stavo leggendo un quotidiano on line e nel caricarire una pagina qualcosa ha messo fuori uso sia Avira che Malwarebytes, mi si è aperta una finestra, non so quale, nel mio pc dove apparivano entrambe le icone dei miei antivirus (che non se ne sono neppure accorti, infatti non hanno rilevato nulla), e si è istallato da solo qualcosa, io vedevo al centro del monitor le barrette verdi di caricamento. Ho immediatamente staccato la connesione togliendo il filo, anche se penso non serva a nulla, intanto l'istallazione si è completata e il pc si è spento. L'ho riacceso ed è ripartito normalmente. Non sapendo cosa fare, avevo paura a riconnettermi per contattarvi, (paura ingiustificata, si lo so da sola
). Avevo combofix su una chiavetta e l'ho fatto partire.Non ho mai fatto nulla senza prima un vostro consiglio e supporto che sono sempre stati per me preziosissimi ma ho pensato che fosse la cosa migliore da farsi.
Se qualcuno vuole dare un'occhiata al report lo ringrazio moltissimo.
- Codice: Seleziona tutto
ComboFix 12-05-22.02 - Roberta 22/05/2012 22.23.52.16.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.39.1040.18.1790.1203 [GMT 2:00]
Eseguito da: c:\documents and settings\Roberta\Desktop\abc.exe
AV: AntiVir Desktop *Disabled/Outdated* {0012F2B4-5CE9-7C92-0300-000000000000}
AV: Avira Desktop *Disabled/Updated* {11638345-E4FC-4BEE-BB73-EC754659C5F6}
FW: FireWall *Disabled* {11638345-E4FC-4BEE-BB73-EC754659C5F6}
.
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\avisynth.dll
c:\windows\system32\devil.dll
.
.
((((((((((((((((((((((((( Files Creati Da 2012-04-22 al 2012-05-22 )))))))))))))))))))))))))))))))))))
.
.
2012-05-17 20:18 . 2012-05-17 20:18 -------- d-----w- c:\documents and settings\Roberta\Dati applicazioni\SUPERAntiSpyware.com
2012-05-17 20:17 . 2012-05-17 20:17 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\SUPERAntiSpyware.com
2012-05-17 20:12 . 2012-05-17 20:12 -------- d-----w- c:\programmi\VS Revo Group
2012-05-13 08:29 . 2012-05-13 08:29 -------- d-----w- c:\documents and settings\Roberta\Dati applicazioni\DVDFab
2012-05-13 07:13 . 2012-05-13 07:13 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\dvdfab
2012-05-13 07:05 . 2012-05-13 07:05 -------- d-----w- c:\programmi\DVDFab 8 Qt
2012-05-07 18:49 . 2012-05-07 18:49 -------- d-----w- c:\programmi\Fastweb
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-04 20:39 . 2012-04-09 20:50 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-05-04 20:39 . 2012-04-09 20:50 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-04-25 10:32 . 2010-04-18 10:31 250880 ----a-w- c:\windows\system32\GSService.exe
2012-04-11 13:51 . 2008-04-13 18:55 2030080 ------w- c:\windows\system32\ntkrnlpa.exe
2012-04-11 13:51 . 2008-05-16 22:36 1862272 ----a-w- c:\windows\system32\win32k.sys
2012-04-11 13:51 . 2008-05-16 22:36 2151936 ------w- c:\windows\system32\ntoskrnl.exe
2012-04-04 13:56 . 2010-12-21 16:40 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-03-14 20:01 . 2012-03-14 20:02 73728 ----a-w- c:\windows\system32\javacpl.cpl
2012-03-14 20:01 . 2010-12-29 11:24 472808 ----a-w- c:\windows\system32\deployJava1.dll
2012-03-01 11:00 . 2008-05-16 22:36 916992 ----a-w- c:\windows\system32\wininet.dll
2012-03-01 11:00 . 2008-05-16 22:36 43520 ----a-w- c:\windows\system32\licmgr10.dll
2012-03-01 11:00 . 2008-05-16 22:36 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2012-02-29 14:10 . 2008-05-16 22:36 177664 ----a-w- c:\windows\system32\wintrust.dll
2012-02-29 14:10 . 2008-05-16 22:36 148480 ----a-w- c:\windows\system32\imagehlp.dll
2012-02-29 12:17 . 2008-05-16 22:36 385024 ----a-w- c:\windows\system32\html.iec
.
.
