Windows xp mi si blocca sempre

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Versione database: 4350

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.11

26/07/2010 11.37.50
mbam-log-2010-07-26 (11-37-50).txt

Tipo di scansione: Scansione veloce
Elementi esaminati: 139372
Tempo trascorso: 7 minuti, 46 secondi

Processi infetti in memoria: 0
Moduli di memoria infetti: 0
Chiavi di registro infette: 8
Valori di registro infetti: 3
Voci infette nei dati di registro: 0
Cartelle infette: 0
File infetti: 21

Processi infetti in memoria:
(Non sono stati rilevati elementi nocivi)

Moduli di memoria infetti:
(Non sono stati rilevati elementi nocivi)

Chiavi di registro infette:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\9f862240-d748-9c66-60f6-384cecdfa2df (Adware.AdRotator) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ajzszubotqd (Adware.Adrotator) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\AppDataLow\HavingFunOnline (Adware.BHO.FL) -> No action taken.
HKEY_CURRENT_USER\Software\M5T8QL3YW3 (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\V71IQL7HI7 (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> No action taken.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SSHNAS (Trojan.Renos) -> No action taken.

Valori di registro infetti:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\forceclassiccontrolpanel (Hijack.ControlPanelStyle) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\m5t8ql3yw3 (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\v71iql7hi7 (Trojan.FakeAlert) -> No action taken.

Voci infette nei dati di registro:
(Non sono stati rilevati elementi nocivi)

Cartelle infette:
(Non sono stati rilevati elementi nocivi)

File infetti:
C:\WINDOWS\system32\9f862240-d748-9c66-60f6-384cecdfa2df.exe (Adware.AdRotator) -> No action taken.
C:\WINDOWS\system32\u_mzabgmyametl.dll.exe (Adware.AdRotator) -> No action taken.
C:\WINDOWS\system32\net.net (Trojan.Downloader) -> No action taken.
C:\WINDOWS\system32\ajzszubotqd.exe (Adware.Adrotator) -> No action taken.
C:\Documents and Settings\Andrea\Impostazioni locali\Temp\Component Update 204 (Adware.AdRotator) -> No action taken.
C:\Documents and Settings\Andrea\Impostazioni locali\Temp\cv45B4.tmp (Adware.BHO) -> No action taken.
C:\Documents and Settings\Andrea\Impostazioni locali\Temp\cv47467.tmp (Adware.BHO) -> No action taken.
C:\Documents and Settings\Andrea\Impostazioni locali\Temp\rnxsacwmeo.tmp (Trojan.Downloader) -> No action taken.
C:\Documents and Settings\Andrea\Impostazioni locali\Temp\A9.tmp (Rootkit.Dropper) -> No action taken.
C:\Documents and Settings\Andrea\Impostazioni locali\Temp\AB.tmp (Rootkit.Dropper) -> No action taken.
C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\6C.tmp (Rootkit.MBR) -> No action taken.
C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\70.tmp (Rootkit.MBR) -> No action taken.
C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\6D.tmp (Rootkit.MBR) -> No action taken.
C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\A9.tmp (Rootkit.Dropper) -> No action taken.
C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\AB.tmp (Rootkit.Dropper) -> No action taken.
C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\Component Update 204 (Adware.AdRotator) -> No action taken.
C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\cv45B4.tmp (Adware.BHO) -> No action taken.
C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\cv47467.tmp (Adware.BHO) -> No action taken.
C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\rnxsacwmeo.tmp (Trojan.Downloader) -> No action taken.
C:\WINDOWS\Enulia.exe (Trojan.Fraudpack) -> No action taken.
C:\WINDOWS\system32\h@tkeysh@@k.dll (Trojan.Agent) -> No action taken.

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Versione database: 4350

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.11

27/07/2010 10.18.11
mbam-log-2010-07-27 (10-18-11).txt

Tipo di scansione: Scansione completa (C:\|D:\|)
Elementi esaminati: 278916
Tempo trascorso: 39 minuti, 38 secondi

Processi infetti in memoria: 0
Moduli di memoria infetti: 0
Chiavi di registro infette: 1
Valori di registro infetti: 0
Voci infette nei dati di registro: 0
Cartelle infette: 0
File infetti: 45

Processi infetti in memoria:
(Non sono stati rilevati elementi nocivi)

Moduli di memoria infetti:
(Non sono stati rilevati elementi nocivi)

Chiavi di registro infette:
HKEY_CURRENT_USER\SOFTWARE\AppDataLow\HavingFunOnline (Adware.BHO.FL) -> Quarantined and deleted successfully.

