What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Problem with Trojan.Wind32.Small [Solved]

70 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hi lukem,


Please follow all previous instructions regarding security programs.

Open a new Notepad session
  • Click the Start button, click run
  • in the run box type notepad
  • click ok
  • In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  • Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

File::
c:\windows\assembly\GAC\desktop.ini

In the notepad
  • Click File, Save as…, and set the Save in to your Desktop
  • In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
  • Click save
Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]

Please post back with
  • combofix log
How's the computer?
Post #17
The PC is a lot better. The only problem is the page that open with browser search. And this problem ramains Thi is the log: ComboFix 12-06-03.01 - Gnorro 03/06/2012 16:20:53.2.8 - x86 Microsoft Windows 7 Ultimate 6.1.7601.1.1252.39.1040.18.3062.1635 [GMT 2:00] Eseguito da: c:\users\Gnorro\Desktop\ComboFix.exe Opzioni usate :: c:\users\Gnorro\Desktop\CFScript.txt AV: Kaspersky Internet Security *Disabled/Updated* {56547CC9-C9B2-849D-8FEF-A496150D6A06} FW: Kaspersky Internet Security *Disabled* {6E6FFDEC-83DD-85C5-A4B0-0DA3EBDE2D7D} SP: Kaspersky Internet Security *Disabled/Updated* {ED359D2D-EF88-8B13-B55F-9FE46E8A20BB} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Creato nuovo punto di ripristino . FILE :: "c:\windows\assembly\GAC\desktop.ini" . . ((((((((((((((((((((((((((((((((((((( Altre eliminazioni ))))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\Gnorro\AppData\Local\Temp\61e4dc9e-b0a3-4e40-99a9-4cd9049f7d99\CliSecureRT.dll . . ((((((((((((((((((((((((( Files Creati Da 2012-05-03 al 2012-06-03 ))))))))))))))))))))))))))))))))))) . . 2012-06-03 14:28 . 2012-06-03 14:30 ——– d—–w- c:\users\Gnorro\AppData\Local\temp 2012-06-03 14:28 . 2012-06-03 14:28 ——– d—–w- c:\users\DefaultAppPool\AppData\Local\temp 2012-06-03 14:28 . 2012-06-03 14:28 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-06-03 14:28 . 2012-06-03 14:28 ——– d—–w- c:\users\Classic .NET AppPool\AppData\Local\temp 2012-06-02 07:50 . 2012-06-02 07:50 28488 —-a-w- c:\windows\system32\drivers\mbamchameleon.sys 2012-06-02 07:46 . 2012-06-02 07:46 ——– d—–w- c:\programdata\Malwarebytes 2012-06-02 07:46 . 2012-06-02 07:46 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware 2012-06-02 07:46 . 2012-04-04 13:56 22344 —-a-w- c:\windows\system32\drivers\mbam.sys 2012-06-01 23:15 . 2012-05-08 16:40 6737808 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{05B4DAC9-2F0C-4109-8523-8E84B817D158}\mpengine.dll 2012-05-27 10:02 . 2012-05-27 10:03 3888 —-a-w- c:\windows\system32\drivers\NTHANDLE.SYS 2012-05-27 10:01 . 2012-05-27 10:01 ——– d—–w- c:\program files\WhoLockMe104 2012-05-27 08:55 . 2012-05-27 08:55 ——– d—–w- c:\users\Gnorro\AppData\Local\antiphishing-vmntbcleaner1_0dn 2012-05-27 08:55 . 2012-05-27 08:55 ——– d—–w- c:\programdata\Anti-phishing Domain Advisor 2012-05-27 08:55 . 2012-05-27 08:55 ——– d—–w- c:\program files\Toolbar Cleaner 2012-05-27 08:47 . 2012-05-27 09:24 ——– d—–w- c:\programdata\Spybot - Search & Destroy 2012-05-27 08:47 . 2012-05-27 08:51 ——– d—–w- c:\program files\Spybot - Search & Destroy 2012-05-27 07:46 . 2012-05-27 09:37 ——– d—–w- c:\program files\hpmonitor 2012-05-27 07:46 . 2012-05-27 07:46 447 —-a-w- C:\user.js 2012-05-27 07:46 . 2012-05-31 19:29 ——– d—–w- c:\program files\Web Assistant 2012-05-27 07:45 . 2012-05-27 08:43 ——– d—–w- c:\program files\Win 32. Trojan . Small Removal Tool 2012-05-27 07:42 . 2012-05-27 07:42 ——– d—–w- c:\programdata\PC Tools 2012-05-27 07:42 . 2012-05-27 07:42 ——– d—–w- c:\users\Gnorro\AppData\Roaming\TestApp 2012-05-26 16:04 . 2012-05-26 16:04 ——– d-sh–w- c:\windows\system32\%APPDATA% 2012-05-18 20:30 . 2012-05-19 08:00 ——– d—–w- c:\users\Gnorro\AppData\Local\ServUpdater 2012-05-18 20:30 . 2012-05-18 20:31 ——– d—–w- c:\users\Gnorro\AppData\Local\PosService 2012-05-18 20:30 . 2012-05-18 20:30 ——– d—–w- c:\users\Gnorro\AppData\Local\PowerOffer 2012-05-11 18:58 . 2012-03-30 10:23 1291632 —-a-w- c:\windows\system32\drivers\tcpip.sys 2012-05-11 18:58 . 2012-03-31 04:30 1221632 —-a-w- c:\program files\Windows Journal\NBDoc.DLL 2012-05-11 18:58 . 2012-03-31 04:29 936960 —-a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll 2012-05-11 18:58 . 2012-03-31 04:29 989184 —-a-w- c:\program files\Windows Journal\JNTFiltr.dll 2012-05-11 18:58 . 2012-03-31 04:29 969216 —-a-w- c:\program files\Windows Journal\JNWDRV.dll 2012-05-11 18:58 . 2012-03-31 04:39 3968368 —-a-w- c:\windows\system32\ntkrnlpa.exe 2012-05-11 18:58 . 2012-03-31 04:39 3913072 —-a-w- c:\windows\system32\ntoskrnl.exe 2012-05-11 18:58 . 2012-03-31 02:36 2343424 —-a-w- c:\windows\system32\win32k.sys 2012-05-11 18:58 . 2012-03-17 07:27 56176 —-a-w- c:\windows\system32\drivers\partmgr.sys 2012-05-11 18:58 . 2012-03-03 05:31 1077248 —-a-w- c:\windows\system32\DWrite.dll 2012-05-05 16:02 . 2012-05-05 16:02 108368 —-a-r- c:\users\Gnorro\AppData\Roaming\Microsoft\Installer\{FEC1DF97-E716-4CD8-A55B-75C373912D35}\ARPPRODUCTICON.exe 2012-05-05 16:02 . 2012-05-05 16:02 ——– d—–w- c:\users\Gnorro\AppData\Local\Sky Italia . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-05-10 09:26 . 2012-03-31 22:05 419488 —-a-w- c:\windows\system32\FlashPlayerApp.exe 2012-05-10 09:26 . 2011-05-16 20:14 70304 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-04-29 12:08 . 2011-10-04 18:58 97208 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Punti Reg Caricati )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* i valori vuoti & legittimi/default non sono visualizzati. REGEDIT4 . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}] 2010-05-26 13:23 1385864 —-a-w- c:\program files\Ask.com\GenericAskToolbar.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864] . [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864] . [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal] @="{C5994560-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}] 2010-03-21 07:55 87304 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified] @="{C5994561-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}] 2010-03-21 07:55 87304 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict] @="{C5994562-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}] 2010-03-21 07:55 87304 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked] @="{C5994563-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}] 2010-03-21 07:55 87304 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly] @="{C5994564-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}] 2010-03-21 07:55 87304 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted] @="{C5994565-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}] 2010-03-21 07:55 87304 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded] @="{C5994566-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}] 2010-03-21 07:55 87304 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored] @="{C5994567-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}] 2010-03-21 07:55 87304 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned] @="{C5994568-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}] 2010-03-21 07:55 87304 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2011-12-05 19:17 94208 —-a-w- c:\users\Gnorro\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2011-12-05 19:17 94208 —-a-w- c:\users\Gnorro\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2011-12-05 19:17 94208 —-a-w- c:\users\Gnorro\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2011-12-05 19:17 94208 —-a-w- c:\users\Gnorro\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "KiesPDLR"="c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2012-03-31 21416] "KiesHelper"="c:\program files\Samsung\Kies\KiesHelper.exe" [2012-02-22 943504] "PCShowServer"="c:\users\Gnorro\AppData\Local\Sky Italia\Sky Go Player\PCShowServerPMWrapper.exe" [2012-04-17 525680] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520] "TurboV"="c:\program files\ASUS\TurboV\TurboV.exe" [2009-05-25 5391872] "JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2009-06-30 36864] "Ai Nap"="c:\program files\ASUS\AI Suite\AiNap\AiNap.exe" [2010-03-10 1439360] "QFan Help"="c:\program files\ASUS\AI Suite\QFan3\QFanHelp.exe" [2010-01-13 611968] "Cpu Level Up help"="c:\program files\ASUS\AI Suite\CpuLevelUpHelp.exe" [2009-12-28 887936] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-12-05 343168] "AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-01-24 500208] "AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992] "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2009-05-26 1468296] "PosService"="c:\users\Public\Documents\AppData\PoApp\PLauncher.exe" [2011-12-03 218624] "Anti-phishing Domain Advisor"="c:\programdata\Anti-phishing Domain Advisor\visicom_antiphishing.exe" [2011-07-05 217256] "avp"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe" [2010-09-20 311680] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\mzvkbd3.dll . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup backupExtension=.CommonStartup . [HKLM\~\startupfolder\C:^Users^Gnorro^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk] path=c:\users\Gnorro\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk backup=c:\windows\pss\Dropbox.lnk.Startup backupExtension=.Startup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount] 2010-08-20 11:03 33120 —-a-w- c:\program files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate] 2010-09-16 20:04 1164584 —-a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update] 2010-12-15 19:38 136176 —-atw- c:\users\Gnorro\AppData\Local\Google\Update\GoogleUpdate.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk] 2007-01-01 21:22 3739648 —-a-w- c:\program files\Google\Google Talk\googletalk.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] 2007-05-08 14:24 54840 —-a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesHelper] 2012-02-22 05:57 943504 —-a-w- c:\program files\Samsung\Kies\KiesHelper.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPDLR] 2012-03-31 12:48 21416 —-a-w- c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesTrayAgent] 2012-02-22 05:57 3508624 —-a-w- c:\program files\Samsung\Kies\KiesTrayAgent.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui] 2010-03-30 09:16 1820040 —-a-w- c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mega Manager] 2010-11-03 10:00 2113024 —-a-w- c:\program files\Megaupload\Mega Manager\MegaManager.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl] 2009-05-22 16:22 7514656 ——w- c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC] 2011-12-05 21:46 343168 —-a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2011-05-04 11:59 252136 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualCloneDrive] 2011-03-07 13:33 89456 —-a-w- c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile Device Center] 2007-05-31 07:21 648072 —-a-w- c:\windows\WindowsMobile\wmdc.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile-based device management] 2007-05-31 07:21 648072 —-a-w- c:\windows\WindowsMobile\wmdcBase.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher] 2011-08-05 10:29 159456 —-a-w- c:\program files\Zune\ZuneLauncher.exe . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 gupdate;Servizio Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-06-18 136176] R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368] R2 ServUpdater;Serv Updater;c:\users\Gnorro\AppData\Local\ServUpdater\ServiceUpd.exe [2011-12-02 156160] R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2012-02-29 158856] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-10 257696] R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2011-12-08 80184] R3 gupdatem;Servizio Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2011-06-18 136176] R3 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys [2012-06-02 28488] R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [2012-04-29 129976] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872] R3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\SiSoftware\SiSoftware Sandra Lite 2011.SP3\RpcAgentSrv.exe [2009-08-10 93848] R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2011-12-08 181432] R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224] R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x] R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x] R3 WatAdminSvc;Servizio Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2010-09-20 1343400] R3 WMZuneComm;Zune Windows Mobile Connectivity Service;c:\program files\Zune\WMZuneComm.exe [2011-08-05 268512] R3 yukonw7;Driver miniport NDIS6.2 per controller Ethernet Marvell Yukon;c:\windows\system32\DRIVERS\yk62x86.sys [2009-07-13 311296] R4 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [2010-03-30 1107336] R4 MSSQLServerADHelper100;Servizio SQL Server Active Directory Helper;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2009-07-21 47128] R4 RsFx0103;RsFx0103 Driver;c:\windows\system32\DRIVERS\RsFx0103.sys [2009-03-30 239336] R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-09-19 436792] R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2009-03-30 366936] S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-12-15 33808] S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2009-05-15 21008] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-12-06 163328] S2 AsSysCtrlService;ASUS System Control Service;c:\program files\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [2009-04-02 90112] S2 CDMA Device Service;CDMA Device Service;c:\program files\Samsung\USB Drivers\26_VIA_driver2\x86\VIAService.exe [2011-08-02 63488] S2 DvmMDES;DeviceVM Meta Data Export Service;c:\asus.sys\config\DVMExportService.exe [2009-02-18 294912] S2 HWiNFO32;HWiNFO32 Kernel Driver;c:\program files\HWiNFO32\HWiNFO32.SYS [2011-09-22 21624] S2 KMService;KMService;c:\windows\system32\srvany.exe [2010-09-24 8192] S2 MsDepSvc;Web Deployment Agent Service;c:\program files\IIS\Microsoft Web Deploy\MsDepSvc.exe [2011-04-01 67400] S2 MsDtsServer;SQL Server Integration Services;c:\program files\Microsoft SQL Server\90\DTS\Binn\MsDtsSrvr.exe [2005-10-14 199384] S2 PowerOffer Service;Pos Service;c:\users\Gnorro\AppData\Local\PosService\Pos.exe [2011-12-02 164864] S2 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [2011-12-14 2984832] S2 Tomcat6;Apache Tomcat 6;c:\program files\Apache Software Foundation\Tomcat 6.0\bin\tomcat6.exe [2010-07-19 61440] S2 Web Assistant Updater;Web Assistant Updater;c:\program files\Web Assistant\ExtensionUpdaterService.exe [2012-05-08 185856] S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2011-12-06 9067008] S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2011-12-06 264192] S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2011-10-17 85520] S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [2011-04-12 45464] S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2009-05-16 19472] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2010-06-23 275048] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 HPService REG_MULTI_SZ HPSLPSVC hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc WindowsMobile REG_MULTI_SZ wcescomm rapimgr LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr iissvcs REG_MULTI_SZ w3svc was apphost REG_MULTI_SZ apphostsvc . Contenuto della cartella 'Scheduled Tasks' . 2012-06-03 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-31 09:26] . 2012-06-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2011-06-18 10:36] . 2012-06-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2011-06-18 10:36] . 2012-06-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3857534020-3991675840-3102532669-1001Core.job - c:\users\Gnorro\AppData\Local\Google\Update\GoogleUpdate.exe [2010-12-15 19:38] . 2012-06-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3857534020-3991675840-3102532669-1001UA.job - c:\users\Gnorro\AppData\Local\Google\Update\GoogleUpdate.exe [2010-12-15 19:38] . . ——- Scansione supplementare ——- . uStart Page = about:blank mStart Page = hxxp://search.findeer.com IE: Aggiungi ad Anti-Banner IE: E&sporta; in Microsoft Excel - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000 TCP: DhcpNameServer = [removed] [removed] TCP: Interfaces\{20582271-F6AE-4E36-886F-48024D8CAC56}: NameServer = 176.31.229.24,176.31.229.25 TCP: Interfaces\{63197F6F-7A11-48D5-B8E7-0161239E9EF3}: NameServer = 176.31.229.24,176.31.229.25 TCP: Interfaces\{e29ac6c2-7037-11de-816d-806e6f6e6963}: NameServer = 176.31.229.24,176.31.229.25 TCP: Interfaces\{E65A718F-C287-4469-9D2A-C248217DFE90}: NameServer = 176.31.229.24,176.31.229.25 TCP: Interfaces\{FD36B4D0-A033-45AC-93E9-C6519D78E284}: NameServer = 176.31.229.24,176.31.229.25 FF - ProfilePath - c:\users\Gnorro\AppData\Roaming\Mozilla\Firefox\Profiles\febeprof.Gnorro\ FF - prefs.js: browser.startup.homepage - about:home FF - prefs.js: network.proxy.type - 0 FF - user.js: network.cookie.cookieBehavior - 0 FF - user.js: privacy.clearOnShutdown.cookies - false FF - user.js: security.warn_viewing_mixed - false FF - user.js: security.warn_viewing_mixed.show_once - false FF - user.js: security.warn_submit_insecure - false FF - user.js: security.warn_submit_insecure.show_once - false FF - user.js: extensions.incredibar_i.newTab - false FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6OyD6PHM7i&loc;=IB_TB&i;=26&search;= FF - user.js: extensions.incredibar_i.id - 78a9fde6000000000000485b3928984f FF - user.js: extensions.incredibar_i.instlDay - 15487 FF - user.js: extensions.incredibar_i.vrsn - [removed] FF - user.js: extensions.incredibar_i.vrsni - [removed] FF - user.js: extensions.incredibar_i.vrsnTs - [removed]:46 FF - user.js: extensions.incredibar_i.prtnrId - Incredibar FF - user.js: extensions.incredibar_i.prdct - incredibar FF - user.js: extensions.incredibar_i.aflt - orgnl FF - user.js: extensions.incredibar_i.smplGrp - none FF - user.js: extensions.incredibar_i.tlbrId - base FF - user.js: extensions.incredibar_i.instlRef - FF - user.js: extensions.incredibar_i.dfltLng - FF - user.js: extensions.incredibar_i.excTlbr - false FF - user.js: extensions.incredibar_i.ms_url_id - FF - user.js: extensions.incredibar_i.upn2 - 6OyD6PHM7i FF - user.js: extensions.incredibar_i.upn2n - 92261480923448156 FF - user.js: extensions.incredibar_i.productid - 26 FF - user.js: extensions.incredibar_i.installerproductid - 26 FF - user.js: extensions.incredibar_i.did - 10604 FF - user.js: extensions.incredibar_i.ppd - . - - - - CHIAVI ORFANE RIMOSSE - - - - . BHO-{336D0C35-8A85-403a-B9D2-65C292C39087} - (no file) . . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MsDepSvc] "ImagePath"="\"c:\program files\IIS\Microsoft Web Deploy\MsDepSvc.exe\" -runService:MsDepSvc" – . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\msftesql] "ImagePath"="\"c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\msftesql.exe\" -s:MSSQL.1 -f:MSSQLSERVER" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MySQL] "ImagePath"="\"c:\program files\MySQL\MySQL Server 5.1\bin\mysqld\" –defaults-file=\"c:\program files\MySQL\MySQL Server 5.1\my.ini\" MySQL" . ——————— CHIAVI DI REGISTRO BLOCCATE ——————— . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ——————— Dlls caricate dai processi in esecuzione ——————— . - - - - - - - > 'Explorer.exe'(3780) c:\programdata\Anti-phishing Domain Advisor\visicom_antiphishing.dll c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll c:\program files\TortoiseSVN\bin\TortoiseStub.dll c:\program files\TortoiseSVN\bin\TortoiseSVN.dll c:\program files\TortoiseSVN\bin\intl3_tsvn.dll c:\users\Gnorro\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\prremote.dll c:\progra~1\SPYBOT~1\SDHelper.dll . ———————— Altri processi in esecuzione ———————— . c:\windows\system32\atieclxx.exe c:\windows\system32\taskhost.exe c:\windows\KMService.exe c:\windows\system32\conhost.exe c:\windows\system32\conhost.exe c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe c:\program files\TortoiseSVN\bin\TSVNCache.exe c:\program files\MySQL\MySQL Server 5.1\bin\mysqld.exe c:\windows\system32\PnkBstrA.exe c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe c:\users\Public\Documents\AppData\PoApp\PService.exe c:\windows\system32\conhost.exe c:\users\Gnorro\AppData\Local\Sky Italia\Sky Go Player\NDSPCShowServer.exe c:\windows\system32\conhost.exe c:\programdata\Anti-phishing Domain Advisor\visicom_antiphishing-tray.exe c:\windows\system32\sppsvc.exe c:\program files\Windows Media Player\wmpnetwk.exe . ************************************************************************** . Ora fine scansione: 2012-06-03 16:38:29 - Il pc è stato riavviato ComboFix-quarantined-files.txt 2012-06-03 14:38 ComboFix2.txt 2012-05-31 19:40 . Pre-Run: 187.363.729.408 byte disponibili Post-Run: 187.323.056.128 byte disponibili . - - End Of File - - 7BC13F55C37E899E656AC954CEA342D6 Thanks
Post #18
Hi

You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM

  • Click the Update tab
  • Click Check for Updates
  • If an update is found, it will download and install the latest version.
  • The program will close to update and reopen.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

How's the computer?
Post #19
Urlseek tag opens again, but the rest is ok this is the log: Thanks Malwarebytes Anti-Malware 1.61.0.1400 www.malwarebytes.org Versione database: v2012.06.04.07 Windows 7 Service Pack 1 x86 NTFS Internet Explorer 9.0.8112.16421 Gnorro :: GNORRO-PC [amministratore] 04/06/2012 21:52:36 mbam-log-2012-06-04 (21-52-36).txt Tipo di scansione: Scansione veloce Opzioni di scansione attive: Memoria | Esecuzione automatica | Registro | File system | Euristica/Extra | Euristica/Shuriken | PUP | PUM Opzioni di scansione disattivate: P2P Elementi esaminati: 270667 Tempo impiegato: 8 minuti, 31 secondi Processi rilevati in memoria: 1 C:\Windows\KMService.exe (RiskWare.Tool.CK) -> 2256 -> Verrà eliminato al riavvio. Moduli di memoria rilevati: 0 (non sono stati rilevati elementi nocivi) Chiavi di registro rilevate: 0 (non sono stati rilevati elementi nocivi) Valori di registro rilevati: 0 (non sono stati rilevati elementi nocivi) Voci rilevate nei dati di registro: 0 (non sono stati rilevati elementi nocivi) Cartelle rilevate: 0 (non sono stati rilevati elementi nocivi) File rilevati: 2 C:\Windows\KMService.exe (RiskWare.Tool.CK) -> Verrà eliminato al riavvio. C:\Windows\assembly\GAC\Desktop.ini (Trojan.0access) -> Spostato in quarantena ed eliminato con successo. (fine)
Post #20
Hi lukem, How is the computer? Still problems with you search? Please rerun MBAM so we can see if the file is actually gone. Thanks
Post #21
Except for the tab that opens again PC is good: this is the new log: Malwarebytes Anti-Malware 1.61.0.1400 www.malwarebytes.org Versione database: v2012.06.04.07 Windows 7 Service Pack 1 x86 NTFS Internet Explorer 9.0.8112.16421 Gnorro :: GNORRO-PC [amministratore] 05/06/2012 19:34:59 mbam-log-2012-06-05 (19-34-59).txt Tipo di scansione: Scansione veloce Opzioni di scansione attive: Memoria | Esecuzione automatica | Registro | File system | Euristica/Extra | Euristica/Shuriken | PUP | PUM Opzioni di scansione disattivate: P2P Elementi esaminati: 270531 Tempo impiegato: 6 minuti, 39 secondi Processi rilevati in memoria: 0 (non sono stati rilevati elementi nocivi) Moduli di memoria rilevati: 0 (non sono stati rilevati elementi nocivi) Chiavi di registro rilevate: 0 (non sono stati rilevati elementi nocivi) Valori di registro rilevati: 0 (non sono stati rilevati elementi nocivi) Voci rilevate nei dati di registro: 0 (non sono stati rilevati elementi nocivi) Cartelle rilevate: 0 (non sono stati rilevati elementi nocivi) File rilevati: 0 (non sono stati rilevati elementi nocivi) (fine) thanks
Post #22
Hi lukem,

Is this folder still present?

