MyCity » Ambulanta -> Arhiva Ambulante » Svastara

Svastara

Napisano na dan: 15.3.2008
2

Svastara
Pagination Prethodna strana

Idi na vrh

Poslao: 16 Mar 2008 13:04
Idi na vrh
offline
  • Pridružio: 09 Mar 2008
  • Poruke: 42

ComboFix 08-03-14.4 - HP_Administrator 2008-03-16 12.54.31.3 - NTFSx86
Eseguito da: C:\Documents and Settings\HP_Administrator\Desktop\th3\ComboFix.exe
.

((((((((((((((((((((((((( Files Creati Da 2008-02-16 al 2008-03-16 )))))))))))))))))))))))))))))))))))
.

2008-03-16 11:10 . 2007-10-04 10:01 66,048 --a------ C:\WINDOWS\ieResetIcons.exe
2008-03-16 08:42 . 2008-03-16 08:42 <DIR> d-------- C:\Programmi\RivaTuner v2.08
2008-03-16 08:41 . 2008-03-16 09:50 <DIR> d-------- C:\programi internet
2008-03-16 07:49 . 2008-03-16 07:49 4,131,160 --a------ C:\registrybooster.exe
2008-03-16 07:45 . 2008-03-16 07:45 3,995,968 --a------ C:\systemtweakerv1.0 kupljen.exe
2008-03-15 21:55 . 2008-03-15 21:55 <DIR> d-------- C:\Documents and Settings\LocalService\Dati applicazioni\Ahead
2008-03-15 19:11 . 2008-03-16 07:09 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-03-15 19:11 . 2008-03-15 19:11 1,409 --a------ C:\WINDOWS\QTFont.for
2008-03-15 19:09 . 2008-03-15 19:09 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Dati applicazioni\Apple Computer
2008-03-15 19:08 . 2008-03-15 19:09 <DIR> d-------- C:\Programmi\iTunes
2008-03-15 19:08 . 2008-03-15 19:08 <DIR> d-------- C:\Programmi\iPod
2008-03-15 19:08 . 2008-03-15 19:08 <DIR> d-------- C:\Programmi\Bonjour
2008-03-15 19:07 . 2008-03-15 19:07 <DIR> d-------- C:\Programmi\Apple Software Update
2008-03-15 19:06 . 2008-03-15 19:06 <DIR> d-------- C:\Programmi\File comuni\Apple
2008-03-15 19:06 . 2008-03-15 19:06 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Apple
2008-03-15 18:53 . 2008-03-15 19:01 59,163,944 --a------ C:\iTunesSetup.exe
2008-03-15 16:54 . 2008-03-15 16:54 4,561,816 --a------ C:\sump3_5_2435_209 kuplljenn.exe
2008-03-15 12:13 . 2008-03-15 12:13 <DIR> d-------- C:\Programmi\WinPcap
2008-03-15 11:37 . 2008-03-15 11:54 <DIR> d-------- C:\VundoFix Backups
2008-03-14 23:54 . 2008-03-14 23:54 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Kaspersky Lab Setup Files
2008-03-09 14:10 . 2008-03-15 12:16 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\RFA_Backups
2008-03-09 14:01 . 2008-03-09 14:01 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Dati applicazioni\RegClean
2008-03-09 08:31 . 2008-03-09 08:32 <DIR> d-------- C:\Sanjarica
2008-03-09 08:11 . 2008-03-15 17:00 <DIR> d-------- C:\Programmi\Kaspersky Lab
2008-03-09 08:11 . 2008-03-09 08:11 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Kaspersky Lab
2008-03-09 08:11 . 2008-03-16 12:57 7,114,272 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-03-09 08:11 . 2008-03-15 13:14 92,720 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-03-09 08:11 . 2008-03-15 21:46 69,408 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-03-09 08:11 . 2008-03-15 13:14 3,476 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-03-04 18:34 . 2008-03-04 18:57 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Dati applicazioni\Prevx
2008-03-02 17:28 . 2008-03-02 17:28 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Dati applicazioni\Snapfish
2008-03-02 13:57 . 2008-03-02 13:57 <DIR> d-------- C:\Programmi\VoipStunt.com
2008-03-02 13:57 . 2008-03-02 13:57 <DIR> d-------- C:\Programmi\ACD Systems
2008-03-02 13:57 . 2008-03-02 13:57 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\ACD Systems
2008-03-02 13:55 . 2008-03-02 13:55 <DIR> d-------- C:\Programmi\Vinci al SuperEnalotto 2
2008-03-02 13:55 . 2008-03-02 13:55 <DIR> d-------- C:\Programmi\Veoh Networks
2008-03-02 13:55 . 2008-03-02 13:55 <DIR> d-------- C:\Programmi\NEXT 3D ARREDAMENTO D'INTERNI
2008-03-02 13:55 . 2008-03-02 13:55 <DIR> d-------- C:\Programmi\Mario Forever
2008-03-02 13:55 . 2008-03-02 13:55 <DIR> d-------- C:\Programmi\Le Guide di Finson Patente Europea per il Computer 2
2008-03-02 13:55 . 2008-03-02 13:55 <DIR> d-------- C:\Programmi\Hair Pro 2006 Light
2008-02-20 21:29 . 2008-02-20 21:29 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Dati applicazioni\ProtezionefiData
2008-02-20 21:28 . 2008-03-02 13:55 <DIR> d-------- C:\Programmi\ProtezionefiData
2008-02-16 20:39 . 2008-02-16 20:39 <DIR> d-------- C:\Programmi\Navman