Valori di registro infetti:
(Non sono stati rilevati elementi nocivi)

Voci infette nei dati di registro:
(Non sono stati rilevati elementi nocivi)

Cartelle infette:
(Non sono stati rilevati elementi nocivi)

File infetti:
C:\Documents and Settings\Andrea\Desktop\Giochi\Panzer1\PANZERS - Phase1\Keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\HelpAssistant\Desktop\Giochi\Panzer1\PANZERS - Phase1\Keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\HelpAssistant\Desktop\Panzer1\PANZERS - Phase1\Keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temporary Internet Files\Content.IE5\L00FAOQM\eHd382bd13V0100f070006R42f94ddd102T98bc9331201l0010K9aa49065318J0f0006010[1] (Rootkit.MBR) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP152\A0153500.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP152\A0154047.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP153\A0158061.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP154\A0159587.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP154\A0163589.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP156\A0183582.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP158\A0186561.exe (Malware.Packer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP165\A0193874.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP165\A0195875.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP165\A0197875.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP165\A0198875.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP167\A0204875.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP168\A0208417.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP168\A0209427.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP168\A0213417.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP169\A0215417.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP171\A0216423.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP171\A0221422.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP171\A0222421.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP172\A0229474.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP131\A0097112.exe (Adware.AdRotator) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP132\A0097234.dll (Adware.AdRotator) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP137\A0121461.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP138\A0124505.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP138\A0125505.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP138\A0127506.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP141\A0128498.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP141\A0130499.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP141\A0131504.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP144\A0133511.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP144\A0134505.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP144\A0136558.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP145\A0137526.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP145\A0138512.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP145\A0139509.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP147\A0140513.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP147\A0141560.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP147\A0147507.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP147\A0148511.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP149\A0149509.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP149\A0150510.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

ComboFix 10-07-24.03 - Andrea 27/07/2010  10.23.41.1.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.39.1040.18.2047.1582 [GMT 2:00]
Eseguito da: c:\documents and settings\Andrea\Desktop\ComboFix.exe

ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.

(((((((((((((((((((((((((((((((((((((   Altre eliminazioni   )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\syswinan.vbs

c:\windows\system32\midimap.dll . . . è infetto!! . . .Failed to restore. Attempting to replace on reboot

La copia infetta di c:\windows\system32\midimap.dll è stata trovata e disinfettata
ipristinata copia da - c:\system volume information\_restore{58D76181-1FCB-4828-8F4D-7BB6DE13D48D}\RP168\A0205288.dll
.
(((((((((((((((((((((((((((((((((((((((   Driver/Servizi   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SSHNAS


(((((((((((((((((((((((((   Files Creati Da 2010-06-27 al 2010-07-27  )))))))))))))))))))))))))))))))))))
.

