Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Bundespolizei Trojaner (https://www.trojaner-board.de/121756-bundespolizei-trojaner.html)

casafon 10.08.2012 18:23
Bundespolizei Trojaner
 
Hallo ich habe den Bundespolizei-Trojaner genommen. Habe mir das Malwarebytes runtergeladen und jetzt laeuft mein Scan. Am Ende werde ich die infizierten Files in die Quarantaene stellen. Soll ich dann einfach den Regeln auf dieser Seite folgen?
Danke
Ciao

Die Anleitung ddes Mawarebytes sagt, dass man die infizierten Files nicht loeschen sondern sie in die Quarantaene stellen soll. Die Anleitung, die sich auf den Bundespolizei-Trojaner bezieht sagt, im Gegenteil, dass man nicht loeschen soll. Welches ist richtig? Allerdings finde ich nicht die Option "in die Quarantaene" im Fenster wo die Funde gezeigt werden.
ciao

Malwarebytes Anti-Malware (Prova) 1.62.0.1300
Malwarebytes : Free anti-malware download

Versione database: v2012.08.10.07

Windows Vista Service Pack 1 x86 NTFS
Internet Explorer 7.0.6001.18000
pablito :: PC-PABLITO [amministratore]

Protezione: Attivata

10/08/2012 19.12.35
mbam-log-2012-08-10 (21-21-43).txt

Tipo di scansione: Scansione completa (C:\|D:\|)
Opzioni di scansione attive: Memoria | Esecuzione automatica | Registro | File system | Euristica/Extra | Euristica/Shuriken | PUP | PUM
Opzioni di scansione disattivate: P2P
Elementi esaminati: 340710
Tempo impiegato: 59 minuti, 3 secondi

Processi rilevati in memoria: 0
(non sono stati rilevati elementi nocivi)

Moduli di memoria rilevati: 0
(non sono stati rilevati elementi nocivi)

Chiavi di registro rilevate: 0
(non sono stati rilevati elementi nocivi)

Valori di registro rilevati: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|cwwxfazvzcptxoj (Trojan.Winlock.P) -> Dati: C:\ProgramData\cwwxfazv.exe -> Nessuna azione intrapresa.

Voci rilevate nei dati di registro: 0
(non sono stati rilevati elementi nocivi)

Cartelle rilevate: 0
(non sono stati rilevati elementi nocivi)

File rilevati: 15
C:\ProgramData\cwwxfazv.exe (Trojan.Winlock.P) -> Nessuna azione intrapresa.
C:\$Recycle.Bin\S-1-5-21-2503310835-3293788857-4269131794-1003\$RU2PUHF.exe (PUP.ToolbarDownloader) -> Nessuna azione intrapresa.
C:\Users\pablito\ms.exe (Trojan.Winlock.P) -> Nessuna azione intrapresa.
C:\Users\pablito\AppData\Local\Temp\+8wZLStS.exe.part (PUP.Adware.Agent) -> Nessuna azione intrapresa.
C:\Users\pablito\AppData\Local\Temp\tf0L_IqV.exe.part (PUP.ToolbarDownloader) -> Nessuna azione intrapresa.
C:\Users\pablito\AppData\Local\Temp\tmp4f072512572ae.exe (PUP.RiskwareTool.CK) -> Nessuna azione intrapresa.
C:\Users\pablito\AppData\Local\Temp\Dd_+Ceks.exe.part (Adware.Agent) -> Nessuna azione intrapresa.
C:\Users\pablito\AppData\Local\Temp\is1590112554\IWantThis_ROW.exe (Adware.GamePlayLabs) -> Nessuna azione intrapresa.
C:\Users\pablito\AppData\Local\Temp\316042.Uninstall\Uninstall.exe (Adware.Agent) -> Nessuna azione intrapresa.
C:\Users\pablito\AppData\Local\Temp\327929.Uninstall\Uninstall.exe (Adware.Agent) -> Nessuna azione intrapresa.
C:\Users\pablito\Downloads\FLVPlayerSetup.exe (Adware.Agent) -> Nessuna azione intrapresa.
C:\Users\pablito\Downloads\MediaPlayerSetup.exe (Adware.Agent) -> Nessuna azione intrapresa.
C:\Users\pablito\Downloads\SoftonicDownloader_para_endnote.exe (PUP.ToolbarDownloader) -> Nessuna azione intrapresa.
C:\Users\pablito\Downloads\SoftonicDownloader_per_free-youtube-to-mp3-converter.exe (PUP.ToolbarDownloader) -> Nessuna azione intrapresa.
C:\Users\pablito\Downloads\SoftonicDownloader_per_winrar.exe (PUP.ToolbarDownloader) -> Nessuna azione intrapresa.

(fine)

Das ist das Log vom Malewarebytes-Scan, leider auf Italienisch (habe dummerweise das Programm auf Italienisch installiert). Kann man das auch so verstehen? Ist jemand von der Community da, und kann mir sagen, ob ich jetzt loeschen oder in die Quarantaene verschoben soll? Das ware nett! Danke!
paolo

t'john 11.08.2012 02:17
:hallo:

Loeschen!

CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.


Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\*.*
%APPDATA%\*AcroIEH*.*
%APPDATA%\*.exe
%APPDATA%\*.tmp
CREATERESTOREPOINT

casafon 11.08.2012 11:08
Es gab auch ein Extras.TXT, ich füge es hier unten (kann sein, dass es das gleich ist):OTL EXTRAS Logfile:
Code:
OTL Extras logfile created on: 11/08/2012 11.41.52 - Run 1
OTL by OldTimer - Version 3.2.56.0    Folder = C:\Users\pablito\Downloads
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000410 | Country: Italia | Language: ITA | Date Format: dd/MM/yyyy
 
2,99 Gb Total Physical Memory | 1,92 Gb Available Physical Memory | 64,04% Memory free
6,19 Gb Paging File | 5,13 Gb Available in Paging File | 82,93% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 69,05 Gb Total Space | 23,46 Gb Free Space | 33,97% Space Free | Partition Type: NTFS
Drive D: | 70,00 Gb Total Space | 7,11 Gb Free Space | 10,15% Space Free | Partition Type: NTFS
 
Computer Name: PC-PABLITO | User Name: pablito | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
 
[HKEY_USERS\S-1-5-21-2503310835-3293788857-4269131794-1003\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{009F1F94-0B8A-4268-9DE5-8DCFD094EDBE}" = rport=139 | protocol=6 | dir=out | app=system |
"{014F0CBA-0F1A-49E0-ACC9-27A09ED26DA7}" = lport=445 | protocol=6 | dir=in | app=system |
"{042F50A5-1701-4F8A-91B9-479286765BA2}" = rport=138 | protocol=17 | dir=out | app=system |
"{229A929F-970D-4652-870E-C6A0954B48A7}" = lport=139 | protocol=6 | dir=in | app=system |
"{48917E09-2EB7-45DC-A697-03E7289AB601}" = rport=445 | protocol=6 | dir=out | app=system |
"{52CAEBE2-3C2D-4CE9-BD91-4DE3DAD1BBAC}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{615330B9-CD25-4409-B73B-7DB6079A3774}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{7109573F-271B-4EB5-B096-22CF6F7838AE}" = lport=137 | protocol=17 | dir=in | app=system |
"{8185ED46-9C93-45CD-B8AF-D863E0A5F421}" = lport=59981 | protocol=17 | dir=in | name=emule_udp |
"{9DD9526D-8B8D-4FF4-9066-2247EAE76A3C}" = lport=138 | protocol=17 | dir=in | app=system |
"{ED44A955-797C-41D0-A338-6AD8F12CC84B}" = rport=137 | protocol=17 | dir=out | app=system |
"{F7C7F958-A7C5-4F8E-9B04-19DD171ACA09}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{FCF633A9-4536-4F25-9BE7-645CF44AD52A}" = lport=11512 | protocol=6 | dir=in | name=emule_tcp |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{091E3CD9-7CD0-45B2-A23A-BD6D97B97036}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{0BF8BB8F-071D-43AB-8EA4-5AEF35F83839}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{24C83CF4-6C37-4741-A4D6-A8D23DF3A5FD}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{49903F9A-0F64-4562-90D0-C3DCF34E7A88}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{6C006DDE-1CA0-47A3-BC2C-265D7E389FDD}" = protocol=6 | dir=in | app=c:\program files\hp\hp deskjet 1000 j110 series\bin\usbsetup.exe |
"{9D15A38B-672C-4EA8-908D-1222C131DDFD}" = dir=in | app=c:\program files\cyberlink\powerdvd\powerdvd.exe |
"{BE21953C-8058-43AF-B135-9EFF88FAC927}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe |
"{C4FD52E2-283C-49D6-99E6-6B42A682D39B}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{CAA37B94-763F-4726-9B40-C29EDB53DA17}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{DDB9A1DE-2050-4E8D-8C29-80B2A6DE6CF7}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{E6B137C7-6A31-4D7D-AF13-2D6C1FD5970D}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{F337FEA1-61F6-4B9B-8D1E-C2C535FB0350}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{F65B368C-F19E-40DD-95A6-61E562C21605}" = protocol=17 | dir=in | app=c:\program files\hp\hp deskjet 1000 j110 series\bin\usbsetup.exe |
"{FC3133C9-7C5A-4713-B64F-8E43465722F5}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"TCP Query User{5F1DC39A-D48A-4345-9665-A0CCA3C2D3C2}C:\program files\emule\emule.exe" = protocol=6 | dir=in | app=c:\program files\emule\emule.exe |
"TCP Query User{A3A5A0EB-0117-4B2D-90D9-5CBE56B07769}C:\program files\soulseekns\slsk.exe" = protocol=6 | dir=in | app=c:\program files\soulseekns\slsk.exe |
"UDP Query User{673B0C67-375A-470A-8C82-540C344B9F37}C:\program files\emule\emule.exe" = protocol=17 | dir=in | app=c:\program files\emule\emule.exe |
"UDP Query User{7C1BC5BA-C768-4FC4-931A-AE69074974F9}C:\program files\soulseekns\slsk.exe" = protocol=17 | dir=in | app=c:\program files\soulseekns\slsk.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{004C5DA2-2051-4D25-94BA-51CF810C91EB}" = LightScribe System Software  1.12.37.1
"{00AF10C1-44BD-4862-9D7F-24E6BA3E87FD}" = imagine digital freedom - Samsung
"{03D1988F-469F-4843-8E6E-E5FE9D17889D}" = WIDCOMM Bluetooth Software 6.0.1.6300
"{04983D37-2202-4295-94A2-8B547C66133F}" = Atheros WLAN Client
"{090962E2-4BE8-4A8A-86B0-7A5ED31C1273}" = USB2.0 UVC WebCam
"{0DBF4004-C60A-446E-B253-ABB596B5FC76}" = TRADOS 6 Freelance
"{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}" = Samsung Recovery Solution III
"{17283B95-21A8-4996-97DA-547A48DB266F}" = Easy Display Manager
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite
"{32714140-CBC5-3FAF-BFC2-3A7376C3EECF}" = Microsoft .NET Framework 4 Client Profile ITA Language Pack
"{32D6A58F-9659-446C-BBFC-E6F2B41F24DC}" = Samsung Magic Doctor
"{36BEAD11-8577-49AD-9250-E06A50AE87B0}" = Microsoft SOAP Toolkit 2.0 SP2
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"{4603F945-4A94-4E70-BE8B-A6075B00BB1C}" = Studio per il miglioramento del prodotto HP Deskjet 1000 J110 series
"{4ceda886-a089-4f97-a408-27ae660d7760}" = Business Contact Manager per Outlook 2007
"{4D2D9016-70A9-4D91-9AA7-686ACAF056D9}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
"{4EA8EA5D-8E46-4698-9BF7-2F2AD8E1C185}" = Easy Network Manager 3.0
"{5081528F-5DD5-49BA-8213-9A6A13502497}" = Sentinel System Driver 5.41.1 (32-bit)
"{55CA4086-0D2C-30E3-A7B5-C76BA737CECE}" = Microsoft .NET Framework 3.5 Language Pack SP1 - ita
"{6379FD0A-8964-4A50-80A6-B20B65117905}" = File di supporto dell'installazione di Microsoft SQL Server (Italiano)
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{685707A4-911C-468D-BFC4-64A50E5E3A0C}" = Samsung Update Plus
"{6F730513-8688-4C3C-90A3-6B9792CE2EF3}" = Easy Battery Manager
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79ABE4FF-60E6-4440-A692-6C0E6339AD6B}" = Microsoft SQL Server VSS Writer
"{7B46F9CF-CF60-492E-816E-95EB1A9D1BB4}" = Play Camera
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{86B3F2D6-AC2B-0015-8AE1-F2F77F781B0C}" = EndNote X5
"{889DF117-14D1-44EE-9F31-C5FB5D47F68B}" = Yontoo 1.10.02
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90110410-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0015-0410-0000-0000000FF1CE}" = Microsoft Office Access MUI (Italian) 2007
"{90120000-0016-0410-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Italian) 2007
"{90120000-0018-0410-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Italian) 2007
"{90120000-0019-0410-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Italian) 2007
"{90120000-001A-0410-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Italian) 2007
"{90120000-001B-0410-0000-0000000FF1CE}" = Microsoft Office Word MUI (Italian) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0410-0000-0000000FF1CE}" = Microsoft Office Proofing (Italian) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0410-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (Italian) 2007
"{90120000-006E-0410-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Italian) 2007
"{90120000-00A1-0410-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Italian) 2007
"{90120000-00BA-0410-0000-0000000FF1CE}" = Microsoft Office Groove MUI (Italian) 2007
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{955597D8-E5E1-474D-B647-60AC44566D24}" = Play AVStation
"{A0E7A72E-FEFF-47BA-B893-1697CCAE5FE2}" = calibre
"{A83279FD-CA4B-4206-9535-90974DE76654}" = Apple Application Support
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Componenti di connettività di Microsoft Office Small Business
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AC76BA86-7AD7-1040-7B44-A81000000003}" = Adobe Reader 8.1.0 - Italiano
"{B0069CFA-5BB9-4C03-B1C6-89CE290E5AFE}" = HP Update
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = PowerProducer
"{BA5F3E0E-8F3E-47BD-88E4-AD3EB5225F51}" = Software Intel(R) PROSet/Wireless WiFi
"{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}" = User Guide
"{BC4AE628-81A4-4FC6-863A-7A9BA2E2531F}" = Nokia Connectivity Cable Driver
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"{C88B366A-301C-487A-9606-E3E293F2FF01}" = Software di base della periferica HP Deskjet 1000 J110 series
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D3C7BBDC-C6BD-40C8-996E-824F9F147A4C}" = Microsoft SQL Server Native Client
"{DDDFCC77-7F9C-45E9-B38E-721BA599BA0C}" = HP Deskjet 1000 J110 series ?
"{EF367AA4-070B-493C-9575-85BE59D789C9}" = Easy SpeedUp Manager
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F9FD80CE-0448-4D4F-8BCD-77FC514C3F99}" = Vista Codec Package
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"Audacity_is1" = Audacity 2.0
"avast" = avast! Internet Security
"AVS Document Converter_is1" = AVS Document Converter 2.1.2
"AVS Update Manager_is1" = AVS Update Manager 1.0
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.4
"Business Contact Manager per Outlook 2007" = Business Contact Manager per Outlook 2007
"DealPly" = DealPly
"eMule" = eMule
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.15.1228
"HP Photo Creations" = HP Photo Creations
"Indirizzo Linguistico-Letterario" = Indirizzo Linguistico-Letterario
"InstallShield_{4EA8EA5D-8E46-4698-9BF7-2F2AD8E1C185}" = Easy Network Manager 3.0
"InstallShield_{685707A4-911C-468D-BFC4-64A50E5E3A0C}" = Samsung Update Plus
"InstallShield_{7B46F9CF-CF60-492E-816E-95EB1A9D1BB4}" = Play Camera
"InstallShield_{955597D8-E5E1-474D-B647-60AC44566D24}" = Play AVStation
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware versione 1.62.0.1300
"Microsoft .NET Framework 3.5 Language Pack SP1 - ita" = Microsoft .NET Framework 3.5 - Language Pack SP1 (italiano)
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile ITA Language Pack" = Microsoft .NET Framework 4 Client Profile - Language Pack (ITA)
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Mozilla Firefox 14.0.1 (x86 it)" = Mozilla Firefox 14.0.1 (x86 it)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIA Drivers" = NVIDIA Drivers
"ProInst" = Intel PROSet Wireless
"ResearchSoft Direct Export Helper" = ResearchSoft Direct Export Helper
"SecureW2 EAP Suite" = SecureW2 EAP Suite 1.1.1 for Windows
"ShockwaveFlash" = Adobe Flash Player 9 ActiveX
"Soulseek2" = SoulSeek 157 NS 13e
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Transcribe!_is1" = Transcribe! 7.20
"WinRAR archiver" = WinRAR 4.01 (32-bit)
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-2503310835-3293788857-4269131794-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Wajam" = Wajam
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 17/07/2012 11.11.18 | Computer Name = PC-pablito | Source = WinMgmt | ID = 10
Description =
 
Error - 18/07/2012 5.46.57 | Computer Name = PC-pablito | Source = Application Error | ID = 1000
Description = Applicazione che ha generato l'errore AcroRd32.exe, versione 8.1.0.137,
 timestamp 0x46444e37, modulo che ha generato l'errore unknown, versione 0.0.0.0,
 timestamp 0x00000000, codice eccezione 0xc0000005, offset errore 0x24005bb1,  ID
processo 0x127c, data e ora di avvio dell'applicazione 0x01cd642f0e9dc4c2.
 
Error - 18/07/2012 5.48.21 | Computer Name = PC-pablito | Source = WinMgmt | ID = 10
Description =
 
Error - 19/07/2012 5.53.29 | Computer Name = PC-pablito | Source = WinMgmt | ID = 10
Description =
 
Error - 19/07/2012 12.55.45 | Computer Name = PC-pablito | Source = WinMgmt | ID = 10
Description =
 
Error - 21/07/2012 6.05.22 | Computer Name = PC-pablito | Source = WinMgmt | ID = 10
Description =
 
Error - 22/07/2012 12.24.15 | Computer Name = PC-pablito | Source = WinMgmt | ID = 10
Description =
 
Error - 22/07/2012 12.32.45 | Computer Name = PC-pablito | Source = WinMgmt | ID = 10
Description =
 
Error - 22/07/2012 12.52.39 | Computer Name = PC-pablito | Source = WinMgmt | ID = 10
Description =
 
Error - 23/07/2012 7.10.58 | Computer Name = PC-pablito | Source = WinMgmt | ID = 10
Description =
 
[ OSession Events ]
Error - 25/04/2012 3.02.51 | Computer Name = PC-pablito | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 389
 seconds with 300 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 05/04/2012 18.26.51 | Computer Name = PC-pablito | Source = Service Control Manager | ID = 7000
Description =
 
Error - 06/04/2012 3.24.53 | Computer Name = PC-pablito | Source = HTTP | ID = 15016
Description =
 
Error - 06/04/2012 3.24.58 | Computer Name = PC-pablito | Source = Service Control Manager | ID = 7000
Description =
 
Error - 06/04/2012 3.24.58 | Computer Name = PC-pablito | Source = Service Control Manager | ID = 7000
Description =
 
Error - 07/04/2012 3.39.02 | Computer Name = PC-pablito | Source = HTTP | ID = 15016
Description =
 
Error - 07/04/2012 3.39.09 | Computer Name = PC-pablito | Source = Service Control Manager | ID = 7000
Description =
 
Error - 07/04/2012 3.39.09 | Computer Name = PC-pablito | Source = Service Control Manager | ID = 7000
Description =
 
Error - 08/04/2012 7.46.46 | Computer Name = PC-pablito | Source = HTTP | ID = 15016
Description =
 
Error - 08/04/2012 7.46.54 | Computer Name = PC-pablito | Source = Service Control Manager | ID = 7000
Description =
 
Error - 08/04/2012 7.46.54 | Computer Name = PC-pablito | Source = Service Control Manager | ID = 7000
Description =
 
 
< End of report >
--- --- ---


Und das ist das OTL.Txt:OTL Logfile:
Code:
OTL logfile created on: 11/08/2012 11.41.52 - Run 1
OTL by OldTimer - Version 3.2.56.0    Folder = C:\Users\pablito\Downloads
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000410 | Country: Italia | Language: ITA | Date Format: dd/MM/yyyy
 
2,99 Gb Total Physical Memory | 1,92 Gb Available Physical Memory | 64,04% Memory free
6,19 Gb Paging File | 5,13 Gb Available in Paging File | 82,93% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 69,05 Gb Total Space | 23,46 Gb Free Space | 33,97% Space Free | Partition Type: NTFS
Drive D: | 70,00 Gb Total Space | 7,11 Gb Free Space | 10,15% Space Free | Partition Type: NTFS
 
Computer Name: PC-PABLITO | User Name: pablito | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012/08/11 11.39.26 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\pablito\Downloads\OTL.exe
PRC - [2012/07/03 13.46.44 | 000,462,920 | ---- | M] (Malwarebytes Corporation) -- C:\Programmi\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2011/11/28 20.01.24 | 003,744,552 | ---- | M] (AVAST Software) -- C:\Programmi\AVAST Software\Avast\AvastUI.exe
PRC - [2008/10/29 08.29.41 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008/05/22 10.33.54 | 000,688,128 | ---- | M] (SAMSUNG Electronics) -- C:\Programmi\Samsung\Easy Display Manager\dmhkcore.exe
PRC - [2008/05/13 02.13.28 | 000,085,672 | ---- | M] () -- C:\Programmi\Samsung\Samsung Update Plus\SLUTrayNotifier.exe
PRC - [2008/04/25 14.31.34 | 000,565,248 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Programmi\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
PRC - [2008/04/17 08.26.46 | 000,352,256 | ---- | M] (SAMSUNG Electronics co., LTD.) -- C:\Programmi\Samsung\EBM\EasyBatteryMgr3.exe
PRC - [2008/04/17 04.50.00 | 006,111,232 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2008/02/12 06.19.52 | 000,723,496 | ---- | M] (Broadcom Corporation.) -- C:\Programmi\WIDCOMM\Bluetooth Software\BTTray.exe
PRC - [2008/01/21 04.23.32 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programmi\Windows Defender\MSASCui.exe
PRC - [2008/01/21 04.23.29 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programmi\Windows Sidebar\sidebar.exe
PRC - [2007/07/05 00.41.42 | 000,045,056 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Programmi\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe
PRC - [2006/10/27 01.47.42 | 000,031,016 | ---- | M] (Microsoft Corporation) -- C:\Programmi\Microsoft Office\Office12\GrooveMonitor.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2008/05/13 02.13.28 | 000,085,672 | ---- | M] () -- C:\Programmi\Samsung\Samsung Update Plus\SLUTrayNotifier.exe
MOD - [2007/08/14 06.59.54 | 006,365,184 | ---- | M] () -- C:\Programmi\Common Files\LightScribe\QtGui4.dll
MOD - [2007/07/12 06.55.52 | 000,131,072 | ---- | M] () -- C:\Programmi\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll
MOD - [2007/07/12 06.55.28 | 001,581,056 | ---- | M] () -- C:\Programmi\Common Files\LightScribe\QtCore4.dll
MOD - [2006/08/12 05.48.40 | 000,049,152 | ---- | M] () -- C:\Programmi\Samsung\Samsung Magic Doctor\HookDllPS2.dll
MOD - [2006/08/12 05.48.40 | 000,049,152 | ---- | M] () -- C:\Programmi\Samsung\EasySpeedUpManager\HookDllPS2.dll
MOD - [2006/08/12 05.48.40 | 000,049,152 | ---- | M] () -- C:\Programmi\Samsung\Easy Display Manager\HookDllPS2.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] -- C:\Windows\system32\rvseres32.exe -- (rvseres32)
SRV - [2012/08/07 16.44.15 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/07/31 12.01.57 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programmi\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/07/03 13.46.44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programmi\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012/03/10 00.50.38 | 000,109,064 | ---- | M] (Wajam) [Auto | Running] -- C:\Programmi\Wajam\Updater\WajamUpdater.exe -- (WajamUpdater)
SRV - [2011/11/28 20.01.23 | 000,127,192 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Programmi\AVAST Software\Avast\afwServ.exe -- (avast! Firewall)
SRV - [2011/11/28 20.01.23 | 000,044,768 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Programmi\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2008/05/23 07.11.56 | 000,819,200 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Programmi\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
SRV - [2008/05/23 06.43.52 | 000,466,944 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Programmi\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
SRV - [2008/05/13 01.47.20 | 000,077,480 | ---- | M] () [Auto | Stopped] -- C:\Programmi\Samsung\Samsung Update Plus\SLUBackgroundService.exe -- (Samsung Update Plus)
SRV - [2008/01/21 04.25.33 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programmi\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2008/01/21 04.23.32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programmi\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008/01/16 10.37.38 | 000,031,248 | ---- | M] (Syntek America Inc.) [Auto | Running] -- C:\Windows\System32\StkCSrv.exe -- (StkSSrv)
SRV - [2006/10/27 01.47.54 | 000,065,824 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programmi\Microsoft Office\Office12\GrooveAuditService.exe -- (Microsoft Office Groove Audit Service)
SRV - [2006/10/26 20.49.34 | 000,441,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programmi\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2006/10/26 14.03.08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programmi\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
SRV - [2006/10/05 06.10.12 | 000,009,216 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)
SRV - [2006/04/14 03.07.20 | 028,933,976 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programmi\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe -- (MSSQL$MSSMLBIZ)
SRV - [2006/04/14 03.05.58 | 000,240,416 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programmi\Microsoft SQL Server\90\Shared\sqlbrowser.exe -- (SQLBrowser)
SRV - [2006/04/14 03.04.54 | 000,087,840 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programmi\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter)
SRV - [2005/10/13 20.50.20 | 000,045,272 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programmi\Microsoft SQL Server\90\Shared\sqladhlp90.exe -- (MSSQLServerADHelper)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - [2012/07/03 13.46.44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011/11/28 19.54.38 | 000,111,320 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswFW.sys -- (aswFW)
DRV - [2011/11/28 19.53.53 | 000,435,032 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2011/11/28 19.53.35 | 000,314,456 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2011/11/28 19.53.22 | 000,195,416 | ---- | M] (AVAST Software) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\aswNdis2.sys -- (aswNdis2)
DRV - [2011/11/28 19.52.19 | 000,034,392 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2011/11/28 19.52.16 | 000,052,952 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2011/11/28 19.52.07 | 000,055,128 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV - [2011/11/28 19.51.50 | 000,020,568 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2011/11/28 19.26.19 | 000,012,112 | ---- | M] (ALWIL Software) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\aswNdis.sys -- (aswNdis)
DRV - [2011/08/17 09.56.32 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2011/08/17 09.56.30 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2011/08/17 09.56.26 | 000,023,168 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2011/08/17 09.56.22 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2008/06/25 02.58.05 | 000,013,312 | ---- | M] (SAMSUNG ELECTRONICS CO., LTD.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\KMDFMEMIO.sys -- (KMDFMEMIO)
DRV - [2008/06/09 00.23.00 | 007,522,624 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2008/05/20 21.36.12 | 003,663,360 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32)
DRV - [2008/05/08 11.51.18 | 000,226,328 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\iaNvStor.sys -- (iaNvStor)
DRV - [2008/03/28 12.19.54 | 001,363,088 | ---- | M] (Syntek) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\StkCMini.sys -- (StkCMini)
DRV - [2008/01/21 04.23.20 | 002,225,664 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32)
DRV - [2006/11/28 09.11.00 | 001,161,888 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2006/11/02 09.30.53 | 000,045,056 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
DRV - [2004/04/06 09.38.27 | 000,008,599 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\sentinel.sys -- (Sentinel)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http:\\www.samsungcomputer.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2504091
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-2503310835-3293788857-4269131794-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http:\\www.samsungcomputer.com
IE - HKU\S-1-5-21-2503310835-3293788857-4269131794-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.babylon.com/?affID=110819&tt=090212_ctrl&babsrc=HP_ss&mntrId=4cba115700000000000000216b08462c
IE - HKU\S-1-5-21-2503310835-3293788857-4269131794-1003\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-2503310835-3293788857-4269131794-1003\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - No CLSID value found
IE - HKU\S-1-5-21-2503310835-3293788857-4269131794-1003\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-2503310835-3293788857-4269131794-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?FORM=IPGTDF&PC=IPGTDF&q={searchTerms}&src=IE-SearchBox
IE - HKU\S-1-5-21-2503310835-3293788857-4269131794-1003\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=110819&tt=090212_ctrl&babsrc=SP_ss&mntrId=4cba115700000000000000216b08462c
IE - HKU\S-1-5-21-2503310835-3293788857-4269131794-1003\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2504091
IE - HKU\S-1-5-21-2503310835-3293788857-4269131794-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.defaultthis.engineName: "Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2504091&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.startup.homepage: "hxxp://www.enet.gr/"
FF - prefs.js..keyword.URL: "hxxp://www.google.com/search?q="
FF - prefs.js..network.proxy.type: 0
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_270.dll ()
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012/01/28 00.22.44 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/07/31 12.01.58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/07/31 12.01.58 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2012/01/27 17.07.43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\pablito\AppData\Roaming\mozilla\Extensions
[2012/08/08 20.27.03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\pablito\AppData\Roaming\mozilla\Firefox\Profiles\ujvrci5x.default\extensions
[2012/02/22 01.21.30 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\pablito\AppData\Roaming\mozilla\Firefox\Profiles\ujvrci5x.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012/07/17 17.12.15 | 000,000,000 | ---D | M] (Vuze Remote Community Toolbar) -- C:\Users\pablito\AppData\Roaming\mozilla\Firefox\Profiles\ujvrci5x.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}
[2012/04/18 10.27.58 | 000,000,000 | ---D | M] (DealPly) -- C:\Users\pablito\AppData\Roaming\mozilla\Firefox\Profiles\ujvrci5x.default\extensions\{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}
[2012/04/18 10.27.58 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\pablito\AppData\Roaming\mozilla\Firefox\Profiles\ujvrci5x.default\extensions\ffxtlbr@babylon.com
[2012/04/18 00.00.14 | 000,000,000 | ---D | M] (Yontoo) -- C:\Users\pablito\AppData\Roaming\mozilla\Firefox\Profiles\ujvrci5x.default\extensions\plugin@yontoo.com
[2012/03/28 23.55.52 | 000,000,879 | ---- | M] () -- C:\Users\pablito\AppData\Roaming\Mozilla\Firefox\Profiles\ujvrci5x.default\searchplugins\conduit.xml
[2012/01/27 17.07.17 | 000,000,000 | ---D | M] (No name found) -- C:\Programmi\Mozilla Firefox\extensions
[2012/08/08 20.27.03 | 000,061,073 | ---- | M] () (No name found) -- C:\USERS\PABLITO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UJVRCI5X.DEFAULT\EXTENSIONS\{2CF72B5C-77F2-F10F-B018-37A6596BBD62}.XPI
[2012/05/01 12.28.53 | 000,068,498 | ---- | M] () (No name found) -- C:\USERS\PABLITO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UJVRCI5X.DEFAULT\EXTENSIONS\{4D0E099F-40C4-5D83-91D4-890BE874BBCC}.XPI
[2012/06/16 22.22.27 | 000,060,246 | ---- | M] () (No name found) -- C:\USERS\PABLITO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UJVRCI5X.DEFAULT\EXTENSIONS\{8FB2E6D2-BD0B-7282-0C7E-0DDF509E26B3}.XPI
[2012/05/08 15.10.20 | 000,005,637 | ---- | M] () (No name found) -- C:\USERS\PABLITO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UJVRCI5X.DEFAULT\EXTENSIONS\ANALYST_SEARCH@WAVEMETRIX.COM.XPI
[2012/07/31 12.01.58 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/03/23 18.42.02 | 000,001,393 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazon-it.xml
[2012/04/18 00.00.23 | 000,002,354 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2012/03/23 18.42.02 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/03/23 18.42.02 | 000,000,744 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-it.xml
[2012/04/25 15.13.13 | 000,000,817 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\hoepli.xml
[2012/03/23 18.42.02 | 000,001,182 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-it.xml
[2012/03/23 18.42.02 | 000,000,953 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-it.xml
 
O1 HOSTS File: ([2006/09/18 23.41.30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (Supporto di collegamento per Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programmi\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programmi\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (DealPly) - {A6174F27-1FFF-E1D6-A93F-BA48AD5DD448} - C:\Programmi\DealPly\DealPlyIE.dll (DealPly Technologies Ltd)
O2 - BHO: (Wajam) - {A7A6995D-6EE1-4FD1-A258-49395D5BF99C} - C:\Programmi\Wajam\IE\wajam.dll (Wajam)
O2 - BHO: (Yontoo) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Programmi\Yontoo\YontooIEClient.dll (Yontoo LLC)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programmi\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [LanguageShortcut] C:\Program Files\CyberLink\PowerDVD\Language\Language.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-2503310835-3293788857-4269131794-1003..\Run: [SetupWizard] E:\SetupWizard.exe reboot File not found
O8 - Extra context menu item: E&sporta in Microsoft Excel - C:\Programmi\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\pablito\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O9 - Extra Button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programmi\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : I&nvia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programmi\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programmi\Microsoft Office2003\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{60B4A45F-EA3B-4411-8398-5509C0355C98}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programmi\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programmi\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programmi\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programmi\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Sec\Wallpapers\wallpaper1.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Sec\Wallpapers\wallpaper1.jpg
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programmi\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 23.43.36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{41d79112-4932-11e1-89c9-00137796a806}\Shell - "" = AutoRun
O33 - MountPoints2\{41d79112-4932-11e1-89c9-00137796a806}\Shell\AutoRun\command - "" = "F:\WD SmartWare.exe" autoplay=true
O33 - MountPoints2\{cf672fa0-4a5f-11e1-b992-00137796a806}\Shell - "" = AutoRun
O33 - MountPoints2\{cf672fa0-4a5f-11e1-b992-00137796a806}\Shell\AutoRun\command - "" = F:\SETUP.EXE
O33 - MountPoints2\{cf672fa0-4a5f-11e1-b992-00137796a806}\Shell\configure\command - "" = F:\SETUP.EXE
O33 - MountPoints2\{cf672fa0-4a5f-11e1-b992-00137796a806}\Shell\install\command - "" = F:\SETUP.EXE
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - StartUpReg: DAEMON Tools Pro Agent - hkey= - key= -  File not found
MsConfig - StartUpReg: Skype - hkey= - key= - C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.)
MsConfig - State: "startup" - 2
 
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Programmi\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Programmi\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5A604D2C-E968-429B-8327-62B5CE52126D} - .NET Framework
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 
Drivers32:  -  File not found
Drivers32: msacm.ac3acm - C:\Windows\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.ac3filter - C:\Windows\System32\ac3filter.acm ()
Drivers32: msacm.avis - C:\Windows\System32\ff_acm.acm ()
Drivers32: msacm.clmp3enc - C:\Programmi\CyberLink\Power2Go\CLMP3Enc.ACM (CyberLink Corp.)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\Windows\System32\lameACM.acm (hxxp://www.mp3dev.org/)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FFDS - C:\Windows\System32\ff_vfw.dll ()
Drivers32: VIDC.I420 - MSh263.drv File not found
Drivers32: vidc.x264 - C:\Windows\System32\x264vfw.dll ()
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/08/10 19.10.31 | 000,000,000 | ---D | C] -- C:\Users\pablito\AppData\Roaming\Malwarebytes
[2012/08/10 19.10.20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/08/10 19.10.19 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/08/10 19.10.18 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012/08/10 19.10.18 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012/08/10 01.26.40 | 000,000,000 | ---D | C] -- C:\ProgramData\fbgxtfrvzlgioqg
[2012/01/30 02.50.17 | 033,679,720 | ---- | C] (Online Media Technologies Ltd.                              ) -- C:\Users\pablito\AVSDocumentConverter.exe
[1 C:\Users\pablito\Desktop\*.tmp files -> C:\Users\pablito\Desktop\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/08/11 11.44.15 | 000,000,978 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/08/11 11.39.33 | 000,726,084 | ---- | M] () -- C:\Windows\System32\perfh010.dat
[2012/08/11 11.39.33 | 000,642,704 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/08/11 11.39.33 | 000,144,600 | ---- | M] () -- C:\Windows\System32\perfc010.dat
[2012/08/11 11.39.33 | 000,121,592 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/08/11 11.33.44 | 000,166,495 | ---- | M] () -- C:\ProgramData\nvModes.001
[2012/08/11 11.33.41 | 000,166,495 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2012/08/11 11.33.06 | 000,004,912 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/08/11 11.33.06 | 000,004,912 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/08/11 11.33.01 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/08/11 11.32.55 | 3215,577,088 | -HS- | M] () -- C:\hiberfil.sys
[2012/08/10 23.51.04 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2012/08/10 22.59.00 | 000,000,328 | ---- | M] () -- C:\Windows\tasks\HP Photo Creations Communicator.job
[2012/08/10 19.11.45 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/08/10 01.26.40 | 000,000,051 | ---- | M] () -- C:\ProgramData\etusietinsljbfo
[2012/07/27 14.15.33 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_Kernel_ccdcmb_01009.Wdf
[2012/07/27 14.15.32 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
[2012/07/22 18.40.15 | 000,000,266 | ---- | M] () -- C:\Windows\SetupWizard.INI
[2012/07/22 18.40.01 | 000,003,654 | ---- | M] () -- C:\Windows\checkip.dat
[2012/07/22 18.34.13 | 000,003,170 | ---- | M] () -- C:\Windows\dhstatus.dat
[2012/07/13 08.46.42 | 000,384,528 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[1 C:\Users\pablito\Desktop\*.tmp files -> C:\Users\pablito\Desktop\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/08/10 21.36.09 | 3215,577,088 | -HS- | C] () -- C:\hiberfil.sys
[2012/08/10 19.10.20 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/08/10 01.26.35 | 000,000,051 | ---- | C] () -- C:\ProgramData\etusietinsljbfo
[2012/07/27 14.15.33 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_Kernel_ccdcmb_01009.Wdf
[2012/07/27 14.15.32 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
[2012/07/27 14.15.06 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_Kernel_01009_Inbox_Critical.Wdf
[2012/07/22 18.40.15 | 000,000,266 | ---- | C] () -- C:\Windows\SetupWizard.INI
[2012/07/22 18.34.13 | 000,003,170 | ---- | C] () -- C:\Windows\dhstatus.dat
[2012/07/22 18.29.12 | 000,003,654 | ---- | C] () -- C:\Windows\checkip.dat
[2012/06/20 21.49.03 | 000,024,082 | ---- | C] () -- C:\Users\pablito\Smodaka.pdf
[2012/05/17 14.17.23 | 000,402,287 | ---- | C] () -- C:\Users\pablito\Rodogno, Italiani e gli Ebrei.pdf
[2012/05/02 20.26.40 | 000,004,096 | -H-- | C] () -- C:\Users\pablito\AppData\Local\keyfile3.drm
[2012/05/02 12.07.58 | 000,000,424 | ---- | C] () -- C:\Windows\ODBC.INI
[2012/01/30 00.21.11 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2012/01/28 00.16.25 | 000,017,408 | ---- | C] () -- C:\Users\pablito\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/01/27 16.07.41 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2012/01/27 16.07.40 | 000,106,605 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2012/01/24 15.18.04 | 004,794,880 | ---- | C] () -- C:\Windows\System32\x264vfw.dll
[2011/07/12 16.56.50 | 000,074,752 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2011/01/04 14.28.18 | 000,175,616 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2008/06/25 03.16.12 | 000,166,495 | ---- | C] () -- C:\ProgramData\nvModes.001
[2008/06/25 03.16.10 | 000,166,495 | ---- | C] () -- C:\ProgramData\nvModes.dat
 
========== LOP Check ==========
 
[2012/04/22 16.00.00 | 000,000,000 | ---D | M] -- C:\Users\pablito\AppData\Roaming\Audacity
[2012/01/28 00.29.24 | 000,000,000 | ---D | M] -- C:\Users\pablito\AppData\Roaming\Babylon
[2012/01/30 03.54.58 | 000,000,000 | ---D | M] -- C:\Users\pablito\AppData\Roaming\calibre
[2012/01/29 17.05.03 | 000,000,000 | ---D | M] -- C:\Users\pablito\AppData\Roaming\DAEMON Tools Pro
[2012/02/22 01.21.51 | 000,000,000 | ---D | M] -- C:\Users\pablito\AppData\Roaming\DVDVideoSoft
[2012/02/22 01.21.23 | 000,000,000 | ---D | M] -- C:\Users\pablito\AppData\Roaming\DVDVideoSoftIEHelpers
[2012/04/06 00.39.02 | 000,000,000 | ---D | M] -- C:\Users\pablito\AppData\Roaming\EndNote
[2012/01/30 00.21.15 | 000,000,000 | ---D | M] -- C:\Users\pablito\AppData\Roaming\pdfforge
[2012/02/26 20.59.01 | 000,000,000 | ---D | M] -- C:\Users\pablito\AppData\Roaming\Visan
[2012/01/28 00.46.29 | 000,000,000 | ---D | M] -- C:\Users\pablito\AppData\Roaming\VistaCodecs
[2012/06/16 22.44.20 | 000,000,000 | ---D | M] -- C:\Users\pablito\AppData\Roaming\WaveRunner
[2012/08/10 23.51.04 | 000,032,612 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2012/01/28 02.27.40 | 000,000,000 | ---D | M] -- C:\Users\pablito\AppData\Roaming\Adobe
[2012/04/20 10.38.52 | 000,000,000 | ---D | M] -- C:\Users\pablito\AppData\Roaming\Apple Computer
[2012/04/22 16.00.00 | 000,000,000 | ---D | M] -- C:\Users\pablito\AppData\Roaming\Audacity
[2012/01/28 00.29.24 | 000,000,000 | ---D | M] -- C:\Users\pablito\AppData\Roaming\Babylon
[2012/01/30 03.54.58 | 000,000,000 | ---D | M] -- C:\Users\pablito\AppData\Roaming\calibre
[2012/01/29 16.46.58 | 000,000,000 | ---D | M] -- C:\Users\pablito\AppData\Roaming\CyberLink
[2012/01/29 17.05.03 | 000,000,000 | ---D | M] -- C:\Users\pablito\AppData\Roaming\DAEMON Tools Pro
[2012/02/22 01.21.51 | 000,000,000 | ---D | M] -- C:\Users\pablito\AppData\Roaming\DVDVideoSoft
[2012/02/22 01.21.23 | 000,000,000 | ---D | M] -- C:\Users\pablito\AppData\Roaming\DVDVideoSoftIEHelpers
[2012/04/06 00.39.02 | 000,000,000 | ---D | M] -- C:\Users\pablito\AppData\Roaming\EndNote
[2012/02/16 23.39.49 | 000,000,000 | ---D | M] -- C:\Users\pablito\AppData\Roaming\HpUpdate
[2008/12/23 23.57.34 | 000,000,000 | ---D | M] -- C:\Users\pablito\AppData\Roaming\Identities
[2012/01/28 00.22.10 | 000,000,000 | ---D | M] -- C:\Users\pablito\AppData\Roaming\Macromedia
[2012/08/10 19.10.31 | 000,000,000 | ---D | M] -- C:\Users\pablito\AppData\Roaming\Malwarebytes
[2006/11/02 14.37.34 | 000,000,000 | ---D | M] -- C:\Users\pablito\AppData\Roaming\Media Center Programs
[2012/07/09 09.40.02 | 000,000,000 | --SD | M] -- C:\Users\pablito\AppData\Roaming\Microsoft
[2012/01/27 17.07.43 | 000,000,000 | ---D | M] -- C:\Users\pablito\AppData\Roaming\Mozilla
[2012/01/30 00.21.15 | 000,000,000 | ---D | M] -- C:\Users\pablito\AppData\Roaming\pdfforge
[2012/08/07 20.24.36 | 000,000,000 | ---D | M] -- C:\Users\pablito\AppData\Roaming\Skype
[2012/02/26 20.59.01 | 000,000,000 | ---D | M] -- C:\Users\pablito\AppData\Roaming\Visan
[2012/01/28 00.46.29 | 000,000,000 | ---D | M] -- C:\Users\pablito\AppData\Roaming\VistaCodecs
[2012/06/16 22.44.20 | 000,000,000 | ---D | M] -- C:\Users\pablito\AppData\Roaming\WaveRunner
[2012/01/28 00.25.32 | 000,000,000 | ---D | M] -- C:\Users\pablito\AppData\Roaming\WinRAR
 
< %APPDATA%\*.exe /s >
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2008/01/21 04.23.01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys
[2008/01/21 04.23.01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008/01/21 04.23.01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008/01/21 04.23.01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2006/11/02 11.49.52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009/04/11 08.32.26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\SoftwareDistribution\Download\3bd8fe73c6fda64a95e9e60ac46184d4\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008/01/21 04.23.00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\drivers\atapi.sys
[2008/01/21 04.23.00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008/01/21 04.23.00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006/11/02 11.49.36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006/11/02 11.46.03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006/11/02 11.46.03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: IASTOR.SYS  >
[2008/05/07 10.40.02 | 000,317,976 | ---- | M] (Intel Corporation) MD5=80C633722DA72E97F3F5B3B11325696D -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_1ab0331f\iaStor.sys
[2008/06/16 14.38.28 | 000,396,312 | ---- | M] (Intel Corporation) MD5=DB0C1076AB442C09D2A3AB0410DBEA0D -- C:\Program Files\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys
[2008/06/16 14.38.10 | 000,318,488 | ---- | M] (Intel Corporation) MD5=F263A9036F8897FFA2AE54685E03AD60 -- C:\Program Files\Intel\Intel Matrix Storage Manager\driver\IaStor.sys
[2008/06/16 14.38.10 | 000,318,488 | ---- | M] (Intel Corporation) MD5=F263A9036F8897FFA2AE54685E03AD60 -- C:\Windows\System32\drivers\iaStor.sys
[2008/06/16 14.38.10 | 000,318,488 | ---- | M] (Intel Corporation) MD5=F263A9036F8897FFA2AE54685E03AD60 -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_3506096f\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2008/01/21 04.23.23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys
[2008/01/21 04.23.23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008/01/21 04.23.23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006/11/02 11.51.25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009/04/11 08.28.23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\SoftwareDistribution\Download\3bd8fe73c6fda64a95e9e60ac46184d4\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008/01/21 04.24.05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\System32\netlogon.dll
[2008/01/21 04.24.05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006/11/02 11.50.13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008/01/21 04.23.21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys
[2008/01/21 04.23.21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008/01/21 04.23.21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2008/01/21 04.24.50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\System32\scecli.dll
[2008/01/21 04.24.50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2009/04/11 08.28.24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\SoftwareDistribution\Download\3bd8fe73c6fda64a95e9e60ac46184d4\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009/04/11 08.28.25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\SoftwareDistribution\Download\3bd8fe73c6fda64a95e9e60ac46184d4\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
[2008/01/21 04.24.21 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\System32\user32.dll
[2008/01/21 04.24.21 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008/01/21 04.24.49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008/01/21 04.24.49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2008/01/21 04.23.42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008/01/21 04.23.42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009/04/11 08.28.13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\SoftwareDistribution\Download\3bd8fe73c6fda64a95e9e60ac46184d4\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2012/07/03 13.46.42 | 000,217,672 | ---- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008/01/21 04.24.49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\System32\winlogon.exe
[2008/01/21 04.24.49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008/01/21 04.24.47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008/01/21 04.24.47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2008/01/21 05.14.18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2008/01/21 05.14.08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2008/01/21 05.14.18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 12.34.08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 12.34.08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
< %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\*.* >
[2008/12/23 23.57.42 | 000,000,174 | -HS- | M] () -- C:\Users\pablito\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
 
< %APPDATA%\*AcroIEH*.* >
 
< %APPDATA%\*.exe >
 
< %APPDATA%\*.tmp >

< End of report >
--- --- ---

Hi, Danke für die Antwort und die Hilfe!
Nachdem ich die infizierten Files im Malewarebytes gelöscht haben, scheint alles wieder in Ordnung zu sein. Ich surfe jetzt mit meinem normalen Konto (nur das Gast-Konto hat vorher funktioniert) und nicht im abgesicherten Modus. Natürlich könnte noch was da sein, aber bisher zeigt sich noch nichts.
Ciao
Paolo

Hi, Danke für die Antwort und die Hilfe!
Nachdem ich die infizierten Files im Malewarebytes gelöscht haben, scheint alles wieder in Ordnung zu sein. Ich surfe jetzt mit meinem normalen Konto (nur das Gast-Konto hat vorher funktioniert) und nicht im abgesicherten Modus. Natürlich könnte noch was da sein, aber bisher zeigt sich noch nichts.
Ciao
Paolo

t'john 11.08.2012 14:49
Wo ist das Malwarebytes Log?

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

  • Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
  • Starte die OTL.exe.
    Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
  • Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:


Code:
:OTL
SRV - File not found [Auto | Stopped] -- C:\Windows\system32\rvseres32.exe -- (rvseres32)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2504091
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2503310835-3293788857-4269131794-1003\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - No CLSID value found
IE - HKU\S-1-5-21-2503310835-3293788857-4269131794-1003\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-2503310835-3293788857-4269131794-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?FORM=IPGTDF&PC=IPGTDF&q={searchTerms}&src=IE-SearchBox
IE - HKU\S-1-5-21-2503310835-3293788857-4269131794-1003\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}&affID=110819&tt=090212_ctrl&babsrc=SP_ss&mntrId=4cba115700000000000000216b08462c
IE - HKU\S-1-5-21-2503310835-3293788857-4269131794-1003\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2504091
IE - HKU\S-1-5-21-2503310835-3293788857-4269131794-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.defaultthis.engineName: "Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2504091&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..network.proxy.type: 0
O4 - HKLM..\Run: [] File not found
O4 - HKU\S-1-5-21-2503310835-3293788857-4269131794-1003..\Run: [SetupWizard] E:\SetupWizard.exe reboot File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 23.43.36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{41d79112-4932-11e1-89c9-00137796a806}\Shell - "" = AutoRun
O33 - MountPoints2\{41d79112-4932-11e1-89c9-00137796a806}\Shell\AutoRun\command - "" = "F:\WD SmartWare.exe" autoplay=true
O33 - MountPoints2\{cf672fa0-4a5f-11e1-b992-00137796a806}\Shell - "" = AutoRun
O33 - MountPoints2\{cf672fa0-4a5f-11e1-b992-00137796a806}\Shell\AutoRun\command - "" = F:\SETUP.EXE

:Files


ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
  • Schließe alle Programme.
  • Klicke auf den Fix Button.
  • Wenn OTL einen Neustart verlangt, bitte zulassen.
  • Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
    Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

casafon 11.08.2012 15:17
Hi das Malwarebytes Log habe ich schon oben im Thread kopiert.
Ich habe jetzt alles gemacht. Nur während OTL das Fix-Vorgehen ausführt, erscheint ein Fenster ich gefragt werde ob er einen Ordner depend.ini schaffen muss. Er sagt, dass er den Ordner mit diesem Name nicht finden kann. Unten steht, dass dieses Problem 37 Mal auftaucht und er fragt mich, ob die Antwort auf diese Frage auch für die anderen 37 Fälle gelten soll. Was soll ich machen? Am besten den neuen Ordner schaffen?

t'john 11.08.2012 15:20
Ja, erlaube es.

casafon 11.08.2012 15:28
Während des Fix-Vorgehens hat OTL aufgehört zu funktionieren. Soll ich einfach nochmal das Ganze machen?
Vielleicht liegt es daran, dass als die Meldung "willst du einen neuen Ordner schaffen" kam, wieder Mozilla aufgemacht habe, um hier über das Problem zu schreiben.
Eine andere Frage: soll ich während des Fix meinen Avast Anti Virus deaktivieren?

t'john 11.08.2012 15:41
Ja, deaktiviere alles und versche es nochmal!

casafon 11.08.2012 15:59
Ok. Alles gut gelaufen. Nur: ich habe keinen Log bekommen. Vielleicht hätte ich irgendwo was klicken sollen und ich habe es übersehen, aber ich glaube nicht.

t'john 11.08.2012 16:44
Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Bitte suchen und posten!

t'john 09.09.2012 02:40
Fehlende Rückmeldung

Gibt es Probleme beim Abarbeiten obiger Anleitung?

Um Kapazitäten für andere Hilfesuchende freizumachen, lösche ich dieses Thema aus meinen Benachrichtigungen.

Solltest Du weitermachen wollen, schreibe mir eine PN oder eröffne ein neues Thema.
http://www.trojaner-board.de/69886-a...-beachten.html


Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner sauber ist.


Alle Zeitangaben in WEZ +1. Es ist jetzt 05:33 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19