Malaware impossibile da eliminare!!!

[ninosting]

Salve a tutti...avrei bisogno di aiuto...da qualche giorno al primo avvio di firefox mi si apre oltre alla finestra principale un'altra finestra con pubblicità varie. Ho provato a fare uno scan con ad-aware...poi con ewido...poi con combofix...e infine con sysclean...sempre in modalità provvisoria e disattivando il ripristino di configurazione di sistema...ma non trova nulla eccetto un infezione a livello di cookie che ho rimosso. Però il problema persiste...ho provato a fare un controllo in task manager ed effettivamente ho trovato in processi una voce sospetta "wnns.exe", che ogni volta provo a terminare, rispunta dopo pochi secondi provocando l'apertura di una finestra di firefox pubblicitaria. Qualcuno potrebbe darmi una mano?
Ho usato Hijackthis e questo è il log file:


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16.38.55, on 24/07/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Programmi\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Programmi\Motorola\SMSERIAL\sm56hlpr.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIA AE.EXE
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\File comuni\Java\Java Update\jusched.exe
C:\Programmi\ESET\ESET NOD32 Antivirus\egui.exe
C:\Programmi\Lavasoft\Ad-Aware\AAWTray.exe
C:\Programmi\File comuni\LightScribe\LightScribeControlPanel.exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleTo olbarNotifier.exe
C:\Programmi\DNA\btdna.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Programmi\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Programmi\ewido anti-spyware 4.0\guard.exe
C:\Programmi\Java\jre6\bin\jqs.exe
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Programmi\IVT Corporation\BlueSoleil\StartSkysolSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\config\systemprofile\Impostazi oni locali\Dati applicazioni\Windows Network Name Service\wnns.exe
C:\WINDOWS\system32\msiexec.exe
C:\Programmi\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.iplay.com/?o=shp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: SuggestMeYesBHO - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Programmi\AutocompletePro\AutocompletePro.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programmi\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\5.5.5126 .1836\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmi\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugi n.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programmi\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [SynTPStart] C:\Programmi\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Programmi\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SMSERIAL] C:\Programmi\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [EPSON Stylus D68 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIA AE.EXE /P23 "EPSON Stylus D68 Series" /O6 "USB001" /M "Stylus D68"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\File comuni\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [egui] "C:\Programmi\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Programmi\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Programmi\File comuni\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [swg] "C:\Programmi\Google\GoogleToolbarNotifier\GoogleT oolbarNotifier.exe"
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Programmi\DNA\btdna.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Programmi\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8 574934B26AC4.dll/cmsidewiki.html
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/Driver...reqlab_nvd.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Programmi\File comuni\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Programmi\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Programmi\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Programmi\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Programmi\ewido anti-spyware 4.0\guard.exe
O23 - Service: Servizio di Google Update (gupdate) (gupdate) - Google Inc. - C:\Programmi\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Programmi\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmi\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Programmi\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Start BT in service - Unknown owner - C:\Programmi\IVT Corporation\BlueSoleil\StartSkysolSvc.exe
O23 - Service: Windows Network Name Service - Unknown owner - C:\WINDOWS\system32\config\systemprofile\Impostazi oni locali\Dati applicazioni\Windows Network Name Service\wnns.exe

--
End of file - 10431 bytes

[menatwork]

ciao

il file al quale ti riferisci non trova riscontro, prova ad analizzarlo su virus total e vedi cosa rilevano gli antivirus

C:\WINDOWS\system32\config\systemprofile\Impostazi oni locali\Dati applicazioni\Windows Network Name Service\wnns.exe

intanto dovresti postare il log di combofix per un controllo

se la pagina iniziale non e' quella da te impostata in questa riga, apri hijackthis e con la spunta accanto alla voce premi FIX CHECKED

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.iplay.com/?o=shp

[SharinGan]

Ehm, ma il malaware mica è di tipi diversi?
Beh se così fosse, ogni tipo agisce su una parte del pc. Esempio:
L'overwriting virus è un virus rintracciabile facilmente dall'antivirus, è quello che ognuno di noi sicuramente ha riscontrato... Ci sono poi altri virus come ad esempio il Macro virus che agisce nei documenti World, exel office e cosi via..Se noi facciamo una scansione su questi documenti è più facile ritrovarlo ed eliminarlo... Attenzione pero' non sempre è possibile. Bisogna disporre di un antivirus come si deve e non quelli gratis, perché non servono a niente.

Poi non ti parlo dei network virus che sono difficilissimi da rintracciare e sono tostissimi.

[amvinfe]

Originariamente inviato da SharinGan
Ehm, ma il malaware mica è di tipi diversi?
Beh se così fosse, ogni tipo agisce su una parte del pc. Esempio:
L'overwriting virus è un virus rintracciabile facilmente dall'antivirus, è quello che ognuno di noi sicuramente ha riscontrato... Ci sono poi altri virus come ad esempio il Macro virus che agisce nei documenti World, exel office e cosi via..Se noi facciamo una scansione su questi documenti è più facile ritrovarlo ed eliminarlo... Attenzione pero' non sempre è possibile. Bisogna disporre di un antivirus come si deve e non quelli gratis, perché non servono a niente.

Poi non ti parlo dei network virus che sono difficilissimi da rintracciare e sono tostissimi.

a parte il tuo discorso sugli antivirus free che evito di commentare
con quello che hai scritto che volevi dire???

[ninosting]

Innanzitutto grazie mille per l'aiuto e per la rapidità con cui mi avete risposto.
Allora ho controllato il file su virustotal ma sembra apposto. Però stamattina mia sorella ha trovato su un sito che il problema potrebbe essere dovuto a programmi non sicurissimi che si comportano come spyware e che ti sottoscrivono come condizione d'uso, senza che tu te ne accroga, di inviarti della pubblicità. Ora lei dice di aver seguito le istruzioni che dicevano e di aver effettivamente trovato nella cartella C:\Documents and Settings\nome utente\Impostazioni locali\Dati applicazioni\ che loro indicavano un file sospetto che ha cancellato. Ora avendo fatto tutto lei nn saprei dirvi che file era...però ho appurato che adesso all'avvio di firefox non si apre più nulla di strano. Cmq mi ha detto che un paio di volte mentre navigava gli si sono aperte delle finestre pubblicitarie.

[ninosting]

Vi allego il file log di combofix diviso in 2 parti perchè se no eccedo come lunghezza massima di caratteri:
ComboFix 10-07-24.06 - Alessandra 26/07/2010 16.44.01.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.39.1040.18.2046.1443 [GMT 2:00]
Eseguito da: c:\documents and settings\Alessandra\Desktop\Clinica PC\ComboFix.exe
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.

((((((((((((((((((((((((( Files Creati Da 2010-06-26 al 2010-07-26 )))))))))))))))))))))))))))))))))))
.

2010-07-25 17:23 . 2010-07-25 17:23 -------- d--h--w- c:\windows\PIF
2010-07-24 14:35 . 2010-07-24 14:35 388096 ----a-r- c:\documents and settings\Alessandra\Dati applicazioni\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-07-24 14:35 . 2010-07-24 14:35 -------- d-----w- c:\programmi\Trend Micro
2010-07-24 14:00 . 2010-07-24 14:00 -------- d-sh--w- c:\documents and settings\Administrator\IECompatCache
2010-07-24 13:57 . 2010-07-24 13:57 -------- d-----w- c:\documents and settings\Administrator\Impostazioni locali\Dati applicazioni\Mozilla
2010-07-24 12:45 . 2010-07-25 10:32 -------- d-----w- c:\programmi\ewido anti-spyware 4.0
2010-07-24 12:11 . 2010-07-24 10:37 15688 ----a-w- c:\windows\system32\lsdelete.exe
2010-07-24 10:36 . 2010-07-24 10:36 -------- dc-h--w- c:\documents and settings\All Users\Dati applicazioni\{83C91755-2546-441D-AC40-9A6B4B860800}
2010-07-24 10:36 . 2009-01-18 21:43 2892112 -c--a-w- c:\documents and settings\All Users\Dati applicazioni\{83C91755-2546-441D-AC40-9A6B4B860800}\Ad-AwareAE.exe
2010-07-24 10:35 . 2010-07-24 10:35 -------- d-----w- c:\programmi\Lavasoft
2010-07-24 10:15 . 2010-07-24 10:15 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-07-24 10:12 . 2010-07-24 10:12 -------- d-----w- c:\documents and settings\Alessandra\Impostazioni locali\Dati applicazioni\Sunbelt Software
2010-07-24 09:57 . 2010-07-24 09:57 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
2010-07-24 09:15 . 2010-07-24 10:37 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys
2010-07-24 09:10 . 2010-07-24 10:35 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Lavasoft
2010-07-21 18:52 . 2010-07-21 18:52 -------- d-----w- c:\programmi\AutocompletePro
2010-07-21 18:52 . 2010-07-26 13:56 10 ----a-w- c:\windows\system32\stamp.dat
2010-07-20 19:23 . 2010-07-20 19:24 -------- d-----w- c:\programmi\File comuni\Adobe
2010-07-17 17:20 . 2010-07-17 17:20 -------- d-----w- c:\programmi\Garmin GPS Plugin
2010-07-17 16:59 . 2010-07-21 18:17 -------- d-----w- c:\documents and settings\Alessandra\Dati applicazioni\GARMIN
2010-07-17 16:45 . 2010-07-17 16:45 -------- d-----w- C:\Garmin
2010-07-17 16:45 . 2010-07-17 16:45 -------- d-----w- c:\programmi\DIFX
2010-07-17 16:45 . 2010-07-17 17:20 -------- d-----w- c:\programmi\Garmin
2010-07-09 18:31 . 2010-07-09 18:31 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\AlawarWrapper
2010-07-08 23:37 . 2010-07-08 23:37 -------- d-----w- c:\programmi\MSECache
2010-07-04 21:08 . 2010-07-04 21:08 -------- d-----w- c:\documents and settings\Antonella\Dati applicazioni\U3

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) )
.
2010-07-26 14:36 . 2009-12-13 13:24 -------- d-----w- c:\documents and settings\Alessandra\Dati applicazioni\DNA
2010-07-26 14:18 . 2009-10-06 16:53 -------- d-----w- c:\programmi\Microsoft Silverlight
2010-07-26 13:56 . 2009-12-13 13:24 -------- d-----w- c:\programmi\DNA
2010-07-24 11:37 . 2009-08-05 12:29 -------- d---a-w- c:\documents and settings\All Users\Dati applicazioni\TEMP
2010-07-22 15:39 . 2009-12-13 13:25 -------- d-----w- c:\documents and settings\Alessandra\Dati applicazioni\BitTorrent
2010-07-22 07:47 . 2010-01-15 14:53 99624 ----a-w- c:\documents and settings\Antonella\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2010-07-09 17:11 . 2009-07-25 12:07 48858 ----a-w- c:\windows\system32\nvModes.dat
2010-07-03 17:43 . 2009-07-25 13:18 -------- d-----w- c:\documents and settings\Alessandra\Dati applicazioni\vlc
2010-06-27 17:15 . 2010-02-02 19:55 -------- d-----w- c:\documents and settings\Alessandra\Dati applicazioni\U3
2010-06-26 16:33 . 2010-05-25 15:16 -------- d-----w- c:\documents and settings\Alessandra\Dati applicazioni\Skype
2010-06-26 16:33 . 2010-05-25 15:18 -------- d-----w- c:\documents and settings\Alessandra\Dati applicazioni\skypePM
2010-06-25 23:49 . 2009-12-13 18:12 -------- d-----w- c:\documents and settings\Alessandra\Dati applicazioni\gtk-2.0
2010-06-25 11:48 . 2009-07-25 10:08 1324 ----a-w- c:\windows\system32\d3d9caps.dat
2010-06-19 12:20 . 2010-06-19 12:17 -------- d-----w- c:\documents and settings\Antonella\Dati applicazioni\Skype
2010-06-09 08:06 . 2010-06-09 08:06 976832 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Adobe\Reader\9.2\ARM\ARM Update\AdobeARM.exe
2010-06-09 08:06 . 2010-06-09 08:06 70584 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Adobe\Reader\9.2\ARM\ARM Update\AdobeExtractFiles.dll
2010-06-09 08:06 . 2010-06-09 08:06 331176 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Adobe\Reader\9.2\ARM\ARM Update\ReaderUpdater.exe
2010-06-09 08:06 . 2010-06-09 08:06 331176 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Adobe\Reader\9.2\ARM\ARM Update\AcrobatUpdater.exe
2010-06-02 10:35 . 2010-06-02 10:35 -------- d-----w- c:\programmi\File comuni\Canon
2010-05-27 07:57 . 2010-05-27 07:57 503808 ----a-w- c:\documents and settings\Antonella\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\4 6\f84c6ae-419a5cab-n\msvcp71.dll
2010-05-27 07:57 . 2010-05-27 07:57 499712 ----a-w- c:\documents and settings\Antonella\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\4 6\f84c6ae-419a5cab-n\jmc.dll
2010-05-27 07:57 . 2010-05-27 07:57 348160 ----a-w- c:\documents and settings\Antonella\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\4 6\f84c6ae-419a5cab-n\msvcr71.dll
2010-05-27 07:57 . 2010-05-27 07:57 61440 ----a-w- c:\documents and settings\Antonella\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\5 0\5535ab32-136891bc-n\decora-sse.dll
2010-05-27 07:57 . 2010-05-27 07:57 12800 ----a-w- c:\documents and settings\Antonella\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\5 0\5535ab32-136891bc-n\decora-d3d.dll
2010-05-26 13:33 . 2010-05-26 13:33 503808 ----a-w- c:\documents and settings\Alessandra\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\4 6\f84c6ae-737caedf-n\msvcp71.dll
2010-05-26 13:33 . 2010-05-26 13:33 499712 ----a-w- c:\documents and settings\Alessandra\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\4 6\f84c6ae-737caedf-n\jmc.dll
2010-05-26 13:33 . 2010-05-26 13:33 348160 ----a-w- c:\documents and settings\Alessandra\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\4 6\f84c6ae-737caedf-n\msvcr71.dll
2010-05-26 13:33 . 2010-05-26 13:33 61440 ----a-w- c:\documents and settings\Alessandra\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\5 0\5535ab32-692fcdd3-n\decora-sse.dll
2010-05-26 13:33 . 2010-05-26 13:33 12800 ----a-w- c:\documents and settings\Alessandra\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\5 0\5535ab32-692fcdd3-n\decora-d3d.dll
2010-05-25 15:18 . 2010-05-25 15:18 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-05-21 16:37 . 2010-05-21 16:37 503808 ----a-w- c:\documents and settings\Alessandra\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\5 4\1a209876-2ebc9eb9-n\msvcp71.dll
2010-05-21 16:37 . 2010-05-21 16:37 499712 ----a-w- c:\documents and settings\Alessandra\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\5 4\1a209876-2ebc9eb9-n\jmc.dll
2010-05-21 16:37 . 2010-05-21 16:37 348160 ----a-w- c:\documents and settings\Alessandra\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\5 4\1a209876-2ebc9eb9-n\msvcr71.dll
2010-05-21 16:37 . 2010-05-21 16:37 61440 ----a-w- c:\documents and settings\Alessandra\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\1 7\6d0ad391-68a641e1-n\decora-sse.dll
2010-05-21 16:37 . 2010-05-21 16:37 12800 ----a-w- c:\documents and settings\Alessandra\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\1 7\6d0ad391-68a641e1-n\decora-d3d.dll
.

------- Sigcheck -------

[-] 2009-07-24 . 3316C8A8EC07A9D4C0BE10310809A9E5 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot@2010-07-24_11.12.21 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-07-26 13:56 . 2010-07-26 13:56 16384 c:\windows\Temp\Perflib_Perfdata_324.dat
+ 2010-07-26 14:18 . 2010-07-26 14:18 49152 c:\windows\Installer\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}\ConfigIcon.dll
+ 2010-07-24 14:35 . 2010-07-24 14:35 1094656 c:\windows\Installer\53c29.msi
+ 2010-07-26 14:18 . 2010-07-26 14:18 20242432 c:\windows\Installer\14ef67.msp
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"LightScribe Control Panel"="c:\programmi\File comuni\LightScribe\LightScribeControlPanel.exe" [2007-08-23 455968]
"swg"="c:\programmi\Google\GoogleToolbarNotifier\G oogleToolbarNotifier.exe" [2009-07-25 39408]
"BitTorrent DNA"="c:\programmi\DNA\btdna.exe" [2009-12-13 323392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"SynTPStart"="c:\programmi\Synaptics\SynTP\SynTPSt art.exe" [2007-09-14 102400]
"IAAnotif"="c:\programmi\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-04 186904]
"QlbCtrl"="c:\programmi\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-12-06 202032]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-22 13594624]
"nwiz"="nwiz.exe" [2009-01-22 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray. dll" [2009-01-22 86016]
"RTHDCPL"="RTHDCPL.EXE" [2009-07-20 18670592]
"SMSERIAL"="c:\programmi\Motorola\SMSERIAL\sm56hlp r.exe" [2006-02-09 729088]
"EPSON Stylus D68 Series"="c:\windows\System32\spool\DRIVERS\W32X86\ 3\E_FATIAAE.EXE" [2005-01-25 98304]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.e xe" [2001-07-09 155648]
"SunJavaUpdateSched"="c:\programmi\File comuni\Java\Java Update\jusched.exe" [2010-02-18 248040]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-13 110592]
"egui"="c:\programmi\ESET\ESET NOD32 Antivirus\egui.exe" [2009-10-07 1461080]
"Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"Ad-Watch"="c:\programmi\Lavasoft\Ad-Aware\AAWTray.exe" [2010-07-24 524632]
"MyGarminAgent"="c:\programmi\Garmin\MyGarminAgent \MyGarminAgent.exe" [2010-03-16 337256]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programmi\\DNA\\btdna.exe"=
"c:\\Programmi\\BitTorrent\\bittorrent.exe"=
"c:\\Programmi\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"c:\\Programmi\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Programmi\\Skype\\Phone\\Skype.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [24/07/2010 11.15.27 64160]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfw tdir.sys [24/09/2008 15.53.52 35168]
R2 ekrn;Eset Service;c:\programmi\ESET\ESET NOD32 Antivirus\ekrn.exe [24/09/2008 15.53.16 472280]
R2 Start BT in service;Start BT in service;c:\programmi\IVT Corporation\BlueSoleil\StartSkysolSvc.exe [30/09/2007 9.16.38 51816]
R2 Windows Network Name Service;Windows Network Name Service;c:\windows\system32\config\systemprofile\I mpostazioni locali\Dati applicazioni\Windows Network Name Service\wnns.exe [21/07/2010 20.52.14 405504]
S2 gupdate;Servizio di Google Update (gupdate);c:\programmi\Google\Update\GoogleUpdate. exe [29/01/2010 22.10.43 135664]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\programmi\Lavasoft\Ad-Aware\AAWService.exe [18/01/2009 23.34.37 1029456]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-08-23 15:34 451872 ----a-w- c:\programmi\File comuni\LightScribe\LSRunOnce.exe
.

[ninosting]

Contenuto della cartella 'Scheduled Tasks'

2010-07-24 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\programmi\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 10:37]

2010-07-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2010-01-29 20:10]

2010-07-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2010-01-29 20:10]
.
.
------- Scansione supplementare -------
.
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\programmi\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8 574934B26AC4.dll/cmsidewiki.html
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949}
FF - ProfilePath - c:\documents and settings\Alessandra\Dati applicazioni\Mozilla\Firefox\Profiles\4d63pzus.def ault\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7& query=
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/webhp?hl=it
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&q uery=
FF - component: c:\programmi\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - plugin: c:\documents and settings\Alessandra\Dati applicazioni\Mozilla\Firefox\Profiles\4d63pzus.def ault\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
FF - plugin: c:\programmi\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\programmi\Google\Update\1.2.183.29\npGoogleOneC lick8.dll
FF - plugin: c:\programmi\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\programmi\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\programmi\Mozilla Firefox\plugins\npMyGames.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - truec:\programmi\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\programmi\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_every where__temporarily_available_pref", true);
c:\programmi\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\programmi\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_bro ken", false);
c:\programmi\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
.
.
------- Associazioni dei file -------
.
.scr=AutoCADScriptFile
.

************************************************** ************************
scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti:

************************************************** ************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\Curr entVersion\Installer\UserData\LocalSystem\Componen ts\€–€|ÿÿÿÿÀ•€|ù•9~*]
"0140110900063D11C8EF10054038389C"="C?\\WINDOWS\\s ystem32\\FM20ENU.DLL"
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------

- - - - - - - > 'explorer.exe'(2156)
c:\windows\system32\WININET.dll
c:\windows\system32\webcheck.dll
.
Ora fine scansione: 2010-07-26 16:46:58
ComboFix-quarantined-files.txt 2010-07-26 14:46
ComboFix2.txt 2010-07-24 11:13

Pre-Run: 90.970.107.904 byte disponibili
Post-Run: 90.959.458.304 byte disponibili

WindowsXP-KB310994-SP2-Pro-BootDisk-ITA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOW S
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Micro soft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 3B911B0194DED81659E53A1BEF14010E