((((((((((((((((((((((((((((( SnapShot_2012-05-12_07.19.35 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-05-22 20:13 . 2012-05-22 20:13 16384 c:\windows\temp\Perflib_Perfdata_32c.dat
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-01-26 8491008]
"QuickTime Task"="c:\programmi\QuickTime\qttask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\programmi\iTunes\iTunesHelper.exe" [2011-06-07 421160]
"Adobe ARM"="c:\programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"Malwarebytes' Anti-Malware"="c:\programmi\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
"avgnt"="c:\programmi\Avira\AntiVir Desktop\avgnt.exe" [2012-01-25 258512]
"SunJavaUpdateSched"="c:\programmi\File comuni\Java\Java Update\jusched.exe" [2012-01-18 254696]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\InterVideo\\DVD7\\WinDVD.exe"=
"c:\\Programmi\\File comuni\\Nero\\Nero Web\\SetupX.exe"=
"c:\\Programmi\\eMule AdunanzA\\eMule_AdnzA.exe"=
"c:\\Programmi\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Programmi\\Bonjour\\mDNSResponder.exe"=
"c:\\Programmi\\iTunes\\iTunes.exe"=
"c:\\Programmi\\RipTiger\\RipTiger.exe"=
"c:\\Programmi\\RipTiger\\HTTPDownloaderApp.exe"=
"c:\\Programmi\\RipTiger\\RTMPDownloaderApp.exe"=
"c:\\Programmi\\RipTiger\\VideoDownloadApp_RTMP.exe"=
"c:\\Programmi\\RipTiger\\MMSDownloaderApp.exe"=
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [23/03/2011 15.28.16 717296]
R1 avfwot;avfwot;c:\windows\system32\drivers\avfwot.sys [25/01/2012 13.15.45 111160]
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [25/01/2012 13.15.46 36000]
R2 AntiVirFirewallService;Avira FireWall;c:\programmi\Avira\AntiVir Desktop\avfwsvc.exe [25/01/2012 13.15.45 616400]
R2 AntiVirMailService;Avira Mail Protection;c:\programmi\Avira\AntiVir Desktop\avmailc.exe [25/01/2012 13.15.46 342480]
R2 AntiVirSchedulerService;Avira Pianificatore;c:\programmi\Avira\AntiVir Desktop\sched.exe [25/01/2012 13.15.48 86224]
R2 AntiVirWebService;Avira Web Protection;c:\programmi\Avira\AntiVir Desktop\avwebgrd.exe [25/01/2012 13.15.46 463824]
R2 MBAMService;MBAMService;c:\programmi\Malwarebytes' Anti-Malware\mbamservice.exe [21/12/2010 18.40.53 654408]
R2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [16/07/2010 2.45.44 35088]
R3 avfwim;AvFw Packet Filter Miniport;c:\windows\system32\drivers\avfwim.sys [25/01/2012 13.15.45 91096]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [21/12/2010 18.40.48 22344]
R3 pcouffin;VSO Software pcouffin;c:\windows\system32\drivers\pcouffin.sys [10/04/2010 23.13.33 47360]
S2 gupdate;Servizio di Google Update (gupdate);c:\programmi\Google\Update\GoogleUpdate.exe [07/04/2010 11.31.57 136176]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [09/04/2012 22.50.18 257696]
S3 GSService;GSService;c:\windows\system32\GSService.exe [18/04/2010 12.31.54 250880]
S3 gupdatem;Servizio Google Update (gupdatem);c:\programmi\Google\Update\GoogleUpdate.exe [07/04/2010 11.31.57 136176]
.
Contenuto della cartella 'Scheduled Tasks'
.
2012-05-22 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-09 20:39]
.
2012-04-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programmi\Apple Software Update\SoftwareUpdate.exe [2011-06-01 15:57]
.
2012-05-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2010-04-07 19:22]
.
2012-05-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2010-04-07 19:22]
.
2012-05-22 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 13:07]
.
2012-05-22 c:\windows\Tasks\User_Feed_Synchronization-{B231C5D4-29AB-456F-AE9A-25E1ADE2C378}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.fastweb.it/portale/
uInternet Settings,ProxyOverride = *.local
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
LSP: c:\programmi\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 83.103.25.250 62.101.93.101
TCP: Interfaces\{2C327EF4-1974-4A9C-A032-DD6EE4B2C52D}: DhcpNameServer = 83.103.25.250 62.101.93.101
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-05-22 22:31
Windows 5.1.2600 Service Pack 3 NTFS
.
scansione processi nascosti ...
.
scansione entrate autostart nascoste ...
.
Scansione files nascosti ...
.
Scansione completata con successo
Files nascosti: 0
.
**************************************************************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•9~*]
"0140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------
.
- - - - - - - > 'lsass.exe'(1188)
c:\programmi\Avira\AntiVir Desktop\avsda.dll
.
Ora fine scansione: 2012-05-22 22:33:29
ComboFix-quarantined-files.txt 2012-05-22 20:33
ComboFix2.txt 2012-05-12 07:27
ComboFix3.txt 2012-04-27 10:15
ComboFix4.txt 2012-02-04 07:20
ComboFix5.txt 2012-05-22 20:21
.
Pre-Run: 21.339.672.576 byte disponibili
Post-Run: 21.773.815.808 byte disponibili
.
- - End Of File - - FD6D684CB8663CA0B086FAF7991A8A06