Spyware / Malware / Virus Removal

SEARCHQU [Solved]

17 min read

Looking for the outcome? Ask AI

jeffce

Post #16June 26, 2012, 7:32 PM UTC

Hi,

Please download Malwarebytes' Anti-Malware to your desktop.

Right-click and Run as Administrator mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan as shown below.

[external image: Posted Image]
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.

The log can also be found here:
C:\Documents and Settings\\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
———-

Please run a free online scan with the ESET Online Scanner
Note: You will need to use Internet Explorer for this scan

Tick the box next to YES, I accept the Terms of Use
Click Start
When asked, allow the ActiveX control to install
Click Start
Make sure that the options Remove found threats is NOT selected and the option Scan unwanted applications is selected.
Click Scan (This scan can take several hours, so please be patient)
Once the scan is completed, you may close the window
Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
Copy and paste that log as a reply to this topic

———-

In your next reply please post the logs made by Malwarebytes and ESET online scan.

SuperQvas

Post #17June 26, 2012, 9:13 PM UTC

Malwarebytes Anti-Malware (Prova) 1.61.0.1400 www.malwarebytes.org Versione database: v2012.06.26.08 Windows 7 x64 NTFS Internet Explorer 9.0.8112.16421 vaio :: NB_EB4B4E [amministratore] Protezione: Disattivata 26/06/2012 21:38:36 mbam-log-2012-06-26 (21-38-36).txt Tipo di scansione: Scansione veloce Opzioni di scansione attive: Memoria | Esecuzione automatica | Registro | File system | Euristica/Extra | Euristica/Shuriken | PUP | PUM Opzioni di scansione disattivate: P2P Elementi esaminati: 212558 Tempo impiegato: 2 minuti, 13 secondi Processi rilevati in memoria: 0 (non sono stati rilevati elementi nocivi) Moduli di memoria rilevati: 0 (non sono stati rilevati elementi nocivi) Chiavi di registro rilevate: 0 (non sono stati rilevati elementi nocivi) Valori di registro rilevati: 0 (non sono stati rilevati elementi nocivi) Voci rilevate nei dati di registro: 0 (non sono stati rilevati elementi nocivi) Cartelle rilevate: 0 (non sono stati rilevati elementi nocivi) File rilevati: 0 (non sono stati rilevati elementi nocivi) (fine) ESETSmartInstaller@High as CAB hook log: OnlineScanner64.ocx - registred OK OnlineScanner.ocx - registred OK # version=7 # iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330) # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=7ccf72b2c1dac246a3ce6cd38a6c97ba # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2012-06-26 08:55:52 # local_time=2012-06-26 10:55:52 (+0100, ora legale Europa occidentale) # country="Italy" # lang=1033 # osver=6.1.7600 NT # compatibility_mode=512 16777215 100 0 0 0 0 0 # compatibility_mode=2560 16777215 100 0 0 0 0 0 # compatibility_mode=5893 16776574 100 94 18353 92370857 0 0 # compatibility_mode=8199 22379965 100 76 11769 45739851 0 0 # scanned=176694 # found=1 # cleaned=0 # scan_time=3145 # nod_component=V3 Build:0x30000000 C:\Windows\AutoKMS.exe Win32/HackKMS application (unable to clean) 00000000000000000000000000000000 I

jeffce

Post #18June 26, 2012, 11:10 PM UTC

Download CKScanner by askey127 from Here & save it to your Desktop.

Right-click and Run as Administrator CKScanner.exe then click Search For Files
When the cursor hourglass disappears, click Save List To File
A message box will verify the file saved
Double-click the CKFiles.txt icon on your desktop then copy/paste the contents in your next reply

———-

SuperQvas

Post #19June 27, 2012, 3:56 PM UTC

CKScanner - Additional Security Risks - These are not necessarily bad c:\program files (x86)\adobe\adobe dreamweaver cs5.5\configuration\taglibraries\html\keygen.vtm c:\program files (x86)\jdownloader\jd\plugins\hoster\crackedcom.class c:\smartdraw 2010\sd2010.keygen.exe c:\users\public\documents\keygen.exe c:\users\vaio\desktop\atomic email hunter 3.50\double click for reg entries\crack.reg scanner sequence 3.EM.11.DLNARH —– EOF —–

jeffce

Post #20June 27, 2012, 4:03 PM UTC

CKScanner has detected illegal software on your system. Besides being illegal, it's the number one way of infecting your system as all cracked/keygen software is infected. This forum, as well as all the other malware removal forums, do not support the use of illegal software except for their removal. If I were to continue helping you with illegal software installed, it could be construed in the eyes of the law as aiding and abetting a crime. I have worked up a fix for their removal. If you do not agree to this then this thread will be closed and no further help will be offered because I will never be able to tell you your malware logs are clean. Please let me know if you wish to continue.

SuperQvas

Post #21June 27, 2012, 4:13 PM UTC

let's keep going on!

jeffce

Post #22June 27, 2012, 4:45 PM UTC

Hi,

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

ClearJavaCache::

File::
C:\Windows\AutoKMS.exe
c:\program files (x86)\adobe\adobe dreamweaver cs5.5\configuration\taglibraries\html\keygen.vtm
c:\program files (x86)\jdownloader\jd\plugins\hoster\crackedcom.class
c:\smartdraw 2010\sd2010.keygen.exe
c:\users\public\documents\keygen.exe
c:\users\vaio\desktop\atomic email hunter 3.50\double click for reg entries\crack.reg

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
———-

SuperQvas

Post #23June 27, 2012, 5:33 PM UTC

ComboFix 12-06-26.01 - vaio 27/06/2012 19:08:46.5.4 - x64 Microsoft Windows 7 Home Premium 6.1.7600.0.1252.39.1040.18.3758.2051 [GMT 2:00] Eseguito da: c:\users\vaio\Desktop\ComboFix.exe Opzioni usate :: c:\users\vaio\Desktop\CFScript.txt AV: ESET NOD32 Antivirus 4.2 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1} SP: ESET NOD32 Antivirus 4.2 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Resident AV is active . . FILE :: "c:\program files (x86)\adobe\adobe dreamweaver cs5.5\configuration\taglibraries\html\keygen.vtm" "c:\program files (x86)\jdownloader\jd\plugins\hoster\crackedcom.class" "c:\smartdraw 2010\sd2010.keygen.exe" "c:\users\public\documents\keygen.exe" "c:\users\vaio\desktop\atomic email hunter 3.50\double click for reg entries\crack.reg" "c:\windows\AutoKMS.exe" . . ((((((((((((((((((((((((((((((((((((( Altre eliminazioni ))))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files (x86)\adobe\adobe dreamweaver cs5.5\configuration\taglibraries\html\keygen.vtm c:\program files (x86)\jdownloader\jd\plugins\hoster\crackedcom.class c:\smartdraw 2010\sd2010.keygen.exe c:\users\public\documents\keygen.exe c:\users\vaio\AppData\Local\Temp\c25e8b3d-33a7-42bf-85e6-6880c6753136\CliSecureRT.dll c:\users\vaio\desktop\atomic email hunter 3.50\double click for reg entries\crack.reg c:\windows\AutoKMS.exe . . ((((((((((((((((((((((((( Files Creati Da 2012-05-27 al 2012-06-27 ))))))))))))))))))))))))))))))))))) . . 2012-06-27 17:14 . 2012-06-27 17:14 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-06-26 19:49 . 2012-06-26 19:49 ——– d—–w- c:\program files (x86)\ESET 2012-06-26 19:37 . 2012-06-26 19:37 ——– d—–w- c:\program files (x86)\Malwarebytes' Anti-Malware 2012-06-26 19:37 . 2012-04-04 13:56 24904 —-a-w- c:\windows\system32\drivers\mbam.sys 2012-06-26 10:16 . 2012-06-26 10:16 ——– d—–w- c:\users\vaio\AppData\Roaming\PC Cleaners 2012-06-26 10:16 . 2012-06-26 10:16 ——– d—–w- c:\users\vaio\AppData\Roaming\PCPro 2012-06-26 10:16 . 2012-06-26 10:16 4446520 —-a-w- c:\windows\uninst.exe 2012-06-26 10:16 . 2012-06-26 10:16 ——– d—–w- c:\programdata\PC1Data 2012-06-26 09:38 . 2012-05-31 04:04 9013136 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{BCD702F2-1ED6-4347-B583-1F66521B0D09}\mpengine.dll 2012-06-25 21:24 . 2012-06-25 21:24 ——– d—–w- c:\users\vaio\AppData\Roaming\Malwarebytes 2012-06-25 21:23 . 2012-06-25 21:23 ——– d—–w- c:\programdata\Malwarebytes 2012-06-25 21:02 . 2012-06-25 21:32 ——– d—–w- c:\program files (x86)\ZHPDiag 2012-06-25 21:02 . 2012-06-25 21:06 ——– d—–w- C:\ZHP 2012-06-21 18:04 . 2012-06-02 22:19 57880 —-a-w- c:\windows\system32\wuauclt.exe 2012-06-21 18:04 . 2012-06-02 22:19 44056 —-a-w- c:\windows\system32\wups2.dll 2012-06-21 18:04 . 2012-06-02 22:15 2622464 —-a-w- c:\windows\system32\wucltux.dll 2012-06-21 18:04 . 2012-06-02 22:19 2428952 —-a-w- c:\windows\system32\wuaueng.dll 2012-06-21 18:03 . 2012-06-02 22:19 38424 —-a-w- c:\windows\system32\wups.dll 2012-06-21 18:03 . 2012-06-02 22:19 701976 —-a-w- c:\windows\system32\wuapi.dll 2012-06-21 18:03 . 2012-06-02 22:15 99840 —-a-w- c:\windows\system32\wudriver.dll 2012-06-21 18:03 . 2012-06-02 13:19 186752 —-a-w- c:\windows\system32\wuwebv.dll 2012-06-21 18:03 . 2012-06-02 13:15 36864 —-a-w- c:\windows\system32\wuapp.exe 2012-06-19 09:53 . 2012-06-19 09:53 ——– d—–w- C:\Nuova cartella 2012-06-15 06:32 . 2012-06-15 06:32 ——– d—–w- c:\users\vaio\AppData\Local\Macromedia 2012-06-14 14:39 . 2012-04-26 05:34 76288 —-a-w- c:\windows\system32\rdpwsx.dll 2012-06-14 14:39 . 2012-04-26 05:34 149504 —-a-w- c:\windows\system32\rdpcorekmts.dll 2012-06-14 14:39 . 2012-04-26 05:28 9216 —-a-w- c:\windows\system32\rdrmemptylst.exe 2012-06-14 14:39 . 2012-05-02 05:32 208896 —-a-w- c:\windows\system32\profsvc.dll 2012-06-14 14:39 . 2012-05-04 10:52 5505392 —-a-w- c:\windows\system32\ntoskrnl.exe 2012-06-14 14:39 . 2012-05-04 10:08 3902320 —-a-w- c:\windows\SysWow64\ntoskrnl.exe 2012-06-14 14:39 . 2012-05-04 10:08 3958128 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe 2012-06-14 14:39 . 2012-04-07 12:18 3213824 —-a-w- c:\windows\system32\msi.dll 2012-06-14 14:38 . 2012-04-07 11:34 2342400 —-a-w- c:\windows\SysWow64\msi.dll 2012-06-14 14:38 . 2012-04-28 03:50 204800 —-a-w- c:\windows\system32\drivers\rdpwd.sys 2012-06-14 14:38 . 2012-05-15 01:32 3144192 —-a-w- c:\windows\system32\win32k.sys 2012-06-14 14:38 . 2012-04-24 05:59 182272 —-a-w- c:\windows\system32\cryptsvc.dll 2012-06-14 14:38 . 2012-04-24 05:59 1460224 —-a-w- c:\windows\system32\crypt32.dll 2012-06-14 14:38 . 2012-04-24 05:59 140288 —-a-w- c:\windows\system32\cryptnet.dll 2012-06-14 14:38 . 2012-04-24 04:47 139264 —-a-w- c:\windows\SysWow64\cryptsvc.dll 2012-06-14 14:38 . 2012-04-24 04:47 1156608 —-a-w- c:\windows\SysWow64\crypt32.dll 2012-06-14 14:38 . 2012-04-24 04:47 103936 —-a-w- c:\windows\SysWow64\cryptnet.dll 2012-06-13 20:28 . 2012-06-13 21:05 ——– d—–w- C:\ExchangeSetupLogs 2012-06-05 17:48 . 2012-06-05 17:49 ——– d—–w- c:\program files (x86)\Monster Of The Deep 2012-06-05 08:29 . 2012-06-19 08:51 ——– d—–w- c:\users\vaio\AppData\Roaming\deluge 2012-06-05 08:28 . 2012-06-05 08:29 ——– d—–w- c:\program files (x86)\Deluge . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-06-23 15:21 . 2012-04-13 06:48 426184 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-06-23 15:21 . 2011-06-01 16:52 70344 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-03-30 11:09 . 2012-05-08 20:46 1895280 —-a-w- c:\windows\system32\drivers\tcpip.sys . . ((((((((((((((((((((((((((((( SnapShot@2012-06-26_15.02.42 ))))))))))))))))))))))))))))))))))))))))) . - 2009-07-14 04:54 . 2012-06-26 15:01 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-07-14 04:54 . 2012-06-27 17:14 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2012-06-26 10:46 . 2012-06-26 15:01 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2012-06-26 10:46 . 2012-06-27 17:14 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-07-14 04:54 . 2012-06-27 17:14 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-07-14 04:54 . 2012-06-26 15:01 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2011-02-06 14:56 . 2012-06-26 14:46 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2011-02-06 14:56 . 2012-06-27 16:44 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-07-14 04:54 . 2012-06-27 16:44 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-07-14 04:54 . 2012-06-26 14:46 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2010-10-12 16:34 . 2012-06-26 15:01 1956 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Bluetooth\bthservsdp.dat + 2010-10-12 16:34 . 2012-06-27 17:14 1956 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Bluetooth\bthservsdp.dat + 2012-06-27 17:15 . 2012-06-27 17:15 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2012-06-26 15:01 . 2012-06-26 15:01 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2012-06-26 15:01 . 2012-06-26 15:01 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2012-06-27 17:15 . 2012-06-27 17:15 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2011-02-06 23:50 . 2012-06-27 16:46 698804 c:\windows\system32\perfh010.dat - 2011-02-06 23:50 . 2012-06-26 14:48 698804 c:\windows\system32\perfh010.dat + 2009-07-14 02:36 . 2012-06-27 16:46 616242 c:\windows\system32\perfh009.dat - 2009-07-14 02:36 . 2012-06-26 14:48 616242 c:\windows\system32\perfh009.dat - 2011-02-06 23:50 . 2012-06-26 14:48 127998 c:\windows\system32\perfc010.dat + 2011-02-06 23:50 . 2012-06-27 16:46 127998 c:\windows\system32\perfc010.dat - 2009-07-14 02:36 . 2012-06-26 14:48 106622 c:\windows\system32\perfc009.dat + 2009-07-14 02:36 . 2012-06-27 16:46 106622 c:\windows\system32\perfc009.dat - 2011-02-06 14:56 . 2012-06-26 14:46 163840 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2011-02-06 14:56 . 2012-06-27 16:44 163840 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2012-06-20 18:05 . 2012-06-26 15:01 503144 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2012-06-20 18:05 . 2012-06-27 17:14 503144 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2012-06-20 18:05 . 2012-06-27 17:14 8947476 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3564337256-1403246104-864991456-1000-8192.dat + 2009-07-14 02:34 . 2012-06-27 15:47 10485760 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT - 2009-07-14 02:34 . 2012-06-26 14:57 10485760 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT . ((((((((((((((((((((((((((((((((((((( Punti Reg Caricati )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* i valori vuoti & legittimi/default non sono visualizzati. REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088] "KiesHelper"="c:\program files (x86)\Samsung\Kies\KiesHelper.exe" [2012-05-04 955792] "KiesPDLR"="c:\program files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2012-05-04 21392] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "!SearchquFFHP"="c:\windows\system32\RUNDLL32.EXE" [2009-07-14 44544] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "SHTtray.exe"="c:\program files (x86)\Common Files\Sony Shared\SOHLib\SHTtray.exe" [2010-06-20 99696] "SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096] "KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2012-05-04 3521424] "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2010-6-9 1128224] Google Calendar Sync.lnk - c:\program files (x86)\Google\Google Calendar Sync\GoogleCalendarSync.exe [2011-4-8 542264] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "mixer2"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~2\AVG\AVG10\avgchsva.exe /sync\0c:\progra~2\AVG\AVG10\avgrsa.exe /sync /restart\0OODBS . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-23 250056] R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [x] R3 GRemoteBus;GRemote virtual joystick Bus Enumerator;c:\windows\system32\DRIVERS\GRemoteBus64.sys [x] R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184] R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [x] R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096] R3 TFsExDisk;TFsExDisk;c:\windows\System32\Drivers\TFsExDisk.sys [x] R3 VBTUSB;VBTUSB.Sys VAIO Bluetooth Driver over USB device;c:\windows\system32\Drivers\VBTUSB.sys [x] R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [2011-02-18 99104] R3 WatAdminSvc;Servizio Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [x] R3 WMZuneComm;Zune Windows Mobile Connectivity Service;c:\program files\Zune\WMZuneComm.exe [2011-08-05 306400] R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files (x86)\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2008-07-10 47128] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184] S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x] S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2011-01-14 810144] S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [x] S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408] S2 nlsX86cc;NLS Service;c:\windows\SysWOW64\NLSSRV32.EXE [2011-01-12 68928] S2 OODefragAgent;O&O; Defrag;c:\program files\OO Software\Defrag\oodag.exe [2011-09-18 3271496] S2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [2010-10-01 632792] S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [2010-11-26 398176] S2 rimspci;rimspci;c:\windows\system32\drivers\rimssne64.sys [x] S2 risdsnpe;risdsnpe;c:\windows\system32\drivers\risdsne64.sys [x] S2 SOHCImp;VAIO Media plus Content Importer;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [2010-06-20 108400] S2 SOHDms;VAIO Media plus Digital Media Server;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe [2010-06-18 423280] S2 SOHDs;VAIO Media plus Device Searcher;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [2010-06-20 67952] S2 uCamMonitor;CamMonitor;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [2008-09-18 104960] S2 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-05-28 2320920] S2 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe [2010-06-21 575856] S2 VCFw;VAIO Content Folder Watcher;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2011-01-20 887000] S2 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2011-05-19 549616] S2 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [2010-06-09 384880] S2 VSNService;VSNService;c:\program files\Sony\VAIO Smart Network\VSNService.exe [2010-06-08 836608] S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys [x] S3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys [x] S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x] S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x] S3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys [x] S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x] S3 NETw5s64;Driver scheda Intel® Wireless WiFi Link 5000 Series per Windows 7 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [x] S3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys [x] S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\DRIVERS\SFEP.sys [x] S3 SpfService;VAIO Entertainment Common Service;c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe [2011-01-20 286936] S3 VCService;VCService;c:\program files\Sony\VAIO Care\VCService.exe [2011-02-14 44736] S3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update Common\VUAgent.exe [2012-01-13 1256040] S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x] . . Contenuto della cartella 'Scheduled Tasks' . 2012-06-27 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-13 15:21] . 2012-06-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3564337256-1403246104-864991456-1000Core.job - c:\users\vaio\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-18 13:33] . 2012-06-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3564337256-1403246104-864991456-1000UA.job - c:\users\vaio\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-18 13:33] . 2012-06-27 c:\windows\Tasks\RMSchedule.job - c:\program files (x86)\Registry Mechanic\RegMech.exe [2011-11-04 16:05] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-06-24 161304] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-06-24 386584] "Persistence"="c:\windows\system32\igfxpers.exe" [2010-06-24 413208] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-05-31 10775584] "RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2010-05-31 2040352] "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2011-12-23 2918656] "OODefragTray"="c:\program files\OO Software\Defrag\oodtray.exe" [2011-09-18 3993416] "KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2012-05-04 3521424] . ——- Scansione supplementare ——- . uStart Page = hxxp://www.google.com.do/ IE: E&sporta; in Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000 IE: Extract e-mail addresses IE: Google Sidewiki… IE: I&nvia; a OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105 TCP: DhcpNameServer = [removed] [removed] . . ——————— CHIAVI DI REGISTRO BLOCCATE ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\ESET\ESET Security\CurrentVersion\Info] @Denied: (2) (LocalSystem) "AppDataDir"="c:\\ProgramData\\ESET\\ESET NOD32 Antivirus\\" "DataDir"="ESET\\ESET NOD32 Antivirus\\" "EditionName"=" " "InstallDir"="c:\\Program Files\\ESET\\ESET NOD32 Antivirus\\" "LanguageId"=dword:00000410 "PackageTag"=dword:00000000 "ProductBase"=dword:00000000 "ProductCode"="{E6AF0EB3-0945-431F-919E-6826C969AA84}" "ProductName"="ESET NOD32 Antivirus" "ProductType"="eav" "ProductVersion"="4.2.71.3" "UniqueId"="00592B264EF5040F" "ScannerBuild"=dword:00001dd3 "ScannerVersionId"=dword:000015fe "ScannerVersion"="ready" "ei2"=hex(

:58,cf,fc,46,b5,b2,38,70 "ei1"=hex(

:78,84,3c,cc,61,35,00,00 "ei3"=hex(

:7d,04,f5,4e,00,00,00,00 "ei4"=dword:00000000 "FixId"=dword:00000009 . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System*] "OODEFRAG15.00.00.01PROFESSIONAL"="AEAF1ADEE5DE6C3445EDEA2460BB66387BB72696E7CE70F9FA27B15974733E247A07F66420E 75DA07C834742FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC 9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B98085D575E7D6A3B98088EDD5E5BE2F6E6675D575 E7D6A3B9808D259E42D773D84900C1FDB7C2D56980ED62A73B0BF4B8C9C258D205821E1CA5EFB7EFB EE9435C2AE48C60217F5EB56628FB421694CFA1125EC2B9BD32EF4B05DD73EB589F76E7AA0485ABB7 E4EF1E93D1FFDCBF7737F254F6288FCAA6D20C368498DCAE9778A6CC19DC85562C751B90BE011786E 252B7338CF65A170CABF17EB28080C421C8BAF71CB273735A857013AA71ABE9F04B37CFE732A76F66 68F8DDB3EEB5C0923592C90C9AC582FEBB2CD40B6E9CD23E7B194C87F5E7DDA95B3E02D4C9CB1F87E 3FA1088534434B40F80392C6F46656DCA3633F9A32CC76DFB11DD804A01A8F546C2041DD3F1AC708A 157AE06D45D5822E8640EDCF511EC82F4A45D0C23320F7D748EA9A67111A85A0B561416C59B0E2A49 6666D52084226E4BAA3B7FF2AEFC08CFA636A712EFB401F25E450A2920209E6D8E7C074AFC3F47E53 979EE83D62534D7F5DC1E8D12F67AFE21CA6D057A795962540967B25F3265DD2CA1DB6A849478CC5D 17B9736ABEF8B7A7AF3B7F50CA6A180449DF3B252CD6AB3340BEE4A99D7F5393649EF77A9F648ACA0 4E4675C0895E6BCFC4E695DA1D9ADD5E6804FC6562470A2C8E372DB70D5453A5BCE2E69E9D0867169 05672BCBE5276A2D812E74987A1268C7965FBACB1C1F78CD5466DAEC4A16EBD7CA04C328203E202A9 5275E024785166F35DED6113BAE5CF6404B25CF60144613D82FF0F7E7FC757E0207C377827FB1CB36 3406E4E7EF1075D338D0172667F0ED5D0012C04CD14048823AF51C5B9714707FC62E2C0D4593ECC4A FFC8BE259AF3BFAB01ACA1290A8B0C7D55F5B33476C74EDA44D14C8F1B9873C555939929799D4C61E 8DA2326DAC5F7110F8639FEFBBF2D1FAF3096F9E276DD772ABEF65341B16CACB861CD8839B8119435 2A6E9D45809EE2045C106D5D851A6F24DC43EA27561865DB5C8E5D21BCAC8EE8F5A0F9CEA5A7C0B79 33480B1DE42F692C0F34BEB99AEA1FDA056F3B24EE80B5E678C1D2730D28565D18A3121660E90AC76 A1443502A5DFD4E6B3D058328B25E2541E5E6414C11C352F13AA1BA7FC4ADB7375CD3F6FC398BF85F CA5A59B4C5D3283496AC7BC5CAB6C980635756029E52239AC0F43C83CA7D5805CAC79AD694A5E31A2 1DB9BAD5DB6CECE2AB287ABCF96C87C298F82B2D62E014420428F51EF065FFA860E6E3A46EFFC244C 1941C21E40F808B0F18302109B984C639F567199CB36A5FB44182574B18313BC534995C83919AE27C C4AEFA367D70EE1195F0248F2962C" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ———————— Altri processi in esecuzione ———————— . c:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe c:\program files (x86)\Sony\VAIO Event Service\VESMgr.exe c:\windows\SysWOW64\DllHost.exe c:\program files (x86)\Sony\VAIO Event Service\VESMgrSub.exe c:\windows\SysWOW64\RunDll32.exe c:\program files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe c:\program files\Sony\VAIO Personalization Manager\VpmLM.exe . ************************************************************************** . Ora fine scansione: 2012-06-27 19:21:29 - Il pc è stato riavviato ComboFix-quarantined-files.txt 2012-06-27 17:21 ComboFix2.txt 2012-06-26 19:24 ComboFix3.txt 2012-06-26 18:14 ComboFix4.txt 2012-06-26 15:09 . Pre-Run: 229.539.016.704 byte disponibili Post-Run: 229.452.693.504 byte disponibili . - - End Of File - - 76329B342F560C09BC608592C7904B5A

jeffce

Post #24June 27, 2012, 5:36 PM UTC

Hi, Thanks for posting that. How is your system running?

SuperQvas

Post #25June 27, 2012, 5:57 PM UTC

Hi Jeff, the problem's still there :(. I'm sending you a screenshot of what I am dealing with.

Attachments:

📎Nuova_immagine.bmp

jeffce

Post #26June 27, 2012, 6:39 PM UTC

Ok..

Download OTL to your desktop.
Right-click and Run as Administrator on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

———-

SuperQvas

Post #27June 27, 2012, 6:53 PM UTC

OTL logfile created on: 27/06/2012 20:44:46 - Run 6
OTL by OldTimer - Version 3.2.53.0 Folder = C:\Users\vaio\Desktop
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000410 | Country: Italia | Language: ITA | Date Format: dd/MM/yyyy

3,67 Gb Total Physical Memory | 2,05 Gb Available Physical Memory | 55,86% Memory free
7,34 Gb Paging File | 5,46 Gb Available in Paging File | 74,45% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 287,59 Gb Total Space | 213,80 Gb Free Space | 74,34% Space Free | Partition Type: NTFS

Computer Name: NB_EB4B4E | User Name: vaio | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\vaio\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
PRC - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Programmi\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Google\Google Calendar Sync\GoogleCalendarSync.exe (Google)
PRC - C:\Programmi\Sony\VAIO Care\VCService.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe (Sony Corporation)
PRC - C:\Programmi\ESET\ESET NOD32 Antivirus\x86\ekrn.exe (ESET)
PRC - C:\Windows\SysWOW64\NLSSRV32.EXE (Nalpeiron Ltd.)
PRC - C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe (PC Tools)
PRC - C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SHTtray.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe (Sony Corporation)
PRC - C:\Programmi\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe (Sony Corporation)
PRC - C:\Programmi\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe (Broadcom Corporation.)
PRC - C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
PRC - C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe (ArcSoft, Inc.)

========== Modules (No Company Name) ==========

MOD - C:\Users\vaio\AppData\Local\Temp\c25e8b3d-33a7-42bf-85e6-6880c6753136\CliSecureRT.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\d239f585ee55f833dbe21e897e1265ac\PresentationFramework.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\b7de318e9fd1ef519ca6c1f3b5dba8e0\PresentationCore.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\00a4922fbf869a79c043b665035516b6\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\a6e37a05b8d0cedbc5c3ea266ae3fc31\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\4230ed1c7990e4ee8352baf67a2a85fa\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\d0e1cdaff8f9055187f8e7b52c060dff\System.Management.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\31fab24c51c0cfe8b8115f24545f169f\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\b68bee05c7e518172982cc92059c3315\System.Xaml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\608d29d7cc89f3a9a195c91354561915\PresentationFramework.Aero.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\09bd2126bba2ab4f29ed52afde1470d7\System.Core.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\9abe44a0f82070ead5f1256683a4d25a\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System\a6be120e49f895ef6b00e9918402395b\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\c1af4ec9a36f671617a8ecaec00373f4\mscorlib.ni.dll ()
MOD - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()

========== Win32 Services (SafeList) ==========

SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MBAMService) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (VUAgent) – C:\Programmi\Sony\VAIO Update Common\VUAgent.exe (Sony Corporation)
SRV - (OODefragAgent) – C:\Programmi\OO Software\Defrag\oodag.exe (O&O; Software GmbH)
SRV - (ZuneWlanCfgSvc) – c:\Programmi\Zune\ZuneWlanCfgSvc.exe (Microsoft Corporation)
SRV - (WMZuneComm) – c:\Programmi\Zune\WMZuneComm.exe (Microsoft Corporation)
SRV - (ZuneNetworkSvc) – c:\Programmi\Zune\ZuneNss.exe (Microsoft Corporation)
SRV - (VcmIAlzMgr) – C:\Programmi\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe (Sony Corporation)
SRV - (KMService) – C:\Windows\SysWOW64\srvany.exe ()
SRV - (VcmXmlIfHelper) – C:\Programmi\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe (Sony Corporation)
SRV - (VCService) – C:\Programmi\Sony\VAIO Care\VCService.exe (Sony Corporation)
SRV - (SpfService) – C:\Programmi\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe (Sony Corporation)
SRV - (VCFw) – C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe (Sony Corporation)
SRV - (EhttpSrv) – C:\Programmi\ESET\ESET NOD32 Antivirus\EHttpSrv.exe (ESET)
SRV - (ekrn) – C:\Programmi\ESET\ESET NOD32 Antivirus\x86\ekrn.exe (ESET)
SRV - (nlsX86cc) – C:\Windows\SysWOW64\NLSSRV32.EXE (Nalpeiron Ltd.)
SRV - (PMBDeviceInfoProvider) – C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe (Sony Corporation)
SRV - (PCToolsSSDMonitorSvc) – C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe (PC Tools)
SRV - (wlcrasvc) – C:\Programmi\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV - (wlidsvc) – C:\Programmi\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (VAIO Power Management) – C:\Programmi\Sony\VAIO Power Management\SPMService.exe (Sony Corporation)
SRV - (SOHCImp) – C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe (Sony Corporation)
SRV - (SOHDs) – C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe (Sony Corporation)
SRV - (SOHDms) – C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe (Sony Corporation)
SRV - (VcmINSMgr) – C:\Programmi\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe (Sony Corporation)
SRV - (btwdins) – C:\Programmi\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.)
SRV - (VSNService) – C:\Programmi\Sony\VAIO Smart Network\VSNService.exe (Sony Corporation)
SRV - (VAIO Event Service) – C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe (Sony Corporation)
SRV - (UNS) Intel® – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) Intel® – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (ACDaemon) – C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (EvtEng) Intel® – C:\Programmi\Intel\WiFi\bin\EvtEng.exe (Intel® Corporation)
SRV - (RegSrvc) Intel® – C:\Programmi\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel® Corporation)
SRV - (IAStorDataMgrSvc) Intel® – C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
SRV - (SwitchBoard) – C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (osppsvc) – C:\Programmi\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (uCamMonitor) – C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe (ArcSoft, Inc.)

========== Driver Services (SafeList) ==========

DRV:64bit: - (MBAMProtector) – C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (ssudmdm) SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.) – C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.) – C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (sscdmdm) – C:\Windows\SysNative\drivers\sscdmdm.sys (MCCI Corporation)
DRV:64bit: - (sscdbus) SAMSUNG USB Composite Device driver (WDM) – C:\Windows\SysNative\drivers\sscdbus.sys (MCCI Corporation)
DRV:64bit: - (sscdmdfl) – C:\Windows\SysNative\drivers\sscdmdfl.sys (MCCI Corporation)
DRV:64bit: - (pcouffin) – C:\Windows\SysNative\drivers\pcouffin.sys (VSO Software)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (eamonm) – C:\Windows\SysNative\drivers\eamonm.sys (ESET)
DRV:64bit: - (ehdrv) – C:\Windows\SysNative\drivers\ehdrv.sys (ESET)
DRV:64bit: - (epfwwfpr) – C:\Windows\SysNative\drivers\epfwwfpr.sys (ESET)
DRV:64bit: - (fssfltr) – C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)
DRV:64bit: - (IntcDAud) Intel® – C:\Windows\SysNative\drivers\IntcDAud.sys (Intel® Corporation)
DRV:64bit: - (igfx) – C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (atikmdag) – C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (btwrchid) – C:\Windows\SysNative\drivers\btwrchid.sys (Broadcom Corporation.)
DRV:64bit: - (btwampfl) – C:\Windows\SysNative\drivers\btwampfl.sys (Broadcom Corporation.)
DRV:64bit: - (btwavdt) – C:\Windows\SysNative\drivers\btwavdt.sys (Broadcom Corporation.)
DRV:64bit: - (btwaudio) – C:\Windows\SysNative\drivers\btwaudio.sys (Broadcom Corporation.)
DRV:64bit: - (btwl2cap) – C:\Windows\SysNative\drivers\btwl2cap.sys (Broadcom Corporation.)
DRV:64bit: - (risdsnpe) – C:\Windows\SysNative\drivers\risdsne64.sys (REDC)
DRV:64bit: - (rimspci) – C:\Windows\SysNative\drivers\rimssne64.sys (REDC)
DRV:64bit: - (VBTUSB) – C:\Windows\SysNative\drivers\VBTUSB.sys (Sony Corporation)
DRV:64bit: - (ApfiltrService) – C:\Windows\SysNative\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV:64bit: - (yukonw7) – C:\Windows\SysNative\drivers\yk62x64.sys (Marvell)
DRV:64bit: - (athr) – C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (NETw5s64) Driver scheda Intel® – C:\Windows\SysNative\drivers\NETw5s64.sys (Intel Corporation)
DRV:64bit: - (Impcd) – C:\Windows\SysNative\drivers\Impcd.sys (Intel Corporation)
DRV:64bit: - (HECIx64) Intel® – C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (SFEP) – C:\Windows\SysNative\drivers\SFEP.sys (Sony Corporation)
DRV:64bit: - (iaStor) – C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (sdbus) – C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation)
DRV:64bit: - (GRemoteBus) – C:\Windows\SysNative\drivers\GRemoteBus64.sys (GBM Software)
DRV:64bit: - (TFsExDisk) – C:\Windows\SysNative\drivers\TFsExDisk.sys (Teruten Inc)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (ArcSoftKsUFilter) – C:\Windows\SysNative\drivers\ArcSoftKsUFilter.sys (ArcSoft, Inc.)
DRV:64bit: - (mcdbus) – C:\Windows\SysNative\drivers\mcdbus.sys (MagicISO, Inc.)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (mcdbus) – C:\Windows\SysWOW64\drivers\mcdbus.sys (MagicISO, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE:64bit: - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&a;…q={searchTerms}
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKLM\..\SearchScopes\{8A96AF9E-4074-43b7-BEA3-87217BDA7406}: "URL" = http://www.searchqu.com/web?src=ieb&sy;…q={searchTerms}
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&a;…q={searchTerms}
IE - HKLM\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = http://mystart.incredimail.com/?search={se…929752390932140

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com.do/
IE - HKCU\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKCU\..\SearchScopes\{479E92B7-80E2-4021-B575-10F68B79BC49}: "URL" = http://www.google.it/#hl=it&source;=hp&…fca69c98b5d77d7
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…;rlz=1I7SVEE_it
IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&a;…q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Search Results"
FF - prefs.js..browser.search.order.1: "Search Results"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.com.do/"
FF - prefs.js..keyword.URL: "http://dts.search-results.com/sr?src=ffb&appid;=394&systemid;=406&sr;=0&q;="
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_262.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.19: C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\vaio\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\vaio\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[removed]: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2011/12/24 00:43:06 | 000,000,000 | —D | M]

[2012/06/20 09:41:27 | 000,000,000 | —D | M] (No name found) – C:\Users\vaio\AppData\Roaming\mozilla\Extensions
[2012/06/20 09:41:26 | 000,000,000 | —D | M] (No name found) – C:\Users\vaio\AppData\Roaming\mozilla\Firefox\Profiles\qqfpf2rt.default\extensions
[2011/11/03 17:28:55 | 000,000,000 | —D | M] (No name found) – C:\Users\vaio\AppData\Roaming\mozilla\SeaMonkey\Profiles\ksk5md02.default\extensions
[2012/06/25 16:33:13 | 000,003,907 | —- | M] () – C:\Users\vaio\AppData\Roaming\Mozilla\Firefox\Profiles\qqfpf2rt.default\searchplugins\torrentfinderru.xml
[2012/04/11 16:00:30 | 000,120,275 | —- | M] () (No name found) – C:\USERS\VAIO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QQFPF2RT.DEFAULT\EXTENSIONS\[removed]
[2011/11/02 14:57:50 | 000,002,227 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
[2012/06/19 13:18:38 | 000,002,519 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\Search_Results.xml

========== Chrome ==========

CHR - default_search_provider: Search Results (Enabled)
CHR - default_search_provider: search_url = http://dts.search-results.com/sr?src=crb&a;…q={searchTerms}
CHR - default_search_provider: suggest_url =
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\vaio\AppData\Local\Google\Chrome\Application\19.0.1084.56\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\vaio\AppData\Local\Google\Chrome\Application\19.0.1084.56\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\vaio\AppData\Local\Google\Chrome\Application\19.0.1084.56\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\vaio\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.290.11 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U29 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
CHR - plugin: Veetle TV Player (Enabled) = C:\Program Files (x86)\Veetle\Player\npvlc.dll
CHR - plugin: Veetle TV Core (Enabled) = C:\Program Files (x86)\Veetle\plugins\npVeetle.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Google Update (Enabled) = C:\Users\vaio\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - Extension: YouTube = C:\Users\vaio\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Ricerca Google = C:\Users\vaio\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Gmail = C:\Users\vaio\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2012/06/27 19:15:23 | 000,000,027 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programmi\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programmi\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2:64bit: - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - No CLSID value found.
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4:64bit: - HKLM..\Run: [OODefragTray] C:\Programmi\OO Software\Defrag\oodtray.exe (O&O; Software GmbH)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [SHTtray.exe] C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SHTtray.exe (Sony Corporation)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [KiesHelper] C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe (Samsung)
O4 - HKCU..\Run: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - HKCU..\RunOnce: [!SearchquFFHP] C:\Windows\system32\RUNDLL32.EXE C:\Users\vaio\AppData\Local\Temp\INSTAL~1.DLL,_SetFirefoxHP http://www.searchnu.com/406, File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: E&sporta; in Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Extract e-mail addresses - Reg Error: Value error. File not found
O8:64bit: - Extra context menu item: Google Sidewiki… - Reg Error: Value error. File not found
O8:64bit: - Extra context menu item: I&nvia; a OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: E&sporta; in Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Extract e-mail addresses - Reg Error: Value error. File not found
O8 - Extra context menu item: Google Sidewiki… - Reg Error: Value error. File not found
O8 - Extra context menu item: I&nvia; a OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O9:64bit: - Extra Button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programmi\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : I&nvia; a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programmi\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: &Note; collegate di OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programmi\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : &Note; collegate di OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programmi\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra Button: Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - C:\Program Files (x86)\Evernote\Evernote3.5\enbar.dll (Evernote Corporation)
O9 - Extra 'Tools' menuitem : Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - C:\Program Files (x86)\Evernote\Evernote3.5\enbar.dll (Evernote Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programmi\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programmi\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{423D4F55-13A2-4D2E-BBDA-A1774A136043}: DhcpNameServer = 10.100.6.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A56D231E-447F-43BC-B413-876EA6E69004}: DhcpNameServer = [removed] [removed]
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programmi\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programmi\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~2\AVG\AVG10\avgchsva.exe /sync)
O34 - HKLM BootExecute: (C:\PROGRA~2\AVG\AVG10\avgrsa.exe /sync /restart)
O34 - HKLM BootExecute: (OODBS)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = ComFile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/06/27 19:50:54 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2012/06/27 19:21:32 | 000,000,000 | —D | C] – C:\Windows\temp
[2012/06/26 23:10:01 | 000,000,000 | —D | C] – C:\Users\vaio\Documents\Nuova cartella
[2012/06/26 21:49:57 | 000,000,000 | —D | C] – C:\Program Files (x86)\ESET
[2012/06/26 21:37:06 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/06/26 21:37:05 | 000,024,904 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2012/06/26 21:37:05 | 000,000,000 | —D | C] – C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012/06/26 21:36:16 | 010,063,000 | —- | C] (Malwarebytes Corporation ) – C:\Users\vaio\Desktop\mbam-setup-1.61.0.1400.exe
[2012/06/26 16:50:17 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2012/06/26 16:50:17 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2012/06/26 16:50:17 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2012/06/26 16:50:05 | 000,000,000 | —D | C] – C:\Qoobox
[2012/06/26 16:49:40 | 000,000,000 | —D | C] – C:\Windows\erdnt
[2012/06/26 16:48:09 | 004,569,417 | R— | C] (Swearware) – C:\Users\vaio\Desktop\ComboFix.exe
[2012/06/26 15:30:15 | 002,128,984 | —- | C] (Kaspersky Lab ZAO) – C:\Users\vaio\Desktop\TDSSKiller.exe
[2012/06/26 15:26:06 | 000,607,260 | R— | C] (Swearware) – C:\Users\vaio\Desktop\dds.com
[2012/06/26 15:08:03 | 004,731,392 | —- | C] (AVAST Software) – C:\Users\vaio\Desktop\aswMBR.exe
[2012/06/26 14:56:02 | 000,596,992 | —- | C] (OldTimer Tools) – C:\Users\vaio\Desktop\OTL.exe
[2012/06/26 12:16:39 | 000,000,000 | —D | C] – C:\Users\vaio\AppData\Roaming\PC Cleaners
[2012/06/26 12:16:35 | 004,446,520 | —- | C] (PC Cleaners) – C:\Windows\uninst.exe
[2012/06/26 12:16:35 | 000,000,000 | —D | C] – C:\Users\vaio\AppData\Roaming\PCPro
[2012/06/26 12:16:33 | 000,000,000 | —D | C] – C:\ProgramData\PC1Data
[2012/06/25 23:24:27 | 000,000,000 | —D | C] – C:\Users\vaio\AppData\Roaming\Malwarebytes
[2012/06/25 23:23:46 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2012/06/25 23:02:12 | 000,000,000 | —D | C] – C:\Program Files (x86)\ZHPDiag
[2012/06/25 23:02:12 | 000,000,000 | —D | C] – C:\ZHP
[2012/06/21 20:04:26 | 002,622,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wucltux.dll
[2012/06/21 20:04:26 | 000,057,880 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuauclt.exe
[2012/06/21 20:04:26 | 000,044,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wups2.dll
[2012/06/21 20:03:59 | 000,701,976 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuapi.dll
[2012/06/21 20:03:59 | 000,099,840 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wudriver.dll
[2012/06/21 20:03:59 | 000,038,424 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wups.dll
[2012/06/21 20:03:23 | 000,186,752 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuwebv.dll
[2012/06/21 20:03:23 | 000,036,864 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuapp.exe
[2012/06/19 11:53:08 | 000,000,000 | —D | C] – C:\Nuova cartella
[2012/06/15 08:32:23 | 000,000,000 | —D | C] – C:\Users\vaio\AppData\Local\Macromedia
[2012/06/14 23:46:06 | 000,096,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2012/06/14 23:46:06 | 000,073,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2012/06/14 23:46:05 | 000,237,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2012/06/14 23:46:05 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2012/06/14 23:46:04 | 000,248,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2012/06/14 23:46:04 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2012/06/14 23:46:04 | 000,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2012/06/14 23:46:04 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2012/06/14 23:46:02 | 002,311,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2012/06/14 23:46:02 | 001,494,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2012/06/14 23:46:02 | 001,427,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2012/06/14 23:46:02 | 000,716,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2012/06/14 23:46:01 | 000,818,688 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2012/06/14 16:39:12 | 000,149,504 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdpcorekmts.dll
[2012/06/14 16:39:12 | 000,076,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdpwsx.dll
[2012/06/14 16:39:12 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdrmemptylst.exe
[2012/06/14 16:39:10 | 005,505,392 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntoskrnl.exe
[2012/06/14 16:39:08 | 003,902,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntoskrnl.exe
[2012/06/14 16:39:07 | 003,958,128 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntkrnlpa.exe
[2012/06/14 16:39:00 | 003,213,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msi.dll
[2012/06/14 16:38:49 | 001,460,224 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\crypt32.dll
[2012/06/14 16:38:49 | 000,140,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\cryptnet.dll
[2012/06/13 22:28:09 | 000,000,000 | —D | C] – C:\ExchangeSetupLogs
[2012/06/05 19:48:53 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Carlton Books
[2012/06/05 19:48:49 | 000,000,000 | —D | C] – C:\Program Files (x86)\Monster Of The Deep
[2012/06/05 10:29:44 | 000,000,000 | —D | C] – C:\Users\vaio\AppData\Roaming\deluge
[2012/06/05 10:29:28 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Deluge
[2012/06/05 10:28:57 | 000,000,000 | —D | C] – C:\Program Files (x86)\Deluge
[2011/04/14 22:22:08 | 000,082,816 | —- | C] (VSO Software) – C:\Users\vaio\AppData\Roaming\pcouffin.sys

