What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Problem with Trojan.Wind32.Small [Solved]

70 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31 last edited
Hi lukem,

All the java listed is out of date and have vulnerabilities that can be exploited by malware.

The new version of Java SE Development Kit 7 can be found HERE . Scroll down to Windows x86 (32-bit)

After you uninstall the older versions of the rest of the java can be updated by:

Go to Start > Control Panel , switch to Classic View if it isn't already.
  • Locate the Java icon (it looks like a coffee cup)
  • double click it to open it
  • click the Update tab
  • Click update now

Did you run combofix?
Post #34
is it really necessary update now java? because I have to reconfigure a lot of application if i do that can i run combofix anyway without uninstalling java?
Post #35 last edited
Hi lukem,

Let's do it this way for now. This will only update the JSE version of java.

Uninstall

Java™ 6 Update 24

next

Click your start button > Control Panel
  • Use the drop down menu beside view by and change it to small icons
  • locate java in the list and click on it
  • when the java console opens click the update tab
  • Click update now

Next

Run the combofix CFScript.
Post #36
When I started combofix with CFScript.txt it asked me to update combofix, so I'm not sure it hase ran the script. However, thi is the log: ComboFix 12-06-15.06 - Gnorro 15/06/2012 23:25:54.4.8 - x86 Microsoft Windows 7 Ultimate 6.1.7601.1.1252.39.1040.18.3062.1644 [GMT 2:00] Eseguito da: c:\users\Gnorro\Desktop\ComboFix.exe Opzioni usate :: c:\users\Gnorro\Desktop\CFScript.txt AV: Kaspersky Internet Security *Disabled/Updated* {56547CC9-C9B2-849D-8FEF-A496150D6A06} FW: Kaspersky Internet Security *Disabled* {6E6FFDEC-83DD-85C5-A4B0-0DA3EBDE2D7D} SP: Kaspersky Internet Security *Disabled/Updated* {ED359D2D-EF88-8B13-B55F-9FE46E8A20BB} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . FILE :: "c:\program files\Web Assistant\ExtensionUpdaterService.exe" "c:\users\Gnorro\AppData\Local\PosService\Pos.exe" "c:\users\Gnorro\AppData\Local\ServUpdater\ServiceUpd.exe" . . ((((((((((((((((((((((((((((((((((((( Altre eliminazioni ))))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\Gnorro\AppData\Local\PosService c:\users\Gnorro\AppData\Local\PosService\Pos.InstallLog c:\users\Gnorro\AppData\Local\PosService\settings.ini c:\users\Gnorro\AppData\Local\PosService\settings\settings.ini c:\users\Gnorro\AppData\Local\ServUpdater c:\users\Gnorro\AppData\Local\ServUpdater\7z.dll c:\users\Gnorro\AppData\Local\ServUpdater\AppLib.Zip.dll c:\users\Gnorro\AppData\Local\ServUpdater\ServiceUpd.exe c:\users\Gnorro\AppData\Local\ServUpdater\ServiceUpd.InstallLog c:\users\Gnorro\AppData\Local\ServUpdater\ServiceUpd.InstallState c:\users\Gnorro\AppData\Local\ServUpdater\settings.ini c:\users\Gnorro\AppData\Local\ServUpdater\settings\settings.ini c:\users\Gnorro\AppData\Local\ServUpdater\upd.exe c:\users\Gnorro\AppData\Local\Temp\26b4a1dd-e07b-48af-be4e-9642b273284b\CliSecureRT.dll . . ((((((((((((((((((((((((((((((((((((((( Driver/Servizi ))))))))))))))))))))))))))))))))))))))))))))))))) . . ——-\Service_ServUpdater . . ((((((((((((((((((((((((( Files Creati Da 2012-05-15 al 2012-06-15 ))))))))))))))))))))))))))))))))))) . . 2012-06-15 21:33 . 2012-06-15 21:36 ——– d—–w- c:\users\Gnorro\AppData\Local\temp 2012-06-15 21:33 . 2012-06-15 21:33 ——– d—–w- c:\users\DefaultAppPool\AppData\Local\temp 2012-06-15 21:33 . 2012-06-15 21:33 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-06-15 21:33 . 2012-06-15 21:33 ——– d—–w- c:\users\Classic .NET AppPool\AppData\Local\temp 2012-06-15 21:12 . 2012-06-15 21:12 ——– d—–w- c:\program files\Common Files\Java 2012-06-15 21:12 . 2012-06-15 21:12 ——– d—–w- c:\program files\Oracle 2012-06-15 21:11 . 2012-05-04 17:29 772504 —-a-w- c:\windows\system32\npDeployJava1.dll 2012-06-15 19:08 . 2012-06-15 19:08 ——– d—–w- c:\users\Gnorro\AppData\Local\Macromedia 2012-06-15 17:54 . 2012-05-08 16:40 6737808 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{FE91B83C-2557-4E2D-993E-7E8F5712B16F}\mpengine.dll 2012-06-14 06:24 . 2012-04-28 04:41 919040 —-a-w- c:\windows\system32\rdpcorets.dll 2012-06-14 06:24 . 2012-04-28 03:17 183808 —-a-w- c:\windows\system32\drivers\rdpwd.sys 2012-06-14 06:24 . 2012-05-15 01:05 2343936 —-a-w- c:\windows\system32\win32k.sys 2012-06-14 06:24 . 2012-04-26 04:45 58880 —-a-w- c:\windows\system32\rdpwsx.dll 2012-06-14 06:24 . 2012-04-26 04:45 129536 —-a-w- c:\windows\system32\rdpcorekmts.dll 2012-06-14 06:24 . 2012-04-26 04:41 8192 —-a-w- c:\windows\system32\rdrmemptylst.exe 2012-06-09 09:36 . 2012-05-24 10:27 ——– d—–w- c:\program files\Odin3_v3.04 2012-06-09 08:51 . 2012-06-09 08:51 ——– d—–w- c:\windows\system32\System32 2012-06-06 20:14 . 2012-06-06 20:14 770384 —-a-w- c:\program files\Mozilla Firefox\msvcr100.dll 2012-06-06 20:14 . 2012-06-06 20:14 421200 —-a-w- c:\program files\Mozilla Firefox\msvcp100.dll 2012-06-04 19:51 . 2012-06-04 19:51 ——– d—–w- c:\users\Gnorro\AppData\Roaming\Malwarebytes 2012-06-02 07:50 . 2012-06-02 07:50 28488 —-a-w- c:\windows\system32\drivers\mbamchameleon.sys 2012-06-02 07:46 . 2012-06-02 07:46 ——– d—–w- c:\programdata\Malwarebytes 2012-06-02 07:46 . 2012-06-02 07:46 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware 2012-06-02 07:46 . 2012-04-04 13:56 22344 —-a-w- c:\windows\system32\drivers\mbam.sys 2012-05-27 10:02 . 2012-05-27 10:03 3888 —-a-w- c:\windows\system32\drivers\NTHANDLE.SYS 2012-05-27 10:01 . 2012-05-27 10:01 ——– d—–w- c:\program files\WhoLockMe104 2012-05-27 08:55 . 2012-05-27 08:55 ——– d—–w- c:\users\Gnorro\AppData\Local\antiphishing-vmntbcleaner1_0dn 2012-05-27 08:55 . 2012-05-27 08:55 ——– d—–w- c:\programdata\Anti-phishing Domain Advisor 2012-05-27 08:47 . 2012-05-27 09:24 ——– d—–w- c:\programdata\Spybot - Search & Destroy 2012-05-27 08:47 . 2012-05-27 08:51 ——– d—–w- c:\program files\Spybot - Search & Destroy 2012-05-27 07:46 . 2012-05-27 09:37 ——– d—–w- c:\program files\hpmonitor 2012-05-27 07:46 . 2012-05-27 07:46 447 —-a-w- C:\user.js 2012-05-27 07:45 . 2012-05-27 08:43 ——– d—–w- c:\program files\Win 32. Trojan . Small Removal Tool 2012-05-27 07:42 . 2012-05-27 07:42 ——– d—–w- c:\programdata\PC Tools 2012-05-27 07:42 . 2012-05-27 07:42 ——– d—–w- c:\users\Gnorro\AppData\Roaming\TestApp 2012-05-26 16:04 . 2012-05-26 16:04 ——– d-sh–w- c:\windows\system32\%APPDATA% . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-06-15 06:01 . 2012-03-31 22:05 426184 —-a-w- c:\windows\system32\FlashPlayerApp.exe 2012-06-15 06:01 . 2011-05-16 20:14 70344 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-05-29 07:38 . 2011-07-26 15:26 330240 —-a-w- c:\windows\MASetupCaller.dll 2012-05-05 16:02 . 2012-05-05 16:02 108368 —-a-r- c:\users\Gnorro\AppData\Roaming\Microsoft\Installer\{FEC1DF97-E716-4CD8-A55B-75C373912D35}\ARPPRODUCTICON.exe 2012-05-04 17:29 . 2010-10-17 12:46 687504 —-a-w- c:\windows\system32\deployJava1.dll 2012-03-31 04:39 . 2012-05-11 18:58 3968368 —-a-w- c:\windows\system32\ntkrnlpa.exe 2012-03-31 04:39 . 2012-05-11 18:58 3913072 —-a-w- c:\windows\system32\ntoskrnl.exe 2012-03-30 10:23 . 2012-05-11 18:58 1291632 —-a-w- c:\windows\system32\drivers\tcpip.sys 2012-06-06 20:13 . 2011-10-04 18:58 85472 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Punti Reg Caricati )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* i valori vuoti & legittimi/default non sono visualizzati. REGEDIT4 . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}] 2010-05-26 13:23 1385864 —-a-w- c:\program files\Ask.com\GenericAskToolbar.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864] . [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864] . [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal] @="{C5994560-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}] 2010-03-21 07:55 87304 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified] @="{C5994561-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}] 2010-03-21 07:55 87304 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict] @="{C5994562-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}] 2010-03-21 07:55 87304 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked] @="{C5994563-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}] 2010-03-21 07:55 87304 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly] @="{C5994564-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}] 2010-03-21 07:55 87304 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted] @="{C5994565-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}] 2010-03-21 07:55 87304 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded] @="{C5994566-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}] 2010-03-21 07:55 87304 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored] @="{C5994567-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}] 2010-03-21 07:55 87304 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned] @="{C5994568-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}] 2010-03-21 07:55 87304 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2011-12-05 19:17 94208 —-a-w- c:\users\Gnorro\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2011-12-05 19:17 94208 —-a-w- c:\users\Gnorro\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2011-12-05 19:17 94208 —-a-w- c:\users\Gnorro\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2011-12-05 19:17 94208 —-a-w- c:\users\Gnorro\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "KiesPDLR"="c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2012-05-30 21432] "PCShowServer"="c:\users\Gnorro\AppData\Local\Sky Italia\Sky Go Player\PCShowServerPMWrapper.exe" [2012-04-17 525680] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296] "avp"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe" [2010-09-20 311680] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\mzvkbd3.dll . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup backupExtension=.CommonStartup . [HKLM\~\startupfolder\C:^Users^Gnorro^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk] path=c:\users\Gnorro\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk backup=c:\windows\pss\Dropbox.lnk.Startup backupExtension=.Startup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount] 2010-08-20 11:03 33120 —-a-w- c:\program files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate] 2010-09-16 20:04 1164584 —-a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update] 2010-12-15 19:38 136176 —-atw- c:\users\Gnorro\AppData\Local\Google\Update\GoogleUpdate.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk] 2007-01-01 21:22 3739648 —-a-w- c:\program files\Google\Google Talk\googletalk.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] 2007-05-08 14:24 54840 —-a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPDLR] 2012-05-30 01:18 21432 —-a-w- c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesTrayAgent] 2012-05-30 01:17 3521464 —-a-w- c:\program files\Samsung\Kies\KiesTrayAgent.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui] 2010-03-30 09:16 1820040 —-a-w- c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mega Manager] 2010-11-03 10:00 2113024 —-a-w- c:\program files\Megaupload\Mega Manager\MegaManager.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl] 2009-05-22 16:22 7514656 ——w- c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC] 2011-12-05 21:46 343168 —-a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2012-01-17 09:07 252296 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualCloneDrive] 2011-03-07 13:33 89456 —-a-w- c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile Device Center] 2007-05-31 07:21 648072 —-a-w- c:\windows\WindowsMobile\wmdc.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile-based device management] 2007-05-31 07:21 648072 —-a-w- c:\windows\WindowsMobile\wmdcBase.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher] 2011-08-05 10:29 159456 —-a-w- c:\program files\Zune\ZuneLauncher.exe . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 gupdate;Servizio Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-06-18 136176] R2 KMService;KMService;c:\windows\system32\srvany.exe [2010-09-24 8192] R2 MsDepSvc;Web Deployment Agent Service;c:\program files\IIS\Microsoft Web Deploy\MsDepSvc.exe [2011-04-01 67400] R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2012-02-29 158856] R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2011-12-08 80184] R3 gupdatem;Servizio Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2011-06-18 136176] R3 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys [2012-06-02 28488] R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-06 113120] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872] R3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\SiSoftware\SiSoftware Sandra Lite 2011.SP3\RpcAgentSrv.exe [2009-08-10 93848] R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2011-12-08 181432] R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224] R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x] R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x] R3 WatAdminSvc;Servizio Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2010-09-20 1343400] R3 WMZuneComm;Zune Windows Mobile Connectivity Service;c:\program files\Zune\WMZuneComm.exe [2011-08-05 268512] R3 yukonw7;Driver miniport NDIS6.2 per controller Ethernet Marvell Yukon;c:\windows\system32\DRIVERS\yk62x86.sys [2009-07-13 311296] R4 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [2010-03-30 1107336] R4 MSSQLServerADHelper100;Servizio SQL Server Active Directory Helper;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2009-07-21 47128] R4 RsFx0103;RsFx0103 Driver;c:\windows\system32\DRIVERS\RsFx0103.sys [2009-03-30 239336] R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-09-19 436792] R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2009-03-30 366936] S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-12-15 33808] S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2009-05-15 21008] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-12-06 163328] S2 AsSysCtrlService;ASUS System Control Service;c:\program files\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [2009-04-02 90112] S2 CDMA Device Service;CDMA Device Service;c:\program files\Samsung\USB Drivers\26_VIA_driver2\x86\VIAService.exe [2011-08-02 63488] S2 DvmMDES;DeviceVM Meta Data Export Service;c:\asus.sys\config\DVMExportService.exe [2009-02-18 294912] S2 HWiNFO32;HWiNFO32 Kernel Driver;c:\program files\HWiNFO32\HWiNFO32.SYS [2011-09-22 21624] S2 MsDtsServer;SQL Server Integration Services;c:\program files\Microsoft SQL Server\90\DTS\Binn\MsDtsSrvr.exe [2005-10-14 199384] S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368] S2 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [2011-12-14 2984832] S2 Tomcat6;Apache Tomcat 6;c:\program files\Apache Software Foundation\Tomcat 6.0\bin\tomcat6.exe [2010-07-19 61440] S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2011-12-06 9067008] S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2011-12-06 264192] S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2011-10-17 85520] S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [2011-04-12 45464] S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2009-05-16 19472] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2010-06-23 275048] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 HPService REG_MULTI_SZ HPSLPSVC hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc WindowsMobile REG_MULTI_SZ wcescomm rapimgr LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr iissvcs REG_MULTI_SZ w3svc was apphost REG_MULTI_SZ apphostsvc . Contenuto della cartella 'Scheduled Tasks' . 2012-06-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2011-06-18 10:36] . 2012-06-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2011-06-18 10:36] . 2012-06-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3857534020-3991675840-3102532669-1001Core.job - c:\users\Gnorro\AppData\Local\Google\Update\GoogleUpdate.exe [2010-12-15 19:38] . 2012-06-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3857534020-3991675840-3102532669-1001UA.job - c:\users\Gnorro\AppData\Local\Google\Update\GoogleUpdate.exe [2010-12-15 19:38] . . ——- Scansione supplementare ——- . uStart Page = hxxp://search.findeer.com IE: Aggiungi ad Anti-Banner IE: E&sporta; in Microsoft Excel - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000 TCP: DhcpNameServer = [removed] [removed] TCP: Interfaces\{20582271-F6AE-4E36-886F-48024D8CAC56}: NameServer = 176.31.229.24,176.31.229.25 TCP: Interfaces\{63197F6F-7A11-48D5-B8E7-0161239E9EF3}: NameServer = 176.31.229.24,176.31.229.25 TCP: Interfaces\{e29ac6c2-7037-11de-816d-806e6f6e6963}: NameServer = 176.31.229.24,176.31.229.25 TCP: Interfaces\{E65A718F-C287-4469-9D2A-C248217DFE90}: NameServer = 176.31.229.24,176.31.229.25 TCP: Interfaces\{FD36B4D0-A033-45AC-93E9-C6519D78E284}: NameServer = 176.31.229.24,176.31.229.25 FF - ProfilePath - c:\users\Gnorro\AppData\Roaming\Mozilla\Firefox\Profiles\febeprof.Gnorro\ FF - prefs.js: browser.startup.homepage - about:home FF - prefs.js: network.proxy.type - 0 FF - user.js: network.cookie.cookieBehavior - 0 FF - user.js: privacy.clearOnShutdown.cookies - false FF - user.js: security.warn_viewing_mixed - false FF - user.js: security.warn_viewing_mixed.show_once - false FF - user.js: security.warn_submit_insecure - false FF - user.js: security.warn_submit_insecure.show_once - false . - - - - CHIAVI ORFANE RIMOSSE - - - - . BHO-{336D0C35-8A85-403a-B9D2-65C292C39087} - (no file) HKCU-Run-KiesHelper - c:\program files\Samsung\Kies\KiesHelper.exe MSConfigStartUp-KiesHelper - c:\program files\Samsung\Kies\KiesHelper.exe . . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MsDepSvc] "ImagePath"="\"c:\program files\IIS\Microsoft Web Deploy\MsDepSvc.exe\" -runService:MsDepSvc" – . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\msftesql] "ImagePath"="\"c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\msftesql.exe\" -s:MSSQL.1 -f:MSSQLSERVER" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MySQL] "ImagePath"="\"c:\program files\MySQL\MySQL Server 5.1\bin\mysqld\" –defaults-file=\"c:\program files\MySQL\MySQL Server 5.1\my.ini\" MySQL" . ——————— CHIAVI DI REGISTRO BLOCCATE ——————— . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ——————— Dlls caricate dai processi in esecuzione ——————— . - - - - - - - > 'Explorer.exe'(468) c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll c:\program files\TortoiseSVN\bin\TortoiseStub.dll c:\program files\TortoiseSVN\bin\TortoiseSVN.dll c:\program files\TortoiseSVN\bin\intl3_tsvn.dll c:\users\Gnorro\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . ———————— Altri processi in esecuzione ———————— . c:\windows\system32\atieclxx.exe c:\windows\system32\taskhost.exe c:\windows\system32\conhost.exe c:\program files\TortoiseSVN\bin\TSVNCache.exe c:\users\Gnorro\AppData\Local\Sky Italia\Sky Go Player\NDSPCShowServer.exe c:\windows\system32\conhost.exe c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe c:\program files\MySQL\MySQL Server 5.1\bin\mysqld.exe c:\windows\system32\PnkBstrA.exe c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe c:\windows\system32\conhost.exe c:\windows\system32\sppsvc.exe c:\program files\Windows Media Player\wmpnetwk.exe . ************************************************************************** . Ora fine scansione: 2012-06-15 23:42:58 - Il pc è stato riavviato ComboFix-quarantined-files.txt 2012-06-15 21:42 ComboFix2.txt 2012-06-09 08:05 ComboFix3.txt 2012-06-03 14:38 ComboFix4.txt 2012-05-31 19:40 . Pre-Run: 177.452.089.344 byte disponibili Post-Run: 176.499.593.216 byte disponibili . - - End Of File - - 497878826A5C815E87D0CDD1C29D825B
Post #37
Hi lukem,

