Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Can't open My Documents, ZIP files, and drag to Recycle Bin [RESOL

Started by Tw@in 28 , May 29 2008 09:14 AM

  • This topic is locked This topic is locked

#1
Tw@in 28
Posted 29 May 2008 - 09:14 AM

Tw@in 28

    New Member

  • Member
  • Pip
  • 8 posts
Hello everybody, I do hope someone might help me here....
The facts: Since 24 hours ago, my pc is acting strangely.

"My Documents" desktop shortcut won't work (I can't open them using doubleclick, and rightclicking it brings up nothing). I can reach its contents, though, using the shortcut inside "My Computer", but I'd like to have my shortcut back working.

I can't directly open any ZIP file....I'm using Izarc, but even if I change file association and try to use MS compressed folders utility, neither doubleclicking or rightclicking does the trick. Again, I can reach their contents by opening Izarc and browsing my HD to locate and open them allright.

Drag and drop files to my Recycle Bin doesn't work anymore....What the...? :)

I'm brought to believe this is related to some infection I might have caught online, but I really can't understand what kind of it!
Scanned my pc with Kaspersky 6 removed a few low viruses, I run SpyBot and no infection shows, Ad-Aware spotted only a few low-warnings I deleted, SpySweeper one low threat, Ewido Micro another few small ones.
Here's my current HijackThis! log....as you can see, quite a clean one....

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13.28.24, on 29/05/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
J:\WINDOWS\System32\smss.exe
J:\WINDOWS\system32\winlogon.exe
J:\WINDOWS\system32\services.exe
J:\WINDOWS\system32\lsass.exe
J:\WINDOWS\system32\svchost.exe
J:\WINDOWS\System32\svchost.exe
J:\WINDOWS\system32\svchost.exe
J:\WINDOWS\system32\spoolsv.exe
J:\WINDOWS\Explorer.EXE
J:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
J:\WINDOWS\system32\rundll32.exe
J:\WINDOWS\system32\Rundll32.exe
J:\Programmi\LClock\lclock.exe
J:\Programmi\Microsoft ActiveSync\Wcescomm.exe
J:\PROGRA~1\MI3AA1~1\rapimgr.exe
J:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
J:\WINDOWS\system32\nvsvc32.exe
J:\Programmi\Raxco\PerfectDisk\PD91Agent.exe
J:\WINDOWS\system32\svchost.exe
J:\WINDOWS\system32\Tablet.exe
J:\WINDOWS\System32\svchost.exe
J:\Programmi\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
J:\Programmi\Mozilla Thunderbird\thunderbird.exe
J:\Programmi\Mozilla Firefox\firefox.exe
J:\Programmi\PeerGuardian2\pg2.exe
J:\Programmi\Halite\Halite.exe
C:\Hijack This\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - J:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - J:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - j:\programmi\google\googletoolbar3.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - j:\programmi\google\googletoolbar3.dll
O4 - HKLM\..\Run: [AVP] "J:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] "rundll32.exe" bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [CTSysVol] hstart /NOWINDOW /D=J:\Programmi\Creative "J:\Programmi\Creative\CTSysVol.bat"
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" J:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [BootSkin Startup Jobs] "J:\Programmi\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKLM\..\Run: [KernelFaultCheck] J:\WINDOWS\system32\dumprep 0 -k
O4 - HKCU\..\Run: [LClock] J:\Programmi\LClock\lclock.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "J:\Programmi\Microsoft ActiveSync\Wcescomm.exe"
O4 - Global Startup: StartupFaster
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://J:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - J:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - J:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Anti-virus web - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - J:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - J:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - J:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Crea preferiti portatile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - J:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - J:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - J:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - J:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - J:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - J:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - J:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15031/CTSUEng.cab
O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1201336318593
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1145477730062
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15033/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0ADBE9E5-66FE-4C2E-8151-7F56BD92FE2E}: NameServer = 194.243.154.62,212.216.112.112,212.216.172.62,195.31.190.31
O17 - HKLM\System\CS1\Services\Tcpip\..\{0ADBE9E5-66FE-4C2E-8151-7F56BD92FE2E}: NameServer = 194.243.154.62,212.216.112.112,212.216.172.62,195.31.190.31
O17 - HKLM\System\CS2\Services\Tcpip\..\{0ADBE9E5-66FE-4C2E-8151-7F56BD92FE2E}: NameServer = 194.243.154.62,212.216.112.112,212.216.172.62,195.31.190.31
O17 - HKLM\System\CS3\Services\Tcpip\..\{0ADBE9E5-66FE-4C2E-8151-7F56BD92FE2E}: NameServer = 194.243.154.62,212.216.112.112,212.216.172.62,195.31.190.31
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - J:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - J:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - J:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - J:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - J:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PD91Agent - Raxco Software, Inc. - J:\Programmi\Raxco\PerfectDisk\PD91Agent.exe
O23 - Service: PD91Engine - Raxco Software, Inc. - J:\Programmi\Raxco\PerfectDisk\PD91Engine.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - J:\Programmi\WinPcap\rpcapd.exe
O23 - Service: ServiceLayer - Nokia. - J:\Programmi\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TabletService - Wacom Technology, Corp. - J:\WINDOWS\system32\Tablet.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - J:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - J:\Programmi\File comuni\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 7356 bytes

Hope you can Help me.... :)
  • 0

Advertisements

#2
Rorschach112
Posted 02 June 2008 - 08:50 AM

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
Don't put the logs in quotes

Do you have the Kaspersky log ?


Please download Deckard's System Scanner (DSS) and save it to your Desktop.
  • Close all other windows before proceeding.
  • Double-click on dss.exe and follow the prompts.
  • If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
  • When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.

  • 0

#3
Tw@in 28
Posted 02 June 2008 - 02:49 PM

Tw@in 28

    New Member

  • Topic Starter
  • Member
  • Pip
  • 8 posts
Hi, Rorschach112!
First of all, thanks for your answer.
Here folows the logs you requested.

Main.txt:
"Deckard's System Scanner v20071014.68
Run by Tw@in 28 on 2008-06-02 22:25:55
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
106: 2008-06-02 20:26:04 UTC - RP1061 - Deckard's System Scanner Restore Point
105: 2008-06-02 20:21:26 UTC - RP1060 - Operazione di ripristino
104: 2008-06-02 13:03:45 UTC - RP1059 - Istanza di Kaspersky Internet Security 7.0 installata.
103: 2008-06-02 12:53:15 UTC - RP1058 - Installed AVG 8.0
102: 2008-06-02 12:52:22 UTC - RP1057 - Removed AVG 8.0


-- First Restore Point --
1: 2008-03-17 13:02:57 UTC - RP956 - Punto di arresto del sistema


Backed up registry hives.
Performed disk cleanup.



