Cycbot.b combofix log

Forum Guidelines

Read the following topic before creating a new topic in this forum. It contains instructions on the what we would like you to post, which will enable us to help you more quickly.

Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help

Posted Image

Unfortunately, with the amount of logs we receive per day, the average response time is 5 days. I want to assure you, though, that your topic will be looked at and responded to. So please be patient.

Posted Image

DO NOT RUN ComboFix unless requested to.

Posted Image

Only members of the Malware Response Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log.

Posted Image

When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc.

Posted Image

Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.

2 Pages
←
1
2

You cannot start a new topic
This topic is locked

Cycbot.b combofix log

#16 giulso

New Member

Group: Members
Posts: 12
Joined: 31-May 11

Posted 15 June 2011 - 04:08 PM

Hi and sorry for the delay.

Java updated;
Adobe acrobat reader updated;

This is the OTL fix report:

All processes killed
========== SERVICES/DRIVERS ==========
========== FILES ==========
< ipconfig /flushdns /c >
Configurazione IP di Windows
Svuotata la cache del resolver DNS.
C:\Documents and Settings\Giulio&Vale\Desktop\cmd.bat deleted successfully.
C:\Documents and Settings\Giulio&Vale\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
Restore point Set: OTL Restore Point (0)

[EMPTYTEMP]

User: Default User
->Temp folder emptied: 500224 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Flash cache emptied: 41620 bytes

User: All Users

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: Giulio&Vale
->Temp folder emptied: 3252883 bytes
->Temporary Internet Files folder emptied: 47640309 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 1736 bytes

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 78991 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 16384 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 49,00 mb

[EMPTYFLASH]

User: Default User
->Flash cache emptied: 0 bytes

User: All Users

User: NetworkService

User: LocalService

User: Giulio&Vale
->Flash cache emptied: 0 bytes

User: Administrator
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0,00 mb

OTL by OldTimer - Version 3.2.23.0 log created on 06152011_225949

Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\Giulio&Vale\Impostazioni locali\Temp\Perflib_Perfdata_d10.dat not found!
File\Folder C:\Documents and Settings\Giulio&Vale\Impostazioni locali\Temp\~DF6B75.tmp not found!
File\Folder C:\Documents and Settings\Giulio&Vale\Impostazioni locali\Temp\~DF6B83.tmp not found!
C:\Documents and Settings\Giulio&Vale\Impostazioni locali\Temporary Internet Files\AntiPhishing\A0AB7674-8D67-4F4D-B5E1-96FAEADFB79D.dat moved successfully.
C:\Documents and Settings\Giulio&Vale\Impostazioni locali\Temporary Internet Files\Content.IE5\314VIUAJ\page__gopid__2287222[1].htm moved successfully.
C:\Documents and Settings\Giulio&Vale\Impostazioni locali\Temporary Internet Files\Content.IE5\8W59EEDW\translate_t[1].htm moved successfully.

Registry entries deleted on Reboot...

#17 giulso

New Member

Group: Members
Posts: 12
Joined: 31-May 11

Posted 15 June 2011 - 04:18 PM

... and this is the OTL scan report:

OTL logfile created on: 15/06/2011 23.13.12 - Run 2
OTL by OldTimer - Version 3.2.23.0 Folder = C:\Documents and Settings\Giulio&Vale\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000410 | Country: Italia | Language: ITA | Date Format: dd/MM/yyyy

2,00 Gb Total Physical Memory | 1,40 Gb Available Physical Memory | 70,05% Memory free
3,85 Gb Paging File | 3,24 Gb Available in Paging File | 84,30% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programmi
Drive C: | 53,69 Gb Total Space | 21,28 Gb Free Space | 39,64% Space Free | Partition Type: FAT32
Drive D: | 54,19 Gb Total Space | 34,14 Gb Free Space | 63,01% Space Free | Partition Type: NTFS

