Ciao, anch'io non riesco a collegarmi al sito di avast, avg e ad altri siti di antivirus, né con firefox né con explorer e nemmeno ai siti microsoft. Gli altri siti funzionano regolarmente.
Mi sono permessa di inviarvi il file di log di Combofix. Potete darmi una mano?
Grazie 1000!!
ComboFix 10-01-03.05 - Proprietario 04/01/2010 21.55.43.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.39.1040.18.1023.688 [GMT 1:00]
Eseguito da: c:\documents and settings\Proprietario\Desktop\ComboFix.exe
ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\muzapp.exe
.
((((((((((((((((((((((((( Files Creati Da 2009-12-04 al 2010-01-04 )))))))))))))))))))))))))))))))))))
.
2010-01-02 18:37 . 2010-01-02 18:40 -------- d-----w- c:\documents and settings\Proprietario\Impostazioni locali\Dati applicazioni\Temp
2010-01-02 18:37 . 2010-01-02 18:37 -------- d-----w- c:\documents and settings\Proprietario\Impostazioni locali\Dati applicazioni\Deployment
2010-01-02 18:14 . 2010-01-04 20:55 -------- d-----w- c:\windows\system32\CatRoot2
2009-12-17 19:36 . 2009-12-17 19:36 -------- d-----w- c:\documents and settings\Proprietario\Impostazioni locali\Dati applicazioni\Help
2009-12-10 20:19 . 2008-12-08 16:21 110080 ----a-r- c:\windows\system32\drivers\ZTEusbnet.sys
2009-12-10 20:19 . 2008-12-08 16:21 104960 ----a-r- c:\windows\system32\drivers\ZTEusbmdm6k.sys
2009-12-10 20:19 . 2008-12-08 16:21 104960 ----a-r- c:\windows\system32\drivers\zteusbvoice.sys
2009-12-10 20:19 . 2008-12-08 16:21 105344 ----a-r- c:\windows\system32\drivers\ZTEusbnmea.sys
2009-12-10 20:19 . 2008-12-08 16:21 104960 ----a-r- c:\windows\system32\drivers\ZTEusbser6k.sys
2009-12-10 20:19 . 2009-12-10 20:19 -------- d-----w- c:\documents and settings\Proprietario\Dati applicazioni\Vodafone
2009-12-10 20:19 . 2009-12-10 20:19 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\InstallShield
2009-12-10 20:19 . 2009-12-10 20:19 -------- d-----w- c:\documents and settings\LocalService\Dati applicazioni\Vodafone
2009-12-10 20:19 . 2008-12-08 16:21 7680 ----a-r- c:\windows\system32\drivers\massfilter.sys
2009-12-10 20:18 . 2009-12-10 20:18 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Vodafone
2009-12-10 20:18 . 2009-12-10 20:18 -------- d-----w- c:\programmi\Vodafone
2009-12-10 20:18 . 2009-12-10 20:18 -------- d-----w- c:\documents and settings\Proprietario\Impostazioni locali\Dati applicazioni\{90DDF577-6237-4218-85BC-4261AC7E443B}
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-04 17:20 . 2007-09-26 22:31 1 ----a-w- c:\documents and settings\Proprietario\Dati applicazioni\OpenOffice.org2\user\uno_packages\cache\stamp.sys
2010-01-04 17:20 . 2007-09-26 22:30 -------- d-----w- c:\documents and settings\Proprietario\Dati applicazioni\OpenOffice.org2
2009-12-10 20:18 . 2006-12-21 15:57 -------- d-----w- c:\programmi\File comuni\InstallShield
2009-12-10 20:18 . 2006-03-02 12:00 74210 ----a-w- c:\windows\system32\perfc010.dat
2009-12-10 20:18 . 2006-03-02 12:00 447502 ----a-w- c:\windows\system32\perfh010.dat
2009-12-09 20:03 . 2009-04-21 18:21 -------- d-----w- c:\documents and settings\Proprietario\Dati applicazioni\HP
2009-11-15 11:27 . 2007-11-22 23:06 -------- d-----w- c:\programmi\eMule
2009-11-08 15:40 . 2009-11-08 15:36 -------- d-----w- c:\programmi\SopCast
2009-11-08 15:36 . 2009-11-08 15:36 -------- d-----w- c:\programmi\Ask.com
2009-04-20 18:29 . 2009-04-20 18:29 82432 --sha-r- c:\windows\system32\qmldkr.dll
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-06-04 17:04 1144712 ----a-w- c:\programmi\Ask.com\GenericAskToolbar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\programmi\Ask.com\GenericAskToolbar.dll" [2009-06-04 1144712]
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\programmi\Ask.com\GenericAskToolbar.dll" [2009-06-04 1144712]
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-16 68856]
"DAEMON Tools"="c:\programmi\DAEMON Tools\daemon.exe" [2006-11-12 157592]
"MSMSGS"="c:\programmi\Messenger\msmsgs.exe" [2004-10-13 1694208]
"Google Update"="c:\documents and settings\Proprietario\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe" [2010-01-02 135664]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\programmi\QuickTime\qttask.exe" [2007-06-29 286720]
"SMSTray"="c:\programmi\Samsung\EmoDio\SMSTray.exe" [2008-09-17 484880]
"AdslTaskBar"="stmctrl.dll" [2003-03-27 151552]
"Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2009-10-03 39792]
"Adobe ARM"="c:\programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"MobileConnect"="c:\programmi\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe" [2008-11-04 2087424]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-03-02 15360]
"ATICCC"="c:\programmi\ATI Technologies\ATI.ACE\cli.exe" [2004-11-24 32768]
c:\documents and settings\Proprietario\Menu Avvio\Programmi\Esecuzione automatica\
Monitor Apache Servers.lnk - c:\web\WebServer\Apache2\bin\ApacheMonitor.exe [2006-7-27 41042]
c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
ATI CATALYST System Tray.lnk - c:\programmi\ATI Technologies\ATI.ACE\CLI.exe [2004-11-25 32768]
HP Digital Imaging Monitor.lnk - c:\programmi\HP\Digital Imaging\bin\hpqtra08.exe [2003-9-16 237568]
Logitech Desktop Messenger.lnk - c:\programmi\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-6-21 67128]
WinZip Quick Pick.lnk - c:\programmi\WinZip\WZQKPICK.EXE [2007-1-2 118784]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\Messenger\\msmsgs.exe"=
"c:\\Programmi\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Programmi\\iTunes\\iTunes.exe"=
"c:\\Programmi\\BitTorrent\\bittorrent.exe"=
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [02/01/2007 19.13.30 646392]
R0 vburner;vburner;c:\windows\system32\drivers\vburner.sys [16/01/2008 17.55.17 17408]
R2 pgsql-8.1;PostgreSQL Database Server 8.1;c:\programmi\PostgreSQL\8.1\bin\pg_ctl.exe runservice -N "pgsql-8.1" -D "c:\programmi\PostgreSQL\8.1\data\" --> c:\programmi\PostgreSQL\8.1\bin\pg_ctl.exe runservice -N pgsql-8.1 [?]
R2 Tomcat5;Apache Tomcat;c:\programmi\Apache Software Foundation\Tomcat 5.0\bin\tomcat5.exe [29/08/2004 1.06.16 94208]
R2 VMCService;Vodafone Mobile Connect Service;c:\programmi\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [04/11/2008 11.39.20 14336]
R3 Stmatm;ATM/ADSL miniport;c:\windows\system32\drivers\stmatm.sys [06/01/2007 19.20.49 59466]
R3 TaurusUsb;ADSL Modem USB Service;c:\windows\system32\drivers\torususb.sys [06/01/2007 19.20.49 538925]
S0 ntcdrdrv;ntcdrdrv;c:\windows\system32\DRIVERS\ntcdrdrv.sys --> c:\windows\system32\DRIVERS\ntcdrdrv.sys [?]
S2 Remotesvc;Support Center;c:\windows\system32\svchost.exe -k netsvcs [02/03/2006 13.00.00 14336]
S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [10/12/2009 21.19.03 7680]
S3 ZTEusbnet;ZTE USB-NDIS miniport;c:\windows\system32\drivers\ZTEusbnet.sys [10/12/2009 21.19.54 110080]
S3 ZTEusbvoice;ZTE VoUSB Port;c:\windows\system32\drivers\zteusbvoice.sys [10/12/2009 21.19.36 104960]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
Remotesvc
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{34e80a12-9a8d-11db-a5b1-e41825dd69fa}]
\Shell\AutoRun\command - E:\Setup.exe
.
Contenuto della cartella 'Scheduled Tasks'
2010-01-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-436374069-838170752-839522115-1003Core.job
- c:\documents and settings\Proprietario\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe [2010-01-02 18:37]
2010-01-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-436374069-838170752-839522115-1003UA.job
- c:\documents and settings\Proprietario\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe [2010-01-02 18:37]
2010-01-04 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\programmi\Ask.com\UpdateTask.exe [2009-06-04 17:04]
.
.
------- Scansione supplementare -------
.
uStart Page =
hxxp://www.google.it/uSearchMigratedDefaultURL =
hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = 127.0.0.1
uSearchAssistant =
hxxp://www.google.com/ieuSearchURL,(Default) =
hxxp://www.google.com/search?q=%s
IE: Google Sidewiki... - c:\programmi\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\programmi\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
DPF: Microsoft XML Parser for Java -
file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Proprietario\Dati applicazioni\Mozilla\Firefox\Profiles\o18inczb.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage -
hxxp://www.google.it/FF - plugin: c:\documents and settings\Proprietario\Impostazioni locali\Dati applicazioni\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Garmin GPS Plugin\npGarmin.dll
FF - plugin: c:\programmi\Mozilla Firefox\plugins\npitunes.dll
.
- - - - CHIAVI ORFANE RIMOSSE - - - -
WebBrowser-{4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - (no file)
HKCU-Run-LDM - c:\programmi\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2010-01-04 22:05
Windows 5.1.2600 Service Pack 2 NTFS
scansione processi nascosti ...
scansione entrate autostart nascoste ...
Scansione files nascosti ...
Scansione completata con successo
Files nascosti: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer,
http://www.gmer.netdevice: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x867D41E8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf7893fc3
\Driver\ACPI -> ACPI.sys @ 0xf76f4cb8
\Driver\atapi -> 0x867661e8
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0004
ParseProcedure -> ntoskrnl.exe @ 0x8056f00e
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0004
ParseProcedure -> ntoskrnl.exe @ 0x8056f00e
NDIS: -> SendCompleteHandler -> 0x0
PacketIndicateHandler -> 0x0
SendHandler -> 0x0
Warning: possible MBR rootkit infection !
user & kernel MBR OK
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySQL]
"ImagePath"="\"c:\programmi\MySQL\MySQL Server 5.0\bin\mysqld-nt\" --defaults-file=\"c:\programmi\MySQL\MySQL Server 5.0\my.ini\" MySQL"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Remotesvc]
"ServiceDll"="c:\windows\system32\qmldkr.dll"
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------
- - - - - - - > 'winlogon.exe'(520)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\programmi\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
c:\programmi\PostgreSQL\8.1\bin\pg_ctl.exe
c:\programmi\PostgreSQL\8.1\bin\postmaster.exe
c:\windows\system32\wdfmgr.exe
c:\programmi\PostgreSQL\8.1\bin\postgres.exe
c:\programmi\PostgreSQL\8.1\bin\postgres.exe
c:\programmi\PostgreSQL\8.1\bin\postgres.exe
c:\programmi\PostgreSQL\8.1\bin\postgres.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
.
**************************************************************************
.
Ora fine scansione: 2010-01-04 22:11:33 - Il pc è stato riavviato
ComboFix-quarantined-files.txt 2010-01-04 21:11
Pre-Run: 92.597.506.048 byte disponibili
Post-Run: 92.923.551.744 byte disponibili
- - End Of File - - 97E08CAE64E70214A3DD81E3D852F130
