Need Help

FliffyMagic Topic Starter

Post #1September 26, 2010, 12:53 AM UTC

Hi there, Can you help sort me out? It is becoming increasing clear to me that my machine is now infected, so I would like to send you my latest scan from hijackthis and ask if you may help me identify where & how to fix the issues? Here goes…please see attached…

Attachments:

📎hijackthislog01.txt

oldman960

Post #2September 26, 2010, 4:03 AM UTC

Hi FliffyMagic, welcome to the forum.

To make cleaning this machine easier

Please do not uninstall/install any programs unless asked to
It is more difficult when files/programs are appearing in/disappearing from the logs.
Please do not run any scans other than those requested
Please follow all instructions in the order posted
All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
Do not attach any logs/reports, etc.. unless specifically requested to do so.
If you have problems with or do not understand the instructions, Please ask before continuing.
Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.

Open hijackthis, do a system scan only and checkmark these lines, if present

O17 - HKLM\System\CCS\Services\Tcpip\..\{1200BD5D-759F-4B5B-A572-A95576BBE32A}: NameServer = 93.188.163.67,93.188.166.6
O17 - HKLM\System\CCS\Services\Tcpip\..\{464CB424-5022-4761-B85D-CD1E4C8D7E9A}: NameServer = 93.188.163.67,93.188.166.6
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 93.188.163.67,93.188.166.6
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 93.188.163.67,93.188.166.6
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 93.188.163.67,93.188.166.6

Close ALL other windows/browsers and click Fix Checked. Answer Yes if prompted. Close HJT.

Reboot your computer.

Next

Download OTL to your Desktop

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Click on Minimal Output at the top
Download the following file scan.txt to your Desktop. Click here to download it. You may need to right click on it and select "Save"
Double click inside the Custom Scan box at the bottom
A window will appear saying "Click OK to load a custom scan from a file or Cancel to cancel"
Click the OK button and navigate to the file scan.txt which we just saved to your desktop
Select scan.txt and click Open. Writing will now appear under the Custom Scan box
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan won?t take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic

Please post back with both OTL logs.

Please describe all symptoms you are experiencing.

Thanks

FliffyMagic

Post #3September 26, 2010, 9:11 AM UTC

Thanks OldTimer,

Symptoms: Once navigating to additional web pages in explorer, a short error message pops-up stating that a file can not be found, then immediately aftewards, the second web page popsup with the hijacked url (some dating site called "Wildlife.")

Here are the files;

OTL.Txt

OTL logfile created on: 26/09/2010 10.59.38 - Run 1
OTL by OldTimer - Version 3.2.14.1 Folder = C:\Documents and Settings\Pc\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000410 | Country: Italia | Language: ITA | Date Format: dd/MM/yyyy

503,00 Mb Total Physical Memory | 205,00 Mb Available Physical Memory | 41,00% Memory free
1,00 Gb Paging File | 1,00 Gb Available in Paging File | 71,00% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programmi
Drive C: | 67,22 Gb Total Space | 54,35 Gb Free Space | 80,86% Space Free | Partition Type: NTFS
Drive D: | 7,30 Gb Total Space | 0,42 Gb Free Space | 5,80% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: PC382528461259
Current User Name: Pc
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Pc\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programmi\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programmi\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programmi\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programmi\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Programmi\Panda USB Vaccine\USBVaccine.exe (Panda Security)
PRC - C:\Programmi\File comuni\Panda Security\PavShld\PavPrSrv.exe (Panda Security, S.L.)
PRC - C:\Programmi\File comuni\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
PRC - C:\Programmi\HPQ\IAM\Bin\asghost.exe (Cognizance Corporation)
PRC - C:\WINDOWS\system32\CNAB4RPK.EXE (CANON INC.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Pc\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Programmi\HPQ\IAM\Bin\ItMsg.dll (Cognizance Corporation)
MOD - C:\Programmi\HPQ\IAM\Bin\SFSShell.dll (Cognizance Corporation)
MOD - C:\Programmi\HPQ\IAM\Bin\1040\SFSShell.dll (Cognizance Corporation)
MOD - C:\WINDOWS\system32\msvbvm60.dll (Microsoft Corporation)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\dinput.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\credui.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
MOD - C:\WINDOWS\system32\iphlpapi.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\rtutils.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msvcr70.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (AntiVirScheduler) – C:\Programmi\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (AntiVirService) – C:\Programmi\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (PavPrSrv) – C:\Programmi\File comuni\Panda Security\PavShld\pavprsrv.exe (Panda Security, S.L.)
SRV - (LightScribeService) – C:\Programmi\File comuni\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
SRV - (IDriverT) – C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)

========== Driver Services (SafeList) ==========

DRV - (tifm21) – C:\WINDOWS\System32\drivers\tifm21.sys File not found
DRV - (GTIPCI21) – C:\WINDOWS\System32\DRIVERS\gtipci21.sys File not found
DRV - (avipbb) – C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) – C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (ssmdrv) – C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avgio) – C:\Programmi\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (PavProc) – C:\WINDOWS\system32\drivers\PavProc.sys (Panda Security, S.L.)
DRV - (ONDAusbser6k) – C:\WINDOWS\system32\drivers\ONDAusbser6k.sys (ONDA Incorporated)
DRV - (ONDAusbnmea) – C:\WINDOWS\system32\drivers\ONDAusbnmea.sys (ONDA Incorporated)
DRV - (ONDAusbmdm6k) – C:\WINDOWS\system32\drivers\ONDAusbmdm6k.sys (ONDA Incorporated)
DRV - (ShldDrv) – C:\WINDOWS\system32\drivers\ShlDrv51.sys (Panda Security, S.L.)
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (ATSWPDRV) AuthenTec TruePrint USB Driver (AES2500) – C:\WINDOWS\system32\drivers\atswpdrv.sys (AuthenTec, Inc.)
DRV - (SynTP) – C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (ADIHdAudAddService) – C:\WINDOWS\system32\drivers\ADIHdAud.sys (Analog Devices, Inc.)
DRV - (b57w2k) Broadcom NetLink ™ – C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (bcm4sbxp) – C:\WINDOWS\system32\drivers\bcm4sbxp.sys (Broadcom Corporation)
DRV - (w39n51) Intel® – C:\WINDOWS\system32\drivers\w39n51.sys (Intel® Corporation)
DRV - (BCM43XX) – C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (BTWUSB) – C:\WINDOWS\system32\drivers\btwusb.sys (Broadcom Corporation.)
DRV - (iaStor) – C:\WINDOWS\System32\DRIVERS\iaStor.sys (Intel Corporation)
DRV - (eabusb) – C:\WINDOWS\system32\drivers\EabUsb.sys (Hewlett-Packard Development Company, L.P.)
DRV - (HBtnKey) – C:\WINDOWS\system32\drivers\CPQBttn.sys (Hewlett-Packard Development Company, L.P.)
DRV - (eabfiltr) – C:\WINDOWS\system32\drivers\eabfiltr.sys (Hewlett-Packard Development Company, L.P.)
DRV - (DLAUDFAM) – C:\WINDOWS\system32\DLA\DLAUDFAM.SYS (Sonic Solutions)
DRV - (DLAUDF_M) – C:\WINDOWS\system32\DLA\DLAUDF_M.SYS (Sonic Solutions)
DRV - (DLAIFS_M) – C:\WINDOWS\system32\DLA\DLAIFS_M.SYS (Sonic Solutions)
DRV - (DLABOIOM) – C:\WINDOWS\system32\DLA\DLABOIOM.SYS (Sonic Solutions)
DRV - (DLAOPIOM) – C:\WINDOWS\system32\DLA\DLAOPIOM.SYS (Sonic Solutions)
DRV - (DLAPoolM) – C:\WINDOWS\system32\DLA\DLAPoolM.SYS (Sonic Solutions)
DRV - (DLADResN) – C:\WINDOWS\system32\DLA\DLADResN.SYS (Sonic Solutions)
DRV - (DRVMCDB) – C:\WINDOWS\System32\Drivers\DRVMCDB.SYS (Sonic Solutions)
DRV - (DLACDBHM) – C:\WINDOWS\system32\drivers\DLACDBHM.SYS (Sonic Solutions)
DRV - (DLARTL_N) – C:\WINDOWS\system32\drivers\DLARTL_N.SYS (Sonic Solutions)
DRV - (DRVNDDM) – C:\WINDOWS\system32\drivers\DRVNDDM.SYS (Sonic Solutions)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\Hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (usbaudio) Driver audio USB (WDM) – C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (SMCIRDA) – C:\WINDOWS\system32\drivers\smcirda.sys (SMC)
DRV - (AliIde) – C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

O1 HOSTS File: ([2004/08/19 10.00.00 | 000,000,768 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\DLA\DLASHX_W.DLL (Sonic Solutions)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (HP Credential Manager for ProtectTools) - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Programmi\HPQ\IAM\Bin\ItIeAddIN.dll (Infineon Technologies AG)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O4 - HKLM..\Run: [avgnt] C:\Programmi\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - Startup: C:\Documents and Settings\Pc\Menu Avvio\Programmi\Esecuzione automatica\PandaUSBVaccine.lnk = C:\Programmi\Panda USB Vaccine\USBVaccine.exe (Panda Security)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Cerca con Google - C:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: &Traduci parola in italiano - C:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: E&sporta in Microsoft Excel - C:\Programmi\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Link a ritroso - C:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Pagine simili - C:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Versione cache della pagina - C:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\NPJPI150_06.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab (Symantec RuFSI Utility Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.1.1
O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programmi\File comuni\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programmi\File comuni\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programmi\File comuni\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programmi\File comuni\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\OneCard: DllName - C:\Programmi\HPQ\IAM\Bin\AsWlnPkg.dll - C:\Programmi\HPQ\IAM\Bin\AsWlnPkg.dll (Cognizance Corporation)
O24 - Desktop Components:0 (Pagina iniziale corrente) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Colline.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Colline.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2001/07/28 01.07.00 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ NTFS ]
O32 - Unable to obtain root file information for disk D:\
O33 - MountPoints2\{63221a62-0635-11de-b34a-c49af543bef3}\Shell - "" = AutoRun
O33 - MountPoints2\{63221a62-0635-11de-b34a-c49af543bef3}\Shell\AutoRun\command - "" = F:\AutoRun.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.ac3acm - C:\WINDOWS\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.DIVX - C:\WINDOWS\System32\divx.dll (DivX, Inc.)
Drivers32: VIDC.FPS1 - C:\WINDOWS\System32\frapsvid.dll (Beepa P/L)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.wmv3 - C:\WINDOWS\System32\WMV9VCM.dll (Microsoft Corporation)
Drivers32: VIDC.XVID - C:\WINDOWS\System32\xvidvfw.dll ()

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (76293329439948800)

========== Files/Folders - Created Within 90 Days ==========

[2010/09/26 10.47.32 | 000,575,488 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Pc\Desktop\OTL.exe
[2010/09/26 03.06.40 | 000,000,000 | —D | C] – C:\Programmi\Panda USB Vaccine
[2010/09/26 02.32.21 | 000,000,000 | —D | C] – C:\Programmi\Trend Micro
[2010/09/26 02.17.25 | 000,000,000 | —D | C] – C:\WINDOWS\System32\NtmsData
[2010/09/26 02.16.28 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Dati applicazioni\Avira
[2010/09/26 02.09.57 | 000,028,520 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\ssmdrv.sys
[2010/09/26 02.09.56 | 000,126,856 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\avipbb.sys
[2010/09/26 02.09.56 | 000,060,936 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\avgntflt.sys
[2010/09/26 02.09.56 | 000,045,416 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\avgntdd.sys
[2010/09/26 02.09.56 | 000,022,360 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\avgntmgr.sys
[2010/09/26 02.09.56 | 000,000,000 | —D | C] – C:\Programmi\Avira
[2010/09/26 02.09.56 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Dati applicazioni\Avira
[2010/09/26 01.43.24 | 000,041,144 | —- | C] (Panda Security, S.L.) – C:\WINDOWS\System32\drivers\ShlDrv51.sys
[2010/09/26 01.43.23 | 000,163,336 | —- | C] (Panda Security, S.L.) – C:\WINDOWS\System32\drivers\PavProc.sys
[2010/09/26 01.40.47 | 000,000,000 | —D | C] – C:\Programmi\File comuni\Panda Security
[2010/09/26 00.58.07 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Dati applicazioni\ss_dtx_tb
[2010/09/25 23.55.23 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Dati applicazioni\Panda Security
[2010/09/25 23.53.43 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Dati applicazioni\Panda Security
[2010/09/25 23.42.40 | 000,000,000 | —D | C] – C:\Programmi\Panda Security
[2010/09/19 12.34.00 | 000,000,000 | —D | C] – C:\Programmi\MSECache
[2010/09/16 07.43.35 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Pc\IECompatCache
[2010/09/15 20.08.27 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Pc\PrivacIE
[2010/09/15 20.06.31 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Pc\IETldCache
[2010/09/15 20.04.43 | 000,000,000 | —D | C] – C:\WINDOWS\WBEM
[2010/09/15 20.04.20 | 000,000,000 | -H-D | C] – C:\WINDOWS\ie8
[2010/09/15 20.04.20 | 000,000,000 | —D | C] – C:\WINDOWS\System32\it-IT
[2010/09/12 17.01.28 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Desktop\WIP
[2010/09/12 17.00.01 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Desktop\Project Viewpoint
[2010/09/12 16.55.33 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Desktop\LiftLoft
[2010/09/09 18.02.37 | 000,000,000 | —D | C] – C:\Fraps
[2010/09/09 13.10.37 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Dati applicazioni\Apple Computer
[2010/09/09 13.09.44 | 000,000,000 | —D | C] – C:\Programmi\QuickTime
[2010/09/09 13.09.43 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Dati applicazioni\Apple Computer
[2010/09/09 13.09.27 | 000,000,000 | —D | C] – C:\Programmi\File comuni\Apple
[2010/09/09 13.09.21 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\Apple
[2010/09/09 13.09.19 | 000,000,000 | —D | C] – C:\Programmi\Apple Software Update
[2010/09/09 13.09.19 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Dati applicazioni\Apple
[2010/09/09 13.08.54 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\Apple Computer
[2010/09/07 07.36.47 | 000,000,000 | R–D | C] – C:\Documents and Settings\Pc\Documenti\Video
[2010/09/07 07.36.47 | 000,000,000 | R–D | C] – C:\Documents and Settings\All Users\Documenti\Video
[2010/09/06 22.56.55 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Dati applicazioni\WinRAR
[2010/09/06 15.43.52 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Dati applicazioni\skypePM
[2010/09/06 15.42.24 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Dati applicazioni\Skype
[2010/09/06 15.42.05 | 000,000,000 | —D | C] – C:\Programmi\File comuni\Skype
[2010/09/06 15.42.02 | 000,000,000 | R–D | C] – C:\Programmi\Skype
[2010/09/06 15.41.59 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Dati applicazioni\Skype
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/09/26 10.47.36 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Pc\Desktop\OTL.exe
[2010/09/26 10.40.55 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/09/26 10.40.51 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/09/26 10.40.49 | 527,880,192 | -HS- | M] () – C:\hiberfil.sys
[2010/09/26 10.40.16 | 003,145,728 | -H– | M] () – C:\Documents and Settings\Pc\NTUSER.DAT
[2010/09/26 10.40.12 | 000,000,194 | -HS- | M] () – C:\Documents and Settings\Pc\ntuser.ini
[2010/09/26 05.05.14 | 000,001,697 | —- | M] () – C:\Documents and Settings\Pc\Desktop\Profilo di Avira AntiVir Personal Hard Disk locali.LNK
[2010/09/26 03.06.41 | 000,000,789 | —- | M] () – C:\Documents and Settings\Pc\Menu Avvio\Programmi\Esecuzione automatica\PandaUSBVaccine.lnk
[2010/09/26 02.32.21 | 000,001,698 | —- | M] () – C:\Documents and Settings\Pc\Desktop\HijackThis.lnk
[2010/09/25 13.32.54 | 000,018,141 | —- | M] () – C:\Documents and Settings\Pc\Desktop\tossL.JPG
[2010/09/25 10.01.44 | 000,095,995 | —- | M] () – C:\Documents and Settings\Pc\Desktop\team in svizzera.jpg
[2010/09/25 09.59.40 | 000,040,443 | —- | M] () – C:\Documents and Settings\Pc\Desktop\trophy.jpg
[2010/09/25 08.45.56 | 000,002,241 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2010/09/19 12.37.12 | 000,151,584 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/09/16 21.39.43 | 000,071,693 | —- | M] () – C:\Documents and Settings\Pc\Desktop\andy_pandy_5.jpg
[2010/09/16 21.33.57 | 000,124,367 | —- | M] () – C:\Documents and Settings\Pc\Desktop\bear-t17682.jpg
[2010/09/16 19.30.51 | 000,024,576 | —- | M] () – C:\Documents and Settings\Pc\Desktop\Benvenuto in topbonus_Lara.doc
[2010/09/16 18.41.59 | 000,327,160 | —- | M] () – C:\Documents and Settings\Pc\Desktop\refertoS00002E9CL_16Sett2010.pdf
[2010/09/15 15.02.31 | 000,000,049 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2010/09/13 15.52.36 | 006,801,188 | —- | M] () – C:\Documents and Settings\Pc\Desktop\attachments_13_09_2010.zip
[2010/09/11 20.12.14 | 010,043,951 | —- | M] () – C:\Documents and Settings\Pc\Desktop\1008digitale.pdf
[2010/09/09 18.02.38 | 000,000,478 | —- | M] () – C:\Documents and Settings\Pc\Desktop\Fraps.lnk
[2010/09/09 13.10.36 | 000,024,800 | —- | M] () – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
[2010/09/09 13.09.56 | 000,001,584 | —- | M] () – C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2010/09/09 11.29.02 | 000,426,042 | —- | M] () – C:\WINDOWS\System32\perfh010.dat
[2010/09/09 11.29.02 | 000,380,684 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/09/09 11.29.02 | 000,063,600 | —- | M] () – C:\WINDOWS\System32\perfc010.dat
[2010/09/09 11.29.02 | 000,053,098 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/09/09 11.29.01 | 000,931,806 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/09/08 13.47.30 | 000,024,800 | —- | M] () – C:\Documents and Settings\Pc\Dati applicazioni\GDIPFONTCACHEV1.DAT
[2010/09/07 14.38.32 | 000,403,828 | —- | M] () – C:\Documents and Settings\Pc\Desktop\Foot.jpeg
[2010/09/07 14.38.26 | 000,238,809 | —- | M] () – C:\Documents and Settings\Pc\Desktop\NoseandLips(front).png
[2010/09/07 12.34.22 | 000,503,405 | —- | M] () – C:\Documents and Settings\Pc\Desktop\Schermata 2010-09-07 a 12.33.13.png
[2010/09/06 21.21.11 | 000,000,366 | —- | M] () – C:\Documents and Settings\Pc\Desktop\Collegamento a Connessione rete senza fili.lnk
[2010/09/06 15.43.54 | 000,000,056 | -H– | M] () – C:\WINDOWS\System32\ezsidmv.dat
[2010/09/05 22.56.57 | 000,002,397 | —- | M] () – C:\Documents and Settings\Pc\Desktop\AutoRoute.lnk
[2010/09/05 22.56.50 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/09/01 14.22.25 | 000,126,856 | —- | M] (Avira GmbH) – C:\WINDOWS\System32\drivers\avipbb.sys
[2010/09/01 14.22.25 | 000,060,936 | —- | M] (Avira GmbH) – C:\WINDOWS\System32\drivers\avgntflt.sys
[2010/08/04 20.15.23 | 000,056,832 | —- | M] () – C:\Documents and Settings\Pc\Documenti\Inventario materiale di produzione_08_07_10_MW.xls
[2010/07/04 19.54.15 | 000,016,384 | —- | M] () – C:\Documents and Settings\Pc\Documenti\INDIRIZZO X BUSTA.xls
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/09/26 05.05.14 | 000,001,697 | —- | C] () – C:\Documents and Settings\Pc\Desktop\Profilo di Avira AntiVir Personal Hard Disk locali.LNK
[2010/09/26 03.06.41 | 000,000,789 | —- | C] () – C:\Documents and Settings\Pc\Menu Avvio\Programmi\Esecuzione automatica\PandaUSBVaccine.lnk
[2010/09/26 02.32.21 | 000,001,698 | —- | C] () – C:\Documents and Settings\Pc\Desktop\HijackThis.lnk
[2010/09/25 13.30.17 | 000,018,141 | —- | C] () – C:\Documents and Settings\Pc\Desktop\tossL.JPG
[2010/09/25 10.03.30 | 000,040,443 | —- | C] () – C:\Documents and Settings\Pc\Desktop\trophy.jpg
[2010/09/25 10.02.11 | 000,095,995 | —- | C] () – C:\Documents and Settings\Pc\Desktop\team in svizzera.jpg
[2010/09/16 21.39.51 | 000,071,693 | —- | C] () – C:\Documents and Settings\Pc\Desktop\andy_pandy_5.jpg
[2010/09/16 21.34.19 | 000,124,367 | —- | C] () – C:\Documents and Settings\Pc\Desktop\bear-t17682.jpg
[2010/09/16 19.30.51 | 000,024,576 | —- | C] () – C:\Documents and Settings\Pc\Desktop\Benvenuto in topbonus_Lara.doc
[2010/09/16 18.41.58 | 000,327,160 | —- | C] () – C:\Documents and Settings\Pc\Desktop\refertoS00002E9CL_16Sett2010.pdf
[2010/09/13 15.52.24 | 006,801,188 | —- | C] () – C:\Documents and Settings\Pc\Desktop\attachments_13_09_2010.zip
[2010/09/11 20.12.14 | 010,043,951 | —- | C] () – C:\Documents and Settings\Pc\Desktop\1008digitale.pdf
[2010/09/09 18.02.38 | 000,000,478 | —- | C] () – C:\Documents and Settings\Pc\Desktop\Fraps.lnk
[2010/09/09 13.09.56 | 000,001,584 | —- | C] () – C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2010/09/07 14.38.13 | 000,403,828 | —- | C] () – C:\Documents and Settings\Pc\Desktop\Foot.jpeg
[2010/09/07 14.38.09 | 000,238,809 | —- | C] () – C:\Documents and Settings\Pc\Desktop\NoseandLips(front).png
[2010/09/07 12.34.04 | 000,503,405 | —- | C] () – C:\Documents and Settings\Pc\Desktop\Schermata 2010-09-07 a 12.33.13.png
[2010/09/06 21.21.11 | 000,000,366 | —- | C] () – C:\Documents and Settings\Pc\Desktop\Collegamento a Connessione rete senza fili.lnk
[2010/09/06 15.43.54 | 000,000,056 | -H– | C] () – C:\WINDOWS\System32\ezsidmv.dat
[2010/09/06 15.42.05 | 000,002,241 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2010/08/04 20.15.23 | 000,056,832 | —- | C] () – C:\Documents and Settings\Pc\Documenti\Inventario materiale di produzione_08_07_10_MW.xls
[2010/01/08 23.50.09 | 000,000,049 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2009/05/30 10.36.47 | 000,007,680 | —- | C] () – C:\WINDOWS\System32\CNMVS61.DLL
[2009/03/01 12.23.25 | 000,000,000 | —- | C] () – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\FnF4.txt
[2009/03/01 10.18.28 | 003,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2009/03/01 10.18.28 | 001,138,688 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2009/03/01 10.18.28 | 000,200,704 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2009/03/01 10.18.26 | 000,019,968 | —- | C] () – C:\WINDOWS\System32\cpuinf32.dll
[2009/02/28 19.37.59 | 000,000,424 | —- | C] () – C:\WINDOWS\ODBC.INI
[2009/02/28 19.03.59 | 000,204,800 | —- | C] () – C:\WINDOWS\System32\IVIresizeW7.dll
[2009/02/28 19.03.59 | 000,200,704 | —- | C] () – C:\WINDOWS\System32\IVIresizeA6.dll
[2009/02/28 19.03.59 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeP6.dll
[2009/02/28 19.03.59 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeM6.dll
[2009/02/28 19.03.59 | 000,188,416 | —- | C] () – C:\WINDOWS\System32\IVIresizePX.dll
[2009/02/28 19.03.58 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\IVIresize.dll
[2009/02/28 19.02.58 | 000,000,141 | —- | C] () – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\fusioncache.dat
[2009/02/28 19.02.58 | 000,000,000 | —- | C] () – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\QSwitch.txt
[2009/02/28 19.02.58 | 000,000,000 | —- | C] () – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\DSwitch.txt
[2009/02/28 19.02.58 | 000,000,000 | —- | C] () – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\AtStart.txt
[2006/08/23 07.04.30 | 000,000,175 | —- | C] () – C:\WINDOWS\wininit.ini
[2006/08/23 07.03.06 | 000,029,888 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2005/12/01 21.11.40 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2004/08/30 13.26.38 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2004/08/30 13.19.50 | 000,000,825 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/08/19 10.00.00 | 000,027,440 | —- | C] () – C:\WINDOWS\System32\drivers\secdrv.sys
[2004/06/01 11.39.56 | 000,094,274 | —- | C] () – C:\WINDOWS\System32\HPBHEALR.DLL
[1998/05/07 04.10.00 | 000,069,632 | —- | C] () – C:\WINDOWS\System32\ODMA32.dll

========== LOP Check ==========

[2010/09/25 23.53.43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Dati applicazioni\Panda Security
[2009/06/22 23.16.30 | 000,000,000 | —D | M] – C:\Documents and Settings\Pc\Dati applicazioni\Faykh
[2010/09/26 02.13.38 | 000,000,000 | —D | M] – C:\Documents and Settings\Pc\Dati applicazioni\Ilza
[2009/03/01 12.02.43 | 000,000,000 | —D | M] – C:\Documents and Settings\Pc\Dati applicazioni\InterVideo
[2010/01/25 22.09.58 | 000,000,000 | —D | M] – C:\Documents and Settings\Pc\Dati applicazioni\Leadertech
[2010/09/25 23.55.23 | 000,000,000 | —D | M] – C:\Documents and Settings\Pc\Dati applicazioni\Panda Security
[2006/08/23 17.17.05 | 000,000,000 | —D | M] – C:\Documents and Settings\Pc\Dati applicazioni\SampleView
[2010/09/26 00.58.07 | 000,000,000 | —D | M] – C:\Documents and Settings\Pc\Dati applicazioni\ss_dtx_tb
[2010/09/26 02.04.45 | 000,000,000 | —D | M] – C:\Documents and Settings\Pc\Dati applicazioni\Uxfek
[2010/09/26 03.01.04 | 000,000,000 | —D | M] – C:\Documents and Settings\Pc\Dati applicazioni\Ymyfup

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2009/03/05 19.49.01 | 000,000,211 | RHS- | M] () – C:\boot.ini
[1999/04/13 01.12.26 | 000,000,512 | —- | M] () – C:\Boot32.w2k
[2004/08/19 10.00.00 | 000,004,952 | RHS- | M] () – C:\Bootfont.bin
[1998/10/05 17.32.06 | 000,000,512 | —- | M] () – C:\bootsec
[1999/04/07 04.34.04 | 000,001,536 | —- | M] () – C:\BOOTSEC.32
[2010/09/26 10.40.49 | 527,880,192 | -HS- | M] () – C:\hiberfil.sys
[2004/08/19 10.00.00 | 000,047,564 | -HS- | M] () – C:\NTDETECT.COM
[2004/08/19 10.00.00 | 000,251,072 | -HS- | M] () – C:\NTLDR
[2010/09/26 10.40.48 | 792,723,456 | -HS- | M] () – C:\pagefile.sys

< %systemroot%\Fonts\*.com >

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2004/08/30 13.07.18 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2004/06/15 06.00.00 | 000,017,920 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPD61.DLL
[2004/06/15 06.00.00 | 000,054,272 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPP61.DLL
[2004/06/01 14.55.56 | 000,061,952 | —- | M] (Hewlett-Packard Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp35z.dll
[2004/07/23 02.00.00 | 000,026,112 | —- | M] (PortableAppZ.blogspot.com) – C:\WINDOWS\system32\spool\prtprocs\w32x86\xkUOCEI3.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2004/08/30 14.54.42 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2004/08/30 14.54.42 | 000,638,976 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2004/08/30 14.54.42 | 000,434,176 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/02/28 19.04.49 | 000,000,123 | -HS- | M] () – C:\Documents and Settings\Pc\Dati applicazioni\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2010/09/26 10.47.36 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Pc\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2010/09/26 00.51.18 | 000,000,067 | -HS- | M] () – C:\Documents and Settings\Pc\Cookies\desktop.ini
[2010/09/26 10.58.20 | 000,229,376 | —- | M] () – C:\Documents and Settings\Pc\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2004/08/11 21.28.54 | 000,192,512 | —- | M] (Microsoft Corporation) – C:\WINDOWS\inf\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.exe >
[2004/10/13 18.24.37 | 001,694,208 | —- | M] (Microsoft Corporation) – C:\Programmi\Messenger\msmsgs.exe

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< %USERPROFILE%\Templates\*.tmp >

< %SYSTEMDRIVE%\explorexxx.exe\*.* >

< %Windir%\Installer\*.tmp >

< %systemroot%\System32\*.xco >

< %ProgramFiles%\system32\*.* >

< %systemroot%\System32\windos\*.* >

< %SystemRoot%\system32\sandbox\*.* >

< %SystemRoot%\system32\*.amo >

< %SystemRoot%\system32\Windows Live\*.* >

< %ProgramFiles%\logs\*.* >

< %ProgramFiles%\Bifrost\*.* >

< %SystemRoot%\system32\*.goo >

< %systemroot%\system32\IME\*.* >

< %systemroot%\BackUp\*.* >

< %systemroot%\system32\*.ico >

< %systemroot%\system\*.dat >

< %systemroot%\system\*.exe >

< %AppData%\Macromedia\Common\*.* >

< %SYSTEMDRIVE%\dir\*.* /s >

< %systemroot%\system32\ras\*.exe >

< %SYSTEMDRIVE%\MFILES\*.* >

< %SYSTEMDRIVE%\mDNSRespon.exe\*.* >

< %systemroot%\system32\services\*.* >

< %systemroot%\Spooler\*.* >

< %ProgramFiles%\system32\*.* >

< %systemroot%\system32\Setup\*.dll /x >

< %systemroot%\system32\*.mine >

< %SYSTEMDRIVE%\cleansweep.exe\*.* >

< %systemroot%\system32\ras\*.dll >

< %systemroot%\system32\ras\*.drv >

< %systemroot%\*.iq >

< %systemroot%\system32\XP\*.* >

< %SYSTEMDRIVE%\Extracted\*.* >

< %systemroot%\system32\windows\*.* >

< %systemroot%\logs\*.* >

< %SYSTEMDRIVE%\Win.Msi\*.* >

< %systemroot%\regedit\*.* >

< %systemroot%\system32\skype\*.* >

< %AppData%\Adobe\dlluplwin25\*.* >

< %UserProfile%\*.dat >
[2010/09/26 10.40.16 | 003,145,728 | -H– | M] () – C:\Documents and Settings\Pc\NTUSER.DAT

< %UserProfile%\*.dll >

< %systemroot%\system32\*.sxo >

< %SYSTEMDRIVE%\Gazma\*.* /s >

< %systemroot%\system32\spynet\*.* >

< %systemroot%\system32\System\*.* >

< %appdata%\Microsoft\Windows\*.* >

< %systemroot%\system32\WinDir\*.* >

< %systemroot%\_\*.* >

< %systemroot%\system32\windows32\*.* >

< %ProgramFiles%\win\*.* >

< %AppData%\Microsoft\CD Burning\*.* >

< %systemroot%\*.cab >

< %systemroot%\K.Backup\*.* >

< %ProgramFiles%\Massenger\*.* >

< %systemroot%\System32\*.doc >

< %systemroot%\Office12\*.* >

< %systemroot%\System32\Rundl32.exe\*.* >

< %ProgramFiles%\yahoo.net\*.* >

< %systemroot%\system32\*.igo >

< %systemroot%\*.rew >

< %systemroot%\System32\spool\DRIVERS\W32X86\3\*.exe >
[2005/03/27 17.00.00 | 000,045,056 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CNAB4LAK.EXE
[2005/03/27 17.00.00 | 000,057,344 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CNAB4RPK.EXE
[2005/03/27 17.00.00 | 000,409,600 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CNAB4SWK.EXE
[2005/03/27 17.00.00 | 000,372,736 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CNAB4UN.EXE
[2004/06/15 06.00.00 | 000,080,896 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMPV61.EXE
[2004/06/15 06.00.00 | 000,008,704 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSD61.EXE
[2004/06/15 06.00.00 | 000,130,048 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSM61.EXE
[2004/06/15 06.00.00 | 000,006,656 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSQ61.EXE
[2004/11/04 21.07.00 | 000,524,288 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CPC10DA4.EXE
[2004/11/04 21.07.00 | 000,880,640 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CPC10QA4.EXE
[2004/11/04 21.07.00 | 000,450,560 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CPC10VA4.EXE
[2004/06/01 11.42.42 | 000,073,728 | —- | M] (Hewlett-Packard Company) – C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
[2004/06/01 11.42.44 | 000,077,824 | —- | M] (Hewlett-Packard Company) – C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
[2004/06/01 11.42.32 | 000,061,440 | —- | M] (Hewlett-Packard) – C:\WINDOWS\system32\spool\drivers\w32x86\3\HPNRA.EXE
[2004/06/01 11.42.34 | 000,061,699 | —- | M] (HP) – C:\WINDOWS\system32\spool\drivers\w32x86\3\HPZINW12.EXE
[2004/06/01 11.42.36 | 000,065,536 | —- | M] (HP) – C:\WINDOWS\system32\spool\drivers\w32x86\3\HPZIPM12.EXE