2010-07-27 08:35 . 2010-07-27 08:35   --------   d-----w-   c:\windows\system32\xircom
2010-07-27 08:35 . 2010-07-27 08:35   --------   d-----w-   c:\windows\system32\wbem\snmp
2010-07-27 08:35 . 2010-07-27 08:35   --------   d-----w-   c:\windows\srchasst
2010-07-27 08:35 . 2010-07-27 08:35   --------   d-----w-   c:\programmi\microsoft frontpage
2010-07-26 08:47 . 2010-07-26 08:47   --------   d-----w-   c:\documents and settings\Andrea\Dati applicazioni\Malwarebytes
2010-07-26 08:47 . 2010-04-29 13:39   38224   ----a-w-   c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-26 08:47 . 2010-07-26 08:47   --------   d-----w-   c:\programmi\Malwarebytes' Anti-Malware
2010-07-26 08:47 . 2010-07-26 08:47   --------   d-----w-   c:\documents and settings\All Users\Dati applicazioni\Malwarebytes
2010-07-26 08:47 . 2010-04-29 13:39   20952   ----a-w-   c:\windows\system32\drivers\mbam.sys
2010-07-26 08:46 . 2010-07-26 08:46   --------   d-----w-   c:\programmi\IObit
2010-07-26 08:46 . 2010-07-26 08:46   --------   d-----w-   c:\documents and settings\Andrea\Dati applicazioni\IObit
2010-07-23 08:49 . 2010-07-23 08:49   --------   d-----w-   c:\programmi\Defraggler
2010-07-23 08:33 . 2010-07-23 08:33   --------   d-----w-   c:\documents and settings\Andrea\Dati applicazioni\Yahoo!
2010-07-23 08:33 . 2010-07-23 08:33   --------   d-----w-   c:\documents and settings\All Users\Dati applicazioni\Yahoo! Companion
2010-07-23 08:33 . 2010-07-23 08:33   --------   d-----w-   c:\programmi\Yahoo!
2010-07-22 20:43 . 2010-07-22 20:43   --------   d-----w-   c:\documents and settings\Andrea\Documents
2010-07-22 18:05 . 2010-07-22 18:05   --------   d-----w-   c:\documents and settings\All Users\Dati applicazioni\Nexon
2010-07-21 14:28 . 2010-07-21 14:28   --------   d-----w-   c:\programmi\AVG
2010-07-21 14:28 . 2010-07-21 15:35   --------   d-----w-   c:\windows\SxsCaPendDel
2010-07-21 14:05 . 2010-06-28 20:32   17744   ----a-w-   c:\windows\system32\drivers\aswFsBlk.sys
2010-07-21 14:05 . 2010-06-28 20:37   165456   ----a-w-   c:\windows\system32\drivers\aswSP.sys
2010-07-21 14:05 . 2010-06-28 20:33   23376   ----a-w-   c:\windows\system32\drivers\aswRdr.sys
2010-07-21 14:05 . 2010-06-28 20:37   46672   ----a-w-   c:\windows\system32\drivers\aswTdi.sys
2010-07-21 14:05 . 2010-06-28 20:32   100176   ----a-w-   c:\windows\system32\drivers\aswmon2.sys
2010-07-21 14:05 . 2010-06-28 20:32   94544   ----a-w-   c:\windows\system32\drivers\aswmon.sys
2010-07-21 14:05 . 2010-06-28 20:32   28880   ----a-w-   c:\windows\system32\drivers\aavmker4.sys
2010-07-21 14:04 . 2010-06-28 20:57   38848   ----a-w-   c:\windows\avastSS.scr
2010-07-21 14:04 . 2010-06-28 20:57   165032   ----a-w-   c:\windows\system32\aswBoot.exe
2010-07-21 14:04 . 2010-07-21 14:04   --------   d-----w-   c:\programmi\Alwil Software
2010-07-21 14:04 . 2010-07-21 14:04   --------   d-----w-   c:\documents and settings\All Users\Dati applicazioni\Alwil Software
2010-07-21 12:09 . 2010-07-21 12:09   --------   d-----w-   c:\programmi\Apple Software Update
2010-07-21 12:09 . 2010-07-21 12:09   --------   d-----w-   c:\documents and settings\All Users\Dati applicazioni\Apple
2010-07-21 08:15 . 2010-07-21 08:15   --------   d-----w-   c:\documents and settings\All Users\Dati applicazioni\Apple Computer
2010-07-20 12:43 . 2010-07-20 12:52   --------   d-----w-   c:\windows\VistaMizer
2010-07-20 12:17 . 2010-07-20 12:17   --------   d-----w-   c:\documents and settings\All Users\Dati applicazioni\CenerTCPMessenger
2010-07-20 11:39 . 2010-07-20 11:39   --------   d-----w-   c:\documents and settings\All Users\Dati applicazioni\DAEMON Tools Lite
2010-07-20 11:39 . 2010-07-20 11:39   --------   d-----w-   c:\documents and settings\All Users\Dati applicazioni\Electronic Arts
2010-07-19 17:12 . 2010-07-19 17:15   --------   d-----w-   c:\programmi\Wisdom-soft AutoScreenRecorder 3 Free
2010-07-19 16:59 . 2010-06-14 14:31   744448   ------w-   c:\windows\system32\dllcache\helpsvc.exe

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-27 08:35 . 2010-01-04 21:46   --------   d-----w-   c:\programmi\File comuni\Akamai
2010-07-24 17:11 . 2001-08-31 17:00   84020   ----a-w-   c:\windows\system32\perfc010.dat
2010-07-24 17:11 . 2001-08-31 17:00   488582   ----a-w-   c:\windows\system32\perfh010.dat
2010-07-23 08:33 . 2009-06-25 08:10   --------   d-----w-   c:\programmi\CCleaner
2010-07-20 12:52 . 2008-05-03 02:29   219648   ----a-w-   c:\windows\system32\uxtheme.dll
2010-07-19 17:47 . 2009-06-26 14:51   1   ----a-w-   c:\documents and settings\Andrea\Dati applicazioni\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-07-19 11:06 . 2009-06-25 13:33   --------   d--h--w-   c:\programmi\InstallShield Installation Information
2010-07-18 12:07 . 2009-07-20 18:01   --------   d-----w-   c:\programmi\uTorrent
2010-07-18 12:07 . 2009-07-20 17:58   --------   d-----w-   c:\documents and settings\Andrea\Dati applicazioni\uTorrent
2010-07-18 12:06 . 2009-06-29 13:30   --------   d-----w-   c:\programmi\Capcom
2010-06-20 12:10 . 2009-09-19 14:03   --------   d-----w-   c:\programmi\GIMP-2.0
2010-06-20 12:09 . 2009-08-27 12:32   --------   d-----w-   c:\programmi\AlienGUIse
2010-06-20 12:09 . 2009-08-25 11:20   --------   d--h--w-   c:\programmi\FX Uninstall Information
2010-06-20 09:14 . 2010-06-20 08:24   43520   ----a-w-   c:\windows\system32\CmdLineExt03.dll
2010-06-19 16:51 . 2010-06-19 16:51   --------   d-----w-   c:\programmi\File comuni\BioWare
2010-06-14 14:31 . 2009-06-25 07:47   744448   ----a-w-   c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-11 19:41 . 2010-06-11 19:41   --------   d-----w-   c:\programmi\Paradox Interactive
2010-06-05 20:46 . 2010-06-05 20:37   --------   d-----w-   c:\documents and settings\Andrea\Dati applicazioni\NationRed
2010-06-04 19:02 . 2009-07-07 20:50   --------   d-----w-   c:\programmi\Microsoft Silverlight
2010-05-15 16:38 . 2009-08-19 21:05   56   --sh--r-   c:\windows\system32\C6CDC4D2EF.sys
2010-05-15 16:38 . 2009-08-19 21:04   1056   --sha-w-   c:\windows\system32\KGyGaAvL.sys
2010-05-04 17:16 . 2008-05-03 02:03   933888   ----a-w-   c:\windows\system32\wininet.dll
2010-05-04 17:15 . 2008-05-03 01:53   78336   ----a-w-   c:\windows\system32\ieencode.dll
2010-05-04 17:15 . 2008-05-03 01:53   17408   ----a-w-   c:\windows\system32\corpol.dll
2010-05-02 08:06 . 2008-04-13 18:50   1851264   ----a-w-   c:\windows\system32\win32k.sys
2009-10-03 15:23 . 2009-10-03 15:22   4037036   ----a-w-   c:\programmi\FalloutLauncher.exe.patched
2008-10-28 16:35 . 2009-10-03 15:22   18552088   ----a-r-   c:\programmi\FalloutLauncher.exe.merge
.