You did fine.

One more scan to check for remnants.

As a Vista/Win7 user you will need to right click your browser icon and select "Run as Administrator" in order to run this scan.
  • Do not use this instance of your browser for anything besides doing this scan
  • When the scan is complete and the results saved, close that instance of your browser
  • Open a new one the usual way and post the results in this topic.

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.


Go here to run an online scannner from
ESET

(Note: You can use Internet Explorer or FireFox for this scan. If you use FireFox you will be asked to install an additional component. Please allow this.)

  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Disable your Antivirus software. You can usually do this with its Notfication Tray icon near the clock
  • Click Start
  • Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is Checked.
  • Click Scan.
  • Wait for the scan to finish.
  • When the scan completes, click List of found threats
  • click Export to Text file and save the file to your desktop using a unique name, such as ESETScan.
  • Include the contents of this report in your next reply

    Note - when ESET doesn't find any threats, no report will be created.
  • Push the back button.
  • Push Finish
  • Re-enable your Antivirus software.

Next

Open OTL and click the Quick Scan button. Please post the log produced.

Please post back with
  • ESET log if there was one
  • OTL.txt
Post #38
ESET Log:
C:\ProgramData\Spybot - Search & Destroy\Recovery\BrothersoftExtremeCT.zip Win32/Bagle.gen.zip worm
C:\Qoobox\Quarantine\C\Users\Gnorro\AppData\Local\{9bdfedbd-95a6-3dea-2142-6b3449bc5010}\L\80000032.@.vir probably a variant of Win32/Sirefef.EU trojan
C:\Qoobox\Quarantine\C\Users\Gnorro\AppData\Local\{9bdfedbd-95a6-3dea-2142-6b3449bc5010}\U\80000032.@.vir probably a variant of Win32/Sirefef.EU trojan
C:\Qoobox\Quarantine\C\Windows\System32\Attivazione Automatica Office\KMS.exe.vir a variant of Win32/HackKMS.A application
C:\Users\All Users\Spybot - Search & Destroy\Recovery\BrothersoftExtremeCT.zip Win32/Bagle.gen.zip worm
C:\Users\Gnorro\Documents\Windows.7.LXE.3.503\w7lxe.exe a variant of Win32/HackKMS.A application
F:\Documenti\Windows.7.LXE.3.503\w7lxe.exe a variant of Win32/HackKMS.A application
F:\downloads\Programmi\Office2010\180_Days_Locker_By_Hoxygen92.exe a variant of Win32/HackKMS.A application
F:\downloads\Programmi\Office2010\mini-KMS_Activator_v1.2_Office2010_VL_ENG_FIXED.exe a variant of Win32/HackKMS.A application
F:\downloads\Programmi\Office2010\180_Days_Locker_By_Hoxygen92\Attivazione Automatica Office\KMS.exe a variant of Win32/HackKMS.A application
F:\downloads\Programmi\W7\Windows.7.LXE.3.503\w7lxe.exe a variant of Win32/HackKMS.A application
F:\Programmi\kaspersky\BOX_KTR_v2.5A.exe Win32/RiskWare.HackAV.GB application



********************************************************************************
*********************************************************************************
********


OTL Log:
OTL logfile created on: 18/06/2012 20:15:08 - Run 2
OTL by OldTimer - Version 3.2.49.0 Folder = C:\Users\Gnorro\Desktop
Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000410 | Country: Italia | Language: ITA | Date Format: dd/MM/yyyy

2,99 Gb Total Physical Memory | 1,12 Gb Available Physical Memory | 37,61% Memory free
5,98 Gb Paging File | 3,23 Gb Available in Paging File | 53,96% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 246,06 Gb Total Space | 156,66 Gb Free Space | 63,67% Space Free | Partition Type: NTFS
Drive D: | 19,88 Gb Total Space | 9,16 Gb Free Space | 46,06% Space Free | Partition Type: NTFS
Drive E: | 199,72 Gb Total Space | 127,71 Gb Free Space | 63,94% Space Free | Partition Type: NTFS
Drive F: | 465,76 Gb Total Space | 220,74 Gb Free Space | 47,39% Space Free | Partition Type: NTFS

Computer Name: GNORRO-PC | User Name: Gnorro | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Gnorro\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_3_300_257.exe (Adobe Systems, Inc.)
PRC - C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
PRC - C:\Users\Gnorro\AppData\Local\Sky Italia\Sky Go Player\PCShowServerPMWrapper.exe (NDS Technologies)
PRC - C:\Users\Gnorro\AppData\Local\Sky Italia\Sky Go Player\NDSPCShowServer.exe ()
PRC - C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Windows\System32\atieclxx.exe (AMD)
PRC - C:\Windows\System32\atiesrxx.exe (AMD)
PRC - C:\Program Files\Samsung\USB Drivers\26_VIA_driver2\x86\VIAService.exe ()
PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)
PRC - C:\Program Files\IIS\Microsoft Web Deploy\MsDepSvc.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\TortoiseSVN\bin\TSVNCache.exe (http://tortoisesvn.net)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\tomcat6.exe (Apache Software Foundation)
PRC - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (StarWind Software)
PRC - C:\Program Files\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe ()
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\ASUS.SYS\config\DVMExportService.exe (DeviceVM)
PRC - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Program Files\eMule AdunanzA\eMule_AdnzA.exe (http://www.emule-project.net)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\Users\Gnorro\AppData\Local\Temp\26b4a1dd-e07b-48af-be4e-9642b273284b\CliSecureRT.dll ()
MOD - C:\Windows\System32\Macromed\Flash\NPSWF32_11_3_300_257.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\672af464f839fa6415b1bfba3ddded8b\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\7675052cbc96dfde4a0384d1b9b509e6\PresentationFramework.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\311f97a7e1344d8e2f2f00e8f0922950\PresentationCore.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\c111c0a17c30051d271fb562d6f970c7\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\c25563098edb7a0d031ca11bd5835657\System.Drawing.ni.dll ()
MOD - C:\Users\Gnorro\AppData\Local\Google\Chrome\Application\19.0.1084.56\ppGoogleNaClPluginChrome.dll ()
MOD - C:\Users\Gnorro\AppData\Local\Google\Chrome\Application\19.0.1084.56\pdf.dll ()
MOD - C:\Users\Gnorro\AppData\Local\Google\Chrome\Application\19.0.1084.56\libglesv2.dll ()
MOD - C:\Users\Gnorro\AppData\Local\Google\Chrome\Application\19.0.1084.56\libegl.dll ()
MOD - C:\Users\Gnorro\AppData\Local\Google\Chrome\Application\19.0.1084.56\avutil-51.dll ()
MOD - C:\Users\Gnorro\AppData\Local\Google\Chrome\Application\19.0.1084.56\avformat-54.dll ()
MOD - C:\Users\Gnorro\AppData\Local\Google\Chrome\Application\19.0.1084.56\avcodec-54.dll ()
MOD - C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\7fc18f2090a13cea5af7bf66c643a328\System.Management.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\423e9251a1d85573bbb1270dac940726\System.Xaml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\ce69ef2b59d6cc8dd59e9b529a9d6faf\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\f765dcb1d3de13b6dfd768b2c1b68d30\PresentationFramework.Aero.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\94605854f8328aadab15bc25eb6fbe77\System.Core.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\6ab7327878d105c015e6781c0fc07387\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\17be0d942faf64df32a7720cf54765ff\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System\e995cc6f08a3e381012423f9594648a6\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\c1af4ec9a36f671617a8ecaec00373f4\mscorlib.ni.dll ()
MOD - C:\Users\Gnorro\AppData\Local\Sky Italia\Sky Go Player\z.dll ()
MOD - C:\Users\Gnorro\AppData\Local\Sky Italia\Sky Go Player\ndsLogStore.dll ()
MOD - C:\Users\Gnorro\AppData\Local\Sky Italia\Sky Go Player\libxml2-2.dll ()
MOD - C:\Users\Gnorro\AppData\Local\Sky Italia\Sky Go Player\libgstreamer-0.10.dll ()
MOD - C:\Users\Gnorro\AppData\Local\Sky Italia\Sky Go Player\gsttspplugin.dll ()
MOD - C:\Users\Gnorro\AppData\Local\Sky Italia\Sky Go Player\NDSPCShowServer.exe ()
MOD - C:\Users\Gnorro\AppData\Local\Sky Italia\Sky Go Player\DrmSingleton.dll ()
MOD - C:\Program Files\FileZilla FTP Client\fzshellext.dll ()
MOD - C:\Program Files\Notepad++\NppShell_02.dll ()
MOD - C:\Program Files\WinRAR\rarext.dll ()
MOD - C:\PROGRA~1\IZArc\IZArcCM.dll ()


========== Win32 Services (SafeList) ==========

SRV - (SBSDWSCService) – C:\Program Files\Spybot File not found
SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (Steam Client Service) – C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (SkypeUpdate) – C:\Program Files\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (TeamViewer7) – C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (AMD External Events Utility) – C:\Windows\System32\atiesrxx.exe (AMD)
SRV - (ZuneWlanCfgSvc) – C:\Program Files\Zune\ZuneWlanCfgSvc.exe (Microsoft Corporation)
SRV - (WMZuneComm) – C:\Program Files\Zune\WMZuneComm.exe (Microsoft Corporation)
SRV - (ZuneNetworkSvc) – C:\Program Files\Zune\ZuneNss.exe (Microsoft Corporation)
SRV - (CDMA Device Service) – C:\Program Files\Samsung\USB Drivers\26_VIA_driver2\x86\VIAService.exe ()
SRV - (TVersityMediaServer) – C:\ProgramData\TVersity\Media Server\MediaServer.exe ()
SRV - (MsDepSvc) – C:\Program Files\IIS\Microsoft Web Deploy\MsDepSvc.exe (Microsoft Corporation)
SRV - (Macromedia Licensing Service) – C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe ()
SRV - (WAS) – C:\Windows\System32\inetsrv\iisw3adm.dll (Microsoft Corporation)
SRV - (W3SVC) – C:\Windows\System32\inetsrv\iisw3adm.dll (Microsoft Corporation)
SRV - (AppHostSvc) – C:\Windows\System32\inetsrv\apphostsvc.dll (Microsoft Corporation)
SRV - (KMService) – C:\Windows\System32\srvany.exe ()
SRV - (WatAdminSvc) – C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (AVP) – C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab)
SRV - (Tomcat6) – C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\tomcat6.exe (Apache Software Foundation)
SRV - (Hamachi2Svc) – C:\Program Files\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
SRV - (StarWindServiceAE) – C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (StarWind Software)
SRV - (SandraAgentSrv) – C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2011.SP3\RpcAgentSrv.exe (SiSoftware)
SRV - (SensrSvc) – C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) – C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SRV - (AsSysCtrlService) – C:\Program Files\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe ()
SRV - (DvmMDES) – C:\ASUS.SYS\config\DVMExportService.exe (DeviceVM)
SRV - (msvsmon90) – C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x86\msvsmon.exe (Microsoft Corporation)
SRV - (WcesComm) – C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) – C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)
SRV - (AcronisOSSReinstallSvc) – C:\Program Files\Common Files\Acronis\Acronis Disk Director\oss_reinstall_svc.exe ()