C:\Users\Gnorro\AppData\Local\{9bdfedbd-95a6-3dea-2142-6b3449bc5010}

Try running OTL again and post the OTL.txt if it runs.

Thanks
Post #23
Hi

Yes, the folder is present:

OTL.txt Log:

OTL logfile created on: 06/06/2012 21:21:07 - Run 1
OTL by OldTimer - Version 3.2.46.1 Folder = C:\Users\Gnorro\Desktop
Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000410 | Country: Italia | Language: ITA | Date Format: dd/MM/yyyy

2,99 Gb Total Physical Memory | 1,59 Gb Available Physical Memory | 53,10% Memory free
5,98 Gb Paging File | 3,60 Gb Available in Paging File | 60,21% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 246,06 Gb Total Space | 174,08 Gb Free Space | 70,75% Space Free | Partition Type: NTFS
Drive D: | 19,88 Gb Total Space | 9,16 Gb Free Space | 46,06% Space Free | Partition Type: NTFS
Drive E: | 199,72 Gb Total Space | 127,71 Gb Free Space | 63,95% Space Free | Partition Type: NTFS
Drive F: | 465,76 Gb Total Space | 225,26 Gb Free Space | 48,36% Space Free | Partition Type: NTFS

Computer Name: GNORRO-PC | User Name: Gnorro | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Gnorro\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
PRC - C:\Program Files\Web Assistant\ExtensionUpdaterService.exe ()
PRC - C:\Users\Gnorro\AppData\Local\Sky Italia\Sky Go Player\PCShowServerPMWrapper.exe (NDS Technologies)
PRC - C:\Users\Gnorro\AppData\Local\Sky Italia\Sky Go Player\NDSPCShowServer.exe ()
PRC - C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
PRC - C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Windows\System32\atieclxx.exe (AMD)
PRC - C:\Windows\System32\atiesrxx.exe (AMD)
PRC - C:\Users\Public\Documents\AppData\PoApp\PService.exe (PService)
PRC - C:\Program Files\Samsung\USB Drivers\26_VIA_driver2\x86\VIAService.exe ()
PRC - C:\ProgramData\Anti-phishing Domain Advisor\visicom_antiphishing.exe (Visicom Media Inc. (Powered by Panda Security))
PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)
PRC - C:\ProgramData\Anti-phishing Domain Advisor\visicom_antiphishing-tray.exe ()
PRC - C:\Program Files\IIS\Microsoft Web Deploy\MsDepSvc.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\TortoiseSVN\bin\TSVNCache.exe (http://tortoisesvn.net)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\tomcat6.exe (Apache Software Foundation)
PRC - C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe (ASUSTeK Computer Inc.)
PRC - C:\Program Files\ASUS\AI Suite\QFan3\QFanHelp.exe (ASUSTeK Computer Inc.)
PRC - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (StarWind Software)
PRC - C:\Program Files\ASUS\TurboV\TurboV.exe ()
PRC - C:\Program Files\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe ()
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\ASUS.SYS\config\DVMExportService.exe (DeviceVM)
PRC - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)


========== Modules (No Company Name) ==========

MOD - C:\Users\Gnorro\AppData\Local\Temp\61e4dc9e-b0a3-4e40-99a9-4cd9049f7d99\CliSecureRT.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\dab0ad2d0f5da372a4947d3a1c7c07a9\Microsoft.VisualBasic.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\03dee80574f4ec770b6f77ca030ded6c\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\f3814b488d9e083cbbc623e01b389f09\System.Data.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\90555968565afd59bce4b0974e9903bd\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\69f6e582cb79f107c61308b468c1a215\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\7fc18f2090a13cea5af7bf66c643a328\System.Management.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\423e9251a1d85573bbb1270dac940726\System.Xaml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\ce69ef2b59d6cc8dd59e9b529a9d6faf\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\bcb28f4bf66181ab783ba939ae6ac445\PresentationFramework.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\a5b8fbeae31c6e4437a3019fd4abf23d\PresentationCore.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\0615f03d7e847743aae33ccee19a5ce3\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\f765dcb1d3de13b6dfd768b2c1b68d30\PresentationFramework.Aero.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\95ce21535d44a9a907dbb85d908d0102\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\94605854f8328aadab15bc25eb6fbe77\System.Core.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\6ab7327878d105c015e6781c0fc07387\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\7b5e8b5f20ab51dee167ee6d4f991ab9\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System\e995cc6f08a3e381012423f9594648a6\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\c1af4ec9a36f671617a8ecaec00373f4\mscorlib.ni.dll ()
MOD - C:\Users\Gnorro\AppData\Local\Sky Italia\Sky Go Player\z.dll ()
MOD - C:\Users\Gnorro\AppData\Local\Sky Italia\Sky Go Player\ndsLogStore.dll ()
MOD - C:\Users\Gnorro\AppData\Local\Sky Italia\Sky Go Player\libxml2-2.dll ()
MOD - C:\Users\Gnorro\AppData\Local\Sky Italia\Sky Go Player\libgstreamer-0.10.dll ()
MOD - C:\Users\Gnorro\AppData\Local\Sky Italia\Sky Go Player\gsttspplugin.dll ()
MOD - C:\Users\Gnorro\AppData\Local\Sky Italia\Sky Go Player\NDSPCShowServer.exe ()
MOD - C:\Users\Gnorro\AppData\Local\Sky Italia\Sky Go Player\DrmSingleton.dll ()
MOD - C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
MOD - C:\Program Files\FileZilla FTP Client\fzshellext.dll ()
MOD - C:\ProgramData\Anti-phishing Domain Advisor\visicom_antiphishing-tray.exe ()
MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll ()
MOD - C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll ()
MOD - C:\Program Files\Notepad++\NppShell_02.dll ()
MOD - C:\Program Files\WinRAR\rarext.dll ()
MOD - C:\Program Files\ASUS\TurboV\TurboV.exe ()
MOD - C:\Program Files\ASUS\TurboV\OcProfile.dll ()
MOD - C:\Program Files\ASUS\TurboV\TVOCLIB.DLL ()
MOD - C:\Program Files\ASUS\TurboV\pngio.dll ()
MOD - C:\Program Files\ASUS\AI Suite\AiNap\AiNap.dll ()
MOD - C:\PROGRA~1\IZArc\IZArcCM.dll ()
MOD - C:\Program Files\ASUS\AI Suite\AiNap\vvc.dll ()
MOD - C:\Windows\System32\AsIO.dll ()


========== Win32 Services (SafeList) ==========

SRV - (SBSDWSCService) – C:\Program Files\Spybot File not found
SRV - (Skype C2C Service) – C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (Web Assistant Updater) – C:\Program Files\Web Assistant\ExtensionUpdaterService.exe ()
SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (Steam Client Service) – C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (SkypeUpdate) – C:\Program Files\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (TeamViewer7) – C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (AMD External Events Utility) – C:\Windows\System32\atiesrxx.exe (AMD)
SRV - (PowerOffer Service) – C:\Users\Gnorro\AppData\Local\PosService\Pos.exe (PowerOfferService)
SRV - (ServUpdater) – C:\Users\Gnorro\AppData\Local\ServUpdater\ServiceUpd.exe (ServiceUpd)
SRV - (ZuneWlanCfgSvc) – C:\Program Files\Zune\ZuneWlanCfgSvc.exe (Microsoft Corporation)
SRV - (WMZuneComm) – C:\Program Files\Zune\WMZuneComm.exe (Microsoft Corporation)
SRV - (ZuneNetworkSvc) – C:\Program Files\Zune\ZuneNss.exe (Microsoft Corporation)
SRV - (CDMA Device Service) – C:\Program Files\Samsung\USB Drivers\26_VIA_driver2\x86\VIAService.exe ()
SRV - (TVersityMediaServer) – C:\ProgramData\TVersity\Media Server\MediaServer.exe ()
SRV - (MsDepSvc) – C:\Program Files\IIS\Microsoft Web Deploy\MsDepSvc.exe (Microsoft Corporation)
SRV - (Macromedia Licensing Service) – C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe ()
SRV - (Mcx2Svc) – C:\Windows\System32\Mcx2Svc.dll (Microsoft Corporation)
SRV - (WAS) – C:\Windows\System32\inetsrv\iisw3adm.dll (Microsoft Corporation)
SRV - (W3SVC) – C:\Windows\System32\inetsrv\iisw3adm.dll (Microsoft Corporation)
SRV - (AppHostSvc) – C:\Windows\System32\inetsrv\apphostsvc.dll (Microsoft Corporation)
SRV - (KMService) – C:\Windows\System32\srvany.exe ()
SRV - (WatAdminSvc) – C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (AVP) – C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab)
SRV - (Tomcat6) – C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\tomcat6.exe (Apache Software Foundation)
SRV - (Hamachi2Svc) – C:\Program Files\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
SRV - (NetTcpPortSharing) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe (Microsoft Corporation)
SRV - (NetTcpActivator) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe (Microsoft Corporation)
SRV - (NetPipeActivator) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe (Microsoft Corporation)
SRV - (NetMsmqActivator) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe (Microsoft Corporation)
SRV - (StarWindServiceAE) – C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (StarWind Software)
SRV - (SandraAgentSrv) – C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2011.SP3\RpcAgentSrv.exe (SiSoftware)
SRV - (MSSQLServerADHelper100) – C:\Program Files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE (Microsoft Corporation)
SRV - (SensrSvc) – C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) – C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SRV - (RemoteAccess) – C:\Windows\System32\mprdim.dll (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (AsSysCtrlService) – C:\Program Files\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe ()
SRV - (MSSQL$SQLEXPRESS) SQL Server (SQLEXPRESS) – C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
SRV - (SQLBrowser) – C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation)
SRV - (SQLAgent$SQLEXPRESS) SQL Server Agent (SQLEXPRESS) – C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE (Microsoft Corporation)
SRV - (DvmMDES) – C:\ASUS.SYS\config\DVMExportService.exe (DeviceVM)
SRV - (msvsmon90) – C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x86\msvsmon.exe (Microsoft Corporation)
SRV - (WcesComm) – C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) – C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)
SRV - (AcronisOSSReinstallSvc) – C:\Program Files\Common Files\Acronis\Acronis Disk Director\oss_reinstall_svc.exe ()
SRV - (MSSQLServerADHelper) – C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (VGPU) – System32\drivers\rdvgkmd.sys File not found
DRV - (tsusbhub) – system32\drivers\tsusbhub.sys File not found
DRV - (Synth3dVsc) – System32\drivers\synth3dvsc.sys File not found
DRV - (nvlddmkm) – system32\DRIVERS\nvlddmkm.sys File not found
DRV - (EIO) – system32\DRIVERS\EIO.sys File not found
DRV - (catchme) – C:\Users\Gnorro\AppData\Local\Temp\catchme.sys File not found
DRV - (mbamchameleon) – C:\Windows\System32\drivers\mbamchameleon.sys ()
DRV - (ssudmdm) SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.) – C:\Windows\System32\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV - (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.) – C:\Windows\System32\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV - (atikmdag) – C:\Windows\System32\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV - (amdkmdag) – C:\Windows\System32\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV - (amdkmdap) – C:\Windows\System32\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV - (AtiHDAudioService) – C:\Windows\System32\drivers\AtihdW73.sys (Advanced Micro Devices)
DRV - (HWiNFO32) – C:\Program Files\HWiNFO32\HWiNFO32.SYS (REALiX™)
DRV - (dc3d) MS Hardware Device Detection Driver (USB) – C:\Windows\System32\drivers\dc3d.sys (Microsoft Corporation)
DRV - (speedfan) – C:\Windows\System32\speedfan.sys (Almico Software)
DRV - (vmbus) – C:\Windows\System32\drivers\vmbus.sys (Microsoft Corporation)
DRV - (storflt) – C:\Windows\System32\drivers\vmstorfl.sys (Microsoft Corporation)
DRV - (storvsc) – C:\Windows\System32\drivers\storvsc.sys (Microsoft Corporation)
DRV - (TsUsbFlt) – C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (RdpVideoMiniport) – C:\Windows\System32\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV - (WINUSB) – C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (VMBusHID) – C:\Windows\System32\drivers\VMBusHID.sys (Microsoft Corporation)
DRV - (s3cap) – C:\Windows\System32\drivers\vms3cap.sys (Microsoft Corporation)
DRV - (udfs) – C:\Windows\System32\drivers\udfs.sys (Microsoft Corporation)
DRV - (KLIF) – C:\Windows\System32\drivers\klif.sys (Kaspersky Lab)
DRV - (sptd) – C:\Windows\System32\drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (snapman) – C:\Windows\System32\drivers\snapman.sys (Acronis)
DRV - (vmm) – C:\Windows\System32\drivers\VMM.sys (Microsoft Corporation)
DRV - (hamachi) – C:\Windows\System32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (AtiHdmiService) – C:\Windows\System32\drivers\AtiHdmi.sys (ATI Technologies, Inc.)
DRV - (RivaTuner32) – C:\Program Files\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner32.sys ()
DRV - (SANDRA) – C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2011.SP3\WNt500x86\Sandra.sys (SiSoftware)
DRV - (AsIO) – C:\Windows\System32\drivers\AsIO.sys ()
DRV - (MTsensor) – C:\Windows\System32\drivers\ASACPI.sys ()
DRV - (crcdisk) – C:\Windows\System32\drivers\crcdisk.sys (Microsoft Corporation)
DRV - (Serial) – C:\Windows\System32\drivers\serial.sys (Brother Industries Ltd.)
DRV - (cdfs) – C:\Windows\System32\drivers\cdfs.sys (Microsoft Corporation)
DRV - (yukonw7) – C:\Windows\System32\drivers\yk62x86.sys (Marvell)
DRV - (JRAID) – C:\Windows\System32\drivers\jraid.sys (JMicron Technology Corp.)
DRV - (kl1) – C:\Windows\System32\drivers\kl1.sys (Kaspersky Lab)
DRV - (klmouflt) – C:\Windows\System32\drivers\klmouflt.sys (Kaspersky Lab)
DRV - (KLIM6) – C:\Windows\System32\drivers\klim6.sys (Kaspersky Lab)
DRV - (Point32) – C:\Windows\System32\drivers\point32k.sys (Microsoft Corporation)
DRV - (RsFx0103) – C:\Windows\System32\drivers\RsFx0103.sys (Microsoft Corporation)
DRV - (klbg) – C:\Windows\System32\drivers\klbg.sys (Kaspersky Lab)
DRV - (ATITool) – C:\Windows\System32\drivers\ATITool.sys ()
DRV - (giveio) – C:\Windows\System32\giveio.sys ()


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.findeer.com
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = it
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = FE 39 A6 FC 66 57 CB 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}: "URL" = http://search.yahoo.com/search?fr=vmn&…q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: ' http://search.findeer.com'
FF - prefs.js..extensions.enabledItems: {4BBDD651-70CF-4821-84F8-2B918CF89CA3}:6.3.3.2
FF - prefs.js..browser.startup.homepage: "http://search.findeer.com/"
FF - prefs.js..: 'Cerca…'


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.0: C:\Program Files\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll File not found
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.102.0: C:\Program Files\Battlelog Web Plugins\1.102.0\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/wpi,version=1.4: C:\Program Files\Microsoft\Web Platform Installer\\npwpidetector.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@nds.com/PCShowPlugin: C:\Users\Gnorro\AppData\Local\Sky Italia\Sky Go Player\npPCShowPlugin.dll File not found
FF - HKCU\Software\MozillaPlugins\@nds.com/PlayerPlugin: C:\Users\Gnorro\AppData\Local\Sky Italia\Sky Go Player\npPlayerPlugin.dll (NDS)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Gnorro\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Gnorro\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\NDS.com/PlayerPlugin: C:\Users\Gnorro\AppData\Local\Sky Italia\Sky Go Player\npPlayerPlugin.dll (NDS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/09/19 19:17:47 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\Web Assistant\Firefox [2012/05/27 09:46:15 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/04/29 14:08:04 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/10/04 20:58:05 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\THBExt [2010/09/19 19:01:03 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/09/19 19:17:47 | 000,000,000 | —D | M]