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-16 11:54 --------- d-----w C:\Documents and Settings\HP_Administrator\Dati applicazioni\Skype
2008-03-16 09:44 --------- d-----w C:\Programmi\RegistryFix
2008-03-16 09:00 --------- d-----w C:\Programmi\eMule
2008-03-16 08:41 --------- d-----w C:\Programmi\Spybot - Search & Destroy
2008-03-16 07:23 --------- d-----w C:\Programmi\Mozilla Thunderbird
2008-03-16 06:45 --------- d-----w C:\Programmi\Uniblue
2008-03-15 18:15 --------- d-----w C:\Programmi\QuickTime
2008-03-15 18:08 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\Apple Computer
2008-03-15 12:33 --------- d-----w C:\Programmi\Spyware Terminator
2008-03-15 11:11 --------- d-----w C:\Programmi\iViVo
2008-03-15 11:09 --------- d--h--w C:\Programmi\InstallShield Installation Information
2008-03-15 10:54 --------- d-----w C:\Programmi\PowerISO
2008-03-15 10:37 --------- d-----w C:\Documents and Settings\HP_Administrator\Dati applicazioni\CallingID
2008-03-14 19:50 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\Spyware Terminator
2008-03-13 12:09 --------- d-----w C:\Programmi\Zortam Mp3 Media Studio
2008-03-13 12:09 --------- d-----w C:\Programmi\Microsoft ActiveSync
2008-03-09 07:08 --------- d-----w C:\Programmi\ESET
2008-03-07 18:36 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\CanonIJPLM
2008-03-02 12:57 --------- d-----w C:\Programmi\File comuni\ACD Systems
2008-03-02 12:55 --------- d-----w C:\Programmi\TorrenTopia
2008-03-01 19:08 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\AntiVir PersonalEdition Classic
2008-02-27 15:35 --------- d-----w C:\Documents and Settings\HP_Administrator\Dati applicazioni\Uniblue
2008-02-03 11:51 --------- d-----w C:\Programmi\PrestoNotes
2008-02-03 10:45 --------- d-----w C:\Programmi\Ashampoo
2008-01-27 07:59 15,360 ----a-w C:\WINDOWS\system32\ctfmon .exe
2008-01-21 20:00 140 ------w C:\Documents and Settings\HP_Administrator\Dati applicazioni\wklnhst.dat
2008-01-19 23:03 --------- d-----w C:\Programmi\HP
2008-01-19 17:06 --------- d-----w C:\Programmi\LogiGuard
2007-06-03 20:31 540,000 ----a-w C:\Programmi\System Cleaner 5.50.zip
2007-05-30 19:13 4,660,390 ----a-w C:\Programmi\DV_Install_Demo_v21.exe
2007-05-30 19:05 947,526 ----a-w C:\Programmi\waver.zip
2007-05-30 19:03 186,767 ----a-w C:\Programmi\audc80konvertor.exe
2007-05-30 18:39 4,408,592 ----a-w C:\Programmi\vfvh571i fax.exe
2007-05-20 08:56 814,016 ----a-w C:\Programmi\Google_Updater.exe
2007-05-19 08:06 6,337,564 ----a-w C:\Programmi\WebUpdaterForLegacyOperatingSystems_240.exe
2007-05-19 07:57 4,310,568 ----a-w C:\Programmi\WebUpdater_241 za navigator.exe
2007-05-06 17:17 17,938,288 ----a-w C:\Programmi\Install_Messenger.exe
2007-05-06 15:33 10,064,213 ----a-w C:\Programmi\POILoader_232.exe
2007-05-06 10:46 669,184 ----a-w C:\Programmi\Nokia_Connectivity_Cable_Driver_6_80_5_1_ita.msi
2007-05-06 10:45 658,432 ----a-w C:\Programmi\nokia_connectivity_cable_driver_rel_6_81_1_spa.msi
2007-05-06 10:07 2,372,760 ----a-w C:\Programmi\winzip90.exe
2007-05-06 10:05 13,185,024 ----a-w C:\Programmi\Nokia_DKU-5_1_24.exe
2007-05-06 08:45 273,229,544 ----a-w C:\Programmi\WindowsXP-KB835935-SP2-ITA.exe
2007-05-06 08:20 445,208 ----a-w C:\Programmi\windowsxp-kb838989-X86-ITA.exe
2007-05-06 08:08 5,034,240 ----a-w C:\Programmi\DriverDetective.exe
2007-05-06 08:04 829,577 ----a-w C:\Programmi\modem_it.chm
2007-05-05 22:32 994,304 ----a-w C:\Programmi\Setup.msi
2007-05-05 22:01 21,485,136 ----a-w C:\Programmi\Nokia_PC_Suite_683_rel_14_1_ita_web.exe
2007-05-05 21:29 23,785,680 ----a-w C:\Programmi\NokiaSoftwareUpdaterSetup_it.exe
2007-05-05 15:40 840,192 ----a-w C:\Programmi\Nokia_Connectivity_Cable_Driver_rel_6_83_9_0_eng.msi
2007-05-05 15:39 6,685 ----a-w C:\Programmi\Nokia6103_MS_BT.inf
2007-05-05 15:39 6,494 ----a-w C:\Programmi\Nokia6103BT.inf
2007-04-30 11:31 4,212,210 ----a-w C:\Programmi\Demo_SSTworld.exe
2007-04-30 11:27 4,064,518 ----a-w C:\Programmi\bettinggenius30.exe
2007-04-29 00:11 1,087,682 ----a-w C:\Programmi\subtitleworkshop251.zip
2007-04-24 16:09 10,451,656 ----a-w C:\Programmi\XLVIEWER.EXE
2007-04-24 16:05 28,508,368 ----a-w C:\Programmi\FileFormatConverters.exe
2007-04-24 16:01 1,321 ----a-w C:\Programmi\katalog18apr07.CSV
2007-04-24 15:51 4,792,136 ----a-w C:\Programmi\CX.EXE
2007-04-24 15:48 735,232 ----a-w C:\Programmi\katalog18Apr07.xls
2007-04-24 15:46 12,337,352 ----a-w C:\Programmi\WDVIEWER.EXE
2007-04-19 20:34 122,880 ----a-w C:\Programmi\Download_wma-mp3-converter.exe
2007-04-18 08:37 1,014,730 ----a-w C:\Programmi\PowerISO37.exe
2007-03-28 22:14 6,597,960 ----a-w C:\Programmi\audioconverter_wmf_setup.exe
2007-03-28 22:08 4,708,303 ----a-w C:\Programmi\mms1001.exe
2007-03-28 21:33 404,890 ----a-w C:\Programmi\switch.zip
2007-03-25 09:56 122,880 ----a-w C:\Programmi\Download_AliveWMAMP3Recorder.exe
2007-03-25 06:50 3,326,142 ----a-w C:\Programmi\DupKillerSetup081.zip
2007-03-20 22:19 4,107,201 ----a-w C:\Programmi\burn4free_setup.exe
2007-03-20 21:48 1,219,544 ----a-w C:\Programmi\mp3cddoctorlite.exe
2007-03-18 22:48 1,988,744 ----a-w C:\Programmi\trojanb6758.exe
2007-03-18 22:42 414,580 ----a-w C:\Programmi\Megamp3Split_2.0b.zip
2007-03-18 11:58 59,392 ----a-w C:\Programmi\Italian_Serie_A_06-07.mdb
2007-03-18 10:13 2,863,832 ----a-w C:\Programmi\DeepBurner1.exe
2007-03-18 08:37 15,342,568 ----a-w C:\Programmi\20070317-017-i32.exe
2007-03-18 08:31 13,445,912 ----a-w C:\Programmi\XPBP_ESD_IT.exe
2007-03-17 22:42 3,109,256 ----a-w C:\Programmi\LinkScannerProSetup_2_5_2_0052_9.exe
2007-03-16 18:05 402,208 ----a-w C:\Programmi\rainbow(zabranjeno)-1.2-win.zip
2007-03-16 15:22 652,560 ----a-w C:\Programmi\pdf2text.exe
2007-03-16 13:44 1,622,912 ----a-w C:\Programmi\CuteWriter.exe
2007-03-16 12:57 697,042 ----a-w C:\Programmi\Scan2PDF.zip
2007-03-16 10:12 934,479 ----a-w C:\Programmi\TE20Setup.exe
2007-03-13 15:34 71,737,595 ----a-w C:\Programmi\200301010000aib.zip
2007-03-13 15:17 3,519,074 ----a-w C:\Programmi\teach800.exe
2007-03-13 15:12 23,510,720 ----a-w C:\Programmi\dotnetfx.exe
2007-03-13 14:14 14,730,232 ----a-w C:\Programmi\DivXPlay.exe
2007-03-11 21:30 1,834,548 ----a-w C:\Programmi\tbrush35 slikanje.exe
2007-03-11 21:21 34,959,384 ----a-w C:\Programmi\5.05.18.00_ntune_winxp_international.exe
2007-03-11 21:19 9,590,117 ----a-w C:\Programmi\kmp.exe
2007-03-11 21:14 4,237,337 ----a-w C:\Programmi\RLSetup_Final.exe
2007-03-11 21:10 34,282,256 ----a-w C:\Programmi\AVSTVBox.exe
2007-03-11 20:58 24,836,360 ----a-w C:\Programmi\acdsee.exe
2007-03-11 20:52 3,424,620 ----a-w C:\Programmi\MP4 Video Player.zip
2007-03-11 14:29 2,649,601 ----a-w C:\Programmi\winsonar_free_70103.zip
2007-03-11 13:17 988,039 ----a-w C:\Programmi\starsetup.exe
2007-03-11 10:50 6,932,421 ----a-w C:\Programmi\Alcohol52.zip
2007-03-11 10:45 2,579,338 ----a-w C:\Programmi\MyPhoneExplorer_Setup_1.5.9.exe
2007-03-11 10:40 1,118,786 ----a-w C:\Programmi\installer_Ringtone_CD_Ripper.exe
2007-03-11 10:38 1,665,325 ----a-w C:\Programmi\agsetup sa cd-ea.exe
2007-03-11 10:31 12,128,824 ----a-w C:\Programmi\SimpleDivX.zip
2007-03-11 00:56 56 --sh--r C:\WINDOWS\system32\590BA312D1.sys
2007-03-11 00:56 1,890 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.
<pre>
----a-w            61,440 2008-03-09 13:45:27  C:\hp\KBD\KBD .EXE
----a-w         1,603,152 2008-03-09 13:45:33  C:\Programmi\Canon\MyPrinter\BJMyPrt .exe
----a-w           644,696 2008-03-09 13:45:31  C:\Programmi\Canon\SolutionMenu\CNSLMAIN .exe
----a-w           155,648 2008-01-19 17:03:55  C:\Programmi\File comuni\Ahead\Lib\NeroCheck .exe
----a-w           210,472 2008-03-09 13:45:33  C:\Programmi\File comuni\ScanSoft Shared\SSBkgdUpdate\SSBkgdupdate .exe
----a-w           176,128 2008-03-09 13:46:08  C:\Programmi\LogiGuard\Master Mechanic II\agent .exe
----a-w            79,400 2008-01-19 17:04:13  C:\Programmi\ScanSoft\OmniPageSE4\OpwareSE4 .exe
----a-w         2,870,784 2008-03-09 07:14:10  C:\Programmi\Spyware Terminator\SpywareTerminatorShield .exe
----a-w            64,512 2008-03-06 17:11:32  C:\WINDOWS\ehome\ehtray .exe
----a-w            15,360 2008-01-27 07:59:23  C:\WINDOWS\system32\ctfmon .exe
</pre>


((((((((((((((((((((((((((((( [Link mogu videti samo ulogovani korisnici] )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-03-15 18:08:36 86,016 ----a-r C:\WINDOWS\Installer\{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}\PrntWzrdIco.exe
+ 2008-03-15 18:09:31 102,400 ----a-r C:\WINDOWS\Installer\{80FD852F-5AAC-4129-B931-06AAFFA43138}\iTunesIco.exe
+ 2008-03-15 18:07:20 27,136 ----a-r C:\WINDOWS\Installer\{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}\AppleSoftwareUpdateIco.exe
+ 2007-07-24 14:17:08 81,920 ----a-w C:\WINDOWS\system32\dns-sd.exe
+ 2007-07-24 14:17:08 61,440 ----a-w C:\WINDOWS\system32\dnssd.dll
+ 2006-09-19 13:44:04 15,664 ----a-w C:\WINDOWS\system32\drivers\GEARAspiWDM.sys
+ 2008-02-18 10:16:24 30,464 -c--a-w C:\WINDOWS\system32\DRVSTORE\usbaapl_4351B7DAFF62FD33510D77DFAE3CF8CC82517571\usbaapl.sys
+ 2006-10-03 18:47:52 109,360 ----a-w C:\WINDOWS\system32\GEARAspi.dll
+ 2008-03-16 06:09:36 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_334.dat
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* i valori vuoti & legittimi/default non sono visualizzati.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{33161E98-0A6C-4d3c-BD62-3A7D56137F52}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7EBD0DF4-1263-4ED3-96CB-4CDC66C58318}]
C:\WINDOWS\system32\mlljj.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e133f12d-08c2-4d7e-a5f7-09cc0a4a151d}]
C:\WINDOWS\system32\cidqmmrf.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Procs]
@={51D8EAB2-A055-487F-BBE0-DFB79DD0E76D}

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [ ]
"Uniblue SpeedUpMyPC"="C:\Programmi\Uniblue\SpeedUpMyPC\SpeedUpMyPC.exe" [2007-01-12 09:26 5288960]
"Uniblue RegistryBooster 2"="C:\Programmi\Uniblue\RegistryBooster 2\RegistryBooster.exe" [2007-12-05 16:06 1885464]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ftutil2"="ftutil2.dll" [2004-06-07 13:05 106496 C:\WINDOWS\system32\ftutil2.dll]
"nwiz"="nwiz.exe" [2006-10-22 11:22 1622016 C:\WINDOWS\system32\nwiz.exe]
"CanonSolutionMenu"="C:\Programmi\Canon\SolutionMenu\CNSLMAIN.exe" [2008-03-09 14:42 644696]
"CanonMyPrinter"="C:\Programmi\Canon\MyPrinter\BJMyPrt.exe" [2008-03-09 18:45 1603152]
"SSBkgdUpdate"="C:\Programmi\File comuni\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2008-03-09 18:44 210472]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 11:22 7700480]
"SpywareTerminator"="C:\Programmi\Spyware Terminator\SpywareTerminatorShield.exe" [2008-03-09 18:46 2870784]
"UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" [ ]
"kis"="C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" [2006-03-24 19:09 139367]
"QuickTime Task"="C:\Programmi\QuickTime\QTTask.exe" [2008-01-31 23:13 385024]
"iTunesHelper"="C:\Programmi\iTunes\iTunesHelper.exe" [2008-02-19 13:10 267048]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoSecCPL"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoConfigPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoNetSetup"= 0 (0x0)
"NoNetSetupIDPage"= 0 (0x0)
"NoNetSetupSecurityPage"= 0 (0x0)
"NoWorkgroupContents"= 0 (0x0)
"NoEntireNetwork"= 0 (0x0)
"NoFileSharingControl"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoStartMenuPinnedList"= 0 (0x0)
"NoStartMenuMFUprogramsList"= 0 (0x0)
"NoUserNameInStartMenu"= 0 (0x0)
"NoStartMenuSubFolders"= 0 (0x0)
"NoCommonGroups"= 0 (0x0)
"NoPrinterTabs"= 0 (0x0)
"NoDeletePrinter"= 0 (0x0)
"NoAddPrinter"= 0 (0x0)
"NoPrinters"= 0 (0x0)
"NoFavoritesMenu"= 0 (0x0)
"NoToolbarCustomize"= 0 (0x0)
"NoRecentDocsNetHood"= 0 (0x0)
"NoChangeAnimation"= 0 (0x0)
"NoChangeKeyboardNavigationIndicators"= 0 (0x0)
"RestrictRun"= 0 (0x0)
"NoResolveTrack"= 1 (0x1)
"NoThumbnailCache"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoRun"= 0 (0x0)
"NoLogOff"= 0 (0x0)
"NoFind"= 0 (0x0)
"NoClose"= 0 (0x0)
"NoSetFolders"= 0 (0x0)
"NoFavoritesMenu"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcawts]
efcawts.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"xmlprov"=3 (0x3)
"WudfSvc"=3 (0x3)
"ServiceLayer"=3 (0x3)
"Fax"=3 (0x3)
"BlueSoleil Hid Service"=2 (0x2)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe"
"VoipStunt"="C:\Programmi\VoipStunt.com\VoipStunt\VoipStunt.exe" -nosplash -minimized
"DAEMON Tools"="C:\Programmi\DAEMON Tools\daemon.exe" -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"RegEasy.exe"=C:\Programmi\Registry Easy\RegEasy.exe
"SpywareTerminator"="C:\Programmi\Spyware Terminator\SpywareTerminatorShield.exe"
"ISUSPM Startup"=C:\PROGRA~1\FILECO~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
"ISUSScheduler"="C:\Programmi\File comuni\InstallShield\UpdateService\issch.exe" -start

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"C:\\Programmi\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Programmi\\Sitecom\\IVT BlueSoleil\\BlueSoleil.exe"=
"C:\\Programmi\\THQ\\Dawn of War - Dark Crusade\\DarkCrusade.exe"=
"C:\\Programmi\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe"=
"C:\\Programmi\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"=
"C:\\Programmi\\NAMCO BANDAI Games\\Warhammer Mark of Chaos\\Warhammer.exe"=
"C:\\Programmi\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"C:\\Programmi\\RadLight Company\\RadLight 4.0\\rlkernel.exe"=
"C:\Programmi\Microsoft ActiveSync\rapimgr.exe"= C:\Programmi\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"C:\Programmi\Microsoft ActiveSync\WCESMgr.exe"= C:\Programmi\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"C:\\Programmi\\Bonjour\\mDNSResponder.exe"=
"C:\\Programmi\\iTunes\\iTunes.exe"=
"C:\\Programmi\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"4662:TCP"= 4662:TCP:emule
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
\Shell\AutoRun\command - J:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\K]
\Shell\AutoRun\command - K:\Autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7ca93cf4-7368-11dc-82fa-001731e138a9}]
\Shell\AutoRun\command - K:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{83cc3187-cece-11db-821f-806d6172696f}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{83cc318d-cece-11db-821f-806d6172696f}]
\Shell\AutoRun\command - J:\Autorun.exe

*Newly Created Service* - RIVATUNER32
.
Contenuto della cartella 'Scheduled Tasks'
"2008-03-07 21:19:22 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Programmi\TuneUp Utilities 2006\SystemOptimizer.exe
"2008-03-15 18:07:19 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Programmi\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2008-03-16 12:57:58
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
Ora fine scansione: 2008-03-16 12.58.45
ComboFix-quarantined-files.txt 2008-03-16 11:58:43
ComboFix2.txt 2008-03-15 16:13:37
ComboFix3.txt 2008-03-15 12:22:10
.
2007-10-07 01:25:16 --- E O F ---



Poslao: 16 Mar 2008 13:51
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Otvoriti Notepad i iskopirati sledeci tekst (sve što se nalazi unutar Kod polja):

File::
C:\Documents and Settings\HP_Administrator\Dati applicazioni\wklnhst.dat

Folder::
C:\VundoFix Backups

RenV::
----a-w            61,440 2008-03-09 13:45:27  C:\hp\KBD\KBD .EXE
----a-w         1,603,152 2008-03-09 13:45:33  C:\Programmi\Canon\MyPrinter\BJMyPrt .exe
----a-w           644,696 2008-03-09 13:45:31  C:\Programmi\Canon\SolutionMenu\CNSLMAIN .exe
----a-w           155,648 2008-01-19 17:03:55  C:\Programmi\File comuni\Ahead\Lib\NeroCheck .exe
----a-w           210,472 2008-03-09 13:45:33  C:\Programmi\File comuni\ScanSoft Shared\SSBkgdUpdate\SSBkgdupdate .exe
----a-w           176,128 2008-03-09 13:46:08  C:\Programmi\LogiGuard\Master Mechanic II\agent .exe
----a-w            79,400 2008-01-19 17:04:13  C:\Programmi\ScanSoft\OmniPageSE4\OpwareSE4 .exe
----a-w         2,870,784 2008-03-09 07:14:10  C:\Programmi\Spyware Terminator\SpywareTerminatorShield .exe
----a-w            64,512 2008-03-06 17:11:32  C:\WINDOWS\ehome\ehtray .exe
----a-w            15,360 2008-01-27 07:59:23  C:\WINDOWS\system32\ctfmon .exe

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{33161E98-0A6C-4d3c-BD62-3A7D56137F52}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7EBD0DF4-1263-4ED3-96CB-4CDC66C58318}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e133f12d-08c2-4d7e-a5f7-09cc0a4a151d}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcawts]



Snimiti na Desktop fajl iz Notepada kao "CFScript"




Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.



Poslao: 16 Mar 2008 14:27
Idi na vrh
offline
  • Pridružio: 09 Mar 2008
  • Poruke: 42

Pocelo je stalno da mi izbaciju jedan prozor ERROR CONSOLE i onda mi se blokira internet moram sve da ztvorim a i neznam kako da napravim taj CFSskript na desktopu .Tu consolu mi otvara browser Opera (CSS.Java script) i ispred je crveni kruzic sa crvenim X-om (kao znak zabranjeno parkiranje i zaustavljanje) i zuti trougao sa znakom uzvika.
Znaci ispred je jedan od tih znakova i posle pise CSS ili Java Script a posle toga ide neka internet adresa

Poslao: 16 Mar 2008 16:08
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Hajde da probamo ovako...


Skini file sa sledećeg linka: [Link mogu videti samo ulogovani korisnici] i pokreni ga dvoklikom.

Ovo bi trebalo da automatski pokrene ComboFix sa odgovarajućom skriptom.
Kada proces bude završen, postavi ovde log koji će se otvoriti...

Poslao: 16 Mar 2008 17:21
Idi na vrh
offline
  • Pridružio: 09 Mar 2008
  • Poruke: 42

ComboFix 08-03-14.4 - HP_Administrator 2008-03-16 17:08:32.4 - NTFSx86
Eseguito da: C:\Documents and Settings\HP_Administrator\Desktop\th3\ComboFix.exe
Command switches used :: CFScript.txt
.

((((((((((((((((((((((((( Files Creati Da 2008-02-16 al 2008-03-16 )))))))))))))))))))))))))))))))))))
.

2008-03-16 11:10 . 2007-10-04 10:01 66,048 --a------ C:\WINDOWS\ieResetIcons.exe
2008-03-16 08:42 . 2008-03-16 08:42 <DIR> d-------- C:\Programmi\RivaTuner v2.08
2008-03-16 08:41 . 2008-03-16 14:27 <DIR> d-------- C:\programi internet
2008-03-16 07:49 . 2008-03-16 07:49 4,131,160 --a------ C:\registrybooster.exe
2008-03-16 07:45 . 2008-03-16 07:45 3,995,968 --a------ C:\systemtweakerv1.0 kupljen.exe
2008-03-15 21:55 . 2008-03-15 21:55 <DIR> d-------- C:\Documents and Settings\LocalService\Dati applicazioni\Ahead
2008-03-15 19:11 . 2008-03-16 07:09 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-03-15 19:11 . 2008-03-15 19:11 1,409 --a------ C:\WINDOWS\QTFont.for
2008-03-15 19:09 . 2008-03-15 19:09 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Dati applicazioni\Apple Computer
2008-03-15 19:08 . 2008-03-15 19:09 <DIR> d-------- C:\Programmi\iTunes
2008-03-15 19:08 . 2008-03-15 19:08 <DIR> d-------- C:\Programmi\iPod
2008-03-15 19:08 . 2008-03-15 19:08 <DIR> d-------- C:\Programmi\Bonjour
2008-03-15 19:07 . 2008-03-15 19:07 <DIR> d-------- C:\Programmi\Apple Software Update
2008-03-15 19:06 . 2008-03-15 19:06 <DIR> d-------- C:\Programmi\File comuni\Apple
2008-03-15 19:06 . 2008-03-15 19:06 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Apple
2008-03-15 18:53 . 2008-03-15 19:01 59,163,944 --a------ C:\iTunesSetup.exe
2008-03-15 16:54 . 2008-03-15 16:54 4,561,816 --a------ C:\sump3_5_2435_209 kuplljenn.exe
2008-03-15 12:13 . 2008-03-15 12:13 <DIR> d-------- C:\Programmi\WinPcap
2008-03-15 11:37 . 2008-03-15 11:54 <DIR> d-------- C:\VundoFix Backups
2008-03-14 23:54 . 2008-03-14 23:54 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Kaspersky Lab Setup Files
2008-03-09 14:10 . 2008-03-15 12:16 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\RFA_Backups
2008-03-09 14:01 . 2008-03-09 14:01 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Dati applicazioni\RegClean
2008-03-09 08:31 . 2008-03-09 08:32 <DIR> d-------- C:\Sanjarica
2008-03-09 08:11 . 2008-03-15 17:00 <DIR> d-------- C:\Programmi\Kaspersky Lab
2008-03-09 08:11 . 2008-03-09 08:11 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Kaspersky Lab
2008-03-09 08:11 . 2008-03-16 17:10 7,345,440 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-03-09 08:11 . 2008-03-15 13:14 92,720 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-03-09 08:11 . 2008-03-15 21:46 69,408 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-03-09 08:11 . 2008-03-15 13:14 3,476 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-03-04 18:34 . 2008-03-04 18:57 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Dati applicazioni\Prevx
2008-03-02 17:28 . 2008-03-02 17:28 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Dati applicazioni\Snapfish
2008-03-02 13:57 . 2008-03-02 13:57 <DIR> d-------- C:\Programmi\VoipStunt.com
2008-03-02 13:57 . 2008-03-02 13:57 <DIR> d-------- C:\Programmi\ACD Systems
2008-03-02 13:57 . 2008-03-02 13:57 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\ACD Systems
2008-03-02 13:55 . 2008-03-02 13:55 <DIR> d-------- C:\Programmi\Vinci al SuperEnalotto 2
2008-03-02 13:55 . 2008-03-02 13:55 <DIR> d-------- C:\Programmi\Veoh Networks
2008-03-02 13:55 . 2008-03-02 13:55 <DIR> d-------- C:\Programmi\NEXT 3D ARREDAMENTO D'INTERNI
2008-03-02 13:55 . 2008-03-02 13:55 <DIR> d-------- C:\Programmi\Mario Forever
2008-03-02 13:55 . 2008-03-02 13:55 <DIR> d-------- C:\Programmi\Le Guide di Finson Patente Europea per il Computer 2
2008-03-02 13:55 . 2008-03-02 13:55 <DIR> d-------- C:\Programmi\Hair Pro 2006 Light
2008-02-20 21:29 . 2008-02-20 21:29 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Dati applicazioni\ProtezionefiData
2008-02-20 21:28 . 2008-03-02 13:55 <DIR> d-------- C:\Programmi\ProtezionefiData
2008-02-16 20:39 . 2008-02-16 20:39 <DIR> d-------- C:\Programmi\Navman

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-16 15:49 --------- d-----w C:\Documents and Settings\HP_Administrator\Dati applicazioni\Skype
2008-03-16 13:33 --------- d-----w C:\Documents and Settings\HP_Administrator\Dati applicazioni\CallingID
2008-03-16 09:44 --------- d-----w C:\Programmi\RegistryFix
2008-03-16 09:00 --------- d-----w C:\Programmi\eMule
2008-03-16 08:41 --------- d-----w C:\Programmi\Spybot - Search & Destroy
2008-03-16 07:23 --------- d-----w C:\Programmi\Mozilla Thunderbird
2008-03-16 06:45 --------- d-----w C:\Programmi\Uniblue
2008-03-15 18:15 --------- d-----w C:\Programmi\QuickTime
2008-03-15 18:08 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\Apple Computer
2008-03-15 12:33 --------- d-----w C:\Programmi\Spyware Terminator
2008-03-15 11:11 --------- d-----w C:\Programmi\iViVo
2008-03-15 11:09 --------- d--h--w C:\Programmi\InstallShield Installation Information
2008-03-15 10:54 --------- d-----w C:\Programmi\PowerISO
2008-03-14 19:50 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\Spyware Terminator
2008-03-13 12:09 --------- d-----w C:\Programmi\Zortam Mp3 Media Studio
2008-03-13 12:09 --------- d-----w C:\Programmi\Microsoft ActiveSync
2008-03-09 07:08 --------- d-----w C:\Programmi\ESET
2008-03-07 18:36 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\CanonIJPLM
2008-03-02 12:57 --------- d-----w C:\Programmi\File comuni\ACD Systems
2008-03-02 12:55 --------- d-----w C:\Programmi\TorrenTopia
2008-03-01 19:08 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\AntiVir PersonalEdition Classic
2008-02-27 15:35 --------- d-----w C:\Documents and Settings\HP_Administrator\Dati applicazioni\Uniblue
2008-02-03 11:51 --------- d-----w C:\Programmi\PrestoNotes
2008-02-03 10:45 --------- d-----w C:\Programmi\Ashampoo
2008-01-27 07:59 15,360 ----a-w C:\WINDOWS\system32\ctfmon .exe
2008-01-21 20:00 140 ------w C:\Documents and Settings\HP_Administrator\Dati applicazioni\wklnhst.dat
2008-01-19 23:03 --------- d-----w C:\Programmi\HP
2008-01-19 17:06 --------- d-----w C:\Programmi\LogiGuard
2007-06-03 20:31 540,000 ----a-w C:\Programmi\System Cleaner 5.50.zip
2007-05-30 19:13 4,660,390 ----a-w C:\Programmi\DV_Install_Demo_v21.exe
2007-05-30 19:05 947,526 ----a-w C:\Programmi\waver.zip
2007-05-30 19:03 186,767 ----a-w C:\Programmi\audc80konvertor.exe
2007-05-30 18:39 4,408,592 ----a-w C:\Programmi\vfvh571i fax.exe
2007-05-20 08:56 814,016 ----a-w C:\Programmi\Google_Updater.exe
2007-05-19 08:06 6,337,564 ----a-w C:\Programmi\WebUpdaterForLegacyOperatingSystems_240.exe
2007-05-19 07:57 4,310,568 ----a-w C:\Programmi\WebUpdater_241 za navigator.exe
2007-05-06 17:17 17,938,288 ----a-w C:\Programmi\Install_Messenger.exe
2007-05-06 15:33 10,064,213 ----a-w C:\Programmi\POILoader_232.exe
2007-05-06 10:46 669,184 ----a-w C:\Programmi\Nokia_Connectivity_Cable_Driver_6_80_5_1_ita.msi
2007-05-06 10:45 658,432 ----a-w C:\Programmi\nokia_connectivity_cable_driver_rel_6_81_1_spa.msi
2007-05-06 10:07 2,372,760 ----a-w C:\Programmi\winzip90.exe
2007-05-06 10:05 13,185,024 ----a-w C:\Programmi\Nokia_DKU-5_1_24.exe
2007-05-06 08:45 273,229,544 ----a-w C:\Programmi\WindowsXP-KB835935-SP2-ITA.exe
2007-05-06 08:20 445,208 ----a-w C:\Programmi\windowsxp-kb838989-X86-ITA.exe
2007-05-06 08:08 5,034,240 ----a-w C:\Programmi\DriverDetective.exe
2007-05-06 08:04 829,577 ----a-w C:\Programmi\modem_it.chm
2007-05-05 22:32 994,304 ----a-w C:\Programmi\Setup.msi
2007-05-05 22:01 21,485,136 ----a-w C:\Programmi\Nokia_PC_Suite_683_rel_14_1_ita_web.exe
2007-05-05 21:29 23,785,680 ----a-w C:\Programmi\NokiaSoftwareUpdaterSetup_it.exe
2007-05-05 15:40 840,192 ----a-w C:\Programmi\Nokia_Connectivity_Cable_Driver_rel_6_83_9_0_eng.msi
2007-05-05 15:39 6,685 ----a-w C:\Programmi\Nokia6103_MS_BT.inf
2007-05-05 15:39 6,494 ----a-w C:\Programmi\Nokia6103BT.inf
2007-04-30 11:31 4,212,210 ----a-w C:\Programmi\Demo_SSTworld.exe
2007-04-30 11:27 4,064,518 ----a-w C:\Programmi\bettinggenius30.exe
2007-04-29 00:11 1,087,682 ----a-w C:\Programmi\subtitleworkshop251.zip
2007-04-24 16:09 10,451,656 ----a-w C:\Programmi\XLVIEWER.EXE
2007-04-24 16:05 28,508,368 ----a-w C:\Programmi\FileFormatConverters.exe
2007-04-24 16:01 1,321 ----a-w C:\Programmi\katalog18apr07.CSV
2007-04-24 15:51 4,792,136 ----a-w C:\Programmi\CX.EXE
2007-04-24 15:48 735,232 ----a-w C:\Programmi\katalog18Apr07.xls
2007-04-24 15:46 12,337,352 ----a-w C:\Programmi\WDVIEWER.EXE
2007-04-19 20:34 122,880 ----a-w C:\Programmi\Download_wma-mp3-converter.exe
2007-04-18 08:37 1,014,730 ----a-w C:\Programmi\PowerISO37.exe
2007-03-28 22:14 6,597,960 ----a-w C:\Programmi\audioconverter_wmf_setup.exe
2007-03-28 22:08 4,708,303 ----a-w C:\Programmi\mms1001.exe
2007-03-28 21:33 404,890 ----a-w C:\Programmi\switch.zip
2007-03-25 09:56 122,880 ----a-w C:\Programmi\Download_AliveWMAMP3Recorder.exe
2007-03-25 06:50 3,326,142 ----a-w C:\Programmi\DupKillerSetup081.zip
2007-03-20 22:19 4,107,201 ----a-w C:\Programmi\burn4free_setup.exe
2007-03-20 21:48 1,219,544 ----a-w C:\Programmi\mp3cddoctorlite.exe
2007-03-18 22:48 1,988,744 ----a-w C:\Programmi\trojanb6758.exe
2007-03-18 22:42 414,580 ----a-w C:\Programmi\Megamp3Split_2.0b.zip
2007-03-18 11:58 59,392 ----a-w C:\Programmi\Italian_Serie_A_06-07.mdb
2007-03-18 10:13 2,863,832 ----a-w C:\Programmi\DeepBurner1.exe
2007-03-18 08:37 15,342,568 ----a-w C:\Programmi\20070317-017-i32.exe
2007-03-18 08:31 13,445,912 ----a-w C:\Programmi\XPBP_ESD_IT.exe
2007-03-17 22:42 3,109,256 ----a-w C:\Programmi\LinkScannerProSetup_2_5_2_0052_9.exe
2007-03-16 18:05 402,208 ----a-w C:\Programmi\rainbow(zabranjeno)-1.2-win.zip
2007-03-16 15:22 652,560 ----a-w C:\Programmi\pdf2text.exe
2007-03-16 13:44 1,622,912 ----a-w C:\Programmi\CuteWriter.exe
2007-03-16 12:57 697,042 ----a-w C:\Programmi\Scan2PDF.zip
2007-03-16 10:12 934,479 ----a-w C:\Programmi\TE20Setup.exe
2007-03-13 15:34 71,737,595 ----a-w C:\Programmi\200301010000aib.zip
2007-03-13 15:17 3,519,074 ----a-w C:\Programmi\teach800.exe
2007-03-13 15:12 23,510,720 ----a-w C:\Programmi\dotnetfx.exe
2007-03-13 14:14 14,730,232 ----a-w C:\Programmi\DivXPlay.exe
2007-03-11 21:30 1,834,548 ----a-w C:\Programmi\tbrush35 slikanje.exe
2007-03-11 21:21 34,959,384 ----a-w C:\Programmi\5.05.18.00_ntune_winxp_international.exe
2007-03-11 21:19 9,590,117 ----a-w C:\Programmi\kmp.exe
2007-03-11 21:14 4,237,337 ----a-w C:\Programmi\RLSetup_Final.exe
2007-03-11 21:10 34,282,256 ----a-w C:\Programmi\AVSTVBox.exe
2007-03-11 20:58 24,836,360 ----a-w C:\Programmi\acdsee.exe
2007-03-11 20:52 3,424,620 ----a-w C:\Programmi\MP4 Video Player.zip
2007-03-11 14:29 2,649,601 ----a-w C:\Programmi\winsonar_free_70103.zip
2007-03-11 13:17 988,039 ----a-w C:\Programmi\starsetup.exe
2007-03-11 10:50 6,932,421 ----a-w C:\Programmi\Alcohol52.zip
2007-03-11 10:45 2,579,338 ----a-w C:\Programmi\MyPhoneExplorer_Setup_1.5.9.exe
2007-03-11 10:40 1,118,786 ----a-w C:\Programmi\installer_Ringtone_CD_Ripper.exe
2007-03-11 10:38 1,665,325 ----a-w C:\Programmi\agsetup sa cd-ea.exe
2007-03-11 10:31 12,128,824 ----a-w C:\Programmi\SimpleDivX.zip
2007-03-11 00:56 56 --sh--r C:\WINDOWS\system32\590BA312D1.sys
2007-03-11 00:56 1,890 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.
<pre>
----a-w            61,440 2008-03-09 13:45:27  C:\hp\KBD\KBD .EXE
----a-w         1,603,152 2008-03-09 13:45:33  C:\Programmi\Canon\MyPrinter\BJMyPrt .exe
----a-w           644,696 2008-03-09 13:45:31  C:\Programmi\Canon\SolutionMenu\CNSLMAIN .exe
----a-w           155,648 2008-01-19 17:03:55  C:\Programmi\File comuni\Ahead\Lib\NeroCheck .exe
----a-w           210,472 2008-03-09 13:45:33  C:\Programmi\File comuni\ScanSoft Shared\SSBkgdUpdate\SSBkgdupdate .exe
----a-w           176,128 2008-03-09 13:46:08  C:\Programmi\LogiGuard\Master Mechanic II\agent .exe
----a-w            79,400 2008-01-19 17:04:13  C:\Programmi\ScanSoft\OmniPageSE4\OpwareSE4 .exe
----a-w         2,870,784 2008-03-09 07:14:10  C:\Programmi\Spyware Terminator\SpywareTerminatorShield .exe
----a-w            64,512 2008-03-06 17:11:32  C:\WINDOWS\ehome\ehtray .exe
----a-w            15,360 2008-01-27 07:59:23  C:\WINDOWS\system32\ctfmon .exe
</pre>


((((((((((((((((((((((((((((( [Link mogu videti samo ulogovani korisnici] )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-03-15 18:08:36 86,016 ----a-r C:\WINDOWS\Installer\{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}\PrntWzrdIco.exe
+ 2008-03-15 18:09:31 102,400 ----a-r C:\WINDOWS\Installer\{80FD852F-5AAC-4129-B931-06AAFFA43138}\iTunesIco.exe
+ 2008-03-15 18:07:20 27,136 ----a-r C:\WINDOWS\Installer\{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}\AppleSoftwareUpdateIco.exe
+ 2007-07-24 14:17:08 81,920 ----a-w C:\WINDOWS\system32\dns-sd.exe
+ 2007-07-24 14:17:08 61,440 ----a-w C:\WINDOWS\system32\dnssd.dll
+ 2006-09-19 13:44:04 15,664 ----a-w C:\WINDOWS\system32\drivers\GEARAspiWDM.sys
+ 2008-02-18 10:16:24 30,464 -c--a-w C:\WINDOWS\system32\DRVSTORE\usbaapl_4351B7DAFF62FD33510D77DFAE3CF8CC82517571\usbaapl.sys
+ 2006-10-03 18:47:52 109,360 ----a-w C:\WINDOWS\system32\GEARAspi.dll
+ 2008-03-16 06:09:36 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_334.dat
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* i valori vuoti & legittimi/default non sono visualizzati.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{33161E98-0A6C-4d3c-BD62-3A7D56137F52}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7EBD0DF4-1263-4ED3-96CB-4CDC66C58318}]
C:\WINDOWS\system32\mlljj.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e133f12d-08c2-4d7e-a5f7-09cc0a4a151d}]
C:\WINDOWS\system32\cidqmmrf.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Procs]
@={51D8EAB2-A055-487F-BBE0-DFB79DD0E76D}

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [ ]
"Uniblue SpeedUpMyPC"="C:\Programmi\Uniblue\SpeedUpMyPC\SpeedUpMyPC.exe" [2007-01-12 09:26 5288960]
"Uniblue RegistryBooster 2"="C:\Programmi\Uniblue\RegistryBooster 2\RegistryBooster.exe" [2007-12-05 16:06 1885464]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ftutil2"="ftutil2.dll" [2004-06-07 13:05 106496 C:\WINDOWS\system32\ftutil2.dll]
"nwiz"="nwiz.exe" [2006-10-22 11:22 1622016 C:\WINDOWS\system32\nwiz.exe]
"CanonSolutionMenu"="C:\Programmi\Canon\SolutionMenu\CNSLMAIN.exe" [2008-03-09 14:42 644696]
"CanonMyPrinter"="C:\Programmi\Canon\MyPrinter\BJMyPrt.exe" [2008-03-09 18:45 1603152]
"SSBkgdUpdate"="C:\Programmi\File comuni\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2008-03-09 18:44 210472]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 11:22 7700480]
"SpywareTerminator"="C:\Programmi\Spyware Terminator\SpywareTerminatorShield.exe" [2008-03-09 18:46 2870784]
"UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" [ ]
"kis"="C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" [2006-03-24 19:09 139367]
"QuickTime Task"="C:\Programmi\QuickTime\QTTask.exe" [2008-01-31 23:13 385024]
"iTunesHelper"="C:\Programmi\iTunes\iTunesHelper.exe" [2008-02-19 13:10 267048]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoSecCPL"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoConfigPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoNetSetup"= 0 (0x0)
"NoNetSetupIDPage"= 0 (0x0)
"NoNetSetupSecurityPage"= 0 (0x0)
"NoWorkgroupContents"= 0 (0x0)
"NoEntireNetwork"= 0 (0x0)
"NoFileSharingControl"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoStartMenuPinnedList"= 0 (0x0)
"NoStartMenuMFUprogramsList"= 0 (0x0)
"NoUserNameInStartMenu"= 0 (0x0)
"NoStartMenuSubFolders"= 0 (0x0)
"NoCommonGroups"= 0 (0x0)
"NoPrinterTabs"= 0 (0x0)
"NoDeletePrinter"= 0 (0x0)
"NoAddPrinter"= 0 (0x0)
"NoPrinters"= 0 (0x0)
"NoFavoritesMenu"= 0 (0x0)
"NoToolbarCustomize"= 0 (0x0)
"NoRecentDocsNetHood"= 0 (0x0)
"NoChangeAnimation"= 0 (0x0)
"NoChangeKeyboardNavigationIndicators"= 0 (0x0)
"RestrictRun"= 0 (0x0)
"NoResolveTrack"= 1 (0x1)
"NoThumbnailCache"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoRun"= 0 (0x0)
"NoLogOff"= 0 (0x0)
"NoFind"= 0 (0x0)
"NoClose"= 0 (0x0)
"NoSetFolders"= 0 (0x0)
"NoFavoritesMenu"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcawts]
efcawts.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"xmlprov"=3 (0x3)
"WudfSvc"=3 (0x3)
"ServiceLayer"=3 (0x3)
"Fax"=3 (0x3)
"BlueSoleil Hid Service"=2 (0x2)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe"
"VoipStunt"="C:\Programmi\VoipStunt.com\VoipStunt\VoipStunt.exe" -nosplash -minimized
"DAEMON Tools"="C:\Programmi\DAEMON Tools\daemon.exe" -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"RegEasy.exe"=C:\Programmi\Registry Easy\RegEasy.exe
"SpywareTerminator"="C:\Programmi\Spyware Terminator\SpywareTerminatorShield.exe"
"ISUSPM Startup"=C:\PROGRA~1\FILECO~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
"ISUSScheduler"="C:\Programmi\File comuni\InstallShield\UpdateService\issch.exe" -start

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"C:\\Programmi\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Programmi\\Sitecom\\IVT BlueSoleil\\BlueSoleil.exe"=
"C:\\Programmi\\THQ\\Dawn of War - Dark Crusade\\DarkCrusade.exe"=
"C:\\Programmi\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe"=
"C:\\Programmi\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"=
"C:\\Programmi\\NAMCO BANDAI Games\\Warhammer Mark of Chaos\\Warhammer.exe"=
"C:\\Programmi\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"C:\\Programmi\\RadLight Company\\RadLight 4.0\\rlkernel.exe"=
"C:\Programmi\Microsoft ActiveSync\rapimgr.exe"= C:\Programmi\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"C:\Programmi\Microsoft ActiveSync\WCESMgr.exe"= C:\Programmi\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"C:\\Programmi\\Bonjour\\mDNSResponder.exe"=
"C:\\Programmi\\iTunes\\iTunes.exe"=
"C:\\Programmi\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"4662:TCP"= 4662:TCP:emule
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
\Shell\AutoRun\command - J:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\K]
\Shell\AutoRun\command - K:\Autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7ca93cf4-7368-11dc-82fa-001731e138a9}]
\Shell\AutoRun\command - K:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{83cc3187-cece-11db-821f-806d6172696f}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{83cc318d-cece-11db-821f-806d6172696f}]
\Shell\AutoRun\command - J:\Autorun.exe

*Newly Created Service* - RIVATUNER32
.
Contenuto della cartella 'Scheduled Tasks'
"2008-03-07 21:19:22 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Programmi\TuneUp Utilities 2006\SystemOptimizer.exe
"2008-03-15 18:07:19 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Programmi\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2008-03-16 17:11:13
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
Ora fine scansione: 2008-03-16 17:11:59
ComboFix-quarantined-files.txt 2008-03-16 16:11:56
ComboFix2.txt 2008-03-16 11:58:46
ComboFix3.txt 2008-03-15 16:13:37
ComboFix4.txt 2008-03-15 12:22:10
.
2007-10-07 01:25:16 --- E O F ---

Poslao: 16 Mar 2008 17:34
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Uhhh... Ni ovo nije dobro, ali je ovaj put moja greška.
No, deo posla je bar obavljen.

Da Desktopu imaš folder th3 i u njemu se nalazi ComboFix.
Sada bi tamo trebao biti i file CFScript.

Prevuci file CFScript na ikonicu ComboFix-a kao na slici:




Kad bude gotovo, logfile će se otvoriti - iskopiraj ga ovde.

Poslao: 16 Mar 2008 17:54
Idi na vrh
offline
  • Pridružio: 09 Mar 2008
  • Poruke: 42

ComboFix 08-03-14.4 - HP_Administrator 2008-03-16 17.45.34.5 - NTFSx86
Eseguito da: C:\Documents and Settings\HP_Administrator\Desktop\th3\ComboFix.exe
Command switches used :: C:\Documents and Settings\HP_Administrator\Desktop\th3\CFScript.txt
* Creato nuovo punto di ripristino

FILE ::
C:\Documents and Settings\HP_Administrator\Dati applicazioni\wklnhst.dat
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\HP_Administrator\Dati applicazioni\wklnhst.dat
C:\VundoFix Backups
C:\VundoFix Backups\addmorefiles.txt
C:\VundoFix Backups\PWRISOSH.DLL.bad
C:\VundoFix Backups\ymfevzil.dllbox.bad

.
((((((((((((((((((((((((( Files Creati Da 2008-02-16 al 2008-03-16 )))))))))))))))))))))))))))))))))))
.

2008-03-16 11:10 . 2007-10-04 10:01 66,048 --a------ C:\WINDOWS\ieResetIcons.exe
2008-03-16 08:42 . 2008-03-16 08:42 <DIR> d-------- C:\Programmi\RivaTuner v2.08
2008-03-16 08:41 . 2008-03-16 14:27 <DIR> d-------- C:\programi internet
2008-03-16 07:49 . 2008-03-16 07:49 4,131,160 --a------ C:\registrybooster.exe
2008-03-16 07:45 . 2008-03-16 07:45 3,995,968 --a------ C:\systemtweakerv1.0 kupljen.exe
2008-03-15 21:55 . 2008-03-15 21:55 <DIR> d-------- C:\Documents and Settings\LocalService\Dati applicazioni\Ahead
2008-03-15 19:11 . 2008-03-16 07:09 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-03-15 19:11 . 2008-03-15 19:11 1,409 --a------ C:\WINDOWS\QTFont.for
2008-03-15 19:09 . 2008-03-15 19:09 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Dati applicazioni\Apple Computer
2008-03-15 19:08 . 2008-03-15 19:09 <DIR> d-------- C:\Programmi\iTunes
2008-03-15 19:08 . 2008-03-15 19:08 <DIR> d-------- C:\Programmi\iPod
2008-03-15 19:08 . 2008-03-15 19:08 <DIR> d-------- C:\Programmi\Bonjour
2008-03-15 19:07 . 2008-03-15 19:07 <DIR> d-------- C:\Programmi\Apple Software Update
2008-03-15 19:06 . 2008-03-15 19:06 <DIR> d-------- C:\Programmi\File comuni\Apple
2008-03-15 19:06 . 2008-03-15 19:06 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Apple
2008-03-15 18:53 . 2008-03-15 19:01 59,163,944 --a------ C:\iTunesSetup.exe
2008-03-15 16:54 . 2008-03-15 16:54 4,561,816 --a------ C:\sump3_5_2435_209 kuplljenn.exe
2008-03-15 12:13 . 2008-03-15 12:13 <DIR> d-------- C:\Programmi\WinPcap
2008-03-14 23:54 . 2008-03-14 23:54 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Kaspersky Lab Setup Files
2008-03-09 14:10 . 2008-03-15 12:16 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\RFA_Backups
2008-03-09 14:01 . 2008-03-09 14:01 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Dati applicazioni\RegClean
2008-03-09 08:31 . 2008-03-09 08:32 <DIR> d-------- C:\Sanjarica
2008-03-09 08:11 . 2008-03-15 17:00 <DIR> d-------- C:\Programmi\Kaspersky Lab
2008-03-09 08:11 . 2008-03-09 08:11 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Kaspersky Lab
2008-03-09 08:11 . 2008-03-16 17:48 7,384,864 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-03-09 08:11 . 2008-03-15 13:14 92,720 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-03-09 08:11 . 2008-03-15 21:46 69,408 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-03-09 08:11 . 2008-03-15 13:14 3,476 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-03-04 18:34 . 2008-03-04 18:57 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Dati applicazioni\Prevx
2008-03-02 17:28 . 2008-03-02 17:28 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Dati applicazioni\Snapfish
2008-03-02 13:57 . 2008-03-02 13:57 <DIR> d-------- C:\Programmi\VoipStunt.com
2008-03-02 13:57 . 2008-03-02 13:57 <DIR> d-------- C:\Programmi\ACD Systems
2008-03-02 13:57 . 2008-03-02 13:57 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\ACD Systems
2008-03-02 13:55 . 2008-03-02 13:55 <DIR> d-------- C:\Programmi\Vinci al SuperEnalotto 2
2008-03-02 13:55 . 2008-03-02 13:55 <DIR> d-------- C:\Programmi\Veoh Networks
2008-03-02 13:55 . 2008-03-02 13:55 <DIR> d-------- C:\Programmi\NEXT 3D ARREDAMENTO D'INTERNI
2008-03-02 13:55 . 2008-03-02 13:55 <DIR> d-------- C:\Programmi\Mario Forever
2008-03-02 13:55 . 2008-03-02 13:55 <DIR> d-------- C:\Programmi\Le Guide di Finson Patente Europea per il Computer 2
2008-03-02 13:55 . 2008-03-02 13:55 <DIR> d-------- C:\Programmi\Hair Pro 2006 Light
2008-02-20 21:29 . 2008-02-20 21:29 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Dati applicazioni\ProtezionefiData
2008-02-20 21:28 . 2008-03-02 13:55 <DIR> d-------- C:\Programmi\ProtezionefiData
2008-02-16 20:39 . 2008-02-16 20:39 <DIR> d-------- C:\Programmi\Navman

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-16 16:48 --------- d-----w C:\Documents and Settings\HP_Administrator\Dati applicazioni\Skype
2008-03-16 16:45 --------- d-----w C:\Programmi\Spyware Terminator
2008-03-16 13:33 --------- d-----w C:\Documents and Settings\HP_Administrator\Dati applicazioni\CallingID
2008-03-16 09:44 --------- d-----w C:\Programmi\RegistryFix
2008-03-16 09:00 --------- d-----w C:\Programmi\eMule
2008-03-16 08:41 --------- d-----w C:\Programmi\Spybot - Search & Destroy
2008-03-16 07:23 --------- d-----w C:\Programmi\Mozilla Thunderbird
2008-03-16 06:45 --------- d-----w C:\Programmi\Uniblue
2008-03-15 18:15 --------- d-----w C:\Programmi\QuickTime
2008-03-15 18:08 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\Apple Computer
2008-03-15 11:11 --------- d-----w C:\Programmi\iViVo
2008-03-15 11:09 --------- d--h--w C:\Programmi\InstallShield Installation Information
2008-03-15 10:54 --------- d-----w C:\Programmi\PowerISO
2008-03-14 19:50 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\Spyware Terminator
2008-03-13 12:09 --------- d-----w C:\Programmi\Zortam Mp3 Media Studio
2008-03-13 12:09 --------- d-----w C:\Programmi\Microsoft ActiveSync
2008-03-09 07:08 --------- d-----w C:\Programmi\ESET
2008-03-07 18:36 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\CanonIJPLM
2008-03-06 17:11 64,512 ----a-w C:\WINDOWS\system32\dllcache\ehtray.exe
2008-03-02 12:57 --------- d-----w C:\Programmi\File comuni\ACD Systems
2008-03-02 12:55 --------- d-----w C:\Programmi\TorrenTopia
2008-03-01 19:08 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\AntiVir PersonalEdition Classic
2008-02-27 15:35 --------- d-----w C:\Documents and Settings\HP_Administrator\Dati applicazioni\Uniblue
2008-02-03 11:51 --------- d-----w C:\Programmi\PrestoNotes
2008-02-03 10:45 --------- d-----w C:\Programmi\Ashampoo
2008-01-27 07:59 15,360 ----a-w C:\WINDOWS\system32\dllcache\ctfmon.exe
2008-01-27 07:59 15,360 ----a-w C:\WINDOWS\system32\ctfmon.exe
2008-01-19 23:03 --------- d-----w C:\Programmi\HP
2008-01-19 17:06 --------- d-----w C:\Programmi\LogiGuard
2007-06-03 20:31 540,000 ----a-w C:\Programmi\System Cleaner 5.50.zip
2007-05-30 19:13 4,660,390 ----a-w C:\Programmi\DV_Install_Demo_v21.exe
2007-05-30 19:05 947,526 ----a-w C:\Programmi\waver.zip
2007-05-30 19:03 186,767 ----a-w C:\Programmi\audc80konvertor.exe
2007-05-30 18:39 4,408,592 ----a-w C:\Programmi\vfvh571i fax.exe
2007-05-20 08:56 814,016 ----a-w C:\Programmi\Google_Updater.exe
2007-05-19 08:06 6,337,564 ----a-w C:\Programmi\WebUpdaterForLegacyOperatingSystems_240.exe
2007-05-19 07:57 4,310,568 ----a-w C:\Programmi\WebUpdater_241 za navigator.exe
2007-05-06 17:17 17,938,288 ----a-w C:\Programmi\Install_Messenger.exe
2007-05-06 15:33 10,064,213 ----a-w C:\Programmi\POILoader_232.exe
2007-05-06 10:46 669,184 ----a-w C:\Programmi\Nokia_Connectivity_Cable_Driver_6_80_5_1_ita.msi
2007-05-06 10:45 658,432 ----a-w C:\Programmi\nokia_connectivity_cable_driver_rel_6_81_1_spa.msi
2007-05-06 10:07 2,372,760 ----a-w C:\Programmi\winzip90.exe
2007-05-06 10:05 13,185,024 ----a-w C:\Programmi\Nokia_DKU-5_1_24.exe
2007-05-06 08:45 273,229,544 ----a-w C:\Programmi\WindowsXP-KB835935-SP2-ITA.exe
2007-05-06 08:20 445,208 ----a-w C:\Programmi\windowsxp-kb838989-X86-ITA.exe
2007-05-06 08:08 5,034,240 ----a-w C:\Programmi\DriverDetective.exe
2007-05-06 08:04 829,577 ----a-w C:\Programmi\modem_it.chm
2007-05-05 22:32 994,304 ----a-w C:\Programmi\Setup.msi
2007-05-05 22:01 21,485,136 ----a-w C:\Programmi\Nokia_PC_Suite_683_rel_14_1_ita_web.exe
2007-05-05 21:29 23,785,680 ----a-w C:\Programmi\NokiaSoftwareUpdaterSetup_it.exe
2007-05-05 15:40 840,192 ----a-w C:\Programmi\Nokia_Connectivity_Cable_Driver_rel_6_83_9_0_eng.msi
2007-05-05 15:39 6,685 ----a-w C:\Programmi\Nokia6103_MS_BT.inf
2007-05-05 15:39 6,494 ----a-w C:\Programmi\Nokia6103BT.inf
2007-04-30 11:31 4,212,210 ----a-w C:\Programmi\Demo_SSTworld.exe
2007-04-30 11:27 4,064,518 ----a-w C:\Programmi\bettinggenius30.exe
2007-04-29 00:11 1,087,682 ----a-w C:\Programmi\subtitleworkshop251.zip
2007-04-24 16:09 10,451,656 ----a-w C:\Programmi\XLVIEWER.EXE
2007-04-24 16:05 28,508,368 ----a-w C:\Programmi\FileFormatConverters.exe
2007-04-24 16:01 1,321 ----a-w C:\Programmi\katalog18apr07.CSV
2007-04-24 15:51 4,792,136 ----a-w C:\Programmi\CX.EXE
2007-04-24 15:48 735,232 ----a-w C:\Programmi\katalog18Apr07.xls
2007-04-24 15:46 12,337,352 ----a-w C:\Programmi\WDVIEWER.EXE
2007-04-19 20:34 122,880 ----a-w C:\Programmi\Download_wma-mp3-converter.exe
2007-04-18 08:37 1,014,730 ----a-w C:\Programmi\PowerISO37.exe
2007-03-28 22:14 6,597,960 ----a-w C:\Programmi\audioconverter_wmf_setup.exe
2007-03-28 22:08 4,708,303 ----a-w C:\Programmi\mms1001.exe
2007-03-28 21:33 404,890 ----a-w C:\Programmi\switch.zip
2007-03-25 09:56 122,880 ----a-w C:\Programmi\Download_AliveWMAMP3Recorder.exe
2007-03-25 06:50 3,326,142 ----a-w C:\Programmi\DupKillerSetup081.zip
2007-03-20 22:19 4,107,201 ----a-w C:\Programmi\burn4free_setup.exe
2007-03-20 21:48 1,219,544 ----a-w C:\Programmi\mp3cddoctorlite.exe
2007-03-18 22:48 1,988,744 ----a-w C:\Programmi\trojanb6758.exe
2007-03-18 22:42 414,580 ----a-w C:\Programmi\Megamp3Split_2.0b.zip
2007-03-18 11:58 59,392 ----a-w C:\Programmi\Italian_Serie_A_06-07.mdb
2007-03-18 10:13 2,863,832 ----a-w C:\Programmi\DeepBurner1.exe
2007-03-18 08:37 15,342,568 ----a-w C:\Programmi\20070317-017-i32.exe
2007-03-18 08:31 13,445,912 ----a-w C:\Programmi\XPBP_ESD_IT.exe
2007-03-17 22:42 3,109,256 ----a-w C:\Programmi\LinkScannerProSetup_2_5_2_0052_9.exe
2007-03-16 18:05 402,208 ----a-w C:\Programmi\rainbow(zabranjeno)-1.2-win.zip
2007-03-16 15:22 652,560 ----a-w C:\Programmi\pdf2text.exe
2007-03-16 13:44 1,622,912 ----a-w C:\Programmi\CuteWriter.exe
2007-03-16 12:57 697,042 ----a-w C:\Programmi\Scan2PDF.zip
2007-03-16 10:12 934,479 ----a-w C:\Programmi\TE20Setup.exe
2007-03-13 15:34 71,737,595 ----a-w C:\Programmi\200301010000aib.zip
2007-03-13 15:17 3,519,074 ----a-w C:\Programmi\teach800.exe
2007-03-13 15:12 23,510,720 ----a-w C:\Programmi\dotnetfx.exe
2007-03-13 14:14 14,730,232 ----a-w C:\Programmi\DivXPlay.exe
2007-03-11 21:30 1,834,548 ----a-w C:\Programmi\tbrush35 slikanje.exe
2007-03-11 21:21 34,959,384 ----a-w C:\Programmi\5.05.18.00_ntune_winxp_international.exe
2007-03-11 21:19 9,590,117 ----a-w C:\Programmi\kmp.exe
2007-03-11 21:14 4,237,337 ----a-w C:\Programmi\RLSetup_Final.exe
2007-03-11 21:10 34,282,256 ----a-w C:\Programmi\AVSTVBox.exe
2007-03-11 20:58 24,836,360 ----a-w C:\Programmi\acdsee.exe
2007-03-11 20:52 3,424,620 ----a-w C:\Programmi\MP4 Video Player.zip
2007-03-11 14:29 2,649,601 ----a-w C:\Programmi\winsonar_free_70103.zip
2007-03-11 13:17 988,039 ----a-w C:\Programmi\starsetup.exe
2007-03-11 10:50 6,932,421 ----a-w C:\Programmi\Alcohol52.zip
2007-03-11 10:45 2,579,338 ----a-w C:\Programmi\MyPhoneExplorer_Setup_1.5.9.exe
2007-03-11 10:40 1,118,786 ----a-w C:\Programmi\installer_Ringtone_CD_Ripper.exe
2007-03-11 10:38 1,665,325 ----a-w C:\Programmi\agsetup sa cd-ea.exe
2007-03-11 00:56 56 --sh--r C:\WINDOWS\system32\590BA312D1.sys
2007-03-11 00:56 1,890 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( [Link mogu videti samo ulogovani korisnici] )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-03-06 17:11:32 64,512 ----a-w C:\WINDOWS\ehome\ehtray.exe
+ 2008-03-15 18:08:36 86,016 ----a-r C:\WINDOWS\Installer\{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}\PrntWzrdIco.exe
+ 2008-03-15 18:09:31 102,400 ----a-r C:\WINDOWS\Installer\{80FD852F-5AAC-4129-B931-06AAFFA43138}\iTunesIco.exe
+ 2008-03-15 18:07:20 27,136 ----a-r C:\WINDOWS\Installer\{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}\AppleSoftwareUpdateIco.exe
+ 2007-07-24 14:17:08 81,920 ----a-w C:\WINDOWS\system32\dns-sd.exe
+ 2007-07-24 14:17:08 61,440 ----a-w C:\WINDOWS\system32\dnssd.dll
+ 2006-09-19 13:44:04 15,664 ----a-w C:\WINDOWS\system32\drivers\GEARAspiWDM.sys
+ 2008-02-18 10:16:24 30,464 -c--a-w C:\WINDOWS\system32\DRVSTORE\usbaapl_4351B7DAFF62FD33510D77DFAE3CF8CC82517571\usbaapl.sys
+ 2006-10-03 18:47:52 109,360 ----a-w C:\WINDOWS\system32\GEARAspi.dll
+ 2008-03-16 06:09:36 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_334.dat
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* i valori vuoti & legittimi/default non sono visualizzati.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Procs]
@={51D8EAB2-A055-487F-BBE0-DFB79DD0E76D}

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [ ]
"Uniblue SpeedUpMyPC"="C:\Programmi\Uniblue\SpeedUpMyPC\SpeedUpMyPC.exe" [2007-01-12 09:26 5288960]
"Uniblue RegistryBooster 2"="C:\Programmi\Uniblue\RegistryBooster 2\RegistryBooster.exe" [2007-12-05 16:06 1885464]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ftutil2"="ftutil2.dll" [2004-06-07 13:05 106496 C:\WINDOWS\system32\ftutil2.dll]
"nwiz"="nwiz.exe" [2006-10-22 11:22 1622016 C:\WINDOWS\system32\nwiz.exe]
"CanonSolutionMenu"="C:\Programmi\Canon\SolutionMenu\CNSLMAIN.exe" [2008-03-09 14:45 644696]
"CanonMyPrinter"="C:\Programmi\Canon\MyPrinter\BJMyPrt.exe" [2008-03-09 14:45 1603152]
"SSBkgdUpdate"="C:\Programmi\File comuni\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2008-03-09 14:45 210472]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 11:22 7700480]
"SpywareTerminator"="C:\Programmi\Spyware Terminator\SpywareTerminatorShield.exe" [2008-03-09 08:14 2870784]
"UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" [ ]
"kis"="C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" [2006-03-24 19:09 139367]
"QuickTime Task"="C:\Programmi\QuickTime\QTTask.exe" [2008-01-31 23:13 385024]
"iTunesHelper"="C:\Programmi\iTunes\iTunesHelper.exe" [2008-02-19 13:10 267048]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoSecCPL"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoConfigPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoNetSetup"= 0 (0x0)
"NoNetSetupIDPage"= 0 (0x0)
"NoNetSetupSecurityPage"= 0 (0x0)
"NoWorkgroupContents"= 0 (0x0)
"NoEntireNetwork"= 0 (0x0)
"NoFileSharingControl"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoStartMenuPinnedList"= 0 (0x0)
"NoStartMenuMFUprogramsList"= 0 (0x0)
"NoUserNameInStartMenu"= 0 (0x0)
"NoStartMenuSubFolders"= 0 (0x0)
"NoCommonGroups"= 0 (0x0)
"NoPrinterTabs"= 0 (0x0)
"NoDeletePrinter"= 0 (0x0)
"NoAddPrinter"= 0 (0x0)
"NoPrinters"= 0 (0x0)
"NoFavoritesMenu"= 0 (0x0)
"NoToolbarCustomize"= 0 (0x0)
"NoRecentDocsNetHood"= 0 (0x0)
"NoChangeAnimation"= 0 (0x0)
"NoChangeKeyboardNavigationIndicators"= 0 (0x0)
"RestrictRun"= 0 (0x0)
"NoResolveTrack"= 1 (0x1)
"NoThumbnailCache"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoRun"= 0 (0x0)
"NoLogOff"= 0 (0x0)
"NoFind"= 0 (0x0)
"NoClose"= 0 (0x0)
"NoSetFolders"= 0 (0x0)
"NoFavoritesMenu"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"xmlprov"=3 (0x3)
"WudfSvc"=3 (0x3)
"ServiceLayer"=3 (0x3)
"Fax"=3 (0x3)
"BlueSoleil Hid Service"=2 (0x2)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe"
"VoipStunt"="C:\Programmi\VoipStunt.com\VoipStunt\VoipStunt.exe" -nosplash -minimized
"DAEMON Tools"="C:\Programmi\DAEMON Tools\daemon.exe" -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"RegEasy.exe"=C:\Programmi\Registry Easy\RegEasy.exe
"SpywareTerminator"="C:\Programmi\Spyware Terminator\SpywareTerminatorShield.exe"
"ISUSPM Startup"=C:\PROGRA~1\FILECO~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
"ISUSScheduler"="C:\Programmi\File comuni\InstallShield\UpdateService\issch.exe" -start

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Programmi\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"C:\\Programmi\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Programmi\\Sitecom\\IVT BlueSoleil\\BlueSoleil.exe"=
"C:\\Programmi\\THQ\\Dawn of War - Dark Crusade\\DarkCrusade.exe"=
"C:\\Programmi\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe"=
"C:\\Programmi\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"=
"C:\\Programmi\\NAMCO BANDAI Games\\Warhammer Mark of Chaos\\Warhammer.exe"=
"C:\\Programmi\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"C:\\Programmi\\RadLight Company\\RadLight 4.0\\rlkernel.exe"=
"C:\Programmi\Microsoft ActiveSync\rapimgr.exe"= C:\Programmi\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"C:\Programmi\Microsoft ActiveSync\WCESMgr.exe"= C:\Programmi\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"C:\\Programmi\\Bonjour\\mDNSResponder.exe"=
"C:\\Programmi\\iTunes\\iTunes.exe"=
"C:\\Programmi\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"4662:TCP"= 4662:TCP:emule
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
\Shell\AutoRun\command - J:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\K]
\Shell\AutoRun\command - K:\Autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7ca93cf4-7368-11dc-82fa-001731e138a9}]
\Shell\AutoRun\command - K:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{83cc3187-cece-11db-821f-806d6172696f}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{83cc318d-cece-11db-821f-806d6172696f}]
\Shell\AutoRun\command - J:\Autorun.exe

*Newly Created Service* - RIVATUNER32
.
Contenuto della cartella 'Scheduled Tasks'
"2008-03-07 21:19:22 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Programmi\TuneUp Utilities 2006\SystemOptimizer.exe
"2008-03-15 18:07:19 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Programmi\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2008-03-16 17:48:07
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
Ora fine scansione: 2008-03-16 17.48.48
ComboFix-quarantined-files.txt 2008-03-16 16:48:46
ComboFix2.txt 2008-03-16 16:12:00
ComboFix3.txt 2008-03-16 11:58:46
ComboFix4.txt 2008-03-15 16:13:37
ComboFix5.txt 2008-03-15 12:22:10
.
2007-10-07 01:25:16 --- E O F ---

Poslao: 16 Mar 2008 18:00
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

To je to...

Rešili smo se posledica infekcije koju si imao.

Kakvo je sada stanje? Postoje li neki problemi?

Poslao: 16 Mar 2008 18:35
Idi na vrh
offline
  • Pridružio: 09 Mar 2008
  • Poruke: 42

Hvala bas si se namaltretirao oko mene svaka cast kako radite ovo profesionalno, ako postoji nacin za neku donaciju pomoc sajtu ili vec nekako .
Videcu ovih dana kako radi moracu ponovo da skinem IE on mi nije radi mesecima

Dopuna: 16 Mar 2008 18:35

A da dali da deinstaliram combofix sad ?

Poslao: 16 Mar 2008 19:24
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

MyCity » Ambulanta -> Arhiva Ambulante » Svastara

Ko je trenutno na forumu
 

Ukupno su 1439 korisnika na forumu :: 74 registrovanih, 5 sakrivenih i 1360 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: 357magnum, Aleksa 3215, Arsenije, Asteker, Avalon015, bigvlada, Bivan, bobomicek, boromir, bufanje, bukefal, BWG, chitach, Cian, Clouseau, cojapop, darkdruid72, delrey, Dimitrije Paunovic, Dimitrise93, Dioniss, Djota1, djuradj, doktor097, Dovla 1980, Electron, ElvisP, goranvas, HrcAk47, ikan, kaskadija, kihot, Korle, ladro, Litostroton, LostInSpaceandTime, Marko1238, mb1213, mercedesamg, Miki01, milutin134, mm1811, nazgul75, Nik_sasa, Nikolaa11, panzermilan45, panzerwaffe, Prašinar, Primus17, PrincipL, radoznao, Ran, repac, ruma, S-lash, Semprini, Sevetar, shaja1, Silvertooth, Stanlio, Stija zmija, takini, tmanda323, Tvrtko I, vathra, Vlada1389, vukovi, zlaya011, Zmaj001, zmajbre, Zorge, Zrcalo, zvomar, 1107