ComboFix 08-04-24.1 - Jarek 2008-04-25 15.42.39.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1040.18.610 [GMT 2:00]
Eseguito da: C:\Documents and Settings\Jarek\Desktop\ComboFix.exe
* Creato nuovo punto di ripristino
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Administrator\Impostazioni locali\Dati applicazioni\Microsoft\Windows Media\10.0\WMSDKNSD.XML
.
((((((((((((((((((((((((( Files Creati Da 2008-03-25 al 2008-04-25 )))))))))))))))))))))))))))))))))))
.
2008-04-25 14:51 . 2008-04-25 14:51
2008-04-25 13:58 . 2008-04-25 13:58
2008-04-25 13:11 . 2008-04-25 13:11
2008-04-25 13:11 . 2008-04-25 13:12
2008-04-25 13:11 . 2008-04-25 13:11
2008-04-25 13:03 . 2008-04-25 13:03 19 --a------ C:\WINDOWS\SoundConverter.INI
2008-04-24 16:50 . 2008-04-24 16:50
2008-04-24 16:50 . 2008-04-24 19:03
2008-04-24 16:50 . 2007-03-08 01:51 129,784 --------- C:\WINDOWS\system32\pxafs.dll
2008-04-24 16:50 . 2007-03-08 01:51 9,464 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2008-04-24 16:50 . 2007-03-08 01:51 9,336 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2008-04-23 22:34 . 2008-04-23 22:34
2008-04-23 22:31 . 2008-04-23 22:31
2008-04-23 21:02 . 2008-04-23 22:28
2008-04-23 20:50 . 2008-04-23 22:39
2008-04-23 20:50 . 2008-04-23 20:50
2008-04-23 20:47 . 2008-04-23 20:47
2008-04-23 20:00 . 2008-04-24 18:40
2008-04-23 19:59 . 2005-05-26 15:34 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll
2008-04-23 19:57 . 2008-04-23 19:59
2008-04-23 12:39 . 2008-04-23 12:39
2008-04-21 19:22 . 2008-04-21 19:37
2008-04-21 19:22 . 2006-10-04 16:06 1,197,294 --------- C:\WINDOWS\system32\dllcache\sysmain.sdb
2008-04-21 19:22 . 2006-10-04 16:06 764,868 --------- C:\WINDOWS\system32\dllcache\apph_sp.sdb
2008-04-21 19:22 . 2006-10-04 16:06 217,118 --------- C:\WINDOWS\system32\dllcache\apphelp.sdb
2008-04-21 19:20 . 2008-04-21 19:20
2008-04-21 19:20 . 2008-04-21 19:21
2008-04-18 20:52 . 2004-08-03 23:08 26,496 --a------ C:\WINDOWS\system32\dllcache\usbstor.sys
2008-04-17 17:45 . 2008-04-17 17:45
2008-04-16 21:26 . 2008-04-16 21:26
2008-04-16 21:10 . 2008-04-16 21:10
2008-04-16 21:10 . 2008-04-16 21:10
2008-04-15 17:58 . 2008-04-15 17:58
2008-04-15 17:13 . 2008-03-06 21:32 23,904 --a------ C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-04-15 17:13 . 2008-03-06 21:32 10,537 --a------ C:\WINDOWS\system32\drivers\COH_Mon.cat
2008-04-15 17:13 . 2008-03-06 21:32 706 --a------ C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-04-15 13:29 . 2007-03-21 20:33 503,808 --a------ C:\WINDOWS\system32\MSVCP71.DL1
2008-04-15 13:06 . 2008-04-15 13:09 16 --a------ C:\WINDOWS\system32\coh.cache
2008-04-15 13:04 . 2008-04-25 12:45
2008-04-15 13:03 . 2008-04-15 16:45
2008-04-15 13:03 . 2008-04-25 15:40
2008-04-15 13:03 . 2008-04-15 16:45 123,952 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-04-15 13:03 . 2008-04-15 16:45 60,800 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
2008-04-14 20:02 . 2008-04-14 20:02
2008-04-14 20:02 . 2008-04-25 15:06
2008-04-14 20:02 . 2008-04-14 20:02 32 --a------ C:\Documents and Settings\All Users\Dati applicazioni\ezsid.dat
2008-04-14 20:01 . 2008-04-14 20:02
2008-04-14 19:34 . 2008-04-15 16:45 10,740 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-04-14 19:34 . 2008-04-15 16:45 805 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-04-14 19:06 . 2008-04-23 22:30