------- Sigcheck -------

[-] 2008-05-03 . 6DC43081C760EEC1130D2C8C145DF375 . 549888 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe
[-] 2008-05-03 . 6DC43081C760EEC1130D2C8C145DF375 . 549888 . . [5.1.2600.5512] . . c:\windows\VistaMizer\old\winlogon.exe

[-] 2008-05-03 . 6A110D92798C536DBBD75717F7899096 . 724992 . . [5.82] . . c:\windows\system32\comctl32.dll
[-] 2008-05-03 . 8B2A7229651894B07A5F750E1FEF99CC . 724992 . . [5.82] . . c:\windows\VistaMizer\old\comctl32.dll

[-] 2010-05-04 . 5E68787DF434EEB273E8A88EBB7C7F96 . 3825152 . . [7.00.6000.17063] . . c:\windows\system32\mshtml.dll
[-] 2010-05-04 . 5E68787DF434EEB273E8A88EBB7C7F96 . 3825152 . . [7.00.6000.17063] . . c:\windows\system32\dllcache\mshtml.dll
[7] 2010-05-04 . E713ED6823AC5528EE4CD1482EF94B74 . 3600384 . . [7.00.6000.17063] . . c:\windows\VistaMizer\old\mshtml.dll
[7] 2010-05-04 . 77968988F8D07572499D9181B47E2B12 . 3603456 . . [7.00.6000.21264] . . c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\mshtml.dll
[7] 2010-03-11 . 3D9800304502C033E67C9133DE7EB946 . 3599872 . . [7.00.6000.17023] . . c:\windows\ie7updates\KB982381-IE7\mshtml.dll
[7] 2010-03-11 . 42CCADED3A3430D0A96C3C2077DA79B4 . 3602944 . . [7.00.6000.21228] . . c:\windows\$hf_mig$\KB980182-IE7\SP3QFE\mshtml.dll
[7] 2009-10-29 . AC38AC7BC2947A9788B92C85FAA040EC . 3598336 . . [7.00.6000.16945] . . c:\windows\ie7updates\KB980182-IE7\mshtml.dll
[7] 2009-10-29 . AC38AC7BC2947A9788B92C85FAA040EC . 3598336 . . [7.00.6000.16945] . . c:\windows\SoftwareDistribution\Download\d3c31c4fa0b91219cebe2621c7470b32\backup\sp3gdr\mshtml.dll
[7] 2009-10-29 . AC38AC7BC2947A9788B92C85FAA040EC . 3598336 . . [7.00.6000.16945] . . c:\windows\SoftwareDistribution\Download\d3c31c4fa0b91219cebe2621c7470b32\backup\sp3qfe\mshtml.dll
[7] 2009-10-29 . 6A23746C85468A631B25050C59C2CA14 . 3602432 . . [7.00.6000.21148] . . c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\mshtml.dll
[7] 2009-10-21 . C79296190F63CCD64A19727068F03AF0 . 3598336 . . [7.00.6000.16939] . . c:\windows\ie7updates\KB976325-IE7\mshtml.dll
[7] 2009-10-21 . B8D6A50D6306F869C771B77FBC793FAD . 3602432 . . [7.00.6000.21142] . . c:\windows\$hf_mig$\KB976749-IE7\SP3QFE\mshtml.dll
[7] 2009-08-29 . FBE19F692A6C20D34D3DDBC0A6B4A0DB . 3598336 . . [7.00.6000.16915] . . c:\windows\ie7updates\KB976749-IE7\mshtml.dll
[7] 2009-08-29 . 68B859DDC8FF192D9FFC02229B6BE355 . 3600384 . . [7.00.6000.21115] . . c:\windows\$hf_mig$\KB974455-IE7\SP3QFE\mshtml.dll
[7] 2009-07-19 . DB2E2E87EDF8DCDC6B0B76244B2B97D1 . 3597824 . . [7.00.6000.16890] . . c:\windows\ie7updates\KB974455-IE7\mshtml.dll
[7] 2009-07-19 . 5E84885C93642BB82E88CD1CBC345FAF . 3600384 . . [7.00.6000.21089] . . c:\windows\$hf_mig$\KB972260-IE7\SP3QFE\mshtml.dll
[7] 2009-04-29 . B49494080ED7D6D749D65786494ABD9A . 3596288 . . [7.00.6000.16850] . . c:\windows\ie7updates\KB972260-IE7\mshtml.dll
[7] 2009-04-29 . 2ECF7C62E692BBE1D7F9A72B42AECAA9 . 3598336 . . [7.00.6000.21045] . . c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\mshtml.dll
[-] 2008-05-03 . 3D924F7769CC25ABC4499E0E32293018 . 3802624 . . [7.00.5730.11] . . c:\windows\ie7updates\KB969897-IE7\mshtml.dll