< %USERPROFILE%\.COMMgr\*.* >

< %USERPROFILE%\Desktop\*.bat >

< %PROGRAMFILES%\Common Files\Real\visualizations\*.* >

< %PROGRAMFILES%\Internet Explorer\*.Jmp >

< %PROGRAMFILES%\Windows NT\system\*.dll >

< %systemroot%\system32\*.ext >

< %systemroot%\system32\Com\*.cfg >

< %systemroot%\system32\btz\*.* >

< %systemroot%\system32\EMP\*.* >

< %systemroot%\system32\expo\*.* >

< %systemroot%\system32\inet2\*.* >

< %systemroot%\system32\xrem\*.* >

< %ProgramFiles%\Microsoft\*.* >

< %systemroot%\usgwmt\*.* >

< %ProgramFiles%\B\*.* >

< %SYSTEMDRIVE%\lspp\*.* >

< %systemroot%\Kral\*.* >

< %SYSTEMDRIVE%\windowsdvd.exe\*.* >

< %systemroot%\system32\*.ipo >

< %SYSTEMDRIVE%\usxxxxxxxx.exe\*.* >

< %systemroot%\system32\*.mof >

< %systemroot%\*.atm >

< %systemroot%\system32\svhost\*.* >

< %ProgramFiles%\system32\*.* >

< %ProgramFiles%\Docmentt\*.* >

< %systemroot%\Help\*.vbs >

< %ProgramFiles%\Windows WinSxs\*.* /s >

< %ProgramFiles%\Outlook Express\IDT\*.* /s >

< %ProgramFiles%\Microsoft Office\365\*.* /s >

< %ProgramFiles%\Windows Live\*.* >

< %systemroot%\system32\win32\*.* >

< %SYSTEMDRIVE%\RECYCLER\*.* >

< %systemroot%\Fresh1\*.* >

< %ProgramFiles%\Kekj\*.* /s >

< %systemroot%\GDU\*.* >

< %systemroot%\KA\*.* >

< %systemroot%\R\*.* >

< %systemroot%\system32\*.fyo >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
< End of report >

Extras.Txt

OTL Extras logfile created on: 26/09/2010 10.59.38 - Run 1
OTL by OldTimer - Version 3.2.14.1 Folder = C:\Documents and Settings\Pc\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000410 | Country: Italia | Language: ITA | Date Format: dd/MM/yyyy

503,00 Mb Total Physical Memory | 205,00 Mb Available Physical Memory | 41,00% Memory free
1,00 Gb Paging File | 1,00 Gb Available in Paging File | 71,00% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programmi
Drive C: | 67,22 Gb Total Space | 54,35 Gb Free Space | 80,86% Space Free | Partition Type: NTFS
Drive D: | 7,30 Gb Total Space | 0,42 Gb Free Space | 5,80% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: PC382528461259
Current User Name: Pc
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "C:\Programmi\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Programmi\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 1
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\SMINST\Scheduler.exe" = C:\WINDOWS\SMINST\Scheduler.exe:*:Enabled:Scheduler – ()
"C:\WINDOWS\system32\CNAB4RPK.EXE" = C:\WINDOWS\system32\CNAB4RPK.EXE:*:Enabled:Canon LBP2900 RPC Server Process – (CANON INC.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{075473F5-846A-448B-BCB3-104AA1760205}" = Sonic Data Module
"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Sonic DLA
"{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}" = Google Earth
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{21657574-BD54-48A2-9450-EB03B2C7FC29}" = Sonic MyDVD Plus
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.00 H1
"{350C9410-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3F9F7336-6DF8-476F-ABF6-C70A17FAF619}" = Installer HP Backup and Recovery Manager
"{4302B2DD-D958-40E3-BAF3-B07FFE1978CE}" = HP Wireless Assistant 2.00 E1
"{48CF6549-B45D-4313-9927-EFCCC8A3493F}" = TIPCI
"{559AD08F-3474-4F96-B374-A59F2A1E2518}" = MH505UP Onda Wizard
"{55A41219-9B22-4098-BAE7-AE289B3C569A}_is1" = Panda USB Vaccine 1.0.1.4
"{5D97A4A7-C274-4B63-86D9-07A33435F505}" = InterVideo DVD Check
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Sonic Express Labeler
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{83ED1E80-A1B7-4236-BCF1-AC4A88151A6B}" = Microsoft AutoRoute 2006
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Graphics Media Accelerator Driver
"{90280410-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional con FrontPage
"{914E1AB1-DCA0-4A7D-935F-B58C4B887A2B}" = HP ProtectTools Security Manager 2.00 C3
"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9F7AF7CD-E3D0-4C68-A3BA-C76C359B3AA8}" = LightScribe 1.4.105.1
"{A7AD8CEF-72D7-4FE4-8A14-DDD09DC86074}" = HP Notebook Accessories Product Tour
"{A93944F2-D2D4-4750-BFE7-9A288FEAF2CF}" = Apple Application Support
"{A93C4E94-1005-489D-BEAA-B873C1AA6CFC}" = HP Help and Support
"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Sonic Audio Module
"{AC76BA86-7AD7-1040-7B44-A70500000002}" = Adobe Reader 7.0.5 - Italiano
"{AE052EF7-2640-48D7-8915-69B810D975CB}" = HP BIOS Configuration for ProtectTools 2.00 E1
"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Sonic Copy Module
"{B9F4C05D-E42F-4E9A-A73F-FDD9355319FB}" = HP Credential Manager for ProtectTools
"{BB85ED9C-AFC9-43BD-B8DC-258C3C7DF72E}" = HP Software Update
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{DB0781F5-06D2-49BB-87B5-00F3B834FC3B}" = HP User Guides 0015
"{DB518BA6-CB74-4EB6-9ABD-880B6D6E1F38}" = HpSdpAppCoreApp
"{E0DBC47C-ED3F-4A1B-A929-9A26DAAA14B3}" = Application Installer 4.00.B5
"{EB900AF8-CC61-4E15-871B-98D1EA3E8025}" = QuickTime
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F2D2B58B-B2FD-46D1-8319-DCE564079934}" = Microsoft .NET Framework 1.1 Italian Language Pack
"{F6869CD2-3DB4-476D-A4C7-B3AE7C3ACF7B}" = Windows Media Connect
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Canon LBP2900" = Canon LBP2900
"CANONBJ_Deinstall_CNMCP61.DLL" = Canon PIXMA iP3000
"Fraps" = Fraps
"HijackThis" = HijackThis 2.0.2
"ie8" = Windows Internet Explorer 8
"InstallShield_{48CF6549-B45D-4313-9927-EFCCC8A3493F}" = Texas Instruments PCIxx21/x515/xx12 drivers.
"KLiteCodecPack_is1" = K-Lite Mega Codec Pack 1.60
"Nero - Burning Rom!UninstallKey" = Nero 6
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"WGA" = Windows Genuine Advantage Validation Tool
"Windows Media Connect" = Windows Media Connect
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"WinRAR archiver" = WinRAR gestione archivi

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 25/09/2010 19.59.58 | Computer Name = PC382528461259 | Source = MsiInstaller | ID = 11406
Description = Product: Panda Cloud Antivirus – Error 1406.Could not write value
to key \SOFTWARE\Panda Software\Setup\UIDS. System error . Verify that you have
sufficient access to that key, or contact your support personnel.

Error - 25/09/2010 20.08.30 | Computer Name = PC382528461259 | Source = Application Hang | ID = 1002
Description = Applicazione in stallo iexplore.exe, versione 8.0.6001.18702, modulo
in stallo hungapp, versione 0.0.0.0, indirizzo stallo 0x00000000.

Error - 25/09/2010 20.10.41 | Computer Name = PC382528461259 | Source = crypt32 | ID = 131080
Description = Impossibile eseguire il recupero con aggiornamento automatico del
numero di sequenza dell'elenco principale di altri produttori da: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
a causa del seguente errore: A connection with the server could not be established

Error - 25/09/2010 20.15.44 | Computer Name = PC382528461259 | Source = crypt32 | ID = 131080
Description = Impossibile eseguire il recupero con aggiornamento automatico del
numero di sequenza dell'elenco principale di altri produttori da: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
a causa del seguente errore: A connection with the server could not be established

Error - 25/09/2010 21.00.01 | Computer Name = PC382528461259 | Source = Application Hang | ID = 1002
Description = Applicazione in stallo iexplore.exe, versione 8.0.6001.18702, modulo
in stallo hungapp, versione 0.0.0.0, indirizzo stallo 0x00000000.

Error - 25/09/2010 21.11.46 | Computer Name = PC382528461259 | Source = crypt32 | ID = 131080
Description = Impossibile eseguire il recupero con aggiornamento automatico del
numero di sequenza dell'elenco principale di altri produttori da: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
a causa del seguente errore: A connection with the server could not be established

Error - 25/09/2010 21.15.15 | Computer Name = PC382528461259 | Source = Application Hang | ID = 1002
Description = Applicazione in stallo iexplore.exe, versione 8.0.6001.18702, modulo
in stallo hungapp, versione 0.0.0.0, indirizzo stallo 0x00000000.

Error - 25/09/2010 21.15.19 | Computer Name = PC382528461259 | Source = Application Hang | ID = 1001
Description = Bucket 1180947459 errato.

Error - 25/09/2010 22.59.51 | Computer Name = PC382528461259 | Source = Application Hang | ID = 1002
Description = Applicazione in stallo iexplore.exe, versione 8.0.6001.18702, modulo
in stallo hungapp, versione 0.0.0.0, indirizzo stallo 0x00000000.

Error - 26/09/2010 4.23.54 | Computer Name = PC382528461259 | Source = crypt32 | ID = 131080
Description = Impossibile eseguire il recupero con aggiornamento automatico del
numero di sequenza dell'elenco principale di altri produttori da: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
a causa del seguente errore: A connection with the server could not be established

[ System Events ]
Error - 25/09/2010 18.34.35 | Computer Name = PC382528461259 | Source = Service Control Manager | ID = 7023
Description = Servizio HID Input Service terminato con l'errore: %%2

Error - 25/09/2010 19.39.44 | Computer Name = PC382528461259 | Source = Service Control Manager | ID = 7023
Description = Servizio HID Input Service terminato con l'errore: %%2

Error - 25/09/2010 19.44.41 | Computer Name = PC382528461259 | Source = Service Control Manager | ID = 7023
Description = Servizio HID Input Service terminato con l'errore: %%2

Error - 25/09/2010 20.06.53 | Computer Name = PC382528461259 | Source = SideBySide | ID = 16842784
Description = Impossibile trovare assemblaggio dipendente Microsoft.VC90.CRT e l'ultimo
errore è stato L'assembly a cui si fa riferimento non è installato nel computer.

Error - 25/09/2010 20.06.53 | Computer Name = PC382528461259 | Source = SideBySide | ID = 16842811
Description = Resolve Partial Assembly non riuscito per Microsoft.VC90.CRT. Riferimento
al messaggio di errore: L'assembly a cui si fa riferimento non è installato nel
computer. .

Error - 25/09/2010 20.06.53 | Computer Name = PC382528461259 | Source = SideBySide | ID = 16842811
Description = Generate Activation Context non riuscito per C:\DOCUME~1\Pc\IMPOST~1\Temp\RarSFX2\redist.dll.
Riferimento
al messaggio di errore: Operazione completata. .

Error - 25/09/2010 20.15.11 | Computer Name = PC382528461259 | Source = Service Control Manager | ID = 7023
Description = Servizio HID Input Service terminato con l'errore: %%2

Error - 25/09/2010 21.11.22 | Computer Name = PC382528461259 | Source = Service Control Manager | ID = 7023
Description = Servizio HID Input Service terminato con l'errore: %%2

Error - 26/09/2010 4.23.34 | Computer Name = PC382528461259 | Source = Service Control Manager | ID = 7023
Description = Servizio HID Input Service terminato con l'errore: %%2

Error - 26/09/2010 4.41.03 | Computer Name = PC382528461259 | Source = Service Control Manager | ID = 7023
Description = Servizio HID Input Service terminato con l'errore: %%2

< End of report >

FliffyMagic

Post #4September 26, 2010, 9:12 AM UTC

Thanks OldTimer,

Symptoms: Once navigating to additional web pages in explorer, a short error message pops-up stating that a file can not be found, then immediately aftewards, the second web page popsup with the hijacked url (some dating site called "Wildlife.")

Here are the files;

OTL.Txt

OTL logfile created on: 26/09/2010 10.59.38 - Run 1
OTL by OldTimer - Version 3.2.14.1 Folder = C:\Documents and Settings\Pc\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000410 | Country: Italia | Language: ITA | Date Format: dd/MM/yyyy

503,00 Mb Total Physical Memory | 205,00 Mb Available Physical Memory | 41,00% Memory free
1,00 Gb Paging File | 1,00 Gb Available in Paging File | 71,00% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programmi
Drive C: | 67,22 Gb Total Space | 54,35 Gb Free Space | 80,86% Space Free | Partition Type: NTFS
Drive D: | 7,30 Gb Total Space | 0,42 Gb Free Space | 5,80% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: PC382528461259
Current User Name: Pc
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Pc\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programmi\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programmi\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programmi\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programmi\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Programmi\Panda USB Vaccine\USBVaccine.exe (Panda Security)
PRC - C:\Programmi\File comuni\Panda Security\PavShld\PavPrSrv.exe (Panda Security, S.L.)
PRC - C:\Programmi\File comuni\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
PRC - C:\Programmi\HPQ\IAM\Bin\asghost.exe (Cognizance Corporation)
PRC - C:\WINDOWS\system32\CNAB4RPK.EXE (CANON INC.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Pc\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Programmi\HPQ\IAM\Bin\ItMsg.dll (Cognizance Corporation)
MOD - C:\Programmi\HPQ\IAM\Bin\SFSShell.dll (Cognizance Corporation)
MOD - C:\Programmi\HPQ\IAM\Bin\1040\SFSShell.dll (Cognizance Corporation)
MOD - C:\WINDOWS\system32\msvbvm60.dll (Microsoft Corporation)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\dinput.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\credui.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
MOD - C:\WINDOWS\system32\iphlpapi.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\rtutils.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msvcr70.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (AntiVirScheduler) – C:\Programmi\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (AntiVirService) – C:\Programmi\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (PavPrSrv) – C:\Programmi\File comuni\Panda Security\PavShld\pavprsrv.exe (Panda Security, S.L.)
SRV - (LightScribeService) – C:\Programmi\File comuni\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
SRV - (IDriverT) – C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)

========== Driver Services (SafeList) ==========

DRV - (tifm21) – C:\WINDOWS\System32\drivers\tifm21.sys File not found
DRV - (GTIPCI21) – C:\WINDOWS\System32\DRIVERS\gtipci21.sys File not found
DRV - (avipbb) – C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) – C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (ssmdrv) – C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avgio) – C:\Programmi\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (PavProc) – C:\WINDOWS\system32\drivers\PavProc.sys (Panda Security, S.L.)
DRV - (ONDAusbser6k) – C:\WINDOWS\system32\drivers\ONDAusbser6k.sys (ONDA Incorporated)
DRV - (ONDAusbnmea) – C:\WINDOWS\system32\drivers\ONDAusbnmea.sys (ONDA Incorporated)
DRV - (ONDAusbmdm6k) – C:\WINDOWS\system32\drivers\ONDAusbmdm6k.sys (ONDA Incorporated)
DRV - (ShldDrv) – C:\WINDOWS\system32\drivers\ShlDrv51.sys (Panda Security, S.L.)
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (ATSWPDRV) AuthenTec TruePrint USB Driver (AES2500) – C:\WINDOWS\system32\drivers\atswpdrv.sys (AuthenTec, Inc.)
DRV - (SynTP) – C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (ADIHdAudAddService) – C:\WINDOWS\system32\drivers\ADIHdAud.sys (Analog Devices, Inc.)
DRV - (b57w2k) Broadcom NetLink ™ – C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (bcm4sbxp) – C:\WINDOWS\system32\drivers\bcm4sbxp.sys (Broadcom Corporation)
DRV - (w39n51) Intel® – C:\WINDOWS\system32\drivers\w39n51.sys (Intel® Corporation)
DRV - (BCM43XX) – C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (BTWUSB) – C:\WINDOWS\system32\drivers\btwusb.sys (Broadcom Corporation.)
DRV - (iaStor) – C:\WINDOWS\System32\DRIVERS\iaStor.sys (Intel Corporation)
DRV - (eabusb) – C:\WINDOWS\system32\drivers\EabUsb.sys (Hewlett-Packard Development Company, L.P.)
DRV - (HBtnKey) – C:\WINDOWS\system32\drivers\CPQBttn.sys (Hewlett-Packard Development Company, L.P.)
DRV - (eabfiltr) – C:\WINDOWS\system32\drivers\eabfiltr.sys (Hewlett-Packard Development Company, L.P.)
DRV - (DLAUDFAM) – C:\WINDOWS\system32\DLA\DLAUDFAM.SYS (Sonic Solutions)
DRV - (DLAUDF_M) – C:\WINDOWS\system32\DLA\DLAUDF_M.SYS (Sonic Solutions)
DRV - (DLAIFS_M) – C:\WINDOWS\system32\DLA\DLAIFS_M.SYS (Sonic Solutions)
DRV - (DLABOIOM) – C:\WINDOWS\system32\DLA\DLABOIOM.SYS (Sonic Solutions)
DRV - (DLAOPIOM) – C:\WINDOWS\system32\DLA\DLAOPIOM.SYS (Sonic Solutions)
DRV - (DLAPoolM) – C:\WINDOWS\system32\DLA\DLAPoolM.SYS (Sonic Solutions)
DRV - (DLADResN) – C:\WINDOWS\system32\DLA\DLADResN.SYS (Sonic Solutions)
DRV - (DRVMCDB) – C:\WINDOWS\System32\Drivers\DRVMCDB.SYS (Sonic Solutions)
DRV - (DLACDBHM) – C:\WINDOWS\system32\drivers\DLACDBHM.SYS (Sonic Solutions)
DRV - (DLARTL_N) – C:\WINDOWS\system32\drivers\DLARTL_N.SYS (Sonic Solutions)
DRV - (DRVNDDM) – C:\WINDOWS\system32\drivers\DRVNDDM.SYS (Sonic Solutions)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\Hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (usbaudio) Driver audio USB (WDM) – C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (SMCIRDA) – C:\WINDOWS\system32\drivers\smcirda.sys (SMC)
DRV - (AliIde) – C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

O1 HOSTS File: ([2004/08/19 10.00.00 | 000,000,768 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\DLA\DLASHX_W.DLL (Sonic Solutions)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (HP Credential Manager for ProtectTools) - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Programmi\HPQ\IAM\Bin\ItIeAddIN.dll (Infineon Technologies AG)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O4 - HKLM..\Run: [avgnt] C:\Programmi\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - Startup: C:\Documents and Settings\Pc\Menu Avvio\Programmi\Esecuzione automatica\PandaUSBVaccine.lnk = C:\Programmi\Panda USB Vaccine\USBVaccine.exe (Panda Security)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Cerca con Google - C:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: &Traduci parola in italiano - C:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: E&sporta in Microsoft Excel - C:\Programmi\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Link a ritroso - C:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Pagine simili - C:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Versione cache della pagina - C:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\NPJPI150_06.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab (Symantec RuFSI Utility Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.1.1
O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programmi\File comuni\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programmi\File comuni\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programmi\File comuni\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programmi\File comuni\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\OneCard: DllName - C:\Programmi\HPQ\IAM\Bin\AsWlnPkg.dll - C:\Programmi\HPQ\IAM\Bin\AsWlnPkg.dll (Cognizance Corporation)
O24 - Desktop Components:0 (Pagina iniziale corrente) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Colline.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Colline.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2001/07/28 01.07.00 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ NTFS ]
O32 - Unable to obtain root file information for disk D:\
O33 - MountPoints2\{63221a62-0635-11de-b34a-c49af543bef3}\Shell - "" = AutoRun
O33 - MountPoints2\{63221a62-0635-11de-b34a-c49af543bef3}\Shell\AutoRun\command - "" = F:\AutoRun.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.ac3acm - C:\WINDOWS\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.DIVX - C:\WINDOWS\System32\divx.dll (DivX, Inc.)
Drivers32: VIDC.FPS1 - C:\WINDOWS\System32\frapsvid.dll (Beepa P/L)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.wmv3 - C:\WINDOWS\System32\WMV9VCM.dll (Microsoft Corporation)
Drivers32: VIDC.XVID - C:\WINDOWS\System32\xvidvfw.dll ()

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (76293329439948800)

========== Files/Folders - Created Within 90 Days ==========

[2010/09/26 10.47.32 | 000,575,488 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Pc\Desktop\OTL.exe
[2010/09/26 03.06.40 | 000,000,000 | —D | C] – C:\Programmi\Panda USB Vaccine
[2010/09/26 02.32.21 | 000,000,000 | —D | C] – C:\Programmi\Trend Micro
[2010/09/26 02.17.25 | 000,000,000 | —D | C] – C:\WINDOWS\System32\NtmsData
[2010/09/26 02.16.28 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Dati applicazioni\Avira
[2010/09/26 02.09.57 | 000,028,520 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\ssmdrv.sys
[2010/09/26 02.09.56 | 000,126,856 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\avipbb.sys
[2010/09/26 02.09.56 | 000,060,936 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\avgntflt.sys
[2010/09/26 02.09.56 | 000,045,416 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\avgntdd.sys
[2010/09/26 02.09.56 | 000,022,360 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\avgntmgr.sys
[2010/09/26 02.09.56 | 000,000,000 | —D | C] – C:\Programmi\Avira
[2010/09/26 02.09.56 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Dati applicazioni\Avira
[2010/09/26 01.43.24 | 000,041,144 | —- | C] (Panda Security, S.L.) – C:\WINDOWS\System32\drivers\ShlDrv51.sys
[2010/09/26 01.43.23 | 000,163,336 | —- | C] (Panda Security, S.L.) – C:\WINDOWS\System32\drivers\PavProc.sys
[2010/09/26 01.40.47 | 000,000,000 | —D | C] – C:\Programmi\File comuni\Panda Security
[2010/09/26 00.58.07 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Dati applicazioni\ss_dtx_tb
[2010/09/25 23.55.23 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Dati applicazioni\Panda Security
[2010/09/25 23.53.43 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Dati applicazioni\Panda Security
[2010/09/25 23.42.40 | 000,000,000 | —D | C] – C:\Programmi\Panda Security
[2010/09/19 12.34.00 | 000,000,000 | —D | C] – C:\Programmi\MSECache
[2010/09/16 07.43.35 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Pc\IECompatCache
[2010/09/15 20.08.27 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Pc\PrivacIE
[2010/09/15 20.06.31 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Pc\IETldCache
[2010/09/15 20.04.43 | 000,000,000 | —D | C] – C:\WINDOWS\WBEM
[2010/09/15 20.04.20 | 000,000,000 | -H-D | C] – C:\WINDOWS\ie8
[2010/09/15 20.04.20 | 000,000,000 | —D | C] – C:\WINDOWS\System32\it-IT
[2010/09/12 17.01.28 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Desktop\WIP
[2010/09/12 17.00.01 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Desktop\Project Viewpoint
[2010/09/12 16.55.33 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Desktop\LiftLoft
[2010/09/09 18.02.37 | 000,000,000 | —D | C] – C:\Fraps
[2010/09/09 13.10.37 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Dati applicazioni\Apple Computer
[2010/09/09 13.09.44 | 000,000,000 | —D | C] – C:\Programmi\QuickTime
[2010/09/09 13.09.43 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Dati applicazioni\Apple Computer
[2010/09/09 13.09.27 | 000,000,000 | —D | C] – C:\Programmi\File comuni\Apple
[2010/09/09 13.09.21 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\Apple
[2010/09/09 13.09.19 | 000,000,000 | —D | C] – C:\Programmi\Apple Software Update
[2010/09/09 13.09.19 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Dati applicazioni\Apple
[2010/09/09 13.08.54 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\Apple Computer
[2010/09/07 07.36.47 | 000,000,000 | R–D | C] – C:\Documents and Settings\Pc\Documenti\Video
[2010/09/07 07.36.47 | 000,000,000 | R–D | C] – C:\Documents and Settings\All Users\Documenti\Video
[2010/09/06 22.56.55 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Dati applicazioni\WinRAR
[2010/09/06 15.43.52 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Dati applicazioni\skypePM
[2010/09/06 15.42.24 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Dati applicazioni\Skype
[2010/09/06 15.42.05 | 000,000,000 | —D | C] – C:\Programmi\File comuni\Skype
[2010/09/06 15.42.02 | 000,000,000 | R–D | C] – C:\Programmi\Skype
[2010/09/06 15.41.59 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Dati applicazioni\Skype
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/09/26 10.47.36 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Pc\Desktop\OTL.exe
[2010/09/26 10.40.55 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/09/26 10.40.51 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/09/26 10.40.49 | 527,880,192 | -HS- | M] () – C:\hiberfil.sys
[2010/09/26 10.40.16 | 003,145,728 | -H– | M] () – C:\Documents and Settings\Pc\NTUSER.DAT
[2010/09/26 10.40.12 | 000,000,194 | -HS- | M] () – C:\Documents and Settings\Pc\ntuser.ini
[2010/09/26 05.05.14 | 000,001,697 | —- | M] () – C:\Documents and Settings\Pc\Desktop\Profilo di Avira AntiVir Personal Hard Disk locali.LNK
[2010/09/26 03.06.41 | 000,000,789 | —- | M] () – C:\Documents and Settings\Pc\Menu Avvio\Programmi\Esecuzione automatica\PandaUSBVaccine.lnk
[2010/09/26 02.32.21 | 000,001,698 | —- | M] () – C:\Documents and Settings\Pc\Desktop\HijackThis.lnk
[2010/09/25 13.32.54 | 000,018,141 | —- | M] () – C:\Documents and Settings\Pc\Desktop\tossL.JPG
[2010/09/25 10.01.44 | 000,095,995 | —- | M] () – C:\Documents and Settings\Pc\Desktop\team in svizzera.jpg
[2010/09/25 09.59.40 | 000,040,443 | —- | M] () – C:\Documents and Settings\Pc\Desktop\trophy.jpg
[2010/09/25 08.45.56 | 000,002,241 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2010/09/19 12.37.12 | 000,151,584 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/09/16 21.39.43 | 000,071,693 | —- | M] () – C:\Documents and Settings\Pc\Desktop\andy_pandy_5.jpg
[2010/09/16 21.33.57 | 000,124,367 | —- | M] () – C:\Documents and Settings\Pc\Desktop\bear-t17682.jpg
[2010/09/16 19.30.51 | 000,024,576 | —- | M] () – C:\Documents and Settings\Pc\Desktop\Benvenuto in topbonus_Lara.doc
[2010/09/16 18.41.59 | 000,327,160 | —- | M] () – C:\Documents and Settings\Pc\Desktop\refertoS00002E9CL_16Sett2010.pdf
[2010/09/15 15.02.31 | 000,000,049 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2010/09/13 15.52.36 | 006,801,188 | —- | M] () – C:\Documents and Settings\Pc\Desktop\attachments_13_09_2010.zip
[2010/09/11 20.12.14 | 010,043,951 | —- | M] () – C:\Documents and Settings\Pc\Desktop\1008digitale.pdf
[2010/09/09 18.02.38 | 000,000,478 | —- | M] () – C:\Documents and Settings\Pc\Desktop\Fraps.lnk
[2010/09/09 13.10.36 | 000,024,800 | —- | M] () – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
[2010/09/09 13.09.56 | 000,001,584 | —- | M] () – C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2010/09/09 11.29.02 | 000,426,042 | —- | M] () – C:\WINDOWS\System32\perfh010.dat
[2010/09/09 11.29.02 | 000,380,684 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/09/09 11.29.02 | 000,063,600 | —- | M] () – C:\WINDOWS\System32\perfc010.dat
[2010/09/09 11.29.02 | 000,053,098 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/09/09 11.29.01 | 000,931,806 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/09/08 13.47.30 | 000,024,800 | —- | M] () – C:\Documents and Settings\Pc\Dati applicazioni\GDIPFONTCACHEV1.DAT
[2010/09/07 14.38.32 | 000,403,828 | —- | M] () – C:\Documents and Settings\Pc\Desktop\Foot.jpeg
[2010/09/07 14.38.26 | 000,238,809 | —- | M] () – C:\Documents and Settings\Pc\Desktop\NoseandLips(front).png
[2010/09/07 12.34.22 | 000,503,405 | —- | M] () – C:\Documents and Settings\Pc\Desktop\Schermata 2010-09-07 a 12.33.13.png
[2010/09/06 21.21.11 | 000,000,366 | —- | M] () – C:\Documents and Settings\Pc\Desktop\Collegamento a Connessione rete senza fili.lnk
[2010/09/06 15.43.54 | 000,000,056 | -H– | M] () – C:\WINDOWS\System32\ezsidmv.dat
[2010/09/05 22.56.57 | 000,002,397 | —- | M] () – C:\Documents and Settings\Pc\Desktop\AutoRoute.lnk
[2010/09/05 22.56.50 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/09/01 14.22.25 | 000,126,856 | —- | M] (Avira GmbH) – C:\WINDOWS\System32\drivers\avipbb.sys
[2010/09/01 14.22.25 | 000,060,936 | —- | M] (Avira GmbH) – C:\WINDOWS\System32\drivers\avgntflt.sys
[2010/08/04 20.15.23 | 000,056,832 | —- | M] () – C:\Documents and Settings\Pc\Documenti\Inventario materiale di produzione_08_07_10_MW.xls
[2010/07/04 19.54.15 | 000,016,384 | —- | M] () – C:\Documents and Settings\Pc\Documenti\INDIRIZZO X BUSTA.xls
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/09/26 05.05.14 | 000,001,697 | —- | C] () – C:\Documents and Settings\Pc\Desktop\Profilo di Avira AntiVir Personal Hard Disk locali.LNK
[2010/09/26 03.06.41 | 000,000,789 | —- | C] () – C:\Documents and Settings\Pc\Menu Avvio\Programmi\Esecuzione automatica\PandaUSBVaccine.lnk
[2010/09/26 02.32.21 | 000,001,698 | —- | C] () – C:\Documents and Settings\Pc\Desktop\HijackThis.lnk
[2010/09/25 13.30.17 | 000,018,141 | —- | C] () – C:\Documents and Settings\Pc\Desktop\tossL.JPG
[2010/09/25 10.03.30 | 000,040,443 | —- | C] () – C:\Documents and Settings\Pc\Desktop\trophy.jpg
[2010/09/25 10.02.11 | 000,095,995 | —- | C] () – C:\Documents and Settings\Pc\Desktop\team in svizzera.jpg
[2010/09/16 21.39.51 | 000,071,693 | —- | C] () – C:\Documents and Settings\Pc\Desktop\andy_pandy_5.jpg
[2010/09/16 21.34.19 | 000,124,367 | —- | C] () – C:\Documents and Settings\Pc\Desktop\bear-t17682.jpg
[2010/09/16 19.30.51 | 000,024,576 | —- | C] () – C:\Documents and Settings\Pc\Desktop\Benvenuto in topbonus_Lara.doc
[2010/09/16 18.41.58 | 000,327,160 | —- | C] () – C:\Documents and Settings\Pc\Desktop\refertoS00002E9CL_16Sett2010.pdf
[2010/09/13 15.52.24 | 006,801,188 | —- | C] () – C:\Documents and Settings\Pc\Desktop\attachments_13_09_2010.zip
[2010/09/11 20.12.14 | 010,043,951 | —- | C] () – C:\Documents and Settings\Pc\Desktop\1008digitale.pdf
[2010/09/09 18.02.38 | 000,000,478 | —- | C] () – C:\Documents and Settings\Pc\Desktop\Fraps.lnk
[2010/09/09 13.09.56 | 000,001,584 | —- | C] () – C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2010/09/07 14.38.13 | 000,403,828 | —- | C] () – C:\Documents and Settings\Pc\Desktop\Foot.jpeg
[2010/09/07 14.38.09 | 000,238,809 | —- | C] () – C:\Documents and Settings\Pc\Desktop\NoseandLips(front).png
[2010/09/07 12.34.04 | 000,503,405 | —- | C] () – C:\Documents and Settings\Pc\Desktop\Schermata 2010-09-07 a 12.33.13.png
[2010/09/06 21.21.11 | 000,000,366 | —- | C] () – C:\Documents and Settings\Pc\Desktop\Collegamento a Connessione rete senza fili.lnk
[2010/09/06 15.43.54 | 000,000,056 | -H– | C] () – C:\WINDOWS\System32\ezsidmv.dat
[2010/09/06 15.42.05 | 000,002,241 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2010/08/04 20.15.23 | 000,056,832 | —- | C] () – C:\Documents and Settings\Pc\Documenti\Inventario materiale di produzione_08_07_10_MW.xls
[2010/01/08 23.50.09 | 000,000,049 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2009/05/30 10.36.47 | 000,007,680 | —- | C] () – C:\WINDOWS\System32\CNMVS61.DLL
[2009/03/01 12.23.25 | 000,000,000 | —- | C] () – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\FnF4.txt
[2009/03/01 10.18.28 | 003,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2009/03/01 10.18.28 | 001,138,688 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2009/03/01 10.18.28 | 000,200,704 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2009/03/01 10.18.26 | 000,019,968 | —- | C] () – C:\WINDOWS\System32\cpuinf32.dll
[2009/02/28 19.37.59 | 000,000,424 | —- | C] () – C:\WINDOWS\ODBC.INI
[2009/02/28 19.03.59 | 000,204,800 | —- | C] () – C:\WINDOWS\System32\IVIresizeW7.dll
[2009/02/28 19.03.59 | 000,200,704 | —- | C] () – C:\WINDOWS\System32\IVIresizeA6.dll
[2009/02/28 19.03.59 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeP6.dll
[2009/02/28 19.03.59 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeM6.dll
[2009/02/28 19.03.59 | 000,188,416 | —- | C] () – C:\WINDOWS\System32\IVIresizePX.dll
[2009/02/28 19.03.58 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\IVIresize.dll
[2009/02/28 19.02.58 | 000,000,141 | —- | C] () – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\fusioncache.dat
[2009/02/28 19.02.58 | 000,000,000 | —- | C] () – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\QSwitch.txt
[2009/02/28 19.02.58 | 000,000,000 | —- | C] () – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\DSwitch.txt
[2009/02/28 19.02.58 | 000,000,000 | —- | C] () – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\AtStart.txt
[2006/08/23 07.04.30 | 000,000,175 | —- | C] () – C:\WINDOWS\wininit.ini
[2006/08/23 07.03.06 | 000,029,888 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2005/12/01 21.11.40 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2004/08/30 13.26.38 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2004/08/30 13.19.50 | 000,000,825 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/08/19 10.00.00 | 000,027,440 | —- | C] () – C:\WINDOWS\System32\drivers\secdrv.sys
[2004/06/01 11.39.56 | 000,094,274 | —- | C] () – C:\WINDOWS\System32\HPBHEALR.DLL
[1998/05/07 04.10.00 | 000,069,632 | —- | C] () – C:\WINDOWS\System32\ODMA32.dll