Computer Name: ACER-AE863C6296 | User Name: Giulio&Vale | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/06/11 08.30.58 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Giulio&Vale\Desktop\OTL.exe
PRC - [2011/04/21 16.54.40 | 000,402,832 | ---- | M] (IObit) -- C:\Programmi\IObit\Advanced SystemCare 4\ASCTray.exe
PRC - [2011/04/21 16.54.38 | 000,352,656 | ---- | M] (IObit) -- C:\Programmi\IObit\Advanced SystemCare 4\ASCService.exe
PRC - [2011/04/08 12.59.52 | 000,254,696 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programmi\File comuni\Java\Java Update\jusched.exe
PRC - [2011/03/28 16.17.56 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programmi\Avira\AntiVir Desktop\avshadow.exe
PRC - [2011/03/28 16.17.46 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programmi\Avira\AntiVir Desktop\sched.exe
PRC - [2011/03/28 16.17.34 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programmi\Avira\AntiVir Desktop\avgnt.exe
PRC - [2011/03/28 16.17.34 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programmi\Avira\AntiVir Desktop\avguard.exe
PRC - [2009/12/23 23.34.20 | 000,370,688 | ---- | M] (StarWind Software) -- d:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
PRC - [2008/09/24 14.32.48 | 000,935,208 | ---- | M] (Nero AG) -- C:\Programmi\File comuni\Nero\Nero BackItUp 4\NBService.exe
PRC - [2008/04/14 03.14.08 | 001,036,288 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/11/21 03.13.10 | 003,293,184 | ---- | M] (Google) -- C:\Programmi\Google\Google Talk\googletalk.exe
PRC - [2007/01/31 14.55.42 | 000,096,370 | ---- | M] (Canon Inc.) -- C:\Programmi\Canon\CAL\CALMAIN.exe
PRC - [2006/06/23 10.40.58 | 000,086,016 | ---- | M] (Logitech) -- c:\Programmi\File comuni\Logitech\LVMVFM\LVPrcSrv.exe
PRC - [2006/06/23 10.39.54 | 000,225,280 | ---- | M] (Logitech) -- C:\WINDOWS\system32\LVCOMSX.EXE
PRC - [2006/05/09 11.54.26 | 000,352,256 | ---- | M] (Acer Incorporated) -- C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
PRC - [2006/04/03 17.03.38 | 000,471,040 | ---- | M] (Dritek System Inc.) -- C:\Programmi\Launch Manager\QtZgAcer.EXE
PRC - [2006/02/17 15.26.32 | 000,073,728 | ---- | M] (Hewlett-Packard Company) -- C:\Programmi\File comuni\LightScribe\LSSrvc.exe
PRC - [2006/01/24 18.00.08 | 000,397,312 | ---- | M] (acer Inc.) -- C:\Acer\Empowering Technology\eRecovery\Monitor.exe
PRC - [2006/01/17 10.45.32 | 000,618,557 | ---- | M] (Broadcom Corporation.) -- C:\Programmi\WIDCOMM\Bluetooth Software\BTTray.exe
PRC - [2006/01/02 17.41.22 | 000,045,056 | ---- | M] (ATI Technologies Inc.) -- C:\Programmi\ATI Technologies\ATI.ACE\CLI.exe
PRC - [2005/12/27 15.50.28 | 000,069,632 | ---- | M] (HiTRUST) -- C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
PRC - [2005/12/13 21.31.38 | 000,114,784 | ---- | M] () -- C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
PRC - [2005/12/13 21.31.36 | 000,254,050 | ---- | M] () -- C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
PRC - [2005/12/13 21.31.20 | 000,151,552 | ---- | M] (CyberLink Corp.) -- C:\Program Files\Acer\Acer Arcade\PCMService.exe
PRC - [2005/12/13 21.31.08 | 001,077,376 | ---- | M] (Cyberlink) -- C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
PRC - [2005/12/13 21.31.08 | 000,061,440 | ---- | M] (Cyberlink) -- C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
PRC - [2005/11/02 00.11.00 | 000,102,491 | ---- | M] (Synaptics, Inc.) -- C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
PRC - [2005/10/24 16.45.32 | 002,462,208 | ---- | M] (Avocent Inc.) -- C:\Acer\Empowering Technology\admtray.exe
PRC - [2005/10/24 16.40.52 | 001,314,816 | ---- | M] (Avocent Inc.) -- C:\Acer\Empowering Technology\admServ.exe
PRC - [2004/09/02 23.57.25 | 000,057,344 | ---- | M] (SlySoft, Inc.) -- D:\Programmi\SlySoft\CloneCD\CloneCDTray.exe
PRC - [2004/08/20 12.28.27 | 000,045,056 | ---- | M] (Elaborate Bytes AG) -- D:\VirtualCloneDrive\VCDDaemon.exe
PRC - [2003/06/19 23.25.00 | 000,322,120 | ---- | M] (Microsoft Corporation) -- C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
PRC - [2003/04/09 19.21.38 | 000,147,456 | ---- | M] (Hewlett-Packard Co.) -- D:\Programmi\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
PRC - [2003/04/09 19.11.12 | 000,028,672 | ---- | M] (Hewlett-Packard) -- D:\Programmi\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
PRC - [2003/04/09 18.59.24 | 000,311,296 | ---- | M] (Hewlett-Packard Co.) -- d:\Programmi\Hewlett-Packard\Digital Imaging\bin\hposts08.exe
PRC - [2003/04/09 18.49.36 | 000,286,720 | ---- | M] (Hewlett-Packard Co.) -- d:\Programmi\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe

========== Modules (SafeList) ==========

MOD - [2011/06/11 08.30.58 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Giulio&Vale\Desktop\OTL.exe
MOD - [2011/02/08 15.34.00 | 000,978,944 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\mfc42.dll
MOD - [2010/08/23 18.12.14 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
MOD - [2006/06/23 10.40.58 | 000,081,920 | ---- | M] (Logitech) -- C:\Programmi\File comuni\Logitech\LVMVFM\LVPrcInj.dll
MOD - [2006/01/20 15.56.00 | 000,028,672 | ---- | M] () -- C:\Acer\Empowering Technology\ePower\SysHook.dll
MOD - [2005/12/27 16.57.30 | 000,053,248 | ---- | M] (HiTRUST) -- C:\WINDOWS\system32\sysenv.dll
MOD - [2005/12/27 15.50.26 | 000,010,752 | ---- | M] () -- C:\WINDOWS\system32\MSNChatHook.dll
MOD - [2005/11/02 00.11.00 | 000,069,723 | ---- | M] (Synaptics, Inc.) -- C:\WINDOWS\system32\SynTPFcs.dll
MOD - [2004/08/19 05.00.00 | 000,057,344 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\mfc42loc.dll
MOD - [2003/03/18 22.12.12 | 001,047,552 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\MFC71u.dll
MOD - [2003/03/18 21.44.36 | 000,061,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\MFC71ITA.DLL

========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
SRV - [2011/04/21 16.54.38 | 000,352,656 | ---- | M] (IObit) [Auto | Running] -- C:\Programmi\IObit\Advanced SystemCare 4\ASCService.exe -- (AdvancedSystemCareService)
SRV - [2011/03/28 16.17.46 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programmi\Avira\AntiVir Desktop\sched.exe -- (AntiVirScheduler)
SRV - [2011/03/28 16.17.34 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programmi\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2009/12/23 23.34.20 | 000,370,688 | ---- | M] (StarWind Software) [Auto | Running] -- d:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE)
SRV - [2008/09/24 14.32.48 | 000,935,208 | ---- | M] (Nero AG) [Auto | Running] -- C:\Programmi\File comuni\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2007/01/31 14.55.42 | 000,096,370 | ---- | M] (Canon Inc.) [Auto | Running] -- C:\Programmi\Canon\CAL\CALMAIN.exe -- (CCALib8)
SRV - [2006/06/23 10.40.58 | 000,086,016 | ---- | M] (Logitech) [Auto | Running] -- c:\Programmi\File comuni\Logitech\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)
SRV - [2006/02/17 15.26.32 | 000,073,728 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Programmi\File comuni\LightScribe\LSSrvc.exe -- (LightScribeService)
SRV - [2005/12/13 21.31.38 | 000,114,784 | ---- | M] () [Auto | Running] -- C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe -- (CLSched) CyberLink Task Scheduler (CTS)
SRV - [2005/12/13 21.31.36 | 000,254,050 | ---- | M] () [Auto | Running] -- C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe -- (CLCapSvc) CyberLink Background Capture Service (CBCS)
SRV - [2005/12/13 21.31.08 | 000,061,440 | ---- | M] (Cyberlink) [Auto | Running] -- C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe -- (CyberLink Media Library Service)
SRV - [2005/10/24 16.40.52 | 001,314,816 | ---- | M] (Avocent Inc.) [Auto | Running] -- C:\Acer\Empowering Technology\admServ.exe -- (AWService)
SRV - [2003/07/28 20.28.22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programmi\File comuni\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2003/06/19 23.25.00 | 000,322,120 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE -- (MDM)
SRV - [2003/03/09 05.31.02 | 000,065,795 | ---- | M] (HP) [On_Demand | Stopped] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)