-- HijackThis (run as Tw@in 28.exe) --------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22.27.25, on 02/06/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
J:\WINDOWS\System32\smss.exe
J:\WINDOWS\system32\winlogon.exe
J:\WINDOWS\system32\services.exe
J:\WINDOWS\system32\lsass.exe
J:\WINDOWS\system32\svchost.exe
J:\WINDOWS\System32\svchost.exe
J:\WINDOWS\system32\svchost.exe
J:\WINDOWS\system32\spoolsv.exe
J:\WINDOWS\Explorer.EXE
J:\Programmi\Kaspersky Internet Security\avp.exe
J:\WINDOWS\system32\nvsvc32.exe
J:\Programmi\Raxco\PerfectDisk\PD91Agent.exe
J:\WINDOWS\system32\svchost.exe
J:\WINDOWS\system32\Tablet.exe
J:\WINDOWS\system32\rundll32.exe
J:\WINDOWS\system32\Rundll32.exe
J:\Programmi\Kaspersky Internet Security\avp.exe
J:\Programmi\LClock\lclock.exe
J:\Programmi\Microsoft ActiveSync\Wcescomm.exe
J:\PROGRA~1\MI3AA1~1\rapimgr.exe
J:\WINDOWS\System32\svchost.exe
J:\Programmi\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
J:\dss.exe
C:\HIJACK~1\Tw@in 28.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - J:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - J:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - j:\programmi\google\googletoolbar3.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - j:\programmi\google\googletoolbar3.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] "rundll32.exe" bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [CTSysVol] hstart /NOWINDOW /D=J:\Programmi\Creative "J:\Programmi\Creative\CTSysVol.bat"
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" J:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [BootSkin Startup Jobs] "J:\Programmi\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKLM\..\Run: [AVP] "J:\Programmi\Kaspersky Internet Security\avp.exe"
O4 - HKCU\..\Run: [LClock] J:\Programmi\LClock\lclock.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "J:\Programmi\Microsoft ActiveSync\Wcescomm.exe"
O4 - Global Startup: StartupFaster
O8 - Extra context menu item: Aggiungi ad Anti-Banner - J:\Programmi\Kaspersky Internet Security\ie_banner_deny.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://J:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - J:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - J:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - J:\Programmi\Kaspersky Internet Security\SCIEPlgn.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - J:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - J:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Crea preferiti portatile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - J:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - J:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - J:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - J:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - J:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - J:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - J:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative....031/CTSUEng.cab
O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://catalog.updat...b?1201336318593
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1145477730062
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative....15033/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0ADBE9E5-66FE-4C2E-8151-7F56BD92FE2E}: NameServer = 194.243.154.62,212.216.112.112,212.216.172.62,195.31.190.31
O17 - HKLM\System\CS1\Services\Tcpip\..\{0ADBE9E5-66FE-4C2E-8151-7F56BD92FE2E}: NameServer = 194.243.154.62,212.216.112.112,212.216.172.62,195.31.190.31
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - J:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: J:\PROGRA~1\KASPER~1\adialhk.dll
O23 - Service: Adobe LM Service - Adobe Systems - J:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - J:\Programmi\Kaspersky Internet Security\avp.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - J:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - J:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PD91Agent - Raxco Software, Inc. - J:\Programmi\Raxco\PerfectDisk\PD91Agent.exe
O23 - Service: PD91Engine - Raxco Software, Inc. - J:\Programmi\Raxco\PerfectDisk\PD91Engine.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - J:\Programmi\WinPcap\rpcapd.exe
O23 - Service: ServiceLayer - Nokia. - J:\Programmi\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TabletService - Wacom Technology, Corp. - J:\WINDOWS\system32\Tablet.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - J:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - J:\Programmi\File comuni\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 7125 bytes

-- HijackThis Fixed Entries (C:\HIJACK~1\backups\) -----------------------------

backup-20080524-113532-458 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.finderg.com
backup-20080524-113724-996 O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - J:\Programmi\File comuni\Ulead Systems\DVD\ULCDRSvr.exe

-- File Associations -----------------------------------------------------------

.cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%*
.reg - regfile - shell\open\command - regedit.exe "%1" %*
.scr - scrfile - shell\open\command - "%1" %*


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R0 giveio - j:\windows\system32\giveio.sys
R0 PenClass (Pen Class) - j:\windows\system32\drivers\penclass.sys <Not Verified; Wacom Technology Corporation; Wacom Pen Class Driver>
R0 speedfan - j:\windows\system32\speedfan.sys <Not Verified; Windows ® 2000 DDK provider; Windows ® 2000 DDK driver>
R1 Ext2fs - j:\windows\system32\drivers\ext2fs.sys <Not Verified; Stephan Schreiber; Ext2 IFS for Windows XP/2003 (x86)>
R1 FileDisk - j:\windows\system32\drivers\filedisk.sys <Not Verified; Bo Brantén; filedisk>
R1 IfsMount - j:\windows\system32\drivers\ifsmount.sys <Not Verified; Stephan Schreiber; IFS for Windows XP/2003 (x86)>
R1 oreans32 - j:\windows\system32\drivers\oreans32.sys
R1 XPROTECTOR - j:\windows\system32\drivers\oreans.sys
R2 atksgt - j:\windows\system32\drivers\atksgt.sys
R2 DefragFS - j:\windows\system32\drivers\defragfs.sys <Not Verified; Raxco Software, Inc.; PerfectDisk Driver>
R2 HWiNFO32 (HWiNFO32 Kernel Driver) - j:\programmi\hwinfo32\hwinfo32.sys <Not Verified; REALiX™; HWiNFO32 Kernel Driver>
R2 irda (Protocollo IrDA) - j:\windows\system32\drivers\irda.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 ithsgt - j:\windows\system32\drivers\ithsgt.sys
R2 lilsgt - j:\windows\system32\drivers\lilsgt.sys
R2 lirsgt - j:\windows\system32\drivers\lirsgt.sys
R2 musm3gld - j:\windows\system32\drivers\musm3gld.sys
R3 Cap7134 (ProVideo Capture) - j:\windows\system32\drivers\cap7134.sys <Not Verified; Philips Semiconductors; Philips cap7134>
R3 libusb0 (LibUsb-Win32 - Kernel Driver, Version 0.1.12.1) - j:\windows\system32\drivers\libusb0.sys <Not Verified; http://libusb-win32.sourceforge.net; LibUSB-Win32 - Kernel Driver>
R3 Pcouffin (VSO Software pcouffin) - j:\windows\system32\drivers\pcouffin.sys <Not Verified; VSO Software; Patin couffin engine>
R3 PhTVTune (ProVideo WDM TVTuner) - j:\windows\system32\drivers\phtvtune.sys <Not Verified; Philips Semiconductors; Philips TVTuner WDM Driver>
R3 Rasirda (WAN Miniport (IrDA)) - j:\windows\system32\drivers\rasirda.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 ROOTMODEM (Microsoft Legacy Modem Driver) - j:\windows\system32\drivers\rootmdm.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R3 SaiHFF0C - j:\windows\system32\drivers\saihff0c.sys <Not Verified; Saitek; Configuration Software>
R3 SaiUFF0C - j:\windows\system32\drivers\saiuff0c.sys <Not Verified; Saitek; Configuration Software>