========== LOP Check ==========

[2010/09/25 23.53.43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Dati applicazioni\Panda Security
[2009/06/22 23.16.30 | 000,000,000 | —D | M] – C:\Documents and Settings\Pc\Dati applicazioni\Faykh
[2010/09/26 02.13.38 | 000,000,000 | —D | M] – C:\Documents and Settings\Pc\Dati applicazioni\Ilza
[2009/03/01 12.02.43 | 000,000,000 | —D | M] – C:\Documents and Settings\Pc\Dati applicazioni\InterVideo
[2010/01/25 22.09.58 | 000,000,000 | —D | M] – C:\Documents and Settings\Pc\Dati applicazioni\Leadertech
[2010/09/25 23.55.23 | 000,000,000 | —D | M] – C:\Documents and Settings\Pc\Dati applicazioni\Panda Security
[2006/08/23 17.17.05 | 000,000,000 | —D | M] – C:\Documents and Settings\Pc\Dati applicazioni\SampleView
[2010/09/26 00.58.07 | 000,000,000 | —D | M] – C:\Documents and Settings\Pc\Dati applicazioni\ss_dtx_tb
[2010/09/26 02.04.45 | 000,000,000 | —D | M] – C:\Documents and Settings\Pc\Dati applicazioni\Uxfek
[2010/09/26 03.01.04 | 000,000,000 | —D | M] – C:\Documents and Settings\Pc\Dati applicazioni\Ymyfup

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2009/03/05 19.49.01 | 000,000,211 | RHS- | M] () – C:\boot.ini
[1999/04/13 01.12.26 | 000,000,512 | —- | M] () – C:\Boot32.w2k
[2004/08/19 10.00.00 | 000,004,952 | RHS- | M] () – C:\Bootfont.bin
[1998/10/05 17.32.06 | 000,000,512 | —- | M] () – C:\bootsec
[1999/04/07 04.34.04 | 000,001,536 | —- | M] () – C:\BOOTSEC.32
[2010/09/26 10.40.49 | 527,880,192 | -HS- | M] () – C:\hiberfil.sys
[2004/08/19 10.00.00 | 000,047,564 | -HS- | M] () – C:\NTDETECT.COM
[2004/08/19 10.00.00 | 000,251,072 | -HS- | M] () – C:\NTLDR
[2010/09/26 10.40.48 | 792,723,456 | -HS- | M] () – C:\pagefile.sys

< %systemroot%\Fonts\*.com >

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2004/08/30 13.07.18 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2004/06/15 06.00.00 | 000,017,920 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPD61.DLL
[2004/06/15 06.00.00 | 000,054,272 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPP61.DLL
[2004/06/01 14.55.56 | 000,061,952 | —- | M] (Hewlett-Packard Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp35z.dll
[2004/07/23 02.00.00 | 000,026,112 | —- | M] (PortableAppZ.blogspot.com) – C:\WINDOWS\system32\spool\prtprocs\w32x86\xkUOCEI3.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2004/08/30 14.54.42 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2004/08/30 14.54.42 | 000,638,976 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2004/08/30 14.54.42 | 000,434,176 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/02/28 19.04.49 | 000,000,123 | -HS- | M] () – C:\Documents and Settings\Pc\Dati applicazioni\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2010/09/26 10.47.36 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Pc\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2010/09/26 00.51.18 | 000,000,067 | -HS- | M] () – C:\Documents and Settings\Pc\Cookies\desktop.ini
[2010/09/26 10.58.20 | 000,229,376 | —- | M] () – C:\Documents and Settings\Pc\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2004/08/11 21.28.54 | 000,192,512 | —- | M] (Microsoft Corporation) – C:\WINDOWS\inf\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.exe >
[2004/10/13 18.24.37 | 001,694,208 | —- | M] (Microsoft Corporation) – C:\Programmi\Messenger\msmsgs.exe

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< %USERPROFILE%\Templates\*.tmp >

< %SYSTEMDRIVE%\explorexxx.exe\*.* >

< %Windir%\Installer\*.tmp >

< %systemroot%\System32\*.xco >

< %ProgramFiles%\system32\*.* >

< %systemroot%\System32\windos\*.* >

< %SystemRoot%\system32\sandbox\*.* >

< %SystemRoot%\system32\*.amo >

< %SystemRoot%\system32\Windows Live\*.* >

< %ProgramFiles%\logs\*.* >

< %ProgramFiles%\Bifrost\*.* >

< %SystemRoot%\system32\*.goo >

< %systemroot%\system32\IME\*.* >

< %systemroot%\BackUp\*.* >

< %systemroot%\system32\*.ico >

< %systemroot%\system\*.dat >

< %systemroot%\system\*.exe >

< %AppData%\Macromedia\Common\*.* >

< %SYSTEMDRIVE%\dir\*.* /s >

< %systemroot%\system32\ras\*.exe >

< %SYSTEMDRIVE%\MFILES\*.* >

< %SYSTEMDRIVE%\mDNSRespon.exe\*.* >

< %systemroot%\system32\services\*.* >

< %systemroot%\Spooler\*.* >

< %ProgramFiles%\system32\*.* >

< %systemroot%\system32\Setup\*.dll /x >

< %systemroot%\system32\*.mine >

< %SYSTEMDRIVE%\cleansweep.exe\*.* >

< %systemroot%\system32\ras\*.dll >

< %systemroot%\system32\ras\*.drv >

< %systemroot%\*.iq >

< %systemroot%\system32\XP\*.* >

< %SYSTEMDRIVE%\Extracted\*.* >

< %systemroot%\system32\windows\*.* >

< %systemroot%\logs\*.* >

< %SYSTEMDRIVE%\Win.Msi\*.* >

< %systemroot%\regedit\*.* >

< %systemroot%\system32\skype\*.* >

< %AppData%\Adobe\dlluplwin25\*.* >

< %UserProfile%\*.dat >
[2010/09/26 10.40.16 | 003,145,728 | -H– | M] () – C:\Documents and Settings\Pc\NTUSER.DAT

< %UserProfile%\*.dll >

< %systemroot%\system32\*.sxo >

< %SYSTEMDRIVE%\Gazma\*.* /s >

< %systemroot%\system32\spynet\*.* >

< %systemroot%\system32\System\*.* >

< %appdata%\Microsoft\Windows\*.* >

< %systemroot%\system32\WinDir\*.* >

< %systemroot%\_\*.* >

< %systemroot%\system32\windows32\*.* >

< %ProgramFiles%\win\*.* >

< %AppData%\Microsoft\CD Burning\*.* >

< %systemroot%\*.cab >

< %systemroot%\K.Backup\*.* >

< %ProgramFiles%\Massenger\*.* >

< %systemroot%\System32\*.doc >

< %systemroot%\Office12\*.* >

< %systemroot%\System32\Rundl32.exe\*.* >

< %ProgramFiles%\yahoo.net\*.* >

< %systemroot%\system32\*.igo >

< %systemroot%\*.rew >

< %systemroot%\System32\spool\DRIVERS\W32X86\3\*.exe >
[2005/03/27 17.00.00 | 000,045,056 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CNAB4LAK.EXE
[2005/03/27 17.00.00 | 000,057,344 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CNAB4RPK.EXE
[2005/03/27 17.00.00 | 000,409,600 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CNAB4SWK.EXE
[2005/03/27 17.00.00 | 000,372,736 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CNAB4UN.EXE
[2004/06/15 06.00.00 | 000,080,896 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMPV61.EXE
[2004/06/15 06.00.00 | 000,008,704 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSD61.EXE
[2004/06/15 06.00.00 | 000,130,048 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSM61.EXE
[2004/06/15 06.00.00 | 000,006,656 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSQ61.EXE
[2004/11/04 21.07.00 | 000,524,288 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CPC10DA4.EXE
[2004/11/04 21.07.00 | 000,880,640 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CPC10QA4.EXE
[2004/11/04 21.07.00 | 000,450,560 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CPC10VA4.EXE
[2004/06/01 11.42.42 | 000,073,728 | —- | M] (Hewlett-Packard Company) – C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
[2004/06/01 11.42.44 | 000,077,824 | —- | M] (Hewlett-Packard Company) – C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
[2004/06/01 11.42.32 | 000,061,440 | —- | M] (Hewlett-Packard) – C:\WINDOWS\system32\spool\drivers\w32x86\3\HPNRA.EXE
[2004/06/01 11.42.34 | 000,061,699 | —- | M] (HP) – C:\WINDOWS\system32\spool\drivers\w32x86\3\HPZINW12.EXE
[2004/06/01 11.42.36 | 000,065,536 | —- | M] (HP) – C:\WINDOWS\system32\spool\drivers\w32x86\3\HPZIPM12.EXE

< %USERPROFILE%\.COMMgr\*.* >

< %USERPROFILE%\Desktop\*.bat >

< %PROGRAMFILES%\Common Files\Real\visualizations\*.* >

< %PROGRAMFILES%\Internet Explorer\*.Jmp >

< %PROGRAMFILES%\Windows NT\system\*.dll >

< %systemroot%\system32\*.ext >

< %systemroot%\system32\Com\*.cfg >

< %systemroot%\system32\btz\*.* >

< %systemroot%\system32\EMP\*.* >

< %systemroot%\system32\expo\*.* >

< %systemroot%\system32\inet2\*.* >

< %systemroot%\system32\xrem\*.* >

< %ProgramFiles%\Microsoft\*.* >

< %systemroot%\usgwmt\*.* >

< %ProgramFiles%\B\*.* >

< %SYSTEMDRIVE%\lspp\*.* >

< %systemroot%\Kral\*.* >

< %SYSTEMDRIVE%\windowsdvd.exe\*.* >

< %systemroot%\system32\*.ipo >

< %SYSTEMDRIVE%\usxxxxxxxx.exe\*.* >

< %systemroot%\system32\*.mof >

< %systemroot%\*.atm >

< %systemroot%\system32\svhost\*.* >

< %ProgramFiles%\system32\*.* >

< %ProgramFiles%\Docmentt\*.* >

< %systemroot%\Help\*.vbs >

< %ProgramFiles%\Windows WinSxs\*.* /s >

< %ProgramFiles%\Outlook Express\IDT\*.* /s >

< %ProgramFiles%\Microsoft Office\365\*.* /s >

< %ProgramFiles%\Windows Live\*.* >

< %systemroot%\system32\win32\*.* >

< %SYSTEMDRIVE%\RECYCLER\*.* >

< %systemroot%\Fresh1\*.* >

< %ProgramFiles%\Kekj\*.* /s >

< %systemroot%\GDU\*.* >

< %systemroot%\KA\*.* >

< %systemroot%\R\*.* >

< %systemroot%\system32\*.fyo >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
< End of report >

Extras.Txt

OTL Extras logfile created on: 26/09/2010 10.59.38 - Run 1
OTL by OldTimer - Version 3.2.14.1 Folder = C:\Documents and Settings\Pc\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000410 | Country: Italia | Language: ITA | Date Format: dd/MM/yyyy

503,00 Mb Total Physical Memory | 205,00 Mb Available Physical Memory | 41,00% Memory free
1,00 Gb Paging File | 1,00 Gb Available in Paging File | 71,00% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programmi
Drive C: | 67,22 Gb Total Space | 54,35 Gb Free Space | 80,86% Space Free | Partition Type: NTFS
Drive D: | 7,30 Gb Total Space | 0,42 Gb Free Space | 5,80% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: PC382528461259
Current User Name: Pc
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "C:\Programmi\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Programmi\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 1
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\SMINST\Scheduler.exe" = C:\WINDOWS\SMINST\Scheduler.exe:*:Enabled:Scheduler – ()
"C:\WINDOWS\system32\CNAB4RPK.EXE" = C:\WINDOWS\system32\CNAB4RPK.EXE:*:Enabled:Canon LBP2900 RPC Server Process – (CANON INC.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{075473F5-846A-448B-BCB3-104AA1760205}" = Sonic Data Module
"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Sonic DLA
"{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}" = Google Earth
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{21657574-BD54-48A2-9450-EB03B2C7FC29}" = Sonic MyDVD Plus
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.00 H1
"{350C9410-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3F9F7336-6DF8-476F-ABF6-C70A17FAF619}" = Installer HP Backup and Recovery Manager
"{4302B2DD-D958-40E3-BAF3-B07FFE1978CE}" = HP Wireless Assistant 2.00 E1
"{48CF6549-B45D-4313-9927-EFCCC8A3493F}" = TIPCI
"{559AD08F-3474-4F96-B374-A59F2A1E2518}" = MH505UP Onda Wizard
"{55A41219-9B22-4098-BAE7-AE289B3C569A}_is1" = Panda USB Vaccine 1.0.1.4
"{5D97A4A7-C274-4B63-86D9-07A33435F505}" = InterVideo DVD Check
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Sonic Express Labeler
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{83ED1E80-A1B7-4236-BCF1-AC4A88151A6B}" = Microsoft AutoRoute 2006
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Graphics Media Accelerator Driver
"{90280410-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional con FrontPage
"{914E1AB1-DCA0-4A7D-935F-B58C4B887A2B}" = HP ProtectTools Security Manager 2.00 C3
"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9F7AF7CD-E3D0-4C68-A3BA-C76C359B3AA8}" = LightScribe 1.4.105.1
"{A7AD8CEF-72D7-4FE4-8A14-DDD09DC86074}" = HP Notebook Accessories Product Tour
"{A93944F2-D2D4-4750-BFE7-9A288FEAF2CF}" = Apple Application Support
"{A93C4E94-1005-489D-BEAA-B873C1AA6CFC}" = HP Help and Support
"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Sonic Audio Module
"{AC76BA86-7AD7-1040-7B44-A70500000002}" = Adobe Reader 7.0.5 - Italiano
"{AE052EF7-2640-48D7-8915-69B810D975CB}" = HP BIOS Configuration for ProtectTools 2.00 E1
"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Sonic Copy Module
"{B9F4C05D-E42F-4E9A-A73F-FDD9355319FB}" = HP Credential Manager for ProtectTools
"{BB85ED9C-AFC9-43BD-B8DC-258C3C7DF72E}" = HP Software Update
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{DB0781F5-06D2-49BB-87B5-00F3B834FC3B}" = HP User Guides 0015
"{DB518BA6-CB74-4EB6-9ABD-880B6D6E1F38}" = HpSdpAppCoreApp
"{E0DBC47C-ED3F-4A1B-A929-9A26DAAA14B3}" = Application Installer 4.00.B5
"{EB900AF8-CC61-4E15-871B-98D1EA3E8025}" = QuickTime
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F2D2B58B-B2FD-46D1-8319-DCE564079934}" = Microsoft .NET Framework 1.1 Italian Language Pack
"{F6869CD2-3DB4-476D-A4C7-B3AE7C3ACF7B}" = Windows Media Connect
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Canon LBP2900" = Canon LBP2900
"CANONBJ_Deinstall_CNMCP61.DLL" = Canon PIXMA iP3000
"Fraps" = Fraps
"HijackThis" = HijackThis 2.0.2
"ie8" = Windows Internet Explorer 8
"InstallShield_{48CF6549-B45D-4313-9927-EFCCC8A3493F}" = Texas Instruments PCIxx21/x515/xx12 drivers.
"KLiteCodecPack_is1" = K-Lite Mega Codec Pack 1.60
"Nero - Burning Rom!UninstallKey" = Nero 6
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"WGA" = Windows Genuine Advantage Validation Tool
"Windows Media Connect" = Windows Media Connect
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"WinRAR archiver" = WinRAR gestione archivi

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 25/09/2010 19.59.58 | Computer Name = PC382528461259 | Source = MsiInstaller | ID = 11406
Description = Product: Panda Cloud Antivirus – Error 1406.Could not write value
to key \SOFTWARE\Panda Software\Setup\UIDS. System error . Verify that you have
sufficient access to that key, or contact your support personnel.

Error - 25/09/2010 20.08.30 | Computer Name = PC382528461259 | Source = Application Hang | ID = 1002
Description = Applicazione in stallo iexplore.exe, versione 8.0.6001.18702, modulo
in stallo hungapp, versione 0.0.0.0, indirizzo stallo 0x00000000.

Error - 25/09/2010 20.10.41 | Computer Name = PC382528461259 | Source = crypt32 | ID = 131080
Description = Impossibile eseguire il recupero con aggiornamento automatico del
numero di sequenza dell'elenco principale di altri produttori da: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
a causa del seguente errore: A connection with the server could not be established

Error - 25/09/2010 20.15.44 | Computer Name = PC382528461259 | Source = crypt32 | ID = 131080
Description = Impossibile eseguire il recupero con aggiornamento automatico del
numero di sequenza dell'elenco principale di altri produttori da: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
a causa del seguente errore: A connection with the server could not be established

Error - 25/09/2010 21.00.01 | Computer Name = PC382528461259 | Source = Application Hang | ID = 1002
Description = Applicazione in stallo iexplore.exe, versione 8.0.6001.18702, modulo
in stallo hungapp, versione 0.0.0.0, indirizzo stallo 0x00000000.

Error - 25/09/2010 21.11.46 | Computer Name = PC382528461259 | Source = crypt32 | ID = 131080
Description = Impossibile eseguire il recupero con aggiornamento automatico del
numero di sequenza dell'elenco principale di altri produttori da: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
a causa del seguente errore: A connection with the server could not be established

Error - 25/09/2010 21.15.15 | Computer Name = PC382528461259 | Source = Application Hang | ID = 1002
Description = Applicazione in stallo iexplore.exe, versione 8.0.6001.18702, modulo
in stallo hungapp, versione 0.0.0.0, indirizzo stallo 0x00000000.

Error - 25/09/2010 21.15.19 | Computer Name = PC382528461259 | Source = Application Hang | ID = 1001
Description = Bucket 1180947459 errato.

Error - 25/09/2010 22.59.51 | Computer Name = PC382528461259 | Source = Application Hang | ID = 1002
Description = Applicazione in stallo iexplore.exe, versione 8.0.6001.18702, modulo
in stallo hungapp, versione 0.0.0.0, indirizzo stallo 0x00000000.

Error - 26/09/2010 4.23.54 | Computer Name = PC382528461259 | Source = crypt32 | ID = 131080
Description = Impossibile eseguire il recupero con aggiornamento automatico del
numero di sequenza dell'elenco principale di altri produttori da: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
a causa del seguente errore: A connection with the server could not be established

[ System Events ]
Error - 25/09/2010 18.34.35 | Computer Name = PC382528461259 | Source = Service Control Manager | ID = 7023
Description = Servizio HID Input Service terminato con l'errore: %%2

Error - 25/09/2010 19.39.44 | Computer Name = PC382528461259 | Source = Service Control Manager | ID = 7023
Description = Servizio HID Input Service terminato con l'errore: %%2

Error - 25/09/2010 19.44.41 | Computer Name = PC382528461259 | Source = Service Control Manager | ID = 7023
Description = Servizio HID Input Service terminato con l'errore: %%2

Error - 25/09/2010 20.06.53 | Computer Name = PC382528461259 | Source = SideBySide | ID = 16842784
Description = Impossibile trovare assemblaggio dipendente Microsoft.VC90.CRT e l'ultimo
errore è stato L'assembly a cui si fa riferimento non è installato nel computer.

Error - 25/09/2010 20.06.53 | Computer Name = PC382528461259 | Source = SideBySide | ID = 16842811
Description = Resolve Partial Assembly non riuscito per Microsoft.VC90.CRT. Riferimento
al messaggio di errore: L'assembly a cui si fa riferimento non è installato nel
computer. .

Error - 25/09/2010 20.06.53 | Computer Name = PC382528461259 | Source = SideBySide | ID = 16842811
Description = Generate Activation Context non riuscito per C:\DOCUME~1\Pc\IMPOST~1\Temp\RarSFX2\redist.dll.
Riferimento
al messaggio di errore: Operazione completata. .

Error - 25/09/2010 20.15.11 | Computer Name = PC382528461259 | Source = Service Control Manager | ID = 7023
Description = Servizio HID Input Service terminato con l'errore: %%2

Error - 25/09/2010 21.11.22 | Computer Name = PC382528461259 | Source = Service Control Manager | ID = 7023
Description = Servizio HID Input Service terminato con l'errore: %%2

Error - 26/09/2010 4.23.34 | Computer Name = PC382528461259 | Source = Service Control Manager | ID = 7023
Description = Servizio HID Input Service terminato con l'errore: %%2

Error - 26/09/2010 4.41.03 | Computer Name = PC382528461259 | Source = Service Control Manager | ID = 7023
Description = Servizio HID Input Service terminato con l'errore: %%2

< End of report >

FliffyMagic

Post #5September 26, 2010, 9:13 AM UTC

Thanks OldTimer,

Symptoms: Once navigating to additional web pages in explorer, a short error message pops-up stating that a file can not be found, then immediately aftewards, the second web page popsup with the hijacked url (some dating site called "Wildlife.")

Here are the files;

OTL.Txt

OTL logfile created on: 26/09/2010 10.59.38 - Run 1
OTL by OldTimer - Version 3.2.14.1 Folder = C:\Documents and Settings\Pc\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000410 | Country: Italia | Language: ITA | Date Format: dd/MM/yyyy

503,00 Mb Total Physical Memory | 205,00 Mb Available Physical Memory | 41,00% Memory free
1,00 Gb Paging File | 1,00 Gb Available in Paging File | 71,00% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programmi
Drive C: | 67,22 Gb Total Space | 54,35 Gb Free Space | 80,86% Space Free | Partition Type: NTFS
Drive D: | 7,30 Gb Total Space | 0,42 Gb Free Space | 5,80% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: PC382528461259
Current User Name: Pc
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Pc\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programmi\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programmi\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programmi\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programmi\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Programmi\Panda USB Vaccine\USBVaccine.exe (Panda Security)
PRC - C:\Programmi\File comuni\Panda Security\PavShld\PavPrSrv.exe (Panda Security, S.L.)
PRC - C:\Programmi\File comuni\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
PRC - C:\Programmi\HPQ\IAM\Bin\asghost.exe (Cognizance Corporation)
PRC - C:\WINDOWS\system32\CNAB4RPK.EXE (CANON INC.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Pc\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Programmi\HPQ\IAM\Bin\ItMsg.dll (Cognizance Corporation)
MOD - C:\Programmi\HPQ\IAM\Bin\SFSShell.dll (Cognizance Corporation)
MOD - C:\Programmi\HPQ\IAM\Bin\1040\SFSShell.dll (Cognizance Corporation)
MOD - C:\WINDOWS\system32\msvbvm60.dll (Microsoft Corporation)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\dinput.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\credui.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
MOD - C:\WINDOWS\system32\iphlpapi.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\rtutils.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msvcr70.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (AntiVirScheduler) – C:\Programmi\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (AntiVirService) – C:\Programmi\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (PavPrSrv) – C:\Programmi\File comuni\Panda Security\PavShld\pavprsrv.exe (Panda Security, S.L.)
SRV - (LightScribeService) – C:\Programmi\File comuni\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
SRV - (IDriverT) – C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)

========== Driver Services (SafeList) ==========

DRV - (tifm21) – C:\WINDOWS\System32\drivers\tifm21.sys File not found
DRV - (GTIPCI21) – C:\WINDOWS\System32\DRIVERS\gtipci21.sys File not found
DRV - (avipbb) – C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) – C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (ssmdrv) – C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avgio) – C:\Programmi\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (PavProc) – C:\WINDOWS\system32\drivers\PavProc.sys (Panda Security, S.L.)
DRV - (ONDAusbser6k) – C:\WINDOWS\system32\drivers\ONDAusbser6k.sys (ONDA Incorporated)
DRV - (ONDAusbnmea) – C:\WINDOWS\system32\drivers\ONDAusbnmea.sys (ONDA Incorporated)
DRV - (ONDAusbmdm6k) – C:\WINDOWS\system32\drivers\ONDAusbmdm6k.sys (ONDA Incorporated)
DRV - (ShldDrv) – C:\WINDOWS\system32\drivers\ShlDrv51.sys (Panda Security, S.L.)
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (ATSWPDRV) AuthenTec TruePrint USB Driver (AES2500) – C:\WINDOWS\system32\drivers\atswpdrv.sys (AuthenTec, Inc.)
DRV - (SynTP) – C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (ADIHdAudAddService) – C:\WINDOWS\system32\drivers\ADIHdAud.sys (Analog Devices, Inc.)
DRV - (b57w2k) Broadcom NetLink ™ – C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (bcm4sbxp) – C:\WINDOWS\system32\drivers\bcm4sbxp.sys (Broadcom Corporation)
DRV - (w39n51) Intel® – C:\WINDOWS\system32\drivers\w39n51.sys (Intel® Corporation)
DRV - (BCM43XX) – C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (BTWUSB) – C:\WINDOWS\system32\drivers\btwusb.sys (Broadcom Corporation.)
DRV - (iaStor) – C:\WINDOWS\System32\DRIVERS\iaStor.sys (Intel Corporation)
DRV - (eabusb) – C:\WINDOWS\system32\drivers\EabUsb.sys (Hewlett-Packard Development Company, L.P.)
DRV - (HBtnKey) – C:\WINDOWS\system32\drivers\CPQBttn.sys (Hewlett-Packard Development Company, L.P.)
DRV - (eabfiltr) – C:\WINDOWS\system32\drivers\eabfiltr.sys (Hewlett-Packard Development Company, L.P.)
DRV - (DLAUDFAM) – C:\WINDOWS\system32\DLA\DLAUDFAM.SYS (Sonic Solutions)
DRV - (DLAUDF_M) – C:\WINDOWS\system32\DLA\DLAUDF_M.SYS (Sonic Solutions)
DRV - (DLAIFS_M) – C:\WINDOWS\system32\DLA\DLAIFS_M.SYS (Sonic Solutions)
DRV - (DLABOIOM) – C:\WINDOWS\system32\DLA\DLABOIOM.SYS (Sonic Solutions)
DRV - (DLAOPIOM) – C:\WINDOWS\system32\DLA\DLAOPIOM.SYS (Sonic Solutions)
DRV - (DLAPoolM) – C:\WINDOWS\system32\DLA\DLAPoolM.SYS (Sonic Solutions)
DRV - (DLADResN) – C:\WINDOWS\system32\DLA\DLADResN.SYS (Sonic Solutions)
DRV - (DRVMCDB) – C:\WINDOWS\System32\Drivers\DRVMCDB.SYS (Sonic Solutions)
DRV - (DLACDBHM) – C:\WINDOWS\system32\drivers\DLACDBHM.SYS (Sonic Solutions)
DRV - (DLARTL_N) – C:\WINDOWS\system32\drivers\DLARTL_N.SYS (Sonic Solutions)
DRV - (DRVNDDM) – C:\WINDOWS\system32\drivers\DRVNDDM.SYS (Sonic Solutions)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\Hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (usbaudio) Driver audio USB (WDM) – C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (SMCIRDA) – C:\WINDOWS\system32\drivers\smcirda.sys (SMC)
DRV - (AliIde) – C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

O1 HOSTS File: ([2004/08/19 10.00.00 | 000,000,768 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\DLA\DLASHX_W.DLL (Sonic Solutions)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (HP Credential Manager for ProtectTools) - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Programmi\HPQ\IAM\Bin\ItIeAddIN.dll (Infineon Technologies AG)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O4 - HKLM..\Run: [avgnt] C:\Programmi\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - Startup: C:\Documents and Settings\Pc\Menu Avvio\Programmi\Esecuzione automatica\PandaUSBVaccine.lnk = C:\Programmi\Panda USB Vaccine\USBVaccine.exe (Panda Security)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Cerca con Google - C:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: &Traduci parola in italiano - C:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: E&sporta in Microsoft Excel - C:\Programmi\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Link a ritroso - C:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Pagine simili - C:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Versione cache della pagina - C:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\NPJPI150_06.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab (Symantec RuFSI Utility Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.1.1
O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programmi\File comuni\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programmi\File comuni\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programmi\File comuni\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programmi\File comuni\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\OneCard: DllName - C:\Programmi\HPQ\IAM\Bin\AsWlnPkg.dll - C:\Programmi\HPQ\IAM\Bin\AsWlnPkg.dll (Cognizance Corporation)
O24 - Desktop Components:0 (Pagina iniziale corrente) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Colline.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Colline.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2001/07/28 01.07.00 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ NTFS ]
O32 - Unable to obtain root file information for disk D:\
O33 - MountPoints2\{63221a62-0635-11de-b34a-c49af543bef3}\Shell - "" = AutoRun
O33 - MountPoints2\{63221a62-0635-11de-b34a-c49af543bef3}\Shell\AutoRun\command - "" = F:\AutoRun.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.ac3acm - C:\WINDOWS\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.DIVX - C:\WINDOWS\System32\divx.dll (DivX, Inc.)
Drivers32: VIDC.FPS1 - C:\WINDOWS\System32\frapsvid.dll (Beepa P/L)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.wmv3 - C:\WINDOWS\System32\WMV9VCM.dll (Microsoft Corporation)
Drivers32: VIDC.XVID - C:\WINDOWS\System32\xvidvfw.dll ()

