Non riesco ad accedere ai siti degli antivirus

[toreLELLA]

Salve a tutti... Allora: ho il vago sospetto di avere un bel virusozzo nel mio pc: non mi fa aggiornare AVG e non mi consente l'ingresso nei siti di altri antivirus o di scansioni online. AVG, ovviamente, non rileva nessun problema.
Spybot rileva 3 cookie traccianti: DoubleClick, WebTrendsLIve e Statcounter.
Questo è il log di HijacKThis (che però parrebbe pulito):

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11.34.06, on 05/01/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Programmi\PrevxCSI\prevxcsi.exe
C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\PrevxCSI\prevxcsi.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Programmi\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Programmi\Analog Devices\SoundMAX\Smax4.exe
C:\Programmi\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Programmi\HP\HP Software Update\HPWuSchd.exe
C:\ImageMate CompactFlash USB\SandIcon.Exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE
C:\Programmi\iTunes\iTunesHelper.exe
C:\Programmi\QuickTime\qttask.exe
C:\Programmi\HP\hpcoretech\hpcmpmgr.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
C:\Programmi\OpenOffice.org 2.0\program\soffice.exe
C:\Programmi\OpenOffice.org 2.0\program\soffice.BIN
C:\WINDOWS\system32\HPZipm12.exe
C:\Programmi\MSN Messenger\usnsvc.exe
C:\Programmi\eMule\emule.exe
C:\Programmi\Spybot - Search & Destroy\SpybotSD.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\DOCUME~1\PROPRI~1\IMPOST~1\Temp\Directory temporanea 7 per HiJackThis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.it/0SEITIT/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.utenti.lycos.it/salvatorebonesu/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.it/0SEITIT/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn0\yt.dll (file missing)
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Programmi\Yahoo!\Companion\Installs\cpn0\yt.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programmi\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Programmi\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (file missing)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn0\yt.dll (file missing)
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Programmi\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Programmi\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [RemoteControl] "C:\Programmi\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Programmi\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [SandIcon] C:\ImageMate CompactFlash USB\SandIcon.Exe
O4 - HKLM\..\Run: [EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE /P30 "EPSON Stylus Photo R300 Series" /O6 "USB002" /M "Stylus Photo R300"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Component Manager] "C:\Programmi\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [CnxTrApp] rundll32.exe "C:\Programmi\StarModem\StarModem USB Network\CnxTrApp.dll",AppEntry -REG "Conexant\Conexant USB Network"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [updateMgr] C:\Programmi\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2009] C:\Programmi\Uniblue\RegistryBooster\RegistryBooster.exe /S
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Programmi\OpenOffice.org 2.0\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Programmi\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan ... stubie.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programmi\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftup ... 4930659531
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 4930644422
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programmi\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Programmi\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: CSIScanner - Prevx - C:\Programmi\PrevxCSI\prevxcsi.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 10347 bytes

Suggerimenti?? AIUTO!

[Luke57]

Ciao, scarica sul desktop
http://www.suspectfile.com/systemscan
aprilo ed assicurati che tutte le opzioni siano spuntate, clicca su "Scan Now" al termine della scansione verranno rilasciati (sempre sul desktop all'interno della cartella suspectfile) due file. Allega il file con estensione .zip nella tua prossima risposta.

Ricordati d'effettuare la scansione senza connessione attiva e con l'antivirus disabilitato salvo poi riattivarlo a scansione terminata.

NB
la durata della scansione può risultare lunga, potrebbe addirittura sembrare che il programma non stia lavorando, non preoccuparti non è così

[toreLELLA]

Allora, effettivamente ci ha messo un bel po
Eccoti l'allegato

[Luke57]

Ciao, non ho trovato niente, scarica combofix sul desktop
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
devi rinominare il file prima di salvarlo sul desktop in abc.exe
(per rinominare il file, quando lo scarichi ti chiede dove salvarlo e ti compare la casella "nome file" ,basta che cambi il nome che ti appare in abc.exe)
Fatto questo, clicca su start>esegui, nel box bianco copia e incolla questo comando, virgolette comprese:

"%userprofile%\desktop\abc.exe" /killall

Premi OK, se tutto va bene parte il programma che potrebbe impiegare molto (non fare altre manovre durante la scansione),una volta terminata, se tutto è andato bene, in C:\ dovresti trovare il file combofix.txt , riavvia in modalità normale e posta il contenuto del file o allegalo.

[toreLELLA]

Allora, Luke, fatto. Eccoti l'allegato e grazie mille per la tua disponibilità

[Luke57]

Ciao, apri un file di testo con il blocco note, incollaci il seguente testo:

Codice: Seleziona tutto

File::
c:\windows\system32\ptnrtg.dll

Registry::
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\emwlol]

SALVA IL FILE DI TESTO NELLA STESSA DIREZIONE DI COMBOFIX, chiamandolo obbligatoriamente CFScript.txt
trascinalo con il puntatore del mouse sull'icona di combofix. Il programma avvierà una nuova scansione. Al termine riavvia il computer ed allega il nuovo report (C:\combofix.txt).

[toreLELLA]

Allora Luke, vediamo cosa è venuto fuori

[Luke57]

Ciao, il servizio è stato eliminato, la situazione è migliorata?

[toreLELLA]

SI! Tu sei un genio ed io devo farti un monumento!

[mldctm]

SI! Tu sei un genio ed io devo farti un monumento!

Ciao a tutti,

ho registrato anche io il problema che è stato segnalato sul vostro forum qualche tempo fa. Nessun antivirus nè antispyware registrano anomalie al mio sistema durante la scansione tuttavia la connessione a questi siti appare bloccata, pur riuscendo a navigare su tutti gli altri. Non ho installato nessun firewall e non ho alcuna impostazione di sicurezza personalizzata.

Dunque, dopo avere eseguito le istruzioni in risposta all'utente vengo ad allegarvi il log di combofix :

-------------------

ComboFix 08-08-19.06 - Mauro 2008-08-21 2:35:44.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1040.18.133 [GMT 2:00]
Eseguito da: C:\Documents and Settings\Mauro\Desktop\ComboFix.exe
* Creato nuovo punto di ripristino

ATENÇÃO - ESTA MAQUINA NAO TEM A CONSOLE DE RECUPERAÇÃO INSTALADA !!
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Mauro\Impostazioni locali\Dati applicazioni\bnbnzn.dat
C:\Documents and Settings\Mauro\Impostazioni locali\Dati applicazioni\bnbnzn.exe
C:\Documents and Settings\Mauro\Impostazioni locali\Dati applicazioni\bnbnzn_nav.dat
C:\Documents and Settings\Mauro\Impostazioni locali\Dati applicazioni\bnbnzn_navps.dat

.
((((((((((((((((((((((((( Files Creati Da 2008-07-21 al 2008-08-21 )))))))))))))))))))))))))))))))))))
.

2008-08-19 13:54 . 2008-08-19 13:54 85 --a------ C:\WINDOWS\wininit.ini
2008-08-17 15:26 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll
2008-08-17 15:26 . 2007-07-30 19:19 38,232 --a------ C:\WINDOWS\system32\wucltui.dll.mui
2008-08-17 15:26 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
2008-08-17 15:26 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2008-08-17 15:26 . 2007-07-30 19:18 21,336 --a------ C:\WINDOWS\system32\wuaueng.dll.mui
2008-08-17 13:43 . 2008-08-17 13:43 268 --ah----- C:\sqmdata19.sqm
2008-08-17 13:43 . 2008-08-17 13:43 244 --ah----- C:\sqmnoopt19.sqm
2008-08-16 14:33 . 2008-08-16 14:33 268 --ah----- C:\sqmdata18.sqm
2008-08-16 14:33 . 2008-08-16 14:33 244 --ah----- C:\sqmnoopt18.sqm
2008-08-14 10:00 . 2008-08-14 10:00 268 --ah----- C:\sqmdata17.sqm
2008-08-14 10:00 . 2008-08-14 10:00 244 --ah----- C:\sqmnoopt17.sqm
2008-08-12 12:54 . 2008-08-12 12:54 268 --ah----- C:\sqmdata16.sqm
2008-08-12 12:54 . 2008-08-12 12:54 244 --ah----- C:\sqmnoopt16.sqm
2008-08-12 12:51 . 2008-08-12 12:51 268 --ah----- C:\sqmdata15.sqm
2008-08-12 12:51 . 2008-08-12 12:51 244 --ah----- C:\sqmnoopt15.sqm
2008-08-11 22:55 . 2008-08-11 22:55 268 --ah----- C:\sqmdata14.sqm
2008-08-11 22:55 . 2008-08-11 22:55 244 --ah----- C:\sqmnoopt14.sqm
2008-08-10 17:44 . 2008-08-10 17:44 <DIR> d-------- C:\Programmi\File comuni\Wise Installation Wizard
2008-08-03 14:02 . 2008-08-03 14:02 268 --ah----- C:\sqmdata13.sqm
2008-08-03 14:02 . 2008-08-03 14:02 244 --ah----- C:\sqmnoopt13.sqm
2008-08-03 13:53 . 2008-08-14 10:02 <DIR> d-------- C:\Documents and Settings\Mauro\Contacts
2008-08-03 13:53 . 2008-08-03 13:53 268 --ah----- C:\sqmdata12.sqm
2008-08-03 13:53 . 2008-08-03 13:53 244 --ah----- C:\sqmnoopt12.sqm
2008-08-03 12:45 . 2008-08-03 12:45 0 --a------ C:\WINDOWS\nsreg.dat
2008-08-03 12:39 . 2008-08-03 12:39 169 --a------ C:\WINDOWS\RtlRack.ini
2008-08-02 19:56 . 2008-08-02 19:56 268 --ah----- C:\sqmdata11.sqm
2008-08-02 19:56 . 2008-08-02 19:56 244 --ah----- C:\sqmnoopt11.sqm
2008-08-02 19:24 . 2008-08-02 19:24 268 --ah----- C:\sqmdata10.sqm
2008-08-02 19:24 . 2008-08-02 19:24 244 --ah----- C:\sqmnoopt10.sqm
2008-08-02 13:09 . 2008-08-02 13:09 268 --ah----- C:\sqmdata09.sqm
2008-08-02 13:08 . 2008-08-02 13:08 244 --ah----- C:\sqmnoopt09.sqm
2008-08-01 17:05 . 2008-08-01 17:05 268 --ah----- C:\sqmdata08.sqm
2008-08-01 17:05 . 2008-08-01 17:05 244 --ah----- C:\sqmnoopt08.sqm
2008-08-01 17:02 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-08-01 17:02 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-08-01 15:05 . 2008-08-01 15:05 268 --ah----- C:\sqmdata07.sqm
2008-08-01 15:05 . 2008-08-01 15:05 244 --ah----- C:\sqmnoopt07.sqm
2008-08-01 14:09 . 2008-08-01 14:09 268 --ah----- C:\sqmdata06.sqm
2008-08-01 14:09 . 2008-08-01 14:09 244 --ah----- C:\sqmnoopt06.sqm
2008-08-01 14:04 . 2008-08-01 14:04 <DIR> d---s---- C:\Documents and Settings\Mauro\UserData
2008-08-01 14:00 . 2008-08-01 14:00 268 --ah----- C:\sqmdata05.sqm
2008-08-01 14:00 . 2008-08-01 14:00 244 --ah----- C:\sqmnoopt05.sqm
2008-08-01 13:59 . 2008-08-01 13:59 <DIR> d-------- C:\Programmi\Aethra
2008-08-01 13:59 . 2004-04-20 17:24 52,864 --a------ C:\WINDOWS\system32\drivers\CnxTrUsb.sys
2008-08-01 13:59 . 2004-04-20 17:24 25,984 --a------ C:\WINDOWS\system32\drivers\CnxTrLan.sys
2008-08-01 13:58 . 2008-08-01 13:58 <DIR> d-------- C:\WINDOWS\Motive
2008-08-01 13:58 . 2008-08-01 13:58 <DIR> d-------- C:\Programmi\Motive
2008-08-01 13:58 . 2008-08-01 13:58 <DIR> d-------- C:\Programmi\Common Files
2008-08-01 13:57 . 2008-08-01 13:59 <DIR> d-------- C:\Programmi\Alice ti aiuta
2008-08-01 13:56 . 2008-08-01 13:56 <DIR> d-------- C:\Programmi\Telecom Italia
2008-07-31 15:55 . 2008-07-31 15:55 268 --ah----- C:\sqmdata04.sqm
2008-07-31 15:55 . 2008-07-31 15:55 244 --ah----- C:\sqmnoopt04.sqm
2008-07-31 14:46 . 2008-07-31 14:46 268 --ah----- C:\sqmdata03.sqm
2008-07-31 14:46 . 2008-07-31 14:46 244 --ah----- C:\sqmnoopt03.sqm
2008-07-30 18:30 . 2008-07-30 18:30 268 --ah----- C:\sqmdata02.sqm
2008-07-30 18:30 . 2008-07-30 18:30 244 --ah----- C:\sqmnoopt02.sqm
2008-07-30 12:48 . 2008-07-30 12:48 268 --ah----- C:\sqmdata01.sqm
2008-07-30 12:48 . 2008-07-30 12:48 244 --ah----- C:\sqmnoopt01.sqm
2008-07-29 19:51 . 2008-08-18 12:41 268 --ah----- C:\sqmdata00.sqm
2008-07-29 19:51 . 2008-08-18 12:41 244 --ah----- C:\sqmnoopt00.sqm
2008-07-29 19:50 . 2008-08-18 13:33 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-07-29 04:13 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-07-29 04:13 . 2004-08-03 23:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-07-29 04:13 . 2004-08-19 15:39 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2008-07-29 04:13 . 2004-08-19 15:39 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll
2008-07-29 04:13 . 2004-08-19 15:30 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
2008-07-29 04:13 . 2004-08-19 15:30 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys
2008-07-28 21:24 . 2008-07-28 21:24 <DIR> d-------- C:\Programmi\CCleaner
2008-07-28 20:50 . 2008-08-21 01:14 <DIR> d-------- C:\Programmi\Spybot - Search & Destroy
2008-07-28 20:50 . 2008-08-10 17:56 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Spybot - Search & Destroy
2008-07-28 20:19 . 2008-07-28 20:19 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\nView_Profiles
2008-07-28 19:52 . 2008-07-28 19:52 <DIR> d-------- C:\Documents and Settings\Mauro\Dati applicazioni\vlc
2008-07-28 15:43 . 2008-07-28 15:52 151 --a------ C:\WINDOWS\PhotoSnapViewer.INI
2008-07-28 15:14 . 2008-08-19 16:39 116 --a------ C:\WINDOWS\NeroDigital.ini
2008-07-28 15:10 . 2001-08-30 20:41 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2008-07-28 15:10 . 2001-08-17 22:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2008-07-28 14:01 . 2008-07-28 15:14 <DIR> d-------- C:\Documents and Settings\Mauro\Dati applicazioni\Ahead
2008-07-28 13:58 . 2008-07-28 13:58 <DIR> d-------- C:\Programmi\Nero
2008-07-28 13:58 . 2008-07-28 13:58 <DIR> d-------- C:\Programmi\File comuni\Ahead
2008-07-26 01:19 . 2008-07-26 01:19 <DIR> d-------- C:\Programmi\Alwil Software
2008-07-26 01:09 . 2008-08-10 17:44 <DIR> d-------- C:\Programmi\Lavasoft
2008-07-26 01:09 . 2008-08-10 17:43 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Lavasoft
2008-07-26 01:06 . 2008-07-26 01:06 <DIR> d-------- C:\Programmi\DVD Decrypter
2008-07-26 01:05 . 2003-06-18 17:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2008-07-26 01:05 . 2008-07-26 01:05 376 --a------ C:\WINDOWS\ODBC.INI
2008-07-26 01:04 . 2008-07-26 01:04 <DIR> d-------- C:\Programmi\VideoLAN
2008-07-26 01:04 . 2008-07-26 01:04 <DIR> d-------- C:\Programmi\Microsoft.NET
2008-07-26 01:03 . 2008-07-26 01:03 <DIR> d-------- C:\Programmi\Microsoft ActiveSync
2008-07-26 01:02 . 2008-07-26 01:04 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-07-26 00:58 . 2008-08-21 00:33 <DIR> d-------- C:\Programmi\eMule
2008-07-26 00:58 . 2008-07-26 00:58 <DIR> d-------- C:\Programmi\DVD Shrink
2008-07-26 00:58 . 2008-07-26 00:58 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\DVD Shrink
2008-07-26 00:57 . 2008-07-26 00:57 <DIR> d-------- C:\WINDOWS\system32\Adobe
2008-07-26 00:57 . 2008-07-26 00:57 <DIR> d-------- C:\WINDOWS\Profiles
2008-07-26 00:57 . 2008-08-11 22:16 <DIR> d-------- C:\Programmi\File comuni\Adobe
2008-07-26 00:57 . 2008-07-26 00:57 <DIR> d-------- C:\Documents and Settings\Mauro\Dati applicazioni\InterTrust
2008-07-26 00:57 . 1998-11-13 12:07 307,712 --a------ C:\WINDOWS\IsUn0410.exe
2008-07-26 00:56 . 2008-07-29 17:43 <DIR> d-------- C:\Programmi\SlySoft
2008-07-26 00:56 . 2008-07-29 17:44 <DIR> d-------- C:\Programmi\Elaborate Bytes
2008-07-26 00:55 . 2002-05-06 12:01 45,056 --a------ C:\WINDOWS\system32\WNASPI32.DLL
2008-07-26 00:55 . 2002-05-06 12:01 17,005 --a------ C:\WINDOWS\system32\drivers\ASPI32.SYS
2008-07-26 00:55 . 2001-04-19 18:34 5,600 --a------ C:\WINDOWS\system\WINASPI.DLL
2008-07-26 00:55 . 2001-04-19 18:34 4,672 --a------ C:\WINDOWS\system\WOWPOST.EXE
2008-07-26 00:53 . 2008-07-26 00:53 <DIR> d-------- C:\totalcmd
2008-07-26 00:53 . 2008-07-28 20:47 1,562 --a------ C:\WINDOWS\wincmd.ini
2008-07-26 00:53 . 2004-04-16 06:03 545 --a------ C:\WINDOWS\UC.PIF
2008-07-26 00:53 . 2004-04-16 06:03 545 --a------ C:\WINDOWS\RAR.PIF
2008-07-26 00:53 . 2004-04-16 06:03 545 --a------ C:\WINDOWS\PKZIP.PIF
2008-07-26 00:53 . 2004-04-16 06:03 545 --a------ C:\WINDOWS\PKUNZIP.PIF
2008-07-26 00:53 . 2004-04-16 06:03 545 --a------ C:\WINDOWS\NOCLOSE.PIF
2008-07-26 00:53 . 2004-04-16 06:03 545 --a------ C:\WINDOWS\LHA.PIF
2008-07-26 00:53 . 2004-04-16 06:03 545 --a------ C:\WINDOWS\ARJ.PIF
2008-07-26 00:48 . 2008-07-26 00:48 <DIR> d-------- C:\Documents and Settings\LocalService\Menu Avvio
2008-07-26 00:47 . 2008-07-26 00:47 <DIR> d---s---- C:\WINDOWS\system32\Microsoft
2008-07-26 00:39 . 2008-07-26 00:49 316,640 --a------ C:\WINDOWS\WMSysPr9.prx
2008-07-26 00:37 . 2004-08-19 17:14 141,702 --a--c--- C:\WINDOWS\system32\dllcache\netfx.cat
2008-07-26 00:35 . 2008-07-26 00:35 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-07-26 00:30 . 2004-07-17 11:40 19,528 --a------ C:\WINDOWS\002248_.tmp
2008-07-26 00:30 . 2004-08-03 22:43 15,872 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-07-26 00:27 . 2008-07-26 00:38 <DIR> d-------- C:\WINDOWS\EHome
2008-07-26 00:17 . 2008-07-26 00:17 <DIR> d-------- C:\Programmi\AMD
2008-07-26 00:17 . 2005-03-09 15:53 43,008 --a------ C:\WINDOWS\system32\drivers\AmdK8.sys
2008-07-26 00:17 . 2008-08-21 01:53 39,291 --a------ C:\WINDOWS\system32\nvapps.xml
2008-07-26 00:16 . 2008-07-26 00:20 <DIR> d-------- C:\WINDOWS\nview

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-01 11:57 155,995 ----a-w C:\WINDOWS\java\Packages\UIDJ9F53.ZIP
2008-07-25 14:25 --------- d-----w C:\Programmi\microsoft frontpage
2008-07-25 14:23 --------- d-----w C:\Programmi\Servizi in linea
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15:39 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe" [2005-09-03 15:18 94208]
"SpybotSD TeaTimer"="C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 18:41 1832272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2005-10-10 15:49 7286784]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2005-10-10 15:49 86016]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 16:38 78008]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"CnxTrApp"="C:\Programmi\Aethra\ADSL EB1070 USB\CnxTrApp.dll" [2004-04-20 17:24 247296]
"SoundMan"="SOUNDMAN.EXE" [2005-09-22 10:42 90112 C:\WINDOWS\soundman.exe]
"nwiz"="nwiz.exe" [2005-10-10 15:49 1519616 C:\WINDOWS\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-19 15:39 15360]

C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Alice ti aiuta.lnk - C:\Programmi\Alice ti aiuta\bin\matcli.exe [2008-08-01 13:58:47 212992]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programmi\\eMule\\emule.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37]
S3 Bcfilter;Jetico Personal Firewall Network Monitor;C:\WINDOWS\system32\DRIVERS\bcfilter.sys []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{120f124c-6d34-11dd-aa9d-0009f37bbd8f}]
\Shell\Auto\command - bittorrent.exe e
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL bittorrent.exe e

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
- - - - ORFÃOS REMOVIDOS - - - -

HKCU-Run-MsnMsgr - C:\Programmi\MSN Messenger\MsnMsgr.Exe
HKCU-Run-bnbnzn - c:\documents and settings\mauro\impostazioni locali\dati applicazioni\bnbnzn.exe
HKLM-Run-NWEReboot - (no file)


.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Mauro\Dati applicazioni\Mozilla\Firefox\Profiles\aei1lg4u.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - www.google.it
FF -: plugin - C:\Programmi\Adobe\Acrobat 5.0\Reader\browser\nppdf32.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-21 02:37:50
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
Ora fine scansione: 2008-08-21 2:39:08
ComboFix-quarantined-files.txt 2008-08-21 00:39:05

Pre-Run: 2,684,375,040 byte disponibili
Post-Run: 2,677,805,056 byte disponibili

206
ComboFix 08-08-19.06 - Mauro 2008-08-21 19:31:26.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1040.18.176 [GMT 2:00]
Eseguito da: C:\Documents and Settings\Mauro\Desktop\Setup\ComboFix.exe

ATENÇÃO - ESTA MAQUINA NAO TEM A CONSOLE DE RECUPERAÇÃO INSTALADA !!
.

((((((((((((((((((((((((( Files Creati Da 2008-07-21 al 2008-08-21 )))))))))))))))))))))))))))))))))))
.

2008-08-19 13:54 . 2008-08-19 13:54 85 --a------ C:\WINDOWS\wininit.ini
2008-08-17 15:26 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll
2008-08-17 15:26 . 2007-07-30 19:19 38,232 --a------ C:\WINDOWS\system32\wucltui.dll.mui
2008-08-17 15:26 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
2008-08-17 15:26 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2008-08-17 15:26 . 2007-07-30 19:18 21,336 --a------ C:\WINDOWS\system32\wuaueng.dll.mui
2008-08-17 13:43 . 2008-08-17 13:43 268 --ah----- C:\sqmdata19.sqm
2008-08-17 13:43 . 2008-08-17 13:43 244 --ah----- C:\sqmnoopt19.sqm
2008-08-16 14:33 . 2008-08-16 14:33 268 --ah----- C:\sqmdata18.sqm
2008-08-16 14:33 . 2008-08-16 14:33 244 --ah----- C:\sqmnoopt18.sqm
2008-08-14 10:00 . 2008-08-14 10:00 268 --ah----- C:\sqmdata17.sqm
2008-08-14 10:00 . 2008-08-14 10:00 244 --ah----- C:\sqmnoopt17.sqm
2008-08-12 12:54 . 2008-08-12 12:54 268 --ah----- C:\sqmdata16.sqm
2008-08-12 12:54 . 2008-08-12 12:54 244 --ah----- C:\sqmnoopt16.sqm
2008-08-12 12:51 . 2008-08-12 12:51 268 --ah----- C:\sqmdata15.sqm
2008-08-12 12:51 . 2008-08-12 12:51 244 --ah----- C:\sqmnoopt15.sqm
2008-08-11 22:55 . 2008-08-11 22:55 268 --ah----- C:\sqmdata14.sqm
2008-08-11 22:55 . 2008-08-11 22:55 244 --ah----- C:\sqmnoopt14.sqm
2008-08-10 17:44 . 2008-08-10 17:44 <DIR> d-------- C:\Programmi\File comuni\Wise Installation Wizard
2008-08-03 14:02 . 2008-08-03 14:02 268 --ah----- C:\sqmdata13.sqm
2008-08-03 14:02 . 2008-08-03 14:02 244 --ah----- C:\sqmnoopt13.sqm
2008-08-03 13:53 . 2008-08-14 10:02 <DIR> d-------- C:\Documents and Settings\Mauro\Contacts
2008-08-03 13:53 . 2008-08-03 13:53 268 --ah----- C:\sqmdata12.sqm
2008-08-03 13:53 . 2008-08-03 13:53 244 --ah----- C:\sqmnoopt12.sqm
2008-08-03 12:45 . 2008-08-03 12:45 0 --a------ C:\WINDOWS\nsreg.dat
2008-08-03 12:39 . 2008-08-03 12:39 169 --a------ C:\WINDOWS\RtlRack.ini
2008-08-02 19:56 . 2008-08-02 19:56 268 --ah----- C:\sqmdata11.sqm
2008-08-02 19:56 . 2008-08-02 19:56 244 --ah----- C:\sqmnoopt11.sqm
2008-08-02 19:24 . 2008-08-02 19:24 268 --ah----- C:\sqmdata10.sqm
2008-08-02 19:24 . 2008-08-02 19:24 244 --ah----- C:\sqmnoopt10.sqm
2008-08-02 13:09 . 2008-08-02 13:09 268 --ah----- C:\sqmdata09.sqm
2008-08-02 13:08 . 2008-08-02 13:08 244 --ah----- C:\sqmnoopt09.sqm
2008-08-01 17:05 . 2008-08-01 17:05 268 --ah----- C:\sqmdata08.sqm
2008-08-01 17:05 . 2008-08-01 17:05 244 --ah----- C:\sqmnoopt08.sqm
2008-08-01 17:02 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-08-01 17:02 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-08-01 15:05 . 2008-08-01 15:05 268 --ah----- C:\sqmdata07.sqm
2008-08-01 15:05 . 2008-08-01 15:05 244 --ah----- C:\sqmnoopt07.sqm
2008-08-01 14:09 . 2008-08-01 14:09 268 --ah----- C:\sqmdata06.sqm
2008-08-01 14:09 . 2008-08-01 14:09 244 --ah----- C:\sqmnoopt06.sqm
2008-08-01 14:04 . 2008-08-01 14:04 <DIR> d---s---- C:\Documents and Settings\Mauro\UserData
2008-08-01 14:00 . 2008-08-01 14:00 268 --ah----- C:\sqmdata05.sqm
2008-08-01 14:00 . 2008-08-01 14:00 244 --ah----- C:\sqmnoopt05.sqm
2008-08-01 13:59 . 2008-08-01 13:59 <DIR> d-------- C:\Programmi\Aethra
2008-08-01 13:59 . 2004-04-20 17:24 52,864 --a------ C:\WINDOWS\system32\drivers\CnxTrUsb.sys
2008-08-01 13:59 . 2004-04-20 17:24 25,984 --a------ C:\WINDOWS\system32\drivers\CnxTrLan.sys
2008-08-01 13:58 . 2008-08-01 13:58 <DIR> d-------- C:\WINDOWS\Motive
2008-08-01 13:58 . 2008-08-01 13:58 <DIR> d-------- C:\Programmi\Motive
2008-08-01 13:58 . 2008-08-01 13:58 <DIR> d-------- C:\Programmi\Common Files
2008-08-01 13:57 . 2008-08-01 13:59 <DIR> d-------- C:\Programmi\Alice ti aiuta
2008-08-01 13:56 . 2008-08-01 13:56 <DIR> d-------- C:\Programmi\Telecom Italia
2008-07-31 15:55 . 2008-07-31 15:55 268 --ah----- C:\sqmdata04.sqm
2008-07-31 15:55 . 2008-07-31 15:55 244 --ah----- C:\sqmnoopt04.sqm
2008-07-31 14:46 . 2008-07-31 14:46 268 --ah----- C:\sqmdata03.sqm
2008-07-31 14:46 . 2008-07-31 14:46 244 --ah----- C:\sqmnoopt03.sqm
2008-07-30 18:30 . 2008-07-30 18:30 268 --ah----- C:\sqmdata02.sqm
2008-07-30 18:30 . 2008-07-30 18:30 244 --ah----- C:\sqmnoopt02.sqm
2008-07-30 12:48 . 2008-07-30 12:48 268 --ah----- C:\sqmdata01.sqm
2008-07-30 12:48 . 2008-07-30 12:48 244 --ah----- C:\sqmnoopt01.sqm
2008-07-29 19:51 . 2008-08-18 12:41 268 --ah----- C:\sqmdata00.sqm
2008-07-29 19:51 . 2008-08-18 12:41 244 --ah----- C:\sqmnoopt00.sqm
2008-07-29 19:50 . 2008-08-18 13:33 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-07-29 04:13 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-07-29 04:13 . 2004-08-03 23:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-07-29 04:13 . 2004-08-19 15:39 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2008-07-29 04:13 . 2004-08-19 15:39 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll
2008-07-29 04:13 . 2004-08-19 15:30 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
2008-07-29 04:13 . 2004-08-19 15:30 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys
2008-07-28 21:24 . 2008-07-28 21:24 <DIR> d-------- C:\Programmi\CCleaner
2008-07-28 20:50 . 2008-08-21 01:14 <DIR> d-------- C:\Programmi\Spybot - Search & Destroy
2008-07-28 20:50 . 2008-08-10 17:56 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Spybot - Search & Destroy
2008-07-28 20:19 . 2008-07-28 20:19 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\nView_Profiles
2008-07-28 19:52 . 2008-07-28 19:52 <DIR> d-------- C:\Documents and Settings\Mauro\Dati applicazioni\vlc
2008-07-28 15:43 . 2008-07-28 15:52 151 --a------ C:\WINDOWS\PhotoSnapViewer.INI
2008-07-28 15:14 . 2008-08-19 16:39 116 --a------ C:\WINDOWS\NeroDigital.ini
2008-07-28 15:10 . 2001-08-30 20:41 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2008-07-28 15:10 . 2001-08-17 22:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2008-07-28 14:01 . 2008-07-28 15:14 <DIR> d-------- C:\Documents and Settings\Mauro\Dati applicazioni\Ahead
2008-07-28 13:58 . 2008-07-28 13:58 <DIR> d-------- C:\Programmi\Nero
2008-07-28 13:58 . 2008-07-28 13:58 <DIR> d-------- C:\Programmi\File comuni\Ahead
2008-07-26 01:19 . 2008-07-26 01:19 <DIR> d-------- C:\Programmi\Alwil Software
2008-07-26 01:09 . 2008-08-10 17:44 <DIR> d-------- C:\Programmi\Lavasoft
2008-07-26 01:09 . 2008-08-10 17:43 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Lavasoft
2008-07-26 01:06 . 2008-07-26 01:06 <DIR> d-------- C:\Programmi\DVD Decrypter
2008-07-26 01:05 . 2003-06-18 17:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2008-07-26 01:05 . 2008-07-26 01:05 376 --a------ C:\WINDOWS\ODBC.INI
2008-07-26 01:04 . 2008-07-26 01:04 <DIR> d-------- C:\Programmi\VideoLAN
2008-07-26 01:04 . 2008-07-26 01:04 <DIR> d-------- C:\Programmi\Microsoft.NET
2008-07-26 01:03 . 2008-07-26 01:03 <DIR> d-------- C:\Programmi\Microsoft ActiveSync
2008-07-26 01:02 . 2008-07-26 01:04 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-07-26 00:58 . 2008-08-21 00:33 <DIR> d-------- C:\Programmi\eMule
2008-07-26 00:58 . 2008-07-26 00:58 <DIR> d-------- C:\Programmi\DVD Shrink
2008-07-26 00:58 . 2008-07-26 00:58 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\DVD Shrink
2008-07-26 00:57 . 2008-07-26 00:57 <DIR> d-------- C:\WINDOWS\system32\Adobe
2008-07-26 00:57 . 2008-07-26 00:57 <DIR> d-------- C:\WINDOWS\Profiles
2008-07-26 00:57 . 2008-08-11 22:16 <DIR> d-------- C:\Programmi\File comuni\Adobe
2008-07-26 00:57 . 2008-07-26 00:57 <DIR> d-------- C:\Documents and Settings\Mauro\Dati applicazioni\InterTrust
2008-07-26 00:57 . 1998-11-13 12:07 307,712 --a------ C:\WINDOWS\IsUn0410.exe
2008-07-26 00:56 . 2008-07-29 17:43 <DIR> d-------- C:\Programmi\SlySoft
2008-07-26 00:56 . 2008-07-29 17:44 <DIR> d-------- C:\Programmi\Elaborate Bytes
2008-07-26 00:55 . 2002-05-06 12:01 45,056 --a------ C:\WINDOWS\system32\WNASPI32.DLL
2008-07-26 00:55 . 2002-05-06 12:01 17,005 --a------ C:\WINDOWS\system32\drivers\ASPI32.SYS
2008-07-26 00:55 . 2001-04-19 18:34 5,600 --a------ C:\WINDOWS\system\WINASPI.DLL
2008-07-26 00:55 . 2001-04-19 18:34 4,672 --a------ C:\WINDOWS\system\WOWPOST.EXE
2008-07-26 00:53 . 2008-07-26 00:53 <DIR> d-------- C:\totalcmd
2008-07-26 00:53 . 2008-07-28 20:47 1,562 --a------ C:\WINDOWS\wincmd.ini
2008-07-26 00:53 . 2004-04-16 06:03 545 --a------ C:\WINDOWS\UC.PIF
2008-07-26 00:53 . 2004-04-16 06:03 545 --a------ C:\WINDOWS\RAR.PIF
2008-07-26 00:53 . 2004-04-16 06:03 545 --a------ C:\WINDOWS\PKZIP.PIF
2008-07-26 00:53 . 2004-04-16 06:03 545 --a------ C:\WINDOWS\PKUNZIP.PIF
2008-07-26 00:53 . 2004-04-16 06:03 545 --a------ C:\WINDOWS\NOCLOSE.PIF
2008-07-26 00:53 . 2004-04-16 06:03 545 --a------ C:\WINDOWS\LHA.PIF
2008-07-26 00:53 . 2004-04-16 06:03 545 --a------ C:\WINDOWS\ARJ.PIF
2008-07-26 00:48 . 2008-07-26 00:48 <DIR> d-------- C:\Documents and Settings\LocalService\Menu Avvio
2008-07-26 00:47 . 2008-07-26 00:47 <DIR> d---s---- C:\WINDOWS\system32\Microsoft
2008-07-26 00:39 . 2008-07-26 00:49 316,640 --a------ C:\WINDOWS\WMSysPr9.prx
2008-07-26 00:37 . 2004-08-19 17:14 141,702 --a--c--- C:\WINDOWS\system32\dllcache\netfx.cat
2008-07-26 00:35 . 2008-07-26 00:35 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-07-26 00:30 . 2004-07-17 11:40 19,528 --a------ C:\WINDOWS\002248_.tmp
2008-07-26 00:30 . 2004-08-03 22:43 15,872 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-07-26 00:27 . 2008-07-26 00:38 <DIR> d-------- C:\WINDOWS\EHome
2008-07-26 00:17 . 2008-07-26 00:17 <DIR> d-------- C:\Programmi\AMD
2008-07-26 00:17 . 2005-03-09 15:53 43,008 --a------ C:\WINDOWS\system32\drivers\AmdK8.sys
2008-07-26 00:17 . 2008-08-21 19:13 39,291 --a------ C:\WINDOWS\system32\nvapps.xml
2008-07-26 00:16 . 2008-07-26 00:20 <DIR> d-------- C:\WINDOWS\nview

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-01 11:57 155,995 ----a-w C:\WINDOWS\java\Packages\UIDJ9F53.ZIP
2008-07-25 14:25 --------- d-----w C:\Programmi\microsoft frontpage
2008-07-25 14:23 --------- d-----w C:\Programmi\Servizi in linea
.

((((((((((((((((((((((((((((( snapshot@2008-08-21_ 2.38.50.06 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-08-21 17:13:09 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_770.dat
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15:39 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe" [2005-09-03 15:18 94208]
"SpybotSD TeaTimer"="C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 18:41 1832272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2005-10-10 15:49 7286784]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2005-10-10 15:49 86016]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 16:38 78008]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"CnxTrApp"="C:\Programmi\Aethra\ADSL EB1070 USB\CnxTrApp.dll" [2004-04-20 17:24 247296]
"SoundMan"="SOUNDMAN.EXE" [2005-09-22 10:42 90112 C:\WINDOWS\soundman.exe]
"nwiz"="nwiz.exe" [2005-10-10 15:49 1519616 C:\WINDOWS\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-19 15:39 15360]

C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Alice ti aiuta.lnk - C:\Programmi\Alice ti aiuta\bin\matcli.exe [2008-08-01 13:58:47 212992]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programmi\\eMule\\emule.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37]
S3 Bcfilter;Jetico Personal Firewall Network Monitor;C:\WINDOWS\system32\DRIVERS\bcfilter.sys []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{120f124c-6d34-11dd-aa9d-0009f37bbd8f}]
\Shell\Auto\command - bittorrent.exe e
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL bittorrent.exe e
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Mauro\Dati applicazioni\Mozilla\Firefox\Profiles\aei1lg4u.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - www.google.it
FF -: plugin - C:\Programmi\Adobe\Acrobat 5.0\Reader\browser\nppdf32.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-21 19:33:46
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
Ora fine scansione: 2008-08-21 19:35:07
ComboFix-quarantined-files.txt 2008-08-21 17:35:02
ComboFix2.txt 2008-08-21 00:39:09

Pre-Run: 2,628,325,376 byte disponibili
Post-Run: 2,622,607,360 byte disponibili

197

--------------------------------------------

Tengo a fare presente che questo è l'unico forum su cui sia stato affrontato e risolto un problema di questo tipo, per cui mi auguro che possiate essere di aiuto anche al sottoscritto

L.

[Luke57]

Ciao, lo hai risolto il tuo problema? L'infezione sembra debellata.

[mldctm]

Ciao,

infatti sono riuscito, sorprendendomi e applicando le tue istruzioni al mio log, a risolvere, almeno così parrebbe, il problema. Adesso riesco a connettermi nuovamente ai siti di antivirus e simili.

Grazie per l'aiuto,

L.

[Vale63]

Ciao a tutti, anch'io non riesco a collegarmi ad avg e ad altri siti di antivirus, né con firefox né con explorer. Inoltre explorer non apre neppure windows update. Gli altri siti funzionano regolarmente. Posso iniziare anch'io scaricando combofix e poi procedere con la scansione?
Grazie!

[Luke57]

Ciao a tutti, anch'io non riesco a collegarmi ad avg e ad altri siti di antivirus, né con firefox né con explorer. Inoltre explorer non apre neppure windows update. Gli altri siti funzionano regolarmente. Posso iniziare anch'io scaricando combofix e poi procedere con la scansione?
Grazie!

Ciao, sì, con le stesse modalità

[Vale63]

Ciao, ti invio l'allegato del report di combofix ed attendo tue istruzioni. Grazie! Vale

[L’estensione txt è stata disattivata e non puó essere visualizzata.]

[Luke57]

Ciao, apri un file di testo dal blocco note di windows, al suo interno incolla il seguente script:

Codice: Seleziona tutto

Driver::
psblik

File::
c:\windows\system32\jgdcwlrj.dll

chiama il file CFScript.txt e salvalo nel desktop.
Trascinalo con il puntatore del mouse sull'icona di combofix. Il programma inizierà una nuova scansione, al termine di essa riavvia il computer e controlla se il problema esiste ancora. Fammi sapere.

[Vale63]

Luke, adesso funziona tutto. Anch'io devo farti un monumento! Grazie della tua disponibilità e del vostro sito! Vale

[nunzia83]

Salve, anch'io ho il medesimo vs.problema. Ho provato a seguere le istruzioni ma nn riesco ancora a collegarmi ai siti dell'antivirus.
Ho provveduto a scaricare il combofix, ho effettuato la scansione e ho ottenuto il file log.txt (ved.allegato).
Cosa dovrei fare adesso? Ho provato a copiare ed incollare il testo indicato a toroLELLA ma non ha funzionato.Cosa ho sbagliato?


Grazie in anticipo
Nunzia

[Luke57]

Ciao, ci credo che non abbia funzionato.....
apri un file di testo dal blocco note di windows, al suo interno incolla il seguente script:

Codice: Seleziona tutto

Driver::
Secauto

File::
c:\winnt\system32\xflngh.dll

chiama il file CFScript.txt e salvalo nella stessa directory di combofix.
Trascinalo con il puntatore del mouse sull'icona di combofix. Il programma inizierà una nuova scansione, al termine di essa riavvia il computer e controlla se il problema esiste ancora. Fammi sapere.

PS. Inoltre apri il registro di sistema (start>esegui>regedit (lo digiti nello spazio)>OK
Aperto l'editor cliccando sul segno + accanto alle singole voci, segui questgo percorso:
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows
click sulla cartella windows, all'interno sulla parte detra troverai
"AppInit_DLLs"=\\?\c:\winnt\system32\nul.iqs

doppio clck su AppInit_DLLs" nella finestra che sia aprirà, nella stringa Dati valore , cancella
c:\winnt\system32\nul.iqs (lo evidenzi e premi canc)>OK
Chiudi l'editor.

[nunzia83]

scusami ma io la scansione l'ho fatta con internet connesso e l'antivirus anche.. è il caso ke rifaccio tutto da capo?? scusami ma non sono pratica di questa cose..

grazie in anticipo