[7] 2010-02-17 . CE3BE4BB511B6E0F81D5479F31922574 . 2193664 . . [5.1.2600.5938] . . c:\windows\Driver Cache\i386\ntoskrnl.exe
[-] 2010-02-16 . B2C4E655B0A859AEA55D0E0496FBC264 . 2407424 . . [5.1.2600.5938] . . c:\windows\system32\ntoskrnl.exe
[-] 2010-02-16 . B2C4E655B0A859AEA55D0E0496FBC264 . 2407424 . . [5.1.2600.5938] . . c:\windows\system32\dllcache\ntoskrnl.exe
[7] 2010-02-16 . 2A3C8C51E0D91616415720C48A3E5A66 . 2149888 . . [5.1.2600.5938] . . c:\windows\VistaMizer\old\ntoskrnl.exe
[7] 2010-02-16 . 01CBC934223F6754C3CA87927D409E9E . 2193792 . . [5.1.2600.5938] . . c:\windows\$hf_mig$\KB979683\SP3QFE\ntoskrnl.exe
[7] 2009-08-04 . 66C0988D9B1BB7F41437D91DBCFDF927 . 2193024 . . [5.1.2600.5857] . . c:\windows\$hf_mig$\KB971486\SP3QFE\ntoskrnl.exe
[7] 2009-02-10 . 3B5928FCD0DD3E10DEB1C13CA35201F6 . 2192896 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntoskrnl.exe

[-] 2008-04-13 . 3DBD6DC6D74C517D55A1B3AECA88EF48 . 588800 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll
[7] 2008-04-13 . FA94696C0727BD59E517C674CD6E7C72 . 579584 . . [5.1.2600.5512] . . c:\windows\VistaMizer\old\user32.dll