S0 BootScreen - j:\windows\\systemroot\system32\drivers\vidstub.sys (file missing)
S0 BTHidMgr (Bluetooth HID Manager Service) - j:\windows\system32\drivers\bthidmgr.sys (file missing)
S2 tmcomm - j:\windows\system32\drivers\tmcomm.sys (file missing)
S3 ATIAVAIW (ATI T200 Unified AVStream service) - j:\windows\system32\drivers\atinavt2.sys <Not Verified; ATI Technologies Inc.; ATI AVStream>
S3 atinrvxx (ATI WDM Rage Theater Video) - j:\windows\system32\drivers\atinrvxx.sys <Not Verified; ATI Technologies Inc.; ATI WDM RT>
S3 BlueletAudio (Bluetooth Audio Service) - j:\windows\system32\drivers\blueletaudio.sys (file missing)
S3 BlueletSCOAudio (Bluetooth SCO Audio Service) - j:\windows\system32\drivers\blueletscoaudio.sys (file missing)
S3 BT (Bluetooth PAN Network Adapter) - j:\windows\system32\drivers\btnetdrv.sys (file missing)
S3 Btcsrusb (Bluetooth USB For Bluetooth Service) - j:\windows\system32\drivers\btcusb.sys (file missing)
S3 BthEnum (Servizio enumeratore Bluetooth) - j:\windows\system32\drivers\bthenum.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 BTHidEnum (Bluetooth HID Enumerator) - j:\windows\system32\drivers\vbtenum.sys (file missing)
S3 BthPan (Periferica Bluetooth (Personal Area Network)) - j:\windows\system32\drivers\bthpan.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 BTHPORT (Driver della porta Bluetooth) - j:\windows\system32\drivers\bthport.sys <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
S3 BTHUSB (Driver USB radio Bluetooth) - j:\windows\system32\drivers\bthusb.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 DCamUSBEMPIA (USB 2710 Camera) - j:\windows\system32\drivers\emdevice.sys <Not Verified; eMPIA Technology, Inc.; USB 28xx Video>
S3 FiltUSBEMPIA (USB Device Lower Filter) - j:\windows\system32\drivers\emfilter.sys <Not Verified; eMPIA Technology Inc.; EM27xx / EM28xx USB Video Convertor>
S3 FreshIO - j:\programmi\freshdevices\freshdiagnose\freshio.sys (file missing)
S3 HWIONT - c:\miscuglio\apps & drivers\video tools\mytv_211\hwiont.sys (file missing)
S3 MPE (BDA MPE Filter) - j:\windows\system32\drivers\mpe.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 MSIRCOMM (Microsoft IR Communications Driver) - j:\windows\system32\drivers\msircomm.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 MVDCODEC (ATI WDM Specialized MVD Codec) - j:\windows\system32\drivers\atinmdxx.sys <Not Verified; ATI Technologies Inc.; ATI Specialized MVD VBI Codec>
S3 NCHSSVAD (SoundTap Recorder) - j:\windows\system32\drivers\nchssvad.sys <Not Verified; NCH Swift Sound; NCH Swift Sound Virtual Audio Device>
S3 nm (Driver di Network Monitor) - j:\windows\system32\drivers\nmnt.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 nmwcd (Nokia USB Phone Parent) - j:\windows\system32\drivers\ccdcmb.sys <Not Verified; Nokia; >
S3 nmwcdc (Nokia USB Generic) - j:\windows\system32\drivers\ccdcmbo.sys <Not Verified; Nokia; >
S3 NPF (NetGroup Packet Filter Driver) - j:\windows\system32\drivers\npf.sys <Not Verified; CACE Technologies; WinPcap>
S3 p17filt - j:\windows\system32\drivers\p17filt.sys (file missing)
S3 PCANDIS5_RETWIFI (PCANDIS5_RETWIFI Protocol Driver) - j:\progra~1\eeyedi~1\retina~1\pcandis5_retwifi.sys (file missing)
S3 PCANDIS5_WIFISCAN.SYS - j:\programmi\eeye digital security\retina wireless scanner\pcandis5_wifiscan.sys (file missing)
S3 pccsmcfd (PCCS Mode Change Filter Driver) - j:\windows\system32\drivers\pccsmcfd.sys <Not Verified; Nokia; >
S3 ScanUSBEMPIA (USB Still Image Capture Device) - j:\windows\system32\drivers\emscan.sys <Not Verified; eMPIA Technology, Inc.; USB 28xx Video>
S3 Ser2pl (MAT Serial port driver) - j:\windows\system32\drivers\ser2pl.sys <Not Verified; Prolific Technology Inc.; Prolific USB-to-Serial Bridge Cable>
S3 STIrUsb (Adattatore SigmaTel USB-IrDA) - j:\windows\system32\drivers\irstusb.sys <Not Verified; SigmaTel, Inc.; SigmaTel STIr4200>
S3 upperdev - j:\windows\system32\drivers\usbser_lowerflt.sys <Not Verified; Windows ® Codename Longhorn DDK provider; Windows ® Codename Longhorn DDK driver>
S3 vaxscsi - j:\windows\system32\drivers\vaxscsi.sys <Not Verified; Alcohol Soft Co., Ltd.; Alcohol>
S3 VComm (Virtual Serial port driver) - j:\windows\system32\drivers\vcomm.sys (file missing)
S3 VcommMgr (Bluetooth VComm Manager Service) - j:\windows\system32\drivers\vcommmgr.sys (file missing)
S3 wceusbsh (Windows CE USB Serial Host Driver) - j:\windows\system32\drivers\wceusbsh.sys <Not Verified; Microsoft Corporation; Windows CE USB Serial Host Driver>


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 BthServ (Bluetooth Support Service) - j:\windows\system32\svchost.exe -k bthsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 Irmon (Monitor infrarossi) - j:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
R2 PD91Agent - j:\programmi\raxco\perfectdisk\pd91agent.exe <Not Verified; Raxco Software, Inc.; PerfectDisk 2008>
R2 TabletService - j:\windows\system32\tablet.exe <Not Verified; Wacom Technology, Corp.; Wacom Win32 Tablet Service>

S2 NtmlSvc - j:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 p2pgasvc (Autenticazione gruppo rete peer) - j:\windows\system32\svchost.exe -k p2psvc <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 PD91Engine - j:\programmi\raxco\perfectdisk\pd91engine.exe <Not Verified; Raxco Software, Inc.; PerfectDisk 2008>
S3 rpcapd (Remote Packet Capture Protocol v.0 (experimental)) - "j:\programmi\winpcap\rpcapd.exe" -d -f "j:\programmi\winpcap\rpcapd.ini" <Not Verified; CACE Technologies; WinPcap>
S3 ServiceLayer - "j:\programmi\pc connectivity solution\servicelayer.exe" <Not Verified; Nokia.; PC Connectivity Solution>
S3 TuneUp.Defrag (TuneUp Drive Defrag Service) - j:\windows\system32\tuneupdefragservice.exe <Not Verified; TuneUp Software GmbH; TuneUp Utilities>
S3 usprserv (User Privilege Service) - j:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 UxTuneUp (TuneUp Theme Extension) - j:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S4 ProtexisLicensing - j:\windows\system32\psiservice.exe <Not Verified; ; PSIService>


-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {D76B962B-F0B8-41F2-8590-6605FE4EA312}
Description: Bluetooth VComm Manager
Device ID: ROOT\BLUETOOTH\0001
Manufacturer: IVT Corporation
Name: Bluetooth VComm Manager
PNP Device ID: ROOT\BLUETOOTH\0001
Service: VcommMgr

Class GUID: {EEC5AD98-8080-425F-922A-DABF3DE3F69A}
Description: Nokia 6630
Device ID: ROOT\WPD\0000
Manufacturer: Nokia
Name: Nokia 6630
PNP Device ID: ROOT\WPD\0000
Service: WUDFRd


