Internet Explorer 7 & 8 non si installano [Archivio]

danibaan

25-04-2010, 15:46

Ecco il relativo log:

ComboFix 10-04-21.01 - Vale 25/04/2010 15.35.00.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.39.1040.18.2302.1609 [GMT 2:00]
Eseguito da: c:\documents and settings\Vale\Documenti\Download\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.

((((((((((((((((((((((((( Files Creati Da 2010-03-25 al 2010-04-25 )))))))))))))))))))))))))))))))))))
.

2010-04-25 13:26 . 2010-04-25 13:26 -------- d-----w- c:\windows\LastGood
2010-04-25 13:10 . 2010-04-25 13:11 -------- dc-h--w- c:\windows\ie8
2010-04-25 10:46 . 2010-04-25 10:46 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2010-04-25 10:46 . 2010-04-25 10:46 242896 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-04-25 10:46 . 2010-04-25 10:46 216200 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-04-25 10:46 . 2010-04-25 10:46 29512 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-04-25 10:46 . 2010-04-25 10:46 -------- d-----w- c:\windows\system32\drivers\Avg
2010-04-25 10:44 . 2010-04-25 10:44 -------- d-----w- c:\programmi\AVG
2010-04-25 10:44 . 2010-04-25 10:44 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\avg9
2010-04-25 10:11 . 2010-04-25 10:11 -------- d-----w- c:\programmi\CCleaner
2010-04-25 10:02 . 2010-04-25 10:02 -------- d-sh--w- c:\documents and settings\Vale\IECompatCache
2010-04-25 09:10 . 2010-04-25 09:10 6144 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Spyware Terminator\sp_rsdel.exe
2010-04-25 09:10 . 2010-04-25 09:11 -------- d-----w- c:\documents and settings\Vale\Dati applicazioni\Spyware Terminator
2010-04-25 09:10 . 2010-04-25 09:10 5632 ----a-w- c:\documents and settings\All Users\Dati applicazioni\Spyware Terminator\fileobjinfo.sys
2010-04-25 09:10 . 2010-04-25 09:10 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2010-04-25 09:10 . 2010-04-25 09:52 -------- d-----w- c:\programmi\Spyware Terminator
2010-04-25 09:10 . 2010-04-25 09:52 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Spyware Terminator
2010-04-25 09:09 . 2010-04-25 09:09 -------- d-----w- c:\programmi\File comuni\Java
2010-04-25 09:09 . 2010-04-25 09:09 503808 ----a-w- c:\documents and settings\Vale\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-5c96d3b2-n\msvcp71.dll
2010-04-25 09:09 . 2010-04-25 09:09 499712 ----a-w- c:\documents and settings\Vale\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-5c96d3b2-n\jmc.dll
2010-04-25 09:09 . 2010-04-25 09:09 348160 ----a-w- c:\documents and settings\Vale\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-5c96d3b2-n\msvcr71.dll
2010-04-25 09:09 . 2010-04-25 09:09 61440 ----a-w- c:\documents and settings\Vale\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-7055e942-n\decora-sse.dll
2010-04-25 09:09 . 2010-04-25 09:09 12800 ----a-w- c:\documents and settings\Vale\Dati applicazioni\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-7055e942-n\decora-d3d.dll
2010-04-25 09:09 . 2010-04-12 15:29 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-04-25 09:05 . 2010-04-25 09:05 388096 ----a-r- c:\documents and settings\Vale\Dati applicazioni\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-04-25 09:05 . 2010-04-25 09:05 -------- d-----w- c:\programmi\Trend Micro
2010-04-17 19:14 . 2010-04-25 13:28 -------- d-----w- c:\programmi\Crawler
2010-04-11 14:37 . 2010-04-11 14:37 105482 ----a-w- c:\windows\system32\C3-NMIL_at6.exe
2010-04-11 14:35 . 2010-04-11 14:35 -------- d-----w- c:\programmi\EasyPrediction

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-25 10:31 . 2008-01-01 00:05 69144 ----a-w- c:\documents and settings\Vale\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2010-04-25 10:15 . 2001-08-31 13:00 80268 ----a-w- c:\windows\system32\perfc010.dat
2010-04-25 10:15 . 2001-08-31 13:00 481664 ----a-w- c:\windows\system32\perfh010.dat
2010-04-25 10:13 . 2008-06-08 11:21 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Spybot - Search & Destroy
2010-04-25 09:08 . 2009-10-31 12:37 -------- d-----w- c:\programmi\Java
2010-04-24 20:26 . 2009-04-04 20:28 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Google Updater
2010-04-20 16:55 . 2008-10-14 19:38 -------- d-----w- c:\programmi\Google
2010-03-21 19:54 . 2010-03-21 19:54 -------- d-----w- c:\documents and settings\Vale\Dati applicazioni\Uniblue
2010-03-21 19:54 . 2010-03-21 19:54 -------- d-----w- c:\programmi\Uniblue
2010-03-19 04:00 . 2010-03-19 04:00 1122304 ----a-w- c:\windows\system32\JheM_kkGMPDG_rx.dll
2010-03-14 20:36 . 2008-08-12 16:34 20 ---h--w- c:\documents and settings\All Users\Dati applicazioni\PKP_DLdu.DAT
2010-02-24 13:11 . 2008-04-13 10:17 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-21 15:38 . 2009-10-31 12:40 1 ----a-w- c:\documents and settings\Vale\Dati applicazioni\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-02-16 19:05 . 2008-04-13 16:54 2149888 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-02-16 19:05 . 2008-04-13 18:55 2028032 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-12 10:03 . 2010-03-06 13:21 293376 ------w- c:\windows\system32\browserchoice.exe
2010-02-12 04:33 . 2008-04-13 17:13 100864 ----a-w- c:\windows\system32\6to4svc.dll
2010-02-11 12:02 . 2008-04-13 10:00 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{862a6f87-9f87-5cd7-3ac9-95bbe4fca3c7}]
2010-03-19 04:00 1122304 ----a-w- c:\windows\system32\JheM_kkGMPDG_rx.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\programmi\Windows Live\Messenger\MsnMsgr.Exe" [2009-07-26 3883856]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\programmi\File comuni\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 1828136]
"swg"="c:\programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-04-04 39408]
"SpywareTerminatorUpdate"="c:\programmi\Spyware Terminator\SpywareTerminatorUpdate.exe" [2010-04-25 3037696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"U.S. Robotics Wireless Manager UI"="c:\windows\system32\WLTRAY" [X]
"RTHDCPL"="RTHDCPL.EXE" [2007-04-12 16132608]
"QuickTime Task"="c:\programmi\QuickTime\qttask.exe" [2008-03-28 413696]
"NeroFilterCheck"="c:\programmi\File comuni\Nero\Lib\NeroCheck.exe" [2008-02-28 570664]
"SunJavaUpdateSched"="c:\programmi\File comuni\Java\Java Update\jusched.exe" [2010-02-18 248040]
"Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2010-04-02 40368]
"Adobe ARM"="c:\programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"SpywareTerminator"="c:\programmi\Spyware Terminator\SpywareTerminatorShield.exe" [2010-04-25 2176512]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
"nltide_3"="advpack.dll" [2009-03-08 128512]

c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Nikon Monitor.lnk - c:\programmi\File comuni\Nikon\Monitor\NkMonitor.exe [2007-10-18 479232]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-04-25 10:46 12464 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ PDBoot.exe\0autocheck autochk *

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\eMule\\emule.exe"=
"c:\\Programmi\\Mozilla Firefox\\firefox.exe"=
"c:\\Programmi\\RealVNC\\VNC4\\winvnc4.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programmi\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Programmi\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=
"c:\\Programmi\\AVG\\AVG9\\avgemc.exe"=
"c:\\Programmi\\AVG\\AVG9\\avgupd.exe"=
"c:\\Programmi\\AVG\\AVG9\\avgnsx.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [25/04/2010 12.46.20 216200]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [25/04/2010 12.46.24 242896]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [25/04/2010 11.10.08 142592]
R2 avg9emc;AVG Free E-mail Scanner;c:\programmi\AVG\AVG9\avgemc.exe [25/04/2010 12.45.27 916760]
R2 avg9wd;AVG Free WatchDog;c:\programmi\AVG\AVG9\avgwdsvc.exe [25/04/2010 12.45.25 308064]
R2 PD91Agent;PD91Agent;c:\programmi\Raxco\PerfectDisk2008\PD91Agent.exe [31/12/2008 13.12.40 693512]
S2 gupdate1c9b563fa0b28e7;Servizio di Google Update (gupdate1c9b563fa0b28e7);c:\programmi\Google\Update\GoogleUpdate.exe [04/04/2009 22.28.54 133104]
S3 PD91Engine;PD91Engine;c:\programmi\Raxco\PerfectDisk2008\PD91Engine.exe [31/12/2008 13.12.44 910600]
.
Contenuto della cartella 'Scheduled Tasks'

2010-04-25 c:\windows\Tasks\Google Software Updater.job
- c:\programmi\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-04-04 20:28]

2010-04-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2009-04-04 20:28]

2010-04-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2009-04-04 20:28]

2010-04-25 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 13:07]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
IE: Crawler Search - tbr:iemenu
IE: E&sporta in Microsoft Excel - c:\progra~1\Microsoft Office\OFFICE11\EXCEL.EXE/3000
Trusted Zone: forumcommunity.net\channela
TCP: {D45815C8-B3CA-4762-A0BF-5F9897CEC0B6} = 212.216.112.112,212.216.172.62
TCP: {DFE977B1-1E40-4A2C-9ECE-C0057A0D83AB} = 212.216.112.112,212.216.172.62
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\programmi\Crawler\ctbr.dll
FF - ProfilePath - c:\documents and settings\Vale\Dati applicazioni\Mozilla\Firefox\Profiles\slp6i9ql.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.chameleonsearch.com/search.php?src=tops&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.it/
FF - prefs.js: keyword.URL - hxxp://www.crawler.com/search/dispatcher.aspx?tp=aus&tbid=60076&qkw=
FF - component: c:\programmi\AVG\AVG9\Firefox\components\avgssff.dll
FF - component: c:\programmi\Crawler\firefox\components\xcomm.dll
FF - component: c:\programmi\Crawler\firefox\components\xshared.dll
FF - component: c:\programmi\Crawler\firefox\components\xsupport.dll
FF - component: c:\programmi\Crawler\firefox\components\xwsg.dll
FF - component: c:\programmi\Mozilla Firefox\extensions\{bf9fa269-fc17-c213-aa1a-2c6aa455d98d}\components\-v_Za-ek-Xa-J.dll
FF - plugin: c:\programmi\Earth Resource Mapping\Image Web Server\Firefox Plug-in\NP_NCS6.dll
FF - plugin: c:\programmi\Earth Resource Mapping\Image Web Server\Firefox Plug-in\NP_NCSPB6.dll
FF - plugin: c:\programmi\Earth Resource Mapping\Image Web Server\Firefox Plug-in\NP_NCSTB6.dll
FF - plugin: c:\programmi\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\programmi\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\programmi\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\programmi\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\programmi\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\programmi\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\programmi\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\programmi\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\programmi\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\programmi\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\programmi\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\programmi\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************
scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti:

**************************************************************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•9~*]
"0140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------

- - - - - - - > 'winlogon.exe'(756)
c:\windows\system32\Ati2evxx.dll
c:\windows\System32\BCMLogon.dll

- - - - - - - > 'explorer.exe'(2272)
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Ora fine scansione: 2010-04-25 15:38:59
ComboFix-quarantined-files.txt 2010-04-25 13:38

Pre-Run: 8.098.156.544 byte disponibili
Post-Run: 8.166.133.760 byte disponibili

- - End Of File - - D0454947CB243B7D9A61ABC95665A5BB