Logfile of Spyware Terminator v2.1.1.314 (db:1.0.127.892)
Scan Time: 27/03/2008 14.10.43 length: 150 s
Platform: WXP (5.1.0.2600)
User: Admin
Boot Mode: Normal
Scan type: Fast_Spyware_Scan
Scanned Objects: 11365 (Critical:5)
Filter: No System items, No Safe items, No Invalid items
Running Processes
brsvc01a.exe [brother Industries Ltd] : C:\WINDOWS\system32\brsvc01a.exe
brss01a.exe [brother Industries Ltd] : C:\WINDOWS\system32\brss01a.exe
avgamsvr.exe [GRISOFT, s.r.o.] : C:\Programmi\Grisoft\AVG7\avgamsvr.exe
nvsvc32.exe [NVIDIA Corporation] : C:\WINDOWS\system32\nvsvc32.exe
avgcc.exe [GRISOFT, s.r.o.] : C:\Programmi\Grisoft\AVG7\avgcc.exe
jusched.exe [Sun Microsystems, Inc.] : C:\Programmi\Java\jre1.5.0_03\bin\jusched.exe
bittorrent.exe : C:\WINDOWS\bittorrent.exe
GoogleToolbarNotifier.exe [Google Inc.] : C:\Programmi\Google\GoogleToolbarNotifier\GoogleTo olbarNotifier.exe
ymsgr_tray.exe : C:\Programmi\Yahoo!\Messenger\ymsgr_tray.exe
WINWORD.EXE [Microsoft Corporation] : C:\Programmi\Microsoft Office\OFFICE11\WINWORD.EXE
insF.exe [128 KB] : C:\WINDOWS\Installer\24ha12\Ic2d\insF.exe
insG.exe [128 KB] : C:\WINDOWS\Installer\24ha12\Ic2d\insG.exe
insH.exe [128 KB] : C:\WINDOWS\Installer\24ha12\Ic2d\insH.exe
FHU.exe [190 KB] : C:\WINDOWS\Installer\24ha12\UD\FHU.exe
int2com.exe : C:\WINDOWS\Installer\24ha12\inet\int2com.exe
slp2.exe : C:\Documents and Settings\Selene\slp2.exe
Internet Settings
R - HKCU\Software\Microsoft\Internet Explorer\Main, Search Bar =
http://g.msn.it/0SEITIT/SAOS01
R - HKLM\Software\Microsoft\Internet Explorer\Main, Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157
R - HKLM\Software\Microsoft\Internet Explorer\Search, SearchAssistant =
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
R - HKLM\Software\Microsoft\Internet Explorer\Search, CustomizeSearch =
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
R - HKLM\System\CurrentControlSet\Services\Tcpip\Param eters, Domain =
R - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Tel ephony, DomainName =
BHO
02 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - [Google Inc.] : C:\Programmi\Google\GoogleToolbarNotifier\2.0.301. 7164\swg.dll
StartUps
04 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run , swg : [Google Inc.] : C:\Programmi\Google\GoogleToolbarNotifier\GoogleTo olbarNotifier.exe
04 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run , AVG7_CC : [GRISOFT, s.r.o.] : C:\Programmi\Grisoft\AVG7\avgcc.exe
04 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run , SunJavaUpdateSched : [Sun Microsystems, Inc.] : C:\Programmi\Java\jre1.5.0_03\bin\jusched.exe
04 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run , Adobe Reader Speed Launcher : [Adobe Systems Incorporated] : C:\Programmi\ADOBE\READER 8.0\READER\READER_SL.EXE
04 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run , Bittorrent : : C:\WINDOWS\bittorrent.exe
04 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run , str_insDr : [128 KB] : C:\WINDOWS\Installer\24ha12\Ic2d\str_insDr.exe
04 - Startup: %START_PROGRAMS%\Esecuzione automatica\C'è Posta.lnk : C:\Programmi\C'è Posta\CPosta.exe
Shell Extensions
Desktop Explorer - {1CDB2949-8F65-4355-8456-263E7C208A5D} - [NVIDIA Corporation] : C:\WINDOWS\system32\nvshell.dll
- {1E9B04FB-F9E5-4718-997B-B8DA88302A47} - [NVIDIA Corporation] : C:\WINDOWS\system32\nvshell.dll
nView Desktop Context Menu - {1E9B04FB-F9E5-4718-997B-B8DA88302A48} - [NVIDIA Corporation] : C:\WINDOWS\system32\nvshell.dll
My Digital Camera - {C56C4E21-706D-11d0-AFC5-444553540002} - [FotoNation Inc.] : C:\Programmi\File comuni\FotoNation\camview.dll
Microsoft Office Outlook - {00020D75-0000-0000-C000-000000000046} - [Microsoft Corporation] : C:\Programmi\Microsoft Office\OFFICE11\MLSHEXT.DLL
Estensione dell'icona del file di Outlook - {0006F045-0000-0000-C000-000000000046} - [Microsoft Corporation] : C:\Programmi\Microsoft Office\OFFICE11\OLKFSTUB.DLL
Services
23 - [Realtek Semiconductor Corp.] : C:\WINDOWS\system32\drivers\ALCXWDM.SYS
23 - [GRISOFT, s.r.o.] : C:\Programmi\Grisoft\AVG7\avgamsvr.exe
23 - [GRISOFT, s.r.o.] : C:\WINDOWS\system32\Drivers\avgclean.sys
23 - [brother Industries Ltd] : C:\WINDOWS\system32\brsvc01a.exe
23 - [Brother Industries Ltd.] : C:\WINDOWS\system32\drivers\BrPar.sys
23 - [Conexant Systems, Inc.] : C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys
23 - [Conexant Systems, Inc.] : C:\WINDOWS\system32\DRIVERS\HSF_DP.sys
23 - [NVIDIA Corporation] : C:\WINDOWS\system32\DRIVERS\nvata.sys
23 - [NVIDIA Corporation] : C:\WINDOWS\system32\DRIVERS\NVENETFD.sys
23 - [NVIDIA Corporation] : C:\WINDOWS\system32\DRIVERS\nvnetbus.sys
23 - [NVIDIA Corporation] : C:\WINDOWS\system32\nvsvc32.exe
23 - [Conexant Systems, Inc.] : C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys
Threat Files
<Trojan/Rootkit.Agent.FIL> : C:\WINDOWS\system32\Drivers\filter.sys
Advanced Files Report
%PROGRAMFILES%\SUPERAntiSpyware\SASWINLO.dll []
%SYSDIR%\brsvc01a.exe [brother Industries Ltd] [brother Industries Ltd brsvc01a] MD5=CAC61BDD786A6928989451871FBCEDB8 SIZE=57344
%SYSDIR%\brss01a.exe [brother Industries Ltd] [brother Industries Ltd brss01a.exe] MD5=9E646CD378D4D0C996BAF9BCB18237C7 SIZE=45056
%SYSDIR%\spool\PRTPROCS\W32X86\brpp2ka.dll [Brother Industries ,Ltd ] [Microsoft(R) Windows (R) 2000 Operating System] MD5=6200528732C743F5CA459B0BD3B998BF SIZE=26288
%SYSDIR%\spool\DRIVERS\W32X86\3\BRUCH06A.DLL [Brother Industries Ltd.] [Brother Printer Driver User Interface] MD5=76A0ABF440BD3711C2E9C97684B4C639 SIZE=1670838
%SYSDIR%\spool\DRIVERS\W32X86\3\BRLCH06A.DLL [Brother Industries Ltd.] [Brother Printer Driver Language Resource] MD5=C370646A671688AF3800E011158C720D SIZE=77312
%SYSDIR%\spool\DRIVERS\W32X86\3\BRFCH06A.DLL [Brother Industries Ltd.] [Brother Parameter Set Manager] MD5=2F495869159CD253BDB307DDA92CE1F9 SIZE=827392
%SYSDIR%\spool\DRIVERS\W32X86\3\BROCH06A.DLL [Brother Industries Ltd.] [Brother Printer Driver] MD5=871D5CD4B9AAEFF73043D53E2A7C15EC SIZE=698121
%PROGRAMFILES%\Grisoft\AVG7\avgamsvr.exe [GRISOFT, s.r.o.] [AVG Anti-Virus system] MD5=3C7B93F947355E374A49564D0D017B7B SIZE=418816
%PROGRAMFILES%\Grisoft\AVG7\avgklib.dll [GRISOFT, s.r.o.] [AVG Anti-Virus system] MD5=D756DC41EFFAAD294C858E94B4A11BD2 SIZE=61440
%PROGRAMFILES%\Grisoft\AVG7\avglog.dll [GRISOFT, s.r.o.] [AVG Anti-Virus system] MD5=C935B33CB471DB79A42B81276A8D0934 SIZE=104960
%PROGRAMFILES%\Grisoft\AVG7\avgcfg.dll [GRISOFT, s.r.o.] [AVG Anti-Virus system] MD5=EE3201BF942FB000B8C98A6CEB9C4105 SIZE=572928
%PROGRAMFILES%\Grisoft\AVG7\avgamsps.dll [GRISOFT, s.r.o.] [AVG 7.5 Anti-Virus System] MD5=BD30B82A0364670E95DDBEE7902290C9 SIZE=10752
%SYSDIR%\nvsvc32.exe [NVIDIA Corporation] [NVIDIA Driver Helper Service, Version 81.97] MD5=F88985164ABA1650CA4DF386A731593A SIZE=131139
%PROGRAMFILES%\SUPERAntiSpyware\SASSEH.DLL []
%COMMONFILES%\Adobe\Acrobat\ActiveX\PDFShell.ITA [Adobe Systems, Inc.] [Adobe PDF Shell Extension] MD5=25FAF84103DB2F272835337A4391173C SIZE=311296
%PROGRAMFILES%\Grisoft\AVG7\avgtmgr.dll [GRISOFT, s.r.o.] [AVG Anti-Virus system] MD5=5BD5BD73E02C3D8B2ECBF204E3A67345 SIZE=411648
%PROGRAMFILES%\Grisoft\AVG7\avgctrl.dll [GRISOFT, s.r.o.] [AVG Anti-Virus system] MD5=129BCCA44DD86F63532D59F4377918DC SIZE=905728
%PROGRAMFILES%\Grisoft\AVG7\avgabout.dll [GRISOFT, s.r.o.] [AVG Anti-Virus system] MD5=04E0E30E244A96B7DBE37A30796FEA2D SIZE=435712
%PROGRAMFILES%\Grisoft\AVG7\avgtest.dll [GRISOFT, s.r.o.] [AVG Anti-Virus system] MD5=C7F153B54C1DF8C8E03828C7EE3A74E4 SIZE=604160
%PROGRAMFILES%\Grisoft\AVG7\avgtres.dll [GRISOFT, s.r.o.] [AVG Anti-Virus system] MD5=A8E8CE4A172FD204F745D8C570D23549 SIZE=245248
%PROGRAMFILES%\Grisoft\AVG7\avgset.dll [GRISOFT, s.r.o.] [AVG Anti-Virus system] MD5=940BE885A17CBD5D6AD82C3FA0BB1BF3 SIZE=467456
%PROGRAMFILES%\Grisoft\AVG7\avgresf.dll [AVG Technologies CZ, s.r.o.] [AVG Anti-Virus System] MD5=33CF8594593893FD663576001C3AF535 SIZE=1015808
%PROGRAMFILES%\Grisoft\AVG7\avgf.dll [] MD5=F1A871F63BAE2B0CBA9F8649FF4FB539 SIZE=48128
%PROGRAMFILES%\Grisoft\AVG7\AVGRES.DLL [GRISOFT, s.r.o.] [AVG Anti-Virus system] MD5=8222ADB1A3068E7CC457D72E57339436 SIZE=1282560
%PROGRAMFILES%\Grisoft\AVG7\avgcckrn.dll [GRISOFT, s.r.o.] [AVG Anti-Virus system] MD5=E7588025E17A4C60231A96B4021EF3F2 SIZE=582656
%PROGRAMFILES%\Grisoft\AVG7\avgvault.dll [GRISOFT, s.r.o.] [AVG Anti-Virus system] MD5=BB59C88CBF24F6D136E12CBB7D1F2B64 SIZE=82944
%PROGRAMFILES%\Grisoft\AVG7\avgunarc.dll [GRISOFT, s.r.o.] [AVG Anti-Virus system] MD5=E5D4EDFBE5C6EC8B5FFE2CFCDC6DA880 SIZE=191488
%PROGRAMFILES%\Grisoft\AVG7\avgxch32.dll [GRISOFT, s.r.o.] [AVG Anti-Virus system] MD5=EAE1FACD2B9802282C1516D8C72A6C18 SIZE=124928
%PROGRAMFILES%\Google\GoogleToolbarNotifier\2.0.30 1.7164\res_it.dll [Google Inc.] [GoogleToolbarNotifier] MD5=081F5DB7560F93163FE44D3BC9D1599B SIZE=50688
%PROGRAMFILES%\Yahoo!\Messenger\ymsgr_tray.exe [] MD5=E23A538012FB9EC6AACB67A65589EDC7 SIZE=90112
%PROGRAMFILES%\Yahoo!\Shared\YbSkin2.dll [Yahoo! Inc] [Yahoo! Skinning Object] MD5=B51A02BBDF4CE8FC9DE78EAE9D462308 SIZE=369736
%PROGRAMFILES%\Yahoo!\Messenger\res_msgr.dll [Yahoo! Italia S.r.l] [Yahoo! Messenger] MD5=1CE4D40A4E21B408B6A0F687AF42EE19 SIZE=950272
%PROGRAMFILES%\Microsoft Office\OFFICE11\WINWORD.EXE [Microsoft Corporation] [Microsoft Office 2003] MD5=1EEA7DD2F1EA6EFEF380B99A90228D2F SIZE=12037688
%PROGRAMFILES%\Grisoft\AVG7\avgoff2k.dll [GRISOFT, s.r.o.] [AVG 7.5 Anti-Virus System] MD5=70DD91C81CE3F27ABF4D9912B64BE679 SIZE=54784
%COMMONFILES%\Microsoft Shared\PROOF\MSSP3IT.DLL [Expert System] [Expert System mssp3it.dll] MD5=7FD46E956AAEDE2BE7B4452D64779E84 SIZE=466944
%COMMONFILES%\Microsoft Shared\PROOF\1040\MSGRIT32.DLL [Expert System SpA] [Expert System SpA] MD5=F77484D3D11DFF7DF4DC851332EFECD6 SIZE=1564672
%WINDIR%\Installer\24ha12\Ic2d\insF.exe [128 KB] MD5=4853987B2098AEFF3FD0258A2367572D SIZE=82944
%WINDIR%\Installer\24ha12\Ic2d\insG.exe [128 KB] MD5=434481AE39E6DFB71CAFC9C8F0AD9BEC SIZE=82944
%WINDIR%\Installer\24ha12\Ic2d\insH.exe [128 KB] MD5=B47255D6735F67860E425A96B387F4B2 SIZE=82944
%WINDIR%\Installer\24ha12\UD\FHU.exe [190 KB] MD5=6C52ADB630420022B4007B2937239C12 SIZE=83456
%WINDIR%\Installer\24ha12\inet\int2com.exe [] MD5=7F29ABE2872D561CC1BDB0617BC2996A SIZE=145920
%USERPROFILE%\slp2.exe [] MD5=1A1075E5E307F3A4B8527110A51CE827 SIZE=126976
%WINDIR%\Knight.exe []
%PROGRAMFILES%\C'è Posta\CPosta.exe [] [C'è Posta Application] MD5=FE77EA615C49209BD12329AA54CC5984 SIZE=471040
deskpan.dll []
%SYSDIR%\nvshell.dll [NVIDIA Corporation] [NVIDIA Desktop Explorer, Version 110.13 ] MD5=5860F93AB8D45A32FE76539A3BC81CF9 SIZE=466944
%COMMONFILES%\FotoNation\camview.dll [FotoNation Inc.] [FotoNation Explorer] MD5=FC8AEA28BC8B53F7A794B86DC3AF414A SIZE=200192
%PROGRAMFILES%\Microsoft Office\OFFICE11\MLSHEXT.DLL [Microsoft Corporation] [Microsoft Office Outlook] MD5=1B085E6B3AD4C110FBB9C6BE353E913B SIZE=27224
%PROGRAMFILES%\Microsoft Office\OFFICE11\OLKFSTUB.DLL [Microsoft Corporation] [Microsoft Office Outlook] MD5=36DAA15E14C55D2A2F1A7C7674E4DEB3 SIZE=232024
%SYSDIR%\drivers\ALCXWDM.SYS [Realtek Semiconductor Corp.] [Windows (R) WDM driver for Realtek AC'97 Audio(HRTF data Copyright 1994 by MIT Media Lab)] MD5=08A9AEBDF5C1AE0D5FA6C3F105B2E69E SIZE=3842560
%SYSDIR%\svchost.exe -k netsvcs []
%SYSDIR%\Drivers\avgclean.sys [GRISOFT, s.r.o.] [AVG7 Clean Driver] MD5=603DC17A48C65C637623A9BB5A5E6008 SIZE=10760
%SYSDIR%\drivers\BrPar.sys [Brother Industries Ltd.] [Brother Parallel Class Driver] MD5=2FE6D5BE0629F706197B30C0AA05DE30 SIZE=19537
%SYSDIR%\svchost -k DcomLaunch []
%SYSDIR%\svchost.exe -k NetworkService []
%SYSDIR%\DRIVERS\HSFHWBS2.sys [Conexant Systems, Inc.] [SoftK56 Modem Driver] MD5=128EF741B2293C36810561092B566B1C SIZE=210304
%SYSDIR%\DRIVERS\HSF_DP.sys [Conexant Systems, Inc.] [SoftK56 Modem Driver] MD5=9A0D0C461EF2B3D80CB7875B4B995E47 SIZE=1042816
%SYSDIR%\svchost.exe -k LocalService []
%SYSDIR%\DRIVERS\nvata.sys [NVIDIA Corporation] [NVIDIA nForce(TM) IDE Driver] MD5=0344AA9113DC16EEC379F4652020849D SIZE=93568
%SYSDIR%\DRIVERS\NVENETFD.sys [NVIDIA Corporation] [NVENETFD] MD5=DFE4E623481CB4038C140A6389CDE4CF SIZE=33664
%SYSDIR%\DRIVERS\nvnetbus.sys [NVIDIA Corporation] [NVNETBUS] MD5=8A8513511CAC16810AE738777E6B0F26 SIZE=12928
%SYSDIR%\svchost -k rpcss []
%PROGRAMFILES%\SUPERAntiSpyware\SASKUTIL.sys []
%SYSDIR%\DRIVERS\HSF_CNXT.sys [Conexant Systems, Inc.] [SoftK56 Modem Driver] MD5=CE545A84BF3411E7516FA8DA51AD9D93 SIZE=679808
End of Report
Rispondi quotando