[-] 2010-05-04 . 00059A3FA0B21D85321A67488B8C69F0 . 933888 . . [7.00.6000.17055] . . c:\windows\system32\wininet.dll
[-] 2010-05-04 . 00059A3FA0B21D85321A67488B8C69F0 . 933888 . . [7.00.6000.17055] . . c:\windows\system32\dllcache\wininet.dll
[7] 2010-05-04 . CA555969E0850FB68B84235CD24F54E5 . 832512 . . [7.00.6000.17055] . . c:\windows\VistaMizer\old\wininet.dll
[7] 2010-05-04 . 4CD4DB297B3D6D83F04BE7912B946428 . 841216 . . [7.00.6000.21256] . . c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\wininet.dll
[7] 2010-03-11 . B9F98099FD956224DB86BF3B9E8C8F14 . 832512 . . [7.00.6000.17023] . . c:\windows\ie7updates\KB982381-IE7\wininet.dll
[7] 2010-03-11 . 776681CB75D9DE5EF363FFDEA8D7DA97 . 841216 . . [7.00.6000.21228] . . c:\windows\$hf_mig$\KB980182-IE7\SP3QFE\wininet.dll
[7] 2009-10-29 . 42D48A8065BF1CFB9579261BD6C2CF94 . 832512 . . [7.00.6000.16945] . . c:\windows\ie7updates\KB980182-IE7\wininet.dll
[7] 2009-10-29 . 42D48A8065BF1CFB9579261BD6C2CF94 . 832512 . . [7.00.6000.16945] . . c:\windows\SoftwareDistribution\Download\d3c31c4fa0b91219cebe2621c7470b32\backup\sp3gdr\wininet.dll
[7] 2009-10-29 . 42D48A8065BF1CFB9579261BD6C2CF94 . 832512 . . [7.00.6000.16945] . . c:\windows\SoftwareDistribution\Download\d3c31c4fa0b91219cebe2621c7470b32\backup\sp3qfe\wininet.dll
[7] 2009-10-29 . 24A9BC124187E37A2BE67DFE5BB1A681 . 841216 . . [7.00.6000.21148] . . c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\wininet.dll
[7] 2009-08-29 . 4E3FF8C9D1ADDA0342306E731905FA06 . 832512 . . [7.00.6000.16915] . . c:\windows\ie7updates\KB976325-IE7\wininet.dll
[7] 2009-08-29 . EFC043E6C9D34BA3B22CE51347F08D32 . 840704 . . [7.00.6000.21115] . . c:\windows\$hf_mig$\KB974455-IE7\SP3QFE\wininet.dll
[7] 2009-06-29 . 9BA2E22993954B2C433FDC229801EEFE . 828928 . . [7.00.6000.21073] . . c:\windows\$hf_mig$\KB972260-IE7\SP3QFE\wininet.dll
[7] 2009-06-29 . 349808BF272A3CAB2BE7E4C6662BCDC1 . 827392 . . [7.00.6000.16876] . . c:\windows\ie7updates\KB974455-IE7\wininet.dll
[7] 2009-04-29 . B7DFEFC4FC10B8AC464FCDCA309267B6 . 827392 . . [7.00.6000.16850] . . c:\windows\ie7updates\KB972260-IE7\wininet.dll
[7] 2009-04-29 . D327397F4448DCB912E9FE78C9A94C88 . 828928 . . [7.00.6000.21045] . . c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\wininet.dll
[-] 2008-05-03 . 76042B62EFE8E0CCB7845AE3955EC0BC . 920064 . . [7.00.5730.11] . . c:\windows\ie7updates\KB969897-IE7\wininet.dll

[-] 2008-05-03 . 310C9D7EE621525A7160EE0E0198FF74 . 1554432 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[-] 2008-05-03 . C08C29D743BB88E6DE929CA6B9C23979 . 1554432 . . [6.00.2900.5512] . . c:\windows\VistaMizer\old\explorer.exe


[-] 2008-05-03 . 3316C8A8EC07A9D4C0BE10310809A9E5 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll

[-] 2008-05-03 . 91B6AAC828F8BBE1796275424E44DFB0 . 25088 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe
[-] 2008-05-03 . 91B6AAC828F8BBE1796275424E44DFB0 . 25088 . . [5.1.2600.5512] . . c:\windows\VistaMizer\old\ctfmon.exe

[7] 2010-02-16 . 32ACD29EE9D2C09BD471CDC23C31ED49 . 2070528 . . [5.1.2600.5938] . . c:\windows\Driver Cache\i386\ntkrnlpa.exe
[-] 2010-02-16 . 3A30040773B56D3F80267CAEE20108B4 . 2285568 . . [5.1.2600.5938] . . c:\windows\system32\ntkrnlpa.exe
[-] 2010-02-16 . 3A30040773B56D3F80267CAEE20108B4 . 2285568 . . [5.1.2600.5938] . . c:\windows\system32\dllcache\ntkrnlpa.exe
[7] 2010-02-16 . CC0BD6DF954A759B0C36116AB34F1C85 . 2028032 . . [5.1.2600.5938] . . c:\windows\VistaMizer\old\ntkrnlpa.exe
[7] 2010-02-16 . EAFDE69BE3EDF234CD222712F45A00B6 . 2070656 . . [5.1.2600.5938] . . c:\windows\$hf_mig$\KB979683\SP3QFE\ntkrnlpa.exe
[7] 2009-08-04 . 845344F22D2BA7CDD2847B0B0A5D0EDD . 2069888 . . [5.1.2600.5857] . . c:\windows\$hf_mig$\KB971486\SP3QFE\ntkrnlpa.exe
[7] 2009-02-09 . FF69166080436A31A3EAC9CC7C3F1847 . 2069888 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntkrnlpa.exe

c:\windows\System32\wscntfy.exe ... è mancante !!
.
(((((((((((((((((((((((((((((((((((((   Punti Reg Caricati   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\programmi\Windows Sidebar\sidebar.exe" [2008-04-16 1274880]
"EA Core"="c:\programmi\Electronic Arts\EADM\Core.exe" [2009-03-28 3325952]
"Pando Media Booster"="c:\programmi\Pando Networks\Media Booster\PMB.exe" [2009-10-09 2919608]
"msnmsgr"="c:\programmi\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"Advanced SystemCare 3"="c:\programmi\IObit\Advanced SystemCare 3\AWC.exe" [2010-07-02 2347216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-03-24 13524992]
"nwiz"="nwiz.exe" [2008-03-24 1626112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-03-24 86016]
"RTHDCPL"="RTHDCPL.EXE" [2008-07-03 16876032]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-06-28 2837864]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-05-03 25088]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
"nltide_3"="advpack.dll" [2010-05-04 124928]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages   REG_MULTI_SZ      msv1_0 nwprovau

