Spyware / Malware / Virus Removal

Maybe infected [Solved]

22 min read

Looking for the outcome? Ask AI

marcopcnn Topic Starter

Post #1November 11, 2012, 2:48 PM UTC

I suspect an infection on my PC
First of all from some days i can not reach the starting page of my web provider
I am able to reach any others website bu not the page www.tim.it of the provider
I have tried to check the PC using Malwarebyte, superAntispyware and spyboot search & destroy.
But no particular infection as been found.
Other two strange things.
1) My Antivirus McAfee Total protectino lose one file of SiteAdvisor function
2) The PC does not allow to start in Safe Mode. I push F8 during bootstrap but Seven always starts as usual ( and this is very strange)
thank for your help

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15.42.53, on 11/11/2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16450)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Windows\PLFSetI.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\PGP Corporation\PGP Desktop\PGPtray.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
C:\Program Files\Alice MOBILE E169\Alice MOBILE E169.exe
C:\Program Files\McAfee\MAT\McPvTray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\PGP Corporation\PGP Desktop\PGPdesk.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_4_402_287.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_4_402_287.exe
C:\Users\marco\Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a…p;m=aspire_5735
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a…p;m=aspire_5735
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://it.search.yahoo.com/search?fr=mcafee&p=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20121110080745.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - !{98889811-442D-49dd-99D7-DC866BE87DBC} - (no file)
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [PLFSetI] C:\Windows\PLFSetI.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe" -s
O4 - HKCU\..\Run: [NokiaSuite.exe] C:\Program Files\Nokia\Nokia Suite\NokiaSuite.exe -tray
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: PGPtray.exe.lnk = ?
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{1A6435B2-E1AD-47AA-91F5-524E33F95179}: NameServer = 213.230.129.10 213.230.155.10
O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\progra~1\mcafee\msc\mcsniepl.dll
O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
O23 - Service: Servizio di Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Servizio Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Personal Firewall Service (McMPFSvc) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee VirusScan Announcer (McNaiAnn) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe
O23 - Service: McAfee Firewall Core Service (mfefire) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe
O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - McAfee, Inc. - C:\Windows\system32\mfevtps.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: PGP RDD Service - PGP Corporation - C:\Program Files\PGP Corporation\PGP Desktop\RDDService.exe
O23 - Service: PGPserv - PGP Corporation - C:\Windows\system32\PGPserv.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Skype C2C Service - Skype Technologies S.A. - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

–
End of file - 10007 bytes

OCD

Post #2November 11, 2012, 4:23 PM UTC

Hello marcopcnn,

My name is OCD. I would be more than happy to take a look at your log and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advice, this will be a team effort. This may cause a delay, but I will do my best to keep it as short as possible. Please bear with me, I will post back to you as soon as I can.

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

Important Note for Vista and Windows 7 users:

These tools MUST be run from the executable.(.exe) every time you run them with Admin Rights (Right click, choose "Run as Administrator")

Please stay with this topic until I let you know that your system appears to be "All Clear"

OCD

Post #3November 12, 2012, 2:26 AM UTC

Hi marcopcnn,

We need to disable Spybot - Search & Destroy's Tea Timer. Please follow the instruction below.

Locate your copy of Spybot - Search & Destroy's and open it.
In the menu bar at the top select "Mode", then select "Advanced".
In the left hand menu expand the "Tools" menu.
Select "Resident", then remove the check mark for "Resident Tea Timer"
Then exit the program by clicking "File" then select "Exit"

Next

Download AdwCleaner to your desktop.

Right click and select "Run as Administrator".

Run AdwCleaner and select Delete
Once done it will ask to reboot, allow the reboot
On reboot a log will be produced, please attach the content of the log to your next reply

Next

Download OTL to your desktop.

Right click and select "Run as Administrator".

Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under Custom Scan paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
services.exe
/md5stop
%systemroot%\*. /rp /s
%systemdrive%\$Recycle.Bin|@;true;true;true
%USERPROFILE%\..|smtmp;true;true;true /FP
%temp%\smtmp\*.* /s >
DRIVES
CREATERESTOREPOINT
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

Next

Download aswMBR to your desktop.

Right click and select "Run as Administrator".

Click the Scan button to start scan.
When it finishes, press the save log button, save the log file to your desktop.

[external image: Posted Image]
Click the image to enlarge it

In your next post please provide the following:
AdwCleaner log
OTL.txt
Extras.txt
aswMBR log

marcopcnn

Post #4November 12, 2012, 9:47 PM UTC

Here attached the result of adw Cleaner log Waitin for your indication i will run OTL scan Thanks # AdwCleaner v2.007 - Logfile creato il 12/11/2012 alle 22:12:47 # Aggiornamento 06/11/2012 by Xplode # Sistema Operativo : Windows 7 Home Premium Service Pack 1 (32 bits) # Utente : marco - PORTATILE # Modalità Avvio : Modalità Normale # Eseguito da : C:\Users\marco\Desktop\AdwCleaner.exe # Opzioni [Elimina] ***** [Servizi] ***** ***** [File / Cartelle] ***** Cartella Eliminato : C:\Program Files\DAEMON Tools Toolbar Cartella Eliminato : C:\Program Files\Fluendo Cartella Eliminato : C:\Program Files\Iminent Cartella Eliminato : C:\Program Files\OfferBox Cartella Eliminato : C:\ProgramData\boost_interprocess Cartella Eliminato : C:\Users\marco\AppData\Local\Conduit Cartella Eliminato : C:\Users\marco\AppData\Local\Ilivid Player Cartella Eliminato : C:\Users\marco\AppData\Local\Temp\AskSearch Cartella Eliminato : C:\Users\marco\AppData\Local\Temp\Iminent Cartella Eliminato : C:\Users\marco\AppData\LocalLow\BabylonToolbar Cartella Eliminato : C:\Users\marco\AppData\LocalLow\Conduit Cartella Eliminato : C:\Users\marco\AppData\LocalLow\searchquband Cartella Eliminato : C:\Users\marco\AppData\LocalLow\Softonic Cartella Eliminato : C:\Users\marco\AppData\Roaming\moovida-1 Cartella Eliminato : C:\Users\marco\AppData\Roaming\OfferBox File Eliminato : C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml File Eliminato : C:\Program Files\Mozilla FireFox\searchplugins\Search_Results.xml File Eliminato : C:\user.js File Eliminato : C:\Users\marco\AppData\Local\Temp\Searchqu.ini File Eliminato : C:\Users\marco\AppData\Local\Temp\searchqutoolbar-manifest.xml File Eliminato : C:\Users\marco\AppData\Local\Temp\SetupDataMngr_Searchqu.exe ***** [Registro] ***** Chiave Eliminata : HKCU\Software\AppDataLow\Software\searchqutoolbar Chiave Eliminata : HKCU\Software\Conduit Chiave Eliminata : HKCU\Software\DataMngr Chiave Eliminata : HKCU\Software\Iminent Chiave Eliminata : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{00000000-6E41-4FD3-8538-502F5495E5FC} Chiave Eliminata : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC} Chiave Eliminata : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{99079A25-328F-4BD4-BE04-00955ACAA0A7} Chiave Eliminata : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000000-6E41-4FD3-8538-502F5495E5FC} Chiave Eliminata : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B} Chiave Eliminata : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{99079A25-328F-4BD4-BE04-00955ACAA0A7} Chiave Eliminata : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\incredibar.com Chiave Eliminata : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\incredibar.com Chiave Eliminata : HKCU\Software\Moovida Chiave Eliminata : HKCU\Software\Offerbox Chiave Eliminata : HKCU\Software\Softonic Chiave Eliminata : HKLM\Software\AedgePerformanceBCN Chiave Eliminata : HKLM\SOFTWARE\Classes\AppID\{35C1605E-438B-4D64-AAB1-8885F097A9B1} Chiave Eliminata : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826} Chiave Eliminata : HKLM\SOFTWARE\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D} Chiave Eliminata : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C} Chiave Eliminata : HKLM\SOFTWARE\Classes\b Chiave Eliminata : HKLM\SOFTWARE\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761} Chiave Eliminata : HKLM\SOFTWARE\Classes\Conduit.Engine Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F} Chiave Eliminata : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7} Chiave Eliminata : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils Chiave Eliminata : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils.1 Chiave Eliminata : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator Chiave Eliminata : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator.1 Chiave Eliminata : HKLM\SOFTWARE\Classes\Prod.cap Chiave Eliminata : HKLM\SOFTWARE\Classes\Toolbar.CT2880292 Chiave Eliminata : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759} Chiave Eliminata : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF} Chiave Eliminata : HKLM\Software\Conduit Chiave Eliminata : HKLM\SOFTWARE\Google\Chrome\Extensions\bjeikeheijdjdfjbmknpefojickbkmom Chiave Eliminata : HKLM\Software\Iminent Chiave Eliminata : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199} Chiave Eliminata : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08} Chiave Eliminata : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32 Chiave Eliminata : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS Chiave Eliminata : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32 Chiave Eliminata : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS Chiave Eliminata : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32 Chiave Eliminata : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS Chiave Eliminata : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\incredibar.com Chiave Eliminata : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\incredibar.com Chiave Eliminata : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6084C211-01A1-464E-97A0-09772E122B50} Chiave Eliminata : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP Chiave Eliminata : HKLM\Software\Moovida Chiave Eliminata : HKLM\Software\Offerbox Chiave Eliminata : HKLM\SOFTWARE\Software Valore Eliminata : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{32099AAC-C132-4136-9E9A-4E364A424E17}] Valore Eliminata : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}] Valore Eliminata : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [[removed]] ***** [Browser Internet] ***** -\\ Internet Explorer v9.0.8112.16421 [OK] Registro Pulito. -\\ Mozilla Firefox v16.0.2 (it) Nome Profilo : default-1346880439634 [Profil par défaut] File : C:\Users\marco\AppData\Roaming\Mozilla\Firefox\Profiles\au7lw8rd.default-1346880439634\prefs.js C:\Users\marco\AppData\Roaming\Mozilla\Firefox\Profiles\au7lw8rd.default-1346880439634\user.js … Eliminato ! Eliminata : user_pref("browser.search.defaultenginename", "SearchTheWeb"); Eliminata : user_pref("browser.search.order.1", "Search the web (Babylon)"); Eliminata : user_pref("browser.search.selectedEngine", "Search the web (Babylon)"); Eliminata : user_pref("extensions.BabylonToolbar.admin", false); Eliminata : user_pref("extensions.BabylonToolbar.aflt", "babsst"); Eliminata : user_pref("extensions.BabylonToolbar.appId", "{BDB69379-802F-4eaf-B541-F8DE92DD98DB}"); Eliminata : user_pref("extensions.BabylonToolbar.dfltLng", "en"); Eliminata : user_pref("extensions.BabylonToolbar.excTlbr", false); Eliminata : user_pref("extensions.BabylonToolbar.id", "240e99d100000000000006242b03beaa"); Eliminata : user_pref("extensions.BabylonToolbar.instlDay", "15614"); Eliminata : user_pref("extensions.BabylonToolbar.instlRef", "sst"); Eliminata : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar"); Eliminata : user_pref("extensions.BabylonToolbar.prtnrId", "babylon"); Eliminata : user_pref("extensions.BabylonToolbar.tlbrId", "base"); Eliminata : user_pref("extensions.BabylonToolbar.tlbrSrchUrl", "hxxp://search.babylon.com/?babsrc=TB_def&mntrId=[…] Eliminata : user_pref("extensions.BabylonToolbar.vrsn", "1.8.0.7"); Eliminata : user_pref("extensions.BabylonToolbar.vrsni", "[removed]"); Eliminata : user_pref("extensions.BabylonToolbar_i.newTab", true); Eliminata : user_pref("extensions.BabylonToolbar_i.newTabUrl", "about:home"); Eliminata : user_pref("extensions.BabylonToolbar_i.smplGrp", "none"); Eliminata : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.8.0.722:47:27"); Eliminata : user_pref("keyword.URL", "hxxp://isearch.babylon.com/?affID=116221&tt=300912_IKAN_4012_2&babsrc=KW_s[…] ************************* AdwCleaner[S1].txt - [12397 octets] - [12/11/2012 22:12:47] ########## EOF - C:\AdwCleaner[S1].txt - [12458 octets] ##########

marcopcnn

Post #5November 13, 2012, 4:24 AM UTC

The result Of OTL scan
OTL logfile created on: 12/11/2012 22.47.47 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\marco\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000410 | Country: Italia | Language: ITA | Date Format: dd/MM/yyyy

2,93 Gb Total Physical Memory | 2,26 Gb Available Physical Memory | 77,05% Memory free
5,86 Gb Paging File | 4,36 Gb Available in Paging File | 74,44% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 228,01 Gb Total Space | 127,32 Gb Free Space | 55,84% Space Free | Partition Type: NTFS
Drive D: | 227,98 Gb Total Space | 34,20 Gb Free Space | 15,00% Space Free | Partition Type: NTFS

Computer Name: PORTATILE | User Name: marco | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\marco\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
PRC - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
PRC - C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\MAT\McPvTray.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
PRC - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
PRC - C:\Program Files\Common Files\Mcafee\SystemCore\mfefire.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\Mcafee\SystemCore\mcshield.exe (McAfee, Inc.)
PRC - C:\Windows\System32\mfevtps.exe (McAfee, Inc.)
PRC - C:\Program Files\SUPERAntiSpyware\SASCore.exe (SUPERAntiSpyware.com)
PRC - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia)
PRC - C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe (Nokia)
PRC - C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe (Nokia)
PRC - C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\PGP Corporation\PGP Desktop\PGPtray.exe (PGP Corporation)
PRC - C:\Program Files\PGP Corporation\PGP Desktop\RDDService.exe (PGP Corporation)
PRC - C:\Windows\System32\PGPserv.exe (PGP Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe (Acer Inc.)
PRC - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe ()
PRC - C:\Windows\PLFSetI.exe ()

========== Modules (No Company Name) ==========

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\69ca4a43ba14b66689715ad62aed70e6\System.ServiceProcess.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\03dee80574f4ec770b6f77ca030ded6c\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\Framework.Utility\3.0.3006.0__4df5dcab8860d239\Framework.Utility.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\Framework.Library\3.0.3006.0__3036420f80dd6947\Framework.Library.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\Framework.Model.ControllerInterface\3.0.3006.0__d842b71b4d6ed079\Framework.Model.ControllerInterface.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_it_b77a5c561934e089\System.Runtime.Remoting.resources.dll ()
MOD - C:\Windows\System32\SysHook.dll ()
MOD - C:\Windows\PLFSetI.exe ()

========== Services (SafeList) ==========

SRV - (SBSDWSCService) – C:\Program Files\Spybot File not found
SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (Skype C2C Service) – C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
SRV - (MBAMService) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) – C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (MSK80Service) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McProxy) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNASvc) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNaiAnn) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (mcmscsvc) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McMPFSvc) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McAfee SiteAdvisor Service) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (TomTomHOMEService) – C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
SRV - (mfefire) – C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe ()
SRV - (McShield) – C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe ()
SRV - (mfevtp) – C:\Windows\System32\mfevtps.exe (McAfee, Inc.)
SRV - (SkypeUpdate) – C:\Program Files\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (!SASCORE) – C:\Program Files\SUPERAntiSpyware\SASCore.exe (SUPERAntiSpyware.com)
SRV - (ServiceLayer) – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (BBSvc) – C:\Program Files\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.)
SRV - (SeaPort) – C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
SRV - (PGP RDD Service) – C:\Program Files\PGP Corporation\PGP Desktop\RDDService.exe (PGP Corporation)
SRV - (PGPserv) – C:\Windows\System32\PGPserv.exe (PGP Corporation)
SRV - (C-DillaCdaC11BA) – C:\Windows\System32\drivers\CDAC11BA.EXE (C-Dilla Ltd)
SRV - (WinHttpAutoProxySvc) – winhttp.dll (Microsoft Corporation)
SRV - (WatAdminSvc) – C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (SensrSvc) – C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (eDataSecurity Service) – C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe (Egis Incorporated)
SRV - (ETService) – C:\Program Files\Acer\Empowering Technology\Service\ETService.exe ()
SRV - (CLHNService) – C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe ()
SRV - (MobilityService) – C:\Acer\Mobility Center\MobilityService.exe ()

========== Driver Services (SafeList) ==========

DRV - (nxfilter) – system32\drivers\nxfilter.sys File not found
DRV - (mfeavfk01) – File not found
DRV - ({09BB444F-B2E2-4009-BAF2-7B727681223E}) – C:\Program Files\VMLaunch\BuddyVM.sys File not found
DRV - (MBAMProtector) – C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (McPvDrv) – C:\Windows\System32\drivers\McPvDrv.sys (McAfee, Inc.)
DRV - (cfwids) – C:\Windows\System32\drivers\cfwids.sys (McAfee, Inc.)
DRV - (mferkdet) – C:\Windows\System32\drivers\mferkdet.sys (McAfee, Inc.)
DRV - (mfefirek) – C:\Windows\System32\drivers\mfefirek.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\Windows\System32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\Windows\System32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfewfpk) – C:\Windows\System32\drivers\mfewfpk.sys (McAfee, Inc.)
DRV - (mfehidk) – C:\Windows\System32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfeapfk) – C:\Windows\System32\drivers\mfeapfk.sys (McAfee, Inc.)
DRV - (pccsmcfd) – C:\Windows\System32\drivers\pccsmcfd.sys (Nokia)
DRV - (HipShieldK) – C:\Windows\System32\drivers\HipShieldK.sys (McAfee, Inc.)
DRV - (dtsoftbus01) – C:\Windows\System32\drivers\dtsoftbus01.sys (DT Soft Ltd)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (sptd) – C:\Windows\System32\drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (PGPwded) – C:\Windows\System32\drivers\PGPwded.sys (PGP Corporation)
DRV - (PGPdisk) – C:\Windows\System32\drivers\PGPdisk.sys (PGP Corporation)
DRV - (PGPsdkDriver) – C:\Windows\System32\drivers\PGPsdk.sys (PGP Corporation)
DRV - (pgpfs) – C:\Windows\System32\drivers\PGPfsfd.sys (PGP Corporation)
DRV - (Pgpwdefs) – C:\Windows\System32\drivers\PGPwdefs.sys (PGP Corporation)
DRV - (TsUsbFlt) – C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (athr) – C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (yukonw7) – C:\Windows\System32\drivers\yk62x86.sys ()
DRV - (BthAvrcp) – C:\Windows\System32\drivers\BthAvrcp.sys (CSR, plc)
DRV - (vwifimp) – C:\Windows\System32\drivers\vwifimp.sys (Microsoft Corporation)
DRV - (AgereSoftModem) – C:\Windows\System32\drivers\AGRSM.sys (LSI Corp)
DRV - (RsFx0103) – C:\Windows\System32\drivers\RsFx0103.sys (Microsoft Corporation)
DRV - ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796}) – C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl (Cyberlink Corp.)
DRV - (int15) – C:\Windows\System32\drivers\int15.sys (Acer, Inc.)
DRV - (hwdatacard) – C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (NTIPPKernel) – C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys (Cyberlink Corp.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = Reg Error: Value error.
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = Reg Error: Value error.
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a;…p;m=aspire_5735
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Preserve
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a;…p;m=aspire_5735
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{96B4E0C6-F315-4D86-8A47-A384FA62CF1A}: "URL" = http://www.google.com/search?q={searchTerm…amp;rlz=1I7ACAW
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.it/"
FF - prefs.js..extensions.enabledAddons: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:2.0.15
FF - prefs.js..extensions.enabledAddons: {D19CA586-DD6C-4a0a-96F8-14644F340D60}:15.1.0
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\progra~1\mcafee\msc\npmcsn~1.dll ()
FF - HKLM\Software\MozillaPlugins\@mcafee.com/MVT: C:\Program Files\McAfee\Supportability\MVT\npmvtplugin.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nokia.com/EnablerPlugin: C:\Program Files\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.3: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files\McAfee\SiteAdvisor [2012/11/10 13.48.24 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{D19CA586-DD6C-4a0a-96F8-14644F340D60}: C:\Program Files\Common Files\McAfee\SystemCore [2012/11/12 22.27.13 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/11/10 08.07.45 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/08/18 17.19.37 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[removed]: C:\Program Files\McAfee\MSK [2012/11/12 22.14.49 | 000,000,000 | —D | M]

[2012/11/01 08.16.08 | 000,000,000 | —D | M] (No name found) – C:\Users\marco\AppData\Roaming\mozilla\Extensions
[2011/01/17 22.16.36 | 000,000,000 | —D | M] (No name found) – C:\Users\marco\AppData\Roaming\mozilla\Extensions\[removed]
[2012/10/23 21.14.01 | 000,000,000 | —D | M] (No name found) – C:\Users\marco\AppData\Roaming\mozilla\Firefox\Profiles\au7lw8rd.default-1346880439634\extensions
[2012/10/07 05.55.13 | 000,000,000 | —D | M] (OneClickDownloader) – C:\Users\marco\AppData\Roaming\mozilla\Firefox\Profiles\au7lw8rd.default-1346880439634\extensions\[removed]
[2012/07/31 12.59.18 | 000,221,380 | —- | M] () (No name found) – C:\Users\marco\AppData\Roaming\mozilla\firefox\profiles\au7lw8rd.default-1346880439634\extensions\[removed]
[2012/09/18 04.42.35 | 000,698,867 | —- | M] () (No name found) – C:\Users\marco\AppData\Roaming\mozilla\firefox\profiles\au7lw8rd.default-1346880439634\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi
[2012/11/01 08.16.08 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/11/07 00.14.52 | 000,000,000 | —D | M] (Skype Click to Call) – C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012/11/12 22.27.13 | 000,000,000 | —D | M] (McAfee ScriptScan for Firefox) – C:\PROGRAM FILES\COMMON FILES\MCAFEE\SYSTEMCORE
[2012/10/27 07.37.59 | 000,261,600 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/05/04 03.52.23 | 000,476,904 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2012/08/29 21.04.27 | 000,001,393 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazon-it.xml
[2012/08/29 21.04.27 | 000,002,465 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/08/29 21.04.27 | 000,000,744 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\eBay-it.xml
[2012/08/29 21.04.27 | 000,000,817 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\hoepli.xml
[2011/09/21 21.37.15 | 000,002,039 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\McSiteAdvisor.xml
[2012/08/29 21.04.27 | 000,001,182 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\wikipedia-it.xml
[2012/08/29 21.04.27 | 000,000,953 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo-it.xml

O1 HOSTS File: ([2012/11/11 06.56.55 | 000,444,829 | R— | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 15279 more lines…
O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll File not found
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\Mcafee\SystemCore\ScriptSn.20121110080745.dll (McAfee, Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (no name) - !{98889811-442D-49dd-99D7-DC866BE87DBC} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.)
O4 - HKLM..\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe (Acer Inc.)
O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe ()
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" File not found
O4 - HKCU..\Run: [] File not found
O4 - HKCU..\Run: [NokiaSuite.exe] C:\Program Files\Nokia\Nokia Suite\NokiaSuite.exe (Nokia)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - HKCU..\Run: [TomTomHOME.exe] C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe (TomTom)
O4 - HKLM..\RunOnce: [InstallShieldSetup] C:\Program Files\InstallShield Installation Information\{7F811A54-5A09-4579-90E1-C93498E230D9}\setup.exe (Acer Incorporated)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\PGPlsp.dll (PGP Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Windows\System32\PGPlsp.dll (PGP Corporation)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: poste.it ([myposte] https in Siti attendibili)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0015-0000-0016-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_16)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C0261BC4-106E-4FB7-B15B-106C90B2B374}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\vnd.ms.radio {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\Windows\System32\Msdxm6.ocx (Microsoft Corporation)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\McAfee\MSC\McSnIePl.dll (McAfee, Inc.)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - igfxdev.dll (Intel Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\Acer01.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\Acer01.jpg
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O29 - HKLM SecurityProviders - (credssp.dll) - credssp.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 22.42.20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O33 - MountPoints2\{552f039f-69ee-11e0-b1e4-001d72e8ab06}\Shell - "" = AutoRun
O33 - MountPoints2\{552f039f-69ee-11e0-b1e4-001d72e8ab06}\Shell\AutoRun\command - "" = F:\BNY2UST.exe
O33 - MountPoints2\{5b5cb3c1-660e-11e0-9641-001d72e8ab06}\Shell - "" = AutoRun
O33 - MountPoints2\{5b5cb3c1-660e-11e0-9641-001d72e8ab06}\Shell\AutoRun\command - "" = F:\.\KONY2MLT.EXE
O33 - MountPoints2\{5c525cbf-f164-11e0-807e-001d72e8ab06}\Shell - "" = AutoRun
O33 - MountPoints2\{5c525cbf-f164-11e0-807e-001d72e8ab06}\Shell\AutoRun\command - "" = G:\MMC.EXE
O33 - MountPoints2\{82decec9-f45d-11df-bbb3-001d72e8ab06}\Shell - "" = AutoRun
O33 - MountPoints2\{82decec9-f45d-11df-bbb3-001d72e8ab06}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{82dececb-f45d-11df-bbb3-001d72e8ab06}\Shell - "" = AutoRun
O33 - MountPoints2\{82dececb-f45d-11df-bbb3-001d72e8ab06}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{8a030365-262b-11e1-9cea-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{8a030365-262b-11e1-9cea-806e6f6e6963}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{8a03037b-262b-11e1-9cea-001d72e8ab06}\Shell - "" = AutoRun
O33 - MountPoints2\{8a03037b-262b-11e1-9cea-001d72e8ab06}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{cd392658-67e1-11e0-88e4-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{cd392658-67e1-11e0-88e4-806e6f6e6963}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{cd39266f-67e1-11e0-88e4-001d72e8ab06}\Shell - "" = AutoRun
O33 - MountPoints2\{cd39266f-67e1-11e0-88e4-001d72e8ab06}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{d4662648-7ff2-11e0-aff7-001d72e8ab06}\Shell - "" = AutoRun
O33 - MountPoints2\{d4662648-7ff2-11e0-aff7-001d72e8ab06}\Shell\AutoRun\command - "" = H:\AutoRun.exe
O33 - MountPoints2\{d466264a-7ff2-11e0-aff7-001d72e8ab06}\Shell - "" = AutoRun
O33 - MountPoints2\{d466264a-7ff2-11e0-aff7-001d72e8ab06}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{ecd0a575-f541-11df-972d-001d72e8ab06}\Shell - "" = AutoRun
O33 - MountPoints2\{ecd0a575-f541-11df-972d-001d72e8ab06}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{ecd0a58b-f541-11df-972d-001d72e8ab06}\Shell - "" = AutoRun
O33 - MountPoints2\{ecd0a58b-f541-11df-972d-001d72e8ab06}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{f5458524-f6e0-11e0-856a-001d72e8ab06}\Shell - "" = AutoRun
O33 - MountPoints2\{f5458524-f6e0-11e0-856a-001d72e8ab06}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{f5458527-f6e0-11e0-856a-001d72e8ab06}\Shell - "" = AutoRun
O33 - MountPoints2\{f5458527-f6e0-11e0-856a-001d72e8ab06}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\H\Shell - "" = AutoRun
O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/11/12 22.26.26 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Local\{D3BFCC72-7209-4687-B1A5-3D64DA994B70}
[2012/11/12 22.26.15 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\marco\Desktop\OTL.exe
[2012/11/12 22.22.09 | 000,000,000 | —D | C] – C:\Users\marco\Desktop\tom coyote results
[2012/11/11 06.30.25 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2012/11/11 06.29.55 | 000,000,000 | —D | C] – C:\ProgramData\Spybot - Search & Destroy
[2012/11/11 06.29.55 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2012/11/10 18.36.35 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Local\{833EF5C8-C5A0-4D85-836A-C5687A7BB766}
[2012/11/10 17.54.28 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Local\{561A5798-0B3A-46B5-B7AC-DE14665376A8}
[2012/11/10 13.53.06 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/11/10 13.52.49 | 000,022,856 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2012/11/10 13.52.49 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2012/11/10 08.01.35 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Alice MOBILE E169
[2012/11/10 08.01.24 | 000,101,376 | —- | C] (Huawei Technologies Co., Ltd.) – C:\Windows\System32\drivers\ewusbmdm.sys
[2012/11/10 08.01.24 | 000,100,864 | —- | C] (Huawei Technologies Co., Ltd.) – C:\Windows\System32\drivers\ewusbnet.sys
[2012/11/10 08.01.24 | 000,023,424 | —- | C] (Huawei Tech. Co., Ltd.) – C:\Windows\System32\drivers\ewdcsc.sys
[2012/11/10 06.35.22 | 000,000,000 | —D | C] – C:\1e4a7dd1a1fc6479d8acb16183bb41
[2012/11/10 05.51.58 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Local\{DB0540B7-46BF-434C-A650-A49B79D90E2C}
[2012/11/08 21.44.43 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Local\{0FDC6BF5-EE97-45B6-90E8-E0126AFB376B}
[2012/11/07 21.36.57 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Local\{2518D9CD-7801-43C0-AE82-46A086114CB4}
[2012/11/07 01.01.13 | 000,146,872 | —- | C] (McAfee, Inc.) – C:\Windows\System32\drivers\HipShieldK.sys
[2012/11/07 01.00.56 | 000,064,832 | —- | C] (McAfee, Inc.) – C:\Windows\System32\drivers\McPvDrv.sys
[2012/11/07 01.00.51 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
[2012/11/07 00.59.49 | 000,009,648 | —- | C] (McAfee, Inc.) – C:\Windows\System32\drivers\mfeclnk.sys
[2012/11/07 00.59.28 | 000,360,792 | —- | C] (McAfee, Inc.) – C:\Windows\System32\drivers\mfefirek.sys
[2012/11/07 00.59.28 | 000,230,224 | —- | C] (McAfee, Inc.) – C:\Windows\System32\drivers\mfeavfk.sys
[2012/11/07 00.59.28 | 000,092,192 | —- | C] (McAfee, Inc.) – C:\Windows\System32\drivers\mferkdet.sys
[2012/11/07 00.59.28 | 000,061,912 | —- | C] (McAfee, Inc.) – C:\Windows\System32\drivers\mfebopk.sys
[2012/11/07 00.59.28 | 000,060,480 | —- | C] (McAfee, Inc.) – C:\Windows\System32\drivers\cfwids.sys
[2012/11/07 00.59.08 | 000,000,000 | —D | C] – C:\Program Files\McAfee.com
[2012/11/07 00.33.15 | 000,237,072 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MpSigStub.exe
[2012/11/06 21.53.10 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Local\{0C3CC47A-060E-4D20-A1BB-2A535CA99DDF}
[2012/11/06 21.48.00 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Local\{B4C4D1F0-0BE4-4002-9EA7-0572857FD311}
[2012/11/05 23.09.52 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Roaming\McAfee
[2012/11/05 21.20.17 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Local\{1099A7AD-D8EA-41CD-BC81-5727987BBD42}
[2012/11/04 11.24.43 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Roaming\SUPERAntiSpyware.com
[2012/11/04 11.24.23 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2012/11/04 11.24.18 | 000,000,000 | —D | C] – C:\ProgramData\SUPERAntiSpyware.com
[2012/11/04 11.24.18 | 000,000,000 | —D | C] – C:\Program Files\SUPERAntiSpyware
[2012/11/04 11.09.52 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Local\{5B93A86E-079F-4EBE-BEAC-B5DA345A4A42}
[2012/11/04 11.08.03 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Local\{11CCFB98-8C9F-4361-ACEE-D811C1CF4CF0}
[2012/11/04 11.04.47 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Local\{6A3F78BA-AFF8-4631-840E-58AFAD02F999}
[2012/11/04 09.21.04 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Local\{6E874354-B79D-4591-9400-8540243CF7D5}
[2012/11/03 21.20.30 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Local\{7653DDA7-FC62-46D1-A961-5C37567C58F6}
[2012/11/03 17.03.11 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Local\{CE8CED34-DAC2-4E95-97BA-19D54AF5F4EB}
[2012/11/03 05.03.00 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Local\{C2103E2C-F02B-4DD2-921C-29050A2E71D3}
[2012/11/02 08.45.42 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2012/11/02 08.45.42 | 000,162,304 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msrating.dll
[2012/11/02 08.45.42 | 000,161,792 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msls31.dll
[2012/11/02 08.45.42 | 000,130,560 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieakeng.dll
[2012/11/02 08.45.42 | 000,110,592 | —- | C] (Microsoft Corporation) – C:\Windows\System32\IEAdvpack.dll
[2012/11/02 08.45.42 | 000,086,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2012/11/02 08.45.42 | 000,076,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\SetIEInstalledDate.exe
[2012/11/02 08.45.42 | 000,074,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RegisterIEPKEYs.exe
[2012/11/02 08.45.42 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2012/11/02 08.45.42 | 000,048,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtmler.dll
[2012/11/02 08.45.42 | 000,041,472 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2012/11/02 08.45.42 | 000,010,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2012/11/02 08.45.41 | 003,695,416 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieapfltr.dat
[2012/11/02 08.45.41 | 002,382,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2012/11/02 08.45.41 | 001,800,704 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript9.dll
[2012/11/02 08.45.41 | 001,427,968 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2012/11/02 08.45.41 | 000,607,744 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2012/11/02 08.45.41 | 000,434,176 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieapfltr.dll
[2012/11/02 08.45.41 | 000,367,104 | —- | C] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2012/11/02 08.45.41 | 000,353,792 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dxtmsft.dll
[2012/11/02 08.45.41 | 000,353,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2012/11/02 08.45.41 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\url.dll
[2012/11/02 08.45.41 | 000,227,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieaksie.dll
[2012/11/02 08.45.41 | 000,223,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dxtrans.dll
[2012/11/02 08.45.41 | 000,163,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieakui.dll
[2012/11/02 08.45.41 | 000,152,064 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wextract.exe
[2012/11/02 08.45.41 | 000,150,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iexpress.exe
[2012/11/02 08.45.41 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2012/11/02 08.45.41 | 000,118,784 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2012/11/02 08.45.41 | 000,101,888 | —- | C] (Microsoft Corporation) – C:\Windows\System32\admparse.dll
[2012/11/02 08.45.41 | 000,078,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inseng.dll
[2012/11/02 08.45.41 | 000,074,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2012/11/02 08.45.41 | 000,074,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2012/11/02 08.45.41 | 000,054,272 | —- | C] (Microsoft Corporation) – C:\Windows\System32\pngfilt.dll
[2012/11/02 08.45.41 | 000,035,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\imgutil.dll
[2012/11/02 08.45.41 | 000,031,744 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2012/11/02 08.45.41 | 000,023,552 | —- | C] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2012/11/02 07.48.07 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Roaming\WebMoney
[2012/11/01 17.31.50 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Local\{E6DF21D0-B4CE-4B8A-B5F8-7A69094856B7}
[2012/11/01 05.30.44 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Local\{3A2965D5-729C-40BC-89DD-F24A740EED98}
[2012/10/30 22.39.05 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Local\{D040632F-2AEC-46B5-9552-F39068F78E49}
[2012/10/28 04.16.25 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Local\{A894A2C9-DBF7-49F4-9890-151626242C99}
[2012/10/27 16.15.45 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Local\{4F5071F2-ABE1-4F12-B8CF-74CD951964EE}
[2012/10/27 04.13.16 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Local\{D6592C21-5655-4991-98C3-74CB7E84AB70}
[2012/10/25 20.50.49 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Local\{63C9C80C-F28B-48C3-96E6-7229E5B643B8}
[2012/10/24 20.37.04 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Local\{18CB558E-FBFF-410A-9CB4-2AC018C9AD69}
[2012/10/23 20.43.29 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Local\{3844B339-49F4-4B84-A05B-BBE4C72D024B}
[2012/10/22 21.06.21 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Local\{B7E5F427-52F9-47D1-83C6-6338094F0E86}
[2012/10/22 04.42.20 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Local\{08B165DB-3BA9-45EB-B96D-598A11F7DCF6}
[2012/10/21 19.36.39 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Local\{0AC22C09-037A-4FC2-912B-44178BEE6BCC}
[2012/10/21 07.35.22 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Local\{51ADDFBD-3B01-4ADB-AFDF-5DBD2D962C06}
[2012/10/20 04.22.01 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Local\{A798125C-8D90-4283-A4C1-BE4249A70E05}
[2012/10/18 20.47.14 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Local\{1846B98D-91C4-4E01-8028-C8D44CCEEB48}
[2012/10/17 20.42.19 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Local\{EB093284-B62C-441D-A5CE-03BBC48A2DA6}
[2012/10/16 21.05.05 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Local\{33BA04E9-F878-40EA-B2D3-E5C9E373ED46}
[2012/10/15 20.47.47 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Local\{43BA5BB5-EEA1-4DBC-AB22-9AAD6297356A}
[2012/10/14 04.03.44 | 000,000,000 | —D | C] – C:\Users\marco\AppData\Local\{EBC99707-2072-4CF1-9E20-3DB874F53C80}

