
| |||
---------- Scaricare ViewpointKiller.zip
---------- Java non è aggiornata. Le versioni precedenti sono vulnerabilità siti dannosi che possono essere utilizzate per infettare il sistema. Per prima cosa installare il nuovo Sun Java Runtime Environment Accertarsi di chiudere tutte le finestre del browser prima di iniziare l'installazione. Rimuovere la vecchia versione (s)
---------- Scaricare ATF Cleaner da Atribune al tuo desktop. Link di download alternativo Nota: Vista gli utenti devono utilizzare Esegui come amministratore
Si noti che il sistema più lento per eseguire un riavvio o due dopo aver usato questo strumento in modo non panico. Importante: Riavviare il computer prima di continuare. ---------- Esegui questa scansione on-line. Richiede Internet Explorer Usa la ESET nod32 Scanner Online 1. Seleziona la casella accanto a Sì, accetto i Termini di Utilizzo. 2. Fare clic sul pulsante Inizio 3. Quando richiesto, consentire il controllo ActiveX per l'installazione 4. Fare clic sul pulsante Inizio 5. Assicurarsi che l'opzione Rimuovere le minacce trovato e l'opzione Scan applicazioni indesiderate verificare è segnato. 6. Fare clic sul pulsante Scan 7. Attendere la scansione per terminare 8. Utilizzare il Blocco note per aprire il file di log al sito C: \ Program Files \ EsetOnlineScanner \ log.txt 9. Aggiungere il C: \ Program Files \ EsetOnlineScanner \ log.txt Entra nella tua prossima risposta
__________________  |
|
#13
17 settembre 2008, 04:20
| |||
| |||
| # Version = 4 # OnlineScanner.ocx = 1.0.0.635 # OnlineScannerDLLA.dll = 1, 0, 0, 79 # OnlineScannerDLLW.dll = 1, 0, 0, 78 # OnlineScannerUninstaller.exe = 1, 0, 0, 49 # vers_standard_module = 3447 (20080916) # vers_arch_module = 1,064 (20.080.214) # vers_adv_heur_module = 1,064 (20.070.717) # EOSSerial = 8983b3a42701b342bf8e75ec7f82c98f end # = terminato # remove_checked = true # unwanted_checked = true utc_time # = 2008-09-17 05:39:16 # local_time = 2008-09-17 12:39:16 (-0600, Central Daylight Time) # = Paese "Stati Uniti" OSVer # = NT 5.1.2600 Service Pack 2 # # scansione = 226.155 trovato = 0 # scan_time = 4.934 |
|
#14
17 settembre 2008, 08:40
| |||
| |||
| Impostare un nuovo punto di ripristino per evitare possibili reinfezione da un vecchio Impostazione di un nuovo punto di ripristino dopo la pulizia del sistema consentirà al computer di roll-back di una situazione di lavoro pulito, se necessario.
Ripristino configurazione di sistema di Windows XP Guida o Ripristino configurazione di sistema di Windows Vista Guida ---------- Usa la Secunia Software Inspector per controllare la data di software. Fuori data software è vulnerabilità di sicurezza che il malware in grado di sfruttare.
Vai a Microsoft Windows Update e ottenere tutte aggiornamenti critici. ---------- Qui ci sono alcuni grandi strumenti gratuiti per aiutarti a mantenere da ottenere nuovamente infected. Questi strumenti poco o nessun uso delle risorse in modo da non rallentare il vostro PC. Preoccupato per la sicurezza del browser? Prendete in considerazione l'uso Mozilla Firefox 3,0. Per evitare di essere sconosciuto applicazioni installate sul computer di installazione WinPatrol 2008 * Uso WinPatrol per proteggere il computer da software dannoso Vorrei suggerire che utilizzano SiteAdvisor. SiteAdvisor tassi sui siti delle pratiche d'affari e spam. Sicurezza voti da McAfee SiteAdvisor si basano su test di sicurezza automatici dei siti web. SpywareBlaster - Assicurare il vostro Internet Explorer per rendere più difficile per questi programmi ActiveX per l'esecuzione sul computer. Fermata anche da alcuni cookie che viene aggiunto al tuo computer durante l'esecuzione come browser basati su Mozilla Firefox. * Utilizzo di SpywareBlaster per proteggere il computer da spyware e malware * Se non sai cosa sono i controlli ActiveX, vedere qui Check out Mantenere te sicuro On The Web per suggerimenti e strumenti gratuiti per tenervi al sicuro il futuro. Vedi anche Computer lento? Esso non può essere Malware gratuito per la pulizia / manutenzione di strumenti per aiutare a mantenere il tuo computer che esegue liscia. Utilizzare solo come software per la sicurezza affidabili programmi elencati in questa pagina. Trusted strumenti di sicurezza e risorse
__________________ |
|
#15
17 settembre 2008, 14:24
| |||
| |||
| Io non potrò mai ringraziarvi abbastanza. Mi sento molto più sicuro del mio computer adesso grazie a te. Sono estremamente colpito alla pletora di conoscenza su questo sito e continuerà a usarla per le mie esigenze di elaborazione.  |
|
#16
17 settembre 2008, 14:27
| |||
| |||
| Glad ha funzionato. Navigare in tutta sicurezza ... 
__________________ |
