Guarda questo file e dirmi se posso stare tranquillo o no.
ComboFix 09-07-28.01 - Andrea_Monaci 29/07/2009 9.42.31.3.1 - NTFSx86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.3.1252.39.1040.18.1023.817 [GMT 2:00]
Eseguito da: c:\documents and settings\All Users\Documenti\ComboFix.exe
ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Esecuzione precedente -------
.
c:\windows\TEMP\logishrd\LVPrcInj01.dll
.
((((((((((((((((((((((((( Files Creati Da 2009-06-28 al 2009-07-29 )))))))))))))))))))))))))))))))))))
.
Nessun nuovo file creato in questo arco di tempo
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-26 10:13 . 2008-10-23 16:11 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Microsoft Help
2009-07-26 09:46 . 2008-12-19 08:49 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-07-02 10:12 . 2008-10-01 16:51 91744 -c--a-w- c:\documents and settings\balubeto\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2009-06-17 10:23 . 2008-09-29 18:21 -------- d-----w- c:\programmi\Windows Desktop Search
2009-06-16 14:36 . 2008-07-01 19:11 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2008-07-01 19:11 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-14 01:33 . 2009-06-12 10:18 -------- d-----w- c:\programmi\UltraVNC
2009-06-12 10:53 . 2009-06-12 10:53 -------- d-----w- c:\documents and settings\balubeto\Dati applicazioni\UltraVNC
2009-06-12 10:42 . 2009-06-12 10:42 -------- d-----w- c:\documents and settings\Andrea_Monaci\Dati applicazioni\UltraVNC
2009-06-12 10:22 . 2008-10-05 15:34 10688 ----a-w- c:\windows\system32\drivers\mv2.sys
2009-06-12 10:22 . 2008-10-05 15:34 20672 ----a-w- c:\windows\system32\mv2.dll
2009-06-03 19:09 . 2008-07-01 19:11 1296384 ----a-w- c:\windows\system32\quartz.dll
2009-05-24 22:24 . 2008-05-26 20:18 350208 ----a-w- c:\windows\system32\mssph.dll
2009-05-13 05:02 . 2008-07-01 19:11 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-12 13:12 . 2008-09-29 17:17 26144 ----a-w- c:\windows\system32\spupdsvc.exe
2009-05-12 07:10 . 2008-07-01 19:11 361600 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-05-07 15:32 . 2008-07-01 19:11 347648 ----a-w- c:\windows\system32\localspl.dll
2009-05-06 10:36 . 2008-09-29 10:58 91744 -c--a-w- c:\documents and settings\Andrea_Monaci\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2009-05-04 10:09 . 2008-09-29 16:38 57344 ----a-w- c:\windows\system32\setrysvc.EXE
.
------- Sigcheck -------
[7] 2008-06-20 11:59 361600 AD978A1B783B5719720CFF204B666C8E c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[7] 2008-07-01 19:11 361344 93EA8D04EC73A85DB02EB8805988F733 c:\windows\$NtUninstallKB951748$\tcpip.sys
[7] 2008-06-20 11:51 361600 9AEFA14BD6B182D61E3119FA5F436D3D c:\windows\system32\dllcache\tcpip.sys
[-] 2009-05-12 07:10 361600 05F3441246BFEDC2A5B12CF827012F7F c:\windows\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-07-01 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-07-01 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-07-01 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-07-01 455168]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13574144]
"GCXX-Manager-Class"="c:\programmi\Sony Ericsson\Wireless Manager\GCXXManager.exe" [2008-09-26 802921]
"Synchronization Manager"="c:\windows\system32\mobsync.exe" [2008-07-01 143872]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-17 86016]
"GrooveMonitor"="c:\programmi\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"LogitechCommunicationsManager"="c:\programmi\File comuni\LogiShrd\LComMgr\Communications_Helper.exe" [2008-08-14 565008]
"LogitechQuickCamRibbon"="c:\programmi\Logitech\QuickCam\Quickcam.exe" [2008-08-14 2407184]
"Adobe Acrobat Speed Launcher"="c:\programmi\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232]
"Acrobat Assistant 8.0"="c:\programmi\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-11 640376]
"SunJavaUpdateSched"="c:\programmi\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-09-17 1657376]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-07-01 15360]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\programmi\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\acaptuser32.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Programmi\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Programmi\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Programmi\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Programmi\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programmi\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Programmi\\UltraVNC\\vncviewer.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:
xpsp2res.dll,-22009
"5900:TCP"= 5900:TCP:vnc5900
"5800:TCP"= 5800:TCP:vnc5800
S0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [07/10/2008 20.22.28 28544]
S2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [16/04/2009 19.11.17 55152]
S2 setrysvc;setrysvc;c:\windows\System32\setrysvc.exe c:\windows\System32\semwltry.exe --> c:\windows\System32\setrysvc.exe c:\windows\System32\semwltry.exe 
S2 uvnc_service;uvnc_service;c:\programmi\UltraVNC\winvnc.exe [12/06/2009 12.18.46 1693128]
S2 wlidsvc;Windows Live ID Sign-in Assistant;c:\programmi\File comuni\Microsoft Shared\Windows Live\WLIDSVC.EXE [30/03/2009 16.28.36 1533808]
S2 yksvc;Marvell Yukon Service;RUNDLL32.EXE ykx32mpcoinst,serviceStartProc --> RUNDLL32.EXE ykx32mpcoinst,serviceStartProc
S3 fsssvc;Windows Live Family Safety;c:\programmi\Windows Live\Family Safety\fsssvc.exe [06/02/2009 18.08.58 533360]
S3 mv2;mv2;c:\windows\system32\drivers\mv2.sys [05/10/2008 17.34.52 10688]
S3 SEMWModem;Sony Ericsson SEMWModem;c:\windows\system32\drivers\GCXX.sys [29/09/2008 18.38.11 106624]
S3 SEMWWNIC;Sony Ericsson SEMWWNIC;c:\windows\system32\drivers\GCXXNet.sys [29/09/2008 18.38.12 52992]
S3 Winacusb;Winacusb;c:\windows\system32\drivers\winacusb.sys [29/09/2008 13.06.41 829952]
--- Altri Servizi/Drivers In Memoria ---
*NewlyCreated* - MDMXSDK
*NewlyCreated* - NIC1394
*NewlyCreated* - NVENETFD
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contenuto della cartella 'Scheduled Tasks'
2009-07-28 c:\windows\Tasks\OGADaily.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 16:04]
2009-07-28 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 16:04]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://[www].google.it/
IE: Aggiungi a PDF esistente - c:\programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Aggiungi destinazione link a PDF esistente - c:\programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Converti destinazione link in Adobe PDF - c:\programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Converti in Adobe PDF - c:\programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: {AB90F4A2-D6FB-496C-B1E2-177684B3C6BA} = 192.168.1.1
.
**************************************************************************
driver loading error catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, htt*://[www].gmer.net
Rootkit scan 2009-07-29 09:46
Windows 5.1.2600 Service Pack 3 NTFS
scansione processi nascosti ...
scansione entrate autostart nascoste ...
Scansione files nascosti ...
Scansione completata con successo
Files nascosti: 0
**************************************************************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
[HKEY_USERS\S-1-5-21-776561741-1580818891-1801674531-500\Software\Microsoft\Internet Explorer\User Preferences]
Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,3d,5b,61,22,20,81,98,4a,b7,00,df,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,3d,5b,61,22,20,81,98,4a,b7,00,df,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,3d,5b,61,22,20,81,98,4a,b7,00,df,\
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------
- - - - - - - > 'explorer.exe'(616)
c:\windows\system32\WININET.dll
.
Ora fine scansione: 2009-07-29 9.47.41
ComboFix-quarantined-files.txt 2009-07-29 07:47
ComboFix2.txt 2009-07-28 17:55
Pre-Run: 11.697.725.440 byte disponibili
Post-Run: 11.659.493.376 byte disponibili
157
GRAZIE
CIAO
P.S Volevo spediterlo come allegato ma mi appare una finestra con scritto che non sono autorizzato a fare cio`. Come mai?
Processo WLIDSVC.EXE
Forum Bloccato
Inserito il - 28/07/2009 : 18:13:29