2008-04-14 17:27 . 2008-04-14 17:29
2008-04-14 17:27 . 2008-04-14 17:30 45,056 --a------ C:\WINDOWS\NCUNINST.EXE
2008-04-14 15:46 . 2008-04-25 13:25
2008-04-14 15:46 . 2008-04-14 15:46
2008-04-14 15:46 . 2008-04-14 15:46
2008-04-14 15:14 . 2008-04-14 15:14
2008-04-14 13:22 . 2006-08-21 11:14 128,896 --a------ C:\WINDOWS\system32\dllcache\fltmgr.sys
2008-04-14 13:22 . 2006-08-21 11:14 23,040 --a------ C:\WINDOWS\system32\dllcache\fltmc.exe
2008-04-14 13:22 . 2006-08-21 14:26 16,896 --a------ C:\WINDOWS\system32\dllcache\fltlib.dll
2008-04-14 08:18 . 2004-08-03 23:07 59,264 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys
2008-04-14 08:18 . 2004-08-03 23:07 59,264 --a------ C:\WINDOWS\system32\dllcache\usbaudio.sys
2008-04-13 13:50 . 2007-07-09 15:09 584,192 --a------ C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-04-12 20:40 . 2008-04-25 15:17
2008-04-12 20:40 . 2008-04-14 20:02
2008-04-12 20:38 . 2008-04-12 20:38
2008-04-12 20:34 . 2008-04-17 19:22
2008-04-12 20:34 . 2008-04-20 09:45
2008-04-12 18:25 . 2008-04-12 18:25
2008-04-12 16:57 . 2008-04-12 16:57
2008-04-12 16:49 . 2008-04-12 17:00
2008-04-12 16:49 . 2008-04-12 16:49
2008-04-12 16:49 . 2008-04-12 16:49
2008-04-12 16:49 . 2008-04-12 16:49
2008-04-12 16:47 . 2008-04-12 16:47
2008-04-12 16:40 . 2008-04-12 13:50
2008-04-12 16:40 . 2004-10-25 20:51
2008-04-12 16:40 . 2004-10-25 20:51
2008-04-12 16:40 . 2008-04-24 19:51
2008-04-12 16:40 . 2004-10-25 20:51
2008-04-12 16:40 . 2008-04-12 20:34
2008-04-12 16:40 . 2008-04-25 15:43
2008-04-12 16:40 . 2008-04-23 20:00
2008-04-12 16:40 . 2008-04-25 15:24
2008-04-12 16:40 . 2008-04-25 15:27
2008-04-12 16:40 . 2008-04-25 15:43 319,488 --ah----- C:\Documents and Settings\Jarek\ntuser.dat.LOG
2008-04-12 16:40 . 2008-04-12 16:40 1,024 --ah----- C:\Documents and Settings\All Users\NTUSER.DAT.LOG
2008-04-12 13:52 . 2008-04-12 13:52 8,192 --a------ C:\WINDOWS\REGLOCS.OLD
2008-04-12 13:51 . 2008-04-21 19:21
2008-04-12 13:51 . 2008-04-12 13:51 2,237,122 --a------ C:\WINDOWS\system\RESTORE.INS
2008-04-12 13:51 . 2008-04-12 13:51 2,237,122 --a------ C:\WINDOWS\RESTORE.INS
2008-04-12 13:51 . 2008-04-12 13:51 333 --a------ C:\WINDOWS\system32$ncsp$.inf
2008-04-12 13:51 . 2008-04-12 13:51 61 --a------ C:\WINDOWS\smscfg.ini
2008-04-12 13:50 . 2008-04-12 13:50
2008-04-12 13:48 . 2008-04-12 13:48
2008-04-12 13:47 . 2008-04-12 13:47
2008-04-12 13:47 . 2008-04-12 13:47
2008-04-12 13:47 . 2008-04-12 13:47
2008-04-12 13:47 . 2008-04-12 13:47
2008-04-12 13:47 . 2008-04-12 13:47
2008-04-12 13:47 . 2008-04-12 13:47
2008-04-12 13:47 . 2008-04-12 13:47
2008-04-12 13:47 . 2008-04-18 20:53
2008-04-12 13:47 . 2004-05-04 11:53 1,645,320 --a------ C:\WINDOWS\system32\gdiplus.dll
2008-04-12 13:47 . 1999-11-10 12:05 86,016 --a------ C:\WINDOWS\unvise32qt.exe
2008-04-12 13:46 . 2005-05-03 11:56 410,112 --a------ C:\WINDOWS\system32\SETUPPC.CPL
2008-04-12 13:46 . 2006-02-02 20:37 816 --a------ C:\WINDOWS\system32\SETUPPC.INI
2008-04-12 13:44 . 2008-04-12 13:44 10,344 --a------ C:\WINDOWS\system32\drivers\symlcbrd.sys
2008-04-12 13:42 . 2008-04-25 12:50
2008-04-12 13:42 . 2008-04-12 13:42
2008-04-12 13:42 . 2008-04-12 13:42 59 --a------ C:\WINDOWS\WININIT.INI
2008-04-12 13:41 . 2008-04-12 13:41
2008-04-12 13:41 . 2008-04-12 13:41
2008-04-12 13:41 . 2008-04-12 13:41
2008-04-12 13:41 . 2008-04-12 13:41
2008-04-12 13:40 . 2008-04-12 13:40
2008-04-12 13:40 . 2008-04-12 13:40
2008-04-12 13:40 . 2008-04-12 13:40
2008-04-12 13:40 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
2008-04-12 13:40 . 2008-04-12 16:37 7,605 --a------ C:\WINDOWS\HDReg.ini
2008-04-12 13:39 . 2008-04-12 13:46
2008-04-12 13:39 . 2008-04-12 13:48
2008-04-12 13:39 . 2008-04-12 13:47
2008-04-12 13:38 . 2008-04-12 13:38
2008-04-12 13:37 . 2006-03-21 05:23 23,040 --a------ C:\WINDOWS\kb913800.exe
2008-04-12 13:36 . 2008-04-12 13:36
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-12 14:48 155,995 ----a-w C:\WINDOWS\java\Packages\7V9BZ1BL.ZIP
2008-03-20 08:06 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-20 08:06 1,845,248 ----a-w C:\WINDOWS\system32\dllcache\win32k.sys
2008-02-20 06:50 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 06:50 282,624 ----a-w C:\WINDOWS\system32\dllcache\gdi32.dll
2008-02-20 05:33 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-20 05:33 45,568 ----a-w C:\WINDOWS\system32\dllcache\dnsrslvr.dll
2008-02-20 05:33 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-02-15 09:07 18,432 ----a-w C:\WINDOWS\system32\dllcache\iedw.exe
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“Gadu-Gadu”=“C:\Programmi\Gadu-Gadu\gg.exe” [2008-03-20 12:04 2127296]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“IMJPMIG8.1”=“C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe” [2004-09-07 14:00 208952]
“PHIME2002ASync”=“C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe” [2004-09-07 14:00 455168]
“PHIME2002A”=“C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe” [2004-09-07 14:00 455168]
“ehTray”=“C:\WINDOWS\ehome\ehtray.exe” [2005-09-29 14:01 67584]
“NvCplDaemon”=“C:\WINDOWS\system32\NvCpl.dll” [2006-04-28 00:47 7573504]
“nwiz”=“nwiz.exe” [2006-04-28 00:47 1519616 C:\WINDOWS\system32\nwiz.exe]
“NvMediaCenter”=“C:\WINDOWS\system32\NvMcTray.dll” [2006-04-28 00:47 86016]
“ACTIVBOARD”=“c:\apps\ABoard\ABoard.exe” [2003-05-02 11:31 24576]
“Symantec PIF AlertEng”=“C:\Programmi\File comuni\Symantec Shared\PIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe” [2008-01-29 17:38 583048]
“RTHDCPL”=“RTHDCPL.EXE” [2007-03-21 14:49 16126464 C:\WINDOWS\RTHDCPL.EXE]
[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2004-09-07 14:00 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
“InstallVisualStyle”= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
“InstallTheme”= C:\WINDOWS\Resources\Themes\Royale.theme
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
“msacm.dvacm”= C:\PROGRA~1\FILECO~1\ULEADS~1\Vio\Dvacm.acm
“msacm.mpegacm”= mpegacm.acm
“msacm.ulmp3acm”= ulmp3acm.acm
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
–a------ 2007-01-09 23:59 115816 C:\Programmi\File comuni\Symantec Shared\ccApp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DataLayer]
–a------ 2005-06-07 11:31 819712 C:\Programmi\File comuni\PCSuite\DataLayer\DataLayer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DetectorApp]
–a------ 2005-10-20 06:15 102400 C:\Programmi\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]
–a------ 2008-03-20 12:04 2127296 C:\Programmi\Gadu-Gadu\gg.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
C:\PROGRA~1\FILECO~1\INSTAL~1\UPDATE~1\ISUSPM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
C:\Programmi\File comuni\InstallShield\UpdateService\issch.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
–a------ 2005-06-29 15:29 176128 C:\Programmi\Nokia\Nokia PC Suite 6\LaunchApplication.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
–a------ 2005-06-24 14:08 860160 C:\Programmi\Nokia\Nokia PC Suite 6\PcSync2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a------ 2008-04-12 13:47 98304 C:\Programmi\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmpcSys]
--------- 2005-12-08 16:39 975360 C:\APPS\SMP\SmpSys.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a------ 2005-06-03 03:52 36975 C:\Programmi\Java\jre1.5.0_04\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
–a------ 2008-04-14 20:02 171448 C:\Programmi\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2]
C:\Programmi\Uniblue\RegistryBooster 2\RegistryBooster.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Vade Retro Outlook Express]
–a------ 2004-10-04 13:03 310272 C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
–a------ 2008-04-01 20:49 36352 C:\Programmi\Winamp\winampa.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
“AntiVirusDisableNotify”=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
“DisableMonitoring”=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
“DisableMonitoring”=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
“DisableMonitoring”=dword:00000001
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
“EnableFirewall”= 0 (0x0)
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
“%windir%\system32\sessmgr.exe”=
“C:\Programmi\Messenger\msmsgs.exe”=
“C:\APPS\skype\Phone\Skype.exe”=
R3 3xHybrid;3xHybrid service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2005-05-03 10:25]
R3 usb_rndis;Pirelli Alice Gate 2 plus USB;C:\WINDOWS\system32\DRIVERS\usb8023.sys [2004-09-07 14:00]
R3 X10Hid;X10 Hid Device;C:\WINDOWS\system32\Drivers\x10hid.sys [2005-11-28 10:45]
S2 Utilitŕ di pianificazione di LiveUpdate automatico;Utilitŕ di pianificazione di LiveUpdate automatico;“C:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe” [2007-09-26 16:23]
S3 USBSTOR;Driver archiviazione di massa USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
*Newly Created Service* - CATCHME
*Newly Created Service* - COMHOST
.
Contenuto della cartella ‘Scheduled Tasks’
“2008-04-25 13:30:00 C:\WINDOWS\Tasks\Configura il mio PC.job”
“2008-04-25 13:30:00 C:\WINDOWS\Tasks\Garanzia estesa.job”
“2008-04-25 13:30:00 C:\WINDOWS\Tasks\Master CD_DVD Creator.job”
“2008-04-21 20:00:00 C:\WINDOWS\Tasks\PBRegbk.job”
- c:\Apps\HDReg\HDRegDel.exe
“2008-04-19 15:05:00 C:\WINDOWS\Tasks\Promemoria registrazione 2.job”
- C:\WINDOWS\system32\OOBE\oobebaln.exe
“2008-04-12 14:40:38 C:\WINDOWS\Tasks\Promemoria registrazione 3.job”
- C:\WINDOWS\system32\OOBE\oobebaln.exe
.
**************************************************************************
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-25 15:43:43
Windows 5.1.2600 Service Pack 2 NTFS
scansione processi nascosti …
scansione entrate autostart nascoste …
Scansione files nascosti …
Scansione completata con successo
Files nascosti: 0
**************************************************************************
.
Ora fine scansione: 2008-04-25 15.44.10
ComboFix-quarantined-files.txt 2008-04-25 13:44:07
6 Directory 215,657,967,616 byte disponibili
12 Directory 215,672,688,640 byte disponibili
257 — E O F — 2008-04-21 19:50:03