========== Driver Services (SafeList) ==========

DRV - (VGPU) – System32\drivers\rdvgkmd.sys File not found
DRV - (tsusbhub) – system32\drivers\tsusbhub.sys File not found
DRV - (Synth3dVsc) – System32\drivers\synth3dvsc.sys File not found
DRV - (nvlddmkm) – system32\DRIVERS\nvlddmkm.sys File not found
DRV - (EIO) – system32\DRIVERS\EIO.sys File not found
DRV - (catchme) – C:\Users\Gnorro\AppData\Local\Temp\catchme.sys File not found
DRV - (mbamchameleon) – C:\Windows\System32\drivers\mbamchameleon.sys ()
DRV - (ssudmdm) SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.) – C:\Windows\System32\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV - (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.) – C:\Windows\System32\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV - (atikmdag) – C:\Windows\System32\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV - (amdkmdag) – C:\Windows\System32\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV - (amdkmdap) – C:\Windows\System32\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV - (AtiHDAudioService) – C:\Windows\System32\drivers\AtihdW73.sys (Advanced Micro Devices)
DRV - (HWiNFO32) – C:\Program Files\HWiNFO32\HWiNFO32.SYS (REALiX™)
DRV - (dc3d) MS Hardware Device Detection Driver (USB) – C:\Windows\System32\drivers\dc3d.sys (Microsoft Corporation)
DRV - (speedfan) – C:\Windows\System32\speedfan.sys (Almico Software)
DRV - (vmbus) – C:\Windows\System32\drivers\vmbus.sys (Microsoft Corporation)
DRV - (storflt) – C:\Windows\System32\drivers\vmstorfl.sys (Microsoft Corporation)
DRV - (storvsc) – C:\Windows\System32\drivers\storvsc.sys (Microsoft Corporation)
DRV - (TsUsbFlt) – C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (RdpVideoMiniport) – C:\Windows\System32\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV - (WINUSB) – C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (VMBusHID) – C:\Windows\System32\drivers\VMBusHID.sys (Microsoft Corporation)
DRV - (s3cap) – C:\Windows\System32\drivers\vms3cap.sys (Microsoft Corporation)
DRV - (KLIF) – C:\Windows\System32\drivers\klif.sys (Kaspersky Lab)
DRV - (sptd) – C:\Windows\System32\drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (snapman) – C:\Windows\System32\drivers\snapman.sys (Acronis)
DRV - (vmm) – C:\Windows\System32\drivers\VMM.sys (Microsoft Corporation)
DRV - (hamachi) – C:\Windows\System32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (AtiHdmiService) – C:\Windows\System32\drivers\AtiHdmi.sys (ATI Technologies, Inc.)
DRV - (RivaTuner32) – C:\Program Files\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner32.sys ()
DRV - (SANDRA) – C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2011.SP3\WNt500x86\Sandra.sys (SiSoftware)
DRV - (AsIO) – C:\Windows\System32\drivers\AsIO.sys ()
DRV - (MTsensor) – C:\Windows\System32\drivers\ASACPI.sys ()
DRV - (Serial) – C:\Windows\System32\drivers\serial.sys (Brother Industries Ltd.)
DRV - (yukonw7) – C:\Windows\System32\drivers\yk62x86.sys (Marvell)
DRV - (JRAID) – C:\Windows\System32\drivers\jraid.sys (JMicron Technology Corp.)
DRV - (kl1) – C:\Windows\System32\drivers\kl1.sys (Kaspersky Lab)
DRV - (klmouflt) – C:\Windows\System32\drivers\klmouflt.sys (Kaspersky Lab)
DRV - (KLIM6) – C:\Windows\System32\drivers\klim6.sys (Kaspersky Lab)
DRV - (Point32) – C:\Windows\System32\drivers\point32k.sys (Microsoft Corporation)
DRV - (RsFx0103) – C:\Windows\System32\drivers\RsFx0103.sys (Microsoft Corporation)
DRV - (klbg) – C:\Windows\System32\drivers\klbg.sys (Kaspersky Lab)
DRV - (ATITool) – C:\Windows\System32\drivers\ATITool.sys ()
DRV - (giveio) – C:\Windows\System32\giveio.sys ()


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.findeer.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = it
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = FE 39 A6 FC 66 57 CB 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}: "URL" = http://search.yahoo.com/search?fr=vmn&…q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: ' http://search.findeer.com'
FF - prefs.js..extensions.enabledItems: {4BBDD651-70CF-4821-84F8-2B918CF89CA3}:6.3.3.2
FF - prefs.js..browser.startup.homepage: "http://search.findeer.com/"
FF - prefs.js..: 'Cerca…'


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_257.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.0: C:\Program Files\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll File not found
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.102.0: C:\Program Files\Battlelog Web Plugins\1.102.0\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/wpi,version=1.4: C:\Program Files\Microsoft\Web Platform Installer\\npwpidetector.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@nds.com/PCShowPlugin: C:\Users\Gnorro\AppData\Local\Sky Italia\Sky Go Player\npPCShowPlugin.dll File not found
FF - HKCU\Software\MozillaPlugins\@nds.com/PlayerPlugin: C:\Users\Gnorro\AppData\Local\Sky Italia\Sky Go Player\npPlayerPlugin.dll (NDS)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Gnorro\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Gnorro\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\NDS.com/PlayerPlugin: C:\Users\Gnorro\AppData\Local\Sky Italia\Sky Go Player\npPlayerPlugin.dll (NDS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/09/19 19:17:47 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\Web Assistant\Firefox
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/06/17 23:06:59 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/06/15 23:11:28 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\THBExt [2010/09/19 19:01:03 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/09/19 19:17:47 | 000,000,000 | —D | M]

[2010/09/18 23:50:34 | 000,000,000 | —D | M] (No name found) – C:\Users\Gnorro\AppData\Roaming\mozilla\Extensions
[2010/09/18 23:50:34 | 000,000,000 | —D | M] (No name found) – C:\Users\Gnorro\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012/05/27 09:46:28 | 000,000,000 | —D | M] (No name found) – C:\Users\Gnorro\AppData\Roaming\mozilla\Firefox\Profiles\bclvyy6e.default\extensions
[2010/09/18 22:33:08 | 000,000,000 | —D | M] (FEBE) – C:\Users\Gnorro\AppData\Roaming\mozilla\Firefox\Profiles\bclvyy6e.default\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3}
[2010/10/17 14:46:41 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\Gnorro\AppData\Roaming\mozilla\Firefox\Profiles\bclvyy6e.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2012/05/27 09:46:28 | 000,000,000 | —D | M] (incredibar.com) – C:\Users\Gnorro\AppData\Roaming\mozilla\Firefox\Profiles\bclvyy6e.default\extensions\[removed]
[2010/09/19 18:56:41 | 000,000,000 | —D | M] (Foxit Toolbar) – C:\Users\Gnorro\AppData\Roaming\mozilla\Firefox\Profiles\bclvyy6e.default\extensions\[removed]
[2012/06/14 20:43:34 | 000,000,000 | —D | M] (No name found) – C:\Users\Gnorro\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Gnorro\extensions
[2011/01/10 21:44:25 | 000,000,000 | —D | M] (Remove Cookies for Site) – C:\Users\Gnorro\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Gnorro\extensions\{06997db0-c027-4d5f-bd37-b0d9230226ea}
[2010/09/18 22:34:53 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Gnorro\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Gnorro\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/02/03 23:04:08 | 000,000,000 | —D | M] (PDF Download) – C:\Users\Gnorro\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Gnorro\extensions\{37E4D8EA-8BDA-4831-8EA1-89053939A250}
[2012/01/20 01:02:58 | 000,000,000 | —D | M] (FEBE) – C:\Users\Gnorro\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Gnorro\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3}
[2011/08/29 17:21:35 | 000,000,000 | —D | M] (Vyprázdnit vyrovnávací paměť) – C:\Users\Gnorro\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Gnorro\extensions\{563e4790-7e70-11da-a72b-0800200c9a66}
[2011/06/28 21:48:03 | 000,000,000 | —D | M] (All-in-One Gestures) – C:\Users\Gnorro\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Gnorro\extensions\{8b86149f-01fb-4842-9dd8-4d7eb02fd055}
[2010/09/18 22:34:53 | 000,000,000 | —D | M] (Noia 2.0 (eXtreme)) – C:\Users\Gnorro\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Gnorro\extensions\{9f08cb5a-76b1-4bcf-aff9-90e1a5d60b1e}
[2012/05/22 23:10:40 | 000,000,000 | —D | M] (Page Speed) – C:\Users\Gnorro\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Gnorro\extensions\{e3f6c2cc-d8db-498c-af6c-499fb211db97}
[2010/09/18 22:34:53 | 000,000,000 | —D | M] (Noia 2.0 eXtreme OPT) – C:\Users\Gnorro\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Gnorro\extensions\[removed]
[2012/06/10 11:12:50 | 000,001,867 | —- | M] () – C:\Users\Gnorro\AppData\Roaming\Mozilla\Firefox\Profiles\bclvyy6e.default\searchplugins\findeer.xml
[2012/06/09 11:00:03 | 000,000,000 | —D | M] (No name found) – C:\Program Files\mozilla firefox\extensions
[2010/09/19 19:01:15 | 000,000,000 | —D | M] (Kaspersky URL Advisor) – C:\Program Files\mozilla firefox\extensions\[removed]
[2012/06/17 23:06:59 | 000,085,472 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010/09/19 18:56:18 | 000,075,208 | —- | M] (Foxit Software Company) – C:\Program Files\mozilla firefox\plugins\npFoxitReaderPlugin.dll
[2012/04/29 14:08:02 | 000,001,393 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazon-it.xml
[2012/04/29 14:08:02 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/04/29 14:08:02 | 000,000,744 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\eBay-it.xml
[2012/04/29 14:08:02 | 000,000,817 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\hoepli.xml
[2012/04/29 14:08:02 | 000,001,182 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\wikipedia-it.xml
[2012/04/29 14:08:02 | 000,000,953 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo-it.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{googl
e:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chro
me&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client
=chrome&hl;={language}&q;={searchTerms},
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Gnorro\AppData\Local\Google\Chrome\Application\19.0.1084.56\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Gnorro\AppData\Local\Google\Chrome\Application\19.0.1084.56\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Gnorro\AppData\Local\Google\Chrome\Application\19.0.1084.56\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\Gnorro\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: Java Deployment Toolkit 7.0.0.147 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 7 (Enabled) = C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll
CHR - plugin: Foxit Reader Plugin for Mozilla (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
CHR - plugin: Windows Genuine Advantage (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npLegitCheckPlugin.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL
CHR - plugin: ESN Launch Mozilla Plugin (Enabled) = C:\Program Files\Battlelog Web Plugins\1.102.0\npesnlaunch.dll
CHR - plugin: ESN Sonar API (Enabled) = C:\Program Files\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - plugin: WPI Detector 1.4 (Enabled) = C:\Program Files\Microsoft\Web Platform Installer\\npwpidetector.dll
CHR - plugin: PCShow Player Plugin (Enabled) = C:\Users\Gnorro\AppData\Local\Sky Italia\Sky Go Player\npPlayerPlugin.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - Extension: Angry Birds = C:\Users\Gnorro\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj\1.5.0.7_0\
CHR - Extension: Grepolis = C:\Users\Gnorro\AppData\Local\Google\Chrome\User Data\Default\Extensions\kkgkognjknhcgbgbeijjondlikfkgnog\2.11.13_0\

