[Essexboy]

Once I have finished you up - which should be soon

Run OTL and aswMBR on his computer and post the logs here and I will have a shufti

[Advertisements]

Run OTL and aswMBR on his computer and post the logs here and I will have a shufti

Always copying this?

•

•Under the Custom Scan box paste this in
netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
C:\Windows\assembly\tmp\U /s
CREATERESTOREPOINT

Edited by GabboX, 14 October 2011 - 04:04 PM.

[GabboX]

Run OTL and aswMBR on his computer and post the logs here and I will have a shufti

Always copying this?

•

•Under the Custom Scan box paste this in
netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
C:\Windows\assembly\tmp\U /s
CREATERESTOREPOINT

Edited by GabboX, 14 October 2011 - 04:04 PM.

[Essexboy]

Yes please that is my standard initial scan How is your computer behaving ?

[GabboX]

My computer seems good now. Yesterday night I run Malware and found 3 troyans. I think it put them in quarantine. But I Remember it had found the same 3 days ago.
I'll run it again these days when I have some time off.

[Essexboy]

Could you post the MBAM log so that I can see what it found

[Essexboy]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.

[Essexboy]

User returned

[GabboX]

Thanks.
So let me recap: We removed the problem, we did the fix, the computer now is working good.
Anyway, Antispyware finds a lot of problems! (But i don't believe that tool: I think it was infected at the time, when I had the malware, it didn't even run..)
And Anti - Malware finds with the quick scan a virus. (Everytime I do clean, but whenever I scan it's always there.)

this is the mbam quick scan log, now I'm doing also the complete scan, we'll see.

Attached Files

•  mbam-log-2011-10-29 (13-41-04).txt   1007bytes   108 downloads

[Essexboy]

OK lets have a quick look see at that area using OTL

Run OTL and select all users and the quick scan

[GabboX]

Ok I did the complete scan with Malware Bytes. Now I'll run OTL.

Attached Files

•  mbam-log-2011-10-29 (15-40-36).txt   1KB   95 downloads

[Essexboy]

Still that one orphan registry key, how is your computer behaving ?

[GabboX]

Here it is. My computer works very good.

OTL logfile created on: 29/10/2011 15.42.48 - Run 2
OTL by OldTimer - Version 3.2.29.1 Folder = D:\Documents and Settings\ignazio.SN111236160311.003\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000410 | Country: Italia | Language: ITA | Date Format: dd/MM/yyyy

3,00 Gb Total Physical Memory | 1,91 Gb Available Physical Memory | 63,59% Memory free
5,84 Gb Paging File | 4,91 Gb Available in Paging File | 84,07% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programmi
Drive C: | 37,80 Gb Total Space | 10,02 Gb Free Space | 26,50% Space Free | Partition Type: NTFS
Drive D: | 111,24 Gb Total Space | 0,52 Gb Free Space | 0,46% Space Free | Partition Type: NTFS

Computer Name: SN111236160311 | User Name: ignazio | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/10/14 11.40.50 | 000,582,656 | ---- | M] (OldTimer Tools) -- D:\Documents and Settings\ignazio.SN111236160311.003\Desktop\OTL.exe
PRC - [2011/09/30 17.12.41 | 001,030,200 | ---- | M] (Google Inc.) -- C:\Programmi\Google\Chrome\Application\chrome.exe
PRC - [2011/09/14 21.04.59 | 004,611,456 | ---- | M] (SUPERAntiSpyware.com) -- C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe
PRC - [2011/08/12 01.38.07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) -- C:\Programmi\SUPERAntiSpyware\SASCore.exe
PRC - [2011/06/15 17.33.20 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Programmi\Microsoft\BingBar\SeaPort.EXE
PRC - [2011/06/15 15.16.48 | 000,997,920 | ---- | M] (Microsoft Corporation) -- C:\Programmi\Microsoft Security Client\msseces.exe
PRC - [2011/04/27 15.39.26 | 000,011,736 | ---- | M] (Microsoft Corporation) -- c:\Programmi\Microsoft Security Client\Antimalware\MsMpEng.exe
PRC - [2010/04/30 19.44.23 | 000,180,269 | ---- | M] (RealNetworks, Inc.) -- C:\Programmi\File comuni\Real\Update_OB\realsched.exe
PRC - [2010/01/15 14.49.20 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Programmi\McAfee Security Scan\2.0.181\SSScheduler.exe
PRC - [2009/09/22 11.51.56 | 000,339,968 | ---- | M] (UASSOFT.COM) -- C:\Programmi\Keyboard & Mouse Driver\KMProcess.exe
PRC - [2009/09/22 11.45.58 | 000,391,168 | ---- | M] (UASSOFT.COM) -- C:\Programmi\Keyboard & Mouse Driver\KMCONFIG.exe
PRC - [2009/08/31 22.14.58 | 001,823,744 | ---- | M] (UASSOFT.COM) -- C:\Programmi\Keyboard & Mouse Driver\KMWDSrv.exe
PRC - [2009/03/06 19.05.40 | 001,958,552 | ---- | M] (SmartCom) -- C:\Programmi\Nokia\Nokia Internet Modem\Wellphone2.exe
PRC - [2008/10/02 14.29.56 | 000,032,768 | ---- | M] () -- C:\WINDOWS\system32\SSLEmptyCache.exe
PRC - [2008/08/11 09.49.51 | 000,524,288 | ---- | M] () -- C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe
PRC - [2008/08/07 08.58.04 | 000,495,616 | ---- | M] () -- C:\WINDOWS\twain_32\Samsung\CLX3170\Scan2Pc.exe
PRC - [2008/05/30 01.22.38 | 000,212,992 | ---- | M] (UASSOFT.COM) -- C:\Programmi\Keyboard & Mouse Driver\StartAutorun.exe
PRC - [2008/04/13 19.14.08 | 001,036,288 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/03/14 02.26.20 | 000,795,936 | ---- | M] (Nuance Communications, Inc.) -- C:\Programmi\Nuance\PDF Professional 5\PdfPro5Hook.exe
PRC - [2008/03/14 02.26.14 | 000,144,672 | ---- | M] (Nuance Communications, Inc.) -- C:\Programmi\Nuance\PDF Professional 5\PDFProFiltSrv.exe
PRC - [2007/04/27 07.40.00 | 000,206,400 | ---- | M] (SafeNet, Inc) -- C:\Programmi\File comuni\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
PRC - [2007/04/27 01.00.04 | 000,316,992 | ---- | M] (SafeNet, Inc.) -- C:\Programmi\File comuni\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
PRC - [2006/10/09 11.28.56 | 000,139,264 | ---- | M] (Nero AG) -- C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe
PRC - [2006/10/09 11.22.58 | 000,884,736 | ---- | M] (Nero AG) -- C:\Programmi\File comuni\Ahead\Lib\NMIndexStoreSvr.exe
PRC - [2005/05/11 13.52.04 | 000,737,381 | ---- | M] (Cyberlink) -- C:\Programmi\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
PRC - [2005/05/11 13.52.00 | 000,061,440 | ---- | M] (Cyberlink) -- C:\Programmi\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
PRC - [2005/05/11 13.50.34 | 000,110,672 | ---- | M] () -- c:\APPS\Powercinema\Kernel\TV\CLSched.exe
PRC - [2005/05/11 13.50.14 | 000,221,266 | ---- | M] () -- c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
PRC - [2005/05/11 13.48.02 | 000,127,118 | ---- | M] (CyberLink Corp.) -- C:\APPS\Powercinema\PCMService.exe
PRC - [2005/02/16 16.15.20 | 000,081,920 | ---- | M] (InstallShield Software Corporation) -- C:\Programmi\File comuni\InstallShield\UpdateService\issch.exe
PRC - [2005/01/07 12.01.52 | 000,049,152 | ---- | M] () -- c:\APPS\HIDSERVICE\HidService.exe
PRC - [2004/11/26 11.43.34 | 000,090,112 | ---- | M] (Ulead Systems, Inc.) -- C:\Programmi\File comuni\Ulead Systems\AutoDetector\Monitor.exe
PRC - [2004/02/26 09.52.00 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) -- C:\Programmi\File comuni\Ulead Systems\DVD\ULCDRSvr.exe
PRC - [2003/07/02 17.40.08 | 000,045,056 | ---- | M] ( ) -- C:\WINDOWS\system32\slserv.exe


========== Modules (No Company Name) ==========

MOD - [2011/10/29 09.53.17 | 000,063,488 | ---- | M] () -- D:\Documents and Settings\All Users\Dati applicazioni\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
MOD - [2011/10/29 09.53.17 | 000,052,736 | ---- | M] () -- D:\Documents and Settings\All Users\Dati applicazioni\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10007.dll
MOD - [2011/10/16 21.50.12 | 000,998,400 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Management\90b90e700e59d73d6d692cf74e1ba16e\System.Management.ni.dll
MOD - [2011/10/15 15.31.54 | 001,840,640 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.Services\6303e256d2ac0843c3e4c24172c90544\System.Web.Services.ni.dll
MOD - [2011/10/15 15.31.50 | 011,800,576 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\60df958ca96c9b8945f836759b6abd34\System.Web.ni.dll
MOD - [2011/10/15 15.31.18 | 006,616,576 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Data\ec323cf1df697cc0a45f67de685db90c\System.Data.ni.dll
MOD - [2011/10/15 15.29.53 | 012,430,848 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\71a2ae9ad561a62181cbd9fb11e9de7a\System.Windows.Forms.ni.dll
MOD - [2011/10/15 15.29.33 | 001,587,200 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\c10bea3c4bb7ef654651141bf9419090\System.Drawing.ni.dll
MOD - [2011/10/15 15.28.15 | 005,450,752 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\70cacc44f0b4257f6037eda7a59a0aeb\System.Xml.ni.dll
MOD - [2011/10/15 15.28.01 | 000,971,264 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\bce0720436dc6cb76006377f295ea365\System.Configuration.ni.dll
MOD - [2011/10/15 15.27.55 | 007,950,848 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\af39f6e644af02873b9bae319f2bfb13\System.ni.dll
MOD - [2011/10/15 15.27.33 | 011,490,816 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\ca87ba84221991839abbe7d4bc9c6721\mscorlib.ni.dll
MOD - [2011/10/15 15.24.43 | 002,933,248 | ---- | M] () -- C:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
MOD - [2011/10/12 21.27.05 | 000,117,760 | ---- | M] () -- D:\Documents and Settings\All Users\Dati applicazioni\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
MOD - [2011/10/12 21.27.03 | 000,052,224 | ---- | M] () -- D:\Documents and Settings\All Users\Dati applicazioni\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
MOD - [2011/09/30 17.12.40 | 000,412,728 | ---- | M] () -- C:\Programmi\Google\Chrome\Application\14.0.835.202\ppgooglenaclpluginchrome.dll
MOD - [2011/09/30 17.12.39 | 003,696,184 | ---- | M] () -- C:\Programmi\Google\Chrome\Application\14.0.835.202\pdf.dll
MOD - [2011/09/30 17.11.58 | 000,348,216 | ---- | M] () -- C:\Programmi\Google\Chrome\Application\14.0.835.202\Locales\it.dll
MOD - [2011/09/30 17.11.13 | 000,142,568 | ---- | M] () -- C:\Programmi\Google\Chrome\Application\14.0.835.202\avutil-51.dll
MOD - [2011/09/30 17.11.12 | 000,253,320 | ---- | M] () -- C:\Programmi\Google\Chrome\Application\14.0.835.202\avformat-53.dll
MOD - [2011/09/30 17.11.10 | 002,403,240 | ---- | M] () -- C:\Programmi\Google\Chrome\Application\14.0.835.202\avcodec-53.dll
MOD - [2011/09/29 22.06.57 | 008,587,936 | ---- | M] () -- C:\Programmi\Google\Chrome\Application\14.0.835.202\gcswf32.dll
MOD - [2011/09/05 19.04.58 | 000,301,056 | ---- | M] () -- C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\PDFShell.ITA
MOD - [2011/05/28 22.04.56 | 000,140,288 | ---- | M] () -- C:\Programmi\WinRAR\RarExt.dll
MOD - [2010/05/01 17.44.51 | 000,307,200 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
MOD - [2010/05/01 17.44.50 | 000,204,800 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.resources\2.0.0.0_it_b77a5c561934e089\System.resources.dll
MOD - [2009/03/06 19.05.40 | 000,066,512 | ---- | M] () -- C:\Programmi\File comuni\SmartCom\DragnDropCopyHook.dll
MOD - [2009/03/06 19.05.28 | 000,543,184 | ---- | M] () -- C:\Programmi\Nokia\Nokia Internet Modem\WellphoneLib.dll
MOD - [2009/03/06 19.05.18 | 002,099,664 | ---- | M] () -- C:\Programmi\Nokia\Nokia Internet Modem\Smartcom.dll
MOD - [2008/10/02 14.29.56 | 000,032,768 | ---- | M] () -- C:\WINDOWS\system32\SSLEmptyCache.exe
MOD - [2008/08/11 09.49.51 | 000,524,288 | ---- | M] () -- C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe
MOD - [2008/08/07 08.58.04 | 000,495,616 | ---- | M] () -- C:\WINDOWS\twain_32\Samsung\CLX3170\Scan2Pc.exe
MOD - [2008/06/26 04.46.07 | 001,384,520 | ---- | M] () -- C:\WINDOWS\twain_32\Samsung\CLX3170\SSOle.dll
MOD - [2008/06/26 04.45.14 | 000,367,104 | ---- | M] () -- C:\WINDOWS\twain_32\Samsung\CLX3170\NetModule.dll
MOD - [2008/06/26 04.45.06 | 000,155,648 | ---- | M] () -- C:\WINDOWS\twain_32\Samsung\CLX3170\IMFilter.dll
MOD - [2008/06/16 09.06.10 | 000,053,248 | ---- | M] () -- C:\Programmi\Keyboard & Mouse Driver\MouseHook.dll
MOD - [2008/04/13 19.13.44 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll
MOD - [2007/12/27 16.38.58 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\SamFaxPort.dll
MOD - [2007/08/14 03.01.17 | 000,022,723 | ---- | M] () -- C:\WINDOWS\system32\sst1cl3.dll
MOD - [2007/03/29 12.17.42 | 000,106,496 | ---- | M] () -- C:\Programmi\Keyboard & Mouse Driver\keydll.dll
MOD - [2005/05/11 13.50.34 | 000,110,672 | ---- | M] () -- c:\APPS\Powercinema\Kernel\TV\CLSched.exe
MOD - [2005/05/11 13.50.14 | 000,221,266 | ---- | M] () -- c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
MOD - [2005/05/11 13.49.26 | 000,061,522 | ---- | M] () -- c:\APPS\Powercinema\Kernel\TV\CLSchMgr.dll
MOD - [2005/05/11 13.49.24 | 000,184,408 | ---- | M] () -- c:\APPS\Powercinema\Kernel\TV\CLCapEngine.dll
MOD - [2005/05/11 13.49.24 | 000,028,672 | ---- | M] () -- c:\APPS\Powercinema\Kernel\TV\CLCapSvcps.dll
MOD - [2005/05/11 13.47.40 | 000,229,458 | ---- | M] () -- c:\APPS\Powercinema\Kernel\HomeNetWorking\CLNetMedia.dll
MOD - [2005/01/07 12.01.52 | 000,049,152 | ---- | M] () -- c:\APPS\HIDSERVICE\HidService.exe
MOD - [2004/07/26 17.11.50 | 000,028,672 | ---- | M] () -- C:\Programmi\File comuni\Ulead Systems\AutoDetector\DetMethod.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- -- (Utilità di pianificazione di LiveUpdate automatico)
SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
SRV - [2011/08/12 01.38.07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Programmi\SUPERAntiSpyware\SASCORE.EXE -- (!SASCORE)
SRV - [2011/07/07 19.31.08 | 000,195,336 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Programmi\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011/06/15 17.33.20 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programmi\Microsoft\BingBar\SeaPort.EXE -- (BBUpdate)
SRV - [2011/04/27 15.39.26 | 000,011,736 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programmi\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
SRV - [2010/05/01 15.28.56 | 000,085,096 | ---- | M] (Autodesk) [On_Demand | Stopped] -- C:\Programmi\File comuni\Autodesk Shared\Service\AdskScSrv.exe -- (Autodesk Licensing Service)
SRV - [2010/01/15 14.49.20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Programmi\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2009/08/31 22.14.58 | 001,823,744 | ---- | M] (UASSOFT.COM) [Auto | Running] -- C:\Programmi\Keyboard & Mouse Driver\KMWDSrv.exe -- (KMWDSERVICE)
SRV - [2008/11/04 01.06.28 | 000,441,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programmi\File comuni\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2008/03/14 02.26.14 | 000,144,672 | ---- | M] (Nuance Communications, Inc.) [Auto | Running] -- C:\Programmi\Nuance\PDF Professional 5\PDFProFiltSrv.exe -- (PDFProFiltSrv)
SRV - [2007/04/27 07.40.00 | 000,206,400 | ---- | M] (SafeNet, Inc) [Auto | Running] -- C:\Programmi\File comuni\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe -- (SentinelProtectionServer)
SRV - [2007/04/27 01.00.04 | 000,316,992 | ---- | M] (SafeNet, Inc.) [Auto | Running] -- C:\Programmi\File comuni\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe -- (SentinelKeysServer)
SRV - [2006/10/26 14.03.08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programmi\File comuni\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2005/05/11 13.52.00 | 000,061,440 | ---- | M] (Cyberlink) [Auto | Running] -- C:\Programmi\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe -- (CyberLink Media Library Service)
SRV - [2005/05/11 13.50.34 | 000,110,672 | ---- | M] () [Auto | Running] -- c:\APPS\Powercinema\Kernel\TV\CLSched.exe -- (CLSched) CyberLink Task Scheduler (CTS)
SRV - [2005/05/11 13.50.14 | 000,221,266 | ---- | M] () [Auto | Running] -- c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe -- (CLCapSvc) CyberLink Background Capture Service (CBCS)
SRV - [2005/01/07 12.01.52 | 000,049,152 | ---- | M] () [Auto | Running] -- c:\APPS\HIDSERVICE\HidService.exe -- (GenericHidService)
SRV - [2004/02/26 09.52.00 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) [Auto | Running] -- C:\Programmi\File comuni\Ulead Systems\DVD\ULCDRSvr.exe -- (UleadBurningHelper)
SRV - [2003/07/02 17.40.08 | 000,045,056 | ---- | M] ( ) [Auto | Running] -- C:\WINDOWS\System32\slserv.exe -- (SLService)


========== Driver Services (SafeList) ==========

DRV - [2011/10/29 10.01.20 | 000,028,752 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- D:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Microsoft Antimalware\Definition Updates\{BFAABD06-8560-4C8D-8FC5-0FFD1FE13BDF}\MpKslab7fea6d.sys -- (MpKslab7fea6d)
DRV - [2011/07/22 18.27.02 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programmi\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2011/07/12 23.55.22 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programmi\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2009/11/19 01.24.26 | 000,095,232 | R--- | M] (ATI Research Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV - [2009/08/05 22.48.42 | 000,054,752 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\fssfltr_tdi.sys -- (fssfltr)
DRV - [2009/04/29 23.37.26 | 000,025,088 | ---- | M] (Windows ® Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\KMWDFILTER.sys -- (KMWDFILTERx86)
DRV - [2009/04/29 23.37.26 | 000,025,088 | ---- | M] (Windows ® Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\KMWDFILTER.sys -- (KMWDFilter)
DRV - [2009/03/03 15.32.48 | 000,027,008 | ---- | M] (Icera Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nokiappo.sys -- (nokiappo)
DRV - [2009/03/03 15.32.48 | 000,019,072 | ---- | M] (Icera Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nokiacpo.sys -- (nokiacpo)
DRV - [2008/12/18 09.19.18 | 000,067,528 | ---- | M] (Aladdin Knowledge Systems Ltd.) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\eugssxp.sys -- (eugss)
DRV - [2008/12/18 09.13.18 | 000,025,680 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\eusk2par.sys -- (eusk2par)
DRV - [2008/07/11 07.05.00 | 000,092,712 | ---- | M] (SafeNet, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\System32\Drivers\SENTINEL.SYS -- (Sentinel)
DRV - [2008/07/11 07.05.00 | 000,037,088 | ---- | M] (SafeNet, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SNTNLUSB.SYS -- (SNTNLUSB)
DRV - [2007/10/22 08.55.46 | 000,041,984 | ---- | M] (Samsung Electronics Co., Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\DgivEcp.sys -- (DgiVecp)
DRV - [2006/09/18 15.12.36 | 000,020,269 | ---- | M] (USB Smart Card Reader) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\EMVSCARD.sys -- (EMVSCARD)
DRV - [2006/01/12 21.46.28 | 000,252,928 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\rt73.sys -- (RT73)
DRV - [2005/08/22 11.02.02 | 000,043,968 | ---- | M] (Eutron) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\eusk3usb.sys -- (eusk3usb)
DRV - [2005/06/29 14.35.10 | 003,173,888 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2005/01/07 17.07.16 | 000,145,920 | ---- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Hdaudio.sys -- (HdAudAddService)
DRV - [2004/08/03 22.41.40 | 000,013,776 | ---- | M] (Smart Link) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RecAgent.sys -- (RecAgent)
DRV - [2003/12/31 11.58.46 | 000,069,504 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtlnic51.sys -- (RTL8023)
DRV - [2003/08/20 17.34.50 | 000,548,952 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\slntamr.sys -- (Slntamr)
DRV - [2003/07/16 12.30.26 | 000,221,736 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mtlmnt5.sys -- (Mtlmnt5)
DRV - [2003/07/02 16.26.36 | 001,301,128 | ---- | M] ( ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mtlstrm.sys -- (Mtlstrm)
DRV - [2003/07/02 16.24.36 | 000,086,128 | ---- | M] ( ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\slnthal.sys -- (SlNtHal)
DRV - [2003/07/02 16.12.52 | 000,039,348 | ---- | M] (Vireo Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\slwdmsup.sys -- (SlWdmSup)
DRV - [2003/07/02 15.57.10 | 000,167,384 | ---- | M] ( ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ntmtlfax.sys -- (NtMtlFax)
DRV - [2002/10/24 02.00.00 | 000,017,080 | R--- | M] (Micropi Elettronica) [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\CPUSB.sys -- (CPUSB)
DRV - [1997/05/30 00.00.00 | 000,021,824 | ---- | M] (Micropi Elettronica - Italia) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\CPWNT.SYS -- (cpwnt)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========



IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-2487860481-4207145581-1689497151-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
IE - HKU\S-1-5-21-2487860481-4207145581-1689497151-1006\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - No CLSID value found
IE - HKU\S-1-5-21-2487860481-4207145581-1689497151-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programmi\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Programmi\McAfee\SiteAdvisor\npmcffplg32.dll File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Programmi\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Programmi\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Programmi\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2088: C:\Programmi\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.2146: C:\Programmi\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1069: C:\Programmi\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programmi\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programmi\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programmi\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Programmi\McAfee\SiteAdvisor


========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Shockwave Flash (Enabled) = C:\Programmi\Google\Chrome\Application\14.0.835.202\gcswf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.200.2 (Enabled) = C:\Programmi\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U20 (Enabled) = C:\Programmi\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Programmi\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Programmi\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\WINDOWS\system32\Adobe\Director\np32dsw.dll
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Programmi\Real\RealPlayer\Netscape6\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Programmi\Real\RealPlayer\Netscape6\nprpjplug.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Programmi\Windows Media Player\npdsplay.dll
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Programmi\Microsoft\Office Live\npOLW.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Programmi\Google\Chrome\Application\14.0.835.202\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Programmi\Google\Chrome\Application\14.0.835.202\pdf.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Programmi\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Programmi\Windows Media Player\npwmsdrm.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Programmi\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Programmi\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Programmi\Real\RealPlayer\Netscape6\nprjplug.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Programmi\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin

O1 HOSTS File: ([2011/10/14 22.56.30 | 000,000,098 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Guida per l'accesso a Windows Live) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (CNisExtBho Class) - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Programmi\File comuni\Symantec Shared\AdBlocking\NISShExt.dll File not found
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O2 - BHO: (CNavExtBho Class) - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmi\Norton Internet Security\Norton AntiVirus\NavShExt.dll File not found
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Programmi\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (ZeonIEEventHelper Class) - {DA986D7D-CCAF-47B2-84FE-BFA1549BEBF9} - C:\Programmi\Nuance\PDF Professional 5\bin\ZeonIEFavClient.dll (Zeon Corporation)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Programmi\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (Nuance PDF) - {E3286BF1-E654-42FF-B4A6-5E111731DF6B} - C:\Programmi\Nuance\PDF Professional 5\bin\ZeonIEFavClient.dll (Zeon Corporation)
O3 - HKU\S-1-5-21-2487860481-4207145581-1689497151-1006\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O4 - HKLM..\Run: [3170 Scan2PC] C:\WINDOWS\Twain_32\Samsung\CLX3170\Scan2pc.exe ()
O4 - HKLM..\Run: [Adobe ARM] C:\Programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [AzMixerSel] C:\Programmi\Realtek\InstallShield\AzMixerSel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [bit4id store register] C:\WINDOWS\System32\bit4cnsp.dll (bit4id srl (http://www.bit4id.com))
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\HdAShCut.exe (Windows ® Server 2003 DDK provider)
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Programmi\File comuni\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Programmi\File comuni\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [KMCONFIG] C:\Programmi\Keyboard & Mouse Driver\StartAutorun.exe KMConfig.exe File not found
O4 - HKLM..\Run: [MSC] c:\Programmi\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programmi\File comuni\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [Nuance PDF Professional 5-reminder] C:\Programmi\Nuance\PDF Professional 5\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] nwiz.exe /installquiet File not found
O4 - HKLM..\Run: [PCMService] c:\Apps\Powercinema\PCMService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [PDF5 Registry Controller] C:\Programmi\Nuance\PDF Professional 5\RegistryController.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PDFHook] C:\Programmi\Nuance\PDF Professional 5\PdfPro5Hook.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe ()
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Programmi\File comuni\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [SSLEmptyCache] C:\WINDOWS\system32\SSLEmptyCache.exe ()
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre6\bin\jusched.exe" File not found
O4 - HKLM..\Run: [TkBellExe] C:\Programmi\File comuni\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [Ulead AutoDetector v2] C:\Programmi\File comuni\Ulead Systems\AutoDetector\Monitor.exe (Ulead Systems, Inc.)
O4 - HKU\S-1-5-19..\Run: [Configura il mio PC] C:\Apps\SMP\PCSETUP.exe (NEC Computers International)
O4 - HKU\S-1-5-20..\Run: [Configura il mio PC] C:\Apps\SMP\PCSETUP.exe (NEC Computers International)
O4 - HKU\S-1-5-21-2487860481-4207145581-1689497151-1006..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKU\S-1-5-21-2487860481-4207145581-1689497151-1006..\Run: [Nokia Internet Modem] C:\Programmi\Nokia\Nokia Internet Modem\WellPhone2.exe (SmartCom)
O4 - HKU\S-1-5-21-2487860481-4207145581-1689497151-1006..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe File not found
O4 - HKU\S-1-5-21-2487860481-4207145581-1689497151-1006..\Run: [SUPERAntiSpyware] C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - Startup: D:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\McAfee Security Scan Plus.lnk = C:\Programmi\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O4 - Startup: D:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\Tasto di scelta rapida per l'avvio di AutoCAD LT.lnk = C:\Programmi\File comuni\Autodesk Shared\acstart17.exe (Autodesk, Inc)
O4 - Startup: D:\Documents and Settings\Ignazio.SN111236160311\Menu Avvio\Programmi\Esecuzione automatica\Registration-Studio 7.lnk = File not found
O4 - Startup: D:\Documents and Settings\ignazio.SN111236160311.002\Menu Avvio\Programmi\Esecuzione automatica\Registrazioni Seagate.lnk = File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-2487860481-4207145581-1689497151-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Aggiungi a file PDF esistente - C:\Programmi\Nuance\PDF Professional 5\bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: Aggiungi il contenuto dei collegamenti selezionati al file PDF esistente - C:\Programmi\Nuance\PDF Professional 5\bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: Aggiungi il contenuto del collegamento al file PDF esistente - C:\Programmi\Nuance\PDF Professional 5\bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: Apri con Nuance PDF Converter 5.0 - C:\Programmi\Nuance\PDF Professional 5\cnvres_ita.dll (Nuance Communications, Inc.)
O8 - Extra context menu item: Crea file PDF - C:\Programmi\Nuance\PDF Professional 5\bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: Crea file PDF dai collegamenti selezionati - C:\Programmi\Nuance\PDF Professional 5\bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: Crea file PDF dal contenuto del collegamento - C:\Programmi\Nuance\PDF Professional 5\bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: Google Sidewiki... - C:\Programmi\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll (Google Inc.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macr...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {4D054067-DE3A-48F9-B19B-BCD229B9AE8D} http://www.samsungdp...X/DrPrinter.cab (PrinterHelpEtcActiveX Control)
O16 - DPF: {877E14A6-0ACF-4509-8CF3-E4A0F4ED46F4} http://supportsiss.l...onents/pdlc.cab (Postazione di Lavoro del Cittadino 3.0)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.5.0_02)
O16 - DPF: {CAFEEFAC-0015-0000-0015-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.5.0_15)
O16 - DPF: {CAFEEFAC-0015-0000-0016-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.5.0_16)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.m...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1F026B2A-18BC-41FA-9D3B-4855C93656BA}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2A5FC410-9131-47A3-BC0E-370304AE95BF}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6519A8C1-B342-4041-866B-71B438D02F86}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\dssrequest - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programmi\File comuni\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programmi\File comuni\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programmi\File comuni\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\sacore - No CLSID value found
O18 - Protocol\Filter\application/x-internet-signup {A173B69A-1F9B-4823-9FDA-412F641E65D6} - C:\Programmi\Tiscali\Tiscali Internet\dlls\tiscalifilter.dll ()
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programmi\File comuni\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Programmi\SUPERAntiSpyware\SASWINLO.DLL) - C:\Programmi\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Reg Error: Value error.) - Reg Error: Value error. File not found
O24 - Desktop Components:0 (Pagina iniziale corrente) - About:Home
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Programmi\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/10/14 11.40.51 | 000,582,656 | ---- | C] (OldTimer Tools) -- D:\Documents and Settings\ignazio.SN111236160311.003\Desktop\OTL.exe
[2011/10/14 11.40.34 | 001,916,416 | ---- | C] (AVAST Software) -- D:\Documents and Settings\ignazio.SN111236160311.003\Desktop\aswMBR.exe
[2011/10/14 11.40.21 | 000,000,000 | ---D | C] -- D:\Documents and Settings\ignazio.SN111236160311.003\Documenti\Downloads
[2011/10/12 22.09.54 | 000,000,000 | ---D | C] -- C:\Programmi\CCleaner
[2011/10/12 22.09.50 | 000,000,000 | ---D | C] -- D:\Documents and Settings\All Users\Menu Avvio\Programmi\Google Chrome
[2011/10/12 21.50.51 | 000,000,000 | ---D | C] -- D:\Documents and Settings\ignazio.SN111236160311.003\Dati applicazioni\SUPERAntiSpyware.com
[2011/10/12 21.26.11 | 000,000,000 | ---D | C] -- D:\Documents and Settings\All Users\Dati applicazioni\SUPERAntiSpyware.com
[2011/10/12 20.16.06 | 000,000,000 | ---D | C] -- D:\Documents and Settings\All Users\Menu Avvio\Programmi\Malwarebytes' Anti-Malware
[2011/10/12 20.16.00 | 000,022,216 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/10/12 20.16.00 | 000,000,000 | ---D | C] -- C:\Programmi\Malwarebytes' Anti-Malware
[2011/10/11 16.35.04 | 000,000,000 | ---D | C] -- D:\Documents and Settings\ignazio.SN111236160311.003\Dati applicazioni\Malwarebytes
[2011/10/11 13.02.45 | 000,000,000 | ---D | C] -- D:\Documents and Settings\All Users\Dati applicazioni\Malwarebytes
[2011/10/08 09.09.19 | 000,000,000 | ---D | C] -- D:\Documents and Settings\ignazio.SN111236160311.003\Desktop\TESTI
[2011/10/08 09.06.36 | 000,000,000 | ---D | C] -- C:\Programmi\SUPERAntiSpyware
[2011/10/07 23.33.21 | 000,000,000 | ---D | C] -- D:\Documents and Settings\All Users\Dati applicazioni\Spybot - Search & Destroy
[2011/10/07 23.33.21 | 000,000,000 | ---D | C] -- C:\Programmi\Spybot - Search & Destroy
[2011/10/07 23.29.27 | 007,909,184 | ---- | C] (McAfee Inc.) -- D:\Documents and Settings\ignazio.SN111236160311.003\Desktop\stinger10.2.0.310.exe
[2010/05/01 11.47.53 | 000,018,944 | ---- | C] ( ) -- C:\WINDOWS\System32\Implode.dll
[2010/04/30 19.21.49 | 000,014,976 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\winddx.sys
[1980/01/01 00.00.00 | 001,301,128 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\mtlstrm.sys
[1980/01/01 00.00.00 | 000,548,952 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\slntamr.sys
[1980/01/01 00.00.00 | 000,221,736 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\mtlmnt5.sys
[1980/01/01 00.00.00 | 000,167,384 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\ntmtlfax.sys
[1980/01/01 00.00.00 | 000,086,128 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\slnthal.sys
[1980/01/01 00.00.00 | 000,045,056 | ---- | C] ( ) -- C:\WINDOWS\System32\slserv.exe
[2 D:\Documents and Settings\ignazio.SN111236160311.003\Impostazioni locali\Dati applicazioni\*.tmp files -> D:\Documents and Settings\ignazio.SN111236160311.003\Impostazioni locali\Dati applicazioni\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/10/29 15.21.32 | 000,000,156 | ---- | M] () -- D:\Documents and Settings\ignazio.SN111236160311.003\default.pls
[2011/10/29 15.21.32 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2011/10/29 14.54.18 | 000,001,132 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/10/29 10.38.29 | 000,095,403 | ---- | M] () -- D:\Documents and Settings\ignazio.SN111236160311.003\Desktop\ReportPrinter Report.pdf
[2011/10/29 10.19.33 | 000,053,554 | ---- | M] () -- D:\Documents and Settings\ignazio.SN111236160311.003\Desktop\Rapporto MODUL4.pdf
[2011/10/29 09.55.32 | 000,000,416 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2011/10/29 09.51.34 | 000,276,202 | ---- | M] () -- C:\WINDOWS\System32\NvApps.xml
[2011/10/29 09.50.26 | 000,001,128 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/10/29 09.49.59 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/10/29 09.49.52 | 3220,754,432 | -HS- | M] () -- C:\hiberfil.sys
[2011/10/28 12.25.32 | 000,115,712 | ---- | M] () -- D:\Documents and Settings\ignazio.SN111236160311.003\Impostazioni locali\Dati applicazioni\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/10/24 21.16.01 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/10/21 13.02.17 | 000,031,513 | ---- | M] () -- D:\Documents and Settings\ignazio.SN111236160311.003\Desktop\vancouverkiss.jpg
[2011/10/18 11.21.33 | 000,575,056 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/10/15 15.24.58 | 000,490,164 | ---- | M] () -- C:\WINDOWS\System32\perfh010.dat
[2011/10/15 15.24.58 | 000,441,996 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/10/15 15.24.58 | 000,084,926 | ---- | M] () -- C:\WINDOWS\System32\perfc010.dat
[2011/10/15 15.24.58 | 000,071,932 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011/10/15 15.16.47 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011/10/14 22.56.30 | 000,000,098 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\Hosts
[2011/10/14 11.40.50 | 000,582,656 | ---- | M] (OldTimer Tools) -- D:\Documents and Settings\ignazio.SN111236160311.003\Desktop\OTL.exe
[2011/10/14 11.40.31 | 001,916,416 | ---- | M] (AVAST Software) -- D:\Documents and Settings\ignazio.SN111236160311.003\Desktop\aswMBR.exe
[2011/10/14 11.16.50 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/10/12 22.09.55 | 000,000,575 | ---- | M] () -- D:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2011/10/12 22.09.50 | 000,001,668 | ---- | M] () -- D:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2011/10/12 21.26.15 | 000,001,531 | ---- | M] () -- D:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011/10/12 20.16.08 | 000,000,649 | ---- | M] () -- D:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/10/08 00.09.03 | 000,000,151 | ---- | M] () -- C:\WINDOWS\PhotoSnapViewer.INI
[2011/10/07 23.29.56 | 007,909,184 | ---- | M] (McAfee Inc.) -- D:\Documents and Settings\ignazio.SN111236160311.003\Desktop\stinger10.2.0.310.exe
[2011/10/03 10.33.20 | 005,971,456 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtml.dll
[2 D:\Documents and Settings\ignazio.SN111236160311.003\Impostazioni locali\Dati applicazioni\*.tmp files -> D:\Documents and Settings\ignazio.SN111236160311.003\Impostazioni locali\Dati applicazioni\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/10/29 10.38.26 | 000,095,403 | ---- | C] () -- D:\Documents and Settings\ignazio.SN111236160311.003\Desktop\ReportPrinter Report.pdf
[2011/10/29 10.19.32 | 000,053,554 | ---- | C] () -- D:\Documents and Settings\ignazio.SN111236160311.003\Desktop\Rapporto MODUL4.pdf
[2011/10/21 13.02.21 | 000,031,513 | ---- | C] () -- D:\Documents and Settings\ignazio.SN111236160311.003\Desktop\vancouverkiss.jpg
[2011/10/15 15.14.13 | 000,001,393 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2011/10/14 11.35.39 | 3220,754,432 | -HS- | C] () -- C:\hiberfil.sys
[2011/10/14 11.16.50 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/10/12 22.09.55 | 000,000,575 | ---- | C] () -- D:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2011/10/12 22.09.50 | 000,001,668 | ---- | C] () -- D:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2011/10/12 21.26.15 | 000,001,531 | ---- | C] () -- D:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011/10/12 20.16.08 | 000,000,649 | ---- | C] () -- D:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/08/05 17.38.00 | 000,000,000 | ---- | C] () -- D:\Documents and Settings\ignazio.SN111236160311.003\Impostazioni locali\Dati applicazioni\{2D15FA5F-9426-4F7A-8328-27556455A395}
[2011/06/26 18.18.18 | 000,000,564 | ---- | C] () -- D:\Documents and Settings\ignazio.SN111236160311.003\Impostazioni locali\Dati applicazioni\FSCache.dat
[2011/06/20 15.29.14 | 021,022,914 | ---- | C] () -- C:\Programmi\vlc-1.1.10-win32.exe
[2011/03/12 22.46.40 | 000,115,712 | ---- | C] () -- D:\Documents and Settings\ignazio.SN111236160311.003\Impostazioni locali\Dati applicazioni\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/02/14 19.08.42 | 000,000,141 | ---- | C] () -- D:\Documents and Settings\ignazio.SN111236160311.003\Impostazioni locali\Dati applicazioni\fusioncache.dat
[2010/12/08 11.42.07 | 000,014,849 | ---- | C] () -- C:\WINDOWS\CJ1_10.ini
[2010/12/07 19.53.11 | 000,327,680 | ---- | C] () -- C:\WINDOWS\eSINLD.dll
[2010/12/07 19.53.09 | 000,020,480 | ---- | C] () -- C:\WINDOWS\eSINLDLG.dll
[2010/12/06 13.06.20 | 000,303,104 | R--- | C] () -- C:\WINDOWS\System32\eST3snm.dll
[2010/11/22 18.39.51 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\RT2573.dll
[2010/11/22 18.39.48 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\GTW32N50.dll
[2010/11/04 20.34.26 | 000,059,916 | ---- | C] () -- C:\WINDOWS\System32\bit4cnsp-uninst.exe
[2010/10/28 19.56.48 | 000,000,050 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2010/10/23 13.06.08 | 000,000,530 | ---- | C] () -- C:\WINDOWS\System32\tx14_ic.ini
[2010/08/27 20.21.24 | 001,757,222 | ---- | C] () -- C:\WINDOWS\System32\dbcmdb32.dll
[2010/08/27 20.21.24 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\DBCDBF32.DLL
[2010/08/27 20.21.24 | 000,135,168 | ---- | C] () -- C:\WINDOWS\System32\dbcmem32.dll
[2010/08/27 20.21.24 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\dbcgeo32.dll
[2010/08/27 20.21.24 | 000,057,856 | ---- | C] () -- C:\WINDOWS\System32\Skeylink.dll
[2010/08/02 18.24.06 | 000,000,392 | ---- | C] () -- C:\WINDOWS\System32\winsusrm.dll
[2010/08/02 18.24.06 | 000,000,344 | ---- | C] () -- C:\WINDOWS\System32\winsusrx.dll
[2010/07/29 19.24.21 | 000,000,024 | ---- | C] () -- C:\WINDOWS\mc4hvac.ini
[2010/07/29 18.42.56 | 000,000,037 | ---- | C] () -- C:\WINDOWS\acltdrv.ini
[2010/07/29 18.42.45 | 000,000,039 | ---- | C] () -- C:\WINDOWS\progman.ini
[2010/07/29 18.28.13 | 000,000,000 | ---- | C] () -- C:\WINDOWS\MTSTACK.INI
[2010/07/29 18.28.11 | 000,043,008 | ---- | C] () -- C:\WINDOWS\System32\MTSTACK.EXE
[2010/07/15 18.36.48 | 001,765,376 | R--- | C] () -- C:\WINDOWS\System32\TKernel.dll
[2010/07/15 18.36.47 | 001,851,392 | R--- | C] () -- C:\WINDOWS\System32\TKXSBase.dll
[2010/07/15 18.36.46 | 000,290,816 | R--- | C] () -- C:\WINDOWS\System32\TKXDESTEP.dll
[2010/07/15 18.36.46 | 000,262,144 | R--- | C] () -- C:\WINDOWS\System32\TKXCAF.dll
[2010/07/15 18.36.46 | 000,054,272 | R--- | C] () -- C:\WINDOWS\System32\TKXDEIGES.dll
[2010/07/15 18.36.45 | 002,885,120 | R--- | C] () -- C:\WINDOWS\System32\TKV3d.dll
[2010/07/15 18.36.45 | 000,567,296 | R--- | C] () -- C:\WINDOWS\System32\TKVRML.dll
[2010/07/15 18.36.44 | 000,901,120 | R--- | C] () -- C:\WINDOWS\System32\TKV2d.dll
[2010/07/15 18.36.43 | 001,568,768 | R--- | C] () -- C:\WINDOWS\System32\TKTopAlgo.dll
[2010/07/15 18.36.42 | 000,909,312 | R--- | C] () -- C:\WINDOWS\System32\TKShapeSchema.dll
[2010/07/15 18.36.41 | 001,519,616 | R--- | C] () -- C:\WINDOWS\System32\TKShHealing.dll
[2010/07/15 18.36.40 | 001,097,728 | R--- | C] () -- C:\WINDOWS\System32\TKService.dll
[2010/07/15 18.36.40 | 000,106,496 | R--- | C] () -- C:\WINDOWS\System32\TKSTL.dll
[2010/07/15 18.36.39 | 001,830,912 | R--- | C] () -- C:\WINDOWS\System32\TKSTEPBase.dll
[2010/07/15 18.36.38 | 001,974,272 | R--- | C] () -- C:\WINDOWS\System32\TKSTEP.dll
[2010/07/15 18.36.38 | 000,589,824 | R--- | C] () -- C:\WINDOWS\System32\TKSTEP209.dll
[2010/07/15 18.36.38 | 000,491,520 | R--- | C] () -- C:\WINDOWS\System32\TKSTEPAttr.dll
[2010/07/15 18.36.37 | 000,925,696 | R--- | C] () -- C:\WINDOWS\System32\TKPShape.dll
[2010/07/15 18.36.37 | 000,237,568 | R--- | C] () -- C:\WINDOWS\System32\TKPrim.dll
[2010/07/15 18.36.36 | 000,761,856 | R--- | C] () -- C:\WINDOWS\System32\TKOffset.dll
[2010/07/15 18.36.36 | 000,602,112 | R--- | C] () -- C:\WINDOWS\System32\TKOpenGl.dll
[2010/07/15 18.36.35 | 001,142,784 | R--- | C] () -- C:\WINDOWS\System32\TKMath.dll
[2010/07/15 18.36.35 | 000,454,656 | R--- | C] () -- C:\WINDOWS\System32\TKMesh.dll
[2010/07/15 18.36.35 | 000,307,200 | R--- | C] () -- C:\WINDOWS\System32\TKMeshVS.dll
[2010/07/15 18.36.34 | 002,543,616 | R--- | C] () -- C:\WINDOWS\System32\TKIGES.dll
[2010/07/15 18.36.34 | 000,835,584 | R--- | C] () -- C:\WINDOWS\System32\TKLCAF.dll
[2010/07/15 18.36.33 | 000,794,624 | R--- | C] () -- C:\WINDOWS\System32\TKHLR.dll
[2010/07/15 18.36.32 | 003,448,832 | R--- | C] () -- C:\WINDOWS\System32\TKGeomBase.dll
[2010/07/15 18.36.31 | 003,072,000 | R--- | C] () -- C:\WINDOWS\System32\TKGeomAlgo.dll
[2010/07/15 18.36.30 | 000,827,392 | R--- | C] () -- C:\WINDOWS\System32\TKG3d.dll
[2010/07/15 18.36.29 | 001,576,960 | R--- | C] () -- C:\WINDOWS\System32\TKFillet.dll
[2010/07/15 18.36.29 | 000,364,544 | R--- | C] () -- C:\WINDOWS\System32\TKG2d.dll
[2010/07/15 18.36.28 | 000,294,912 | R--- | C] () -- C:\WINDOWS\System32\TKCDF.dll
[2010/07/15 18.36.28 | 000,245,760 | R--- | C] () -- C:\WINDOWS\System32\TKCAF.dll
[2010/07/15 18.36.26 | 002,502,656 | R--- | C] () -- C:\WINDOWS\System32\TKBool.dll
[2010/07/15 18.36.24 | 000,606,208 | R--- | C] () -- C:\WINDOWS\System32\TKBRep.dll
[2010/07/15 18.36.23 | 001,249,280 | R--- | C] () -- C:\WINDOWS\System32\TKBO.dll
[2010/07/15 18.36.22 | 000,376,832 | R--- | C] () -- C:\WINDOWS\System32\PTKernel.dll
[2010/06/26 13.23.04 | 000,060,984 | ---- | C] () -- D:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\FontCache3.0.0.0.dat
[2010/05/25 19.19.18 | 000,906,784 | ---- | C] () -- C:\WINDOWS\System32\Owl52f.dll
[2010/05/25 19.19.17 | 000,297,680 | ---- | C] () -- C:\WINDOWS\System32\Bocof.dll
[2010/05/22 14.46.06 | 000,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI
[2010/05/22 13.02.18 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2010/05/08 11.14.43 | 002,183,470 | ---- | C] () -- C:\WINDOWS\System32\nvdata.bin
[2010/05/04 22.23.19 | 000,000,010 | ---- | C] () -- C:\WINDOWS\WinInit.ini
[2010/05/02 14.48.09 | 000,001,364 | ---- | C] () -- C:\WINDOWS\LMAAG2DD.ini
[2010/05/01 19.05.40 | 000,172,032 | ---- | C] () -- C:\WINDOWS\System32\SecSNMP.dll
[2010/05/01 19.05.33 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\SamFaxPort.dll
[2010/05/01 19.05.28 | 000,000,116 | ---- | C] () -- C:\WINDOWS\Readiris.ini
[2010/05/01 19.05.23 | 000,023,040 | ---- | C] () -- C:\WINDOWS\System32\irisco32.dll
[2010/05/01 19.04.06 | 000,479,232 | ---- | C] () -- C:\WINDOWS\ssndii.exe
[2010/05/01 19.03.08 | 000,022,723 | ---- | C] () -- C:\WINDOWS\System32\sst1cl3.dll
[2010/05/01 18.59.56 | 000,110,592 | R--- | C] () -- C:\WINDOWS\WiaInst.exe
[2010/05/01 18.59.54 | 000,138,240 | R--- | C] () -- C:\WINDOWS\System32\SaXPUIEx.dll
[2010/05/01 18.59.53 | 000,116,736 | R--- | C] () -- C:\WINDOWS\System32\SaXPIPH.dll
[2010/05/01 18.59.53 | 000,087,040 | R--- | C] () -- C:\WINDOWS\System32\SaXPSTI.dll
[2010/05/01 18.59.52 | 000,139,776 | R--- | C] () -- C:\WINDOWS\System32\SaXPEH.dll
[2010/05/01 18.59.51 | 000,138,752 | R--- | C] () -- C:\WINDOWS\System32\SaXPWIA.dll
[2010/05/01 18.12.26 | 000,015,516 | R--- | C] () -- C:\WINDOWS\CJ2_10.ini
[2010/05/01 18.12.26 | 000,000,037 | R--- | C] () -- C:\WINDOWS\V_eS205SC.ini
[2010/05/01 18.08.37 | 000,274,432 | ---- | C] () -- C:\WINDOWS\System32\ESTsnmp.dll
[2010/05/01 18.08.06 | 000,024,576 | ---- | C] () -- C:\WINDOWS\SPortLG.dll
[2010/05/01 18.08.05 | 000,286,720 | R--- | C] () -- C:\WINDOWS\eSTsnmp.dll
[2010/05/01 17.29.23 | 000,017,072 | ---- | C] () -- C:\WINDOWS\System32\serv.dll
[2010/05/01 16.54.34 | 000,079,360 | ---- | C] () -- C:\WINDOWS\System32\acdbres.dll
[2010/05/01 15.10.50 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin
[2010/05/01 15.10.44 | 000,887,724 | R--- | C] () -- C:\WINDOWS\System32\ativva6x.dat
[2010/05/01 15.10.44 | 000,197,982 | R--- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2010/05/01 15.10.44 | 000,000,003 | R--- | C] () -- C:\WINDOWS\System32\ativva5x.dat
[2010/05/01 11.55.09 | 000,000,548 | ---- | C] () -- C:\WINDOWS\EvvivaRG.ini
[2010/05/01 11.55.05 | 000,000,600 | ---- | C] () -- C:\WINDOWS\NEXTRG.INI
[2010/05/01 11.54.16 | 000,000,264 | ---- | C] () -- C:\WINDOWS\FinsonLiveUpdate.ini
[2010/04/30 20.08.56 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2010/04/30 19.49.26 | 000,198,144 | ---- | C] () -- C:\WINDOWS\System32\_psisdecd.dll
[2010/04/30 19.49.07 | 000,000,424 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2010/04/30 19.45.26 | 000,000,604 | ---- | C] () -- C:\WINDOWS\System32\SETUPPC.INI
[2010/04/30 19.38.23 | 000,007,585 | ---- | C] () -- C:\WINDOWS\HDReg.ini
[2010/04/30 19.29.48 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2010/04/30 19.21.49 | 000,475,136 | ---- | C] () -- C:\WINDOWS\System32\SLLights.dll
[2010/04/30 19.21.49 | 000,376,832 | ---- | C] () -- C:\WINDOWS\System32\slmh.exe
[2010/04/30 19.21.49 | 000,167,936 | ---- | C] () -- C:\WINDOWS\System32\minirec.exe
[2010/04/30 19.21.49 | 000,155,648 | ---- | C] () -- C:\WINDOWS\System32\amr_cpl.dll
[2010/04/30 19.21.49 | 000,135,168 | ---- | C] () -- C:\WINDOWS\System32\SLMOHServ.dll
[2010/04/30 19.21.49 | 000,061,440 | ---- | C] () -- C:\WINDOWS\SmCfg.exe
[2009/11/24 15.58.10 | 000,000,213 | ---- | C] () -- C:\WINDOWS\V_eSWIA.ini
[2009/11/24 15.57.27 | 000,000,254 | ---- | C] () -- C:\WINDOWS\V_eSTRS.ini
[2009/11/24 15.57.04 | 000,000,248 | ---- | C] () -- C:\WINDOWS\V_eSFD.ini
[2009/11/24 15.54.51 | 000,000,251 | ---- | C] () -- C:\WINDOWS\V_eSABV.ini
[2009/10/15 14.51.26 | 000,270,336 | ---- | C] () -- C:\WINDOWS\System32\eSABLD.dll
[2009/10/09 13.45.02 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\eSABLDLG.dll
[2009/09/10 19.59.10 | 000,003,990 | ---- | C] () -- C:\WINDOWS\COMM_RS.ini
[2009/09/10 19.59.10 | 000,003,990 | ---- | C] () -- C:\WINDOWS\COMM_FD.ini
[2009/09/10 19.59.10 | 000,003,990 | ---- | C] () -- C:\WINDOWS\COMM_AB.ini
[2009/08/30 19.15.48 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\eSTsnv3.dll
[2009/08/26 18.45.52 | 000,001,577 | ---- | C] () -- C:\WINDOWS\System32\eSABLD.bin
[2008/10/02 14.29.58 | 000,000,244 | ---- | C] () -- C:\WINDOWS\System32\SSLEmptyCache.ini
[2008/10/02 14.29.56 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\SSLEmptyCache.exe
[2008/01/15 21.13.38 | 000,000,422 | ---- | C] () -- C:\WINDOWS\APL_RS.ini
[2008/01/15 21.13.38 | 000,000,422 | ---- | C] () -- C:\WINDOWS\APL_FD.ini
[2008/01/15 21.13.38 | 000,000,422 | ---- | C] () -- C:\WINDOWS\APL_AB.ini
[2007/03/12 18.49.21 | 000,000,085 | -HS- | C] () -- D:\Documents and Settings\All Users\Dati applicazioni\.zreglib
[2006/06/16 18.41.00 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\ClearLogonCredentials.dll
[2005/10/21 15.28.56 | 000,005,968 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2005/05/12 14.24.00 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2004/09/03 12.11.59 | 000,000,825 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004/09/03 11.59.47 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2004/09/03 11.52.31 | 000,021,840 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004/09/03 11.46.42 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004/09/03 11.45.07 | 000,575,056 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2004/09/03 11.37.03 | 000,490,164 | ---- | C] () -- C:\WINDOWS\System32\perfh010.dat
[2004/09/03 11.37.03 | 000,300,212 | ---- | C] () -- C:\WINDOWS\System32\perfi010.dat
[2004/09/03 11.37.03 | 000,084,926 | ---- | C] () -- C:\WINDOWS\System32\perfc010.dat
[2004/09/03 11.37.03 | 000,034,004 | ---- | C] () -- C:\WINDOWS\System32\perfd010.dat
[2004/09/03 11.36.44 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/09/03 11.36.41 | 000,441,996 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004/09/03 11.36.41 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/09/03 11.36.41 | 000,071,932 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004/09/03 11.36.41 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/09/03 11.36.40 | 000,004,541 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004/09/03 11.36.38 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2004/09/03 11.36.36 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2004/09/03 11.36.28 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/09/03 11.36.28 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/09/03 11.36.20 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/09/03 11.36.12 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2003/04/01 11.49.16 | 000,005,360 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[1980/01/01 00.00.00 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\slextspk.dll
[1980/01/01 00.00.00 | 000,159,744 | ---- | C] () -- C:\WINDOWS\System32\SLGen.dll
[1980/01/01 00.00.00 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\coinst.dll
[1980/01/01 00.00.00 | 000,024,576 | ---- | C] () -- C:\WINDOWS\slrundll.exe

========== Alternate Data Streams ==========

@Alternate Data Stream - 119 bytes -> D:\Documents and Settings\All Users\Dati applicazioni\TEMP:DFC5A2B2
@Alternate Data Stream - 109 bytes -> D:\Documents and Settings\All Users\Dati applicazioni\TEMP:A8ADE5D8

< End of report >

Attached Files

•  OTL.Txt   118.1KB   121 downloads

Edited by Essexboy, 29 October 2011 - 07:51 AM.

[Essexboy]

I think that spybot is re-instating that key - are you ready for the second system now ?


While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent our tools from fixing certain things.
Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your the MBAM log is clean.

• Open Spybot Search & Destroy.
• In the Mode menu click "Advanced mode" if not already selected.
• Choose "Yes" at the Warning prompt.
• Expand the "Tools" menu.
• Click "Resident".
• Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
• In the File menu click "Exit" to exit Spybot Search & Destroy.

[GabboX]

I'm sorry..but what's teatimer?

Anyway I don't have spybot installed.

Edited by GabboX, 29 October 2011 - 07:55 AM.

[Essexboy]

OK I will try a manual removal plus the spybot registry entries

Subject to no further problems

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset System Restore points:

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  

  :OTL
  O4 - HKU\S-1-5-21-2487860481-4207145581-1689497151-1006..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe File not found
  
  :Reg
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
  "ODBC"=-
  
  :Files
  C:\Programmi\Spybot - Search & Destroy
  
  :Commands
  [resethosts]
  [purity]
  [emptytemp]
  [EMPTYFLASH]
  [CLEARALLRESTOREPOINTS]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done

Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself.

We will now confirm that your hidden files are set to that, as some of the tools I use will change that

• Click Start.
• Open My Computer.
• Select the Tools menu and click Folder Options.
• Select the View Tab.
• Under the Hidden files and folders heading select Do not show hidden files and folders.
• Click Yes to confirm.
• Click OK.

Your Java is out of date.
Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version of Java components and upgrade the application.

Upgrading Java:

• Go to this site and click Do I have Java
• It will check your current version and then offer to update to the latest version

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

Malwarebytes.

Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link

It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit

• Microsoft Windows Update

To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?Keep safe