[2010/09/18 23:50:34 | 000,000,000 | —D | M] (No name found) – C:\Users\Gnorro\AppData\Roaming\mozilla\Extensions
[2010/09/18 23:50:34 | 000,000,000 | —D | M] (No name found) – C:\Users\Gnorro\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012/05/27 09:46:28 | 000,000,000 | —D | M] (No name found) – C:\Users\Gnorro\AppData\Roaming\mozilla\Firefox\Profiles\bclvyy6e.default\extensions
[2010/09/18 22:33:08 | 000,000,000 | —D | M] (FEBE) – C:\Users\Gnorro\AppData\Roaming\mozilla\Firefox\Profiles\bclvyy6e.default\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3}
[2010/10/17 14:46:41 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\Gnorro\AppData\Roaming\mozilla\Firefox\Profiles\bclvyy6e.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2012/05/27 09:46:28 | 000,000,000 | —D | M] (incredibar.com) – C:\Users\Gnorro\AppData\Roaming\mozilla\Firefox\Profiles\bclvyy6e.default\extensions\[removed]
[2010/09/19 18:56:41 | 000,000,000 | —D | M] (Foxit Toolbar) – C:\Users\Gnorro\AppData\Roaming\mozilla\Firefox\Profiles\bclvyy6e.default\extensions\[removed]
[2012/05/27 10:56:41 | 000,000,000 | —D | M] (No name found) – C:\Users\Gnorro\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Gnorro\extensions
[2011/01/10 21:44:25 | 000,000,000 | —D | M] (Remove Cookies for Site) – C:\Users\Gnorro\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Gnorro\extensions\{06997db0-c027-4d5f-bd37-b0d9230226ea}
[2010/09/18 22:34:53 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Gnorro\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Gnorro\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/02/03 23:04:08 | 000,000,000 | —D | M] (PDF Download) – C:\Users\Gnorro\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Gnorro\extensions\{37E4D8EA-8BDA-4831-8EA1-89053939A250}
[2012/01/20 01:02:58 | 000,000,000 | —D | M] (FEBE) – C:\Users\Gnorro\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Gnorro\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3}
[2011/08/29 17:21:35 | 000,000,000 | —D | M] (Vyprázdnit vyrovnávací paměť) – C:\Users\Gnorro\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Gnorro\extensions\{563e4790-7e70-11da-a72b-0800200c9a66}
[2011/06/28 21:48:03 | 000,000,000 | —D | M] (All-in-One Gestures) – C:\Users\Gnorro\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Gnorro\extensions\{8b86149f-01fb-4842-9dd8-4d7eb02fd055}
[2010/09/18 22:34:53 | 000,000,000 | —D | M] (Noia 2.0 (eXtreme)) – C:\Users\Gnorro\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Gnorro\extensions\{9f08cb5a-76b1-4bcf-aff9-90e1a5d60b1e}
[2012/05/22 23:10:40 | 000,000,000 | —D | M] (Page Speed) – C:\Users\Gnorro\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Gnorro\extensions\{e3f6c2cc-d8db-498c-af6c-499fb211db97}
[2010/09/18 22:34:53 | 000,000,000 | —D | M] (Noia 2.0 eXtreme OPT) – C:\Users\Gnorro\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Gnorro\extensions\[removed]
[2012/05/18 22:30:52 | 000,001,867 | —- | M] () – C:\Users\Gnorro\AppData\Roaming\Mozilla\Firefox\Profiles\bclvyy6e.default\searchplugins\findeer.xml
[2011/11/12 10:14:08 | 000,000,000 | —D | M] (No name found) – C:\Program Files\mozilla firefox\extensions
[2012/06/05 18:05:08 | 000,000,000 | —D | M] (Skype Click to Call) – C:\Program Files\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2010/09/19 19:01:15 | 000,000,000 | —D | M] (Kaspersky URL Advisor) – C:\Program Files\mozilla firefox\extensions\[removed]
[2012/04/29 14:08:04 | 000,097,208 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/08/29 22:43:22 | 000,611,224 | —- | M] (Oracle Corporation) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010/09/19 18:56:18 | 000,075,208 | —- | M] (Foxit Software Company) – C:\Program Files\mozilla firefox\plugins\npFoxitReaderPlugin.dll
[2012/04/29 14:08:02 | 000,001,393 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazon-it.xml
[2012/04/29 14:08:02 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/04/29 14:08:02 | 000,000,744 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\eBay-it.xml
[2012/04/29 14:08:02 | 000,000,817 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\hoepli.xml
[2012/04/29 14:08:02 | 000,001,182 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\wikipedia-it.xml
[2012/04/29 14:08:02 | 000,000,953 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo-it.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{googl
e:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chro
me&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client
=chrome&hl;={language}&q;={searchTerms},
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Gnorro\AppData\Local\Google\Chrome\Application\19.0.1084.52\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Gnorro\AppData\Local\Google\Chrome\Application\19.0.1084.52\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Gnorro\AppData\Local\Google\Chrome\Application\19.0.1084.52\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\Gnorro\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: Java Deployment Toolkit 7.0.0.147 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 7 (Enabled) = C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll
CHR - plugin: Foxit Reader Plugin for Mozilla (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
CHR - plugin: Windows Genuine Advantage (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npLegitCheckPlugin.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL
CHR - plugin: ESN Launch Mozilla Plugin (Enabled) = C:\Program Files\Battlelog Web Plugins\1.102.0\npesnlaunch.dll
CHR - plugin: ESN Sonar API (Enabled) = C:\Program Files\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - plugin: WPI Detector 1.4 (Enabled) = C:\Program Files\Microsoft\Web Platform Installer\\npwpidetector.dll
CHR - plugin: PCShow Player Plugin (Enabled) = C:\Users\Gnorro\AppData\Local\Sky Italia\Sky Go Player\npPlayerPlugin.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - Extension: Angry Birds = C:\Users\Gnorro\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj\1.5.0.7_0\
CHR - Extension: Grepolis = C:\Users\Gnorro\AppData\Local\Google\Chrome\User Data\Default\Extensions\kkgkognjknhcgbgbeijjondlikfkgnog\2.11.13_0\
CHR - Extension: Skype Click to Call = C:\Users\Gnorro\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.0.0.10201_0\

O1 HOSTS File: ([2012/06/03 16:30:21 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {336D0C35-8A85-403a-B9D2-65C292C39087} - No CLSID value found.
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (IeMonitorBho Class) - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll (Megaupload Limited)
O2 - BHO: (Foxit Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O3 - HKLM\..\Toolbar: (Foxit Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (Foxit Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Ai Nap] C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe (ASUSTeK Computer Inc.)
O4 - HKLM..\Run: [Anti-phishing Domain Advisor] C:\ProgramData\Anti-phishing Domain Advisor\visicom_antiphishing.exe (Visicom Media Inc. (Powered by Panda Security))
O4 - HKLM..\Run: [avp] C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab)
O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Cpu Level Up help] C:\Program Files\ASUS\AI Suite\CpuLevelUpHelp.exe ()
O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe ()
O4 - HKLM..\Run: [PosService] C:\Users\Public\Documents\AppData\PoApp\PLauncher.exe (PLauncher)
O4 - HKLM..\Run: [QFan Help] C:\Program Files\ASUS\AI Suite\QFan3\QFanHelp.exe (ASUSTeK Computer Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [TurboV] C:\Program Files\ASUS\TurboV\TurboV.exe ()
O4 - HKCU..\Run: [KiesHelper] C:\Program Files\Samsung\Kies\KiesHelper.exe (Samsung)
O4 - HKCU..\Run: [KiesPDLR] C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
O4 - HKCU..\Run: [PCShowServer] C:\Users\Gnorro\AppData\Local\Sky Italia\Sky Go Player\PCShowServerPMWrapper.exe (NDS Technologies)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Aggiungi ad Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm ()
O8 - Extra context menu item: E&sporta; in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office14\EXCEL.EXE/3000 File not found
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: &Tastiera; Virtuale - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: C&ontrollo; URL - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.0.0)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{20582271-F6AE-4E36-886F-48024D8CAC56}: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{20582271-F6AE-4E36-886F-48024D8CAC56}: NameServer = 176.31.229.24,176.31.229.25
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{63197F6F-7A11-48D5-B8E7-0161239E9EF3}: NameServer = 176.31.229.24,176.31.229.25
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{e29ac6c2-7037-11de-816d-806e6f6e6963}: NameServer = 176.31.229.24,176.31.229.25
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E65A718F-C287-4469-9D2A-C248217DFE90}: NameServer = 176.31.229.24,176.31.229.25
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FD36B4D0-A033-45AC-93E9-C6519D78E284}: NameServer = 176.31.229.24,176.31.229.25
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll) - C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll (Kaspersky Lab)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\klogon: DllName - (C:\Windows\system32\klogon.dll) - C:\Windows\System32\klogon.dll (Kaspersky Lab)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 23:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/06/06 21:16:14 | 000,596,480 | —- | C] (OldTimer Tools) – C:\Users\Gnorro\Desktop\OTL.exe
[2012/06/04 21:51:43 | 000,000,000 | —D | C] – C:\Users\Gnorro\AppData\Roaming\Malwarebytes
[2012/06/03 16:30:25 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2012/06/03 16:28:55 | 000,000,000 | —D | C] – C:\Users\Gnorro\AppData\Local\temp
[2012/06/03 16:02:59 | 004,535,659 | R— | C] (Swearware) – C:\Users\Gnorro\Desktop\ComboFix.exe
[2012/06/02 14:56:09 | 002,127,960 | —- | C] (Kaspersky Lab ZAO) – C:\Users\Gnorro\Desktop\tdsskiller.exe
[2012/06/02 09:46:53 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/06/02 09:46:53 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2012/06/02 09:46:52 | 000,022,344 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2012/06/02 09:46:52 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2012/05/31 20:59:08 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2012/05/31 20:59:08 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2012/05/31 20:59:08 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2012/05/31 20:59:01 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2012/05/31 20:58:58 | 000,000,000 | —D | C] – C:\Qoobox
[2012/05/27 12:14:41 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\Gnorro\Desktop\HiJackThis.exe
[2012/05/27 12:01:33 | 000,000,000 | —D | C] – C:\Program Files\WhoLockMe104
[2012/05/27 10:55:21 | 000,000,000 | —D | C] – C:\Users\Gnorro\AppData\Local\antiphishing-vmntbcleaner1_0dn
[2012/05/27 10:55:20 | 000,000,000 | —D | C] – C:\ProgramData\Anti-phishing Domain Advisor
[2012/05/27 10:55:00 | 000,000,000 | —D | C] – C:\Users\Gnorro\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Toolbar Cleaner
[2012/05/27 10:55:00 | 000,000,000 | —D | C] – C:\Program Files\Toolbar Cleaner
[2012/05/27 10:47:24 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2012/05/27 10:47:22 | 000,000,000 | —D | C] – C:\ProgramData\Spybot - Search & Destroy
[2012/05/27 10:47:22 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2012/05/27 09:46:36 | 000,000,000 | —D | C] – C:\Program Files\hpmonitor
[2012/05/27 09:46:14 | 000,000,000 | —D | C] – C:\Program Files\Web Assistant
[2012/05/27 09:45:51 | 000,000,000 | —D | C] – C:\Program Files\Win 32. Trojan . Small Removal Tool
[2012/05/27 09:42:26 | 000,000,000 | —D | C] – C:\ProgramData\TEMP
[2012/05/27 09:42:25 | 000,000,000 | —D | C] – C:\ProgramData\PC Tools
[2012/05/27 09:42:24 | 000,000,000 | —D | C] – C:\Users\Gnorro\AppData\Roaming\TestApp
[2012/05/26 18:04:54 | 000,000,000 | -HSD | C] – C:\Windows\System32\%APPDATA%
[2012/05/25 21:06:19 | 000,000,000 | —D | C] – C:\Users\Gnorro\Desktop\ellegi
[2012/05/18 22:30:43 | 000,000,000 | —D | C] – C:\Users\Gnorro\AppData\Local\ServUpdater
[2012/05/18 22:30:43 | 000,000,000 | —D | C] – C:\Users\Gnorro\AppData\Local\PosService
[2012/05/18 22:30:43 | 000,000,000 | —D | C] – C:\Users\Public\Documents\AppData
[2012/05/18 22:30:42 | 000,000,000 | —D | C] – C:\Users\Gnorro\AppData\Local\PowerOffer
[2012/05/18 22:30:30 | 000,000,000 | —D | C] – C:\Users\Public\Documents\PhotoMagick
[2012/05/15 20:47:57 | 000,000,000 | —D | C] – C:\Users\Gnorro\Documents\Juventus
[2012/05/14 00:31:37 | 000,000,000 | —D | C] – C:\Users\Gnorro\Desktop\kproxyagent
[2012/05/11 20:58:48 | 003,968,368 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntkrnlpa.exe
[2012/05/11 20:58:48 | 003,913,072 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntoskrnl.exe
[2012/05/11 20:58:47 | 002,343,424 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2012/05/11 20:58:13 | 001,077,248 | —- | C] (Microsoft Corporation) – C:\Windows\System32\DWrite.dll

========== Files - Modified Within 30 Days ==========

[2012/06/06 21:26:05 | 000,000,978 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/06/06 21:22:01 | 000,001,164 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3857534020-3991675840-3102532669-1001UA.job
[2012/06/06 21:22:01 | 000,001,138 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/06/06 21:16:23 | 000,596,480 | —- | M] (OldTimer Tools) – C:\Users\Gnorro\Desktop\OTL.exe
[2012/06/06 21:10:55 | 000,000,177 | -H– | M] () – C:\dvmexp.idx
[2012/06/06 18:38:39 | 000,014,192 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/06/06 18:38:39 | 000,014,192 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/06/06 18:30:45 | 000,001,134 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/06/06 18:30:38 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/06/06 11:22:01 | 000,001,112 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3857534020-3991675840-3102532669-1001Core.job
[2012/06/05 17:58:03 | 001,306,135 | —- | M] () – C:\Users\Gnorro\Desktop\Humanitas_piano_ottimizzazione.pdf
[2012/06/03 16:30:21 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2012/06/03 16:03:32 | 004,535,659 | R— | M] (Swearware) – C:\Users\Gnorro\Desktop\ComboFix.exe
[2012/06/03 10:40:26 | 000,001,021 | —- | M] () – C:\Users\Gnorro\Desktop\Dropbox.lnk
[2012/06/02 14:56:14 | 002,127,960 | —- | M] (Kaspersky Lab ZAO) – C:\Users\Gnorro\Desktop\tdsskiller.exe
[2012/06/02 14:17:07 | 000,000,020 | —- | M] () – C:\Users\Gnorro\defogger_reenable
[2012/06/02 14:15:31 | 000,050,477 | —- | M] () – C:\Users\Gnorro\Desktop\Defogger.exe
[2012/06/02 11:00:29 | 003,622,051 | —- | M] () – C:\Users\Gnorro\Desktop\area-trade.zip
[2012/06/02 09:50:22 | 000,028,488 | —- | M] () – C:\Windows\System32\drivers\mbamchameleon.sys
[2012/05/27 23:20:17 | 368,133,497 | —- | M] () – C:\Windows\MEMORY.DMP
[2012/05/27 12:14:43 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\Gnorro\Desktop\HiJackThis.exe
[2012/05/27 12:03:19 | 000,003,888 | —- | M] () – C:\Windows\System32\drivers\NTHANDLE.SYS
[2012/05/27 11:24:14 | 000,000,185 | —- | M] () – C:\Windows\wininit.ini
[2012/05/27 10:47:25 | 000,001,220 | —- | M] () – C:\Users\Gnorro\Desktop\Spybot - Search & Destroy.lnk
[2012/05/27 09:46:29 | 000,000,447 | —- | M] () – C:\user.js
[2012/05/26 17:33:27 | 001,217,091 | —- | M] () – C:\Users\Gnorro\Desktop\ablaze_free.zip
[2012/05/20 10:58:00 | 002,397,439 | —- | M] () – C:\Users\Gnorro\Desktop\Scooba-385.pdf
[2012/05/19 18:57:46 | 000,000,900 | —- | M] () – C:\Windows\System32\drivers\etc\hosts.20120527-113137.backup
[2012/05/19 17:20:04 | 171,180,657 | —- | M] () – C:\Users\Gnorro\Desktop\sito_old.zip
[2012/05/14 00:30:05 | 085,308,274 | —- | M] () – C:\Users\Gnorro\Desktop\kproxyagent.zip
[2012/05/13 19:25:34 | 000,002,070 | -H– | M] () – C:\Users\Gnorro\Documents\Default.rdp
[2012/05/12 11:36:33 | 000,958,040 | —- | M] () – C:\Windows\System32\perfh010.dat
[2012/05/12 11:36:33 | 000,851,266 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/05/12 11:36:33 | 000,225,976 | —- | M] () – C:\Windows\System32\perfc010.dat
[2012/05/12 11:36:33 | 000,189,972 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/05/12 10:28:05 | 000,330,816 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2012/05/11 23:32:05 | 000,000,660 | —- | M] () – C:\Users\Gnorro\Documents\ax_files.xml
[2012/05/10 11:26:11 | 000,419,488 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerApp.exe
[2012/05/10 11:26:11 | 000,070,304 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerCPLApp.cpl

========== Files Created - No Company Name ==========

[2012/06/05 17:57:50 | 001,306,135 | —- | C] () – C:\Users\Gnorro\Desktop\Humanitas_piano_ottimizzazione.pdf
[2012/06/02 14:16:26 | 000,000,020 | —- | C] () – C:\Users\Gnorro\defogger_reenable
[2012/06/02 14:15:16 | 000,050,477 | —- | C] () – C:\Users\Gnorro\Desktop\Defogger.exe
[2012/06/02 11:00:15 | 003,622,051 | —- | C] () – C:\Users\Gnorro\Desktop\area-trade.zip
[2012/06/02 09:50:22 | 000,028,488 | —- | C] () – C:\Windows\System32\drivers\mbamchameleon.sys
[2012/05/31 20:59:08 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2012/05/31 20:59:08 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2012/05/31 20:59:08 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2012/05/31 20:59:08 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2012/05/31 20:59:08 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2012/05/27 12:02:36 | 000,003,888 | —- | C] () – C:\Windows\System32\drivers\NTHANDLE.SYS
[2012/05/27 11:24:14 | 000,000,185 | —- | C] () – C:\Windows\wininit.ini
[2012/05/27 10:47:25 | 000,001,220 | —- | C] () – C:\Users\Gnorro\Desktop\Spybot - Search & Destroy.lnk
[2012/05/27 09:46:28 | 000,000,447 | —- | C] () – C:\user.js
[2012/05/26 17:33:24 | 001,217,091 | —- | C] () – C:\Users\Gnorro\Desktop\ablaze_free.zip
[2012/05/20 10:57:57 | 002,397,439 | —- | C] () – C:\Users\Gnorro\Desktop\Scooba-385.pdf
[2012/05/19 17:18:58 | 171,180,657 | —- | C] () – C:\Users\Gnorro\Desktop\sito_old.zip
[2012/05/14 00:26:09 | 085,308,274 | —- | C] () – C:\Users\Gnorro\Desktop\kproxyagent.zip
[2011/12/06 04:27:36 | 000,204,960 | —- | C] () – C:\Windows\System32\ativvsvl.dat
[2011/12/06 04:27:36 | 000,157,152 | —- | C] () – C:\Windows\System32\ativvsva.dat
[2011/12/05 23:04:00 | 000,059,904 | —- | C] () – C:\Windows\System32\OpenVideo.dll
[2011/12/05 23:03:52 | 000,054,784 | —- | C] () – C:\Windows\System32\OVDecode.dll
[2011/11/18 21:14:01 | 000,000,245 | —- | C] () – C:\Windows\game.ini
[2011/11/14 21:47:22 | 000,608,507 | —- | C] () – C:\Windows\System32\atiicdxx.dat
[2011/10/30 12:15:02 | 000,000,000 | —- | C] () – C:\Users\Gnorro\AppData\Local\{F1DD04A4-CDCE-4856-8928-729F1D9A6DF1}
[2011/09/13 01:06:16 | 000,003,917 | —- | C] () – C:\Windows\System32\atipblag.dat
[2011/07/26 17:26:48 | 000,030,568 | —- | C] () – C:\Windows\MusiccityDownload.exe
[2011/07/26 17:26:46 | 000,974,848 | —- | C] () – C:\Windows\System32\cis-2.4.dll
[2011/07/26 17:26:46 | 000,081,920 | —- | C] () – C:\Windows\System32\issacapi_bs-2.3.dll
[2011/07/26 17:26:46 | 000,065,536 | —- | C] () – C:\Windows\System32\issacapi_pe-2.3.dll
[2011/07/26 17:26:46 | 000,057,344 | —- | C] () – C:\Windows\System32\issacapi_se-2.3.dll
[2011/07/16 16:17:56 | 000,000,000 | —- | C] () – C:\Users\Gnorro\AppData\Local\{3C57C1EE-0A2B-4BDD-9FC2-BA875F75C67D}
[2011/07/16 13:35:08 | 000,000,000 | —- | C] () – C:\Users\Gnorro\AppData\Local\{9ECB4060-87E8-4B49-B26F-01DEE7CBDE4B}
[2011/07/13 23:28:06 | 000,000,000 | —- | C] () – C:\Users\Gnorro\AppData\Local\{699843D5-5BB0-4E63-B969-284AB1A9DEF3}
[2011/07/03 22:06:35 | 011,120,640 | —- | C] () – C:\Users\Gnorro\AppData\Roaming\Sandra.mdb
[2011/06/29 21:31:34 | 000,013,216 | —- | C] () – C:\Windows\System32\drivers\ASACPI.sys
[2011/05/20 22:35:28 | 000,304,744 | —- | C] () – C:\Windows\System32\nvStreaming.exe
[2011/02/27 13:18:40 | 000,000,306 | —- | C] () – C:\Windows\ODBC.INI
[2011/02/23 22:58:46 | 000,080,896 | —- | C] () – C:\Windows\System32\RDVGHelper.exe
[2011/02/23 22:57:58 | 000,066,048 | —- | C] () – C:\Windows\System32\PrintBrmUi.exe
[2011/01/29 16:44:37 | 000,205,293 | —- | C] () – C:\Windows\hpoins39.dat.temp
[2010/12/29 20:48:58 | 000,008,704 | —- | C] () – C:\Users\Gnorro\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/12/08 11:46:11 | 000,000,703 | —- | C] () – C:\Windows\hpomdl39.dat.temp
[2010/11/22 21:30:22 | 000,024,576 | —- | C] () – C:\Windows\System32\AsIO.dll
[2010/11/22 21:30:22 | 000,011,296 | —- | C] () – C:\Windows\System32\drivers\AsIO.sys
[2010/11/22 21:30:19 | 000,011,832 | —- | C] () – C:\Windows\System32\drivers\AsInsHelp64.sys
[2010/11/22 21:30:19 | 000,010,216 | —- | C] () – C:\Windows\System32\drivers\AsInsHelp32.sys
[2010/10/18 22:07:16 | 000,000,756 | -HS- | C] () – C:\Windows\bink32.dll
[2010/10/06 19:56:57 | 000,140,072 | —- | C] () – C:\Windows\System32\drivers\PnkBstrK.sys
[2010/10/06 19:56:57 | 000,138,056 | —- | C] () – C:\Users\Gnorro\AppData\Roaming\PnkBstrK.sys
[2010/10/06 19:56:14 | 000,280,904 | —- | C] () – C:\Windows\System32\PnkBstrB.exe
[2010/10/06 19:56:13 | 002,601,752 | —- | C] () – C:\Windows\System32\pbsvc_moh.exe
[2010/10/06 19:56:13 | 000,075,136 | —- | C] () – C:\Windows\System32\PnkBstrA.exe
[2010/09/24 20:13:59 | 000,008,192 | —- | C] () – C:\Windows\System32\srvany.exe
[2010/09/20 20:12:08 | 000,604,140 | -HS- | C] () – C:\Windows\System32\drivers\ISwift3.dat
[2010/09/19 19:13:14 | 000,205,297 | —- | C] () – C:\Windows\hpoins39.dat
[2010/09/19 19:01:12 | 000,115,369 | —- | C] () – C:\Windows\System32\drivers\klin.dat
[2010/09/19 19:01:12 | 000,097,961 | —- | C] () – C:\Windows\System32\drivers\klick.dat
[2010/09/19 00:28:21 | 000,000,056 | -H– | C] () – C:\Windows\System32\ezsidmv.dat
[2010/09/18 23:50:34 | 000,000,000 | —- | C] () – C:\Windows\nsreg.dat
[2010/09/18 20:57:24 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin
[2010/09/02 00:53:48 | 000,108,032 | —- | C] () – C:\Windows\System32\ff_vfw.dll
[2010/06/23 12:35:52 | 000,790,528 | —- | C] () – C:\Windows\System32\xvidcore.dll
[2010/06/23 12:35:52 | 000,134,144 | —- | C] () – C:\Windows\System32\xvidvfw.dll