========== Files - Modified Within 30 Days ==========

[2012/06/27 20:21:00 | 000,000,978 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/06/27 19:58:32 | 000,020,032 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/06/27 19:58:32 | 000,020,032 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/06/27 19:55:07 | 001,541,618 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2012/06/27 19:55:07 | 000,698,804 | —- | M] () – C:\Windows\SysNative\perfh010.dat
[2012/06/27 19:55:07 | 000,616,242 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2012/06/27 19:55:07 | 000,127,998 | —- | M] () – C:\Windows\SysNative\perfc010.dat
[2012/06/27 19:55:07 | 000,106,622 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2012/06/27 19:54:08 | 000,223,142 | —- | M] () – C:\Users\vaio\Desktop\Nuova immagine.bmp
[2012/06/27 19:52:00 | 000,001,156 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3564337256-1403246104-864991456-1000UA.job
[2012/06/27 19:50:38 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/06/27 19:50:37 | 2955,485,184 | -HS- | M] () – C:\hiberfil.sys
[2012/06/27 19:50:35 | 000,434,775 | —- | M] () – C:\Windows\SysNative\oodbs.lor
[2012/06/27 19:15:23 | 000,000,027 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts
[2012/06/27 19:14:21 | 000,000,264 | —- | M] () – C:\Windows\tasks\RMSchedule.job
[2012/06/27 17:45:03 | 000,458,240 | —- | M] () – C:\Users\vaio\Desktop\CKScanner.exe
[2012/06/26 21:37:06 | 000,001,109 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/06/26 21:36:28 | 010,063,000 | —- | M] (Malwarebytes Corporation ) – C:\Users\vaio\Desktop\mbam-setup-1.61.0.1400.exe
[2012/06/26 16:48:53 | 004,569,417 | R— | M] (Swearware) – C:\Users\vaio\Desktop\ComboFix.exe
[2012/06/26 15:28:41 | 002,109,990 | —- | M] () – C:\Users\vaio\Desktop\tdsskiller.zip
[2012/06/26 15:26:06 | 000,607,260 | R— | M] (Swearware) – C:\Users\vaio\Desktop\dds.com
[2012/06/26 15:08:14 | 004,731,392 | —- | M] (AVAST Software) – C:\Users\vaio\Desktop\aswMBR.exe
[2012/06/26 14:56:02 | 000,596,992 | —- | M] (OldTimer Tools) – C:\Users\vaio\Desktop\OTL.exe
[2012/06/26 12:31:15 | 000,000,512 | —- | M] () – C:\Users\vaio\Desktop\MBR.dat
[2012/06/26 12:16:21 | 004,446,520 | —- | M] (PC Cleaners) – C:\Windows\uninst.exe
[2012/06/25 21:19:12 | 002,128,984 | —- | M] (Kaspersky Lab ZAO) – C:\Users\vaio\Desktop\TDSSKiller.exe
[2012/06/25 17:23:10 | 000,002,978 | —- | M] () – C:\Users\vaio\Documents\cc_20120625_172305.reg
[2012/06/23 17:21:35 | 000,426,184 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2012/06/23 17:21:35 | 000,070,344 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/06/22 09:52:00 | 000,001,104 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3564337256-1403246104-864991456-1000Core.job
[2012/06/21 20:02:14 | 005,003,208 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2012/06/19 10:52:03 | 000,006,787 | —- | M] () – C:\Users\vaio\AppData\Local\recently-used.xbel
[2012/06/11 19:20:11 | 000,003,072 | —- | M] () – C:\Windows\SysWow64\Cache.db
[2012/06/11 17:26:33 | 000,760,690 | —- | M] () – C:\test.xml
[2012/06/05 19:55:53 | 000,002,170 | —- | M] () – C:\Users\Public\Desktop\Monster Of The Deep.lnk
[2012/06/05 10:29:28 | 000,000,979 | —- | M] () – C:\Users\Public\Desktop\Deluge.lnk
[2012/06/03 00:19:46 | 000,038,424 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\wups.dll
[2012/06/03 00:19:42 | 000,057,880 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\wuauclt.exe
[2012/06/03 00:19:42 | 000,044,056 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\wups2.dll
[2012/06/03 00:19:23 | 000,701,976 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\wuapi.dll
[2012/06/03 00:15:31 | 002,622,464 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\wucltux.dll
[2012/06/03 00:15:08 | 000,099,840 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\wudriver.dll
[2012/06/02 15:19:42 | 000,186,752 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\wuwebv.dll
[2012/06/02 15:15:12 | 000,036,864 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\wuapp.exe
[2012/06/01 14:08:38 | 000,019,496 | —- | M] () – C:\Users\vaio\Desktop\Gestione Lavoro2.pdf
[2012/06/01 11:47:43 | 000,001,456 | —- | M] () – C:\Users\vaio\AppData\Local\Adobe Save for Web 12.0 Prefs

========== Files Created - No Company Name ==========

[2012/06/27 19:54:07 | 000,223,142 | —- | C] () – C:\Users\vaio\Desktop\Nuova immagine.bmp
[2012/06/27 17:45:03 | 000,458,240 | —- | C] () – C:\Users\vaio\Desktop\CKScanner.exe
[2012/06/26 21:37:06 | 000,001,109 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/06/26 16:50:17 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2012/06/26 16:50:17 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2012/06/26 16:50:17 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2012/06/26 16:50:17 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2012/06/26 16:50:17 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2012/06/26 15:28:35 | 002,109,990 | —- | C] () – C:\Users\vaio\Desktop\tdsskiller.zip
[2012/06/25 19:38:27 | 000,000,512 | —- | C] () – C:\Users\vaio\Desktop\MBR.dat
[2012/06/25 17:23:08 | 000,002,978 | —- | C] () – C:\Users\vaio\Documents\cc_20120625_172305.reg
[2012/06/21 19:59:33 | 005,003,208 | —- | C] () – C:\Windows\SysNative\FNTCACHE.DAT
[2012/06/19 10:52:03 | 000,006,787 | —- | C] () – C:\Users\vaio\AppData\Local\recently-used.xbel
[2012/06/05 19:48:54 | 000,002,170 | —- | C] () – C:\Users\Public\Desktop\Monster Of The Deep.lnk
[2012/06/05 10:29:28 | 000,000,979 | —- | C] () – C:\Users\Public\Desktop\Deluge.lnk
[2012/06/01 14:08:45 | 000,019,496 | —- | C] () – C:\Users\vaio\Desktop\Gestione Lavoro2.pdf
[2012/04/11 11:45:37 | 000,000,071 | —- | C] () – C:\Users\vaio\.emailgrabber2
[2012/03/24 17:07:13 | 000,000,132 | —- | C] () – C:\Users\vaio\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2012/03/16 01:10:47 | 001,570,074 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2012/03/01 01:32:58 | 000,013,030 | —- | C] () – C:\Users\vaio\AppData\Local\PDOXUSRS.NET
[2012/03/01 00:18:42 | 000,000,024 | —- | C] () – C:\Windows\SysWow64\sysdate.ini
[2012/02/25 12:28:16 | 000,000,000 | —- | C] () – C:\Windows\iwlufklg.dll
[2012/02/02 22:36:09 | 000,001,456 | —- | C] () – C:\Users\vaio\AppData\Local\Adobe Save for Web 12.0 Prefs
[2012/01/31 01:15:44 | 000,030,568 | —- | C] () – C:\Windows\MusiccityDownload.exe
[2012/01/31 01:15:42 | 000,974,848 | —- | C] () – C:\Windows\SysWow64\cis-2.4.dll
[2012/01/31 01:15:42 | 000,081,920 | —- | C] () – C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2012/01/31 01:15:42 | 000,065,536 | —- | C] () – C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2012/01/31 01:15:42 | 000,057,344 | —- | C] () – C:\Windows\SysWow64\issacapi_se-2.3.dll
[2011/12/29 21:30:36 | 000,001,145 | —- | C] () – C:\Windows\EVVIVARG.INI
[2011/12/29 21:17:15 | 000,000,114 | —- | C] () – C:\Windows\EvvivaLiveUpdate.ini
[2011/12/29 21:16:54 | 000,001,279 | —- | C] () – C:\Windows\ODBCINST.INI
[2011/12/24 00:01:13 | 000,196,608 | —- | C] () – C:\Windows\SysWow64\avisynth.dll
[2011/11/02 13:47:46 | 000,000,003 | —- | C] () – C:\Windows\SysWow64\krx280.dat
[2011/07/26 21:32:57 | 000,000,046 | —- | C] () – C:\Windows\PCCT.INI
[2011/04/14 22:22:08 | 000,007,859 | —- | C] () – C:\Users\vaio\AppData\Roaming\pcouffin.cat
[2011/04/14 22:22:08 | 000,001,167 | —- | C] () – C:\Users\vaio\AppData\Roaming\pcouffin.inf
[2011/04/14 18:33:24 | 000,000,036 | —- | C] () – C:\Windows\hdd.ini
[2011/04/13 15:23:00 | 000,008,192 | —- | C] () – C:\Windows\SysWow64\srvany.exe
[2011/04/09 18:55:28 | 000,179,261 | —- | C] () – C:\Windows\SysWow64\xlive.dll.cat
[2010/12/06 15:58:56 | 002,496,715 | —- | C] () – C:\Windows\SysWow64\abgx360.exe
[2010/10/12 19:30:23 | 000,208,896 | —- | C] () – C:\Windows\SysWow64\iglhsip32.dll
[2010/10/12 19:30:22 | 000,870,560 | —- | C] () – C:\Windows\SysWow64\igkrng575.bin
[2010/10/12 19:30:22 | 000,143,360 | —- | C] () – C:\Windows\SysWow64\iglhcp32.dll
[2010/10/12 19:30:21 | 000,104,636 | —- | C] () – C:\Windows\SysWow64\igfcg575m.bin
[2010/10/12 19:30:20 | 000,127,868 | —- | C] () – C:\Windows\SysWow64\igcompkrng575.bin
[2010/10/12 19:30:13 | 000,028,732 | —- | C] () – C:\Windows\SysWow64\ativvsny.dat
[2010/10/12 19:30:13 | 000,026,936 | —- | C] () – C:\Windows\SysWow64\ativvsnl.dat
[2010/10/12 19:27:41 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin

========== LOP Check ==========

[2011/11/08 20:54:08 | 000,000,000 | —D | M] – C:\Users\vaio\AppData\Roaming\abgx360
[2011/11/02 16:54:34 | 000,000,000 | —D | M] – C:\Users\vaio\AppData\Roaming\AtomPark
[2011/04/18 18:35:58 | 000,000,000 | —D | M] – C:\Users\vaio\AppData\Roaming\Auslogics
[2011/11/02 23:10:54 | 000,000,000 | —D | M] – C:\Users\vaio\AppData\Roaming\Avant Downloader
[2012/03/13 19:35:21 | 000,000,000 | —D | M] – C:\Users\vaio\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2011/12/25 17:54:51 | 000,000,000 | —D | M] – C:\Users\vaio\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
[2012/02/24 04:06:04 | 000,000,000 | —D | M] – C:\Users\vaio\AppData\Roaming\com.adobe.WidgetBrowser.E7BED6E5DDA59983786DD72EBFA46B1598278E07.1
[2011/06/30 15:55:06 | 000,000,000 | —D | M] – C:\Users\vaio\AppData\Roaming\DAEMON Tools Pro
[2012/02/27 18:43:40 | 000,000,000 | —D | M] – C:\Users\vaio\AppData\Roaming\Data Solutions
[2012/06/19 10:51:58 | 000,000,000 | —D | M] – C:\Users\vaio\AppData\Roaming\deluge
[2011/04/29 23:25:36 | 000,000,000 | —D | M] – C:\Users\vaio\AppData\Roaming\Downloaded Installations
[2011/06/09 20:20:02 | 000,000,000 | —D | M] – C:\Users\vaio\AppData\Roaming\eMule AdunanzA
[2011/05/15 22:11:12 | 000,000,000 | —D | M] – C:\Users\vaio\AppData\Roaming\FileZilla
[2011/11/08 22:35:56 | 000,000,000 | —D | M] – C:\Users\vaio\AppData\Roaming\ImgBurn
[2011/08/09 22:41:15 | 000,000,000 | —D | M] – C:\Users\vaio\AppData\Roaming\iolo
[2011/05/13 13:09:27 | 000,000,000 | —D | M] – C:\Users\vaio\AppData\Roaming\MAGIX
[2011/11/05 13:40:22 | 000,000,000 | —D | M] – C:\Users\vaio\AppData\Roaming\NetDomino
[2011/04/29 23:31:11 | 000,000,000 | —D | M] – C:\Users\vaio\AppData\Roaming\Nitro PDF
[2012/03/16 01:11:00 | 000,000,000 | —D | M] – C:\Users\vaio\AppData\Roaming\Nokia
[2011/11/09 22:03:39 | 000,000,000 | —D | M] – C:\Users\vaio\AppData\Roaming\Opera
[2012/06/26 12:16:39 | 000,000,000 | —D | M] – C:\Users\vaio\AppData\Roaming\PC Cleaners
[2012/03/15 14:25:02 | 000,000,000 | —D | M] – C:\Users\vaio\AppData\Roaming\PC Suite
[2012/06/26 12:16:40 | 000,000,000 | —D | M] – C:\Users\vaio\AppData\Roaming\PCPro
[2012/06/20 16:03:28 | 000,000,000 | —D | M] – C:\Users\vaio\AppData\Roaming\R-Wipe&Clean;
[2011/11/04 15:12:03 | 000,000,000 | —D | M] – C:\Users\vaio\AppData\Roaming\Registry Mechanic
[2012/03/27 19:06:37 | 000,000,000 | —D | M] – C:\Users\vaio\AppData\Roaming\Samsung
[2011/07/12 22:38:25 | 000,000,000 | —D | M] – C:\Users\vaio\AppData\Roaming\SmartDraw
[2012/02/03 00:40:25 | 000,000,000 | —D | M] – C:\Users\vaio\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2011/04/24 22:31:33 | 000,000,000 | —D | M] – C:\Users\vaio\AppData\Roaming\StreamTorrent
[2011/08/09 22:12:37 | 000,000,000 | —D | M] – C:\Users\vaio\AppData\Roaming\Systweak
[2012/05/11 16:39:59 | 000,000,000 | —D | M] – C:\Users\vaio\AppData\Roaming\Temp
[2012/06/05 11:05:01 | 000,000,000 | —D | M] – C:\Users\vaio\AppData\Roaming\uTorrent
[2012/02/17 19:26:15 | 000,000,000 | —D | M] – C:\Users\vaio\AppData\Roaming\VoipStunt
[2011/04/14 22:23:16 | 000,000,000 | —D | M] – C:\Users\vaio\AppData\Roaming\Vso
[2012/02/18 23:47:11 | 000,000,000 | —D | M] – C:\Users\vaio\AppData\Roaming\WebCallDirect
[2012/06/27 19:14:21 | 000,000,264 | —- | M] () – C:\Windows\Tasks\RMSchedule.job
[2012/05/28 19:28:13 | 000,032,556 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:D1B5B4F1
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:1F8C9007

< End of report >

that's the only one txt file I've got after the scan

jeffce

Post #28June 27, 2012, 7:14 PM UTC

Hi,

Please download ERUNT (Emergency Recovery Utility NT). This program allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed. **Remember if you are using Windows Vista as your operating system right-click the executable and Run as Administrator.
———-

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services

:OTL
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE:64bit: - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&a…q={searchTerms}
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKLM\..\SearchScopes\{8A96AF9E-4074-43b7-BEA3-87217BDA7406}: "URL" = http://www.searchqu.com/web?src=ieb&sy…q={searchTerms}
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&a…q={searchTerms}
IE - HKLM\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = http://mystart.incredimail.com/?search={se…929752390932140
IE - HKCU\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKCU\..\SearchScopes\{479E92B7-80E2-4021-B575-10F68B79BC49}: "URL" = http://www.google.it/#hl=it&source=hp&…fca69c98b5d77d7
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…;rlz=1I7SVEE_it
IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&a…q={searchTerms}
FF - prefs.js..browser.search.defaultenginename: "Search Results"
FF - prefs.js..browser.search.order.1: "Search Results"
FF - prefs.js..keyword.URL: "http://dts.search-results.com/sr?src=ffb&appid=394&systemid=406&sr=0&q="
[2011/11/02 14:57:50 | 000,002,227 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
[2012/06/19 13:18:38 | 000,002,519 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\Search_Results.xml
O2:64bit: - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - No CLSID value found.

:Files
ipconfig /flushdns /c

:Commands
[purity]
[emptytemp]
[resethosts]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

SuperQvas

Post #29June 27, 2012, 7:41 PM UTC

OTL logfile created on: 27/06/2012 21:33:46 - Run 7
OTL by OldTimer - Version 3.2.53.0 Folder = C:\Users\vaio\Desktop
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000410 | Country: Italia | Language: ITA | Date Format: dd/MM/yyyy

3,67 Gb Total Physical Memory | 1,86 Gb Available Physical Memory | 50,57% Memory free
7,34 Gb Paging File | 5,46 Gb Available in Paging File | 74,37% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 287,59 Gb Total Space | 213,83 Gb Free Space | 74,35% Space Free | Partition Type: NTFS

Computer Name: NB_EB4B4E | User Name: vaio | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\vaio\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
PRC - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Programmi\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Google\Google Calendar Sync\GoogleCalendarSync.exe (Google)
PRC - C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe (Sony Corporation)
PRC - C:\Programmi\ESET\ESET NOD32 Antivirus\x86\ekrn.exe (ESET)
PRC - C:\Windows\SysWOW64\NLSSRV32.EXE (Nalpeiron Ltd.)
PRC - C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe (PC Tools)
PRC - C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SHTtray.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe (Sony Corporation)
PRC - C:\Programmi\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe (Sony Corporation)
PRC - C:\Programmi\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe (Broadcom Corporation.)
PRC - C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
PRC - C:\Windows\SysWOW64\wbem\WmiPrvSE.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
PRC - C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe (ArcSoft, Inc.)

========== Modules (No Company Name) ==========

MOD - C:\Users\vaio\AppData\Local\Temp\c25e8b3d-33a7-42bf-85e6-6880c6753136\CliSecureRT.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\d239f585ee55f833dbe21e897e1265ac\PresentationFramework.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\b7de318e9fd1ef519ca6c1f3b5dba8e0\PresentationCore.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\00a4922fbf869a79c043b665035516b6\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\a6e37a05b8d0cedbc5c3ea266ae3fc31\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\4230ed1c7990e4ee8352baf67a2a85fa\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\d0e1cdaff8f9055187f8e7b52c060dff\System.Management.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\31fab24c51c0cfe8b8115f24545f169f\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\b68bee05c7e518172982cc92059c3315\System.Xaml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\608d29d7cc89f3a9a195c91354561915\PresentationFramework.Aero.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\09bd2126bba2ab4f29ed52afde1470d7\System.Core.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\9abe44a0f82070ead5f1256683a4d25a\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System\a6be120e49f895ef6b00e9918402395b\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\c1af4ec9a36f671617a8ecaec00373f4\mscorlib.ni.dll ()
MOD - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
MOD - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf ()
MOD - C:\PROGRA~2\MICROS~1\Office14\1033\GrooveIntlResource.dll ()

========== Win32 Services (SafeList) ==========

SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MBAMService) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (VUAgent) – C:\Programmi\Sony\VAIO Update Common\VUAgent.exe (Sony Corporation)
SRV - (OODefragAgent) – C:\Programmi\OO Software\Defrag\oodag.exe (O&O; Software GmbH)
SRV - (ZuneWlanCfgSvc) – c:\Programmi\Zune\ZuneWlanCfgSvc.exe (Microsoft Corporation)
SRV - (WMZuneComm) – c:\Programmi\Zune\WMZuneComm.exe (Microsoft Corporation)
SRV - (ZuneNetworkSvc) – c:\Programmi\Zune\ZuneNss.exe (Microsoft Corporation)
SRV - (VcmIAlzMgr) – C:\Programmi\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe (Sony Corporation)
SRV - (KMService) – C:\Windows\SysWOW64\srvany.exe ()
SRV - (VcmXmlIfHelper) – C:\Programmi\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe (Sony Corporation)
SRV - (VCService) – C:\Programmi\Sony\VAIO Care\VCService.exe (Sony Corporation)
SRV - (SpfService) – C:\Programmi\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe (Sony Corporation)
SRV - (VCFw) – C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe (Sony Corporation)
SRV - (EhttpSrv) – C:\Programmi\ESET\ESET NOD32 Antivirus\EHttpSrv.exe (ESET)
SRV - (ekrn) – C:\Programmi\ESET\ESET NOD32 Antivirus\x86\ekrn.exe (ESET)
SRV - (nlsX86cc) – C:\Windows\SysWOW64\NLSSRV32.EXE (Nalpeiron Ltd.)
SRV - (PMBDeviceInfoProvider) – C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe (Sony Corporation)
SRV - (PCToolsSSDMonitorSvc) – C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe (PC Tools)
SRV - (wlcrasvc) – C:\Programmi\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV - (wlidsvc) – C:\Programmi\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (VAIO Power Management) – C:\Programmi\Sony\VAIO Power Management\SPMService.exe (Sony Corporation)
SRV - (SOHCImp) – C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe (Sony Corporation)
SRV - (SOHDs) – C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe (Sony Corporation)
SRV - (SOHDms) – C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe (Sony Corporation)
SRV - (VcmINSMgr) – C:\Programmi\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe (Sony Corporation)
SRV - (btwdins) – C:\Programmi\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.)
SRV - (VSNService) – C:\Programmi\Sony\VAIO Smart Network\VSNService.exe (Sony Corporation)
SRV - (VAIO Event Service) – C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe (Sony Corporation)
SRV - (UNS) Intel® – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) Intel® – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (ACDaemon) – C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (EvtEng) Intel® – C:\Programmi\Intel\WiFi\bin\EvtEng.exe (Intel® Corporation)
SRV - (RegSrvc) Intel® – C:\Programmi\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel® Corporation)
SRV - (IAStorDataMgrSvc) Intel® – C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
SRV - (SwitchBoard) – C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (osppsvc) – C:\Programmi\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (uCamMonitor) – C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe (ArcSoft, Inc.)

========== Driver Services (SafeList) ==========

DRV:64bit: - (MBAMProtector) – C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (ssudmdm) SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.) – C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.) – C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (sscdmdm) – C:\Windows\SysNative\drivers\sscdmdm.sys (MCCI Corporation)
DRV:64bit: - (sscdbus) SAMSUNG USB Composite Device driver (WDM) – C:\Windows\SysNative\drivers\sscdbus.sys (MCCI Corporation)
DRV:64bit: - (sscdmdfl) – C:\Windows\SysNative\drivers\sscdmdfl.sys (MCCI Corporation)
DRV:64bit: - (pcouffin) – C:\Windows\SysNative\drivers\pcouffin.sys (VSO Software)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (eamonm) – C:\Windows\SysNative\drivers\eamonm.sys (ESET)
DRV:64bit: - (ehdrv) – C:\Windows\SysNative\drivers\ehdrv.sys (ESET)
DRV:64bit: - (epfwwfpr) – C:\Windows\SysNative\drivers\epfwwfpr.sys (ESET)
DRV:64bit: - (fssfltr) – C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)
DRV:64bit: - (IntcDAud) Intel® – C:\Windows\SysNative\drivers\IntcDAud.sys (Intel® Corporation)
DRV:64bit: - (igfx) – C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (atikmdag) – C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (btwrchid) – C:\Windows\SysNative\drivers\btwrchid.sys (Broadcom Corporation.)
DRV:64bit: - (btwampfl) – C:\Windows\SysNative\drivers\btwampfl.sys (Broadcom Corporation.)
DRV:64bit: - (btwavdt) – C:\Windows\SysNative\drivers\btwavdt.sys (Broadcom Corporation.)
DRV:64bit: - (btwaudio) – C:\Windows\SysNative\drivers\btwaudio.sys (Broadcom Corporation.)
DRV:64bit: - (btwl2cap) – C:\Windows\SysNative\drivers\btwl2cap.sys (Broadcom Corporation.)
DRV:64bit: - (risdsnpe) – C:\Windows\SysNative\drivers\risdsne64.sys (REDC)
DRV:64bit: - (rimspci) – C:\Windows\SysNative\drivers\rimssne64.sys (REDC)
DRV:64bit: - (VBTUSB) – C:\Windows\SysNative\drivers\VBTUSB.sys (Sony Corporation)
DRV:64bit: - (ApfiltrService) – C:\Windows\SysNative\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV:64bit: - (yukonw7) – C:\Windows\SysNative\drivers\yk62x64.sys (Marvell)
DRV:64bit: - (athr) – C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (NETw5s64) Driver scheda Intel® – C:\Windows\SysNative\drivers\NETw5s64.sys (Intel Corporation)
DRV:64bit: - (Impcd) – C:\Windows\SysNative\drivers\Impcd.sys (Intel Corporation)
DRV:64bit: - (HECIx64) Intel® – C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (SFEP) – C:\Windows\SysNative\drivers\SFEP.sys (Sony Corporation)
DRV:64bit: - (iaStor) – C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (sdbus) – C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation)
DRV:64bit: - (GRemoteBus) – C:\Windows\SysNative\drivers\GRemoteBus64.sys (GBM Software)
DRV:64bit: - (TFsExDisk) – C:\Windows\SysNative\drivers\TFsExDisk.sys (Teruten Inc)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (ArcSoftKsUFilter) – C:\Windows\SysNative\drivers\ArcSoftKsUFilter.sys (ArcSoft, Inc.)
DRV:64bit: - (mcdbus) – C:\Windows\SysNative\drivers\mcdbus.sys (MagicISO, Inc.)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (mcdbus) – C:\Windows\SysWOW64\drivers\mcdbus.sys (MagicISO, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes,DefaultScope =

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com.do/
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.order.1: ""
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.com.do/"
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_262.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.19: C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\vaio\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\vaio\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[removed]: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2011/12/24 00:43:06 | 000,000,000 | —D | M]

[2012/06/20 09:41:27 | 000,000,000 | —D | M] (No name found) – C:\Users\vaio\AppData\Roaming\mozilla\Extensions
[2012/06/20 09:41:26 | 000,000,000 | —D | M] (No name found) – C:\Users\vaio\AppData\Roaming\mozilla\Firefox\Profiles\qqfpf2rt.default\extensions
[2011/11/03 17:28:55 | 000,000,000 | —D | M] (No name found) – C:\Users\vaio\AppData\Roaming\mozilla\SeaMonkey\Profiles\ksk5md02.default\extensions
[2012/06/25 16:33:13 | 000,003,907 | —- | M] () – C:\Users\vaio\AppData\Roaming\Mozilla\Firefox\Profiles\qqfpf2rt.default\searchplugins\torrentfinderru.xml
[2012/04/11 16:00:30 | 000,120,275 | —- | M] () (No name found) – C:\USERS\VAIO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QQFPF2RT.DEFAULT\EXTENSIONS\[removed]

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{googl
e:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chro
me&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client
=chrome&hl;={language}&q;={searchTerms}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\vaio\AppData\Local\Google\Chrome\Application\19.0.1084.56\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\vaio\AppData\Local\Google\Chrome\Application\19.0.1084.56\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\vaio\AppData\Local\Google\Chrome\Application\19.0.1084.56\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\vaio\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.290.11 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U29 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
CHR - plugin: Veetle TV Player (Enabled) = C:\Program Files (x86)\Veetle\Player\npvlc.dll
CHR - plugin: Veetle TV Core (Enabled) = C:\Program Files (x86)\Veetle\plugins\npVeetle.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Google Update (Enabled) = C:\Users\vaio\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - Extension: YouTube = C:\Users\vaio\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Ricerca Google = C:\Users\vaio\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Gmail = C:\Users\vaio\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2012/06/27 21:29:29 | 000,000,098 | —- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programmi\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programmi\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4:64bit: - HKLM..\Run: [OODefragTray] C:\Programmi\OO Software\Defrag\oodtray.exe (O&O; Software GmbH)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [SHTtray.exe] C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SHTtray.exe (Sony Corporation)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [KiesHelper] C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe (Samsung)
O4 - HKCU..\Run: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - HKCU..\RunOnce: [!SearchquFFHP] C:\Windows\system32\RUNDLL32.EXE C:\Users\vaio\AppData\Local\Temp\INSTAL~1.DLL,_SetFirefoxHP http://www.searchnu.com/406, File not found
O4 - Startup: C:\Users\vaio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files (x86)\ERUNT\AUTOBACK.EXE ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: E&sporta; in Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Extract e-mail addresses - Reg Error: Value error. File not found
O8:64bit: - Extra context menu item: Google Sidewiki… - Reg Error: Value error. File not found
O8:64bit: - Extra context menu item: I&nvia; a OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: E&sporta; in Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Extract e-mail addresses - Reg Error: Value error. File not found
O8 - Extra context menu item: Google Sidewiki… - Reg Error: Value error. File not found
O8 - Extra context menu item: I&nvia; a OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O9:64bit: - Extra Button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programmi\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : I&nvia; a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programmi\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: &Note; collegate di OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programmi\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : &Note; collegate di OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programmi\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra Button: Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - C:\Program Files (x86)\Evernote\Evernote3.5\enbar.dll (Evernote Corporation)
O9 - Extra 'Tools' menuitem : Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - C:\Program Files (x86)\Evernote\Evernote3.5\enbar.dll (Evernote Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programmi\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programmi\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{423D4F55-13A2-4D2E-BBDA-A1774A136043}: DhcpNameServer = 10.100.6.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A56D231E-447F-43BC-B413-876EA6E69004}: DhcpNameServer = [removed] [removed]
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programmi\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programmi\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~2\AVG\AVG10\avgchsva.exe /sync)
O34 - HKLM BootExecute: (C:\PROGRA~2\AVG\AVG10\avgrsa.exe /sync /restart)
O34 - HKLM BootExecute: (OODBS)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = ComFile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/06/27 21:28:52 | 000,000,000 | —D | C] – C:\_OTL
[2012/06/27 21:26:29 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT
[2012/06/27 21:26:29 | 000,000,000 | —D | C] – C:\Program Files (x86)\ERUNT
[2012/06/27 21:25:03 | 000,791,393 | —- | C] (Lars Hederer ) – C:\Users\vaio\Desktop\erunt-setup.exe
[2012/06/27 19:50:54 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2012/06/27 19:21:32 | 000,000,000 | —D | C] – C:\Windows\temp
[2012/06/26 23:10:01 | 000,000,000 | —D | C] – C:\Users\vaio\Documents\Nuova cartella
[2012/06/26 21:49:57 | 000,000,000 | —D | C] – C:\Program Files (x86)\ESET
[2012/06/26 21:37:06 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/06/26 21:37:05 | 000,024,904 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2012/06/26 21:37:05 | 000,000,000 | —D | C] – C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012/06/26 21:36:16 | 010,063,000 | —- | C] (Malwarebytes Corporation ) – C:\Users\vaio\Desktop\mbam-setup-1.61.0.1400.exe
[2012/06/26 16:50:17 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2012/06/26 16:50:17 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2012/06/26 16:50:17 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2012/06/26 16:50:05 | 000,000,000 | —D | C] – C:\Qoobox
[2012/06/26 16:49:40 | 000,000,000 | —D | C] – C:\Windows\erdnt
[2012/06/26 16:48:09 | 004,569,417 | R— | C] (Swearware) – C:\Users\vaio\Desktop\ComboFix.exe
[2012/06/26 15:30:15 | 002,128,984 | —- | C] (Kaspersky Lab ZAO) – C:\Users\vaio\Desktop\TDSSKiller.exe
[2012/06/26 15:26:06 | 000,607,260 | R— | C] (Swearware) – C:\Users\vaio\Desktop\dds.com
[2012/06/26 15:08:03 | 004,731,392 | —- | C] (AVAST Software) – C:\Users\vaio\Desktop\aswMBR.exe
[2012/06/26 14:56:02 | 000,596,992 | —- | C] (OldTimer Tools) – C:\Users\vaio\Desktop\OTL.exe
[2012/06/26 12:16:39 | 000,000,000 | —D | C] – C:\Users\vaio\AppData\Roaming\PC Cleaners
[2012/06/26 12:16:35 | 004,446,520 | —- | C] (PC Cleaners) – C:\Windows\uninst.exe
[2012/06/26 12:16:35 | 000,000,000 | —D | C] – C:\Users\vaio\AppData\Roaming\PCPro
[2012/06/26 12:16:33 | 000,000,000 | —D | C] – C:\ProgramData\PC1Data
[2012/06/25 23:24:27 | 000,000,000 | —D | C] – C:\Users\vaio\AppData\Roaming\Malwarebytes
[2012/06/25 23:23:46 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2012/06/25 23:02:12 | 000,000,000 | —D | C] – C:\Program Files (x86)\ZHPDiag
[2012/06/25 23:02:12 | 000,000,000 | —D | C] – C:\ZHP
[2012/06/21 20:04:26 | 002,622,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wucltux.dll
[2012/06/21 20:04:26 | 000,057,880 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuauclt.exe
[2012/06/21 20:04:26 | 000,044,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wups2.dll
[2012/06/21 20:03:59 | 000,701,976 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuapi.dll
[2012/06/21 20:03:59 | 000,099,840 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wudriver.dll
[2012/06/21 20:03:59 | 000,038,424 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wups.dll
[2012/06/21 20:03:23 | 000,186,752 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuwebv.dll
[2012/06/21 20:03:23 | 000,036,864 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuapp.exe
[2012/06/19 11:53:08 | 000,000,000 | —D | C] – C:\Nuova cartella
[2012/06/15 08:32:23 | 000,000,000 | —D | C] – C:\Users\vaio\AppData\Local\Macromedia
[2012/06/14 23:46:06 | 000,096,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2012/06/14 23:46:06 | 000,073,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2012/06/14 23:46:05 | 000,237,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2012/06/14 23:46:05 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2012/06/14 23:46:04 | 000,248,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2012/06/14 23:46:04 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2012/06/14 23:46:04 | 000,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2012/06/14 23:46:04 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2012/06/14 23:46:02 | 002,311,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2012/06/14 23:46:02 | 001,494,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2012/06/14 23:46:02 | 001,427,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2012/06/14 23:46:02 | 000,716,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2012/06/14 23:46:01 | 000,818,688 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2012/06/14 16:39:12 | 000,149,504 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdpcorekmts.dll
[2012/06/14 16:39:12 | 000,076,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdpwsx.dll
[2012/06/14 16:39:12 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdrmemptylst.exe
[2012/06/14 16:39:10 | 005,505,392 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntoskrnl.exe
[2012/06/14 16:39:08 | 003,902,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntoskrnl.exe
[2012/06/14 16:39:07 | 003,958,128 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntkrnlpa.exe
[2012/06/14 16:39:00 | 003,213,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msi.dll
[2012/06/14 16:38:49 | 001,460,224 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\crypt32.dll
[2012/06/14 16:38:49 | 000,140,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\cryptnet.dll
[2012/06/13 22:28:09 | 000,000,000 | —D | C] – C:\ExchangeSetupLogs
[2012/06/05 19:48:53 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Carlton Books
[2012/06/05 19:48:49 | 000,000,000 | —D | C] – C:\Program Files (x86)\Monster Of The Deep
[2012/06/05 10:29:44 | 000,000,000 | —D | C] – C:\Users\vaio\AppData\Roaming\deluge
[2012/06/05 10:29:28 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Deluge
[2012/06/05 10:28:57 | 000,000,000 | —D | C] – C:\Program Files (x86)\Deluge
[2011/04/14 22:22:08 | 000,082,816 | —- | C] (VSO Software) – C:\Users\vaio\AppData\Roaming\pcouffin.sys

========== Files - Modified Within 30 Days ==========

[2012/06/27 21:38:07 | 000,020,032 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/06/27 21:38:07 | 000,020,032 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/06/27 21:34:43 | 001,541,618 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2012/06/27 21:34:43 | 000,698,804 | —- | M] () – C:\Windows\SysNative\perfh010.dat
[2012/06/27 21:34:43 | 000,616,242 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2012/06/27 21:34:43 | 000,127,998 | —- | M] () – C:\Windows\SysNative\perfc010.dat
[2012/06/27 21:34:43 | 000,106,622 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2012/06/27 21:30:18 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/06/27 21:30:17 | 2955,485,184 | -HS- | M] () – C:\hiberfil.sys
[2012/06/27 21:30:15 | 000,436,050 | —- | M] () – C:\Windows\SysNative\oodbs.lor
[2012/06/27 21:29:29 | 000,000,098 | —- | M] () – C:\Windows\SysNative\drivers\etc\Hosts
[2012/06/27 21:26:34 | 000,001,104 | —- | M] () – C:\Users\vaio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2012/06/27 21:26:30 | 000,000,924 | —- | M] () – C:\Users\vaio\Desktop\NTREGOPT.lnk
[2012/06/27 21:26:30 | 000,000,905 | —- | M] () – C:\Users\vaio\Desktop\ERUNT.lnk
[2012/06/27 21:25:03 | 000,791,393 | —- | M] (Lars Hederer ) – C:\Users\vaio\Desktop\erunt-setup.exe
[2012/06/27 21:21:00 | 000,000,978 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/06/27 20:52:00 | 000,001,156 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3564337256-1403246104-864991456-1000UA.job
[2012/06/27 19:54:08 | 000,223,142 | —- | M] () – C:\Users\vaio\Desktop\Nuova immagine.bmp
[2012/06/27 19:14:21 | 000,000,264 | —- | M] () – C:\Windows\tasks\RMSchedule.job
[2012/06/27 17:45:03 | 000,458,240 | —- | M] () – C:\Users\vaio\Desktop\CKScanner.exe
[2012/06/26 21:37:06 | 000,001,109 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/06/26 21:36:28 | 010,063,000 | —- | M] (Malwarebytes Corporation ) – C:\Users\vaio\Desktop\mbam-setup-1.61.0.1400.exe
[2012/06/26 16:48:53 | 004,569,417 | R— | M] (Swearware) – C:\Users\vaio\Desktop\ComboFix.exe
[2012/06/26 15:28:41 | 002,109,990 | —- | M] () – C:\Users\vaio\Desktop\tdsskiller.zip
[2012/06/26 15:26:06 | 000,607,260 | R— | M] (Swearware) – C:\Users\vaio\Desktop\dds.com
[2012/06/26 15:08:14 | 004,731,392 | —- | M] (AVAST Software) – C:\Users\vaio\Desktop\aswMBR.exe
[2012/06/26 14:56:02 | 000,596,992 | —- | M] (OldTimer Tools) – C:\Users\vaio\Desktop\OTL.exe
[2012/06/26 12:31:15 | 000,000,512 | —- | M] () – C:\Users\vaio\Desktop\MBR.dat
[2012/06/26 12:16:21 | 004,446,520 | —- | M] (PC Cleaners) – C:\Windows\uninst.exe
[2012/06/25 21:19:12 | 002,128,984 | —- | M] (Kaspersky Lab ZAO) – C:\Users\vaio\Desktop\TDSSKiller.exe
[2012/06/25 17:23:10 | 000,002,978 | —- | M] () – C:\Users\vaio\Documents\cc_20120625_172305.reg
[2012/06/23 17:21:35 | 000,426,184 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2012/06/23 17:21:35 | 000,070,344 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/06/22 09:52:00 | 000,001,104 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3564337256-1403246104-864991456-1000Core.job
[2012/06/21 20:02:14 | 005,003,208 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2012/06/19 10:52:03 | 000,006,787 | —- | M] () – C:\Users\vaio\AppData\Local\recently-used.xbel
[2012/06/11 19:20:11 | 000,003,072 | —- | M] () – C:\Windows\SysWow64\Cache.db
[2012/06/11 17:26:33 | 000,760,690 | —- | M] () – C:\test.xml
[2012/06/05 19:55:53 | 000,002,170 | —- | M] () – C:\Users\Public\Desktop\Monster Of The Deep.lnk
[2012/06/05 10:29:28 | 000,000,979 | —- | M] () – C:\Users\Public\Desktop\Deluge.lnk
[2012/06/03 00:19:46 | 000,038,424 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\wups.dll
[2012/06/03 00:19:42 | 000,057,880 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\wuauclt.exe
[2012/06/03 00:19:42 | 000,044,056 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\wups2.dll
[2012/06/03 00:19:23 | 000,701,976 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\wuapi.dll
[2012/06/03 00:15:31 | 002,622,464 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\wucltux.dll
[2012/06/03 00:15:08 | 000,099,840 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\wudriver.dll
[2012/06/02 15:19:42 | 000,186,752 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\wuwebv.dll
[2012/06/02 15:15:12 | 000,036,864 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\wuapp.exe
[2012/06/01 14:08:38 | 000,019,496 | —- | M] () – C:\Users\vaio\Desktop\Gestione Lavoro2.pdf
[2012/06/01 11:47:43 | 000,001,456 | —- | M] () – C:\Users\vaio\AppData\Local\Adobe Save for Web 12.0 Prefs

========== Files Created - No Company Name ==========

[2012/06/27 21:26:34 | 000,001,104 | —- | C] () – C:\Users\vaio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2012/06/27 21:26:30 | 000,000,924 | —- | C] () – C:\Users\vaio\Desktop\NTREGOPT.lnk
[2012/06/27 21:26:30 | 000,000,905 | —- | C] () – C:\Users\vaio\Desktop\ERUNT.lnk
[2012/06/27 19:54:07 | 000,223,142 | —- | C] () – C:\Users\vaio\Desktop\Nuova immagine.bmp
[2012/06/27 17:45:03 | 000,458,240 | —- | C] () – C:\Users\vaio\Desktop\CKScanner.exe
[2012/06/26 21:37:06 | 000,001,109 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/06/26 16:50:17 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2012/06/26 16:50:17 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2012/06/26 16:50:17 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2012/06/26 16:50:17 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2012/06/26 16:50:17 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2012/06/26 15:28:35 | 002,109,990 | —- | C] () – C:\Users\vaio\Desktop\tdsskiller.zip
[2012/06/25 19:38:27 | 000,000,512 | —- | C] () – C:\Users\vaio\Desktop\MBR.dat
[2012/06/25 17:23:08 | 000,002,978 | —- | C] () – C:\Users\vaio\Documents\cc_20120625_172305.reg
[2012/06/21 19:59:33 | 005,003,208 | —- | C] () – C:\Windows\SysNative\FNTCACHE.DAT
[2012/06/19 10:52:03 | 000,006,787 | —- | C] () – C:\Users\vaio\AppData\Local\recently-used.xbel
[2012/06/05 19:48:54 | 000,002,170 | —- | C] () – C:\Users\Public\Desktop\Monster Of The Deep.lnk
[2012/06/05 10:29:28 | 000,000,979 | —- | C] () – C:\Users\Public\Desktop\Deluge.lnk
[2012/06/01 14:08:45 | 000,019,496 | —- | C] () – C:\Users\vaio\Desktop\Gestione Lavoro2.pdf
[2012/04/11 11:45:37 | 000,000,071 | —- | C] () – C:\Users\vaio\.emailgrabber2
[2012/03/24 17:07:13 | 000,000,132 | —- | C] () – C:\Users\vaio\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2012/03/16 01:10:47 | 001,570,074 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2012/03/01 01:32:58 | 000,013,030 | —- | C] () – C:\Users\vaio\AppData\Local\PDOXUSRS.NET
[2012/03/01 00:18:42 | 000,000,024 | —- | C] () – C:\Windows\SysWow64\sysdate.ini
[2012/02/25 12:28:16 | 000,000,000 | —- | C] () – C:\Windows\iwlufklg.dll
[2012/02/02 22:36:09 | 000,001,456 | —- | C] () – C:\Users\vaio\AppData\Local\Adobe Save for Web 12.0 Prefs
[2012/01/31 01:15:44 | 000,030,568 | —- | C] () – C:\Windows\MusiccityDownload.exe
[2012/01/31 01:15:42 | 000,974,848 | —- | C] () – C:\Windows\SysWow64\cis-2.4.dll
[2012/01/31 01:15:42 | 000,081,920 | —- | C] () – C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2012/01/31 01:15:42 | 000,065,536 | —- | C] () – C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2012/01/31 01:15:42 | 000,057,344 | —- | C] () – C:\Windows\SysWow64\issacapi_se-2.3.dll
[2011/12/29 21:30:36 | 000,001,145 | —- | C] () – C:\Windows\EVVIVARG.INI
[2011/12/29 21:17:15 | 000,000,114 | —- | C] () – C:\Windows\EvvivaLiveUpdate.ini
[2011/12/29 21:16:54 | 000,001,279 | —- | C] () – C:\Windows\ODBCINST.INI
[2011/12/24 00:01:13 | 000,196,608 | —- | C] () – C:\Windows\SysWow64\avisynth.dll
[2011/11/02 13:47:46 | 000,000,003 | —- | C] () – C:\Windows\SysWow64\krx280.dat
[2011/07/26 21:32:57 | 000,000,046 | —- | C] () – C:\Windows\PCCT.INI
[2011/04/14 22:22:08 | 000,007,859 | —- | C] () – C:\Users\vaio\AppData\Roaming\pcouffin.cat
[2011/04/14 22:22:08 | 000,001,167 | —- | C] () – C:\Users\vaio\AppData\Roaming\pcouffin.inf
[2011/04/14 18:33:24 | 000,000,036 | —- | C] () – C:\Windows\hdd.ini
[2011/04/13 15:23:00 | 000,008,192 | —- | C] () – C:\Windows\SysWow64\srvany.exe
[2011/04/09 18:55:28 | 000,179,261 | —- | C] () – C:\Windows\SysWow64\xlive.dll.cat
[2010/12/06 15:58:56 | 002,496,715 | —- | C] () – C:\Windows\SysWow64\abgx360.exe
[2010/10/12 19:30:23 | 000,208,896 | —- | C] () – C:\Windows\SysWow64\iglhsip32.dll
[2010/10/12 19:30:22 | 000,870,560 | —- | C] () – C:\Windows\SysWow64\igkrng575.bin
[2010/10/12 19:30:22 | 000,143,360 | —- | C] () – C:\Windows\SysWow64\iglhcp32.dll
[2010/10/12 19:30:21 | 000,104,636 | —- | C] () – C:\Windows\SysWow64\igfcg575m.bin
[2010/10/12 19:30:20 | 000,127,868 | —- | C] () – C:\Windows\SysWow64\igcompkrng575.bin
[2010/10/12 19:30:13 | 000,028,732 | —- | C] () – C:\Windows\SysWow64\ativvsny.dat
[2010/10/12 19:30:13 | 000,026,936 | —- | C] () – C:\Windows\SysWow64\ativvsnl.dat
[2010/10/12 19:27:41 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin

========== Alternate Data Streams ==========

@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:D1B5B4F1
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:1F8C9007

< End of report >

jeffce

Post #30June 27, 2012, 8:40 PM UTC

Hi, How is your system behaving?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

SEARCHQU [Solved]

✨ Ask AI

Ask AI