========== Driver Services (SafeList) ==========

DRV - [2011/05/22 09.51.30 | 000,436,792 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2011/04/01 17.09.28 | 000,137,656 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2011/04/01 17.09.28 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010/06/17 15.28.22 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010/06/17 15.28.12 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programmi\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2008/04/13 19.46.22 | 000,015,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mpe.sys -- (MPE)
DRV - [2006/06/23 10.40.58 | 002,400,128 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVMVdrv.sys -- (lvmvdrv)
DRV - [2006/06/23 10.40.58 | 000,016,768 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVPrcMon.sys -- (LVPrcMon)
DRV - [2006/06/19 12.20.24 | 001,097,728 | ---- | M] (Logitech) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lv321av.sys -- (lv321av) Logitech USB PC Camera (VC0321)
DRV - [2006/06/19 12.16.16 | 000,039,424 | ---- | M] (Logitech) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2006/05/03 12.50.54 | 001,522,688 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2006/03/19 20.29.00 | 000,520,192 | ---- | M] (AVerMedia Technologies, Inc. ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\AVerE506.sys -- (AVerE506)
DRV - [2006/03/19 20.28.00 | 001,274,880 | ---- | M] (AVerMedia Technologies, Inc. ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\AVerM115.sys -- (AVerM115)
DRV - [2006/01/23 12.41.04 | 000,078,208 | ---- | M] (Acer Value Labs, USA) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\epm-shd.sys -- (EpmShd)
DRV - [2006/01/23 12.41.04 | 000,004,096 | ---- | M] (Acer Value Labs, USA) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\epm-psd.sys -- (EpmPsd)
DRV - [2006/01/17 10.21.52 | 000,328,061 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btaudio.sys -- (btaudio)
DRV - [2006/01/17 10.19.46 | 000,023,271 | ---- | M] (Broadcom Corporation.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\btserial.sys -- (BTSERIAL)
DRV - [2006/01/17 10.18.22 | 000,850,474 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)
DRV - [2006/01/17 10.15.36 | 000,030,459 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btport.sys -- (BTDriver)
DRV - [2006/01/17 10.14.52 | 000,065,688 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
DRV - [2006/01/17 10.11.56 | 000,148,900 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwdndis.sys -- (BTWDNDIS)
DRV - [2005/12/06 17.50.10 | 000,015,744 | ---- | M] (SMSC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hidsmsc.sys -- (SMCB000)
DRV - [2005/11/28 12.09.26 | 000,013,568 | ---- | M] (Intel Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\s24trans.sys -- (s24trans)
DRV - [2005/11/26 16.36.08 | 001,427,968 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\w39n51.sys -- (w39n51) Intel®
DRV - [2005/11/17 15.45.40 | 004,069,888 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2005/11/08 00.12.18 | 000,997,376 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DPV.sys -- (HSF_DPV)
DRV - [2005/11/08 00.11.34 | 000,202,240 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWAZL.sys -- (HSFHWAZL)
DRV - [2005/11/08 00.11.30 | 000,723,712 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2005/10/15 18.20.44 | 000,012,106 | ---- | M] (OSA Technologies) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\OsaFsLoc.sys -- (OsaFsLoc)
DRV - [2005/09/13 15.34.40 | 000,004,392 | ---- | M] (OSA Technologies) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NdisFilt.sys -- (NdisFilt)
DRV - [2005/06/30 16.58.24 | 000,007,296 | ---- | M] (OSA Technologies, An Avocent Company) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\osaio.sys -- (osaio)
DRV - [2005/06/23 09.16.08 | 000,162,176 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\tifm21.sys -- (tifm21)
DRV - [2005/05/02 12.13.42 | 000,009,600 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\NETMNT.sys -- (NETMNT)
DRV - [2005/04/05 01.38.32 | 000,132,352 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k)
DRV - [2005/01/14 15.57.16 | 000,004,010 | ---- | M] (Windows ® 2000 DDK provider) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\osanbm.sys -- (osanbm)
DRV - [2005/01/13 14.46.16 | 000,069,632 | ---- | M] () [Kernel | Auto | Running] -- C:\Acer\Empowering Technology\eRecovery\int15.sys -- (int15.sys)
DRV - [2004/12/09 14.54.12 | 000,046,592 | ---- | M] (SMSC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\smcirda.sys -- (SMCIRDA)
DRV - [2004/08/31 19.07.10 | 000,026,240 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ElbyCDFL.sys -- (ElbyCDFL)
DRV - [2003/04/02 12.25.10 | 000,538,925 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\torususb.sys -- (TaurusUsb)
DRV - [2003/03/27 13.11.38 | 000,059,466 | ---- | M] (STMicroelectronics ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\stmatm.sys -- (Stmatm)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

O1 HOSTS File: ([2011/06/13 00.28.30 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll (HiTRUST)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
O4 - HKLM..\Run: [Acer ePower Management] C:\Acer\Empowering Technology\ePower\Acer ePower Management.exe (Acer Value Labs, Taiwan)
O4 - HKLM..\Run: [ADMTray.exe] C:\Acer\Empowering Technology\admtray.exe (Avocent Inc.)
O4 - HKLM..\Run: [Adobe ARM] C:\Programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdslTaskBar] C:\WINDOWS\System32\stmctrl.dll (STMicroelectronics )
O4 - HKLM..\Run: [ATICCC] C:\Programmi\ATI Technologies\ATI.ACE\cli.exe (ATI Technologies Inc.)
O4 - HKLM..\Run: [avgnt] C:\Programmi\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [CloneCDTray] d:\Programmi\SlySoft\CloneCD\CloneCDTray.exe (SlySoft, Inc.)
O4 - HKLM..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe (HiTRUST)
O4 - HKLM..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe (Acer Incorporated)
O4 - HKLM..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe (acer Inc.)
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [LaunchApp] C:\WINDOWS\Alaunch.exe (Acer Inc.)
O4 - HKLM..\Run: [LManager] C:\Programmi\Launch Manager\QtZgAcer.EXE (Dritek System Inc.)
O4 - HKLM..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE (Logitech)
O4 - HKLM..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe ()
O4 - HKLM..\Run: [PCMService] C:\Program Files\Acer\Acer Arcade\PCMService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programmi\File comuni\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SynTPLpr] C:\Programmi\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [VirtualCloneDrive] D:\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG)
O4 - HKCU..\Run: [Advanced SystemCare 4] C:\Programmi\IObit\Advanced SystemCare 4\ASCTray.exe (IObit)
O4 - HKCU..\Run: [AlcoholAutomount] d:\Programmi\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe (Alcohol Soft Development Team)
O4 - HKCU..\Run: [googletalk] C:\Programmi\Google\Google Talk\googletalk.exe (Google)
O4 - Startup: C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\BTTray.lnk = C:\Programmi\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
O4 - Startup: C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\hpoddt01.exe.lnk = D:\Programmi\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe (Hewlett-Packard)
O4 - Startup: C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\hp psc 1000 series.lnk = D:\Programmi\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe (Hewlett-Packard Co.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1265845366203 (WUWebControl Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos-beta/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programmi\File comuni\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programmi\File comuni\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programmi\File comuni\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programmi\File comuni\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Pagina iniziale corrente) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Acer.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Acer.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2003/09/05 11.31.16 | 000,000,100 | ---- | M] () - C:\AUTOEXEC.BAT -- [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - File not found
Drivers32: msacm.mkdmp3enc - C:\PROGRA~2\Acer\ACERAR~1\Kernel\Burner\MKDMP3Enc.ACM File not found
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.I420 - C:\WINDOWS\System32\lvcodec2.dll (Logitech)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