O1 HOSTS File: ([2012/06/15 23:35:47 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {336D0C35-8A85-403a-B9D2-65C292C39087} - No CLSID value found.
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (IeMonitorBho Class) - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll (Megaupload Limited)
O2 - BHO: (Foxit Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O3 - HKLM\..\Toolbar: (Foxit Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (Foxit Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [avp] C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab)
O4 - HKCU..\Run: [KiesPDLR] C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
O4 - HKCU..\Run: [PCShowServer] C:\Users\Gnorro\AppData\Local\Sky Italia\Sky Go Player\PCShowServerPMWrapper.exe (NDS Technologies)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Aggiungi ad Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm ()
O8 - Extra context menu item: E&sporta; in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office14\EXCEL.EXE/3000 File not found
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: &Tastiera; Virtuale - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O9 - Extra Button: C&ontrollo; URL - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll (Safer Networking Limited)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{20582271-F6AE-4E36-886F-48024D8CAC56}: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{20582271-F6AE-4E36-886F-48024D8CAC56}: NameServer = 176.31.229.24,176.31.229.25
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{63197F6F-7A11-48D5-B8E7-0161239E9EF3}: NameServer = 176.31.229.24,176.31.229.25
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{e29ac6c2-7037-11de-816d-806e6f6e6963}: NameServer = 176.31.229.24,176.31.229.25
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E65A718F-C287-4469-9D2A-C248217DFE90}: NameServer = 176.31.229.24,176.31.229.25
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FD36B4D0-A033-45AC-93E9-C6519D78E284}: NameServer = 176.31.229.24,176.31.229.25
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll) - C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll (Kaspersky Lab)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\klogon: DllName - (C:\Windows\system32\klogon.dll) - C:\Windows\System32\klogon.dll (Kaspersky Lab)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 23:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/06/18 20:14:32 | 000,595,968 | —- | C] (OldTimer Tools) – C:\Users\Gnorro\Desktop\OTL.exe
[2012/06/17 21:31:17 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2012/06/15 23:35:52 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2012/06/15 23:33:58 | 000,000,000 | —D | C] – C:\Users\Gnorro\AppData\Local\temp
[2012/06/15 23:22:30 | 004,559,503 | R— | C] (Swearware) – C:\Users\Gnorro\Desktop\ComboFix.exe
[2012/06/15 23:12:48 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2012/06/15 23:12:12 | 000,000,000 | —D | C] – C:\Program Files\Oracle
[2012/06/15 21:08:55 | 000,000,000 | —D | C] – C:\Users\Gnorro\AppData\Local\Macromedia
[2012/06/10 11:12:25 | 000,000,000 | —D | C] – C:\Users\Public\Documents\StreamFree
[2012/06/10 10:45:38 | 000,000,000 | —D | C] – C:\Users\Gnorro\Desktop\Un giorno da J
[2012/06/09 11:36:21 | 000,000,000 | —D | C] – C:\Program Files\Odin3_v3.04
[2012/06/09 10:51:53 | 000,000,000 | —D | C] – C:\Windows\System32\System32
[2012/06/04 21:51:43 | 000,000,000 | —D | C] – C:\Users\Gnorro\AppData\Roaming\Malwarebytes
[2012/06/02 09:46:53 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/06/02 09:46:53 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2012/06/02 09:46:52 | 000,022,344 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2012/06/02 09:46:52 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2012/05/31 20:59:08 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2012/05/31 20:59:08 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2012/05/31 20:59:08 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2012/05/31 20:59:01 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2012/05/31 20:58:58 | 000,000,000 | —D | C] – C:\Qoobox
[2012/05/27 12:01:33 | 000,000,000 | —D | C] – C:\Program Files\WhoLockMe104
[2012/05/27 10:55:21 | 000,000,000 | —D | C] – C:\Users\Gnorro\AppData\Local\antiphishing-vmntbcleaner1_0dn
[2012/05/27 10:55:20 | 000,000,000 | —D | C] – C:\ProgramData\Anti-phishing Domain Advisor
[2012/05/27 10:47:24 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2012/05/27 10:47:22 | 000,000,000 | —D | C] – C:\ProgramData\Spybot - Search & Destroy
[2012/05/27 10:47:22 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2012/05/27 09:46:36 | 000,000,000 | —D | C] – C:\Program Files\hpmonitor
[2012/05/27 09:45:51 | 000,000,000 | —D | C] – C:\Program Files\Win 32. Trojan . Small Removal Tool
[2012/05/27 09:42:26 | 000,000,000 | —D | C] – C:\ProgramData\TEMP
[2012/05/27 09:42:25 | 000,000,000 | —D | C] – C:\ProgramData\PC Tools
[2012/05/27 09:42:24 | 000,000,000 | —D | C] – C:\Users\Gnorro\AppData\Roaming\TestApp
[2012/05/26 18:04:54 | 000,000,000 | -HSD | C] – C:\Windows\System32\%APPDATA%

========== Files - Modified Within 30 Days ==========

[2012/06/18 20:22:03 | 000,001,164 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3857534020-3991675840-3102532669-1001UA.job
[2012/06/18 20:22:03 | 000,001,138 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/06/18 20:16:09 | 000,000,177 | -H– | M] () – C:\dvmexp.idx
[2012/06/18 20:14:40 | 000,595,968 | —- | M] (OldTimer Tools) – C:\Users\Gnorro\Desktop\OTL.exe
[2012/06/18 11:36:32 | 000,001,112 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3857534020-3991675840-3102532669-1001Core.job
[2012/06/18 10:43:34 | 000,014,416 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/06/18 10:43:34 | 000,014,416 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/06/18 10:35:01 | 000,001,134 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/06/18 10:34:56 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/06/16 12:15:32 | 000,002,058 | -H– | M] () – C:\Users\Gnorro\Documents\Default.rdp
[2012/06/15 23:35:47 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2012/06/15 23:22:54 | 004,559,503 | R— | M] (Swearware) – C:\Users\Gnorro\Desktop\ComboFix.exe
[2012/06/15 07:56:31 | 000,330,816 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2012/06/15 00:44:28 | 000,958,040 | —- | M] () – C:\Windows\System32\perfh010.dat
[2012/06/15 00:44:28 | 000,851,266 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/06/15 00:44:28 | 000,225,976 | —- | M] () – C:\Windows\System32\perfc010.dat
[2012/06/15 00:44:28 | 000,189,972 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/06/05 17:58:03 | 001,306,135 | —- | M] () – C:\Users\Gnorro\Documents\Humanitas_piano_ottimizzazione.pdf
[2012/06/03 10:40:26 | 000,001,021 | —- | M] () – C:\Users\Gnorro\Desktop\Dropbox.lnk
[2012/06/02 14:17:07 | 000,000,020 | —- | M] () – C:\Users\Gnorro\defogger_reenable
[2012/06/02 09:50:22 | 000,028,488 | —- | M] () – C:\Windows\System32\drivers\mbamchameleon.sys
[2012/05/29 09:38:50 | 000,330,240 | —- | M] ((주)마크애니) – C:\Windows\MASetupCaller.dll
[2012/05/27 23:20:17 | 368,133,497 | —- | M] () – C:\Windows\MEMORY.DMP
[2012/05/27 12:03:19 | 000,003,888 | —- | M] () – C:\Windows\System32\drivers\NTHANDLE.SYS
[2012/05/27 11:24:14 | 000,000,185 | —- | M] () – C:\Windows\wininit.ini
[2012/05/27 09:46:29 | 000,000,447 | —- | M] () – C:\user.js
[2012/05/26 17:33:27 | 001,217,091 | —- | M] () – C:\Users\Gnorro\Desktop\ablaze_free.zip
[2012/05/20 10:58:00 | 002,397,439 | —- | M] () – C:\Users\Gnorro\Desktop\Scooba-385.pdf

========== Files Created - No Company Name ==========

[2012/06/05 17:57:50 | 001,306,135 | —- | C] () – C:\Users\Gnorro\Documents\Humanitas_piano_ottimizzazione.pdf
[2012/06/02 14:16:26 | 000,000,020 | —- | C] () – C:\Users\Gnorro\defogger_reenable
[2012/06/02 09:50:22 | 000,028,488 | —- | C] () – C:\Windows\System32\drivers\mbamchameleon.sys
[2012/05/31 20:59:08 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2012/05/31 20:59:08 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2012/05/31 20:59:08 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2012/05/31 20:59:08 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2012/05/31 20:59:08 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2012/05/27 12:02:36 | 000,003,888 | —- | C] () – C:\Windows\System32\drivers\NTHANDLE.SYS
[2012/05/27 11:24:14 | 000,000,185 | —- | C] () – C:\Windows\wininit.ini
[2012/05/27 09:46:28 | 000,000,447 | —- | C] () – C:\user.js
[2012/05/26 17:33:24 | 001,217,091 | —- | C] () – C:\Users\Gnorro\Desktop\ablaze_free.zip
[2012/05/20 10:57:57 | 002,397,439 | —- | C] () – C:\Users\Gnorro\Desktop\Scooba-385.pdf
[2011/12/06 04:27:36 | 000,204,960 | —- | C] () – C:\Windows\System32\ativvsvl.dat
[2011/12/06 04:27:36 | 000,157,152 | —- | C] () – C:\Windows\System32\ativvsva.dat
[2011/12/05 23:04:00 | 000,059,904 | —- | C] () – C:\Windows\System32\OpenVideo.dll
[2011/12/05 23:03:52 | 000,054,784 | —- | C] () – C:\Windows\System32\OVDecode.dll
[2011/11/18 21:14:01 | 000,000,245 | —- | C] () – C:\Windows\game.ini
[2011/11/14 21:47:22 | 000,608,507 | —- | C] () – C:\Windows\System32\atiicdxx.dat
[2011/10/30 12:15:02 | 000,000,000 | —- | C] () – C:\Users\Gnorro\AppData\Local\{F1DD04A4-CDCE-4856-8928-729F1D9A6DF1}
[2011/09/13 01:06:16 | 000,003,917 | —- | C] () – C:\Windows\System32\atipblag.dat
[2011/07/26 17:26:48 | 000,030,568 | —- | C] () – C:\Windows\MusiccityDownload.exe
[2011/07/26 17:26:46 | 000,974,848 | —- | C] () – C:\Windows\System32\cis-2.4.dll
[2011/07/26 17:26:46 | 000,081,920 | —- | C] () – C:\Windows\System32\issacapi_bs-2.3.dll
[2011/07/26 17:26:46 | 000,065,536 | —- | C] () – C:\Windows\System32\issacapi_pe-2.3.dll
[2011/07/26 17:26:46 | 000,057,344 | —- | C] () – C:\Windows\System32\issacapi_se-2.3.dll
[2011/07/16 16:17:56 | 000,000,000 | —- | C] () – C:\Users\Gnorro\AppData\Local\{3C57C1EE-0A2B-4BDD-9FC2-BA875F75C67D}
[2011/07/16 13:35:08 | 000,000,000 | —- | C] () – C:\Users\Gnorro\AppData\Local\{9ECB4060-87E8-4B49-B26F-01DEE7CBDE4B}
[2011/07/13 23:28:06 | 000,000,000 | —- | C] () – C:\Users\Gnorro\AppData\Local\{699843D5-5BB0-4E63-B969-284AB1A9DEF3}
[2011/07/03 22:06:35 | 011,120,640 | —- | C] () – C:\Users\Gnorro\AppData\Roaming\Sandra.mdb
[2011/06/29 21:31:34 | 000,013,216 | —- | C] () – C:\Windows\System32\drivers\ASACPI.sys
[2011/05/20 22:35:28 | 000,304,744 | —- | C] () – C:\Windows\System32\nvStreaming.exe
[2011/02/27 13:18:40 | 000,000,306 | —- | C] () – C:\Windows\ODBC.INI
[2011/02/23 22:58:46 | 000,080,896 | —- | C] () – C:\Windows\System32\RDVGHelper.exe
[2011/02/23 22:57:58 | 000,066,048 | —- | C] () – C:\Windows\System32\PrintBrmUi.exe
[2011/01/29 16:44:37 | 000,205,293 | —- | C] () – C:\Windows\hpoins39.dat.temp
[2010/12/29 20:48:58 | 000,008,704 | —- | C] () – C:\Users\Gnorro\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/12/08 11:46:11 | 000,000,703 | —- | C] () – C:\Windows\hpomdl39.dat.temp
[2010/11/22 21:30:22 | 000,024,576 | —- | C] () – C:\Windows\System32\AsIO.dll
[2010/11/22 21:30:22 | 000,011,296 | —- | C] () – C:\Windows\System32\drivers\AsIO.sys
[2010/11/22 21:30:19 | 000,011,832 | —- | C] () – C:\Windows\System32\drivers\AsInsHelp64.sys
[2010/11/22 21:30:19 | 000,010,216 | —- | C] () – C:\Windows\System32\drivers\AsInsHelp32.sys
[2010/10/18 22:07:16 | 000,000,756 | -HS- | C] () – C:\Windows\bink32.dll
[2010/10/06 19:56:57 | 000,140,072 | —- | C] () – C:\Windows\System32\drivers\PnkBstrK.sys
[2010/10/06 19:56:57 | 000,138,056 | —- | C] () – C:\Users\Gnorro\AppData\Roaming\PnkBstrK.sys
[2010/10/06 19:56:14 | 000,280,904 | —- | C] () – C:\Windows\System32\PnkBstrB.exe
[2010/10/06 19:56:13 | 002,601,752 | —- | C] () – C:\Windows\System32\pbsvc_moh.exe
[2010/10/06 19:56:13 | 000,075,136 | —- | C] () – C:\Windows\System32\PnkBstrA.exe
[2010/09/24 20:13:59 | 000,008,192 | —- | C] () – C:\Windows\System32\srvany.exe
[2010/09/20 20:12:08 | 000,604,140 | -HS- | C] () – C:\Windows\System32\drivers\ISwift3.dat
[2010/09/19 19:13:14 | 000,205,297 | —- | C] () – C:\Windows\hpoins39.dat
[2010/09/19 19:01:12 | 000,115,369 | —- | C] () – C:\Windows\System32\drivers\klin.dat
[2010/09/19 19:01:12 | 000,097,961 | —- | C] () – C:\Windows\System32\drivers\klick.dat
[2010/09/19 00:28:21 | 000,000,056 | -H– | C] () – C:\Windows\System32\ezsidmv.dat
[2010/09/18 23:50:34 | 000,000,000 | —- | C] () – C:\Windows\nsreg.dat
[2010/09/18 20:57:24 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin
[2010/09/02 00:53:48 | 000,108,032 | —- | C] () – C:\Windows\System32\ff_vfw.dll
[2010/06/23 12:35:52 | 000,790,528 | —- | C] () – C:\Windows\System32\xvidcore.dll
[2010/06/23 12:35:52 | 000,134,144 | —- | C] () – C:\Windows\System32\xvidvfw.dll

========== LOP Check ==========

[2010/09/19 19:38:35 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\Acoustica
[2011/09/26 21:25:45 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\avidemux
[2011/03/14 22:02:00 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\BitTorrent
[2010/12/08 12:51:58 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\Business Objects
[2010/10/02 19:00:01 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\Canneverbe Limited
[2010/10/18 22:18:41 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\DAEMON Tools Pro
[2012/06/10 14:48:32 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\Dropbox
[2011/06/19 12:05:50 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\eMule AdunanzA
[2012/06/18 16:29:12 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\FileZilla
[2010/09/20 20:33:04 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\Foxit Software
[2012/04/01 12:43:07 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\GetRightToGo
[2012/05/03 21:23:33 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\Hausqyw
[2012/02/08 21:27:01 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\IrfanView
[2011/02/08 19:51:25 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\Leadertech
[2010/09/25 14:30:53 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\LucasArts
[2010/12/02 00:00:43 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\Megaupload
[2012/03/31 14:43:43 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\Mipony
[2010/11/14 14:54:48 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\Notepad++
[2011/11/02 23:52:24 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\Origin
[2012/01/12 23:08:09 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\Passware
[2012/04/01 18:19:22 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\RobotSoft
[2011/08/29 19:13:11 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\Samsung
[2012/05/13 19:29:22 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\SQLyog
[2010/12/15 01:23:39 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\Subversion
[2011/12/17 19:37:40 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\TeamViewer
[2012/05/27 09:42:24 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\TestApp
[2012/01/12 22:52:27 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\Thinstall
[2010/09/18 23:50:33 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\Thunderbird
[2010/10/18 22:36:16 | 000,000,000 | –SD | M] – C:\Users\Gnorro\AppData\Roaming\Virtual CD v10
[2010/10/05 22:20:13 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\Win7codecs
[2012/05/03 22:56:41 | 000,000,000 | —D | M] – C:\Users\Gnorro\AppData\Roaming\Xeo
[2012/05/11 10:51:57 | 000,032,556 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



< End of report >
Post #39
Hi lukem,

Windows.7.LXE.3.503, BOX_KTR_v2.5A.exe, 180_Days_Locker_By_Hoxygen92.exe


What are these used for?

Download CKScanner by askey127 from Here & save it to your Desktop.
  • Right-click and Run as Administrator CKScanner.exe then click Search For Files
  • When the cursor hourglass disappears, click Save List To File
  • A message box will verify the file saved
  • Double-click the CKFiles.txt icon on your desktop then copy/paste the contents in your next reply
Post #40
They are crack for W7 and office This is the log: CKScanner - Additional Security Risks - These are not necessarily bad scanner sequence 3.MN.11.SFAPDG —– EOF —–
Post #41 last edited
Hi lukem,

Until you remove the program and legally valiate Windows7 I will not be able to assist you any further.

We do not support the use of illegal Pirated/Warez/Cracked software.

Helping a person who insists on using such software, could be construed in the eyes of the law to be aiding and abetting a crime. Therefore you will be asked to remove any cracked programs and in the case of your operating system, to obtain a valid licensed copy.

http://forums.whatthetech.com/index.php?showtopic=92526
Post #42
Hi oldman To be honest the problem with virus was on my work pc where I have a license for windows and office. I have those files for my home pc. It's ok If i delete them? thanks
Post #43
Hi lukem,

Next, Double click on OTL.exe
  • Under the Custom Scans/Fixes box at the bottom, paste in the following
  • Do Not copy the word CODE
  • please note the fix starts with the :
:Services

:Files
C:\Users\Gnorro\Documents\Windows.7.LXE.3.503\w7lxe.exe 
F:\Documenti\Windows.7.LXE.3.503\w7lxe.exe
f:\downloads\Programmi\Office2010\180_Days_Locker_By_Hoxygen92.exe
F:\downloads\Programmi\Office2010\mini-KMS_Activator_v1.2_Office2010_VL_ENG_FIXED.exe
F:\downloads\Programmi\Office2010\180_Days_Locker_By_Hoxygen92\Attivazione Automatica Office\KMS.exe
F:\downloads\Programmi\W7\Windows.7.LXE.3.503\w7lxe.exe
F:\Programmi\kaspersky\BOX_KTR_v2.5A.exe 

:Commands
[emptytemp]
[createrestorepoint]

Then click the Run Fix button at the top
  • Let the program run unhindered
  • Please save the resulting log to be posted in your next reply.
  • Reboot your computer
Please post the OTL fix log.
Post #44
All processes killed ========== SERVICES/DRIVERS ========== ========== FILES ========== C:\Users\Gnorro\Documents\Windows.7.LXE.3.503\w7lxe.exe moved successfully. F:\Documenti\Windows.7.LXE.3.503\w7lxe.exe moved successfully. f:\downloads\Programmi\Office2010\180_Days_Locker_By_Hoxygen92.exe moved successfully. F:\downloads\Programmi\Office2010\mini-KMS_Activator_v1.2_Office2010_VL_ENG_FIXED.exe moved successfully. F:\downloads\Programmi\Office2010\180_Days_Locker_By_Hoxygen92\Attivazione Automatica Office\KMS.exe moved successfully. F:\downloads\Programmi\W7\Windows.7.LXE.3.503\w7lxe.exe moved successfully. F:\Programmi\kaspersky\BOX_KTR_v2.5A.exe moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Classic .NET AppPool ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Flash cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: DefaultAppPool ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Gnorro ->Temp folder emptied: 26054100 bytes ->Temporary Internet Files folder emptied: 21508646 bytes ->Java cache emptied: 1398268 bytes ->FireFox cache emptied: 1126645530 bytes ->Google Chrome cache emptied: 437868088 bytes ->Flash cache emptied: 13427 bytes User: Public ->Temp folder emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 8450036 bytes RecycleBin emptied: 783 bytes Total Files Cleaned = 1.547,00 mb Restore point Set: OTL Restore Point OTL by OldTimer - Version 3.2.53.0 log created on 06302012_181009 Files\Folders moved on Reboot… File\Folder C:\Windows\temp\hsperfdata_GNORRO-PC$\2252 not found! PendingFileRenameOperations files… File C:\Windows\temp\hsperfdata_GNORRO-PC$\2252 not found! Registry entries deleted on Reboot…

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI