Backdoor.Tidserv!inf

View previous topic View next topic Go down

Backdoor.Tidserv!inf

Post by Gennarino4 on Sat Jun 12, 2010 10:41 pm

I got attacked by this virus, my Norton comes up every now and then to tell me that there's this Backdoor.Tidserv!inf, which can't be deleted nor quarantined. Here's the name of the virus and its path:
C:\System Volume Information\_restore{F042C73A-C05C-47E0-9AA5-F39017A4A2FF}\RP944\A0186110.sys

Here are the OTL logs:
OTL logfile created on: 13/06/2010 0.18.17 - Run 1
OTL by OldTimer - Version 3.2.6.0 Folder = C:\Documents and Settings\Michael\Documenti\Download
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000410 | Country: Italia | Language: ITA | Date Format: dd/MM/yyyy

1.023,00 Mb Total Physical Memory | 453,00 Mb Available Physical Memory | 44,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 85,00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programmi
Drive C: | 232,88 Gb Total Space | 150,41 Gb Free Space | 64,59% Space Free | Partition Type: NTFS
Drive D: | 486,07 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: JORDAN
Current User Name: Michael
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/06/13 00.16.54 | 000,572,416 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Michael\Documenti\Download\OTL.exe
PRC - [2009/08/28 20.42.54 | 000,144,672 | ---- | M] (Apple Inc.) -- C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
PRC - [2009/03/09 13.44.12 | 000,130,560 | ---- | M] () -- C:\Programmi\PC Connectivity Solution\Transports\NclUSBSrv.exe
PRC - [2009/03/04 11.25.12 | 000,621,056 | ---- | M] (Nokia.) -- C:\Programmi\PC Connectivity Solution\ServiceLayer.exe
PRC - [2008/04/23 02.08.13 | 000,483,328 | ---- | M] (Adobe Systems Inc.) -- C:\Programmi\Adobe\Acrobat 7.0\Distillr\acrotray.exe
PRC - [2008/04/14 04.14.07 | 001,036,288 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/11/01 10.09.52 | 000,036,972 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programmi\Java\jre1.5.0\bin\jusched.exe
PRC - [2007/08/03 12.51.18 | 000,382,248 | ---- | M] (Nero AG) -- C:\Programmi\File comuni\Nero\Lib\NMIndexingService.exe
PRC - [2005/10/11 13.33.20 | 002,807,808 | R--- | M] (RealTek Semicoductor Corp.) -- C:\WINDOWS\ALCWZRD.EXE
PRC - [2005/09/21 10.24.02 | 000,086,016 | R--- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE
PRC - [2005/08/12 15.43.58 | 000,045,056 | ---- | M] (ATI Technologies Inc.) -- C:\Programmi\ATI Technologies\ATI.ACE\CLI.exe
PRC - [2005/06/23 20.27.36 | 000,085,696 | ---- | M] (Symantec Corporation) -- C:\Programmi\Symantec AntiVirus\VPTray.exe
PRC - [2005/06/23 20.27.28 | 001,715,904 | ---- | M] (Symantec Corporation) -- C:\Programmi\Symantec AntiVirus\Rtvscan.exe
PRC - [2005/06/23 20.27.18 | 000,019,648 | ---- | M] (Symantec Corporation) -- C:\Programmi\Symantec AntiVirus\DefWatch.exe
PRC - [2005/06/02 10.21.46 | 000,161,392 | ---- | M] (Symantec Corporation) -- C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe
PRC - [2005/06/02 10.21.40 | 000,185,968 | ---- | M] (Symantec Corporation) -- C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe
PRC - [2005/06/02 10.21.38 | 000,048,752 | ---- | M] (Symantec Corporation) -- C:\Programmi\File comuni\Symantec Shared\ccApp.exe


========== Modules (SafeList) ==========

MOD - [2010/06/13 00.16.54 | 000,572,416 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Michael\Documenti\Download\OTL.exe
MOD - [2008/04/14 04.12.35 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx


========== Win32 Services (SafeList) ==========

SRV - [2009/08/28 20.42.54 | 000,144,672 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2009/03/04 11.25.12 | 000,621,056 | ---- | M] (Nokia.) [On_Demand | Running] -- C:\Programmi\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2007/08/09 09.27.52 | 000,073,728 | ---- | M] (HP) [Auto | Stopped] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)
SRV - [2007/08/03 12.51.18 | 000,382,248 | ---- | M] (Nero AG) [On_Demand | Running] -- C:\Programmi\File comuni\Nero\Lib\NMIndexingService.exe -- (NMIndexingService)
SRV - [2005/06/23 20.27.30 | 000,124,608 | ---- | M] (symantec) [On_Demand | Stopped] -- C:\Programmi\Symantec AntiVirus\SavRoam.exe -- (SavRoam)
SRV - [2005/06/23 20.27.28 | 001,715,904 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Programmi\Symantec AntiVirus\Rtvscan.exe -- (Symantec AntiVirus)
SRV - [2005/06/23 20.27.18 | 000,019,648 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Programmi\Symantec AntiVirus\DefWatch.exe -- (DefWatch)
SRV - [2005/06/02 10.21.46 | 000,161,392 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe -- (ccSetMgr)
SRV - [2005/06/02 10.21.46 | 000,083,568 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Programmi\File comuni\Symantec Shared\ccPwdSvc.exe -- (ccPwdSvc)
SRV - [2005/06/02 10.21.40 | 000,185,968 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe -- (ccEvtMgr)
SRV - [2005/04/22 13.03.28 | 000,206,552 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Programmi\File comuni\Symantec Shared\SNDSrvc.exe -- (SNDSrvc)
SRV - [2005/04/04 01.41.10 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2005/03/30 22.48.22 | 000,992,864 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Programmi\File comuni\Symantec Shared\SPBBC\SPBBCSvc.exe -- (SPBBCSvc)
SRV - [2003/07/28 12.28.22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programmi\File comuni\Microsoft Shared\Source Engine\OSE.EXE -- (ose)


========== Driver Services (SafeList) ==========

DRV - [2010/05/28 10.00.00 | 000,371,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Programmi\File comuni\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2010/05/17 10.00.00 | 001,347,504 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Programmi\File comuni\Symantec Shared\VirusDefs\20100611.003\NAVEX15.SYS -- (NAVEX15)
DRV - [2010/05/17 10.00.00 | 000,085,552 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Programmi\File comuni\Symantec Shared\VirusDefs\20100611.003\NAVENG.SYS -- (NAVENG)
DRV - [2009/02/09 07.37.56 | 000,007,808 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2009/02/09 07.37.48 | 000,007,808 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2009/02/09 07.37.46 | 000,022,016 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2009/02/09 07.37.46 | 000,017,664 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2008/08/26 10.26.12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2008/04/13 18.36.05 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2006/05/03 16.40.42 | 000,390,784 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\snpstd.sys -- (snpstd)
DRV - [2006/04/22 03.44.39 | 000,008,064 | ---- | M] (Elaborate Bytes AG) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\ElbyCDIO.sys -- (ElbyCDIO)
DRV - [2005/11/23 05.50.52 | 001,410,560 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2005/10/18 13.15.42 | 004,034,048 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2005/09/30 12.11.42 | 000,078,720 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtnicxp.sys -- (RTL8023xp)
DRV - [2005/05/13 20.50.10 | 000,123,488 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Programmi\Symantec\SYMEVENT.SYS -- (SymEvent)
DRV - [2005/05/03 17.34.02 | 000,027,392 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ElbyCDFL.sys -- (ElbyCDFL)
DRV - [2005/04/22 13.03.02 | 000,267,192 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\SYMTDI.SYS -- (SYMTDI)
DRV - [2005/04/22 13.03.00 | 000,017,976 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\Drivers\SYMREDRV.SYS -- (SYMREDRV)
DRV - [2005/03/30 22.48.20 | 000,372,832 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Programmi\File comuni\Symantec Shared\SPBBC\SPBBCDrv.sys -- (SPBBCDrv)
DRV - [2005/02/04 21.14.32 | 000,053,896 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Programmi\Symantec AntiVirus\Savrtpel.sys -- (SAVRTPEL)
DRV - [2005/02/04 21.14.30 | 000,324,232 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Programmi\Symantec AntiVirus\savrt.sys -- (SAVRT)
DRV - [2004/10/27 16.21.30 | 000,145,920 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Hdaudio.sys -- (HdAudAddService)
DRV - [2004/08/04 00.31.34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139)
DRV - [2003/11/13 19.19.48 | 000,210,304 | R--- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWBS2.sys -- (HSFHWBS2)
DRV - [2003/11/13 19.18.36 | 000,679,808 | R--- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2003/11/13 19.17.00 | 001,042,816 | R--- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = [You must be registered and logged in to see this link.]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = [You must be registered and logged in to see this link.]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = it
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 10 53 BC 72 05 0A CB 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:1435

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.defaulturl: "http://www.bing.com/search?FORM=IEFM1&q="
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Wikipedia (it)"
FF - prefs.js..browser.search.selectedengine: "Google"
FF - prefs.js..browser.search.usedbfororder: true
FF - prefs.js..browser.startup.homepage: "http://fr.yahoo.com/"
FF - prefs.js..extensions.enabledItems: [You must be registered and logged in to see this link.]:1.0
FF - prefs.js..extensions.enabledItems: [You must be registered and logged in to see this link.]:3.10.7
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.2.20100119091315
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20


FF - HKLM\software\mozilla\Firefox\Extensions\\bkmrksync@nokia.com: C:\Programmi\Nokia\Nokia PC Suite 7\bkmrksync\ [2009/09/28 18.13.24 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Programmi\Mozilla Firefox\components [2010/04/08 12.39.58 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Programmi\Mozilla Firefox\plugins [2010/06/13 00.12.54 | 000,000,000 | ---D | M]

[2008/08/29 14.37.51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Michael\Dati applicazioni\Mozilla\Extensions
[2010/06/13 00.13.26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Michael\Dati applicazioni\Mozilla\Firefox\Profiles\b7lznjem.default\extensions
[2010/06/12 23.13.54 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Michael\Dati applicazioni\Mozilla\Firefox\Profiles\b7lznjem.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/02/17 19.25.33 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Documents and Settings\Michael\Dati applicazioni\Mozilla\Firefox\Profiles\b7lznjem.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/01/18 15.43.58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Michael\Dati applicazioni\Mozilla\Firefox\Profiles\b7lznjem.default\extensions\scoreboard@ryan.net
[2010/06/09 09.03.57 | 000,004,885 | ---- | M] () -- C:\Documents and Settings\Michael\Dati applicazioni\Mozilla\Firefox\Profiles\b7lznjem.default\searchplugins\dizionario-repubblica.xml
[2010/06/12 10.01.30 | 000,001,238 | ---- | M] () -- C:\Documents and Settings\Michael\Dati applicazioni\Mozilla\Firefox\Profiles\b7lznjem.default\searchplugins\facebook.xml
[2009/09/14 20.08.05 | 000,002,318 | ---- | M] () -- C:\Documents and Settings\Michael\Dati applicazioni\Mozilla\Firefox\Profiles\b7lznjem.default\searchplugins\filmtvit.xml
[2010/06/09 09.03.57 | 000,001,986 | ---- | M] () -- C:\Documents and Settings\Michael\Dati applicazioni\Mozilla\Firefox\Profiles\b7lznjem.default\searchplugins\garzanti-it.xml
[2009/09/29 17.53.16 | 000,002,438 | ---- | M] () -- C:\Documents and Settings\Michael\Dati applicazioni\Mozilla\Firefox\Profiles\b7lznjem.default\searchplugins\longman-english-dictionary.xml
[2009/05/24 11.39.10 | 000,002,411 | ---- | M] () -- C:\Documents and Settings\Michael\Dati applicazioni\Mozilla\Firefox\Profiles\b7lznjem.default\searchplugins\oxford-paravia.xml
[2009/09/09 16.54.27 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Michael\Dati applicazioni\Mozilla\Firefox\Profiles\b7lznjem.default\searchplugins\ricerca-video-di-youtube.xml
[2009/09/10 18.56.35 | 000,001,358 | ---- | M] () -- C:\Documents and Settings\Michael\Dati applicazioni\Mozilla\Firefox\Profiles\b7lznjem.default\searchplugins\wikipdia-fr.xml
[2009/09/16 15.05.01 | 000,001,340 | ---- | M] () -- C:\Documents and Settings\Michael\Dati applicazioni\Mozilla\Firefox\Profiles\b7lznjem.default\searchplugins\wikipedia-en.xml
[2010/06/13 00.13.26 | 000,000,000 | ---D | M] -- C:\Programmi\Mozilla Firefox\extensions
[2010/06/13 00.12.56 | 000,000,000 | ---D | M] (Java Console) -- C:\Programmi\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/06/13 00.12.40 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programmi\Mozilla Firefox\plugins\npdeployJava1.dll
[2009/07/09 14.34.59 | 000,001,412 | ---- | M] () -- C:\Programmi\Mozilla Firefox\searchplugins\demauro.xml
[2010/03/24 11.28.35 | 000,000,744 | ---- | M] () -- C:\Programmi\Mozilla Firefox\searchplugins\eBay-it.xml
[2010/03/24 11.28.35 | 000,000,825 | ---- | M] () -- C:\Programmi\Mozilla Firefox\searchplugins\hoepli.xml
[2010/03/24 11.28.35 | 000,001,182 | ---- | M] () -- C:\Programmi\Mozilla Firefox\searchplugins\wikipedia-it.xml
[2010/03/24 11.28.35 | 000,000,953 | ---- | M] () -- C:\Programmi\Mozilla Firefox\searchplugins\yahoo-it.xml

O1 HOSTS File: ([2010/06/12 18.48.47 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programmi\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Guida per l'accesso a Windows Live) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (QUICKfind BHO Object) - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:\Programmi\IDM\QUICKfind\PlugIns\IEHelp.dll ()
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Yahoo! uC) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! uC) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [Acrobat Assistant 7.0] C:\Programmi\Adobe\Acrobat 7.0\Distillr\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [AlcWzrd] C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.)
O4 - HKLM..\Run: [ATICCC] C:\Programmi\ATI Technologies\ATI.ACE\cli.exe (ATI Technologies Inc.)
O4 - HKLM..\Run: [ccApp] C:\Programmi\File comuni\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [CloneCDTray] C:\Programmi\SlySoft\CloneCD\CloneCDTray.exe (SlySoft, Inc.)
O4 - HKLM..\Run: [EverioService] C:\Programmi\CyberLink\PCM4Everio\EverioService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\HdAShCut.exe (Windows (R) Server 2003 DDK provider)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (rootkit-scan)] C:\Programmi\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NBKeyScan] C:\Programmi\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG)
O4 - HKLM..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programmi\File comuni\Nero\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programmi\File comuni\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [vptray] C:\Programmi\Symantec AntiVirus\VPTray.exe (Symantec Corporation)
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Programmi\File comuni\Nero\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKCU..\Run: [CTSyncU.exe] C:\Programmi\Creative\Sync Manager Unicode\CTSyncU.exe ()
O4 - HKCU..\Run: [igndlm.exe] C:\Programmi\Download Manager\DLM.exe (IGN Entertainment)
O4 - HKCU..\Run: [PC Suite Tray] C:\Programmi\Nokia\Nokia PC Suite 7\PCSuite.exe (Nokia)
O4 - HKCU..\Run: [Yahoo! Pager] C:\Programmi\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKCU..\RunOnce: [Shockwave Updater] C:\WINDOWS\System32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1103470 -Mozilla\4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident\4.0; File not found
O4 - Startup: C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\Adobe Acrobat Speed Launcher.lnk = C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-100000000002}\SC_Acrobat.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\Avvio rapido HP Photosmart Premier.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqthb08.exe (Hewlett-Packard Development Company, L.P.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programmi\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} [You must be registered and logged in to see this link.] (QuickTime Object)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} [You must be registered and logged in to see this link.] (Shockwave ActiveX Control)
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} [You must be registered and logged in to see this link.] (Reg Error: Key error.)
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} [You must be registered and logged in to see this link.] (CDownloadCtrl Object)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} [You must be registered and logged in to see this link.] (MSN Photo Upload Tool)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} [You must be registered and logged in to see this link.] (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} [You must be registered and logged in to see this link.] (Java Plug-in 1.6.0_20)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} [You must be registered and logged in to see this link.] (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} [You must be registered and logged in to see this link.] (Java Plug-in 1.5.0)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [You must be registered and logged in to see this link.] (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [You must be registered and logged in to see this link.] (Java Plug-in 1.6.0_20)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} [You must be registered and logged in to see this link.] (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programmi\File comuni\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programmi\File comuni\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programmi\File comuni\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\NavLogon: DllName - C:\WINDOWS\system32\NavLogon.dll - C:\WINDOWS\system32\NavLogon.dll (Symantec Corporation)
O24 - Desktop Components:0 (Pagina iniziale corrente) - About:Home
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Michael\Impostazioni locali\Dati applicazioni\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/11/01 10.07.06 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2008/03/26 17.29.21 | 000,000,054 | RH-- | M] () - D:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

Gennarino4
Novice
Novice

Posts Posts : 12
Joined Joined : 2010-06-12
OS OS : Windows XP Home Edition
Points Points : 23848
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Backdoor.Tidserv!inf

Post by Gennarino4 on Sat Jun 12, 2010 10:42 pm

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2007/11/01 10.06.44 | 000,000,000 | ---D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\system32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found

MsConfig - StartUpReg: CTFMON.EXE - hkey= - key= - File not found
MsConfig - StartUpReg: Defense Center - hkey= - key= - C:\Programmi\Defense Center\defcnt.exe ()
MsConfig - StartUpReg: iTunesHelper - hkey= - key= - C:\Programmi\iTunes\iTunesHelper.exe (Apple Inc.)
MsConfig - StartUpReg: MSMSGS - hkey= - key= - C:\Programmi\Messenger\msmsgs.exe (Microsoft Corporation)
MsConfig - StartUpReg: MsnMsgr - hkey= - key= - C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe (Microsoft Corporation)
MsConfig - StartUpReg: Qsotexinodusex - hkey= - key= - C:\WINDOWS\ntPrasti.DLL (Wondershare)
MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Programmi\QuickTime\qttask.exe (Apple Inc.)
MsConfig - StartUpReg: snpstd - hkey= - key= - C:\WINDOWS\vsnpstd.exe ()
MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Programmi\Java\jre6\bin\jusched.exe File not found
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 2

SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

ActiveX: {0291E591-EA41-4c82-8106-3DC6CE7F7664} - Reg Error: Value error.
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Rendering grafica vettoriale (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 10.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 10.4
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} - Reg Error: Value error.
ActiveX: {347B0667-C7ED-429B-BDE3-CC8D3BACAA31} - Reg Error: Value error.
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Binding dati Dynamic HTML per Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Creazione avanzata
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015C} - Microsoft DirectX
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - Classi Java DirectAnimation
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows script 5.6
ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Aggiornamento della protezione per Windows XP (KB923789)
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {A17E30C4-A9BA-11D4-8673-60DB54C10000} - Reg Error: Value error.
ActiveX: {AA218328-0EA8-4D70-8972-E987A9190FF4} - Reg Error: Value error.
ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CB86EC62-CEA7-4C82-9EBA-B7A5E410E54C} - Reg Error: Value error.
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Utilit di pianificazione
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - Reg Error: Value error.
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F2D2B58B-B2FD-46D1-8319-DCE564079934} - .NET Framework
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.siren - C:\WINDOWS\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FFDS - C:\WINDOWS\System32\ff_vfw.dll ()
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.LEAD - LCODCCMP.DLL File not found
Drivers32: vidc.XVID - C:\WINDOWS\System32\xvidvfw.dll ()

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 30 Days ==========

[2010/06/13 00.13.23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dati applicazioni\Sun
[2010/06/13 00.12.54 | 000,411,368 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2010/06/13 00.12.54 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010/06/13 00.12.54 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010/06/13 00.12.54 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010/06/13 00.12.54 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2010/06/13 00.00.40 | 000,000,000 | ---D | C] -- C:\Programmi\Hijackthis
[2010/06/12 23.07.16 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2010/06/12 20.20.08 | 000,743,424 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iedvtool.dll
[2010/06/12 19.51.38 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Michael\Recent
[2010/06/12 18.12.25 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010/06/12 18.12.25 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010/06/12 18.12.25 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010/06/12 18.12.25 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010/06/12 17.48.30 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/06/12 16.50.07 | 000,000,000 | ---D | C] -- C:\Programmi\Defense Center
[2010/06/11 11.21.44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Dati applicazioni\AdobeUM
[2010/06/11 11.20.41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Adobe
[2010/06/11 11.20.33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Dati applicazioni\Real
[2010/06/10 13.33.15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael\Dati applicazioni\Malwarebytes
[2010/06/10 13.33.03 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/06/10 13.33.02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dati applicazioni\Malwarebytes
[2010/06/10 13.33.01 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/06/10 13.33.01 | 000,000,000 | ---D | C] -- C:\Programmi\Malwarebytes' Anti-Malware
[2010/06/10 10.59.46 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8
[2010/06/10 09.53.35 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss
[2010/06/10 09.25.20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Dati applicazioni\Macromedia
[2010/06/10 09.25.18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Dati applicazioni\Adobe
[2010/05/24 10.32.39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael\Impostazioni locali\Dati applicazioni\DOSBox
[2010/05/24 10.32.28 | 000,000,000 | ---D | C] -- C:\Programmi\DOSBox-0.74
[2010/05/24 10.28.29 | 000,000,000 | ---D | C] -- C:\RAPTOR
[2010/05/21 10.12.51 | 000,000,000 | ---D | C] -- C:\Programmi\Wedding Dash 2 - Rings Around the World
[2010/05/14 21.27.54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dati applicazioni\TEMP
[2010/05/14 21.27.41 | 000,000,000 | ---D | C] -- C:\Programmi\Wedding Dash
[2010/05/14 21.25.58 | 000,000,000 | ---D | C] -- C:\Programmi\bfgclient
[2010/05/14 21.25.20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dati applicazioni\BigFishGamesCache
[2009/02/21 23.57.27 | 000,061,440 | ---- | C] ( ) -- C:\WINDOWS\System32\rsnpstd.dll
[2009/02/21 23.57.27 | 000,061,440 | ---- | C] ( ) -- C:\WINDOWS\System32\csnpstd.dll
[2009/02/21 23.57.27 | 000,036,864 | ---- | C] ( ) -- C:\WINDOWS\System32\vsnpstd.dll
[9 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Documents and Settings\Michael\Documenti\*.tmp files -> C:\Documents and Settings\Michael\Documenti\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/06/13 17.21.42 | 002,080,368 | ---- | M] () -- C:\Documents and Settings\Michael\Documenti\ALIM1667.JPG
[2010/06/13 17.21.34 | 002,004,508 | ---- | M] () -- C:\Documents and Settings\Michael\Documenti\ALIM1666.JPG
[2010/06/13 17.20.44 | 002,587,316 | ---- | M] () -- C:\Documents and Settings\Michael\Documenti\ALIM1664.JPG
[2010/06/13 00.12.39 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2010/06/13 00.12.39 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010/06/13 00.12.39 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010/06/13 00.12.39 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010/06/13 00.12.39 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2010/06/13 00.05.48 | 104,857,600 | ---- | M] () -- C:\Documents and Settings\Michael\Desktop\P_Girls_of_Hedonism_R.B.Jamaica.part4.rar
[2010/06/13 00.01.08 | 000,002,541 | ---- | M] () -- C:\Documents and Settings\Michael\Desktop\HiJackThis.lnk
[2010/06/12 22.30.46 | 104,857,600 | ---- | M] () -- C:\Documents and Settings\Michael\Desktop\P_Girls_of_Hedonism_R.B.Jamaica.part3.rar
[2010/06/12 21.29.37 | 000,002,319 | ---- | M] () -- C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\Adobe Acrobat Speed Launcher.lnk
[2010/06/12 21.29.31 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/06/12 21.29.27 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/06/12 21.29.24 | 000,216,064 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/06/12 21.28.20 | 009,437,184 | -H-- | M] () -- C:\Documents and Settings\Michael\NTUSER.DAT
[2010/06/12 21.28.09 | 000,000,194 | -HS- | M] () -- C:\Documents and Settings\Michael\ntuser.ini
[2010/06/12 20.57.44 | 104,857,600 | ---- | M] () -- C:\Documents and Settings\Michael\Desktop\P_Girls_of_Hedonism_R.B.Jamaica.part2.rar
[2010/06/12 20.47.42 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/06/12 20.33.07 | 001,055,768 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/06/12 20.33.07 | 000,489,410 | ---- | M] () -- C:\WINDOWS\System32\perfh010.dat
[2010/06/12 20.33.07 | 000,441,260 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/06/12 20.33.07 | 000,084,156 | ---- | M] () -- C:\WINDOWS\System32\perfc010.dat
[2010/06/12 20.33.07 | 000,071,196 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/06/12 18.49.21 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/06/12 18.48.47 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010/06/12 18.17.16 | 000,000,930 | ---- | M] () -- C:\WINDOWS\win.ini
[2010/06/12 18.17.16 | 000,000,211 | -HS- | M] () -- C:\boot.ini
[2010/06/12 17.57.56 | 000,000,897 | ---- | M] () -- C:\Documents and Settings\Michael\Desktop\Collegamento a ComboFix.exe.lnk
[2010/06/12 16.18.47 | 104,857,600 | ---- | M] () -- C:\Documents and Settings\Michael\Desktop\P_Girls_of_Hedonism_R.B.Jamaica.part1.rar
[2010/06/12 10.02.03 | 000,000,438 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{D35A9AC5-A617-4241-A07E-4471DF07796E}.job
[2010/06/12 09.57.04 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010/06/11 18.00.01 | 000,000,396 | ---- | M] () -- C:\WINDOWS\tasks\Norton Security Scan for Michael.job
[2010/06/06 09.45.13 | 000,142,848 | ---- | M] () -- C:\Documents and Settings\Michael\Impostazioni locali\Dati applicazioni\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/06/05 10.16.35 | 000,023,014 | ---- | M] () -- C:\Documents and Settings\Michael\Desktop\doc_news_2173_27-05-2010_4bfe4496c452d.pdf
[2010/06/04 15.32.10 | 000,055,320 | ---- | M] () -- C:\Documents and Settings\Michael\Desktop\doc_obj_5213_11-05-2010_4be92cfd0d028.pdf
[2010/06/02 17.23.34 | 000,064,000 | ---- | M] () -- C:\Documents and Settings\Michael\Documenti\Lettera XX provvisorio.doc
[2010/06/01 10.37.37 | 000,061,952 | ---- | M] () -- C:\Documents and Settings\Michael\Documenti\Lettera XIX provvisorio.doc
[2010/06/01 10.08.14 | 000,071,331 | ---- | M] () -- C:\Documents and Settings\Michael\Documenti\Immag0063.jpg
[2010/06/01 10.08.02 | 000,062,712 | ---- | M] () -- C:\Documents and Settings\Michael\Documenti\Immag0062.jpg
[2010/05/31 18.12.01 | 000,022,528 | ---- | M] () -- C:\Documents and Settings\Michael\Documenti\LETTERA DI LEILA A NANCY.doc
[2010/05/31 12.50.00 | 000,052,912 | ---- | M] () -- C:\Documents and Settings\Michael\Documenti\Immag0061.jpg
[2010/05/25 20.32.28 | 000,060,701 | ---- | M] () -- C:\Documents and Settings\Michael\Dati applicazioni\mdbu.bin
[2010/05/25 10.15.09 | 000,118,801 | ---- | M] () -- C:\Documents and Settings\Michael\Desktop\doc_obj_5213_11-05-2010_4be92dbe74842.pdf
[2010/05/18 12.07.54 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[9 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Documents and Settings\Michael\Documenti\*.tmp files -> C:\Documents and Settings\Michael\Documenti\*.tmp -> ]

Gennarino4
Novice
Novice

Posts Posts : 12
Joined Joined : 2010-06-12
OS OS : Windows XP Home Edition
Points Points : 23848
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Backdoor.Tidserv!inf

Post by Gennarino4 on Sat Jun 12, 2010 10:43 pm

========== Files Created - No Company Name ==========

[2010/06/13 00.05.48 | 104,857,600 | ---- | C] () -- C:\Documents and Settings\Michael\Desktop\P_Girls_of_Hedonism_R.B.Jamaica.part4.rar
[2010/06/13 00.00.41 | 000,002,541 | ---- | C] () -- C:\Documents and Settings\Michael\Desktop\HiJackThis.lnk
[2010/06/12 22.30.46 | 104,857,600 | ---- | C] () -- C:\Documents and Settings\Michael\Desktop\P_Girls_of_Hedonism_R.B.Jamaica.part3.rar
[2010/06/12 20.57.45 | 104,857,600 | ---- | C] () -- C:\Documents and Settings\Michael\Desktop\P_Girls_of_Hedonism_R.B.Jamaica.part2.rar
[2010/06/12 18.12.25 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/06/12 18.12.25 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/06/12 18.12.25 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/06/12 18.12.25 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/06/12 18.12.25 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010/06/12 17.57.56 | 000,000,897 | ---- | C] () -- C:\Documents and Settings\Michael\Desktop\Collegamento a ComboFix.exe.lnk
[2010/06/12 16.18.47 | 104,857,600 | ---- | C] () -- C:\Documents and Settings\Michael\Desktop\P_Girls_of_Hedonism_R.B.Jamaica.part1.rar
[2010/06/06 10.06.06 | 000,071,331 | ---- | C] () -- C:\Documents and Settings\Michael\Documenti\Immag0063.jpg
[2010/06/06 10.06.06 | 000,062,712 | ---- | C] () -- C:\Documents and Settings\Michael\Documenti\Immag0062.jpg
[2010/06/06 10.06.06 | 000,052,912 | ---- | C] () -- C:\Documents and Settings\Michael\Documenti\Immag0061.jpg
[2010/06/06 10.03.06 | 002,587,316 | ---- | C] () -- C:\Documents and Settings\Michael\Documenti\ALIM1664.JPG
[2010/06/06 10.03.06 | 002,080,368 | ---- | C] () -- C:\Documents and Settings\Michael\Documenti\ALIM1667.JPG
[2010/06/06 10.03.06 | 002,004,508 | ---- | C] () -- C:\Documents and Settings\Michael\Documenti\ALIM1666.JPG
[2010/06/05 10.16.34 | 000,023,014 | ---- | C] () -- C:\Documents and Settings\Michael\Desktop\doc_news_2173_27-05-2010_4bfe4496c452d.pdf
[2010/06/04 15.32.09 | 000,055,320 | ---- | C] () -- C:\Documents and Settings\Michael\Desktop\doc_obj_5213_11-05-2010_4be92cfd0d028.pdf
[2010/06/02 15.10.11 | 000,064,000 | ---- | C] () -- C:\Documents and Settings\Michael\Documenti\Lettera XX provvisorio.doc
[2010/05/31 18.12.16 | 000,061,952 | ---- | C] () -- C:\Documents and Settings\Michael\Documenti\Lettera XIX provvisorio.doc
[2010/05/31 18.02.54 | 000,022,528 | ---- | C] () -- C:\Documents and Settings\Michael\Documenti\LETTERA DI LEILA A NANCY.doc
[2010/05/25 10.15.09 | 000,118,801 | ---- | C] () -- C:\Documents and Settings\Michael\Desktop\doc_obj_5213_11-05-2010_4be92dbe74842.pdf
[2010/04/06 21.41.30 | 000,000,048 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2009/03/13 23.56.16 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt03.dll
[2009/02/21 23.57.38 | 000,015,541 | ---- | C] () -- C:\WINDOWS\snpstd.ini
[2009/02/21 23.57.34 | 000,390,784 | ---- | C] () -- C:\WINDOWS\System32\drivers\snpstd.sys
[2009/02/14 22.43.24 | 000,002,138 | ---- | C] () -- C:\WINDOWS\EaseAudioCutter.ini
[2009/02/13 22.59.02 | 000,000,033 | ---- | C] () -- C:\WINDOWS\ateg.ini
[2008/12/01 21.16.28 | 000,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2008/10/28 18.01.19 | 000,198,144 | ---- | C] () -- C:\WINDOWS\System32\_psisdecd.dll
[2008/10/03 17.34.48 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2008/08/27 12.18.23 | 000,761,856 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2008/08/27 12.18.23 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2008/08/27 12.18.12 | 000,010,752 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2008/08/27 12.18.12 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2008/02/17 23.35.53 | 000,000,221 | ---- | C] () -- C:\WINDOWS\NCLogConfig.ini
[2007/11/09 10.44.29 | 000,027,002 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2007/11/01 16.42.03 | 000,000,000 | ---- | C] () -- C:\WINDOWS\vpc32.INI
[2007/11/01 12.36.17 | 000,077,824 | R--- | C] () -- C:\WINDOWS\System32\HPZIDS01.dll
[2007/11/01 11.55.33 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2007/11/01 10.10.18 | 000,000,996 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2006/12/30 17.31.06 | 000,000,460 | ---- | C] () -- C:\WINDOWS\superwmamp3cutter.ini
[2004/09/10 15.36.12 | 000,327,680 | ---- | C] () -- C:\WINDOWS\System32\QFClient2.dll
[2003/08/07 15.01.52 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll
[2001/07/07 04.00.02 | 000,003,267 | ---- | C] () -- C:\WINDOWS\System32\HPTCPMON.INI
[1997/06/14 12.56.08 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\iyvu9_32.dll

========== Custom Scans ==========


< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\*.exe /lockedfiles >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2007/11/01 10.56.16 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2007/11/01 10.56.16 | 000,638,976 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2007/11/01 10.56.16 | 000,458,752 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\*.sys >
[2004/08/19 14.00.00 | 000,009,030 | ---- | M] () -- C:\WINDOWS\system32\ansi.sys
[2004/08/19 14.00.00 | 000,027,097 | ---- | M] () -- C:\WINDOWS\system32\country.sys
[2004/08/19 14.00.00 | 000,004,800 | ---- | M] () -- C:\WINDOWS\system32\himem.sys
[2004/08/19 14.00.00 | 000,042,809 | ---- | M] () -- C:\WINDOWS\system32\key01.sys
[2004/08/19 14.00.00 | 000,042,537 | ---- | M] () -- C:\WINDOWS\system32\keyboard.sys
[2004/08/19 14.00.00 | 000,027,898 | ---- | M] () -- C:\WINDOWS\system32\ntdos.sys
[2004/08/19 14.00.00 | 000,029,146 | ---- | M] () -- C:\WINDOWS\system32\ntdos404.sys
[2004/08/19 14.00.00 | 000,029,370 | ---- | M] () -- C:\WINDOWS\system32\ntdos411.sys
[2004/08/19 14.00.00 | 000,029,274 | ---- | M] () -- C:\WINDOWS\system32\ntdos412.sys
[2004/08/19 14.00.00 | 000,029,146 | ---- | M] () -- C:\WINDOWS\system32\ntdos804.sys
[2004/08/19 14.00.00 | 000,033,968 | ---- | M] () -- C:\WINDOWS\system32\ntio.sys
[2004/08/19 14.00.00 | 000,034,560 | ---- | M] () -- C:\WINDOWS\system32\ntio404.sys
[2004/08/19 14.00.00 | 000,035,648 | ---- | M] () -- C:\WINDOWS\system32\ntio411.sys
[2004/08/19 14.00.00 | 000,035,424 | ---- | M] () -- C:\WINDOWS\system32\ntio412.sys
[2004/08/19 14.00.00 | 000,034,560 | ---- | M] () -- C:\WINDOWS\system32\ntio804.sys
[2008/04/13 20.44.59 | 000,017,664 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\watchdog.sys
[2010/05/02 10.06.54 | 001,851,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\win32k.sys
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\drivers\*.dll >
[2008/04/14 04.13.36 | 000,004,255 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv01nt5.dll
[2008/04/14 04.13.36 | 000,003,967 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv02nt5.dll
[2008/04/14 04.13.36 | 000,003,615 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv05nt5.dll
[2008/04/14 04.13.36 | 000,003,647 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv07nt5.dll
[2008/04/14 04.13.36 | 000,003,135 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv08nt5.dll
[2008/04/14 04.13.36 | 000,003,711 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv09nt5.dll
[2008/04/14 04.13.36 | 000,003,775 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv11nt5.dll
[2005/11/23 04.48.38 | 000,040,960 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\drivers\ati2erec.dll
[2008/04/14 04.13.37 | 000,021,183 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\atv01nt5.dll
[2008/04/14 04.13.37 | 000,011,359 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\atv02nt5.dll
[2008/04/14 04.13.37 | 000,025,471 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\atv04nt5.dll
[2008/04/14 04.13.37 | 000,014,143 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\atv06nt5.dll
[2008/04/14 04.13.37 | 000,017,279 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\atv10nt5.dll
[2008/04/14 04.13.37 | 000,015,423 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\ch7xxnt5.dll
[2008/04/14 04.13.51 | 000,003,901 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\siint5.dll
[2008/04/14 04.13.55 | 000,011,325 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\vchnt5.dll

< %systemroot%\system32\drivers\*.ini >

< %systemroot%\system32\drivers\*.exe >

< %SYSTEMDRIVE%\*.* >
[2007/11/01 10.07.06 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2010/06/12 18.17.16 | 000,000,211 | -HS- | M] () -- C:\boot.ini
[2004/08/19 14.00.00 | 000,004,952 | RHS- | M] () -- C:\Bootfont.bin
[2010/06/12 18.57.08 | 000,017,089 | ---- | M] () -- C:\ComboFix.txt
[2007/11/01 10.07.06 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2007/11/01 10.07.06 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2010/06/13 00.15.58 | 000,000,474 | ---- | M] () -- C:\JavaRa.log
[2007/11/01 10.07.06 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2004/08/19 14.00.00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008/09/22 10.44.52 | 000,251,600 | RHS- | M] () -- C:\ntldr
[2010/06/12 21.29.23 | 1610,612,736 | -HS- | M] () -- C:\pagefile.sys

< %PROGRAMFILES%\*. >
[2009/07/10 13.54.05 | 000,000,000 | ---D | M] -- C:\Programmi\Adobe
[2008/03/18 16.43.04 | 000,000,000 | ---D | M] -- C:\Programmi\Ahead
[2009/09/17 16.21.32 | 000,000,000 | ---D | M] -- C:\Programmi\Amazon
[2009/12/20 11.24.30 | 000,000,000 | ---D | M] -- C:\Programmi\Apple Software Update
[2007/11/01 10.51.05 | 000,000,000 | ---D | M] -- C:\Programmi\ATI Technologies
[2008/08/27 12.13.43 | 000,000,000 | ---D | M] -- C:\Programmi\Avi2Dvd
[2008/08/27 12.17.44 | 000,000,000 | ---D | M] -- C:\Programmi\AviSynth 2.5
[2010/05/14 21.25.59 | 000,000,000 | ---D | M] -- C:\Programmi\bfgclient
[2010/06/09 17.29.53 | 000,000,000 | ---D | M] -- C:\Programmi\Bompiani
[2009/12/20 11.27.41 | 000,000,000 | ---D | M] -- C:\Programmi\Bonjour
[2008/10/31 16.47.23 | 000,000,000 | ---D | M] -- C:\Programmi\Commandos II
[2007/11/01 12.36.48 | 000,000,000 | ---D | M] -- C:\Programmi\Common Files
[2007/11/01 10.04.19 | 000,000,000 | ---D | M] -- C:\Programmi\ComPlus Applications
[2007/11/01 10.50.27 | 000,000,000 | ---D | M] -- C:\Programmi\CONEXANT
[2008/09/26 01.18.46 | 000,000,000 | ---D | M] -- C:\Programmi\Creative
[2008/09/26 01.18.51 | 000,000,000 | -H-D | M] -- C:\Programmi\Creative Installation Information
[2008/10/28 18.02.10 | 000,000,000 | ---D | M] -- C:\Programmi\CyberLink
[2008/08/27 22.39.37 | 000,000,000 | ---D | M] -- C:\Programmi\d2mp
[2010/06/12 16.51.07 | 000,000,000 | ---D | M] -- C:\Programmi\Defense Center
[2009/09/28 18.13.01 | 000,000,000 | ---D | M] -- C:\Programmi\DIFX
[2008/10/28 17.57.38 | 000,000,000 | ---D | M] -- C:\Programmi\Digital Photo Navigator 1.5
[2008/10/31 13.42.15 | 000,000,000 | ---D | M] -- C:\Programmi\directx
[2010/05/27 23.29.22 | 000,000,000 | ---D | M] -- C:\Programmi\DOSBox-0.74
[2008/12/01 20.57.54 | 000,000,000 | ---D | M] -- C:\Programmi\Download Manager
[2008/03/25 12.08.56 | 000,000,000 | ---D | M] -- C:\Programmi\DVD Decrypter
[2009/06/09 22.11.34 | 000,000,000 | ---D | M] -- C:\Programmi\easetech
[2009/03/08 10.33.24 | 000,000,000 | ---D | M] -- C:\Programmi\eMule
[2008/08/27 12.18.12 | 000,000,000 | ---D | M] -- C:\Programmi\ffdshow
[2010/06/12 18.37.56 | 000,000,000 | ---D | M] -- C:\Programmi\File comuni
[2010/04/06 20.41.51 | 000,000,000 | ---D | M] -- C:\Programmi\Free M4a to MP3 Converter
[2007/11/09 10.44.28 | 000,000,000 | ---D | M] -- C:\Programmi\FreeRIP3
[2008/12/01 23.11.05 | 000,000,000 | ---D | M] -- C:\Programmi\GameSpy Arcade
[2007/11/01 12.38.33 | 000,000,000 | ---D | M] -- C:\Programmi\Hewlett-Packard
[2010/06/13 00.00.40 | 000,000,000 | ---D | M] -- C:\Programmi\Hijackthis
[2009/04/29 19.01.12 | 000,000,000 | ---D | M] -- C:\Programmi\HP
[2009/02/22 12.52.10 | 000,000,000 | ---D | M] -- C:\Programmi\IDM
[2008/07/03 13.12.57 | 000,000,000 | ---D | M] -- C:\Programmi\InfraRecorder
[2010/04/06 21.41.09 | 000,000,000 | -H-D | M] -- C:\Programmi\InstallShield Installation Information
[2010/06/12 21.29.20 | 000,000,000 | ---D | M] -- C:\Programmi\Internet Explorer
[2009/12/20 11.28.36 | 000,000,000 | ---D | M] -- C:\Programmi\iPod
[2009/12/20 11.29.29 | 000,000,000 | ---D | M] -- C:\Programmi\iTunes
[2010/06/12 23.50.50 | 000,000,000 | ---D | M] -- C:\Programmi\Java
[2010/06/10 13.33.07 | 000,000,000 | ---D | M] -- C:\Programmi\Malwarebytes' Anti-Malware
[2008/09/24 00.00.58 | 000,000,000 | ---D | M] -- C:\Programmi\Messenger
[2009/11/06 10.24.44 | 000,000,000 | ---D | M] -- C:\Programmi\Microsoft
[2007/11/01 11.53.59 | 000,000,000 | ---D | M] -- C:\Programmi\Microsoft ActiveSync
[2008/06/06 00.03.04 | 000,000,000 | ---D | M] -- C:\Programmi\Microsoft CAPICOM 2.1.0.2
[2007/11/01 10.10.28 | 000,000,000 | ---D | M] -- C:\Programmi\microsoft frontpage
[2008/12/01 20.58.40 | 000,000,000 | ---D | M] -- C:\Programmi\Microsoft Games
[2007/11/01 11.52.36 | 000,000,000 | ---D | M] -- C:\Programmi\Microsoft Office
[2010/06/05 08.46.12 | 000,000,000 | ---D | M] -- C:\Programmi\Microsoft Silverlight
[2007/11/01 11.51.04 | 000,000,000 | ---D | M] -- C:\Programmi\Microsoft.NET
[2009/10/27 17.57.36 | 000,000,000 | ---D | M] -- C:\Programmi\miofotografo.it
[2010/03/11 00.54.14 | 000,000,000 | ---D | M] -- C:\Programmi\Movie Maker
[2010/06/01 10.57.03 | 000,000,000 | ---D | M] -- C:\Programmi\Mozilla Firefox
[2007/12/26 04.13.13 | 000,000,000 | ---D | M] -- C:\Programmi\MP-S10
[2009/08/10 00.05.19 | 000,000,000 | ---D | M] -- C:\Programmi\MSBuild
[2007/11/01 10.03.44 | 000,000,000 | ---D | M] -- C:\Programmi\MSN Gaming Zone
[2007/11/05 00.59.00 | 000,000,000 | ---D | M] -- C:\Programmi\MSXML 4.0
[2008/10/03 17.01.27 | 000,000,000 | ---D | M] -- C:\Programmi\Nero
[2008/09/22 10.47.44 | 000,000,000 | ---D | M] -- C:\Programmi\NetMeeting
[2009/09/28 18.13.19 | 000,000,000 | ---D | M] -- C:\Programmi\Nokia
[2010/06/11 18.00.00 | 000,000,000 | ---D | M] -- C:\Programmi\Norton Security Scan
[2010/05/13 00.01.22 | 000,000,000 | ---D | M] -- C:\Programmi\Outlook Express
[2009/02/22 12.46.17 | 000,000,000 | ---D | M] -- C:\Programmi\Oxford
[2007/11/03 16.00.58 | 000,000,000 | ---D | M] -- C:\Programmi\Paravia
[2009/09/28 18.12.54 | 000,000,000 | ---D | M] -- C:\Programmi\PC Connectivity Solution
[2010/03/20 21.19.15 | 000,000,000 | ---D | M] -- C:\Programmi\Poker Club by Lottomatica
[2010/01/09 12.44.58 | 000,000,000 | ---D | M] -- C:\Programmi\PokerStars.IT
[2009/12/20 11.27.22 | 000,000,000 | ---D | M] -- C:\Programmi\QuickTime
[2009/08/10 00.05.10 | 000,000,000 | ---D | M] -- C:\Programmi\Reference Assemblies
[2008/12/30 01.19.31 | 000,000,000 | ---D | M] -- C:\Programmi\ScummVM
[2008/03/27 19.18.43 | 000,000,000 | ---D | M] -- C:\Programmi\Seagrand
[2007/11/01 10.05.52 | 000,000,000 | ---D | M] -- C:\Programmi\Servizi in linea
[2008/08/27 22.42.33 | 000,000,000 | ---D | M] -- C:\Programmi\SlySoft
[2007/11/01 11.00.28 | 000,000,000 | ---D | M] -- C:\Programmi\Symantec
[2010/06/12 21.31.02 | 000,000,000 | ---D | M] -- C:\Programmi\Symantec AntiVirus
[2009/02/22 12.52.10 | 000,000,000 | ---D | M] -- C:\Programmi\TEXTware
[2009/02/21 23.46.58 | 000,000,000 | ---D | M] -- C:\Programmi\Trust
[2007/11/01 10.14.33 | 000,000,000 | -H-D | M] -- C:\Programmi\Uninstall Information
[2010/01/16 22.14.46 | 000,000,000 | ---D | M] -- C:\Programmi\Veoh Networks
[2007/11/10 17.22.00 | 000,000,000 | ---D | M] -- C:\Programmi\VideoLAN
[2009/12/20 02.13.58 | 000,000,000 | ---D | M] -- C:\Programmi\Vuze
[2010/05/14 21.27.49 | 000,000,000 | ---D | M] -- C:\Programmi\Wedding Dash
[2010/05/21 10.12.59 | 000,000,000 | ---D | M] -- C:\Programmi\Wedding Dash 2 - Rings Around the World
[2008/07/06 09.48.23 | 000,000,000 | ---D | M] -- C:\Programmi\Winamp
[2009/11/06 10.23.54 | 000,000,000 | ---D | M] -- C:\Programmi\Windows Live
[2008/09/04 12.16.23 | 000,000,000 | ---D | M] -- C:\Programmi\Windows Live Safety Center
[2009/11/06 10.24.23 | 000,000,000 | ---D | M] -- C:\Programmi\Windows Live SkyDrive
[2008/09/22 10.47.40 | 000,000,000 | ---D | M] -- C:\Programmi\Windows Media Player
[2008/09/22 10.47.40 | 000,000,000 | ---D | M] -- C:\Programmi\Windows NT
[2008/01/10 12.31.08 | 000,000,000 | ---D | M] -- C:\Programmi\WinRAR
[2007/11/01 10.58.33 | 000,000,000 | ---D | M] -- C:\Programmi\WinZip
[2009/12/19 14.04.03 | 000,000,000 | ---D | M] -- C:\Programmi\WMATool
[2007/11/01 10.10.28 | 000,000,000 | ---D | M] -- C:\Programmi\xerox
[2008/08/27 12.18.24 | 000,000,000 | ---D | M] -- C:\Programmi\XviD
[2008/04/08 22.35.31 | 000,000,000 | ---D | M] -- C:\Programmi\Yahoo!
[2008/12/02 11.42.20 | 000,000,000 | ---D | M] -- C:\Programmi\Zune

< %appdata%\*.* >
[2007/11/01 10.57.41 | 000,000,062 | -HS- | M] () -- C:\Documents and Settings\Michael\Dati applicazioni\desktop.ini
[2010/05/25 20.32.28 | 000,060,701 | ---- | M] () -- C:\Documents and Settings\Michael\Dati applicazioni\mdbu.bin
[2009/09/28 18.18.40 | 000,830,013 | ---- | M] () -- C:\Documents and Settings\Michael\Dati applicazioni\NMM-MetaData.db
[2008/11/19 22.54.36 | 043,019,018 | ---- | M] () -- C:\Documents and Settings\Michael\Dati applicazioni\RayV.trc


< MD5 for: AGP440.SYS >
[2004/08/19 14.00.00 | 018,778,587 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008/09/22 10.40.21 | 023,892,987 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2008/09/22 10.40.21 | 023,892,987 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 20.36.38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ERDNT\cache\agp440.sys
[2008/04/13 20.36.38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 20.36.38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys

< MD5 for: ATAPI.SYS >
[2004/08/19 14.00.00 | 018,778,587 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008/09/22 10.40.21 | 023,892,987 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008/09/22 10.40.21 | 023,892,987 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/13 20.40.30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ERDNT\cache\atapi.sys
[2008/04/13 20.40.30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 20.40.30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/03 23.59.44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2004/08/19 14.00.00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0012\DriverFiles\i386\atapi.sys
[2004/08/03 23.59.44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0013\DriverFiles\i386\atapi.sys

< MD5 for: DISK.SYS >
[2004/08/19 14.00.00 | 018,778,587 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:disk.sys
[2008/09/22 10.40.21 | 023,892,987 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:disk.sys
[2008/09/22 10.40.21 | 023,892,987 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:disk.sys
[2004/08/19 14.00.00 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=00CA44E4534865F8A3B64F7C0984BFF0 -- C:\WINDOWS\$NtServicePackUninstall$\disk.sys
[2008/04/13 20.40.47 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=044452051F3E02E7963599FC8F4F3E25 -- C:\WINDOWS\ServicePackFiles\i386\disk.sys
[2008/04/13 20.40.47 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=044452051F3E02E7963599FC8F4F3E25 -- C:\WINDOWS\system32\drivers\disk.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/14 04.13.39 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=BD5FEE908FDD9CB09AA3E78111AB1119 -- C:\WINDOWS\ERDNT\cache\eventlog.dll
[2008/04/14 04.13.39 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=BD5FEE908FDD9CB09AA3E78111AB1119 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/14 04.13.39 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=BD5FEE908FDD9CB09AA3E78111AB1119 -- C:\WINDOWS\system32\eventlog.dll
[2004/08/19 14.00.00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=D1CAA255F33C06C8302769A86FFB905E -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: IASTOR.SYS >
[2004/09/26 15.24.54 | 000,477,952 | ---- | M] (Intel Corporation) MD5=DD19FDD8BB262F64A11C50CC23FC6F70 -- C:\WINDOWS\OEM\iaStor\iaStor.sys

< MD5 for: NETLOGON.DLL >
[2004/08/19 14.00.00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=926BB51BB6DE79DEDB93E9C2B0811CCF -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
[2008/04/14 04.13.46 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=E1DACEE13CAF8E118416399ABD2A08D9 -- C:\WINDOWS\ERDNT\cache\netlogon.dll
[2008/04/14 04.13.46 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=E1DACEE13CAF8E118416399ABD2A08D9 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/14 04.13.46 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=E1DACEE13CAF8E118416399ABD2A08D9 -- C:\WINDOWS\system32\netlogon.dll

< MD5 for: NVATABUS.SYS >
[2004/09/02 09.24.38 | 000,082,816 | ---- | M] (NVIDIA Corporation) MD5=EEABD98AA887DD923546F20D400B2907 -- C:\WINDOWS\OEM\nvatabus\nvatabus.sys

< MD5 for: SCECLI.DLL >
[2008/04/14 04.13.49 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=034B4B1E882563562B35E1FAB279DEDF -- C:\WINDOWS\ERDNT\cache\scecli.dll
[2008/04/14 04.13.49 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=034B4B1E882563562B35E1FAB279DEDF -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/14 04.13.49 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=034B4B1E882563562B35E1FAB279DEDF -- C:\WINDOWS\system32\scecli.dll
[2004/08/19 14.00.00 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=1446EB71ADF0F54980CDD7E5A812E102 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll

< MD5 for: USBSTOR.SYS >
[2004/08/19 14.00.00 | 018,778,587 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:usbstor.sys
[2008/09/22 10.40.21 | 023,892,987 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:usbstor.sys
[2008/09/22 10.40.21 | 023,892,987 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:usbstor.sys
[2004/08/19 14.00.00 | 000,026,496 | ---- | M] (Microsoft Corporation) MD5=6CD7B22193718F1D17A47A1CD6D37E75 -- C:\WINDOWS\$NtServicePackUninstall$\usbstor.sys
[2008/04/13 20.45.38 | 000,026,368 | ---- | M] (Microsoft Corporation) MD5=A32426D9B14A089EAA1D922E0C5801A9 -- C:\WINDOWS\ServicePackFiles\i386\usbstor.sys
[2008/04/13 20.45.38 | 000,026,368 | ---- | M] (Microsoft Corporation) MD5=A32426D9B14A089EAA1D922E0C5801A9 -- C:\WINDOWS\system32\drivers\usbstor.sys

< MD5 for: VIAMRAID.SYS >
[2004/05/18 15.55.26 | 000,074,112 | ---- | M] (VIA Technologies inc,.ltd) MD5=F199939205DCCC7836AE5AB8B5DD5E83 -- C:\WINDOWS\OEM\viapdsk\viamraid.sys

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-06-12 18:48:17

========== Alternate Data Streams ==========

@Alternate Data Stream - 217 bytes -> C:\Documents and Settings\All Users\Dati applicazioni\TEMP:CEE4A457
@Alternate Data Stream - 190 bytes -> C:\Documents and Settings\All Users\Dati applicazioni\TEMP:80B291A7
< End of report >

Gennarino4
Novice
Novice

Posts Posts : 12
Joined Joined : 2010-06-12
OS OS : Windows XP Home Edition
Points Points : 23848
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Backdoor.Tidserv!inf

Post by Gennarino4 on Sat Jun 12, 2010 10:44 pm

Here's the "Extras" log:

OTL Extras logfile created on: 13/06/2010 0.18.17 - Run 1
OTL by OldTimer - Version 3.2.6.0 Folder = C:\Documents and Settings\Michael\Documenti\Download
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000410 | Country: Italia | Language: ITA | Date Format: dd/MM/yyyy

1.023,00 Mb Total Physical Memory | 453,00 Mb Available Physical Memory | 44,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 85,00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programmi
Drive C: | 232,88 Gb Total Space | 150,41 Gb Free Space | 64,59% Space Free | Partition Type: NTFS
Drive D: | 486,07 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: JORDAN
Current User Name: Michael
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] -- C:\Programmi\Mozilla Firefox\firefox.exe (Mozilla Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] -- C:\Programmi\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programmi\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Programmi\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{0A65A3BD-54B5-4d0d-B084-7688507813F5}" = SlideShow
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{15C0AF59-4877-49B6-B8C6-A61CE54515F5}" = cp_OnlineProjectsConfig
"{15e13d3b-4b57-4f68-9ba4-5d86c0931833}" = Pixia
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Strumento di caricamento di Windows Live
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2376813B-2E5A-4641-B7B3-A0D5ADB55229}" = HPPhotoSmartExpress
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20
"{2F58D60D-2BFD-4467-9B4D-64E7355C329D}" = Sonic_PrimoSDK
"{3248E093-5288-4CA9-B3AB-11A675FEA1F9}" = Symantec AntiVirus
"{3248F0A8-6813-11D6-A77B-00B0D0150000}" = J2SE Runtime Environment 5.0
"{33BF0960-DBA3-4187-B6CC-C969FCFA2D25}" = SkinsHP1
"{350C9410-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{363790D2-DA98-41DD-9C9F-69FA36B169DE}" = PanoStandAlone
"{36FDBE6E-6684-462B-AE98-9A39A1B200CC}" = HP Product Assistant
"{39CEE1F2-12B6-4C50-9131-04BFCA110578}" = PowerCinema NE for Everio
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{41E776A5-9B12-416D-9A12-B4F7B044EBED}" = CP_Package_Basic1
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{45B8A76B-57EC-4242-B019-066400CD8428}" = BufferChm
"{47046207-F450-4065-8FDD-1050F1D1C4BF}" = ATI Catalyst Control Center
"{49C77D21-F91F-4296-B7DF-19C5FF51AF4D}" = Windows Live Call
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4EA684E9-5C81-4033-A696-3019EC57AC3A}" = HPProductAssistant
"{501451DE-5808-4599-B544-8BD0915B6B24}_is1" = FreeRIP v3.04
"{53EE9E42-CECB-4C92-BF76-9CA65DAF8F1C}" = FullDPAppQFolder
"{57383270-6F61-4DC8-A9B8-C1745FC29F38}" = Trust Webcam 15082
"{57B2281D-A34A-4a48-8C68-169B8873659D}" = c4100_Help
"{593AFFA4-D08E-4272-BABB-420949D32A10}" = QUICKfind
"{63B93949-6377-4920-BE7D-961EE5841E90}" = Norton Security Scan
"{66910000-8B30-4973-A159-6371345AFFA5}" = WebReg
"{6696D9A4-28A8-4F5A-8E9A-2E8974C8C39C}" = RandMap
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{68763C27-235D-4165-A961-FDEA228CE504}" = AiOSoftwareNPI
"{6909F917-5499-482e-9AA1-FAD06A99F231}" = Toolbox
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6D7BDA00-A4DA-49F9-BAE4-7FB71FAA4737}" = Windows Live Essentials
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{6F695BCF-9BDC-48AB-8D46-D57CFAD7A248}" = Assistente per l'accesso a Windows Live
"{736C803C-DD3B-4015-BC51-AFB9E67B9076}" = Readme
"{7694EC32-CB0E-4B35-9088-7B320CB1F4FE}" = Nokia PC Suite
"{7C03270C-4FAB-4F5C-B10D-52FEDA190790}" = DocumentViewerQFolder
"{7E351356-81B3-4339-96FA-04A1F652CF2C}" = Dizionario Oxford-Paravia
"{7E7B7865-6C80-4373-8BC1-C2EB9431F9DE}" = ProductContextNPI
"{82427977-8776-4087-90CA-9F65174D3C4D}" = Nokia Connectivity Cable Driver
"{8331C3EA-0C91-43AA-A4D4-27221C631139}" = Status
"{84975365-177A-42EB-A265-9C9B6DB1FEA1}" = Trust Photo Tools
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A4CE7FD-9657-4B06-9943-E1819F3D5D67}" = DocProc
"{8AEA4BE2-2B52-41C0-BB7D-9F2D17AF1040}" = Nero 8
"{8CE4E6E9-9D55-43FB-9DDB-688C976BFC05}" = Unload
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{996512CF-F35B-48DE-9291-557FA5316967}" = ScannerCopy
"{A0BCF90F-B4E4-435C-A48D-8FAAE10554F9}" = Pixia
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A29800BA-0BF1-4E63-9F31-DF05A87F4104}" = InstantShareDevices
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A4D7B764-4140-11D4-88EB-0050DA3579C0}" = Nero
"{A6FDF86A-F541-4E7B-AEA0-8849A2A700D5}" = iTunes
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-1033-0000-7760-100000000002}" = Adobe Acrobat 7.0 Professional
"{B2157760-AA3C-4E2E-BFE6-D20BC52495D9}" = cp_PosterPrintConfig
"{B6286A44-7505-471A-A72B-04EC2DB2F442}" = CueTour
"{B69CFE29-FD03-4E0A-87A7-6ED97F98E5B3}" = CP_Panorama1Config
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = PowerProducer
"{B7CB0BF3-791E-44D3-9F04-786E36D51C9D}" = PC Connectivity Solution
"{BDBE2F3E-42DB-4d4a-8CB1-19BA765DBC6C}" = HP Photosmart, Officejet and Deskjet 7.0.A
"{BEEFC4F8-2909-48B3-AFAA-55D3533FDEDD}" = Creative MediaSource 5
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C1C6767D-B395-43CB-BF99-051B58B86DA6}" = PhotoGallery
"{C208375A-3AC5-4914-9B22-1DCE9EB3FB75}" = Aggiornamento software per Cartelle Web
"{C7F54CF8-D6FB-4E0A-93A3-E68AE0D6C476}" = SolutionCenter
"{C871525F-7116-4d26-BA6D-215F59B6F88B}" = C4100
"{C8753E28-2680-49BF-BD48-DD38FD086EFE}" = AiO_Scan_CDA
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF9CD37C-E29A-11D5-AE3D-005004B8E30C}" = Digital Photo Navigator 1.5
"{DBC20735-34E6-4E97-A9E5-2066B66B243D}" = TrayApp
"{E0ABA486-A39B-4B96-BD80-757396151079}" = Windows Live Messenger
"{E1B80DEE-A795-4258-8445-074C06AE3AB8}" = MarketResearch
"{E7F56612-69F7-4F85-AD0B-B04B1C5BC3BD}" = Creative ZEN V Series (R2)
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{ED2C557E-9C18-41FF-B58E-A05EEF0B3B5F}" = CP_CalendarTemplates1
"{EDE721EC-870A-11D8-9D75-000129760D75}" = PowerDirector Express
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F157460F-720E-482f-8625-AD7843891E5F}" = InstantShareDevicesMFC
"{F2D2B58B-B2FD-46D1-8319-DCE564079934}" = Microsoft .NET Framework 1.1 Italian Language Pack
"{F3760724-B29D-465B-BC53-E5D72095BCC4}" = Scan
"{F6076EF9-08E1-442F-B6A2-BFB61B295A14}" = Fax_CDA
"{F7963BA0-EE1C-11D4-9FA5-00A0C9E6A342}" = Commandos 2: Men of Courage
"{FB15E224-67C3-491F-9F5C-F257BC418412}" = Destinations
"{FBB980B0-63F8-4B48-8D65-90F1D9F81D9F}" = NewCopy_CDA
"{FE57DE70-95DE-4B64-9266-84DA811053DB}" = HP Update
"{FE7E1DD7-EBCE-4696-ADE2-22BDBF2372DA}" = DocumentViewer
"504244733D18C8F63FF584AEB290E3904E791693" = Pacchetto driver Windows - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"8461-7759-5462-8226" = Vuze
"Adobe Acrobat 5.0" = Adobe Acrobat 5.0
"Adobe Acrobat 7.0 Professional - V" = Adobe Acrobat 7.1.0 Professional
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Amazon MP3 Downloader" = Amazon MP3 Downloader 1.0.8
"ATI Display Driver" = ATI Display Driver
"AviSynth" = AviSynth 2.5
"BFGC" = Big Fish Games: Game Manager
"BFG-Wedding Dash" = Wedding Dash
"BFG-Wedding Dash 2 - Rings Around the World" = Wedding Dash 2: Rings Around the World
"bwin Poker_is1" = bwin Poker
"Cambridge- Advanced Grammar in Use" = Cambridge- Advanced Grammar in Use
"CloneCD" = CloneCD
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200014F1" = SoftV92 Data Fax Modem with SmartCP
"Creative Removable Disk Manager" = Manager disco rimovibile Creative
"d2mp" = d2mp
"D978F69D5F15B845BD6BC6F8BF9BCD36982A2087" = Pacchetto driver Windows - Nokia Modem (02/24/2009 4.0)
"Dizionario Bompiani" = Dizionario Bompiani
"Download Manager" = Download Manager 2.3.7
"DVD Decrypter" = DVD Decrypter (Remove Only)
"E7F682214B951640C9C539C41FDA1A7F836FF7B6" = Pacchetto driver Windows - Nokia Modem (02/23/2009 7.01.0.2)
"Ease Audio Cutter_is1" = Ease Audio Cutter 1.20
"eMule" = eMule
"ffdshow_is1" = ffdshow [rev 1288] [2007-06-15]
"Free M4a to MP3 Converter_is1" = Free M4a to MP3 Converter 6.1
"GameSpy Arcade" = GameSpy Arcade
"HP Document Viewer" = HP Document Viewer 7.0
"HP Imaging Device Functions" = HP Imaging Device Functions 7.0
"HP Photo & Imaging" = HP Photosmart Premier Software 6.5
"HP Solution Center & Imaging Support Tools" = HP Solution Center 7.0
"HPExtendedCapabilities" = HP Customer Participation Program 7.0
"HPOCR" = OCR Software by I.R.I.S 7.0
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"il Boch quinta edizione" = il Boch quinta edizione
"InfraRecorder" = InfraRecorder
"LiveUpdate" = LiveUpdate 2.6 (Symantec Corporation)
"lo Zingarelli 2009" = lo Zingarelli 2009
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MioFotografo.it MyComposer_is1" = MioFotografo.it MyComposer 5.0
"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Nokia PC Suite" = Nokia PC Suite
"NSSSetup.{63B93949-6377-4920-BE7D-961EE5841E90}" = Norton Security Scan (Symantec Corporation)
"OALD7" = Oxford Advanced Learner's Dictionary - 7th edition
"Poker Club by Lottomatica" = Poker Club by Lottomatica
"RealPlayer 6.0" = RealPlayer
"ScummVM_is1" = ScummVM 0.12.0
"SHOUTcastDSP" = SHOUTcast Source DSP 1.9.0 (remove only)
"Super WMA MP3 Cutter_is1" = Super WMA MP3 Cutter 1.00
"SysInfo" = Creative System Information
"VLC media player" = VideoLAN VLC media player 0.8.6c
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Winamp" = Winamp
"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR gestione archivi
"WinZip" = WinZip
"XviD_is1" = XviD 1.1 final uninstall
"Yahoo! Anti-Spy" = Yahoo! Anti-Spy
"Yahoo! Companion" = Yahoo! uC
"Yahoo! Customizations" = Yahoo! Extras
"Yahoo! Internet Mail" = Yahoo! Internet Mail
"Yahoo! Messenger" = Yahoo! Messenger
"YInstHelper" = Yahoo! Install Manager
"ZENcast Organizer" = Organizer ZENcast

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 12/06/2010 16.57.03 | Computer Name = JORDAN | Source = Symantec AntiVirus | ID = 16711726
Description = Security Risk Found!Threat: Backdoor.Tidserv!inf in File: C:\System
Volume Information\_restore{F042C73A-C05C-47E0-9AA5-F39017A4A2FF}\RP944\A0186110.sys
by: Auto-Protect scan. Action: Clean failed : Quarantine failed. Action Description:
The file was left unchanged.

Error - 12/06/2010 16.57.03 | Computer Name = JORDAN | Source = Symantec AntiVirus | ID = 16711685
Description = Threat Found!Threat: Backdoor.Tidserv!inf in File: c:\system volume
information\_restore{f042c73a-c05c-47e0-9aa5-f39017a4a2ff}\RP944\A0186110.sys by:
Auto-Protect scan. Action: Clean failed : Quarantine failed. Action Description:
The file was left unchanged.

Error - 12/06/2010 16.57.03 | Computer Name = JORDAN | Source = Symantec AntiVirus | ID = 16711685
Description = Threat Found!Threat: Backdoor.Tidserv!inf in File: c:\system~1\_resto~1\rp944\a0186110.sys
by: Auto-Protect scan. Action: Clean failed : Quarantine failed. Action Description:
The file was left unchanged.

Error - 12/06/2010 16.57.04 | Computer Name = JORDAN | Source = Symantec AntiVirus | ID = 16711731
Description = Security Risk Found!Threat: Backdoor.Tidserv!inf in File: C:\System
Volume Information\_restore{F042C73A-C05C-47E0-9AA5-F39017A4A2FF}\RP944\A0186110.sys
by: Auto-Protect scan. Action: Clean failed : Quarantine failed : Access denied.
Action Description: Quarantine was partially successful.

Error - 12/06/2010 17.37.16 | Computer Name = JORDAN | Source = Symantec AntiVirus | ID = 16711726
Description = Security Risk Found!Threat: Backdoor.Tidserv!inf in File: C:\System
Volume Information\_restore{F042C73A-C05C-47E0-9AA5-F39017A4A2FF}\RP944\A0186110.sys
by: Auto-Protect scan. Action: Clean failed : Quarantine failed. Action Description:
The file was left unchanged.

Error - 12/06/2010 17.37.17 | Computer Name = JORDAN | Source = Symantec AntiVirus | ID = 16711685
Description = Threat Found!Threat: Backdoor.Tidserv!inf in File: c:\system volume
information\_restore{f042c73a-c05c-47e0-9aa5-f39017a4a2ff}\RP944\A0186110.sys by:
Auto-Protect scan. Action: Clean failed : Quarantine failed. Action Description:
The file was left unchanged.

Error - 12/06/2010 17.37.17 | Computer Name = JORDAN | Source = Symantec AntiVirus | ID = 16711685
Description = Threat Found!Threat: Backdoor.Tidserv!inf in File: c:\system~1\_resto~1\rp944\a0186110.sys
by: Auto-Protect scan. Action: Clean failed : Quarantine failed. Action Description:
The file was left unchanged.

Error - 12/06/2010 17.37.20 | Computer Name = JORDAN | Source = Symantec AntiVirus | ID = 16711731
Description = Security Risk Found!Threat: Backdoor.Tidserv!inf in File: C:\System
Volume Information\_restore{F042C73A-C05C-47E0-9AA5-F39017A4A2FF}\RP944\A0186110.sys
by: Auto-Protect scan. Action: Clean failed : Quarantine failed : Access denied.
Action Description: Quarantine was partially successful.

Error - 12/06/2010 18.15.47 | Computer Name = JORDAN | Source = Application Error | ID = 1000
Description = Applicazione che ha provocato l'errore javara.exe, versione 1.15.0.1745,
modulo che ha provocato l'errore msvcrt.dll, versione 7.0.2600.5512, indirizzo
errore 0x00032a16.

Error - 12/06/2010 18.15.57 | Computer Name = JORDAN | Source = Application Error | ID = 1000
Description = Applicazione che ha provocato l'errore javara.exe, versione 1.15.0.1745,
modulo che ha provocato l'errore msvcrt.dll, versione 7.0.2600.5512, indirizzo
errore 0x00032a16.

[ System Events ]
Error - 12/06/2010 17.51.06 | Computer Name = JORDAN | Source = Service Control Manager | ID = 7023
Description = Servizio Gestione applicazione terminato con l'errore: %%126

Error - 12/06/2010 17.51.07 | Computer Name = JORDAN | Source = Service Control Manager | ID = 7023
Description = Servizio Gestione applicazione terminato con l'errore: %%126

Error - 12/06/2010 17.51.07 | Computer Name = JORDAN | Source = Service Control Manager | ID = 7023
Description = Servizio Gestione applicazione terminato con l'errore: %%126

Error - 12/06/2010 17.51.07 | Computer Name = JORDAN | Source = Service Control Manager | ID = 7023
Description = Servizio Gestione applicazione terminato con l'errore: %%126

Error - 12/06/2010 17.51.07 | Computer Name = JORDAN | Source = Service Control Manager | ID = 7023
Description = Servizio Gestione applicazione terminato con l'errore: %%126

Error - 12/06/2010 17.51.07 | Computer Name = JORDAN | Source = Service Control Manager | ID = 7023
Description = Servizio Gestione applicazione terminato con l'errore: %%126

Error - 12/06/2010 17.51.07 | Computer Name = JORDAN | Source = Service Control Manager | ID = 7023
Description = Servizio Gestione applicazione terminato con l'errore: %%126

Error - 12/06/2010 17.51.07 | Computer Name = JORDAN | Source = Service Control Manager | ID = 7023
Description = Servizio Gestione applicazione terminato con l'errore: %%126

Error - 12/06/2010 17.51.07 | Computer Name = JORDAN | Source = Service Control Manager | ID = 7023
Description = Servizio Gestione applicazione terminato con l'errore: %%126

Error - 12/06/2010 17.51.07 | Computer Name = JORDAN | Source = Service Control Manager | ID = 7023
Description = Servizio Gestione applicazione terminato con l'errore: %%126


< End of report >

Gennarino4
Novice
Novice

Posts Posts : 12
Joined Joined : 2010-06-12
OS OS : Windows XP Home Edition
Points Points : 23848
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Backdoor.Tidserv!inf

Post by Belahzur on Sun Jun 13, 2010 12:52 am

Hello.

Remove the Proxy setting in Internet Explorer and/or in FireFox.

    In Internet Explorer
  1. Tools Menu -> Internet Options -> Connections Tab ->Lan Settings > uncheck "use a proxy server" or reconfigure the Proxy server again in case you have set it previously.

    In Firefox
  1. Tools Menu -> Options... -> Advanced Tab -> Network Tab -> "Settings" under Connection > Choose "No Proxy"
  2. Click the apply button and restart that computer in normal mode.

Please run OTL.exe.

  • Copy the commands with file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose CopyCrying


    :OTL
    FF - prefs.js..browser.search.defaultengine: "Ask.com"
    FF - prefs.js..browser.search.defaultenginename: "Ask.com"
    FF - prefs.js..browser.search.order.1: "Ask.com"
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.



  • Return to OTL, right click in the "Custom Scans/Fixes" window (under the light green bar) and choose Paste.

  • Click the red Run Fix button.
  • A fix log in Notepad will appear. Copy the contents of the fix log to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTL.exe
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245059
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Backdoor.Tidserv!inf

Post by Gennarino4 on Sun Jun 13, 2010 7:45 am

Done, thank you! The browsers were already set not to use a proxy server, does that mean anything?

========== OTL ==========
Prefs.js: "Ask.com" removed from browser.search.defaultengine
Prefs.js: "Ask.com" removed from browser.search.defaultenginename
Prefs.js: "Ask.com" removed from browser.search.order.1
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.

OTL by OldTimer - Version 3.2.6.0 log created on 06132010_094232

Gennarino4
Novice
Novice

Posts Posts : 12
Joined Joined : 2010-06-12
OS OS : Windows XP Home Edition
Points Points : 23848
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Backdoor.Tidserv!inf

Post by Belahzur on Sun Jun 13, 2010 2:47 pm

Please download and run this tool.

Download Malwarebytes' Anti-Malware from [You must be registered and logged in to see this link.]

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245059
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Backdoor.Tidserv!inf

Post by Gennarino4 on Sun Jun 13, 2010 9:54 pm

Here's the log, nothing found:


Malwarebytes' Anti-Malware 1.46
[You must be registered and logged in to see this link.]

Database version: 4191

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

13/06/2010 23.47.57
mbam-log-2010-06-13 (23-47-57).txt

Scan type: Quick scan
Objects scanned: 141559
Time elapsed: 6 minute(s), 33 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

By the way, today Symantec AntiVirus detected the Backdoor at 17.53.35
18.53.35
19.52.59
20.53.35
21.53.35
22.53.35
Don't know what that implies, I just thought that was worth a mention...

Gennarino4
Novice
Novice

Posts Posts : 12
Joined Joined : 2010-06-12
OS OS : Windows XP Home Edition
Points Points : 23848
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Backdoor.Tidserv!inf

Post by Belahzur on Mon Jun 14, 2010 12:42 am

Hello.

  • Download combofix from here
    [You must be registered and logged in to see this link.]
    [You must be registered and logged in to see this link.]

    1. If you are using Firefox, make sure that your download settings are as follows:

    * Tools->Options->Main tab
    * Set to "Always ask me where to Save the files".

    2. During the download, rename Combofix to Combo-Fix as follows:





    3. It is important you rename Combofix during the download, but not after.
    4. Please do not rename Combofix to other names, but only to the one indicated.
    5. Close any open browsers.
    6. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

  • We need to disable your local AV (Anti-virus) before running Combofix.
  • See [You must be registered and logged in to see this link.] for how to disable your AV.
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.


  • The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.



  • Allow ComboFix to download the Recovery Console.
  • Accept the End-User License Agreement.
  • The Recovery Console will be installed.
  • You will then get this next prompt that asks if you want to continue the malware scan, select yes



  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245059
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Backdoor.Tidserv!inf

Post by Gennarino4 on Mon Jun 14, 2010 8:08 am

I'm sorry there's some italian word every now and then. There was no way to set the language with combofix... Hope that's not a big problem.
By the way, before asking for help on GeekPolice, I tried myself to fix this stuff with MalwareBytes and Combofix (which I uninstalled and re-downloaded and re-installed from the link you gave me). They cleaned a whole bunch of malwares, which were less hard to delete, but more obtrusive than this one, 'cause they popped up windows all the time, they disabled the task manager and so on. The only thing I didn't like with combofix, was that at the beginning there were two backdoor.tidserv!inf detected by the Symantec AV, and one was in the Qoobox folder created by Combofix, that I deleted. Probably these are all useless informations, I'm telling you this just in case...

ComboFix 10-06-13.01 - Michael 14/06/2010 9.47.36.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.39.1040.18.1023.318 [GMT 2:00]
Eseguito da: c:\documents and settings\Michael\Desktop\Combo-Fix.exe
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
* Creato nuovo punto di ripristino
.

((((((((((((((((((((((((( Files Creati Da 2010-05-14 al 2010-06-14 )))))))))))))))))))))))))))))))))))
.

2010-06-14 07:41 . 2010-06-14 07:43 -------- d-----w- C:\ComboFix
2010-06-13 07:42 . 2010-06-13 07:42 -------- d-----w- C:\_OTL
2010-06-12 22:13 . 2010-06-12 22:13 503808 ----a-w- c:\documents and settings\Michael\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-3f8ddbd7-n\msvcp71.dll
2010-06-12 22:13 . 2010-06-12 22:13 499712 ----a-w- c:\documents and settings\Michael\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-3f8ddbd7-n\jmc.dll
2010-06-12 22:13 . 2010-06-12 22:13 348160 ----a-w- c:\documents and settings\Michael\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-3f8ddbd7-n\msvcr71.dll
2010-06-12 22:13 . 2010-06-12 22:13 61440 ----a-w- c:\documents and settings\Michael\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-2a0805b3-n\decora-sse.dll
2010-06-12 22:13 . 2010-06-12 22:13 12800 ----a-w- c:\documents and settings\Michael\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-2a0805b3-n\decora-d3d.dll
2010-06-12 22:12 . 2010-06-12 22:12 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-06-12 22:00 . 2010-06-12 22:00 388096 ----a-r- c:\documents and settings\Michael\Dati applicazioni\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-06-12 18:20 . 2010-05-06 10:32 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2010-06-12 16:04 . 2010-06-12 16:04 -------- d-----w- c:\documents and settings\Administrator\Impostazioni locali\Dati applicazioni\Mozilla
2010-06-12 14:50 . 2010-06-12 14:51 -------- d-----w- c:\programmi\Defense Center
2010-06-12 11:09 . 2010-06-12 11:09 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-06-11 09:21 . 2010-06-11 09:21 -------- d-----w- c:\documents and settings\NetworkService\Dati applicazioni\AdobeUM
2010-06-11 09:20 . 2010-06-11 09:21 -------- d-----w- c:\documents and settings\NetworkService\Impostazioni locali\Dati applicazioni\Adobe
2010-05-27 07:09 . 2010-05-27 07:09 503808 ----a-w- c:\documents and settings\Michael\Dati applicazioni\Sun\Java\Deployment\cache\6.0\46\f84c6ae-3b0b8f3b-n\msvcp71.dll
2010-05-27 07:09 . 2010-05-27 07:09 499712 ----a-w- c:\documents and settings\Michael\Dati applicazioni\Sun\Java\Deployment\cache\6.0\46\f84c6ae-3b0b8f3b-n\jmc.dll
2010-05-27 07:09 . 2010-05-27 07:09 348160 ----a-w- c:\documents and settings\Michael\Dati applicazioni\Sun\Java\Deployment\cache\6.0\46\f84c6ae-3b0b8f3b-n\msvcr71.dll
2010-05-24 08:32 . 2010-05-24 08:32 -------- d-----w- c:\documents and settings\Michael\Impostazioni locali\Dati applicazioni\DOSBox
2010-05-24 08:32 . 2010-05-27 21:29 -------- d-----w- c:\programmi\DOSBox-0.74
2010-05-24 08:28 . 2010-05-24 08:42 -------- d-----w- C:\RAPTOR
2010-05-21 08:12 . 2010-05-21 08:12 -------- d-----w- c:\programmi\Wedding Dash 2 - Rings Around the World

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-14 07:43 . 2007-11-01 09:00 -------- d-----w- c:\programmi\Symantec AntiVirus
2010-06-13 16:00 . 2008-11-21 19:47 -------- d-----w- c:\programmi\Norton Security Scan
2010-06-12 22:13 . 2007-11-01 08:09 -------- d-----w- c:\programmi\File comuni\Java
2010-06-12 21:50 . 2007-11-01 08:09 -------- d-----w- c:\programmi\Java
2010-06-12 18:33 . 2004-08-19 12:00 84156 ----a-w- c:\windows\system32\perfc010.dat
2010-06-12 18:33 . 2004-08-19 12:00 489410 ----a-w- c:\windows\system32\perfh010.dat
2010-06-10 11:33 . 2010-06-10 11:33 -------- d-----w- c:\documents and settings\Michael\Dati applicazioni\Malwarebytes
2010-06-10 11:33 . 2010-06-10 11:33 -------- d-----w- c:\programmi\Malwarebytes' Anti-Malware
2010-06-10 11:33 . 2010-06-10 11:33 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Malwarebytes
2010-06-09 15:29 . 2010-01-13 18:18 -------- d-----w- c:\programmi\Bompiani
2010-06-05 06:46 . 2007-12-24 09:45 -------- d-----w- c:\programmi\Microsoft Silverlight
2010-05-25 18:32 . 2009-10-27 16:36 60701 ----a-w- c:\documents and settings\Michael\Dati applicazioni\mdbu.bin
2010-05-22 14:22 . 2010-05-14 19:27 -------- d---a-w- c:\documents and settings\All Users\Dati applicazioni\TEMP
2010-05-21 08:13 . 2010-05-13 18:04 -------- d-----w- c:\documents and settings\Michael\Dati applicazioni\PlayFirst
2010-05-21 08:13 . 2010-05-13 18:04 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\PlayFirst
2010-05-14 19:27 . 2010-05-14 19:27 -------- d-----w- c:\programmi\Wedding Dash
2010-05-14 19:26 . 2010-05-14 19:25 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\BigFishGamesCache
2010-05-14 19:25 . 2010-05-14 19:25 -------- d-----w- c:\programmi\bfgclient
2010-05-14 19:25 . 2010-05-14 19:25 3085800 ----a-w- c:\documents and settings\All Users\Dati applicazioni\BigFishGamesCache\Upgrade\Unpack\bfgsetup_s1_l1.exe
2010-05-13 18:00 . 2010-05-13 18:00 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Trymedia
2010-05-06 10:32 . 2004-09-29 18:48 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-02 08:06 . 2004-08-19 12:00 1851264 ----a-w- c:\windows\system32\win32k.sys
2010-04-29 13:39 . 2010-06-10 11:33 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 13:39 . 2010-06-10 11:33 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-20 05:30 . 2004-08-19 12:00 285696 ----a-w- c:\windows\system32\atmfd.dll
2010-04-14 10:47 . 2009-11-11 20:36 79488 ----a-w- c:\documents and settings\Michael\Dati applicazioni\Sun\Java\jre1.6.0_17\gtapi.dll
2010-04-06 10:12 . 2010-04-06 10:12 51936 ----a-w- c:\documents and settings\Gennarino\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2010-04-06 10:12 . 2010-04-06 10:12 138 ----a-w- c:\documents and settings\Gennarino\Impostazioni locali\Dati applicazioni\fusioncache.dat
2010-04-03 21:06 . 2009-09-08 10:33 37280 ---ha-w- c:\windows\system32\mlfcache.dat
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="c:\programmi\Yahoo!\Messenger\YahooMessenger.exe" [2008-02-29 4670704]
"CTSyncU.exe"="c:\programmi\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 868352]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\programmi\File comuni\Nero\Lib\NMBgMonitor.exe" [2007-08-03 202024]
"igndlm.exe"="c:\programmi\Download Manager\DLM.exe" [2008-08-01 1103216]
"PC Suite Tray"="c:\programmi\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-03-20 1312256]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 61952]
"SoundMan"="SOUNDMAN.EXE" [2005-09-21 86016]
"AlcWzrd"="ALCWZRD.EXE" [2005-10-11 2807808]
"ATICCC"="c:\programmi\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 45056]
"ccApp"="c:\programmi\File comuni\Symantec Shared\ccApp.exe" [2005-06-02 48752]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2005-06-23 85696]
"Acrobat Assistant 7.0"="c:\programmi\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2008-04-23 483328]
"HP Software Update"="c:\programmi\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"CloneCDTray"="c:\programmi\SlySoft\CloneCD\CloneCDTray.exe" [2005-05-19 57344]
"NeroFilterCheck"="c:\programmi\File comuni\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
"NBKeyScan"="c:\programmi\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-08-08 1828136]
"EverioService"="c:\programmi\CyberLink\PCM4Everio\EverioService.exe" [2006-11-22 151552]
"Malwarebytes Anti-Malware (rootkit-scan)"="c:\programmi\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]
"SunJavaUpdateSched"="c:\programmi\File comuni\Java\Java Update\jusched.exe" [2010-02-18 248040]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-100000000002}\SC_Acrobat.exe [2007-11-1 25214]
Avvio rapido HP Photosmart Premier.lnk - c:\programmi\HP\Digital Imaging\bin\hpqthb08.exe [2006-2-10 73728]
HP Digital Imaging Monitor.lnk - c:\programmi\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 02:14 15360 ----a-w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Defense Center]
2010-06-12 14:50 1661952 ----a-w- c:\programmi\Defense Center\defcnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-11-12 15:33 141600 ----a-w- c:\programmi\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 02:14 1695232 ------w- c:\programmi\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2009-07-26 15:44 3883856 ----a-w- c:\programmi\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Qsotexinodusex]
2008-04-14 02:13 62976 ----a-w- c:\windows\ntPrasti.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 22:08 417792 ----a-w- c:\programmi\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snpstd]
2006-08-23 13:36 339968 ----a-w- c:\windows\vsnpstd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

S3 SavRoam;SAVRoam;c:\programmi\Symantec AntiVirus\SavRoam.exe [23/06/2005 20.27.30 124608]

--- Altri Servizi/Drivers In Memoria ---

*Deregistered* - EraserUtilDrv11010
*Deregistered* - EraserUtilRebootDrv
.
Contenuto della cartella 'Scheduled Tasks'

2010-06-13 c:\windows\Tasks\Norton Security Scan for Michael.job
- c:\programmi\Norton Security Scan\Nss.exe [2008-09-19 03:18]

2010-06-13 c:\windows\Tasks\User_Feed_Synchronization-{D35A9AC5-A617-4241-A07E-4471DF07796E}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Scansione supplementare -------
.
uSearchMigratedDefaultURL = [You must be registered and logged in to see this link.]
uStart Page = [You must be registered and logged in to see this link.]
uInternet Settings,ProxyOverride =
uInternet Settings,ProxyServer = http=127.0.0.1:1435
uSearchURL,(Default) = [You must be registered and logged in to see this link.]
FF - ProfilePath - c:\documents and settings\Michael\Dati applicazioni\Mozilla\Firefox\Profiles\b7lznjem.default\
FF - prefs.js: browser.search.defaulturl - [You must be registered and logged in to see this link.]
FF - prefs.js: browser.search.selectedEngine - Ricerca video di YouTube
FF - prefs.js: browser.search.selectedengine - Google
FF - prefs.js: browser.startup.homepage - [You must be registered and logged in to see this link.]
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nppl3260.dll
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nprjplug.dll
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nprpjplug.dll
FF - plugin: c:\programmi\Download Manager\npfpdlm.dll
FF - plugin: c:\programmi\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: general.useragent.extra.zencast - Creative ZENcast v2.01.01c:\programmi\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\programmi\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\programmi\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\programmi\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\programmi\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.
- - - - CHIAVI ORFANE RIMOSSE - - - -

MSConfigStartUp-SunJavaUpdateSched - c:\programmi\Java\jre6\bin\jusched.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2010-06-14 09:52
Windows 5.1.2600 Service Pack 3 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------

[HKEY_USERS\S-1-5-21-1177238915-1364589140-839522115-1005\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{B37FA422-CEA0-E9C6-C4DB-4E930D56B329}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"iagcbgjgeninhgiboj"=hex:6b,61,69,62,63,6c,70,64,6e,65,63,67,70,68,61,64,66,70,
6f,68,6e,6b,00,00
"hamhdeiejmhbcidb"=hex:6b,61,69,62,63,6c,70,64,6e,65,63,67,70,68,61,64,66,70,
6f,68,6e,6b,00,00

[HKEY_USERS\S-1-5-21-1177238915-1364589140-839522115-1005\Software\SecuROM\License information*]
"datasecu"=hex:02,70,0e,40,38,dd,27,7b,bb,5a,80,5d,1e,87,53,7b,c1,30,ec,71,bb,
bf,13,c3,20,61,04,82,8b,65,34,cc,34,0b,8b,9b,b1,5e,07,b1,47,f4,d9,12,76,a7,\
"rkeysecu"=hex:9b,ee,52,03,85,aa,ed,fc,74,92,5c,80,c1,67,e8,f9
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------

- - - - - - - > 'winlogon.exe'(724)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3836)
c:\windows\system32\WININET.dll
c:\windows\system32\webcheck.dll
.
Ora fine scansione: 2010-06-14 09:56:19
ComboFix-quarantined-files.txt 2010-06-14 07:56
ComboFix2.txt 2010-06-12 16:57

Pre-Run: 163.864.096.768 byte disponibili
Post-Run: 163.869.630.464 byte disponibili

WindowsXP-KB310994-SP2-Home-BootDisk-ITA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - B94AFEE323EE9E50ED0FC6027D38EC04


I'll tell you later if this Backdoor.Tidserv thing keeps appearing!
Thank you so much for the help

Gennarino4
Novice
Novice

Posts Posts : 12
Joined Joined : 2010-06-12
OS OS : Windows XP Home Edition
Points Points : 23848
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Backdoor.Tidserv!inf

Post by Gennarino4 on Mon Jun 14, 2010 3:06 pm

The Backdoor.Tidserv is not showing up, or at least has not been detected by Symantec AV after the Combofix scan. But there are problems with explorer.exe: every time I try to right click an empty point in a folder or on the desktop / I try to create a new folder / I click on "File" in any folder, explorer.exe crashes.

Gennarino4
Novice
Novice

Posts Posts : 12
Joined Joined : 2010-06-12
OS OS : Windows XP Home Edition
Points Points : 23848
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Backdoor.Tidserv!inf

Post by Belahzur on Mon Jun 14, 2010 11:58 pm

Hello.

  1. Close any open browsers.
  2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  3. Open notepad and copy/paste the text in the quotebox below into it:
    Code:

    DDS::
    uInternet Settings,ProxyOverride =
    uInternet Settings,ProxyServer = http=127.0.0.1:1435

    RegNull::
    [HKEY_USERS\S-1-5-21-1177238915-1364589140-839522115-1005\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{B37FA422-CEA0-E9C6-C4DB-4E930D56B329}*]

  4. Save this as CFScript.txt, in the same location as ComboFix.exe



  5. Referring to the picture above, drag CFScript into ComboFix.exe
  6. When finished, it shall produce a log for you at C:\ComboFix.txt
  7. Please post the contents of the log in your next reply.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245059
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Backdoor.Tidserv!inf

Post by Gennarino4 on Tue Jun 15, 2010 7:08 am

ComboFix 10-06-14.02 - Michael 15/06/2010 8.54.26.3.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.39.1040.18.1023.532 [GMT 2:00]
Eseguito da: c:\documents and settings\Michael\Desktop\Combo-Fix.exe
Opzioni usate :: c:\documents and settings\Michael\Desktop\CFscript.txt
AV: Symantec AntiVirus Corporate Edition *On-access scanning enabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
* Creato nuovo punto di ripristino
.

((((((((((((((((((((((((( Files Creati Da 2010-05-15 al 2010-06-15 )))))))))))))))))))))))))))))))))))
.

2010-06-14 07:43 . 2010-06-14 07:56 -------- d-----w- C:\Combo-Fix
2010-06-14 07:41 . 2010-06-14 07:43 -------- d-----w- C:\ComboFix
2010-06-13 07:42 . 2010-06-13 07:42 -------- d-----w- C:\_OTL
2010-06-12 22:13 . 2010-06-12 22:13 503808 ----a-w- c:\documents and settings\Michael\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-3f8ddbd7-n\msvcp71.dll
2010-06-12 22:13 . 2010-06-12 22:13 499712 ----a-w- c:\documents and settings\Michael\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-3f8ddbd7-n\jmc.dll
2010-06-12 22:13 . 2010-06-12 22:13 348160 ----a-w- c:\documents and settings\Michael\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-3f8ddbd7-n\msvcr71.dll
2010-06-12 22:13 . 2010-06-12 22:13 61440 ----a-w- c:\documents and settings\Michael\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-2a0805b3-n\decora-sse.dll
2010-06-12 22:13 . 2010-06-12 22:13 12800 ----a-w- c:\documents and settings\Michael\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-2a0805b3-n\decora-d3d.dll
2010-06-12 22:12 . 2010-06-12 22:12 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-06-12 22:00 . 2010-06-12 22:00 388096 ----a-r- c:\documents and settings\Michael\Dati applicazioni\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-06-12 18:20 . 2010-05-06 10:32 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2010-06-12 16:04 . 2010-06-12 16:04 -------- d-----w- c:\documents and settings\Administrator\Impostazioni locali\Dati applicazioni\Mozilla
2010-06-12 14:50 . 2010-06-12 14:51 -------- d-----w- c:\programmi\Defense Center
2010-06-12 11:09 . 2010-06-12 11:09 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-06-11 09:21 . 2010-06-11 09:21 -------- d-----w- c:\documents and settings\NetworkService\Dati applicazioni\AdobeUM
2010-06-11 09:20 . 2010-06-11 09:21 -------- d-----w- c:\documents and settings\NetworkService\Impostazioni locali\Dati applicazioni\Adobe
2010-05-27 07:09 . 2010-05-27 07:09 503808 ----a-w- c:\documents and settings\Michael\Dati applicazioni\Sun\Java\Deployment\cache\6.0\46\f84c6ae-3b0b8f3b-n\msvcp71.dll
2010-05-27 07:09 . 2010-05-27 07:09 499712 ----a-w- c:\documents and settings\Michael\Dati applicazioni\Sun\Java\Deployment\cache\6.0\46\f84c6ae-3b0b8f3b-n\jmc.dll
2010-05-27 07:09 . 2010-05-27 07:09 348160 ----a-w- c:\documents and settings\Michael\Dati applicazioni\Sun\Java\Deployment\cache\6.0\46\f84c6ae-3b0b8f3b-n\msvcr71.dll
2010-05-24 08:32 . 2010-05-24 08:32 -------- d-----w- c:\documents and settings\Michael\Impostazioni locali\Dati applicazioni\DOSBox
2010-05-24 08:32 . 2010-05-27 21:29 -------- d-----w- c:\programmi\DOSBox-0.74
2010-05-24 08:28 . 2010-05-24 08:42 -------- d-----w- C:\RAPTOR
2010-05-21 08:12 . 2010-05-21 08:12 -------- d-----w- c:\programmi\Wedding Dash 2 - Rings Around the World

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-15 06:26 . 2007-11-01 09:00 -------- d-----w- c:\programmi\Symantec AntiVirus
2010-06-14 09:32 . 2008-12-01 18:39 -------- d-----w- c:\programmi\GameSpy Arcade
2010-06-14 09:32 . 2008-10-31 11:08 -------- d-----w- c:\programmi\Commandos II
2010-06-14 09:32 . 2008-03-25 11:56 -------- d--h--w- c:\programmi\InstallShield Installation Information
2010-06-14 09:31 . 2008-10-28 15:57 -------- d-----w- c:\programmi\CyberLink
2010-06-14 09:31 . 2008-08-27 09:33 -------- d-----w- c:\programmi\AviSynth 2.5
2010-06-14 09:29 . 2008-08-27 20:42 -------- d-----w- c:\programmi\SlySoft
2010-06-13 16:00 . 2008-11-21 19:47 -------- d-----w- c:\programmi\Norton Security Scan
2010-06-12 22:13 . 2007-11-01 08:09 -------- d-----w- c:\programmi\File comuni\Java
2010-06-12 21:50 . 2007-11-01 08:09 -------- d-----w- c:\programmi\Java
2010-06-12 18:33 . 2004-08-19 12:00 84156 ----a-w- c:\windows\system32\perfc010.dat
2010-06-12 18:33 . 2004-08-19 12:00 489410 ----a-w- c:\windows\system32\perfh010.dat
2010-06-10 11:33 . 2010-06-10 11:33 -------- d-----w- c:\documents and settings\Michael\Dati applicazioni\Malwarebytes
2010-06-10 11:33 . 2010-06-10 11:33 -------- d-----w- c:\programmi\Malwarebytes' Anti-Malware
2010-06-10 11:33 . 2010-06-10 11:33 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Malwarebytes
2010-06-09 15:29 . 2010-01-13 18:18 -------- d-----w- c:\programmi\Bompiani
2010-06-05 06:46 . 2007-12-24 09:45 -------- d-----w- c:\programmi\Microsoft Silverlight
2010-05-25 18:32 . 2009-10-27 16:36 60701 ----a-w- c:\documents and settings\Michael\Dati applicazioni\mdbu.bin
2010-05-22 14:22 . 2010-05-14 19:27 -------- d---a-w- c:\documents and settings\All Users\Dati applicazioni\TEMP
2010-05-21 08:13 . 2010-05-13 18:04 -------- d-----w- c:\documents and settings\Michael\Dati applicazioni\PlayFirst
2010-05-21 08:13 . 2010-05-13 18:04 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\PlayFirst
2010-05-14 19:27 . 2010-05-14 19:27 -------- d-----w- c:\programmi\Wedding Dash
2010-05-14 19:26 . 2010-05-14 19:25 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\BigFishGamesCache
2010-05-14 19:25 . 2010-05-14 19:25 -------- d-----w- c:\programmi\bfgclient
2010-05-14 19:25 . 2010-05-14 19:25 3085800 ----a-w- c:\documents and settings\All Users\Dati applicazioni\BigFishGamesCache\Upgrade\Unpack\bfgsetup_s1_l1.exe
2010-05-13 18:00 . 2010-05-13 18:00 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Trymedia
2010-05-06 10:32 . 2004-09-29 18:48 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-02 08:06 . 2004-08-19 12:00 1851264 ----a-w- c:\windows\system32\win32k.sys
2010-04-29 13:39 . 2010-06-10 11:33 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 13:39 . 2010-06-10 11:33 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-20 05:30 . 2004-08-19 12:00 285696 ----a-w- c:\windows\system32\atmfd.dll
2010-04-14 10:47 . 2009-11-11 20:36 79488 ----a-w- c:\documents and settings\Michael\Dati applicazioni\Sun\Java\jre1.6.0_17\gtapi.dll
2010-04-06 10:12 . 2010-04-06 10:12 51936 ----a-w- c:\documents and settings\Gennarino\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2010-04-06 10:12 . 2010-04-06 10:12 138 ----a-w- c:\documents and settings\Gennarino\Impostazioni locali\Dati applicazioni\fusioncache.dat
2010-04-03 21:06 . 2009-09-08 10:33 37280 ---ha-w- c:\windows\system32\mlfcache.dat
.

((((((((((((((((((((((((((((( [You must be registered and logged in to see this link.] )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-06-15 06:24 . 2010-06-15 06:24 16384 c:\windows\Temp\Perflib_Perfdata_e4.dat
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="c:\programmi\Yahoo!\Messenger\YahooMessenger.exe" [2008-02-29 4670704]
"CTSyncU.exe"="c:\programmi\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 868352]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\programmi\File comuni\Nero\Lib\NMBgMonitor.exe" [2007-08-03 202024]
"igndlm.exe"="c:\programmi\Download Manager\DLM.exe" [2008-08-01 1103216]
"PC Suite Tray"="c:\programmi\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-03-20 1312256]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 61952]
"SoundMan"="SOUNDMAN.EXE" [2005-09-21 86016]
"AlcWzrd"="ALCWZRD.EXE" [2005-10-11 2807808]
"ATICCC"="c:\programmi\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 45056]
"ccApp"="c:\programmi\File comuni\Symantec Shared\ccApp.exe" [2005-06-02 48752]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2005-06-23 85696]
"Acrobat Assistant 7.0"="c:\programmi\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2008-04-23 483328]
"HP Software Update"="c:\programmi\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"NeroFilterCheck"="c:\programmi\File comuni\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
"NBKeyScan"="c:\programmi\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-08-08 1828136]
"EverioService"="c:\programmi\CyberLink\PCM4Everio\EverioService.exe" [2006-11-22 151552]
"Malwarebytes Anti-Malware (rootkit-scan)"="c:\programmi\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]
"SunJavaUpdateSched"="c:\programmi\File comuni\Java\Java Update\jusched.exe" [2010-02-18 248040]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-100000000002}\SC_Acrobat.exe [2007-11-1 25214]
Avvio rapido HP Photosmart Premier.lnk - c:\programmi\HP\Digital Imaging\bin\hpqthb08.exe [2006-2-10 73728]
HP Digital Imaging Monitor.lnk - c:\programmi\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 02:14 15360 ----a-w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Defense Center]
2010-06-12 14:50 1661952 ----a-w- c:\programmi\Defense Center\defcnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-11-12 15:33 141600 ----a-w- c:\programmi\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 02:14 1695232 ------w- c:\programmi\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2009-07-26 15:44 3883856 ----a-w- c:\programmi\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Qsotexinodusex]
2008-04-14 02:13 62976 ----a-w- c:\windows\ntPrasti.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 22:08 417792 ----a-w- c:\programmi\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snpstd]
2006-08-23 13:36 339968 ----a-w- c:\windows\vsnpstd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

S3 SavRoam;SAVRoam;c:\programmi\Symantec AntiVirus\SavRoam.exe [23/06/2005 20.27.30 124608]

--- Altri Servizi/Drivers In Memoria ---

*Deregistered* - EraserUtilDrv11010
*Deregistered* - EraserUtilRebootDrv
*Deregistered* - PROCEXP141
.
Contenuto della cartella 'Scheduled Tasks'

2010-06-13 c:\windows\Tasks\Norton Security Scan for Michael.job
- c:\programmi\Norton Security Scan\Nss.exe [2008-09-19 03:18]

2010-06-14 c:\windows\Tasks\User_Feed_Synchronization-{D35A9AC5-A617-4241-A07E-4471DF07796E}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Scansione supplementare -------
.
uSearchMigratedDefaultURL = [You must be registered and logged in to see this link.]
uStart Page = [You must be registered and logged in to see this link.]
uSearchURL,(Default) = [You must be registered and logged in to see this link.]
FF - ProfilePath - c:\documents and settings\Michael\Dati applicazioni\Mozilla\Firefox\Profiles\b7lznjem.default\
FF - prefs.js: browser.search.defaulturl - [You must be registered and logged in to see this link.]
FF - prefs.js: browser.search.selectedEngine - Wikipedia (en)
FF - prefs.js: browser.search.selectedengine - Google
FF - prefs.js: browser.startup.homepage - [You must be registered and logged in to see this link.]
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nppl3260.dll
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nprjplug.dll
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nprpjplug.dll
FF - plugin: c:\programmi\Download Manager\npfpdlm.dll
FF - plugin: c:\programmi\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: general.useragent.extra.zencast - Creative ZENcast v2.01.01c:\programmi\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\programmi\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\programmi\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\programmi\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\programmi\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2010-06-15 08:59
Windows 5.1.2600 Service Pack 3 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------

[HKEY_USERS\S-1-5-21-1177238915-1364589140-839522115-1005\Software\SecuROM\License information*]
"datasecu"=hex:27,6b,a5,d0,b2,3e,cf,18,6e,02,ae,97,c1,e1,27,8d,df,d0,69,bf,92,
f1,a3,e4,b0,3b,9c,e1,92,a5,6d,48,20,45,a5,da,32,03,d0,45,76,03,4e,fa,06,9b,\
"rkeysecu"=hex:33,17,e4,7d,62,96,84,89,c0,38,a9,3e,77,cf,e9,a9
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------

- - - - - - - > 'winlogon.exe'(724)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2384)
c:\windows\system32\WININET.dll
c:\windows\system32\webcheck.dll
.
Ora fine scansione: 2010-06-15 09:01:05
ComboFix-quarantined-files.txt 2010-06-15 07:01
ComboFix2.txt 2010-06-14 07:56
ComboFix3.txt 2010-06-12 16:57

Pre-Run: 185.465.524.224 byte disponibili
Post-Run: 185.675.399.168 byte disponibili

- - End Of File - - 0FB2A9CB0CB6E15F0057E63984A89ED6

Gennarino4
Novice
Novice

Posts Posts : 12
Joined Joined : 2010-06-12
OS OS : Windows XP Home Edition
Points Points : 23848
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Backdoor.Tidserv!inf

Post by Gennarino4 on Tue Jun 15, 2010 7:11 am

That C:\Programmi\Defense Center\defcnt.exe is a fake antivirus that caused me a lot of troubles some day ago, when this all began. I thought it was deleted by malware bytes or Combofix, I'm surprised to see it's still there. What should I do to remove it?

Gennarino4
Novice
Novice

Posts Posts : 12
Joined Joined : 2010-06-12
OS OS : Windows XP Home Edition
Points Points : 23848
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Backdoor.Tidserv!inf

Post by Belahzur on Tue Jun 15, 2010 8:07 pm

Hello.
Just delete the "Defense Center" folder.

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /uninstall

This will also reset your restore points.

Run ESET Online Scan
Please do an online scan with [You must be registered and logged in to see this link.]. Please use Internet Explorer as it uses ActiveX.

  • Check (tick) this box: YES, I accept the Terms of Use.
  • Click on the Start button next to it.
  • When prompted to run ActiveX. click Yes.
  • You will be asked to install an ActiveX. Click Install.
  • Once installed, the scanner will be initialized.
  • After the scanner is initialized, click Start.
  • Check (tick) Remove found threats box.
  • Check (tick) Scan unwanted applications.
  • Click on Scan.
  • It will start scanning. Please be patient.
  • Once the scan is done, the log will be saved here: C:\Program Files\esetonlinescanner\log.txt.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245059
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Backdoor.Tidserv!inf

Post by Gennarino4 on Tue Jun 15, 2010 10:58 pm

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=5f230a9fc89a4a47b15130cc25bf2ec1
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-06-15 10:56:10
# local_time=2010-06-16 12:56:10 (+0100, ora legale Europa occidentale)
# country="Italy"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=8192 67108863 100 0 208 208 0 0
# scanned=83961
# found=2
# cleaned=2
# scan_time=3128
C:\Documents and Settings\Michael\Dati applicazioni\Sun\Java\Deployment\cache\6.0\53\34cea775-36183b74 Java/TrojanDownloader.OpenStream.NAC trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\ntPrasti.dll a variant of Win32/Cimag.CO trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

Gennarino4
Novice
Novice

Posts Posts : 12
Joined Joined : 2010-06-12
OS OS : Windows XP Home Edition
Points Points : 23848
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Backdoor.Tidserv!inf

Post by Gennarino4 on Tue Jun 15, 2010 11:02 pm

Whatever the next moves, the computer's working absoƖute fine. The problem I had with explorer.exe is over. Apparently everything's right! You're great.

Gennarino4
Novice
Novice

Posts Posts : 12
Joined Joined : 2010-06-12
OS OS : Windows XP Home Edition
Points Points : 23848
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Backdoor.Tidserv!inf

Post by Belahzur on Thu Jun 17, 2010 12:35 am

Okay good.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245059
# Likes # Likes : 1

View user profile

Back to top Go down

View previous topic View next topic Back to top


 
Permissions in this forum:
You cannot reply to topics in this forum