[Closed] Help Needed - Got infected with Yur.exe

hangar18 Topic Starter

Post #1September 16, 2008, 3:51 PM UTC

Hello guys, my pc got infected with a very strange trojan ( Yur.exe, yur.exe1 untill Yur.exe9 …) That trojan has bypassed my antivirus ( norton ) and has infected my pc with strange pops up!
what i did untill now: scan my pc with : spybot s&d – no result! I run also superantispyware and removeit Pro that had detected this trojan ( as unknow..) and gave me the message to reboot until the pc got completely clean! After the reboot didnt got any avoid stuff anymore but the yur.exe (1-9 ) are still in my winlog file!!!

this is my Hj log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17.48.12, on 16/09/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\File comuni\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wwSecure.exe
C:\WINDOWS\system32\devldr32.exe
C:\Programmi\Java\jre1.6.0_07\bin\jusched.exe
C:\Programmi\File comuni\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Microsoft ActiveSync\WCESCOMM.EXE
C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe
C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Programmi\Windows Live\Messenger\usnsvc.exe
C:\PROGRA~1\Systran\4_0\Premium\SYSTRA~1.EXE
C:\Programmi\Windows Live\Messenger\msnmsgr.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Programmi\File comuni\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Encarta Web Companion Oggetto helper - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Programmi\File comuni\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: Encarta Web Companion - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Programmi\File comuni\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Systran40premi.IEPlugIn - {D3919E1A-D6A5-11D6-AC3E-00B0D094B576} - C:\Programmi\Systran\4_0\Premium\IEPlugIn.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Programmi\File comuni\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Programmi\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Programmi\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [NSWosCheck] C:\Programmi\Norton SystemWorks Premier\osCheck.exe
O4 - HKLM\..\Run: [USRobotics Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [\YUR2.exe] C:\Windows\system32\YUR2.exe
O4 - HKLM\..\Run: [\YUR4C8.exe] C:\Windows\system32\YUR4C8.exe
O4 - HKLM\..\Run: [\YUR4.exe] C:\Windows\system32\YUR4.exe
O4 - HKLM\..\Run: [\YUR4C7.exe] C:\Windows\system32\YUR4C7.exe
O4 - HKLM\..\Run: [\YUR4C9.exe] C:\Windows\system32\YUR4C9.exe
O4 - HKLM\..\Run: [\YUR4CA.exe] C:\Windows\system32\YUR4CA.exe
O4 - HKLM\..\Run: [\YUR3.exe] C:\Windows\system32\YUR3.exe
O4 - HKLM\..\Run: [\YUR1.exe] C:\Windows\system32\YUR1.exe
O4 - HKLM\..\RunOnce: [ Privacy Eraser Pro] C:\Programmi\PrivacyEraser Computing\Privacy Eraser Pro\PrivacyEraser.exe /ErIEIndex
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programmi\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\RunOnce: [ Privacy Eraser Pro] C:\Programmi\PrivacyEraser Computing\Privacy Eraser Pro\PrivacyEraser.exe /ErIEIndex
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: O?iana.lnk
O8 - Extra context menu item: &Download All with Rapidshare Downloader - C:\DOCUME~1\H18\IMPOST~1\Temp\RarSFX0\jc_all.htm
O8 - Extra context menu item: &Download with Rapidshare Downloader - C:\DOCUME~1\H18\IMPOST~1\Temp\RarSFX0\jc_link.htm
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Crea preferiti portatile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Programmi\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programmi\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Crea preferiti portatile… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programmi\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Programmi\Norton SystemWorks Premier\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Programmi\Norton SystemWorks Premier\Norton Cleanup\WCQuick.lnk
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Barra di ricerca di Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programmi\File comuni\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{AD81C8A6-4507-4E78-9486-F9D0B6A49758}: NameServer = 213.215.115.88,147.175.167.50
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Programmi\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Programmi\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NBService - Nero AG - C:\Programmi\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Unknown owner - C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
O23 - Service: Washer AutoComplete (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe
O23 - Service: WEP/WPA-PMK key recovery service (WZCOOK) - Unknown owner - C:\Documents and Settings\H18\Desktop\WiFi_WEP_Key_Finder\aircrack-ng-0.6.2-win\bin\wzcook.exe (file missing)
O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/H18/IMPOST~1/Temp/msohtml1/01/clip_image001.jpg

–
End of file - 14652 bytes

I really hope someone can help with this cause no anti spam software seems that can help!!
Also i found an article to the pc magazine on line, that the only way to get rid of this is to format the pc…

Kind regards
h18

Rorschach112

Post #2September 16, 2008, 4:29 PM UTC

Hello

Before we begin, you should save these instructions in Notepad to your desktop, or print them, for easy reference. Much of our fix will be done in Safe mode, and you will be unable to access this thread at that time. If you have questions at any point, or are unsure of the instructions, feel free to post here and ask for clarification before proceeding.

Please download SmitfraudFix (by S!Ri) to your Desktop.

Next, please reboot your computer in Safe Mode by doing the following :

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.

Once in Safe Mode, double-click on SmitfraudFix.exe
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.
A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, usually at C:\rapport.txt

Warning : running option #2 on a non infected computer will remove your Desktop background.

Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
Double click on RSIT.exe to run RSIT.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open. Please post the contents of both log.txt (<info.txt (<

hangar18

Post #3September 17, 2008, 11:24 AM UTC

i follow very carefully your instructions! Here are the results you have ask me!
As i can see the trojan is still on … :-((

Rapport.txt:

SmitFraudFix v2.352

Scan done at 13.03.10,75, 17/09/2008
Run from C:\Documents and Settings\H18\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Versione 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix

AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» RK

Log.txt :

Logfile of random's system information tool 1.01 (written by random/random)
Run by [removed] at 2008-09-17 13:16:12
Microsoft Windows XP Professional Service Pack 3
System drive C: has 906 MB (2%) free of 46 GB
Total RAM: 1023 MB (47% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:16:29, on 17/09/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
C:\Programmi\File comuni\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wwSecure.exe
C:\WINDOWS\system32\devldr32.exe
C:\Programmi\Java\jre1.6.0_07\bin\jusched.exe
C:\Programmi\File comuni\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Microsoft ActiveSync\WCESCOMM.EXE
C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe
C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Programmi\Symantec\LiveUpdate\AUPDATE.EXE
C:\Programmi\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Programmi\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Programmi\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Programmi\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Documents and Settings\H18\Desktop\RSIT.exe
C:\Programmi\Trend Micro\HijackThis\H18.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Programmi\File comuni\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - (no file)
O2 - BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Encarta Web Companion Oggetto helper - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Programmi\File comuni\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: Encarta Web Companion - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Programmi\File comuni\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Systran40premi.IEPlugIn - {D3919E1A-D6A5-11D6-AC3E-00B0D094B576} - C:\Programmi\Systran\4_0\Premium\IEPlugIn.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Programmi\File comuni\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Programmi\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Programmi\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [NSWosCheck] C:\Programmi\Norton SystemWorks Premier\osCheck.exe
O4 - HKLM\..\Run: [USRobotics Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [\YUR4C8.exe] C:\Windows\system32\YUR4C8.exe
O4 - HKLM\..\Run: [\YUR4C7.exe] C:\Windows\system32\YUR4C7.exe
O4 - HKLM\..\Run: [\YUR4C9.exe] C:\Windows\system32\YUR4C9.exe
O4 - HKLM\..\Run: [\YUR4CA.exe] C:\Windows\system32\YUR4CA.exe
O4 - HKLM\..\Run: [\YUR1.exe] C:\Windows\system32\YUR1.exe
O4 - HKLM\..\Run: [\YUR2.exe] C:\Windows\system32\YUR2.exe
O4 - HKLM\..\Run: [\YUR4.exe] C:\Windows\system32\YUR4.exe
O4 - HKLM\..\Run: [\YUR3.exe] C:\Windows\system32\YUR3.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programmi\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: O?iana.lnk
O8 - Extra context menu item: &Download; All with Rapidshare Downloader - C:\DOCUME~1\H18\IMPOST~1\Temp\RarSFX0\jc_all.htm
O8 - Extra context menu item: &Download; with Rapidshare Downloader - C:\DOCUME~1\H18\IMPOST~1\Temp\RarSFX0\jc_link.htm
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Crea preferiti portatile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Programmi\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programmi\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Crea preferiti portatile… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programmi\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Programmi\Norton SystemWorks Premier\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Programmi\Norton SystemWorks Premier\Norton Cleanup\WCQuick.lnk
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Barra di ricerca di Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programmi\File comuni\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{AD81C8A6-4507-4E78-9486-F9D0B6A49758}: NameServer = 213.215.115.88,147.175.167.50
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Programmi\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Programmi\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NBService - Nero AG - C:\Programmi\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Unknown owner - C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
O23 - Service: Washer AutoComplete (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe
O23 - Service: WEP/WPA-PMK key recovery service (WZCOOK) - Unknown owner - C:\Documents and Settings\H18\Desktop\WiFi_WEP_Key_Finder\aircrack-ng-0.6.2-win\bin\wzcook.exe (file missing)

–
End of file - 13160 bytes

Scheduled tasks folder

C:\WINDOWS\tasks\MP Scheduled Scan.job
C:\WINDOWS\tasks\Norton Internet Security - Run Full System Scan - H18.job
C:\WINDOWS\tasks\Norton SystemWorks One Button Checkup.job

Registry dump

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E8A6170-7264-4D0F-BEAE-D42A53123C75}]
C:\Programmi\File comuni\Symantec Shared\coShared\Browser\1.0\NppBho.dll [2006-09-06 93400]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D; IE Protection - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll [2008-07-07 1562448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{955BE0B8-BC85-4CAF-856E-8E0D8B610560}]
Encarta Web Companion Oggetto helper - C:\Programmi\File comuni\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL [2006-06-13 256792]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
AcroIEToolbarHelper Class - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2004-12-14 225280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Programmi\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll [2008-05-18 654320]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{147D6308-0614-4112-89B1-31402F9B82C4} - Encarta Web Companion - C:\Programmi\File comuni\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL [2006-06-13 256792]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2004-12-14 225280]
{D3919E1A-D6A5-11D6-AC3E-00B0D094B576} - Systran40premi.IEPlugIn - C:\Programmi\Systran\4_0\Premium\IEPlugIn.dll [2002-10-03 73728]
{90222687-F593-4738-B738-FBEE9C7B26DF} - Show Norton Toolbar - C:\Programmi\File comuni\Symantec Shared\coShared\Browser\1.0\UIBHO.dll [2006-09-06 510152]
{D0943516-5076-4020-A3B5-AEFAF26AB263} - Veoh Browser Plug-in - C:\Programmi\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll [2008-04-01 352256]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2005-02-24 5537792]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2005-02-24 86016]
"SunJavaUpdateSched"=C:\Programmi\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
""=C:\WINDOWS\system32\
"ccApp"=C:\Programmi\File comuni\Symantec Shared\ccApp.exe [2006-10-28 107112]
"osCheck"=C:\Programmi\Norton Internet Security\osCheck.exe [2006-09-06 26248]
"Symantec PIF AlertEng"=C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2007-11-28 583048]
"NSWosCheck"=C:\Programmi\Norton SystemWorks Premier\osCheck.exe [2007-12-03 25472]
"USRobotics Wireless Manager UI"=C:\WINDOWS\system32\WLTRAY.exe [2006-10-12 1290240]
"\YUR4C8.exe"=C:\Windows\system32\YUR4C8.exe []
"\YUR4C7.exe"=C:\Windows\system32\YUR4C7.exe []
"\YUR4C9.exe"=C:\Windows\system32\YUR4C9.exe []
"\YUR4CA.exe"=C:\Windows\system32\YUR4CA.exe []
"\YUR1.exe"=C:\Windows\system32\YUR1.exe []
"\YUR2.exe"=C:\Windows\system32\YUR2.exe []
"\YUR4.exe"=C:\Windows\system32\YUR4.exe []
"\YUR3.exe"=C:\Windows\system32\YUR3.exe []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"H/PC Connection Agent"=C:\Programmi\Microsoft ActiveSync\WCESCOMM.EXE [2005-01-19 405583]
"MsnMsgr"=C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe [2007-10-18 5724184]
""=C:\WINDOWS\system32\
"SpybotSD TeaTimer"=C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe [2008-08-18 1832272]
"SUPERAntiSpyware"=C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe [2008-09-03 1576176]

C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica
O?iana.lnk - C:\Programmi\Today\TODAY.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Programmi\SUPERAntiSpyware\SASWINLO.dll [2008-07-23 352256]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"=C:\PROGRA~1\WIFD1F~1\MpShHook.dll [2006-11-03 83224]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Programmi\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinDefend]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Programmi\Java\jre1.5.0_10\bin\javaw.exe"="C:\Programmi\Java\jre1.5.0_10\bin\javaw.exe:*:Enabled:Java™ 2 Platform Standard Edition binary"
"C:\Documents and Settings\H18\Documenti\eDonkey2000 Downloads\Msn Messenger winks moods etc\winks,moods,muggins,weemees and meegos\mcoinstall.exe"="C:\Documents and Settings\H18\Documenti\eDonkey2000 Downloads\Msn Messenger winks moods etc\winks,moods,muggins,weemees and meegos\mcoinstall.exe:*:Disabled:mcoinstall"
"C:\Programmi\Kazaa Lite K++\KazaaLite.kpp"="C:\Programmi\Kazaa Lite K++\KazaaLite.kpp:*:Enabled:KazaaLite"
"C:\Programmi\Real\RealPlayer\realplay.exe"="C:\Programmi\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer"
"C:\Programmi\webcamXP\webcamXP.exe"="C:\Programmi\webcamXP\webcamXP.exe:*:Enabled:webcamXP"
"C:\Programmi\THQ\MotoGP URT 3\motogp.exe"="C:\Programmi\THQ\MotoGP URT 3\motogp.exe:*:Disabled:motogp"
"C:\Programmi\SopCast\SopCast.exe"="C:\Programmi\SopCast\SopCast.exe:*:Enabled:SopCast Main Application"
"C:\Documents and Settings\H18\Dati applicazioni\SopCast\adv\SopAdver.exe"="C:\Documents and Settings\H18\Dati applicazioni\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver"
"C:\Documents and Settings\H18\Impostazioni locali\Temp\ir_ext_temp_0\AutoPlay\Docs\PackIcons.exe"="C:\Documents and Settings\H18\Impostazioni locali\Temp\ir_ext_temp_0\AutoPlay\Docs\PackIcons.exe:*:Disabled:Messenger Content Installer"
"C:\Programmi\Java\jre1.5.0_11\bin\javaw.exe"="C:\Programmi\Java\jre1.5.0_11\bin\javaw.exe:*:Enabled:Java™ 2 Platform Standard Edition binary"
"C:\Programmi\myTV\myTV.exe"="C:\Programmi\myTV\myTV.exe:*:Enabled:myTV"
"C:\Programmi\Yahoo!\Messenger\YahooMessenger.exe"="C:\Programmi\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\Programmi\Yahoo!\Messenger\YServer.exe"="C:\Programmi\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\Programmi\CCNetwork\WebCamSrv\CCCamSrv.exe"="C:\Programmi\CCNetwork\WebCamSrv\CCCamSrv.exe:*:Disabled:CCN WebCam Server"
"C:\Programmi\MessengerDiscovery\MessengerDiscovery Live.exe"="C:\Programmi\MessengerDiscovery\MessengerDiscovery Live.exe:*:Enabled:MessengerDiscovery Live the Windows Live Messenger addon"
"C:\Programmi\Trillian\trillian.exe"="C:\Programmi\Trillian\trillian.exe:*:Enabled:Trillian"
"C:\Program Files\DoubleB\BBcat\fcPSGRun.exe"="C:\Program Files\DoubleB\BBcat\fcPSGRun.exe:*:Enabled:Play Sex Game 1.17 HTTP emulator"
"C:\Documents and Settings\H18\Desktop\P.S.G.part1\P-S-G\Members\fcPSGRun.exe"="C:\Documents and Settings\H18\Desktop\P.S.G.part1\P-S-G\Members\fcPSGRun.exe:*:Enabled:Play Sex Game 1.17 HTTP emulator"
"C:\Program Files\DoubleB\BBcat\Members\fcPSGRun.exe"="C:\Program Files\DoubleB\BBcat\Members\fcPSGRun.exe:*:Enabled:Play Sex Game 1.17 HTTP emulator"
"C:\Programmi\e frontier\Poser 7\Poser.exe"="C:\Programmi\e frontier\Poser 7\Poser.exe:*:Enabled:Poser executable file"
"C:\Programmi\Microsoft ActiveSync\wcescomm.exe"="C:\Programmi\Microsoft ActiveSync\wcescomm.exe:*:Enabled:ActiveSync Connection Manager"
"C:\Programmi\Microsoft ActiveSync\WCESMgr.exe"="C:\Programmi\Microsoft ActiveSync\WCESMgr.exe:*:Enabled:ActiveSync Application"
"C:\Programmi\DC++\DCPlusPlus.exe"="C:\Programmi\DC++\DCPlusPlus.exe:*:Enabled:DC++"
"C:\Programmi\Steam\steamapps\common\defcon\defcon.exe"="C:\Programmi\Steam\steamapps\common\defcon\defcon.exe:*:Enabled:Defcon"
"C:\Programmi\Kazaa Lite\Kazaa.kpp"="C:\Programmi\Kazaa Lite\Kazaa.kpp:*:Enabled:Kazaa Lite"
"C:\Documents and Settings\H18\Desktop\emule0.48a-Xtreme6.1\emule.exe"="C:\Documents and Settings\H18\Desktop\emule0.48a-Xtreme6.1\emule.exe:*:Enabled:eMule"
"C:\Programmi\Steam\steamapps\hangar1818\half-life 2 deathmatch\hl2.exe"="C:\Programmi\Steam\steamapps\hangar1818\half-life 2 deathmatch\hl2.exe:*:Disabled:hl2"
"C:\Programmi\Soulseek\slsk.exe"="C:\Programmi\Soulseek\slsk.exe:*:Disabled:SoulSeek"
"C:\Programmi\Invisible Browsing\InvisibleBrowsing.exe"="C:\Programmi\Invisible Browsing\InvisibleBrowsing.exe:*:Enabled:IB6_UI"
"C:\Programmi\Skype\Phone\Skype.exe"="C:\Programmi\Skype\Phone\Skype.exe:*:Enabled:Skype. The whole world can talk for free."
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Programmi\Windows Live\Messenger\msnmsgr.exe"="C:\Programmi\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Programmi\Windows Live\Messenger\livecall.exe"="C:\Programmi\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Programmi\Windows Live\Messenger\msnmsgr.exe"="C:\Programmi\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Programmi\Windows Live\Messenger\livecall.exe"="C:\Programmi\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0e340a40-5dab-11dd-9d9b-00e04c39dbc5}]
shell\AutoRun\command - 1rfw8hjr.com
shell\explore\command - 1rfw8hjr.com
shell\open\command - 1rfw8hjr.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2a391560-2e27-11dd-9d15-00e04c39dbc5}]
shell\AutoRun\command - 1rfw8hjr.com
shell\explore\command - 1rfw8hjr.com
shell\open\command - 1rfw8hjr.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{45da8111-d614-11db-98ce-00e04c39dbc5}]
shell\AutoRun\command - J:\.\run\autorun.exe
shell\open\command - J:\.\run\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{95cced30-cb2f-11db-9896-00e04c39dbc5}]
shell\AutoRun\command - H:\.\run\autorun.exe
shell\open\command - H:\.\run\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{977b7d43-d7e4-11dc-9c37-00e04c39dbc5}]
shell\AutoRun\command - H:\.\run\autorun.exe
shell\open\command - H:\.\run\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fa8c97f1-43a1-11dd-9d49-00e04c39dbc5}]
shell\AutoRun\command - .\run\autorun.exe
shell\open\command - .\run\autorun.exe

List of files/folders created in the last three months

2008-09-17 13:16:12 —-D—- C:\rsit
2008-09-17 13:03:20 —-A—- C:\WINDOWS\system32\tmp.txt
2008-09-17 13:01:53 —-A—- C:\WINDOWS\ntbtlog.txt
2008-09-16 17:55:34 —-D—- C:\Documents and Settings\H18\Dati applicazioni\Malwarebytes
2008-09-16 17:55:28 —-D—- C:\Programmi\Malwarebytes' Anti-Malware
2008-09-16 17:55:28 —-D—- C:\Documents and Settings\All Users\Dati applicazioni\Malwarebytes
2008-09-16 17:32:35 —-D—- C:\Programmi\Trend Micro
2008-09-15 21:05:04 —-D—- C:\Programmi\The Cleaner Free
2008-09-15 15:03:23 —-D—- C:\Documents and Settings\All Users\Dati applicazioni\SUPERAntiSpyware.com
2008-09-15 15:03:14 —-D—- C:\Programmi\SUPERAntiSpyware
2008-09-15 15:03:14 —-D—- C:\Documents and Settings\H18\Dati applicazioni\SUPERAntiSpyware.com
2008-09-10 16:08:14 —-HDC—- C:\WINDOWS\$NtUninstallKB938464$
2008-09-10 16:07:20 —-HDC—- C:\WINDOWS\$NtUninstallKB954154_WM11$
2008-09-09 12:07:34 —-HDC—- C:\WINDOWS\$NtUninstallKB951978$
2008-09-09 11:41:49 —-D—- C:\WINDOWS\Prefetch
2008-09-09 02:02:51 —-HDC—- C:\WINDOWS\$NtUninstallKB952954$
2008-09-09 02:02:39 —-HDC—- C:\WINDOWS\$NtUninstallKB952287$
2008-09-09 02:02:17 —-HDC—- C:\WINDOWS\$NtUninstallKB951748$
2008-09-09 02:02:02 —-HDC—- C:\WINDOWS\$NtUninstallKB951698$
2008-09-09 02:01:50 —-HDC—- C:\WINDOWS\$NtUninstallKB951376-v2$
2008-09-09 02:01:37 —-HDC—- C:\WINDOWS\$NtUninstallKB951376$
2008-09-09 02:01:21 —-HDC—- C:\WINDOWS\$NtUninstallKB951066$
2008-09-09 02:01:07 —-HDC—- C:\WINDOWS\$NtUninstallKB950974$
2008-09-09 02:00:54 —-HDC—- C:\WINDOWS\$NtUninstallKB950762$
2008-09-09 02:00:38 —-HDC—- C:\WINDOWS\$NtUninstallKB946648$
2008-09-09 01:53:16 —-D—- C:\WINDOWS\l2schemas
2008-09-09 01:53:15 —-D—- C:\WINDOWS\system32\it
2008-09-09 01:53:14 —-D—- C:\WINDOWS\system32\bits
2008-09-09 01:48:22 —-D—- C:\WINDOWS\ServicePackFiles
2008-09-09 01:45:54 —-D—- C:\WINDOWS\network diagnostic
2008-09-09 01:40:45 —-HDC—- C:\WINDOWS\$NtServicePackUninstall$
2008-09-02 16:43:04 —-D—- C:\Programmi\Spybot - Search & Destroy
2008-09-01 00:45:08 —-HDC—- C:\WINDOWS\$NtUninstallKB952954_0$
2008-09-01 00:45:00 —-HDC—- C:\WINDOWS\$NtUninstallKB946648_0$
2008-09-01 00:44:53 —-HDC—- C:\WINDOWS\$NtUninstallKB953839$
2008-09-01 00:44:45 —-HDC—- C:\WINDOWS\$NtUninstallKB950974_0$
2008-09-01 00:43:11 —-HDC—- C:\WINDOWS\$NtUninstallKB951072-v2$
2008-09-01 00:43:02 —-HDC—- C:\WINDOWS\$NtUninstallKB952287_0$
2008-09-01 00:42:17 —-HDC—- C:\WINDOWS\$NtUninstallKB951066_0$
2008-07-09 16:10:46 —-A—- C:\WINDOWS\system32\javaws.exe
2008-07-09 16:10:46 —-A—- C:\WINDOWS\system32\javaw.exe
2008-07-09 16:10:46 —-A—- C:\WINDOWS\system32\java.exe
2008-07-09 09:09:26 —-HDC—- C:\WINDOWS\$NtUninstallKB951748_0$
2008-06-26 15:15:58 —-HDC—- C:\WINDOWS\$NtUninstallKB951376-v2_0$

List of drivers

R1 AmdK7;Driver del processore AMD K7; C:\WINDOWS\system32\DRIVERS\amdk7.sys [2008-04-14 41728]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Programmi\File comuni\Symantec Shared\EENGINE\eeCtrl.sys []
R1 SASDIFSV;SASDIFSV; \??\C:\Programmi\SUPERAntiSpyware\SASDIFSV.SYS []
R1 SASKUTIL;SASKUTIL; \??\C:\Programmi\SUPERAntiSpyware\SASKUTIL.sys []
R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2005-10-16 27171]
R1 SPBBCDrv;SPBBCDrv; \??\C:\Programmi\File comuni\Symantec Shared\SPBBC\SPBBCDrv.sys []
R1 SRTSP;SRTSP; C:\WINDOWS\System32\Drivers\SRTSP.SYS [2007-12-01 279088]
R1 SRTSPX;SRTSPX; C:\WINDOWS\System32\Drivers\SRTSPX.SYS [2007-12-01 43696]
R1 SYMTDI;SYMTDI; C:\WINDOWS\System32\Drivers\SYMTDI.SYS [2007-10-30 191536]
R2 usbhub;Ph USB Standard Hub Driver; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 BCM43XX;U.S. Robotics Wireless MAXg Adapter; C:\WINDOWS\system32\DRIVERS\bcmwl5.sys [2006-10-12 604928]
R3 ctljystk;Creative SBLive! Porta giochi; C:\WINDOWS\system32\DRIVERS\ctljystk.sys [2001-08-17 3712]
R3 dtscsi;dtscsi; C:\WINDOWS\System32\Drivers\dtscsi.sys [2007-01-21 223128]
R3 emu10k;Creative SB Live! (WDM); C:\WINDOWS\system32\drivers\emu10k1m.sys [2001-08-17 283904]
R3 emu10k1;Driver per Creative Interface Manager (WDM); C:\WINDOWS\system32\drivers\ctlfacem.sys [2001-08-17 6912]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Programmi\File comuni\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys []
R3 NAVENG;NAVENG; \??\C:\PROGRA~1\FILECO~1\SYMANT~1\VIRUSD~1\20080916.003\NAVENG.SYS []
R3 NAVEX15;NAVEX15; \??\C:\PROGRA~1\FILECO~1\SYMANT~1\VIRUSD~1\20080916.003\NAVEX15.SYS []
R3 NPDriver;Norton UnErase Protection Driver; \??\C:\WINDOWS\system32\Drivers\NPDRIVER.SYS []
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2005-02-24 3454144]
R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2007-01-21 10368]
R3 rtl8139;Driver NT scheda Fast Ethernet PCI Realtek basata su RTL8139; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-04 20992]
R3 SASENUM;SASENUM; \??\C:\Programmi\SUPERAntiSpyware\SASENUM.SYS []
R3 sfman;Driver per Creative SoundFont Manager (WDM); C:\WINDOWS\system32\drivers\sfmanm.sys [2001-08-17 36480]
R3 SYMDNS;SYMDNS; C:\WINDOWS\System32\Drivers\SYMDNS.SYS [2007-10-30 12848]
R3 SymEvent;SymEvent; \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS []
R3 SYMFW;SYMFW; C:\WINDOWS\System32\Drivers\SYMFW.SYS [2007-10-30 145968]
R3 SYMIDS;SYMIDS; C:\WINDOWS\System32\Drivers\SYMIDS.SYS [2007-10-30 39856]
R3 SYMIDSCO;SYMIDSCO; \??\C:\PROGRA~1\FILECO~1\SYMANT~1\SymcData\idsdefs\20080913.002\SymIDSCo.sys []
R3 SYMNDIS;SYMNDIS; C:\WINDOWS\System32\Drivers\SYMNDIS.SYS [2007-10-30 35120]
R3 SYMREDRV;SYMREDRV; C:\WINDOWS\System32\Drivers\SYMREDRV.SYS [2007-10-30 27696]
R3 usbuhci;Driver Miniport Controller Universal Host USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 camvid20;Philips ToUcam Camera; Video; C:\WINDOWS\system32\DRIVERS\camdrv21.sys [2001-12-10 253909]
S3 CCDECODE;Decoder sottotitoli codificati; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 MS1000;MS1000; C:\WINDOWS\System32\DRIVERS\MS1000.sys [2008-09-15 5376]
S3 MSTEE;Convertitore a T/Sito a sito per flusso Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Connesione TV/Video Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 nm;Driver di Network Monitor; C:\WINDOWS\system32\DRIVERS\NMnt.sys [2008-04-13 40320]
S3 PCASp50;PCASp50 NDIS Protocol Driver; C:\WINDOWS\System32\Drivers\PCASp50.sys [2004-09-07 17664]
S3 SDdriver;SDdriver; \??\C:\WINDOWS\system32\Drivers\sddriver.sys []
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 SRTSPL;SRTSPL; C:\WINDOWS\System32\Drivers\SRTSPL.SYS [2007-12-01 317616]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbaudio;Philips USB Microphone; C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
S3 usbscan;Driver scanner USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Driver archiviazione di massa USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 vaxscsi;vaxscsi; C:\WINDOWS\System32\Drivers\vaxscsi.sys []
S3 wceusbsh;Windows CE USB Serial Host Driver; C:\WINDOWS\system32\DRIVERS\wceusbsh.sys [2004-12-06 104064]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;Codec World Standard Teletext; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