========== Files/Folders - Created Within 30 Days ==========

[2011/06/15 22.55.47 | 000,000,000 | ---D | C] -- C:\Programmi\Adobe
[2011/06/15 22.46.30 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2011/06/15 22.38.55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dati applicazioni\Sun
[2011/06/15 22.38.54 | 000,000,000 | ---D | C] -- C:\Programmi\File comuni\Java
[2011/06/15 22.38.03 | 000,000,000 | ---D | C] -- C:\Programmi\Java
[2011/06/13 20.27.50 | 000,000,000 | -HSD | C] -- C:\Recycled
[2011/06/13 20.18.56 | 000,072,704 | ---- | C] (GravityGripp) -- C:\Documents and Settings\Giulio&Vale\Desktop\ZipIt2.exe
[2011/06/13 20.08.09 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Giulio&Vale\Recent
[2011/06/13 00.06.21 | 004,120,119 | R--- | C] (Swearware) -- C:\Documents and Settings\Giulio&Vale\Desktop\ComboFix.exe
[2011/06/12 23.57.33 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/06/11 11.26.38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Avvio\Programmi\Il Giardino della Lettura
[2011/06/11 11.24.41 | 000,000,000 | ---D | C] -- C:\Programmi\Giotec
[2011/06/11 08.30.56 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Giulio&Vale\Desktop\OTL.exe
[2011/06/04 15.53.30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Giulio&Vale\Impostazioni locali\Dati applicazioni\WMTools Downloaded Files
[2011/06/03 19.20.45 | 000,000,000 | ---D | C] -- C:\Programmi\Nikita
[2011/05/29 17.08.47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Giulio&Vale\Menu Avvio\Programmi\FormatFactory
[2011/05/29 16.49.21 | 000,000,000 | ---D | C] -- C:\Programmi\FreeTime
[2011/05/29 16.30.26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Giulio&Vale\Desktop\Dolce matematica
[2011/05/27 17.44.23 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2011/05/27 17.43.33 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2011/05/27 17.43.33 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2011/05/27 17.43.33 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2011/05/27 17.43.33 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2011/05/27 17.42.17 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2011/05/27 17.42.14 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/05/27 17.42.12 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Giulio&Vale\Menu Avvio\Programmi\Strumenti di amministrazione
[2011/05/27 17.28.44 | 004,296,418 | R--- | C] (Swearware) -- C:\Documents and Settings\Giulio&Vale\Desktop\ComboFixOLD.exe
[2011/05/27 17.22.04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dati applicazioni\TEMP
[2011/05/27 17.18.28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dati applicazioni\SUPERAntiSpyware.com
[2011/05/27 16.00.07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dati applicazioni\PC Tools
[2011/05/25 00.52.36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Giulio&Vale\Dati applicazioni\Malwarebytes
[2011/05/25 00.52.27 | 000,039,984 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/05/25 00.52.27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Avvio\Programmi\Malwarebytes' Anti-Malware
[2011/05/25 00.52.24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dati applicazioni\Malwarebytes
[2011/05/25 00.52.20 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/05/25 00.52.20 | 000,000,000 | ---D | C] -- C:\Programmi\Malwarebytes' Anti-Malware
[2011/05/25 00.37.59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Giulio&Vale\Dati applicazioni\Avira
[2011/05/25 00.26.46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Avvio\Programmi\Avira
[2011/05/25 00.26.30 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys
[2011/05/25 00.26.29 | 000,137,656 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2011/05/25 00.26.29 | 000,061,960 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2011/05/25 00.26.29 | 000,045,416 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntdd.sys
[2011/05/25 00.26.29 | 000,022,360 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntmgr.sys
[2011/05/25 00.26.28 | 000,000,000 | ---D | C] -- C:\Programmi\Avira
[2011/05/25 00.26.28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dati applicazioni\Avira
[2011/05/24 23.36.32 | 000,000,000 | ---D | C] -- C:\FOUND.010
[2011/05/23 15.59.16 | 000,000,000 | ---D | C] -- C:\FOUND.009
[2011/05/23 01.50.20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Giulio&Vale\Dati applicazioni\OfferBox
[2011/05/23 00.03.26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Avvio\Programmi\Alcohol 120%
[2011/05/20 22.56.32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Avvio\Programmi\Advanced SystemCare 4
[2011/05/20 22.56.17 | 000,000,000 | ---D | C] -- C:\Programmi\IObit
[2011/05/20 01.01.03 | 000,000,000 | ---D | C] -- C:\Programmi\Foxit Software
[5 C:\Documents and Settings\Giulio&Vale\Impostazioni locali\Dati applicazioni\*.tmp files -> C:\Documents and Settings\Giulio&Vale\Impostazioni locali\Dati applicazioni\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/06/15 23.10.42 | 000,006,935 | ---- | M] () -- C:\WINDOWS\UEDIT32.INI
[2011/06/15 23.02.42 | 000,000,536 | ---- | M] () -- C:\WINDOWS\System32\eRLog.ini
[2011/06/15 23.01.26 | 000,001,136 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/15 23.01.24 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/06/15 23.01.20 | 2145,505,280 | -HS- | M] () -- C:\hiberfil.sys
[2011/06/15 23.00.28 | 000,000,012 | ---- | M] () -- C:\WINDOWS\bthservsdp.dat
[2011/06/15 22.55.58 | 000,001,622 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2011/06/15 22.42.12 | 000,001,140 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/06/15 21.54.02 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/06/13 23.34.34 | 000,879,099 | ---- | M] () -- C:\Documents and Settings\Giulio&Vale\Desktop\SecurityCheck.exe
[2011/06/13 20.45.16 | 000,000,664 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/13 20.19.38 | 000,000,733 | ---- | M] () -- C:\Documents and Settings\Giulio&Vale\Desktop\Giulio&Vale.zip
[2011/06/13 20.18.58 | 000,072,704 | ---- | M] (GravityGripp) -- C:\Documents and Settings\Giulio&Vale\Desktop\ZipIt2.exe
[2011/06/13 00.06.22 | 004,120,119 | R--- | M] (Swearware) -- C:\Documents and Settings\Giulio&Vale\Desktop\ComboFix.exe
[2011/06/11 11.28.14 | 000,332,280 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/06/11 11.26.50 | 000,000,000 | ---- | M] () -- C:\WINDOWS\PROTOCOL.INI
[2011/06/11 10.40.12 | 000,000,691 | ---- | M] () -- C:\Documents and Settings\Giulio&Vale\Desktop\Calcolare a mente.lnk
[2011/06/11 09.42.56 | 000,001,409 | ---- | M] () -- C:\WINDOWS\System32\tmp63333.FOT
[2011/06/11 08.30.58 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Giulio&Vale\Desktop\OTL.exe
[2011/06/11 08.10.40 | 000,139,264 | ---- | M] () -- C:\RKUnhookerLE.EXE
[2011/06/05 17.06.30 | 000,000,522 | ---- | M] () -- C:\hpfr3420.xml
[2011/05/29 17.08.48 | 000,000,695 | ---- | M] () -- C:\Documents and Settings\Giulio&Vale\Desktop\Format Factory.lnk
[2011/05/29 16.54.44 | 000,000,584 | ---- | M] () -- C:\Documents and Settings\Giulio&Vale\Desktop\Collegamento a FFOutput.lnk
[2011/05/29 15.31.04 | 000,021,610 | ---- | M] () -- C:\Documents and Settings\Giulio&Vale\Desktop\Il caffe' della Peppina.zip
[2011/05/29 15.28.52 | 000,020,343 | ---- | M] () -- C:\Documents and Settings\Giulio&Vale\Desktop\Dolce matematica.zip
[2011/05/29 15.12.58 | 005,052,503 | ---- | M] () -- C:\Documents and Settings\Giulio&Vale\Desktop\Dolce matematica 47°Zecchino d'oro 2004.mp3
[2011/05/29 09.11.30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/05/29 09.11.20 | 000,022,712 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/05/27 17.44.28 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2011/05/27 17.43.12 | 004,296,418 | R--- | M] (Swearware) -- C:\Documents and Settings\Giulio&Vale\Desktop\ComboFixOLD.exe
[2011/05/27 17.14.22 | 000,002,048 | ---- | M] () -- C:\Uninstall.dat
[2011/05/26 21.59.12 | 000,000,124 | ---- | M] () -- C:\Documents and Settings\Giulio&Vale\Documenti\ax_files.xml
[2011/05/25 01.04.18 | 000,000,237 | ---- | M] () -- C:\WINDOWS\System32\queries-02.cache
[2011/05/25 01.04.16 | 000,000,217 | ---- | M] () -- C:\WINDOWS\System32\queries-01.cache
[2011/05/25 01.04.16 | 000,000,118 | ---- | M] () -- C:\WINDOWS\System32\queries-03.cache
[2011/05/25 00.19.32 | 000,001,912 | ---- | M] () -- C:\WINDOWS\epplauncher.mif
[2011/05/24 19.22.18 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Giulio&Vale\Desktop\Dolce matematica.pdf
[2011/05/23 02.15.58 | 000,025,088 | ---- | M] () -- C:\Documents and Settings\Giulio&Vale\Impostazioni locali\Dati applicazioni\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/05/23 00.03.30 | 000,000,685 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Alcohol 120%.lnk
[2011/05/21 09.58.42 | 000,490,288 | ---- | M] () -- C:\WINDOWS\System32\perfh010.dat
[2011/05/21 09.58.42 | 000,442,774 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/05/21 09.58.42 | 000,084,650 | ---- | M] () -- C:\WINDOWS\System32\perfc010.dat
[2011/05/21 09.58.42 | 000,071,848 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011/05/20 22.56.36 | 000,000,754 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Advanced SystemCare 4.lnk
[2011/05/17 00.10.08 | 003,328,815 | ---- | M] () -- C:\Documents and Settings\Giulio&Vale\Desktop\310-052.zip
[5 C:\Documents and Settings\Giulio&Vale\Impostazioni locali\Dati applicazioni\*.tmp files -> C:\Documents and Settings\Giulio&Vale\Impostazioni locali\Dati applicazioni\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/06/15 22.55.56 | 000,001,804 | ---- | C] () -- C:\Documents and Settings\All Users\Menu Avvio\Programmi\Adobe Reader X.lnk