-- Files created between 2008-05-02 and 2008-06-02 -----------------------------

2008-06-02 22:24:54 686630 --a------ J:\dss.exe
2008-06-02 22:19:07 0 dr-h----- J:\Documents and Settings\Tw@in 28\Recent
2008-06-02 22:18:31 0 d-------- J:\Programmi\Lavasoft
2008-06-02 15:04:50 96966 --a------ J:\WINDOWS\system32\drivers\klin.dat
2008-06-02 15:04:50 88774 --a------ J:\WINDOWS\system32\drivers\klick.dat
2008-06-02 15:04:50 27464224 --ahs---- J:\WINDOWS\system32\drivers\fidbox.dat
2008-06-02 15:03:57 48160 --ahs---- J:\WINDOWS\system32\drivers\fidbox2.dat
2008-06-02 15:03:57 0 d-------- J:\Programmi\Kaspersky Internet Security
2008-06-02 14:16:45 18432 --a------ J:\WINDOWS\system32\secedit.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-06-01 18:56:10 526 --a------ J:\reset.cmd
2008-06-01 18:43:11 0 d-------- J:\Programmi\Windows Resource Kits
2008-05-30 23:09:55 39936 --a------ J:\EvID4226Patch.exe <EVID42~1.EXE>
2008-05-29 17:15:04 0 d-------- J:\Programmi\Panda Security
2008-05-29 10:19:37 0 d-------- J:\Documents and Settings\Tw@in 28\.housecall6.6
2008-05-27 13:36:11 0 d-------- J:\Documents and Settings\All Users\Application Data\DAEMON Tools Pro
2008-05-22 20:08:04 231936 --a------ J:\WINDOWS\epsuninst.exe <Not Verified; Marcelo Bona Boff; e-PocketSetup 2003>
2008-05-22 19:52:21 163599 --a------ J:\WINDOWS\psuninst2.exe <Not Verified; HelpStudio Software House; PocketSetup 2001>
2008-05-21 00:20:00 0 d-------- J:\Programmi\PDAmill
2008-05-21 00:07:33 0 d-------- J:\Programmi\Simbsoft
2008-05-15 23:27:26 0 d-------- J:\Programmi\ACCESS
2008-05-15 22:40:41 0 d-------- J:\Programmi\Gaxo
2008-05-15 22:30:34 0 d-------- J:\Programmi\RESETgame
2008-05-15 22:27:35 0 d-------- J:\Programmi\Program Files
2008-05-11 10:40:36 0 d-------- J:\Programmi\CoreCodec
2008-05-10 12:49:11 0 d-------- J:\Programmi\Microsoft.NET
2008-05-10 11:15:44 82432 --a------ J:\WINDOWS\RSetupCE.exe
2008-05-10 11:06:18 0 d-------- J:\Programmi\Handmark
2008-05-07 21:09:48 0 d-------- J:\Programmi\Microsoft ActiveSync
2008-05-07 10:46:04 0 d-------- J:\WINDOWS\Prefetch
2008-05-07 10:28:43 92672 -----n--- J:\WINDOWS\system32\msxml6r.dll <Not Verified; Microsoft Corporation; Microsoft® MSXML 6.0>
2008-05-07 10:28:43 0 d-------- J:\Programmi\Messenger
2008-05-07 10:28:42 1306624 -----n--- J:\WINDOWS\system32\msxml6.dll <Not Verified; Microsoft Corporation; Microsoft® MSXML 6.0 SP2>
2008-05-07 10:28:39 233472 -----n--- J:\WINDOWS\system32\azroles.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-05-07 10:28:39 870784 -----n--- J:\WINDOWS\system32\ati3d1ag.dll <Not Verified; ATI Technologies Inc.; ATI Technologies Inc. Radeon DirectX Universal Driver>
2008-05-07 10:28:39 377984 -----n--- J:\WINDOWS\system32\ati2dvaa.dll <Not Verified; ATI Technologies Inc.; ATI Rage 128 Family>
2008-05-07 10:28:38 12800 -----n--- J:\WINDOWS\system32\credssp.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-05-07 10:28:38 7168 -----n--- J:\WINDOWS\system32\bitsprx4.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-05-07 10:28:37 33792 -----n--- J:\WINDOWS\system32\eapsvc.dll <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-05-07 10:28:37 59392 -----n--- J:\WINDOWS\system32\eapqec.dll <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-05-07 10:28:37 40960 --a------ J:\WINDOWS\system32\eappprxy.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-05-07 10:28:37 179712 -----n--- J:\WINDOWS\system32\eapphost.dll <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-05-07 10:28:37 94720 -----n--- J:\WINDOWS\system32\eappgnui.dll <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-05-07 10:28:37 126976 --a------ J:\WINDOWS\system32\eappcfg.dll <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-05-07 10:28:37 184832 -----n--- J:\WINDOWS\system32\eapp3hst.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-05-07 10:28:37 31232 --a------ J:\WINDOWS\system32\eapolqec.dll <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-05-07 10:28:37 651264 -----n--- J:\WINDOWS\system32\dot3ui.dll <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-05-07 10:28:37 133120 -----n--- J:\WINDOWS\system32\dot3svc.dll <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-05-07 10:28:37 56832 -----n--- J:\WINDOWS\system32\dot3msm.dll <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-05-07 10:28:37 39936 -----n--- J:\WINDOWS\system32\dot3gpclnt.dll <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-05-07 10:28:37 9216 --a------ J:\WINDOWS\system32\dot3dlg.dll <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-05-07 10:28:37 59904 -----n--- J:\WINDOWS\system32\dot3cfg.dll <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-05-07 10:28:37 26112 --a------ J:\WINDOWS\system32\dot3api.dll <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-05-07 10:28:37 39936 -----n--- J:\WINDOWS\system32\dimsroam.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-05-07 10:28:37 19456 --a------ J:\WINDOWS\system32\dimsntfy.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-05-07 10:28:37 48640 -----n--- J:\WINDOWS\system32\dhcpqec.dll <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-05-07 10:28:36 32285 -----n--- J:\WINDOWS\system32\hsfcisp2.dll <Not Verified; Conexant Systems, Inc.; SoftK56>
2008-05-07 10:28:35 6144 -----n--- J:\WINDOWS\system32\kbdnepr.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-05-07 10:28:35 6144 -----n--- J:\WINDOWS\system32\kbdiultn.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-05-07 10:28:35 6144 -----n--- J:\WINDOWS\system32\kbdbhc.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-05-07 10:28:34 33792 -----n--- J:\WINDOWS\system32\mmcperf.exe <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-05-07 10:28:34 106496 -----n--- J:\WINDOWS\system32\mmcfxcommon.dll <Not Verified; Microsoft Corporation; Microsoft ® Windows ® Operating System>
2008-05-07 10:28:34 397312 -----n--- J:\WINDOWS\system32\mmcex.dll <Not Verified; Microsoft Corporation; Microsoft ® Windows ® Operating System>
2008-05-07 10:28:34 86016 -----n--- J:\WINDOWS\system32\mdmxsdk.dll <Not Verified; Conexant; Diagnostic Interface>
2008-05-07 10:28:34 37376 -----n--- J:\WINDOWS\system32\l2gpstore.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-05-07 10:28:34 61440 -----n--- J:\WINDOWS\system32\kmsvc.dll <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-05-07 10:28:34 6144 -----n--- J:\WINDOWS\system32\kbdpash.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-05-07 10:28:33 144896 --a------ J:\WINDOWS\system32\onex.dll <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-05-07 10:28:33 177152 -----n--- J:\WINDOWS\system32\napstat.exe <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-05-07 10:28:33 199680 -----n--- J:\WINDOWS\system32\napmontr.dll <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-05-07 10:28:33 31232 -----n--- J:\WINDOWS\system32\napipsec.dll <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-05-07 10:28:33 1737856 -----n--- J:\WINDOWS\system32\mtxparhd.dll <Not Verified; Matrox Graphics Inc.; Matrox Parhelia Display Driver>
2008-05-07 10:28:33 80896 -----n--- J:\WINDOWS\system32\msshavmsg.dll <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-05-07 10:28:33 155136 -----n--- J:\WINDOWS\system32\mssha.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-05-07 10:28:32 73796 -----n--- J:\WINDOWS\system32\slserv.exe <Not Verified; Smart Link; Soft Modem>
2008-05-07 10:28:32 32866 -----n--- J:\WINDOWS\system32\slrundll.exe <Not Verified; Smart Link; Soft Modem>
2008-05-07 10:28:32 188508 -----n--- J:\WINDOWS\system32\slgen.dll <Not Verified; Smart Link; Soft Modem>
2008-05-07 10:28:32 286792 -----n--- J:\WINDOWS\system32\slextspk.dll <Not Verified; Smart Link; Soft Modem>
2008-05-07 10:28:32 73832 -----n--- J:\WINDOWS\system32\slcoinst.dll <Not Verified; Smart Link; Soft Modem>
2008-05-07 10:28:32 32768 -----n--- J:\WINDOWS\system32\setupn.exe <Not Verified; Microsoft Corporation; Microsoft® Windows Media Player>
2008-05-07 10:28:32 397056 -----n--- J:\WINDOWS\system32\s3gnb.dll <Not Verified; S3 Graphics, Inc.; S3 ProSavage(DDR) & Twister Display Driver>
2008-05-07 10:28:32 61952 --a------ J:\WINDOWS\system32\rasqec.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-05-07 10:28:32 76800 --a------ J:\WINDOWS\system32\qutil.dll <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-05-07 10:28:32 62464 -----n--- J:\WINDOWS\system32\qcliprov.dll <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-05-07 10:28:32 293888 -----n--- J:\WINDOWS\system32\qagentrt.dll <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-05-07 10:28:32 150528 -----n--- J:\WINDOWS\system32\qagent.dll <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-05-07 10:28:30 50688 -----n--- J:\WINDOWS\system32\tspkg.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-05-07 10:28:29 69120 -----n--- J:\WINDOWS\system32\wlanapi.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-05-07 10:28:28 32866 -----n--- J:\WINDOWS\slrundll.exe <Not Verified; Smart Link; Soft Modem>
2008-05-07 10:28:27 0 d-------- J:\WINDOWS\l2schemas
2008-05-07 10:28:26 0 d-------- J:\WINDOWS\system32\it
2008-05-07 10:28:26 0 d-------- J:\WINDOWS\system32\bits
2008-05-07 10:26:37 0 d-------- J:\WINDOWS\ServicePackFiles
2008-05-07 10:24:12 12047 -----n--- J:\WINDOWS\system32\drivers\ati1pdxx.sys <Not Verified; ATI Technologies Inc.; ATI Specialized PCD VBI Codec>
2008-05-07 10:24:12 11615 -----n--- J:\WINDOWS\system32\drivers\ati1mdxx.sys <Not Verified; ATI Technologies Inc.; ATI Specialized MVD VBI Codec>
2008-05-07 10:24:12 56623 -----n--- J:\WINDOWS\system32\drivers\ati1btxx.sys <Not Verified; ATI Technologies Inc.; ATI WDM BT829x>
2008-05-07 10:24:12 43008 -----n--- J:\WINDOWS\system32\drivers\amdagp.sys <Not Verified; Advanced Micro Devices, Inc.; Windows ® 2000 DDK Driver>
2008-05-07 10:24:12 42752 -----n--- J:\WINDOWS\system32\drivers\alim1541.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-05-07 10:24:12 44928 -----n--- J:\WINDOWS\system32\drivers\agpcpq.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-05-07 10:24:12 42368 -----n--- J:\WINDOWS\system32\drivers\agp440.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-05-07 10:24:12 3775 -----n--- J:\WINDOWS\system32\drivers\adv11nt5.dll <Not Verified; Intel® Corporation; Intel® Graphics Accelerator Drivers for Windows NT®>
2008-05-07 10:24:12 3711 -----n--- J:\WINDOWS\system32\drivers\adv09nt5.dll <Not Verified; Intel® Corporation; Intel® Graphics Accelerator Drivers for Windows NT®>
2008-05-07 10:24:12 3135 -----n--- J:\WINDOWS\system32\drivers\adv08nt5.dll <Not Verified; Intel® Corporation; Intel® Graphics Accelerator Drivers for Windows NT®>
2008-05-07 10:24:12 3647 -----n--- J:\WINDOWS\system32\drivers\adv07nt5.dll <Not Verified; Intel® Corporation; Intel® Graphics Accelerator Drivers for Windows NT®>
2008-05-07 10:24:12 3615 -----n--- J:\WINDOWS\system32\drivers\adv05nt5.dll <Not Verified; Intel® Corporation; Intel® Graphics Accelerator Drivers for Windows NT®>
2008-05-07 10:24:12 3967 -----n--- J:\WINDOWS\system32\drivers\adv02nt5.dll <Not Verified; Intel® Corporation; Intel® Graphics Accelerator Drivers for Windows NT®>
2008-05-07 10:24:12 4255 -----n--- J:\WINDOWS\system32\drivers\adv01nt5.dll <Not Verified; Intel® Corporation; Intel® Graphics Accelerator Drivers for Windows NT®>
2008-05-07 10:24:11 17279 -----n--- J:\WINDOWS\system32\drivers\atv10nt5.dll <Not Verified; Intel® Corporation; Intel® Graphics Accelerator Drivers for Windows NT®>
2008-05-07 10:24:11 14143 -----n--- J:\WINDOWS\system32\drivers\atv06nt5.dll <Not Verified; Intel® Corporation; Intel® Graphics Accelerator Drivers for Windows NT®>
2008-05-07 10:24:11 25471 -----n--- J:\WINDOWS\system32\drivers\atv04nt5.dll <Not Verified; Intel® Corporation; Intel® Graphics Accelerator Drivers for Windows NT®>
2008-05-07 10:24:11 11359 -----n--- J:\WINDOWS\system32\drivers\atv02nt5.dll <Not Verified; Intel® Corporation; Intel® Graphics Accelerator Drivers for Windows NT®>
2008-05-07 10:24:11 21183 -----n--- J:\WINDOWS\system32\drivers\atv01nt5.dll <Not Verified; Intel® Corporation; Intel® Graphics Accelerator Drivers for Windows NT®>
2008-05-07 10:24:11 63488 -----n--- J:\WINDOWS\system32\drivers\atinxsxx.sys <Not Verified; ATI Technologies Inc.; ATI WDM TVAUDIO_CROSSBAR>
2008-05-07 10:24:11 31744 -----n--- J:\WINDOWS\system32\drivers\atinxbxx.sys <Not Verified; ATI Technologies Inc.; ATI WDM CROSSBAR>
2008-05-07 10:24:11 73216 -----n--- J:\WINDOWS\system32\drivers\atintuxx.sys <Not Verified; ATI Technologies Inc.; ATI WDM TVTUNER>
2008-05-07 10:24:11 13824 -----n--- J:\WINDOWS\system32\drivers\atinttxx.sys <Not Verified; ATI Technologies Inc.; ATI WDM Teletext Decoder>
2008-05-07 10:24:11 28672 -----n--- J:\WINDOWS\system32\drivers\atinsnxx.sys <Not Verified; ATI Technologies Inc.; ATI WDM TVAUDIO>
2008-05-07 10:24:11 52224 -----n--- J:\WINDOWS\system32\drivers\atinraxx.sys <Not Verified; ATI Technologies Inc.; ATI WDM Rage Theater Audio>
2008-05-07 10:24:11 14336 -----n--- J:\WINDOWS\system32\drivers\atinpdxx.sys <Not Verified; ATI Technologies Inc.; ATI Specialized PCD VBI Codec>
2008-05-07 10:24:11 57856 -----n--- J:\WINDOWS\system32\drivers\atinbtxx.sys <Not Verified; ATI Technologies Inc.; ATI WDM BT829x>
2008-05-07 10:24:11 327168 -----n--- J:\WINDOWS\system32\drivers\ati2mtaa.sys <Not Verified; ATI Technologies Inc.; Famiglia ATI Rage 128>
2008-05-07 10:24:11 34735 -----n--- J:\WINDOWS\system32\drivers\ati1xsxx.sys <Not Verified; ATI Technologies Inc.; ATI WDM TVAUDIO_CROSSBAR>
2008-05-07 10:24:11 29455 -----n--- J:\WINDOWS\system32\drivers\ati1xbxx.sys <Not Verified; ATI Technologies Inc.; ATI WDM CROSSBAR>
2008-05-07 10:24:11 36463 -----n--- J:\WINDOWS\system32\drivers\ati1tuxx.sys <Not Verified; ATI Technologies Inc.; ATI WDM TVTUNER>
2008-05-07 10:24:11 21343 -----n--- J:\WINDOWS\system32\drivers\ati1ttxx.sys <Not Verified; ATI Technologies Inc.; ATI WDM Teletext Decoder>
2008-05-07 10:24:11 26367 -----n--- J:\WINDOWS\system32\drivers\ati1snxx.sys <Not Verified; ATI Technologies Inc.; ATI WDM TVAUDIO>
2008-05-07 10:24:11 63663 -----n--- J:\WINDOWS\system32\drivers\ati1rvxx.sys <Not Verified; ATI Technologies Inc.; ATI WDM RT>
2008-05-07 10:24:11 30671 -----n--- J:\WINDOWS\system32\drivers\ati1raxx.sys <Not Verified; ATI Technologies Inc.; ATI WDM Rage Theater Audio>
2008-05-07 10:24:10 36480 -----n--- J:\WINDOWS\system32\drivers\bthprint.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-05-07 10:24:09 220032 -----n--- J:\WINDOWS\system32\drivers\hsfbs2s2.sys <Not Verified; Conexant Systems, Inc.; SoftK56 Modem Driver>
2008-05-07 10:24:09 19200 -----n--- J:\WINDOWS\system32\drivers\hidir.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-05-07 10:24:09 25728 -----n--- J:\WINDOWS\system32\drivers\hidbth.sys <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-05-07 10:24:09 46464 -----n--- J:\WINDOWS\system32\drivers\gagp30kx.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-05-07 10:24:09 15423 -----n--- J:\WINDOWS\system32\drivers\ch7xxnt5.dll <Not Verified; Intel® Corporation; Intel® Graphics Accelerator Drivers for Windows NT®>
2008-05-07 10:24:08 1041536 -----n--- J:\WINDOWS\system32\drivers\hsfdpsp2.sys <Not Verified; Conexant Systems, Inc.; SoftK56 Modem Driver>
2008-05-07 10:24:08 685056 -----n--- J:\WINDOWS\system32\drivers\hsfcxts2.sys <Not Verified; Conexant Systems, Inc.; SoftK56 Modem Driver>
2008-05-07 10:24:07 166912 -----n--- J:\WINDOWS\system32\drivers\s3gnbm.sys <Not Verified; S3 Graphics, Inc.; S3 ProSavage(DDR) & Twister Miniport Driver>
2008-05-07 10:24:07 30592 -----n--- J:\WINDOWS\system32\drivers\rndismpx.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-05-07 10:24:07 13776 -----n--- J:\WINDOWS\system32\drivers\recagent.sys <Not Verified; Smart Link; Soft Modem>
2008-05-07 10:24:07 180360 -----n--- J:\WINDOWS\system32\drivers\ntmtlfax.sys <Not Verified; Smart Link; Soft Modem>
2008-05-07 10:24:07 12672 -----n--- J:\WINDOWS\system32\drivers\mutohpen.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-05-07 10:24:07 452736 -----n--- J:\WINDOWS\system32\drivers\mtxparhm.sys <Not Verified; Matrox Graphics Inc.; Matrox Parhelia Miniport Driver>
2008-05-07 10:24:07 1309184 -----n--- J:\WINDOWS\system32\drivers\mtlstrm.sys <Not Verified; Smart Link; Soft Modem>
2008-05-07 10:24:07 126686 -----n--- J:\WINDOWS\system32\drivers\mtlmnt5.sys <Not Verified; Smart Link; Soft Modem>
2008-05-07 10:24:07 11868 -----n--- J:\WINDOWS\system32\drivers\mdmxsdk.sys <Not Verified; Conexant; Diagnostic Interface>
2008-05-07 10:24:06 12800 -----n--- J:\WINDOWS\system32\drivers\usb8023x.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-05-07 10:24:06 44672 -----n--- J:\WINDOWS\system32\drivers\uagp35.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-05-07 10:24:06 5888 -----n--- J:\WINDOWS\system32\drivers\smbali.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-05-07 10:24:06 13240 -----n--- J:\WINDOWS\system32\drivers\slwdmsup.sys <Not Verified; Smart Link; Soft Modem>
2008-05-07 10:24:06 95424 -----n--- J:\WINDOWS\system32\drivers\slnthal.sys <Not Verified; Smart Link; Soft Modem>
2008-05-07 10:24:06 404990 -----n--- J:\WINDOWS\system32\drivers\slntamr.sys <Not Verified; Smart Link; Soft Modem>
2008-05-07 10:24:06 129535 -----n--- J:\WINDOWS\system32\drivers\slnt7554.sys <Not Verified; Smart Link; Soft Modem>
2008-05-07 10:24:06 40960 -----n--- J:\WINDOWS\system32\drivers\sisagp.sys <Not Verified; Silicon Integrated Systems Corporation; SiS ® NT AGP Filter>
2008-05-07 10:24:06 3901 -----n--- J:\WINDOWS\system32\drivers\siint5.dll <Not Verified; Intel® Corporation; Intel® Graphics Accelerator Drivers for Windows NT®>
2008-05-07 10:24:06 10240 -----n--- J:\WINDOWS\system32\drivers\sffp_mmc.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-05-07 10:24:05 25471 -----n--- J:\WINDOWS\system32\drivers\watv10nt.sys <Not Verified; Intel® Corporation; Intel® Graphics Accelerator Drivers for Windows NT®>
2008-05-07 10:24:05 22271 -----n--- J:\WINDOWS\system32\drivers\watv06nt.sys <Not Verified; Intel® Corporation; Intel® Graphics Accelerator Drivers for Windows NT®>
2008-05-07 10:24:05 11935 -----n--- J:\WINDOWS\system32\drivers\wadv11nt.sys <Not Verified; Intel® Corporation; Intel® Graphics Accelerator Drivers for Windows NT®>
2008-05-07 10:24:05 11871 -----n--- J:\WINDOWS\system32\drivers\wadv09nt.sys <Not Verified; Intel® Corporation; Intel® Graphics Accelerator Drivers for Windows NT®>
2008-05-07 10:24:05 11295 -----n--- J:\WINDOWS\system32\drivers\wadv08nt.sys <Not Verified; Intel® Corporation; Intel® Graphics Accelerator Drivers for Windows NT®>
2008-05-07 10:24:05 11807 -----n--- J:\WINDOWS\system32\drivers\wadv07nt.sys <Not Verified; Intel® Corporation; Intel® Graphics Accelerator Drivers for Windows NT®>
2008-05-07 10:24:05 14208 -----n--- J:\WINDOWS\system32\drivers\wacompen.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-05-07 10:24:05 42240 -----n--- J:\WINDOWS\system32\drivers\viaagp.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-05-07 10:24:05 11325 -----n--- J:\WINDOWS\system32\drivers\vchnt5.dll <Not Verified; Intel® Corporation; Intel® Graphics Accelerator Drivers for Windows NT®>
2008-05-07 10:24:05 121984 -----n--- J:\WINDOWS\system32\drivers\usbvideo.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-05-07 10:14:23 0 d-------- J:\WINDOWS\EHome