List of services

R2 aawservice;Ad-Aware 2007 Service; C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe [2007-07-06 561152]
R2 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler; C:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2006-09-03 198336]
R2 ccEvtMgr;Symantec Event Manager; C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe [2006-10-28 107624]
R2 ccSetMgr;Symantec Settings Manager; C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe [2006-10-28 107624]
R2 CLTNetCnService;Symantec Lic NetConnect service; C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe [2006-10-28 107624]
R2 gusvc;Google Updater Service; C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-05-18 137200]
R2 LiveUpdate Notice Ex;LiveUpdate Notice Service Ex; C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe [2006-10-28 107624]
R2 NProtectService;Norton UnErase Protection; C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE [2005-11-04 95832]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2005-02-24 127043]
R2 Speed Disk service;Speed Disk service; C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE [2005-11-04 176193]
R2 SymAppCore;Symantec AppCore Service; C:\Programmi\File comuni\Symantec Shared\AppCore\AppSvc32.exe [2006-09-02 46736]
R2 WinDefend;Windows Defender; C:\Programmi\Windows Defender\MsMpEng.exe [2006-11-03 13592]
R2 wltrysvc;Broadcom Wireless LAN Tray Service; C:\WINDOWS\System32\WLTRYSVC.EXE [2006-10-12 20480]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 wwSecSvc;Washer AutoComplete; C:\WINDOWS\system32\wwSecure.exe [2005-04-20 487936]
R3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2006-09-03 2528960]
S2 LiveUpdate Notice Service;LiveUpdate Notice Service; C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2007-11-28 583048]
S3 Adobe LM Service;Adobe LM Service; C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe [2007-09-05 72704]
S3 aspnet_state;Servizio stato di ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 comHost;COM Host; C:\Programmi\File comuni\Symantec Shared\VAScanner\comHost.exe [2006-09-03 48272]
S3 IDriverT;InstallDriver Table Manager; C:\Programmi\File comuni\InstallShield\Driver\1150\Intel 32\IDriverT.exe [2005-11-14 69632]
S3 ISPwdSvc;Symantec IS Password Validation; C:\Programmi\Norton Internet Security\isPwdSvc.exe [2006-09-06 79496]
S3 NBService;NBService; C:\Programmi\Nero\Nero 7\Nero BackItUp\NBService.exe [2006-10-09 724992]
S3 ose;Office Source Engine; C:\Programmi\File comuni\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 Symantec Core LC;Symantec Core LC; C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe [2008-01-24 1251720]
S3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Programmi\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
S3 WLSetupSvc;Windows Live Setup Service; C:\Programmi\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Programmi\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S3 WZCOOK;WEP/WPA-PMK key recovery service; C:\Documents and Settings\H18\Desktop\WiFi_WEP_Key_Finder\aircrack-ng-0.6.2-win\bin\wzcook.exe []

—————–EOF—————–

info.txt :

info.txt logfile of random's system information tool 1.01 2008-09-17 13:16:32

Uninstall list

–>C:\Programmi\File comuni\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
–>C:\Programmi\Nero\Nero 7\nero\uninstall\UNNERO.exe /UNINSTALL
–>C:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL
–>C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL
–>C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL
–>C:\WINDOWS\UNNeroVision.exe /UNINSTALL
–>C:\WINDOWS\UNRecode.exe /UNINSTALL
–>MsiExec.exe /I{0F122737-72B2-4095-8B3E-7AAE753DFD3D}
–>MsiExec.exe /I{219B0DA4-8F1A-499D-8795-4A07C632521E}
–>MsiExec.exe /I{644B991F-B109-4360-9DA3-40CDAD13961C}
–>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
ACDSee Pro–>MsiExec.exe /I{F99F74B4-972B-4B06-B893-6B3B0DB0128B}
Acronis Disk Director Server–>MsiExec.exe /X{F0E8F664-CAC6-4104-A4F9-4373F0633495}
Ad-Aware 2007–>MsiExec.exe /X{E31C348B-63A9-4CBF-8D7F-D932ABB63244}
Adobe Acrobat 7.0 Professional–>msiexec /I {AC76BA86-1033-0000-7760-000000000002}
Adobe Bridge 1.0–>MsiExec.exe /I{B74D4E10-1033-0000-0000-000000000001}
Adobe Common File Installer–>MsiExec.exe /I{8EDBA74D-0686-4C99-BFDD-F894678E5B39}
Adobe Flash Player ActiveX–>C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin–>C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Help Center 1.0–>MsiExec.exe /I{E9787678-1033-0000-8E67-000000000001}
Adobe Photoshop CS2–>msiexec /I {236BB7C4-4419-42FD-0409-1E257A25E34D}
Aggiornamento della protezione per Windows Internet Explorer 7 (KB928090)–>"C:\WINDOWS\ie7updates\KB928090-IE7\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows Internet Explorer 7 (KB931768)–>"C:\WINDOWS\ie7updates\KB931768-IE7\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows Internet Explorer 7 (KB933566)–>"C:\WINDOWS\ie7updates\KB933566-IE7\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows Internet Explorer 7 (KB937143)–>"C:\WINDOWS\ie7updates\KB937143-IE7\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows Internet Explorer 7 (KB938127)–>"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows Internet Explorer 7 (KB939653)–>"C:\WINDOWS\ie7updates\KB939653-IE7\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows Internet Explorer 7 (KB942615)–>"C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows Internet Explorer 7 (KB944533)–>"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows Internet Explorer 7 (KB950759)–>"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows Internet Explorer 7 (KB953838)–>"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows Media Player 11 (KB936782)–>"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows Media Player 11 (KB954154)–>"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows Media Player 9 (KB917734)–>"C:\WINDOWS\$NtUninstallKB917734_WMP9$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB923789)–>C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Aggiornamento della protezione per Windows XP (KB938464)–>"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB941569)–>"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB946648)–>"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB950760)–>"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB950762)–>"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB950974)–>"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB951066)–>"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB951376)–>"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB951376-v2)–>"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB951698)–>"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB951748)–>"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB952954)–>"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB953839)–>"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Aggiornamento per Windows XP (KB951072-v2)–>"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Aggiornamento per Windows XP (KB951978)–>"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Aggiornamento rapido per Windows Internet Explorer 7 (KB947864)–>"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
Aggiornamento rapido per Windows Media Player 11 (KB939683)–>"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Aggiornamento rapido per Windows XP (KB952287)–>"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
AppCore–>MsiExec.exe /I{EFB5B3B5-A280-4E25-BE1C-634EEFE32C1B}
Ashampoo UnInstaller Platinum 2–>"C:\Programmi\Ashampoo\Ashampoo UnInstaller Platinum 2\Uninstall\UIP_Uninstall.exe"
AV–>MsiExec.exe /I{F4DB525F-A986-4249-B98B-42A8066251CA}
Azureus–>C:\Programmi\Azureus\Uninstall.exe
Calculator Powertoy for Windows XP–>MsiExec.exe /I{B37C842A-B624-46B8-A727-654E72F1C91A}
ccCommon–>MsiExec.exe /I{3CCAD2EF-CFF2-4637-82AA-AABF370282D3}
ClearType Tuning Control Panel Applet–>MsiExec.exe /I{C9E4932C-8417-4E4C-A0E3-EE534810AB4D}
Component Framework–>MsiExec.exe /I{31478BE1-CDE5-4753-A8B2-F6D4BC1FBE09}
Connection Keep Alive–>MsiExec.exe /I{77364F85-6219-4CB8-AAA0-6D53368D683D}
Crazy Machines - New Challenges–>MsiExec.exe /X{1039158D-B0B8-4C52-8CA6-F3C9F072657D}
DC++ 0.699–>"C:\Programmi\DC++\uninstall.exe"
DivX Content Uploader–>C:\Programmi\DivX\DivXContentUploaderUninstall.exe /CUPLOADER
DivX Web Player–>C:\Programmi\DivX\DivXWebPlayerUninstall.exe /PLUGIN
Easy Video Joiner 5.21–>"C:\Programmi\Easy Video Joiner\unins000.exe"
Google Earth–>MsiExec.exe /I{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}
Google Updater–>"C:\Programmi\Google\Google Updater\GoogleUpdater.exe" -uninstall
GTK+ Runtime 2.6.9 rev a (remove only)–>C:\Programmi\File comuni\GTK\2.0\uninst.exe
HijackThis 2.0.2–>"C:\Programmi\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Windows Media Format 11 SDK (KB929399)–>"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
ILLUSION RapeLay–>MsiExec.exe /X{D1E1F028-1953-43A3-BFD8-D2A00EC06E36}
IMMonitor MSN Spy–>C:\Programmi\Fake Webcam\unins000.exe
J2SE Runtime Environment 5.0 Update 10–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150100}
J2SE Runtime Environment 5.0 Update 11–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150110}
Java™ 6 Update 2–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}
Java™ 6 Update 3–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Java™ 6 Update 5–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Java™ 6 Update 7–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
L&H; TTS3000 British English–>RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\LHTTSENG.inf, Uninstall
LiveUpdate 3.1 (Symantec Corporation)–>"C:\Programmi\Symantec\LiveUpdate\LSETUP.EXE" /U
LiveUpdate Notice (Symantec Corporation)–>MsiExec.exe /X{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}
Macromedia Extension Manager–>MsiExec.exe /I{5546CDB5-2CE2-498B-B059-5B3BF81FC41F}
Macromedia Flash 8 Video Encoder–>MsiExec.exe /X{8BF2C401-02CE-424D-BC26-6C4F9FB446B6}
Macromedia Flash 8–>MsiExec.exe /I{2BD5C305-1B27-4D41-B690-7A61172D2FEB}
Magic ISO Maker v5.4 (build 0239)–>C:\PROGRA~1\MagicISO\UNWISE.EXE C:\PROGRA~1\MagicISO\INSTALL.LOG
Malwarebytes' Anti-Malware–>"C:\Programmi\Malwarebytes' Anti-Malware\unins000.exe"
Messenger Plus! Live–>"C:\Programmi\Messenger Plus! Live\Uninstall.exe"
Microsoft - Math–>MsiExec.exe /I{07243840-959A-4B0D-8825-2C533F0DDB19}
Microsoft .NET Framework 2.0 - Language Pack (italiano)–>C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - ITA\install.exe
Microsoft .NET Framework 2.0 Service Pack 1–>MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft ActiveSync 3.8–>"C:\WINDOWS\ISUN0410.EXE" -f"C:\Programmi\Microsoft ActiveSync\DeIsL1.isu" -c"C:\Programmi\Microsoft ActiveSync\ceuninst.dll"
Microsoft Compression Client Pack 1.0 for Windows XP–>"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Encarta 2007 - Premium + Student–>MsiExec.exe /I{07241881-E9B4-4DF6-A845-CAAFD093E477}
Microsoft English TTS Engine–>MsiExec.exe /I{94824ADD-8F26-43D2-84DB-22E11F377E5E}
Microsoft Internationalized Domain Names Mitigation APIs–>"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs–>"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office 2003 Proofing Tools–>MsiExec.exe /I{901F0409-6000-11D3-8CFE-0150048383C9}
Microsoft Office Professional Edition 2003–>MsiExec.exe /I{90110409-6000-11D3-8CFE-0150048383C9}
Microsoft Plus! Digital Media Edition–>MsiExec.exe /I{C6A7AF96-4EB1-4AAE-8318-1AB393C64F88}
Microsoft Streets & Trips 2007–>MsiExec.exe /I{C82185E8-C27B-4EF4-2007-4444BC2C2B6D}
Microsoft User-Mode Driver Framework Feature Pack 1.0–>"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Mozilla Firefox (3.0.1)–>C:\Programmi\Mozilla Firefox\uninstall\helper.exe
MSRedist–>MsiExec.exe /I{B7C61755-DB48-4003-948F-3D34DB8EAF69}
MSRedist–>MsiExec.exe /I{D1725BDB-BA2B-4503-A8CB-F5C835D743FA}
MSXML 6.0 Parser (KB933579)–>MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}
myTV–>C:\Programmi\InstallShield Installation Information\{C54184D0-D281-4523-B357-0606209DB56C}\setup.exe -runfromtemp -l0x0009 -removeonly
Nero 7 Ultra Edition–>MsiExec.exe /I{F14B8ECC-BDA0-4987-9201-D7B7DBE11040}
Norton AntiVirus–>MsiExec.exe /X{830D8CBD-C668-49e2-A969-C2C2106332E0}
Norton Cleanup–>MsiExec.exe /I{CA31120D-2101-484D-9FF1-195DE96FE346}
Norton Confidential Browser Component–>MsiExec.exe /I{4843B611-8FCB-4428-8C23-31D0A5EAE164}
Norton Confidential Web Protection Component–>MsiExec.exe /I{D353CC51-430D-4C6F-9B7E-52003DA1E05A}
Norton Internet Security (Symantec Corporation)–>"C:\Programmi\File comuni\Symantec Shared\SymSetup\{5AA2CD16-706F-41f3-87C5-2B5A031F2B3B}_10_0_0_86\{5AA2CD16-706F-41f3-87C5-2B5A031F2B3B}.exe" /X
Norton Internet Security–>MsiExec.exe /I{48185814-A224-447a-81DA-71BD20580E1B}
Norton Internet Security–>MsiExec.exe /I{5AA2CD16-706F-41f3-87C5-2B5A031F2B3B}
Norton Internet Security–>MsiExec.exe /I{E3EFA461-EB83-4C3B-9C47-2C1D58A01555}
Norton Internet Security–>MsiExec.exe /I{E5EE9939-259F-4DE2-8023-5C49E16A4F43}
Norton Protection Center–>MsiExec.exe /I{9A129ABC-A53A-4209-A21E-D5DEDFB7CCA8}
Norton SystemWorks (Symantec Corporation)–>"C:\Programmi\File comuni\Symantec Shared\SymSetup\{B9807C3D-B3DD-41B7-8321-53DDB3A3A888}\{B9807C3D-B3DD-41B7-8321-53DDB3A3A888}.exe" /X
Norton SystemWorks Premier–>MsiExec.exe /I{B9807C3D-B3DD-41B7-8321-53DDB3A3A888}
Norton SystemWorks–>MsiExec.exe /I{9E23C48E-5483-4971-BA50-089F2FABCD66}
Norton Utilities–>MsiExec.exe /I{6A7867BA-B7CA-4CC9-ACAB-85BA46865EE5}
NVIDIA Drivers–>C:\WINDOWS\system32\nvudisp.exe UninstallGUI
oggcodecs 0.71.0946–>C:\Programmi\illiminable\oggcodecs\uninst.exe
Opera 9.52–>MsiExec.exe /X{E1A88DE8-BD36-4DEA-8DD8-E35EF475ADC7}
O?iana–>C:\Programmi\Today\unins000.exe
Philips ToUcam XS Camera–>C:\WINDOWS\IsUn0410.exe -f"C:\Programmi\Philips ToUcam Camera\ToUcamXS.isu"
PowerDVD–>RunDll32 C:\PROGRA~1\FILECO~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programmi\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe" -uninstall
PowerISO–>"C:\Programmi\PowerISO\uninstall.exe"
Privacy Eraser Pro–>"C:\Programmi\PrivacyEraser Computing\Privacy Eraser Pro\unins000.exe"
QuickTime–>MsiExec.exe /I{50D8FFDD-90CD-4859-841F-AA1961C7767A}
RealPlayer–>C:\Programmi\File comuni\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Security Update for CAPICOM (KB931906)–>MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)–>MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Skype™ 3.6–>MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
SopCast 1.1.1–>C:\Programmi\SopCast\uninst.exe
SPBBC 32bit–>MsiExec.exe /I{77772678-817F-4401-9301-ED1D01A8DA56}
Spybot - Search & Destroy–>"C:\Programmi\Spybot - Search & Destroy\unins000.exe"
Strumenti e modelli didattici per Microsoft Office–>MsiExec.exe /X{B348E585-E872-41DF-8234-E2D49917CFBB}
SUPERAntiSpyware Free Edition–>MsiExec.exe /X{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}
SYSTRAN Premium 4.0–>C:\WINDOWS\unvise32.exe C:\Programmi\Systran\4_0\Premium\uninstal.log
TablePCRT–>MsiExec.exe /X{C46A5F24-B91F-477C-B634-DB99A7D7792A}
TTS Wrapper–>MsiExec.exe /I{97D0C0A1-7E64-4B05-A2EE-61D2CE23F154}
TVAnts 1.0–>C:\PROGRA~1\TVAnts\UNWISE.EXE C:\PROGRA~1\TVAnts\INSTALL.LOG
U.S. Robotics Wireless MAXg Adapter–>"C:\WINDOWS\system32\MAXguninst.exe" "C:\Programmi\U.S. Robotics\U.S. Robotics Wireless MAXg Adapter\bcmwlu00.exe" verbose /rootkey="Software\Broadcom\802.11\UninstallInfo" /rootdir="C:\Programmi\U.S. Robotics\U.S. Robotics Wireless MAXg Adapter"
VeohTV BETA–>C:\Programmi\InstallShield Installation Information\{0405E51E-9582-4207-8F38-AC44201D3808}\setup.exe -runfromtemp -l0x0409
WinAce Archiver–>C:\Programmi\WinAce\SXUNINST.EXE C:\Programmi\WinAce\SXUNINST.INI
Window Washer–>C:\WINDOWS\Unwash6.exe
Windows Defender–>MsiExec.exe /I{A06275F4-324B-4E85-95E6-87B2CD729401}
Windows Live installer–>MsiExec.exe /X{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320}
Windows Live Messenger–>MsiExec.exe /X{508CE775-4BA4-4748-82DF-FE28DA9F03B0}
Windows Media Format 11 runtime–>"C:\Programmi\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime–>"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11–>"C:\Programmi\Windows Media Player\Setup_wm.exe" /Uninstall
Windows Media Player 11–>"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows Media Player Firefox Plugin–>MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
Windows Media Recorder–>C:\Programmi\Windows Media Recorder\WMR PRO 5.0\Uninstal.exe
Windows XP Service Pack 3–>"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
WinRAR archiver–>C:\Programmi\WinRAR\uninstall.exe
Your Uninstaller! 2006 Version 5–>"C:\Programmi\Your Uninstaller 2006\unins000.exe"

Security center information

AV: Norton Internet Security
FW: Norton Internet Security

Environment variables

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Programmi\QuickTime\QTSystem\;C:\Programmi\File comuni\Adobe\AGL
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 6 Stepping 2, AuthenticAMD
"PROCESSOR_REVISION"=0602
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CNVPATH"=C:\Programmi\Systran\4_0\Premium\Dicts
"CLASSPATH"=.;C:\Programmi\Java\jre1.5.0_10\lib\ext\QTJava.zip
"QTJAVA"=C:\Programmi\Java\jre1.5.0_10\lib\ext\QTJava.zip

—————–EOF—————–

many thxs
h18

Rorschach112

Post #4September 18, 2008, 12:38 AM UTC

Hello

Please click on Start > Control Panel > Add/Remove Programs and uninstall the following programs(if present):

J2SE Runtime Environment 5.0 Update 10–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150100}
J2SE Runtime Environment 5.0 Update 11–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150110}
Java™ 6 Update 2–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}
Java™ 6 Update 3–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Java™ 6 Update 5–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}

1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present):

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [\YUR4C8.exe] C:\Windows\system32\YUR4C8.exe
O4 - HKLM\..\Run: [\YUR4C7.exe] C:\Windows\system32\YUR4C7.exe
O4 - HKLM\..\Run: [\YUR4C9.exe] C:\Windows\system32\YUR4C9.exe
O4 - HKLM\..\Run: [\YUR4CA.exe] C:\Windows\system32\YUR4CA.exe
O4 - HKLM\..\Run: [\YUR1.exe] C:\Windows\system32\YUR1.exe
O4 - HKLM\..\Run: [\YUR2.exe] C:\Windows\system32\YUR2.exe
O4 - HKLM\..\Run: [\YUR4.exe] C:\Windows\system32\YUR4.exe
O4 - HKLM\..\Run: [\YUR3.exe] C:\Windows\system32\YUR3.exe

2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.

Please download the OTMoveIt2 by OldTimer.

Save it to your desktop.
Please double-click OTMoveIt2.exe to run it.

Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

[kill explorer]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0e340a40-5dab-11dd-9d9b-00e04c39dbc5}
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2a391560-2e27-11dd-9d15-00e04c39dbc5}
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{45da8111-d614-11db-98ce-00e04c39dbc5}
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{95cced30-cb2f-11db-9896-00e04c39dbc5}
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{977b7d43-d7e4-11dc-9c37-00e04c39dbc5}
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fa8c97f1-43a1-11dd-9d49-00e04c39dbc5}
purity 
EmptyTemp
[start explorer]

Return to OTMoveIt2, right click in the "Paste List of Files/Folders to Move" window (under the light Yellow bar) and choose Paste.
Click the red Moveit! button.
A log of files and folders moved will be created in the c:\_OTMoveIt\MovedFiles folder in the form of Date and Time (mmddyyyy_hhmmss.log). Please open this log in Notepad and post its contents in your next reply.
Close OTMoveIt2

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Also post a new rsit log

hangar18

Post #5September 18, 2008, 10:31 AM UTC

here is the files you have asked me :

first : c:\_OTMoveIt\MovedFiles

< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm >
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm\\ deleted successfully.
File/Folder HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys not found.
File/Folder HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0e340a40-5dab-11dd-9d9b-00e04c39dbc5} not found.
File/Folder HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2a391560-2e27-11dd-9d15-00e04c39dbc5} not found.
File/Folder HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{45da8111-d614-11db-98ce-00e04c39dbc5} not found.
File/Folder HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{95cced30-cb2f-11db-9896-00e04c39dbc5} not found.
File/Folder HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{977b7d43-d7e4-11dc-9c37-00e04c39dbc5} not found.
File/Folder HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fa8c97f1-43a1-11dd-9d49-00e04c39dbc5} not found.
< purity >
< EmptyTemp >
File delete failed. C:\DOCUME~1\H18\IMPOST~1\Temp\~DF1A50.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\H18\IMPOST~1\Temp\~DFBE71.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\H18\IMPOST~1\Temp\~DFC1E1.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\H18\IMPOST~1\Temp\~DFFBB9.tmp scheduled to be deleted on reboot.
Temp folders emptied.
IE temp folders emptied.

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 09182008_121306

Files moved on Reboot…
File C:\DOCUME~1\H18\IMPOST~1\Temp\~DF1A50.tmp not found!
File C:\DOCUME~1\H18\IMPOST~1\Temp\~DFBE71.tmp not found!
File C:\DOCUME~1\H18\IMPOST~1\Temp\~DFC1E1.tmp not found!
File C:\DOCUME~1\H18\IMPOST~1\Temp\~DFFBB9.tmp not found!

second the rsit.exe results :

Logfile of random's system information tool 1.01 (written by random/random)
Run by [removed] at 2008-09-18 12:29:00
Microsoft Windows XP Professional Service Pack 3
System drive C: has 1 GB (2%) free of 46 GB
Total RAM: 1023 MB (47% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:29:09, on 18/09/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
C:\Programmi\File comuni\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\notepad.exe
C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Programmi\File comuni\Symantec Shared\ccApp.exe
C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wwSecure.exe
C:\Programmi\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Microsoft ActiveSync\WCESCOMM.EXE
C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe
C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Documents and Settings\H18\Desktop\RSIT.exe
C:\Programmi\Trend Micro\HijackThis\H18.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Programmi\File comuni\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: (no name) - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - (no file)
O2 - BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Encarta Web Companion Oggetto helper - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Programmi\File comuni\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: Encarta Web Companion - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Programmi\File comuni\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Systran40premi.IEPlugIn - {D3919E1A-D6A5-11D6-AC3E-00B0D094B576} - C:\Programmi\Systran\4_0\Premium\IEPlugIn.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Programmi\File comuni\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Programmi\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Programmi\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [NSWosCheck] C:\Programmi\Norton SystemWorks Premier\osCheck.exe
O4 - HKLM\..\Run: [USRobotics Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [\YUR4C8.exe] C:\Windows\system32\YUR4C8.exe
O4 - HKLM\..\Run: [\YUR4.exe] C:\Windows\system32\YUR4.exe
O4 - HKLM\..\Run: [\YUR4C7.exe] C:\Windows\system32\YUR4C7.exe
O4 - HKLM\..\Run: [\YUR4C9.exe] C:\Windows\system32\YUR4C9.exe
O4 - HKLM\..\Run: [\YUR4CA.exe] C:\Windows\system32\YUR4CA.exe
O4 - HKLM\..\Run: [\YUR3.exe] C:\Windows\system32\YUR3.exe
O4 - HKLM\..\Run: [\YUR1.exe] C:\Windows\system32\YUR1.exe
O4 - HKLM\..\Run: [\YUR2.exe] C:\Windows\system32\YUR2.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programmi\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: O?iana.lnk
O8 - Extra context menu item: &Download; All with Rapidshare Downloader - C:\DOCUME~1\H18\IMPOST~1\Temp\RarSFX0\jc_all.htm
O8 - Extra context menu item: &Download; with Rapidshare Downloader - C:\DOCUME~1\H18\IMPOST~1\Temp\RarSFX0\jc_link.htm
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Crea preferiti portatile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Programmi\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programmi\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Crea preferiti portatile… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programmi\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Programmi\Norton SystemWorks Premier\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Programmi\Norton SystemWorks Premier\Norton Cleanup\WCQuick.lnk
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Barra di ricerca di Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programmi\File comuni\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{AD81C8A6-4507-4E78-9486-F9D0B6A49758}: NameServer = 213.215.115.88,147.175.167.50
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Programmi\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Programmi\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NBService - Nero AG - C:\Programmi\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Unknown owner - C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
O23 - Service: Washer AutoComplete (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe
O23 - Service: WEP/WPA-PMK key recovery service (WZCOOK) - Unknown owner - C:\Documents and Settings\H18\Desktop\WiFi_WEP_Key_Finder\aircrack-ng-0.6.2-win\bin\wzcook.exe (file missing)

–
End of file - 13162 bytes

Scheduled tasks folder

C:\WINDOWS\tasks\MP Scheduled Scan.job
C:\WINDOWS\tasks\Norton Internet Security - Run Full System Scan - H18.job
C:\WINDOWS\tasks\Norton SystemWorks One Button Checkup.job

Registry dump

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E8A6170-7264-4D0F-BEAE-D42A53123C75}]
C:\Programmi\File comuni\Symantec Shared\coShared\Browser\1.0\NppBho.dll [2006-09-06 93400]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D; IE Protection - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll [2008-07-07 1562448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{955BE0B8-BC85-4CAF-856E-8E0D8B610560}]
Encarta Web Companion Oggetto helper - C:\Programmi\File comuni\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL [2006-06-13 256792]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
AcroIEToolbarHelper Class - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2004-12-14 225280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Programmi\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll [2008-05-18 654320]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{147D6308-0614-4112-89B1-31402F9B82C4} - Encarta Web Companion - C:\Programmi\File comuni\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL [2006-06-13 256792]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2004-12-14 225280]
{D3919E1A-D6A5-11D6-AC3E-00B0D094B576} - Systran40premi.IEPlugIn - C:\Programmi\Systran\4_0\Premium\IEPlugIn.dll [2002-10-03 73728]
{90222687-F593-4738-B738-FBEE9C7B26DF} - Show Norton Toolbar - C:\Programmi\File comuni\Symantec Shared\coShared\Browser\1.0\UIBHO.dll [2006-09-06 510152]
{D0943516-5076-4020-A3B5-AEFAF26AB263} - Veoh Browser Plug-in - C:\Programmi\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll [2008-04-01 352256]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2005-02-24 5537792]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2005-02-24 86016]
""=C:\WINDOWS\system32\
"ccApp"=C:\Programmi\File comuni\Symantec Shared\ccApp.exe [2006-10-28 107112]
"osCheck"=C:\Programmi\Norton Internet Security\osCheck.exe [2006-09-06 26248]
"Symantec PIF AlertEng"=C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2007-11-28 583048]
"NSWosCheck"=C:\Programmi\Norton SystemWorks Premier\osCheck.exe [2007-12-03 25472]
"USRobotics Wireless Manager UI"=C:\WINDOWS\system32\WLTRAY.exe [2006-10-12 1290240]
"SunJavaUpdateSched"=C:\Programmi\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
"\YUR4C8.exe"=C:\Windows\system32\YUR4C8.exe []
"\YUR4.exe"=C:\Windows\system32\YUR4.exe []
"\YUR4C7.exe"=C:\Windows\system32\YUR4C7.exe []
"\YUR4C9.exe"=C:\Windows\system32\YUR4C9.exe []
"\YUR4CA.exe"=C:\Windows\system32\YUR4CA.exe []
"\YUR3.exe"=C:\Windows\system32\YUR3.exe []
"\YUR1.exe"=C:\Windows\system32\YUR1.exe []
"\YUR2.exe"=C:\Windows\system32\YUR2.exe []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"H/PC Connection Agent"=C:\Programmi\Microsoft ActiveSync\WCESCOMM.EXE [2005-01-19 405583]
"MsnMsgr"=C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe [2007-10-18 5724184]
""=C:\WINDOWS\system32\
"SpybotSD TeaTimer"=C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe [2008-08-18 1832272]
"SUPERAntiSpyware"=C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe [2008-09-03 1576176]

C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica
O?iana.lnk - C:\Programmi\Today\TODAY.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Programmi\SUPERAntiSpyware\SASWINLO.dll [2008-07-23 352256]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"=C:\PROGRA~1\WIFD1F~1\MpShHook.dll [2006-11-03 83224]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Programmi\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinDefend]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Programmi\Java\jre1.5.0_10\bin\javaw.exe"="C:\Programmi\Java\jre1.5.0_10\bin\javaw.exe:*:Enabled:Java™ 2 Platform Standard Edition binary"
"C:\Documents and Settings\H18\Documenti\eDonkey2000 Downloads\Msn Messenger winks moods etc\winks,moods,muggins,weemees and meegos\mcoinstall.exe"="C:\Documents and Settings\H18\Documenti\eDonkey2000 Downloads\Msn Messenger winks moods etc\winks,moods,muggins,weemees and meegos\mcoinstall.exe:*:Disabled:mcoinstall"
"C:\Programmi\Kazaa Lite K++\KazaaLite.kpp"="C:\Programmi\Kazaa Lite K++\KazaaLite.kpp:*:Enabled:KazaaLite"
"C:\Programmi\Real\RealPlayer\realplay.exe"="C:\Programmi\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer"
"C:\Programmi\webcamXP\webcamXP.exe"="C:\Programmi\webcamXP\webcamXP.exe:*:Enabled:webcamXP"
"C:\Programmi\THQ\MotoGP URT 3\motogp.exe"="C:\Programmi\THQ\MotoGP URT 3\motogp.exe:*:Disabled:motogp"
"C:\Programmi\SopCast\SopCast.exe"="C:\Programmi\SopCast\SopCast.exe:*:Enabled:SopCast Main Application"
"C:\Documents and Settings\H18\Dati applicazioni\SopCast\adv\SopAdver.exe"="C:\Documents and Settings\H18\Dati applicazioni\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver"
"C:\Documents and Settings\H18\Impostazioni locali\Temp\ir_ext_temp_0\AutoPlay\Docs\PackIcons.exe"="C:\Documents and Settings\H18\Impostazioni locali\Temp\ir_ext_temp_0\AutoPlay\Docs\PackIcons.exe:*:Disabled:Messenger Content Installer"
"C:\Programmi\Java\jre1.5.0_11\bin\javaw.exe"="C:\Programmi\Java\jre1.5.0_11\bin\javaw.exe:*:Enabled:Java™ 2 Platform Standard Edition binary"
"C:\Programmi\myTV\myTV.exe"="C:\Programmi\myTV\myTV.exe:*:Enabled:myTV"
"C:\Programmi\Yahoo!\Messenger\YahooMessenger.exe"="C:\Programmi\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\Programmi\Yahoo!\Messenger\YServer.exe"="C:\Programmi\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\Programmi\CCNetwork\WebCamSrv\CCCamSrv.exe"="C:\Programmi\CCNetwork\WebCamSrv\CCCamSrv.exe:*:Disabled:CCN WebCam Server"
"C:\Programmi\MessengerDiscovery\MessengerDiscovery Live.exe"="C:\Programmi\MessengerDiscovery\MessengerDiscovery Live.exe:*:Enabled:MessengerDiscovery Live the Windows Live Messenger addon"
"C:\Programmi\Trillian\trillian.exe"="C:\Programmi\Trillian\trillian.exe:*:Enabled:Trillian"
"C:\Program Files\DoubleB\BBcat\fcPSGRun.exe"="C:\Program Files\DoubleB\BBcat\fcPSGRun.exe:*:Enabled:Play Sex Game 1.17 HTTP emulator"
"C:\Documents and Settings\H18\Desktop\P.S.G.part1\P-S-G\Members\fcPSGRun.exe"="C:\Documents and Settings\H18\Desktop\P.S.G.part1\P-S-G\Members\fcPSGRun.exe:*:Enabled:Play Sex Game 1.17 HTTP emulator"
"C:\Program Files\DoubleB\BBcat\Members\fcPSGRun.exe"="C:\Program Files\DoubleB\BBcat\Members\fcPSGRun.exe:*:Enabled:Play Sex Game 1.17 HTTP emulator"
"C:\Programmi\e frontier\Poser 7\Poser.exe"="C:\Programmi\e frontier\Poser 7\Poser.exe:*:Enabled:Poser executable file"
"C:\Programmi\Microsoft ActiveSync\wcescomm.exe"="C:\Programmi\Microsoft ActiveSync\wcescomm.exe:*:Enabled:ActiveSync Connection Manager"
"C:\Programmi\Microsoft ActiveSync\WCESMgr.exe"="C:\Programmi\Microsoft ActiveSync\WCESMgr.exe:*:Enabled:ActiveSync Application"
"C:\Programmi\DC++\DCPlusPlus.exe"="C:\Programmi\DC++\DCPlusPlus.exe:*:Enabled:DC++"
"C:\Programmi\Steam\steamapps\common\defcon\defcon.exe"="C:\Programmi\Steam\steamapps\common\defcon\defcon.exe:*:Enabled:Defcon"
"C:\Programmi\Kazaa Lite\Kazaa.kpp"="C:\Programmi\Kazaa Lite\Kazaa.kpp:*:Enabled:Kazaa Lite"
"C:\Documents and Settings\H18\Desktop\emule0.48a-Xtreme6.1\emule.exe"="C:\Documents and Settings\H18\Desktop\emule0.48a-Xtreme6.1\emule.exe:*:Enabled:eMule"
"C:\Programmi\Steam\steamapps\hangar1818\half-life 2 deathmatch\hl2.exe"="C:\Programmi\Steam\steamapps\hangar1818\half-life 2 deathmatch\hl2.exe:*:Disabled:hl2"
"C:\Programmi\Soulseek\slsk.exe"="C:\Programmi\Soulseek\slsk.exe:*:Disabled:SoulSeek"
"C:\Programmi\Invisible Browsing\InvisibleBrowsing.exe"="C:\Programmi\Invisible Browsing\InvisibleBrowsing.exe:*:Enabled:IB6_UI"
"C:\Programmi\Skype\Phone\Skype.exe"="C:\Programmi\Skype\Phone\Skype.exe:*:Enabled:Skype. The whole world can talk for free."
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Programmi\Windows Live\Messenger\msnmsgr.exe"="C:\Programmi\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Programmi\Windows Live\Messenger\livecall.exe"="C:\Programmi\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Programmi\Windows Live\Messenger\msnmsgr.exe"="C:\Programmi\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Programmi\Windows Live\Messenger\livecall.exe"="C:\Programmi\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0e340a40-5dab-11dd-9d9b-00e04c39dbc5}]
shell\AutoRun\command - 1rfw8hjr.com
shell\explore\command - 1rfw8hjr.com
shell\open\command - 1rfw8hjr.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2a391560-2e27-11dd-9d15-00e04c39dbc5}]
shell\AutoRun\command - 1rfw8hjr.com
shell\explore\command - 1rfw8hjr.com
shell\open\command - 1rfw8hjr.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{45da8111-d614-11db-98ce-00e04c39dbc5}]
shell\AutoRun\command - J:\.\run\autorun.exe
shell\open\command - J:\.\run\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{95cced30-cb2f-11db-9896-00e04c39dbc5}]
shell\AutoRun\command - H:\.\run\autorun.exe
shell\open\command - H:\.\run\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{977b7d43-d7e4-11dc-9c37-00e04c39dbc5}]
shell\AutoRun\command - H:\.\run\autorun.exe
shell\open\command - H:\.\run\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fa8c97f1-43a1-11dd-9d49-00e04c39dbc5}]
shell\AutoRun\command - .\run\autorun.exe
shell\open\command - .\run\autorun.exe

List of files/folders created in the last three months

2008-09-18 12:29:00 —-D—- C:\rsit
2008-09-18 12:13:06 —-D—- C:\_OTMoveIt
2008-09-18 11:55:13 —-D—- C:\WINDOWS\system32\appmgmt
2008-09-17 13:03:20 —-A—- C:\WINDOWS\system32\tmp.txt
2008-09-16 17:55:34 —-D—- C:\Documents and Settings\H18\Dati applicazioni\Malwarebytes
2008-09-16 17:55:28 —-D—- C:\Programmi\Malwarebytes' Anti-Malware
2008-09-16 17:55:28 —-D—- C:\Documents and Settings\All Users\Dati applicazioni\Malwarebytes
2008-09-16 17:32:35 —-D—- C:\Programmi\Trend Micro
2008-09-15 21:05:04 —-D—- C:\Programmi\The Cleaner Free
2008-09-15 15:03:23 —-D—- C:\Documents and Settings\All Users\Dati applicazioni\SUPERAntiSpyware.com
2008-09-15 15:03:14 —-D—- C:\Programmi\SUPERAntiSpyware
2008-09-15 15:03:14 —-D—- C:\Documents and Settings\H18\Dati applicazioni\SUPERAntiSpyware.com
2008-09-10 16:08:14 —-HDC—- C:\WINDOWS\$NtUninstallKB938464$
2008-09-10 16:07:20 —-HDC—- C:\WINDOWS\$NtUninstallKB954154_WM11$
2008-09-09 12:07:34 —-HDC—- C:\WINDOWS\$NtUninstallKB951978$
2008-09-09 11:41:49 —-D—- C:\WINDOWS\Prefetch
2008-09-09 02:02:51 —-HDC—- C:\WINDOWS\$NtUninstallKB952954$
2008-09-09 02:02:39 —-HDC—- C:\WINDOWS\$NtUninstallKB952287$
2008-09-09 02:02:17 —-HDC—- C:\WINDOWS\$NtUninstallKB951748$
2008-09-09 02:02:02 —-HDC—- C:\WINDOWS\$NtUninstallKB951698$
2008-09-09 02:01:50 —-HDC—- C:\WINDOWS\$NtUninstallKB951376-v2$
2008-09-09 02:01:37 —-HDC—- C:\WINDOWS\$NtUninstallKB951376$
2008-09-09 02:01:21 —-HDC—- C:\WINDOWS\$NtUninstallKB951066$
2008-09-09 02:01:07 —-HDC—- C:\WINDOWS\$NtUninstallKB950974$
2008-09-09 02:00:54 —-HDC—- C:\WINDOWS\$NtUninstallKB950762$
2008-09-09 02:00:38 —-HDC—- C:\WINDOWS\$NtUninstallKB946648$
2008-09-09 01:53:16 —-D—- C:\WINDOWS\l2schemas
2008-09-09 01:53:15 —-D—- C:\WINDOWS\system32\it
2008-09-09 01:53:14 —-D—- C:\WINDOWS\system32\bits
2008-09-09 01:48:22 —-D—- C:\WINDOWS\ServicePackFiles
2008-09-09 01:45:54 —-D—- C:\WINDOWS\network diagnostic
2008-09-09 01:40:45 —-HDC—- C:\WINDOWS\$NtServicePackUninstall$
2008-09-02 16:43:04 —-D—- C:\Programmi\Spybot - Search & Destroy
2008-09-01 00:45:08 —-HDC—- C:\WINDOWS\$NtUninstallKB952954_0$
2008-09-01 00:45:00 —-HDC—- C:\WINDOWS\$NtUninstallKB946648_0$
2008-09-01 00:44:53 —-HDC—- C:\WINDOWS\$NtUninstallKB953839$
2008-09-01 00:44:45 —-HDC—- C:\WINDOWS\$NtUninstallKB950974_0$
2008-09-01 00:43:11 —-HDC—- C:\WINDOWS\$NtUninstallKB951072-v2$
2008-09-01 00:43:02 —-HDC—- C:\WINDOWS\$NtUninstallKB952287_0$
2008-09-01 00:42:17 —-HDC—- C:\WINDOWS\$NtUninstallKB951066_0$
2008-07-09 16:10:46 —-A—- C:\WINDOWS\system32\javaws.exe
2008-07-09 16:10:46 —-A—- C:\WINDOWS\system32\javaw.exe
2008-07-09 16:10:46 —-A—- C:\WINDOWS\system32\java.exe
2008-07-09 09:09:26 —-HDC—- C:\WINDOWS\$NtUninstallKB951748_0$
2008-06-26 15:15:58 —-HDC—- C:\WINDOWS\$NtUninstallKB951376-v2_0$

List of drivers

R1 AmdK7;Driver del processore AMD K7; C:\WINDOWS\system32\DRIVERS\amdk7.sys [2008-04-14 41728]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Programmi\File comuni\Symantec Shared\EENGINE\eeCtrl.sys []
R1 SASDIFSV;SASDIFSV; \??\C:\Programmi\SUPERAntiSpyware\SASDIFSV.SYS []
R1 SASKUTIL;SASKUTIL; \??\C:\Programmi\SUPERAntiSpyware\SASKUTIL.sys []
R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2005-10-16 27171]
R1 SPBBCDrv;SPBBCDrv; \??\C:\Programmi\File comuni\Symantec Shared\SPBBC\SPBBCDrv.sys []
R1 SRTSP;SRTSP; C:\WINDOWS\System32\Drivers\SRTSP.SYS [2007-12-01 279088]
R1 SRTSPX;SRTSPX; C:\WINDOWS\System32\Drivers\SRTSPX.SYS [2007-12-01 43696]
R1 SYMTDI;SYMTDI; C:\WINDOWS\System32\Drivers\SYMTDI.SYS [2007-10-30 191536]
R2 usbhub;Ph USB Standard Hub Driver; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 BCM43XX;U.S. Robotics Wireless MAXg Adapter; C:\WINDOWS\system32\DRIVERS\bcmwl5.sys [2006-10-12 604928]
R3 ctljystk;Creative SBLive! Porta giochi; C:\WINDOWS\system32\DRIVERS\ctljystk.sys [2001-08-17 3712]
R3 dtscsi;dtscsi; C:\WINDOWS\System32\Drivers\dtscsi.sys [2007-01-21 223128]
R3 emu10k;Creative SB Live! (WDM); C:\WINDOWS\system32\drivers\emu10k1m.sys [2001-08-17 283904]
R3 emu10k1;Driver per Creative Interface Manager (WDM); C:\WINDOWS\system32\drivers\ctlfacem.sys [2001-08-17 6912]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Programmi\File comuni\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys []
R3 NAVENG;NAVENG; \??\C:\PROGRA~1\FILECO~1\SYMANT~1\VIRUSD~1\20080917.003\NAVENG.SYS []
R3 NAVEX15;NAVEX15; \??\C:\PROGRA~1\FILECO~1\SYMANT~1\VIRUSD~1\20080917.003\NAVEX15.SYS []
R3 NPDriver;Norton UnErase Protection Driver; \??\C:\WINDOWS\system32\Drivers\NPDRIVER.SYS []
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2005-02-24 3454144]
R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2007-01-21 10368]
R3 rtl8139;Driver NT scheda Fast Ethernet PCI Realtek basata su RTL8139; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-04 20992]
R3 SASENUM;SASENUM; \??\C:\Programmi\SUPERAntiSpyware\SASENUM.SYS []
R3 sfman;Driver per Creative SoundFont Manager (WDM); C:\WINDOWS\system32\drivers\sfmanm.sys [2001-08-17 36480]
R3 SYMDNS;SYMDNS; C:\WINDOWS\System32\Drivers\SYMDNS.SYS [2007-10-30 12848]
R3 SymEvent;SymEvent; \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS []
R3 SYMFW;SYMFW; C:\WINDOWS\System32\Drivers\SYMFW.SYS [2007-10-30 145968]
R3 SYMIDS;SYMIDS; C:\WINDOWS\System32\Drivers\SYMIDS.SYS [2007-10-30 39856]
R3 SYMIDSCO;SYMIDSCO; \??\C:\PROGRA~1\FILECO~1\SYMANT~1\SymcData\idsdefs\20080917.005\SymIDSCo.sys []
R3 SYMNDIS;SYMNDIS; C:\WINDOWS\System32\Drivers\SYMNDIS.SYS [2007-10-30 35120]
R3 SYMREDRV;SYMREDRV; C:\WINDOWS\System32\Drivers\SYMREDRV.SYS [2007-10-30 27696]
R3 usbuhci;Driver Miniport Controller Universal Host USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 camvid20;Philips ToUcam Camera; Video; C:\WINDOWS\system32\DRIVERS\camdrv21.sys [2001-12-10 253909]
S3 CCDECODE;Decoder sottotitoli codificati; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 MS1000;MS1000; C:\WINDOWS\System32\DRIVERS\MS1000.sys [2008-09-15 5376]
S3 MSTEE;Convertitore a T/Sito a sito per flusso Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Connesione TV/Video Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 nm;Driver di Network Monitor; C:\WINDOWS\system32\DRIVERS\NMnt.sys [2008-04-13 40320]
S3 PCASp50;PCASp50 NDIS Protocol Driver; C:\WINDOWS\System32\Drivers\PCASp50.sys [2004-09-07 17664]
S3 SDdriver;SDdriver; \??\C:\WINDOWS\system32\Drivers\sddriver.sys []
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 SRTSPL;SRTSPL; C:\WINDOWS\System32\Drivers\SRTSPL.SYS [2007-12-01 317616]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbaudio;Philips USB Microphone; C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
S3 usbscan;Driver scanner USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Driver archiviazione di massa USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 vaxscsi;vaxscsi; C:\WINDOWS\System32\Drivers\vaxscsi.sys []
S3 wceusbsh;Windows CE USB Serial Host Driver; C:\WINDOWS\system32\DRIVERS\wceusbsh.sys [2004-12-06 104064]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;Codec World Standard Teletext; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

List of services

R2 aawservice;Ad-Aware 2007 Service; C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe [2007-07-06 561152]
R2 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler; C:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2006-09-03 198336]
R2 ccEvtMgr;Symantec Event Manager; C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe [2006-10-28 107624]
R2 ccSetMgr;Symantec Settings Manager; C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe [2006-10-28 107624]
R2 CLTNetCnService;Symantec Lic NetConnect service; C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe [2006-10-28 107624]
R2 gusvc;Google Updater Service; C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-05-18 137200]
R2 LiveUpdate Notice Ex;LiveUpdate Notice Service Ex; C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe [2006-10-28 107624]
R2 NProtectService;Norton UnErase Protection; C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE [2005-11-04 95832]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2005-02-24 127043]
R2 Speed Disk service;Speed Disk service; C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE [2005-11-04 176193]
R2 SymAppCore;Symantec AppCore Service; C:\Programmi\File comuni\Symantec Shared\AppCore\AppSvc32.exe [2006-09-02 46736]
R2 WinDefend;Windows Defender; C:\Programmi\Windows Defender\MsMpEng.exe [2006-11-03 13592]
R2 wltrysvc;Broadcom Wireless LAN Tray Service; C:\WINDOWS\System32\WLTRYSVC.EXE [2006-10-12 20480]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 wwSecSvc;Washer AutoComplete; C:\WINDOWS\system32\wwSecure.exe [2005-04-20 487936]
R3 Symantec Core LC;Symantec Core LC; C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe [2008-01-24 1251720]
S2 LiveUpdate Notice Service;LiveUpdate Notice Service; C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2007-11-28 583048]
S3 Adobe LM Service;Adobe LM Service; C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe [2007-09-05 72704]
S3 aspnet_state;Servizio stato di ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 comHost;COM Host; C:\Programmi\File comuni\Symantec Shared\VAScanner\comHost.exe [2006-09-03 48272]
S3 IDriverT;InstallDriver Table Manager; C:\Programmi\File comuni\InstallShield\Driver\1150\Intel 32\IDriverT.exe [2005-11-14 69632]
S3 ISPwdSvc;Symantec IS Password Validation; C:\Programmi\Norton Internet Security\isPwdSvc.exe [2006-09-06 79496]
S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2006-09-03 2528960]
S3 NBService;NBService; C:\Programmi\Nero\Nero 7\Nero BackItUp\NBService.exe [2006-10-09 724992]
S3 ose;Office Source Engine; C:\Programmi\File comuni\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Programmi\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
S3 WLSetupSvc;Windows Live Setup Service; C:\Programmi\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Programmi\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S3 WZCOOK;WEP/WPA-PMK key recovery service; C:\Documents and Settings\H18\Desktop\WiFi_WEP_Key_Finder\aircrack-ng-0.6.2-win\bin\wzcook.exe []

—————–EOF—————–

and the third :

info.txt logfile of random's system information tool 1.01 2008-09-18 12:29:11

Uninstall list

–>C:\Programmi\File comuni\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
–>C:\Programmi\Nero\Nero 7\nero\uninstall\UNNERO.exe /UNINSTALL
–>C:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL
–>C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL
–>C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL
–>C:\WINDOWS\UNNeroVision.exe /UNINSTALL
–>C:\WINDOWS\UNRecode.exe /UNINSTALL
–>MsiExec.exe /I{0F122737-72B2-4095-8B3E-7AAE753DFD3D}
–>MsiExec.exe /I{219B0DA4-8F1A-499D-8795-4A07C632521E}
–>MsiExec.exe /I{644B991F-B109-4360-9DA3-40CDAD13961C}
–>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
ACDSee Pro–>MsiExec.exe /I{F99F74B4-972B-4B06-B893-6B3B0DB0128B}
Acronis Disk Director Server–>MsiExec.exe /X{F0E8F664-CAC6-4104-A4F9-4373F0633495}
Ad-Aware 2007–>MsiExec.exe /X{E31C348B-63A9-4CBF-8D7F-D932ABB63244}
Adobe Acrobat 7.0 Professional–>msiexec /I {AC76BA86-1033-0000-7760-000000000002}
Adobe Bridge 1.0–>MsiExec.exe /I{B74D4E10-1033-0000-0000-000000000001}
Adobe Common File Installer–>MsiExec.exe /I{8EDBA74D-0686-4C99-BFDD-F894678E5B39}
Adobe Flash Player ActiveX–>C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin–>C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Help Center 1.0–>MsiExec.exe /I{E9787678-1033-0000-8E67-000000000001}
Adobe Photoshop CS2–>msiexec /I {236BB7C4-4419-42FD-0409-1E257A25E34D}
Aggiornamento della protezione per Windows Internet Explorer 7 (KB928090)–>"C:\WINDOWS\ie7updates\KB928090-IE7\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows Internet Explorer 7 (KB931768)–>"C:\WINDOWS\ie7updates\KB931768-IE7\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows Internet Explorer 7 (KB933566)–>"C:\WINDOWS\ie7updates\KB933566-IE7\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows Internet Explorer 7 (KB937143)–>"C:\WINDOWS\ie7updates\KB937143-IE7\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows Internet Explorer 7 (KB938127)–>"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows Internet Explorer 7 (KB939653)–>"C:\WINDOWS\ie7updates\KB939653-IE7\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows Internet Explorer 7 (KB942615)–>"C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows Internet Explorer 7 (KB944533)–>"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows Internet Explorer 7 (KB950759)–>"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows Internet Explorer 7 (KB953838)–>"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows Media Player 11 (KB936782)–>"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows Media Player 11 (KB954154)–>"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows Media Player 9 (KB917734)–>"C:\WINDOWS\$NtUninstallKB917734_WMP9$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB923789)–>C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Aggiornamento della protezione per Windows XP (KB938464)–>"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB941569)–>"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB946648)–>"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB950760)–>"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB950762)–>"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB950974)–>"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB951066)–>"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB951376)–>"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB951376-v2)–>"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB951698)–>"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB951748)–>"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB952954)–>"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB953839)–>"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Aggiornamento per Windows XP (KB951072-v2)–>"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Aggiornamento per Windows XP (KB951978)–>"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Aggiornamento rapido per Windows Internet Explorer 7 (KB947864)–>"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
Aggiornamento rapido per Windows Media Player 11 (KB939683)–>"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Aggiornamento rapido per Windows XP (KB952287)–>"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
AppCore–>MsiExec.exe /I{EFB5B3B5-A280-4E25-BE1C-634EEFE32C1B}
Ashampoo UnInstaller Platinum 2–>"C:\Programmi\Ashampoo\Ashampoo UnInstaller Platinum 2\Uninstall\UIP_Uninstall.exe"
AV–>MsiExec.exe /I{F4DB525F-A986-4249-B98B-42A8066251CA}
Azureus–>C:\Programmi\Azureus\Uninstall.exe
Calculator Powertoy for Windows XP–>MsiExec.exe /I{B37C842A-B624-46B8-A727-654E72F1C91A}
ccCommon–>MsiExec.exe /I{3CCAD2EF-CFF2-4637-82AA-AABF370282D3}
ClearType Tuning Control Panel Applet–>MsiExec.exe /I{C9E4932C-8417-4E4C-A0E3-EE534810AB4D}
Component Framework–>MsiExec.exe /I{31478BE1-CDE5-4753-A8B2-F6D4BC1FBE09}
Connection Keep Alive–>MsiExec.exe /I{77364F85-6219-4CB8-AAA0-6D53368D683D}
Crazy Machines - New Challenges–>MsiExec.exe /X{1039158D-B0B8-4C52-8CA6-F3C9F072657D}
DC++ 0.699–>"C:\Programmi\DC++\uninstall.exe"
DivX Content Uploader–>C:\Programmi\DivX\DivXContentUploaderUninstall.exe /CUPLOADER
DivX Web Player–>C:\Programmi\DivX\DivXWebPlayerUninstall.exe /PLUGIN
Easy Video Joiner 5.21–>"C:\Programmi\Easy Video Joiner\unins000.exe"
Google Earth–>MsiExec.exe /I{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}
Google Updater–>"C:\Programmi\Google\Google Updater\GoogleUpdater.exe" -uninstall
GTK+ Runtime 2.6.9 rev a (remove only)–>C:\Programmi\File comuni\GTK\2.0\uninst.exe
HijackThis 2.0.2–>"C:\Programmi\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Windows Media Format 11 SDK (KB929399)–>"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
ILLUSION RapeLay–>MsiExec.exe /X{D1E1F028-1953-43A3-BFD8-D2A00EC06E36}
IMMonitor MSN Spy–>C:\Programmi\Fake Webcam\unins000.exe
Java™ 6 Update 7–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
L&H; TTS3000 British English–>RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\LHTTSENG.inf, Uninstall
LiveUpdate 3.1 (Symantec Corporation)–>"C:\Programmi\Symantec\LiveUpdate\LSETUP.EXE" /U
LiveUpdate Notice (Symantec Corporation)–>MsiExec.exe /X{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}
Macromedia Extension Manager–>MsiExec.exe /I{5546CDB5-2CE2-498B-B059-5B3BF81FC41F}
Macromedia Flash 8 Video Encoder–>MsiExec.exe /X{8BF2C401-02CE-424D-BC26-6C4F9FB446B6}
Macromedia Flash 8–>MsiExec.exe /I{2BD5C305-1B27-4D41-B690-7A61172D2FEB}
Magic ISO Maker v5.4 (build 0239)–>C:\PROGRA~1\MagicISO\UNWISE.EXE C:\PROGRA~1\MagicISO\INSTALL.LOG
Malwarebytes' Anti-Malware–>"C:\Programmi\Malwarebytes' Anti-Malware\unins000.exe"
Messenger Plus! Live–>"C:\Programmi\Messenger Plus! Live\Uninstall.exe"
Microsoft - Math–>MsiExec.exe /I{07243840-959A-4B0D-8825-2C533F0DDB19}
Microsoft .NET Framework 2.0 - Language Pack (italiano)–>C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - ITA\install.exe
Microsoft .NET Framework 2.0 Service Pack 1–>MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft ActiveSync 3.8–>"C:\WINDOWS\ISUN0410.EXE" -f"C:\Programmi\Microsoft ActiveSync\DeIsL1.isu" -c"C:\Programmi\Microsoft ActiveSync\ceuninst.dll"
Microsoft Compression Client Pack 1.0 for Windows XP–>"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Encarta 2007 - Premium + Student–>MsiExec.exe /I{07241881-E9B4-4DF6-A845-CAAFD093E477}
Microsoft English TTS Engine–>MsiExec.exe /I{94824ADD-8F26-43D2-84DB-22E11F377E5E}
Microsoft Internationalized Domain Names Mitigation APIs–>"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs–>"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office 2003 Proofing Tools–>MsiExec.exe /I{901F0409-6000-11D3-8CFE-0150048383C9}
Microsoft Office Professional Edition 2003–>MsiExec.exe /I{90110409-6000-11D3-8CFE-0150048383C9}
Microsoft Plus! Digital Media Edition–>MsiExec.exe /I{C6A7AF96-4EB1-4AAE-8318-1AB393C64F88}
Microsoft Streets & Trips 2007–>MsiExec.exe /I{C82185E8-C27B-4EF4-2007-4444BC2C2B6D}
Microsoft User-Mode Driver Framework Feature Pack 1.0–>"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Mozilla Firefox (3.0.1)–>C:\Programmi\Mozilla Firefox\uninstall\helper.exe
MSRedist–>MsiExec.exe /I{B7C61755-DB48-4003-948F-3D34DB8EAF69}
MSRedist–>MsiExec.exe /I{D1725BDB-BA2B-4503-A8CB-F5C835D743FA}
MSXML 6.0 Parser (KB933579)–>MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}
myTV–>C:\Programmi\InstallShield Installation Information\{C54184D0-D281-4523-B357-0606209DB56C}\setup.exe -runfromtemp -l0x0009 -removeonly
Nero 7 Ultra Edition–>MsiExec.exe /I{F14B8ECC-BDA0-4987-9201-D7B7DBE11040}
Norton AntiVirus–>MsiExec.exe /X{830D8CBD-C668-49e2-A969-C2C2106332E0}
Norton Cleanup–>MsiExec.exe /I{CA31120D-2101-484D-9FF1-195DE96FE346}
Norton Confidential Browser Component–>MsiExec.exe /I{4843B611-8FCB-4428-8C23-31D0A5EAE164}
Norton Confidential Web Protection Component–>MsiExec.exe /I{D353CC51-430D-4C6F-9B7E-52003DA1E05A}
Norton Internet Security (Symantec Corporation)–>"C:\Programmi\File comuni\Symantec Shared\SymSetup\{5AA2CD16-706F-41f3-87C5-2B5A031F2B3B}_10_0_0_86\{5AA2CD16-706F-41f3-87C5-2B5A031F2B3B}.exe" /X
Norton Internet Security–>MsiExec.exe /I{48185814-A224-447a-81DA-71BD20580E1B}
Norton Internet Security–>MsiExec.exe /I{5AA2CD16-706F-41f3-87C5-2B5A031F2B3B}
Norton Internet Security–>MsiExec.exe /I{E3EFA461-EB83-4C3B-9C47-2C1D58A01555}
Norton Internet Security–>MsiExec.exe /I{E5EE9939-259F-4DE2-8023-5C49E16A4F43}
Norton Protection Center–>MsiExec.exe /I{9A129ABC-A53A-4209-A21E-D5DEDFB7CCA8}
Norton SystemWorks (Symantec Corporation)–>"C:\Programmi\File comuni\Symantec Shared\SymSetup\{B9807C3D-B3DD-41B7-8321-53DDB3A3A888}\{B9807C3D-B3DD-41B7-8321-53DDB3A3A888}.exe" /X
Norton SystemWorks Premier–>MsiExec.exe /I{B9807C3D-B3DD-41B7-8321-53DDB3A3A888}
Norton SystemWorks–>MsiExec.exe /I{9E23C48E-5483-4971-BA50-089F2FABCD66}
Norton Utilities–>MsiExec.exe /I{6A7867BA-B7CA-4CC9-ACAB-85BA46865EE5}
NVIDIA Drivers–>C:\WINDOWS\system32\nvudisp.exe UninstallGUI
oggcodecs 0.71.0946–>C:\Programmi\illiminable\oggcodecs\uninst.exe
Opera 9.52–>MsiExec.exe /X{E1A88DE8-BD36-4DEA-8DD8-E35EF475ADC7}
O?iana–>C:\Programmi\Today\unins000.exe
Philips ToUcam XS Camera–>C:\WINDOWS\IsUn0410.exe -f"C:\Programmi\Philips ToUcam Camera\ToUcamXS.isu"
PowerDVD–>RunDll32 C:\PROGRA~1\FILECO~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programmi\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe" -uninstall
PowerISO–>"C:\Programmi\PowerISO\uninstall.exe"
Privacy Eraser Pro–>"C:\Programmi\PrivacyEraser Computing\Privacy Eraser Pro\unins000.exe"
QuickTime–>MsiExec.exe /I{50D8FFDD-90CD-4859-841F-AA1961C7767A}
RealPlayer–>C:\Programmi\File comuni\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Security Update for CAPICOM (KB931906)–>MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)–>MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Skype™ 3.6–>MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
SopCast 1.1.1–>C:\Programmi\SopCast\uninst.exe
SPBBC 32bit–>MsiExec.exe /I{77772678-817F-4401-9301-ED1D01A8DA56}
Spybot - Search & Destroy–>"C:\Programmi\Spybot - Search & Destroy\unins000.exe"
Strumenti e modelli didattici per Microsoft Office–>MsiExec.exe /X{B348E585-E872-41DF-8234-E2D49917CFBB}
SUPERAntiSpyware Free Edition–>MsiExec.exe /X{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}
SYSTRAN Premium 4.0–>C:\WINDOWS\unvise32.exe C:\Programmi\Systran\4_0\Premium\uninstal.log
TablePCRT–>MsiExec.exe /X{C46A5F24-B91F-477C-B634-DB99A7D7792A}
TTS Wrapper–>MsiExec.exe /I{97D0C0A1-7E64-4B05-A2EE-61D2CE23F154}
TVAnts 1.0–>C:\PROGRA~1\TVAnts\UNWISE.EXE C:\PROGRA~1\TVAnts\INSTALL.LOG
U.S. Robotics Wireless MAXg Adapter–>"C:\WINDOWS\system32\MAXguninst.exe" "C:\Programmi\U.S. Robotics\U.S. Robotics Wireless MAXg Adapter\bcmwlu00.exe" verbose /rootkey="Software\Broadcom\802.11\UninstallInfo" /rootdir="C:\Programmi\U.S. Robotics\U.S. Robotics Wireless MAXg Adapter"
VeohTV BETA–>C:\Programmi\InstallShield Installation Information\{0405E51E-9582-4207-8F38-AC44201D3808}\setup.exe -runfromtemp -l0x0409
WinAce Archiver–>C:\Programmi\WinAce\SXUNINST.EXE C:\Programmi\WinAce\SXUNINST.INI
Window Washer–>C:\WINDOWS\Unwash6.exe
Windows Defender–>MsiExec.exe /I{A06275F4-324B-4E85-95E6-87B2CD729401}
Windows Live installer–>MsiExec.exe /X{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320}
Windows Live Messenger–>MsiExec.exe /X{508CE775-4BA4-4748-82DF-FE28DA9F03B0}
Windows Media Format 11 runtime–>"C:\Programmi\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime–>"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11–>"C:\Programmi\Windows Media Player\Setup_wm.exe" /Uninstall
Windows Media Player 11–>"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows Media Player Firefox Plugin–>MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
Windows Media Recorder–>C:\Programmi\Windows Media Recorder\WMR PRO 5.0\Uninstal.exe
Windows XP Service Pack 3–>"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
WinRAR archiver–>C:\Programmi\WinRAR\uninstall.exe
Your Uninstaller! 2006 Version 5–>"C:\Programmi\Your Uninstaller 2006\unins000.exe"

Security center information

AV: Norton Internet Security
FW: Norton Internet Security

Environment variables

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Programmi\QuickTime\QTSystem\;C:\Programmi\File comuni\Adobe\AGL
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 6 Stepping 2, AuthenticAMD
"PROCESSOR_REVISION"=0602
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CNVPATH"=C:\Programmi\Systran\4_0\Premium\Dicts
"CLASSPATH"=.;C:\Programmi\Java\jre1.5.0_10\lib\ext\QTJava.zip
"QTJAVA"=C:\Programmi\Java\jre1.5.0_10\lib\ext\QTJava.zip

—————–EOF—————–

Im desperated …..!!!!

hangar18

Post #6September 18, 2008, 10:31 AM UTC

here is the files you have asked me :

first : c:\_OTMoveIt\MovedFiles

< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm >
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm\\ deleted successfully.
File/Folder HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys not found.
File/Folder HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0e340a40-5dab-11dd-9d9b-00e04c39dbc5} not found.
File/Folder HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2a391560-2e27-11dd-9d15-00e04c39dbc5} not found.
File/Folder HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{45da8111-d614-11db-98ce-00e04c39dbc5} not found.
File/Folder HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{95cced30-cb2f-11db-9896-00e04c39dbc5} not found.
File/Folder HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{977b7d43-d7e4-11dc-9c37-00e04c39dbc5} not found.
File/Folder HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fa8c97f1-43a1-11dd-9d49-00e04c39dbc5} not found.
< purity >
< EmptyTemp >
File delete failed. C:\DOCUME~1\H18\IMPOST~1\Temp\~DF1A50.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\H18\IMPOST~1\Temp\~DFBE71.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\H18\IMPOST~1\Temp\~DFC1E1.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\H18\IMPOST~1\Temp\~DFFBB9.tmp scheduled to be deleted on reboot.
Temp folders emptied.
IE temp folders emptied.

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 09182008_121306

Files moved on Reboot…
File C:\DOCUME~1\H18\IMPOST~1\Temp\~DF1A50.tmp not found!
File C:\DOCUME~1\H18\IMPOST~1\Temp\~DFBE71.tmp not found!
File C:\DOCUME~1\H18\IMPOST~1\Temp\~DFC1E1.tmp not found!
File C:\DOCUME~1\H18\IMPOST~1\Temp\~DFFBB9.tmp not found!

second the rsit.exe results :

Logfile of random's system information tool 1.01 (written by random/random)
Run by [removed] at 2008-09-18 12:29:00
Microsoft Windows XP Professional Service Pack 3
System drive C: has 1 GB (2%) free of 46 GB
Total RAM: 1023 MB (47% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:29:09, on 18/09/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
C:\Programmi\File comuni\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\notepad.exe
C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Programmi\File comuni\Symantec Shared\ccApp.exe
C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wwSecure.exe
C:\Programmi\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Microsoft ActiveSync\WCESCOMM.EXE
C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe
C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Documents and Settings\H18\Desktop\RSIT.exe
C:\Programmi\Trend Micro\HijackThis\H18.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Programmi\File comuni\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: (no name) - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - (no file)
O2 - BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Encarta Web Companion Oggetto helper - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Programmi\File comuni\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: Encarta Web Companion - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Programmi\File comuni\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Systran40premi.IEPlugIn - {D3919E1A-D6A5-11D6-AC3E-00B0D094B576} - C:\Programmi\Systran\4_0\Premium\IEPlugIn.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Programmi\File comuni\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Programmi\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Programmi\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [NSWosCheck] C:\Programmi\Norton SystemWorks Premier\osCheck.exe
O4 - HKLM\..\Run: [USRobotics Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [\YUR4C8.exe] C:\Windows\system32\YUR4C8.exe
O4 - HKLM\..\Run: [\YUR4.exe] C:\Windows\system32\YUR4.exe
O4 - HKLM\..\Run: [\YUR4C7.exe] C:\Windows\system32\YUR4C7.exe
O4 - HKLM\..\Run: [\YUR4C9.exe] C:\Windows\system32\YUR4C9.exe
O4 - HKLM\..\Run: [\YUR4CA.exe] C:\Windows\system32\YUR4CA.exe
O4 - HKLM\..\Run: [\YUR3.exe] C:\Windows\system32\YUR3.exe
O4 - HKLM\..\Run: [\YUR1.exe] C:\Windows\system32\YUR1.exe
O4 - HKLM\..\Run: [\YUR2.exe] C:\Windows\system32\YUR2.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programmi\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: O?iana.lnk
O8 - Extra context menu item: &Download; All with Rapidshare Downloader - C:\DOCUME~1\H18\IMPOST~1\Temp\RarSFX0\jc_all.htm
O8 - Extra context menu item: &Download; with Rapidshare Downloader - C:\DOCUME~1\H18\IMPOST~1\Temp\RarSFX0\jc_link.htm
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Crea preferiti portatile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Programmi\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programmi\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Crea preferiti portatile… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programmi\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Programmi\Norton SystemWorks Premier\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Programmi\Norton SystemWorks Premier\Norton Cleanup\WCQuick.lnk
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Barra di ricerca di Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programmi\File comuni\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{AD81C8A6-4507-4E78-9486-F9D0B6A49758}: NameServer = 213.215.115.88,147.175.167.50
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Programmi\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Programmi\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NBService - Nero AG - C:\Programmi\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Unknown owner - C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
O23 - Service: Washer AutoComplete (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe
O23 - Service: WEP/WPA-PMK key recovery service (WZCOOK) - Unknown owner - C:\Documents and Settings\H18\Desktop\WiFi_WEP_Key_Finder\aircrack-ng-0.6.2-win\bin\wzcook.exe (file missing)

–
End of file - 13162 bytes

Scheduled tasks folder

C:\WINDOWS\tasks\MP Scheduled Scan.job
C:\WINDOWS\tasks\Norton Internet Security - Run Full System Scan - H18.job
C:\WINDOWS\tasks\Norton SystemWorks One Button Checkup.job

Registry dump

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E8A6170-7264-4D0F-BEAE-D42A53123C75}]
C:\Programmi\File comuni\Symantec Shared\coShared\Browser\1.0\NppBho.dll [2006-09-06 93400]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D; IE Protection - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll [2008-07-07 1562448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{955BE0B8-BC85-4CAF-856E-8E0D8B610560}]
Encarta Web Companion Oggetto helper - C:\Programmi\File comuni\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL [2006-06-13 256792]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
AcroIEToolbarHelper Class - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2004-12-14 225280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Programmi\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll [2008-05-18 654320]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{147D6308-0614-4112-89B1-31402F9B82C4} - Encarta Web Companion - C:\Programmi\File comuni\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL [2006-06-13 256792]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2004-12-14 225280]
{D3919E1A-D6A5-11D6-AC3E-00B0D094B576} - Systran40premi.IEPlugIn - C:\Programmi\Systran\4_0\Premium\IEPlugIn.dll [2002-10-03 73728]
{90222687-F593-4738-B738-FBEE9C7B26DF} - Show Norton Toolbar - C:\Programmi\File comuni\Symantec Shared\coShared\Browser\1.0\UIBHO.dll [2006-09-06 510152]
{D0943516-5076-4020-A3B5-AEFAF26AB263} - Veoh Browser Plug-in - C:\Programmi\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll [2008-04-01 352256]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2005-02-24 5537792]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2005-02-24 86016]
""=C:\WINDOWS\system32\
"ccApp"=C:\Programmi\File comuni\Symantec Shared\ccApp.exe [2006-10-28 107112]
"osCheck"=C:\Programmi\Norton Internet Security\osCheck.exe [2006-09-06 26248]
"Symantec PIF AlertEng"=C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2007-11-28 583048]
"NSWosCheck"=C:\Programmi\Norton SystemWorks Premier\osCheck.exe [2007-12-03 25472]
"USRobotics Wireless Manager UI"=C:\WINDOWS\system32\WLTRAY.exe [2006-10-12 1290240]
"SunJavaUpdateSched"=C:\Programmi\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
"\YUR4C8.exe"=C:\Windows\system32\YUR4C8.exe []
"\YUR4.exe"=C:\Windows\system32\YUR4.exe []
"\YUR4C7.exe"=C:\Windows\system32\YUR4C7.exe []
"\YUR4C9.exe"=C:\Windows\system32\YUR4C9.exe []
"\YUR4CA.exe"=C:\Windows\system32\YUR4CA.exe []
"\YUR3.exe"=C:\Windows\system32\YUR3.exe []
"\YUR1.exe"=C:\Windows\system32\YUR1.exe []
"\YUR2.exe"=C:\Windows\system32\YUR2.exe []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"H/PC Connection Agent"=C:\Programmi\Microsoft ActiveSync\WCESCOMM.EXE [2005-01-19 405583]
"MsnMsgr"=C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe [2007-10-18 5724184]
""=C:\WINDOWS\system32\
"SpybotSD TeaTimer"=C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe [2008-08-18 1832272]
"SUPERAntiSpyware"=C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe [2008-09-03 1576176]

C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica
O?iana.lnk - C:\Programmi\Today\TODAY.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Programmi\SUPERAntiSpyware\SASWINLO.dll [2008-07-23 352256]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"=C:\PROGRA~1\WIFD1F~1\MpShHook.dll [2006-11-03 83224]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Programmi\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinDefend]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Programmi\Java\jre1.5.0_10\bin\javaw.exe"="C:\Programmi\Java\jre1.5.0_10\bin\javaw.exe:*:Enabled:Java™ 2 Platform Standard Edition binary"
"C:\Documents and Settings\H18\Documenti\eDonkey2000 Downloads\Msn Messenger winks moods etc\winks,moods,muggins,weemees and meegos\mcoinstall.exe"="C:\Documents and Settings\H18\Documenti\eDonkey2000 Downloads\Msn Messenger winks moods etc\winks,moods,muggins,weemees and meegos\mcoinstall.exe:*:Disabled:mcoinstall"
"C:\Programmi\Kazaa Lite K++\KazaaLite.kpp"="C:\Programmi\Kazaa Lite K++\KazaaLite.kpp:*:Enabled:KazaaLite"
"C:\Programmi\Real\RealPlayer\realplay.exe"="C:\Programmi\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer"
"C:\Programmi\webcamXP\webcamXP.exe"="C:\Programmi\webcamXP\webcamXP.exe:*:Enabled:webcamXP"
"C:\Programmi\THQ\MotoGP URT 3\motogp.exe"="C:\Programmi\THQ\MotoGP URT 3\motogp.exe:*:Disabled:motogp"
"C:\Programmi\SopCast\SopCast.exe"="C:\Programmi\SopCast\SopCast.exe:*:Enabled:SopCast Main Application"
"C:\Documents and Settings\H18\Dati applicazioni\SopCast\adv\SopAdver.exe"="C:\Documents and Settings\H18\Dati applicazioni\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver"
"C:\Documents and Settings\H18\Impostazioni locali\Temp\ir_ext_temp_0\AutoPlay\Docs\PackIcons.exe"="C:\Documents and Settings\H18\Impostazioni locali\Temp\ir_ext_temp_0\AutoPlay\Docs\PackIcons.exe:*:Disabled:Messenger Content Installer"
"C:\Programmi\Java\jre1.5.0_11\bin\javaw.exe"="C:\Programmi\Java\jre1.5.0_11\bin\javaw.exe:*:Enabled:Java™ 2 Platform Standard Edition binary"
"C:\Programmi\myTV\myTV.exe"="C:\Programmi\myTV\myTV.exe:*:Enabled:myTV"
"C:\Programmi\Yahoo!\Messenger\YahooMessenger.exe"="C:\Programmi\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\Programmi\Yahoo!\Messenger\YServer.exe"="C:\Programmi\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\Programmi\CCNetwork\WebCamSrv\CCCamSrv.exe"="C:\Programmi\CCNetwork\WebCamSrv\CCCamSrv.exe:*:Disabled:CCN WebCam Server"
"C:\Programmi\MessengerDiscovery\MessengerDiscovery Live.exe"="C:\Programmi\MessengerDiscovery\MessengerDiscovery Live.exe:*:Enabled:MessengerDiscovery Live the Windows Live Messenger addon"
"C:\Programmi\Trillian\trillian.exe"="C:\Programmi\Trillian\trillian.exe:*:Enabled:Trillian"
"C:\Program Files\DoubleB\BBcat\fcPSGRun.exe"="C:\Program Files\DoubleB\BBcat\fcPSGRun.exe:*:Enabled:Play Sex Game 1.17 HTTP emulator"
"C:\Documents and Settings\H18\Desktop\P.S.G.part1\P-S-G\Members\fcPSGRun.exe"="C:\Documents and Settings\H18\Desktop\P.S.G.part1\P-S-G\Members\fcPSGRun.exe:*:Enabled:Play Sex Game 1.17 HTTP emulator"
"C:\Program Files\DoubleB\BBcat\Members\fcPSGRun.exe"="C:\Program Files\DoubleB\BBcat\Members\fcPSGRun.exe:*:Enabled:Play Sex Game 1.17 HTTP emulator"
"C:\Programmi\e frontier\Poser 7\Poser.exe"="C:\Programmi\e frontier\Poser 7\Poser.exe:*:Enabled:Poser executable file"
"C:\Programmi\Microsoft ActiveSync\wcescomm.exe"="C:\Programmi\Microsoft ActiveSync\wcescomm.exe:*:Enabled:ActiveSync Connection Manager"
"C:\Programmi\Microsoft ActiveSync\WCESMgr.exe"="C:\Programmi\Microsoft ActiveSync\WCESMgr.exe:*:Enabled:ActiveSync Application"
"C:\Programmi\DC++\DCPlusPlus.exe"="C:\Programmi\DC++\DCPlusPlus.exe:*:Enabled:DC++"
"C:\Programmi\Steam\steamapps\common\defcon\defcon.exe"="C:\Programmi\Steam\steamapps\common\defcon\defcon.exe:*:Enabled:Defcon"
"C:\Programmi\Kazaa Lite\Kazaa.kpp"="C:\Programmi\Kazaa Lite\Kazaa.kpp:*:Enabled:Kazaa Lite"
"C:\Documents and Settings\H18\Desktop\emule0.48a-Xtreme6.1\emule.exe"="C:\Documents and Settings\H18\Desktop\emule0.48a-Xtreme6.1\emule.exe:*:Enabled:eMule"
"C:\Programmi\Steam\steamapps\hangar1818\half-life 2 deathmatch\hl2.exe"="C:\Programmi\Steam\steamapps\hangar1818\half-life 2 deathmatch\hl2.exe:*:Disabled:hl2"
"C:\Programmi\Soulseek\slsk.exe"="C:\Programmi\Soulseek\slsk.exe:*:Disabled:SoulSeek"
"C:\Programmi\Invisible Browsing\InvisibleBrowsing.exe"="C:\Programmi\Invisible Browsing\InvisibleBrowsing.exe:*:Enabled:IB6_UI"
"C:\Programmi\Skype\Phone\Skype.exe"="C:\Programmi\Skype\Phone\Skype.exe:*:Enabled:Skype. The whole world can talk for free."
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Programmi\Windows Live\Messenger\msnmsgr.exe"="C:\Programmi\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Programmi\Windows Live\Messenger\livecall.exe"="C:\Programmi\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Programmi\Windows Live\Messenger\msnmsgr.exe"="C:\Programmi\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Programmi\Windows Live\Messenger\livecall.exe"="C:\Programmi\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0e340a40-5dab-11dd-9d9b-00e04c39dbc5}]
shell\AutoRun\command - 1rfw8hjr.com
shell\explore\command - 1rfw8hjr.com
shell\open\command - 1rfw8hjr.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2a391560-2e27-11dd-9d15-00e04c39dbc5}]
shell\AutoRun\command - 1rfw8hjr.com
shell\explore\command - 1rfw8hjr.com
shell\open\command - 1rfw8hjr.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{45da8111-d614-11db-98ce-00e04c39dbc5}]
shell\AutoRun\command - J:\.\run\autorun.exe
shell\open\command - J:\.\run\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{95cced30-cb2f-11db-9896-00e04c39dbc5}]
shell\AutoRun\command - H:\.\run\autorun.exe
shell\open\command - H:\.\run\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{977b7d43-d7e4-11dc-9c37-00e04c39dbc5}]
shell\AutoRun\command - H:\.\run\autorun.exe
shell\open\command - H:\.\run\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fa8c97f1-43a1-11dd-9d49-00e04c39dbc5}]
shell\AutoRun\command - .\run\autorun.exe
shell\open\command - .\run\autorun.exe

List of files/folders created in the last three months

2008-09-18 12:29:00 —-D—- C:\rsit
2008-09-18 12:13:06 —-D—- C:\_OTMoveIt
2008-09-18 11:55:13 —-D—- C:\WINDOWS\system32\appmgmt
2008-09-17 13:03:20 —-A—- C:\WINDOWS\system32\tmp.txt
2008-09-16 17:55:34 —-D—- C:\Documents and Settings\H18\Dati applicazioni\Malwarebytes
2008-09-16 17:55:28 —-D—- C:\Programmi\Malwarebytes' Anti-Malware
2008-09-16 17:55:28 —-D—- C:\Documents and Settings\All Users\Dati applicazioni\Malwarebytes
2008-09-16 17:32:35 —-D—- C:\Programmi\Trend Micro
2008-09-15 21:05:04 —-D—- C:\Programmi\The Cleaner Free
2008-09-15 15:03:23 —-D—- C:\Documents and Settings\All Users\Dati applicazioni\SUPERAntiSpyware.com
2008-09-15 15:03:14 —-D—- C:\Programmi\SUPERAntiSpyware
2008-09-15 15:03:14 —-D—- C:\Documents and Settings\H18\Dati applicazioni\SUPERAntiSpyware.com
2008-09-10 16:08:14 —-HDC—- C:\WINDOWS\$NtUninstallKB938464$
2008-09-10 16:07:20 —-HDC—- C:\WINDOWS\$NtUninstallKB954154_WM11$
2008-09-09 12:07:34 —-HDC—- C:\WINDOWS\$NtUninstallKB951978$
2008-09-09 11:41:49 —-D—- C:\WINDOWS\Prefetch
2008-09-09 02:02:51 —-HDC—- C:\WINDOWS\$NtUninstallKB952954$
2008-09-09 02:02:39 —-HDC—- C:\WINDOWS\$NtUninstallKB952287$
2008-09-09 02:02:17 —-HDC—- C:\WINDOWS\$NtUninstallKB951748$
2008-09-09 02:02:02 —-HDC—- C:\WINDOWS\$NtUninstallKB951698$
2008-09-09 02:01:50 —-HDC—- C:\WINDOWS\$NtUninstallKB951376-v2$
2008-09-09 02:01:37 —-HDC—- C:\WINDOWS\$NtUninstallKB951376$
2008-09-09 02:01:21 —-HDC—- C:\WINDOWS\$NtUninstallKB951066$
2008-09-09 02:01:07 —-HDC—- C:\WINDOWS\$NtUninstallKB950974$
2008-09-09 02:00:54 —-HDC—- C:\WINDOWS\$NtUninstallKB950762$
2008-09-09 02:00:38 —-HDC—- C:\WINDOWS\$NtUninstallKB946648$
2008-09-09 01:53:16 —-D—- C:\WINDOWS\l2schemas
2008-09-09 01:53:15 —-D—- C:\WINDOWS\system32\it
2008-09-09 01:53:14 —-D—- C:\WINDOWS\system32\bits
2008-09-09 01:48:22 —-D—- C:\WINDOWS\ServicePackFiles
2008-09-09 01:45:54 —-D—- C:\WINDOWS\network diagnostic
2008-09-09 01:40:45 —-HDC—- C:\WINDOWS\$NtServicePackUninstall$
2008-09-02 16:43:04 —-D—- C:\Programmi\Spybot - Search & Destroy
2008-09-01 00:45:08 —-HDC—- C:\WINDOWS\$NtUninstallKB952954_0$
2008-09-01 00:45:00 —-HDC—- C:\WINDOWS\$NtUninstallKB946648_0$
2008-09-01 00:44:53 —-HDC—- C:\WINDOWS\$NtUninstallKB953839$
2008-09-01 00:44:45 —-HDC—- C:\WINDOWS\$NtUninstallKB950974_0$
2008-09-01 00:43:11 —-HDC—- C:\WINDOWS\$NtUninstallKB951072-v2$
2008-09-01 00:43:02 —-HDC—- C:\WINDOWS\$NtUninstallKB952287_0$
2008-09-01 00:42:17 —-HDC—- C:\WINDOWS\$NtUninstallKB951066_0$
2008-07-09 16:10:46 —-A—- C:\WINDOWS\system32\javaws.exe
2008-07-09 16:10:46 —-A—- C:\WINDOWS\system32\javaw.exe
2008-07-09 16:10:46 —-A—- C:\WINDOWS\system32\java.exe
2008-07-09 09:09:26 —-HDC—- C:\WINDOWS\$NtUninstallKB951748_0$
2008-06-26 15:15:58 —-HDC—- C:\WINDOWS\$NtUninstallKB951376-v2_0$

List of drivers

R1 AmdK7;Driver del processore AMD K7; C:\WINDOWS\system32\DRIVERS\amdk7.sys [2008-04-14 41728]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Programmi\File comuni\Symantec Shared\EENGINE\eeCtrl.sys []
R1 SASDIFSV;SASDIFSV; \??\C:\Programmi\SUPERAntiSpyware\SASDIFSV.SYS []
R1 SASKUTIL;SASKUTIL; \??\C:\Programmi\SUPERAntiSpyware\SASKUTIL.sys []
R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2005-10-16 27171]
R1 SPBBCDrv;SPBBCDrv; \??\C:\Programmi\File comuni\Symantec Shared\SPBBC\SPBBCDrv.sys []
R1 SRTSP;SRTSP; C:\WINDOWS\System32\Drivers\SRTSP.SYS [2007-12-01 279088]
R1 SRTSPX;SRTSPX; C:\WINDOWS\System32\Drivers\SRTSPX.SYS [2007-12-01 43696]
R1 SYMTDI;SYMTDI; C:\WINDOWS\System32\Drivers\SYMTDI.SYS [2007-10-30 191536]
R2 usbhub;Ph USB Standard Hub Driver; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 BCM43XX;U.S. Robotics Wireless MAXg Adapter; C:\WINDOWS\system32\DRIVERS\bcmwl5.sys [2006-10-12 604928]
R3 ctljystk;Creative SBLive! Porta giochi; C:\WINDOWS\system32\DRIVERS\ctljystk.sys [2001-08-17 3712]
R3 dtscsi;dtscsi; C:\WINDOWS\System32\Drivers\dtscsi.sys [2007-01-21 223128]
R3 emu10k;Creative SB Live! (WDM); C:\WINDOWS\system32\drivers\emu10k1m.sys [2001-08-17 283904]
R3 emu10k1;Driver per Creative Interface Manager (WDM); C:\WINDOWS\system32\drivers\ctlfacem.sys [2001-08-17 6912]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Programmi\File comuni\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys []
R3 NAVENG;NAVENG; \??\C:\PROGRA~1\FILECO~1\SYMANT~1\VIRUSD~1\20080917.003\NAVENG.SYS []
R3 NAVEX15;NAVEX15; \??\C:\PROGRA~1\FILECO~1\SYMANT~1\VIRUSD~1\20080917.003\NAVEX15.SYS []
R3 NPDriver;Norton UnErase Protection Driver; \??\C:\WINDOWS\system32\Drivers\NPDRIVER.SYS []
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2005-02-24 3454144]
R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2007-01-21 10368]
R3 rtl8139;Driver NT scheda Fast Ethernet PCI Realtek basata su RTL8139; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-04 20992]
R3 SASENUM;SASENUM; \??\C:\Programmi\SUPERAntiSpyware\SASENUM.SYS []
R3 sfman;Driver per Creative SoundFont Manager (WDM); C:\WINDOWS\system32\drivers\sfmanm.sys [2001-08-17 36480]
R3 SYMDNS;SYMDNS; C:\WINDOWS\System32\Drivers\SYMDNS.SYS [2007-10-30 12848]
R3 SymEvent;SymEvent; \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS []
R3 SYMFW;SYMFW; C:\WINDOWS\System32\Drivers\SYMFW.SYS [2007-10-30 145968]
R3 SYMIDS;SYMIDS; C:\WINDOWS\System32\Drivers\SYMIDS.SYS [2007-10-30 39856]
R3 SYMIDSCO;SYMIDSCO; \??\C:\PROGRA~1\FILECO~1\SYMANT~1\SymcData\idsdefs\20080917.005\SymIDSCo.sys []
R3 SYMNDIS;SYMNDIS; C:\WINDOWS\System32\Drivers\SYMNDIS.SYS [2007-10-30 35120]
R3 SYMREDRV;SYMREDRV; C:\WINDOWS\System32\Drivers\SYMREDRV.SYS [2007-10-30 27696]
R3 usbuhci;Driver Miniport Controller Universal Host USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 camvid20;Philips ToUcam Camera; Video; C:\WINDOWS\system32\DRIVERS\camdrv21.sys [2001-12-10 253909]
S3 CCDECODE;Decoder sottotitoli codificati; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 MS1000;MS1000; C:\WINDOWS\System32\DRIVERS\MS1000.sys [2008-09-15 5376]
S3 MSTEE;Convertitore a T/Sito a sito per flusso Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Connesione TV/Video Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 nm;Driver di Network Monitor; C:\WINDOWS\system32\DRIVERS\NMnt.sys [2008-04-13 40320]
S3 PCASp50;PCASp50 NDIS Protocol Driver; C:\WINDOWS\System32\Drivers\PCASp50.sys [2004-09-07 17664]
S3 SDdriver;SDdriver; \??\C:\WINDOWS\system32\Drivers\sddriver.sys []
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 SRTSPL;SRTSPL; C:\WINDOWS\System32\Drivers\SRTSPL.SYS [2007-12-01 317616]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbaudio;Philips USB Microphone; C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
S3 usbscan;Driver scanner USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Driver archiviazione di massa USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 vaxscsi;vaxscsi; C:\WINDOWS\System32\Drivers\vaxscsi.sys []
S3 wceusbsh;Windows CE USB Serial Host Driver; C:\WINDOWS\system32\DRIVERS\wceusbsh.sys [2004-12-06 104064]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;Codec World Standard Teletext; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

List of services

R2 aawservice;Ad-Aware 2007 Service; C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe [2007-07-06 561152]
R2 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler; C:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2006-09-03 198336]
R2 ccEvtMgr;Symantec Event Manager; C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe [2006-10-28 107624]
R2 ccSetMgr;Symantec Settings Manager; C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe [2006-10-28 107624]
R2 CLTNetCnService;Symantec Lic NetConnect service; C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe [2006-10-28 107624]
R2 gusvc;Google Updater Service; C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-05-18 137200]
R2 LiveUpdate Notice Ex;LiveUpdate Notice Service Ex; C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe [2006-10-28 107624]
R2 NProtectService;Norton UnErase Protection; C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE [2005-11-04 95832]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2005-02-24 127043]
R2 Speed Disk service;Speed Disk service; C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE [2005-11-04 176193]
R2 SymAppCore;Symantec AppCore Service; C:\Programmi\File comuni\Symantec Shared\AppCore\AppSvc32.exe [2006-09-02 46736]
R2 WinDefend;Windows Defender; C:\Programmi\Windows Defender\MsMpEng.exe [2006-11-03 13592]
R2 wltrysvc;Broadcom Wireless LAN Tray Service; C:\WINDOWS\System32\WLTRYSVC.EXE [2006-10-12 20480]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 wwSecSvc;Washer AutoComplete; C:\WINDOWS\system32\wwSecure.exe [2005-04-20 487936]
R3 Symantec Core LC;Symantec Core LC; C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe [2008-01-24 1251720]
S2 LiveUpdate Notice Service;LiveUpdate Notice Service; C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2007-11-28 583048]
S3 Adobe LM Service;Adobe LM Service; C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe [2007-09-05 72704]
S3 aspnet_state;Servizio stato di ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 comHost;COM Host; C:\Programmi\File comuni\Symantec Shared\VAScanner\comHost.exe [2006-09-03 48272]
S3 IDriverT;InstallDriver Table Manager; C:\Programmi\File comuni\InstallShield\Driver\1150\Intel 32\IDriverT.exe [2005-11-14 69632]
S3 ISPwdSvc;Symantec IS Password Validation; C:\Programmi\Norton Internet Security\isPwdSvc.exe [2006-09-06 79496]
S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2006-09-03 2528960]
S3 NBService;NBService; C:\Programmi\Nero\Nero 7\Nero BackItUp\NBService.exe [2006-10-09 724992]
S3 ose;Office Source Engine; C:\Programmi\File comuni\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Programmi\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
S3 WLSetupSvc;Windows Live Setup Service; C:\Programmi\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Programmi\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S3 WZCOOK;WEP/WPA-PMK key recovery service; C:\Documents and Settings\H18\Desktop\WiFi_WEP_Key_Finder\aircrack-ng-0.6.2-win\bin\wzcook.exe []

—————–EOF—————–

and the third :

info.txt logfile of random's system information tool 1.01 2008-09-18 12:29:11

Uninstall list

–>C:\Programmi\File comuni\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
–>C:\Programmi\Nero\Nero 7\nero\uninstall\UNNERO.exe /UNINSTALL
–>C:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL
–>C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL
–>C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL
–>C:\WINDOWS\UNNeroVision.exe /UNINSTALL
–>C:\WINDOWS\UNRecode.exe /UNINSTALL
–>MsiExec.exe /I{0F122737-72B2-4095-8B3E-7AAE753DFD3D}
–>MsiExec.exe /I{219B0DA4-8F1A-499D-8795-4A07C632521E}
–>MsiExec.exe /I{644B991F-B109-4360-9DA3-40CDAD13961C}
–>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
ACDSee Pro–>MsiExec.exe /I{F99F74B4-972B-4B06-B893-6B3B0DB0128B}
Acronis Disk Director Server–>MsiExec.exe /X{F0E8F664-CAC6-4104-A4F9-4373F0633495}
Ad-Aware 2007–>MsiExec.exe /X{E31C348B-63A9-4CBF-8D7F-D932ABB63244}
Adobe Acrobat 7.0 Professional–>msiexec /I {AC76BA86-1033-0000-7760-000000000002}
Adobe Bridge 1.0–>MsiExec.exe /I{B74D4E10-1033-0000-0000-000000000001}
Adobe Common File Installer–>MsiExec.exe /I{8EDBA74D-0686-4C99-BFDD-F894678E5B39}
Adobe Flash Player ActiveX–>C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin–>C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Help Center 1.0–>MsiExec.exe /I{E9787678-1033-0000-8E67-000000000001}
Adobe Photoshop CS2–>msiexec /I {236BB7C4-4419-42FD-0409-1E257A25E34D}
Aggiornamento della protezione per Windows Internet Explorer 7 (KB928090)–>"C:\WINDOWS\ie7updates\KB928090-IE7\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows Internet Explorer 7 (KB931768)–>"C:\WINDOWS\ie7updates\KB931768-IE7\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows Internet Explorer 7 (KB933566)–>"C:\WINDOWS\ie7updates\KB933566-IE7\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows Internet Explorer 7 (KB937143)–>"C:\WINDOWS\ie7updates\KB937143-IE7\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows Internet Explorer 7 (KB938127)–>"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows Internet Explorer 7 (KB939653)–>"C:\WINDOWS\ie7updates\KB939653-IE7\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows Internet Explorer 7 (KB942615)–>"C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows Internet Explorer 7 (KB944533)–>"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows Internet Explorer 7 (KB950759)–>"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows Internet Explorer 7 (KB953838)–>"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows Media Player 11 (KB936782)–>"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows Media Player 11 (KB954154)–>"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows Media Player 9 (KB917734)–>"C:\WINDOWS\$NtUninstallKB917734_WMP9$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB923789)–>C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Aggiornamento della protezione per Windows XP (KB938464)–>"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB941569)–>"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB946648)–>"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB950760)–>"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB950762)–>"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB950974)–>"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB951066)–>"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB951376)–>"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB951376-v2)–>"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB951698)–>"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB951748)–>"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB952954)–>"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Aggiornamento della protezione per Windows XP (KB953839)–>"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Aggiornamento per Windows XP (KB951072-v2)–>"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Aggiornamento per Windows XP (KB951978)–>"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Aggiornamento rapido per Windows Internet Explorer 7 (KB947864)–>"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
Aggiornamento rapido per Windows Media Player 11 (KB939683)–>"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Aggiornamento rapido per Windows XP (KB952287)–>"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
AppCore–>MsiExec.exe /I{EFB5B3B5-A280-4E25-BE1C-634EEFE32C1B}
Ashampoo UnInstaller Platinum 2–>"C:\Programmi\Ashampoo\Ashampoo UnInstaller Platinum 2\Uninstall\UIP_Uninstall.exe"
AV–>MsiExec.exe /I{F4DB525F-A986-4249-B98B-42A8066251CA}
Azureus–>C:\Programmi\Azureus\Uninstall.exe
Calculator Powertoy for Windows XP–>MsiExec.exe /I{B37C842A-B624-46B8-A727-654E72F1C91A}
ccCommon–>MsiExec.exe /I{3CCAD2EF-CFF2-4637-82AA-AABF370282D3}
ClearType Tuning Control Panel Applet–>MsiExec.exe /I{C9E4932C-8417-4E4C-A0E3-EE534810AB4D}
Component Framework–>MsiExec.exe /I{31478BE1-CDE5-4753-A8B2-F6D4BC1FBE09}
Connection Keep Alive–>MsiExec.exe /I{77364F85-6219-4CB8-AAA0-6D53368D683D}
Crazy Machines - New Challenges–>MsiExec.exe /X{1039158D-B0B8-4C52-8CA6-F3C9F072657D}
DC++ 0.699–>"C:\Programmi\DC++\uninstall.exe"
DivX Content Uploader–>C:\Programmi\DivX\DivXContentUploaderUninstall.exe /CUPLOADER
DivX Web Player–>C:\Programmi\DivX\DivXWebPlayerUninstall.exe /PLUGIN
Easy Video Joiner 5.21–>"C:\Programmi\Easy Video Joiner\unins000.exe"
Google Earth–>MsiExec.exe /I{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}
Google Updater–>"C:\Programmi\Google\Google Updater\GoogleUpdater.exe" -uninstall
GTK+ Runtime 2.6.9 rev a (remove only)–>C:\Programmi\File comuni\GTK\2.0\uninst.exe
HijackThis 2.0.2–>"C:\Programmi\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Windows Media Format 11 SDK (KB929399)–>"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
ILLUSION RapeLay–>MsiExec.exe /X{D1E1F028-1953-43A3-BFD8-D2A00EC06E36}
IMMonitor MSN Spy–>C:\Programmi\Fake Webcam\unins000.exe
Java™ 6 Update 7–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
L&H; TTS3000 British English–>RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\LHTTSENG.inf, Uninstall
LiveUpdate 3.1 (Symantec Corporation)–>"C:\Programmi\Symantec\LiveUpdate\LSETUP.EXE" /U
LiveUpdate Notice (Symantec Corporation)–>MsiExec.exe /X{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}
Macromedia Extension Manager–>MsiExec.exe /I{5546CDB5-2CE2-498B-B059-5B3BF81FC41F}
Macromedia Flash 8 Video Encoder–>MsiExec.exe /X{8BF2C401-02CE-424D-BC26-6C4F9FB446B6}
Macromedia Flash 8–>MsiExec.exe /I{2BD5C305-1B27-4D41-B690-7A61172D2FEB}
Magic ISO Maker v5.4 (build 0239)–>C:\PROGRA~1\MagicISO\UNWISE.EXE C:\PROGRA~1\MagicISO\INSTALL.LOG
Malwarebytes' Anti-Malware–>"C:\Programmi\Malwarebytes' Anti-Malware\unins000.exe"
Messenger Plus! Live–>"C:\Programmi\Messenger Plus! Live\Uninstall.exe"
Microsoft - Math–>MsiExec.exe /I{07243840-959A-4B0D-8825-2C533F0DDB19}
Microsoft .NET Framework 2.0 - Language Pack (italiano)–>C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - ITA\install.exe
Microsoft .NET Framework 2.0 Service Pack 1–>MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft ActiveSync 3.8–>"C:\WINDOWS\ISUN0410.EXE" -f"C:\Programmi\Microsoft ActiveSync\DeIsL1.isu" -c"C:\Programmi\Microsoft ActiveSync\ceuninst.dll"
Microsoft Compression Client Pack 1.0 for Windows XP–>"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Encarta 2007 - Premium + Student–>MsiExec.exe /I{07241881-E9B4-4DF6-A845-CAAFD093E477}
Microsoft English TTS Engine–>MsiExec.exe /I{94824ADD-8F26-43D2-84DB-22E11F377E5E}
Microsoft Internationalized Domain Names Mitigation APIs–>"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs–>"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office 2003 Proofing Tools–>MsiExec.exe /I{901F0409-6000-11D3-8CFE-0150048383C9}
Microsoft Office Professional Edition 2003–>MsiExec.exe /I{90110409-6000-11D3-8CFE-0150048383C9}
Microsoft Plus! Digital Media Edition–>MsiExec.exe /I{C6A7AF96-4EB1-4AAE-8318-1AB393C64F88}
Microsoft Streets & Trips 2007–>MsiExec.exe /I{C82185E8-C27B-4EF4-2007-4444BC2C2B6D}
Microsoft User-Mode Driver Framework Feature Pack 1.0–>"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Mozilla Firefox (3.0.1)–>C:\Programmi\Mozilla Firefox\uninstall\helper.exe
MSRedist–>MsiExec.exe /I{B7C61755-DB48-4003-948F-3D34DB8EAF69}
MSRedist–>MsiExec.exe /I{D1725BDB-BA2B-4503-A8CB-F5C835D743FA}
MSXML 6.0 Parser (KB933579)–>MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}
myTV–>C:\Programmi\InstallShield Installation Information\{C54184D0-D281-4523-B357-0606209DB56C}\setup.exe -runfromtemp -l0x0009 -removeonly
Nero 7 Ultra Edition–>MsiExec.exe /I{F14B8ECC-BDA0-4987-9201-D7B7DBE11040}
Norton AntiVirus–>MsiExec.exe /X{830D8CBD-C668-49e2-A969-C2C2106332E0}
Norton Cleanup–>MsiExec.exe /I{CA31120D-2101-484D-9FF1-195DE96FE346}
Norton Confidential Browser Component–>MsiExec.exe /I{4843B611-8FCB-4428-8C23-31D0A5EAE164}
Norton Confidential Web Protection Component–>MsiExec.exe /I{D353CC51-430D-4C6F-9B7E-52003DA1E05A}
Norton Internet Security (Symantec Corporation)–>"C:\Programmi\File comuni\Symantec Shared\SymSetup\{5AA2CD16-706F-41f3-87C5-2B5A031F2B3B}_10_0_0_86\{5AA2CD16-706F-41f3-87C5-2B5A031F2B3B}.exe" /X
Norton Internet Security–>MsiExec.exe /I{48185814-A224-447a-81DA-71BD20580E1B}
Norton Internet Security–>MsiExec.exe /I{5AA2CD16-706F-41f3-87C5-2B5A031F2B3B}
Norton Internet Security–>MsiExec.exe /I{E3EFA461-EB83-4C3B-9C47-2C1D58A01555}
Norton Internet Security–>MsiExec.exe /I{E5EE9939-259F-4DE2-8023-5C49E16A4F43}
Norton Protection Center–>MsiExec.exe /I{9A129ABC-A53A-4209-A21E-D5DEDFB7CCA8}
Norton SystemWorks (Symantec Corporation)–>"C:\Programmi\File comuni\Symantec Shared\SymSetup\{B9807C3D-B3DD-41B7-8321-53DDB3A3A888}\{B9807C3D-B3DD-41B7-8321-53DDB3A3A888}.exe" /X
Norton SystemWorks Premier–>MsiExec.exe /I{B9807C3D-B3DD-41B7-8321-53DDB3A3A888}
Norton SystemWorks–>MsiExec.exe /I{9E23C48E-5483-4971-BA50-089F2FABCD66}
Norton Utilities–>MsiExec.exe /I{6A7867BA-B7CA-4CC9-ACAB-85BA46865EE5}
NVIDIA Drivers–>C:\WINDOWS\system32\nvudisp.exe UninstallGUI
oggcodecs 0.71.0946–>C:\Programmi\illiminable\oggcodecs\uninst.exe
Opera 9.52–>MsiExec.exe /X{E1A88DE8-BD36-4DEA-8DD8-E35EF475ADC7}
O?iana–>C:\Programmi\Today\unins000.exe
Philips ToUcam XS Camera–>C:\WINDOWS\IsUn0410.exe -f"C:\Programmi\Philips ToUcam Camera\ToUcamXS.isu"
PowerDVD–>RunDll32 C:\PROGRA~1\FILECO~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programmi\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe" -uninstall
PowerISO–>"C:\Programmi\PowerISO\uninstall.exe"
Privacy Eraser Pro–>"C:\Programmi\PrivacyEraser Computing\Privacy Eraser Pro\unins000.exe"
QuickTime–>MsiExec.exe /I{50D8FFDD-90CD-4859-841F-AA1961C7767A}
RealPlayer–>C:\Programmi\File comuni\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Security Update for CAPICOM (KB931906)–>MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)–>MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Skype™ 3.6–>MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
SopCast 1.1.1–>C:\Programmi\SopCast\uninst.exe
SPBBC 32bit–>MsiExec.exe /I{77772678-817F-4401-9301-ED1D01A8DA56}
Spybot - Search & Destroy–>"C:\Programmi\Spybot - Search & Destroy\unins000.exe"
Strumenti e modelli didattici per Microsoft Office–>MsiExec.exe /X{B348E585-E872-41DF-8234-E2D49917CFBB}
SUPERAntiSpyware Free Edition–>MsiExec.exe /X{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}
SYSTRAN Premium 4.0–>C:\WINDOWS\unvise32.exe C:\Programmi\Systran\4_0\Premium\uninstal.log
TablePCRT–>MsiExec.exe /X{C46A5F24-B91F-477C-B634-DB99A7D7792A}
TTS Wrapper–>MsiExec.exe /I{97D0C0A1-7E64-4B05-A2EE-61D2CE23F154}
TVAnts 1.0–>C:\PROGRA~1\TVAnts\UNWISE.EXE C:\PROGRA~1\TVAnts\INSTALL.LOG
U.S. Robotics Wireless MAXg Adapter–>"C:\WINDOWS\system32\MAXguninst.exe" "C:\Programmi\U.S. Robotics\U.S. Robotics Wireless MAXg Adapter\bcmwlu00.exe" verbose /rootkey="Software\Broadcom\802.11\UninstallInfo" /rootdir="C:\Programmi\U.S. Robotics\U.S. Robotics Wireless MAXg Adapter"
VeohTV BETA–>C:\Programmi\InstallShield Installation Information\{0405E51E-9582-4207-8F38-AC44201D3808}\setup.exe -runfromtemp -l0x0409
WinAce Archiver–>C:\Programmi\WinAce\SXUNINST.EXE C:\Programmi\WinAce\SXUNINST.INI
Window Washer–>C:\WINDOWS\Unwash6.exe
Windows Defender–>MsiExec.exe /I{A06275F4-324B-4E85-95E6-87B2CD729401}
Windows Live installer–>MsiExec.exe /X{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320}
Windows Live Messenger–>MsiExec.exe /X{508CE775-4BA4-4748-82DF-FE28DA9F03B0}
Windows Media Format 11 runtime–>"C:\Programmi\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime–>"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11–>"C:\Programmi\Windows Media Player\Setup_wm.exe" /Uninstall
Windows Media Player 11–>"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows Media Player Firefox Plugin–>MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
Windows Media Recorder–>C:\Programmi\Windows Media Recorder\WMR PRO 5.0\Uninstal.exe
Windows XP Service Pack 3–>"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
WinRAR archiver–>C:\Programmi\WinRAR\uninstall.exe
Your Uninstaller! 2006 Version 5–>"C:\Programmi\Your Uninstaller 2006\unins000.exe"

Security center information

AV: Norton Internet Security
FW: Norton Internet Security

Environment variables

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Programmi\QuickTime\QTSystem\;C:\Programmi\File comuni\Adobe\AGL
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 6 Stepping 2, AuthenticAMD
"PROCESSOR_REVISION"=0602
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CNVPATH"=C:\Programmi\Systran\4_0\Premium\Dicts
"CLASSPATH"=.;C:\Programmi\Java\jre1.5.0_10\lib\ext\QTJava.zip
"QTJAVA"=C:\Programmi\Java\jre1.5.0_10\lib\ext\QTJava.zip

—————–EOF—————–

Im desperated …..!!!!

Rorschach112

Post #7September 18, 2008, 12:48 PM UTC

Don't worry

Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Please do an online scan with Kaspersky WebScanner

Make sure you are using Internet Explorer for this. Click on Kaspersky Online Scanner and click Accept

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on NEXT
Now click on Scan Settings
In the scan settings make that the following are selected:
- Scan using the following Anti-Virus database:
Extended (if available otherwise Standard)
- Scan Options:
Scan Archives
Scan Mail Bases
Click OK
Now under select a target to scan:Select My Computer
This will program will start and scan your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.
- Now click on the Save as Text button:
Save the file to your desktop.
Copy and paste that information in your next post.

hangar18

Post #8September 19, 2008, 2:37 PM UTC last edited September 19, 2008, 2:40 PM UTC

i have installed and follow your istructions about the malwarebytes( the proggy didnt aske me to rebbot my pc) : here is the file you ask:

alwarebytes' Anti-Malware 1.28
Database version: 1166
Windows 5.1.2600 Service Pack 3

18/09/2008 15.40.57
mbam-log-2008-09-18 (15-40-57).txt

Scan type: Quick Scan
Objects scanned: 45570
Time elapsed: 4 minute(s), 56 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 8
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur4c8.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur4.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur4c7.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur4c9.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur4ca.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur3.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur2.exe (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Unfortunately i cant perfom the online scan cause my internet connection is very slow and my pc crashed after 4 hours of online scan… :-((!!

Immediately after i run the malwarebytes i can see that the suspect files are still on my boot system!! :-(((

here is the logfile of rsit !

Logfile of random's system information tool 1.01 (written by random/random)
Run by [removed] at 2008-09-19 16:38:32
Microsoft Windows XP Professional Service Pack 3
System drive C: has 2 GB (4%) free of 46 GB
Total RAM: 1023 MB (36% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:38:37, on 19/09/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
C:\Programmi\File comuni\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Programmi\File comuni\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Microsoft ActiveSync\WCESCOMM.EXE
C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe
C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wwSecure.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Programmi\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Documents and Settings\H18\Desktop\RSIT.exe
C:\Programmi\Trend Micro\HijackThis\H18.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Programmi\File comuni\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: (no name) - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - (no file)
O2 - BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Encarta Web Companion Oggetto helper - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Programmi\File comuni\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: Encarta Web Companion - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Programmi\File comuni\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Systran40premi.IEPlugIn - {D3919E1A-D6A5-11D6-AC3E-00B0D094B576} - C:\Programmi\Systran\4_0\Premium\IEPlugIn.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Programmi\File comuni\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Programmi\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Programmi\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [NSWosCheck] C:\Programmi\Norton SystemWorks Premier\osCheck.exe
O4 - HKLM\..\Run: [USRobotics Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [\YUR4C8.exe] C:\Windows\system32\YUR4C8.exe
O4 - HKLM\..\Run: [\YUR4.exe] C:\Windows\system32\YUR4.exe
O4 - HKLM\..\Run: [\YUR4C7.exe] C:\Windows\system32\YUR4C7.exe
O4 - HKLM\..\Run: [\YUR4C9.exe] C:\Windows\system32\YUR4C9.exe
O4 - HKLM\..\Run: [\YUR4CA.exe] C:\Windows\system32\YUR4CA.exe
O4 - HKLM\..\Run: [\YUR3.exe] C:\Windows\system32\YUR3.exe
O4 - HKLM\..\Run: [\YUR1.exe] C:\Windows\system32\YUR1.exe
O4 - HKLM\..\Run: [\YUR2.exe] C:\Windows\system32\YUR2.exe
O4 - HKLM\..\RunOnce: [ Privacy Eraser Pro] C:\Programmi\PrivacyEraser Computing\Privacy Eraser Pro\PrivacyEraser.exe /ErIEIndex
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programmi\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\RunOnce: [ Privacy Eraser Pro] C:\Programmi\PrivacyEraser Computing\Privacy Eraser Pro\PrivacyEraser.exe /ErIEIndex
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: O?iana.lnk
O8 - Extra context menu item: &Download; All with Rapidshare Downloader - C:\DOCUME~1\H18\IMPOST~1\Temp\RarSFX0\jc_all.htm
O8 - Extra context menu item: &Download; with Rapidshare Downloader - C:\DOCUME~1\H18\IMPOST~1\Temp\RarSFX0\jc_link.htm
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Crea preferiti portatile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Programmi\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programmi\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Crea preferiti portatile… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programmi\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Programmi\Norton SystemWorks Premier\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Programmi\Norton SystemWorks Premier\Norton Cleanup\WCQuick.lnk
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Barra di ricerca di Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programmi\File comuni\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{AD81C8A6-4507-4E78-9486-F9D0B6A49758}: NameServer = 213.215.115.88,147.175.167.50
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Programmi\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Programmi\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NBService - Nero AG - C:\Programmi\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Unknown owner - C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
O23 - Service: Washer AutoComplete (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe
O23 - Service: WEP/WPA-PMK key recovery service (WZCOOK) - Unknown owner - C:\Documents and Settings\H18\Desktop\WiFi_WEP_Key_Finder\aircrack-ng-0.6.2-win\bin\wzcook.exe (file missing)

–
End of file - 13427 bytes

Scheduled tasks folder

C:\WINDOWS\tasks\MP Scheduled Scan.job
C:\WINDOWS\tasks\Norton Internet Security - Run Full System Scan - H18.job
C:\WINDOWS\tasks\Norton SystemWorks One Button Checkup.job

Registry dump

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E8A6170-7264-4D0F-BEAE-D42A53123C75}]
C:\Programmi\File comuni\Symantec Shared\coShared\Browser\1.0\NppBho.dll [2006-09-06 93400]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D; IE Protection - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll [2008-07-07 1562448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{955BE0B8-BC85-4CAF-856E-8E0D8B610560}]
Encarta Web Companion Oggetto helper - C:\Programmi\File comuni\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL [2006-06-13 256792]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
AcroIEToolbarHelper Class - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2004-12-14 225280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Programmi\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll [2008-05-18 654320]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{147D6308-0614-4112-89B1-31402F9B82C4} - Encarta Web Companion - C:\Programmi\File comuni\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL [2006-06-13 256792]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2004-12-14 225280]
{D3919E1A-D6A5-11D6-AC3E-00B0D094B576} - Systran40premi.IEPlugIn - C:\Programmi\Systran\4_0\Premium\IEPlugIn.dll [2002-10-03 73728]
{90222687-F593-4738-B738-FBEE9C7B26DF} - Show Norton Toolbar - C:\Programmi\File comuni\Symantec Shared\coShared\Browser\1.0\UIBHO.dll [2006-09-06 510152]
{D0943516-5076-4020-A3B5-AEFAF26AB263} - Veoh Browser Plug-in - C:\Programmi\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll [2008-04-01 352256]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2005-02-24 5537792]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2005-02-24 86016]
""=C:\WINDOWS\system32\
"ccApp"=C:\Programmi\File comuni\Symantec Shared\ccApp.exe [2006-10-28 107112]
"osCheck"=C:\Programmi\Norton Internet Security\osCheck.exe [2006-09-06 26248]
"Symantec PIF AlertEng"=C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2007-11-28 583048]
"NSWosCheck"=C:\Programmi\Norton SystemWorks Premier\osCheck.exe [2007-12-03 25472]
"USRobotics Wireless Manager UI"=C:\WINDOWS\system32\WLTRAY.exe [2006-10-12 1290240]
"SunJavaUpdateSched"=C:\Programmi\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
"\YUR4C8.exe"=C:\Windows\system32\YUR4C8.exe []
"\YUR4.exe"=C:\Windows\system32\YUR4.exe []
"\YUR4C7.exe"=C:\Windows\system32\YUR4C7.exe []
"\YUR4C9.exe"=C:\Windows\system32\YUR4C9.exe []
"\YUR4CA.exe"=C:\Windows\system32\YUR4CA.exe []
"\YUR3.exe"=C:\Windows\system32\YUR3.exe []
"\YUR1.exe"=C:\Windows\system32\YUR1.exe []
"\YUR2.exe"=C:\Windows\system32\YUR2.exe []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
" Privacy Eraser Pro"=C:\Programmi\PrivacyEraser Computing\Privacy Eraser Pro\PrivacyEraser.exe [2008-07-01 1732608]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"H/PC Connection Agent"=C:\Programmi\Microsoft ActiveSync\WCESCOMM.EXE [2005-01-19 405583]
"MsnMsgr"=C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe [2007-10-18 5724184]
""=C:\WINDOWS\system32\
"SpybotSD TeaTimer"=C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe [2008-08-18 1832272]
"SUPERAntiSpyware"=C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe [2008-09-03 1576176]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
" Privacy Eraser Pro"=C:\Programmi\PrivacyEraser Computing\Privacy Eraser Pro\PrivacyEraser.exe [2008-07-01 1732608]

C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica
O?iana.lnk - C:\Programmi\Today\TODAY.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Programmi\SUPERAntiSpyware\SASWINLO.dll [2008-07-23 352256]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"=C:\PROGRA~1\WIFD1F~1\MpShHook.dll [2006-11-03 83224]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Programmi\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinDefend]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Programmi\Java\jre1.5.0_10\bin\javaw.exe"="C:\Programmi\Java\jre1.5.0_10\bin\javaw.exe:*:Enabled:Java™ 2 Platform Standard Edition binary"
"C:\Documents and Settings\H18\Documenti\eDonkey2000 Downloads\Msn Messenger winks moods etc\winks,moods,muggins,weemees and meegos\mcoinstall.exe"="C:\Documents and Settings\H18\Documenti\eDonkey2000 Downloads\Msn Messenger winks moods etc\winks,moods,muggins,weemees and meegos\mcoinstall.exe:*:Disabled:mcoinstall"
"C:\Programmi\Kazaa Lite K++\KazaaLite.kpp"="C:\Programmi\Kazaa Lite K++\KazaaLite.kpp:*:Enabled:KazaaLite"
"C:\Programmi\Real\RealPlayer\realplay.exe"="C:\Programmi\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer"
"C:\Programmi\webcamXP\webcamXP.exe"="C:\Programmi\webcamXP\webcamXP.exe:*:Enabled:webcamXP"
"C:\Programmi\THQ\MotoGP URT 3\motogp.exe"="C:\Programmi\THQ\MotoGP URT 3\motogp.exe:*:Disabled:motogp"
"C:\Programmi\SopCast\SopCast.exe"="C:\Programmi\SopCast\SopCast.exe:*:Enabled:SopCast Main Application"
"C:\Documents and Settings\H18\Dati applicazioni\SopCast\adv\SopAdver.exe"="C:\Documents and Settings\H18\Dati applicazioni\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver"
"C:\Documents and Settings\H18\Impostazioni locali\Temp\ir_ext_temp_0\AutoPlay\Docs\PackIcons.exe"="C:\Documents and Settings\H18\Impostazioni locali\Temp\ir_ext_temp_0\AutoPlay\Docs\PackIcons.exe:*:Disabled:Messenger Content Installer"
"C:\Programmi\Java\jre1.5.0_11\bin\javaw.exe"="C:\Programmi\Java\jre1.5.0_11\bin\javaw.exe:*:Enabled:Java™ 2 Platform Standard Edition binary"
"C:\Programmi\myTV\myTV.exe"="C:\Programmi\myTV\myTV.exe:*:Enabled:myTV"
"C:\Programmi\Yahoo!\Messenger\YahooMessenger.exe"="C:\Programmi\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\Programmi\Yahoo!\Messenger\YServer.exe"="C:\Programmi\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\Programmi\CCNetwork\WebCamSrv\CCCamSrv.exe"="C:\Programmi\CCNetwork\WebCamSrv\CCCamSrv.exe:*:Disabled:CCN WebCam Server"
"C:\Programmi\MessengerDiscovery\MessengerDiscovery Live.exe"="C:\Programmi\MessengerDiscovery\MessengerDiscovery Live.exe:*:Enabled:MessengerDiscovery Live the Windows Live Messenger addon"
"C:\Programmi\Trillian\trillian.exe"="C:\Programmi\Trillian\trillian.exe:*:Enabled:Trillian"
"C:\Program Files\DoubleB\BBcat\fcPSGRun.exe"="C:\Program Files\DoubleB\BBcat\fcPSGRun.exe:*:Enabled:Play Sex Game 1.17 HTTP emulator"
"C:\Documents and Settings\H18\Desktop\P.S.G.part1\P-S-G\Members\fcPSGRun.exe"="C:\Documents and Settings\H18\Desktop\P.S.G.part1\P-S-G\Members\fcPSGRun.exe:*:Enabled:Play Sex Game 1.17 HTTP emulator"
"C:\Program Files\DoubleB\BBcat\Members\fcPSGRun.exe"="C:\Program Files\DoubleB\BBcat\Members\fcPSGRun.exe:*:Enabled:Play Sex Game 1.17 HTTP emulator"
"C:\Programmi\e frontier\Poser 7\Poser.exe"="C:\Programmi\e frontier\Poser 7\Poser.exe:*:Enabled:Poser executable file"
"C:\Programmi\Microsoft ActiveSync\wcescomm.exe"="C:\Programmi\Microsoft ActiveSync\wcescomm.exe:*:Enabled:ActiveSync Connection Manager"
"C:\Programmi\Microsoft ActiveSync\WCESMgr.exe"="C:\Programmi\Microsoft ActiveSync\WCESMgr.exe:*:Enabled:ActiveSync Application"
"C:\Programmi\DC++\DCPlusPlus.exe"="C:\Programmi\DC++\DCPlusPlus.exe:*:Enabled:DC++"
"C:\Programmi\Steam\steamapps\common\defcon\defcon.exe"="C:\Programmi\Steam\steamapps\common\defcon\defcon.exe:*:Enabled:Defcon"
"C:\Programmi\Kazaa Lite\Kazaa.kpp"="C:\Programmi\Kazaa Lite\Kazaa.kpp:*:Enabled:Kazaa Lite"
"C:\Documents and Settings\H18\Desktop\emule0.48a-Xtreme6.1\emule.exe"="C:\Documents and Settings\H18\Desktop\emule0.48a-Xtreme6.1\emule.exe:*:Enabled:eMule"
"C:\Programmi\Steam\steamapps\hangar1818\half-life 2 deathmatch\hl2.exe"="C:\Programmi\Steam\steamapps\hangar1818\half-life 2 deathmatch\hl2.exe:*:Disabled:hl2"
"C:\Programmi\Soulseek\slsk.exe"="C:\Programmi\Soulseek\slsk.exe:*:Disabled:SoulSeek"
"C:\Programmi\Invisible Browsing\InvisibleBrowsing.exe"="C:\Programmi\Invisible Browsing\InvisibleBrowsing.exe:*:Enabled:IB6_UI"
"C:\Programmi\Skype\Phone\Skype.exe"="C:\Programmi\Skype\Phone\Skype.exe:*:Enabled:Skype. The whole world can talk for free."
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Programmi\Windows Live\Messenger\msnmsgr.exe"="C:\Programmi\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Programmi\Windows Live\Messenger\livecall.exe"="C:\Programmi\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Programmi\Windows Live\Messenger\msnmsgr.exe"="C:\Programmi\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Programmi\Windows Live\Messenger\livecall.exe"="C:\Programmi\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0e340a40-5dab-11dd-9d9b-00e04c39dbc5}]
shell\AutoRun\command - 1rfw8hjr.com
shell\explore\command - 1rfw8hjr.com
shell\open\command - 1rfw8hjr.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2a391560-2e27-11dd-9d15-00e04c39dbc5}]
shell\AutoRun\command - 1rfw8hjr.com
shell\explore\command - 1rfw8hjr.com
shell\open\command - 1rfw8hjr.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{45da8111-d614-11db-98ce-00e04c39dbc5}]
shell\AutoRun\command - J:\.\run\autorun.exe
shell\open\command - J:\.\run\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{95cced30-cb2f-11db-9896-00e04c39dbc5}]
shell\AutoRun\command - H:\.\run\autorun.exe
shell\open\command - H:\.\run\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{977b7d43-d7e4-11dc-9c37-00e04c39dbc5}]
shell\AutoRun\command - H:\.\run\autorun.exe
shell\open\command - H:\.\run\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fa8c97f1-43a1-11dd-9d49-00e04c39dbc5}]
shell\AutoRun\command - .\run\autorun.exe
shell\open\command - .\run\autorun.exe

List of files/folders created in the last three months

2008-09-18 15:33:38 —-D—- C:\Programmi\Malwarebytes' Anti-Malware
2008-09-18 12:29:00 —-D—- C:\rsit
2008-09-18 12:13:06 —-D—- C:\_OTMoveIt
2008-09-18 11:55:13 —-D—- C:\WINDOWS\system32\appmgmt
2008-09-17 13:03:20 —-A—- C:\WINDOWS\system32\tmp.txt
2008-09-16 17:55:34 —-D—- C:\Documents and Settings\H18\Dati applicazioni\Malwarebytes
2008-09-16 17:55:28 —-D—- C:\Documents and Settings\All Users\Dati applicazioni\Malwarebytes
2008-09-16 17:32:35 —-D—- C:\Programmi\Trend Micro
2008-09-15 21:05:04 —-D—- C:\Programmi\The Cleaner Free
2008-09-15 15:03:23 —-D—- C:\Documents and Settings\All Users\Dati applicazioni\SUPERAntiSpyware.com
2008-09-15 15:03:14 —-D—- C:\Programmi\SUPERAntiSpyware
2008-09-15 15:03:14 —-D—- C:\Documents and Settings\H18\Dati applicazioni\SUPERAntiSpyware.com
2008-09-10 16:08:14 —-HDC—- C:\WINDOWS\$NtUninstallKB938464$
2008-09-10 16:07:20 —-HDC—- C:\WINDOWS\$NtUninstallKB954154_WM11$
2008-09-09 12:07:34 —-HDC—- C:\WINDOWS\$NtUninstallKB951978$
2008-09-09 11:41:49 —-D—- C:\WINDOWS\Prefetch
2008-09-09 02:02:51 —-HDC—- C:\WINDOWS\$NtUninstallKB952954$
2008-09-09 02:02:39 —-HDC—- C:\WINDOWS\$NtUninstallKB952287$
2008-09-09 02:02:17 —-HDC—- C:\WINDOWS\$NtUninstallKB951748$
2008-09-09 02:02:02 —-HDC—- C:\WINDOWS\$NtUninstallKB951698$
2008-09-09 02:01:50 —-HDC—- C:\WINDOWS\$NtUninstallKB951376-v2$
2008-09-09 02:01:37 —-HDC—- C:\WINDOWS\$NtUninstallKB951376$
2008-09-09 02:01:21 —-HDC—- C:\WINDOWS\$NtUninstallKB951066$
2008-09-09 02:01:07 —-HDC—- C:\WINDOWS\$NtUninstallKB950974$
2008-09-09 02:00:54 —-HDC—- C:\WINDOWS\$NtUninstallKB950762$
2008-09-09 02:00:38 —-HDC—- C:\WINDOWS\$NtUninstallKB946648$
2008-09-09 01:53:16 —-D—- C:\WINDOWS\l2schemas
2008-09-09 01:53:15 —-D—- C:\WINDOWS\system32\it
2008-09-09 01:53:14 —-D—- C:\WINDOWS\system32\bits
2008-09-09 01:48:22 —-D—- C:\WINDOWS\ServicePackFiles
2008-09-09 01:45:54 —-D—- C:\WINDOWS\network diagnostic
2008-09-09 01:40:45 —-HDC—- C:\WINDOWS\$NtServicePackUninstall$
2008-09-02 16:43:04 —-D—- C:\Programmi\Spybot - Search & Destroy
2008-09-01 00:45:08 —-HDC—- C:\WINDOWS\$NtUninstallKB952954_0$
2008-09-01 00:45:00 —-HDC—- C:\WINDOWS\$NtUninstallKB946648_0$
2008-09-01 00:44:53 —-HDC—- C:\WINDOWS\$NtUninstallKB953839$
2008-09-01 00:44:45 —-HDC—- C:\WINDOWS\$NtUninstallKB950974_0$
2008-09-01 00:43:11 —-HDC—- C:\WINDOWS\$NtUninstallKB951072-v2$
2008-09-01 00:43:02 —-HDC—- C:\WINDOWS\$NtUninstallKB952287_0$
2008-09-01 00:42:17 —-HDC—- C:\WINDOWS\$NtUninstallKB951066_0$
2008-07-09 16:10:46 —-A—- C:\WINDOWS\system32\javaws.exe
2008-07-09 16:10:46 —-A—- C:\WINDOWS\system32\javaw.exe
2008-07-09 16:10:46 —-A—- C:\WINDOWS\system32\java.exe
2008-07-09 09:09:26 —-HDC—- C:\WINDOWS\$NtUninstallKB951748_0$
2008-06-26 15:15:58 —-HDC—- C:\WINDOWS\$NtUninstallKB951376-v2_0$

List of drivers

R1 AmdK7;Driver del processore AMD K7; C:\WINDOWS\system32\DRIVERS\amdk7.sys [2008-04-14 41728]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Programmi\File comuni\Symantec Shared\EENGINE\eeCtrl.sys []
R1 SASDIFSV;SASDIFSV; \??\C:\Programmi\SUPERAntiSpyware\SASDIFSV.SYS []
R1 SASKUTIL;SASKUTIL; \??\C:\Programmi\SUPERAntiSpyware\SASKUTIL.sys []
R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2005-10-16 27171]
R1 SPBBCDrv;SPBBCDrv; \??\C:\Programmi\File comuni\Symantec Shared\SPBBC\SPBBCDrv.sys []
R1 SRTSP;SRTSP; C:\WINDOWS\System32\Drivers\SRTSP.SYS [2007-12-01 279088]
R1 SRTSPX;SRTSPX; C:\WINDOWS\System32\Drivers\SRTSPX.SYS [2007-12-01 43696]
R1 SYMTDI;SYMTDI; C:\WINDOWS\System32\Drivers\SYMTDI.SYS [2007-10-30 191536]
R2 usbhub;Ph USB Standard Hub Driver; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 BCM43XX;U.S. Robotics Wireless MAXg Adapter; C:\WINDOWS\system32\DRIVERS\bcmwl5.sys [2006-10-12 604928]
R3 camvid20;Philips ToUcam Camera; Video; C:\WINDOWS\system32\DRIVERS\camdrv21.sys [2001-12-10 253909]
R3 ctljystk;Creative SBLive! Porta giochi; C:\WINDOWS\system32\DRIVERS\ctljystk.sys [2001-08-17 3712]
R3 dtscsi;dtscsi; C:\WINDOWS\System32\Drivers\dtscsi.sys [2007-01-21 223128]
R3 emu10k;Creative SB Live! (WDM); C:\WINDOWS\system32\drivers\emu10k1m.sys [2001-08-17 283904]
R3 emu10k1;Driver per Creative Interface Manager (WDM); C:\WINDOWS\system32\drivers\ctlfacem.sys [2001-08-17 6912]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Programmi\File comuni\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys []
R3 NAVENG;NAVENG; \??\C:\PROGRA~1\FILECO~1\SYMANT~1\VIRUSD~1\20080918.008\NAVENG.SYS []
R3 NAVEX15;NAVEX15; \??\C:\PROGRA~1\FILECO~1\SYMANT~1\VIRUSD~1\20080918.008\NAVEX15.SYS []
R3 NPDriver;Norton UnErase Protection Driver; \??\C:\WINDOWS\system32\Drivers\NPDRIVER.SYS []
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2005-02-24 3454144]
R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2007-01-21 10368]
R3 rtl8139;Driver NT scheda Fast Ethernet PCI Realtek basata su RTL8139; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-04 20992]
R3 SASENUM;SASENUM; \??\C:\Programmi\SUPERAntiSpyware\SASENUM.SYS []
R3 sfman;Driver per Creative SoundFont Manager (WDM); C:\WINDOWS\system32\drivers\sfmanm.sys [2001-08-17 36480]
R3 SYMDNS;SYMDNS; C:\WINDOWS\System32\Drivers\SYMDNS.SYS [2007-10-30 12848]
R3 SymEvent;SymEvent; \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS []
R3 SYMFW;SYMFW; C:\WINDOWS\System32\Drivers\SYMFW.SYS [2007-10-30 145968]
R3 SYMIDS;SYMIDS; C:\WINDOWS\System32\Drivers\SYMIDS.SYS [2007-10-30 39856]
R3 SYMIDSCO;SYMIDSCO; \??\C:\PROGRA~1\FILECO~1\SYMANT~1\SymcData\idsdefs\20080917.005\SymIDSCo.sys []
R3 SYMNDIS;SYMNDIS; C:\WINDOWS\System32\Drivers\SYMNDIS.SYS [2007-10-30 35120]
R3 SYMREDRV;SYMREDRV; C:\WINDOWS\System32\Drivers\SYMREDRV.SYS [2007-10-30 27696]
R3 usbaudio;Philips USB Microphone; C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
R3 usbuhci;Driver Miniport Controller Universal Host USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 CCDECODE;Decoder sottotitoli codificati; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 MS1000;MS1000; C:\WINDOWS\System32\DRIVERS\MS1000.sys [2008-09-15 5376]
S3 MSTEE;Convertitore a T/Sito a sito per flusso Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Connesione TV/Video Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 nm;Driver di Network Monitor; C:\WINDOWS\system32\DRIVERS\NMnt.sys [2008-04-13 40320]
S3 PCASp50;PCASp50 NDIS Protocol Driver; C:\WINDOWS\System32\Drivers\PCASp50.sys [2004-09-07 17664]
S3 SDdriver;SDdriver; \??\C:\WINDOWS\system32\Drivers\sddriver.sys []
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 SRTSPL;SRTSPL; C:\WINDOWS\System32\Drivers\SRTSPL.SYS [2007-12-01 317616]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbscan;Driver scanner USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Driver archiviazione di massa USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 vaxscsi;vaxscsi; C:\WINDOWS\System32\Drivers\vaxscsi.sys []
S3 wceusbsh;Windows CE USB Serial Host Driver; C:\WINDOWS\system32\DRIVERS\wceusbsh.sys [2004-12-06 104064]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;Codec World Standard Teletext; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

List of services

R2 aawservice;Ad-Aware 2007 Service; C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe [2007-07-06 561152]
R2 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler; C:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2006-09-03 198336]
R2 ccEvtMgr;Symantec Event Manager; C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe [2006-10-28 107624]
R2 ccSetMgr;Symantec Settings Manager; C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe [2006-10-28 107624]
R2 CLTNetCnService;Symantec Lic NetConnect service; C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe [2006-10-28 107624]
R2 gusvc;Google Updater Service; C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-05-18 137200]
R2 LiveUpdate Notice Ex;LiveUpdate Notice Service Ex; C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe [2006-10-28 107624]
R2 NProtectService;Norton UnErase Protection; C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE [2005-11-04 95832]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2005-02-24 127043]
R2 Speed Disk service;Speed Disk service; C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE [2005-11-04 176193]
R2 SymAppCore;Symantec AppCore Service; C:\Programmi\File comuni\Symantec Shared\AppCore\AppSvc32.exe [2006-09-02 46736]
R2 WinDefend;Windows Defender; C:\Programmi\Windows Defender\MsMpEng.exe [2006-11-03 13592]
R2 wltrysvc;Broadcom Wireless LAN Tray Service; C:\WINDOWS\System32\WLTRYSVC.EXE [2006-10-12 20480]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 wwSecSvc;Washer AutoComplete; C:\WINDOWS\system32\wwSecure.exe [2005-04-20 487936]
R3 Symantec Core LC;Symantec Core LC; C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe [2008-01-24 1251720]
R3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Programmi\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
S2 LiveUpdate Notice Service;LiveUpdate Notice Service; C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2007-11-28 583048]
S3 Adobe LM Service;Adobe LM Service; C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe [2007-09-05 72704]
S3 aspnet_state;Servizio stato di ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 comHost;COM Host; C:\Programmi\File comuni\Symantec Shared\VAScanner\comHost.exe [2006-09-03 48272]
S3 IDriverT;InstallDriver Table Manager; C:\Programmi\File comuni\InstallShield\Driver\1150\Intel 32\IDriverT.exe [2005-11-14 69632]
S3 ISPwdSvc;Symantec IS Password Validation; C:\Programmi\Norton Internet Security\isPwdSvc.exe [2006-09-06 79496]
S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2006-09-03 2528960]
S3 NBService;NBService; C:\Programmi\Nero\Nero 7\Nero BackItUp\NBService.exe [2006-10-09 724992]
S3 ose;Office Source Engine; C:\Programmi\File comuni\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 WLSetupSvc;Windows Live Setup Service; C:\Programmi\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Programmi\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S3 WZCOOK;WEP/WPA-PMK key recovery service; C:\Documents and Settings\H18\Desktop\WiFi_WEP_Key_Finder\aircrack-ng-0.6.2-win\bin\wzcook.exe []

—————–EOF—————–

Rorschach112

Post #9September 19, 2008, 3:08 PM UTC

Hello

1 - Flash Drive Disinfector
Download Flash_Disinfector.exe by sUBs from >here< and save it to your desktop.
Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
Wait until it has finished scanning and then exit the program.
Reboot your computer when done.

Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you ran it. Don't delete this folder…it will help protect your drives from future infection.

1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present):

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [\YUR4C8.exe] C:\Windows\system32\YUR4C8.exe
O4 - HKLM\..\Run: [\YUR4.exe] C:\Windows\system32\YUR4.exe
O4 - HKLM\..\Run: [\YUR4C7.exe] C:\Windows\system32\YUR4C7.exe
O4 - HKLM\..\Run: [\YUR4C9.exe] C:\Windows\system32\YUR4C9.exe
O4 - HKLM\..\Run: [\YUR4CA.exe] C:\Windows\system32\YUR4CA.exe
O4 - HKLM\..\Run: [\YUR3.exe] C:\Windows\system32\YUR3.exe
O4 - HKLM\..\Run: [\YUR1.exe] C:\Windows\system32\YUR1.exe
O4 - HKLM\..\Run: [\YUR2.exe] C:\Windows\system32\YUR2.exe

2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.

Plug your USB key in for this

Please download the OTMoveIt2 by OldTimer.

Save it to your desktop.
Please double-click OTMoveIt2.exe to run it.

Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

[kill explorer]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0e340a40-5dab-11dd-9d9b-00e04c39dbc5}
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2a391560-2e27-11dd-9d15-00e04c39dbc5}
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{45da8111-d614-11db-98ce-00e04c39dbc5}
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{95cced30-cb2f-11db-9896-00e04c39dbc5}
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{977b7d43-d7e4-11dc-9c37-00e04c39dbc5}
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fa8c97f1-43a1-11dd-9d49-00e04c39dbc5}
purity 
EmptyTemp
[start explorer]

Return to OTMoveIt2, right click in the "Paste List of Files/Folders to Move" window (under the light Yellow bar) and choose Paste.
Click the red Moveit! button.
A log of files and folders moved will be created in the c:\_OTMoveIt\MovedFiles folder in the form of Date and Time (mmddyyyy_hhmmss.log). Please open this log in Notepad and post its contents in your next reply.
Close OTMoveIt2

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Reboot and post a new rsit log

hangar18

Post #10September 19, 2008, 5:08 PM UTC

Logfile of random's system information tool 1.01 (written by random/random)
Run by [removed] at 2008-09-19 19:05:37
Microsoft Windows XP Professional Service Pack 3
System drive C: has 927 MB (2%) free of 46 GB
Total RAM: 1023 MB (45% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:05:47, on 19/09/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
C:\Programmi\File comuni\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wwSecure.exe
C:\Programmi\File comuni\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Programmi\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Microsoft ActiveSync\WCESCOMM.EXE
C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe
C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Windows Live\Messenger\usnsvc.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Documents and Settings\H18\Desktop\RSIT.exe
C:\Programmi\Trend Micro\HijackThis\H18.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Programmi\File comuni\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: (no name) - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - (no file)
O2 - BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Encarta Web Companion Oggetto helper - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Programmi\File comuni\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: Encarta Web Companion - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Programmi\File comuni\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Systran40premi.IEPlugIn - {D3919E1A-D6A5-11D6-AC3E-00B0D094B576} - C:\Programmi\Systran\4_0\Premium\IEPlugIn.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Programmi\File comuni\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Programmi\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Programmi\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [NSWosCheck] C:\Programmi\Norton SystemWorks Premier\osCheck.exe
O4 - HKLM\..\Run: [USRobotics Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [\YUR4C8.exe] C:\Windows\system32\YUR4C8.exe
O4 - HKLM\..\Run: [\YUR4.exe] C:\Windows\system32\YUR4.exe
O4 - HKLM\..\Run: [\YUR4C7.exe] C:\Windows\system32\YUR4C7.exe
O4 - HKLM\..\Run: [\YUR4C9.exe] C:\Windows\system32\YUR4C9.exe
O4 - HKLM\..\Run: [\YUR4CA.exe] C:\Windows\system32\YUR4CA.exe
O4 - HKLM\..\Run: [\YUR3.exe] C:\Windows\system32\YUR3.exe
O4 - HKLM\..\Run: [\YUR1.exe] C:\Windows\system32\YUR1.exe
O4 - HKLM\..\Run: [\YUR2.exe] C:\Windows\system32\YUR2.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programmi\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: O?iana.lnk
O8 - Extra context menu item: &Download; All with Rapidshare Downloader - C:\DOCUME~1\H18\IMPOST~1\Temp\RarSFX0\jc_all.htm
O8 - Extra context menu item: &Download; with Rapidshare Downloader - C:\DOCUME~1\H18\IMPOST~1\Temp\RarSFX0\jc_link.htm
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Crea preferiti portatile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Programmi\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programmi\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Crea preferiti portatile… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programmi\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Programmi\Norton SystemWorks Premier\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Programmi\Norton SystemWorks Premier\Norton Cleanup\WCQuick.lnk
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Barra di ricerca di Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programmi\File comuni\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{AD81C8A6-4507-4E78-9486-F9D0B6A49758}: NameServer = 213.215.115.88,147.175.167.50
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Programmi\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Programmi\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NBService - Nero AG - C:\Programmi\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Unknown owner - C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
O23 - Service: Washer AutoComplete (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe
O23 - Service: WEP/WPA-PMK key recovery service (WZCOOK) - Unknown owner - C:\Documents and Settings\H18\Desktop\WiFi_WEP_Key_Finder\aircrack-ng-0.6.2-win\bin\wzcook.exe (file missing)

–
End of file - 13186 bytes

Scheduled tasks folder

C:\WINDOWS\tasks\MP Scheduled Scan.job
C:\WINDOWS\tasks\Norton Internet Security - Run Full System Scan - H18.job
C:\WINDOWS\tasks\Norton SystemWorks One Button Checkup.job

Registry dump

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E8A6170-7264-4D0F-BEAE-D42A53123C75}]
C:\Programmi\File comuni\Symantec Shared\coShared\Browser\1.0\NppBho.dll [2006-09-06 93400]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D; IE Protection - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll [2008-07-07 1562448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{955BE0B8-BC85-4CAF-856E-8E0D8B610560}]
Encarta Web Companion Oggetto helper - C:\Programmi\File comuni\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL [2006-06-13 256792]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
AcroIEToolbarHelper Class - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2004-12-14 225280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Programmi\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll [2008-05-18 654320]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{147D6308-0614-4112-89B1-31402F9B82C4} - Encarta Web Companion - C:\Programmi\File comuni\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL [2006-06-13 256792]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2004-12-14 225280]
{D3919E1A-D6A5-11D6-AC3E-00B0D094B576} - Systran40premi.IEPlugIn - C:\Programmi\Systran\4_0\Premium\IEPlugIn.dll [2002-10-03 73728]
{90222687-F593-4738-B738-FBEE9C7B26DF} - Show Norton Toolbar - C:\Programmi\File comuni\Symantec Shared\coShared\Browser\1.0\UIBHO.dll [2006-09-06 510152]
{D0943516-5076-4020-A3B5-AEFAF26AB263} - Veoh Browser Plug-in - C:\Programmi\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll [2008-04-01 352256]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2005-02-24 5537792]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2005-02-24 86016]
""=C:\WINDOWS\system32\
"ccApp"=C:\Programmi\File comuni\Symantec Shared\ccApp.exe [2006-10-28 107112]
"osCheck"=C:\Programmi\Norton Internet Security\osCheck.exe [2006-09-06 26248]
"Symantec PIF AlertEng"=C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2007-11-28 583048]
"NSWosCheck"=C:\Programmi\Norton SystemWorks Premier\osCheck.exe [2007-12-03 25472]
"USRobotics Wireless Manager UI"=C:\WINDOWS\system32\WLTRAY.exe [2006-10-12 1290240]
"SunJavaUpdateSched"=C:\Programmi\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
"\YUR4C8.exe"=C:\Windows\system32\YUR4C8.exe []
"\YUR4.exe"=C:\Windows\system32\YUR4.exe []
"\YUR4C7.exe"=C:\Windows\system32\YUR4C7.exe []
"\YUR4C9.exe"=C:\Windows\system32\YUR4C9.exe []
"\YUR4CA.exe"=C:\Windows\system32\YUR4CA.exe []
"\YUR3.exe"=C:\Windows\system32\YUR3.exe []
"\YUR1.exe"=C:\Windows\system32\YUR1.exe []
"\YUR2.exe"=C:\Windows\system32\YUR2.exe []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"H/PC Connection Agent"=C:\Programmi\Microsoft ActiveSync\WCESCOMM.EXE [2005-01-19 405583]
"MsnMsgr"=C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe [2007-10-18 5724184]
""=C:\WINDOWS\system32\
"SpybotSD TeaTimer"=C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe [2008-08-18 1832272]
"SUPERAntiSpyware"=C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe [2008-09-03 1576176]

C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica
O?iana.lnk - C:\Programmi\Today\TODAY.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Programmi\SUPERAntiSpyware\SASWINLO.dll [2008-07-23 352256]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"=C:\PROGRA~1\WIFD1F~1\MpShHook.dll [2006-11-03 83224]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Programmi\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinDefend]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Programmi\Java\jre1.5.0_10\bin\javaw.exe"="C:\Programmi\Java\jre1.5.0_10\bin\javaw.exe:*:Enabled:Java™ 2 Platform Standard Edition binary"
"C:\Documents and Settings\H18\Documenti\eDonkey2000 Downloads\Msn Messenger winks moods etc\winks,moods,muggins,weemees and meegos\mcoinstall.exe"="C:\Documents and Settings\H18\Documenti\eDonkey2000 Downloads\Msn Messenger winks moods etc\winks,moods,muggins,weemees and meegos\mcoinstall.exe:*:Disabled:mcoinstall"
"C:\Programmi\Kazaa Lite K++\KazaaLite.kpp"="C:\Programmi\Kazaa Lite K++\KazaaLite.kpp:*:Enabled:KazaaLite"
"C:\Programmi\Real\RealPlayer\realplay.exe"="C:\Programmi\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer"
"C:\Programmi\webcamXP\webcamXP.exe"="C:\Programmi\webcamXP\webcamXP.exe:*:Enabled:webcamXP"
"C:\Programmi\THQ\MotoGP URT 3\motogp.exe"="C:\Programmi\THQ\MotoGP URT 3\motogp.exe:*:Disabled:motogp"
"C:\Programmi\SopCast\SopCast.exe"="C:\Programmi\SopCast\SopCast.exe:*:Enabled:SopCast Main Application"
"C:\Documents and Settings\H18\Dati applicazioni\SopCast\adv\SopAdver.exe"="C:\Documents and Settings\H18\Dati applicazioni\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver"
"C:\Documents and Settings\H18\Impostazioni locali\Temp\ir_ext_temp_0\AutoPlay\Docs\PackIcons.exe"="C:\Documents and Settings\H18\Impostazioni locali\Temp\ir_ext_temp_0\AutoPlay\Docs\PackIcons.exe:*:Disabled:Messenger Content Installer"
"C:\Programmi\Java\jre1.5.0_11\bin\javaw.exe"="C:\Programmi\Java\jre1.5.0_11\bin\javaw.exe:*:Enabled:Java™ 2 Platform Standard Edition binary"
"C:\Programmi\myTV\myTV.exe"="C:\Programmi\myTV\myTV.exe:*:Enabled:myTV"
"C:\Programmi\Yahoo!\Messenger\YahooMessenger.exe"="C:\Programmi\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\Programmi\Yahoo!\Messenger\YServer.exe"="C:\Programmi\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\Programmi\CCNetwork\WebCamSrv\CCCamSrv.exe"="C:\Programmi\CCNetwork\WebCamSrv\CCCamSrv.exe:*:Disabled:CCN WebCam Server"
"C:\Programmi\MessengerDiscovery\MessengerDiscovery Live.exe"="C:\Programmi\MessengerDiscovery\MessengerDiscovery Live.exe:*:Enabled:MessengerDiscovery Live the Windows Live Messenger addon"
"C:\Programmi\Trillian\trillian.exe"="C:\Programmi\Trillian\trillian.exe:*:Enabled:Trillian"
"C:\Program Files\DoubleB\BBcat\fcPSGRun.exe"="C:\Program Files\DoubleB\BBcat\fcPSGRun.exe:*:Enabled:Play Sex Game 1.17 HTTP emulator"
"C:\Documents and Settings\H18\Desktop\P.S.G.part1\P-S-G\Members\fcPSGRun.exe"="C:\Documents and Settings\H18\Desktop\P.S.G.part1\P-S-G\Members\fcPSGRun.exe:*:Enabled:Play Sex Game 1.17 HTTP emulator"
"C:\Program Files\DoubleB\BBcat\Members\fcPSGRun.exe"="C:\Program Files\DoubleB\BBcat\Members\fcPSGRun.exe:*:Enabled:Play Sex Game 1.17 HTTP emulator"
"C:\Programmi\e frontier\Poser 7\Poser.exe"="C:\Programmi\e frontier\Poser 7\Poser.exe:*:Enabled:Poser executable file"
"C:\Programmi\Microsoft ActiveSync\wcescomm.exe"="C:\Programmi\Microsoft ActiveSync\wcescomm.exe:*:Enabled:ActiveSync Connection Manager"
"C:\Programmi\Microsoft ActiveSync\WCESMgr.exe"="C:\Programmi\Microsoft ActiveSync\WCESMgr.exe:*:Enabled:ActiveSync Application"
"C:\Programmi\DC++\DCPlusPlus.exe"="C:\Programmi\DC++\DCPlusPlus.exe:*:Enabled:DC++"
"C:\Programmi\Steam\steamapps\common\defcon\defcon.exe"="C:\Programmi\Steam\steamapps\common\defcon\defcon.exe:*:Enabled:Defcon"
"C:\Programmi\Kazaa Lite\Kazaa.kpp"="C:\Programmi\Kazaa Lite\Kazaa.kpp:*:Enabled:Kazaa Lite"
"C:\Documents and Settings\H18\Desktop\emule0.48a-Xtreme6.1\emule.exe"="C:\Documents and Settings\H18\Desktop\emule0.48a-Xtreme6.1\emule.exe:*:Enabled:eMule"
"C:\Programmi\Steam\steamapps\hangar1818\half-life 2 deathmatch\hl2.exe"="C:\Programmi\Steam\steamapps\hangar1818\half-life 2 deathmatch\hl2.exe:*:Disabled:hl2"
"C:\Programmi\Soulseek\slsk.exe"="C:\Programmi\Soulseek\slsk.exe:*:Disabled:SoulSeek"
"C:\Programmi\Invisible Browsing\InvisibleBrowsing.exe"="C:\Programmi\Invisible Browsing\InvisibleBrowsing.exe:*:Enabled:IB6_UI"
"C:\Programmi\Skype\Phone\Skype.exe"="C:\Programmi\Skype\Phone\Skype.exe:*:Enabled:Skype. The whole world can talk for free."
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Programmi\Windows Live\Messenger\msnmsgr.exe"="C:\Programmi\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Programmi\Windows Live\Messenger\livecall.exe"="C:\Programmi\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Programmi\Windows Live\Messenger\msnmsgr.exe"="C:\Programmi\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Programmi\Windows Live\Messenger\livecall.exe"="C:\Programmi\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

List of files/folders created in the last three months

2008-09-19 18:16:52 —-RASHD—- C:\autorun.inf
2008-09-18 15:33:38 —-D—- C:\Programmi\Malwarebytes' Anti-Malware
2008-09-18 12:29:00 —-D—- C:\rsit
2008-09-18 12:13:06 —-D—- C:\_OTMoveIt
2008-09-18 11:55:13 —-D—- C:\WINDOWS\system32\appmgmt
2008-09-17 13:03:20 —-A—- C:\WINDOWS\system32\tmp.txt
2008-09-16 17:55:34 —-D—- C:\Documents and Settings\H18\Dati applicazioni\Malwarebytes
2008-09-16 17:55:28 —-D—- C:\Documents and Settings\All Users\Dati applicazioni\Malwarebytes
2008-09-16 17:32:35 —-D—- C:\Programmi\Trend Micro
2008-09-15 21:05:04 —-D—- C:\Programmi\The Cleaner Free
2008-09-15 15:03:23 —-D—- C:\Documents and Settings\All Users\Dati applicazioni\SUPERAntiSpyware.com
2008-09-15 15:03:14 —-D—- C:\Programmi\SUPERAntiSpyware
2008-09-15 15:03:14 —-D—- C:\Documents and Settings\H18\Dati applicazioni\SUPERAntiSpyware.com
2008-09-10 16:08:14 —-HDC—- C:\WINDOWS\$NtUninstallKB938464$
2008-09-10 16:07:20 —-HDC—- C:\WINDOWS\$NtUninstallKB954154_WM11$
2008-09-09 12:07:34 —-HDC—- C:\WINDOWS\$NtUninstallKB951978$
2008-09-09 11:41:49 —-D—- C:\WINDOWS\Prefetch
2008-09-09 02:02:51 —-HDC—- C:\WINDOWS\$NtUninstallKB952954$
2008-09-09 02:02:39 —-HDC—- C:\WINDOWS\$NtUninstallKB952287$
2008-09-09 02:02:17 —-HDC—- C:\WINDOWS\$NtUninstallKB951748$
2008-09-09 02:02:02 —-HDC—- C:\WINDOWS\$NtUninstallKB951698$
2008-09-09 02:01:50 —-HDC—- C:\WINDOWS\$NtUninstallKB951376-v2$
2008-09-09 02:01:37 —-HDC—- C:\WINDOWS\$NtUninstallKB951376$
2008-09-09 02:01:21 —-HDC—- C:\WINDOWS\$NtUninstallKB951066$
2008-09-09 02:01:07 —-HDC—- C:\WINDOWS\$NtUninstallKB950974$
2008-09-09 02:00:54 —-HDC—- C:\WINDOWS\$NtUninstallKB950762$
2008-09-09 02:00:38 —-HDC—- C:\WINDOWS\$NtUninstallKB946648$
2008-09-09 01:53:16 —-D—- C:\WINDOWS\l2schemas
2008-09-09 01:53:15 —-D—- C:\WINDOWS\system32\it
2008-09-09 01:53:14 —-D—- C:\WINDOWS\system32\bits
2008-09-09 01:48:22 —-D—- C:\WINDOWS\ServicePackFiles
2008-09-09 01:45:54 —-D—- C:\WINDOWS\network diagnostic
2008-09-09 01:40:45 —-HDC—- C:\WINDOWS\$NtServicePackUninstall$
2008-09-02 16:43:04 —-D—- C:\Programmi\Spybot - Search & Destroy
2008-09-01 00:45:08 —-HDC—- C:\WINDOWS\$NtUninstallKB952954_0$
2008-09-01 00:45:00 —-HDC—- C:\WINDOWS\$NtUninstallKB946648_0$
2008-09-01 00:44:53 —-HDC—- C:\WINDOWS\$NtUninstallKB953839$
2008-09-01 00:44:45 —-HDC—- C:\WINDOWS\$NtUninstallKB950974_0$
2008-09-01 00:43:11 —-HDC—- C:\WINDOWS\$NtUninstallKB951072-v2$
2008-09-01 00:43:02 —-HDC—- C:\WINDOWS\$NtUninstallKB952287_0$
2008-09-01 00:42:17 —-HDC—- C:\WINDOWS\$NtUninstallKB951066_0$
2008-07-09 16:10:46 —-A—- C:\WINDOWS\system32\javaws.exe
2008-07-09 16:10:46 —-A—- C:\WINDOWS\system32\javaw.exe
2008-07-09 16:10:46 —-A—- C:\WINDOWS\system32\java.exe
2008-07-09 09:09:26 —-HDC—- C:\WINDOWS\$NtUninstallKB951748_0$
2008-06-26 15:15:58 —-HDC—- C:\WINDOWS\$NtUninstallKB951376-v2_0$

List of drivers

R1 AmdK7;Driver del processore AMD K7; C:\WINDOWS\system32\DRIVERS\amdk7.sys [2008-04-14 41728]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Programmi\File comuni\Symantec Shared\EENGINE\eeCtrl.sys []
R1 SASDIFSV;SASDIFSV; \??\C:\Programmi\SUPERAntiSpyware\SASDIFSV.SYS []
R1 SASKUTIL;SASKUTIL; \??\C:\Programmi\SUPERAntiSpyware\SASKUTIL.sys []
R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2005-10-16 27171]
R1 SPBBCDrv;SPBBCDrv; \??\C:\Programmi\File comuni\Symantec Shared\SPBBC\SPBBCDrv.sys []
R1 SRTSP;SRTSP; C:\WINDOWS\System32\Drivers\SRTSP.SYS [2007-12-01 279088]
R1 SRTSPX;SRTSPX; C:\WINDOWS\System32\Drivers\SRTSPX.SYS [2007-12-01 43696]
R1 SYMTDI;SYMTDI; C:\WINDOWS\System32\Drivers\SYMTDI.SYS [2007-10-30 191536]
R2 usbhub;Ph USB Standard Hub Driver; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 BCM43XX;U.S. Robotics Wireless MAXg Adapter; C:\WINDOWS\system32\DRIVERS\bcmwl5.sys [2006-10-12 604928]
R3 camvid20;Philips ToUcam Camera; Video; C:\WINDOWS\system32\DRIVERS\camdrv21.sys [2001-12-10 253909]
R3 ctljystk;Creative SBLive! Porta giochi; C:\WINDOWS\system32\DRIVERS\ctljystk.sys [2001-08-17 3712]
R3 dtscsi;dtscsi; C:\WINDOWS\System32\Drivers\dtscsi.sys [2007-01-21 223128]
R3 emu10k;Creative SB Live! (WDM); C:\WINDOWS\system32\drivers\emu10k1m.sys [2001-08-17 283904]
R3 emu10k1;Driver per Creative Interface Manager (WDM); C:\WINDOWS\system32\drivers\ctlfacem.sys [2001-08-17 6912]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Programmi\File comuni\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys []
R3 NAVENG;NAVENG; \??\C:\PROGRA~1\FILECO~1\SYMANT~1\VIRUSD~1\20080919.007\NAVENG.SYS []
R3 NAVEX15;NAVEX15; \??\C:\PROGRA~1\FILECO~1\SYMANT~1\VIRUSD~1\20080919.007\NAVEX15.SYS []
R3 NPDriver;Norton UnErase Protection Driver; \??\C:\WINDOWS\system32\Drivers\NPDRIVER.SYS []
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2005-02-24 3454144]
R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2007-01-21 10368]
R3 rtl8139;Driver NT scheda Fast Ethernet PCI Realtek basata su RTL8139; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-04 20992]
R3 SASENUM;SASENUM; \??\C:\Programmi\SUPERAntiSpyware\SASENUM.SYS []
R3 sfman;Driver per Creative SoundFont Manager (WDM); C:\WINDOWS\system32\drivers\sfmanm.sys [2001-08-17 36480]
R3 SYMDNS;SYMDNS; C:\WINDOWS\System32\Drivers\SYMDNS.SYS [2007-10-30 12848]
R3 SymEvent;SymEvent; \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS []
R3 SYMFW;SYMFW; C:\WINDOWS\System32\Drivers\SYMFW.SYS [2007-10-30 145968]
R3 SYMIDS;SYMIDS; C:\WINDOWS\System32\Drivers\SYMIDS.SYS [2007-10-30 39856]
R3 SYMIDSCO;SYMIDSCO; \??\C:\PROGRA~1\FILECO~1\SYMANT~1\SymcData\idsdefs\20080917.005\SymIDSCo.sys []
R3 SYMNDIS;SYMNDIS; C:\WINDOWS\System32\Drivers\SYMNDIS.SYS [2007-10-30 35120]
R3 SYMREDRV;SYMREDRV; C:\WINDOWS\System32\Drivers\SYMREDRV.SYS [2007-10-30 27696]
R3 usbaudio;Philips USB Microphone; C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
R3 usbuhci;Driver Miniport Controller Universal Host USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 CCDECODE;Decoder sottotitoli codificati; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 MS1000;MS1000; C:\WINDOWS\System32\DRIVERS\MS1000.sys [2008-09-15 5376]
S3 MSTEE;Convertitore a T/Sito a sito per flusso Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Connesione TV/Video Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 nm;Driver di Network Monitor; C:\WINDOWS\system32\DRIVERS\NMnt.sys [2008-04-13 40320]
S3 PCASp50;PCASp50 NDIS Protocol Driver; C:\WINDOWS\System32\Drivers\PCASp50.sys [2004-09-07 17664]
S3 SDdriver;SDdriver; \??\C:\WINDOWS\system32\Drivers\sddriver.sys []
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 SRTSPL;SRTSPL; C:\WINDOWS\System32\Drivers\SRTSPL.SYS [2007-12-01 317616]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbscan;Driver scanner USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Driver archiviazione di massa USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 vaxscsi;vaxscsi; C:\WINDOWS\System32\Drivers\vaxscsi.sys []
S3 wceusbsh;Windows CE USB Serial Host Driver; C:\WINDOWS\system32\DRIVERS\wceusbsh.sys [2004-12-06 104064]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;Codec World Standard Teletext; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

List of services

R2 aawservice;Ad-Aware 2007 Service; C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe [2007-07-06 561152]
R2 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler; C:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2006-09-03 198336]
R2 ccEvtMgr;Symantec Event Manager; C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe [2006-10-28 107624]
R2 ccSetMgr;Symantec Settings Manager; C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe [2006-10-28 107624]
R2 CLTNetCnService;Symantec Lic NetConnect service; C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe [2006-10-28 107624]
R2 gusvc;Google Updater Service; C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-05-18 137200]
R2 LiveUpdate Notice Ex;LiveUpdate Notice Service Ex; C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe [2006-10-28 107624]
R2 NProtectService;Norton UnErase Protection; C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE [2005-11-04 95832]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2005-02-24 127043]
R2 Speed Disk service;Speed Disk service; C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE [2005-11-04 176193]
R2 SymAppCore;Symantec AppCore Service; C:\Programmi\File comuni\Symantec Shared\AppCore\AppSvc32.exe [2006-09-02 46736]
R2 WinDefend;Windows Defender; C:\Programmi\Windows Defender\MsMpEng.exe [2006-11-03 13592]
R2 wltrysvc;Broadcom Wireless LAN Tray Service; C:\WINDOWS\System32\WLTRYSVC.EXE [2006-10-12 20480]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 wwSecSvc;Washer AutoComplete; C:\WINDOWS\system32\wwSecure.exe [2005-04-20 487936]
R3 Symantec Core LC;Symantec Core LC; C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe [2008-01-24 1251720]
R3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Programmi\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
S2 LiveUpdate Notice Service;LiveUpdate Notice Service; C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2007-11-28 583048]
S3 Adobe LM Service;Adobe LM Service; C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe [2007-09-05 72704]
S3 aspnet_state;Servizio stato di ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 comHost;COM Host; C:\Programmi\File comuni\Symantec Shared\VAScanner\comHost.exe [2006-09-03 48272]
S3 IDriverT;InstallDriver Table Manager; C:\Programmi\File comuni\InstallShield\Driver\1150\Intel 32\IDriverT.exe [2005-11-14 69632]
S3 ISPwdSvc;Symantec IS Password Validation; C:\Programmi\Norton Internet Security\isPwdSvc.exe [2006-09-06 79496]
S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2006-09-03 2528960]
S3 NBService;NBService; C:\Programmi\Nero\Nero 7\Nero BackItUp\NBService.exe [2006-10-09 724992]
S3 ose;Office Source Engine; C:\Programmi\File comuni\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 WLSetupSvc;Windows Live Setup Service; C:\Programmi\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Programmi\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S3 WZCOOK;WEP/WPA-PMK key recovery service; C:\Documents and Settings\H18\Desktop\WiFi_WEP_Key_Finder\aircrack-ng-0.6.2-win\bin\wzcook.exe []

—————–EOF—————–

still on…

Rorschach112

Post #11September 19, 2008, 5:09 PM UTC

Try this

Please visit this web page for instructions for downloading and running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

This includes installing the Windows XP Recovery Console in case you have not installed it yet.

For more information on the Windows XP Recovery Console read http://support.microsoft.com/kb/314058.

Once you install the Recovery Console, when you reboot your computer, you'll see the option for the Recovery Console now as well. Don't select Recovery Console as we don't need it. By default, your main OS is selected there. The screen stays for 2 seconds and then it proceeds to load Windows. That is normal.

Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.

hangar18

Post #12September 19, 2008, 5:57 PM UTC

ComboFix 08-09-16.05 - H18 2008-09-19 19.32.00.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1253.30.1040.18.563 [GMT 2:00]
Eseguito da: C:\Documents and Settings\H18\Desktop\ComboFix.exe

ATENΗΓO - ESTA MAQUINA NAO TEM A CONSOLE DE RECUPERAΗΓO INSTALADA !!
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\H18\Documenti\BILL\Tshirts\DS2 lady\lady\_desktop.ini
C:\Documents and Settings\H18\Documenti\BILL\Tshirts\DS2 man\man\_desktop.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_NPF

((((((((((((((((((((((((( Files Creati Da 2008-08-19 al 2008-09-19 )))))))))))))))))))))))))))))))))))
.

2008-09-18 15:33 . 2008-09-18 15:35 d——– C:\Programmi\Malwarebytes' Anti-Malware
2008-09-18 15:33 . 2008-09-10 00:04 38,528 –a—— C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-18 15:33 . 2008-09-10 00:03 17,200 –a—— C:\WINDOWS\system32\drivers\mbam.sys
2008-09-18 12:29 . 2008-09-18 12:29 d——– C:\rsit
2008-09-18 12:13 . 2008-09-18 12:13 d——– C:\_OTMoveIt
2008-09-17 13:03 . 2008-09-17 13:03 3,504 –a—— C:\WINDOWS\system32\tmp.reg
2008-09-16 17:55 . 2008-09-16 17:55 d——– C:\Documents and Settings\H18\Dati applicazioni\Malwarebytes
2008-09-16 17:55 . 2008-09-16 17:55 d——– C:\Documents and Settings\All Users\Dati applicazioni\Malwarebytes
2008-09-16 17:32 . 2008-09-16 17:32 d——– C:\Programmi\Trend Micro
2008-09-15 21:05 . 2008-09-16 18:26 d——– C:\Programmi\The Cleaner Free
2008-09-15 21:05 . 2008-09-15 21:05 5,376 –a—— C:\WINDOWS\system32\drivers\MS1000.sys
2008-09-15 15:03 . 2008-09-15 15:03 d——– C:\Programmi\SUPERAntiSpyware
2008-09-15 15:03 . 2008-09-15 15:03 d——– C:\Documents and Settings\H18\Dati applicazioni\SUPERAntiSpyware.com
2008-09-15 15:03 . 2008-09-15 15:03 d——– C:\Documents and Settings\All Users\Dati applicazioni\SUPERAntiSpyware.com
2008-09-09 01:53 . 2008-09-09 01:53 d——– C:\WINDOWS\system32\it
2008-09-09 01:53 . 2008-09-09 01:53 d——– C:\WINDOWS\system32\bits
2008-09-09 01:53 . 2008-09-09 01:53 d——– C:\WINDOWS\l2schemas
2008-09-09 01:48 . 2008-09-09 01:53 d——– C:\WINDOWS\ServicePackFiles
2008-09-09 01:23 . 2004-08-03 22:41 1,309,184 ——— C:\WINDOWS\system32\drivers\mtlstrm.sys
2008-09-09 01:23 . 2004-08-03 22:41 1,041,536 ——— C:\WINDOWS\system32\drivers\hsfdpsp2.sys
2008-09-09 01:23 . 2004-08-03 22:41 685,056 ——— C:\WINDOWS\system32\drivers\hsfcxts2.sys
2008-09-09 01:23 . 2004-08-03 22:29 452,736 ——— C:\WINDOWS\system32\drivers\mtxparhm.sys
2008-09-09 01:23 . 2004-08-03 22:41 220,032 ——— C:\WINDOWS\system32\drivers\hsfbs2s2.sys
2008-09-09 01:23 . 2004-08-03 22:41 180,360 ——— C:\WINDOWS\system32\drivers\ntmtlfax.sys
2008-09-09 01:23 . 2004-07-17 22:55 129,045 ——— C:\WINDOWS\system32\drivers\cxthsfs2.cty
2008-09-09 01:23 . 2004-08-03 22:41 126,686 ——— C:\WINDOWS\system32\drivers\mtlmnt5.sys
2008-09-09 01:23 . 2004-07-17 11:35 67,866 ——— C:\WINDOWS\system32\drivers\netwlan5.img
2008-09-09 01:23 . 2004-08-03 22:41 13,776 ——— C:\WINDOWS\system32\drivers\recagent.sys
2008-09-09 01:23 . 2004-08-03 22:41 11,868 ——— C:\WINDOWS\system32\drivers\mdmxsdk.sys
2008-09-02 16:43 . 2008-09-02 16:45 d——– C:\Programmi\Spybot - Search & Destroy
2008-08-31 23:41 . 2008-04-11 21:04 691,712 —–c— C:\WINDOWS\system32\dllcache\inetcomm.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-19 17:39 ——— d—–w C:\Programmi\File comuni\Symantec Shared
2008-09-19 17:00 ——— d—a-w C:\Documents and Settings\All Users\Dati applicazioni\TEMP
2008-09-19 16:07 ——— d—–w C:\Documents and Settings\All Users\Dati applicazioni\Symantec
2008-09-19 11:55 ——— d—–w C:\Documents and Settings\All Users\Dati applicazioni\Google Updater
2008-09-18 10:08 ——— d—–w C:\Programmi\Java
2008-09-17 10:58 ——— d—–w C:\Documents and Settings\H18\Dati applicazioni\Azureus
2008-09-15 13:03 ——— d—–w C:\Programmi\File comuni\Wise Installation Wizard
2008-09-02 18:59 ——— d—–w C:\Documents and Settings\All Users\Dati applicazioni\Spybot - Search & Destroy
2008-09-01 16:52 ——— d—–w C:\Programmi\Microsoft ActiveSync
2008-09-01 16:20 ——— d—–w C:\Programmi\Opera
2008-08-31 21:47 ——— d—–w C:\Programmi\Google
2008-07-30 15:42 23,888 —-a-w C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-07-30 15:28 706 —-a-w C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-07-30 15:28 10,537 —-a-w C:\WINDOWS\system32\drivers\COH_Mon.cat
2008-07-29 07:04 ——— d—–w C:\Programmi\Norton Internet Security
2008-07-28 18:10 805 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-07-28 18:10 123,952 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-07-28 18:10 10,671 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-07-28 18:10 ——— d—–w C:\Programmi\Symantec
2008-01-28 22:16 32 —-a-w C:\Documents and Settings\All Users\Dati applicazioni\ezsid.dat
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"H/PC Connection Agent"="C:\Programmi\Microsoft ActiveSync\WCESCOMM.EXE" [2005-01-19 405583]
"MsnMsgr"="C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"SpybotSD TeaTimer"="C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 1832272]
"SUPERAntiSpyware"="C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-09-03 1576176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-02-24 5537792]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-02-24 86016]
"ccApp"="C:\Programmi\File comuni\Symantec Shared\ccApp.exe" [2006-10-28 107112]
"osCheck"="C:\Programmi\Norton Internet Security\osCheck.exe" [2006-09-06 26248]
"Symantec PIF AlertEng"="C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-11-28 583048]
"NSWosCheck"="C:\Programmi\Norton SystemWorks Premier\osCheck.exe" [2007-12-03 25472]
"USRobotics Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [2006-10-12 1290240]
"SunJavaUpdateSched"="C:\Programmi\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"nwiz"="nwiz.exe" [2005-02-24 C:\WINDOWS\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360]
"Symantec NetDriver Warning"="C:\PROGRA~1\SYMNET~1\SNDWarn.exe" [2004-10-29 218232]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Programmi\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-07-23 16:28 352256 C:\Programmi\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"= ctwdm32.dll
"VIDC.ACDV"= ACDV.dll
"MSACM.CEGSM"= mobilev.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programmi\\Real\\RealPlayer\\realplay.exe"=
"C:\\Programmi\\SopCast\\SopCast.exe"=
"C:\\Documents and Settings\\H18\\Dati applicazioni\\SopCast\\adv\\SopAdver.exe"=
"C:\\Programmi\\myTV\\myTV.exe"=
"C:\\Programmi\\Microsoft ActiveSync\\wcescomm.exe"=
"C:\\Programmi\\Microsoft ActiveSync\\WCESMgr.exe"=
"C:\\Programmi\\DC++\\DCPlusPlus.exe"=
"C:\\Programmi\\Skype\\Phone\\Skype.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Programmi\\Windows Live\\Messenger\\livecall.exe"=

R0 hpt3xx;hpt3xx;C:\WINDOWS\system32\drivers\hpt3xx.sys [2002-01-30 40037]
R0 hptpro;hptpro;C:\WINDOWS\system32\drivers\hptpro.sys [2002-01-21 9490]
R3 camvid20;Philips ToUcam Camera; Video;C:\WINDOWS\system32\DRIVERS\camdrv21.sys [ ]
S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\PCASp50.sys [2004-09-07 17664]
S3 WZCOOK;WEP/WPA-PMK key recovery service;C:\Documents and Settings\H18\Desktop\WiFi_WEP_Key_Finder\aircrack-ng-0.6.2-win\bin\wzcook.exe [ ]

*Newly Created Service* - COMHOST
.
Contenuto della cartella 'Scheduled Tasks'
.
- - - - ORF‚OS REMOVIDOS - - - -

HKLM-Run-\YUR4C8.exe - C:\Windows\system32\YUR4C8.exe
HKLM-Run-\YUR4.exe - C:\Windows\system32\YUR4.exe
HKLM-Run-\YUR4C7.exe - C:\Windows\system32\YUR4C7.exe
HKLM-Run-\YUR4C9.exe - C:\Windows\system32\YUR4C9.exe
HKLM-Run-\YUR4CA.exe - C:\Windows\system32\YUR4CA.exe
HKLM-Run-\YUR3.exe - C:\Windows\system32\YUR3.exe
HKLM-Run-\YUR1.exe - C:\Windows\system32\YUR1.exe
HKLM-Run-\YUR2.exe - C:\Windows\system32\YUR2.exe

.
——- Supplementary Scan ——-
.
FireFox -: Profile - C:\Documents and Settings\H18\Dati applicazioni\Mozilla\Firefox\Profiles\lzo7tgox.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - www.alpha.gr
FF -: plugin - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\browser\nppdf32.dll
FF -: plugin - C:\Programmi\DivX\DivX Content Uploader\npUpload.dll
FF -: plugin - C:\Programmi\Google\Google Updater\2.2.1229.1533\npCIDetect11.dll
FF -: plugin - C:\Programmi\Opera\program\plugins\npdivx32.dll
FF -: plugin - C:\Programmi\Opera\program\plugins\NPSWF32_back.dll
FF -: plugin - C:\Programmi\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-19 19:40:17
Windows 5.1.2600 Service Pack 3 NTFS

scansione processi nascosti …

scansione entrate autostart nascoste …

Scansione files nascosti …

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
——————— DLLs Carregadas Sob os Processos em Execužšo ———————

PROCESS: C:\WINDOWS\explorer.exe
-> ?:\WINDOWS\system32\MLANG.dll
.
———————— Other Running Processes ————————
.
C:\Programmi\Windows Defender\MsMpEng.exe
C:\WINDOWS\system32\WLTRYSVC.EXE
C:\WINDOWS\system32\BCMWLTRY.EXE
C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
C:\Programmi\File comuni\Symantec Shared\AppCore\AppSvc32.exe
C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Programmi\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.exe
C:\WINDOWS\system32\wwSecure.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\rundll32.exe
.
**************************************************************************
.
Ora fine scansione: 2008-09-19 19:51:33 - machine was rebooted
ComboFix-quarantined-files.txt 2008-09-19 17:51:26

Pre-Run: 896,249,856 byte disponibili
Post-Run: 1,292,341,248 byte disponibili

191 — E O F — 2008-09-19 11:58:32

also the this :

Logfile of random's system information tool 1.01 (written by random/random)
Run by [removed] at 2008-09-19 19:56:32
Microsoft Windows XP Professional Service Pack 3
System drive C: has 2 GB (4%) free of 46 GB
Total RAM: 1023 MB (41% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:56:54, on 19/09/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
C:\Programmi\File comuni\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wwSecure.exe
C:\WINDOWS\system32\devldr32.exe
C:\Programmi\File comuni\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Programmi\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Microsoft ActiveSync\WCESCOMM.EXE
C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe
C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\explorer.exe
C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Windows Live\Messenger\usnsvc.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Programmi\Symantec\LiveUpdate\AUPDATE.EXE
C:\Programmi\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Programmi\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Programmi\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Programmi\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Programmi\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Programmi\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Documents and Settings\H18\Desktop\RSIT.exe
C:\Programmi\Trend Micro\HijackThis\H18.exe
C:\Programmi\Webroot\Washer\wwShred.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Programmi\File comuni\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: (no name) - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - (no file)
O2 - BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Encarta Web Companion Oggetto helper - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Programmi\File comuni\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: Encarta Web Companion - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Programmi\File comuni\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Systran40premi.IEPlugIn - {D3919E1A-D6A5-11D6-AC3E-00B0D094B576} - C:\Programmi\Systran\4_0\Premium\IEPlugIn.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Programmi\File comuni\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Programmi\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Programmi\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [NSWosCheck] C:\Programmi\Norton SystemWorks Premier\osCheck.exe
O4 - HKLM\..\Run: [USRobotics Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [\YUR4C8.exe] C:\Windows\system32\YUR4C8.exe
O4 - HKLM\..\Run: [\YUR4.exe] C:\Windows\system32\YUR4.exe
O4 - HKLM\..\Run: [\YUR4C7.exe] C:\Windows\system32\YUR4C7.exe
O4 - HKLM\..\Run: [\YUR4C9.exe] C:\Windows\system32\YUR4C9.exe
O4 - HKLM\..\Run: [\YUR4CA.exe] C:\Windows\system32\YUR4CA.exe
O4 - HKLM\..\Run: [\YUR3.exe] C:\Windows\system32\YUR3.exe
O4 - HKLM\..\Run: [\YUR1.exe] C:\Windows\system32\YUR1.exe
O4 - HKLM\..\Run: [\YUR2.exe] C:\Windows\system32\YUR2.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programmi\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: O?iana.lnk
O8 - Extra context menu item: &Download; All with Rapidshare Downloader - C:\DOCUME~1\H18\IMPOST~1\Temp\RarSFX0\jc_all.htm
O8 - Extra context menu item: &Download; with Rapidshare Downloader - C:\DOCUME~1\H18\IMPOST~1\Temp\RarSFX0\jc_link.htm
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Crea preferiti portatile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Programmi\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programmi\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Crea preferiti portatile… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programmi\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Programmi\Norton SystemWorks Premier\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Programmi\Norton SystemWorks Premier\Norton Cleanup\WCQuick.lnk
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Barra di ricerca di Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programmi\File comuni\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{AD81C8A6-4507-4E78-9486-F9D0B6A49758}: NameServer = 213.215.115.88,147.175.167.50
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Programmi\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Programmi\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NBService - Nero AG - C:\Programmi\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Unknown owner - C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
O23 - Service: Washer AutoComplete (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe
O23 - Service: WEP/WPA-PMK key recovery service (WZCOOK) - Unknown owner - C:\Documents and Settings\H18\Desktop\WiFi_WEP_Key_Finder\aircrack-ng-0.6.2-win\bin\wzcook.exe (file missing)

–
End of file - 13517 bytes

Scheduled tasks folder

C:\WINDOWS\tasks\MP Scheduled Scan.job
C:\WINDOWS\tasks\Norton Internet Security - Run Full System Scan - H18.job
C:\WINDOWS\tasks\Norton SystemWorks One Button Checkup.job

Registry dump

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E8A6170-7264-4D0F-BEAE-D42A53123C75}]
C:\Programmi\File comuni\Symantec Shared\coShared\Browser\1.0\NppBho.dll [2006-09-06 93400]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D; IE Protection - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll [2008-07-07 1562448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{955BE0B8-BC85-4CAF-856E-8E0D8B610560}]
Encarta Web Companion Oggetto helper - C:\Programmi\File comuni\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL [2006-06-13 256792]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
AcroIEToolbarHelper Class - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2004-12-14 225280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Programmi\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll [2008-05-18 654320]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{147D6308-0614-4112-89B1-31402F9B82C4} - Encarta Web Companion - C:\Programmi\File comuni\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL [2006-06-13 256792]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2004-12-14 225280]
{D3919E1A-D6A5-11D6-AC3E-00B0D094B576} - Systran40premi.IEPlugIn - C:\Programmi\Systran\4_0\Premium\IEPlugIn.dll [2002-10-03 73728]
{90222687-F593-4738-B738-FBEE9C7B26DF} - Show Norton Toolbar - C:\Programmi\File comuni\Symantec Shared\coShared\Browser\1.0\UIBHO.dll [2006-09-06 510152]
{D0943516-5076-4020-A3B5-AEFAF26AB263} - Veoh Browser Plug-in - C:\Programmi\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll [2008-04-01 352256]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2005-02-24 5537792]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2005-02-24 86016]
"ccApp"=C:\Programmi\File comuni\Symantec Shared\ccApp.exe [2006-10-28 107112]
"osCheck"=C:\Programmi\Norton Internet Security\osCheck.exe [2006-09-06 26248]
"Symantec PIF AlertEng"=C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2007-11-28 583048]
"NSWosCheck"=C:\Programmi\Norton SystemWorks Premier\osCheck.exe [2007-12-03 25472]
"USRobotics Wireless Manager UI"=C:\WINDOWS\system32\WLTRAY.exe [2006-10-12 1290240]
"SunJavaUpdateSched"=C:\Programmi\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
"\YUR4C8.exe"=C:\Windows\system32\YUR4C8.exe []
"\YUR4.exe"=C:\Windows\system32\YUR4.exe []
"\YUR4C7.exe"=C:\Windows\system32\YUR4C7.exe []
"\YUR4C9.exe"=C:\Windows\system32\YUR4C9.exe []
"\YUR4CA.exe"=C:\Windows\system32\YUR4CA.exe []
"\YUR3.exe"=C:\Windows\system32\YUR3.exe []
"\YUR1.exe"=C:\Windows\system32\YUR1.exe []
"\YUR2.exe"=C:\Windows\system32\YUR2.exe []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"H/PC Connection Agent"=C:\Programmi\Microsoft ActiveSync\WCESCOMM.EXE [2005-01-19 405583]
"MsnMsgr"=C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe [2007-10-18 5724184]
"SpybotSD TeaTimer"=C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe [2008-08-18 1832272]
"SUPERAntiSpyware"=C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe [2008-09-03 1576176]

C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica
O?iana.lnk - C:\Programmi\Today\TODAY.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Programmi\SUPERAntiSpyware\SASWINLO.dll [2008-07-23 352256]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"=C:\PROGRA~1\WIFD1F~1\MpShHook.dll [2006-11-03 83224]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Programmi\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinDefend]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Programmi\Real\RealPlayer\realplay.exe"="C:\Programmi\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer"
"C:\Programmi\SopCast\SopCast.exe"="C:\Programmi\SopCast\SopCast.exe:*:Enabled:SopCast Main Application"
"C:\Documents and Settings\H18\Dati applicazioni\SopCast\adv\SopAdver.exe"="C:\Documents and Settings\H18\Dati applicazioni\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver"
"C:\Programmi\myTV\myTV.exe"="C:\Programmi\myTV\myTV.exe:*:Enabled:myTV"
"C:\Programmi\Microsoft ActiveSync\wcescomm.exe"="C:\Programmi\Microsoft ActiveSync\wcescomm.exe:*:Enabled:ActiveSync Connection Manager"
"C:\Programmi\Microsoft ActiveSync\WCESMgr.exe"="C:\Programmi\Microsoft ActiveSync\WCESMgr.exe:*:Enabled:ActiveSync Application"
"C:\Programmi\DC++\DCPlusPlus.exe"="C:\Programmi\DC++\DCPlusPlus.exe:*:Enabled:DC++"
"C:\Programmi\Skype\Phone\Skype.exe"="C:\Programmi\Skype\Phone\Skype.exe:*:Enabled:Skype. The whole world can talk for free."
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Programmi\Windows Live\Messenger\msnmsgr.exe"="C:\Programmi\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Programmi\Windows Live\Messenger\livecall.exe"="C:\Programmi\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Programmi\Windows Live\Messenger\msnmsgr.exe"="C:\Programmi\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Programmi\Windows Live\Messenger\livecall.exe"="C:\Programmi\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

List of files/folders created in the last three months

2008-09-19 19:51:38 —-D—- C:\WINDOWS\temp
2008-09-19 19:51:34 —-A—- C:\ComboFix.txt
2008-09-19 19:31:38 —-D—- C:\WINDOWS\erdnt
2008-09-19 19:31:27 —-D—- C:\QooBox
2008-09-19 19:31:25 —-A—- C:\WINDOWS\zip.exe
2008-09-19 19:31:25 —-A—- C:\WINDOWS\VFind.exe
2008-09-19 19:31:25 —-A—- C:\WINDOWS\swxcacls.exe
2008-09-19 19:31:25 —-A—- C:\WINDOWS\swsc.exe
2008-09-19 19:31:25 —-A—- C:\WINDOWS\swreg.exe
2008-09-19 19:31:25 —-A—- C:\WINDOWS\sed.exe
2008-09-19 19:31:25 —-A—- C:\WINDOWS\Nircmd.exe
2008-09-19 19:31:25 —-A—- C:\WINDOWS\grep.exe
2008-09-19 19:31:25 —-A—- C:\WINDOWS\fdsv.exe
2008-09-19 19:31:21 —-D—- C:\ComboFix
2008-09-19 18:16:52 —-RASHD—- C:\autorun.inf
2008-09-18 15:33:38 —-D—- C:\Programmi\Malwarebytes' Anti-Malware
2008-09-18 12:29:00 —-D—- C:\rsit
2008-09-18 12:13:06 —-D—- C:\_OTMoveIt
2008-09-18 11:55:13 —-D—- C:\WINDOWS\system32\appmgmt
2008-09-17 13:03:20 —-A—- C:\WINDOWS\system32\tmp.txt
2008-09-16 17:55:34 —-D—- C:\Documents and Settings\H18\Dati applicazioni\Malwarebytes
2008-09-16 17:55:28 —-D—- C:\Documents and Settings\All Users\Dati applicazioni\Malwarebytes
2008-09-16 17:32:35 —-D—- C:\Programmi\Trend Micro
2008-09-15 21:05:04 —-D—- C:\Programmi\The Cleaner Free
2008-09-15 15:03:23 —-D—- C:\Documents and Settings\All Users\Dati applicazioni\SUPERAntiSpyware.com
2008-09-15 15:03:14 —-D—- C:\Programmi\SUPERAntiSpyware
2008-09-15 15:03:14 —-D—- C:\Documents and Settings\H18\Dati applicazioni\SUPERAntiSpyware.com
2008-09-10 16:08:14 —-HDC—- C:\WINDOWS\$NtUninstallKB938464$
2008-09-10 16:07:20 —-HDC—- C:\WINDOWS\$NtUninstallKB954154_WM11$
2008-09-09 12:07:34 —-HDC—- C:\WINDOWS\$NtUninstallKB951978$
2008-09-09 11:41:49 —-D—- C:\WINDOWS\Prefetch
2008-09-09 02:02:51 —-HDC—- C:\WINDOWS\$NtUninstallKB952954$
2008-09-09 02:02:39 —-HDC—- C:\WINDOWS\$NtUninstallKB952287$
2008-09-09 02:02:17 —-HDC—- C:\WINDOWS\$NtUninstallKB951748$
2008-09-09 02:02:02 —-HDC—- C:\WINDOWS\$NtUninstallKB951698$
2008-09-09 02:01:50 —-HDC—- C:\WINDOWS\$NtUninstallKB951376-v2$
2008-09-09 02:01:37 —-HDC—- C:\WINDOWS\$NtUninstallKB951376$
2008-09-09 02:01:21 —-HDC—- C:\WINDOWS\$NtUninstallKB951066$
2008-09-09 02:01:07 —-HDC—- C:\WINDOWS\$NtUninstallKB950974$
2008-09-09 02:00:54 —-HDC—- C:\WINDOWS\$NtUninstallKB950762$
2008-09-09 02:00:38 —-HDC—- C:\WINDOWS\$NtUninstallKB946648$
2008-09-09 01:53:16 —-D—- C:\WINDOWS\l2schemas
2008-09-09 01:53:15 —-D—- C:\WINDOWS\system32\it
2008-09-09 01:53:14 —-D—- C:\WINDOWS\system32\bits
2008-09-09 01:48:22 —-D—- C:\WINDOWS\ServicePackFiles
2008-09-09 01:45:54 —-D—- C:\WINDOWS\network diagnostic
2008-09-09 01:40:45 —-HDC—- C:\WINDOWS\$NtServicePackUninstall$
2008-09-02 16:43:04 —-D—- C:\Programmi\Spybot - Search & Destroy
2008-09-01 00:45:08 —-HDC—- C:\WINDOWS\$NtUninstallKB952954_0$
2008-09-01 00:45:00 —-HDC—- C:\WINDOWS\$NtUninstallKB946648_0$
2008-09-01 00:44:53 —-HDC—- C:\WINDOWS\$NtUninstallKB953839$
2008-09-01 00:44:45 —-HDC—- C:\WINDOWS\$NtUninstallKB950974_0$
2008-09-01 00:43:11 —-HDC—- C:\WINDOWS\$NtUninstallKB951072-v2$
2008-09-01 00:43:02 —-HDC—- C:\WINDOWS\$NtUninstallKB952287_0$
2008-09-01 00:42:17 —-HDC—- C:\WINDOWS\$NtUninstallKB951066_0$
2008-07-09 16:10:46 —-A—- C:\WINDOWS\system32\javaws.exe
2008-07-09 16:10:46 —-A—- C:\WINDOWS\system32\javaw.exe
2008-07-09 16:10:46 —-A—- C:\WINDOWS\system32\java.exe
2008-07-09 09:09:26 —-HDC—- C:\WINDOWS\$NtUninstallKB951748_0$
2008-06-26 15:15:58 —-HDC—- C:\WINDOWS\$NtUninstallKB951376-v2_0$

List of drivers

R1 AmdK7;Driver del processore AMD K7; C:\WINDOWS\system32\DRIVERS\amdk7.sys [2008-04-14 41728]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Programmi\File comuni\Symantec Shared\EENGINE\eeCtrl.sys []
R1 SASDIFSV;SASDIFSV; \??\C:\Programmi\SUPERAntiSpyware\SASDIFSV.SYS []
R1 SASKUTIL;SASKUTIL; \??\C:\Programmi\SUPERAntiSpyware\SASKUTIL.sys []
R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2005-10-16 27171]
R1 SPBBCDrv;SPBBCDrv; \??\C:\Programmi\File comuni\Symantec Shared\SPBBC\SPBBCDrv.sys []
R1 SRTSP;SRTSP; C:\WINDOWS\System32\Drivers\SRTSP.SYS [2007-12-01 279088]
R1 SRTSPX;SRTSPX; C:\WINDOWS\System32\Drivers\SRTSPX.SYS [2007-12-01 43696]
R1 SYMTDI;SYMTDI; C:\WINDOWS\System32\Drivers\SYMTDI.SYS [2007-10-30 191536]
R2 usbhub;Ph USB Standard Hub Driver; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 BCM43XX;U.S. Robotics Wireless MAXg Adapter; C:\WINDOWS\system32\DRIVERS\bcmwl5.sys [2006-10-12 604928]
R3 camvid20;Philips ToUcam Camera; Video; C:\WINDOWS\system32\DRIVERS\camdrv21.sys [2001-12-10 253909]
R3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
R3 ctljystk;Creative SBLive! Porta giochi; C:\WINDOWS\system32\DRIVERS\ctljystk.sys [2001-08-17 3712]
R3 dtscsi;dtscsi; C:\WINDOWS\System32\Drivers\dtscsi.sys [2007-01-21 223128]
R3 emu10k;Creative SB Live! (WDM); C:\WINDOWS\system32\drivers\emu10k1m.sys [2001-08-17 283904]
R3 emu10k1;Driver per Creative Interface Manager (WDM); C:\WINDOWS\system32\drivers\ctlfacem.sys [2001-08-17 6912]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Programmi\File comuni\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys []
R3 NAVENG;NAVENG; \??\C:\PROGRA~1\FILECO~1\SYMANT~1\VIRUSD~1\20080919.007\NAVENG.SYS []
R3 NAVEX15;NAVEX15; \??\C:\PROGRA~1\FILECO~1\SYMANT~1\VIRUSD~1\20080919.007\NAVEX15.SYS []
R3 NPDriver;Norton UnErase Protection Driver; \??\C:\WINDOWS\system32\Drivers\NPDRIVER.SYS []
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2005-02-24 3454144]
R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2007-01-21 10368]
R3 rtl8139;Driver NT scheda Fast Ethernet PCI Realtek basata su RTL8139; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-04 20992]
R3 SASENUM;SASENUM; \??\C:\Programmi\SUPERAntiSpyware\SASENUM.SYS []
R3 sfman;Driver per Creative SoundFont Manager (WDM); C:\WINDOWS\system32\drivers\sfmanm.sys [2001-08-17 36480]
R3 SYMDNS;SYMDNS; C:\WINDOWS\System32\Drivers\SYMDNS.SYS [2007-10-30 12848]
R3 SymEvent;SymEvent; \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS []
R3 SYMFW;SYMFW; C:\WINDOWS\System32\Drivers\SYMFW.SYS [2007-10-30 145968]
R3 SYMIDS;SYMIDS; C:\WINDOWS\System32\Drivers\SYMIDS.SYS [2007-10-30 39856]
R3 SYMIDSCO;SYMIDSCO; \??\C:\PROGRA~1\FILECO~1\SYMANT~1\SymcData\idsdefs\20080917.005\SymIDSCo.sys []
R3 SYMNDIS;SYMNDIS; C:\WINDOWS\System32\Drivers\SYMNDIS.SYS [2007-10-30 35120]
R3 SYMREDRV;SYMREDRV; C:\WINDOWS\System32\Drivers\SYMREDRV.SYS [2007-10-30 27696]
R3 usbaudio;Philips USB Microphone; C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
R3 usbuhci;Driver Miniport Controller Universal Host USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 CCDECODE;Decoder sottotitoli codificati; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 MS1000;MS1000; C:\WINDOWS\System32\DRIVERS\MS1000.sys [2008-09-15 5376]
S3 MSTEE;Convertitore a T/Sito a sito per flusso Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Connesione TV/Video Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 nm;Driver di Network Monitor; C:\WINDOWS\system32\DRIVERS\NMnt.sys [2008-04-13 40320]
S3 PCASp50;PCASp50 NDIS Protocol Driver; C:\WINDOWS\System32\Drivers\PCASp50.sys [2004-09-07 17664]
S3 SDdriver;SDdriver; \??\C:\WINDOWS\system32\Drivers\sddriver.sys []
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 SRTSPL;SRTSPL; C:\WINDOWS\System32\Drivers\SRTSPL.SYS [2007-12-01 317616]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbscan;Driver scanner USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Driver archiviazione di massa USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 vaxscsi;vaxscsi; C:\WINDOWS\System32\Drivers\vaxscsi.sys []
S3 wceusbsh;Windows CE USB Serial Host Driver; C:\WINDOWS\system32\DRIVERS\wceusbsh.sys [2004-12-06 104064]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;Codec World Standard Teletext; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

List of services

R2 aawservice;Ad-Aware 2007 Service; C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe [2007-07-06 561152]
R2 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler; C:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2006-09-03 198336]
R2 ccEvtMgr;Symantec Event Manager; C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe [2006-10-28 107624]
R2 ccSetMgr;Symantec Settings Manager; C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe [2006-10-28 107624]
R2 CLTNetCnService;Symantec Lic NetConnect service; C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe [2006-10-28 107624]
R2 gusvc;Google Updater Service; C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-05-18 137200]
R2 LiveUpdate Notice Ex;LiveUpdate Notice Service Ex; C:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe [2006-10-28 107624]
R2 NProtectService;Norton UnErase Protection; C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE [2005-11-04 95832]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2005-02-24 127043]
R2 Speed Disk service;Speed Disk service; C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE [2005-11-04 176193]
R2 SymAppCore;Symantec AppCore Service; C:\Programmi\File comuni\Symantec Shared\AppCore\AppSvc32.exe [2006-09-02 46736]
R2 WinDefend;Windows Defender; C:\Programmi\Windows Defender\MsMpEng.exe [2006-11-03 13592]
R2 wltrysvc;Broadcom Wireless LAN Tray Service; C:\WINDOWS\System32\WLTRYSVC.EXE [2006-10-12 20480]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 wwSecSvc;Washer AutoComplete; C:\WINDOWS\system32\wwSecure.exe [2005-04-20 487936]
R3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2006-09-03 2528960]
R3 Symantec Core LC;Symantec Core LC; C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe [2008-01-24 1251720]
R3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Programmi\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
S2 LiveUpdate Notice Service;LiveUpdate Notice Service; C:\Programmi\File comuni\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2007-11-28 583048]
S3 Adobe LM Service;Adobe LM Service; C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe [2007-09-05 72704]
S3 aspnet_state;Servizio stato di ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 comHost;COM Host; C:\Programmi\File comuni\Symantec Shared\VAScanner\comHost.exe [2006-09-03 48272]
S3 IDriverT;InstallDriver Table Manager; C:\Programmi\File comuni\InstallShield\Driver\1150\Intel 32\IDriverT.exe [2005-11-14 69632]
S3 ISPwdSvc;Symantec IS Password Validation; C:\Programmi\Norton Internet Security\isPwdSvc.exe [2006-09-06 79496]
S3 NBService;NBService; C:\Programmi\Nero\Nero 7\Nero BackItUp\NBService.exe [2006-10-09 724992]
S3 ose;Office Source Engine; C:\Programmi\File comuni\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 WLSetupSvc;Windows Live Setup Service; C:\Programmi\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Programmi\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S3 WZCOOK;WEP/WPA-PMK key recovery service; C:\Documents and Settings\H18\Desktop\WiFi_WEP_Key_Finder\aircrack-ng-0.6.2-win\bin\wzcook.exe []

—————–EOF—————–

Rorschach112

Post #13September 20, 2008, 12:18 AM UTC

Hello

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

File::

Folder::

Registry::
O4 - HKLM\..\Run: [\YUR4C8.exe] C:\Windows\system32\YUR4C8.exe
O4 - HKLM\..\Run: [\YUR4.exe] C:\Windows\system32\YUR4.exe
O4 - HKLM\..\Run: [\YUR4C7.exe] C:\Windows\system32\YUR4C7.exe
O4 - HKLM\..\Run: [\YUR4C9.exe] C:\Windows\system32\YUR4C9.exe
O4 - HKLM\..\Run: [\YUR4CA.exe] C:\Windows\system32\YUR4CA.exe
O4 - HKLM\..\Run: [\YUR3.exe] C:\Windows\system32\YUR3.exe
O4 - HKLM\..\Run: [\YUR1.exe] C:\Windows\system32\YUR1.exe
O4 - HKLM\..\Run: [\YUR2.exe] C:\Windows\system32\YUR2.exe

Sysrst::

Driver::

Save this as CFScript.txt, in the same location as ComboFix.exe

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

Doubleclick the drweb-cureit.exe file and Allow to run the express scan
This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
Once the short scan has finished, mark the drives that you want to scan.
Select all drives. A red dot shows which drives have been chosen.
Click the green arrow at the right, and the scan will start.
Click 'Yes to all' if it asks if you want to cure/move the file.
When the scan has finished, in the menu, click file and choose save report list
Save the report to your desktop. The report will be called DrWeb.csv
Close Dr.Web Cureit.

Also post a new HJT log

Rorschach112

Post #14September 23, 2008, 9:03 PM UTC

Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log

[Closed] Help Needed - Got infected with Yur.exe

✨ Ask AI

Ask AI