Sospetti Virus!!

[Workman86]

Ragazzi nn saprei se sono infetto o no...potete controllare un attimo!!!

Avira AntiVir Personal
Report file date: domenica 30 novembre 2008 00:18

Scanning for 1058638 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 3) [5.1.2600]
Boot mode: Normally booted
Username: SYSTEM
Computer name: ALFIERI-546F074

Version information:
BUILD.DAT : 8.2.0.337 16934 Bytes 18/11/2008 13:05:00
AVSCAN.EXE : 8.1.4.10 315649 Bytes 25/11/2008 17:06:57
AVSCAN.DLL : 8.1.4.0 40705 Bytes 17/07/2008 19:38:04
LUKE.DLL : 8.1.4.5 164097 Bytes 17/07/2008 19:38:04
LUKERES.DLL : 8.1.4.0 12033 Bytes 17/07/2008 19:38:04
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 16:35:06
ANTIVIR1.VDF : 7.1.0.56 411136 Bytes 09/11/2008 17:20:22
ANTIVIR2.VDF : 7.1.0.124 376832 Bytes 23/11/2008 14:00:47
ANTIVIR3.VDF : 7.1.0.157 195072 Bytes 28/11/2008 16:37:07
Engineversion : 8.2.0.36
AEVDF.DLL : 8.1.0.6 102772 Bytes 15/10/2008 15:26:47
AESCRIPT.DLL : 8.1.1.15 332156 Bytes 11/11/2008 17:20:47
AESCN.DLL : 8.1.1.5 123251 Bytes 09/11/2008 10:35:18
AERDL.DLL : 8.1.1.3 438645 Bytes 05/11/2008 21:25:17
AEPACK.DLL : 8.1.3.4 393591 Bytes 11/11/2008 17:20:46
AEOFFICE.DLL : 8.1.0.30 196986 Bytes 09/11/2008 10:35:18
AEHEUR.DLL : 8.1.0.71 1487222 Bytes 09/11/2008 10:35:17
AEHELP.DLL : 8.1.2.0 119159 Bytes 18/11/2008 19:58:31
AEGEN.DLL : 8.1.1.6 323955 Bytes 28/11/2008 16:38:09
AEEMU.DLL : 8.1.0.9 393588 Bytes 15/10/2008 15:26:40
AECORE.DLL : 8.1.5.2 172405 Bytes 28/11/2008 16:38:08
AEBB.DLL : 8.1.0.3 53618 Bytes 15/10/2008 15:26:38
AVWINLL.DLL : 1.0.0.12 15105 Bytes 17/07/2008 19:38:04
AVPREF.DLL : 8.0.2.0 38657 Bytes 17/07/2008 19:38:04
AVREP.DLL : 8.0.0.2 98344 Bytes 31/07/2008 15:15:39
AVREG.DLL : 8.0.0.1 33537 Bytes 17/07/2008 19:38:04
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 17/07/2008 19:38:04
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 17/07/2008 19:38:04
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 17/07/2008 19:38:01
RCTEXT.DLL : 8.0.52.0 86273 Bytes 17/07/2008 19:38:01

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\programmi\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: repair
Secondary action.................: quarantine
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, D:, W:,
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: on
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Deviating archive types..........: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox,
Macro heuristic..................: on
File heuristic...................: high
Deviating risk categories........: +APPL,+GAME,+JOKE,+PCK,+SPR,

Start of the scan: domenica 30 novembre 2008 00:18

Starting search for hidden objects.
'73307' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'emule.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'SAgent4.exe' - '1' Module(s) have been scanned
Scan process 'sp_rsser.exe' - '1' Module(s) have been scanned
Scan process 'PsiService_2.exe' - '1' Module(s) have been scanned
Scan process 'PSIService.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'NBService.exe' - '1' Module(s) have been scanned
Scan process 'MDM.EXE' - '1' Module(s) have been scanned
Scan process 'GoogleUpdaterService.exe' - '1' Module(s) have been scanned
Scan process 'E_S00RP2.EXE' - '1' Module(s) have been scanned
Scan process 'Crypserv.exe' - '1' Module(s) have been scanned
Scan process 'CTSVCCDA.EXE' - '1' Module(s) have been scanned
Scan process 'DevSvc.exe' - '1' Module(s) have been scanned
Scan process 'ATKKBService.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'CTSched.exe' - '1' Module(s) have been scanned
Scan process 'SmartDoctor.exe' - '1' Module(s) have been scanned
Scan process 'reader_sl.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'SpywareTerminatorShield.Exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'CTSysVol.exe' - '1' Module(s) have been scanned
Scan process 'ipoint.exe' - '1' Module(s) have been scanned
Scan process 'itype.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
43 processes with 43 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!
Master boot sector HD2
[INFO] No virus was found!
[WARNING] System error [21]: Periferica non pronta.
Master boot sector HD3
[INFO] No virus was found!
[WARNING] System error [21]: Periferica non pronta.
Master boot sector HD4
[INFO] No virus was found!
[WARNING] System error [21]: Periferica non pronta.
Master boot sector HD5
[INFO] No virus was found!
[WARNING] System error [21]: Periferica non pronta.

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
[WARNING] System error [3]: Impossibile trovare il percorso specificato.
Boot sector 'D:\'
[INFO] No virus was found!
Boot sector 'W:\'
[INFO] No virus was found!

Starting to scan the registry.
The registry was scanned ( '55' files ).


Starting the file scan:

Begin scan in 'C:\' <Disco Locale>
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\Programmi\Electronic Arts\Crytek\Crysis WARHEAD\Bin32\PAUL.DLL
[DETECTION] Contains HEUR/Malware suspicious code
[NOTE] The detection was classified as suspicious.
[NOTE] The file was moved to '4986d207.qua'!
C:\System Volume Information\_restore{AA155B4C-26CE-46AD-8DE1-1E3C000FCBE6}\RP366\A0101338.sys
[DETECTION] Is the TR/Rootkit.Gen Trojan
[NOTE] The file was moved to '4962d5c6.qua'!
C:\System Volume Information\_restore{AA155B4C-26CE-46AD-8DE1-1E3C000FCBE6}\RP366\A0102150.DLL
[DETECTION] Contains HEUR/Malware suspicious code
[NOTE] The detection was classified as suspicious.
[NOTE] The file was moved to '4962d5c8.qua'!
C:\WINDOWS\system32\drivers\atapi.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\drivers\Changer.sys
[DETECTION] Is the TR/Rootkit.Gen Trojan
[NOTE] The file was moved to '4992d79c.qua'!
Begin scan in 'D:\' <Dati>
Begin scan in 'W:\' <Western Digital>
W:\CSRSS.exe
[DETECTION] Is the TR/Autorun.UG Trojan
[NOTE] The file was moved to '4983d8a9.qua'!
W:\SERVICES.exe
[DETECTION] Is the TR/Autorun.UG Trojan
[NOTE] The file was moved to '4983d89b.qua'!
W:\System Volume Information\_restore{AA155B4C-26CE-46AD-8DE1-1E3C000FCBE6}\RP366\A0102154.exe
[DETECTION] Is the TR/Autorun.UG Trojan
[NOTE] The file was moved to '4962dd17.qua'!
W:\System Volume Information\_restore{AA155B4C-26CE-46AD-8DE1-1E3C000FCBE6}\RP366\A0102155.exe
[DETECTION] Is the TR/Autorun.UG Trojan
[NOTE] The file was moved to '48e30f58.qua'!


End of the scan: domenica 30 novembre 2008 01:23
Used time: 1:04:40 Hour(s)

The scan has been done completely.

9119 Scanning directories
488797 Files were scanned
6 viruses and/or unwanted programs were found
2 Files were classified as suspicious:
0 files were deleted
0 files were repaired
8 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
488787 Files not concerned
4554 Archives were scanned
7 Warnings
8 Notes
73307 Objects were scanned with rootkit scan
0 Hidden objects were found

[Chill-Out]

Ciao disabilita il ripristino configurazione sistema e ripeti scansione completa con Avira ed allega il log.

[Workman86]

Ho fatto cm hai detto tu...

Avira AntiVir Personal
Report file date: domenica 30 novembre 2008 17:19

Scanning for 1058638 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 3) [5.1.2600]
Boot mode: Normally booted
Username: SYSTEM
Computer name: ALFIERI-546F074

Version information:
BUILD.DAT : 8.2.0.337 16934 Bytes 18/11/2008 13:05:00
AVSCAN.EXE : 8.1.4.10 315649 Bytes 25/11/2008 17:06:57
AVSCAN.DLL : 8.1.4.0 40705 Bytes 17/07/2008 19:38:04
LUKE.DLL : 8.1.4.5 164097 Bytes 17/07/2008 19:38:04
LUKERES.DLL : 8.1.4.0 12033 Bytes 17/07/2008 19:38:04
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 16:35:06
ANTIVIR1.VDF : 7.1.0.56 411136 Bytes 09/11/2008 17:20:22
ANTIVIR2.VDF : 7.1.0.124 376832 Bytes 23/11/2008 14:00:47
ANTIVIR3.VDF : 7.1.0.157 195072 Bytes 28/11/2008 16:37:07
Engineversion : 8.2.0.36
AEVDF.DLL : 8.1.0.6 102772 Bytes 15/10/2008 15:26:47
AESCRIPT.DLL : 8.1.1.15 332156 Bytes 11/11/2008 17:20:47
AESCN.DLL : 8.1.1.5 123251 Bytes 09/11/2008 10:35:18
AERDL.DLL : 8.1.1.3 438645 Bytes 05/11/2008 21:25:17
AEPACK.DLL : 8.1.3.4 393591 Bytes 11/11/2008 17:20:46
AEOFFICE.DLL : 8.1.0.30 196986 Bytes 09/11/2008 10:35:18
AEHEUR.DLL : 8.1.0.71 1487222 Bytes 09/11/2008 10:35:17
AEHELP.DLL : 8.1.2.0 119159 Bytes 18/11/2008 19:58:31
AEGEN.DLL : 8.1.1.6 323955 Bytes 28/11/2008 16:38:09
AEEMU.DLL : 8.1.0.9 393588 Bytes 15/10/2008 15:26:40
AECORE.DLL : 8.1.5.2 172405 Bytes 28/11/2008 16:38:08
AEBB.DLL : 8.1.0.3 53618 Bytes 15/10/2008 15:26:38
AVWINLL.DLL : 1.0.0.12 15105 Bytes 17/07/2008 19:38:04
AVPREF.DLL : 8.0.2.0 38657 Bytes 17/07/2008 19:38:04
AVREP.DLL : 8.0.0.2 98344 Bytes 31/07/2008 15:15:39
AVREG.DLL : 8.0.0.1 33537 Bytes 17/07/2008 19:38:04
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 17/07/2008 19:38:04
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 17/07/2008 19:38:04
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 17/07/2008 19:38:01
RCTEXT.DLL : 8.0.52.0 86273 Bytes 17/07/2008 19:38:01

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\programmi\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: repair
Secondary action.................: quarantine
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, D:, W:,
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: on
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Deviating archive types..........: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox,
Macro heuristic..................: on
File heuristic...................: high
Deviating risk categories........: +APPL,+GAME,+JOKE,+PCK,+SPR,

Start of the scan: domenica 30 novembre 2008 17:19

Starting search for hidden objects.
'61754' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'ACDSeeQV.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'SAgent4.exe' - '1' Module(s) have been scanned
Scan process 'sp_rsser.exe' - '1' Module(s) have been scanned
Scan process 'PsiService_2.exe' - '1' Module(s) have been scanned
Scan process 'PSIService.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'NBService.exe' - '1' Module(s) have been scanned
Scan process 'MDM.EXE' - '1' Module(s) have been scanned
Scan process 'GoogleUpdaterService.exe' - '1' Module(s) have been scanned
Scan process 'E_S00RP2.EXE' - '1' Module(s) have been scanned
Scan process 'Crypserv.exe' - '1' Module(s) have been scanned
Scan process 'CTSVCCDA.EXE' - '1' Module(s) have been scanned
Scan process 'DevSvc.exe' - '1' Module(s) have been scanned
Scan process 'ATKKBService.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'CTSched.exe' - '1' Module(s) have been scanned
Scan process 'SmartDoctor.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'SpywareTerminatorShield.Exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'CTSysVol.exe' - '1' Module(s) have been scanned
Scan process 'ipoint.exe' - '1' Module(s) have been scanned
Scan process 'itype.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
42 processes with 42 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!
Master boot sector HD2
[INFO] No virus was found!
[WARNING] System error [21]: Periferica non pronta.
Master boot sector HD3
[INFO] No virus was found!
[WARNING] System error [21]: Periferica non pronta.
Master boot sector HD4
[INFO] No virus was found!
[WARNING] System error [21]: Periferica non pronta.
Master boot sector HD5
[INFO] No virus was found!
[WARNING] System error [21]: Periferica non pronta.

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
[WARNING] System error [3]: Impossibile trovare il percorso specificato.
Boot sector 'D:\'
[INFO] No virus was found!
Boot sector 'W:\'
[INFO] No virus was found!

Starting to scan the registry.
The registry was scanned ( '55' files ).


Starting the file scan:

Begin scan in 'C:\' <Disco Locale>
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\drivers\atapi.sys
[WARNING] The file could not be opened!
Begin scan in 'D:\' <Dati>
Begin scan in 'W:\' <Western Digital>


End of the scan: domenica 30 novembre 2008 18:23
Used time: 1:03:26 Hour(s)

The scan has been done completely.

8826 Scanning directories
455568 Files were scanned
0 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
455566 Files not concerned
4121 Archives were scanned
7 Warnings
0 Notes
61754 Objects were scanned with rootkit scan
0 Hidden objects were found

[Chill-Out]

Dal log di Avira sei ok

[Workman86]

xkè nella prima ci sono tt quei problemi??

[Workman86]

QUESTO ME LO HA RIVELATO ORA SPYWARE TERMINATOR

Trojan.KillAV.lz
Description: Trojan
Risk Level: Critical
Date of First Occurence: Thursday, April 17, 2008
Software Developer: (unknown)
Brief Info: Trojan is a seemingly legitimate computer program that has been intentionally designed to disrupt and damage computer activity. Trojans are sometimes used in conjunction with viruses.
Removal: This threat can be removed using "Spyware Terminator"

[Chill-Out]

Originariamente inviato da Workman86

xkè nella prima ci sono tt quei problemi??

avevi virus nel system volume information

Originariamente inviato da Workman86

QUESTO ME LO HA RIVELATO ORA SPYWARE TERMINATOR

cosa e dove?

ma perchè tutte queste scansioni, il problema di fondo qual'è?

[Workman86]

questo file..

asc3550p me lo rileva ma nn me lo cancella

Detected Item: HKLM\SYSTEM\CurrentControlSet\Services\asc3550p

il problema di fondo è ke xsbaglio ho lanciato un setup ke nn dovevo!!

[Workman86]

Questo è l info ke mi da

Detected Items

1. Detected Files: %SYSDIR%\drivers\asc3550u.sys MD5: 2E51FCA0A666B07B96CE264D1FC7504A Size:59104 MD5: 3971A1DD1C2B8DD222412C42748BA0BB Size:27360 MD5: 758DEFD696EB6F3CC5EAFCB7AE8F4ACB Size:67936 MD5: 6AC22501944105E5C6373ED9C65B783F Size:67872 MD5: 93B1A86E98D186E890B6A850CD638F7E Size:67936 MD5: 0C6FCF48607F16EB35E7F55FFD2AF528 Size:32864 MD5: 295B1972961EAF28E45038E6622E7F13 Size:32704 MD5: 8496C0F5D68E69EDF70F9DFDF7EB209A Size:67968 %SYSDIR%\drivers\asc3550v.sys MD5: 63AD64373B89C1D36F10B3EB25A1AF40 Size:64096 %SYSDIR%\drivers\asc3550p.sys MD5: EF581EC6F5C92B42BB2E5D9ABD48356D Size:42688 MD5: 642A5C79962AAC586F6EAEFBD1833C7E Size:42688 MD5: 583C8E8DD8FD50DE8AA1BA67DF48E8DE Size:42496 MD5: EF2FA5C501D0861528290640BAB1FB46 Size:42688 MD5: 40C1B3D3C574629D5A1200B12358EBDC Size:42688 MD5: C01C996BA021C3F79395EA13FEFB3AD4 Size:42688 MD5: BDDB0CADA728E271472071A7D3164F5B Size:42688 MD5: 0B98421AA81DF881D000CFC552D10342 Size:42368 MD5: 12BC854BCB1C6A21A1A54673FE461C39 Size:42688 MD5: 0DE25B79F732FE0C05122EAE0EFC0507 Size:42688 MD5: CA1A5342EA446187D5C331A502151584 Size:42688 MD5: 0A43002F24CE4A4044D65B55156B9334 Size:42688 and more.... %SYSDIR%\drivers\asc3550p.sys MD5: ABED53F9F12982158A7B398AE553D7AA Size:42688 MD5: 7C039514007CE6C9EFCFE0F382F3FF8F Size:42336 MD5: 7DF01A215B2EBB9BB8E54F0651A20BD8 Size:42688 MD5: C4D2D117803C4F2A631087EB2ADE30A6 Size:42240 MD5: A83B31C55CE27A5B804633801E8FAD28 Size:42688 MD5: 428F83F6ABFB80B6801BBE355FC7BE3B Size:39808 MD5: FE45293BA2BA5DD1D2492C9CF83F955B Size:39808 MD5: 834FE4F385CA5B16ECF582674425EE39 Size:39680 %SYSDIR%\drivers\asc3550o.sys MD5: 494E7BEBA7AA278A967E01308A559A8E Size:73536 MD5: 1F124A87EC6A9181E9C521F6FE5EB75F Size:73664
2. Detected Files with variable Filenames:

Detecting items list:

1. Files by Name %SYSDIR%\drivers\asc3550a.sys %SYSDIR%\drivers\asc3550o.sys %SYSDIR%\drivers\asc3550u.sys %SYSDIR%\drivers\asc3550v.sys %SYSDIR%\drivers\asc3550p.sys
2. Files by MD5 MD5: ADB68B31CD9E2DF72C93EFF2B5D9592E Size: 40768 MD5: EDFA85E8849FA413C5BF179083B8190F Size: 40768
3. Registry Keys HKLM\SYSTEM\CurrentControlSet\Services\asc3550p

[Chill-Out]

Passalo pure in quarantena, poi se desideri fare un controlla approfondito segui la Guida alla disinfezione allegando tutti i log prodotti in un'unico post secondo le sottoindicate modalità, grazie per la collaborazione

MODALITA' DI PUBBLICAZIONE DEI LOG RICHIESTI:

Ogni singolo log, esclusivamente in formato txt a parte SynInspector e nell'ordine indicato in Guida, deve essere hostato su Fileqube, clicca qui per raggiungere Fileqube, pubblicando, nella discussione, singolarmente, per ogni log, il link che verrà rilasciato per il download

[Workman86]

Guardate anke questo

SDFix: Version 1.240
Run by Carmine on 01/12/2008 at 00.27

Microsoft Windows XP [Versione 5.1.2600]
Running From: C:\SDFix

Checking Services :


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

No Trojan Files Found






Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-01 00:32:42
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a347scsi\Config\jdgg40]

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E9F81423-211E-46B6-9AE0-38568BC5CF6F}]
"DisplayName"="Alcohol 120%"

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Programmi\\uTorrent\\uTorrent.exe"="C:\\Programmi\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\\Programmi\\Mozilla Firefox\\firefox.exe"="C:\\Programmi\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"
"W:\\Emule ScarAngel 2.5\\emule.exe"="W:\\Emule ScarAngel 2.5\\emule.exe:*:Enabled:eMule"
"C:\\WINDOWS\\system32\\ftp.exe"="C:\\WINDOWS\\system32\\ftp.exe:*:Enabled:Programma di trasferimento file (FTP)"
"C:\\Programmi\\KONAMI\\Pro Evolution Soccer 2008\\PES2008.exe"="C:\\Programmi\\KONAMI\\Pro Evolution Soccer 2008\\PES2008.exe:*:Enabled:Pro Evolution Soccer 2008"
"W:\\Emule ScarAngel 3.0\\emule.exe"="W:\\Emule ScarAngel 3.0\\emule.exe:*:Enabled:eMule"
"C:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Programmi\\Windows Live\\Messenger\\livecall.exe"="C:\\Programmi\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Programmi\\EA Sports\\FIFA 09\\FIFA09.exe"="C:\\Programmi\\EA Sports\\FIFA 09\\FIFA09.exe:*:Enabled:FIFA09"
"C:\\Programmi\\KONAMI\\Pro Evolution Soccer 2009\\pes2009.exe"="C:\\Programmi\\KONAMI\\Pro Evolution Soccer 2009\\pes2009.exe:*:Enabled:Pro Evolution Soccer 2009"
"C:\\Documents and Settings\\Carmine\\Desktop\\PES 2009.exe"="C:\\Documents and Settings\\Carmine\\Desktop\\PES 2009.exe:*:Enabled:Pro Evolution Soccer 2009"
"C:\\Programmi\\Bonjour\\mDNSResponder.exe"="C:\\Programmi\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Programmi\\Windows Live\\Messenger\\livecall.exe"="C:\\Programmi\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Remaining Files :



Files with Hidden Attributes :

Thu 24 May 2001 162,304 A..H. --- "C:\UNWISE.EXE"
Mon 13 Aug 2007 71,680 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\admparse.dll"
Mon 13 Aug 2007 123,904 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\advpack.dll"
Sat 23 Sep 2006 1,022,976 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\browseui.dll"
Mon 13 Aug 2007 17,408 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\corpol.dll"
Mon 13 Aug 2007 33,792 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\custsat.dll"
Mon 13 Aug 2007 346,624 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\dxtmsft.dll"
Mon 13 Aug 2007 214,528 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\dxtrans.dll"
Mon 13 Aug 2007 131,584 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\extmgr.dll"
Mon 13 Aug 2007 60,416 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\hmmapi.dll"
Mon 13 Aug 2007 61,952 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\icardie.dll"
Mon 13 Aug 2007 54,784 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\ie4uinit.exe"
Mon 13 Aug 2007 152,064 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\ieakeng.dll"
Mon 13 Aug 2007 229,376 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\ieaksie.dll"
Mon 13 Aug 2007 161,792 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\ieakui.dll"
Wed 11 Jul 2007 383,488 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\ieapfltr.dll"
Mon 13 Aug 2007 382,976 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\iedkcs32.dll"
Mon 13 Aug 2007 69,120 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\iedw.exe"
Mon 13 Aug 2007 78,336 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\ieencode.dll"
Mon 13 Aug 2007 6,049,280 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\ieframe.dll"
Mon 13 Aug 2007 191,488 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\iepeers.dll"
Mon 13 Aug 2007 287,744 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\ieproxy.dll"
Mon 13 Aug 2007 43,008 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\iernonce.dll"
Mon 13 Aug 2007 266,752 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\iertutil.dll"
Mon 13 Aug 2007 55,296 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\iesetup.dll"
Mon 13 Aug 2007 13,312 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\ieudinit.exe"
Mon 13 Aug 2007 180,736 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\ieui.dll"
Mon 13 Aug 2007 622,080 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\iexplore.exe"
Mon 13 Aug 2007 36,352 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\imgutil.dll"
Mon 13 Aug 2007 92,672 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\inseng.dll"
Mon 13 Aug 2007 491,520 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\jscript.dll"
Mon 13 Aug 2007 27,136 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\jsproxy.dll"
Mon 13 Aug 2007 40,960 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\licmgr10.dll"
Mon 13 Aug 2007 458,752 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\msfeeds.dll"
Mon 13 Aug 2007 50,688 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\msfeedsbs.dll"
Mon 13 Aug 2007 12,288 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\msfeedssync.exe"
Mon 13 Aug 2007 45,568 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\mshta.exe"
Mon 13 Aug 2007 3,578,368 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\mshtml.dll"
Mon 13 Aug 2007 475,648 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\mshtmled.dll"
Mon 13 Aug 2007 48,128 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\mshtmler.dll"
Mon 13 Aug 2007 156,160 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\msls31.dll"
Mon 13 Aug 2007 192,000 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\msrating.dll"
Mon 13 Aug 2007 670,720 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\mstime.dll"
Mon 13 Aug 2007 101,376 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\occache.dll"
Mon 13 Aug 2007 44,544 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\pngfilt.dll"
Sat 23 Sep 2006 1,497,088 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\shdocvw.dll"
Sat 23 Sep 2006 474,112 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\shlwapi.dll"
Wed 6 Sep 2006 15,584 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\spmsg.dll"
Wed 6 Sep 2006 215,776 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\spuninst.exe"
Wed 6 Sep 2006 22,752 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\spupdsvc.exe"
Mon 13 Aug 2007 105,984 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\url.dll"
Mon 13 Aug 2007 1,162,240 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\urlmon.dll"
Mon 13 Aug 2007 413,696 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\vbscript.dll"
Mon 13 Aug 2007 765,952 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\vgx.dll"
Mon 13 Aug 2007 231,424 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\webcheck.dll"
Mon 13 Aug 2007 206,336 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\winfxdocobj.exe"
Mon 13 Aug 2007 818,688 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\wininet.dll"
Mon 13 Aug 2007 71,680 A..H. --- "C:\9b751e1b441c4ba50fca9383\admparse.dll"
Mon 13 Aug 2007 123,904 A..H. --- "C:\9b751e1b441c4ba50fca9383\advpack.dll"
Sat 23 Sep 2006 1,022,976 A..H. --- "C:\9b751e1b441c4ba50fca9383\browseui.dll"
Mon 13 Aug 2007 17,408 A..H. --- "C:\9b751e1b441c4ba50fca9383\corpol.dll"
Mon 13 Aug 2007 33,792 A..H. --- "C:\9b751e1b441c4ba50fca9383\custsat.dll"
Mon 13 Aug 2007 346,624 A..H. --- "C:\9b751e1b441c4ba50fca9383\dxtmsft.dll"
Mon 13 Aug 2007 214,528 A..H. --- "C:\9b751e1b441c4ba50fca9383\dxtrans.dll"
Mon 13 Aug 2007 131,584 A..H. --- "C:\9b751e1b441c4ba50fca9383\extmgr.dll"
Mon 13 Aug 2007 60,416 A..H. --- "C:\9b751e1b441c4ba50fca9383\hmmapi.dll"
Mon 13 Aug 2007 61,952 A..H. --- "C:\9b751e1b441c4ba50fca9383\icardie.dll"
Mon 13 Aug 2007 54,784 A..H. --- "C:\9b751e1b441c4ba50fca9383\ie4uinit.exe"
Mon 13 Aug 2007 152,064 A..H. --- "C:\9b751e1b441c4ba50fca9383\ieakeng.dll"
Mon 13 Aug 2007 229,376 A..H. --- "C:\9b751e1b441c4ba50fca9383\ieaksie.dll"
Mon 13 Aug 2007 161,792 A..H. --- "C:\9b751e1b441c4ba50fca9383\ieakui.dll"
Wed 11 Jul 2007 383,488 A..H. --- "C:\9b751e1b441c4ba50fca9383\ieapfltr.dll"
Mon 13 Aug 2007 382,976 A..H. --- "C:\9b751e1b441c4ba50fca9383\iedkcs32.dll"
Mon 13 Aug 2007 69,120 A..H. --- "C:\9b751e1b441c4ba50fca9383\iedw.exe"
Mon 13 Aug 2007 78,336 A..H. --- "C:\9b751e1b441c4ba50fca9383\ieencode.dll"
Mon 13 Aug 2007 6,049,280 A..H. --- "C:\9b751e1b441c4ba50fca9383\ieframe.dll"
Mon 13 Aug 2007 191,488 A..H. --- "C:\9b751e1b441c4ba50fca9383\iepeers.dll"
Mon 13 Aug 2007 287,744 A..H. --- "C:\9b751e1b441c4ba50fca9383\ieproxy.dll"
Mon 13 Aug 2007 43,008 A..H. --- "C:\9b751e1b441c4ba50fca9383\iernonce.dll"
Mon 13 Aug 2007 266,752 A..H. --- "C:\9b751e1b441c4ba50fca9383\iertutil.dll"
Mon 13 Aug 2007 55,296 A..H. --- "C:\9b751e1b441c4ba50fca9383\iesetup.dll"
Mon 13 Aug 2007 13,312 A..H. --- "C:\9b751e1b441c4ba50fca9383\ieudinit.exe"
Mon 13 Aug 2007 180,736 A..H. --- "C:\9b751e1b441c4ba50fca9383\ieui.dll"
Mon 13 Aug 2007 622,080 A..H. --- "C:\9b751e1b441c4ba50fca9383\iexplore.exe"
Mon 13 Aug 2007 36,352 A..H. --- "C:\9b751e1b441c4ba50fca9383\imgutil.dll"
Mon 13 Aug 2007 92,672 A..H. --- "C:\9b751e1b441c4ba50fca9383\inseng.dll"
Mon 13 Aug 2007 491,520 A..H. --- "C:\9b751e1b441c4ba50fca9383\jscript.dll"
Mon 13 Aug 2007 27,136 A..H. --- "C:\9b751e1b441c4ba50fca9383\jsproxy.dll"
Mon 13 Aug 2007 40,960 A..H. --- "C:\9b751e1b441c4ba50fca9383\licmgr10.dll"
Mon 13 Aug 2007 458,752 A..H. --- "C:\9b751e1b441c4ba50fca9383\msfeeds.dll"
Mon 13 Aug 2007 50,688 A..H. --- "C:\9b751e1b441c4ba50fca9383\msfeedsbs.dll"
Mon 13 Aug 2007 12,288 A..H. --- "C:\9b751e1b441c4ba50fca9383\msfeedssync.exe"
Mon 13 Aug 2007 45,568 A..H. --- "C:\9b751e1b441c4ba50fca9383\mshta.exe"
Mon 13 Aug 2007 3,578,368 A..H. --- "C:\9b751e1b441c4ba50fca9383\mshtml.dll"
Mon 13 Aug 2007 475,648 A..H. --- "C:\9b751e1b441c4ba50fca9383\mshtmled.dll"
Mon 13 Aug 2007 48,128 A..H. --- "C:\9b751e1b441c4ba50fca9383\mshtmler.dll"
Mon 13 Aug 2007 156,160 A..H. --- "C:\9b751e1b441c4ba50fca9383\msls31.dll"
Mon 13 Aug 2007 192,000 A..H. --- "C:\9b751e1b441c4ba50fca9383\msrating.dll"
Mon 13 Aug 2007 670,720 A..H. --- "C:\9b751e1b441c4ba50fca9383\mstime.dll"
Mon 13 Aug 2007 101,376 A..H. --- "C:\9b751e1b441c4ba50fca9383\occache.dll"
Mon 13 Aug 2007 44,544 A..H. --- "C:\9b751e1b441c4ba50fca9383\pngfilt.dll"
Sat 23 Sep 2006 1,497,088 A..H. --- "C:\9b751e1b441c4ba50fca9383\shdocvw.dll"
Sat 23 Sep 2006 474,112 A..H. --- "C:\9b751e1b441c4ba50fca9383\shlwapi.dll"
Wed 6 Sep 2006 15,584 A..H. --- "C:\9b751e1b441c4ba50fca9383\spmsg.dll"
Wed 6 Sep 2006 215,776 A..H. --- "C:\9b751e1b441c4ba50fca9383\spuninst.exe"
Wed 6 Sep 2006 22,752 A..H. --- "C:\9b751e1b441c4ba50fca9383\spupdsvc.exe"
Mon 13 Aug 2007 105,984 A..H. --- "C:\9b751e1b441c4ba50fca9383\url.dll"
Mon 13 Aug 2007 1,162,240 A..H. --- "C:\9b751e1b441c4ba50fca9383\urlmon.dll"
Mon 13 Aug 2007 413,696 A..H. --- "C:\9b751e1b441c4ba50fca9383\vbscript.dll"
Mon 13 Aug 2007 765,952 A..H. --- "C:\9b751e1b441c4ba50fca9383\vgx.dll"
Mon 13 Aug 2007 231,424 A..H. --- "C:\9b751e1b441c4ba50fca9383\webcheck.dll"
Mon 13 Aug 2007 206,336 A..H. --- "C:\9b751e1b441c4ba50fca9383\winfxdocobj.exe"
Mon 13 Aug 2007 818,688 A..H. --- "C:\9b751e1b441c4ba50fca9383\wininet.dll"
Wed 6 Sep 2006 589,672 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\update\idndl.exe"
Thu 4 Oct 2007 33,472 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\update\iecustom.dll"
Thu 4 Oct 2007 66,048 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\update\iereseticons.exe"
Thu 4 Oct 2007 1,088,192 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\update\iesetup.exe"
Mon 12 Feb 2007 635,696 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\update\legitlibm.dll"
Wed 6 Sep 2006 498,016 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\update\nlsdl.exe"
Wed 6 Sep 2006 724,192 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\update\update.exe"
Wed 6 Sep 2006 390,880 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\update\updspapi.dll"
Wed 6 Sep 2006 536,888 A..H. --- "C:\2c5198581cf5dd573e1a7ed62c\update\xmllitesetup.exe"
Wed 6 Sep 2006 589,672 A..H. --- "C:\9b751e1b441c4ba50fca9383\update\idndl.exe"
Thu 4 Oct 2007 33,472 A..H. --- "C:\9b751e1b441c4ba50fca9383\update\iecustom.dll"
Thu 4 Oct 2007 66,048 A..H. --- "C:\9b751e1b441c4ba50fca9383\update\iereseticons.exe"
Thu 4 Oct 2007 1,088,192 A..H. --- "C:\9b751e1b441c4ba50fca9383\update\iesetup.exe"
Mon 12 Feb 2007 635,696 A..H. --- "C:\9b751e1b441c4ba50fca9383\update\legitlibm.dll"
Wed 6 Sep 2006 498,016 A..H. --- "C:\9b751e1b441c4ba50fca9383\update\nlsdl.exe"
Wed 6 Sep 2006 724,192 A..H. --- "C:\9b751e1b441c4ba50fca9383\update\update.exe"
Wed 6 Sep 2006 390,880 A..H. --- "C:\9b751e1b441c4ba50fca9383\update\updspapi.dll"
Wed 6 Sep 2006 536,888 A..H. --- "C:\9b751e1b441c4ba50fca9383\update\xmllitesetup.exe"
Thu 15 May 2008 88 ..SHR --- "C:\WINDOWS\system32\105CC996E0.sys"
Sun 30 Nov 2008 2,568 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
Fri 2 May 2008 88 ..SHR --- "C:\Documents and Settings\All Users\Dati applicazioni\105CC996E0.sys"
Sun 30 Nov 2008 2,568 A.SH. --- "C:\Documents and Settings\All Users\Dati applicazioni\KGyGaAvL.sys"
Sat 9 Aug 2008 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Thu 1 May 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Fri 25 Apr 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\83bd538cd3d9f07c65b9c9fc3e4b0606\BIT1.tmp"
Mon 24 Nov 2008 2,602 ...HR --- "C:\Documents and Settings\Carmine\Dati applicazioni\SecuROM\UserData\securom_v7_01.bak"
Mon 25 Feb 2008 3,489,792 A..H. --- "C:\Documents and Settings\Carmine\Dati applicazioni\U3\temp\Launchpad Removal.exe"

Finished!

[Chill-Out]

http://www.hwupgrade.it/forum/showpo...1&postcount=10