========== LOP Check ==========

[2010/09/19 19:38:35 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\Acoustica
[2011/09/26 21:25:45 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\avidemux
[2011/03/14 22:02:00 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\BitTorrent
[2010/12/08 12:51:58 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\Business Objects
[2010/10/02 19:00:01 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\Canneverbe Limited
[2010/10/18 22:18:41 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\DAEMON Tools Pro
[2012/06/03 13:39:30 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\Dropbox
[2011/06/19 12:05:50 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\eMule AdunanzA
[2012/06/06 20:38:08 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\FileZilla
[2010/09/20 20:33:04 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\Foxit Software
[2012/04/01 12:43:07 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\GetRightToGo
[2012/05/03 21:23:33 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\Hausqyw
[2012/02/08 21:27:01 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\IrfanView
[2011/02/08 19:51:25 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\Leadertech
[2010/09/25 14:30:53 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\LucasArts
[2010/12/02 00:00:43 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\Megaupload
[2012/03/31 14:43:43 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\Mipony
[2010/11/14 14:54:48 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\Notepad++
[2011/11/02 23:52:24 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\Origin
[2012/01/12 23:08:09 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\Passware
[2012/04/01 18:19:22 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\RobotSoft
[2011/08/29 19:13:11 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\Samsung
[2012/05/13 19:29:22 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\SQLyog
[2010/12/15 01:23:39 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\Subversion
[2011/12/17 19:37:40 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\TeamViewer
[2012/05/27 09:42:24 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\TestApp
[2012/01/12 22:52:27 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\Thinstall
[2010/09/18 23:50:33 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\Thunderbird
[2010/10/18 22:36:16 | 000,000,000 | –SD | M] – C:\Users\Gnorro\AppData\Roaming\Virtual CD v10
[2010/10/05 22:20:13 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\Win7codecs
[2012/05/03 22:56:41 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\Xeo
[2012/05/11 10:51:57 | 000,032,556 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2009/06/10 23:42:20 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2012/06/03 16:38:30 | 000,028,537 | —- | M] () – C:\ComboFix.txt
[2009/06/10 23:42:20 | 000,000,010 | —- | M] () – C:\config.sys
[2012/06/06 21:10:55 | 000,000,177 | -H– | M] () – C:\dvmexp.idx
[2011/01/02 15:56:36 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2011/01/02 15:56:36 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2012/06/06 18:30:36 | 3210,862,592 | -HS- | M] () – C:\pagefile.sys
[2002/01/01 01:25:28 | 000,001,875 | —- | M] () – C:\RHDSetup.log
[2011/11/27 12:43:05 | 000,085,798 | —- | M] () – C:\shared.log
[2010/11/22 21:37:42 | 000,000,057 | -H– | M] () – C:\splash.idx
[2012/06/02 15:01:51 | 000,313,432 | —- | M] () – C:\TDSSKiller.2.7.36.0_02.06.2012_14.57.00_log.txt
[2012/02/11 12:26:35 | 000,049,664 | -HS- | M] () – C:\Thumbs.db
[2012/05/27 09:46:29 | 000,000,447 | —- | M] () – C:\user.js
[2009/03/13 19:21:12 | 000,009,312 | -H– | M] () – C:\version

< %systemroot%\Fonts\*.com >
[2009/07/14 06:52:25 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 06:52:25 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 06:52:25 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 06:52:25 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 23:31:19 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2009/04/20 12:23:48 | 000,315,904 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\hpfpp70w.dll
[2009/07/14 03:15:35 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\jnwppr.dll
[2010/11/20 14:21:36 | 000,030,208 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\winprint.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/14 06:41:57 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lîk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Mikzosoft\Internet Explorer\Quick Launch\*.lnk /x >

< %USERPROFILE%\Desktop\*.exe >
[2012/04/13 22:49:24 | 001,975,840 | —- | M] (Comfort Software Group ) – C:\Users\Gnorro\Desktop\FreeCountdownTimerSetup.exe
[2012/06/06 21:16:23 | 000,596,480 | —- | M] (OldTimer Tools) – C:\Users\Gnorro\Desktop\OTL.exe
[2011/01/02 16:02:16 | 007,100,928 | —- | M] () – C:\Users\Gnorro\Desktop\PocketDivXEncoder_0.3.96.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2012-06-05 15:28:24

< %USERPROFILE%\..|smtmp;true;true;true /FP >

< %temp%\smtmp\*.* /s > >

< MD5 for: EXPLORER.ADML >
[2009/07/14 10:20:49 | 000,004,183 | —- | M] () MD5=4CF10EA9BAB7750F41A7E154AECAF977 – C:\Windows\PolicyDefinitions\it-IT\Explorer.adml
[2009/07/14 10:20:49 | 000,004,183 | —- | M] () MD5=4CF10EA9BAB7750F41A7E154AECAF977 – C:\Windows\winsxs\x86_microsoft-windows-s..ouppolicy.resources_31bf3856ad364e35_6.1.7600.16385_it-it_af819edf95d3f553\Explorer.adml

< MD5 for: EXPLORER.ADMX >
[2009/06/10 23:34:46 | 000,003,836 | —- | M] () MD5=AD131A834808E6AFF4A3918DE05BFCF6 – C:\Windows\PolicyDefinitions\Explorer.admx
[2009/06/10 23:34:46 | 000,003,836 | —- | M] () MD5=AD131A834808E6AFF4A3918DE05BFCF6 – C:\Windows\winsxs\x86_microsoft-windows-shell-grouppolicy_31bf3856ad364e35_6.1.7600.16385_none_1590ffd752297581\Explorer.admx

< MD5 for: EXPLORER.CSS >
[2010/12/11 12:12:55 | 000,003,832 | —- | M] () MD5=D93189C3B39B965660A088B75D67DB44 – C:\Program Files\Apache Software Foundation\Tomcat 6.0\webapps\opencms\resources\commons\explorer.css
[2010/12/11 12:21:20 | 000,003,832 | —- | M] () MD5=D93189C3B39B965660A088B75D67DB44 – C:\Program Files\Apache Software Foundation\Tomcat 6.0\webapps\ROOT\resources\commons\explorer.css

< MD5 for: EXPLORER.DESIGNER.VB >
[2007/12/31 03:19:38 | 000,036,551 | —- | M] () MD5=632916338A43FA996AE2C8E0EBBF7B20 – C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\ItemTemplatesCache\VisualBasic\Windows Forms\1040\Explorer.zip\explorer.designer.vb

< MD5 for: EXPLORER.EXE >
[2011/02/26 07:19:21 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe
[2009/07/14 03:14:20 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe
[2011/02/26 07:51:13 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_525b5180f3f95373\explorer.exe
[2009/10/31 07:45:39 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe
[2011/02/26 07:33:07 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_51a3a583dafd0cef\explorer.exe
[2010/11/20 14:17:09 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe
[2011/02/25 07:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\ERDNT\cache\explorer.exe
[2011/02/25 07:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\explorer.exe
[2011/02/25 07:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe
[2009/08/03 07:49:47 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe
[2009/08/03 07:35:50 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe
[2009/10/31 08:00:51 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe

< MD5 for: EXPLORER.EXE.MUI >
[2009/07/14 10:20:23 | 000,025,088 | —- | M] (Microsoft Corporation) MD5=D871BB5958AEF9F493B330FCB533DE6B – C:\Windows\it-IT\explorer.exe.mui
[2009/07/14 10:20:23 | 000,025,088 | —- | M] (Microsoft Corporation) MD5=D871BB5958AEF9F493B330FCB533DE6B – C:\Windows\winsxs\x86_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_it-it_9273a66a9f204dea\explorer.exe.mui

< MD5 for: EXPLORER.ICO >
[2007/07/20 12:55:08 | 000,025,214 | —- | M] () MD5=9B8226EC0C75BA9BDE995D8FBC3FDF59 – C:\Program Files\FreeCountdownTimer\explorer.ico

< MD5 for: EXPLORER.JS >
[2010/12/11 12:12:55 | 000,046,421 | —- | M] () MD5=4CE93A6778987DE5C4B2496D7F596B1E – C:\Program Files\Apache Software Foundation\Tomcat 6.0\webapps\opencms\resources\commons\explorer.js
[2010/12/11 12:21:20 | 000,046,421 | —- | M] () MD5=4CE93A6778987DE5C4B2496D7F596B1E – C:\Program Files\Apache Software Foundation\Tomcat 6.0\webapps\ROOT\resources\commons\explorer.js

< MD5 for: EXPLORER.PNG >
[2010/12/11 12:05:35 | 000,000,273 | —- | M] () MD5=A4DFC62730048C24F20D4C1B8A808B0A – C:\Program Files\Apache Software Foundation\Tomcat 6.0\webapps\opencms\resources\list\explorer.png
[2010/12/11 12:20:17 | 000,000,273 | —- | M] () MD5=A4DFC62730048C24F20D4C1B8A808B0A – C:\Program Files\Apache Software Foundation\Tomcat 6.0\webapps\ROOT\resources\list\explorer.png

< MD5 for: EXPLORER.RESX >
[2007/12/31 03:19:38 | 000,040,049 | —- | M] () MD5=B16D2C77324DE7222CB0EA55C7B32784 – C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\ItemTemplatesCache\VisualBasic\Windows Forms\1040\Explorer.zip\explorer.resx

< MD5 for: EXPLORER.VB >
[2007/12/31 03:19:38 | 000,009,118 | —- | M] () MD5=520A5CAF9B1C02D5D83F7240E53032AB – C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\ItemTemplatesCache\VisualBasic\Windows Forms\1040\Explorer.zip\explorer.vb

< MD5 for: EXPLORER.VSTEMPLATE >
[2007/12/31 03:19:38 | 000,006,618 | —- | M] () MD5=ED8224C07431AE870DE48F1F34A06505 – C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\ItemTemplatesCache\VisualBasic\Windows Forms\1040\Explorer.zip\explorer.vstemplate

< MD5 for: EXPLORER.ZIP >
[2007/12/31 03:19:40 | 000,024,652 | —- | M] () MD5=4AC037C964E6B55E012384E1C4886DEF – C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\ItemTemplates\VisualBasic\Windows Forms\1040\Explorer.zip

< MD5 for: IEXPLORE.EXE >
[2012/04/04 15:56:38 | 000,199,240 | —- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\iexplore.exe
[2010/09/08 06:36:39 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=14803EA3E5DD7CB37CB446C74CFDA38F – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20795_none_b3c5cc459f4108f2\iexplore.exe
[2009/07/14 03:17:29 | 000,673,048 | —- | M] (Microsoft Corporation) MD5=2C32E3E596CFE660353753EABEFB0540 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16385_none_b346f9b4861b55c2\iexplore.exe
[2011/08/20 06:35:15 | 000,673,024 | —- | M] (Microsoft Corporation) MD5=41FE5E37EFE0B587A688BA0E4FA41288 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16869_none_b360a432860774ff\iexplore.exe
[2010/11/04 07:54:54 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=58CF468D3FF4CF830339FE5E45356355 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16700_none_b3987f3a85deec23\iexplore.exe
[2011/04/22 21:29:16 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=64EFAF916C4009F1B84153D0BB491FB0 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16800_none_b398812085dee94a\iexplore.exe
[2010/11/04 07:54:59 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=6B2258FF6D2332073FE9E90122FA4168 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20831_none_b402ac8b9f13f917\iexplore.exe
[2011/06/21 07:25:30 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=6BB506124872ACDFAC5BD912CA1334CE – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20992_none_b3c2cf339f43b73b\iexplore.exe
[2011/11/18 21:05:16 | 000,748,336 | —- | M] (Microsoft Corporation) MD5=904E13BA41AF2E353A32CF351CA53639 – C:\Program Files\Internet Explorer\iexplore.exe
[2011/11/18 21:05:16 | 000,748,336 | —- | M] (Microsoft Corporation) MD5=904E13BA41AF2E353A32CF351CA53639 – C:\Windows\ERDNT\cache\iexplore.exe
[2011/11/18 21:05:16 | 000,748,336 | —- | M] (Microsoft Corporation) MD5=904E13BA41AF2E353A32CF351CA53639 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16421_none_b135ff17c80c1949\iexplore.exe
[2010/12/18 07:32:25 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=9321CF0D023528C71E3645F8433C86C8 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20861_none_b3e23cc79f2c4cea\iexplore.exe
[2010/12/18 07:33:54 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=AA08B68EF4E35EFA170CF85A44B23B70 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16722_none_b384dff685ed56b3\iexplore.exe
[2011/02/24 07:45:11 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=AB2BB40A5FE49AD236791AC22BD08869 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20908_none_b42a203b9ef553cc\iexplore.exe
[2010/11/20 14:22:51 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=C613E69C3B191BB02C7A191741A1D024 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7601.17514_none_b5780d7c8309d95c\iexplore.exe
[2011/02/24 07:32:52 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=C6697A46554E36541E81182B258A19D6 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16766_none_b35da16e860a2bd3\iexplore.exe
[2011/04/22 21:11:29 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=F94877A94996B3C12BB31AD722840457 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20949_none_b3ffe0d59f14dce7\iexplore.exe
[2011/08/20 06:32:44 | 000,673,024 | —- | M] (Microsoft Corporation) MD5=FA623BE79902A7B49FF4F21117B63C83 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.21033_none_b40487279f125c2e\iexplore.exe
[2010/09/08 06:31:24 | 000,673,040 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16671_none_b34dce2a8616cbea\iexplore.exe
[2011/06/21 07:37:00 | 000,673,040 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16839_none_b38113f685ef212c\iexplore.exe

< MD5 for: IEXPLORE.EXE.CFG >
[2009/08/22 20:25:00 | 000,000,029 | —- | M] () MD5=14C57B5BD3C8168436AAC8858DCF0FCE – C:\Program Files\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\Tools\D3DOverrider\ProfileTemplates\IExplore.exe.cfg
[2009/08/22 20:25:00 | 000,000,029 | —- | M] () MD5=14C57B5BD3C8168436AAC8858DCF0FCE – C:\Program Files\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\Tools\RTSS\ProfileTemplates\IExplore.exe.cfg

< MD5 for: IEXPLORE.EXE.MUI >
[2009/07/14 10:20:49 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=25762CE531381E3240DF74F039B5744F – C:\Windows\winsxs\x86_microsoft-windows-i..-optional.resources_31bf3856ad364e35_8.0.7601.17514_it-it_3bcf6c1d84e207c8\iexplore.exe.mui
[2011/11/18 21:05:37 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=4C71CCB3C8817185E67210856778831F – C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
[2011/11/18 21:05:37 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=4C71CCB3C8817185E67210856778831F – C:\Windows\winsxs\x86_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_en-us_aae2948effb95a30\iexplore.exe.mui
[2011/11/18 21:06:38 | 000,006,144 | —- | M] (Microsoft Corporation) MD5=6C29D19B759CD0F65AB91C658D5173CA – C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui
[2011/11/18 21:06:38 | 000,006,144 | —- | M] (Microsoft Corporation) MD5=6C29D19B759CD0F65AB91C658D5173CA – C:\Windows\winsxs\x86_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_it-it_378d5db8c9e447b5\iexplore.exe.mui
[2009/07/14 10:20:49 | 000,005,632 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\winsxs\x86_microsoft-windows-i..-optional.resources_31bf3856ad364e35_8.0.7600.16385_it-it_399e585587f3842e\iexplore.exe.mui

< MD5 for: IEXPLORE.EXE-908C99F8.PF >
[2012/06/06 00:09:56 | 000,317,508 | —- | M] () MD5=09DD5ED832F0CB6A6616E95C4AFAF86F – C:\Windows\Prefetch\IEXPLORE.EXE-908C99F8.pf

< MD5 for: WINLOGON.ADML >
[2009/07/14 10:20:45 | 000,009,430 | —- | M] () MD5=7A3DF5FA7925B53A60E9B3A0764A296B – C:\Windows\PolicyDefinitions\it-IT\WinLogon.adml
[2009/07/14 10:20:45 | 000,009,430 | —- | M] () MD5=7A3DF5FA7925B53A60E9B3A0764A296B – C:\Windows\winsxs\x86_microsoft-windows-winlogon-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_218530d508607cbf\WinLogon.adml

< MD5 for: WINLOGON.ADMX >
[2009/06/10 23:43:18 | 000,005,237 | —- | M] () MD5=89D8F50E186A16C2CED3CF36DBBC0B2C – C:\Windows\PolicyDefinitions\WinLogon.admx
[2009/06/10 23:43:18 | 000,005,237 | —- | M] () MD5=89D8F50E186A16C2CED3CF36DBBC0B2C – C:\Windows\winsxs\x86_microsoft-windows-winlogon-adm_31bf3856ad364e35_6.1.7600.16385_none_7ae3b2e5da95d117\WinLogon.admx

< MD5 for: WINLOGON.EXE >
[2012/04/04 15:56:38 | 000,199,240 | —- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009/10/28 08:17:59 | 000,285,696 | —- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009/10/28 07:52:08 | 000,285,696 | —- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2010/11/20 14:17:54 | 000,286,720 | —- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 – C:\Windows\ERDNT\cache\winlogon.exe
[2010/11/20 14:17:54 | 000,286,720 | —- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 – C:\Windows\System32\winlogon.exe
[2010/11/20 14:17:54 | 000,286,720 | —- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2009/07/14 03:14:45 | 000,285,696 | —- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe

< MD5 for: WINLOGON.EXE.MUI >
[2009/07/14 10:20:20 | 000,024,064 | —- | M] (Microsoft Corporation) MD5=10F25BD9440B0451952225BCAAB284E2 – C:\Windows\winsxs\x86_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.1.7600.16385_it-it_5779b0d82f94f530\winlogon.exe.mui
[2010/11/20 14:44:35 | 000,024,576 | —- | M] (Microsoft Corporation) MD5=7BD9167BB877D31F841EC130A6137E76 – C:\Windows\System32\it-IT\winlogon.exe.mui
[2010/11/20 14:44:35 | 000,024,576 | —- | M] (Microsoft Corporation) MD5=7BD9167BB877D31F841EC130A6137E76 – C:\Windows\winsxs\x86_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.1.7601.17514_it-it_59aac4a02c8378ca\winlogon.exe.mui

< MD5 for: WINLOGON.MFL >
[2009/07/14 10:20:21 | 000,001,080 | —- | M] () MD5=B5CE50ECD88A87597DE1E8DE71AC2ADF – C:\Windows\System32\wbem\it-IT\winlogon.mfl
[2009/07/14 10:20:21 | 000,001,080 | —- | M] () MD5=B5CE50ECD88A87597DE1E8DE71AC2ADF – C:\Windows\winsxs\x86_microsoft-windows-winlogon-mof.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b53c02a34acd4ec5\winlogon.mfl

< MD5 for: WINLOGON.MOF >
[2009/07/13 22:37:34 | 000,003,192 | —- | M] () MD5=DF722B96F32A61783BC310FACF10240B – C:\Windows\System32\wbem\winlogon.mof
[2009/07/13 22:37:34 | 000,003,192 | —- | M] () MD5=DF722B96F32A61783BC310FACF10240B – C:\Windows\winsxs\x86_microsoft-windows-winlogon-mof_31bf3856ad364e35_6.1.7600.16385_none_800f1ff3d73b72d9\winlogon.mof

< End of report >
Post #24
Extras.txt Log:

OTL Extras logfile created on: 06/06/2012 21:21:07 - Run 1
OTL by OldTimer - Version 3.2.46.1 Folder = C:\Users\Gnorro\Desktop
Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000410 | Country: Italia | Language: ITA | Date Format: dd/MM/yyyy

2,99 Gb Total Physical Memory | 1,59 Gb Available Physical Memory | 53,10% Memory free
5,98 Gb Paging File | 3,60 Gb Available in Paging File | 60,21% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 246,06 Gb Total Space | 174,08 Gb Free Space | 70,75% Space Free | Partition Type: NTFS
Drive D: | 19,88 Gb Total Space | 9,16 Gb Free Space | 46,06% Space Free | Partition Type: NTFS
Drive E: | 199,72 Gb Total Space | 127,71 Gb Free Space | 63,95% Space Free | Partition Type: NTFS
Drive F: | 465,76 Gb Total Space | 225,26 Gb Free Space | 48,36% Space Free | Partition Type: NTFS

Computer Name: GNORRO-PC | User Name: Gnorro | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
jsfile – "C:\Program Files\Macromedia\Dreamweaver 8\dreamweaver.exe" "%1" (Macromedia, Inc.)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [Browse with &IrfanView] – "C:\Program Files\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [MediaMonkey.1Play] – "C:\Program Files\MediaMonkey\MediaMonkey.exe" "%1" (Ventis Media Inc.)
Directory [MediaMonkey.2PlayNext] – "C:\Program Files\MediaMonkey\MediaMonkey.exe" /NEXT "%1" (Ventis Media Inc.)
Directory [MediaMonkey.3Enqueue] – "C:\Program Files\MediaMonkey\MediaMonkey.exe" /ADD "%1" (Ventis Media Inc.)
Directory [OpenAsAWebSite] – C:\Program Files\Microsoft WebMatrix\WebMatrix.exe #ExecuteCommand# SiteFromFolder %L (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Directory [TVersity] – "C:\ProgramData\TVersity\Media Server\GUILaunch.exe" -type "folder" -url "%1" -title "" -tags "" ()
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
"" =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0294BB2F-6178-459D-8C46-8D1C40D6AD6B}" = rport=445 | protocol=6 | dir=out | app=system |
"{057550CC-1C7E-4C7B-A2F8-3A8DDC978C8C}" = lport=138 | protocol=17 | dir=in | app=system |
"{08E024BB-596A-4DFF-A430-159062EB67CE}" = lport=10243 | protocol=6 | dir=in | app=system |
"{19A5737B-0BEE-43C8-BCD3-3CC714AA4FD3}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{2395C027-BA51-47C0-825E-E7FB151D5C00}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{25B9D31D-64EC-44F5-900B-17177C3E5D3C}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{295EF879-34FC-4A05-A484-51AA1443280E}" = lport=445 | protocol=6 | dir=in | app=system |
"{2FA65B31-3A9D-4C20-AFC6-469495F0EF44}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{4084E937-EAAA-47EE-9520-7BE7CE434C09}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{4A0ED3E1-80F3-4EA8-AAC2-D83C26F665DA}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{4BF5EB07-06A2-40E2-B5B6-244EF5C49A0F}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{5456EA1E-AF45-48BD-9C96-AB99A6CCF1D9}" = lport=139 | protocol=6 | dir=in | app=system |
"{5B1F0042-D0B5-47D4-8B19-BC306176F59A}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{5DDD2B7A-97B0-46CF-BCD6-AA5C552BC809}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{62579D06-FA6F-472C-B49F-7DB6AB3FCD44}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{6364B77A-8796-4078-B3CC-5963A3E70B4F}" = rport=139 | protocol=6 | dir=out | app=system |
"{68140C73-3365-4E68-BA86-A4E23E92B7F0}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{6EFD3216-D4DB-448C-81DA-E8838C66FFD2}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{7A7BAAD3-3B7E-49F6-ADAE-27EC13D94315}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{7C7BD74E-D59D-40F9-8481-A74C4729E9DD}" = rport=138 | protocol=17 | dir=out | app=system |
"{86444BB3-291D-4D31-A046-BB4AA3243C28}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{8A6B8F1B-EB95-4DBC-9161-CB51969E4700}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{A9C77A19-76DE-4254-93F5-AD5E4836D0AD}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{AF8150A9-8B4A-4262-900E-D368942052B3}" = lport=2869 | protocol=6 | dir=in | app=system |
"{BE10AB93-C4A6-464B-BE93-069E778BFF99}" = rport=10243 | protocol=6 | dir=out | app=system |
"{C232D951-55E7-4D04-9346-F88A07FC0B22}" = lport=137 | protocol=17 | dir=in | app=system |
"{C428A183-FD79-40B5-990D-895328F43AC8}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{CE850164-3939-46B6-81E6-6AF24F7168BB}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{CF0676E6-E2EC-438A-9741-7029DEBD00CE}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F534D21D-02A4-4E48-A237-A3745ED5E6D3}" = rport=137 | protocol=17 | dir=out | app=system |
"{F9C1EEE5-72B7-40C6-BC7C-64E9DF7DEB39}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{003C7A18-60D9-4C89-94D8-DE42C1AA1D76}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{02A4D600-582A-4C14-ADFE-C125CF0CB18F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{1473D86F-6F04-46A3-9153-CD04272511DC}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{4849799C-D8E9-4360-8F9A-6B5F2BCC7EA4}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{56E808A1-BFD0-4B79-B567-B9FA848D697F}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{61FB8AD2-C831-45AB-9DFB-D685C3A8300D}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{62F27534-2769-4D2F-B42F-E96E62F64F44}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{65901CFC-D156-4C8F-90EA-C26D256CA195}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{68F6992D-6E9D-4F14-88EC-3E0B8BEC7EFF}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{8642AF85-31DC-4BB3-8E9D-1E478C224084}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{A5589677-56C4-46C1-A86B-1F0B5425786F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{AB3FBA72-52C3-4476-9A38-230DBE05659B}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{BC7833D1-AE4B-4CAB-BDD5-6EA587E5C763}" = protocol=6 | dir=out | app=system |
"{C1DE39F9-4714-4EF5-8FFB-DB1BD39FA7FB}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{CE504808-152F-4073-8BB9-0F8E7C4D30C6}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{D3648D1D-2BA3-4973-9B7E-EDC907B6E342}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{E8715BB0-E132-4617-B344-62E03BFE2C1C}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{E926E57D-011D-4F63-BCC5-FFCFDC28D091}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{EFA98652-B437-42AA-B7D3-EFFD71ED4ECD}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F7DCF881-DB9D-4779-8D1C-CCCBAC7C73FF}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"TCP Query User{0B569918-D866-493A-B5D8-FCEA71C0833B}C:\program files\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files\skype\phone\skype.exe |
"TCP Query User{1AABAC12-15B5-47D3-81CC-82663384752E}C:\program files\emule adunanza\emule_adnza.exe" = protocol=6 | dir=in | app=c:\program files\emule adunanza\emule_adnza.exe |
"TCP Query User{8CEB48C1-E8A5-4510-9D47-20BD1740438B}C:\users\gnorro\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\gnorro\appdata\roaming\dropbox\bin\dropbox.exe |
"TCP Query User{B182FAD4-70B2-4497-94B1-21E1A49A67D8}E:\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe" = protocol=6 | dir=in | app=e:\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe |
"UDP Query User{062C1583-38F2-423B-802F-E0494A9C62A9}E:\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe" = protocol=17 | dir=in | app=e:\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe |
"UDP Query User{362F4AB8-5886-4A9D-AFBC-A13B33293CB7}C:\program files\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe |
"UDP Query User{53C48928-C86C-4E0C-BE23-2D84308378A0}C:\users\gnorro\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\gnorro\appdata\roaming\dropbox\bin\dropbox.exe |
"UDP Query User{5CF644DA-87C2-4A57-8B37-2206C0E80A39}C:\program files\emule adunanza\emule_adnza.exe" = protocol=17 | dir=in | app=c:\program files\emule adunanza\emule_adnza.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{01C79EF3-DE84-4B56-B638-8BEA0D507506}" = Microsoft XNA Game Studio 4.0 (XnaLiveProxy)
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{0666E46E-A860-4353-BE6D-13AA72FABB57}" = Microsoft XNA Game Studio Platform Tools
"{068857D8-FDD1-4F29-8F74-E9DE91E8A587}" = Crystal Reports 2008 SP3
"{07EEE598-5F21-4B57-B40B-46592625B3D9}" = Zune Language Pack (PTB)
"{07FB17D8-7DB6-4F06-80C4-8BE1719CB6A1}" = hpWLPGInstaller
"{08C84CC6-E7FD-4B2D-BBF9-B02CC90EE031}" = Microsoft XNA Game Studio 4.0 (Shared Components)
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0B500125-92A7-40BF-ACF0-45A9221ADE21}_is1" = PowerOffer 2.0
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0D6D309A-DADD-449E-B61E-3238129FBD50}" = Microsoft Expression Blend SDK for .NET 4
"{0D97F8D1-2102-53D2-5633-C992D6086801}" = CCC Help Chinese Traditional
"{0EA00EA7-42C0-ED9C-9110-2C04B8EDBA66}" = CCC Help Italian
"{0EB86B70-91FF-39BF-633C-785DF2218CC6}" = CCC Help French
"{0F367CA3-3B2F-43F9-A44A-25A8EE69E45D}" = Scan
"{0F37D969-1260-419E-B308-EF7D29ABDE20}" = Web Deployment Tool
"{0FFAC7BB-50DC-CB54-6CA7-A8B74513280B}" = CCC Help Chinese Traditional
"{134EE273-0F1C-4A5B-817D-13111DB75B14}" = B109n-z
"{1686C07D-C2BB-A8B2-C5ED-32C4EE1A3E62}" = CCC Help Spanish
"{175F0111-2968-4935-8F70-33108C6A4DE3}" = MarketResearch
"{1803A630-3C38-4D2B-9B9A-0CB37243539C}" = Microsoft ASP.NET MVC 2
"{185292F7-7C0A-4F72-B2CC-CBEBD40B050E}" = Microsoft SQL Server 2008 R2 Native Client
"{18B6A9F8-25BC-5978-6B42-A50FA2CABC18}" = CCC Help English
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{1C802083-6D79-78ED-BF1C-601DDF908DD1}" = Catalyst Control Center Core Implementation
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F3979D0-503A-4C4F-BB53-BBA42108AE6D}" = Passware Kit Agent 11.1
"{1FF8DF65-DFA4-4463-AA7C-0A114C3F6006}" = Microsoft XNA Game Studio 4.0 Language Pack (it-IT)
"{2012098D-EEE9-4769-8DD3-B038050854D4}" = Microsoft Silverlight 3 SDK
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Strumento di caricamento di Windows Live
"{21A2F5EE-1DC5-488A-BE7E-E526F8C61488}" = DeviceDiscovery
"{226b64e8-dc75-4eea-a6c8-abcb496320f2}-Google Talk" = Google Talk (remove only)
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2300EE96-0A41-4FAB-BD03-989EC44577A0}" = Acronis Disk Director Suite
"{246D27BE-94F5-4838-B1F9-6DD3E379E488}" = Microsoft SQL Server 2008 Database Engine Services
"{262D6036-7ECB-4D8E-938C-6BB24D1F04DA}" = Installazione di Microsoft SQL Server 2008 R2 (Italiano)
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java™ 6 Update 24
"{26A24AE4-039D-4CA4-87B4-2F83217000FF}" = Java™ 7
"{27B6D024-FD7E-4A88-BC17-5AFBE33EC072}" = Microsoft F# Runtime for Silverlight 4
"{282C4EAA-F162-F52F-7BAF-C7B50DAAA00A}" = ccc-utility
"{28728178-FF15-218B-0B63-012692F42C28}" = CCC Help Danish
"{2934DCB0-F8EE-11E0-A4A5-B8AC6F97B88E}" = Google Earth Plug-in
"{298C6691-46B2-2065-0DD7-1E7B3B669A47}" = CCC Help Finnish
"{2A9DFFD8-4E09-4B91-B957-454805B0D7C4}" = Zune Language Pack (CHS)
"{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}" = Microsoft XNA Framework Redistributable 4.0
"{2ECA81CA-D932-4AD3-AD59-BF5CCF099C83}" = Catalyst Control Center - Branding
"{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm
"{300A2961-B2B5-4889-9CB9-5C2A570D08AD}" = Debugging Tools for Windows (x86)
"{310BC5E2-31AF-49BB-904D-E71EB93645DC}" = AI Suite
"{3136905A-611F-492B-AB3D-FC51B46B0752}" = Windows Mobile 5.0 SDK R2 for Smartphone
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{32714140-CBC5-3FAF-BFC2-3A7376C3EECF}" = Microsoft .NET Framework 4 Client Profile ITA Language Pack
"{32851025-1E46-83A3-1320-471619254E39}" = Catalyst Control Center Localization All
"{32A3A4F4-B792-11D6-A78A-00B0D0160210}" = Java™ SE Development Kit 6 Update 21
"{32A3A4F4-B792-11D6-A78A-00B0D0160220}" = Java™ SE Development Kit 6 Update 22
"{32A3A4F4-B792-11D6-A78A-00B0D0170000}" = Java™ SE Development Kit 7
"{32B8F4FE-80E3-47CD-BB8D-2DACD43E74A2}" = Macromedia Dreamweaver 8
"{336D0C35-8A85-403a-B9D2-65C292C39087}_is1" = Web Assistant 2.0.0.439
"{33AE9E89-47C9-4A0D-9E9D-BDD6966A3804}" = Microsoft SQL Server 2008 RsFx Driver
"{3589A659-F732-4E65-A89A-5438C332E59D}" = Zune Language Pack (ELL)
"{388E4B09-3E71-4649-8921-F44A3A2954A7}" = Microsoft Visual Studio 2005 Tools for Office Runtime
"{39AE27EE-A148-48A3-B98D-35498C4D9719}" = Windows Live Messenger
"{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}" = JMicron JMB36X Driver
"{3A698498-6C55-8C4D-DCF4-840930FF990F}" = AMD Drag and Drop Transcoding
"{3B6E3FC6-274C-4B6C-BC85-5C3B15DE18E2}" = Mega Manager
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3F4EB5FE-B5BE-4069-A5A8-6D9262E1B379}" = Microsoft XNA Game Studio 4.0 Documentation
"{3FEA6CD1-EA13-4CE7-A74E-A74A4A0A7B5C}" = FIFA 11
"{400C5445-1AE8-1A41-CAC6-AB114341F65D}" = CCC Help Swedish
"{40217B2F-462B-94A4-E84E-6A1C6EDBCE2F}" = CCC Help Swedish
"{404245D0-E836-4737-9C12-D4D0034540F5}_is1" = Free Countdown Timer 2.5.0
"{415030B8-3E8B-462A-8C03-41D95AA3AB3B}" = Medal of Honor ™
"{4344E211-F621-3870-9A08-2F56C71BA0A7}" = Microsoft .NET Framework 4 Extended ITA Language Pack
"{43CDF946-F5D9-4292-B006-BA0D92013021}" = WebReg
"{448B1C6D-02C2-7681-66B2-624E58B25375}" = CCC Help Turkish
"{45C8D17D-B5E0-4e93-8370-4329AB16D2A0}" = Battlefield 3™ Open Beta
"{46EB9D45-FC1A-2635-1693-176E6FA1C672}" = CCC Help Portuguese
"{48667EB3-6A7F-47B1-9C97-AFEDB4FD6B8D}" = Microsoft SQL Server 2008 Database Engine Shared
"{48EA2B54-7121-42D9-A2DD-187C27E0CCB8}" = Microsoft .NET Compact Framework 2.0 SP2
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A6F34E2-09E5-4616-B227-4A26A488A6F9}" = Microsoft SQL Server 2008 Common Files
"{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}" = SolutionCenter
"{4B9465AB-53D6-3C2A-82A6-901FE8D91F92}" = Microsoft Help Viewer 1.1 Language Pack - ITA
"{4D81B0E7-2F76-472A-9A8C-5240A3404BC3}" = IIS 7.5 Express
"{512EB920-9A91-31F0-9511-41A3F5D62DA3}" = Visual Studio Tools for the Office system 3.0 Runtime Language Pack - ITA
"{5134B35A-B559-4762-94A4-FD4918977953}" = Microsoft Web Deploy 2.0
"{51C839E1-2BE4-4E77-A1BA-CCEA5DAFA741}" = Zune Language Pack (KOR)
"{52310F97-0A4B-429C-BE51-1D7F8F79ECC5}" = Microsoft Expression Blend SDK for Windows Phone 7
"{5343A801-92E5-C234-9F27-AB27EC738BF6}" = CCC Help Japanese
"{558358E5-E4F3-4374-BA1D-26FF39EF87D9}" = Microsoft Silverlight Tools for Visual Studio 2010
"{56B83336-FBC1-4C46-8613-90A9E3B440D6}" = EPU-6 Engine
"{56DE6C23-9823-4FEB-B8E8-DA051BBFC142}" = Microsoft Expression Blend 4
"{57BB52B7-6B7B-31F3-89F4-4EE8FE5CEF6D}" = Microsoft Help Viewer 1.1
"{57C51D56-B287-4C11-9192-EC3C46EF76A4}" = Zune Language Pack (RUS)
"{5AB7D739-1735-3A9E-BE73-C43507CB4E6F}" = Microsoft Visual Studio 2010 Service Pack 1
"{5BDFAB82-060E-438B-AB4F-A2331B2294C0}" = Microsoft ASP.NET MVC 2 - VWD Express 2010 Tools
"{5C93E291-A1CC-4E51-85C6-E194209FCDB4}" = Zune Language Pack (PTG)
"{5D22226D-EBC1-C95F-7746-2E3A9F4C97BA}" = CCC Help Russian
"{5D9ED403-94DE-3BA0-B1D6-71F4BDA412E6}" = Microsoft Visual C++ 2010 x86 Runtime - 10.0.40219
"{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
"{5DB161C0-7C9C-41D7-8DA1-CB112F60946B}" = Microsoft Visual Studio 2005 Tools for Office Runtime Language Pack
"{5DDF31D2-63BB-4268-895B-FB05A82A1C00}" = Microsoft XNA Game Studio 4.0 Windows Phone Extensions
"{5DEFD397-4012-46C3-B6DA-E8013E660772}" = Zune Language Pack (NOR)
"{5E952987-3307-4D11-8E95-CBABEACBA60E}" = Microsoft SQL Server Compact 3.5 ITA
"{5EE6E987-1B79-4A93-832B-27472C7D1579}" = WPF Toolkit February 2010 (Version 3.5.50211.1)
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5FD88490-011C-4DF1-B886-F298D955171B}" = MySQL Connector Net 6.3.7
"{600C37F2-098B-A165-C1DB-6AE2B89D8D49}" = Catalyst Control Center Graphics Previews Common
"{607169F0-07F6-4797-99D2-D5E7C4715E20}" = Mega Manager
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{61F8CA2C-9A80-8A1B-D3B9-347530CB387F}" = CCC Help Norwegian
"{631471BE-DEAB-454B-A9AC-CE3EB42C28B3}" = Microsoft ASP.NET Web Pages
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{6379FD0A-8964-4A50-80A6-B20B65117905}" = File di supporto dell'installazione di Microsoft SQL Server (Italiano)
"{63FF21C9-A810-464F-B60A-3111747B1A6D}" = GPBaseService2
"{64476BE0-75FA-4E08-97F4-9B3E9EB443FB}" = Microsoft Expression Blend 3 SDK
"{64c5b887-b5ee-42b8-8596-78905a6b5f1f}" = Microsoft Windows SDK for Visual Studio 2008 SDK Reference Assemblies and IntelliSense
"{651F43AA-3F06-9277-6F1B-8E8155017463}" = CCC Help Polish
"{656FDFA4-C7C6-40D9-99F7-F6F331412AEF}" = WarrantyExtension
"{65C06675-250E-3307-8DAF-A1D6255D34F5}" = Microsoft Visual Studio 2008 Professional Edition - ITA
"{6740BCB0-5863-47F4-80F4-44F394DE4FE2}" = Zune Language Pack (NLD)
"{674B407D-EAB1-B6B6-F9BF-C34CEE4CD83F}" = Catalyst Control Center Graphics Light
"{6753B40C-0FBD-3BED-8A9D-0ACAC2DCD85D}" = Microsoft Document Explorer 2008
"{68A10D12-0D0F-4212-BDE6-D87FAD32A8FA}" = SmartWebPrinting
"{68BD57D3-D606-411E-A7E0-3EB6EA5660F6}" = Microsoft XNA Game Studio 4.0 (Redists)
"{68DE32E1-292B-6A02-6A53-935BFAE70C99}" = CCC Help Chinese Standard
"{69F411C5-4851-6DA9-EA4C-160BEF8788AA}" = CCC Help French
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6B2FFB21-AC88-45C3-9A7D-4BB3E744EC91}" = HPSSupply
"{6B33492E-FBBC-4EC3-8738-09E16E395A10}" = Zune Language Pack (ESP)
"{6BBA26E9-AB03-4FE7-831A-3535584CA002}" = Toolbox
"{6D92C207-2687-459D-9617-2F517567F077}" = Microsoft Expression Blend SDK for Silverlight 4
"{6DD27E54-2598-0FEC-7CE1-BE00924C0570}" = Catalyst Control Center Graphics Previews Vista
"{6DF870EB-5F85-3065-A839-0477F4B825F7}" = Windows Phone 7 Add-in for Visual Studio 2010 - ITA
"{6EB931CD-A7DA-4A44-B74A-89C8EB50086F}" = Zune Language Pack (SVE)
"{6F695BCF-9BDC-48AB-8D46-D57CFAD7A248}" = Assistente per l'accesso a Windows Live
"{7059BDA7-E1DB-442C-B7A1-6144596720A4}" = HP Update
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{722B4A13-F24D-43AE-8813-5DB82C0B23C2}" = HP Photosmart Wireless B109n-z All-In-One Driver Software 13.0 Rel .6
"{7281CABA-E70B-411A-AF4B-ECB3C8778364}_is1" = Mouse Recorder [removed]
"{73BE04D9-BA0E-4BAF-9C9D-677278BDB3DC}" = Microsoft XNA Game Studio 4.0 (ARP entry)
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{76285C16-411A-488A-BCE3-C83CB933D8CF}" = Battlefield 3™
"{76BA306B-2AA0-47C0-AB6B-F313AB56C136}" = Zune Language Pack (MSL)
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77D2813F-A6E3-4B4E-A76E-45BCCCBBF27E}" = Microsoft .NET Compact Framework 3.5
"{795A20A6-E381-45BD-AF19-D45AF956933B}" = Passware Kit Enterprise 10.0
"{7C27114E-6FC8-21F5-E501-FE48F09243DF}" = CCC Help Dutch
"{7E20763E-D941-4E63-AAC2-510E870047BF}" = Strumenti Web di Microsoft SQL Server Compact 4.0 ITA
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{7F9957FC-1D14-4C73-BC29-05F2AE0D84F6}" = Microsoft Expression Blend 4 Add-in for Adobe FXG Import
"{80237C20-CBF3-F841-4AD5-E727AA86FBD1}" = CCC Help Italian
"{802EE127-D32A-1447-09DC-77419772BCDC}" = CCC Help Portuguese