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Programmi\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programmi\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Programmi\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Documents and Settings\\All Users\\Dati applicazioni\\NexonUS\\NGM\\NGM.exe"=
"c:\\Nexon\\NEXON_EU_Downloader\\NEXON_EU_Downloader_Engine.exe"=
"c:\\Documents and Settings\\All Users\\Dati applicazioni\\NexonEU\\NGM\\NGM.exe"=
"e:\combat arms eu\CombatArms.exe"= e:\combat arms eu\CombatArms.exe:*Enabled:CombatArms.exe
"e:\\Combat Arms EU\\NMService.exe"=
"c:\\Programmi\\The Game Creators\\FPS Creator\\FPSC-Game.exe"=
"e:\\Left 4 Dead\\left4dead.exe"=
"e:\\Tom Clancy's H.A.W.X\\HAWX.exe"=
"e:\\Programmi\\Mass Effect\\Binaries\\MassEffect.exe"=
"e:\\Programmi\\Mass Effect\\MassEffectLauncher.exe"=
"c:\\Programmi\\The Game Creators\\FPS Creator\\FPSCreator.exe"=
"e:\\Combat Arms EU\\Engine.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:Remote Desktop
"58083:TCP"= 58083:TCP:Pando Media Booster
"58083:UDP"= 58083:UDP:Pando Media Booster
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"3246:TCP"= 3246:TCP:Services
"2479:TCP"= 2479:TCP:Services

R0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [26/06/2009 15.46.40 5248]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [21/07/2010 16.05.17 165456]
R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [13/04/2008 21.14.22 14336]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [21/07/2010 16.05.18 17744]
S0 mv61xx;mv61xx;c:\windows\system32\DRIVERS\mv61xx.sys --> c:\windows\system32\DRIVERS\mv61xx.sys [?]
S3 dump_wmimmc;dump_wmimmc;\??\c:\fiaa\OPERATION7\GameGuard\dump_wmimmc.sys --> c:\fiaa\OPERATION7\GameGuard\dump_wmimmc.sys [?]
S3 kbeepm;kbeepm;\??\c:\docume~1\Andrea\IMPOST~1\Temp\kbeepm.sys --> c:\docume~1\Andrea\IMPOST~1\Temp\kbeepm.sys [?]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S4 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [26/06/2009 15.46.40 160640]
S4 ASKUpgrade;ASKUpgrade;c:\programmi\AskBarDis\bar\bin\ASKUpgrade.exe [20/07/2009 20.01.21 234888]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [08/07/2009 20.57.48 721904]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai   REG_MULTI_SZ      Akamai

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D58F39FF-953E-4F45-898F-59F243B9A523}]
2010-05-04 17:15   124928   ----a-w-   c:\windows\system32\advpack.dll
.
Contenuto della cartella 'Scheduled Tasks'

2010-07-27 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-07-08 20:18]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
uInternet Settings,ProxyServer = 192.168.1.39:3128
FF - ProfilePath - c:\documents and settings\Andrea\Dati applicazioni\Mozilla\Firefox\Profiles\hcfmnykr.default\
FF - prefs.js: browser.search.defaulturl - 4.6.6.2
FF - prefs.js: browser.search.selectedEngine - 4.6.6.2
FF - prefs.js: keyword.URL - 4.6.6.2
FF - component: e:\extensions\{8d77e251-6bff-eb5a-85ea-15533ea18c4c}\components\4cdf5ebd-fd32-1769-8a4e-5b1daf4d1e2e.dll
FF - plugin: c:\documents and settings\All Users\Dati applicazioni\NexonUS\NGM\npNxGameUS.dll
FF - plugin: c:\programmi\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: browser.search.defaultenginename - 4.6.6.2
FF - user.js: browser.search.defaulturl - 4.6.6.2
FF - user.js: browser.search.selectedEngine - 4.6.6.2
FF - user.js: keyword.URL - 4.6.6.2
FF - user.js: keyword.enabled - true
.
- - - - CHIAVI ORFANE RIMOSSE - - - -

Toolbar-{3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\programmi\AskBarDis\bar\bin\askBar.dll
WebBrowser-{3041D03E-FD4B-44E0-B742-2D9B88305F98} - c:\programmi\AskBarDis\bar\bin\askBar.dll
AddRemove-DAEMON Tools Toolbar - c:\programmi\DAEMON Tools Toolbar\uninst.exe
AddRemove-{BC6DEDC5-8CB4-FEFD-D8BD-6E5D2595D066} - c:\windows\system32\mzabgmyametl.dll-uninst.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-27 10:36
Windows 5.1.2600 Service Pack 3 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------

[HKEY_USERS\S-1-5-21-507921405-583907252-1177238915-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
@Denied: (Full) (LocalSystem)

[HKEY_USERS\S-1-5-21-507921405-583907252-1177238915-1003\Software\SecuROM\License information*]
"datasecu"=hex:9d,2e,3f,b4,da,6f,4c,b1,d1,e1,d8,f3,ef,78,98,67,a8,5c,98,17,9f,
   fc,c8,76,15,40,bb,40,f8,40,ac,5b,7f,bb,a7,1f,8e,b4,7d,f3,c7,fd,25,80,52,c8,\
"rkeysecu"=hex:b5,ac,e7,00,c3,02,a2,db,56,1d,0e,9d,3d,25,04,cd
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------

- - - - - - - > 'winlogon.exe'(632)
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\sfc_os.dll
c:\windows\system32\cscui.dll

- - - - - - - > 'lsass.exe'(688)
c:\windows\system32\setupapi.dll
c:\windows\system32\scecli.dll
c:\windows\system32\psbase.dll

- - - - - - - > 'explorer.exe'(3524)
c:\windows\system32\SHDOCVW.dll
c:\windows\system32\WININET.dll
c:\windows\system32\nview.dll
c:\windows\system32\NVWRSIT.DLL
c:\windows\system32\COMRes.dll
c:\windows\System32\cscui.dll
c:\windows\system32\msi.dll
c:\windows\system32\LINKINFO.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
c:\windows\system32\MSVCP60.dll
c:\windows\system32\wpdshserviceobj.dll
c:\programmi\Microsoft Virtual PC\VPCShExH.DLL
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\programmi\Alwil Software\Avast5\AvastSvc.exe
c:\programmi\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\UAService7.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\RTHDCPL.EXE
c:\windows\system32\rundll32.exe
c:\programmi\Windows Sidebar\Shared Gadgets\livemessenger.Gadget\Connector\CenerTCPMessenger.exe
c:\programmi\Windows Live\Contacts\wlcomm.exe
.
**************************************************************************
.
Ora fine scansione: 2010-07-27  10:39:57 - Il pc è stato riavviato
ComboFix-quarantined-files.txt  2010-07-27 08:39

Pre-Run: 63.738.535.936 byte disponibili
Post-Run: 72.115.163.136 byte disponibili

- - End Of File - - 7469074B3E75419747CAE15869F28A53

Logfile of Advanced SystemCare 3 Security Analyzer
Scan saved at 10.51.20, on 27/07/2010
Platform: Windows XP (WinNT 5.1)
MSIE: Internet Explorer v7.0 (7.0.5730.11)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\Programmi\Alwil Software\Avast5\AvastSvc.exe
C:\windows\system32\spoolsv.exe
C:\windows\System32\svchost.exe
C:\Programmi\Java\jre6\bin\jqs.exe
C:\windows\system32\nvsvc32.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\windows\System32\svchost.exe
C:\windows\system32\RUNDLL32.EXE
C:\windows\RTHDCPL.EXE
C:\windows\system32\rundll32.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\Programmi\Windows Sidebar\sidebar.exe
C:\Programmi\Electronic Arts\EADM\Core.exe
C:\Programmi\Pando Networks\Media Booster\PMB.exe
C:\Programmi\Windows Live\Messenger\msnmsgr.exe
C:\Programmi\IObit\Advanced SystemCare 3\AWC.exe
C:\Programmi\Windows Sidebar\sidebar.exe
C:\Programmi\Windows Sidebar\Shared Gadgets\livemessenger.Gadget\Connector\CenerTCPMessenger.exe
C:\Programmi\Windows Live\Contacts\wlcomm.exe
C:\windows\explorer.exe
C:\windows\system32\notepad.exe
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Programmi\Windows Live\Messenger\wlchtc.dll
O2 - BHO: Click-to-Call BHO - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Click-to-Call BHO - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmi\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: JQSIEStartDetectorImpl - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Programmi\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKCU\..\Run: [Sidebar] C:\Programmi\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [EA Core] "C:\Programmi\Electronic Arts\EADM\Core.exe" -silent
O4 - HKCU\..\Run: [Pando Media Booster] C:\Programmi\Pando Networks\Media Booster\PMB.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmi\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Programmi\IObit\Advanced SystemCare 3\AWC.exe" /startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O9 - Extra button: Inserisci &blog in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - 
O9 - Extra button: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.6.0_15) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} (Java Plug-in 1.6.0_15) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Plug-in 1.6.0_15) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: ASKUpgrade - Unknown - C:\Programmi\AskBarDis\bar\bin\ASKUpgrade.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Programmi\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Programmi\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Programmi\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmi\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown - C:\WINDOWS\system32\UAService7.exe

O23 - Service: ASKUpgrade - Unknown - C:\Programmi\AskBarDis\bar\bin\ASKUpgrade.exe

O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Programmi\IObit\Advanced SystemCare 3\AWC.exe" /startup