-- Find3M Report ---------------------------------------------------------------

2008-06-02 22:22:36 0 d-------- J:\Programmi\Mozilla Thunderbird
2008-06-02 22:21:02 12349 --a------ J:\WINDOWS\system32\tablet.dat
2008-06-02 22:18:40 0 d-------- J:\Documents and Settings\Tw@in 28\Dati applicazioni\Malwarebytes
2008-06-02 22:18:23 0 d-------- J:\Programmi\Pidgin
2008-06-02 22:17:51 0 d-------- J:\Programmi\DAEMON Tools Pro
2008-06-02 22:17:07 0 d-------- J:\Documents and Settings\Tw@in 28\Dati applicazioni\gtk-2.0
2008-06-02 22:08:13 0 d-------- J:\Programmi\File comuni\Wise Installation Wizard
2008-06-02 22:07:31 0 d-------- J:\Programmi\SpeedFan
2008-06-02 22:05:38 0 d-------- J:\Programmi\Halite
2008-06-02 22:01:13 0 d-------- J:\Programmi\PeerGuardian2
2008-05-30 13:05:13 0 d-------- J:\Documents and Settings\Tw@in 28\Dati applicazioni\.purple
2008-05-29 15:02:57 0 d-------- J:\Documents and Settings\Tw@in 28\Dati applicazioni\Skype
2008-05-29 15:01:43 0 d-------- J:\Documents and Settings\Tw@in 28\Dati applicazioni\skypePM
2008-05-28 21:28:44 0 d-------- J:\Programmi\UltraVNC
2008-05-28 16:17:36 668 --a------ J:\Documents and Settings\Tw@in 28\Dati applicazioni\vso_ts_preview.xml
2008-05-28 16:17:36 0 d-------- J:\Documents and Settings\Tw@in 28\Dati applicazioni\Vso
2008-05-27 20:02:38 392 --a------ J:\Documents and Settings\Tw@in 28\Dati applicazioni\burnaware.ini
2008-05-24 21:18:40 0 d--h----- J:\Programmi\InstallShield Installation Information
2008-05-19 10:00:22 162816 --a------ J:\WINDOWS\system32\fmod.dll <Not Verified; Firelight Technologies Pty, Ltd; FMOD>
2008-05-18 23:55:29 0 d-------- J:\Programmi\File comuni
2008-05-14 19:52:06 0 d-------- J:\Documents and Settings\Tw@in 28\Dati applicazioni\Real
2008-05-07 21:29:18 489598 --a------ J:\WINDOWS\system32\perfh010.dat
2008-05-07 21:29:18 84330 --a------ J:\WINDOWS\system32\perfc010.dat
2008-05-07 21:11:44 2528 --a------ J:\Documents and Settings\Tw@in 28\Dati applicazioni\$_hpcst$.hpc
2008-05-07 10:48:59 219648 --a------ J:\WINDOWS\system32\uxtheme.dll <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-05-07 10:28:26 0 d-------- J:\Programmi\Movie Maker
2008-05-07 10:26:19 0 d-------- J:\Programmi\Windows NT
2008-05-07 10:23:37 251600 -rahs---- J:\ntldr
2008-05-06 12:39:35 0 d-------- J:\Documents and Settings\Tw@in 28\Dati applicazioni\aignes
2008-05-04 21:48:54 0 d-------- J:\Programmi\Paint.NET
2008-04-30 21:38:20 0 d-------- J:\Programmi\Microsoft Silverlight
2008-04-29 20:20:44 0 d-------- J:\Documents and Settings\Tw@in 28\Dati applicazioni\DVDFab
2008-04-28 22:17:21 0 d-------- J:\Documents and Settings\Tw@in 28\Dati applicazioni\Azureus
2008-04-25 12:45:03 0 d-------- J:\Programmi\WinFlip
2008-04-25 12:11:09 0 d-------- J:\Documents and Settings\Tw@in 28\Dati applicazioni\Adobe
2008-04-24 23:11:31 0 d-------- J:\Programmi\K-Lite Codec Pack
2008-04-21 22:59:37 0 d-------- J:\Programmi\File comuni\PCSuite
2008-04-21 22:59:37 0 d-------- J:\Programmi\File comuni\Nokia
2008-04-21 22:58:40 0 d-------- J:\Programmi\DIFX
2008-04-21 22:58:28 0 d-------- J:\Programmi\PC Connectivity Solution
2008-04-21 22:57:30 0 d-------- J:\Programmi\Nokia
2008-04-20 15:27:36 0 d-------- J:\Programmi\Common Files
2008-04-16 13:00:20 230664 --a------ J:\WINDOWS\system32\PDBoot.exe <Not Verified; Raxco Software, Inc.; PerfectDisk 2008>
2008-04-14 12:42:26 0 d-------- J:\Documents and Settings\Tw@in 28\Dati applicazioni\Sauce Reader
2008-04-13 19:27:18 1804 --a------ J:\WINDOWS\system32\dcache.bin
2008-04-13 19:16:52 331776 --a------ J:\WINDOWS\system32\netsetup.exe <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-04-13 19:14:48 12168 --a------ J:\WINDOWS\system32\tsddd.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-13 19:14:48 87176 --a------ J:\WINDOWS\system32\rdpwsx.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-13 19:14:48 92424 --a------ J:\WINDOWS\system32\rdpdd.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-13 19:14:28 12800 --a------ J:\WINDOWS\system32\tree.com <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-13 19:14:28 684032 --a------ J:\WINDOWS\system32\sstext3d.scr <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-04-13 19:14:28 14336 --a------ J:\WINDOWS\system32\ssstars.scr <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-04-13 19:14:28 610304 --a------ J:\WINDOWS\system32\sspipes.scr <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-04-13 19:14:28 18944 --a------ J:\WINDOWS\system32\ssmyst.scr <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-04-13 19:14:28 47104 --a------ J:\WINDOWS\system32\ssmypics.scr <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-04-13 19:14:28 20992 --a------ J:\WINDOWS\system32\ssmarque.scr <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-04-13 19:14:28 393216 --a------ J:\WINDOWS\system32\ssflwbox.scr <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-04-13 19:14:28 19968 --a------ J:\WINDOWS\system32\ssbezier.scr <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-04-13 19:14:28 708608 --a------ J:\WINDOWS\system32\ss3dfo.scr <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-04-13 19:14:28 9216 --a------ J:\WINDOWS\system32\scrnsave.scr <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-04-13 19:14:28 16896 --a------ J:\WINDOWS\system32\more.com <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-13 19:14:28 220672 --a------ J:\WINDOWS\system32\logon.scr <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-04-13 19:14:28 29696 --a------ J:\WINDOWS\system32\format.com <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-13 19:14:26 286720 --a------ J:\WINDOWS\winhlp32.exe <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-04-13 19:14:26 30720 --a------ J:\WINDOWS\system32\xcopy.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-13 19:14:26 155648 --a------ J:\WINDOWS\system32\wscript.exe <Not Verified; Microsoft Corporation; Microsoft ® Windows Script Host>
2008-04-13 19:14:26 13824 --a------ J:\WINDOWS\system32\wscntfy.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-13 19:14:26 11776 --a------ J:\WINDOWS\system32\wpnpinst.exe <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-04-13 19:14:26 32256 --a------ J:\WINDOWS\system32\wpabaln.exe <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-04-13 19:14:26 5632 --a------ J:\WINDOWS\system32\winver.exe <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-04-13 19:14:26 510464 --a------ J:\WINDOWS\system32\winlogon.exe <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-04-13 19:14:24 435712 --a------ J:\WINDOWS\system32\wiaacmgr.exe <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-04-13 19:14:24 66560 --a------ J:\WINDOWS\system32\wextract.exe <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-04-13 19:14:24 293888 --a------ J:\WINDOWS\system32\vssvc.exe <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-04-13 19:14:24 28672 --a------ J:\WINDOWS\system32\verclsid.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-13 19:14:24 50176 --a------ J:\WINDOWS\system32\utilman.exe <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-04-13 19:14:24 26624 --a------ J:\WINDOWS\system32\userinit.exe <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-04-13 19:14:24 18432 --a------ J:\WINDOWS\system32\ups.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-13 19:14:24 16896 --a------ J:\WINDOWS\system32\upnpcont.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-13 19:14:24 13312 --a------ J:\WINDOWS\system32\tracert.exe <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-04-13 19:14:24 347136 --a------ J:\WINDOWS\system32\tourstart.exe <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-04-13 19:14:24 77824 --a------ J:\WINDOWS\system32\telnet.exe <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-04-13 19:14:22 139264 --a------ J:\WINDOWS\system32\taskmgr.exe <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-04-13 19:14:22 107008 --a------ J:\WINDOWS\system32\sysocmgr.exe <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-04-13 19:14:22 14336 --a------ J:\WINDOWS\system32\svchost.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-13 19:14:22 14848 --a------ J:\WINDOWS\system32\stimon.exe <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-04-13 19:14:22 20992 -----n--- J:\WINDOWS\system32\spupdwxp.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-13 19:14:22 57856 --a------ J:\WINDOWS\system32\spoolsv.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-13 19:14:22 11264 --a------ J:\WINDOWS\system32\spnpinst.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-13 19:14:22 539136 --a------ J:\WINDOWS\system32\spider.exe <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-04-13 19:14:22 7680 --a------ J:\WINDOWS\system32\spdwnwxp.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-13 19:14:22 26112 --a------ J:\WINDOWS\system32\sort.exe <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-04-13 19:14:22 132608 --a------ J:\WINDOWS\system32\sndrec32.exe <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-04-13 19:14:22 50688 --a------ J:\WINDOWS\system32\smss.exe <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-04-13 19:14:22 92672 --a------ J:\WINDOWS\system32\smlogsvc.exe <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-04-13 19:14:22 8192 --a------ J:\WINDOWS\system32\smbinst.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-13 19:14:22 26112 --a------ J:\WINDOWS\system32\skeys.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-13 19:14:20 70656 --a------ J:\WINDOWS\system32\sigverif.exe <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-04-13 19:14:20 19968 --a------ J:\WINDOWS\system32\shutdown.exe <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-04-13 19:14:20 78336 --a------ J:\WINDOWS\system32\shrpubw.exe <Not Verified; Microsoft Corporation; Sistema operativo Microsoft® Windows®>
2008-04-13 19:14:20 45056 --a------ J:\WINDOWS\system32\shmgrate.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-13 19:14:20 23040 --a------ J:\WINDOWS\system32\setup.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-04-13 19:14:20 32768 --a------ J:\WINDOWS\system32\sethc.exe <Not Veri
  • 0