[2011/06/15 22.55.56 | 000,001,622 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2011/06/13 23.34.18 | 000,879,099 | ---- | C] () -- C:\Documents and Settings\Giulio&Vale\Desktop\SecurityCheck.exe
[2011/06/13 20.19.36 | 000,000,733 | ---- | C] () -- C:\Documents and Settings\Giulio&Vale\Desktop\Giulio&Vale.zip
[2011/06/11 11.26.48 | 000,000,000 | ---- | C] () -- C:\WINDOWS\PROTOCOL.INI
[2011/06/11 10.40.10 | 000,000,691 | ---- | C] () -- C:\Documents and Settings\Giulio&Vale\Desktop\Calcolare a mente.lnk
[2011/06/11 09.42.56 | 000,001,409 | ---- | C] () -- C:\WINDOWS\System32\tmp63333.FOT
[2011/06/11 08.10.32 | 000,139,264 | ---- | C] () -- C:\RKUnhookerLE.EXE
[2011/05/29 17.08.47 | 000,000,695 | ---- | C] () -- C:\Documents and Settings\Giulio&Vale\Desktop\Format Factory.lnk
[2011/05/29 16.54.43 | 000,000,584 | ---- | C] () -- C:\Documents and Settings\Giulio&Vale\Desktop\Collegamento a FFOutput.lnk
[2011/05/29 16.19.08 | 000,090,686 | ---- | C] () -- C:\Documents and Settings\Giulio&Vale\Desktop\Dolce matematica.mid
[2011/05/29 15.31.02 | 000,021,610 | ---- | C] () -- C:\Documents and Settings\Giulio&Vale\Desktop\Il caffe' della Peppina.zip
[2011/05/29 15.30.03 | 000,020,343 | ---- | C] () -- C:\Documents and Settings\Giulio&Vale\Desktop\Dolce matematica.zip
[2011/05/29 15.12.39 | 005,052,503 | ---- | C] () -- C:\Documents and Settings\Giulio&Vale\Desktop\Dolce matematica 47°Zecchino d'oro 2004.mp3
[2011/05/28 18.50.59 | 2145,505,280 | -HS- | C] () -- C:\hiberfil.sys
[2011/05/27 17.44.25 | 000,261,312 | RHS- | C] () -- C:\cmldr
[2011/05/27 17.43.33 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2011/05/27 17.43.33 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2011/05/27 17.43.33 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2011/05/27 17.43.33 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2011/05/27 17.43.33 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2011/05/26 21.54.00 | 000,002,048 | ---- | C] () -- C:\Uninstall.dat
[2011/05/25 01.04.15 | 000,000,217 | ---- | C] () -- C:\WINDOWS\System32\queries-01.cache
[2011/05/25 01.04.15 | 000,000,118 | ---- | C] () -- C:\WINDOWS\System32\queries-03.cache
[2011/05/25 00.52.28 | 000,000,664 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/05/24 19.22.26 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Giulio&Vale\Desktop\Dolce matematica.pdf
[2011/05/24 15.10.04 | 000,000,237 | ---- | C] () -- C:\WINDOWS\System32\queries-02.cache
[2011/05/23 00.22.55 | 000,000,124 | ---- | C] () -- C:\Documents and Settings\Giulio&Vale\Documenti\ax_files.xml
[2011/05/23 00.03.28 | 000,000,685 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Alcohol 120%.lnk
[2011/05/20 22.56.35 | 000,000,754 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Advanced SystemCare 4.lnk
[2011/05/17 00.09.55 | 003,328,815 | ---- | C] () -- C:\Documents and Settings\Giulio&Vale\Desktop\310-052.zip
[2011/05/09 01.05.46 | 000,187,376 | ---- | C] () -- C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\FontCache3.0.0.0.dat
[2010/09/04 05.18.28 | 000,000,268 | ---- | C] () -- C:\WINDOWS\Clony2.ini
[2010/09/04 04.47.12 | 000,000,031 | -HS- | C] () -- C:\Documents and Settings\All Users\Dati applicazioni\.zreglib
[2010/06/11 20.42.48 | 000,000,451 | ---- | C] () -- C:\WINDOWS\Disney.ini
[2010/05/14 22.49.49 | 000,017,408 | ---- | C] () -- C:\WINDOWS\System32\Delphimm.dll
[2010/04/26 20.26.38 | 000,000,172 | ---- | C] () -- C:\Documents and Settings\Giulio&Vale\Dati applicazioni\default.rss
[2010/04/26 20.26.38 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Giulio&Vale\Dati applicazioni\downloads.m3u
[2010/04/25 18.21.49 | 000,016,384 | ---- | C] () -- C:\WINDOWS\System32\FileOps.exe
[2010/04/22 00.00.47 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2010/03/16 23.09.20 | 000,019,554 | ---- | C] () -- C:\WINDOWS\hpoins01.dat
[2010/03/16 23.09.20 | 000,016,606 | ---- | C] () -- C:\WINDOWS\hpomdl01.dat
[2010/03/15 22.20.35 | 000,004,767 | ---- | C] () -- C:\WINDOWS\Irremote.ini
[2010/02/27 17.04.50 | 000,000,424 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2010/02/11 00.32.16 | 000,025,088 | ---- | C] () -- C:\Documents and Settings\Giulio&Vale\Impostazioni locali\Dati applicazioni\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/02/10 23.57.41 | 000,006,935 | ---- | C] () -- C:\WINDOWS\UEDIT32.INI
[2010/02/10 23.44.48 | 000,000,719 | R--- | C] () -- C:\WINDOWS\System32\InstExec.ini
[2010/02/10 23.44.45 | 000,013,227 | ---- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2010/02/10 22.33.49 | 000,000,544 | ---- | C] () -- C:\WINDOWS\_delis32.ini
[2010/02/10 21.04.24 | 000,538,925 | ---- | C] () -- C:\WINDOWS\System32\drivers\torususb.sys
[2010/02/09 05.58.21 | 000,000,536 | ---- | C] () -- C:\WINDOWS\System32\eRLog.ini
[2010/02/09 05.56.05 | 000,000,012 | ---- | C] () -- C:\WINDOWS\bthservsdp.dat
[2010/02/09 05.50.30 | 000,000,000 | ---- | C] () -- C:\WINDOWS\NT.INI
[2010/02/09 05.39.25 | 000,000,140 | ---- | C] () -- C:\Documents and Settings\Giulio&Vale\Impostazioni locali\Dati applicazioni\fusioncache.dat
[2006/03/19 20.28.00 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\34CoInstaller.dll
[2006/03/09 23.15.44 | 000,036,404 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2006/01/17 10.31.30 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\btprn2k.dll
[2005/12/27 15.50.32 | 000,067,072 | ---- | C] () -- C:\WINDOWS\System32\HTCA_SelfExtract.bin
[2005/12/27 15.50.26 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\APISlice.dll
[2005/12/27 15.50.26 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\SC_res.dll
[2005/12/27 15.50.26 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\EN_res.dll
[2005/12/27 15.50.26 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\TC_res.dll
[2005/12/27 15.50.26 | 000,010,752 | ---- | C] () -- C:\WINDOWS\System32\MSNChatHook.dll
[2005/12/22 02.44.30 | 000,121,995 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2005/12/14 20.59.52 | 000,000,038 | ---- | C] () -- C:\WINDOWS\Acer.ini
[2005/11/30 20.45.10 | 002,400,128 | ---- | C] () -- C:\WINDOWS\System32\drivers\LVMVdrv.sys
[2005/11/30 20.45.10 | 000,016,768 | ---- | C] () -- C:\WINDOWS\System32\drivers\LVPrcMon.sys
[2005/10/31 03.17.38 | 000,135,168 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2005/10/18 09.28.50 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2005/10/18 09.11.36 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2005/07/15 01.48.00 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2005/05/02 12.13.42 | 000,009,600 | ---- | C] () -- C:\WINDOWS\System32\drivers\NETMNT.sys
[2005/03/28 00.45.26 | 000,000,091 | ---- | C] () -- C:\WINDOWS\ALaunch.ini
[2004/08/19 15.39.24 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\PsisDecd.dll
[2004/08/19 05.00.00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/08/19 05.00.00 | 000,300,212 | ---- | C] () -- C:\WINDOWS\System32\perfi010.dat
[2004/08/19 05.00.00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/08/19 05.00.00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/08/19 05.00.00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/08/19 05.00.00 | 000,034,004 | ---- | C] () -- C:\WINDOWS\System32\perfd010.dat
[2004/08/19 05.00.00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/08/19 05.00.00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/08/19 05.00.00 | 000,003,476 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2004/08/19 05.00.00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2004/08/19 05.00.00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2004/01/13 18.46.34 | 000,172,032 | ---- | C] () -- C:\WINDOWS\System32\tifmicon.dll
[2003/12/29 20.45.08 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\ServiceControl.dll
[2003/09/05 11.49.46 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2003/09/05 11.38.22 | 000,490,288 | ---- | C] () -- C:\WINDOWS\System32\perfh010.dat
[2003/09/05 11.38.22 | 000,442,774 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2003/09/05 11.38.22 | 000,084,650 | ---- | C] () -- C:\WINDOWS\System32\perfc010.dat
[2003/09/05 11.38.20 | 000,071,848 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2003/09/05 11.31.46 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIBUN4.dll
[2003/09/05 11.30.36 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMPEG2.dll
[2003/09/05 11.30.36 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMP3.dll
[2003/09/05 11.30.36 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIFCD3.dll
[2003/09/05 11.30.36 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTICDMK7.dll
[2003/07/11 21.56.36 | 000,332,280 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2003/07/10 10.38.52 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2003/07/10 10.37.40 | 000,021,840 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2003/04/01 11.49.16 | 000,005,360 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2003/03/09 21.31.04 | 000,561,152 | ---- | C] () -- C:\WINDOWS\System32\hpotscl.dll
[2002/05/24 01.34.46 | 000,032,768 | ---- | C] () -- C:\WINDOWS\AMove.exe
[2001/12/26 15.12.30 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\multiplex_vcd.dll
[2001/11/14 12.56.00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll
[2001/09/03 22.46.38 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\Hmpg12.dll
[2001/08/26 02.04.08 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2001/08/26 02.02.42 | 000,004,524 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2001/07/30 15.33.56 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\HMPV2_ENC.dll
[2001/07/23 21.04.36 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\HMPV2_ENC_MMX.dll
[1999/01/27 13.39.06 | 000,065,024 | ---- | C] () -- C:\WINDOWS\System32\indounin.dll
[1997/06/13 07.56.08 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\Iyvu9_32.dll

========== LOP Check ==========

[2003/09/05 11.28.36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dati applicazioni\Acer
[2010/04/24 07.52.56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dati applicazioni\IObit
[2010/08/29 10.40.06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dati applicazioni\Ubisoft
[2010/09/04 03.59.18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dati applicazioni\SlySoft
[2011/03/05 18.18.46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dati applicazioni\Propellerhead Software
[2011/05/27 17.22.06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dati applicazioni\TEMP
[2003/09/05 11.29.46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Giulio&Vale\Dati applicazioni\Acer
[2010/02/10 21.01.58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Giulio&Vale\Dati applicazioni\Uniblue
[2010/03/23 19.39.50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Giulio&Vale\Dati applicazioni\it.clementoni.SapFattoriaAnimaliIT.290A939A40FB4C06653AD1460C6BEBD4C065087B.1
[2010/03/23 20.02.48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Giulio&Vale\Dati applicazioni\IObit
[2010/09/04 05.24.24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Giulio&Vale\Dati applicazioni\RipIt4Me
[2010/11/19 19.48.36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Giulio&Vale\Dati applicazioni\fltk.org
[2011/01/16 23.51.14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Giulio&Vale\Dati applicazioni\PriceGong
[2011/03/05 18.18.44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Giulio&Vale\Dati applicazioni\Propellerhead Software
[2011/05/23 01.50.22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Giulio&Vale\Dati applicazioni\OfferBox
[2010/07/13 22.05.16 | 000,000,346 | ---- | M] () -- C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1268859854.job

========== Purity Check ==========

========== Custom Scans ==========

< hklm\software\clients\startmenuinternet|command /rs >
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\WINDOWS\system32\ie4uinit.exe" -reinstall [2011/02/17 13.43.28 | 000,070,656 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -hide [2011/02/17 13.43.28 | 000,070,656 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -show [2011/02/17 13.43.28 | 000,070,656 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: "C:\Programmi\Internet Explorer\iexplore.exe" [2011/02/14 14.17.08 | 000,634,648 | ---- | M] (Microsoft Corporation)

< %USERPROFILE%\AppData\Local\Google\Chrome\User Data\*.* /s >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-05-16 13:44:20

< >

< >

< >

< >

< End of report >

#18 SweetTech

Agent ST

Group: Malware Response Team
Posts: 12,662
Joined: 15-March 09
Gender:Male
Location:Antarctica

Posted 15 June 2011 - 04:22 PM

Hello,

Your logs appear to be clean, so if you have no further issues with your computer, then please proceed with the following housekeeping procedures outlined below.

Time for some housekeeping
The following will implement some cleanup procedures as well as reset System Restore points:

Click Start > Run and copy/paste the following bolded text into the Run box and click OK: ComboFix /Uninstall

NEXT:

OTL Fix

We need to run an OTL Fix

Please reopen on your desktop.
Copy and Paste the following code into the textbox.
```
:Commands
[ClearAllRestorePoints]
```
Push
OTL may ask to reboot the machine. Please do so if asked.
Click the OK button.
A report will open. Copy and Paste that report in your next reply.

NEXT:

OTL Clean-Up

We Need to Clean Up our Mess
Our work on your machine has left considerable leftovers on your box. Let's clean those up real quick:

Reopen on your desktop.
Click on
You will be prompted to reboot your system. Please do so.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

NEXT:

All Clean Speech

===> Make sure you've re-enabled any Security Programs that we may have disabled during the malware removal process. <===

Below I have included a number of recommendations for how to protect your computer against malware infections.

Updated Anti-Virus Program
It's essential that you have an updated anti-virus program running on your computer. You don't want to run more than one as it can cause program conflicts, as well as false positives

You can view an excellent list of Free Security Software programs that has been compiled by GeekstoGo.

Avoid P2P Programs

Remember that no matter how clean the program you're using for peer-to-peer filesharing may be, it offers no guarantees regarding the cleanliness of files you may choose to download. All files available via p2p filesharing carry a high risk, particularly those that offer you illegitimate methods of using legitimate software programs without paying for them. Some further readings on this subject, along the included links, are as follows: File-Sharing, otherwise known as Peer To Peer and Risks of File-Sharing Technology.

If you have any of these programs installed then I highly suggest you uninstall them.

NOTE: Take care when answering any questions posed by an uninstaller. Some questions may be worded to deceive you into keeping the program.

Internet Browsers

Many of the users that I assist here on the forums, ask me which programs they can use to prevent themselves from getting infected again in the future. The best answer I can give you is too practice safe browsing.

Please consider using an alternative browser such as Google Chrome or Opera. They are both much more secure than Internet Explorer, immune to almost all known browser hijackers, and also have great built-in pop-up blockers.

I also suggest you make your Internet Explore more secure.

Make Internet Explorer more secure

Click Start > Run
Type Inetcpl.cpl & click OK
Click on the Security tab
Click Reset all zones to default level
Make sure the Internet Zone is selected & Click Custom level
In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
Next Click OK, then Apply button and then OK to exit the Internet Properties page.

Extra Goodies

It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them then consider a password keeper, to keep all your passwords safe.
Keep Windows updated by regularly checking their website at: http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.
You should run an updated scan with MalwareBytes' Anti-Malware weekly. Instructions are included below:
- Open Malwarebytes' Anti-Malware
- Select the Update tab
- Click Check for Updates
Be weary of e-mails from unknown senders. Keep the following in mind as well: If it's to good to be true, then it more than likely is.
FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated. Its important to keep programs up to date so that malware doesn't exploit any old security flaws.
WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
- Green to go
- Yellow for caution
- Red to stop
WOT has an addon available for Chrome and Opera.
Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:

**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.

Cheers,
SweetTech.

Have I helped you? If you'd like to assist in the fight against malware, click here

The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.

#19 giulso

New Member

Group: Members
Posts: 12
Joined: 31-May 11

Posted 15 June 2011 - 05:05 PM

This is OTL fix report:

========== COMMANDS ==========
Restore points cleared and new OTL Restore Point set!

OTL by OldTimer - Version 3.2.24.0 log created on 06152011_234026

Thank you for your help e for the time you spend with me. The pc seems ok, but I want to control Windows XP (the Start menu is always empty, and there are no shortcuts to programs), is there a program that monitors Windows XP and restore any deleted, damaged or corrupted files?

Thanks

#20 SweetTech

Agent ST

Group: Malware Response Team
Posts: 12,662
Joined: 15-March 09
Gender:Male
Location:Antarctica

Posted 15 June 2011 - 05:22 PM

Hi!

There is this:

You can restore the defaults for the Start Menu, Accessories and Administrative Tools as follows:

Restore Accessories Program Files Menu with accrestore.zip for XP
- Extract (unzip) the tool, double-click on it to run and ensure that the following check boxes are checked (as shown below):
- Then click on the Restore button.
Restore Admin Tools Program Files Menu with admintools.zip for XP
- Extract (unzip) the tool, double-click on it to run and click on Restore Administrative Tools Items (as shown below):
- Then click on the Restore button.

For any other missing program shortcuts you will probably need to reinstall the application or manually create new shortcuts.

To manually recreate "All Programs" entries, follow these steps...

Download App Paths
Double click on AppPaths.exe to run the program.
Keep the program open.

In this example I'll recreate an entry for Avast antivirus program.

Go Start>All Programs.
Right click on Avast entry, click "Properties".

NOTE. Make sure, you right click on Avast program, NOT on Avast folder.

You'll see this window:

Due to the damage caused by the infection, you'll find "Target" box empty.

Go back to AppPaths window and find Avast entry.
Right click on Avast line, click "Edit".
A pop-up window will open:

Highlight everything in "Path" box, right click on it, click "Copy"
Go back to Avast "Properties" window, right click inside "Target" box, click "Paste".
IMPORTANT! Add quotation marks at the beginning of the path and at the end
Click OK and you're done.

In case, program's link shows as (empty):

Posted Image

Open Windows Explorer, navigate to Avast folder in Program Files
Right click on Avast ".exe" file, click "Create shortcut":

Copy that shortcut, go back to Start menu.
Right click on avast!Free Antivirus, click "Paste".
You'll see Avast shortcut recreated replacing (empty) entry.

Alternatively....
...you paste that shortcut in:
(XP) - C:\Documents and Settings\All Users\Start Menu\Programs\Avast
(Vista/7) - C:\Program Data\Start Menu\Programs\Avast

#21 SweetTech

Agent ST

Group: Malware Response Team
Posts: 12,662
Joined: 15-March 09
Gender:Male
Location:Antarctica

Posted 17 June 2011 - 09:54 AM

Since it appears that the issues you were experiencing with your computer have been resolved, I am going to close this thread. If you should need the thread re-opened please send me a Private Message (PM) with a request to re-open the thread, as well as the link to the thread in question, and I'd be happy to re-open the thread.