domanda

[homerino85]

Ciao a tutti ho ripristinato il computer con acronis ma il problema delle disconnessioni ancora è presente.....Volevo sapere è possibile che il virus non sia stato eliminato?Vi allego un report di combofix....

Codice: Seleziona tutto

Eseguito da: c:\users\GM\Desktop\ComboFix.exe
AV: AVG Internet Security 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
FW: AVG Internet Security 2012 *Disabled* {621CC794-9486-F902-D092-0484E8EA828B}
SP: AVG Internet Security 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((((   Altre eliminazioni   )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
c:\windows\XSxS
.
.
(((((((((((((((((((((((((   Files Creati Da 2012-05-12 al 2012-06-12  )))))))))))))))))))))))))))))))))))
.
.
2012-06-11 09:32 . 2011-02-19 05:33    802304    ----a-w-    c:\windows\system32\FntCache.dll
2012-06-11 09:01 . 2012-06-11 09:01    --------    d-----w-    C:\Vincenzo
2012-06-10 22:26 . 2012-06-10 22:26    --------    d-----w-    C:\ef4db60163a3947b02aa800353cd4ff6
2012-06-10 14:51 . 2012-04-02 04:46    3958128    ----a-w-    c:\windows\system32\ntkrnlpa.exe
2012-06-10 14:51 . 2012-04-02 04:46    3902320    ----a-w-    c:\windows\system32\ntoskrnl.exe
2012-06-10 14:51 . 2012-04-02 02:43    2342400    ----a-w-    c:\windows\system32\win32k.sys
2012-06-10 13:39 . 2012-06-10 13:39    --------    d-----w-    c:\programdata\McAfee Security Scan
2012-06-10 13:39 . 2012-06-10 13:39    --------    d-----w-    c:\programdata\McAfee
2012-06-10 13:39 . 2012-06-10 13:39    --------    d-----w-    c:\program files\McAfee Security Scan
2012-06-10 13:39 . 2012-06-10 13:39    404640    ----a-w-    c:\windows\system32\FlashPlayerCPLApp.cpl
2012-06-10 08:30 . 2012-06-10 08:30    --------    d-----w-    c:\users\GM\AppData\Local\AVG Secure Search
2012-06-10 08:27 . 2012-06-10 08:27    --------    d-----w-    C:\$AVG
2012-06-10 08:27 . 2012-06-10 08:27    --------    d-----w-    c:\users\GM\AppData\Roaming\AVG2012
2012-06-10 08:27 . 2012-06-10 08:39    --------    d-----w-    c:\programdata\AVG2012
2012-06-10 07:55 . 2009-09-10 05:52    257024    ----a-w-    c:\windows\system32\msv1_0.dll
2012-06-10 07:32 . 2012-06-10 07:32    --------    d-----w-    c:\users\GM\AppData\Roaming\Iminent
2012-06-10 07:25 . 2012-06-10 07:25    --------    d-----w-    c:\windows\system32\wbem\en-US
2012-06-09 22:41 . 2012-06-09 22:41    --------    d-----w-    c:\users\Default\AppData\Local\Microsoft Help
2012-06-09 22:33 . 2012-03-01 05:53    19312    ----a-w-    c:\windows\system32\drivers\fs_rec.sys
2012-06-09 22:33 . 2012-03-01 05:49    172544    ----a-w-    c:\windows\system32\wintrust.dll
2012-06-09 22:33 . 2012-03-01 05:45    158720    ----a-w-    c:\windows\system32\imagehlp.dll
2012-06-09 22:33 . 2012-03-01 05:40    5120    ----a-w-    c:\windows\system32\wmi.dll
2012-06-09 22:30 . 2010-02-11 07:10    293376    ----a-w-    c:\windows\system32\browserchoice.exe
2012-06-09 19:47 . 2012-06-10 09:05    --------    d-----w-    c:\program files\Iminent
2012-06-09 19:43 . 2009-11-25 19:47    49472    ----a-w-    c:\windows\system32\netfxperf.dll
2012-06-09 19:43 . 2009-11-25 19:47    297808    ----a-w-    c:\windows\system32\mscoree.dll
2012-06-09 19:43 . 2009-11-25 19:47    99176    ----a-w-    c:\windows\system32\PresentationHostProxy.dll
2012-06-09 19:43 . 2009-11-25 19:47    295264    ----a-w-    c:\windows\system32\PresentationHost.exe
2012-06-09 19:43 . 2009-11-25 19:47    1130824    ----a-w-    c:\windows\system32\dfshim.dll
2012-06-09 19:40 . 2009-09-26 05:58    194488    ----a-w-    c:\windows\system32\drivers\fvevol.sys
2012-06-09 19:39 . 2010-07-29 06:30    197632    ----a-w-    c:\windows\system32\ir32_32.dll
2012-06-09 19:38 . 2010-11-02 04:41    351232    ----a-w-    c:\windows\system32\wmicmiplugin.dll
2012-06-09 19:37 . 2009-09-03 07:04    1320960    ----a-w-    c:\windows\system32\CertEnroll.dll
2012-06-09 19:36 . 2011-02-12 05:30    191488    ----a-w-    c:\windows\system32\FXSCOVER.exe
2012-06-09 19:35 . 2011-07-16 04:37    169984    ----a-w-    c:\windows\system32\winsrv.dll
2012-06-09 19:34 . 2010-08-21 05:36    738816    ----a-w-    c:\windows\system32\wmpmde.dll
2012-06-09 19:13 . 2011-12-16 07:59    690688    ----a-w-    c:\windows\system32\msvcrt.dll
2012-06-09 19:13 . 2012-03-17 07:20    56688    ----a-w-    c:\windows\system32\drivers\partmgr.sys
2012-06-09 19:13 . 2010-08-27 05:46    168448    ----a-w-    c:\windows\system32\srvsvc.dll
2012-06-09 19:05 . 2012-06-09 19:05    --------    d-----w-    c:\windows\system32\Wat
2012-06-09 19:02 . 2010-03-04 03:57    190976    ----a-w-    c:\windows\system32\drivers\ks.sys
2012-06-09 19:01 . 2010-09-14 06:07    276992    ----a-w-    c:\windows\system32\wcncsvc.dll
2012-06-09 18:54 . 2012-06-12 08:01    --------    d-----w-    c:\users\GM\Tracing
2012-06-09 18:53 . 2010-11-02 04:46    728448    ----a-w-    c:\windows\system32\drivers\dxgkrnl.sys
2012-06-09 18:53 . 2011-02-03 05:45    219008    ----a-w-    c:\windows\system32\drivers\dxgmms1.sys
2012-06-09 18:53 . 2010-11-02 04:23    107520    ----a-w-    c:\windows\system32\cdd.dll
2012-06-09 18:51 . 2012-06-09 18:51    --------    d-----w-    c:\windows\it
2012-06-09 18:51 . 2012-01-25 05:40    8192    ----a-w-    c:\windows\system32\rdrmemptylst.exe
2012-06-09 18:51 . 2012-01-25 05:44    57856    ----a-w-    c:\windows\system32\rdpwsx.dll
2012-06-09 18:51 . 2012-01-25 05:44    129536    ----a-w-    c:\windows\system32\rdpcorekmts.dll
2012-06-09 18:50 . 2012-02-15 05:44    826368    ----a-w-    c:\windows\system32\rdpcore.dll
2012-06-09 18:50 . 2012-02-15 04:22    24064    ----a-w-    c:\windows\system32\drivers\tdtcp.sys
2012-06-09 18:50 . 2012-02-15 04:22    177152    ----a-w-    c:\windows\system32\drivers\rdpwd.sys
2012-06-09 18:47 . 2012-06-09 18:47    --------    d-----w-    c:\program files\Microsoft SQL Server Compact Edition
2012-06-09 18:41 . 2012-06-09 18:47    --------    d-----w-    c:\program files\Windows Live
2012-06-09 18:40 . 2009-09-04 15:44    69464    ----a-w-    c:\windows\system32\XAPOFX1_3.dll
2012-06-09 18:40 . 2009-09-04 15:44    515416    ----a-w-    c:\windows\system32\XAudio2_5.dll
2012-06-09 18:40 . 2009-09-04 15:29    453456    ----a-w-    c:\windows\system32\d3dx10_42.dll
2012-06-09 18:40 . 2006-11-29 11:06    3426072    ----a-w-    c:\windows\system32\d3dx9_32.dll
2012-06-09 18:39 . 2010-01-09 06:52    132608    ----a-w-    c:\windows\system32\cabview.dll
2012-06-09 18:38 . 2012-06-10 14:16    --------    d-----w-    c:\program files\Microsoft Silverlight
2012-06-09 18:37 . 2010-08-11 04:44    2983424    ----a-w-    c:\windows\system32\UIRibbon.dll
2012-06-09 18:37 . 2010-08-11 04:35    1164800    ----a-w-    c:\windows\system32\UIRibbonRes.dll
2012-06-09 18:32 . 2010-05-23 10:11    196608    ----a-w-    c:\windows\system32\mfreadwrite.dll
2012-06-09 18:32 . 2010-05-23 10:15    1619456    ----a-w-    c:\windows\system32\WMVDECOD.DLL
2012-06-09 18:32 . 2010-05-23 10:11    3181568    ----a-w-    c:\windows\system32\mf.dll
2012-06-09 17:56 . 2012-06-09 17:56    --------    d-----w-    c:\programdata\InterAction studios
2012-06-09 17:38 . 2012-06-12 06:58    --------    d-----w-    c:\users\GM\AppData\Local\Windows Live
2012-06-09 17:38 . 2012-06-09 17:38    --------    d-----w-    c:\program files\Common Files\Windows Live
2012-06-09 17:34 . 2012-06-10 08:30    --------    d-----w-    c:\programdata\AVG Secure Search
2012-06-09 17:34 . 2012-06-10 08:30    --------    d-----w-    c:\program files\Common Files\AVG Secure Search
2012-06-09 17:34 . 2012-06-10 08:30    --------    d-----w-    c:\program files\AVG Secure Search
2012-06-09 16:35 . 2012-06-09 16:35    --------    d-----w-    c:\windows\system32\Lang
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-09 18:41 . 2011-03-28 16:36    19736    ----a-w-    c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2012-04-19 02:50 . 2012-04-19 02:50    24896    ----a-w-    c:\windows\system32\drivers\avgidshx.sys
2012-03-19 03:17 . 2012-03-19 03:17    301248    ----a-w-    c:\windows\system32\drivers\avgtdix.sys
.
.
(((((((((((((((((((((((((((((((((((((   Punti Reg Caricati   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2012-06-10 08:29    2068536    ----a-w-    c:\program files\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll" [2012-06-10 2068536]
.
[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccleaner"="c:\program files\CCleaner\ccleaner.exe" [2010-07-23 1755960]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2012-06-10 880496]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-12-19 16062464]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-21 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2012-04-05 2587008]
"vProt"="c:\program files\AVG Secure Search\vprot.exe" [2012-06-10 1104440]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.0.207\SSScheduler.exe [2011-6-17 272528]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute    REG_MULTI_SZ       autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages    REG_MULTI_SZ       kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\avgidsagent.exe [2012-04-30 5106744]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG10\Toolbar\ToolbarBroker.exe [2011-11-10 167264]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.0.207\McCHSvc.exe [2011-06-17 237008]
R3 WatAdminSvc;Servizio Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2012-06-09 1343400]
S0 AVGIDSHX;AVGIDSHX;c:\windows\system32\DRIVERS\avgidshx.sys [2012-04-19 24896]
S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [2012-01-31 31952]
S1 Avgfwfd;AVG network filter service;c:\windows\system32\DRIVERS\avgfwd6x.sys [2011-05-22 47968]
S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [2012-02-22 235216]
S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [2012-03-19 301248]
S2 avgfws;AVG Firewall;c:\program files\AVG\AVG2012\avgfws.exe [2012-03-23 2321520]
S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [2012-02-14 193288]
S2 vToolbarUpdater11.1.0;vToolbarUpdater11.1.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\11.1.0\ToolbarUpdater.exe [2012-06-10 935480]
S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdriverx.sys [2011-12-23 139856]
S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\avgidsfilterx.sys [2011-12-23 24144]
S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\avgidsshimx.sys [2011-12-23 17232]
S3 yukonw7;Driver miniport NDIS6.2 per controller Ethernet Marvell Yukon;c:\windows\system32\DRIVERS\yk62x86.sys [2009-07-13 311296]
.
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
TCP: Interfaces\{CCA6DC43-77E0-4026-AC87-7F100BECA733}: DhcpNameServer = 192.168.0.1
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\11.1.0\ViProtocol.dll
FF - ProfilePath - c:\users\GM\AppData\Roaming\Mozilla\Firefox\Profiles\4s1fob9y.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - www.virgilio.it
FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7B483a1347-a851-48fb-86db-c95cf4fef151%7D&mid=1ae87b56d9314842b973dd0619525f12-731045572bf46aa7e679ba2b87c0664067ed7a66&ds=AVG&v=11.1.0.7&lang=it&pr=pr&d=2012-06-10%2010%3A30%3A00&sap=ku&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: IMinent Toolbar: {C9B68337-E93A-44EA-94DC-CB300EC06444} - %profile%\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}
FF - Ext: AVG Security Toolbar: avg@toolbar - c:\programdata\AVG Secure Search\11.1.0.7
FF - Ext: AVG Safe Search: {1E73965B-8B48-48be-9C8D-68B920ABC1C4} - c:\program files\AVG\AVG2012\Firefox4
FF - Ext: AVG Do Not Track: {F53C93F1-07D5-430c-86D4-C9531B27DFAF} - c:\program files\AVG\AVG2012\Firefox\DoNotTrack
.
- - - - CHIAVI ORFANE RIMOSSE - - - -
.
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
HKLM-Run-WinampAgent - c:\program files\Winamp\winampa.exe
.
.
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Ora fine scansione: 2012-06-12  15:58:48
ComboFix-quarantined-files.txt  2012-06-12 13:58
.
Pre-Run: 185.669.394.432 byte disponibili
Post-Run: 185.598.169.088 byte disponibili
.
- - End Of File - - 6B639DAE0E3286B06C9C52D46964BCE3


[homerino85]

Nessuno che mi puo aiutare per favore?