========== Files - Modified Within 30 Days ==========

[2012/11/12 22.45.01 | 000,000,978 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/11/12 22.37.01 | 000,001,138 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/11/12 22.32.37 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\marco\Desktop\OTL.exe
[2012/11/12 22.27.22 | 000,804,778 | —- | M] () – C:\Windows\System32\perfh010.dat
[2012/11/12 22.27.22 | 000,717,672 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/11/12 22.27.22 | 000,170,908 | —- | M] () – C:\Windows\System32\perfc010.dat
[2012/11/12 22.27.22 | 000,145,694 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/11/12 22.26.12 | 000,010,048 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/11/12 22.26.12 | 000,010,048 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/11/12 22.25.48 | 000,001,792 | —- | M] () – C:\Users\Public\Desktop\McAfee Total Protection.lnk
[2012/11/12 22.21.42 | 000,000,436 | —- | M] () – C:\Windows\System32\drivers\etc\hosts.ics
[2012/11/12 22.21.04 | 000,001,134 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/11/12 22.16.36 | 000,000,000 | —- | M] () – C:\Windows\System32\LogConfigTemp.xml
[2012/11/12 22.16.00 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/11/12 22.15.55 | 2359,971,840 | -HS- | M] () – C:\hiberfil.sys
[2012/11/12 22.11.58 | 000,541,569 | —- | M] () – C:\Users\marco\Desktop\AdwCleaner.exe
[2012/11/12 21.59.10 | 000,000,510 | —- | M] () – C:\Windows\tasks\SUPERAntiSpyware Scheduled Task 887d97b5-bf2c-46cd-bda1-7992caa5fc3b.job
[2012/11/11 06.56.55 | 000,444,829 | R— | M] () – C:\Windows\System32\drivers\etc\hosts
[2012/11/11 06.30.25 | 000,001,180 | —- | M] () – C:\Users\marco\Desktop\Spybot - Search & Destroy.lnk
[2012/11/11 02.00.02 | 000,000,510 | —- | M] () – C:\Windows\tasks\SUPERAntiSpyware Scheduled Task 066e0261-b6fe-4589-8b98-afdec45359ce.job
[2012/11/10 13.53.06 | 000,001,031 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/11/10 08.01.36 | 000,001,037 | —- | M] () – C:\Users\Public\Desktop\Alice MOBILE E169.lnk
[2012/11/06 07.00.09 | 000,000,462 | —- | M] () – C:\Windows\tasks\vtscheduletask.job
[2012/11/05 23.09.51 | 000,002,062 | —- | M] () – C:\Users\Public\Desktop\McAfee Virtual Technician.lnk
[2012/11/04 11.24.24 | 000,001,925 | —- | M] () – C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012/11/02 08.45.42 | 000,176,640 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2012/11/02 08.45.42 | 000,162,304 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msrating.dll
[2012/11/02 08.45.42 | 000,161,792 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msls31.dll
[2012/11/02 08.45.42 | 000,130,560 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieakeng.dll
[2012/11/02 08.45.42 | 000,110,592 | —- | M] (Microsoft Corporation) – C:\Windows\System32\IEAdvpack.dll
[2012/11/02 08.45.42 | 000,086,528 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2012/11/02 08.45.42 | 000,076,800 | —- | M] (Microsoft Corporation) – C:\Windows\System32\SetIEInstalledDate.exe
[2012/11/02 08.45.42 | 000,074,752 | —- | M] (Microsoft Corporation) – C:\Windows\System32\RegisterIEPKEYs.exe
[2012/11/02 08.45.42 | 000,065,024 | —- | M] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2012/11/02 08.45.42 | 000,048,640 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mshtmler.dll
[2012/11/02 08.45.42 | 000,041,472 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2012/11/02 08.45.42 | 000,010,752 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2012/11/02 08.45.41 | 003,695,416 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieapfltr.dat
[2012/11/02 08.45.41 | 002,382,848 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2012/11/02 08.45.41 | 001,800,704 | —- | M] (Microsoft Corporation) – C:\Windows\System32\jscript9.dll
[2012/11/02 08.45.41 | 001,427,968 | —- | M] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2012/11/02 08.45.41 | 000,607,744 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2012/11/02 08.45.41 | 000,434,176 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieapfltr.dll
[2012/11/02 08.45.41 | 000,367,104 | —- | M] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2012/11/02 08.45.41 | 000,353,792 | —- | M] (Microsoft Corporation) – C:\Windows\System32\dxtmsft.dll
[2012/11/02 08.45.41 | 000,353,584 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2012/11/02 08.45.41 | 000,231,936 | —- | M] (Microsoft Corporation) – C:\Windows\System32\url.dll
[2012/11/02 08.45.41 | 000,227,840 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieaksie.dll
[2012/11/02 08.45.41 | 000,223,232 | —- | M] (Microsoft Corporation) – C:\Windows\System32\dxtrans.dll
[2012/11/02 08.45.41 | 000,163,840 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieakui.dll
[2012/11/02 08.45.41 | 000,152,064 | —- | M] (Microsoft Corporation) – C:\Windows\System32\wextract.exe
[2012/11/02 08.45.41 | 000,150,528 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iexpress.exe
[2012/11/02 08.45.41 | 000,142,848 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2012/11/02 08.45.41 | 000,118,784 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2012/11/02 08.45.41 | 000,101,888 | —- | M] (Microsoft Corporation) – C:\Windows\System32\admparse.dll
[2012/11/02 08.45.41 | 000,078,848 | —- | M] (Microsoft Corporation) – C:\Windows\System32\inseng.dll
[2012/11/02 08.45.41 | 000,074,752 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2012/11/02 08.45.41 | 000,074,240 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2012/11/02 08.45.41 | 000,072,822 | —- | M] () – C:\Windows\System32\ieuinit.inf
[2012/11/02 08.45.41 | 000,054,272 | —- | M] (Microsoft Corporation) – C:\Windows\System32\pngfilt.dll
[2012/11/02 08.45.41 | 000,035,840 | —- | M] (Microsoft Corporation) – C:\Windows\System32\imgutil.dll
[2012/11/02 08.45.41 | 000,031,744 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2012/11/02 08.45.41 | 000,023,552 | —- | M] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2012/10/21 20.01.03 | 322,903,813 | —- | M] () – C:\Windows\MEMORY.DMP
[2012/10/18 05.31.04 | 000,000,870 | —- | M] () – C:\Windows\System32\InstallUtil.InstallLog

========== Files Created - No Company Name ==========

[2012/11/12 22.11.38 | 000,541,569 | —- | C] () – C:\Users\marco\Desktop\AdwCleaner.exe
[2012/11/11 06.30.25 | 000,001,180 | —- | C] () – C:\Users\marco\Desktop\Spybot - Search & Destroy.lnk
[2012/11/10 13.53.06 | 000,001,031 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/11/10 08.01.36 | 000,001,037 | —- | C] () – C:\Users\Public\Desktop\Alice MOBILE E169.lnk
[2012/11/07 01.02.24 | 000,001,792 | —- | C] () – C:\Users\Public\Desktop\McAfee Total Protection.lnk
[2012/11/05 23.09.51 | 000,002,062 | —- | C] () – C:\Users\Public\Desktop\McAfee Virtual Technician.lnk
[2012/11/05 23.09.48 | 000,000,462 | —- | C] () – C:\Windows\tasks\vtscheduletask.job
[2012/11/05 23.06.11 | 000,002,072 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Virtual Technician.lnk
[2012/11/04 11.25.05 | 000,000,510 | —- | C] () – C:\Windows\tasks\SUPERAntiSpyware Scheduled Task 887d97b5-bf2c-46cd-bda1-7992caa5fc3b.job
[2012/11/04 11.25.03 | 000,000,510 | —- | C] () – C:\Windows\tasks\SUPERAntiSpyware Scheduled Task 066e0261-b6fe-4589-8b98-afdec45359ce.job
[2012/11/04 11.24.24 | 000,001,925 | —- | C] () – C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012/11/02 08.45.41 | 000,072,822 | —- | C] () – C:\Windows\System32\ieuinit.inf
[2012/06/25 21.35.06 | 000,086,016 | —- | C] () – C:\Windows\System32\custmon32.dll
[2012/03/15 23.31.08 | 000,019,456 | —- | C] () – C:\Windows\System32\ventmon.dll
[2012/03/15 23.04.31 | 000,000,031 | —- | C] () – C:\Windows\System32\faxman32.INI
[2012/03/15 22.59.18 | 000,051,200 | —- | C] () – C:\Windows\System32\dtmon.dll
[2012/03/15 22.59.11 | 000,002,219 | —- | C] () – C:\Windows\OEDEVKIT.INI
[2012/03/15 22.59.09 | 000,000,761 | —- | C] () – C:\Windows\BTI.INI
[2012/03/15 22.58.25 | 000,000,035 | —- | C] () – C:\Windows\WININI.INI
[2012/01/02 22.03.29 | 000,000,056 | -H– | C] () – C:\Windows\System32\ezsidmv.dat
[2011/10/29 04.49.42 | 000,007,605 | —- | C] () – C:\Users\marco\AppData\Local\Resmon.ResmonCfg
[2011/09/24 09.15.06 | 000,360,584 | —- | C] () – C:\Users\marco\AppData\Local\census.cache
[2011/09/24 09.14.13 | 000,178,038 | —- | C] () – C:\Users\marco\AppData\Local\ars.cache
[2011/09/04 04.41.22 | 000,001,166 | —- | C] () – C:\Windows\ScreenHunter.INI
[2011/07/12 22.41.20 | 000,003,584 | —- | C] () – C:\Users\marco\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/06/19 06.21.32 | 000,000,000 | —- | C] () – C:\Users\marco\AppData\Local\{6312E0A5-81E9-46F7-81FB-A34384EDA261}
[2011/06/16 21.52.03 | 002,923,100 | —- | C] () – C:\Users\marco\AppData\Local\train2sv.bin
[2011/06/15 21.32.30 | 021,022,914 | —- | C] () – C:\Users\marco\vlc-1.1.10-win32.exe
[2011/05/11 22.11.59 | 000,044,544 | —- | C] () – C:\Windows\System32\Gif89.dll
[2011/05/04 22.22.28 | 000,000,236 | —- | C] () – C:\Windows\ACTIVEJP.INI
[2011/04/24 07.24.15 | 000,000,218 | —- | C] () – C:\Users\marco\.recently-used.xbel
[2011/03/17 06.51.53 | 000,000,081 | —- | C] () – C:\Windows\MrSetup.ini
[2011/01/12 20.42.54 | 000,000,280 | —- | C] () – C:\Windows\System32\PGPsdk.dll.sig
[2010/12/04 18.37.28 | 000,064,000 | —- | C] () – C:\Windows\System32\esfw30.bin
[2010/12/04 17.39.19 | 000,000,131 | —- | C] () – C:\Windows\EPSON Perfection 1670I.ini
[2010/11/21 18.26.36 | 000,000,004 | RHS- | C] () – C:\ProgramData\sysqcl1129139270.dat
[2010/11/20 16.12.55 | 000,001,374 | —- | C] () – C:\Windows\photopnt.ini
[2010/11/20 09.13.35 | 000,000,424 | —- | C] () – C:\Windows\ODBC.INI
[2010/11/19 01.13.31 | 000,021,500 | —- | C] () – C:\Windows\System32\emptyregdb.dat
[2010/11/17 22.32.53 | 000,001,766 | —- | C] () – C:\Users\marco\AppData\Roaming\wklnhst.dat
[2010/11/17 00.00.14 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2010/11/15 08.51.09 | 000,049,152 | —- | C] ( ) – C:\Windows\Interop.IWshRuntimeLibrary.dll
[2010/11/15 08.37.26 | 001,060,424 | —- | C] () – C:\Windows\System32\WdfCoInstaller01000.dll
[2010/11/15 05.15.12 | 000,204,800 | —- | C] () – C:\Windows\System32\SysHook.dll
[2010/11/15 05.12.31 | 000,626,688 | —- | C] () – C:\Windows\Image.dll
[2010/11/15 05.12.31 | 000,200,704 | —- | C] () – C:\Windows\PLFSetI.exe
[2010/11/15 05.12.31 | 000,000,036 | —- | C] () – C:\Windows\PidList.ini
[2010/11/15 05.09.19 | 000,001,694 | —- | C] () – C:\Windows\RtDefLvl.ini
[2010/11/15 05.09.19 | 000,000,520 | —- | C] () – C:\Windows\System32\drivers\RTEQEX1.dat
[2010/11/15 05.09.19 | 000,000,520 | —- | C] () – C:\Windows\System32\drivers\RTEQEX0.dat
[2010/11/15 05.09.19 | 000,000,008 | —- | C] () – C:\Windows\System32\drivers\rtkhdaud.dat

========== ZeroAccess Check ==========

[2009/07/14 05.42.31 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/09 05.41.00 | 012,873,728 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/20 13.19.02 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll – [2009/07/14 02.16.17 | 000,342,528 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2010/11/19 01.08.09 | 000,000,000 | —D | M] – C:\Users\marco\AppData\Roaming\Acer GameZone Console
[2011/04/12 23.15.37 | 000,000,000 | —D | M] – C:\Users\marco\AppData\Roaming\DAEMON Tools Lite
[2011/04/14 05.57.29 | 000,000,000 | —D | M] – C:\Users\marco\AppData\Roaming\DAEMON Tools Pro
[2010/12/04 18.56.15 | 000,000,000 | —D | M] – C:\Users\marco\AppData\Roaming\EPSON
[2011/05/07 07.14.34 | 000,000,000 | —D | M] – C:\Users\marco\AppData\Roaming\GetGo Software
[2012/10/01 21.42.07 | 000,000,000 | —D | M] – C:\Users\marco\AppData\Roaming\GoforFiles
[2011/04/23 17.59.24 | 000,000,000 | —D | M] – C:\Users\marco\AppData\Roaming\gtk-2.0
[2012/02/07 22.11.31 | 000,000,000 | —D | M] – C:\Users\marco\AppData\Roaming\Nokia
[2011/09/03 15.38.05 | 000,000,000 | —D | M] – C:\Users\marco\AppData\Roaming\OutWit
[2011/02/19 17.48.43 | 000,000,000 | —D | M] – C:\Users\marco\AppData\Roaming\PC Suite
[2012/09/29 08.46.14 | 000,000,000 | —D | M] – C:\Users\marco\AppData\Roaming\PGP Corporation
[2012/03/15 22.13.37 | 000,000,000 | —D | M] – C:\Users\marco\AppData\Roaming\Scendix Software
[2012/03/15 22.13.17 | 000,000,000 | —D | M] – C:\Users\marco\AppData\Roaming\Softland
[2010/11/19 01.08.13 | 000,000,000 | —D | M] – C:\Users\marco\AppData\Roaming\Template
[2011/06/07 22.18.20 | 000,000,000 | —D | M] – C:\Users\marco\AppData\Roaming\thriXXX
[2011/01/17 22.16.34 | 000,000,000 | —D | M] – C:\Users\marco\AppData\Roaming\TomTom
[2011/03/31 19.16.09 | 000,000,000 | —D | M] – C:\Users\marco\AppData\Roaming\webex
[2012/11/02 07.48.07 | 000,000,000 | —D | M] – C:\Users\marco\AppData\Roaming\WebMoney
[2011/08/10 10.01.51 | 000,000,000 | —D | M] – C:\Users\marco\AppData\Roaming\WhiteSmoke
[2010/12/02 22.48.16 | 000,000,000 | —D | M] – C:\Users\marco\AppData\Roaming\Windows Live Writer

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: EXPLORER.EXE >
[2011/02/26 06.19.21 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe
[2009/07/14 02.14.20 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe
[2011/02/26 06.51.13 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_525b5180f3f95373\explorer.exe
[2009/10/31 06.45.39 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe
[2011/02/26 06.33.07 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_51a3a583dafd0cef\explorer.exe
[2010/11/20 13.17.09 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe
[2011/02/25 06.30.54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\explorer.exe
[2011/02/25 06.30.54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe
[2009/08/03 06.49.47 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe
[2009/08/03 06.35.50 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe
[2009/10/31 07.00.51 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe

< MD5 for: SERVICES.EXE >
[2009/07/14 02.14.36 | 000,259,072 | —- | M] (Microsoft Corporation) MD5=5F1B6A9C35D3D5CA72D6D6FDEF9747D6 – C:\Windows\System32\services.exe
[2009/07/14 02.14.36 | 000,259,072 | —- | M] (Microsoft Corporation) MD5=5F1B6A9C35D3D5CA72D6D6FDEF9747D6 – C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\services.exe

< MD5 for: SVCHOST.EXE >
[2009/07/14 02.14.41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe
[2012/09/29 19.54.26 | 000,218,184 | —- | M] () MD5=8846E87210AD131CF71E3E2E49F647B0 – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\svchost.exe
[2009/07/14 02.14.41 | 000,020,992 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\System32\svchost.exe

< MD5 for: USERINIT.EXE >
[2010/11/20 13.17.48 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\System32\userinit.exe
[2010/11/20 13.17.48 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009/07/14 02.14.43 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

< MD5 for: WINLOGON.EXE >
[2009/10/28 07.17.59 | 000,285,696 | —- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009/10/28 06.52.08 | 000,285,696 | —- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2010/11/20 13.17.54 | 000,286,720 | —- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 – C:\Windows\System32\winlogon.exe
[2010/11/20 13.17.54 | 000,286,720 | —- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2012/09/29 19.54.26 | 000,218,184 | —- | M] () MD5=8846E87210AD131CF71E3E2E49F647B0 – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009/07/14 02.14.45 | 000,285,696 | —- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe

< %systemroot%\*. /rp /s >

< %systemdrive%\$Recycle.Bin|@;true;true;true >

< %USERPROFILE%\..|smtmp;true;true;true /FP >

< %temp%\smtmp\*.* /s > >

========== Drive Information ==========

Physical Drives
—————

Drive: \\\\.\\PHYSICALDRIVE0 - Fixed hard disk media
Interface type: IDE
Media Type: Fixed hard disk media
Model: WDC WD5000BEVT-22ZAT0 ATA Device
Partitions: 3
Status: OK
Status Info: 0

Partitions
—————

DeviceID: Disk #0, Partition #0
PartitionType: Unknown
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 10,00GB
Starting Offset: 1048576
Hidden sectors: 0

DeviceID: Disk #0, Partition #1
PartitionType: Installable File System
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 228,00GB
Starting Offset: 10486808576
Hidden sectors: 0

DeviceID: Disk #0, Partition #2
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 228,00GB
Starting Offset: 255310430208
Hidden sectors: 0

========== Alternate Data Streams ==========

@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:A064CECC
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:41ADDB8A
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:D5AD7675

< End of report >

marcopcnn

Post #6November 13, 2012, 4:28 AM UTC

The OTL extra file
OTL Extras logfile created on: 12/11/2012 22.47.47 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\marco\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000410 | Country: Italia | Language: ITA | Date Format: dd/MM/yyyy

2,93 Gb Total Physical Memory | 2,26 Gb Available Physical Memory | 77,05% Memory free
5,86 Gb Paging File | 4,36 Gb Available in Paging File | 74,44% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 228,01 Gb Total Space | 127,32 Gb Free Space | 55,84% Space Free | Partition Type: NTFS
Drive D: | 227,98 Gb Total Space | 34,20 Gb Free Space | 15,00% Space Free | Partition Type: NTFS

Computer Name: PORTATILE | User Name: marco | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

========== Authorized Applications List ==========

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{002F6CF4-D2A8-43AC-89AE-445000BC6CE8}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{09699A25-5845-411C-8579-550D22ECBA64}" = lport=445 | protocol=6 | dir=in | app=system |
"{0C3D7F2F-0607-4D4B-BC18-6D15074236BD}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{126ADA38-81AC-44F7-AFA1-101F975893EB}" = lport=2869 | protocol=6 | dir=in | app=system |
"{1282B405-19AA-4CD3-8DD9-2346CA39BA8E}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{1A04922C-6AB4-4B12-A724-ED69D3C6B7A2}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{1E30532F-9D7C-4479-A836-A91CBD10568D}" = rport=2869 | protocol=6 | dir=out | app=system |
"{32EDB9F9-B0E2-4D60-9CCA-9E4D5ABE7EF9}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{3BCC2A94-B418-428E-9350-B86554C90E5C}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework\v4.0.30319\smsvchost.exe |
"{3CA8D12D-4EC2-4116-B2E0-0DF2252FAF4F}" = lport=138 | protocol=17 | dir=in | app=system |
"{42D2D932-C9C2-4B68-9509-5D2BC3530F16}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{51BBF075-69BF-4796-B353-E0AF7D7BF433}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{533E77A3-1CF8-4D46-BB49-95E2DB07D41E}" = rport=445 | protocol=6 | dir=out | app=system |
"{5AEB7B46-0B5D-4D40-895A-C013C6C6AD41}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{5FC2E9A4-11E5-4FDA-A2D7-31D36697CB33}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{6375ACA7-FFD5-486A-920B-38D1C8B2191D}" = rport=137 | protocol=17 | dir=out | app=system |
"{6446BE75-E1CF-4D53-943C-6F13CA40F3FB}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{6BBFD7B5-033D-47AA-9F10-43D7AF1195A3}" = rport=138 | protocol=17 | dir=out | app=system |
"{718AB818-7022-4FA0-A584-31E6D6AF3795}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{8E70C6A0-5C91-4F05-BE75-CCF4D22415D3}" = lport=2869 | protocol=6 | dir=in | app=system |
"{914AF5DD-1B12-4D85-961B-BE6B582D3A64}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{B4E7CE2F-07A5-4DE9-B168-049366758A28}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{BC8BE561-AA46-4A87-93C5-1C227E03664D}" = rport=139 | protocol=6 | dir=out | app=system |
"{CA33FE20-2BCB-470F-8260-96EA054BB7EB}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{CCABF71D-9FE3-4F99-9ECA-12CB55B5F550}" = lport=137 | protocol=17 | dir=in | app=system |
"{D73B619B-0474-4BAA-B542-05D4C1E8B7A8}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{E5863DE5-5EF5-40D2-9AE0-90224AF66B35}" = lport=139 | protocol=6 | dir=in | app=system |
"{E7AE1022-D1AB-45DD-A460-41A6222D08F8}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{E80DD5C4-DDF5-4EE9-B872-0449669B4BB5}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{EFA0B683-1B26-4259-8DF9-1DEF3064A16F}" = rport=10243 | protocol=6 | dir=out | app=system |
"{F7929B76-5315-4FE2-89AA-329AF274D89C}" = lport=10243 | protocol=6 | dir=in | app=system |
"{FC1F1B25-6EC2-4FAD-9713-489720A7912E}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{FE72F2D7-5851-48F6-89AA-81D6025AD736}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{FE73D608-5663-4FB6-A302-18B64930F1C8}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00B4AFDE-1F10-4A70-9B72-BD168607555E}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe |
"{080AEFC1-AC51-4EE7-85D8-6B02DDEE5DC1}" = dir=in | app=c:\program files\acer arcade deluxe\playmovie\pmvservice.exe |
"{0830F5D2-91EA-40FA-AE01-7440809979E6}" = dir=in | app=c:\program files\common files\nokia\service layer\a\nsl_host_process.exe |
"{0D51BA99-356E-4B7A-9E65-987ED78BA285}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\client\agentsvc.exe |
"{172CB168-2EA8-42F8-AFCC-517FB503736A}" = dir=in | app=c:\program files\acer arcade deluxe\playmovie\playmovie.exe |
"{17CBDD5E-81F4-4BC4-A838-BF49445C92DC}" = protocol=6 | dir=in | app=c:\program files\freesoft\titaniumfax\titaniumfaxserver.exe |
"{1CCE1935-C12D-4249-AB64-BD114350BE1B}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{2484158C-2296-4D70-B65F-CB8298C576F2}" = dir=in | app=c:\program files\common files\nokia\service layer\a\nsl_host_process.exe |
"{25ACE27A-FC13-4D40-B5FC-CEDBF81C08AC}" = protocol=58 | dir=out | name=@iphlpsvc.dll,-503 |
"{2AE8BDA9-CEF6-494B-BA3D-1DE9080FB128}" = protocol=6 | dir=in | app=c:\program files\freesoft\titaniumfax\titaniumfax.exe |
"{2E777D66-8EEA-4BAA-891D-021D5138D5E9}" = dir=in | app=c:\program files\nokia\nokia suite\nokiasuite.exe |
"{316AA45D-3875-46A9-BB64-C51508AC4141}" = protocol=6 | dir=in | app=c:\program files\goforfiles\goforfilesdl.exe |
"{33B26067-91C4-46CC-9702-FA58CACFD47F}" = dir=in | app=c:\program files\acer arcade deluxe\homemedia\homemedia.exe |
"{33E13B53-184D-40FA-A9FF-BF1DEDE1F3DE}" = dir=in | app=c:\program files\nokia\nokia ovi suite\nokiaovisuite.exe |
"{36B54A40-EFFD-4DAC-96BD-05BC8F01F5B9}" = protocol=17 | dir=in | app=c:\program files\freesoft\titaniumfax\titaniumfax.exe |
"{4104C360-373D-47D1-A845-E52C5D735D35}" = protocol=6 | dir=in | app=c:\program files\goforfiles\goforfiles.exe |
"{44AEB2C0-9453-4B3A-BED8-025D352F0005}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{4E63B3B4-3164-4D97-A532-2B291FB6D847}" = dir=in | app=c:\program files\nokia\nokia ovi suite\nokiaovisuite.exe |
"{4F0DE112-58F0-4603-8FCA-D7C11B78AD06}" = dir=in | app=c:\program files\common files\nokia\service layer\a\nsl_host_process.exe |
"{551D50E5-0264-45AE-B807-D17FEE3A200D}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{586A398C-C349-483E-9ECA-262AD02B1811}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{5DC4340F-D057-4369-A25B-2BBC563C29D2}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{638D525A-B8EA-44F6-BDD8-C30828E847E5}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{6C4D10BE-E04D-4CCA-A4C9-728B10CE61B6}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{744B8387-2FCE-444C-9953-C6FD952C18BB}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{750D13A7-D3E5-4537-9C53-849A0BE311F8}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{76897652-EB3B-411A-90F5-DE621002FCA0}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{8214AEF2-F104-4975-ACE9-D33F92F217D7}" = dir=in | app=c:\program files\nokia\nokia suite\nokiasuite.exe |
"{838AB3E8-9733-4E5C-979D-C6AB261E1B33}" = dir=in | app=c:\program files\common files\nokia\service layer\a\nsl_host_process.exe |
"{84DDF911-286A-4F5F-A65C-04670E7BE627}" = dir=in | app=c:\program files\common files\nokia\service layer\a\nsl_host_process.exe |
"{8B5C62A1-1CE2-4802-BF03-34597667CE8D}" = dir=in | app=c:\program files\acer arcade deluxe\acer arcade deluxe\acer arcade deluxe.exe |
"{8CE8F528-1E9F-4430-AD9B-10259617BCBD}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe |
"{8D0247B6-B148-4E39-870B-8FF98EEBC8C8}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\schedulersvc.exe |
"{90CCE488-2499-41DF-B68B-6DBA099FA159}" = dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{99E2FA24-9CCE-4BE4-9490-66099D6E89E3}" = protocol=17 | dir=in | app=c:\program files\goforfiles\goforfilesdl.exe |
"{9B7BAA3B-F58F-43DE-A0FA-5133AAAB90AC}" = dir=in | app=c:\program files\nokia\nokia ovi suite\nokiaovisuite.exe |
"{A38B6703-8CFB-464A-BA28-0C7599718CD6}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\client\agentsvc.exe |
"{A8523A70-DE7B-4ABD-B8FC-540617C6DF60}" = protocol=6 | dir=out | app=system |
"{A9E25D76-F723-4541-B5E1-6679E3D3C787}" = dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe |
"{B34FC194-DDE7-4935-92EE-656BAF42FC7C}" = dir=in | app=c:\program files\common files\nokia\service layer\a\nsl_host_process.exe |
"{B4AE1856-28C0-4FC8-9C33-F11CEC22AD59}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{B649FC54-F64C-4EDC-9143-D822A5E8E5E4}" = protocol=17 | dir=in | app=c:\program files\freesoft\titaniumfax\titaniumfaxserver.exe |
"{B8B088DD-7103-47E0-B4B1-0AE27590E422}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{BAB2351A-AFB4-4174-A406-B14C15C2E4F9}" = dir=in | app=c:\program files\windows live\mesh\moe.exe |
"{BDFAEAEA-3242-433E-A253-F663B5799573}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{C25C39B7-BE70-407E-B33B-415FB6E209C3}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{C604FC6E-825F-4E29-8A72-37E7A1DCFFF5}" = dir=in | app=c:\program files\nokia\nokia ovi suite\nokiaovisuite.exe |
"{CA62FE32-F382-440C-8A52-9B84EFEBB87B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{D0928843-AC55-4A19-BE03-95D9AC427752}" = protocol=17 | dir=in | app=c:\program files\goforfiles\goforfiles.exe |
"{DC808DF1-C040-4E29-A5B1-73952534C8BA}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\backupsvc.exe |
"{DE5DC351-5F3C-4804-8BE0-576F4D1C5411}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 |
"{DF21046C-0A25-4FAF-A1BF-517BEF5405D8}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{E0D3F5EF-AC42-43B6-8083-1F92DF80C365}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{E7396943-4CE5-42E3-A7EA-71FF51C54DCF}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\backupsvc.exe |
"{EAF42EA8-B19B-495B-BC9A-91FB56C6C156}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe |
"{EC24D04E-12B7-4179-977F-3C02A544607F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{EDD33C57-C9CF-452D-AF8F-BF917549F62B}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{F0599F67-0601-4D3D-A86A-E4681DE023BA}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\schedulersvc.exe |
"{F2EBA39F-97B5-42B4-89E6-4F36500815AE}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{F3E164C9-F722-4569-ACDF-EA617CBA91F6}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{F882C326-7909-4B91-ACC1-E4AFD032F9F1}" = protocol=58 | dir=in | app=system |
"{FF394253-3C61-40B8-82D7-9694C6915A13}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{10722A88-7C26-4F90-A520-88B40A91E485}" = Microsoft SQL Server 2008 R2 Management Objects
"{11316260-6666-467B-AC34-183FCB5D4335}" = Acer Mobility Center Plug-In
"{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now Standard
"{13D85C14-2B85-419F-AC41-C7F21E68B25D}" = Acer eSettings Management
"{186CCF6D-5BEF-3591-80E3-5300CEBA876E}" = Microsoft Visual Basic 2010 Express - ITA
"{1945A4B5-73B6-4DE9-99A3-05261B7FDED0}" = Shared C Run-time for x86
"{19A4A990-5343-4FF7-B3B5-6F046C091EDF}" = Windows Live Remote Client
"{1D76557F-04F5-4CF9-AB20-6A621B0D52D7}" = MyPDFConverter
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{227E8782-B2F4-4E97-B0EE-49DE9CC1C0C0}" = Windows Live Remote Service
"{22F90F2E-1DA2-4801-A58C-FC3D13297749}" = Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 ITA
"{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"{246D27BE-94F5-4838-B1F9-6DD3E379E488}" = Microsoft SQL Server 2008 Database Engine Services
"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade Deluxe
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java™ 6 Update 26
"{2D6E3D97-1FDF-4993-AC75-72F59EC445C5}" = Windows Live Family Safety
"{3248F0A8-6813-11D6-A77B-00B0D0150160}" = J2SE Runtime Environment 5.0 Update 16
"{32714140-CBC5-3FAF-BFC2-3A7376C3EECF}" = Microsoft .NET Framework 4 Client Profile ITA Language Pack
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{33AE9E89-47C9-4A0D-9E9D-BDD6966A3804}" = Microsoft SQL Server 2008 RsFx Driver
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{40BFD84C-64CD-42CC-9909-8734C50429C6}" = Windows Live UX Platform Language Pack
"{4344E211-F621-3870-9A08-2F56C71BA0A7}" = Microsoft .NET Framework 4 Extended ITA Language Pack
"{4506A36C-D783-473A-886D-10869597FD50}" = Microsoft SQL Server System CLR Types
"{46872828-6453-4138-BE1C-CE35FBF67978}" = Windows Live Mesh
"{47AB8413-346A-4745-BC24-8520877313C1}" = Windows Live Family Safety
"{47C39E4A-28F2-33B1-B9B7-97F24E52D917}" = Microsoft Help Viewer 1.0
"{48667EB3-6A7F-47B1-9C97-AFEDB4FD6B8D}" = Microsoft SQL Server 2008 Database Engine Shared
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A6F34E2-09E5-4616-B227-4A26A488A6F9}" = Microsoft SQL Server 2008 Common Files
"{4B1EDAFC-B0EB-465F-886C-24FAC1BED2AC}" = Windows Live Remote Client Resources
"{520C1D80-935C-42B9-9340-E883849D804F}_is1" = DriverTuner [removed]
"{58E5844B-7CE2-413D-83D1-99294BF6C74F}" = Acer ePower Management
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5A9FE525-8B8F-4701-A937-7F6745A4E9C7}" = RGSS-RTP Standard
"{5B63A470-9334-44D1-AF61-6CE2DB565AE9}" = Orion
"{62D5B0B1-9E1D-4d66-A593-D68F3FED7709}" = Microsoft Works
"{6432B21C-CA95-46CA-87D4-178CC2E58F84}_is1" = PamFax
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{677AAD91-1790-4FC5-B285-0E6A9D65F7DC}" = Windows Live Mail
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6A1F0A1A-474C-4151-8534-5F61832D88CD}" = Comic Life
"{6C5D7191-140A-11D6-B5A0-0050DA208A93}" = ArcSoft PhotoImpression
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6E8AFC13-F7B8-41D8-88AB-F1D0CFC56305}" = Windows Live Messenger
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{73FC3510-6421-40F7-9503-EDAE4D0CF70D}" = Windows Live Photo Common
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77F8A71E-3515-4832-B8B2-2F1EDBD2E0F1}" = Bing Bar
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{7964AE02-9127-42C0-A917-2CE4CD4EFE3B}" = Nokia Suite
"{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}" = Acer ScreenSaver
"{7F18F75E-A395-4273-A73E-C87CD0705D9B}" = PGP Desktop
"{81861164-9522-43FA-8880-B4F71CB3CF79}" = Microsoft SQL Server 2008 Native Client
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11029123}" = Bricks of Egypt
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110322783}" = Big Kahuna Reef
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110411970}" = Chuzzle
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111118433}" = Mystery Case Files - Huntsville
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111199750}" = Cake Mania
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111252743}" = Mahjong Escape Ancient China
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111543617}" = Backspin Billiards
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111692950}" = Mahjongg Artifacts
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111771833}" = Jewel Quest Solitaire
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111796363}" = Mystery Solitaire - Secret Island
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111872660}" = Diner Dash Flo on the Go
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112531267}" = Chicken Invaders 3
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113009953}" = Turbo Pizza
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113080210}" = Azada
"{834EA459-FD2C-4336-9DFE-C4EDBF63D51A}" = Microsoft SQL Server 2008 Browser
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A9E54D0-3AD3-11D6-BF73-0050BF5A9E54}" = WebPix 1.07
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8F1B6239-FEA0-450A-A950-B05276CE177C}" = Acer Empowering Technology
"{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{9017CEAF-BE5A-4F73-8A0E-C87E26971E55}" = TomTom HOME
"{90300410-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Media Content
"{91110410-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional
"{91190410-6000-11D3-8CFE-0050048383C9}" = Microsoft Publisher 2002
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{93E464B3-D075-4989-87FD-A828B5C308B1}" = Windows Live Writer Resources
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A14F2004-5A64-35A0-BA3F-C525B0E75263}" = Microsoft Help Viewer 1.0 Language Pack - ITA
"{A5633652-3795-4829-BB0B-644F0279E279}" = Acer eDataSecurity Management
"{A57025CC-5F2E-4D01-B387-06DB10500D43}" = Nokia Connectivity Cable Driver
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A77255C4-AFCB-44A3-BF0F-2091A71FFD9E}" = Acer Crystal Eye Webcam 2.0.8
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AC0628FF-532F-4800-91EC-40903B04682F}" = Windows Live Remote Service Resources
"{AC76BA86-7AD7-1040-7B44-A95000000001}" = Adobe Reader 9.5.2 - Italiano
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{ACB6D28B-2D17-314C-9C6C-B597C0A3C15A}" = Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{AF600F7B-67A7-48D9-BA3B-0FF97F35F970}" = ABBYY FineReader 6.0
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{B23B8C0C-DEAE-4147-AFD4-A000A67CB98C}" = Microsoft SQL Server Compact 3.5 SP2 ITA
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B423108E-F1F3-4EC0-80F5-0AC7D6ED5F1E}" = Microsoft SQL Server VSS Writer
"{B5153233-9AEE-4CD4-9D2C-4FAAC870DBE2}" = Microsoft SQL Server 2008 Database Engine Services
"{B69CC1A5-0404-11D6-ABCB-005004C21D30}" = EPSON Copy Utility
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B7E38540-E355-3503-AFD7-635B2F2F76E1}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974
"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant
"{C63A1E60-B6A4-440B-89A5-1FC6E4AC1C94}" = Windows Live Mesh ActiveX Control for Remote Connections
"{C7DAD22D-29D4-438F-B986-03B9ED582EA4}" = Messenger Companion
"{C965F01C-76EA-4BD7-973E-46236AE312D7}" = Sql Server Customer Experience Improvement Program
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe 1.4.142.1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{D1696920-9794-4BBC-8A30-7A88763DE5A2}" = ABBYY FineReader 5.0 Sprint
"{D36DD326-7280-11D8-97C8-000129760CBE}" = PhotoNow!
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DA5B2BDC-F654-4A88-A669-4D34BC7846A1}" = PC Connectivity Solution
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{DE7C13A6-E4EA-4296-B0D5-5D7E8AD69501}" = Windows Live Writer
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{DEF91E0F-D266-453D-B6F2-1BA002B40CB6}" = Windows Live Essentials
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E3B64CC5-C011-40C0-92BC-7316CD5E5688}" = Microsoft_VC100_CRT_SP1_x86
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E6192C90-2D14-45FC-AB62-CC1D3EF948C9}" = File di supporto installazione di Microsoft SQL Server 2008
"{EBAE381B-60A6-4863-AA9F-FCAB755BC9E5}" = ScanToWeb
"{ED16B700-D91F-44B0-867C-7EB5253CA38D}" = Raccolta foto di Windows Live
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{EF462F41-AE1B-4C95-98B3-077562EA190F}" = Microsoft SQL Server 2008 Common Files
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F3494AB6-6900-41C6-AF57-823626827ED8}" = Microsoft SQL Server 2008 Database Engine Shared
"{F70AE624-2B41-476F-BC9C-0A7F158C3F15}" = SweetIM for Messenger 3.4
"{FF3DFA01-1E98-46B4-A065-DA8AD47C9598}" = Windows Live Movie Maker
"1ClickDownload" = 1ClickDownloader
"4k Video Downloader_is1" = 4k Video Downloader 2.2
"4k YouTube to MP3_is1" = 4k YouTube to MP3 1.6
"504244733D18C8F63FF584AEB290E3904E791693" = Pacchetto driver Windows - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"Acer GameZone Console_is1" = Acer GameZone Console 2.0.1.1
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Adventure Maker v4.5.2_is1" = Adventure Maker v4.5.2 (build1)
"Adventure Maker v4.6.1_is1" = Adventure Maker v4.6.1 (build1)
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"Alice MOBILE E169" = Alice MOBILE E169
"AoA Video Joiner_is1" = AoA Video Joiner
"Banshee Screamer Alarm_is1" = Banshee Screamer Alarm 2.55
"BSPlayerf" = BS.Player FREE
"DAEMON Tools Lite" = DAEMON Tools Lite
"Driving Speed 2_is1" = Driving Speed 2.0
"EPSON Scanner" = EPSON Scan
"ESET Online Scanner" = ESET Online Scanner v3
"File Internet" = UnicoOnLine - File Internet 2.6.6
"FileInternet" = FileInternet
"Fisconline-UnicoOnLinePF 2010" = Fisconline-UnicoOnLinePF 2010
"GridVista" = Acer GridVista
"HDMI" = Intel® Graphics Media Accelerator Driver
"InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now 5
"InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade Deluxe
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"Karen's Directory Printer" = Karen's Directory Printer
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware versione 1.65.1.1000
"Marvell Miniport Driver" = Marvell Miniport Driver
"McAfee Virtual Technician" = McAfee Virtual Technician
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile ITA Language Pack" = Microsoft .NET Framework 4 Client Profile - Language Pack (ITA)
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended ITA Language Pack" = Microsoft .NET Framework 4 Extended - Language Pack (ITA)
"Microsoft Help Viewer 1.0" = Microsoft Help Viewer 1.0
"Microsoft Help Viewer 1.0 Language Pack - ITA" = Language Pack del Visualizzatore della Guida Microsoft 1.0 - ITA
"Microsoft SQL Server 10" = Microsoft SQL Server 2008
"Microsoft SQL Server 10 Release" = Microsoft SQL Server 2008
"Microsoft Visual Basic 2010 Express - ITA" = Microsoft Visual Basic 2010 Express - ITA
"MMC" = ƒ}ƒ}ƒNƒ‰ƒu
"ModuliControllo2012" = ModuliControllo2012
"Mozilla Firefox 16.0.2 (x86 it)" = Mozilla Firefox 16.0.2 (x86 it)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MSC" = McAfee Total Protection
"Nokia Suite" = Nokia Suite
"P1670 Guida di riferimento" = P1670 Guida di riferimento
"Split Join Convert Video_is1" = Split Join Convert Video 1.0
"ST5UNST #1" = FaxDrive
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"VLC media player" = VLC media player 2.0.3
"WH_DirPrint40" = DirPrint 4.0
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR gestione archivi
"Wisdom-soft Set up ScreenHunter 5.1 Free" = Wisdom-soft Set up ScreenHunter 5.1 Free

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"ActiveTouchMeetingClient" = WebEx
"Controlli 2012" = Controlli 2012
"UnicoOnLine PF 2011" = UnicoOnLine PF 2011
"UnicoOnLine PF 2012" = UnicoOnLine PF 2012

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 31/01/2012 22.51.30 | Computer Name = Portatile | Source = SideBySide | ID = 16842785
Description = Generazione del contesto di attivazione non riuscita per "C:\Program
Files\Acer\Empowering Technology\eDataSecurity\x64\eDScsp.exe". Impossibile trovare
l'assembly dipendente Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0".
Utilizzare
sxstrace.exe per ottenere una diagnosi dettagliata.

Error - 31/01/2012 22.52.50 | Computer Name = Portatile | Source = SideBySide | ID = 16842785
Description = Generazione del contesto di attivazione non riuscita per "C:\Program
Files\Acer\Empowering Technology\eDataSecurity\x64\eDStbmngr.exe". Impossibile trovare
l'assembly dipendente Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0".
Utilizzare
sxstrace.exe per ottenere una diagnosi dettagliata.

Error - 31/01/2012 22.53.12 | Computer Name = Portatile | Source = SideBySide | ID = 16842785
Description = Generazione del contesto di attivazione non riuscita per "C:\Program
Files\Acer\Empowering Technology\eDataSecurity\x64\eDSLoader.exe". Impossibile trovare
l'assembly dipendente Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0".
Utilizzare
sxstrace.exe per ottenere una diagnosi dettagliata.

Error - 31/01/2012 22.53.53 | Computer Name = Portatile | Source = SideBySide | ID = 16842785
Description = Generazione del contesto di attivazione non riuscita per "C:\Program
Files\Acer\Empowering Technology\eDataSecurity\x64\eDS_CCPSD.exe". Impossibile trovare
l'assembly dipendente Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0".
Utilizzare
sxstrace.exe per ottenere una diagnosi dettagliata.

Error - 31/01/2012 23.00.50 | Computer Name = Portatile | Source = SideBySide | ID = 16842785
Description = Generazione del contesto di attivazione non riuscita per "c:\Program
Files\Microsoft Visual Studio 10.0\Common7\Packages\Debugger\X64\msvsmon.exe". Impossibile
trovare l'assembly dipendente Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0".
Utilizzare
sxstrace.exe per ottenere una diagnosi dettagliata.

Error - 02/02/2012 17.07.42 | Computer Name = Portatile | Source = WinMgmt | ID = 10
Description =

Error - 02/02/2012 17.19.33 | Computer Name = Portatile | Source = TomTomHOMEService | ID = 10000
Description =

Error - 04/02/2012 0.18.51 | Computer Name = Portatile | Source = WinMgmt | ID = 10
Description =

Error - 06/02/2012 16.51.23 | Computer Name = Portatile | Source = WinMgmt | ID = 10
Description =

Error - 07/02/2012 16.46.11 | Computer Name = Portatile | Source = WinMgmt | ID = 10
Description =

Error - 08/02/2012 16.43.25 | Computer Name = Portatile | Source = WinMgmt | ID = 10
Description =

[ Media Center Events ]
Error - 26/02/2012 3.14.39 | Computer Name = Portatile | Source = MCUpdate | ID = 0
Description = 08:14:39 - Errore di connessione a Internet. 08:14:39 - Impossibile
contattare il server..

Error - 26/02/2012 3.14.51 | Computer Name = Portatile | Source = MCUpdate | ID = 0
Description = 08:14:44 - Errore di connessione a Internet. 08:14:44 - Impossibile
contattare il server..

Error - 26/02/2012 4.15.03 | Computer Name = Portatile | Source = MCUpdate | ID = 0
Description = 09:15:03 - Errore di connessione a Internet. 09:15:03 - Impossibile
contattare il server..

Error - 26/02/2012 4.15.12 | Computer Name = Portatile | Source = MCUpdate | ID = 0
Description = 09:15:08 - Errore di connessione a Internet. 09:15:08 - Impossibile
contattare il server..

Error - 28/02/2012 17.05.04 | Computer Name = Portatile | Source = MCUpdate | ID = 0
Description = 22:05:04 - Errore di connessione a Internet. 22:05:04 - Impossibile
contattare il server..

Error - 28/02/2012 17.05.23 | Computer Name = Portatile | Source = MCUpdate | ID = 0
Description = 22:05:09 - Errore di connessione a Internet. 22:05:09 - Impossibile
contattare il server..

Error - 13/03/2012 22.53.07 | Computer Name = Portatile | Source = MCUpdate | ID = 0
Description = 03:52:58 - Errore di connessione a Internet. 03:52:58 - Impossibile
contattare il server..

Error - 13/03/2012 23.53.52 | Computer Name = Portatile | Source = MCUpdate | ID = 0
Description = 04:53:33 - Errore di connessione a Internet. 04:53:33 - Impossibile
contattare il server..

Error - 14/03/2012 0.53.59 | Computer Name = Portatile | Source = MCUpdate | ID = 0
Description = 05:53:57 - Errore di connessione a Internet. 05:53:57 - Impossibile
contattare il server..

Error - 17/03/2012 1.24.45 | Computer Name = Portatile | Source = MCUpdate | ID = 0
Description = 06:24:16 - Impossibile recuperare Broadband (Errore: Connessione sottostante
chiusa: Impossibile stabilire una relazione di trust per il canale sicuro SSL/TLS..)

[ System Events ]
Error - 12/11/2012 17.19.35 | Computer Name = Portatile | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 millisecondi) durante l'attesa della risposta alla
transazione dal servizio ShellHWDetection.

Error - 12/11/2012 17.20.05 | Computer Name = Portatile | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 millisecondi) durante l'attesa della risposta alla
transazione dal servizio ShellHWDetection.

Error - 12/11/2012 17.20.35 | Computer Name = Portatile | Source = Service Control Manager | ID = 7022
Description = Servizio Pubblicazione risorse per individuazione bloccato in partenza.

Error - 12/11/2012 17.20.36 | Computer Name = Portatile | Source = Service Control Manager | ID = 7001
Description = Il servizio Provider Gruppo Home dipende dal servizio Pubblicazione
risorse per individuazione che non è stato avviato per il seguente errore: %%1070

Error - 12/11/2012 17.21.08 | Computer Name = Portatile | Source = ipnathlp | ID = 31004
Description = Agente proxy DNS: impossibile allocare 0 byte di memoria. Ciò potrebbe
indicare una condizione di memoria virtuale insufficiente nel sistema oppure un
errore interno rilevato dal gestore della memoria.

Error - 12/11/2012 17.21.32 | Computer Name = Portatile | Source = Service Control Manager | ID = 7031
Description = Il servizio McAfee McShield è stato arrestato in modo imprevisto.
Questo problema si è verificato 1 volta/e. Le seguenti azioni di correzione saranno
eseguite tra 5000 millisecondi: Riavvia il servizio.

Error - 12/11/2012 17.22.34 | Computer Name = Portatile | Source = ipnathlp | ID = 30005
Description = Allocatore DHCP: rilevato un server DHCP con indirizzo IP 192.168.0.1
nella stessa rete dell'interfaccia con indirizzo IP 192.168.0.2. L'allocatore si
è disabilitato sull'interfaccia per evitare di confondere i client DHCP.

Error - 12/11/2012 17.23.39 | Computer Name = Portatile | Source = ipnathlp | ID = 31004
Description = Agente proxy DNS: impossibile allocare 0 byte di memoria. Ciò potrebbe
indicare una condizione di memoria virtuale insufficiente nel sistema oppure un
errore interno rilevato dal gestore della memoria.

Error - 12/11/2012 17.24.10 | Computer Name = Portatile | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 millisecondi) durante l'attesa della risposta alla
transazione dal servizio Dnscache.

Error - 12/11/2012 17.26.36 | Computer Name = Portatile | Source = Service Control Manager | ID = 7031
Description = Il servizio McAfee McShield è stato arrestato in modo imprevisto.
Questo problema si è verificato 2 volta/e. Le seguenti azioni di correzione saranno
eseguite tra 5000 millisecondi: Riavvia il servizio.

< End of report >

marcopcnn

Post #7November 13, 2012, 4:54 AM UTC

The aswMBR log I have started the qickScan that is the default setting. If I have to change something please let me know aswMBR version 0.9.9.1707 Copyright© 2011 AVAST Software Run date: 2012-11-13 05:30:24 —————————– 05:30:24.445 OS Version: Windows 6.1.7601 Service Pack 1 05:30:24.445 Number of processors: 2 586 0xF0D 05:30:24.505 ComputerName: PORTATILE UserName: marco 05:30:32.695 Initialize success 05:33:32.789 AVAST engine defs: 12111201 05:34:27.463 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 05:34:27.463 Disk 0 Vendor: WDC_WD5000BEVT-22ZAT0 01.01A01 Size: 476940MB BusType: 11 05:34:27.473 Disk 0 MBR read successfully 05:34:27.483 Disk 0 MBR scan 05:34:27.543 Disk 0 Windows 7 default MBR code 05:34:27.563 Disk 0 Partition 1 00 27 Hidden NTFS WinRE MSDOS5.0 10000 MB offset 2048 05:34:27.603 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 233482 MB offset 20482048 05:34:27.623 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 233456 MB offset 498653184 05:34:27.643 Disk 0 scanning sectors +976771072 05:34:27.733 Disk 0 scanning C:\Windows\system32\drivers 05:35:18.894 Service scanning 05:36:19.094 Modules scanning 05:36:31.434 Disk 0 trace - called modules: 05:36:31.794 ntkrnlpa.exe CLASSPNP.SYS disk.sys ataport.SYS halmacpi.dll PCIIDEX.SYS msahci.sys 05:36:31.814 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x877775e8] 05:36:31.824 3 CLASSPNP.SYS[8c3d159e] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x87623908] 05:36:33.104 AVAST engine scan C:\Windows 05:36:54.621 AVAST engine scan C:\Windows\system32 05:49:18.672 AVAST engine scan C:\Windows\system32\drivers 05:50:10.832 AVAST engine scan C:\Users\marco 05:52:14.882 Disk 0 MBR has been saved successfully to "C:\Users\marco\Desktop\tom coyote results\MBR.dat" 05:52:14.912 The log file has been saved successfully to "C:\Users\marco\Desktop\tom coyote results\aswMBR.txt"

OCD

Post #8November 13, 2012, 7:44 AM UTC

Hi marcopcnn,

I need some clarification, kindly answer the following questions in as much detail as possible.

I can not reach the starting page of my web provider. I am able to reach any others website but not the page www.tim.it of the provider.
Can you access www.tim.it when you type it into the address bar?

My Antivirus McAfee Total protectino lose one file of SiteAdvisor function.
Can you explain what you mean by lose one file?

The PC does not allow to start in Safe Mode. I push F8 during bootstrap but Seven always starts as usual ( and this is very strange)
Are you tapping the F8 key repeatedly at start up? Or are you holding the F8 key down at start up?
What are the symptoms you are experiencing that lead you to believe you are infected?

marcopcnn

Post #9November 13, 2012, 9:53 PM UTC

Hi marcopcnn,

I need some clarification, kindly answer the following questions in as much detail as possible.

I can not reach the starting page of my web provider. I am able to reach any others website but not the page www.tim.it of the provider.
Can you access www.tim.it when you type it into the address bar?

My Antivirus McAfee Total protectino lose one file of SiteAdvisor function.
Can you explain what you mean by lose one file?

The PC does not allow to start in Safe Mode. I push F8 during bootstrap but Seven always starts as usual ( and this is very strange)
Are you tapping the F8 key repeatedly at start up? Or are you holding the F8 key down at start up?

What are the symptoms you are experiencing that lead you to believe you are infected?

Question n. 1
Normally not i cannot reach che htttp:\\www.tim.it website neither selection my favorites nor typing the addres in the address bar
additional information,
1)tthis morning after the threatment and the scan of yesterday the system seems to run normally and i am able to reach the tim website without any problem
2) After the therat my browser has change. The search refer tp google search engine. Till yesterday refers to bybilon iven if Have removed byblon toolbar from the settings
Question 2
1) McAfee normally include in the browser a flag that indicates that McAfee site advisor is enabled. From many days the flags is not present
2) Mc Afee provide a tooll to analize the Mcaff installation and correct errors. Runnin this tool the results is and indication of "Losed File". It seems that the system, to work properly
needs a file tha the tool is not able to fin in my PC.
Question 3
1) I coontinuoasly pres F8 non only pres and maintains. No results
2) As explained the mayor item is that i Cannot reach my provider's website.
Starting from this.
a) The result Of McAfee tools

The anavailability Safe mode
c) The internet navigation becames very slow with lon persiod of yime out of the browser.
I hope that these information are usefull
Marco

OCD

Post #10November 14, 2012, 1:15 PM UTC

Hi marcopcnn,

Please read through these steps below before attempting to carry out the procedure. Timing is critical in order to receive the desired outcome. (booting into safe mode)

To access safe mode, follow these steps:
(read through the steps before starting)

Remove all floppy disks and CDs from your computer and then restart your computer.
Press F8 at the operating system menu. If the operating system menu does not appear, press F8 repeatedly after the firmware POST process completes but before the Starting Windows logo appears. The Advanced Boot Options menu appears.
On the Advanced Boot Options menu, select Safe Mode, Safe Mode With Networking, or Safe Mode With Command Prompt.
Select Safe Mode if you do not require networking support.
Select Safe Mode With Networking if you require access to the network for your troubleshooting-for example, if you must download an updated driver.
Select Safe Mode With Command Prompt if you want to work at a command prompt.

Next

The issue you appear to be having with McAfee is that you are missing a file. Do you have have a way to reinstall the software. (i.e. installation disks, downloaded file)

In your next post please provide the following:
Results of booting into Safe Mode
Answer to McAfee software question.
Make & Model of your computer

marcopcnn

Post #11November 14, 2012, 10:16 PM UTC

Hi marcopcnn,

Please read through these steps below before attempting to carry out the procedure. Timing is critical in order to receive the desired outcome. (booting into safe mode)

To access safe mode, follow these steps:
(read through the steps before starting)

Remove all floppy disks and CDs from your computer and then restart your computer.
Press F8 at the operating system menu. If the operating system menu does not appear, press F8 repeatedly after the firmware POST process completes but before the Starting Windows logo appears. The Advanced Boot Options menu appears.
On the Advanced Boot Options menu, select Safe Mode, Safe Mode With Networking, or Safe Mode With Command Prompt.

Select Safe Mode if you do not require networking support.
Select Safe Mode With Networking if you require access to the network for your troubleshooting-for example, if you must download an updated driver.
Select Safe Mode With Command Prompt if you want to work at a command prompt.
Next

The issue you appear to be having with McAfee is that you are missing a file. Do you have have a way to reinstall the software. (i.e. installation disks, downloaded file)

In your next post please provide the following:
Results of booting into Safe Mode
Answer to McAfee software question.
Make & Model of your computer

Ok,For your information I can confirm tha the problems that i have described are related to the infection.
I really do not konw anything about the infectiom threated but know the PC is workin properly

1) I have tried to strad in the safe mode without find any problems
2) reinstalling the McAfee site advisor with the hel of McAfee virtual Technician I have solved any problems.

Before the last threatment I have tries exactly several times the same action with no results.
Know 1 attempt alla the problems solved
Marco

OCD

Post #12November 15, 2012, 7:14 AM UTC

Hi marcopcnn,

Locate Malwarebytes' Anti-Malware (it should be on your desktop).

Right click and select "Run as Administrator" mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan as shown below.

[external image: Posted Image]
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.

Next

Please run Eset Online Scanner

Administrator rights are required to run ESET Online Scanner

Place a check mark in the box YES, I accept the Terms Of Use
Click the Start button.
Now click the Install button.
Click Start. The scanner engine will initialize and update.
Do Not place a check mark in the box beside Remove found threats.
Click the Scan button. The scan will now run, please be patient.
When the scan finishes click the Details tab.
Copy and paste the contents of the C:\Program Files\ESET\log.txt into your next reply.

In your next post please provide the following:
MBAM log
ESET log
How is the computer running, any remaining issues?

marcopcnn

Post #13November 15, 2012, 11:08 PM UTC

Done, both the scan has returned no virus found as result. At the end of the post the malwarebytes log. The PC is apparently running properly. Apparently because the last startup result very slow but maybe this is due to the download of a big windows update I continue to monitor Marco Malwarebytes Anti-Malware (Prova) 1.65.1.1000 www.malwarebytes.org Versione database: v2012.11.15.08 Windows 7 Service Pack 1 x86 NTFS Internet Explorer 9.0.8112.16421 marco :: PORTATILE [amministratore] Protezione: Disattivata 15/11/2012 23.21.11 mbam-log-2012-11-15 (23-21-11).txt Tipo di scansione: Scansione veloce Opzioni di scansione attive: Memoria | Esecuzione automatica | Registro | File di sistema | Euristica/Extra | Euristica/Shuriken | PUP | PUM Opzioni di scansione disattivate: P2P Elementi esaminati: 206408 Tempo impiegato: 29 minuti, 7 secondi Processi rilevati in memoria: 0 (non sono stati rilevati elementi nocivi) Moduli di memoria rilevati: 0 (non sono stati rilevati elementi nocivi) Chiavi di registro rilevate: 0 (non sono stati rilevati elementi nocivi) Valori di registro rilevati: 0 (non sono stati rilevati elementi nocivi) Voci rilevate nei dati di registro: 0 (non sono stati rilevati elementi nocivi) Cartelle rilevate: 0 (non sono stati rilevati elementi nocivi) File rilevati: 0 (non sono stati rilevati elementi nocivi) (fine)

OCD

Post #14November 16, 2012, 1:29 AM UTC

Hi marcopcnn,

Your log appears to be clean. We have a few items to take care of before we get to the All Clean Speech.

Check to see if you have the current version of Java (Version 7 Update 9) by going to http://java.com/en/download/installed.jsp
Select the Verify Java Version button and follow the onscreen instructions to update if necessary.

Next

Locate the Java Control Panel in Windows 7

Click on the Start button and then click on the Control Panel option.
In the Control Panel Search enter "Java Control Panel".
Click on the Java icon [external image: Posted Image] to open the Java Control Panel.

Delete Temporary Files through the Java Control Panel
[external image: Posted Image]

In the Java Control Panel, under the General tab, click Settings under the Temporary Internet Files section.
The Temporary Files Settings dialog box appears.

[external image: Posted Image]

Click Delete Files on the Temporary Files Settings dialog.
The Delete Temporary Files dialog box appears.

[external image: Posted Image]

Click OK on the Delete Temporary Files dialog.
Note: This deletes all the Downloaded Applications and Applets from the cache.
Click OK on the Temporary Files Settings dialog.
Note: If you want to delete a specific application and applet from the cache, click on View Application and View Applet options respectively.

Next

Click 'Start > Control Panel > Programs and Features. Locate and select the following that are present on the list and click the Remove button: (if present)

Java 5 Update 16
Java 6 Update 26
Adobe Reader 9.5.2

Next

Adobe Reader: Go to http://get.adobe.com/reader/otherversions/

Use the drop down menu's to select your operating system
Select your language > Select Reader 11.0 English for Windows
Remove the check mark from the box "Free! McAfee Security Scan Plus"
Click the Download button, and follow the onscreen directions to complete the installation.

Please note, depending on your settings, you may have to temporarily disable your antivirus software for the Adobe Reader update.

Next

We need to re-enable Spybot - Search & Destroy's Tea Timer. Please follow the instruction below.

Locate your copy of Spybot - Search & Destroy's and open it.
In the menu bar at the top select "Mode", then select "Advanced".
In the left hand menu expand the "Tools" menu.
Select "Resident", then place a check mark for "Resident Tea Timer"
Then exit the program by clicking "File" then select "Exit"

Next

Clean up with OTL:

Right-click OTL.exe select "Run as Administrator" to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

Next

You can now delete any remaining tools and logs still remaining on your desktop.

= = = = = = = = = = = = = = = = = = = =

With the above items taken care of let's move on to the All Clean part of the process.

This infection appears to have been cleaned, but I can not give you any absolute guarantees. As a precaution, I would go ahead and change all of your passwords as this is especially important after an infection.

Any of the logs that you created for use in the forums or remaining tools that have not yet been removed can be deleted so they aren't cluttering up your desktop.

Here are some tips to reduce the potential for spyware infection in the future:

Make your Internet Explorer more secure - This can be done by following these simple instructions:

From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.

Make your Mozilla Firefox more secure - This can be done by adding these add-ons:

Use and update an anti-virus software - I can not overemphasize the need for you to use and update your anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

Firewall
Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a firewall in its default configuration can lower your risk greatly. A tutorial on firewalls can be found here. **There are firewalls listed in this tutorial that could be downloaded and used but I would personally only recommend using one of the following two below:
Online Armor Free
Agnitum Outpost Firewall Free

Make sure you keep your Windows OS current. Windows XP users can visit Windows update regularly to download and install any critical updates and service packs. Windows Vista/7 users can open the Start menu > All Programs > Windows Update > Check for Updates (in left hand task pane) to update these systems. Without these you are leaving the back door open.

Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers. For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.

WOT (Web of Trust) As "Googling" is such an integral part of internet life, this free browser add on warns you about risky websites that try to scam visitors, deliver malware or send spam. It is especially helpful when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites. WOT has an add-on available for Firefox, Internet Explorer as well as Google Chrome.

Finally, I strongly recommend that you read TonyKlein's good advice So how did I get infected in the first place?

Please reply to this thread once more if you are satisfied so that we can mark the problem as resolved.

marcopcnn

Post #15November 17, 2012, 6:13 AM UTC

Hi OCD, before starting to apply your new instruction I have to report that after few days of proper working the problem with the provider site appears again. This morning I try to reach www.tim.it with negative results. Please confirm to porcceed in accordance with your last message or change any necessary Thanks Marco

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Maybe infected [Solved]

✨ Ask AI

Ask AI