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (76293329439948800)

========== Files/Folders - Created Within 90 Days ==========

[2010/09/26 10.47.32 | 000,575,488 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Pc\Desktop\OTL.exe
[2010/09/26 03.06.40 | 000,000,000 | —D | C] – C:\Programmi\Panda USB Vaccine
[2010/09/26 02.32.21 | 000,000,000 | —D | C] – C:\Programmi\Trend Micro
[2010/09/26 02.17.25 | 000,000,000 | —D | C] – C:\WINDOWS\System32\NtmsData
[2010/09/26 02.16.28 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Dati applicazioni\Avira
[2010/09/26 02.09.57 | 000,028,520 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\ssmdrv.sys
[2010/09/26 02.09.56 | 000,126,856 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\avipbb.sys
[2010/09/26 02.09.56 | 000,060,936 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\avgntflt.sys
[2010/09/26 02.09.56 | 000,045,416 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\avgntdd.sys
[2010/09/26 02.09.56 | 000,022,360 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\avgntmgr.sys
[2010/09/26 02.09.56 | 000,000,000 | —D | C] – C:\Programmi\Avira
[2010/09/26 02.09.56 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Dati applicazioni\Avira
[2010/09/26 01.43.24 | 000,041,144 | —- | C] (Panda Security, S.L.) – C:\WINDOWS\System32\drivers\ShlDrv51.sys
[2010/09/26 01.43.23 | 000,163,336 | —- | C] (Panda Security, S.L.) – C:\WINDOWS\System32\drivers\PavProc.sys
[2010/09/26 01.40.47 | 000,000,000 | —D | C] – C:\Programmi\File comuni\Panda Security
[2010/09/26 00.58.07 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Dati applicazioni\ss_dtx_tb
[2010/09/25 23.55.23 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Dati applicazioni\Panda Security
[2010/09/25 23.53.43 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Dati applicazioni\Panda Security
[2010/09/25 23.42.40 | 000,000,000 | —D | C] – C:\Programmi\Panda Security
[2010/09/19 12.34.00 | 000,000,000 | —D | C] – C:\Programmi\MSECache
[2010/09/16 07.43.35 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Pc\IECompatCache
[2010/09/15 20.08.27 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Pc\PrivacIE
[2010/09/15 20.06.31 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Pc\IETldCache
[2010/09/15 20.04.43 | 000,000,000 | —D | C] – C:\WINDOWS\WBEM
[2010/09/15 20.04.20 | 000,000,000 | -H-D | C] – C:\WINDOWS\ie8
[2010/09/15 20.04.20 | 000,000,000 | —D | C] – C:\WINDOWS\System32\it-IT
[2010/09/12 17.01.28 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Desktop\WIP
[2010/09/12 17.00.01 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Desktop\Project Viewpoint
[2010/09/12 16.55.33 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Desktop\LiftLoft
[2010/09/09 18.02.37 | 000,000,000 | —D | C] – C:\Fraps
[2010/09/09 13.10.37 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Dati applicazioni\Apple Computer
[2010/09/09 13.09.44 | 000,000,000 | —D | C] – C:\Programmi\QuickTime
[2010/09/09 13.09.43 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Dati applicazioni\Apple Computer
[2010/09/09 13.09.27 | 000,000,000 | —D | C] – C:\Programmi\File comuni\Apple
[2010/09/09 13.09.21 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\Apple
[2010/09/09 13.09.19 | 000,000,000 | —D | C] – C:\Programmi\Apple Software Update
[2010/09/09 13.09.19 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Dati applicazioni\Apple
[2010/09/09 13.08.54 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\Apple Computer
[2010/09/07 07.36.47 | 000,000,000 | R–D | C] – C:\Documents and Settings\Pc\Documenti\Video
[2010/09/07 07.36.47 | 000,000,000 | R–D | C] – C:\Documents and Settings\All Users\Documenti\Video
[2010/09/06 22.56.55 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Dati applicazioni\WinRAR
[2010/09/06 15.43.52 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Dati applicazioni\skypePM
[2010/09/06 15.42.24 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Dati applicazioni\Skype
[2010/09/06 15.42.05 | 000,000,000 | —D | C] – C:\Programmi\File comuni\Skype
[2010/09/06 15.42.02 | 000,000,000 | R–D | C] – C:\Programmi\Skype
[2010/09/06 15.41.59 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Dati applicazioni\Skype
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/09/26 10.47.36 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Pc\Desktop\OTL.exe
[2010/09/26 10.40.55 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/09/26 10.40.51 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/09/26 10.40.49 | 527,880,192 | -HS- | M] () – C:\hiberfil.sys
[2010/09/26 10.40.16 | 003,145,728 | -H– | M] () – C:\Documents and Settings\Pc\NTUSER.DAT
[2010/09/26 10.40.12 | 000,000,194 | -HS- | M] () – C:\Documents and Settings\Pc\ntuser.ini
[2010/09/26 05.05.14 | 000,001,697 | —- | M] () – C:\Documents and Settings\Pc\Desktop\Profilo di Avira AntiVir Personal Hard Disk locali.LNK
[2010/09/26 03.06.41 | 000,000,789 | —- | M] () – C:\Documents and Settings\Pc\Menu Avvio\Programmi\Esecuzione automatica\PandaUSBVaccine.lnk
[2010/09/26 02.32.21 | 000,001,698 | —- | M] () – C:\Documents and Settings\Pc\Desktop\HijackThis.lnk
[2010/09/25 13.32.54 | 000,018,141 | —- | M] () – C:\Documents and Settings\Pc\Desktop\tossL.JPG
[2010/09/25 10.01.44 | 000,095,995 | —- | M] () – C:\Documents and Settings\Pc\Desktop\team in svizzera.jpg
[2010/09/25 09.59.40 | 000,040,443 | —- | M] () – C:\Documents and Settings\Pc\Desktop\trophy.jpg
[2010/09/25 08.45.56 | 000,002,241 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2010/09/19 12.37.12 | 000,151,584 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/09/16 21.39.43 | 000,071,693 | —- | M] () – C:\Documents and Settings\Pc\Desktop\andy_pandy_5.jpg
[2010/09/16 21.33.57 | 000,124,367 | —- | M] () – C:\Documents and Settings\Pc\Desktop\bear-t17682.jpg
[2010/09/16 19.30.51 | 000,024,576 | —- | M] () – C:\Documents and Settings\Pc\Desktop\Benvenuto in topbonus_Lara.doc
[2010/09/16 18.41.59 | 000,327,160 | —- | M] () – C:\Documents and Settings\Pc\Desktop\refertoS00002E9CL_16Sett2010.pdf
[2010/09/15 15.02.31 | 000,000,049 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2010/09/13 15.52.36 | 006,801,188 | —- | M] () – C:\Documents and Settings\Pc\Desktop\attachments_13_09_2010.zip
[2010/09/11 20.12.14 | 010,043,951 | —- | M] () – C:\Documents and Settings\Pc\Desktop\1008digitale.pdf
[2010/09/09 18.02.38 | 000,000,478 | —- | M] () – C:\Documents and Settings\Pc\Desktop\Fraps.lnk
[2010/09/09 13.10.36 | 000,024,800 | —- | M] () – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
[2010/09/09 13.09.56 | 000,001,584 | —- | M] () – C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2010/09/09 11.29.02 | 000,426,042 | —- | M] () – C:\WINDOWS\System32\perfh010.dat
[2010/09/09 11.29.02 | 000,380,684 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/09/09 11.29.02 | 000,063,600 | —- | M] () – C:\WINDOWS\System32\perfc010.dat
[2010/09/09 11.29.02 | 000,053,098 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/09/09 11.29.01 | 000,931,806 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/09/08 13.47.30 | 000,024,800 | —- | M] () – C:\Documents and Settings\Pc\Dati applicazioni\GDIPFONTCACHEV1.DAT
[2010/09/07 14.38.32 | 000,403,828 | —- | M] () – C:\Documents and Settings\Pc\Desktop\Foot.jpeg
[2010/09/07 14.38.26 | 000,238,809 | —- | M] () – C:\Documents and Settings\Pc\Desktop\NoseandLips(front).png
[2010/09/07 12.34.22 | 000,503,405 | —- | M] () – C:\Documents and Settings\Pc\Desktop\Schermata 2010-09-07 a 12.33.13.png
[2010/09/06 21.21.11 | 000,000,366 | —- | M] () – C:\Documents and Settings\Pc\Desktop\Collegamento a Connessione rete senza fili.lnk
[2010/09/06 15.43.54 | 000,000,056 | -H– | M] () – C:\WINDOWS\System32\ezsidmv.dat
[2010/09/05 22.56.57 | 000,002,397 | —- | M] () – C:\Documents and Settings\Pc\Desktop\AutoRoute.lnk
[2010/09/05 22.56.50 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/09/01 14.22.25 | 000,126,856 | —- | M] (Avira GmbH) – C:\WINDOWS\System32\drivers\avipbb.sys
[2010/09/01 14.22.25 | 000,060,936 | —- | M] (Avira GmbH) – C:\WINDOWS\System32\drivers\avgntflt.sys
[2010/08/04 20.15.23 | 000,056,832 | —- | M] () – C:\Documents and Settings\Pc\Documenti\Inventario materiale di produzione_08_07_10_MW.xls
[2010/07/04 19.54.15 | 000,016,384 | —- | M] () – C:\Documents and Settings\Pc\Documenti\INDIRIZZO X BUSTA.xls
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/09/26 05.05.14 | 000,001,697 | —- | C] () – C:\Documents and Settings\Pc\Desktop\Profilo di Avira AntiVir Personal Hard Disk locali.LNK
[2010/09/26 03.06.41 | 000,000,789 | —- | C] () – C:\Documents and Settings\Pc\Menu Avvio\Programmi\Esecuzione automatica\PandaUSBVaccine.lnk
[2010/09/26 02.32.21 | 000,001,698 | —- | C] () – C:\Documents and Settings\Pc\Desktop\HijackThis.lnk
[2010/09/25 13.30.17 | 000,018,141 | —- | C] () – C:\Documents and Settings\Pc\Desktop\tossL.JPG
[2010/09/25 10.03.30 | 000,040,443 | —- | C] () – C:\Documents and Settings\Pc\Desktop\trophy.jpg
[2010/09/25 10.02.11 | 000,095,995 | —- | C] () – C:\Documents and Settings\Pc\Desktop\team in svizzera.jpg
[2010/09/16 21.39.51 | 000,071,693 | —- | C] () – C:\Documents and Settings\Pc\Desktop\andy_pandy_5.jpg
[2010/09/16 21.34.19 | 000,124,367 | —- | C] () – C:\Documents and Settings\Pc\Desktop\bear-t17682.jpg
[2010/09/16 19.30.51 | 000,024,576 | —- | C] () – C:\Documents and Settings\Pc\Desktop\Benvenuto in topbonus_Lara.doc
[2010/09/16 18.41.58 | 000,327,160 | —- | C] () – C:\Documents and Settings\Pc\Desktop\refertoS00002E9CL_16Sett2010.pdf
[2010/09/13 15.52.24 | 006,801,188 | —- | C] () – C:\Documents and Settings\Pc\Desktop\attachments_13_09_2010.zip
[2010/09/11 20.12.14 | 010,043,951 | —- | C] () – C:\Documents and Settings\Pc\Desktop\1008digitale.pdf
[2010/09/09 18.02.38 | 000,000,478 | —- | C] () – C:\Documents and Settings\Pc\Desktop\Fraps.lnk
[2010/09/09 13.09.56 | 000,001,584 | —- | C] () – C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2010/09/07 14.38.13 | 000,403,828 | —- | C] () – C:\Documents and Settings\Pc\Desktop\Foot.jpeg
[2010/09/07 14.38.09 | 000,238,809 | —- | C] () – C:\Documents and Settings\Pc\Desktop\NoseandLips(front).png
[2010/09/07 12.34.04 | 000,503,405 | —- | C] () – C:\Documents and Settings\Pc\Desktop\Schermata 2010-09-07 a 12.33.13.png
[2010/09/06 21.21.11 | 000,000,366 | —- | C] () – C:\Documents and Settings\Pc\Desktop\Collegamento a Connessione rete senza fili.lnk
[2010/09/06 15.43.54 | 000,000,056 | -H– | C] () – C:\WINDOWS\System32\ezsidmv.dat
[2010/09/06 15.42.05 | 000,002,241 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2010/08/04 20.15.23 | 000,056,832 | —- | C] () – C:\Documents and Settings\Pc\Documenti\Inventario materiale di produzione_08_07_10_MW.xls
[2010/01/08 23.50.09 | 000,000,049 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2009/05/30 10.36.47 | 000,007,680 | —- | C] () – C:\WINDOWS\System32\CNMVS61.DLL
[2009/03/01 12.23.25 | 000,000,000 | —- | C] () – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\FnF4.txt
[2009/03/01 10.18.28 | 003,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2009/03/01 10.18.28 | 001,138,688 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2009/03/01 10.18.28 | 000,200,704 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2009/03/01 10.18.26 | 000,019,968 | —- | C] () – C:\WINDOWS\System32\cpuinf32.dll
[2009/02/28 19.37.59 | 000,000,424 | —- | C] () – C:\WINDOWS\ODBC.INI
[2009/02/28 19.03.59 | 000,204,800 | —- | C] () – C:\WINDOWS\System32\IVIresizeW7.dll
[2009/02/28 19.03.59 | 000,200,704 | —- | C] () – C:\WINDOWS\System32\IVIresizeA6.dll
[2009/02/28 19.03.59 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeP6.dll
[2009/02/28 19.03.59 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeM6.dll
[2009/02/28 19.03.59 | 000,188,416 | —- | C] () – C:\WINDOWS\System32\IVIresizePX.dll
[2009/02/28 19.03.58 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\IVIresize.dll
[2009/02/28 19.02.58 | 000,000,141 | —- | C] () – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\fusioncache.dat
[2009/02/28 19.02.58 | 000,000,000 | —- | C] () – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\QSwitch.txt
[2009/02/28 19.02.58 | 000,000,000 | —- | C] () – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\DSwitch.txt
[2009/02/28 19.02.58 | 000,000,000 | —- | C] () – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\AtStart.txt
[2006/08/23 07.04.30 | 000,000,175 | —- | C] () – C:\WINDOWS\wininit.ini
[2006/08/23 07.03.06 | 000,029,888 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2005/12/01 21.11.40 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2004/08/30 13.26.38 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2004/08/30 13.19.50 | 000,000,825 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/08/19 10.00.00 | 000,027,440 | —- | C] () – C:\WINDOWS\System32\drivers\secdrv.sys
[2004/06/01 11.39.56 | 000,094,274 | —- | C] () – C:\WINDOWS\System32\HPBHEALR.DLL
[1998/05/07 04.10.00 | 000,069,632 | —- | C] () – C:\WINDOWS\System32\ODMA32.dll

========== LOP Check ==========

[2010/09/25 23.53.43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Dati applicazioni\Panda Security
[2009/06/22 23.16.30 | 000,000,000 | —D | M] – C:\Documents and Settings\Pc\Dati applicazioni\Faykh
[2010/09/26 02.13.38 | 000,000,000 | —D | M] – C:\Documents and Settings\Pc\Dati applicazioni\Ilza
[2009/03/01 12.02.43 | 000,000,000 | —D | M] – C:\Documents and Settings\Pc\Dati applicazioni\InterVideo
[2010/01/25 22.09.58 | 000,000,000 | —D | M] – C:\Documents and Settings\Pc\Dati applicazioni\Leadertech
[2010/09/25 23.55.23 | 000,000,000 | —D | M] – C:\Documents and Settings\Pc\Dati applicazioni\Panda Security
[2006/08/23 17.17.05 | 000,000,000 | —D | M] – C:\Documents and Settings\Pc\Dati applicazioni\SampleView
[2010/09/26 00.58.07 | 000,000,000 | —D | M] – C:\Documents and Settings\Pc\Dati applicazioni\ss_dtx_tb
[2010/09/26 02.04.45 | 000,000,000 | —D | M] – C:\Documents and Settings\Pc\Dati applicazioni\Uxfek
[2010/09/26 03.01.04 | 000,000,000 | —D | M] – C:\Documents and Settings\Pc\Dati applicazioni\Ymyfup

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2009/03/05 19.49.01 | 000,000,211 | RHS- | M] () – C:\boot.ini
[1999/04/13 01.12.26 | 000,000,512 | —- | M] () – C:\Boot32.w2k
[2004/08/19 10.00.00 | 000,004,952 | RHS- | M] () – C:\Bootfont.bin
[1998/10/05 17.32.06 | 000,000,512 | —- | M] () – C:\bootsec
[1999/04/07 04.34.04 | 000,001,536 | —- | M] () – C:\BOOTSEC.32
[2010/09/26 10.40.49 | 527,880,192 | -HS- | M] () – C:\hiberfil.sys
[2004/08/19 10.00.00 | 000,047,564 | -HS- | M] () – C:\NTDETECT.COM
[2004/08/19 10.00.00 | 000,251,072 | -HS- | M] () – C:\NTLDR
[2010/09/26 10.40.48 | 792,723,456 | -HS- | M] () – C:\pagefile.sys

< %systemroot%\Fonts\*.com >

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2004/08/30 13.07.18 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2004/06/15 06.00.00 | 000,017,920 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPD61.DLL
[2004/06/15 06.00.00 | 000,054,272 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPP61.DLL
[2004/06/01 14.55.56 | 000,061,952 | —- | M] (Hewlett-Packard Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp35z.dll
[2004/07/23 02.00.00 | 000,026,112 | —- | M] (PortableAppZ.blogspot.com) – C:\WINDOWS\system32\spool\prtprocs\w32x86\xkUOCEI3.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2004/08/30 14.54.42 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2004/08/30 14.54.42 | 000,638,976 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2004/08/30 14.54.42 | 000,434,176 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/02/28 19.04.49 | 000,000,123 | -HS- | M] () – C:\Documents and Settings\Pc\Dati applicazioni\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2010/09/26 10.47.36 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Pc\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2010/09/26 00.51.18 | 000,000,067 | -HS- | M] () – C:\Documents and Settings\Pc\Cookies\desktop.ini
[2010/09/26 10.58.20 | 000,229,376 | —- | M] () – C:\Documents and Settings\Pc\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2004/08/11 21.28.54 | 000,192,512 | —- | M] (Microsoft Corporation) – C:\WINDOWS\inf\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.exe >
[2004/10/13 18.24.37 | 001,694,208 | —- | M] (Microsoft Corporation) – C:\Programmi\Messenger\msmsgs.exe

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< %USERPROFILE%\Templates\*.tmp >

< %SYSTEMDRIVE%\explorexxx.exe\*.* >

< %Windir%\Installer\*.tmp >

< %systemroot%\System32\*.xco >

< %ProgramFiles%\system32\*.* >

< %systemroot%\System32\windos\*.* >

< %SystemRoot%\system32\sandbox\*.* >

< %SystemRoot%\system32\*.amo >

< %SystemRoot%\system32\Windows Live\*.* >

< %ProgramFiles%\logs\*.* >

< %ProgramFiles%\Bifrost\*.* >

< %SystemRoot%\system32\*.goo >

< %systemroot%\system32\IME\*.* >

< %systemroot%\BackUp\*.* >

< %systemroot%\system32\*.ico >

< %systemroot%\system\*.dat >

< %systemroot%\system\*.exe >

< %AppData%\Macromedia\Common\*.* >

< %SYSTEMDRIVE%\dir\*.* /s >

< %systemroot%\system32\ras\*.exe >

< %SYSTEMDRIVE%\MFILES\*.* >

< %SYSTEMDRIVE%\mDNSRespon.exe\*.* >

< %systemroot%\system32\services\*.* >

< %systemroot%\Spooler\*.* >

< %ProgramFiles%\system32\*.* >

< %systemroot%\system32\Setup\*.dll /x >

< %systemroot%\system32\*.mine >

< %SYSTEMDRIVE%\cleansweep.exe\*.* >

< %systemroot%\system32\ras\*.dll >

< %systemroot%\system32\ras\*.drv >

< %systemroot%\*.iq >

< %systemroot%\system32\XP\*.* >

< %SYSTEMDRIVE%\Extracted\*.* >

< %systemroot%\system32\windows\*.* >

< %systemroot%\logs\*.* >

< %SYSTEMDRIVE%\Win.Msi\*.* >

< %systemroot%\regedit\*.* >

< %systemroot%\system32\skype\*.* >

< %AppData%\Adobe\dlluplwin25\*.* >

< %UserProfile%\*.dat >
[2010/09/26 10.40.16 | 003,145,728 | -H– | M] () – C:\Documents and Settings\Pc\NTUSER.DAT

< %UserProfile%\*.dll >

< %systemroot%\system32\*.sxo >

< %SYSTEMDRIVE%\Gazma\*.* /s >

< %systemroot%\system32\spynet\*.* >

< %systemroot%\system32\System\*.* >

< %appdata%\Microsoft\Windows\*.* >

< %systemroot%\system32\WinDir\*.* >

< %systemroot%\_\*.* >

< %systemroot%\system32\windows32\*.* >

< %ProgramFiles%\win\*.* >

< %AppData%\Microsoft\CD Burning\*.* >

< %systemroot%\*.cab >

< %systemroot%\K.Backup\*.* >

< %ProgramFiles%\Massenger\*.* >

< %systemroot%\System32\*.doc >

< %systemroot%\Office12\*.* >

< %systemroot%\System32\Rundl32.exe\*.* >

< %ProgramFiles%\yahoo.net\*.* >

< %systemroot%\system32\*.igo >

< %systemroot%\*.rew >

< %systemroot%\System32\spool\DRIVERS\W32X86\3\*.exe >
[2005/03/27 17.00.00 | 000,045,056 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CNAB4LAK.EXE
[2005/03/27 17.00.00 | 000,057,344 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CNAB4RPK.EXE
[2005/03/27 17.00.00 | 000,409,600 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CNAB4SWK.EXE
[2005/03/27 17.00.00 | 000,372,736 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CNAB4UN.EXE
[2004/06/15 06.00.00 | 000,080,896 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMPV61.EXE
[2004/06/15 06.00.00 | 000,008,704 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSD61.EXE
[2004/06/15 06.00.00 | 000,130,048 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSM61.EXE
[2004/06/15 06.00.00 | 000,006,656 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSQ61.EXE
[2004/11/04 21.07.00 | 000,524,288 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CPC10DA4.EXE
[2004/11/04 21.07.00 | 000,880,640 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CPC10QA4.EXE
[2004/11/04 21.07.00 | 000,450,560 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CPC10VA4.EXE
[2004/06/01 11.42.42 | 000,073,728 | —- | M] (Hewlett-Packard Company) – C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
[2004/06/01 11.42.44 | 000,077,824 | —- | M] (Hewlett-Packard Company) – C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
[2004/06/01 11.42.32 | 000,061,440 | —- | M] (Hewlett-Packard) – C:\WINDOWS\system32\spool\drivers\w32x86\3\HPNRA.EXE
[2004/06/01 11.42.34 | 000,061,699 | —- | M] (HP) – C:\WINDOWS\system32\spool\drivers\w32x86\3\HPZINW12.EXE
[2004/06/01 11.42.36 | 000,065,536 | —- | M] (HP) – C:\WINDOWS\system32\spool\drivers\w32x86\3\HPZIPM12.EXE

< %USERPROFILE%\.COMMgr\*.* >

< %USERPROFILE%\Desktop\*.bat >

< %PROGRAMFILES%\Common Files\Real\visualizations\*.* >

< %PROGRAMFILES%\Internet Explorer\*.Jmp >

< %PROGRAMFILES%\Windows NT\system\*.dll >

< %systemroot%\system32\*.ext >

< %systemroot%\system32\Com\*.cfg >

< %systemroot%\system32\btz\*.* >

< %systemroot%\system32\EMP\*.* >

< %systemroot%\system32\expo\*.* >

< %systemroot%\system32\inet2\*.* >

< %systemroot%\system32\xrem\*.* >

< %ProgramFiles%\Microsoft\*.* >

< %systemroot%\usgwmt\*.* >

< %ProgramFiles%\B\*.* >

< %SYSTEMDRIVE%\lspp\*.* >

< %systemroot%\Kral\*.* >

< %SYSTEMDRIVE%\windowsdvd.exe\*.* >

< %systemroot%\system32\*.ipo >

< %SYSTEMDRIVE%\usxxxxxxxx.exe\*.* >

< %systemroot%\system32\*.mof >

< %systemroot%\*.atm >

< %systemroot%\system32\svhost\*.* >

< %ProgramFiles%\system32\*.* >

< %ProgramFiles%\Docmentt\*.* >

< %systemroot%\Help\*.vbs >

< %ProgramFiles%\Windows WinSxs\*.* /s >

< %ProgramFiles%\Outlook Express\IDT\*.* /s >

< %ProgramFiles%\Microsoft Office\365\*.* /s >

< %ProgramFiles%\Windows Live\*.* >

< %systemroot%\system32\win32\*.* >

< %SYSTEMDRIVE%\RECYCLER\*.* >

< %systemroot%\Fresh1\*.* >

< %ProgramFiles%\Kekj\*.* /s >

< %systemroot%\GDU\*.* >

< %systemroot%\KA\*.* >

< %systemroot%\R\*.* >

< %systemroot%\system32\*.fyo >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
< End of report >

Extras.Txt

OTL Extras logfile created on: 26/09/2010 10.59.38 - Run 1
OTL by OldTimer - Version 3.2.14.1 Folder = C:\Documents and Settings\Pc\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000410 | Country: Italia | Language: ITA | Date Format: dd/MM/yyyy

503,00 Mb Total Physical Memory | 205,00 Mb Available Physical Memory | 41,00% Memory free
1,00 Gb Paging File | 1,00 Gb Available in Paging File | 71,00% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programmi
Drive C: | 67,22 Gb Total Space | 54,35 Gb Free Space | 80,86% Space Free | Partition Type: NTFS
Drive D: | 7,30 Gb Total Space | 0,42 Gb Free Space | 5,80% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: PC382528461259
Current User Name: Pc
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "C:\Programmi\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Programmi\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 1
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\SMINST\Scheduler.exe" = C:\WINDOWS\SMINST\Scheduler.exe:*:Enabled:Scheduler – ()
"C:\WINDOWS\system32\CNAB4RPK.EXE" = C:\WINDOWS\system32\CNAB4RPK.EXE:*:Enabled:Canon LBP2900 RPC Server Process – (CANON INC.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{075473F5-846A-448B-BCB3-104AA1760205}" = Sonic Data Module
"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Sonic DLA
"{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}" = Google Earth
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{21657574-BD54-48A2-9450-EB03B2C7FC29}" = Sonic MyDVD Plus
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.00 H1
"{350C9410-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3F9F7336-6DF8-476F-ABF6-C70A17FAF619}" = Installer HP Backup and Recovery Manager
"{4302B2DD-D958-40E3-BAF3-B07FFE1978CE}" = HP Wireless Assistant 2.00 E1
"{48CF6549-B45D-4313-9927-EFCCC8A3493F}" = TIPCI
"{559AD08F-3474-4F96-B374-A59F2A1E2518}" = MH505UP Onda Wizard
"{55A41219-9B22-4098-BAE7-AE289B3C569A}_is1" = Panda USB Vaccine 1.0.1.4
"{5D97A4A7-C274-4B63-86D9-07A33435F505}" = InterVideo DVD Check
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Sonic Express Labeler
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{83ED1E80-A1B7-4236-BCF1-AC4A88151A6B}" = Microsoft AutoRoute 2006
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Graphics Media Accelerator Driver
"{90280410-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional con FrontPage
"{914E1AB1-DCA0-4A7D-935F-B58C4B887A2B}" = HP ProtectTools Security Manager 2.00 C3
"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9F7AF7CD-E3D0-4C68-A3BA-C76C359B3AA8}" = LightScribe 1.4.105.1
"{A7AD8CEF-72D7-4FE4-8A14-DDD09DC86074}" = HP Notebook Accessories Product Tour
"{A93944F2-D2D4-4750-BFE7-9A288FEAF2CF}" = Apple Application Support
"{A93C4E94-1005-489D-BEAA-B873C1AA6CFC}" = HP Help and Support
"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Sonic Audio Module
"{AC76BA86-7AD7-1040-7B44-A70500000002}" = Adobe Reader 7.0.5 - Italiano
"{AE052EF7-2640-48D7-8915-69B810D975CB}" = HP BIOS Configuration for ProtectTools 2.00 E1
"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Sonic Copy Module
"{B9F4C05D-E42F-4E9A-A73F-FDD9355319FB}" = HP Credential Manager for ProtectTools
"{BB85ED9C-AFC9-43BD-B8DC-258C3C7DF72E}" = HP Software Update
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{DB0781F5-06D2-49BB-87B5-00F3B834FC3B}" = HP User Guides 0015
"{DB518BA6-CB74-4EB6-9ABD-880B6D6E1F38}" = HpSdpAppCoreApp
"{E0DBC47C-ED3F-4A1B-A929-9A26DAAA14B3}" = Application Installer 4.00.B5
"{EB900AF8-CC61-4E15-871B-98D1EA3E8025}" = QuickTime
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F2D2B58B-B2FD-46D1-8319-DCE564079934}" = Microsoft .NET Framework 1.1 Italian Language Pack
"{F6869CD2-3DB4-476D-A4C7-B3AE7C3ACF7B}" = Windows Media Connect
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Canon LBP2900" = Canon LBP2900
"CANONBJ_Deinstall_CNMCP61.DLL" = Canon PIXMA iP3000
"Fraps" = Fraps
"HijackThis" = HijackThis 2.0.2
"ie8" = Windows Internet Explorer 8
"InstallShield_{48CF6549-B45D-4313-9927-EFCCC8A3493F}" = Texas Instruments PCIxx21/x515/xx12 drivers.
"KLiteCodecPack_is1" = K-Lite Mega Codec Pack 1.60
"Nero - Burning Rom!UninstallKey" = Nero 6
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"WGA" = Windows Genuine Advantage Validation Tool
"Windows Media Connect" = Windows Media Connect
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"WinRAR archiver" = WinRAR gestione archivi

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 25/09/2010 19.59.58 | Computer Name = PC382528461259 | Source = MsiInstaller | ID = 11406
Description = Product: Panda Cloud Antivirus – Error 1406.Could not write value
to key \SOFTWARE\Panda Software\Setup\UIDS. System error . Verify that you have
sufficient access to that key, or contact your support personnel.

Error - 25/09/2010 20.08.30 | Computer Name = PC382528461259 | Source = Application Hang | ID = 1002
Description = Applicazione in stallo iexplore.exe, versione 8.0.6001.18702, modulo
in stallo hungapp, versione 0.0.0.0, indirizzo stallo 0x00000000.

Error - 25/09/2010 20.10.41 | Computer Name = PC382528461259 | Source = crypt32 | ID = 131080
Description = Impossibile eseguire il recupero con aggiornamento automatico del
numero di sequenza dell'elenco principale di altri produttori da: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
a causa del seguente errore: A connection with the server could not be established

Error - 25/09/2010 20.15.44 | Computer Name = PC382528461259 | Source = crypt32 | ID = 131080
Description = Impossibile eseguire il recupero con aggiornamento automatico del
numero di sequenza dell'elenco principale di altri produttori da: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
a causa del seguente errore: A connection with the server could not be established

Error - 25/09/2010 21.00.01 | Computer Name = PC382528461259 | Source = Application Hang | ID = 1002
Description = Applicazione in stallo iexplore.exe, versione 8.0.6001.18702, modulo
in stallo hungapp, versione 0.0.0.0, indirizzo stallo 0x00000000.

Error - 25/09/2010 21.11.46 | Computer Name = PC382528461259 | Source = crypt32 | ID = 131080
Description = Impossibile eseguire il recupero con aggiornamento automatico del
numero di sequenza dell'elenco principale di altri produttori da: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
a causa del seguente errore: A connection with the server could not be established

Error - 25/09/2010 21.15.15 | Computer Name = PC382528461259 | Source = Application Hang | ID = 1002
Description = Applicazione in stallo iexplore.exe, versione 8.0.6001.18702, modulo
in stallo hungapp, versione 0.0.0.0, indirizzo stallo 0x00000000.

Error - 25/09/2010 21.15.19 | Computer Name = PC382528461259 | Source = Application Hang | ID = 1001
Description = Bucket 1180947459 errato.

Error - 25/09/2010 22.59.51 | Computer Name = PC382528461259 | Source = Application Hang | ID = 1002
Description = Applicazione in stallo iexplore.exe, versione 8.0.6001.18702, modulo
in stallo hungapp, versione 0.0.0.0, indirizzo stallo 0x00000000.

Error - 26/09/2010 4.23.54 | Computer Name = PC382528461259 | Source = crypt32 | ID = 131080
Description = Impossibile eseguire il recupero con aggiornamento automatico del
numero di sequenza dell'elenco principale di altri produttori da: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
a causa del seguente errore: A connection with the server could not be established

[ System Events ]
Error - 25/09/2010 18.34.35 | Computer Name = PC382528461259 | Source = Service Control Manager | ID = 7023
Description = Servizio HID Input Service terminato con l'errore: %%2

Error - 25/09/2010 19.39.44 | Computer Name = PC382528461259 | Source = Service Control Manager | ID = 7023
Description = Servizio HID Input Service terminato con l'errore: %%2

Error - 25/09/2010 19.44.41 | Computer Name = PC382528461259 | Source = Service Control Manager | ID = 7023
Description = Servizio HID Input Service terminato con l'errore: %%2

Error - 25/09/2010 20.06.53 | Computer Name = PC382528461259 | Source = SideBySide | ID = 16842784
Description = Impossibile trovare assemblaggio dipendente Microsoft.VC90.CRT e l'ultimo
errore è stato L'assembly a cui si fa riferimento non è installato nel computer.

Error - 25/09/2010 20.06.53 | Computer Name = PC382528461259 | Source = SideBySide | ID = 16842811
Description = Resolve Partial Assembly non riuscito per Microsoft.VC90.CRT. Riferimento
al messaggio di errore: L'assembly a cui si fa riferimento non è installato nel
computer. .

Error - 25/09/2010 20.06.53 | Computer Name = PC382528461259 | Source = SideBySide | ID = 16842811
Description = Generate Activation Context non riuscito per C:\DOCUME~1\Pc\IMPOST~1\Temp\RarSFX2\redist.dll.
Riferimento
al messaggio di errore: Operazione completata. .

Error - 25/09/2010 20.15.11 | Computer Name = PC382528461259 | Source = Service Control Manager | ID = 7023
Description = Servizio HID Input Service terminato con l'errore: %%2

Error - 25/09/2010 21.11.22 | Computer Name = PC382528461259 | Source = Service Control Manager | ID = 7023
Description = Servizio HID Input Service terminato con l'errore: %%2

Error - 26/09/2010 4.23.34 | Computer Name = PC382528461259 | Source = Service Control Manager | ID = 7023
Description = Servizio HID Input Service terminato con l'errore: %%2

Error - 26/09/2010 4.41.03 | Computer Name = PC382528461259 | Source = Service Control Manager | ID = 7023
Description = Servizio HID Input Service terminato con l'errore: %%2

< End of report >

FliffyMagic

Post #6September 26, 2010, 9:16 AM UTC

Thanks OldTimer,

Symptoms: Once navigating to additional web pages in explorer, a short error message pops-up stating that a file can not be found, then immediately aftewards, the second web page popsup with the hijacked url (some dating site called "Wildlife.")

Here are the files;

OTL.Txt

OTL logfile created on: 26/09/2010 10.59.38 - Run 1
OTL by OldTimer - Version 3.2.14.1 Folder = C:\Documents and Settings\Pc\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000410 | Country: Italia | Language: ITA | Date Format: dd/MM/yyyy

503,00 Mb Total Physical Memory | 205,00 Mb Available Physical Memory | 41,00% Memory free
1,00 Gb Paging File | 1,00 Gb Available in Paging File | 71,00% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programmi
Drive C: | 67,22 Gb Total Space | 54,35 Gb Free Space | 80,86% Space Free | Partition Type: NTFS
Drive D: | 7,30 Gb Total Space | 0,42 Gb Free Space | 5,80% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: PC382528461259
Current User Name: Pc
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Pc\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programmi\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programmi\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programmi\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programmi\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Programmi\Panda USB Vaccine\USBVaccine.exe (Panda Security)
PRC - C:\Programmi\File comuni\Panda Security\PavShld\PavPrSrv.exe (Panda Security, S.L.)
PRC - C:\Programmi\File comuni\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
PRC - C:\Programmi\HPQ\IAM\Bin\asghost.exe (Cognizance Corporation)
PRC - C:\WINDOWS\system32\CNAB4RPK.EXE (CANON INC.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Pc\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Programmi\HPQ\IAM\Bin\ItMsg.dll (Cognizance Corporation)
MOD - C:\Programmi\HPQ\IAM\Bin\SFSShell.dll (Cognizance Corporation)
MOD - C:\Programmi\HPQ\IAM\Bin\1040\SFSShell.dll (Cognizance Corporation)
MOD - C:\WINDOWS\system32\msvbvm60.dll (Microsoft Corporation)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\dinput.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\credui.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
MOD - C:\WINDOWS\system32\iphlpapi.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\rtutils.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msvcr70.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (AntiVirScheduler) – C:\Programmi\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (AntiVirService) – C:\Programmi\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (PavPrSrv) – C:\Programmi\File comuni\Panda Security\PavShld\pavprsrv.exe (Panda Security, S.L.)
SRV - (LightScribeService) – C:\Programmi\File comuni\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
SRV - (IDriverT) – C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)

========== Driver Services (SafeList) ==========

DRV - (tifm21) – C:\WINDOWS\System32\drivers\tifm21.sys File not found
DRV - (GTIPCI21) – C:\WINDOWS\System32\DRIVERS\gtipci21.sys File not found
DRV - (avipbb) – C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) – C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (ssmdrv) – C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avgio) – C:\Programmi\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (PavProc) – C:\WINDOWS\system32\drivers\PavProc.sys (Panda Security, S.L.)
DRV - (ONDAusbser6k) – C:\WINDOWS\system32\drivers\ONDAusbser6k.sys (ONDA Incorporated)
DRV - (ONDAusbnmea) – C:\WINDOWS\system32\drivers\ONDAusbnmea.sys (ONDA Incorporated)
DRV - (ONDAusbmdm6k) – C:\WINDOWS\system32\drivers\ONDAusbmdm6k.sys (ONDA Incorporated)
DRV - (ShldDrv) – C:\WINDOWS\system32\drivers\ShlDrv51.sys (Panda Security, S.L.)
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (ATSWPDRV) AuthenTec TruePrint USB Driver (AES2500) – C:\WINDOWS\system32\drivers\atswpdrv.sys (AuthenTec, Inc.)
DRV - (SynTP) – C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (ADIHdAudAddService) – C:\WINDOWS\system32\drivers\ADIHdAud.sys (Analog Devices, Inc.)
DRV - (b57w2k) Broadcom NetLink ™ – C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (bcm4sbxp) – C:\WINDOWS\system32\drivers\bcm4sbxp.sys (Broadcom Corporation)
DRV - (w39n51) Intel® – C:\WINDOWS\system32\drivers\w39n51.sys (Intel® Corporation)
DRV - (BCM43XX) – C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (BTWUSB) – C:\WINDOWS\system32\drivers\btwusb.sys (Broadcom Corporation.)
DRV - (iaStor) – C:\WINDOWS\System32\DRIVERS\iaStor.sys (Intel Corporation)
DRV - (eabusb) – C:\WINDOWS\system32\drivers\EabUsb.sys (Hewlett-Packard Development Company, L.P.)
DRV - (HBtnKey) – C:\WINDOWS\system32\drivers\CPQBttn.sys (Hewlett-Packard Development Company, L.P.)
DRV - (eabfiltr) – C:\WINDOWS\system32\drivers\eabfiltr.sys (Hewlett-Packard Development Company, L.P.)
DRV - (DLAUDFAM) – C:\WINDOWS\system32\DLA\DLAUDFAM.SYS (Sonic Solutions)
DRV - (DLAUDF_M) – C:\WINDOWS\system32\DLA\DLAUDF_M.SYS (Sonic Solutions)
DRV - (DLAIFS_M) – C:\WINDOWS\system32\DLA\DLAIFS_M.SYS (Sonic Solutions)
DRV - (DLABOIOM) – C:\WINDOWS\system32\DLA\DLABOIOM.SYS (Sonic Solutions)
DRV - (DLAOPIOM) – C:\WINDOWS\system32\DLA\DLAOPIOM.SYS (Sonic Solutions)
DRV - (DLAPoolM) – C:\WINDOWS\system32\DLA\DLAPoolM.SYS (Sonic Solutions)
DRV - (DLADResN) – C:\WINDOWS\system32\DLA\DLADResN.SYS (Sonic Solutions)
DRV - (DRVMCDB) – C:\WINDOWS\System32\Drivers\DRVMCDB.SYS (Sonic Solutions)
DRV - (DLACDBHM) – C:\WINDOWS\system32\drivers\DLACDBHM.SYS (Sonic Solutions)
DRV - (DLARTL_N) – C:\WINDOWS\system32\drivers\DLARTL_N.SYS (Sonic Solutions)
DRV - (DRVNDDM) – C:\WINDOWS\system32\drivers\DRVNDDM.SYS (Sonic Solutions)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\Hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (usbaudio) Driver audio USB (WDM) – C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (SMCIRDA) – C:\WINDOWS\system32\drivers\smcirda.sys (SMC)
DRV - (AliIde) – C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

O1 HOSTS File: ([2004/08/19 10.00.00 | 000,000,768 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\DLA\DLASHX_W.DLL (Sonic Solutions)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (HP Credential Manager for ProtectTools) - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Programmi\HPQ\IAM\Bin\ItIeAddIN.dll (Infineon Technologies AG)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O4 - HKLM..\Run: [avgnt] C:\Programmi\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - Startup: C:\Documents and Settings\Pc\Menu Avvio\Programmi\Esecuzione automatica\PandaUSBVaccine.lnk = C:\Programmi\Panda USB Vaccine\USBVaccine.exe (Panda Security)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Cerca con Google - C:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: &Traduci parola in italiano - C:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: E&sporta in Microsoft Excel - C:\Programmi\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Link a ritroso - C:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Pagine simili - C:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Versione cache della pagina - C:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\NPJPI150_06.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab (Symantec RuFSI Utility Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.1.1
O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programmi\File comuni\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programmi\File comuni\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programmi\File comuni\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programmi\File comuni\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\OneCard: DllName - C:\Programmi\HPQ\IAM\Bin\AsWlnPkg.dll - C:\Programmi\HPQ\IAM\Bin\AsWlnPkg.dll (Cognizance Corporation)
O24 - Desktop Components:0 (Pagina iniziale corrente) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Colline.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Colline.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2001/07/28 01.07.00 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ NTFS ]
O32 - Unable to obtain root file information for disk D:\
O33 - MountPoints2\{63221a62-0635-11de-b34a-c49af543bef3}\Shell - "" = AutoRun
O33 - MountPoints2\{63221a62-0635-11de-b34a-c49af543bef3}\Shell\AutoRun\command - "" = F:\AutoRun.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.ac3acm - C:\WINDOWS\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.DIVX - C:\WINDOWS\System32\divx.dll (DivX, Inc.)
Drivers32: VIDC.FPS1 - C:\WINDOWS\System32\frapsvid.dll (Beepa P/L)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.wmv3 - C:\WINDOWS\System32\WMV9VCM.dll (Microsoft Corporation)
Drivers32: VIDC.XVID - C:\WINDOWS\System32\xvidvfw.dll ()

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (76293329439948800)

========== Files/Folders - Created Within 90 Days ==========

[2010/09/26 10.47.32 | 000,575,488 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Pc\Desktop\OTL.exe
[2010/09/26 03.06.40 | 000,000,000 | —D | C] – C:\Programmi\Panda USB Vaccine
[2010/09/26 02.32.21 | 000,000,000 | —D | C] – C:\Programmi\Trend Micro
[2010/09/26 02.17.25 | 000,000,000 | —D | C] – C:\WINDOWS\System32\NtmsData
[2010/09/26 02.16.28 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Dati applicazioni\Avira
[2010/09/26 02.09.57 | 000,028,520 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\ssmdrv.sys
[2010/09/26 02.09.56 | 000,126,856 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\avipbb.sys
[2010/09/26 02.09.56 | 000,060,936 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\avgntflt.sys
[2010/09/26 02.09.56 | 000,045,416 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\avgntdd.sys
[2010/09/26 02.09.56 | 000,022,360 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\avgntmgr.sys
[2010/09/26 02.09.56 | 000,000,000 | —D | C] – C:\Programmi\Avira
[2010/09/26 02.09.56 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Dati applicazioni\Avira
[2010/09/26 01.43.24 | 000,041,144 | —- | C] (Panda Security, S.L.) – C:\WINDOWS\System32\drivers\ShlDrv51.sys
[2010/09/26 01.43.23 | 000,163,336 | —- | C] (Panda Security, S.L.) – C:\WINDOWS\System32\drivers\PavProc.sys
[2010/09/26 01.40.47 | 000,000,000 | —D | C] – C:\Programmi\File comuni\Panda Security
[2010/09/26 00.58.07 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Dati applicazioni\ss_dtx_tb
[2010/09/25 23.55.23 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Dati applicazioni\Panda Security
[2010/09/25 23.53.43 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Dati applicazioni\Panda Security
[2010/09/25 23.42.40 | 000,000,000 | —D | C] – C:\Programmi\Panda Security
[2010/09/19 12.34.00 | 000,000,000 | —D | C] – C:\Programmi\MSECache
[2010/09/16 07.43.35 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Pc\IECompatCache
[2010/09/15 20.08.27 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Pc\PrivacIE
[2010/09/15 20.06.31 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Pc\IETldCache
[2010/09/15 20.04.43 | 000,000,000 | —D | C] – C:\WINDOWS\WBEM
[2010/09/15 20.04.20 | 000,000,000 | -H-D | C] – C:\WINDOWS\ie8
[2010/09/15 20.04.20 | 000,000,000 | —D | C] – C:\WINDOWS\System32\it-IT
[2010/09/12 17.01.28 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Desktop\WIP
[2010/09/12 17.00.01 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Desktop\Project Viewpoint
[2010/09/12 16.55.33 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Desktop\LiftLoft
[2010/09/09 18.02.37 | 000,000,000 | —D | C] – C:\Fraps
[2010/09/09 13.10.37 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Dati applicazioni\Apple Computer
[2010/09/09 13.09.44 | 000,000,000 | —D | C] – C:\Programmi\QuickTime
[2010/09/09 13.09.43 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Dati applicazioni\Apple Computer
[2010/09/09 13.09.27 | 000,000,000 | —D | C] – C:\Programmi\File comuni\Apple
[2010/09/09 13.09.21 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\Apple
[2010/09/09 13.09.19 | 000,000,000 | —D | C] – C:\Programmi\Apple Software Update
[2010/09/09 13.09.19 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Dati applicazioni\Apple
[2010/09/09 13.08.54 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\Apple Computer
[2010/09/07 07.36.47 | 000,000,000 | R–D | C] – C:\Documents and Settings\Pc\Documenti\Video
[2010/09/07 07.36.47 | 000,000,000 | R–D | C] – C:\Documents and Settings\All Users\Documenti\Video
[2010/09/06 22.56.55 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Dati applicazioni\WinRAR
[2010/09/06 15.43.52 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Dati applicazioni\skypePM
[2010/09/06 15.42.24 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Dati applicazioni\Skype
[2010/09/06 15.42.05 | 000,000,000 | —D | C] – C:\Programmi\File comuni\Skype
[2010/09/06 15.42.02 | 000,000,000 | R–D | C] – C:\Programmi\Skype
[2010/09/06 15.41.59 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Dati applicazioni\Skype
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/09/26 10.47.36 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Pc\Desktop\OTL.exe
[2010/09/26 10.40.55 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/09/26 10.40.51 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/09/26 10.40.49 | 527,880,192 | -HS- | M] () – C:\hiberfil.sys
[2010/09/26 10.40.16 | 003,145,728 | -H– | M] () – C:\Documents and Settings\Pc\NTUSER.DAT
[2010/09/26 10.40.12 | 000,000,194 | -HS- | M] () – C:\Documents and Settings\Pc\ntuser.ini
[2010/09/26 05.05.14 | 000,001,697 | —- | M] () – C:\Documents and Settings\Pc\Desktop\Profilo di Avira AntiVir Personal Hard Disk locali.LNK
[2010/09/26 03.06.41 | 000,000,789 | —- | M] () – C:\Documents and Settings\Pc\Menu Avvio\Programmi\Esecuzione automatica\PandaUSBVaccine.lnk
[2010/09/26 02.32.21 | 000,001,698 | —- | M] () – C:\Documents and Settings\Pc\Desktop\HijackThis.lnk
[2010/09/25 13.32.54 | 000,018,141 | —- | M] () – C:\Documents and Settings\Pc\Desktop\tossL.JPG
[2010/09/25 10.01.44 | 000,095,995 | —- | M] () – C:\Documents and Settings\Pc\Desktop\team in svizzera.jpg
[2010/09/25 09.59.40 | 000,040,443 | —- | M] () – C:\Documents and Settings\Pc\Desktop\trophy.jpg
[2010/09/25 08.45.56 | 000,002,241 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2010/09/19 12.37.12 | 000,151,584 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/09/16 21.39.43 | 000,071,693 | —- | M] () – C:\Documents and Settings\Pc\Desktop\andy_pandy_5.jpg
[2010/09/16 21.33.57 | 000,124,367 | —- | M] () – C:\Documents and Settings\Pc\Desktop\bear-t17682.jpg
[2010/09/16 19.30.51 | 000,024,576 | —- | M] () – C:\Documents and Settings\Pc\Desktop\Benvenuto in topbonus_Lara.doc
[2010/09/16 18.41.59 | 000,327,160 | —- | M] () – C:\Documents and Settings\Pc\Desktop\refertoS00002E9CL_16Sett2010.pdf
[2010/09/15 15.02.31 | 000,000,049 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2010/09/13 15.52.36 | 006,801,188 | —- | M] () – C:\Documents and Settings\Pc\Desktop\attachments_13_09_2010.zip
[2010/09/11 20.12.14 | 010,043,951 | —- | M] () – C:\Documents and Settings\Pc\Desktop\1008digitale.pdf
[2010/09/09 18.02.38 | 000,000,478 | —- | M] () – C:\Documents and Settings\Pc\Desktop\Fraps.lnk
[2010/09/09 13.10.36 | 000,024,800 | —- | M] () – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
[2010/09/09 13.09.56 | 000,001,584 | —- | M] () – C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2010/09/09 11.29.02 | 000,426,042 | —- | M] () – C:\WINDOWS\System32\perfh010.dat
[2010/09/09 11.29.02 | 000,380,684 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/09/09 11.29.02 | 000,063,600 | —- | M] () – C:\WINDOWS\System32\perfc010.dat
[2010/09/09 11.29.02 | 000,053,098 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/09/09 11.29.01 | 000,931,806 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/09/08 13.47.30 | 000,024,800 | —- | M] () – C:\Documents and Settings\Pc\Dati applicazioni\GDIPFONTCACHEV1.DAT
[2010/09/07 14.38.32 | 000,403,828 | —- | M] () – C:\Documents and Settings\Pc\Desktop\Foot.jpeg
[2010/09/07 14.38.26 | 000,238,809 | —- | M] () – C:\Documents and Settings\Pc\Desktop\NoseandLips(front).png
[2010/09/07 12.34.22 | 000,503,405 | —- | M] () – C:\Documents and Settings\Pc\Desktop\Schermata 2010-09-07 a 12.33.13.png
[2010/09/06 21.21.11 | 000,000,366 | —- | M] () – C:\Documents and Settings\Pc\Desktop\Collegamento a Connessione rete senza fili.lnk
[2010/09/06 15.43.54 | 000,000,056 | -H– | M] () – C:\WINDOWS\System32\ezsidmv.dat
[2010/09/05 22.56.57 | 000,002,397 | —- | M] () – C:\Documents and Settings\Pc\Desktop\AutoRoute.lnk
[2010/09/05 22.56.50 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/09/01 14.22.25 | 000,126,856 | —- | M] (Avira GmbH) – C:\WINDOWS\System32\drivers\avipbb.sys
[2010/09/01 14.22.25 | 000,060,936 | —- | M] (Avira GmbH) – C:\WINDOWS\System32\drivers\avgntflt.sys
[2010/08/04 20.15.23 | 000,056,832 | —- | M] () – C:\Documents and Settings\Pc\Documenti\Inventario materiale di produzione_08_07_10_MW.xls
[2010/07/04 19.54.15 | 000,016,384 | —- | M] () – C:\Documents and Settings\Pc\Documenti\INDIRIZZO X BUSTA.xls
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/09/26 05.05.14 | 000,001,697 | —- | C] () – C:\Documents and Settings\Pc\Desktop\Profilo di Avira AntiVir Personal Hard Disk locali.LNK
[2010/09/26 03.06.41 | 000,000,789 | —- | C] () – C:\Documents and Settings\Pc\Menu Avvio\Programmi\Esecuzione automatica\PandaUSBVaccine.lnk
[2010/09/26 02.32.21 | 000,001,698 | —- | C] () – C:\Documents and Settings\Pc\Desktop\HijackThis.lnk
[2010/09/25 13.30.17 | 000,018,141 | —- | C] () – C:\Documents and Settings\Pc\Desktop\tossL.JPG
[2010/09/25 10.03.30 | 000,040,443 | —- | C] () – C:\Documents and Settings\Pc\Desktop\trophy.jpg
[2010/09/25 10.02.11 | 000,095,995 | —- | C] () – C:\Documents and Settings\Pc\Desktop\team in svizzera.jpg
[2010/09/16 21.39.51 | 000,071,693 | —- | C] () – C:\Documents and Settings\Pc\Desktop\andy_pandy_5.jpg
[2010/09/16 21.34.19 | 000,124,367 | —- | C] () – C:\Documents and Settings\Pc\Desktop\bear-t17682.jpg
[2010/09/16 19.30.51 | 000,024,576 | —- | C] () – C:\Documents and Settings\Pc\Desktop\Benvenuto in topbonus_Lara.doc
[2010/09/16 18.41.58 | 000,327,160 | —- | C] () – C:\Documents and Settings\Pc\Desktop\refertoS00002E9CL_16Sett2010.pdf
[2010/09/13 15.52.24 | 006,801,188 | —- | C] () – C:\Documents and Settings\Pc\Desktop\attachments_13_09_2010.zip
[2010/09/11 20.12.14 | 010,043,951 | —- | C] () – C:\Documents and Settings\Pc\Desktop\1008digitale.pdf
[2010/09/09 18.02.38 | 000,000,478 | —- | C] () – C:\Documents and Settings\Pc\Desktop\Fraps.lnk
[2010/09/09 13.09.56 | 000,001,584 | —- | C] () – C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2010/09/07 14.38.13 | 000,403,828 | —- | C] () – C:\Documents and Settings\Pc\Desktop\Foot.jpeg
[2010/09/07 14.38.09 | 000,238,809 | —- | C] () – C:\Documents and Settings\Pc\Desktop\NoseandLips(front).png
[2010/09/07 12.34.04 | 000,503,405 | —- | C] () – C:\Documents and Settings\Pc\Desktop\Schermata 2010-09-07 a 12.33.13.png
[2010/09/06 21.21.11 | 000,000,366 | —- | C] () – C:\Documents and Settings\Pc\Desktop\Collegamento a Connessione rete senza fili.lnk
[2010/09/06 15.43.54 | 000,000,056 | -H– | C] () – C:\WINDOWS\System32\ezsidmv.dat
[2010/09/06 15.42.05 | 000,002,241 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2010/08/04 20.15.23 | 000,056,832 | —- | C] () – C:\Documents and Settings\Pc\Documenti\Inventario materiale di produzione_08_07_10_MW.xls
[2010/01/08 23.50.09 | 000,000,049 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2009/05/30 10.36.47 | 000,007,680 | —- | C] () – C:\WINDOWS\System32\CNMVS61.DLL
[2009/03/01 12.23.25 | 000,000,000 | —- | C] () – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\FnF4.txt
[2009/03/01 10.18.28 | 003,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2009/03/01 10.18.28 | 001,138,688 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2009/03/01 10.18.28 | 000,200,704 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2009/03/01 10.18.26 | 000,019,968 | —- | C] () – C:\WINDOWS\System32\cpuinf32.dll
[2009/02/28 19.37.59 | 000,000,424 | —- | C] () – C:\WINDOWS\ODBC.INI
[2009/02/28 19.03.59 | 000,204,800 | —- | C] () – C:\WINDOWS\System32\IVIresizeW7.dll
[2009/02/28 19.03.59 | 000,200,704 | —- | C] () – C:\WINDOWS\System32\IVIresizeA6.dll
[2009/02/28 19.03.59 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeP6.dll
[2009/02/28 19.03.59 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeM6.dll
[2009/02/28 19.03.59 | 000,188,416 | —- | C] () – C:\WINDOWS\System32\IVIresizePX.dll
[2009/02/28 19.03.58 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\IVIresize.dll
[2009/02/28 19.02.58 | 000,000,141 | —- | C] () – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\fusioncache.dat
[2009/02/28 19.02.58 | 000,000,000 | —- | C] () – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\QSwitch.txt
[2009/02/28 19.02.58 | 000,000,000 | —- | C] () – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\DSwitch.txt
[2009/02/28 19.02.58 | 000,000,000 | —- | C] () – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\AtStart.txt
[2006/08/23 07.04.30 | 000,000,175 | —- | C] () – C:\WINDOWS\wininit.ini
[2006/08/23 07.03.06 | 000,029,888 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2005/12/01 21.11.40 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2004/08/30 13.26.38 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2004/08/30 13.19.50 | 000,000,825 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/08/19 10.00.00 | 000,027,440 | —- | C] () – C:\WINDOWS\System32\drivers\secdrv.sys
[2004/06/01 11.39.56 | 000,094,274 | —- | C] () – C:\WINDOWS\System32\HPBHEALR.DLL
[1998/05/07 04.10.00 | 000,069,632 | —- | C] () – C:\WINDOWS\System32\ODMA32.dll

========== LOP Check ==========

[2010/09/25 23.53.43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Dati applicazioni\Panda Security
[2009/06/22 23.16.30 | 000,000,000 | —D | M] – C:\Documents and Settings\Pc\Dati applicazioni\Faykh
[2010/09/26 02.13.38 | 000,000,000 | —D | M] – C:\Documents and Settings\Pc\Dati applicazioni\Ilza
[2009/03/01 12.02.43 | 000,000,000 | —D | M] – C:\Documents and Settings\Pc\Dati applicazioni\InterVideo
[2010/01/25 22.09.58 | 000,000,000 | —D | M] – C:\Documents and Settings\Pc\Dati applicazioni\Leadertech
[2010/09/25 23.55.23 | 000,000,000 | —D | M] – C:\Documents and Settings\Pc\Dati applicazioni\Panda Security
[2006/08/23 17.17.05 | 000,000,000 | —D | M] – C:\Documents and Settings\Pc\Dati applicazioni\SampleView
[2010/09/26 00.58.07 | 000,000,000 | —D | M] – C:\Documents and Settings\Pc\Dati applicazioni\ss_dtx_tb
[2010/09/26 02.04.45 | 000,000,000 | —D | M] – C:\Documents and Settings\Pc\Dati applicazioni\Uxfek
[2010/09/26 03.01.04 | 000,000,000 | —D | M] – C:\Documents and Settings\Pc\Dati applicazioni\Ymyfup

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2009/03/05 19.49.01 | 000,000,211 | RHS- | M] () – C:\boot.ini
[1999/04/13 01.12.26 | 000,000,512 | —- | M] () – C:\Boot32.w2k
[2004/08/19 10.00.00 | 000,004,952 | RHS- | M] () – C:\Bootfont.bin
[1998/10/05 17.32.06 | 000,000,512 | —- | M] () – C:\bootsec
[1999/04/07 04.34.04 | 000,001,536 | —- | M] () – C:\BOOTSEC.32
[2010/09/26 10.40.49 | 527,880,192 | -HS- | M] () – C:\hiberfil.sys
[2004/08/19 10.00.00 | 000,047,564 | -HS- | M] () – C:\NTDETECT.COM
[2004/08/19 10.00.00 | 000,251,072 | -HS- | M] () – C:\NTLDR
[2010/09/26 10.40.48 | 792,723,456 | -HS- | M] () – C:\pagefile.sys

< %systemroot%\Fonts\*.com >

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2004/08/30 13.07.18 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2004/06/15 06.00.00 | 000,017,920 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPD61.DLL
[2004/06/15 06.00.00 | 000,054,272 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPP61.DLL
[2004/06/01 14.55.56 | 000,061,952 | —- | M] (Hewlett-Packard Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp35z.dll
[2004/07/23 02.00.00 | 000,026,112 | —- | M] (PortableAppZ.blogspot.com) – C:\WINDOWS\system32\spool\prtprocs\w32x86\xkUOCEI3.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2004/08/30 14.54.42 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2004/08/30 14.54.42 | 000,638,976 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2004/08/30 14.54.42 | 000,434,176 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/02/28 19.04.49 | 000,000,123 | -HS- | M] () – C:\Documents and Settings\Pc\Dati applicazioni\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2010/09/26 10.47.36 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Pc\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2010/09/26 00.51.18 | 000,000,067 | -HS- | M] () – C:\Documents and Settings\Pc\Cookies\desktop.ini
[2010/09/26 10.58.20 | 000,229,376 | —- | M] () – C:\Documents and Settings\Pc\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2004/08/11 21.28.54 | 000,192,512 | —- | M] (Microsoft Corporation) – C:\WINDOWS\inf\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.exe >
[2004/10/13 18.24.37 | 001,694,208 | —- | M] (Microsoft Corporation) – C:\Programmi\Messenger\msmsgs.exe

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< %USERPROFILE%\Templates\*.tmp >

< %SYSTEMDRIVE%\explorexxx.exe\*.* >

< %Windir%\Installer\*.tmp >

< %systemroot%\System32\*.xco >

< %ProgramFiles%\system32\*.* >

< %systemroot%\System32\windos\*.* >

< %SystemRoot%\system32\sandbox\*.* >

< %SystemRoot%\system32\*.amo >

< %SystemRoot%\system32\Windows Live\*.* >

< %ProgramFiles%\logs\*.* >

< %ProgramFiles%\Bifrost\*.* >

< %SystemRoot%\system32\*.goo >

< %systemroot%\system32\IME\*.* >

< %systemroot%\BackUp\*.* >

< %systemroot%\system32\*.ico >

< %systemroot%\system\*.dat >

< %systemroot%\system\*.exe >

< %AppData%\Macromedia\Common\*.* >

< %SYSTEMDRIVE%\dir\*.* /s >

< %systemroot%\system32\ras\*.exe >

< %SYSTEMDRIVE%\MFILES\*.* >

< %SYSTEMDRIVE%\mDNSRespon.exe\*.* >

< %systemroot%\system32\services\*.* >

< %systemroot%\Spooler\*.* >

< %ProgramFiles%\system32\*.* >

< %systemroot%\system32\Setup\*.dll /x >

< %systemroot%\system32\*.mine >

< %SYSTEMDRIVE%\cleansweep.exe\*.* >

< %systemroot%\system32\ras\*.dll >

< %systemroot%\system32\ras\*.drv >

< %systemroot%\*.iq >

< %systemroot%\system32\XP\*.* >

< %SYSTEMDRIVE%\Extracted\*.* >

< %systemroot%\system32\windows\*.* >

< %systemroot%\logs\*.* >

< %SYSTEMDRIVE%\Win.Msi\*.* >

< %systemroot%\regedit\*.* >

< %systemroot%\system32\skype\*.* >

< %AppData%\Adobe\dlluplwin25\*.* >

< %UserProfile%\*.dat >
[2010/09/26 10.40.16 | 003,145,728 | -H– | M] () – C:\Documents and Settings\Pc\NTUSER.DAT

< %UserProfile%\*.dll >

< %systemroot%\system32\*.sxo >

< %SYSTEMDRIVE%\Gazma\*.* /s >

< %systemroot%\system32\spynet\*.* >

< %systemroot%\system32\System\*.* >

< %appdata%\Microsoft\Windows\*.* >

< %systemroot%\system32\WinDir\*.* >

< %systemroot%\_\*.* >

< %systemroot%\system32\windows32\*.* >

< %ProgramFiles%\win\*.* >

< %AppData%\Microsoft\CD Burning\*.* >

< %systemroot%\*.cab >

< %systemroot%\K.Backup\*.* >

< %ProgramFiles%\Massenger\*.* >

< %systemroot%\System32\*.doc >

< %systemroot%\Office12\*.* >

< %systemroot%\System32\Rundl32.exe\*.* >

< %ProgramFiles%\yahoo.net\*.* >

< %systemroot%\system32\*.igo >

< %systemroot%\*.rew >

< %systemroot%\System32\spool\DRIVERS\W32X86\3\*.exe >
[2005/03/27 17.00.00 | 000,045,056 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CNAB4LAK.EXE
[2005/03/27 17.00.00 | 000,057,344 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CNAB4RPK.EXE
[2005/03/27 17.00.00 | 000,409,600 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CNAB4SWK.EXE
[2005/03/27 17.00.00 | 000,372,736 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CNAB4UN.EXE
[2004/06/15 06.00.00 | 000,080,896 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMPV61.EXE
[2004/06/15 06.00.00 | 000,008,704 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSD61.EXE
[2004/06/15 06.00.00 | 000,130,048 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSM61.EXE
[2004/06/15 06.00.00 | 000,006,656 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSQ61.EXE
[2004/11/04 21.07.00 | 000,524,288 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CPC10DA4.EXE
[2004/11/04 21.07.00 | 000,880,640 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CPC10QA4.EXE
[2004/11/04 21.07.00 | 000,450,560 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\CPC10VA4.EXE
[2004/06/01 11.42.42 | 000,073,728 | —- | M] (Hewlett-Packard Company) – C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
[2004/06/01 11.42.44 | 000,077,824 | —- | M] (Hewlett-Packard Company) – C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
[2004/06/01 11.42.32 | 000,061,440 | —- | M] (Hewlett-Packard) – C:\WINDOWS\system32\spool\drivers\w32x86\3\HPNRA.EXE
[2004/06/01 11.42.34 | 000,061,699 | —- | M] (HP) – C:\WINDOWS\system32\spool\drivers\w32x86\3\HPZINW12.EXE
[2004/06/01 11.42.36 | 000,065,536 | —- | M] (HP) – C:\WINDOWS\system32\spool\drivers\w32x86\3\HPZIPM12.EXE

< %USERPROFILE%\.COMMgr\*.* >

< %USERPROFILE%\Desktop\*.bat >

< %PROGRAMFILES%\Common Files\Real\visualizations\*.* >

< %PROGRAMFILES%\Internet Explorer\*.Jmp >

< %PROGRAMFILES%\Windows NT\system\*.dll >

< %systemroot%\system32\*.ext >

< %systemroot%\system32\Com\*.cfg >

< %systemroot%\system32\btz\*.* >

< %systemroot%\system32\EMP\*.* >

< %systemroot%\system32\expo\*.* >

< %systemroot%\system32\inet2\*.* >

< %systemroot%\system32\xrem\*.* >

< %ProgramFiles%\Microsoft\*.* >

< %systemroot%\usgwmt\*.* >

< %ProgramFiles%\B\*.* >

< %SYSTEMDRIVE%\lspp\*.* >

< %systemroot%\Kral\*.* >

< %SYSTEMDRIVE%\windowsdvd.exe\*.* >

< %systemroot%\system32\*.ipo >

< %SYSTEMDRIVE%\usxxxxxxxx.exe\*.* >

< %systemroot%\system32\*.mof >

< %systemroot%\*.atm >

< %systemroot%\system32\svhost\*.* >

< %ProgramFiles%\system32\*.* >

< %ProgramFiles%\Docmentt\*.* >

< %systemroot%\Help\*.vbs >

< %ProgramFiles%\Windows WinSxs\*.* /s >

< %ProgramFiles%\Outlook Express\IDT\*.* /s >

< %ProgramFiles%\Microsoft Office\365\*.* /s >

< %ProgramFiles%\Windows Live\*.* >

< %systemroot%\system32\win32\*.* >

< %SYSTEMDRIVE%\RECYCLER\*.* >

< %systemroot%\Fresh1\*.* >

< %ProgramFiles%\Kekj\*.* /s >

< %systemroot%\GDU\*.* >

< %systemroot%\KA\*.* >

< %systemroot%\R\*.* >

< %systemroot%\system32\*.fyo >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
< End of report >

Extras.Txt

OTL Extras logfile created on: 26/09/2010 10.59.38 - Run 1
OTL by OldTimer - Version 3.2.14.1 Folder = C:\Documents and Settings\Pc\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000410 | Country: Italia | Language: ITA | Date Format: dd/MM/yyyy

503,00 Mb Total Physical Memory | 205,00 Mb Available Physical Memory | 41,00% Memory free
1,00 Gb Paging File | 1,00 Gb Available in Paging File | 71,00% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programmi
Drive C: | 67,22 Gb Total Space | 54,35 Gb Free Space | 80,86% Space Free | Partition Type: NTFS
Drive D: | 7,30 Gb Total Space | 0,42 Gb Free Space | 5,80% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: PC382528461259
Current User Name: Pc
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "C:\Programmi\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Programmi\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 1
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\SMINST\Scheduler.exe" = C:\WINDOWS\SMINST\Scheduler.exe:*:Enabled:Scheduler – ()
"C:\WINDOWS\system32\CNAB4RPK.EXE" = C:\WINDOWS\system32\CNAB4RPK.EXE:*:Enabled:Canon LBP2900 RPC Server Process – (CANON INC.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{075473F5-846A-448B-BCB3-104AA1760205}" = Sonic Data Module
"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Sonic DLA
"{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}" = Google Earth
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{21657574-BD54-48A2-9450-EB03B2C7FC29}" = Sonic MyDVD Plus
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.00 H1
"{350C9410-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3F9F7336-6DF8-476F-ABF6-C70A17FAF619}" = Installer HP Backup and Recovery Manager
"{4302B2DD-D958-40E3-BAF3-B07FFE1978CE}" = HP Wireless Assistant 2.00 E1
"{48CF6549-B45D-4313-9927-EFCCC8A3493F}" = TIPCI
"{559AD08F-3474-4F96-B374-A59F2A1E2518}" = MH505UP Onda Wizard
"{55A41219-9B22-4098-BAE7-AE289B3C569A}_is1" = Panda USB Vaccine 1.0.1.4
"{5D97A4A7-C274-4B63-86D9-07A33435F505}" = InterVideo DVD Check
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Sonic Express Labeler
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{83ED1E80-A1B7-4236-BCF1-AC4A88151A6B}" = Microsoft AutoRoute 2006
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Graphics Media Accelerator Driver
"{90280410-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional con FrontPage
"{914E1AB1-DCA0-4A7D-935F-B58C4B887A2B}" = HP ProtectTools Security Manager 2.00 C3
"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9F7AF7CD-E3D0-4C68-A3BA-C76C359B3AA8}" = LightScribe 1.4.105.1
"{A7AD8CEF-72D7-4FE4-8A14-DDD09DC86074}" = HP Notebook Accessories Product Tour
"{A93944F2-D2D4-4750-BFE7-9A288FEAF2CF}" = Apple Application Support
"{A93C4E94-1005-489D-BEAA-B873C1AA6CFC}" = HP Help and Support
"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Sonic Audio Module
"{AC76BA86-7AD7-1040-7B44-A70500000002}" = Adobe Reader 7.0.5 - Italiano
"{AE052EF7-2640-48D7-8915-69B810D975CB}" = HP BIOS Configuration for ProtectTools 2.00 E1
"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Sonic Copy Module
"{B9F4C05D-E42F-4E9A-A73F-FDD9355319FB}" = HP Credential Manager for ProtectTools
"{BB85ED9C-AFC9-43BD-B8DC-258C3C7DF72E}" = HP Software Update
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{DB0781F5-06D2-49BB-87B5-00F3B834FC3B}" = HP User Guides 0015
"{DB518BA6-CB74-4EB6-9ABD-880B6D6E1F38}" = HpSdpAppCoreApp
"{E0DBC47C-ED3F-4A1B-A929-9A26DAAA14B3}" = Application Installer 4.00.B5
"{EB900AF8-CC61-4E15-871B-98D1EA3E8025}" = QuickTime
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F2D2B58B-B2FD-46D1-8319-DCE564079934}" = Microsoft .NET Framework 1.1 Italian Language Pack
"{F6869CD2-3DB4-476D-A4C7-B3AE7C3ACF7B}" = Windows Media Connect
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Canon LBP2900" = Canon LBP2900
"CANONBJ_Deinstall_CNMCP61.DLL" = Canon PIXMA iP3000
"Fraps" = Fraps
"HijackThis" = HijackThis 2.0.2
"ie8" = Windows Internet Explorer 8
"InstallShield_{48CF6549-B45D-4313-9927-EFCCC8A3493F}" = Texas Instruments PCIxx21/x515/xx12 drivers.
"KLiteCodecPack_is1" = K-Lite Mega Codec Pack 1.60
"Nero - Burning Rom!UninstallKey" = Nero 6
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"WGA" = Windows Genuine Advantage Validation Tool
"Windows Media Connect" = Windows Media Connect
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"WinRAR archiver" = WinRAR gestione archivi

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 25/09/2010 19.59.58 | Computer Name = PC382528461259 | Source = MsiInstaller | ID = 11406
Description = Product: Panda Cloud Antivirus – Error 1406.Could not write value
to key \SOFTWARE\Panda Software\Setup\UIDS. System error . Verify that you have
sufficient access to that key, or contact your support personnel.

Error - 25/09/2010 20.08.30 | Computer Name = PC382528461259 | Source = Application Hang | ID = 1002
Description = Applicazione in stallo iexplore.exe, versione 8.0.6001.18702, modulo
in stallo hungapp, versione 0.0.0.0, indirizzo stallo 0x00000000.

Error - 25/09/2010 20.10.41 | Computer Name = PC382528461259 | Source = crypt32 | ID = 131080
Description = Impossibile eseguire il recupero con aggiornamento automatico del
numero di sequenza dell'elenco principale di altri produttori da: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
a causa del seguente errore: A connection with the server could not be established

Error - 25/09/2010 20.15.44 | Computer Name = PC382528461259 | Source = crypt32 | ID = 131080
Description = Impossibile eseguire il recupero con aggiornamento automatico del
numero di sequenza dell'elenco principale di altri produttori da: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
a causa del seguente errore: A connection with the server could not be established

Error - 25/09/2010 21.00.01 | Computer Name = PC382528461259 | Source = Application Hang | ID = 1002
Description = Applicazione in stallo iexplore.exe, versione 8.0.6001.18702, modulo
in stallo hungapp, versione 0.0.0.0, indirizzo stallo 0x00000000.

Error - 25/09/2010 21.11.46 | Computer Name = PC382528461259 | Source = crypt32 | ID = 131080
Description = Impossibile eseguire il recupero con aggiornamento automatico del
numero di sequenza dell'elenco principale di altri produttori da: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
a causa del seguente errore: A connection with the server could not be established

Error - 25/09/2010 21.15.15 | Computer Name = PC382528461259 | Source = Application Hang | ID = 1002
Description = Applicazione in stallo iexplore.exe, versione 8.0.6001.18702, modulo
in stallo hungapp, versione 0.0.0.0, indirizzo stallo 0x00000000.

Error - 25/09/2010 21.15.19 | Computer Name = PC382528461259 | Source = Application Hang | ID = 1001
Description = Bucket 1180947459 errato.

Error - 25/09/2010 22.59.51 | Computer Name = PC382528461259 | Source = Application Hang | ID = 1002
Description = Applicazione in stallo iexplore.exe, versione 8.0.6001.18702, modulo
in stallo hungapp, versione 0.0.0.0, indirizzo stallo 0x00000000.

Error - 26/09/2010 4.23.54 | Computer Name = PC382528461259 | Source = crypt32 | ID = 131080
Description = Impossibile eseguire il recupero con aggiornamento automatico del
numero di sequenza dell'elenco principale di altri produttori da: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
a causa del seguente errore: A connection with the server could not be established

[ System Events ]
Error - 25/09/2010 18.34.35 | Computer Name = PC382528461259 | Source = Service Control Manager | ID = 7023
Description = Servizio HID Input Service terminato con l'errore: %%2

Error - 25/09/2010 19.39.44 | Computer Name = PC382528461259 | Source = Service Control Manager | ID = 7023
Description = Servizio HID Input Service terminato con l'errore: %%2

Error - 25/09/2010 19.44.41 | Computer Name = PC382528461259 | Source = Service Control Manager | ID = 7023
Description = Servizio HID Input Service terminato con l'errore: %%2

Error - 25/09/2010 20.06.53 | Computer Name = PC382528461259 | Source = SideBySide | ID = 16842784
Description = Impossibile trovare assemblaggio dipendente Microsoft.VC90.CRT e l'ultimo
errore è stato L'assembly a cui si fa riferimento non è installato nel computer.

Error - 25/09/2010 20.06.53 | Computer Name = PC382528461259 | Source = SideBySide | ID = 16842811
Description = Resolve Partial Assembly non riuscito per Microsoft.VC90.CRT. Riferimento
al messaggio di errore: L'assembly a cui si fa riferimento non è installato nel
computer. .

Error - 25/09/2010 20.06.53 | Computer Name = PC382528461259 | Source = SideBySide | ID = 16842811
Description = Generate Activation Context non riuscito per C:\DOCUME~1\Pc\IMPOST~1\Temp\RarSFX2\redist.dll.
Riferimento
al messaggio di errore: Operazione completata. .

Error - 25/09/2010 20.15.11 | Computer Name = PC382528461259 | Source = Service Control Manager | ID = 7023
Description = Servizio HID Input Service terminato con l'errore: %%2

Error - 25/09/2010 21.11.22 | Computer Name = PC382528461259 | Source = Service Control Manager | ID = 7023
Description = Servizio HID Input Service terminato con l'errore: %%2

Error - 26/09/2010 4.23.34 | Computer Name = PC382528461259 | Source = Service Control Manager | ID = 7023
Description = Servizio HID Input Service terminato con l'errore: %%2

Error - 26/09/2010 4.41.03 | Computer Name = PC382528461259 | Source = Service Control Manager | ID = 7023
Description = Servizio HID Input Service terminato con l'errore: %%2

< End of report >

Attachments:

oldman960

Post #7September 26, 2010, 2:01 PM UTC

Hi FliffyMagic,

Next, Double click on OTL.exe

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE
please note the fix starts with the :

:Services

:Files
ipconfig /flushdns /c

:Commands
[emptytemp]
[Reboot]

Then click the Run Fix button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.

Please post the OTL log in your next reply.

Next

Go HERE to get a randomly named copy of GMER. Scroll down to the Download section and click Download EXE. Save it to your desktop.

Before scanning with GMER, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double click on the file you downloaded. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

[external image: Posted Image]
Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and post it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

If GMER will not run in normal windows, please run it in Saffe Mode

Please poat back with

OTL fix log
GMER log

Are you still being redirected?

Do you use a router?

Thanks

FliffyMagic

Post #8September 26, 2010, 3:26 PM UTC

Thank you again, OldTimer,

I am only receiving an error message which says, "Can not find File." once explorer launches - There is no more re-direct (yeah!). Is there a way to eliminate the error message or prevent from popping up? I don't use a router.

Here are the files for you…

All processes killed
========== SERVICES/DRIVERS ==========
========== FILES ==========
< ipconfig /flushdns /c >
Configurazione IP di Windows
Svuotata la cache del resolver DNS.
C:\Documents and Settings\Pc\Desktop\Malware OTL files\cmd.bat deleted successfully.
C:\Documents and Settings\Pc\Desktop\Malware OTL files\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32768 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32969 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Pc
->Temp folder emptied: 398967735 bytes
->Temporary Internet Files folder emptied: 18956565 bytes
->Java cache emptied: 118041 bytes
->Flash cache emptied: 85771 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 2885 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 2450251 bytes

Total Files Cleaned = 401,00 mb

OTL by OldTimer - Version 3.2.14.1 log created on 09262010_164810

Files\Folders moved on Reboot…
File\Folder C:\Documents and Settings\Pc\Impostazioni locali\Temp\~DF5B27.tmp not found!
File\Folder C:\Documents and Settings\Pc\Impostazioni locali\Temp\~DF6B86.tmp not found!
File\Folder C:\Documents and Settings\Pc\Impostazioni locali\Temp\~DF6B9E.tmp not found!
File\Folder C:\Documents and Settings\Pc\Impostazioni locali\Temp\~DF6C1A.tmp not found!
File\Folder C:\Documents and Settings\Pc\Impostazioni locali\Temp\~DF6C32.tmp not found!
File\Folder C:\Documents and Settings\Pc\Impostazioni locali\Temp\~DF6D54.tmp not found!
File\Folder C:\Documents and Settings\Pc\Impostazioni locali\Temp\~DF6D6C.tmp not found!
File\Folder C:\Documents and Settings\Pc\Impostazioni locali\Temp\~DF7367.tmp not found!
File\Folder C:\Documents and Settings\Pc\Impostazioni locali\Temp\~DF9D4.tmp not found!
File\Folder C:\Documents and Settings\Pc\Impostazioni locali\Temp\~DFFF38.tmp not found!
C:\Documents and Settings\Pc\Impostazioni locali\Temporary Internet Files\Content.IE5\O8A2EHEE\iframe[1].htm moved successfully.
C:\Documents and Settings\Pc\Impostazioni locali\Temporary Internet Files\Content.IE5\O8A2EHEE\InboxLight[2].htm moved successfully.
C:\Documents and Settings\Pc\Impostazioni locali\Temporary Internet Files\Content.IE5\O8A2EHEE\index[2].htm moved successfully.
C:\Documents and Settings\Pc\Impostazioni locali\Temporary Internet Files\Content.IE5\O8A2EHEE\xmlProxy[1].htm moved successfully.
C:\Documents and Settings\Pc\Impostazioni locali\Temporary Internet Files\Content.IE5\6ZM0Q0EL\like[1].htm moved successfully.
C:\Documents and Settings\Pc\Impostazioni locali\Temporary Internet Files\Content.IE5\6ZM0Q0EL\LocalStorage[1].htm moved successfully.
C:\Documents and Settings\Pc\Impostazioni locali\Temporary Internet Files\Content.IE5\6ZM0Q0EL\Messenger[1].htm moved successfully.
C:\Documents and Settings\Pc\Impostazioni locali\Temporary Internet Files\Content.IE5\67SZQ6IX\01[1].htm moved successfully.
C:\Documents and Settings\Pc\Impostazioni locali\Temporary Internet Files\Content.IE5\67SZQ6IX\default[1].htm moved successfully.
C:\Documents and Settings\Pc\Impostazioni locali\Temporary Internet Files\Content.IE5\67SZQ6IX\iframe[1].htm moved successfully.
C:\Documents and Settings\Pc\Impostazioni locali\Temporary Internet Files\Content.IE5\67SZQ6IX\xmlProxy[1].htm moved successfully.
C:\Documents and Settings\Pc\Impostazioni locali\Temporary Internet Files\Content.IE5\4T0J1T24\index[2].htm moved successfully.

Registry entries deleted on Reboot…

…AND THE GMER File…

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-09-26 17:12:37
Windows 5.1.2600 Service Pack 2
Running: kgx8bvp9.exe; Driver: C:\DOCUME~1\Pc\IMPOST~1\Temp\ffddafob.sys

—- System - GMER 1.0.15 —-

SSDT F8B9419E ZwCreateKey
SSDT F8B94194 ZwCreateThread
SSDT F8B941A3 ZwDeleteKey
SSDT F8B941AD ZwDeleteValueKey
SSDT F8B941B2 ZwLoadKey
SSDT F8B94180 ZwOpenProcess
SSDT F8B94185 ZwOpenThread
SSDT F8B941BC ZwReplaceKey
SSDT F8B941B7 ZwRestoreKey
SSDT F8B941A8 ZwSetValueKey
SSDT \??\C:\WINDOWS\system32\DRIVERS\PavProc.sys (Panda Protection driver/Panda Security, S.L.) ZwTerminateProcess [0xAA6D54E8]

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!ZwCallbackReturn + 2F90 80503C74 4 Bytes CALL 28FAA9CD
.rsrc C:\WINDOWS\system32\DRIVERS\i8042prt.sys entry point in ".rsrc" section [0xF864C294]

—- Devices - GMER 1.0.15 —-

Device \FileSystem\Ntfs \Ntfs ShlDrv51.sys (PandaShield driver/Panda Security, S.L.)

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 eabfiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Development Company, L.P.)

Device \FileSystem\Cdfs \Cdfs DLAIFS_M.SYS (Drive Letter Access Component/Sonic Solutions)
Device -> \Driver\iaStor \Device\Harddisk0\DR0 81888EC5

—- Registry - GMER 1.0.15 —-

Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{077ACEC7-979C-40AB-9835-435BA1511E0D}@FriendlyName Windows Media Files
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{077ACEC7-979C-40AB-9835-435BA1511E0D}@ComponentGUID {077ACEC7-979C-40AB-9835-435BA1511E0D}
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{077ACEC7-979C-40AB-9835-435BA1511E0D}@Version 655360
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{077ACEC7-979C-40AB-9835-435BA1511E0D}@Sub-Version 3646
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{077ACEC7-979C-40AB-9835-435BA1511E0D}@ExceptionInfName C:\WINDOWS\RegisteredPackages\{077ACEC7-979C-40AB-9835-435BA1511E0D}\MPPRE10.inf
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{077ACEC7-979C-40AB-9835-435BA1511E0D}@ExceptionCatalogName C:\WINDOWS\RegisteredPackages\{077ACEC7-979C-40AB-9835-435BA1511E0D}\mppre10.cat
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{30C7234B-6482-4A55-A11D-ECD9030313F2}@FriendlyName Windows Media Files
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{30C7234B-6482-4A55-A11D-ECD9030313F2}@ComponentGUID {30C7234B-6482-4A55-A11D-ECD9030313F2}
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{30C7234B-6482-4A55-A11D-ECD9030313F2}@Version 655360
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{30C7234B-6482-4A55-A11D-ECD9030313F2}@Sub-Version 3646
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{30C7234B-6482-4A55-A11D-ECD9030313F2}@ExceptionInfName C:\WINDOWS\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\WMDM10.inf
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{30C7234B-6482-4A55-A11D-ECD9030313F2}@ExceptionCatalogName C:\WINDOWS\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\wmdm10.cat
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{3FDF25EE-E592-4495-8391-6E9C504DAC2B}@FriendlyName Windows Media Files
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{3FDF25EE-E592-4495-8391-6E9C504DAC2B}@ComponentGUID {3FDF25EE-E592-4495-8391-6E9C504DAC2B}
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{3FDF25EE-E592-4495-8391-6E9C504DAC2B}@Version 655360
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{3FDF25EE-E592-4495-8391-6E9C504DAC2B}@Sub-Version 3646
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{3FDF25EE-E592-4495-8391-6E9C504DAC2B}@ExceptionInfName C:\WINDOWS\RegisteredPackages\{3FDF25EE-E592-4495-8391-6E9C504DAC2B}\WMSET10.inf
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{3FDF25EE-E592-4495-8391-6E9C504DAC2B}@ExceptionCatalogName C:\WINDOWS\RegisteredPackages\{3FDF25EE-E592-4495-8391-6E9C504DAC2B}\wmset10.cat
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{60204BB3-7078-4F70-8F69-68297621941C}@FriendlyName Windows Media Files
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{60204BB3-7078-4F70-8F69-68297621941C}@ComponentGUID {60204BB3-7078-4F70-8F69-68297621941C}
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{60204BB3-7078-4F70-8F69-68297621941C}@Version 655360
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{60204BB3-7078-4F70-8F69-68297621941C}@Sub-Version 3646
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{60204BB3-7078-4F70-8F69-68297621941C}@ExceptionInfName C:\WINDOWS\RegisteredPackages\{60204BB3-7078-4F70-8F69-68297621941C}\MPSTUB10.inf
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{60204BB3-7078-4F70-8F69-68297621941C}@ExceptionCatalogName C:\WINDOWS\RegisteredPackages\{60204BB3-7078-4F70-8F69-68297621941C}\mpstub10.cat
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{981FB688-E76B-4246-987B-92083185B90A}@FriendlyName Windows Media Files
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{981FB688-E76B-4246-987B-92083185B90A}@ComponentGUID {981FB688-E76B-4246-987B-92083185B90A}
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{981FB688-E76B-4246-987B-92083185B90A}@Version 655360
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{981FB688-E76B-4246-987B-92083185B90A}@Sub-Version 3646
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{981FB688-E76B-4246-987B-92083185B90A}@ExceptionInfName C:\WINDOWS\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\WPD10.inf
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{981FB688-E76B-4246-987B-92083185B90A}@ExceptionCatalogName C:\WINDOWS\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\wpd10.cat
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{A47B3654-48EE-48A5-B629-97D70175E58F}@FriendlyName Windows Media Files
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{A47B3654-48EE-48A5-B629-97D70175E58F}@ComponentGUID {A47B3654-48EE-48A5-B629-97D70175E58F}
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{A47B3654-48EE-48A5-B629-97D70175E58F}@Version 655360
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{A47B3654-48EE-48A5-B629-97D70175E58F}@Sub-Version 3646
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{A47B3654-48EE-48A5-B629-97D70175E58F}@ExceptionInfName C:\WINDOWS\RegisteredPackages\{A47B3654-48EE-48A5-B629-97D70175E58F}\codecs10.inf
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{A47B3654-48EE-48A5-B629-97D70175E58F}@ExceptionCatalogName C:\WINDOWS\RegisteredPackages\{A47B3654-48EE-48A5-B629-97D70175E58F}\codecs10.cat
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}@FriendlyName Windows Media Files
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}@ComponentGUID {AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}@Version 655360
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}@Sub-Version 3646
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}@ExceptionInfName C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\WMFSDK10.inf
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}@ExceptionCatalogName C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\wmfsdk10.cat
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}@FriendlyName Windows Media Files
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}@ComponentGUID {C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}@Version 655360
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}@Sub-Version 3646
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}@ExceptionInfName C:\WINDOWS\RegisteredPackages\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}\DRM10.inf
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}@ExceptionCatalogName C:\WINDOWS\RegisteredPackages\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}\drm10.cat
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{CFB4B314-0328-45E1-94AF-45A3F5F48E0B}@FriendlyName Windows Media Files
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{CFB4B314-0328-45E1-94AF-45A3F5F48E0B}@ComponentGUID {CFB4B314-0328-45E1-94AF-45A3F5F48E0B}
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{CFB4B314-0328-45E1-94AF-45A3F5F48E0B}@Version 655360
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{CFB4B314-0328-45E1-94AF-45A3F5F48E0B}@Sub-Version 3646
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{CFB4B314-0328-45E1-94AF-45A3F5F48E0B}@ExceptionInfName C:\WINDOWS\RegisteredPackages\{CFB4B314-0328-45E1-94AF-45A3F5F48E0B}\MPCD10.inf
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{CFB4B314-0328-45E1-94AF-45A3F5F48E0B}@ExceptionCatalogName C:\WINDOWS\RegisteredPackages\{CFB4B314-0328-45E1-94AF-45A3F5F48E0B}\mpcd10.cat
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{DD90D410-1823-43EB-9A16-A2331BF08799}@FriendlyName Windows Media Files
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{DD90D410-1823-43EB-9A16-A2331BF08799}@ComponentGUID {DD90D410-1823-43EB-9A16-A2331BF08799}
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{DD90D410-1823-43EB-9A16-A2331BF08799}@Version 655360
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{DD90D410-1823-43EB-9A16-A2331BF08799}@Sub-Version 3646
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{DD90D410-1823-43EB-9A16-A2331BF08799}@ExceptionInfName C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}\WMP10.inf
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{DD90D410-1823-43EB-9A16-A2331BF08799}@ExceptionCatalogName C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}\wmp10.cat
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\OptionalComponents\SwFlash@Installed 1

—- Disk sectors - GMER 1.0.15 —-

Disk \Device\Harddisk0\DR0 sector 61: malicious code @ sector 0x950e110 size 0x1ca

—- Files - GMER 1.0.15 —-

File C:\WINDOWS\system32\DRIVERS\i8042prt.sys suspicious modification
File C:\WINDOWS\system32\drivers\iaStor.sys suspicious modification

—- EOF - GMER 1.0.15 —-

Ok?

Thanks!

oldman960

Post #9September 26, 2010, 4:26 PM UTC last edited September 26, 2010, 4:34 PM UTC

Hi FliffyMagic,

I am only receiving an error message which says, "Can not find File." once explorer launches

Are you referring to Internet Explorer?

Please read through the instructions to familarize youself with what to expect when the tool runs.

It is vitally important that combofix is renamed before it is even started to download

Please download ComboFix from Link 1or Link 2 to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

If you are using Firefox, make sure that your download settings are as follows:
-Tools->Options->Main tab
-Set to "Always ask me where to Save the files".
During the download, before you save it to your desktop, rename Combofix to jgh.exe

It is important you rename Combofix during the download, but not after.
Please do not rename Combofix to other names, but only to the one indicated.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix

———————————————————–

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

———————————————————–

Double click on ComboFix.exe (jgh.exe in your case) & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Please post back with

combofix log

How is the computer?

Thanks

FliffyMagic

Post #10September 26, 2010, 5:37 PM UTC

Hi There…yes, was speaking about Internet Explorer.

Ok, so here is the file you asked for. Thanks for directing me to it….

ComboFix 10-09-25.07 - Pc 26/09/2010 19.14.26.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.39.1040.18.503.240 [GMT 2:00]
Eseguito da: c:\documents and settings\Pc\Desktop\jgh.exe
AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {7C911005-0000-0000-0000-010000F0FD7F}
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {00153498-F260-0012-5E64-927CD8C0987C}
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Pc\Dati applicazioni\Faykh
c:\documents and settings\Pc\Dati applicazioni\Faykh\iqexq.ely
c:\windows\system32\spool\prtprocs\w32x86\xkUOCEI3.dll
D:\Autorun.inf

La copia infetta di c:\windows\system32\drivers\i8042prt.sys è stata trovata e disinfettata
ipristinata copia da - Kitty had a snack

.
((((((((((((((((((((((((( Files Creati Da 2010-08-26 al 2010-09-26 )))))))))))))))))))))))))))))))))))
.

2010-09-26 14:48 . 2010-09-26 14:48 ——– d—–w- C:\_OTL
2010-09-26 10:39 . 2010-09-26 10:39 ——– d—–w- c:\documents and settings\Pc\Impostazioni locali\Dati applicazioni\Lingoes
2010-09-26 10:39 . 2010-09-26 10:39 ——– d—–w- c:\documents and settings\Pc\Dati applicazioni\Lingoes
2010-09-26 10:39 . 2010-09-26 10:39 ——– d—–w- c:\documents and settings\All Users\Dati applicazioni\Lingoes
2010-09-26 10:39 . 2010-09-26 10:39 ——– d—–w- c:\programmi\Lingoes
2010-09-26 10:20 . 2010-04-29 13:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-26 10:20 . 2010-09-26 10:20 ——– d—–w- c:\documents and settings\All Users\Dati applicazioni\Malwarebytes
2010-09-26 10:20 . 2010-04-29 13:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-09-26 10:20 . 2010-09-26 11:17 ——– d—–w- c:\programmi\Malwarebytes' Anti-Malware
2010-09-26 01:06 . 2010-09-26 01:06 ——– d—–w- c:\programmi\Panda USB Vaccine
2010-09-26 00:32 . 2010-09-26 00:32 ——– d—–w- c:\programmi\Trend Micro
2010-09-26 00:17 . 2010-09-26 00:54 ——– d—–w- c:\windows\system32\NtmsData
2010-09-26 00:16 . 2010-09-26 00:16 ——– d—–w- c:\documents and settings\Pc\Dati applicazioni\Avira
2010-09-26 00:09 . 2010-09-26 00:09 ——– d—–w- c:\programmi\Avira
2010-09-26 00:09 . 2010-09-26 00:09 ——– d—–w- c:\documents and settings\All Users\Dati applicazioni\Avira
2010-09-26 00:09 . 2010-09-01 12:22 60936 —-a-w- c:\windows\system32\drivers\avgntflt.sys
2010-09-26 00:09 . 2010-09-01 12:22 126856 —-a-w- c:\windows\system32\drivers\avipbb.sys
2010-09-26 00:09 . 2010-06-17 13:28 45416 —-a-w- c:\windows\system32\drivers\avgntdd.sys
2010-09-26 00:09 . 2010-06-17 13:28 22360 —-a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-09-25 23:43 . 2008-03-04 13:59 41144 —-a-w- c:\windows\system32\drivers\ShlDrv51.sys
2010-09-25 23:43 . 2009-06-30 15:17 163336 —-a-w- c:\windows\system32\drivers\PavProc.sys
2010-09-25 23:40 . 2010-09-25 23:40 ——– d—–w- c:\programmi\File comuni\Panda Security
2010-09-25 22:58 . 2010-09-25 22:58 ——– d—–w- c:\documents and settings\Pc\Dati applicazioni\ss_dtx_tb
2010-09-25 21:55 . 2010-09-25 21:55 ——– d—–w- c:\documents and settings\Pc\Dati applicazioni\Panda Security
2010-09-25 21:53 . 2010-09-25 21:53 ——– d—–w- c:\documents and settings\All Users\Dati applicazioni\Panda Security
2010-09-25 21:42 . 2010-09-25 23:52 ——– d—–w- c:\programmi\Panda Security
2010-09-22 08:24 . 2010-09-22 08:24 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache
2010-09-19 10:34 . 2010-09-19 10:34 ——– d—–w- c:\programmi\MSECache
2010-09-16 05:43 . 2010-09-16 05:43 ——– d-sh–w- c:\documents and settings\Pc\IECompatCache
2010-09-15 18:08 . 2010-09-15 18:08 ——– d-sh–w- c:\documents and settings\Pc\PrivacIE
2010-09-15 18:06 . 2010-09-15 18:06 ——– d-sh–w- c:\documents and settings\Pc\IETldCache
2010-09-15 18:04 . 2010-09-15 18:04 ——– d—–w- c:\windows\system32\it-IT
2010-09-15 18:04 . 2010-09-15 18:04 ——– dc-h–w- c:\windows\ie8
2010-09-09 16:02 . 2010-09-09 22:45 ——– d—–w- C:\Fraps
2010-09-09 11:10 . 2010-09-09 11:28 ——– d—–w- c:\documents and settings\Pc\Dati applicazioni\Apple Computer
2010-09-09 11:09 . 2010-09-09 11:10 ——– d—–w- c:\programmi\QuickTime
2010-09-09 11:09 . 2010-09-09 11:09 ——– d—–w- c:\documents and settings\All Users\Dati applicazioni\Apple Computer
2010-09-09 11:09 . 2010-09-09 11:09 ——– d—–w- c:\programmi\File comuni\Apple
2010-09-09 11:09 . 2010-09-09 11:09 ——– d—–w- c:\documents and settings\Pc\Impostazioni locali\Dati applicazioni\Apple
2010-09-09 11:09 . 2010-09-09 11:09 ——– d—–w- c:\programmi\Apple Software Update
2010-09-09 11:09 . 2010-09-09 11:09 ——– d—–w- c:\documents and settings\All Users\Dati applicazioni\Apple
2010-09-09 11:08 . 2010-09-09 11:08 ——– d—–w- c:\documents and settings\Pc\Impostazioni locali\Dati applicazioni\Apple Computer
2010-09-08 17:11 . 2004-08-19 13:39 21504 —-a-w- c:\windows\system32\hidserv.dll
2010-09-08 17:11 . 2004-08-19 13:39 21504 —-a-w- c:\windows\system32\dllcache\hidserv.dll
2010-09-08 17:10 . 2004-08-03 21:07 59264 —-a-w- c:\windows\system32\drivers\USBAUDIO.sys
2010-09-08 17:10 . 2004-08-03 21:07 59264 —-a-w- c:\windows\system32\dllcache\usbaudio.sys
2010-09-06 13:43 . 2010-09-06 13:43 56 —ha-w- c:\windows\system32\ezsidmv.dat
2010-09-06 13:43 . 2010-09-25 14:06 ——– d—–w- c:\documents and settings\Pc\Dati applicazioni\skypePM
2010-09-06 13:42 . 2010-09-25 18:30 ——– d—–w- c:\documents and settings\Pc\Dati applicazioni\Skype
2010-09-06 13:42 . 2010-09-06 13:42 ——– d—–w- c:\programmi\File comuni\Skype
2010-09-06 13:42 . 2010-09-06 13:42 ——– d—–r- c:\programmi\Skype
2010-09-06 13:41 . 2010-09-06 13:42 ——– d—–w- c:\documents and settings\All Users\Dati applicazioni\Skype

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-26 01:01 . 2009-08-26 12:53 ——– d—–w- c:\documents and settings\Pc\Dati applicazioni\Ymyfup
2010-09-26 00:13 . 2010-02-04 15:44 ——– d—–w- c:\documents and settings\Pc\Dati applicazioni\Ilza
2010-09-26 00:04 . 2009-11-05 07:17 ——– d—–w- c:\documents and settings\Pc\Dati applicazioni\Uxfek
2010-09-09 11:10 . 2009-02-28 17:30 24800 —-a-w- c:\documents and settings\Pc\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2010-09-09 09:29 . 2004-08-30 11:20 63600 —-a-w- c:\windows\system32\perfc010.dat
2010-09-09 09:29 . 2004-08-30 11:20 426042 —-a-w- c:\windows\system32\perfh010.dat
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\programmi\QuickTime\qttask.exe" [2010-08-10 421888]
"avgnt"="c:\programmi\Avira\AntiVir Desktop\avgnt.exe" [2010-09-01 281768]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360]

c:\documents and settings\Pc\Menu Avvio\Programmi\Esecuzione automatica\
PandaUSBVaccine.lnk - c:\programmi\Panda USB Vaccine\USBVaccine.exe [2010-9-26 1287176]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard]
2005-07-25 18:41 40960 —-a-w- c:\programmi\HPQ\IAM\Bin\AsWlnPkg.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^Avvio veloce di Adobe Reader.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^DVD Check.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^Microsoft Office.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CognizanceTS]
2003-12-22 18:12 17920 —-a-w- c:\progra~1\HPQ\IAM\Bin\AsTsVcc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cpqset]
2006-01-26 12:35 172094 —-a-w- c:\programmi\HPQ\Default Settings\Cpqset.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]
2005-08-31 03:20 122940 —-a-w- c:\windows\system32\DLA\DLACTRLW.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2005-02-16 21:11 49152 —-a-w- c:\programmi\Hp\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpWirelessAssistant]
2006-02-14 08:49 454656 —-a-w- c:\programmi\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
2006-03-23 12:13 77824 —-a-w- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
2006-03-23 12:17 118784 —-a-w- c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
2006-03-23 12:17 94208 —-a-w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 10:50 155648 —-a-w- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PTHOSTTR]
2006-02-14 09:56 122880 —-a-w- c:\programmi\HPQ\HP ProtectTools Security Manager\pthosttr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl]
2006-05-08 07:56 131072 —-a-w- c:\programmi\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard]
2005-12-20 14:51 1187840 —-a-w- c:\windows\SMINST\Recguard.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder]
2006-03-09 15:38 806912 —-a-w- c:\windows\CREATOR\Remind_XP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Scheduler]
2006-02-15 15:43 892928 —-a-w- c:\windows\SMINST\Scheduler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX]
2005-05-06 12:06 716800 —-a-w- c:\programmi\Analog Devices\SoundMAX\SMax4.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
2005-05-20 08:11 925696 —-a-w- c:\programmi\Analog Devices\Core\smax4pnp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2005-11-10 11:03 36975 —-a-w- c:\programmi\Java\jre1.5.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2006-03-03 16:46 761948 —-a-w- c:\programmi\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WatchDog]
2005-11-08 10:59 184320 —-a-w- c:\programmi\InterVideo\DVD Check\DVDCheck.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\SMINST\\Scheduler.exe"=
"c:\\Programmi\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\CNAB4RPK.EXE"=
"c:\\Programmi\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Programmi\\Skype\\Phone\\Skype.exe"=

R1 ShldDrv;Panda File Shield Driver;c:\windows\system32\drivers\ShlDrv51.sys [26/09/2010 1.43.24 41144]
R2 ASChannel;Canale di comunicazione locale;c:\windows\System32\svchost.exe -k Cognizance [19/08/2004 10.00.00 14336]
R2 PavProc;Panda Process Protection Driver;c:\windows\system32\drivers\PavProc.sys [26/09/2010 1.43.23 163336]
S3 GTIPCI21;GTIPCI21;c:\windows\system32\DRIVERS\gtipci21.sys –> c:\windows\system32\DRIVERS\gtipci21.sys [?]
S3 ONDAusbmdm6k;ONDA Proprietary USB Driver;c:\windows\system32\drivers\ONDAusbmdm6k.sys [28/02/2009 19.58.41 104960]
S3 ONDAusbnmea;ONDA NMEA Port;c:\windows\system32\drivers\ONDAusbnmea.sys [28/02/2009 19.58.41 104960]
S3 ONDAusbser6k;ONDA Diagnostic Port;c:\windows\system32\drivers\ONDAusbser6k.sys [28/02/2009 19.58.41 104960]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Cognizance REG_MULTI_SZ ASChannel
.
.
——- Scansione supplementare ——-
.
uStart Page = hxxp://www.google.it/
uInternet Connection Wizard,ShellNext = hxxp://www.hp.com/
IE: &Cerca con Google - c:\programmi\Google\GoogleToolbar1.dll/cmsearch.html
IE: &Traduci parola in italiano - c:\programmi\Google\GoogleToolbar1.dll/cmwordtrans.html
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Link a ritroso - c:\programmi\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Pagine simili - c:\programmi\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Versione cache della pagina - c:\programmi\Google\GoogleToolbar1.dll/cmcache.html
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-26 19:20
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti …

scansione entrate autostart nascoste …

Scansione files nascosti …

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
——————— CHIAVI DI REGISTRO BLOCCATE ———————

[HKEY_LOCAL_MACHINE\software\Hewlett-Packard Company\Installer HP Backup and Recovery Manager ]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\ITConcepts\Authentication\TicketValidator\Cryptography]
@DACL=(02 0000)
@SACL=
"Csp"="Microsoft Enhanced RSA and AES Cryptographic Provider (Prototype)"
"CipherAlg"="3DES"
"HashAlg"="SHA-1"
"KeyLength"=dword:00000000
"KeysetVersion"=dword:00000066
"MasterKey lifetime, minutes"=dword:000005a0
"MasterKey history length"=dword:00000080

[HKEY_LOCAL_MACHINE\software\ITConcepts\Authentication\TicketValidator\Password History Cache]
@DACL=(02 0000)
@SACL=
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\ITConcepts\Authentication\TicketValidator\Time Synchronization]
@DACL=(02 0000)
@SACL=
"Enabled"=dword:00000001
"Period"=dword:00003840
"TimeCheckAllowance"=dword:0000012c
"(LastSync)"=hex:ae,af,de,06,af,ae,c2,62,79,63,19,d6,4d,ee,c2,62,79,63,19,d6,
4d,ee,f2,bc,32,c5
"(LastLocalSync)"="05/03/2009 18.51.11"
"(LastRemoteSync)"="05/03/2009 18.51.11"
"(Host)"="localhost"

[HKEY_LOCAL_MACHINE\software\Microsoft\Advanced INF Setup\IEHomePageInfo\RegBackup]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\10.0]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\Automenu]
@DACL=(02 0000)
@SACL=
"classid"="clsid:6B28F900-8D64-4B80-9963-CC52DDD1FBB4"
"visible"="false"
"tabstop"="false"
"width"="1"
"height"="1"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\BalanceSlider]
@DACL=(02 0000)
@SACL=
"classid"="clsid:F2BF2C90-405F-11D3-BB39-00A0C93CA73A"
"toolTip"="res://wmploc.dll/RT_STRING/#1845"
"min"="-100"
"max"="100"
"value"="wmpprop:player.settings.balance"
"value_onchange"="player.settings.balance=value;"
"accName"="res://wmploc.dll/RT_STRING/#2112"
"accKeyboardShortcut"="res://wmploc.dll/RT_STRING/#2108"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\browser]
@DACL=(02 0000)
@SACL=
"classid"="clsid:8856F961-340A-11D0-A96B-00C04FD705A2"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\Button]
@DACL=(02 0000)
@SACL=
"classid"="clsid:87291B51-0C8E-11D3-BB2A-00A0C93CA73A"
"accKeyboardShortcut"="res://wmploc.dll/RT_STRING/#2114"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\ButtonGroup]
@DACL=(02 0000)
@SACL=
"classid"="clsid:AE3B6831-25A9-11d3-BD41-00C04F6EA5AE"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\CloseButton]
@DACL=(02 0000)
@SACL=
"classid"="clsid:87291B51-0C8E-11D3-BB2A-00A0C93CA73A"
"upToolTip"="res://wmploc.dll/RT_STRING/#1812"
"onclick"="view.close();"
"accName"="res://wmploc.dll/RT_STRING/#2134"
"accKeyboardShortcut"="res://wmploc.dll/RT_STRING/#2135"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\CurrentPositionText]
@DACL=(02 0000)
@SACL=
"classid"="clsid:DDDA102E-0E17-11D3-A2E2-00C04F79F88E"
"tabStop"="true"
"justification"="right"
"value"="wmpprop:player.controls.currentPositionString"
"accName"="res://wmploc.dll/RT_STRING/#2103"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\CustomSlider]
@DACL=(02 0000)
@SACL=
"classid"="clsid:95F45AA3-ED0A-11D2-BA67-0000F80855E6"
"cursor"="hand"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\DropDownPlaylist]
@DACL=(02 0000)
@SACL=
"classid"="clsid:5F9CFD93-8CAD-11d3-9A7E-00C04F8EFB70"
"playlistItemsVisible"="false"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\DurationText]
@DACL=(02 0000)
@SACL=
"classid"="clsid:DDDA102E-0E17-11D3-A2E2-00C04F79F88E"
"tabStop"="true"
"justification"="right"
"value"="wmpprop:player.currentMedia.DurationString"
"accName"="res://wmploc.dll/RT_STRING/#2104"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\EditBox]
@DACL=(02 0000)
@SACL=
"classid"="clsid:6342FCED-25EA-4033-BDDB-D049A14382D3"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\Effects\Alchemy]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\Effects\Ambience]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\Effects\Bars]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\Effects\Dotplane]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\Effects\Plenoptic]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\Effects\Spikes]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\EqualizerSettings]
@DACL=(02 0000)
@SACL=
"classid"="clsid:93EB32F5-87B1-45ad-ACC6-0F2483DB83BB"
"tabStop"="false"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\FFWDButton]
@DACL=(02 0000)
@SACL=
"classid"="clsid:87291B51-0C8E-11D3-BB2A-00A0C93CA73A"
"enabled"="wmpenabled:player.controls.fastforward"
"upToolTip"="res://wmploc.dll/RT_STRING/#1804"
"onclick"="player.controls.FastForward()"
"accName"="res://wmploc.dll/RT_STRING/#2120"
"accKeyboardShortcut"="res://wmploc.dll/RT_STRING/#2121"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\ImageButton]
@DACL=(02 0000)
@SACL=
"classid"="clsid:87291B51-0C8E-11D3-BB2A-00A0C93CA73A"
"cursor"="hand"
"accName"="res://wmploc.dll/RT_STRING/#2140"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\ItemsPlaylist]
@DACL=(02 0000)
@SACL=
"classid"="clsid:5F9CFD93-8CAD-11d3-9A7E-00C04F8EFB70"
"backgroundcolor"="black"
"foregroundcolor"="white"
"columnsVisible"="false"
"columns"="name=Name;Duration=Time"
"dropDownVisible"="false"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\LibraryTree]
@DACL=(02 0000)
@SACL=
"classid"="clsid:D9DE732A-AEE9-4503-9D11-5605589977A8"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\ListBox]
@DACL=(02 0000)
@SACL=
"classid"="clsid:FC1880CF-83B9-43A7-A066-C44CE8C82583"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\menu]
@DACL=(02 0000)
@SACL=
"classid"="clsid:BAB3768B-8883-4AEC-9F9B-E14C947913EF"
"visible"="false"
"tabstop"="false"
"width"="1"
"height"="1"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\MinimizeButton]
@DACL=(02 0000)
@SACL=
"classid"="clsid:87291B51-0C8E-11D3-BB2A-00A0C93CA73A"
"upToolTip"="res://wmploc.dll/RT_STRING/#1811"
"onclick"="view.minimize();"
"accName"="res://wmploc.dll/RT_STRING/#2132"
"accKeyboardShortcut"="res://wmploc.dll/RT_STRING/#2133"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\MuteButton]
@DACL=(02 0000)
@SACL=
"classid"="clsid:87291B51-0C8E-11D3-BB2A-00A0C93CA73A"
"upToolTip"="res://wmploc.dll/RT_STRING/#1807"
"downToolTip"="res://wmploc.dll/RT_STRING/#1808"
"sticky"="true"
"down"="wmpprop:player.settings.mute"
"onClick"="player.settings.mute=down;"
"accName"="res://wmploc.dll/RT_STRING/#2130"
"accKeyboardShortcut"="res://wmploc.dll/RT_STRING/#2131"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\NextButton]
@DACL=(02 0000)
@SACL=
"classid"="clsid:87291B51-0C8E-11D3-BB2A-00A0C93CA73A"
"enabled"="wmpenabled:player.controls.next"
"upToolTip"="res://wmploc.dll/RT_STRING/#1806"
"onclick"="player.controls.Next()"
"accName"="res://wmploc.dll/RT_STRING/#2124"
"accKeyboardShortcut"="res://wmploc.dll/RT_STRING/#2125"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\PauseButton]
@DACL=(02 0000)
@SACL=
"classid"="clsid:87291B51-0C8E-11D3-BB2A-00A0C93CA73A"
"enabled"="wmpenabled:player.controls.pause"
"upToolTip"="res://wmploc.dll/RT_STRING/#1801"
"onclick"="player.controls.pause()"
"accName"="res://wmploc.dll/RT_STRING/#2116"
"accKeyboardShortcut"="res://wmploc.dll/RT_STRING/#2117"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\PlayButton]
@DACL=(02 0000)
@SACL=
"classid"="clsid:87291B51-0C8E-11D3-BB2A-00A0C93CA73A"
"enabled"="wmpenabled:player.controls.play"
"upToolTip"="res://wmploc.dll/RT_STRING/#1800"
"onclick"="player.controls.play()"
"accName"="res://wmploc.dll/RT_STRING/#2115"
"accKeyboardShortcut"="res://wmploc.dll/RT_STRING/#2117"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\Playlist]
@DACL=(02 0000)
@SACL=
"classid"="clsid:5F9CFD93-8CAD-11d3-9A7E-00C04F8EFB70"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\plugin]
@DACL=(02 0000)
@SACL=
"classid"="clsid:AA1AC37B-49A8-4B41-AF69-B0176C5FFC33"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\PopUp]
@DACL=(02 0000)
@SACL=
"classid"="clsid:FC1880CF-83B9-43A7-A066-C44CE8C82583"
"popup"="true"
"visible"="false"
"backgroundColor"="menu"
"foregroundColor"="menutext"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\PrevButton]
@DACL=(02 0000)
@SACL=
"classid"="clsid:87291B51-0C8E-11D3-BB2A-00A0C93CA73A"
"enabled"="wmpenabled:player.controls.previous"
"upToolTip"="res://wmploc.dll/RT_STRING/#1805"
"onclick"="player.controls.Previous()"
"accName"="res://wmploc.dll/RT_STRING/#2126"
"accKeyboardShortcut"="res://wmploc.dll/RT_STRING/#2127"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\ProgressBar]
@DACL=(02 0000)
@SACL=
"classid"="clsid:F2BF2C90-405F-11D3-BB39-00A0C93CA73A"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\RepeatButton]
@DACL=(02 0000)
@SACL=
"classid"="clsid:87291B51-0C8E-11D3-BB2A-00A0C93CA73A"
"upToolTip"="res://wmploc.dll/RT_STRING/#1816"
"downToolTip"="res://wmploc.dll/RT_STRING/#1817"
"sticky"="true"
"down"="jscript:player.settings.GetMode(\"loop\");"
"onClick"="player.settings.setMode(\"loop\", down);"
"accName"="res://wmploc.dll/RT_STRING/#2138"
"accKeyboardShortcut"="res://wmploc.dll/RT_STRING/#2139"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\ReturnButton]
@DACL=(02 0000)
@SACL=
"upToolTip"="res://wmploc.dll/RT_STRING/#1813"
"classid"="clsid:87291B51-0C8E-11D3-BB2A-00A0C93CA73A"
"onclick"="view.returnToMediaCenter();"
"accName"="res://wmploc.dll/RT_STRING/#2128"
"accKeyboardShortcut"="res://wmploc.dll/RT_STRING/#2129"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\REWButton]
@DACL=(02 0000)
@SACL=
"classid"="clsid:87291B51-0C8E-11D3-BB2A-00A0C93CA73A"
"enabled"="wmpenabled:player.controls.fastreverse"
"upToolTip"="res://wmploc.dll/RT_STRING/#1803"
"onclick"="player.controls.FastReverse()"
"accName"="res://wmploc.dll/RT_STRING/#2122"
"accKeyboardShortcut"="res://wmploc.dll/RT_STRING/#2123"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\SeekSlider]
@DACL=(02 0000)
@SACL=
"classid"="clsid:F2BF2C90-405F-11D3-BB39-00A0C93CA73A"
"toolTip"="res://wmploc.dll/RT_STRING/#1809"
"min"="0"
"max"="wmpprop:player.currentmedia.duration"
"value"="wmpprop:player.controls.currentposition"
"ondragend"="player.controls.currentposition=value;"
"foregroundProgress"="wmpprop:player.network.downloadProgress"
"useForegroundProgress"="true"
"accName"="res://wmploc.dll/RT_STRING/#2109"
"accKeyboardShortcut"="res://wmploc.dll/RT_STRING/#2108"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\ShuffleButton]
@DACL=(02 0000)
@SACL=
"classid"="clsid:87291B51-0C8E-11D3-BB2A-00A0C93CA73A"
"upToolTip"="res://wmploc.dll/RT_STRING/#1814"
"downToolTip"="res://wmploc.dll/RT_STRING/#1815"
"sticky"="true"
"down"="jscript:player.settings.GetMode(\"shuffle\");"
"onClick"="player.settings.setMode(\"shuffle\", down);"
"accName"="res://wmploc.dll/RT_STRING/#2136"
"accKeyboardShortcut"="res://wmploc.dll/RT_STRING/#2137"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\Slider]
@DACL=(02 0000)
@SACL=
"classid"="clsid:F2BF2C90-405F-11D3-BB39-00A0C93CA73A"
"accKeyboardShortcut"="res://wmploc.dll/RT_STRING/#2108"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\StatusText]
@DACL=(02 0000)
@SACL=
"classid"="clsid:DDDA102E-0E17-11D3-A2E2-00C04F79F88E"
"tabStop"="true"
"value"="wmpprop:player.status"
"accName"="res://wmploc.dll/RT_STRING/#2102"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\StopButton]
@DACL=(02 0000)
@SACL=
"classid"="clsid:87291B51-0C8E-11D3-BB2A-00A0C93CA73A"
"enabled"="wmpenabled:player.controls.stop"
"upToolTip"="res://wmploc.dll/RT_STRING/#1802"
"onclick"="player.controls.stop()"
"accName"="res://wmploc.dll/RT_STRING/#2118"
"accKeyboardShortcut"="res://wmploc.dll/RT_STRING/#2119"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\taskcenter]
@DACL=(02 0000)
@SACL=
"classid"="clsid:395BF287-6477-495f-8427-2C09A23C3248"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\Text]
@DACL=(02 0000)
@SACL=
"classid"="clsid:DDDA102E-0E17-11D3-A2E2-00C04F79F88E"
"tabStop"="false"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\TrackNameText]
@DACL=(02 0000)
@SACL=
"classid"="clsid:DDDA102E-0E17-11D3-A2E2-00C04F79F88E"
"tabStop"="true"
"value"="wmpprop:player.currentmedia.name"
"accName"="res://wmploc.dll/RT_STRING/#2105"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\Video]
@DACL=(02 0000)
@SACL=
"classid"="clsid:61CECF11-FC3A-11D2-A1CD-005004602752"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\VideoSettings]
@DACL=(02 0000)
@SACL=
"classid"="clsid:AE7BFAFE-DCC8-4a73-92C8-CC300CA88859"
"tabStop"="false"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\VolumeSlider]
@DACL=(02 0000)
@SACL=
"classid"="clsid:F2BF2C90-405F-11D3-BB39-00A0C93CA73A"
"min"="0"
"max"="100"
"value"="wmpprop:player.settings.volume"
"value_onchange"="if (value!=player.settings.volume){player.settings.volume=value;player.settings.mute=f
alse;}"
"toolTip"="res://wmploc.dll/RT_STRING/#1810"
"accName"="res://wmploc.dll/RT_STRING/#2110"
"accKeyboardShortcut"="res://wmploc.dll/RT_STRING/#2111"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\WMPEffects]
@DACL=(02 0000)
@SACL=
"classid"="clsid:47DEA830-D619-4154-B8D8-6B74845D6A2D"
"tabStop"="false"
"width"="250"
"height"="200"
"horizontalAlignment"="stretch"
"verticalAlignment"="stretch"
"currentEffectType"="wmpprop:mediacenter.effectType"
"currentPreset"="wmpprop:mediacenter.effectPreset"
"currentEffectType_onchange"="mediacenter.effectType = currentEffectType;"
"currentPreset_onchange"="mediacenter.effectPreset = currentPreset;"
"onclick"="next();"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\WMPVideo]
@DACL=(02 0000)
@SACL=
"classid"="clsid:61CECF11-FC3A-11D2-A1CD-005004602752"
"horizontalAlignment"="stretch"
"verticalAlignment"="stretch"
"zoom"="wmpprop:mediacenter.videoZoom"
"stretchToFit"="wmpprop:mediacenter.videoStretchToFit"
"backgroundColor"="black"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\services]
@DACL=(02 0000)
@SACL=
"NoServices"=dword:00000000

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Settings]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{0890F930-4F80-4646-BAB1-4B6E5571FB89}]
@DACL=(02 0000)
@SACL=
"Capabilities"=dword:00000004
"FriendlyName"="res://wmploc.dll/RT_STRING/#1491"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{1F32514F-1561-4922-A604-8A1F478B5A42}]
@DACL=(02 0000)
@SACL=
"Capabilities"=dword:00000004
"FriendlyName"="res://wmploc.dll/RT_STRING/#1495"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{52903d79-f993-4de6-8317-20c9c176d823}]
@DACL=(02 0000)
@SACL=
"Capabilities"=dword:00000004
"FriendlyName"="res://wmploc.dll/RT_STRING/#1496"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{59E7BF52-E5C9-4382-A39A-522DEE9AFDFD}]
@DACL=(02 0000)
@SACL=
"Capabilities"=dword:00000004
"FriendlyName"="res://wmploc.dll/RT_STRING/#1497"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{5DF031B7-6A37-42D9-8802-E27F4F224332}]
@DACL=(02 0000)
@SACL=
"Capabilities"=dword:00000003
"FriendlyName"="Viz Plug-in"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{5F4BB5C9-4652-489B-8601-EEC0C3C32E2E}]
@DACL=(02 0000)
@SACL=
"Capabilities"=dword:00000004
"FriendlyName"="res://wmploc.dll/RT_STRING/#1494"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{7F2B1D6B-1357-402C-A1C8-67E59583B41D}]
@DACL=(02 0000)
@SACL=
"Description"="Captions plugin description"
"Capabilities"=dword:000000f0
"FriendlyName"="Captions plugin name"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{93075F62-16B3-43EC-A53B-FFAD0E01D5E7}]
@DACL=(02 0000)
@SACL=
"Capabilities"=dword:00000003
"FriendlyName"="res://wmploc.dll/RT_STRING/#209"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{9695AEF9-9D03-4671-8F2F-FF49D1BB01C4}]
@DACL=(02 0000)
@SACL=
"Description"="Media Information description"
"Capabilities"=dword:00000005
"FriendlyName"="res://wmploc.dll/RT_STRING/#1407"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{976ABECA-93F7-4d81-9187-2A6137829675}]
@DACL=(02 0000)
@SACL=
"Capabilities"=dword:00000004
"FriendlyName"="res://wmploc.dll/RT_STRING/#1490"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{99DB05E3-F81E-4C8A-A252-F396306AB6FE}]
@DACL=(02 0000)
@SACL=
"Description"="Banner plugin description"
"Capabilities"=dword:000000f0
"FriendlyName"="Banner plugin name"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{9F9562EB-15B6-46C6-A7CB-0A66FC65130E}]
@DACL=(02 0000)
@SACL=
"Capabilities"=dword:00000004
"FriendlyName"="res://wmploc.dll/RT_STRING/#1493"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{9FA014E3-076F-4865-A73C-117131B8E292}]
@DACL=(02 0000)
@SACL=
"Capabilities"=dword:00000004
"FriendlyName"="res://wmploc.dll/RT_STRING/#1492"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{B3FBFCF3-DAE7-4B60-B632-FFFCBDD262A8}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="res://mswmccpl.dll/RT_STRING/#101"
"Description"="res://mswmccpl.dll/RT_STRING/#102"
"Capabilities"=dword:00000002

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{D5E49195-ED19-40fb-9EE0-E6625A808B77}]
@DACL=(02 0000)
@SACL=
"Capabilities"=dword:00000003
"FriendlyName"="Video Plug-in"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{E641D09E-E500-4c09-8260-F1CD7B902E9C}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="WM View plugin name"
"Description"="WM View plugin description"
"Capabilities"=dword:000000f0

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{F24A1BC2-2331-4B91-8A13-5A549DA56E9D}]
@DACL=(02 0000)
@SACL=
"Capabilities"=dword:00000003
"FriendlyName"="Border Plug-in"

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{FD981763-B6BB-4d51-9143-6D372A0ED56F}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="res://wmploc.dll/RT_STRING/#5822"
"Description"="res://wmploc.dll/RT_STRING/#5823"
"Capabilities"=dword:00000003

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{077ACEC7-979C-40AB-9835-435BA1511E0D}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="Windows Media Files"
"ComponentGUID"="{077ACEC7-979C-40AB-9835-435BA1511E0D}"
"Version"=dword:000a0000
"Sub-Version"=dword:00000e3e
"ExceptionInfName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{077ACEC7-979C-40AB-9835-435BA1511E0D}\\MPPRE10.inf"
"ExceptionCatalogName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{077ACEC7-979C-40AB-9835-435BA1511E0D}\\mppre10.cat"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{30C7234B-6482-4A55-A11D-ECD9030313F2}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="Windows Media Files"
"ComponentGUID"="{30C7234B-6482-4A55-A11D-ECD9030313F2}"
"Version"=dword:000a0000
"Sub-Version"=dword:00000e3e
"ExceptionInfName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{30C7234B-6482-4A55-A11D-ECD9030313F2}\\WMDM10.inf"
"ExceptionCatalogName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{30C7234B-6482-4A55-A11D-ECD9030313F2}\\wmdm10.cat"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{3FDF25EE-E592-4495-8391-6E9C504DAC2B}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="Windows Media Files"
"ComponentGUID"="{3FDF25EE-E592-4495-8391-6E9C504DAC2B}"
"Version"=dword:000a0000
"Sub-Version"=dword:00000e3e
"ExceptionInfName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{3FDF25EE-E592-4495-8391-6E9C504DAC2B}\\WMSET10.inf"
"ExceptionCatalogName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{3FDF25EE-E592-4495-8391-6E9C504DAC2B}\\wmset10.cat"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{60204BB3-7078-4F70-8F69-68297621941C}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="Windows Media Files"
"ComponentGUID"="{60204BB3-7078-4F70-8F69-68297621941C}"
"Version"=dword:000a0000
"Sub-Version"=dword:00000e3e
"ExceptionInfName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{60204BB3-7078-4F70-8F69-68297621941C}\\MPSTUB10.inf"
"ExceptionCatalogName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{60204BB3-7078-4F70-8F69-68297621941C}\\mpstub10.cat"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{981FB688-E76B-4246-987B-92083185B90A}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="Windows Media Files"
"ComponentGUID"="{981FB688-E76B-4246-987B-92083185B90A}"
"Version"=dword:000a0000
"Sub-Version"=dword:00000e3e
"ExceptionInfName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{981FB688-E76B-4246-987B-92083185B90A}\\WPD10.inf"
"ExceptionCatalogName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{981FB688-E76B-4246-987B-92083185B90A}\\wpd10.cat"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{A47B3654-48EE-48A5-B629-97D70175E58F}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="Windows Media Files"
"ComponentGUID"="{A47B3654-48EE-48A5-B629-97D70175E58F}"
"Version"=dword:000a0000
"Sub-Version"=dword:00000e3e
"ExceptionInfName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{A47B3654-48EE-48A5-B629-97D70175E58F}\\codecs10.inf"
"ExceptionCatalogName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{A47B3654-48EE-48A5-B629-97D70175E58F}\\codecs10.cat"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="Windows Media Files"
"ComponentGUID"="{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}"
"Version"=dword:000a0000
"Sub-Version"=dword:00000e3e
"ExceptionInfName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\\WMFSDK10.inf"
"ExceptionCatalogName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\\wmfsdk10.cat"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="Windows Media Files"
"ComponentGUID"="{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}"
"Version"=dword:000a0000
"Sub-Version"=dword:00000e3e
"ExceptionInfName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}\\DRM10.inf"
"ExceptionCatalogName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}\\drm10.cat"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{CFB4B314-0328-45E1-94AF-45A3F5F48E0B}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="Windows Media Files"
"ComponentGUID"="{CFB4B314-0328-45E1-94AF-45A3F5F48E0B}"
"Version"=dword:000a0000
"Sub-Version"=dword:00000e3e
"ExceptionInfName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{CFB4B314-0328-45E1-94AF-45A3F5F48E0B}\\MPCD10.inf"
"ExceptionCatalogName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{CFB4B314-0328-45E1-94AF-45A3F5F48E0B}\\mpcd10.cat"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{DD90D410-1823-43EB-9A16-A2331BF08799}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="Windows Media Files"
"ComponentGUID"="{DD90D410-1823-43EB-9A16-A2331BF08799}"
"Version"=dword:000a0000
"Sub-Version"=dword:00000e3e
"ExceptionInfName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{DD90D410-1823-43EB-9A16-A2331BF08799}\\WMP10.inf"
"ExceptionCatalogName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{DD90D410-1823-43EB-9A16-A2331BF08799}\\wmp10.cat"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\OptionalComponents\SwFlash]
@DACL=(02 0000)
@SACL=
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\Symantec\CCPD-LC]
@DACL=(02 0000)
@SACL=
.
——————— Dlls caricate dai processi in esecuzione ———————

- - - - - - - > 'winlogon.exe'(832)
c:\programmi\HPQ\IAM\Bin\AsWlnPkg.dll

- - - - - - - > 'explorer.exe'(3208)
c:\programmi\HPQ\IAM\Bin\SFSShell.dll
c:\programmi\HPQ\IAM\bin\ItMsg.dll
c:\programmi\HPQ\IAM\bin\1040\SFSShell.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
———————— Altri processi in esecuzione ————————
.
c:\programmi\HPQ\IAM\bin\asghost.exe
c:\windows\system32\DllHost.exe
c:\windows\System32\SCardSvr.exe
c:\programmi\Avira\AntiVir Desktop\sched.exe
c:\programmi\Avira\AntiVir Desktop\avguard.exe
c:\programmi\File comuni\LightScribe\LSSrvc.exe
c:\programmi\File comuni\Panda Security\PavShld\pavprsrv.exe
c:\programmi\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\wdfmgr.exe
c:\programmi\Hewlett-Packard\Shared\hpqwmiex.exe
c:\windows\system32\CNAB4RPK.EXE
c:\windows\system32\wscntfy.exe
c:\programmi\Avira\AntiVir Desktop\avscan.exe
.
**************************************************************************
.
Ora fine scansione: 2010-09-26 19:22:13 - Il pc è stato riavviato
ComboFix-quarantined-files.txt 2010-09-26 17:22

Pre-Run: 58.641.879.040 byte disponibili
Post-Run: 58.552.487.936 byte disponibili

WindowsXP-KB310994-SP2-Home-BootDisk-ITA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 44666912C8FD36D722DD142A9BC05B10
_________

No hijacks yet but system is very sluggish, with blinking mouse cursor for each character typed.

oldman960

Post #11September 26, 2010, 6:15 PM UTC last edited September 26, 2010, 6:17 PM UTC

Hi FliffyMagic,

Is the message gone now when you open Internet Explorer?

It looks like you have 2 antivirus programs installed, AntiVir and Panda. If that is the case please ununstall one. 2 antiviurs programs do not mean more protection, It usually means less as the 2 will conflict causing possible slowdowns and or lockups. Let me know about this.

Next, Double click OTL.exe to run it

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE

c:\documents and settings\Pc\Dati applicazioni\Ymyfup\*.* /s
c:\documents and settings\Pc\Dati applicazioni\Ilza\*.* /s
c:\documents and settings\Pc\Dati applicazioni\Uxfek\*.* /s

Then click the Run Fix button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.

There will only be an OTL.txt this time.

Next

You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM

Click the Update tab
Click Check for Updates
If an update is found, it will download and install the latest version.
The program will close to update and reopen.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Please post back with

OTL log
MBAM log

Thanks

FliffyMagic

Post #12September 26, 2010, 6:53 PM UTC

Hi Oldman960, A few strange behaviors; firstly, running the OTL.exe had errors. Then I updated Malwarebyte and it found no errors. Here are the files for you… OTL Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! OTL by OldTimer - Version 3.2.14.1 log created on 09262010_203138 Malewarebyte Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4699 Windows 5.1.2600 Service Pack 2 Internet Explorer 8.0.6001.18702 26/09/2010 20.38.14 mbam-log-2010-09-26 (20-38-14).txt Scan type: Quick scan Objects scanned: 133931 Time elapsed: 4 minute(s), 38 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) Now then, in between my last file send and this one, I went to Facebook and while playing a game, my page got hijacked and the game crashed. I closed IE for a few minutes then cheched and received your next instructions. I am not convinced that all malicious code has been removed - I hope it's just UE on my bad. Anyway, I also removed Panda before running the OTL.exe but I remember installing it, then trying to remove it once I put Avira on my system, but also had issues due to the fact that even though I went into the control pannel and removed, I was still receiving error messages saying that I still had Panda on my system. Now I do not see Panda inside of my task manager or in my applications. Is it possible that some files may stilll be on my system, even though I hav tried to remove? Ok, thanks again!

oldman960

Post #13September 26, 2010, 11:07 PM UTC last edited September 26, 2010, 11:21 PM UTC

Hi FliffyMagic,

We still have some more to do.

There are bits and pieces of Panda showing in the logs. Go Here to get the uninstaller for your version.

On that page you will see a yellow verticle bar called Tools and Links. Place your mouse cursor on it and a menu will appear. Choose the remover for the version you had installed. Download it and run it. Reboot afterwards,

Your java is old and vulnerable. It may also be part of the problem you are having with FaceBook games.

Go to Java Download
Click the Free Java Download button.
Click the Agree and Start Free Download button.
Save the file JavaSetup6u21exe to your desktop;

Do not select Run . Do not install it yet.

When the download is complete, close your browser.

Open Control Panel > Add/Remove Programs and uninstall

J2SE Runtime Environment 5.0 Update 6

Do not uninstall Java TM 6 Update 21 if found!

Reboot your computer.

Double-click on the saved file ( JavaSetup6u21.exe) to install the update.
Delete the downloaded installation file after completing the above procedure and reboot if not prompted to do so.

I gave you the wrong instructions for OTL,

.

Next, Double click on OTL.exe to run it

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE

c:\documents and settings\Pc\Dati applicazioni\Ymyfup\*.* /s
c:\documents and settings\Pc\Dati applicazioni\Ilza\*.* /s
c:\documents and settings\Pc\Dati applicazioni\Uxfek\*.* /s

Then click the Run Scan button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.

Please post back with

OTL log

Any improvement in the computer?

Thanks

FliffyMagic

Post #14September 27, 2010, 6:42 AM UTC

Hi Oldman960,

Thanks for latest round of remedies. I will reboot after sending this message and go back into Facebook games to see how the machine's performance measures-up against the new java installation.

There is still an "Unable to locate Missing File" error popping-up - most frequently when I first launch IE.

The Latest OTL.exe…..

OTL logfile created on: 27/09/2010 8.31.50 - Run 2
OTL by OldTimer - Version 3.2.14.1 Folder = C:\Documents and Settings\Pc\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000410 | Country: Italia | Language: ITA | Date Format: dd/MM/yyyy

503,00 Mb Total Physical Memory | 114,00 Mb Available Physical Memory | 23,00% Memory free
1,00 Gb Paging File | 1,00 Gb Available in Paging File | 67,00% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programmi
Drive C: | 67,22 Gb Total Space | 54,45 Gb Free Space | 81,00% Space Free | Partition Type: NTFS
Drive D: | 7,30 Gb Total Space | 0,42 Gb Free Space | 5,80% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: PC382528461259
Current User Name: Pc
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Pc\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programmi\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programmi\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programmi\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programmi\File comuni\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Programmi\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Programmi\Skype\Toolbars\Shared\SkypeNames2.exe (Skype Technologies S.A.)
PRC - C:\Programmi\File comuni\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
PRC - C:\Programmi\HPQ\IAM\Bin\asghost.exe (Cognizance Corporation)
PRC - C:\WINDOWS\system32\CNAB4RPK.EXE (CANON INC.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Pc\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (AppMgmt) – C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (AntiVirScheduler) – C:\Programmi\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (AntiVirService) – C:\Programmi\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (LightScribeService) – C:\Programmi\File comuni\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
SRV - (IDriverT) – C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)

========== Driver Services (SafeList) ==========

DRV - (tifm21) – C:\WINDOWS\System32\drivers\tifm21.sys File not found
DRV - (GTIPCI21) – C:\WINDOWS\System32\DRIVERS\gtipci21.sys File not found
DRV - (catchme) – C:\jgh\catchme.sys File not found
DRV - (avipbb) – C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) – C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (ssmdrv) – C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avgio) – C:\Programmi\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (ONDAusbser6k) – C:\WINDOWS\system32\drivers\ONDAusbser6k.sys (ONDA Incorporated)
DRV - (ONDAusbnmea) – C:\WINDOWS\system32\drivers\ONDAusbnmea.sys (ONDA Incorporated)
DRV - (ONDAusbmdm6k) – C:\WINDOWS\system32\drivers\ONDAusbmdm6k.sys (ONDA Incorporated)
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (ATSWPDRV) AuthenTec TruePrint USB Driver (AES2500) – C:\WINDOWS\system32\drivers\atswpdrv.sys (AuthenTec, Inc.)
DRV - (SynTP) – C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (ADIHdAudAddService) – C:\WINDOWS\system32\drivers\ADIHdAud.sys (Analog Devices, Inc.)
DRV - (b57w2k) Broadcom NetLink ™ – C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (bcm4sbxp) – C:\WINDOWS\system32\drivers\bcm4sbxp.sys (Broadcom Corporation)
DRV - (w39n51) Intel® – C:\WINDOWS\system32\drivers\w39n51.sys (Intel® Corporation)
DRV - (BCM43XX) – C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (BTWUSB) – C:\WINDOWS\system32\drivers\btwusb.sys (Broadcom Corporation.)
DRV - (iaStor) – C:\WINDOWS\System32\DRIVERS\iaStor.sys (Intel Corporation)
DRV - (eabusb) – C:\WINDOWS\system32\drivers\EabUsb.sys (Hewlett-Packard Development Company, L.P.)
DRV - (HBtnKey) – C:\WINDOWS\system32\drivers\CPQBttn.sys (Hewlett-Packard Development Company, L.P.)
DRV - (eabfiltr) – C:\WINDOWS\system32\drivers\eabfiltr.sys (Hewlett-Packard Development Company, L.P.)
DRV - (DLAUDFAM) – C:\WINDOWS\system32\DLA\DLAUDFAM.SYS (Sonic Solutions)
DRV - (DLAUDF_M) – C:\WINDOWS\system32\DLA\DLAUDF_M.SYS (Sonic Solutions)
DRV - (DLAIFS_M) – C:\WINDOWS\system32\DLA\DLAIFS_M.SYS (Sonic Solutions)
DRV - (DLABOIOM) – C:\WINDOWS\system32\DLA\DLABOIOM.SYS (Sonic Solutions)
DRV - (DLAOPIOM) – C:\WINDOWS\system32\DLA\DLAOPIOM.SYS (Sonic Solutions)
DRV - (DLAPoolM) – C:\WINDOWS\system32\DLA\DLAPoolM.SYS (Sonic Solutions)
DRV - (DLADResN) – C:\WINDOWS\system32\DLA\DLADResN.SYS (Sonic Solutions)
DRV - (DRVMCDB) – C:\WINDOWS\System32\Drivers\DRVMCDB.SYS (Sonic Solutions)
DRV - (DLACDBHM) – C:\WINDOWS\system32\drivers\DLACDBHM.SYS (Sonic Solutions)
DRV - (DLARTL_N) – C:\WINDOWS\system32\drivers\DLARTL_N.SYS (Sonic Solutions)
DRV - (DRVNDDM) – C:\WINDOWS\system32\drivers\DRVNDDM.SYS (Sonic Solutions)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\Hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (usbaudio) Driver audio USB (WDM) – C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (SMCIRDA) – C:\WINDOWS\system32\drivers\smcirda.sys (SMC)
DRV - (AliIde) – C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

O1 HOSTS File: ([2010/09/26 19.19.52 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\DLA\DLASHX_W.DLL (Sonic Solutions)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (HP Credential Manager for ProtectTools) - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Programmi\HPQ\IAM\Bin\ItIeAddIN.dll (Infineon Technologies AG)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O4 - HKLM..\Run: [avgnt] C:\Programmi\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programmi\File comuni\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &Cerca con Google - C:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: &Traduci parola in italiano - C:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: E&sporta in Microsoft Excel - C:\Programmi\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Link a ritroso - C:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Pagine simili - C:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Versione cache della pagina - C:\Programmi\Google\GoogleToolbar1.dll (Google Inc.)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab (Symantec RuFSI Utility Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.1.1
O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programmi\File comuni\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programmi\File comuni\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programmi\File comuni\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programmi\File comuni\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\OneCard: DllName - C:\Programmi\HPQ\IAM\Bin\AsWlnPkg.dll - C:\Programmi\HPQ\IAM\Bin\AsWlnPkg.dll (Cognizance Corporation)
O24 - Desktop Components:0 (Pagina iniziale corrente) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Colline.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Colline.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/09/27 08.10.16 | 000,000,000 | —- | M] () - C:\Autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2001/07/28 01.07.00 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (MACHINE BootExecut) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/09/27 08.30.24 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2010/09/27 08.24.40 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Dati applicazioni\Sun
[2010/09/27 08.24.40 | 000,000,000 | —D | C] – C:\Programmi\File comuni\Java
[2010/09/27 08.24.26 | 000,423,656 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deployJava1.dll
[2010/09/27 08.24.26 | 000,073,728 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2010/09/27 08.24.25 | 000,153,376 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2010/09/27 08.24.25 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2010/09/27 08.24.25 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2010/09/27 08.10.07 | 000,000,000 | —D | C] – C:\SMCLpav
[2010/09/26 23.08.02 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Dati applicazioni\Adobe
[2010/09/26 20.32.13 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Dati applicazioni\Malwarebytes
[2010/09/26 19.22.16 | 000,000,000 | —D | C] – C:\WINDOWS\temp
[2010/09/26 19.09.31 | 000,000,000 | RHSD | C] – C:\cmdcons
[2010/09/26 19.07.40 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2010/09/26 19.07.40 | 000,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2010/09/26 19.07.40 | 000,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2010/09/26 19.07.40 | 000,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2010/09/26 19.07.25 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2010/09/26 19.07.22 | 000,000,000 | —D | C] – C:\jgh
[2010/09/26 19.07.04 | 000,000,000 | —D | C] – C:\Qoobox
[2010/09/26 16.48.10 | 000,000,000 | —D | C] – C:\_OTL
[2010/09/26 12.39.16 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\Lingoes
[2010/09/26 12.39.16 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Dati applicazioni\Lingoes
[2010/09/26 12.39.08 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Dati applicazioni\Lingoes
[2010/09/26 12.39.07 | 000,000,000 | —D | C] – C:\Programmi\Lingoes
[2010/09/26 12.21.46 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Desktop\Malware OTL files
[2010/09/26 12.20.44 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/09/26 12.20.40 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/09/26 12.20.40 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Dati applicazioni\Malwarebytes
[2010/09/26 12.20.39 | 000,000,000 | —D | C] – C:\Programmi\Malwarebytes' Anti-Malware
[2010/09/26 10.47.32 | 000,575,488 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Pc\Desktop\OTL.exe
[2010/09/26 02.32.21 | 000,000,000 | —D | C] – C:\Programmi\Trend Micro
[2010/09/26 02.17.25 | 000,000,000 | —D | C] – C:\WINDOWS\System32\NtmsData
[2010/09/26 02.16.28 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Dati applicazioni\Avira
[2010/09/26 02.09.57 | 000,028,520 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\ssmdrv.sys
[2010/09/26 02.09.56 | 000,126,856 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\avipbb.sys
[2010/09/26 02.09.56 | 000,060,936 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\avgntflt.sys
[2010/09/26 02.09.56 | 000,045,416 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\avgntdd.sys
[2010/09/26 02.09.56 | 000,022,360 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\avgntmgr.sys
[2010/09/26 02.09.56 | 000,000,000 | —D | C] – C:\Programmi\Avira
[2010/09/26 02.09.56 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Dati applicazioni\Avira
[2010/09/26 01.40.47 | 000,000,000 | —D | C] – C:\Programmi\File comuni\Panda Security
[2010/09/26 00.58.07 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Dati applicazioni\ss_dtx_tb
[2010/09/25 23.55.23 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Dati applicazioni\Panda Security
[2010/09/25 23.53.43 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Dati applicazioni\Panda Security
[2010/09/25 23.42.40 | 000,000,000 | —D | C] – C:\Programmi\Panda Security
[2010/09/19 12.34.00 | 000,000,000 | —D | C] – C:\Programmi\MSECache
[2010/09/16 07.43.35 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Pc\IECompatCache
[2010/09/15 20.08.27 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Pc\PrivacIE
[2010/09/15 20.06.31 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Pc\IETldCache
[2010/09/15 20.04.43 | 000,000,000 | —D | C] – C:\WINDOWS\WBEM
[2010/09/15 20.04.20 | 000,000,000 | -H-D | C] – C:\WINDOWS\ie8
[2010/09/15 20.04.20 | 000,000,000 | —D | C] – C:\WINDOWS\System32\it-IT
[2010/09/12 17.01.28 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Desktop\WIP
[2010/09/12 17.00.01 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Desktop\Project Viewpoint
[2010/09/12 16.55.33 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Desktop\LiftLoft
[2010/09/09 18.02.37 | 000,000,000 | —D | C] – C:\Fraps
[2010/09/09 13.10.37 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Dati applicazioni\Apple Computer
[2010/09/09 13.09.44 | 000,000,000 | —D | C] – C:\Programmi\QuickTime
[2010/09/09 13.09.43 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Dati applicazioni\Apple Computer
[2010/09/09 13.09.27 | 000,000,000 | —D | C] – C:\Programmi\File comuni\Apple
[2010/09/09 13.09.21 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\Apple
[2010/09/09 13.09.19 | 000,000,000 | —D | C] – C:\Programmi\Apple Software Update
[2010/09/09 13.09.19 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Dati applicazioni\Apple
[2010/09/09 13.08.54 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\Apple Computer
[2010/09/08 19.11.04 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hidserv.dll
[2010/09/08 19.10.51 | 000,059,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\USBAUDIO.sys
[2010/09/08 19.10.51 | 000,059,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\usbaudio.sys
[2010/09/07 07.36.47 | 000,000,000 | R–D | C] – C:\Documents and Settings\Pc\Documenti\Video
[2010/09/07 07.36.47 | 000,000,000 | R–D | C] – C:\Documents and Settings\All Users\Documenti\Video
[2010/09/06 22.56.55 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Dati applicazioni\WinRAR
[2010/09/06 22.35.19 | 000,005,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mstee.sys
[2010/09/06 22.35.18 | 000,010,880 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ndisip.sys
[2010/09/06 22.35.17 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ipsink.ax
[2010/09/06 22.35.17 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ipsink.ax
[2010/09/06 22.35.17 | 000,015,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\streamip.sys
[2010/09/06 22.35.16 | 000,011,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\slip.sys
[2010/09/06 22.35.15 | 000,019,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wstcodec.sys
[2010/09/06 22.35.13 | 000,085,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nabtsfec.sys
[2010/09/06 22.35.12 | 000,017,024 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ccdecode.sys
[2010/09/06 22.35.07 | 000,091,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kswdmcap.ax
[2010/09/06 22.35.07 | 000,091,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kswdmcap.ax
[2010/09/06 22.35.07 | 000,078,464 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\usbvideo.sys
[2010/09/06 22.35.07 | 000,061,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kstvtune.ax
[2010/09/06 22.35.07 | 000,061,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kstvtune.ax
[2010/09/06 22.35.07 | 000,054,784 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\vfwwdm32.dll
[2010/09/06 22.35.07 | 000,054,784 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\vfwwdm32.dll
[2010/09/06 22.35.07 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\vidcap.ax
[2010/09/06 22.35.07 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\vidcap.ax
[2010/09/06 22.35.05 | 000,043,008 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ksxbar.ax
[2010/09/06 22.35.05 | 000,043,008 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ksxbar.ax
[2010/09/06 22.35.05 | 000,020,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dshowext.ax
[2010/09/06 22.35.05 | 000,020,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dshowext.ax
[2010/09/06 15.43.52 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Dati applicazioni\skypePM
[2010/09/06 15.42.24 | 000,000,000 | —D | C] – C:\Documents and Settings\Pc\Dati applicazioni\Skype
[2010/09/06 15.42.05 | 000,000,000 | —D | C] – C:\Programmi\File comuni\Skype
[2010/09/06 15.42.02 | 000,000,000 | R–D | C] – C:\Programmi\Skype
[2010/09/06 15.41.59 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Dati applicazioni\Skype

========== Files - Modified Within 30 Days ==========

[2010/09/27 08.27.05 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/09/27 08.27.03 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/09/27 08.27.01 | 527,880,192 | -HS- | M] () – C:\hiberfil.sys
[2010/09/27 08.26.30 | 003,145,728 | -H– | M] () – C:\Documents and Settings\Pc\NTUSER.DAT
[2010/09/27 08.26.26 | 000,000,194 | -HS- | M] () – C:\Documents and Settings\Pc\ntuser.ini
[2010/09/27 08.24.10 | 000,423,656 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deployJava1.dll
[2010/09/27 08.24.10 | 000,153,376 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2010/09/27 08.24.10 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2010/09/27 08.24.10 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2010/09/27 08.24.10 | 000,073,728 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2010/09/27 08.10.16 | 000,000,000 | —- | M] () – C:\Autoexec.bat
[2010/09/26 19.29.18 | 000,029,080 | —- | M] () – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
[2010/09/26 19.20.25 | 000,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2010/09/26 19.19.52 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/09/26 19.09.38 | 000,000,327 | RHS- | M] () – C:\boot.ini
[2010/09/26 12.52.48 | 000,152,384 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/09/26 12.20.47 | 000,000,676 | —- | M] () – C:\Documents and Settings\Pc\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/09/26 10.47.36 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Pc\Desktop\OTL.exe
[2010/09/25 13.32.54 | 000,018,141 | —- | M] () – C:\Documents and Settings\Pc\Desktop\tossL.JPG
[2010/09/25 10.01.44 | 000,095,995 | —- | M] () – C:\Documents and Settings\Pc\Desktop\team in svizzera.jpg
[2010/09/25 09.59.40 | 000,040,443 | —- | M] () – C:\Documents and Settings\Pc\Desktop\trophy.jpg
[2010/09/25 08.45.56 | 000,002,241 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2010/09/16 21.39.43 | 000,071,693 | —- | M] () – C:\Documents and Settings\Pc\Desktop\andy_pandy_5.jpg
[2010/09/16 21.33.57 | 000,124,367 | —- | M] () – C:\Documents and Settings\Pc\Desktop\bear-t17682.jpg
[2010/09/16 19.30.51 | 000,024,576 | —- | M] () – C:\Documents and Settings\Pc\Desktop\Benvenuto in topbonus_Lara.doc
[2010/09/16 18.41.59 | 000,327,160 | —- | M] () – C:\Documents and Settings\Pc\Desktop\refertoS00002E9CL_16Sett2010.pdf
[2010/09/15 15.02.31 | 000,000,049 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2010/09/13 15.52.36 | 006,801,188 | —- | M] () – C:\Documents and Settings\Pc\Desktop\attachments_13_09_2010.zip
[2010/09/11 20.12.14 | 010,043,951 | —- | M] () – C:\Documents and Settings\Pc\Desktop\1008digitale.pdf
[2010/09/09 18.02.38 | 000,000,478 | —- | M] () – C:\Documents and Settings\Pc\Desktop\Fraps.lnk
[2010/09/09 13.09.56 | 000,001,584 | —- | M] () – C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2010/09/09 11.29.02 | 000,426,042 | —- | M] () – C:\WINDOWS\System32\perfh010.dat
[2010/09/09 11.29.02 | 000,380,684 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/09/09 11.29.02 | 000,063,600 | —- | M] () – C:\WINDOWS\System32\perfc010.dat
[2010/09/09 11.29.02 | 000,053,098 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/09/09 11.29.01 | 000,931,806 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/09/08 13.47.30 | 000,024,800 | —- | M] () – C:\Documents and Settings\Pc\Dati applicazioni\GDIPFONTCACHEV1.DAT
[2010/09/07 14.38.32 | 000,403,828 | —- | M] () – C:\Documents and Settings\Pc\Desktop\Foot.jpeg
[2010/09/07 14.38.26 | 000,238,809 | —- | M] () – C:\Documents and Settings\Pc\Desktop\NoseandLips(front).png
[2010/09/07 12.34.22 | 000,503,405 | —- | M] () – C:\Documents and Settings\Pc\Desktop\Schermata 2010-09-07 a 12.33.13.png
[2010/09/06 21.21.11 | 000,000,366 | —- | M] () – C:\Documents and Settings\Pc\Desktop\Collegamento a Connessione rete senza fili.lnk
[2010/09/06 15.43.54 | 000,000,056 | -H– | M] () – C:\WINDOWS\System32\ezsidmv.dat
[2010/09/05 22.56.57 | 000,002,397 | —- | M] () – C:\Documents and Settings\Pc\Desktop\AutoRoute.lnk
[2010/09/05 22.56.50 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/09/01 14.22.25 | 000,126,856 | —- | M] (Avira GmbH) – C:\WINDOWS\System32\drivers\avipbb.sys
[2010/09/01 14.22.25 | 000,060,936 | —- | M] (Avira GmbH) – C:\WINDOWS\System32\drivers\avgntflt.sys

========== Files Created - No Company Name ==========

[2010/09/27 08.10.16 | 000,000,000 | —- | C] () – C:\Autoexec.bat
[2010/09/26 19.09.38 | 000,000,211 | —- | C] () – C:\Boot.bak
[2010/09/26 19.09.34 | 000,261,312 | RHS- | C] () – C:\cmldr
[2010/09/26 19.07.40 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2010/09/26 19.07.40 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2010/09/26 19.07.40 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2010/09/26 19.07.40 | 000,077,312 | —- | C] () – C:\WINDOWS\MBR.exe
[2010/09/26 19.07.40 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2010/09/26 12.20.47 | 000,000,676 | —- | C] () – C:\Documents and Settings\Pc\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/09/25 13.30.17 | 000,018,141 | —- | C] () – C:\Documents and Settings\Pc\Desktop\tossL.JPG
[2010/09/25 10.03.30 | 000,040,443 | —- | C] () – C:\Documents and Settings\Pc\Desktop\trophy.jpg
[2010/09/25 10.02.11 | 000,095,995 | —- | C] () – C:\Documents and Settings\Pc\Desktop\team in svizzera.jpg
[2010/09/16 21.39.51 | 000,071,693 | —- | C] () – C:\Documents and Settings\Pc\Desktop\andy_pandy_5.jpg
[2010/09/16 21.34.19 | 000,124,367 | —- | C] () – C:\Documents and Settings\Pc\Desktop\bear-t17682.jpg
[2010/09/16 19.30.51 | 000,024,576 | —- | C] () – C:\Documents and Settings\Pc\Desktop\Benvenuto in topbonus_Lara.doc
[2010/09/16 18.41.58 | 000,327,160 | —- | C] () – C:\Documents and Settings\Pc\Desktop\refertoS00002E9CL_16Sett2010.pdf
[2010/09/13 15.52.24 | 006,801,188 | —- | C] () – C:\Documents and Settings\Pc\Desktop\attachments_13_09_2010.zip
[2010/09/11 20.12.14 | 010,043,951 | —- | C] () – C:\Documents and Settings\Pc\Desktop\1008digitale.pdf
[2010/09/09 18.02.38 | 000,000,478 | —- | C] () – C:\Documents and Settings\Pc\Desktop\Fraps.lnk
[2010/09/09 13.09.56 | 000,001,584 | —- | C] () – C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2010/09/07 14.38.13 | 000,403,828 | —- | C] () – C:\Documents and Settings\Pc\Desktop\Foot.jpeg
[2010/09/07 14.38.09 | 000,238,809 | —- | C] () – C:\Documents and Settings\Pc\Desktop\NoseandLips(front).png
[2010/09/07 12.34.04 | 000,503,405 | —- | C] () – C:\Documents and Settings\Pc\Desktop\Schermata 2010-09-07 a 12.33.13.png
[2010/09/06 21.21.11 | 000,000,366 | —- | C] () – C:\Documents and Settings\Pc\Desktop\Collegamento a Connessione rete senza fili.lnk
[2010/09/06 15.43.54 | 000,000,056 | -H– | C] () – C:\WINDOWS\System32\ezsidmv.dat
[2010/09/06 15.42.05 | 000,002,241 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2010/01/08 23.50.09 | 000,000,049 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2009/05/30 10.36.47 | 000,007,680 | —- | C] () – C:\WINDOWS\System32\CNMVS61.DLL
[2009/03/01 12.23.25 | 000,000,000 | —- | C] () – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\FnF4.txt
[2009/03/01 10.18.28 | 003,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2009/03/01 10.18.28 | 001,138,688 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2009/03/01 10.18.28 | 000,200,704 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2009/03/01 10.18.26 | 000,019,968 | —- | C] () – C:\WINDOWS\System32\cpuinf32.dll
[2009/02/28 19.37.59 | 000,000,424 | —- | C] () – C:\WINDOWS\ODBC.INI
[2009/02/28 19.03.59 | 000,204,800 | —- | C] () – C:\WINDOWS\System32\IVIresizeW7.dll
[2009/02/28 19.03.59 | 000,200,704 | —- | C] () – C:\WINDOWS\System32\IVIresizeA6.dll
[2009/02/28 19.03.59 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeP6.dll
[2009/02/28 19.03.59 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeM6.dll
[2009/02/28 19.03.59 | 000,188,416 | —- | C] () – C:\WINDOWS\System32\IVIresizePX.dll
[2009/02/28 19.03.58 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\IVIresize.dll
[2009/02/28 19.02.58 | 000,000,141 | —- | C] () – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\fusioncache.dat
[2009/02/28 19.02.58 | 000,000,000 | —- | C] () – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\QSwitch.txt
[2009/02/28 19.02.58 | 000,000,000 | —- | C] () – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\DSwitch.txt
[2009/02/28 19.02.58 | 000,000,000 | —- | C] () – C:\Documents and Settings\Pc\Impostazioni locali\Dati applicazioni\AtStart.txt
[2006/08/23 07.04.30 | 000,000,175 | —- | C] () – C:\WINDOWS\wininit.ini
[2006/08/23 07.03.06 | 000,029,888 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2005/12/01 21.11.40 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2004/08/30 13.26.38 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2004/08/30 13.19.50 | 000,000,825 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/08/19 10.00.00 | 000,027,440 | —- | C] () – C:\WINDOWS\System32\drivers\secdrv.sys
[2004/06/01 11.39.56 | 000,094,274 | —- | C] () – C:\WINDOWS\System32\HPBHEALR.DLL
[1998/05/07 04.10.00 | 000,069,632 | —- | C] () – C:\WINDOWS\System32\ODMA32.dll

========== Custom Scans ==========

< c:\documents and settings\Pc\Dati applicazioni\Ymyfup\*.* /s >

< c:\documents and settings\Pc\Dati applicazioni\Ilza\*.* /s >

< c:\documents and settings\Pc\Dati applicazioni\Uxfek\*.* /s >
< End of report >

Ok?

Thanks!

oldman960

Post #15September 27, 2010, 8:00 AM UTC last edited September 27, 2010, 8:01 AM UTC

Hi FliffyMagic,

What is the exact error message? There should be a file name referenced.

Next, Double click on OTL.exe

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE
please note the fix starts with the :

:Services

:OTL
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

:Files
c:\documents and settings\Pc\Dati applicazioni\Ymyfup
c:\documents and settings\Pc\Dati applicazioni\Ilza
c:\documents and settings\Pc\Dati applicazioni\Uxfek

:Commands
[emptytemp]
[Reboot]

Then click the Run Fix button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.

Please post the OTL fix log

✨ Ask AI

Ask AI