"{805A39C9-7B32-434A-A3EA-8BC37F861984}" = Compatibilità con le versioni precedenti a Microsoft SQL Server 2005
"{818212BA-7F8C-DDF9-64BE-F6D0B6F46D29}" = CCC Help German
"{834EA459-FD2C-4336-9DFE-C4EDBF63D51A}" = Microsoft SQL Server 2008 Browser
"{836AFA32-7B8B-2C19-99D9-36EF32B42EB8}" = CCC Help Thai
"{83F2B8F4-5CF3-4BE9-9772-9543EAE4AC5F}" = Microsoft SQL Server 2008 R2 Management Objects
"{842FAF7C-50EF-4463-9B8F-6222E1384D7D}" = Microsoft Windows SDK for Visual Studio 2008 Headers and Libraries
"{8466940C-84D8-484C-B1E3-C2E4D73FD5DD}" = PS_AIO_06_B109n-z_SW_Min
"{84F4542C-ED64-28AC-49B3-1A9BAB395AB4}" = CCC Help Hungarian
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8136 8168 8169 Ethernet Driver
"{8960A0A1-BB5A-479E-92CF-65AB9D684B43}" = Zune Language Pack (PLK)
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74DEFD-A224-49CC-AB80-4E88BC730125}" = LogMeIn Hamachi
"{8B112338-2B08-4851-AF84-E7CAD74CEB32}" = Zune Language Pack (DAN)
"{8BEC4440-FE49-4C5B-8F47-6A0EBE0179D1}" = MySQL Server 5.1
"{8C0CAA7A-3272-4991-A808-2C7559DE3409}" = Win7codecs
"{8C496FBF-DB4A-468D-A3A1-15E127382218}" = Microsoft XNA Game Studio 4.0 (Visual Studio)
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{8FB1B528-E260-451E-9B55-E9152F94B80B}" = Microsoft Games for Windows - LIVE Redistributable
"{8FB53850-246A-3507-8ADE-0060093FFEA6}" = Visual Studio Tools for the Office system 3.0 Runtime
"{90120000-0015-0410-0000-0000000FF1CE}" = Microsoft Office Access MUI (Italian) 2007
"{90120000-0015-0410-0000-0000000FF1CE}_ENTERPRISE_{71CCE0F1-A3B4-49C9-A328-1DABE845E0C4}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0410-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Italian) 2007
"{90120000-0016-0410-0000-0000000FF1CE}_ENTERPRISE_{71CCE0F1-A3B4-49C9-A328-1DABE845E0C4}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0410-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Italian) 2007
"{90120000-0018-0410-0000-0000000FF1CE}_ENTERPRISE_{71CCE0F1-A3B4-49C9-A328-1DABE845E0C4}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0410-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Italian) 2007
"{90120000-0019-0410-0000-0000000FF1CE}_ENTERPRISE_{71CCE0F1-A3B4-49C9-A328-1DABE845E0C4}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0410-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Italian) 2007
"{90120000-001A-0410-0000-0000000FF1CE}_ENTERPRISE_{71CCE0F1-A3B4-49C9-A328-1DABE845E0C4}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0410-0000-0000000FF1CE}" = Microsoft Office Word MUI (Italian) 2007
"{90120000-001B-0410-0000-0000000FF1CE}_ENTERPRISE_{71CCE0F1-A3B4-49C9-A328-1DABE845E0C4}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-0021-0000-0000-0000000FF1CE}" = Microsoft Office Visual Web Developer 2007
"{90120000-0021-0410-0000-0000000FF1CE}" = Microsoft Office Visual Web Developer MUI (Italian) 2007
"{90120000-0021-0410-0000-0000000FF1CE}_VisualWebDeveloper_{342281AF-B7FE-4999-BE64-29F7D6249970}" = Microsoft Office SharePoint Designer 2007 Service Pack 2 (SP2)
"{90120000-002C-0410-0000-0000000FF1CE}" = Microsoft Office Proofing (Italian) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0044-0410-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (Italian) 2007
"{90120000-0044-0410-0000-0000000FF1CE}_ENTERPRISE_{71CCE0F1-A3B4-49C9-A328-1DABE845E0C4}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0410-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Italian) 2007
"{90120000-006E-0410-0000-0000000FF1CE}_ENTERPRISE_{0A75DA12-55CB-4DE5-8B6A-74D97847204E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0410-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Italian) 2007
"{90120000-00A1-0410-0000-0000000FF1CE}_ENTERPRISE_{71CCE0F1-A3B4-49C9-A328-1DABE845E0C4}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0410-0000-0000000FF1CE}" = Microsoft Office Groove MUI (Italian) 2007
"{90120000-00BA-0410-0000-0000000FF1CE}_ENTERPRISE_{71CCE0F1-A3B4-49C9-A328-1DABE845E0C4}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90140000-0016-0000-0000-0000000FF1CE}" = Microsoft Office Excel 2010
"{90140000-0016-0410-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Italian) 2010
"{90140000-001B-0000-0000-0000000FF1CE}" = Microsoft Office Word 2010
"{90140000-001B-0410-0000-0000000FF1CE}" = Microsoft Office Word MUI (Italian) 2010
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-002C-0410-0000-0000000FF1CE}" = Microsoft Office Proofing (Italian) 2010
"{90140000-006E-0410-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Italian) 2010
"{904CCF62-818D-4675-BC76-D37EB399F917}" = Centro gestione dispositivi Windows Mobile
"{90A40410-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 - Componenti Web
"{92127AF5-FDD8-4ADF-BC40-C356C9EE0B7D}" = 32 Bit HP CIO Components Installer
"{92ECE3F9-591E-4C12-8A62-B9FCE38BF646}" = Zune Language Pack (IND)
"{946942CB-D078-F33A-A3CD-27E0393507FD}" = CCC Help Turkish
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9682B99B-BB28-AD37-CA50-C1CB5BFF0FA6}" = Catalyst Control Center Graphics Full New
"{97C82B44-D408-4F14-9252-47FC1636D23E}_is1" = IZArc 3.81
"{98613C99-1399-416C-A07C-1EE1C585D872}" = SeaTools for Windows
"{99AD9D6D-A456-49EE-8360-F22EE7AA1272}" = Express Gate
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A33B83D-FFC4-44CF-BEEF-632DECEF2FCD}" = Microsoft SQL Server Database Publishing Wizard 1.2
"{9B75648B-6C30-4A0D-9DE6-0D09D20AF5A5}" = Zune
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C41195F-11B3-8EEC-6634-7183BE6CB1B1}" = CCC Help Japanese
"{9CEB017E-CC16-4C89-B9E4-AAB5A1DD12F9}" = Windows Live Essentials
"{9D8B0949-7C47-476F-9F06-F900D3B078EA}" = Kaspersky Internet Security 2010
"{9DBCF44B-77AC-81D8-0F8E-1E60D6330AC2}" = Catalyst Control Center InstallProxy
"{A02CC93A-134F-0319-1438-B1E895B52577}" = CCC Help German
"{A084FE67-413B-402E-B289-9C2057222C11}" = Microsoft SQL Server Compact 3.5 Design Tools ITA
"{A146E311-4ABF-57D5-3773-92D303458BEC}" = AMD Media Foundation Decoders
"{A18A5656-B076-4197-AA53-B2727E75888E}" = Microsoft Visual Studio 2010 Express for Windows Phone - ITA
"{A2200017-B0C5-42FA-9BCE-1E340CB90681}" = Microsoft Silverlight 3 SDK - Italiano
"{A25FF1C0-80B6-4B8B-A551-DC525697A408}" = AMD APP SDK Runtime
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A31951C5-DCD8-4DFE-A525-CFC701F54792}" = TurboV
"{A33A89D0-2F48-FD1C-A243-9073EE0592E0}" = Catalyst Control Center InstallProxy
"{A4512736-8D63-4298-9271-5329931FA46B}" = Microsoft SQL Server Management Studio Express
"{A52C48C0-5D3F-3623-88EF-697B738DFA0B}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - ITA
"{A584E2FF-8D78-4D58-B420-F87735C27846}" = Microsoft WebMatrix
"{A5A53EA8-A11E-49F0-BDF5-AE536426A31A}" = Zune Language Pack (CHT)
"{A65B501F-423D-4DA1-93D2-9FE2B77F1DFE}" = Crystal Reports 2008 Italian Language Pack SP3
"{A66FB6C7-B689-AFD5-21BA-7CAF8E44E6E6}" = Catalyst Control Center Graphics Previews Common
"{A7E1ADB8-162B-7C33-60FB-0561A17BD876}" = CCC Help Spanish
"{A8F2E50B-86E2-4D96-9BD2-9758BCC6F9B3}" = Zune Language Pack (CSY)
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A96EEF55-155C-552E-ABB1-6FDAEF5BD944}" = CCC Help Polish
"{AA82713F-7F99-39DB-B01B-E6AD101A90AA}" = Microsoft Document Explorer 2008 Language Pack - ITA
"{AA8422F1-BFFB-3215-9195-9179FE83AFE3}" = Microsoft Visual Web Developer 2010 Express - ITA
"{AB49B509-8FCA-45E6-9FB9-9E4AEEB8F148}" = System Requirements Lab CYRI
"{ACB6D28B-2D17-314C-9C6C-B597C0A3C15A}" = Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools
"{ACCEB7C3-4F3A-4C43-93CA-644951D08B0D}" = TortoiseSVN 1.6.12.20536 (32 bit)
"{ACE28263-76A4-4BF5-B6F4-8BD719595969}" = Microsoft SQL Server Database Publishing Wizard 1.4
"{ADB25FF0-AEC4-2CFB-130C-2C60D80C5934}" = CCC Help Greek
"{AE136F7F-7DC6-600F-9DF9-BFA0DF516135}" = Catalyst Control Center Localization All
"{AE8705FB-E13C-40A9-8A2D-68D6733FBFC2}" = Status
"{B04D5DA5-11DA-830C-85C6-0FF9185787E7}" = Skins
"{B201F8F2-E852-480B-831E-A2D6D5362979}" = Microsoft ASP.NET MVC 2 - VWD Express 2010 Tools - ITA
"{B2455727-ED8F-4643-8A6E-F4AB8DE3633D}" = Network
"{B268E9A1-04A9-40D0-9866-846BE2B74BA7}" = Microsoft Windows SDK for Visual Studio 2008 Win32 Tools
"{B33D8DA3-28E5-2EA8-CC16-8D8A9CED91C4}" = AMD Catalyst Install Manager
"{B3D1CFF9-C5DA-3590-894B-40821DDB67C5}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x86)
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B423108E-F1F3-4EC0-80F5-0AC7D6ED5F1E}" = Microsoft SQL Server VSS Writer
"{B4870774-5F3A-46D9-9DFE-06FB5599E26B}" = Zune Language Pack (FIN)
"{B4CF00AE-2622-7BC6-24EC-4E5A0A8C9135}" = CCC Help Czech
"{B5153233-9AEE-4CD4-9D2C-4FAAC870DBE2}" = Microsoft SQL Server 2008 Database Engine Services
"{B5E6A45E-A794-49B3-B800-7F572E930DCE}" = Microsoft ASP.NET Web Pages - ITA
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B7E38540-E355-3503-AFD7-635B2F2F76E1}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974
"{BAE1C0A8-634D-CFF1-0E0C-893092427D34}" = CCC Help Danish
"{BB603E9F-ECE8-7713-B0AC-7E0614E8C058}" = Catalyst Control Center HydraVision Full
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{BE232D60-AEA5-502F-ACBF-9AC188A82C21}" = CCC Help Finnish
"{BE236D9A-52EC-4A17-82DA-84B5EAD31E3E}" = Zune Language Pack (DEU)
"{C12120B9-905F-4C5D-B147-0FE240F9B6E9}" = Microsoft Windows Phone 7 Developer Resources(IT)
"{C15C4AB5-EF5D-5050-273C-4636E3FBE301}" = CCC Help Czech
"{C23F31BD-AA20-4C8E-AFC1-AB57EFD7DB51}" = Microsoft SQL Server Compact 3.5 for Devices ITA
"{C2DEC505-79A9-E952-32B0-31B67B83E231}" = CCC Help Korean
"{C2FB14FB-DF6B-287D-BDC3-C7BEC86F539E}" = Catalyst Control Center
"{C3113E55-7BCB-4de3-8EBF-60E6CE6B2296}_is1" = SiSoftware Sandra Lite 2011.SP3
"{C3ABE126-2BB2-4246-BFE1-6797679B3579}" = LG USB Modem driver
"{C3C640B8-95B6-40AE-A058-BE4896CD3010}" = Windows Live Call
"{C3F6F200-6D7B-4879-B9EE-700C0CE1FCDA}" = Microsoft SQL Server System CLR Types
"{C43326F5-F135-4551-8270-7F7ABA0462E1}" = HPProductAssistant
"{C5D37FFA-7483-410B-982B-91E93FD3B7DA}" = Zune Language Pack (ITA)
"{C68D33B1-0204-4EBE-BC45-A6E432B1D13A}" = Zune Language Pack (FRA)
"{C6BE19C6-B102-4038-B2A6-1C313872DBB4}" = Zune Language Pack (HUN)
"{C75CDBA2-3C86-481e-BD10-BDDA758F9DFF}" = hpPrintProjects
"{C79312BD-3E76-4474-A10C-1435D1856A4B}" = Adobe Dreamweaver CS5
"{C965F01C-76EA-4BD7-973E-46236AE312D7}" = Sql Server Customer Experience Improvement Program
"{CAA376AF-0DE8-4FCA-942E-C6AC579B94B3}" = Microsoft Windows SDK for Visual Studio 2008 Tools
"{CAE4213F-F797-439D-BD9E-79B71D115BE3}" = HPPhotoGadget
"{CC4878C0-4A6A-49CD-AAA7-DD3FCB06CC84}" = Microsoft Web Platform Installer 3.0
"{CCEFAE22-4D01-0084-D1CA-AC14AA743A97}" = CCC Help Greek
"{CE44CACC-D06C-42D7-8A4B-9BB7BAF1E685}" = Windows Mobile 5.0 SDK R2 for Pocket PC
"{CF95EF0A-A62C-3384-AC15-9E41F4FFE768}" = Microsoft Windows SDK for Visual Studio 2008 .NET Framework Tools
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty® 2
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D37B1201-827B-4D59-815F-3D083E5DDF29}" = Microsoft SQL Server 2005 Integration Services
"{D50823E7-FB5A-3783-B50B-FBBC611D3577}" = Windows Phone Emulator - ITA
"{D6196911-9EFC-4F80-85C7-0A8CB42AE5B5}" = Macromedia Extension Manager
"{D7BF3B76-EEF9-4868-9B2B-42ABF60B279A}" = Microsoft_VC80_CRT_x86
"{D8A781C9-3892-4E2E-9320-480CF896CFBB}" = Zune Language Pack (JPN)
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{D9E6001A-5DC3-4620-AF7A-80B6CD48645D}" = WCF RIA Services V1.0 SP1
"{DB3D1784-421D-9942-3AC4-D90B18615BBC}" = ccc-utility
"{DC0A5F99-FD66-433F-9D3A-05DCBA64BE42}" = TrayApp
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{DE460826-5E72-2357-154F-E376F9926008}" = CCC Help Norwegian
"{E09CD13D-7CE3-351C-1625-8DC7F21A99C0}" = ccc-core-static
"{E0BB3923-308B-4BE9-B3A3-FD5517481E48}" = Microsoft SQL Server 2005
"{E21FFD29-D231-3BD3-6941-15710E44BED4}" = CCC Help Dutch
"{E31A24A7-CF73-42B7-8FA1-26644296C9E3}" = Windows Live Mail
"{E373E0E2-20F5-90DF-B315-615EA6E52101}" = Catalyst Control Center Graphics Full Existing
"{E3E313C7-0AE2-7F44-52E8-528D4EDC74B2}" = CCC Help Thai
"{E583ED6F-BD99-4066-A420-C815BF692B69}" = Macromedia Fireworks MX 2004
"{E6192C90-2D14-45FC-AB62-CC1D3EF948C9}" = File di supporto installazione di Microsoft SQL Server 2008
"{E6DA746E-1175-88BD-2B16-1DC62018E060}" = CCC Help Chinese Standard
"{E7044E25-3038-4A76-9064-344AC038043E}" = Windows Mobile Device Center Driver Update
"{E729034E-0287-3984-83BA-131B65BABDEA}" = Microsoft Device Emulator versione 3.0 - ITA
"{E7F4CA4E-0CC1-4FB7-B625-CF3D6C799AAD}" = Microsoft SQL Server Native Client
"{EA14AFC9-F095-4E59-9CEA-53D05A5B2891}" = Microsoft Silverlight 4 SDK - Italiano
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.8
"{EE75F5DE-959D-4E1C-8731-A1B7EB91E7C9}" = Microsoft ASP.NET MVC 2 - ITA
"{EF462F41-AE1B-4C95-98B3-077562EA190F}" = Microsoft SQL Server 2008 Common Files
"{EF71A531-5B6C-4B20-8D1E-E6379C7FB6D3}" = Microsoft IntelliPoint 7.0
"{F03CB3EF-DC16-35CE-B3C1-C68EA09E5E97}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{F053BFD9-4357-6A82-6042-CF919667448F}" = CCC Help English
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F17EB02C-DA0D-EDEF-2E16-501FB700A710}" = CCC Help Hungarian
"{F2CB8C3C-9C9E-4FAB-9067-655601C5F748}" = Windows Mobile Device Updater Component
"{F3494AB6-6900-41C6-AF57-823626827ED8}" = Microsoft SQL Server 2008 Database Engine Shared
"{F5DDC0CD-F13A-83F0-5103-563A17EA306F}" = CCC Help Korean
"{F7338FA3-DAB5-49B2-900D-0AFB5760C166}" = PC Probe II
"{F9929777-7B6E-F53D-3105-1C06E5120CA1}" = CCC Help Russian
"{FA2EC15F-EAD3-4D0E-8D22-0AE11A2DBFA5}" = Microsoft SQL Server Compact 4.0 ITA
"{FEC1DF97-E716-4CD8-A55B-75C373912D35}" = Sky Go Player
"{FF29527A-44CD-3422-945E-981A13584000}" = VC Runtimes MSI
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Acoustica CD/DVD Label Maker" = Acoustica CD/DVD Label Maker
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Anti-phishing Domain Advisor" = Anti-phishing Domain Advisor
"Apache Tomcat 6.0" = Apache Tomcat 6.0 (remove only)
"Avidemux 2.5" = Avidemux 2.5 (32-bit)
"BitTorrent" = BitTorrent
"Blend_4.0.20901.0" = Microsoft Expression Blend 4
"Bulk Rename Utility_is1" = Bulk Rename Utility [removed]
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"Cities XL 2012" = Cities XL 2012
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"Cool Edit Pro 2.0" = Cool Edit Pro 2.0
"DivX Setup.divx.com" = DivX Setup
"Driver Genius Professional Edition_is1" = Driver Genius Professional Edition
"eMule AdunanzA" = AdunanzA
"ENTERPRISE" = Microsoft Office Enterprise 2007
"ESN Sonar-0.70.0" = ESN Sonar
"ESN Sonar-0.70.4" = ESN Sonar
"FileZilla Client" = FileZilla Client 3.5.3
"Foxit Reader" = Foxit Reader
"Fraps" = Fraps
"HP Imaging Device Functions" = HP Imaging Device Functions 13.0
"HP Print Projects" = HP Print Projects 1.0
"HP Smart Web Printing" = HP Smart Web Printing 4.5
"HP Solution Center & Imaging Support Tools" = HP Solution Center 13.0
"HPExtendedCapabilities" = HP Customer Participation Program 13.0
"HWiNFO32_is1" = HWiNFO32 Version 3.88
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"InstallShield_{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty® 2
"InstallWIX_{9D8B0949-7C47-476F-9F06-F900D3B078EA}" = Kaspersky Internet Security 2010
"IrfanView" = IrfanView (remove only)
"LogMeIn Hamachi" = LogMeIn Hamachi
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware versione 1.61.0.1400
"MediaMonkey_is1" = MediaMonkey 3.2
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile ITA Language Pack" = Microsoft .NET Framework 4 Client Profile - Language Pack (ITA)
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended ITA Language Pack" = Microsoft .NET Framework 4 Extended - Language Pack (ITA)
"Microsoft Document Explorer 2008" = Microsoft Document Explorer 2008
"Microsoft Document Explorer 2008 Language Pack - ITA" = Microsoft Document Explorer 2008 Language Pack - ITA
"Microsoft Help Viewer 1.1" = Microsoft Help Viewer 1.1
"Microsoft Help Viewer 1.1 Language Pack - ITA" = Microsoft Help Viewer 1.1 Language Pack - ITA
"Microsoft SQL Server 10" = Microsoft SQL Server 2008
"Microsoft SQL Server 10 Release" = Microsoft SQL Server 2008
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Microsoft Visual Studio 2005 Tools for Office Runtime" = Visual Studio 2005 Tools per Office Second Edition Runtime
"Microsoft Visual Studio 2005 Tools for Office Runtime Language Pack" = Microsoft Visual Studio 2005 Tools for Office Runtime Language Pack
"Microsoft Visual Studio 2008 Professional Edition - ITA" = Microsoft Visual Studio 2008 Professional Edition - ITA
"Microsoft Visual Studio 2010 Express for Windows Phone - ITA" = Strumenti di sviluppo per Windows Phone Microsoft - ITA
"Microsoft Visual Studio 2010 Service Pack 1" = Microsoft Visual Studio 2010 Service Pack 1
"Microsoft Visual Studio 2010 Tools for Office Runtime (x86)" = Microsoft Visual Studio 2010 Tools for Office Runtime (x86)
"Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - ITA" = Microsoft Visual Studio 2010 Tools per Office Runtime (x86) - Language Pack - ITA
"Microsoft Visual Web Developer 2010 Express - ITA" = Microsoft Visual Web Developer 2010 Express - ITA
"MiPony" = MiPony 1.5.3
"Mozilla Firefox 12.0 (x86 it)" = Mozilla Firefox 12.0 (x86 it)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Notepad++" = Notepad++
"Office14.EXCEL" = Microsoft Excel 2010
"Office14.WORD" = Microsoft Word 2010
"Open Codecs" = Xiph.Org Open Codecs 0.85.17777
"Origin" = Origin
"PunkBusterSvc" = PunkBuster Services
"RivaTuner" = RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition
"R-Studio 4.2NSIS" = R-Studio 4.2
"Shop for HP Supplies" = Shop for HP Supplies
"SpeedFan" = SpeedFan (remove only)
"SQLyog Community" = SQLyog Community 9.0 Beta1
"Steam App 10180" = Call of Duty: Modern Warfare 2
"Steam App 10190" = Call of Duty: Modern Warfare 2 - Multiplayer
"Steam App 42680" = Call of Duty: Modern Warfare 3
"Steam App 42690" = Call of Duty: Modern Warfare 3 - Multiplayer
"Steam App 42700" = Call of Duty: Black Ops
"Steam App 42710" = Call of Duty: Black Ops - Multiplayer
"Steam App 42750" = Call of Duty: Modern Warfare 3 - Dedicated Server
"Steam App 50130" = Mafia II
"TeamViewer 7" = TeamViewer 7
"Toolbar Cleaner" = Toolbar Cleaner 1.0
"TVersity Codec Pack" = TVersity Codec Pack 1.7
"TVersity Media Server" = TVersity Media Server 1.9.7
"VideoLightBox" = VideoLightBox
"VirtualCloneDrive" = VirtualCloneDrive
"Visual Studio Tools for the Office system 3.0 Runtime" = Visual Studio Tools for the Office system 3.0 Runtime
"Visual Studio Tools for the Office system 3.0 Runtime Language Pack - ITA" = Visual Studio Tools per Office System 3.0 Runtime Language Pack - ITA
"VisualWebDeveloper" = Microsoft Visual Studio Web Authoring Component
"VLC media player" = VLC media player 1.1.11
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinMerge_is1" = WinMerge 2.12.4
"WinRAR archiver" = WinRAR archiver
"XNA Game Studio 4.0" = Microsoft XNA Game Studio 4.0
"Zune" = Zune

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 06/06/2012 12:30:49 | Computer Name = Gnorro-PC | Source = MSSQLSERVER | ID = 17207
Description = FCB::RemoveAlternateStreams: Errore del sistema operativo (null) durante
la creazione o l'apertura del file 'C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\DATA\model.mdf'.
Individuare e correggere l'errore del sistema operativo, quindi riprovare.

Error - 06/06/2012 12:30:49 | Computer Name = Gnorro-PC | Source = MSSQLSERVER | ID = 17207
Description = FCB::RemoveAlternateStreams: Errore del sistema operativo (null) durante
la creazione o l'apertura del file 'C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\DATA\tempdb.mdf'.
Individuare e correggere l'errore del sistema operativo, quindi riprovare.

Error - 06/06/2012 12:30:49 | Computer Name = Gnorro-PC | Source = MSSQLSERVER | ID = 17207
Description = FCB::RemoveAlternateStreams: Errore del sistema operativo (null) durante
la creazione o l'apertura del file 'C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\DATA\tempdb.mdf'.
Individuare e correggere l'errore del sistema operativo, quindi riprovare.

Error - 06/06/2012 12:30:49 | Computer Name = Gnorro-PC | Source = MSSQLSERVER | ID = 17207
Description = FCB::RemoveAlternateStreams: Errore del sistema operativo (null) durante
la creazione o l'apertura del file 'C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\DATA\MSDBData.mdf'.
Individuare e correggere l'errore del sistema operativo, quindi riprovare.

Error - 06/06/2012 12:30:49 | Computer Name = Gnorro-PC | Source = MSSQLSERVER | ID = 17207
Description = FCB::RemoveAlternateStreams: Errore del sistema operativo (null) durante
la creazione o l'apertura del file 'C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\DATA\rhcp_opencms.mdf'.
Individuare e correggere l'errore del sistema operativo, quindi riprovare.

Error - 06/06/2012 12:30:49 | Computer Name = Gnorro-PC | Source = MSSQLSERVER | ID = 17207
Description = FCB::RemoveAlternateStreams: Errore del sistema operativo (null) durante
la creazione o l'apertura del file 'C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\DATA\opencms.mdf'.
Individuare e correggere l'errore del sistema operativo, quindi riprovare.

Error - 06/06/2012 12:30:49 | Computer Name = Gnorro-PC | Source = MSSQLSERVER | ID = 17207
Description = FCB::RemoveAlternateStreams: Errore del sistema operativo (null) durante
la creazione o l'apertura del file 'C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\MSSql19331_ultimo_backup_Data.MDF'.
Individuare e correggere l'errore del sistema operativo, quindi riprovare.

Error - 06/06/2012 12:30:49 | Computer Name = Gnorro-PC | Source = MSSQLSERVER | ID = 17207
Description = FCB::RemoveAlternateStreams: Errore del sistema operativo (null) durante
la creazione o l'apertura del file 'C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\MSSql19331_Data.MDF'.
Individuare e correggere l'errore del sistema operativo, quindi riprovare.

Error - 06/06/2012 12:31:35 | Computer Name = Gnorro-PC | Source = PowerOffer Upd Service | ID = 0
Description = Impossibile avviare il servizio. Handle non valido

Error - 06/06/2012 15:08:07 | Computer Name = Gnorro-PC | Source = System Restore | ID = 8193
Description =

[ Media Center Events ]
Error - 15/04/2011 12:35:52 | Computer Name = Gnorro-PC | Source = Microsoft-Windows-Media Center Extender | ID = 602
Description =

[ System Events ]
Error - 04/06/2012 16:04:48 | Computer Name = Gnorro-PC | Source = Service Control Manager | ID = 7003
Description = Il servizio SQL Server FullText Search (MSSQLSERVER) dipende dal servizio
NTLMSSP, che potrebbe non essere installato.

Error - 04/06/2012 16:05:45 | Computer Name = Gnorro-PC | Source = Service Control Manager | ID = 7026
Description = All'avvio non è stato possibile caricare i seguenti driver: ATITool

Error - 05/06/2012 01:35:31 | Computer Name = Gnorro-PC | Source = Service Control Manager | ID = 7003
Description = Il servizio SQL Server FullText Search (MSSQLSERVER) dipende dal servizio
NTLMSSP, che potrebbe non essere installato.

Error - 05/06/2012 01:36:15 | Computer Name = Gnorro-PC | Source = Service Control Manager | ID = 7026
Description = All'avvio non è stato possibile caricare i seguenti driver: ATITool

Error - 05/06/2012 11:21:42 | Computer Name = Gnorro-PC | Source = Service Control Manager | ID = 7003
Description = Il servizio SQL Server FullText Search (MSSQLSERVER) dipende dal servizio
NTLMSSP, che potrebbe non essere installato.

Error - 05/06/2012 11:22:33 | Computer Name = Gnorro-PC | Source = Service Control Manager | ID = 7026
Description = All'avvio non è stato possibile caricare i seguenti driver: ATITool

Error - 06/06/2012 02:15:19 | Computer Name = Gnorro-PC | Source = Service Control Manager | ID = 7003
Description = Il servizio SQL Server FullText Search (MSSQLSERVER) dipende dal servizio
NTLMSSP, che potrebbe non essere installato.

Error - 06/06/2012 02:15:50 | Computer Name = Gnorro-PC | Source = Service Control Manager | ID = 7026
Description = All'avvio non è stato possibile caricare i seguenti driver: ATITool

Error - 06/06/2012 12:30:46 | Computer Name = Gnorro-PC | Source = Service Control Manager | ID = 7003
Description = Il servizio SQL Server FullText Search (MSSQLSERVER) dipende dal servizio
NTLMSSP, che potrebbe non essere installato.

Error - 06/06/2012 12:31:34 | Computer Name = Gnorro-PC | Source = Service Control Manager | ID = 7026
Description = All'avvio non è stato possibile caricare i seguenti driver: ATITool


< End of report >


Thanks
Post #25
Hi lukem,

I noticed that when I open firefox and search something directly in the url bar (not in the search bar) it opens always a new tab with url:
http://urlseek20.vmn.net/search.php

is usually installed with programs such as Youtube downloader toolbar or PDF Creator. I don't see those on your computer. What do you know about this program Anti-phishing Domain Advisor or Toolbar Cleaner?

Next, Double click on OTL.exe
  • Under the Custom Scans/Fixes box at the bottom, paste in the following
  • Do Not copy the word CODE
  • please note the fix starts with the :
:Services

:Files
dir "C:\Users\Gnorro\AppData\Local\{9bdfedbd-95a6-3dea-2142-6b3449bc5010}\*.*" /s /c

:Commands
[emptytemp]
[createrestorepoint]

Then click the Run Fix button at the top
  • Let the program run unhindered
  • Please save the resulting log to be posted in your next reply.
  • Reboot your computer
Please post the OTL fix log.
Post #26 last edited
I've just removed toolbar cleaner. The other one should be a software against worm

This is OTL log:

All processes killed
========== SERVICES/DRIVERS ==========
========== FILES ==========
< dir "C:\Users\Gnorro\AppData\Local\{9bdfedbd-95a6-3dea-2142-6b3449bc5010}\*.*" /s /c >
Il volume nell'unit… C non ha etichetta.
Numero di serie del volume: 78A9-FDE6
Directory di C:\Users\Gnorro\AppData\Local\{9bdfedbd-95a6-3dea-2142-6b3449bc5010}\L
27/05/2012 12:09 926 00000004.@
27/05/2012 12:09 93.696 80000032.@
2 File 94.622 byte
Directory di C:\Users\Gnorro\AppData\Local\{9bdfedbd-95a6-3dea-2142-6b3449bc5010}\U
27/05/2012 12:09 2.048 00000004.@
27/05/2012 12:09 1.584 000000cb.@
27/05/2012 12:09 93.696 80000032.@
3 File 97.328 byte
Totale file elencati:
5 File 191.950 byte
0 Directory 184.771.371.008 byte disponibili
C:\Users\Gnorro\Desktop\cmd.bat deleted successfully.
C:\Users\Gnorro\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Classic .NET AppPool
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 41620 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: DefaultAppPool
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Gnorro
->Temp folder emptied: 11959130 bytes
->Temporary Internet Files folder emptied: 14606621 bytes
->Java cache emptied: 8642 bytes
->FireFox cache emptied: 833148649 bytes
->Google Chrome cache emptied: 163173405 bytes
->Flash cache emptied: 104400 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 389077 bytes
RecycleBin emptied: 907940063 bytes

Total Files Cleaned = 1.842,00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.46.1 log created on 06072012_230747

Files\Folders moved on Reboot…
File\Folder C:\Windows\temp\hsperfdata_GNORRO-PC$\4084 not found!

Registry entries deleted on Reboot…


thanks
Post #27 last edited
Hi lukem,


Are you still getting the extra tab in FireFox?

Let's see if we can get combofix to remove that folder.

Please delete the copy of combpfix you have and download a new copy from HERE .

Please follow all previous instructions regarding security programs.

Open a new Notepad session
  • Click the Start button, click run
  • in the run box type notepad
  • click ok
  • In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  • Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

File::
C:\Users\Gnorro\AppData\Local\{9bdfedbd-95a6-3dea-2142-6b3449bc5010}\L\00000004.@
C:\Users\Gnorro\AppData\Local\{9bdfedbd-95a6-3dea-2142-6b3449bc5010}\L\80000032.@
C:\Users\Gnorro\AppData\Local\{9bdfedbd-95a6-3dea-2142-6b3449bc5010}\U\00000004.@
C:\Users\Gnorro\AppData\Local\{9bdfedbd-95a6-3dea-2142-6b3449bc5010}\U\000000cb.@
C:\Users\Gnorro\AppData\Local\{9bdfedbd-95a6-3dea-2142-6b3449bc5010}\U\80000032.@

Folder::
C:\Users\Gnorro\AppData\Local\{9bdfedbd-95a6-3dea-2142-6b3449bc5010}\U
C:\Users\Gnorro\AppData\Local\{9bdfedbd-95a6-3dea-2142-6b3449bc5010}\L
C:\Users\Gnorro\AppData\Local\{9bdfedbd-95a6-3dea-2142-6b3449bc5010}

In the notepad
  • Click File, Save as…, and set the Save in to your Desktop
  • In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
  • Click save
Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]
Post #28
The extra tab (http://urlseek20.vmn.net) is present, even after running ComboFix However the folder C:\Users\Gnorro\AppData\Local\{9bdfedbd-95a6-3dea-2142-6b3449bc5010} has been removed This is ComboFix log: ComboFix 12-06-08.02 - Gnorro 09/06/2012 9:48.3.8 - x86 Microsoft Windows 7 Ultimate 6.1.7601.1.1252.39.1040.18.3062.1933 [GMT 2:00] Eseguito da: c:\users\Gnorro\Desktop\ComboFix.exe Opzioni usate :: c:\users\Gnorro\Desktop\CFScript.txt AV: Kaspersky Internet Security *Disabled/Updated* {56547CC9-C9B2-849D-8FEF-A496150D6A06} FW: Kaspersky Internet Security *Disabled* {6E6FFDEC-83DD-85C5-A4B0-0DA3EBDE2D7D} SP: Kaspersky Internet Security *Disabled/Updated* {ED359D2D-EF88-8B13-B55F-9FE46E8A20BB} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . FILE :: "c:\users\Gnorro\AppData\Local\{9bdfedbd-95a6-3dea-2142-6b3449bc5010}\L\00000004.@" "c:\users\Gnorro\AppData\Local\{9bdfedbd-95a6-3dea-2142-6b3449bc5010}\L\80000032.@" "c:\users\Gnorro\AppData\Local\{9bdfedbd-95a6-3dea-2142-6b3449bc5010}\U\00000004.@" "c:\users\Gnorro\AppData\Local\{9bdfedbd-95a6-3dea-2142-6b3449bc5010}\U\000000cb.@" "c:\users\Gnorro\AppData\Local\{9bdfedbd-95a6-3dea-2142-6b3449bc5010}\U\80000032.@" . . ((((((((((((((((((((((((((((((((((((( Altre eliminazioni ))))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\Gnorro\AppData\Local\{9bdfedbd-95a6-3dea-2142-6b3449bc5010} c:\users\Gnorro\AppData\Local\{9bdfedbd-95a6-3dea-2142-6b3449bc5010}\@ c:\users\Gnorro\AppData\Local\{9bdfedbd-95a6-3dea-2142-6b3449bc5010}\L\00000004.@ c:\users\Gnorro\AppData\Local\{9bdfedbd-95a6-3dea-2142-6b3449bc5010}\L\80000032.@ c:\users\Gnorro\AppData\Local\{9bdfedbd-95a6-3dea-2142-6b3449bc5010}\U\00000004.@ c:\users\Gnorro\AppData\Local\{9bdfedbd-95a6-3dea-2142-6b3449bc5010}\U\000000cb.@ c:\users\Gnorro\AppData\Local\{9bdfedbd-95a6-3dea-2142-6b3449bc5010}\U\80000032.@ c:\users\Gnorro\AppData\Local\Temp\61e4dc9e-b0a3-4e40-99a9-4cd9049f7d99\CliSecureRT.dll . . ((((((((((((((((((((((((( Files Creati Da 2012-05-09 al 2012-06-09 ))))))))))))))))))))))))))))))))))) . . 2012-06-09 07:55 . 2012-06-09 07:57 ——– d—–w- c:\users\Gnorro\AppData\Local\temp 2012-06-09 07:55 . 2012-06-09 07:55 ——– d—–w- c:\users\DefaultAppPool\AppData\Local\temp 2012-06-09 07:55 . 2012-06-09 07:55 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-06-09 07:55 . 2012-06-09 07:55 ——– d—–w- c:\users\Classic .NET AppPool\AppData\Local\temp 2012-06-07 21:07 . 2012-06-07 21:07 ——– d—–w- C:\_OTL 2012-06-06 20:14 . 2012-06-06 20:14 770384 —-a-w- c:\program files\Mozilla Firefox\msvcr100.dll 2012-06-06 20:14 . 2012-06-06 20:14 421200 —-a-w- c:\program files\Mozilla Firefox\msvcp100.dll 2012-06-04 19:51 . 2012-06-04 19:51 ——– d—–w- c:\users\Gnorro\AppData\Roaming\Malwarebytes 2012-06-02 07:50 . 2012-06-02 07:50 28488 —-a-w- c:\windows\system32\drivers\mbamchameleon.sys 2012-06-02 07:46 . 2012-06-02 07:46 ——– d—–w- c:\programdata\Malwarebytes 2012-06-02 07:46 . 2012-06-02 07:46 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware 2012-06-02 07:46 . 2012-04-04 13:56 22344 —-a-w- c:\windows\system32\drivers\mbam.sys 2012-05-30 11:59 . 2012-05-30 11:59 4966600 —-a-w- c:\program files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll 2012-05-27 10:02 . 2012-05-27 10:03 3888 —-a-w- c:\windows\system32\drivers\NTHANDLE.SYS 2012-05-27 10:01 . 2012-05-27 10:01 ——– d—–w- c:\program files\WhoLockMe104 2012-05-27 08:55 . 2012-05-27 08:55 ——– d—–w- c:\users\Gnorro\AppData\Local\antiphishing-vmntbcleaner1_0dn 2012-05-27 08:55 . 2012-05-27 08:55 ——– d—–w- c:\programdata\Anti-phishing Domain Advisor 2012-05-27 08:47 . 2012-05-27 09:24 ——– d—–w- c:\programdata\Spybot - Search & Destroy 2012-05-27 08:47 . 2012-05-27 08:51 ——– d—–w- c:\program files\Spybot - Search & Destroy 2012-05-27 07:46 . 2012-05-27 09:37 ——– d—–w- c:\program files\hpmonitor 2012-05-27 07:46 . 2012-05-27 07:46 447 —-a-w- C:\user.js 2012-05-27 07:46 . 2012-05-31 19:29 ——– d—–w- c:\program files\Web Assistant 2012-05-27 07:45 . 2012-05-27 08:43 ——– d—–w- c:\program files\Win 32. Trojan . Small Removal Tool 2012-05-27 07:42 . 2012-05-27 07:42 ——– d—–w- c:\programdata\PC Tools 2012-05-27 07:42 . 2012-05-27 07:42 ——– d—–w- c:\users\Gnorro\AppData\Roaming\TestApp 2012-05-26 16:04 . 2012-05-26 16:04 ——– d-sh–w- c:\windows\system32\%APPDATA% 2012-05-18 20:30 . 2012-05-19 08:00 ——– d—–w- c:\users\Gnorro\AppData\Local\ServUpdater 2012-05-18 20:30 . 2012-05-18 20:31 ——– d—–w- c:\users\Gnorro\AppData\Local\PosService 2012-05-18 20:30 . 2012-05-18 20:30 ——– d—–w- c:\users\Gnorro\AppData\Local\PowerOffer 2012-05-11 18:58 . 2012-03-30 10:23 1291632 —-a-w- c:\windows\system32\drivers\tcpip.sys 2012-05-11 18:58 . 2012-03-31 04:30 1221632 —-a-w- c:\program files\Windows Journal\NBDoc.DLL 2012-05-11 18:58 . 2012-03-31 04:29 936960 —-a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll 2012-05-11 18:58 . 2012-03-31 04:29 989184 —-a-w- c:\program files\Windows Journal\JNTFiltr.dll 2012-05-11 18:58 . 2012-03-31 04:29 969216 —-a-w- c:\program files\Windows Journal\JNWDRV.dll 2012-05-11 18:58 . 2012-03-31 04:39 3968368 —-a-w- c:\windows\system32\ntkrnlpa.exe 2012-05-11 18:58 . 2012-03-31 04:39 3913072 —-a-w- c:\windows\system32\ntoskrnl.exe 2012-05-11 18:58 . 2012-03-31 02:36 2343424 —-a-w- c:\windows\system32\win32k.sys 2012-05-11 18:58 . 2012-03-17 07:27 56176 —-a-w- c:\windows\system32\drivers\partmgr.sys 2012-05-11 18:58 . 2012-03-03 05:31 1077248 —-a-w- c:\windows\system32\DWrite.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-05-10 09:26 . 2012-03-31 22:05 419488 —-a-w- c:\windows\system32\FlashPlayerApp.exe 2012-05-10 09:26 . 2011-05-16 20:14 70304 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-05-08 16:40 . 2012-06-08 18:03 6737808 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C6709783-1202-4A8C-9B16-A45AC1F774A6}\mpengine.dll 2012-05-05 16:02 . 2012-05-05 16:02 108368 —-a-r- c:\users\Gnorro\AppData\Roaming\Microsoft\Installer\{FEC1DF97-E716-4CD8-A55B-75C373912D35}\ARPPRODUCTICON.exe 2012-06-06 20:13 . 2011-10-04 18:58 85472 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Punti Reg Caricati )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* i valori vuoti & legittimi/default non sono visualizzati. REGEDIT4 . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}] 2010-05-26 13:23 1385864 —-a-w- c:\program files\Ask.com\GenericAskToolbar.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864] . [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864] . [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal] @="{C5994560-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}] 2010-03-21 07:55 87304 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified] @="{C5994561-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}] 2010-03-21 07:55 87304 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict] @="{C5994562-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}] 2010-03-21 07:55 87304 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked] @="{C5994563-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}] 2010-03-21 07:55 87304 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly] @="{C5994564-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}] 2010-03-21 07:55 87304 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted] @="{C5994565-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}] 2010-03-21 07:55 87304 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded] @="{C5994566-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}] 2010-03-21 07:55 87304 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored] @="{C5994567-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}] 2010-03-21 07:55 87304 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned] @="{C5994568-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}] 2010-03-21 07:55 87304 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2011-12-05 19:17 94208 —-a-w- c:\users\Gnorro\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2011-12-05 19:17 94208 —-a-w- c:\users\Gnorro\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2011-12-05 19:17 94208 —-a-w- c:\users\Gnorro\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2011-12-05 19:17 94208 —-a-w- c:\users\Gnorro\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "KiesPDLR"="c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2012-03-31 21416] "KiesHelper"="c:\program files\Samsung\Kies\KiesHelper.exe" [2012-02-22 943504] "PCShowServer"="c:\users\Gnorro\AppData\Local\Sky Italia\Sky Go Player\PCShowServerPMWrapper.exe" [2012-04-17 525680] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520] "TurboV"="c:\program files\ASUS\TurboV\TurboV.exe" [2009-05-25 5391872] "JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2009-06-30 36864] "Ai Nap"="c:\program files\ASUS\AI Suite\AiNap\AiNap.exe" [2010-03-10 1439360] "QFan Help"="c:\program files\ASUS\AI Suite\QFan3\QFanHelp.exe" [2010-01-13 611968] "Cpu Level Up help"="c:\program files\ASUS\AI Suite\CpuLevelUpHelp.exe" [2009-12-28 887936] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-12-05 343168] "AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-01-24 500208] "AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992] "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2009-05-26 1468296] "PosService"="c:\users\Public\Documents\AppData\PoApp\PLauncher.exe" [2011-12-03 218624] "Anti-phishing Domain Advisor"="c:\programdata\Anti-phishing Domain Advisor\visicom_antiphishing.exe" [2011-07-05 217256] "avp"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe" [2010-09-20 311680] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\mzvkbd3.dll . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup backupExtension=.CommonStartup . [HKLM\~\startupfolder\C:^Users^Gnorro^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk] path=c:\users\Gnorro\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk backup=c:\windows\pss\Dropbox.lnk.Startup backupExtension=.Startup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount] 2010-08-20 11:03 33120 —-a-w- c:\program files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate] 2010-09-16 20:04 1164584 —-a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update] 2010-12-15 19:38 136176 —-atw- c:\users\Gnorro\AppData\Local\Google\Update\GoogleUpdate.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk] 2007-01-01 21:22 3739648 —-a-w- c:\program files\Google\Google Talk\googletalk.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] 2007-05-08 14:24 54840 —-a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesHelper] 2012-02-22 05:57 943504 —-a-w- c:\program files\Samsung\Kies\KiesHelper.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPDLR] 2012-03-31 12:48 21416 —-a-w- c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesTrayAgent] 2012-02-22 05:57 3508624 —-a-w- c:\program files\Samsung\Kies\KiesTrayAgent.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui] 2010-03-30 09:16 1820040 —-a-w- c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mega Manager] 2010-11-03 10:00 2113024 —-a-w- c:\program files\Megaupload\Mega Manager\MegaManager.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl] 2009-05-22 16:22 7514656 ——w- c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC] 2011-12-05 21:46 343168 —-a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2011-05-04 11:59 252136 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualCloneDrive] 2011-03-07 13:33 89456 —-a-w- c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile Device Center] 2007-05-31 07:21 648072 —-a-w- c:\windows\WindowsMobile\wmdc.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile-based device management] 2007-05-31 07:21 648072 —-a-w- c:\windows\WindowsMobile\wmdcBase.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher] 2011-08-05 10:29 159456 —-a-w- c:\program files\Zune\ZuneLauncher.exe . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 gupdate;Servizio Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-06-18 136176] R2 KMService;KMService;c:\windows\system32\srvany.exe [2010-09-24 8192] R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368] R2 ServUpdater;Serv Updater;c:\users\Gnorro\AppData\Local\ServUpdater\ServiceUpd.exe [2011-12-02 156160] R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2012-02-29 158856] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-10 257696] R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2011-12-08 80184] R3 gupdatem;Servizio Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2011-06-18 136176] R3 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys [2012-06-02 28488] R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-06 113120] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872] R3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\SiSoftware\SiSoftware Sandra Lite 2011.SP3\RpcAgentSrv.exe [2009-08-10 93848] R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2011-12-08 181432] R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224] R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x] R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x] R3 WatAdminSvc;Servizio Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2010-09-20 1343400] R3 WMZuneComm;Zune Windows Mobile Connectivity Service;c:\program files\Zune\WMZuneComm.exe [2011-08-05 268512] R3 yukonw7;Driver miniport NDIS6.2 per controller Ethernet Marvell Yukon;c:\windows\system32\DRIVERS\yk62x86.sys [2009-07-13 311296] R4 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [2010-03-30 1107336] R4 MSSQLServerADHelper100;Servizio SQL Server Active Directory Helper;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2009-07-21 47128] R4 RsFx0103;RsFx0103 Driver;c:\windows\system32\DRIVERS\RsFx0103.sys [2009-03-30 239336] R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-09-19 436792] R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2009-03-30 366936] S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-12-15 33808] S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2009-05-15 21008] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-12-06 163328] S2 AsSysCtrlService;ASUS System Control Service;c:\program files\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [2009-04-02 90112] S2 CDMA Device Service;CDMA Device Service;c:\program files\Samsung\USB Drivers\26_VIA_driver2\x86\VIAService.exe [2011-08-02 63488] S2 DvmMDES;DeviceVM Meta Data Export Service;c:\asus.sys\config\DVMExportService.exe [2009-02-18 294912] S2 HWiNFO32;HWiNFO32 Kernel Driver;c:\program files\HWiNFO32\HWiNFO32.SYS [2011-09-22 21624] S2 MsDepSvc;Web Deployment Agent Service;c:\program files\IIS\Microsoft Web Deploy\MsDepSvc.exe [2011-04-01 67400] S2 MsDtsServer;SQL Server Integration Services;c:\program files\Microsoft SQL Server\90\DTS\Binn\MsDtsSrvr.exe [2005-10-14 199384] S2 PowerOffer Service;Pos Service;c:\users\Gnorro\AppData\Local\PosService\Pos.exe [2011-12-02 164864] S2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-05-30 3048136] S2 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [2011-12-14 2984832] S2 Tomcat6;Apache Tomcat 6;c:\program files\Apache Software Foundation\Tomcat 6.0\bin\tomcat6.exe [2010-07-19 61440] S2 Web Assistant Updater;Web Assistant Updater;c:\program files\Web Assistant\ExtensionUpdaterService.exe [2012-05-08 185856] S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2011-12-06 9067008] S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2011-12-06 264192] S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2011-10-17 85520] S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [2011-04-12 45464] S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2009-05-16 19472] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2010-06-23 275048] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 HPService REG_MULTI_SZ HPSLPSVC hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc WindowsMobile REG_MULTI_SZ wcescomm rapimgr LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr iissvcs REG_MULTI_SZ w3svc was apphost REG_MULTI_SZ apphostsvc . Contenuto della cartella 'Scheduled Tasks' . 2012-06-08 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-31 09:26] . 2012-06-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2011-06-18 10:36] . 2012-06-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2011-06-18 10:36] . 2012-06-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3857534020-3991675840-3102532669-1001Core.job - c:\users\Gnorro\AppData\Local\Google\Update\GoogleUpdate.exe [2010-12-15 19:38] . 2012-06-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3857534020-3991675840-3102532669-1001UA.job - c:\users\Gnorro\AppData\Local\Google\Update\GoogleUpdate.exe [2010-12-15 19:38] . . ——- Scansione supplementare ——- . uStart Page = about:blank mStart Page = hxxp://search.findeer.com IE: E&sporta; in Microsoft Excel - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000 TCP: DhcpNameServer = [removed] [removed] TCP: Interfaces\{20582271-F6AE-4E36-886F-48024D8CAC56}: NameServer = 176.31.229.24,176.31.229.25 TCP: Interfaces\{63197F6F-7A11-48D5-B8E7-0161239E9EF3}: NameServer = 176.31.229.24,176.31.229.25 TCP: Interfaces\{e29ac6c2-7037-11de-816d-806e6f6e6963}: NameServer = 176.31.229.24,176.31.229.25 TCP: Interfaces\{E65A718F-C287-4469-9D2A-C248217DFE90}: NameServer = 176.31.229.24,176.31.229.25 TCP: Interfaces\{FD36B4D0-A033-45AC-93E9-C6519D78E284}: NameServer = 176.31.229.24,176.31.229.25 FF - ProfilePath - c:\users\Gnorro\AppData\Roaming\Mozilla\Firefox\Profiles\febeprof.Gnorro\ FF - prefs.js: browser.startup.homepage - about:home FF - prefs.js: network.proxy.type - 0 FF - user.js: network.cookie.cookieBehavior - 0 FF - user.js: privacy.clearOnShutdown.cookies - false FF - user.js: security.warn_viewing_mixed - false FF - user.js: security.warn_viewing_mixed.show_once - false FF - user.js: security.warn_submit_insecure - false FF - user.js: security.warn_submit_insecure.show_once - false FF - user.js: extensions.incredibar_i.newTab - false FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6OyD6PHM7i&loc;=IB_TB&i;=26&search;= FF - user.js: extensions.incredibar_i.id - 78a9fde6000000000000485b3928984f FF - user.js: extensions.incredibar_i.instlDay - 15487 FF - user.js: extensions.incredibar_i.vrsn - [removed] FF - user.js: extensions.incredibar_i.vrsni - [removed] FF - user.js: extensions.incredibar_i.vrsnTs - [removed]:46 FF - user.js: extensions.incredibar_i.prtnrId - Incredibar FF - user.js: extensions.incredibar_i.prdct - incredibar FF - user.js: extensions.incredibar_i.aflt - orgnl FF - user.js: extensions.incredibar_i.smplGrp - none FF - user.js: extensions.incredibar_i.tlbrId - base FF - user.js: extensions.incredibar_i.instlRef - FF - user.js: extensions.incredibar_i.dfltLng - FF - user.js: extensions.incredibar_i.excTlbr - false FF - user.js: extensions.incredibar_i.ms_url_id - FF - user.js: extensions.incredibar_i.upn2 - 6OyD6PHM7i FF - user.js: extensions.incredibar_i.upn2n - 92261480923448156 FF - user.js: extensions.incredibar_i.productid - 26 FF - user.js: extensions.incredibar_i.installerproductid - 26 FF - user.js: extensions.incredibar_i.did - 10604 FF - user.js: extensions.incredibar_i.ppd - . - - - - CHIAVI ORFANE RIMOSSE - - - - . BHO-{336D0C35-8A85-403a-B9D2-65C292C39087} - (no file) . . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MsDepSvc] "ImagePath"="\"c:\program files\IIS\Microsoft Web Deploy\MsDepSvc.exe\" -runService:MsDepSvc" – . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\msftesql] "ImagePath"="\"c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\msftesql.exe\" -s:MSSQL.1 -f:MSSQLSERVER" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MySQL] "ImagePath"="\"c:\program files\MySQL\MySQL Server 5.1\bin\mysqld\" –defaults-file=\"c:\program files\MySQL\MySQL Server 5.1\my.ini\" MySQL" . ——————— CHIAVI DI REGISTRO BLOCCATE ——————— . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ——————— Dlls caricate dai processi in esecuzione ——————— . - - - - - - - > 'Explorer.exe'(1508) c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll c:\program files\TortoiseSVN\bin\TortoiseStub.dll c:\program files\TortoiseSVN\bin\TortoiseSVN.dll c:\program files\TortoiseSVN\bin\intl3_tsvn.dll c:\users\Gnorro\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . ———————— Altri processi in esecuzione ———————— . c:\windows\system32\atieclxx.exe c:\windows\system32\taskhost.exe c:\windows\system32\conhost.exe c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe c:\program files\MySQL\MySQL Server 5.1\bin\mysqld.exe c:\windows\system32\PnkBstrA.exe c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe c:\windows\system32\conhost.exe c:\program files\TortoiseSVN\bin\TSVNCache.exe c:\users\Public\Documents\AppData\PoApp\PService.exe c:\users\Gnorro\AppData\Local\Sky Italia\Sky Go Player\NDSPCShowServer.exe c:\windows\system32\conhost.exe c:\windows\system32\sppsvc.exe c:\program files\Windows Media Player\wmpnetwk.exe c:\windows\system32\taskhost.exe . ************************************************************************** . Ora fine scansione: 2012-06-09 10:05:18 - Il pc è stato riavviato ComboFix-quarantined-files.txt 2012-06-09 08:05 ComboFix2.txt 2012-06-03 14:38 ComboFix3.txt 2012-05-31 19:40 . Pre-Run: 184.741.425.152 byte disponibili Post-Run: 184.384.212.992 byte disponibili . - - End Of File - - EBEA496DF778CAD2543A6C1A058A9738
Post #29
Hi lukem,

You have a questionable toolbar installed, probably came along with Foxit Reader when you installed it. These is also some old vulnerable versions of java.

  • click the Start button
  • click Control Panel
  • click Programs
  • click Programs and Features.
Uninstall the following

Ask Toolbar
Java™ 6 Update 24
Java™ SE Development Kit 6 Update 21
Java™ SE Development Kit 6 Update 22
Java™ SE Development Kit 7
PowerOffer 2.0
Web Assistant 2.0.0.439


Do not uninstall Java™ 7


Next

Please follow all previous instructions regarding security programs.

Open a new Notepad session
  • Click the Start button, click run
  • in the run box type notepad
  • click ok
  • In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  • Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

File::
C:\Program Files\Web Assistant\ExtensionUpdaterService.exe
C:\Users\Gnorro\AppData\Local\ServUpdater\ServiceUpd.exe
C:\Users\Gnorro\AppData\Local\PosService\Pos.exe

folder::
C:\Program Files\Web Assistant
C:\Users\Gnorro\AppData\Local\ServUpdater
C:\Users\Gnorro\AppData\Local\PosService

Driver::
Web Assistant Updater
ServUpdater
PowerOffer Service

DDS::
mStart Page = hxxp://search.findeer.com
TCP: Interfaces\{20582271-F6AE-4E36-886F-48024D8CAC56}: NameServer = 176.31.229.24,176.31.229.25
TCP: Interfaces\{63197F6F-7A11-48D5-B8E7-0161239E9EF3}: NameServer = 176.31.229.24,176.31.229.25
TCP: Interfaces\{e29ac6c2-7037-11de-816d-806e6f6e6963}: NameServer = 176.31.229.24,176.31.229.25
TCP: Interfaces\{E65A718F-C287-4469-9D2A-C248217DFE90}: NameServer = 176.31.229.24,176.31.229.25
TCP: Interfaces\{FD36B4D0-A033-45AC-93E9-C6519D78E284}: NameServer = 176.31.229.24,176.31.229.25

FireFox::
FF - ProfilePath - c:\users\Gnorro\AppData\Roaming\Mozilla\Firefox\Profiles\febeprof.Gnorro\
FF - user.js: extensions.incredibar_i.newTab - false
FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6OyD6PHM7i&loc=IB_TB&i=26&search=
FF - user.js: extensions.incredibar_i.id - 78a9fde6000000000000485b3928984f
FF - user.js: extensions.incredibar_i.instlDay - 15487
FF - user.js: extensions.incredibar_i.vrsn - [removed]
FF - user.js: extensions.incredibar_i.vrsni - [removed]
FF - user.js: extensions.incredibar_i.vrsnTs - [removed]:46
FF - user.js: extensions.incredibar_i.prtnrId - Incredibar
FF - user.js: extensions.incredibar_i.prdct - incredibar
FF - user.js: extensions.incredibar_i.aflt - orgnl
FF - user.js: extensions.incredibar_i.smplGrp - none
FF - user.js: extensions.incredibar_i.tlbrId - base
FF - user.js: extensions.incredibar_i.instlRef - 
FF - user.js: extensions.incredibar_i.dfltLng - 
FF - user.js: extensions.incredibar_i.excTlbr - false
FF - user.js: extensions.incredibar_i.ms_url_id - 
FF - user.js: extensions.incredibar_i.upn2 - 6OyD6PHM7i
FF - user.js: extensions.incredibar_i.upn2n - 92261480923448156
FF - user.js: extensions.incredibar_i.productid - 26
FF - user.js: extensions.incredibar_i.installerproductid - 26
FF - user.js: extensions.incredibar_i.did - 10604
FF - user.js: extensions.incredibar_i.ppd -

In the notepad
  • Click File, Save as…, and set the Save in to your Desktop
  • In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
  • Click save
Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]


How's the computer?
Post #30
Hi after removing PowerOffer and WebAssistant the extra tab of firefox has disappeared I can't find Ask Toolbar in installed programs. I didn't uninstall java because I need for developing. I have to uninstall anyway? thanks

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI