TR/Crypt.XPACK.Gen come eliminarlo?

[anselmo]

Salve ho il pc a pezzi da qualche giorno . Ho letto diverse cose su questo trojan e ho capito che sarà dificile toglierselo dalle scatole. Vi chiedo un grande aiuto.... ho letto il topic introduttivo ma il link ad hijackthis non funziona..... potete aiutarmi a togliere il trojan TR/Crypt.XPACK.Gen dal mio pc? Grazie Anx

[anselmo]

Ho letto un altro topic uguale al mio e vorrei sapere se i consigli vanno bene anche per me........

[gahan]

Ciao,
Scarica, installa malwarebytes dal link sottostante:

http://www.malwarebytes.org/mbam/program/mbam-setup.exe

Aggiornalo, disattiva il tuo antivirus ed esegui una "scansione completa"
Una volta finita la scansione, posta il rapporto.

[anselmo]

Ciao Gahan innanzitutto grazie per avermi risposto. Ho scaricato e fatto partirre il programma da te consigliato. Mentre lavora di fornisco delle informazioni aggiuntive sul mio pc. Ho installato come antivirus kaspersky (versione a pagamento) ma il computer era diventato ingestibile perchè troppo lento e così l'ho disinstallato. Al suo posto ho installato la versione gratuita di avira e contemporaneamente ho installato anche spyware terminator. Da pochi giorni avira mi riconosce quel trojan...lo vede ma non riesce a cancellarlo... e ogni volta il pc è sempre più ingolfato......

[gahan]

Ciao Gahan innanzitutto grazie per avermi risposto. Ho scaricato e fatto partirre il programma da te consigliato. Mentre lavora di fornisco delle informazioni aggiuntive sul mio pc. Ho installato come antivirus kaspersky (versione a pagamento) ma il computer era diventato ingestibile perchè troppo lento e così l'ho disinstallato. Al suo posto ho installato la versione gratuita di avira e contemporaneamente ho installato anche spyware terminator. Da pochi giorni avira mi riconosce quel trojan...lo vede ma non riesce a cancellarlo... e ogni volta il pc è sempre più ingolfato......

Ottima la scelta di Avira come antivirus, a mio avviso il migliore tra i gratuiti
Attendiamo la fine della scansione

[anselmo]

Ecco il log

Malwarebytes' Anti-Malware 1.44
Versione del database: 3540
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

11/01/2010 21.36.25
mbam-log-2010-01-11 (21-36-25).txt

Tipo di scansione: Scansione completa (D:\|F:\|)
Elementi scansionati: 315079
Tempo trascorso: 1 hour(s), 30 minute(s), 34 second(s)

Processi delle memoria infetti: 0
Moduli della memoria infetti: 0
Chiavi di registro infette: 8
Valori di registro infetti: 0
Elementi dato del registro infetti: 0
Cartelle infette: 0
File infetti: 3

Processi delle memoria infetti:
(Nessun elemento malevolo rilevato)

Moduli della memoria infetti:
(Nessun elemento malevolo rilevato)

Chiavi di registro infette:
HKEY_CLASSES_ROOT\minbho.showbarobj (Adware.SkyMediaPack) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{27ba317e-7bbd-4ebe-a06a-47f076d9d6f7} (Adware.SkyMediaPack) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2574231f-9d6f-4b0e-9041-5dd7484564ad} (Adware.SkyMediaPack) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2863e737-dd3f-4280-9af8-e9e79c16f312} (Adware.SkyMediaPack) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2863e737-dd3f-4280-9af8-e9e79c16f312} (Adware.SkyMediaPack) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{2863e737-dd3f-4280-9af8-e9e79c16f312} (Adware.SkyMediaPack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2863e737-dd3f-4280-9af8-e9e79c16f312} (Adware.SkyMediaPack) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\minbho.showbarobj.1 (Adware.SkyMediaPack) -> Quarantined and deleted successfully.

Valori di registro infetti:
(Nessun elemento malevolo rilevato)

Elementi dato del registro infetti:
(Nessun elemento malevolo rilevato)

Cartelle infette:
(Nessun elemento malevolo rilevato)

File infetti:
D:\Programmi\Save Tube Video Company\SaveTubeVideoBurn\MinBHO.dll (Adware.SkyMediaPack) -> Quarantined and deleted successfully.
D:\Programmi\Adobe\Adobe Photoshop CS3\Shfolder.dll (Trojan.Agent) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{74319339-7C95-4B10-9138-9AE5C21B2E23}\RP299\A0087351.exe (Adware.MakeTheWebBetter) -> Quarantined and deleted successfully.

[gahan]

ok,ora scarica hijackthis da questo link:

http://www.hijackthis.de/downloads/HJTInstall.exe

Installalo, avvialo, accetta i termini di licenza e clicca su do a system scan and save a logfile.
Verrà creato un log...postalo qui.

[anselmo]

Eccolo.....


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23.14.29, on 11/01/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\csrss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Programmi\Avira\AntiVir Desktop\sched.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\VTTimer.exe
D:\WINDOWS\system32\S3trayp.exe
D:\WINDOWS\RTHDCPL.EXE
D:\Programmi\Avira\AntiVir Desktop\avgnt.exe
D:\Programmi\Java\jre6\bin\jusched.exe
D:\PROGRA~1\SPYWAR~1\SpywareTerminatorShield.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe
D:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
D:\Documents and Settings\Anselmo\Dati applicazioni\Almeza\StaffLogger\sysdrvmon.exe
D:\Programmi\Skype\Phone\Skype.exe
D:\WINDOWS\System32\svchost.exe
D:\Programmi\Avira\AntiVir Desktop\avguard.exe
D:\WINDOWS\system32\crypserv.exe
D:\Programmi\Java\jre6\bin\jqs.exe
D:\Programmi\SWiSH Studio2\burner\nmsaccessu.exe
D:\Programmi\Spyware Terminator\sp_rsser.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\wdfmgr.exe
D:\Programmi\Internet Explorer\iexplore.exe
D:\Programmi\Internet Explorer\iexplore.exe
D:\WINDOWS\system32\wbem\wmiapsrv.exe
D:\WINDOWS\system32\wbem\wmiprvse.exe
D:\WINDOWS\System32\alg.exe
D:\Programmi\Internet Explorer\iexplore.exe
D:\Programmi\Skype\Plugin Manager\skypePM.exe
D:\Programmi\Trend Micro\HijackThis\HijackThis.exe
D:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.millevetrine.com/public/inizio/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - D:\Programmi\Crawler\ctbr.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Programmi\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Programmi\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {F334C7B0-8774-4d5b-BD7A-4F448D03A1AE} - (no file)
O3 - Toolbar: Toolbar &Crawler - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - D:\Programmi\Crawler\ctbr.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [S3Trayp] S3trayp.exe
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avgnt] "D:\Programmi\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "D:\Programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Programmi\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] D:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [SpywareTerminator] "D:\PROGRA~1\SPYWAR~1\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "D:\Programmi\File comuni\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [SpyHunter Security Suite] D:\Programmi\Enigma Software Group\SpyHunter\SpyHunter3.exe
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "D:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [swg] D:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [StaffLogger] D:\Documents and Settings\Anselmo\Dati applicazioni\Almeza\StaffLogger\sysdrvmon.exe
O4 - HKCU\..\Run: [Skype] "D:\Programmi\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = D:\Programmi\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: Download with Xilisoft Download YouTube Video - D:\Programmi\Xilisoft\Download YouTube Video\upod_link.HTM
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Sothink SWF Catcher - D:\Programmi\File comuni\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - D:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - D:\WINDOWS\bdoscandel.exe
O9 - Extra button: Flash Decompiler SWF Capture tool - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - D:\Programmi\Eltima Software\Flash Decompiler Trillix\saveflash\iebt.dll
O9 - Extra 'Tools' menuitem: Flash Decompiler SWF Capture tool menu - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - D:\Programmi\Eltima Software\Flash Decompiler Trillix\saveflash\iebt.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - D:\Programmi\File comuni\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - D:\Programmi\File comuni\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {22492231-AEF0-49FC-9180-CE8969AB1273} (F-Secure Online Scanner Launcher) - http://download.sp.f-secure.com/ols/f-s ... uncher.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resourc ... oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 9049908078
O16 - DPF: {96816368-C1E3-414D-A193-63C3CC921990} (MJPEGRender Control) - http://hotelatlantestar-rome.remotemana ... Render.ocx
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - http://wwwimages.adobe.com/www.adobe.co ... nos/gp.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{DDD031FF-5C18-4376-A272-C055750FE31E}: NameServer = 212.216.112.112,212.216.172.62
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - D:\Programmi\Crawler\ctbr.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - D:\Programmi\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - D:\Programmi\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - D:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - D:\Programmi\File comuni\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Servizio di Google Update (gupdate1ca1c62892b932c) (gupdate1ca1c62892b932c) - Google Inc. - D:\Programmi\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - D:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Programmi\Java\jre6\bin\jqs.exe
O23 - Service: NMSAccessU - Unknown owner - D:\Programmi\SWiSH Studio2\burner\nmsaccessu.exe
O23 - Service: RGService - Unknown owner - D:\Programmi\RadioGet\RGService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - D:\Programmi\WinPcap\rpcapd.exe (file missing)
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - D:\Programmi\Spyware Terminator\sp_rsser.exe
O23 - Service: STSService - Unknown owner - D:\Programmi\SoundTaxi Media Suite\STSService.exe
O24 - Desktop Component 0: (no name) - file:///D:/DOCUME~1/Anselmo/IMPOST~1/Temp/msohtml1/01/clip_image002.gif

--
End of file - 10549 bytes

[anselmo]

Gahan ancora grazie per il tempo che mi stai dedicando. Grazie!

[gahan]

Gahan ancora grazie per il tempo che mi stai dedicando. Grazie!

Di nulla

Allora, scarica CCleaner da questo link:

http://www.ccleaner.com/download/downloading

installalo, avvialo-->vai in opzioni sulla sinistra-->avanzate-->togli la spunta da cancella file in windows temp se più vecchi di 48 ore.
Ritorna in "pulizia" e clicca su avvia pulizia.

[anselmo]

Gahan... mi dice:
Questo processo cancellerà definitivamente i file dal sistema.
continuo comunque??????

[gahan]

Gahan... mi dice:
Questo processo cancellerà definitivamente i file dal sistema.
continuo comunque??????

certo prosegui

[anselmo]

Gahan fatto tutto.......... adesso??

[gahan]

Gahan fatto tutto.......... adesso??

Noti qualche miglioramento?

[anselmo]

In realtà mi sembra che dal riavvio il problema sia sparito. Il computer è veloce e la connessione ad Internet è tornata alta.... sembra che sia risolto..... anche se avira nei giorni precedenti mi tirava fuori l'avviso del worm soltanto un paio di volte al giorno............ forse dovrò aspettare di vedere domani come andrà..... oppure mi consigli una scansione con avira adesso???? Grazie mille ancora Gahan

[gahan]

In realtà mi sembra che dal riavvio il problema sia sparito. Il computer è veloce e la connessione ad Internet è tornata alta.... sembra che sia risolto..... anche se avira nei giorni precedenti mi tirava fuori l'avviso del worm soltanto un paio di volte al giorno............ forse dovrò aspettare di vedere domani come andrà..... oppure mi consigli una scansione con avira adesso???? Grazie mille ancora Gahan

Si, potresti anche effettuare una scansione con Avira per completezza ma prima cancelliamo i punti di ripristino per evitare di far ritornare il problema.

Click destro su Risorse del computer-->proprietà-->Ripristino configurazione di sistema-->spunta Disattiva ripristino configurazione di sistema e premi su Applica e successivamente conferma cliccando su ok.
Infine, riesegui la stessa procedura solo che questa volta riattivi il Rpristino configurazione di sistema scegliendo attraverso la barra poco più in basso la quantità di Mb che vuoi dargli.

Cio e buona fortuna

[anselmo]

Gahan ci eravamo illusi mentre provavo a navigare è riandato in palla tutto ed avira ha fatto ricomparire il messaggio del trojan.............. l'infame è ancora li.....

[gahan]

Innanzitutto disattiva il ripristino come ho scritto sopra e lascialo disattivato.

In seguito scarica combofix sul desktop dal seguente link

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Disconnetiti da internet
Disattiva Avira e a antispyware in real time.
Avvia il file ComboFix.exe
Digita 1 per avviare il software
Segui le instruzioni senza fare niente altro (non installare la recovery console) e alla fine verrà generato un log che trovi in C:\Combofix.txt, e infine postalo qui sul forum.

[anselmo]

Mentre faccio quello che mi consigli forse ti è utile vedere cosa mi appare quando avira avverte il trojan...... ti mando il link all'imagine http://www.millevetrine.com/trojan.jpg

[anselmo]

fatto tutto ecco il report:



ComboFix 10-01-11.01 - Anselmo 12/01/2010 1.19.20.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.39.1040.18.2943.2254 [GMT 1:00]
Eseguito da: d:\documents and settings\Anselmo\Desktop\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {00000002-0002-0000-7C25-9E7C08000A00}

ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

d:\windows\system32\drivers\npf.sys
d:\windows\system32\Packet.dll
d:\windows\system32\pthreadVC.dll
d:\windows\system32\twain_32.dll
d:\windows\system32\wpcap.dll

.
((((((((((((((((((((((((((((((((((((((( Driver/Servizi )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF
-------\Service_NPF


((((((((((((((((((((((((( Files Creati Da 2009-12-12 al 2010-01-12 )))))))))))))))))))))))))))))))))))
.

2010-01-11 23:06 . 2010-01-11 23:06 -------- d-----w- d:\programmi\CCleaner
2010-01-11 22:14 . 2010-01-11 22:14 -------- d-----w- d:\programmi\Trend Micro
2010-01-11 16:23 . 2010-01-11 16:23 -------- d-----w- d:\documents and settings\Anselmo\Dati applicazioni\Malwarebytes
2010-01-11 16:23 . 2010-01-07 15:07 38224 ----a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2010-01-11 16:23 . 2010-01-11 16:23 -------- d-----w- d:\programmi\Malwarebytes' Anti-Malware
2010-01-11 16:23 . 2010-01-11 16:23 -------- d-----w- d:\documents and settings\All Users\Dati applicazioni\Malwarebytes
2010-01-11 16:23 . 2010-01-07 15:07 19160 ----a-w- d:\windows\system32\drivers\mbam.sys
2010-01-11 14:52 . 2010-01-11 14:52 -------- d-----w- d:\programmi\Enigma Software Group
2010-01-07 09:20 . 2010-01-07 09:20 -------- d-----w- d:\programmi\Apowersoft
2010-01-03 22:19 . 2010-01-03 22:19 -------- d-----w- d:\programmi\Adobe Media Player
2010-01-03 21:07 . 2010-01-12 00:26 -------- d-----w- d:\programmi\File comuni\Akamai
2010-01-03 10:50 . 2010-01-03 10:50 -------- d-----w- d:\programmi\YouTube Downloader
2009-12-31 16:51 . 2009-12-31 16:51 -------- d-----w- d:\documents and settings\Anselmo\Dati applicazioni\SWiSH miniMax3
2009-12-31 16:46 . 2009-12-31 16:46 -------- d-----w- d:\programmi\LameACM
2009-12-31 16:45 . 2009-12-31 16:45 -------- d-----w- d:\programmi\File comuni\SWiSHzone.com
2009-12-31 16:45 . 2009-12-31 17:48 -------- d-----w- d:\programmi\SWiSH miniMax3
2009-12-31 14:36 . 2009-12-31 14:36 -------- d-----w- d:\programmi\Aneesoft
2009-12-29 13:53 . 2009-12-29 13:53 -------- d-----w- d:\documents and settings\Anselmo\Impostazioni locali\Dati applicazioni\Downloaded Installations
2009-12-28 17:28 . 2009-12-28 17:28 -------- d-----w- d:\documents and settings\Anselmo\Dati applicazioni\SuperUtils.com
2009-12-28 17:27 . 2009-12-28 17:27 -------- d-----w- d:\programmi\SuperUtils.com
2009-12-27 21:17 . 2009-12-27 21:17 -------- d-----w- d:\documents and settings\Anselmo\Dati applicazioni\AVS4YOU
2009-12-27 21:11 . 2009-12-27 21:11 -------- d-----w- d:\documents and settings\All Users\Dati applicazioni\AVS4YOU
2009-12-27 21:10 . 2009-12-27 21:11 -------- d-----w- d:\programmi\File comuni\AVSMedia
2009-12-27 21:10 . 2007-09-27 14:22 261632 ----a-w- d:\windows\system32\mcdvd_32.dll
2009-12-27 21:10 . 2009-12-27 21:11 -------- d-----w- d:\programmi\AVS4YOU
2009-12-27 21:10 . 2003-05-21 12:50 24576 ----a-w- d:\windows\system32\msxml3a.dll
2009-12-25 18:59 . 2009-12-25 18:59 -------- d-sh--w- d:\documents and settings\NetworkService\IETldCache
2009-12-18 15:04 . 2009-12-28 21:20 -------- d-----w- d:\programmi\Crawler
2009-12-18 14:54 . 2009-12-18 14:56 -------- d-----w- d:\programmi\WinClamAVShield
2009-12-18 14:52 . 2009-12-18 14:52 142592 ----a-w- d:\windows\system32\drivers\sp_rsdrv2.sys
2009-12-18 14:52 . 2010-01-11 22:10 -------- d-----w- d:\documents and settings\Anselmo\Dati applicazioni\Spyware Terminator
2009-12-18 14:52 . 2010-01-11 22:10 -------- d-----w- d:\documents and settings\All Users\Dati applicazioni\Spyware Terminator
2009-12-18 14:52 . 2010-01-11 22:09 -------- d-----w- d:\programmi\Spyware Terminator
2009-12-17 14:19 . 2009-12-17 14:22 -------- d-----w- d:\documents and settings\Anselmo\Dati applicazioni\FILEminimizerPictures
2009-12-17 14:19 . 2009-12-17 14:19 -------- d-----w- d:\programmi\FILEminimizer Pictures

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-12 00:28 . 2009-04-20 19:22 -------- d-----w- d:\documents and settings\Anselmo\Dati applicazioni\Skype
2010-01-11 23:35 . 2009-09-15 16:52 -------- d-----w- d:\documents and settings\All Users\Dati applicazioni\Spybot - Search & Destroy
2010-01-11 23:34 . 2009-05-30 14:23 -------- d-----w- d:\documents and settings\Anselmo\Dati applicazioni\FileZilla
2010-01-11 23:08 . 2009-04-20 19:25 -------- d-----w- d:\documents and settings\Anselmo\Dati applicazioni\skypePM
2010-01-11 00:23 . 2009-04-08 20:16 -------- d-----w- d:\programmi\SWiSH v2.0
2010-01-07 17:12 . 2009-04-10 20:09 66 ----a-w- d:\documents and settings\Anselmo\Dati applicazioni\ispro4_0.tmp
2010-01-07 09:21 . 2009-10-16 11:57 -------- d-----w- d:\documents and settings\Anselmo\Dati applicazioni\Apowersoft
2010-01-06 09:34 . 2009-04-11 21:22 -------- d---a-w- d:\documents and settings\All Users\Dati applicazioni\TEMP
2010-01-04 16:57 . 2009-04-07 16:30 -------- d-----w- d:\documents and settings\All Users\Dati applicazioni\NOS
2010-01-03 22:22 . 2009-04-07 09:20 -------- d-----w- d:\programmi\File comuni\Adobe
2010-01-03 20:14 . 2010-01-03 20:14 1956528 ----a-w- d:\documents and settings\All Users\Dati applicazioni\NOS\Adobe_Downloads\install_flash_player_ax.exe
2010-01-03 10:17 . 2009-11-08 12:40 -------- d-----w- d:\programmi\YoutubeMusicDownloader
2009-12-31 14:35 . 2009-04-06 21:19 -------- d-----w- d:\documents and settings\All Users\Dati applicazioni\Kaspersky Lab
2009-12-29 13:57 . 2009-04-06 21:22 132408 ----a-w- d:\documents and settings\Anselmo\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2009-12-29 13:42 . 2009-04-17 08:45 -------- d-----w- d:\programmi\Wondershare
2009-12-25 19:00 . 2009-08-13 22:07 -------- d-----w- d:\programmi\Google
2009-12-18 14:52 . 2009-12-18 14:52 6144 ----a-w- d:\documents and settings\All Users\Dati applicazioni\Spyware Terminator\sp_rsdel.exe
2009-12-18 14:52 . 2009-12-18 14:52 5632 ----a-w- d:\documents and settings\All Users\Dati applicazioni\Spyware Terminator\fileobjinfo.sys
2009-12-13 23:38 . 2009-10-29 22:16 -------- d-----w- d:\programmi\Free Video Converter
2009-12-11 11:09 . 2009-07-28 21:45 56816 ----a-w- d:\windows\system32\drivers\avgntflt.sys
2009-12-09 16:29 . 2009-04-18 13:01 -------- d-----w- d:\documents and settings\Anselmo\Dati applicazioni\Audio Editor Deluxe
2009-12-09 16:28 . 2009-04-18 13:00 -------- d-----w- d:\programmi\Audio Editor Deluxe
2009-12-09 14:54 . 2009-04-06 20:22 -------- d--h--w- d:\programmi\InstallShield Installation Information
2009-12-09 12:14 . 2001-08-31 13:00 79514 ----a-w- d:\windows\system32\perfc010.dat
2009-12-09 12:14 . 2001-08-31 13:00 479180 ----a-w- d:\windows\system32\perfh010.dat
2009-12-08 11:12 . 2009-12-08 11:12 -------- d-----w- d:\documents and settings\Anselmo\Dati applicazioni\dvdcss
2009-12-03 08:27 . 2009-12-03 08:27 -------- d-----w- d:\documents and settings\Anselmo\Dati applicazioni\Aunsoft
2009-12-03 08:27 . 2009-12-03 08:27 -------- d-----w- d:\programmi\Aunsoft
2009-12-01 18:37 . 2009-05-13 21:47 111 ----a-w- d:\programmi\unlockswf.ini
2009-12-01 17:59 . 2009-04-16 20:28 -------- d-----w- d:\programmi\Moyea
2009-12-01 08:21 . 2009-12-01 08:21 -------- d-----w- d:\documents and settings\All Users\Dati applicazioni\F-Secure
2009-11-30 22:53 . 2009-11-30 22:53 -------- d-----w- d:\programmi\Sophos
2009-11-30 22:14 . 2009-07-10 21:51 -------- d-----w- d:\programmi\File comuni\DVDVideoSoft
2009-11-30 22:07 . 2009-11-04 12:14 -------- d-----w- d:\programmi\AllMedia Grabber
2009-11-30 21:59 . 2009-09-15 16:52 -------- d-----w- d:\programmi\Spybot - Search & Destroy
2009-11-30 11:46 . 2009-05-13 15:53 -------- d-----w- d:\programmi\OLYMPUS
2009-11-30 11:40 . 2009-04-28 12:04 -------- d-----w- d:\documents and settings\All Users\Dati applicazioni\Apple Computer
2009-11-30 11:33 . 2009-11-30 11:33 -------- d-----w- d:\documents and settings\All Users\Dati applicazioni\Panasonic
2009-11-30 11:29 . 2009-11-30 11:29 -------- d-----w- d:\programmi\File comuni\Panasonic
2009-11-30 11:29 . 2009-11-30 11:29 -------- d-----w- d:\programmi\Panasonic
2009-11-29 15:02 . 2009-11-29 15:02 -------- d-----w- d:\programmi\File comuni\Skype
2009-11-29 15:02 . 2009-11-29 15:02 -------- d-----r- d:\programmi\Skype
2009-11-29 15:02 . 2009-04-20 18:48 -------- d-----w- d:\documents and settings\All Users\Dati applicazioni\Skype
2009-11-24 13:50 . 2009-12-13 21:53 57344 ----a-w- d:\documents and settings\Anselmo\Dati applicazioni\Mozilla\Firefox\Profiles\d01dgee5.default\extensions\{FCAB6FDD-5585-425b-95C1-5ED856F3FD08}\components\nsCatcher.dll
2009-11-21 10:51 . 2009-11-21 10:51 -------- d-----w- d:\programmi\Digiarty
2009-11-20 15:29 . 2009-11-20 15:27 -------- d-----w- d:\documents and settings\Anselmo\Dati applicazioni\GetRightToGo
2009-11-20 15:03 . 2009-11-20 15:03 -------- d-----w- d:\programmi\RichFLV
2009-11-20 15:03 . 2009-11-20 15:03 -------- d-----w- d:\programmi\File comuni\Adobe AIR
2009-11-20 15:03 . 2009-11-20 15:03 38208 ----a-w- d:\documents and settings\Anselmo\Dati applicazioni\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-11-20 15:03 . 2009-11-20 15:03 38208 ----a-w- d:\documents and settings\Default User\Dati applicazioni\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-11-20 14:54 . 2009-11-20 14:54 -------- d-----w- d:\programmi\Emicsoft Studio
2009-11-18 12:49 . 2009-10-26 11:52 12208 --sha-w- d:\windows\system32\KGyGaAvL.sys
2009-11-17 14:07 . 2009-11-16 13:55 -------- d-----w- d:\programmi\Flash2Video
2009-11-17 14:06 . 2009-11-16 13:51 -------- d-----w- d:\programmi\SWF to AVI
2009-11-17 11:29 . 2009-11-17 11:29 -------- d-----w- d:\programmi\AnyBizSoft
2009-11-16 15:37 . 2009-04-16 20:29 -------- d-----w- d:\documents and settings\Anselmo\Dati applicazioni\Moyea
2009-11-15 14:27 . 2009-10-01 20:58 83 ----a-w- d:\windows\system32\gpupdate.bin
2009-11-15 14:09 . 2009-10-01 20:55 -------- d-----w- d:\programmi\RadioGet
2009-11-14 17:35 . 2009-11-14 17:35 -------- d-----w- d:\programmi\Save Tube Video Company
2009-11-10 13:48 . 2009-11-06 10:40 152576 ----a-w- d:\documents and settings\Anselmo\Dati applicazioni\Sun\Java\jre1.6.0_17\lzma.dll
2009-11-10 13:48 . 2009-11-10 13:48 79488 ----a-w- d:\documents and settings\Anselmo\Dati applicazioni\Sun\Java\jre1.6.0_17\gtapi.dll
2009-10-29 07:40 . 2004-08-19 13:39 916480 ----a-w- d:\windows\system32\wininet.dll
2009-10-21 05:38 . 2004-08-19 13:39 75776 ----a-w- d:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2004-08-19 13:39 25088 ----a-w- d:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-03 21:00 265728 ----a-w- d:\windows\system32\drivers\http.sys
2003-12-26 01:00 . 2009-05-13 21:42 335360 ----a-w- d:\programmi\unlockswf.exe
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="d:\programmi\File comuni\Ahead\lib\NMBgMonitor.exe" [2005-10-28 94208]
"swg"="d:\programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-08-13 39408]
"SpybotSD TeaTimer"="d:\programmi\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"StaffLogger"="d:\documents and settings\Anselmo\Dati applicazioni\Almeza\StaffLogger\sysdrvmon.exe" [2009-10-07 965120]
"Skype"="d:\programmi\Skype\Phone\Skype.exe" [2009-10-09 25623336]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTimer"="VTTimer.exe" [2006-08-04 53248]
"S3Trayp"="S3trayp.exe" [2006-07-11 176128]
"SkyTel"="SkyTel.EXE" [2007-08-03 1826816]
"RTHDCPL"="RTHDCPL.EXE" [2007-09-27 16844800]
"NeroFilterCheck"="d:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"QuickTime Task"="d:\programmi\QuickTime\qttask.exe" [2009-01-05 413696]
"avgnt"="d:\programmi\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"Adobe Reader Speed Launcher"="d:\programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="d:\programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"SunJavaUpdateSched"="d:\programmi\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"PinnacleDriverCheck"="d:\windows\system32\PSDrvCheck.exe" [2003-12-04 406016]
"SpywareTerminator"="d:\progra~1\SPYWAR~1\SpywareTerminatorShield.exe" [2009-12-18 2166784]
"AdobeCS4ServiceManager"="d:\programmi\File comuni\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

d:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Microsoft Office.lnk - d:\programmi\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Documents and Settings\\All Users\\Dati applicazioni\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 7.0.1.325\\Italian\\setup.exe"=
"d:\\Programmi\\Skype\\Plugin Manager\\skypePM.exe"=
"d:\\Programmi\\Save Tube Video Company\\SaveTubeVideoBurn\\downloader.exe"=
"d:\\Programmi\\File comuni\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"d:\\Programmi\\Macromedia\\Dreamweaver MX\\Dreamweaver.exe"=
"d:\\Programmi\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R1 SAVRKBootTasks;Boot Tasks Driver;d:\windows\system32\SAVRKBootTasks.sys [01/12/2009 8.27.22 18816]
R1 sp_rsdrv2;Spyware Terminator Driver 2;d:\windows\system32\drivers\sp_rsdrv2.sys [18/12/2009 15.52.26 142592]
R2 Akamai;Akamai NetSession Interface;d:\windows\System32\svchost.exe -k Akamai [19/08/2004 14.39.46 14336]
R3 S3GIGP;S3GIGP;d:\windows\system32\drivers\S3gIGPm.sys [06/04/2009 21.25.05 659456]
S2 gupdate1ca1c62892b932c;Servizio di Google Update (gupdate1ca1c62892b932c);d:\programmi\Google\Update\GoogleUpdate.exe [13/08/2009 23.08.05 133104]
S3 MEMSWEEP2;MEMSWEEP2;\??\d:\windows\system32\1E.tmp --> d:\windows\system32\1E.tmp [?]
S3 QCEmerald;Logitech QuickCam Web;d:\windows\system32\drivers\OVCE.sys [10/06/2009 19.32.26 31872]
S3 RGService;RGService;d:\programmi\RadioGet\RGService.exe [01/10/2009 21.55.25 335872]
S3 STSService;STSService;d:\programmi\SoundTaxi Media Suite\STSService.exe [29/09/2009 11.41.04 335872]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
Akamai REG_MULTI_SZ Akamai
.
Contenuto della cartella 'Scheduled Tasks'

2010-01-12 d:\windows\Tasks\Google Software Updater.job
- d:\programmi\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-08-13 22:07]

2010-01-12 d:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- d:\programmi\Google\Update\GoogleUpdate.exe [2009-08-13 22:08]

2010-01-12 d:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- d:\programmi\Google\Update\GoogleUpdate.exe [2009-08-13 22:08]

2010-01-11 d:\windows\Tasks\User_Feed_Synchronization-{3477BB23-C474-4A4F-BEF9-2BAB34FCEA2E}.job
- d:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Scansione supplementare -------
.
uStart Page = www.millevetrine.com/public/inizio/
IE: Crawler Search - tbr:iemenu
IE: Download with Xilisoft Download YouTube Video - d:\programmi\Xilisoft\Download YouTube Video\upod_link.HTM
IE: E&sporta in Microsoft Excel - d:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Sothink SWF Catcher - d:\programmi\File comuni\SourceTec\SWF Catcher\InternetExplorer.htm
TCP: {DDD031FF-5C18-4376-A272-C055750FE31E} = 212.216.112.112,212.216.172.62
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - d:\programmi\Crawler\ctbr.dll
DPF: {96816368-C1E3-414D-A193-63C3CC921990} - hxxp://hotelatlantestar-rome.remotemana ... Render.ocx
FF - ProfilePath - d:\documents and settings\Anselmo\Dati applicazioni\Mozilla\Firefox\Profiles\d01dgee5.default\
FF - prefs.js: browser.search.selectedEngine - GoogleFeed.net
FF - prefs.js: browser.startup.homepage - hxxp://www.google-feed.net/?CID=2&PID=STV
FF - component: d:\documents and settings\Anselmo\Dati applicazioni\Mozilla\Firefox\Profiles\d01dgee5.default\extensions\{FCAB6FDD-5585-425b-95C1-5ED856F3FD08}\components\nsCatcher.dll
FF - component: d:\programmi\Crawler\firefox\components\xcomm.dll
FF - component: d:\programmi\Crawler\firefox\components\xshared.dll
FF - component: d:\programmi\Crawler\firefox\components\xsupport.dll
FF - component: d:\programmi\Crawler\firefox\components\xwsg.dll
FF - component: d:\programmi\Save Tube Video Company\SaveTubeVideoBurn\FF\components\swslib.dll
FF - plugin: d:\programmi\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: d:\programmi\Google\Google Updater\2.4.1636.7222\npCIDetect13.dll
FF - plugin: d:\programmi\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: d:\programmi\Virtual Earth 3D\npVE3D.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - d:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-12 01:27
Windows 5.1.2600 Service Pack 3 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Akamai]
"ServiceDll"="D:/Programmi/File comuni/Akamai/rswin_3629.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Akamai]
"ServiceDll"="D:/Programmi/File comuni/Akamai/rswin_3629.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
"ImagePath"="\??\d:\windows\system32\1E.tmp"
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\FlashProp.FlashProp]
@DACL=(02 0000)
@="FlashProp Class"

[HKEY_LOCAL_MACHINE\software\Classes\FlashProp.FlashProp.1]
@DACL=(02 0000)
@="FlashProp Class"
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------

- - - - - - - > 'winlogon.exe'(548)
d:\programmi\File comuni\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll

- - - - - - - > 'explorer.exe'(3400)
d:\windows\system32\WININET.dll
d:\windows\system32\webcheck.dll
.
------------------------ Altri processi in esecuzione ------------------------
.
d:\programmi\Avira\AntiVir Desktop\sched.exe
d:\programmi\Avira\AntiVir Desktop\avguard.exe
d:\windows\system32\crypserv.exe
d:\programmi\Java\jre6\bin\jqs.exe
d:\programmi\SWiSH Studio2\burner\nmsaccessu.exe
d:\programmi\Spyware Terminator\sp_rsser.exe
d:\windows\system32\wdfmgr.exe
d:\windows\system32\wbem\wmiapsrv.exe
d:\windows\system32\VTTimer.exe
d:\windows\system32\S3trayp.exe
d:\windows\RTHDCPL.EXE
d:\programmi\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Ora fine scansione: 2010-01-12 01:33:56 - Il pc è stato riavviato
ComboFix-quarantined-files.txt 2010-01-12 00:33

Pre-Run: 224.356.044.800 byte disponibili
Post-Run: 224.237.002.752 byte disponibili

- - End Of File - - 3D3D42CE627B3F3C4069C92494581387