#4
Rorschach112
Posted 02 June 2008 - 03:15 PM

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
Hello

1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present):

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)


2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.




Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.


Reboot and post a new DSS log
  • 0

#5
Tw@in 28
Posted 03 June 2008 - 02:07 AM

Tw@in 28

    New Member

  • Topic Starter
  • Member
  • Pip
  • 8 posts
Darn! Forum truncated half the things I posted....I saw it only now.... :)
I attach the two logs, so you may read them completely.
I had also written a coupla things more, yesterday....here they follow:
"During the last 48 hours I:
- Scanned with TrendMicro HouseCall
- Scanned with SpySweeper
- Scanned with Ad-Aware
- Scanned with SpyBot
- Scanned with Malwarebytes Anti-Malware
- Scanned with Ewido Micro
- Scanned with Panda ActiveScan
- Scanned with AVG
- Did a registry repair with the subinacl method
- Scanned with Kaspersky

(obviously, each program has been installed and launched separately from the others, phisically unplugging my net cable, to avoid any network attack. With the ones allowing, I also took a scan in Safe Mode. A few low menaces and false positives apart, no real threats detected....)"

There....anyway, I'll do as you suggested and report here as soon as I'm done. See you soon.

Attached Files

  • Attached File  main.txt   161.26KB   291 downloads
  • Attached File  extra.txt   26.52KB   550 downloads

  • 0

#6
Tw@in 28
Posted 03 June 2008 - 02:32 AM

Tw@in 28

    New Member

  • Topic Starter
  • Member
  • Pip
  • 8 posts
Done, here's the new log....Deckard just made the Main.txt one.
Attaching it, to avoid Forum truncating it.... :)
The "newly created service: PGFILTER" was already there before....it's peerguardian's one, but I had it closed before launching Deckard.... :)

Attached Files

  • Attached File  main.txt   149.85KB   217 downloads

  • 0

#7
Rorschach112
Posted 03 June 2008 - 06:52 AM

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
Post the MBAM log, don't attach it
  • 0

#8
Tw@in 28
Posted 03 June 2008 - 07:37 AM

Tw@in 28

    New Member

  • Topic Starter
  • Member
  • Pip
  • 8 posts
Here's a fresh one:
"Malwarebytes' Anti-Malware 1.14
Versione del database: 816

15.35.44 03/06/2008
mbam-log-6-3-2008 (15-35-44).txt

Tipo di scansione: Scansione rapida
Elementi scansionati: 35453
Tempo trascorso: 6 minute(s), 0 second(s)

Processi delle memoria infetti: 0
Moduli della memoria infetti: 0
Chiavi di registro infette: 0
Valori di registro infetti: 0
Elementi dato del registro infetti: 0
Cartelle infette: 0
File infetti: 0

Processi delle memoria infetti:
(Nessun elemento malevolo rilevato)

Moduli della memoria infetti:
(Nessun elemento malevolo rilevato)

Chiavi di registro infette:
(Nessun elemento malevolo rilevato)

Valori di registro infetti:
(Nessun elemento malevolo rilevato)

Elementi dato del registro infetti:
(Nessun elemento malevolo rilevato)

Cartelle infette:
(Nessun elemento malevolo rilevato)

File infetti:
(Nessun elemento malevolo rilevato)"
  • 0

#9
Tw@in 28
Posted 03 June 2008 - 03:42 PM

Tw@in 28

    New Member

  • Topic Starter
  • Member
  • Pip
  • 8 posts
I was actually wondering....if it's not Malware's fault, should I try repairing my XP installation, using the appropriate option provided with its installation CD? ('cause rolling back using the system restore wouldn't work....search me why :) )
  • 0

#10
Rorschach112
Posted 03 June 2008 - 03:44 PM

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
That might fix the problem

You can delete the tools that we used


You now need to update your Java and remove your older versions.

Please follow these steps to remove older version Java components.

* Click Start > Control Panel.
* Click Add/Remove Programs.
* Check any item with Java Runtime Environment (JRE) in the name.
* Click the Remove or Change/Remove button.

Download the latest version of Java Runtime Environment (JRE), and install it to your computer from
here



Now we need to create a new System Restore point.

Click Start Menu > Run > type (or copy and paste)

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next. Name it and click Create, when the confirmation screen shows the restore point has been created click Close.

Next goto Start Menu > Run > type

cleanmgr

Click OK, Disk Cleanup will open and start calculating the amount of space that can be freed, Once thats finished it will open the Disk Cleanup options screen, click the More Options tab then click Clean up on the system restore area and choose Yes at the confirmation window which will remove all the restore points except the one we just created.

To close Disk Cleanup and remove the Temporary Internet Files detected in the initial scan click OK then choose Yes on the confirmation window.




Below I have included a number of recommendations for how to protect your computer against malware infections.

* Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.

* To reduce re-infection for malware in the future, I strongly recommend installing these free programs:

SpywareBlaster protects against bad ActiveX
IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all
Have a look at this tutorial for IE-Spyad here

* SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time protection program or there will be a conflict.

Make Internet Explorer more secure
  • Click Start > Run
  • Type Inetcpl.cpl & click OK
  • Click on the Security tab
  • Click Reset all zones to default level
  • Make sure the Internet Zone is selected & Click Custom level
  • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
  • Next Click OK, then Apply button and then OK to exit the Internet Properties page.

* MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

* Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
Here

* Take a good look at the following suggestions for malware prevention by reading Tony Klein’s article 'How Did I Get Infected In The First Place'
Here

Thank you for your patience, and performing all of the procedures requested.
  • 0

#11
Tw@in 28
Posted 04 June 2008 - 04:54 AM

Tw@in 28

    New Member

  • Topic Starter
  • Member
  • Pip
  • 8 posts
Thanks to you for your kind assistance. :)
I repaired my Windows Installation using winxp sp2 cd, then reapplied a clean SP3. All's working fine and sound, now! :)
Using Firefox since v.1.0, will surely take a look at your suggestions, Rorschach112. Thanks a lot again! :)
  • 0

#12
Rorschach112
Posted 04 June 2008 - 05:19 AM

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP