Free Malware Removal Forum

by **ggpp** » June 28th, 2012, 2:01 pm

Hello,
I'm not anymore able to update my antivirus. I'm adding my logfile:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19.44.32, on 28/06/2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Avira\AntiVir Desktop\sched.exe
C:\Programmi\Avira\AntiVir Desktop\avguard.exe
C:\Programmi\Java\jre6\bin\jqs.exe
c:\Programmi\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Programmi\Avira\AntiVir Desktop\avshadow.exe
C:\Programmi\Avira\AntiVir Desktop\AVWEBGRD.EXE
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Programmi\CyberLink\PowerDVD\PDVDServ.exe
C:\Programmi\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programmi\Realtek\Audio\InstallShield\AzMixerSel.exe
C:\Programmi\Microsoft Office\Office12\GrooveMonitor.exe
C:\Programmi\SweetIM\Messenger\SweetIM.exe
C:\Programmi\Ask.com\Updater\Updater.exe
C:\Programmi\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\DOCUME~1\PROPRI~1\IMPOST~1\Temp\RtkBtMnt.exe
C:\Programmi\File comuni\InstallShield\UpdateService\ISUSPM.exe
C:\Programmi\PTC\WindchillSharePointProducts\ClientManager\ProductPointService.exe
C:\Programmi\WinZip\WZQKPICK.EXE
C:\Programmi\OpenOffice.org 3\program\soffice.exe
C:\Programmi\OpenOffice.org 3\program\soffice.bin
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Alice MOBILE E1692\Alice MOBILE E1692.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Programmi\Mozilla Firefox\plugin-container.exe
C:\Programmi\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.maxiwe.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.maxiwe.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:58364
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Reganam Toolbar - {db9d7a78-a76c-4bf2-97c6-258925ee1542} - C:\Programmi\Reganam\prxtbReg2.dll
R3 - URLSearchHook: Softonic-IT Toolbar - {e3393495-8103-46a0-8181-270273eddd60} - C:\Programmi\Softonic-IT\prxtbSof0.dll
R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Programmi\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: PriceGong - {1631550F-191D-4826-B069-D9439253D926} - C:\Programmi\PriceGong\2.1.0\PriceGongIE.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: PCCBHO.CPCCBHO - {22FC6CE8-7D47-479F-B74A-BFBB04ADB9AF} - C:\Programmi\Winferno\PC Confidential\PCCBHO.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programmi\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programmi\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programmi\Ask.com\GenericAskToolbar.dll
O2 - BHO: Reganam - {db9d7a78-a76c-4bf2-97c6-258925ee1542} - C:\Programmi\Reganam\prxtbReg2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmi\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Softonic-IT - {e3393495-8103-46a0-8181-270273eddd60} - C:\Programmi\Softonic-IT\prxtbSof0.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Programmi\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Programmi\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Reganam Toolbar - {db9d7a78-a76c-4bf2-97c6-258925ee1542} - C:\Programmi\Reganam\prxtbReg2.dll
O3 - Toolbar: Softonic-IT Toolbar - {e3393495-8103-46a0-8181-270273eddd60} - C:\Programmi\Softonic-IT\prxtbSof0.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programmi\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programmi\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programmi\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RemoteControl] C:\Programmi\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Programmi\Realtek\Audio\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [PLFSetL] C:\WINDOWS\PLFSetL.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmi\File comuni\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [OwnData2Switch] #owndata20switch.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Programmi\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SweetIM] C:\Programmi\SweetIM\Messenger\SweetIM.exe
O4 - HKLM\..\Run: [ApnUpdater] "C:\Programmi\Ask.com\Updater\Updater.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Programmi\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Programmi\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ISUSPM] "C:\Programmi\File comuni\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [msnmsgr] ~"C:\Programmi\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] "C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [{7CF40D46-49E9-169D-4C2B-470852701327}] "C:\Documents and Settings\Proprietario\Dati applicazioni\Yqohex\taynwa.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Programmi\OpenOffice.org 3\program\quickstart.exe
O4 - Startup: Ritaglio schermata e avvio di OneNote 2007.lnk = C:\Programmi\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Windchill ProductPoint Client Manager.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programmi\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Programmi\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O9 - Extra button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: I&nvia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - C:\Programmi\Winferno\PC Confidential\PCConfidential.exe
O9 - Extra 'Tools' menuitem: PC Confidential - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - C:\Programmi\Winferno\PC Confidential\PCConfidential.exe
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: PC Confidential - {925DAB62-F9AC-4221-806A-057BFB1014AA} - C:\Programmi\Winferno\PC Confidential\PCConfidential.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programmi\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Avira Pianificatore (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Programmi\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira Realtime Protection (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Programmi\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Avira Web Protection (AntiVirWebService) - Avira Operations GmbH & Co. KG - C:\Programmi\Avira\AntiVir Desktop\AVWEBGRD.EXE
O23 - Service: SW Distributed TS Coordinator Service (CoordinatorServiceHost) - Dassault Systèmes SolidWorks Corp. - C:\Programmi\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Programmi\File comuni\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Servizio di Google Update (gupdate1ca3a9dbf66400a) (gupdate1ca3a9dbf66400a) - Google Inc. - C:\Programmi\Google\Update\GoogleUpdate.exe
O23 - Service: Servizio Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Programmi\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmi\Java\jre6\bin\jqs.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Programmi\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: NBService - Nero AG - C:\Programmi\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programmi\File comuni\Ahead\Lib\NMIndexingService.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Programmi\File comuni\SolidWorks Shared\Service\SolidWorksLicensing.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Programmi\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 13200 bytes

Please help me in removal whatever is blocking as spyware or visur or malware.
Thank to all who'll help me!!
AG

by **deltalima** » June 29th, 2012, 4:32 pm

Hi ggpp,

SolidWorks
Windchill SharePoint Products

Is this computer used for business or for home use?

by **ggpp** » July 1st, 2012, 1:44 pm

I use it at home

by **deltalima** » July 1st, 2012, 1:55 pm

How did you obtain the license for SolidWorks?

by **ggpp** » July 1st, 2012, 3:49 pm

Write correctly your name, address, email and I'll write back my own personal data; solidworks supplier too.
Be sure the soft is correctly bought.

by **deltalima** » July 1st, 2012, 3:51 pm

Is solidworks licensed to you or a company?

What is Windchill SharePoint Products used for?

by **ggpp** » July 1st, 2012, 3:54 pm

Solid is licensed to me. I'm a student.

Windchill I do not really what is it!

by **deltalima** » July 1st, 2012, 3:57 pm

Hi ggpp,

Welcome to the forum.

Please be aware that removing Malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.

Please note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for this issue on this machine.
Please do not run any scans or make any changes to the system unless I ask you too.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
If after 3 days you have not responded to this topic, it will be closed, and you will need to start a new one.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

Download and run OTL
Download OTL by Old Timer and save it to your Desktop.

Double click on OTL.exe to run it.
Under Output, ensure that Minimal Output is selected.
Under Extra Registry section, select Use SafeList.
Click the Scan All Users checkbox.
Click on Run Scan at the top left hand corner.
When done, two Notepad files will open.
- OTL.txt <-- Will be opened
- Extras.txt <-- Will be minimized
Please post the contents of these 2 Notepad files in your next reply.

Please download GMER Rootkit Scanner from here.

Double click the .exe file. If asked to allow gmer.sys driver to load, please consent
If it gives you a warning at program start about rootkit activity and asks if you want to run a scan...click NO.
Run Gmer again and click on the Rootkit tab.
Look at the right hand side (under Files) and uncheck all drives with the exception of your C drive.
Make sure all other boxes on the right of the screen are checked, EXCEPT for "Show All".
Click on the "Scan" and wait for the scan to finish.
Note: Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while this scan completes. Also do not use your computer during the scan.
When completed, click on the Copy button and right-click on your Desktop, choose "New" > Text document. Once the file is created, open it and right-click again and choose Paste or Ctrl+V. Save the file as gmer.txt and copy the information in your next reply.
Note: If you have any problems, try running GMER in SAFE MODE

Important! Please do not select the "Show all" checkbox during the scan..

Please post the GMER log along with OTL.txt and Extras.txt from the OTL scan into your next reply.

CKScanner

Please download CKScanner from here to your Desktop.
Make sure that CKScanner.exe is on the your Desktop before running the application!
Double-click on CKScanner.exe and click Search For Files.
After a very short time, when the cursor hourglass disappears, click Save List To File.
A message box will verify the file saved
Double-click on the CKFiles.txt icon on your Desktop and copy/paste the contents in your next reply.

Please download this tool from Microsoft.
Double click on MGADiag.exe to run it.
Click Continue.
The program will run. It takes a while to finish the diagnosis, please be patient.
Once done, click on Copy.
Open Notepad and paste the contents in the window.
Save this file and copy/paste it in your next reply.

by **ggpp** » July 1st, 2012, 4:05 pm

running OTL
wait

by **ggpp** » July 1st, 2012, 4:11 pm

OTL.txt

OTL logfile created on: 01/07/2012 22.01.44 - Run 1
OTL by OldTimer - Version 3.2.53.1 Folder = C:\Documents and Settings\Proprietario\Documenti\Download
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000410 | Country: Italia | Language: ITA | Date Format: dd/MM/yyyy

1,93 Gb Total Physical Memory | 0,64 Gb Available Physical Memory | 33,28% Memory free
3,78 Gb Paging File | 2,54 Gb Available in Paging File | 67,21% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programmi
Drive C: | 232,88 Gb Total Space | 186,61 Gb Free Space | 80,13% Space Free | Partition Type: NTFS
Drive E: | 36,96 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS

Computer Name: USER-5AEC5BC622 | User Name: Proprietario | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Proprietario\Documenti\Download\OTL.exe (OldTimer Tools)
PRC - C:\Programmi\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programmi\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programmi\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programmi\Avira\AntiVir Desktop\avwebgrd.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programmi\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programmi\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Documents and Settings\Proprietario\Impostazioni locali\Temp\RtkBtMnt.exe (Realtek Semiconductor Corp.)
PRC - C:\Programmi\Ask.com\Updater\Updater.exe ({StringFileInfo_CompanyName})
PRC - c:\Program Files\MSSQL.1\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
PRC - C:\Programmi\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.)
PRC - C:\Programmi\PTC\WindchillSharePointProducts\ClientManager\ProductPointService.exe (PTC)
PRC - C:\Programmi\WinZip\WZQKPICK.EXE (WinZip Computing, S.L.)
PRC - C:\Programmi\Alice MOBILE E1692\Alice MOBILE E1692.exe ()
PRC - C:\Programmi\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\Programmi\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Programmi\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programmi\File comuni\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
PRC - C:\Programmi\Realtek\Audio\InstallShield\AzMixerSel.exe (Realtek Semiconductor Corp.)

========== Modules (No Company Name) ==========

MOD - C:\Programmi\Mozilla Firefox\mozjs.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\285dfbf2380436e187cb624bd1cd4683\System.ServiceModel.Web.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\29bdc8352d3c26e3c572ea60639dec3b\System.Web.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\bd3bfd5b6ef659dac4d6cccb34577d33\SMDiagnostics.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\94a40f415bfa947e251888bbe88bb973\System.Configuration.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\1cdcd6d97627d345d5ff446e6ec88b97\System.ServiceModel.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\f2532204217dc10f152afd077b09927c\System.Runtime.Serialization.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\77e1279cbf4eecfb0284b63316fe43fe\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\ad99ac6b5666edb8ee742dd64f9578af\System.Windows.Forms.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\9351cf29bb1ba951e45a9b3b0edab937\System.Drawing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\9e3803cd2a11f056291862e306a8e2b2\System.ni.dll ()
MOD - C:\Programmi\Avira\AntiVir Desktop\sqlite3.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\ca87ba84221991839abbe7d4bc9c6721\mscorlib.ni.dll ()
MOD - C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Programmi\Alice MOBILE E1692\NetInfoPlugin.dll ()
MOD - C:\Programmi\Alice MOBILE E1692\Alice MOBILE E1692.exe ()
MOD - C:\Programmi\Alice MOBILE E1692\DialUpPlugin.dll ()
MOD - C:\Programmi\Alice MOBILE E1692\NDISAPI.dll ()
MOD - C:\Programmi\Alice MOBILE E1692\LocaleMgrPlugin.dll ()
MOD - C:\Programmi\Alice MOBILE E1692\SMSPlugin.dll ()
MOD - C:\Programmi\Alice MOBILE E1692\NotifyServicePlugin.dll ()
MOD - C:\Programmi\Alice MOBILE E1692\ConfigFilePlugin.dll ()
MOD - C:\Programmi\Alice MOBILE E1692\DeviceMgrPlugin.dll ()
MOD - C:\Programmi\Alice MOBILE E1692\DeviceMgrUIPlugin.dll ()
MOD - C:\Programmi\Alice MOBILE E1692\XCodec.dll ()
MOD - C:\Programmi\Alice MOBILE E1692\DeviceOperate.dll ()
MOD - C:\Programmi\Alice MOBILE E1692\DetectDev.dll ()
MOD - C:\Programmi\Alice MOBILE E1692\atcomm.dll ()
MOD - C:\Programmi\OpenOffice.org 3\program\libxml2.dll ()
MOD - C:\Programmi\Alice MOBILE E1692\isaputrace.dll ()
MOD - C:\Programmi\Alice MOBILE E1692\FileManager.dll ()

========== Win32 Services (SafeList) ==========

SRV - (HidServ) -- %SystemRoot%\System32\hidserv.dll File not found
SRV - (AppMgmt) -- %SystemRoot%\System32\appmgmts.dll File not found
SRV - (MozillaMaintenance) -- C:\Programmi\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AntiVirSchedulerService) -- C:\Programmi\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirWebService) -- C:\Programmi\Avira\AntiVir Desktop\avwebgrd.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Programmi\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (odserv) -- C:\Programmi\File comuni\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (PEVSystemStart) -- C:\username12313053u\pev.3XE ()
SRV - (MSSQL$SQLEXPRESS) SQL Server (SQLEXPRESS) -- c:\Program Files\MSSQL.1\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
SRV - (SolidWorks Licensing Service) -- C:\Programmi\File comuni\SolidWorks Shared\Service\SolidWorksLicensing.exe (SolidWorks)
SRV - (FLEXnet Licensing Service) -- C:\Programmi\File comuni\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (CoordinatorServiceHost) -- C:\Programmi\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe (Dassault Systèmes SolidWorks Corp.)
SRV - (YahooAUService) -- C:\Programmi\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (NMIndexingService) -- C:\Programmi\File comuni\Ahead\Lib\NMIndexingService.exe (Nero AG)
SRV - (ose) -- C:\Programmi\File comuni\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (msvsmon80) -- C:\Programmi\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (WDICA) -- File not found
DRV - (PDRFRAME) -- File not found
DRV - (PDRELI) -- File not found
DRV - (PDFRAME) -- File not found
DRV - (PDCOMP) -- File not found
DRV - (PCIDump) -- File not found
DRV - (lbrtfdc) -- File not found
DRV - (i2omgmt) -- File not found
DRV - (Changer) -- File not found
DRV - (NPF) WinPcap Packet Driver (NPF) -- C:\WINDOWS\system32\drivers\npf.sys (CACE Technologies, Inc.)
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avkmgr) -- C:\WINDOWS\system32\drivers\avkmgr.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (ewusbnet) -- C:\WINDOWS\system32\drivers\ewusbnet.sys (Huawei Technologies Co., Ltd.)
DRV - (hwusbfake) -- C:\WINDOWS\system32\drivers\ewusbfake.sys (Huawei Technologies Co., Ltd.)
DRV - (hwdatacard) -- C:\WINDOWS\system32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (AR5416) -- C:\WINDOWS\system32\drivers\athw.sys (Atheros Communications, Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (IntcHdmiAddService) Intel(R) -- C:\WINDOWS\system32\drivers\IntcHdmi.sys (Intel(R) Corporation)
DRV - (b57w2k) -- C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (SNP2UVC) USB2.0 PC Camera (SNP2UVC) -- C:\WINDOWS\system32\drivers\snp2uvc.sys ()
DRV - (WinRT) -- C:\WINDOWS\System32\drivers\WinRT.sys (BlueWater Systems, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.maxiwe.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
IE - HKLM\..\SearchScopes,DefaultScope = {EEE6C360-6118-11DC-9C72-001320C79847}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?src=6&q={searchTerms}

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-57989841-1659004503-1417001333-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.maxiwe.com/
IE - HKU\S-1-5-21-57989841-1659004503-1417001333-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
IE - HKU\S-1-5-21-57989841-1659004503-1417001333-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://it.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-57989841-1659004503-1417001333-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = it
IE - HKU\S-1-5-21-57989841-1659004503-1417001333-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 5E 52 EF 0D DC D1 CA 01 [binary data]
IE - HKU\S-1-5-21-57989841-1659004503-1417001333-1003\..\URLSearchHook: {db9d7a78-a76c-4bf2-97c6-258925ee1542} - C:\Programmi\Reganam\prxtbReg2.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-57989841-1659004503-1417001333-1003\..\URLSearchHook: {e3393495-8103-46a0-8181-270273eddd60} - C:\Programmi\Softonic-IT\prxtbSof0.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-57989841-1659004503-1417001333-1003\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Programmi\SweetIM\Toolbars\Internet Explorer\mgHelper.dll (SweetIM Technologies Ltd.)
IE - HKU\S-1-5-21-57989841-1659004503-1417001333-1003\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-57989841-1659004503-1417001333-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?FORM=IEFM1&q={searchTerms}&src={referrer:source?}
IE - HKU\S-1-5-21-57989841-1659004503-1417001333-1003\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7SKPB_it
IE - HKU\S-1-5-21-57989841-1659004503-1417001333-1003\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2530241
IE - HKU\S-1-5-21-57989841-1659004503-1417001333-1003\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?src=6&q={searchTerms}
IE - HKU\S-1-5-21-57989841-1659004503-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-21-57989841-1659004503-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:58364

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Bing"
FF - prefs.js..browser.search.defaulturl: "http://www.bing.com/search?FORM=IEFM1&q="
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.it/"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}:2.1.0
FF - prefs.js..extensions.enabledItems: {EEE6C361-6118-11DC-9C72-001320C79847}:1.1.0.2
FF - prefs.js..keyword.URL: "http://www.bing.com/search?FORM=IEFM1&q="
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 58364
FF - prefs.js..network.proxy.type: 4
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "chrome://browser-region/locale/region.properties"
FF - prefs.js..browser.startup.homepage: "resource:/browserconfig.properties"
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "chrome://browser-region/locale/region.properties"

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Programmi\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@ptc.com/ProductViewLite: C:\Programmi\File comuni\PTC\np6_pvapplite9.dll (PTC)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programmi\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programmi\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Programmi\Mozilla Firefox\components [2012/06/18 21.40.29 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Programmi\Mozilla Firefox\plugins [2011/12/13 21.27.50 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}: C:\Programmi\PriceGong\2.1.0\FF [2010/09/18 21.09.13 | 000,000,000 | ---D | M]

[2010/09/21 10.25.18 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Proprietario\Dati applicazioni\Mozilla\Extensions
[2012/07/01 20.02.38 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Proprietario\Dati applicazioni\Mozilla\Firefox\Profiles\rzzrhoiv.default\extensions
[2012/07/01 20.02.38 | 000,000,000 | ---D | M] (Bitdefender QuickScan) -- C:\Documents and Settings\Proprietario\Dati applicazioni\Mozilla\Firefox\Profiles\rzzrhoiv.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2011/07/25 21.09.37 | 000,000,557 | ---- | M] () -- C:\Documents and Settings\Proprietario\Dati applicazioni\Mozilla\Firefox\Profiles\rzzrhoiv.default\searchplugins\bing.xml
[2011/01/10 20.06.04 | 000,003,915 | ---- | M] () -- C:\Documents and Settings\Proprietario\Dati applicazioni\Mozilla\Firefox\Profiles\rzzrhoiv.default\searchplugins\sweetim.xml
[2012/01/23 22.48.21 | 000,000,000 | ---D | M] (No name found) -- C:\Programmi\Mozilla Firefox\extensions
[2012/06/18 21.40.29 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Programmi\mozilla firefox\components\browsercomps.dll
[2012/05/31 20.13.09 | 000,001,393 | ---- | M] () -- C:\Programmi\mozilla firefox\searchplugins\amazon-it.xml
[2012/05/31 20.13.09 | 000,002,252 | ---- | M] () -- C:\Programmi\mozilla firefox\searchplugins\bing.xml
[2012/05/31 20.13.09 | 000,000,744 | ---- | M] () -- C:\Programmi\mozilla firefox\searchplugins\eBay-it.xml
[2012/05/31 20.13.09 | 000,000,817 | ---- | M] () -- C:\Programmi\mozilla firefox\searchplugins\hoepli.xml
[2012/05/31 20.13.09 | 000,001,182 | ---- | M] () -- C:\Programmi\mozilla firefox\searchplugins\wikipedia-it.xml
[2012/05/31 20.13.09 | 000,000,953 | ---- | M] () -- C:\Programmi\mozilla firefox\searchplugins\yahoo-it.xml

O1 HOSTS File: ([2007/03/20 01.03.42 | 000,000,819 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 Web2Pop
O1 - Hosts: 127.0.0.1 wardsystems.org
O1 - Hosts: 127.0.0.1 www.wardsystems.org
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Supporto di collegamento per Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (PriceGongBHO Class) - {1631550F-191D-4826-B069-D9439253D926} - C:\Programmi\PriceGong\2.1.0\PriceGongIE.dll (PriceGong)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Guida per l'accesso a Windows Live) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll (Google Inc.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programmi\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (Reganam Toolbar) - {db9d7a78-a76c-4bf2-97c6-258925ee1542} - C:\Programmi\Reganam\prxtbReg2.dll (Conduit Ltd.)
O2 - BHO: (Softonic-IT Toolbar) - {e3393495-8103-46a0-8181-270273eddd60} - C:\Programmi\Softonic-IT\prxtbSof0.dll (Conduit Ltd.)
O2 - BHO: (SweetIM Toolbar Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Programmi\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Programmi\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programmi\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Reganam Toolbar) - {db9d7a78-a76c-4bf2-97c6-258925ee1542} - C:\Programmi\Reganam\prxtbReg2.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Softonic-IT Toolbar) - {e3393495-8103-46a0-8181-270273eddd60} - C:\Programmi\Softonic-IT\prxtbSof0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programmi\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKU\S-1-5-21-57989841-1659004503-1417001333-1003\..\Toolbar\WebBrowser: (Reganam Toolbar) - {DB9D7A78-A76C-4BF2-97C6-258925EE1542} - C:\Programmi\Reganam\prxtbReg2.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-57989841-1659004503-1417001333-1003\..\Toolbar\WebBrowser: (Softonic-IT Toolbar) - {E3393495-8103-46A0-8181-270273EDDD60} - C:\Programmi\Softonic-IT\prxtbSof0.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-57989841-1659004503-1417001333-1003\..\Toolbar\WebBrowser: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programmi\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Adobe ARM] C:\Programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [ApnUpdater] C:\Programmi\Ask.com\Updater\Updater.exe ({StringFileInfo_CompanyName})
O4 - HKLM..\Run: [avgnt] C:\Programmi\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [AzMixerSel] C:\Programmi\Realtek\Audio\InstallShield\AzMixerSel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programmi\File comuni\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [OwnData2Switch] #owndata20switch.exe File not found
O4 - HKLM..\Run: [PLFSetL] C:\WINDOWS\PLFSetL.exe (sonix)
O4 - HKLM..\Run: [SweetIM] C:\Programmi\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.)
O4 - HKU\S-1-5-21-57989841-1659004503-1417001333-1003..\Run: [{7CF40D46-49E9-169D-4C2B-470852701327}] C:\Documents and Settings\Proprietario\Dati applicazioni\Yqohex\taynwa.exe ()
O4 - HKU\S-1-5-21-57989841-1659004503-1417001333-1003..\Run: [ISUSPM] C:\Programmi\File comuni\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\Windchill ProductPoint Client Manager.lnk = C:\WINDOWS\Installer\{AEEBC44F-53B9-4AA9-B272-6C2C9685E1EA}\_2019124893CC8F92CB83EB.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\WinZip Quick Pick.lnk = C:\Programmi\WinZip\WZQKPICK.EXE (WinZip Computing, S.L.)
O4 - Startup: C:\Documents and Settings\Proprietario\Menu Avvio\Programmi\Esecuzione automatica\OpenOffice.org 3.0.lnk = C:\Programmi\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-57989841-1659004503-1417001333-1003\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-21-57989841-1659004503-1417001333-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Google Sidewiki... - res://C:\Programmi\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html File not found
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: PC Confidential - {925DAB62-F9AC-4221-806A-057BFB1014AA} - C:\Programmi\Winferno\PC Confidential\PCConfidential.exe (Capital Intellect, Inc)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Programmi\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Programmi\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000030 - C:\Programmi\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/s ... wflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 213.230.129.10 213.230.155.10
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{623CE8E5-5F1B-4392-995F-A84C2090BC9D}: DhcpNameServer = 213.230.129.10 213.230.155.10
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{878B5EB5-D395-4274-9F92-63CE18975DED}: DhcpNameServer = 192.168.0.11
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programmi\File comuni\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programmi\File comuni\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programmi\File comuni\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programmi\File comuni\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - HKU\S-1-5-21-57989841-1659004503-1417001333-1003 Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKU\S-1-5-21-57989841-1659004503-1417001333-1003 Winlogon: Shell - (C:\Documents and Settings\Proprietario\Dati applicazioni\388A4\9B816.exe) - File not found
O24 - Desktop Components:0 (Pagina iniziale corrente) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Proprietario\Impostazioni locali\Dati applicazioni\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Proprietario\Impostazioni locali\Dati applicazioni\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/08/04 02.13.53 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2009/01/23 03.22.18 | 000,126,976 | R--- | M] (Huawei Technologies Co., Ltd.) - E:\AutoRun.exe -- [ CDFS ]
O32 - AutoRun File - [2008/03/07 02.34.52 | 000,000,047 | R--- | M] () - E:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{023dac18-837f-11de-960e-001f16908742}\Shell - "" = AutoRun
O33 - MountPoints2\{023dac18-837f-11de-960e-001f16908742}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2009/01/23 03.22.18 | 000,126,976 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{74babf16-9fc1-11de-968d-001f16908742}\Shell - "" = AutoRun
O33 - MountPoints2\{74babf16-9fc1-11de-968d-001f16908742}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2009/01/23 03.22.18 | 000,126,976 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{f40ee5ae-2713-11e0-9718-001f169b816b}\Shell - "" = AutoRun
O33 - MountPoints2\{f40ee5ae-2713-11e0-9718-001f169b816b}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2009/01/23 03.22.18 | 000,126,976 | R--- | M] (Huawei Technologies Co., Ltd.)
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012/07/01 20.21.35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Proprietario\Dati applicazioni\ArcaVirMicroScan
[2012/07/01 20.16.51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Dati applicazioni\McAfee
[2012/07/01 20.14.54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dati applicazioni\McAfee
[2012/07/01 20.07.58 | 000,000,000 | ---D | C] -- C:\Programmi\ESET
[2012/07/01 20.02.49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Proprietario\Dati applicazioni\QuickScan
[2012/06/29 06.20.57 | 000,000,000 | --SD | C] -- C:\username12313053u
[2012/06/28 23.10.34 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2012/06/28 23.03.46 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2012/06/28 23.03.46 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2012/06/28 23.03.46 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2012/06/28 23.03.46 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2012/06/28 23.02.16 | 000,000,000 | --SD | C] -- C:\username123
[2012/06/28 22.59.04 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/06/28 22.58.37 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Proprietario\Menu Avvio\Programmi\Strumenti di amministrazione
[2012/06/28 22.58.02 | 000,000,000 | ---D | C] -- C:\WINDOWS\erdnt
[2012/06/28 00.43.56 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\NtmsData
[2012/06/27 22.21.22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Proprietario\Menu Avvio\Programmi\HiJackThis
[2012/06/27 22.21.21 | 000,000,000 | ---D | C] -- C:\Programmi\Trend Micro
[2012/06/27 22.08.37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Proprietario\Desktop\Downloads
[2012/06/27 22.08.31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Proprietario\Dati applicazioni\GetRightToGo
[2012/06/27 22.06.43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Proprietario\Dati applicazioni\Malwarebytes
[2012/06/27 22.06.28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Avvio\Programmi\Malwarebytes' Anti-Malware
[2012/06/27 22.06.27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dati applicazioni\Malwarebytes
[2012/06/27 22.06.26 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012/06/27 22.06.26 | 000,000,000 | ---D | C] -- C:\Programmi\Malwarebytes' Anti-Malware
[2012/06/27 21.55.02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Proprietario\Dati applicazioni\Avira
[2012/06/27 21.53.32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Avvio\Programmi\Avira
[2012/06/27 21.52.37 | 000,000,000 | ---D | C] -- C:\Firefox
[2012/06/27 21.52.37 | 000,000,000 | ---D | C] -- C:\Programmi\Ask.com
[2012/06/27 21.52.25 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys
[2012/06/27 21.52.22 | 000,137,416 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2012/06/27 21.52.22 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avkmgr.sys
[2012/06/27 21.52.09 | 000,000,000 | ---D | C] -- C:\Programmi\Avira
[2012/06/27 21.52.09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dati applicazioni\Avira
[2012/06/25 20.03.43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Proprietario\Desktop\Caty
[2012/06/07 22.33.51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Proprietario\Desktop\comunist
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/07/01 22.01.01 | 000,000,228 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2012/07/01 21.50.01 | 000,001,130 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/07/01 21.10.01 | 000,000,384 | ---- | M] () -- C:\WINDOWS\tasks\Final Media Player Update Checker.job
[2012/07/01 20.50.01 | 000,001,126 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/07/01 20.44.32 | 000,000,376 | ---- | M] () -- C:\WINDOWS\tasks\Registry Reviver-Proprietario-Startup.job
[2012/07/01 20.43.57 | 000,000,400 | ---- | M] () -- C:\WINDOWS\tasks\PCConfidential.job
[2012/07/01 20.43.18 | 000,002,579 | ---- | M] () -- C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\Windchill ProductPoint Client Manager.lnk
[2012/07/01 20.38.18 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/07/01 20.23.09 | 000,000,036 | ---- | M] () -- C:\Documents and Settings\Proprietario\Impostazioni locali\Dati applicazioni\housecall.guid.cache
[2012/07/01 18.05.10 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/06/28 23.10.52 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2012/06/28 22.39.26 | 000,131,072 | ---- | M] () -- C:\Documents and Settings\Proprietario\Desktop\Flusso manutenzione - 3.igx
[2012/06/28 20.16.04 | 000,112,640 | ---- | M] () -- C:\Documents and Settings\Proprietario\Desktop\Flusso manutenzione_2.igx
[2012/06/28 19.44.29 | 000,002,439 | ---- | M] () -- C:\Documents and Settings\Proprietario\Desktop\HiJackThis.lnk
[2012/06/27 21.32.03 | 000,529,838 | ---- | M] () -- C:\WINDOWS\System32\perfh010.dat
[2012/06/27 21.32.03 | 000,483,158 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012/06/27 21.32.03 | 000,099,186 | ---- | M] () -- C:\WINDOWS\System32\perfc010.dat
[2012/06/27 21.32.03 | 000,086,988 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012/06/12 19.53.09 | 000,001,777 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/07/01 20.23.09 | 000,000,036 | ---- | C] () -- C:\Documents and Settings\Proprietario\Impostazioni locali\Dati applicazioni\housecall.guid.cache
[2012/06/28 23.10.50 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2012/06/28 23.10.37 | 000,261,312 | RHS- | C] () -- C:\cmldr
[2012/06/28 23.03.46 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2012/06/28 23.03.46 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2012/06/28 23.03.46 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2012/06/28 23.03.46 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2012/06/28 23.03.46 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2012/06/28 20.20.26 | 000,131,072 | ---- | C] () -- C:\Documents and Settings\Proprietario\Desktop\Flusso manutenzione - 3.igx
[2012/06/28 20.16.04 | 000,112,640 | ---- | C] () -- C:\Documents and Settings\Proprietario\Desktop\Flusso manutenzione_2.igx
[2012/06/27 22.21.22 | 000,002,439 | ---- | C] () -- C:\Documents and Settings\Proprietario\Desktop\HiJackThis.lnk
[2012/06/27 21.53.04 | 000,000,228 | ---- | C] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2012/02/16 20.19.33 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011/03/29 22.33.28 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Proprietario\Dati applicazioni\4.ini
[2011/02/23 19.24.38 | 000,000,352 | ---- | C] () -- C:\WINDOWS\modelcheck.INI
[2011/01/11 19.35.58 | 000,000,127 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2010/09/21 10.25.04 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010/08/19 16.36.51 | 000,551,168 | ---- | C] () -- C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\FontCache3.0.0.0.dat
[2010/06/02 20.49.29 | 000,014,336 | ---- | C] () -- C:\Documents and Settings\Proprietario\Impostazioni locali\Dati applicazioni\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

< End of report >

by **ggpp** » July 1st, 2012, 4:11 pm

Extras.txt

OTL Extras logfile created on: 01/07/2012 22.01.44 - Run 1
OTL by OldTimer - Version 3.2.53.1 Folder = C:\Documents and Settings\Proprietario\Documenti\Download
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000410 | Country: Italia | Language: ITA | Date Format: dd/MM/yyyy

1,93 Gb Total Physical Memory | 0,64 Gb Available Physical Memory | 33,28% Memory free
3,78 Gb Paging File | 2,54 Gb Available in Paging File | 67,21% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programmi
Drive C: | 232,88 Gb Total Space | 186,61 Gb Free Space | 80,13% Space Free | Partition Type: NTFS
Drive E: | 36,96 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS

Computer Name: USER-5AEC5BC622 | User Name: Proprietario | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = htmlfile] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome
.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l

[HKEY_USERS\S-1-5-21-57989841-1659004503-1417001333-1003\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programmi\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1
InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\explorer.exe" = %windir%\explorer.exe -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"E:\Nero\Installation\Setupx.exe" = E:\Nero\Installation\Setupx.exe:*:Enabled:Nero ProductSetup
"C:\Programmi\Google\Google Talk\googletalk.exe" = C:\Programmi\Google\Google Talk\googletalk.exe:*:Enabled:Google Talk
"C:\Programmi\FinalMediaPlayer\FMPCheckForUpdates.exe" = C:\Programmi\FinalMediaPlayer\FMPCheckForUpdates.exe:*:Enabled:Final Media Player Update Checker -- (Bitberry Software)
"C:\WINDOWS\explorer.exe" = C:\WINDOWS\explorer.exe:*:Disabled:Esplora risorse -- (Microsoft Corporation)
"C:\Programmi\PTC\PVX\i486_nt\obj\productview.exe" = C:\Programmi\PTC\PVX\i486_nt\obj\productview.exe:*:Enabled:ProductView Express -- (PTC)
"C:\Programmi\proeWildfire 5.0\i486_nt\nms\nmsd.exe" = C:\Programmi\proeWildfire 5.0\i486_nt\nms\nmsd.exe:*:Disabled:Pro/ENGINEER Wildfire from PTC -- (PTC)
"C:\Programmi\proeWildfire 5.0\i486_nt\obj\xtop.exe" = C:\Programmi\proeWildfire 5.0\i486_nt\obj\xtop.exe:*:Disabled:Pro/ENGINEER Wildfire from PTC -- (PTC)
"C:\Programmi\proeWildfire 5.0\i486_nt\obj\pro_comm_msg.exe" = C:\Programmi\proeWildfire 5.0\i486_nt\obj\pro_comm_msg.exe:*:Disabled:Pro/ENGINEER Wildfire from PTC -- (PTC)
"C:\Programmi\proeWildfire 5.0\bin\proe.exe" = C:\Programmi\proeWildfire 5.0\bin\proe.exe:*:Disabled:Pro/ENGINEER -- (PTC)
"C:\Programmi\Kyodai Mahjongg 2006\kmj.exe" = C:\Programmi\Kyodai Mahjongg 2006\kmj.exe:*:Enabled:Kyodai Mahjongg -- (Rene-Gilles Deberdt)
"%windir%\explorer.exe" = %windir%\explorer.exe -- (Microsoft Corporation)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0978A841-2E44-4A85-922B-36D96F0BAE0E}_is1" = 3GP Player 2009
"{105780AD-54CE-4951-A572-BE49D5B43F97}" = TradeStation 8.6 (Build 2583)
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1959101B-E34C-4266-8915-20F23B5BCF43}" = SolidWorks eDrawings 2010
"{1D301950-EA2F-4882-9AA0-49467756842A}" = SweetIM for Messenger 3.3
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Strumento di caricamento di Windows Live
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{24EA9071-1C24-4A15-8BD4-8702B54E35FD}" = TradeStation 8.2 (Build 3863)
"{26A24AE4-039D-4CA4-87B4-2F83216014FF}" = Java(TM) 6 Update 14
"{2750B389-A2D2-4953-99CA-27C1F2A8E6FD}" = Microsoft SQL Server 2005 Tools Express Edition
"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros for Acer Driver v7.6.1.184_Foxconn Installation Program
"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (SQLEXPRESS)
"{2D8D14CC-5B31-44B9-87FC-BEC3D8AFFD1D}" = SolidWorks Explorer 2010 SP0
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{350C9410-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = Acer Crystal Eye Webcam Video Class Camera
"{39AE27EE-A148-48A3-B98D-35498C4D9719}" = Windows Live Messenger
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{45B3A3BD-F90D-48FE-A147-D74878A51040}" = Nero 7 Essentials
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}" = Skype web features
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{56DCD20A-E558-4396-AF59-14D15AA737BB}" = DWGeditor
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6F695BCF-9BDC-48AB-8D46-D57CFAD7A248}" = Assistente per l'accesso a Windows Live
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{736D2DAD-3D87-4CAA-8646-83D238AD68E0}" = PhotoView 360
"{7670D32F-DAE6-4E49-8C8B-B3F08B5B1686}" = Microsoft SQL Server Native Client
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77A51743-F43C-488E-AEE6-3CD39C507B03}" = Optimax
"{7C05EEDD-E565-4E2B-ADE4-0C784C17311C}" = Crystal Reports for .NET Framework 2.0 (x86)
"{85F0337D-33AC-43B4-A003-DF35061F1D8D}" = OpenOffice.org 3.0
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0010-0410-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (Italian) 12
"{90120000-0015-0410-0000-0000000FF1CE}" = Microsoft Office Access MUI (Italian) 2007
"{90120000-0015-0410-0000-0000000FF1CE}_ENTERPRISE_{7F40286D-09A7-4DC0-A2A4-AA18D026D369}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0410-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Italian) 2007
"{90120000-0016-0410-0000-0000000FF1CE}_ENTERPRISE_{7F40286D-09A7-4DC0-A2A4-AA18D026D369}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0410-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Italian) 2007
"{90120000-0018-0410-0000-0000000FF1CE}_ENTERPRISE_{7F40286D-09A7-4DC0-A2A4-AA18D026D369}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0410-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Italian) 2007
"{90120000-0019-0410-0000-0000000FF1CE}_ENTERPRISE_{7F40286D-09A7-4DC0-A2A4-AA18D026D369}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0410-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Italian) 2007
"{90120000-001A-0410-0000-0000000FF1CE}_ENTERPRISE_{7F40286D-09A7-4DC0-A2A4-AA18D026D369}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0410-0000-0000000FF1CE}" = Microsoft Office Word MUI (Italian) 2007
"{90120000-001B-0410-0000-0000000FF1CE}_ENTERPRISE_{7F40286D-09A7-4DC0-A2A4-AA18D026D369}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0410-0000-0000000FF1CE}" = Microsoft Office Proofing (Italian) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0410-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (Italian) 2007
"{90120000-0044-0410-0000-0000000FF1CE}_ENTERPRISE_{7F40286D-09A7-4DC0-A2A4-AA18D026D369}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0410-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Italian) 2007
"{90120000-006E-0410-0000-0000000FF1CE}_ENTERPRISE_{C0C7E58F-D0A1-4102-855B-0B7AA2E8F1C1}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0410-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Italian) 2007
"{90120000-00A1-0410-0000-0000000FF1CE}_ENTERPRISE_{7F40286D-09A7-4DC0-A2A4-AA18D026D369}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A4-0409-0000-0000000FF1CE}" = Microsoft Office 2003 Web Components
"{90120000-00BA-0410-0000-0000000FF1CE}" = Microsoft Office Groove MUI (Italian) 2007
"{90120000-00BA-0410-0000-0000000FF1CE}_ENTERPRISE_{7F40286D-09A7-4DC0-A2A4-AA18D026D369}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{9447C8A1-6502-46EC-89D0-E47803E7FEFF}" = InTask Personal
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9CEB017E-CC16-4C89-B9E4-AAB5A1DD12F9}" = Windows Live Essentials
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A29F583C-DAB1-435F-BD87-6D76834D7A0A}" = NeuroShell Trader 5
"{A2C4B68E-49B2-4992-908E-1AE049A46B23}" = NeuroShell Trader 4
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A43BF6A5-D5F0-4AAA-BF41-65995063EC44}" = MSXML 6.0 Parser
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1040-7B44-A82000000003}" = Adobe Reader 8.2.6 - Italiano
"{AED0B5AC-0771-4600-9777-9C4C910EBE09}" = Open Workbench
"{AEEBC44F-53B9-4AA9-B272-6C2C9685E1EA}" = Windchill ProductPoint Client Manager
"{AF2066F6-7C57-46A1-A306-077EBBFC7B2B}" = SolidWorks 2010 SP0
"{BB729F7B-D12C-43B0-B211-4AC6C1290ACF}" = OwnData2
"{BF67F764-95B6-4360-BB57-B2E5AA6C814B}" = SweetIM Toolbar for Internet Explorer 4.0
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C3C640B8-95B6-40AE-A058-BE4896CD3010}" = Windows Live Call
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240B8}" = WinZip 12.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{D20BB8C7-7082-4323-A578-177ECE3CDF19}" = Pro/ENGINEER Thumbnail Viewer 1.0
"{D481EA96-2313-4A7C-98EE-710D1AF884AC}" = Microsoft Visual Studio 2005 Tools for Applications - ENU
"{D5068583-D569-468B-9755-5FBF5848F46F}" = Sony Picture Utility
"{D972F309-7376-4B25-10AA-04C80D12E2F0}" = iGrafx 2007
"{DBD88705-2570-4ABA-8EC8-432ACE0481A6}" = Registry Reviver
"{E5A3E181-D9F7-4C73-A23C-7EB726D79698}" = Portfolio Maestro™
"{E7084B89-69E0-46B3-A118-8F99D06988CD}" = Microsoft SQL Server VSS Writer
"{EE9F8512-BE48-4E99-B6E0-7ADBB10A247D}" = ProductView Express 9.1
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F617649B-2104-41C7-B15A-9F0DE2AF8F4E}" = Minitab 15 English
"Adaptive Net Indicators" = Adaptive Net Indicators
"Adaptive Turboprop 2" = Adaptive Turboprop 2
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Advanced Indicator Set 1" = Advanced Indicator Set 1
"Alice MOBILE E1692" = Alice MOBILE E1692
"ASCTrend" = ASCTrend
"Avira AntiVir Desktop" = Avira Free Antivirus
"Cluster Indicators" = Cluster Indicators
"Data Exchange API Add-On" = Data Exchange API Add-On
"DeltaPROD_is1" = DeltaPROD
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Federn-Berechnung_is1" = Federn-Berechnung Release 2003
"Fibonacci/Galactic Trader 4" = Fibonacci/Galactic Trader 4
"FinalMediaPlayer_is1" = Final Media Player 2010
"Fuzzy Pattern Recognizer" = Fuzzy Pattern Recognizer
"Google Chrome" = Google Chrome
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HistoryCentre 2.0 for XPO" = HistoryCentre 2.0 for XPO
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{24EA9071-1C24-4A15-8BD4-8702B54E35FD}" = TradeStation 8.2 (Build 3863)
"InTask Personal" = InTask Personal
"Kyodai Mahjongg 2006_is1" = Kyodai Mahjongg 2006 v1.42
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware versione 1.61.0.1400
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Microsoft Visual Studio 2005 Tools for Applications - ENU" = Microsoft Visual Studio 2005 Tools for Applications - ENU
"Mozilla Firefox 13.0.1 (x86 it)" = Mozilla Firefox 13.0.1 (x86 it)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Neural Indicators" = Neural Indicators
"NeuroShell Classifier Demo" = NeuroShell Classifier Demo
"NeuroShell Predictor Demo" = NeuroShell Predictor Demo
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PCConfidential_is1" = PC Confidential 2008
"PortfolioStream by RINA Systems" = PortfolioStream by RINA Systems
"PriceGong" = PriceGong 2.1.0
"Pro/ENGINEER Release Wildfire 5.0 Datecode M020" = Pro/ENGINEER Release Wildfire 5.0 Datecode M020
"Reganam Toolbar" = Reganam Toolbar
"RegistryReviver" = Registry Reviver
"Safirxp" = SAFIR-Xp
"SirTrade2000" = SirTrade2000
"Softonic-IT Toolbar" = Softonic-IT Toolbar
"SolidWorks Installation Manager 20100-40000-1100-200" = SolidWorks 2010 SP0
"ST6UNST #1" = GUERRILLA-MBA Strategy and Analysis
"ST6UNST #2" = GUERRILLA-MBA Strategy and Analysis (C:\Programmi\GUERRILLA-MBA\)
"S-Tris 2_is1" = S-Tris 2 PC
"THE GRAIL Walk-Forward Optimizer" = THE GRAIL Walk-Forward Optimizer
"WaveFin" = WaveFin
"Windows Media Format Runtime" = Windows Media Format Runtime
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR gestione archivi
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Software Update" = Yahoo! Software Update

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 01/07/2012 14.14.54 | Computer Name = USER-5AEC5BC622 | Source = crypt32 | ID = 131080
Description = Impossibile eseguire il recupero con aggiornamento automatico del
numero di sequenza dell'elenco principale di altri produttori da: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
a causa del seguente errore: La connessione in rete non esiste.

Error - 01/07/2012 14.14.56 | Computer Name = USER-5AEC5BC622 | Source = crypt32 | ID = 131083
Description = Impossibile estrarre l'elenco principale di altri produttori dal file
.cab di aggiornamento automatico in: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
a causa del seguente errore: Un certificato richiesto non rientra nel suo periodo
di validità se verificato rispetto all'ora corrente del sistema o al timestamp
sul file firmato.

Error - 01/07/2012 14.14.56 | Computer Name = USER-5AEC5BC622 | Source = crypt32 | ID = 131080
Description = Impossibile eseguire il recupero con aggiornamento automatico del
numero di sequenza dell'elenco principale di altri produttori da: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
a causa del seguente errore: La connessione in rete non esiste.

Error - 01/07/2012 14.14.56 | Computer Name = USER-5AEC5BC622 | Source = crypt32 | ID = 131083
Description = Impossibile estrarre l'elenco principale di altri produttori dal file
.cab di aggiornamento automatico in: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
a causa del seguente errore: Un certificato richiesto non rientra nel suo periodo
di validità se verificato rispetto all'ora corrente del sistema o al timestamp
sul file firmato.

Error - 01/07/2012 14.14.56 | Computer Name = USER-5AEC5BC622 | Source = crypt32 | ID = 131080
Description = Impossibile eseguire il recupero con aggiornamento automatico del
numero di sequenza dell'elenco principale di altri produttori da: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
a causa del seguente errore: La connessione in rete non esiste.

Error - 01/07/2012 14.14.59 | Computer Name = USER-5AEC5BC622 | Source = crypt32 | ID = 131083
Description = Impossibile estrarre l'elenco principale di altri produttori dal file
.cab di aggiornamento automatico in: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
a causa del seguente errore: Un certificato richiesto non rientra nel suo periodo
di validità se verificato rispetto all'ora corrente del sistema o al timestamp
sul file firmato.

Error - 01/07/2012 14.14.59 | Computer Name = USER-5AEC5BC622 | Source = crypt32 | ID = 131080
Description = Impossibile eseguire il recupero con aggiornamento automatico del
numero di sequenza dell'elenco principale di altri produttori da: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
a causa del seguente errore: La connessione in rete non esiste.

Error - 01/07/2012 14.14.59 | Computer Name = USER-5AEC5BC622 | Source = crypt32 | ID = 131083
Description = Impossibile estrarre l'elenco principale di altri produttori dal file
.cab di aggiornamento automatico in: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
a causa del seguente errore: Un certificato richiesto non rientra nel suo periodo
di validità se verificato rispetto all'ora corrente del sistema o al timestamp
sul file firmato.

Error - 01/07/2012 14.14.59 | Computer Name = USER-5AEC5BC622 | Source = crypt32 | ID = 131080
Description = Impossibile eseguire il recupero con aggiornamento automatico del
numero di sequenza dell'elenco principale di altri produttori da: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
a causa del seguente errore: La connessione in rete non esiste.

Error - 01/07/2012 14.43.56 | Computer Name = USER-5AEC5BC622 | Source = Application Hang | ID = 1002
Description = Applicazione in stallo PCConfidential.exe, versione 2008.4.0.17, modulo
in stallo hungapp, versione 0.0.0.0, indirizzo stallo 0x00000000.

[ OSession Events ]
Error - 07/02/2010 10.50.14 | Computer Name = USER-5AEC5BC622 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 2, Application Name: Microsoft Office Access, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 20
seconds with 0 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 01/07/2012 14.20.01 | Computer Name = USER-5AEC5BC622 | Source = Service Control Manager | ID = 7023
Description = Servizio Gestione applicazione terminato con l'errore: %%126

Error - 01/07/2012 14.20.01 | Computer Name = USER-5AEC5BC622 | Source = Service Control Manager | ID = 7023
Description = Servizio Gestione applicazione terminato con l'errore: %%126

Error - 01/07/2012 14.20.01 | Computer Name = USER-5AEC5BC622 | Source = Service Control Manager | ID = 7023
Description = Servizio Gestione applicazione terminato con l'errore: %%126

Error - 01/07/2012 14.20.01 | Computer Name = USER-5AEC5BC622 | Source = Service Control Manager | ID = 7023
Description = Servizio Gestione applicazione terminato con l'errore: %%126

Error - 01/07/2012 14.20.01 | Computer Name = USER-5AEC5BC622 | Source = Service Control Manager | ID = 7023
Description = Servizio Gestione applicazione terminato con l'errore: %%126

Error - 01/07/2012 14.20.01 | Computer Name = USER-5AEC5BC622 | Source = Service Control Manager | ID = 7023
Description = Servizio Gestione applicazione terminato con l'errore: %%126

Error - 01/07/2012 14.20.01 | Computer Name = USER-5AEC5BC622 | Source = Service Control Manager | ID = 7023
Description = Servizio Gestione applicazione terminato con l'errore: %%126

Error - 01/07/2012 14.34.10 | Computer Name = USER-5AEC5BC622 | Source = DCOM | ID = 10010
Description = Il server {9B1F122C-2982-4E91-AA8B-E071D54F2A4D} non si è registrato
con DCOM entro il tempo d'attesa richiesto.

Error - 01/07/2012 14.37.18 | Computer Name = USER-5AEC5BC622 | Source = DCOM | ID = 10010
Description = Il server {9B1F122C-2982-4E91-AA8B-E071D54F2A4D} non si è registrato
con DCOM entro il tempo d'attesa richiesto.

Error - 01/07/2012 15.31.05 | Computer Name = USER-5AEC5BC622 | Source = Dhcp | ID = 1002
Description = Il lease 109.52.120.13 dell'indirizzo IP della scheda di rete con
indirizzo 001E101FC8C1 è stato negato dal server DHCP 109.52.86.113. Il server DHCP
ha inviato un messaggio DHCPNACK.

< End of report >

by **ggpp** » July 1st, 2012, 4:25 pm

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-07-01 22:25:29
Windows 5.1.2600 Service Pack 3
Running: pffsd3k3.exe; Driver: C:\DOCUME~1\PROPRI~1\IMPOST~1\Temp\kxeyrfog.sys

---- Registry - GMER 1.0.15 ----

Reg HKLM\SOFTWARE\Classes\CLSID\{29C7572E-368C-9746-3DB4E03B0C8852AE}\{D5583F53-2F82-8141-B7E22169E34927D8}\{884189AF-2B25-871B-C10F8549E6A3D936}
Reg HKLM\SOFTWARE\Classes\CLSID\{29C7572E-368C-9746-3DB4E03B0C8852AE}\{D5583F53-2F82-8141-B7E22169E34927D8}\{884189AF-2B25-871B-C10F8549E6A3D936}@{3EE4C831-B7E0-4ed1-B9FC-EDC523C9612F}1 0x01 0x00 0x01 0x00 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{92E364B2-3C99-8131-FA38C55A9DF469B6}\{ED083C7B-BB22-E038-94448FA9BD51D19E}\{5592BF6F-6CA4-ED79-1454C42B0B348E21}
Reg HKLM\SOFTWARE\Classes\CLSID\{92E364B2-3C99-8131-FA38C55A9DF469B6}\{ED083C7B-BB22-E038-94448FA9BD51D19E}\{5592BF6F-6CA4-ED79-1454C42B0B348E21}@RA4KGUJC6T6LBNJRIDQ63C2L6C1 0x01 0x00 0x01 0x00 ...

---- EOF - GMER 1.0.15 ----

by **ggpp** » July 1st, 2012, 4:31 pm

ckfiles.txt

CKScanner - Additional Security Risks - These are not necessarily bad
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\asctrend 3.51 crack - time-limit feb 2009.zip
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\ganntrader 3.07 + crack flying_high.exe
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\asctrend\copia di crack\abs1lock32.dll
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\asctrend\copia di crack\readme.txt
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\crack\install ts2000i pro suite.zip
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\crack\jurik research.txt
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\crack\mesa 2000.exe
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\crack\metaserverkeydde.zip
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\crack\metaserverkeytal .zip
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\crack\neuro shell d t 3.07.zip
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\crack\mesa 2000\manual\manual.doc
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\crack\mesa 2000\mesadll crack\mesa2kc.dll
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\crack\mesa 2000\mesadll crack\mesa2kd.dll
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\crack\mesa 2000\mesadll crack\mesa2ke.dll
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\crack\mesa 2000\mesadll crack\mesa2km.dll
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\crack\mesa 2000\mesadll crack\mesa2kp.dll
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\crack\mesa 2000\mesadll crack\mesa2kr.dll
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\crack\mesa 2000\mesadll crack\mesa2ks.dll
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\crack\mesa 2000\mesadll crack\mesa2kt.dll
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\crack\mesa 2000\program\cmnhlp.exe
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\crack\mesa 2000\program\install.bat
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\crack\mesa 2000\program\install.pif
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\crack\mesa 2000\program\mesa2k.els
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\crack\mesa 2000\program\mesa2kc.dll
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\crack\mesa 2000\program\mesa2kd.dll
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\crack\mesa 2000\program\mesa2ke.dll
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\crack\mesa 2000\program\mesa2km.dll
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\crack\mesa 2000\program\mesa2kp.dll
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\crack\mesa 2000\program\mesa2kr.dll
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\crack\mesa 2000\program\mesa2ks.dll
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\crack\mesa 2000\program\mesa2kt.dll
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\crack\mesa 2000\program\regerror.exe
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\crack\mesa 2000\program\validity.exe
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\databull 1.8.0\crack\databull.exe
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\dati nasdaq100 12-01-06\history centre 2\crack\hc.key
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\dati nasdaq100 12-01-06\history centre 2\crack\hccpt652.dll
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\dati nasdaq100 12-01-06\history centre 2\crack\readme.txt
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\ddechartupdater 1.3\crack\ddechartupdater.exe
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\excelbusinesstools.com.portfolio.optimization.for.excel.datecode.20030114.winall.incl.keygen-blizzard\b-po114.zip
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\excelbusinesstools.com.portfolio.optimization.for.excel.datecode.20030114.winall.incl.keygen-blizzard\blizz.nfo
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\excelbusinesstools.com.portfolio.optimization.for.excel.datecode.20030114.winall.incl.keygen-blizzard\file_id.diz
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\excelbusinesstools.com.real.option.valuation.for.excel.datecode.20030114.winall.incl.keygen-blizzard\b-ro114.zip
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\excelbusinesstools.com.real.option.valuation.for.excel.datecode.20030114.winall.incl.keygen-blizzard\blizz.nfo
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\excelbusinesstools.com.real.option.valuation.for.excel.datecode.20030114.winall.incl.keygen-blizzard\file_id.diz
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\excelbusinesstools.com.regression.forecasting.for.excel.datecode.20030114.winall.incl.keygen-blizzard\b-rf114.zip
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\excelbusinesstools.com.regression.forecasting.for.excel.datecode.20030114.winall.incl.keygen-blizzard\blizz.nfo
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\excelbusinesstools.com.regression.forecasting.for.excel.datecode.20030114.winall.incl.keygen-blizzard\file_id.diz
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\asctrend 3.51 crack - time-limit feb 2009.zip
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\ganntrader 3.07 + crack flying_high.exe
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\crack\install ts2000i pro suite.zip
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\crack\jurik research.txt
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\crack\mesa 2000.exe
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\crack\metaserverkeydde.zip
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\crack\metaserverkeytal .zip
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\crack\neuro shell d t 3.07.zip
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\databull 1.8.0\crack\databull.exe
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\ddechartupdater 1.3\crack\ddechartupdater.exe
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\excelbusinesstools.com.portfolio.optimization.for.excel.datecode.20030114.winall.incl.keygen-blizzard\b-po114.zip
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\excelbusinesstools.com.portfolio.optimization.for.excel.datecode.20030114.winall.incl.keygen-blizzard\blizz.nfo
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\excelbusinesstools.com.portfolio.optimization.for.excel.datecode.20030114.winall.incl.keygen-blizzard\file_id.diz
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\excelbusinesstools.com.real.option.valuation.for.excel.datecode.20030114.winall.incl.keygen-blizzard\b-ro114.zip
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\excelbusinesstools.com.real.option.valuation.for.excel.datecode.20030114.winall.incl.keygen-blizzard\blizz.nfo
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\excelbusinesstools.com.real.option.valuation.for.excel.datecode.20030114.winall.incl.keygen-blizzard\file_id.diz
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\excelbusinesstools.com.regression.forecasting.for.excel.datecode.20030114.winall.incl.keygen-blizzard\b-rf114.zip
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\excelbusinesstools.com.regression.forecasting.for.excel.datecode.20030114.winall.incl.keygen-blizzard\blizz.nfo
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\excelbusinesstools.com.regression.forecasting.for.excel.datecode.20030114.winall.incl.keygen-blizzard\file_id.diz
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\exportdan\rina\rina portfolio maximizer\crack\mm-info.txt
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\exportdan\rina\rina portfolio maximizer\crack\mm-key.exe
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\exportdan\rina\spk_rina money manager 2000 build 0100\crack\keylib32.dll
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\exportdan\rina\spk_rina money manager 2000 build 0100\crack\readme.txt
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\exportdan\rina portfolio maximizer\crack\mm-info.txt
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\exportdan\rina portfolio maximizer\crack\mm-key.exe
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\exportdan\rina system\spk_rina - portfolio maximizer 4.0\crack\mm-info.txt
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\exportdan\rina system\spk_rina - portfolio maximizer 4.0\crack\mm-key.exe
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\exportdan\spk_rina - portfolio maximizer 4.0\crack\mm-info.txt
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\exportdan\spk_rina - portfolio maximizer 4.0\crack\mm-key.exe
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\exportdan\spk_rina money manager 2000 build 0100\crack\keylib32.dll
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\exportdan\spk_rina money manager 2000 build 0100\crack\readme.txt
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\rina\rina portfolio maximizer\crack\mm-info.txt
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\rina\rina portfolio maximizer\crack\mm-key.exe
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\rina\spk_rina money manager 2000 build 0100\crack\keylib32.dll
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\rina\spk_rina money manager 2000 build 0100\crack\readme.txt
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\rina system\spk_rina - portfolio maximizer 4.0\crack\mm-info.txt
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\rina system\spk_rina - portfolio maximizer 4.0\crack\mm-key.exe
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\safir-x 3.2.0\crack\read.me
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\safir-x 3.2.0\crack\safirassistant_eval.exe
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\vantagepoint 5.0\crack\sec.dll
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\musica\vantagepoint 5.0\crack\vppatch.txt
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\neuroshell\crack\nst-ts32.dll
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\neuroshell\crack\readme.txt
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\quotespeed\crack per 1 settimana\historical plugin for tradestation2000 and quotespeed.msi
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\quotespeed\crack per 1 settimana\hyperorder.msi
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\quotespeed\crack per 1 settimana\mpi.rar
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\quotespeed\crack per 1 settimana\omega2000 edition for quotespeed.msi
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\rina\rina portfolio maximizer\crack\mm-info.txt
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\rina\rina portfolio maximizer\crack\mm-key.exe
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\rina\spk_rina money manager 2000 build 0100\crack\keylib32.dll
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\rina\spk_rina money manager 2000 build 0100\crack\readme.txt
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\rina system\spk_rina - portfolio maximizer 4.0\crack\mm-info.txt
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\rina system\spk_rina - portfolio maximizer 4.0\crack\mm-key.exe
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\roy kelly floor\crack\arc1.bat
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\roy kelly floor\crack\arc1.dll
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\safir-x 3.2.0\crack\read.me
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\safir-x 3.2.0\crack\safirassistant_eval.exe
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\salvataggio chiavetta 8 aprile 2011\documenti giampaolo\asctrend 3.51 crack - time-limit feb 2009.zip
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\vantagepoint 5.0\crack\sec.dll
c:\documents and settings\proprietario\documenti\giampa\documenti giampaolo\vantagepoint 5.0\crack\vppatch.txt
c:\documents and settings\proprietario\documenti\giampa\neuroshell\neuro\keygen.exe
c:\documents and settings\proprietario\documenti\giampa\pc vecchio\documenti giampaolo\asctrend 3.51 crack - time-limit feb 2009.zip
c:\documents and settings\proprietario\menu avvio\programmi\michele\michele el password crack ela password crack ela crack.rar.lnk
c:\documents and settings\proprietario\menu avvio\programmi\michele\michele el password crack ela password crack elasucks.bat.lnk
c:\documents and settings\proprietario\menu avvio\programmi\michele\michele el password crack ela password crack elasucks.exe.pif
c:\documents and settings\proprietario\menu avvio\programmi\michele\michele el password crack ela password crack password.out.lnk
c:\documents and settings\proprietario\menu avvio\programmi\michele\michele el password crack ela password crack readme.txt.lnk
c:\documents and settings\proprietario\menu avvio\programmi\michele\michele el password crack eld password crack readme.txt.lnk
c:\documents and settings\proprietario\menu avvio\programmi\michele\michele el password crack eld password crack tradestation 8.1 b2809 authtokencalc.exe.lnk
c:\documents and settings\proprietario\menu avvio\programmi\michele\michele el password crack eld password crack tradestation 8.1 b2809 cache misc.dat.lnk
c:\documents and settings\proprietario\menu avvio\programmi\michele\michele el password crack eld password crack tradestation 8.1 b2809 client.dll.lnk
c:\documents and settings\proprietario\menu avvio\programmi\michele\michele el password crack eld password crack tradestation 8.1 b2809 ordam20.dll.lnk
c:\documents and settings\proprietario\menu avvio\programmi\michele\michele el password crack eld password crack tradestation 8.1 b2809 readme.txt.lnk
c:\documents and settings\proprietario\menu avvio\programmi\michele\michele el password crack eld password crack tradestation 8.1 b2809 wowrt.dll.lnk
c:\documents and settings\proprietario\menu avvio\programmi\michele\michele el password crack eld password crack tselad.ocx.lnk
c:\documents and settings\proprietario\menu avvio\programmi\michele\michele el password crack els password crack els pw breaker inst.txt.lnk
c:\documents and settings\proprietario\menu avvio\programmi\michele\michele el password crack els password crack elspwbreaker.zip.lnk
c:\documents and settings\proprietario\menu avvio\programmi\michele\michele el password crack els password crack oredit32.exe.lnk
c:\documents and settings\proprietario\menu avvio\programmi\michele\michele el password crack els password crack patch.exe.lnk
c:\documents and settings\proprietario\menu avvio\programmi\michele\michele neuroshell trader 5.3 neuroshell predictor 2.0 crack nshellpre20[1].zip.lnk
c:\documents and settings\proprietario\menu avvio\programmi\pippopo\michele el password crack ela password crack ela crack.rar.lnk
c:\documents and settings\proprietario\menu avvio\programmi\pippopo\michele el password crack ela password crack elasucks.bat.lnk
c:\documents and settings\proprietario\menu avvio\programmi\pippopo\michele el password crack ela password crack elasucks.exe.pif
c:\documents and settings\proprietario\menu avvio\programmi\pippopo\michele el password crack ela password crack password.out.lnk
c:\documents and settings\proprietario\menu avvio\programmi\pippopo\michele el password crack ela password crack readme.txt.lnk
c:\documents and settings\proprietario\menu avvio\programmi\pippopo\michele el password crack eld password crack readme.txt.lnk
c:\documents and settings\proprietario\menu avvio\programmi\pippopo\michele el password crack eld password crack tradestation 8.1 b2809 authtokencalc.exe.lnk
c:\documents and settings\proprietario\menu avvio\programmi\pippopo\michele el password crack eld password crack tradestation 8.1 b2809 cache misc.dat.lnk
c:\documents and settings\proprietario\menu avvio\programmi\pippopo\michele el password crack eld password crack tradestation 8.1 b2809 client.dll.lnk
c:\documents and settings\proprietario\menu avvio\programmi\pippopo\michele el password crack eld password crack tradestation 8.1 b2809 ordam20.dll.lnk
c:\documents and settings\proprietario\menu avvio\programmi\pippopo\michele el password crack eld password crack tradestation 8.1 b2809 readme.txt.lnk
c:\documents and settings\proprietario\menu avvio\programmi\pippopo\michele el password crack eld password crack tradestation 8.1 b2809 wowrt.dll.lnk
c:\documents and settings\proprietario\menu avvio\programmi\pippopo\michele el password crack eld password crack tselad.ocx.lnk
c:\documents and settings\proprietario\menu avvio\programmi\pippopo\michele el password crack els password crack els pw breaker inst.txt.lnk
c:\documents and settings\proprietario\menu avvio\programmi\pippopo\michele el password crack els password crack elspwbreaker.zip.lnk
c:\documents and settings\proprietario\menu avvio\programmi\pippopo\michele el password crack els password crack oredit32.exe.lnk
c:\documents and settings\proprietario\menu avvio\programmi\pippopo\michele el password crack els password crack patch.exe.lnk
c:\documents and settings\proprietario\menu avvio\programmi\pippopo\michele neuroshell trader 5.3 neuroshell predictor 2.0 crack nshellpre20[1].zip.lnk
c:\documents and settings\proprietario\menu avvio\programmi\rossi_stas\safir crack readme.txt.lnk
c:\documents and settings\proprietario\menu avvio\programmi\rossi_stas\safir crack safir-xp_eval.exe.lnk
c:\documents and settings\proprietario\menu avvio\programmi\tradestation_8_+_rina_system_+_safir_xp\safir xp crack hh.exe.txt.lnk
c:\documents and settings\proprietario\menu avvio\programmi\tradestation_8_+_rina_system_+_safir_xp\safir xp crack readme.txt.lnk
c:\documents and settings\proprietario\menu avvio\programmi\tradestation_8_+_rina_system_+_safir_xp\safir xp crack safir_xp.exe.lnk
c:\documents and settings\proprietario\menu avvio\programmi\tradestation_8_+_rina_system_+_safir_xp\tradestation 8 owndata v2.2 crack armadillo_1852006_2030_705.reg.lnk
c:\documents and settings\proprietario\menu avvio\programmi\tradestation_8_+_rina_system_+_safir_xp\tradestation 8 owndata v2.2 crack owndata20.dll.lnk
c:\documents and settings\proprietario\preferiti\neuroshell pro 5.0 daytrader, cracked with keygens with addons - page 2 - friendly traders financial trading community.url
scanner sequence 3.ZZ.11.TQLBER
----- EOF -----

by **ggpp** » July 1st, 2012, 4:38 pm

Microsoft genuine Adbantage Tool

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Status: Validation Control not Installed
Validation Code: 0
Cached Validation Code: N/A
Windows Product Key: *****-*****-4JKRB-V3XG3-9DHVJ
Windows Product Key Hash: ntEI91Bmc/UPSOrnAkli2QxxIn0=
Windows Product ID: 76434-OEM-2158032-83807
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 5.1.2600.2.00010300.3.0.hom
ID: {F92B9DB7-CCF3-489F-BB84-AA5B3012BCDB}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: N/A
Architecture: N/A
Build lab: N/A
TTS Error: N/A
Validation Diagnostic: 025D1FF3-230-1_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005_E2AD56EA-765-8009_E2AD56EA-766-2_E2AD56EA-148-80004005_16E0B333-89-80004005_78155E4D-232-80004005
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A
Version: N/A

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 103 Blocked VLK
Microsoft Office Enterprise 2007 - 103 Blocked VLK
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-230-1

Browser Data-->
Proxy settings: http=127.0.0.1:58364
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Programmi\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{F92B9DB7-CCF3-489F-BB84-AA5B3012BCDB}</UGUID><Version>1.9.0027.0</Version><OS>5.1.2600.2.00010300.3.0.hom</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-9DHVJ</PKey><PID>76434-OEM-2158032-83807</PID><PIDType>3</PIDType><SID>S-1-5-21-57989841-1659004503-1417001333</SID><SYSTEM><Manufacturer>Acer </Manufacturer><Model>Extensa 5630 </Model></SYSTEM><BIOS><Manufacturer>Phoenix Technologies LTD</Manufacturer><Version>V1.30 </Version><SMBIOSVersion major="2" minor="5"/><Date>20090319000000.000000+000</Date></BIOS><HWID>72A73E07018400F8</HWID><UserLCID>0410</UserLCID><SystemLCID>0410</SystemLCID><TimeZone>ora solare Europa occidentale(GMT+01:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>103</Result><Products><Product GUID="{90120000-0030-0000-0000-0000000FF1CE}"><LegitResult>103</LegitResult><Name>Microsoft Office Enterprise 2007</Name><Ver>12</Ver><Val>ACD7202654E586</Val><Hash>fFic3JgCreGGRxyF8uMWB4R4Jcg=</Hash><Pid>89388-707-1528066-65254</Pid><PidType>14</PidType></Product></Products><Applications><App Id="15" Version="12" Result="103"/><App Id="16" Version="12" Result="103"/><App Id="18" Version="12" Result="103"/><App Id="19" Version="12" Result="103"/><App Id="1A" Version="12" Result="103"/><App Id="1B" Version="12" Result="103"/><App Id="44" Version="12" Result="103"/><App Id="A1" Version="12" Result="103"/><App Id="BA" Version="12" Result="103"/></Applications></Office></Software></GenuineResults>

Licensing Data-->
N/A

Windows Activation Technologies-->
N/A

HWID Data-->
N/A

OEM Activation 1.0 Data-->
BIOS string matches: yes
Marker string from BIOS: 16BD0:Acer Incorporated
Marker string from OEMBIOS.DAT: N/A, hr = 0x80004005

OEM Activation 2.0 Data-->
N/A

by **ggpp** » July 1st, 2012, 4:39 pm

Waiting for your help

Free Malware Removal Forum

Help Help Help

Help Help Help

Re: Help Help Help

Re: Help Help Help

Re: Help Help Help

Re: Help Help Help

Re: Help Help Help

Re: Help Help Help

Re: Help Help Help

Re: Help Help Help

Re: Help Help Help

Re: Help Help Help

Re: Help Help Help

Re: Help Help Help

Re: Help Help Help

Re: Help Help Help

Who is online