Ciao, sei pronta al lungo elenco?
systemscan -
www.suspectfile.com - ver. 2.0.23
Date: 14/02/2007
Time: 0.40.05,82
Output limited to:
-Recent files
-Registry Run Keys
-Running Services
-Not Running Services
-Device Driver Services
-Svchost.exe instances
-Loaded Dlls
-Alternate Data Sreams
-Encrypted Files
-Hidden objects
-Include hijackthis.log
-------------Users folders -------------
Directory di D:\documents and settings
27/01/2007 10.42 <DIR> All Users
13/02/2007 17.10 <DIR> Cin
27/01/2007 10.51 <DIR> Default User
27/01/2007 10.47 <DIR> LocalService
27/01/2007 10.47 <DIR> NetworkService
-------------Recent files (60 days) -------------
NOTE: searched only in D:, D:\WINDOWS, D:\WINDOWS\system32, D:\Programmi\File comuni, D:\WINDOWS\temp
Directory di D:\
13/02/2007 12.32 <DIR> Programmi
14/02/2007 00.40 <DIR> suspectfile
14/02/2007 00.37 <DIR> WINDOWS
27/01/2007 10.52 <DIR> Documents and Settings
Directory di D:\WINDOWS
27/01/2007 12.06 <DIR> WinSxS
27/01/2007 11.21 <DIR> addins
27/01/2007 10.41 <DIR> Web
27/01/2007 11.23 <DIR> twain_32
27/01/2007 11.25 <DIR> AppPatch
13/02/2007 18.31 <DIR> Temp
13/02/2007 09.55 <DIR> system32
27/01/2007 11.38 <DIR> system
27/01/2007 10.41 <DIR> srchasst
27/01/2007 11.21 <DIR> Config
27/01/2007 11.21 <DIR> Connection Wizard
27/01/2007 14.20 <DIR> SoftwareDistribution
27/01/2007 11.04 <DIR> SMSC
27/01/2007 11.20 <DIR> SHELLNEW
27/01/2007 10.38 <DIR> Cursors
13/02/2007 12.58 <DIR> Debug
27/01/2007 11.09 <DIR> security
27/01/2007 11.02 <DIR> Driver Cache
27/01/2007 11.25 <DIR> ehome
27/01/2007 11.21 <DIR> Resources
27/01/2007 10.43 <DIR> repair
27/01/2007 11.01 <DIR> Help
27/01/2007 10.42 <DIR> Registration
27/01/2007 10.43 <DIR> ime
27/01/2007 11.21 <DIR> Provisioning
27/01/2007 11.21 <DIR> java
13/02/2007 18.48 <DIR> Prefetch
27/01/2007 11.32 <DIR> Media
27/01/2007 11.25 <DIR> PeerNet
27/01/2007 11.25 <DIR> msagent
27/01/2007 11.21 <DIR> msapps
27/01/2007 11.20 <DIR> pchealth
27/01/2007 11.21 <DIR> mui
27/01/2007 11.02 <DIR> Options
27/01/2007 10.41 <DIR> Offline Web Pages
27/01/2007 11.01 <DIR> nview
14/02/2007 00.37 181.694 ntbtlog.txt
27/01/2007 11.21 424 ODBC.INI
27/01/2007 10.42 4.161 ODBCINST.INI
13/02/2007 18.17 69 NeroDigital.ini
13/02/2007 10.13 8.552 ModemLog_TOSHIBA Software Modem AMR.txt
05/02/2007 10.33 1.409 QTFont.for
27/01/2007 10.47 8.192 REGLOCS.OLD
14/02/2007 00.35 4.824 SchedLgU.Txt
27/01/2007 11.03 81 CpRmtKey.UNI
27/01/2007 11.04 73 CplBTQ00.UNI
27/01/2007 10.43 0 control.ini
13/02/2007 17.07 0 Sti_Trace.log
27/01/2007 11.30 231 system.ini
27/01/2007 10.39 36 vb.ini
27/01/2007 10.39 37 vbaddin.ini
14/02/2007 00.35 216 wiadebug.log
14/02/2007 00.35 50 wiaservc.log
13/02/2007 09.55 627 win.ini
14/02/2007 00.35 10.467 WindowsUpdate.log
13/02/2007 17.11 0 0.log
27/01/2007 10.43 316.640 WMSysPr9.prx
Directory di D:\WINDOWS\system32
27/01/2007 11.21 <DIR> wins
27/01/2007 11.21 <DIR> 1025
27/01/2007 11.21 <DIR> 1028
27/01/2007 11.21 <DIR> 1031
27/01/2007 11.22 <DIR> 1033
27/01/2007 11.21 <DIR> 1037
27/01/2007 11.23 <DIR> 1040
27/01/2007 11.21 <DIR> 1041
27/01/2007 11.21 <DIR> 1042
27/01/2007 11.21 <DIR> 1054
27/01/2007 10.43 <DIR> wbem
27/01/2007 11.25 <DIR> usmt
27/01/2007 11.21 <DIR> 2052
27/01/2007 11.21 <DIR> 3076
27/01/2007 11.21 <DIR> 3com_dmi
27/01/2007 10.36 <DIR> spool
27/01/2007 11.21 <DIR> ShellExt
27/01/2007 11.25 <DIR> Setup
13/02/2007 09.51 <DIR> Restore
27/01/2007 12.27 <DIR> ReinstallBackups
27/01/2007 11.23 <DIR> ras
27/01/2007 10.41 <DIR> oobe
27/01/2007 11.25 <DIR> npp
27/01/2007 11.21 <DIR> mui
27/01/2007 10.43 <DIR> xircom
27/01/2007 10.38 <DIR> MsDtc
05/02/2007 19.19 <DIR> Macromed
27/01/2007 10.56 <DIR> InsFiles
27/01/2007 11.21 <DIR> inetsrv
27/01/2007 11.21 <DIR> IME
27/01/2007 11.23 <DIR> icsxml
27/01/2007 10.42 <DIR> ias
27/01/2007 11.21 <DIR> export
27/01/2007 12.06 <DIR> DRVSTORE
08/02/2007 12.44 <DIR> drivers
27/01/2007 10.41 <DIR> DirectX
27/01/2007 11.21 <DIR> dhcp
27/01/2007 10.47 <DIR> config
27/01/2007 10.39 <DIR> Com
11/02/2007 11.41 <DIR> CatRoot2
27/01/2007 11.27 <DIR> CatRoot
27/01/2007 10.43 16.832 amcompat.tlb
14/02/2007 00.35 81.984 bdod.bin
27/01/2007 10.43 2.885 CONFIG.NT
27/01/2007 10.39 21.840 emptyregdb.dat
09/01/2007 18.46 10.752 ff_vfw.dll
27/01/2007 11.54 110.992 FNTCACHE.DAT
27/01/2007 11.57 17.464 GDIPFONTCACHEV1.DAT
13/02/2007 09.55 14 getfile.dat
27/01/2007 11.36 0 h323log.txt
27/01/2007 10.43 23.392 nscompat.tlb
27/01/2007 11.03 40.190 perfc009.dat
27/01/2007 11.03 47.790 perfc010.dat
27/01/2007 11.03 311.802 perfh009.dat
27/01/2007 11.03 345.248 perfh010.dat
27/01/2007 11.03 751.592 PerfStringBackup.INI
19/01/2007 12.53 51.056 sirenacm.dll
27/01/2007 12.00 73.728 sockspy.dll
27/01/2007 10.46 261 $winnt$.inf
20/01/2007 21.26 1.565.480 wmv9vcm.dll
10/02/2007 15.21 2.206 wpa.dbl
27/01/2007 11.59 77.824 xcomm.dll
Directory di D:\Programmi\File comuni
30/01/2007 10.50 <DIR> Adobe
27/01/2007 11.26 <DIR> Ahead
27/01/2007 11.20 <DIR> DESIGNER
05/02/2007 16.46 <DIR> InstallShield
30/01/2007 19.46 <DIR> Jasc Software Inc
27/01/2007 11.43 <DIR> Microsoft Shared
27/01/2007 10.40 <DIR> MSSoap
27/01/2007 11.30 <DIR> ODBC
27/01/2007 10.40 <DIR> Services
27/01/2007 11.12 <DIR> Softwin
27/01/2007 11.30 <DIR> SpeechEngines
27/01/2007 10.40 <DIR> System
Directory di D:\WINDOWS\temp
13/02/2007 18.43 <DIR> RarSFX0
13/02/2007 18.31 16.384 ~DF6E5C.tmp
-------------HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run-------------
-------------HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run-------------
-------------HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows-------------
[Windows]
"AppInit_DLLs"=""
-------------HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon-------------
[Winlogon]
"Shell"="Explorer.exe"
"System"=""
"Userinit"="D:\WINDOWS\system32\userinit.exe,"
"VmApplet"="rundll32 shell32,Control_RunDLL \"sysdm.cpl\""
"forceunlocklogon"=dword:00000000
"AllowMultipleTSSessions"=dword:00000001
"UIHost"=expand:"logonui.exe"
"LogonType"=dword:00000001
"Background"="0 0 0"
"WinStationsDisabled"="0"
"HibernationPreviouslyEnabled"=dword:00000001
[Winlogon\GPExtensions]
[Winlogon\GPExtensions\{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}]
@="Senza fili"
"DllName"=expand:"gptext.dll"
[Winlogon\GPExtensions\{25537BA6-77A8-11D2-9B6C-0000F8080861}]
@="Folder Redirection"
"DllName"=expand:"fdeploy.dll"
"GenerateGroupPolicy"="GenerateGroupPolicy"
"EventSources"=multi:"(Folder Redirection,Application)\00\00"
[Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}]
@="Quota disco Microsoft"
"DllName"=expand:"dskquota.dll"
[Winlogon\GPExtensions\{426031c0-0b47-4852-b0ca-ac3d37bfcb39}]
@="Utilità di pianificazione pacchetti QoS"
"DllName"=expand:"gptext.dll"
[Winlogon\GPExtensions\{42B5FAAE-6536-11d2-AE5A-0000F87571E3}]
@="Script"
"GenerateGroupPolicy"="GenerateScriptsGroupPolicy"
"DllName"=expand:"gptext.dll"
[Winlogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}]
@="Mapping aree Internet Explorer"
"DllName"=expand:"iedkcs32.dll"
[Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}]
"GenerateGroupPolicy"="SceGenerateGroupPolicy"
"ExtensionRsopPlanningDebugLevel"=dword:00000001
"ExtensionDebugLevel"=dword:00000001
"DllName"=expand:"scecli.dll"
@="Security"
[Winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}]
"GenerateGroupPolicy"="GenerateGroupPolicy"
"DllName"=expand:"iedkcs32.dll"
@="Personalizzazione Internet Explorer"
[Winlogon\GPExtensions\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}]
"DllName"=expand:"scecli.dll"
@="EFS recovery"
[Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}]
@="Microsoft Offline Files"
"DllName"=expand:"%SystemRoot%\System32\cscui.dll"
[Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}]
@="Installazione software"
"DllName"=expand:"appmgmts.dll"
"GenerateGroupPolicy"="GenerateGroupPolicy"
"EventSources"=multi:"(Application Management,Application)\00(MsiInstaller,Application)\00\00"
[Winlogon\GPExtensions\{e437bc1c-aa7d-11d2-a382-00c04f991e27}]
@="Protezione IP"
"DllName"=expand:"gptext.dll"
[Winlogon\Notify]
[Winlogon\Notify\crypt32chain]
"DllName"=expand:"crypt32.dll"
"Logoff"="ChainWlxLogoffEvent"
[Winlogon\Notify\cryptnet]
"DllName"=expand:"cryptnet.dll"
"Logoff"="CryptnetWlxLogoffEvent"
[Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"StartShell"="WinlogonStartShellEvent"
[Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
[Winlogon\Notify\Schedule]
"DllName"=expand:"wlnotify.dll"
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"
[Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"DllName"=expand:"sclgntfy.dll"
[Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
[Winlogon\Notify\termsrv]
"DllName"=expand:"wlnotify.dll"
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"
[Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
[Winlogon\SpecialAccounts]
[Winlogon\SpecialAccounts\UserList]
"HelpAssistant"=dword:00000000
"TsInternetUser"=dword:00000000
"SQLAgentCmdExec"=dword:00000000
"NetShowServices"=dword:00000000
"IWAM_"=dword:00010000
"IUSR_"=dword:00010000
"VUSR_"=dword:00010000
-------------HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon-------------
-------------HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon-------------
[Winlogon]
"ExcludeProfileDirs"="Impostazioni locali;Temporary Internet Files;Cronologia;Temp"
"BuildNumber"=dword:00000a28
-------------HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon-------------
-------------HKLM\Software\Microsoft\Windows\CurrentVersion\Run-------------
[Run]
"AdslTaskBar"="rundll32.exe stmctrl.dll,TaskBar"
"NvCplDaemon"="RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"CpRmtKey"="\"D:\Programmi\Toshiba Controls\CpRmtKey.EXE\""
"CplBTQ00"="D:\Programmi\EzButton\CplBTQ00.EXE"
"Apoint"="D:\Programmi\Apoint2K\Apoint.exe"
"BDMCon"="\"D:\Programmi\Softwin\BitDefender9\bdmcon.exe\""
"BDOESRV"="\"D:\Programmi\Softwin\BitDefender9\bdoesrv.exe\""
"BDNewsAgent"="\"D:\Programmi\Softwin\BitDefender9\bdnagent.exe\""
"BDSwitchAgent"="\"D:\Programmi\Softwin\BitDefender9\bdswitch.exe\""
"NeroFilterCheck"="D:\WINDOWS\system32\NeroCheck.exe"
[Run\OptionalComponents]
[Run\OptionalComponents\IMAIL]
"Installed"="1"
[Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"
[Run\OptionalComponents\MSFS]
"Installed"="1"
-------------HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce-------------
[RunOnce]
-------------HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx-------------
[RunOnceEx]
-------------HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices-------------
-------------HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce-------------
-------------HKCU\Software\Microsoft\Windows\CurrentVersion\Run-------------
[Run]
"CTFMON.EXE"="D:\WINDOWS\system32\ctfmon.exe"
"TOSCDSPD"="D:\Programmi\TOSHIBA\TOSCDSPD\toscdspd.exe"
"MsnMsgr"="\"D:\Programmi\MSN Messenger\MsnMsgr.Exe\" /background"
-------------HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce-------------
-------------HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx-------------
-------------HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices-------------
-------------HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce-------------
-------------HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run-------------
-------------HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run-------------
-------------HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects-------------
[Browser Helper Objects]
[Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
[Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
#### HKCR\CLSID\{9030D464-4C02-4ABF-8ECC-5164760863C6}\InprocServer32 @="D:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll"
-------------HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks-------------
[URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""
#### HKCR\CLSID\{CFBFAE00-17A6-11D0-99CB-00C04FD64497}\InprocServer32 @=expand:"%SystemRoot%\system32\shdocvw.dll"
-------------HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks-------------
[ShellExecuteHooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
#### HKCR\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\InprocServer32 @="shell32.dll"
-------------HKLM\SYSTEM\ControlSet001\Control\Lsa-------------
[Lsa]
"Authentication Packages"=multi:"msv1_0\00\00"
"Bounds"=hex:00,30,00,00,00,20,00,00
"LsaPid"=dword:00000124
"SecureBoot"=dword:00000001
"auditbaseobjects"=dword:00000000
"crashonauditfail"=dword:00000000
"everyoneincludesanonymous"=dword:00000000
"fipsalgorithmpolicy"=dword:00000000
"forceguest"=dword:00000001
"fullprivilegeauditing"=hex:00
"limitblankpassworduse"=dword:00000001
"lmcompatibilitylevel"=dword:00000000
"nolmhash"=dword:00000000
"restrictanonymous"=dword:00000000
"restrictanonymoussam"=dword:00000001
"Notification Packages"=multi:"scecli\00\00"
[Lsa\AccessProviders]
"ProviderOrder"=multi:"Windows NT Access Provider\00\00"
[Lsa\AccessProviders\Windows NT Access Provider]
"ProviderPath"=expand:"%SystemRoot%\system32\ntmarta.dll"
[Lsa\Audit]
[Lsa\Audit\PerUserAuditing]
[Lsa\Audit\PerUserAuditing\System]
[Lsa\Data]
@Class="c0081b67"
"Pattern"=hex:78,11,67,31,e5,d2,d5,36,fe,3e,4e,3f,b1,1c,69,02,63,30,30,38,31,\
62,36,37,00,fd,07,00,76,08,00,00,34,fa,07,00,56,82,47,75,20,fa,07,00,40,fd,\
07,00,4c,fd,07,00,95,c2,96,60,da,e0,08,ab,bc,10,77,c0
[Lsa\GBG]
@Class="95e019da"
"GrafBlumGroup"=hex:3c,31,4d,1f,fe,e3,ef,ec,99
[Lsa\JD]
@Class="bc7760ab"
"Lookup"=hex:ac,d2,a7,ad,5a,92
[Lsa\Kerberos]
[Lsa\Kerberos\Domains]
[Lsa\Kerberos\SidCache]
[Lsa\MSV1_0]
"Auth132"="IISSUBA"
"ntlmminclientsec"=dword:00000000
"ntlmminserversec"=dword:00000000
[Lsa\Skew1]
@Class="96c21048"
"SkewMatrix"=hex:71,05,07,65,f7,1a,11,59,af,e5,11,78,97,05,db,13
[Lsa\SSO]
[Lsa\SSO\Passport1.4]
"SSOURL"="http://www.passport.com"
[Lsa\SspiCache]
"Time"=hex:a0,de,3d,91,01,42,c7,01
[Lsa\SspiCache\digest.dll]
"Name"="Digest"
"Comment"="Digest SSPI Authentication Package"
"RpcId"=dword:0000ffff
"Time"=hex:00,e6,db,e6,f1,85,c4,01
"Type"=dword:00000031
[Lsa\SspiCache\msapsspc.dll]
"Name"="DPA"
"Comment"="DPA Security Package"
"RpcId"=dword:00000011
"Time"=hex:00,c7,d1,ec,f1,85,c4,01
"Type"=dword:00000031
[Lsa\SspiCache\msnsspc.dll]
"Name"="MSN"
"Comment"="MSN Security Package"
"RpcId"=dword:00000012
"Time"=hex:00,c7,d1,ec,f1,85,c4,01
"Type"=dword:00000031
-------------HKLM\SYSTEM\ControlSet001\Services\SharedAccess-------------
[SharedAccess]
"Description"="Fornisce servizi di conversione indirizzi di rete, indirizzamento e risoluzione nomi e/o servizi di prevenzione intrusione per una rete domestica o una piccola rete aziendale."
"DisplayName"="Windows Firewall / Condivisione connessione Internet (ICS)"
"ImagePath"=expand:"%SystemRoot%\system32\svchost.exe -k netsvcs"
"ObjectName"="LocalSystem"
"Start"=dword:00000002
"Type"=dword:00000020
[SharedAccess\Epoch]
"Epoch"=dword:00000250
[SharedAccess\Parameters]
"ServiceDll"=expand:"%SystemRoot%\System32\ipnathlp.dll"
[SharedAccess\Parameters\FirewallPolicy]
[SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications]
[SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\Programmi\MSN Messenger\msncall.exe"="D:\Programmi\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"D:\Programmi\MSN Messenger\msnmsgr.exe"="D:\Programmi\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"D:\Programmi\MSN Messenger\livecall.exe"="D:\Programmi\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
[SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=dword:00000001
"DoNotAllowExceptions"=dword:00000000
[SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications]
[SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\Programmi\MSN Messenger\msncall.exe"="D:\Programmi\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"D:\Programmi\eMule\emule.exe"="D:\Programmi\eMule\emule.exe:*:Enabled:eMule"
"D:\Programmi\MSN Messenger\msnmsgr.exe"="D:\Programmi\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"D:\Programmi\MSN Messenger\livecall.exe"="D:\Programmi\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
[SharedAccess\Setup]
"ServiceUpgrade"=dword:00000001
[SharedAccess\Setup\InterfacesUnfirewalledAtUpdate]
"All"=dword:00000001
-------------HKLM\Software\Microsoft\Ole-------------
[Ole]
14,00,00,00,02,00,48,00,03,00,00,00,00,00,18,00,1f,00,00,00,01,02,00,00,00,\
00,00,05,20,00,00,00,20,02,00,00,00,00,14,00,0b,00,00,00,01,01,00,00,00,00,\
00,05,04,00,00,00,00,00,14,00,0b,00,00,00,01,01,00,00,00,00,00,05,12,00,00,\
00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,01,02,00,00,00,00,00,05,\
20,00,00,00,20,02,00,00
"MachineLaunchRestriction"=hex:01,00,04,80,48,00,00,00,58,00,00,00,00,00,00,00,\
14,00,00,00,02,00,34,00,02,00,00,00,00,00,18,00,1f,00,00,00,01,02,00,00,00,\
00,00,05,20,00,00,00,20,02,00,00,00,00,14,00,0b,00,00,00,01,01,00,00,00,00,\
00,01,00,00,00,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,01,02,00,\
00,00,00,00,05,20,00,00,00,20,02,00,00
"MachineAccessRestriction"=hex:01,00,04,80,44,00,00,00,54,00,00,00,00,00,00,00,\
14,00,00,00,02,00,30,00,02,00,00,00,00,00,14,00,03,00,00,00,01,01,00,00,00,\
00,00,05,07,00,00,00,00,00,14,00,07,00,00,00,01,01,00,00,00,00,00,01,00,00,\
00,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,01,02,00,00,00,00,00,\
05,20,00,00,00,20,02,00,00
"EnableDCOM"="Y"
[Ole\AppCompat]
[Ole\AppCompat\ActivationSecurityCheckExemptionList]
"{A50398B8-9075-4FBF-A7A1-456BF21937AD}"="1"
"{AD65A69D-3831-40D7-9629-9B0B50A93843}"="1"
"{0040D221-54A1-11D1-9DE0-006097042D69}"="1"
"{2A6D72F1-6E7E-4702-B99C-E40D3DED33C3}"="1"
-------------HKEY_CLASSES_ROOT\exefile\shell\open\command-------------
@="\"%1\" %*"
-------------HKEY_CLASSES_ROOT\comfile\shell\open\command-------------
@="\"%1\" %*"
-------------HKEY_CLASSES_ROOT\batfile\shell\open\command-------------
@="\"%1\" %*"
-------------HKEY_CLASSES_ROOT\piffile\shell\open\command-------------
@="\"%1\" %*"
-------------HKEY_CLASSES_ROOT\scrFile\shell\open\command-------------
@="\"%1\" /S"
-------------HKEY_CLASSES_ROOT\htafile\shell\open\command-------------
@="D:\WINDOWS\system32\mshta.exe \"%1\" %*"
-------------HKEY_CLASSES_ROOT\logfile\shell\open\command-------------
-------------HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler-------------
[SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Precaricatore Browseui"
#### HKCR\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InprocServer32 @=expand:"%SystemRoot%\system32\browseui.dll"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Daemon di cache delle categorie di componenti"
#### HKCR\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InprocServer32 @=expand:"%SystemRoot%\system32\browseui.dll"
-------------HKLM\Software\Microsoft\Active Setup\Installed Components-------------
[Installed Components]
[Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
#### HKCR\CLSID\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\InprocServer32 @="D:\WINDOWS\system32\wmpdxm.dll"
"Stubpath"="D:\WINDOWS\inf\unregmp2.exe /ShowWMP"
@="Microsoft Windows Media Player"
"ComponentID"="WMPACCESS"
[Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
@="Internet Explorer"
"ComponentID"="IEACCESS"
"StubPath"=expand:"%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE"
[Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
@="Personalizzazione del browser"
"ComponentID"="BRANDING.CAB"
"StubPath"="RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP"
[Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
@="Outlook Express"
"ComponentID"="OEACCESS"
"StubPath"=expand:"%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE"
[Installed Components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}]
@="Rendering grafica vettoriale (VML)"
"ComponentID"="MSVML"
[Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
#### HKCR\CLSID\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}\InprocServer32 @="D:\WINDOWS\system32\wmpdxm.dll"
@=""
"ComponentID"="NetShow"
"StubPath"=""
[Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
#### HKCR\CLSID\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\InprocServer32 @="D:\WINDOWS\system32\wmpdxm.dll"
"ComponentID"="Microsoft Windows Media Player"
"StubPath"=""
@="Microsoft Windows Media Player 6.4"
[Installed Components\{283807B5-2C60-11D0-A31D-00AA00B92C03}]
#### HKCR\CLSID\{283807B5-2C60-11D0-A31D-00AA00B92C03}\InprocServer32 @="D:\WINDOWS\system32\danim.dll"
@="DirectAnimation"
"ComponentID"="DirectAnimation"
[Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
@="Themes Setup"
"ComponentID"="Theme Component"
"StubPath"=expand:"%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll"
[Installed Components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}]
@="Binding dati Dynamic HTML per Java"
"ComponentID"="TridataJava"
[Installed Components\{3af36230-a269-11d1-b5bf-0000f8051515}]
@="Modulo ricerca non in linea"
"ComponentID"="MobilePk"
[Installed Components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}]
@="Uniscribe"
"ComponentID"="USP10"
[Installed Components\{4278c270-a269-11d1-b5bf-0000f8051515}]
@="Creazione avanzata"
"ComponentID"="AdvAuth"
[Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
@="Microsoft Outlook Express 6"
"ComponentID"="MailNews"
"CloneUser"=dword:00000001
"StubPath"=expand:"\"%ProgramFiles%\Outlook Express\setup50.exe\" /APP:OE /CALLER:WINNT /user /install"
[Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
@="NetMeeting 3.01"
"ComponentID"="NetMeeting"
"StubPath"="rundll32.exe advpack.dll,LaunchINFSection D:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT"
[Installed Components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}]
@="DirectShow"
"ComponentID"="activemovie"
[Installed Components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
@="DirectDrawEx"
"ComponentID"="DirectDrawEx"
[Installed Components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
@="Guida di Internet Explorer"
"ComponentID"="HelpCont"
[Installed Components\{4f216970-c90c-11d1-b5c7-0000f8051515}]
@="Classi Java DirectAnimation"
"ComponentID"="DAJava"
[Installed Components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
@="Microsoft Windows Script 5.6"
"ComponentID"="MSVBScript"
[Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
"KeyFileName"="D:\Programmi\Messenger\msmsgs.exe"
@="Windows Messenger 4.7"
"ComponentID"="Messenger"
"StubPath"="rundll32.exe advpack.dll,LaunchINFSection D:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser"
[Installed Components\{5A8D6EE0-3E18-11D0-821E-444553540000}]
"(Default)"="Internet Connection Wizard"
"ComponentID"="ICW"
[Installed Components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
@="Strumenti di installazione di Internet Explorer"
"ComponentID"="GenSetup"
[Installed Components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
@="Miglioramenti sfoglia"
"ComponentID"="ExtraPack"
"KeyFileName"="D:\WINDOWS\system32\msieftp.dll"
[Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
#### HKCR\CLSID\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\InprocServer32 @="D:\WINDOWS\system32\wmp.dll"
@="Microsoft Windows Media Player"
"ComponentID"="Microsoft Windows Media Player"
"StubPath"="rundll32.exe advpack.dll,LaunchINFSection D:\WINDOWS\INF\wmp.inf,PerUserStub"
[Installed Components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
@="Accesso sito MSN"
"ComponentID"="MSN_Auth"
[Installed Components\{73FA19D0-2D75-11D2-995D-00C04F98BBC9}]
@="Web Folders"
"ComponentID"="WebFolders"
"StubPath"=""
[Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
@="Rubrica 6"
"ComponentID"="WAB"
"StubPath"=expand:"\"%ProgramFiles%\Outlook Express\setup50.exe\" /APP:WAB /CALLER:WINNT /user /install"
[Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
@="Windows Desktop Update"
"ComponentID"="IE4Shell_NT"
"StubPath"=expand:"regsvr32.exe /s /n /i:U shell32.dll"
[Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
@="Internet Explorer 6"
"ComponentID"="BASEIE40_W2K"
"StubPath"=expand:"%SystemRoot%\system32\ie4uinit.exe"
[Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\AuthorizedCDFPrefix]
[Installed Components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
@="Binding dati Dynamic HTML"
"ComponentID"="Tridata"
[Installed Components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E}]
[Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600}]
@="Font principali di Internet Explorer"
"ComponentID"="Fontcore"
[Installed Components\{CC2A9BA0-3BDD-11D0-821E-444553540000}]
@="Utilità di pianificazione"
"ComponentID"="MSTASK"
[Installed Components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}]
"ComponentID"="Windows Movie Maker v2.1"
[Installed Components\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@="Adobe Flash Player 9 ActiveX"
"ComponentID"="Flash"
[Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
@="Guida HTML"
"ComponentID"="HTMLHelp"
[Installed Components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]
@="Active Directory Service Interface"
"ComponentID"="ADSI"
-------------Comparing registry keys CCS1 vs CCS2 -------------
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\ACPI\Parameters AMLIMaxCTObjs REG_BINARY 05000000
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\ACPI\Parameters AMLIMaxCTObjs REG_BINARY 04000000
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\ACPI\Parameters\WakeUp GenericEventStatus REG_BINARY 0000FFDE
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\ACPI\Parameters\WakeUp GenericEventStatus REG_BINARY 0300FFCE
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Dhcp\Parameters {769C6ED1-B95B-4C14-AA2A-870140BB23D3} REG_BINARY 0F0000000000000000000000000000005749D245F9000000000000000000000.....
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Dhcp\Parameters {769C6ED1-B95B-4C14-AA2A-870140BB23D3} REG_BINARY 0F0000000000000000000000000000004CB2D145F900000000000000000000..........
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\DS
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\LSA
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\NetDDE Object
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\SC Manager
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\Security
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\Security Account Manager
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\Spooler
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\MRxDAV\EncryptedDirectories
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\mssmbios\Data
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapFileSignature REG_BINARY A369538A629E1F7C2EF8D18E6F9CBDB1
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapFileTime REG_BINARY 002134EFF185C401
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapFileSize REG_DWORD 27136 (0x6A00)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapStatus REG_DWORD 0 (0x0)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapFileSignature REG_BINARY 40234F0365CD9D92CEE459FE58FD1025
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapFileTime REG_BINARY 0058179B2D32C101
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapFileSize REG_DWORD 17408 (0x4400)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapStatus REG_DWORD 0 (0x0)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfOS\Performance WbemAdapFileSignature REG_BINARY 4967673E8ED0786F88E2CB58786FAE7E
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfOS\Performance WbemAdapFileTime REG_BINARY 002134EFF185C401
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfOS\Performance WbemAdapFileSize REG_DWORD 26624 (0x6800)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfOS\Performance WbemAdapStatus REG_DWORD 0 (0x0)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfProc\Performance WbemAdapFileSignature REG_BINARY C903E30BDB77AB0C730237F270EC3F90
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfProc\Performance WbemAdapFileTime REG_BINARY 002134EFF185C401
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfProc\Performance WbemAdapFileSize REG_DWORD 35840 (0x8C00)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfProc\Performance WbemAdapStatus REG_DWORD 0 (0x0)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Schedule NextAtJobId REG_DWORD 2 (0x2)
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Schedule NextAtJobId REG_DWORD 1 (0x1)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Schedule AtTaskMaxHours REG_DWORD 72 (0x48)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\SharedAccess\Epoch Epoch REG_DWORD 592 (0x250)
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\SharedAccess\Epoch Epoch REG_DWORD 522 (0x20A)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapFileSignature REG_BINARY A357128EEA84698DCF3ED33E521292CC
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapFileTime REG_BINARY 0097E4FFF185C401
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapFileSize REG_DWORD 146944 (0x23E00)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapStatus REG_DWORD 0 (0x0)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapFileSignature REG_BINARY B5D91042119372579F52237AFBA5AE7F
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapFileTime REG_BINARY 0058179B2D32C101
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapFileSize REG_DWORD 5632 (0x1600)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapStatus REG_DWORD 0 (0x0)
Result compared: Different
-------------Comparing registry keys CCS1 vs CCS3 -------------
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services
Result compared: Identical
-------------List of running services -------------
000) "CryptSvc" - Servizi di crittografia
---> STAT = (RUNNING) Started automatically
---> FILE = D:\WINDOWS\system32\svchost.exe -k netsvcs
001) "DcomLaunch" - Utilità di avvio processo server DCOM
---> STAT = (RUNNING) Started automatically
---> FILE = D:\WINDOWS\system32\svchost -k DcomLaunch
002) "dmserver" - Gestione dischi logici
---> STAT = (RUNNING) Started automatically
---> FILE = D:\WINDOWS\System32\svchost.exe -k netsvcs
003) "Eventlog" - Registro eventi
---> STAT = (RUNNING) Started automatically
---> FILE = D:\WINDOWS\system32\services.exe
004) "helpsvc" - Guida in linea e supporto tecnico
---> STAT = (RUNNING) Started automatically
---> FILE = D:\WINDOWS\System32\svchost.exe -k netsvcs
005) "PlugPlay" - Plug and Play
---> STAT = (RUNNING) Started automatically
---> FILE = D:\WINDOWS\system32\services.exe
006) "RpcSs" - RPC (Remote Procedure Call)
---> STAT = (RUNNING) Started automatically
---> FILE = D:\WINDOWS\system32\svchost -k rpcss
007) "winmgmt" - Strumentazione gestione Windows
---> STAT = (RUNNING) Started automatically
---> FILE = D:\WINDOWS\system32\svchost.exe -k netsvcs
..:: BOOT REGISTRY ::..
0) "AdslTaskBar"
---> CMD = rundll32.exe stmctrl.dll,TaskBar
---> FILE = D:\WINDOWS\system32\rundll32.exe stmctrl.dll,TaskBar
1) "NvCplDaemon"
---> CMD = RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
---> FILE = (NOT EXISTS)
2) "nwiz"
---> CMD = nwiz.exe /install
---> FILE = nwiz.exe /install
3) "CpRmtKey"
---> CMD = "D:\Programmi\Toshiba Controls\CpRmtKey.EXE"
---> FILE = D:\Programmi\Toshiba Controls\CpRmtKey.EXE
4) "CplBTQ00"
---> CMD = D:\Programmi\EzButton\CplBTQ00.EXE
---> FILE = D:\Programmi\EzButton\CplBTQ00.EXE
5) "Apoint"
---> CMD = D:\Programmi\Apoint2K\Apoint.exe
---> FILE = D:\Programmi\Apoint2K\Apoint.exe
6) "BDMCon"
---> CMD = "D:\Programmi\Softwin\BitDefender9\bdmcon.exe"
---> FILE = D:\Programmi\Softwin\BitDefender9\bdmcon.exe
7) "BDOESRV"
---> CMD = "D:\Programmi\Softwin\BitDefender9\bdoesrv.exe"
---> FILE = D:\Programmi\Softwin\BitDefender9\bdoesrv.exe
8) "BDNewsAgent"
---> CMD = "D:\Programmi\Softwin\BitDefender9\bdnagent.exe"
---> FILE = D:\Programmi\Softwin\BitDefender9\bdnagent.exe
9) "BDSwitchAgent"
---> CMD = "D:\Programmi\Softwin\BitDefender9\bdswitch.exe"
---> FILE = D:\Programmi\Softwin\BitDefender9\bdswitch.exe
10) "NeroFilterCheck"
---> CMD = D:\WINDOWS\system32\NeroCheck.exe
---> FILE = D:\WINDOWS\system32\NeroCheck.exe
-------------List of NOT running services -------------
000) "Alerter" - Avvisi
---> STAT = (NOT RUNNING) Disabled
---> FILE = D:\WINDOWS\system32\svchost.exe -k LocalService
001) "ALG" - Servizio Gateway di livello applicazione
---> STAT = (NOT RUNNING) Started manually
---> FILE = D:\WINDOWS\System32\alg.exe
002) "AppMgmt" - Gestione applicazione
---> STAT = (NOT RUNNING) Started manually
---> FILE = D:\WINDOWS\system32\svchost.exe -k netsvcs
003) "AudioSrv" - Audio Windows
---> STAT = (NOT RUNNING) Started automatically
---> FILE = D:\WINDOWS\System32\svchost.exe -k netsvcs
004) "bdss" - BitDefender Scan Server
---> STAT = (NOT RUNNING) Started automatically
---> FILE = "D:\Programmi\File comuni\Softwin\BitDefender Scan Server\bdss.exe" /service
005) "BITS" - Servizio trasferimento intelligente in background
---> STAT = (NOT RUNNING) Started manually
---> FILE = D:\WINDOWS\system32\svchost.exe -k netsvcs
006) "Browser" - Browser di computer
---> STAT = (NOT RUNNING) Started automatically
---> FILE = D:\WINDOWS\system32\svchost.exe -k netsvcs
007) "CiSvc" - Servizio di indicizzazione
---> STAT = (NOT RUNNING) Started manually
---> FILE = D:\WINDOWS\system32\cisvc.exe
008) "ClipSrv" - ClipBook
---> STAT = (NOT RUNNING) Disabled
---> FILE = D:\WINDOWS\system32\clipsrv.exe
009) "COMSysApp" - Applicazione di sistema COM+
---> STAT = (NOT RUNNING) Started manually
---> FILE = D:\WINDOWS\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
010) "Dhcp" - Client DHCP
---> STAT = (NOT RUNNING) Started automatically
---> FILE = D:\WINDOWS\system32\svchost.exe -k netsvcs
011) "dmadmin" - Servizio amministrativo di Gestione disco logico
---> STAT = (NOT RUNNING) Started manually
---> FILE = D:\WINDOWS\System32\dmadmin.exe /com
012) "Dnscache" - Client DNS
---> STAT = (NOT RUNNING) Started automatically
---> FILE = D:\WINDOWS\system32\svchost.exe -k NetworkService
013) "DVD-RAM_Service" - DVD-RAM_Service
---> STAT = (NOT RUNNING) Started automatically
---> FILE = D:\WINDOWS\system32\DVDRAMSV.exe
014) "ERSvc" - Servizio di segnalazione errori
---> STAT = (NOT RUNNING) Started automatically
---> FILE = D:\WINDOWS\System32\svchost.exe -k netsvcs
015) "EventSystem" - Sistema di eventi COM+
---> STAT = (NOT RUNNING) Started manually
---> FILE = D:\WINDOWS\system32\svchost.exe -k netsvcs
016) "FastUserSwitchingCompatibility" - Compatibilità di Cambio rapido utente
---> STAT = (NOT RUNNING) Started manually
---> FILE = D:\WINDOWS\System32\svchost.exe -k netsvcs
017) "HidServ" - Accesso periferica Human Interface
---> STAT = (NOT RUNNING) Disabled
---> FILE = D:\WINDOWS\System32\svchost.exe -k netsvcs
018) "HTTPFilter" - SSL HTTP
---> STAT = (NOT RUNNING) Started manually
---> FILE = D:\WINDOWS\System32\svchost.exe -k HTTPFilter
019) "ImapiService" - Servizio COM di masterizzazione CD IMAPI
---> STAT = (NOT RUNNING) Started manually
---> FILE = D:\WINDOWS\system32\imapi.exe
020) "Irmon" - Monitor infrarossi
---> STAT = (NOT RUNNING) Started automatically
---> FILE = D:\WINDOWS\system32\svchost.exe -k netsvcs
021) "lanmanserver" - Server
---> STAT = (NOT RUNNING) Started automatically
---> FILE = D:\WINDOWS\system32\svchost.exe -k netsvcs
022) "lanmanworkstation" - Workstation
---> STAT = (NOT RUNNING) Started automatically
---> FILE = D:\WINDOWS\system32\svchost.exe -k netsvcs
023) "LIVESRV" - BitDefender Desktop Update Service
---> STAT = (NOT RUNNING) Started automatically
---> FILE = "D:\Programmi\File comuni\Softwin\BitDefender Update Service\livesrv.exe" /service
024) "LmHosts" - Helper NetBIOS di TCP/IP
---> STAT = (NOT RUNNING) Started automatically
---> FILE = D:\WINDOWS\system32\svchost.exe -k LocalService
025) "Messenger" - Messenger
---> STAT = (NOT RUNNING) Disabled
---> FILE = D:\WINDOWS\system32\svchost.exe -k netsvcs
026) "mnmsrvc" - Condivisione desktop remoto di NetMeeting
---> STAT = (NOT RUNNING) Started manually
---> FILE = D:\WINDOWS\system32\mnmsrvc.exe
027) "MSDTC" - Distributed Transaction Coordinator
---> STAT = (NOT RUNNING) Started manually
---> FILE = D:\WINDOWS\system32\msdtc.exe
028) "MSIServer" - Windows Installer
---> STAT = (NOT RUNNING) Started manually
---> FILE = D:\WINDOWS\system32\msiexec.exe /V
029) "NetDDE" - DDE di rete
---> STAT = (NOT RUNNING) Disabled
---> FILE = D:\WINDOWS\system32\netdde.exe
030) "NetDDEdsdm" - DDE DSDM di rete
---> STAT = (NOT RUNNING) Disabled
---> FILE = D:\WINDOWS\system32\netdde.exe
031) "Netlogon" - Accesso rete
---> STAT = (NOT RUNNING) Started manually
---> FILE = D:\WINDOWS\system32\lsass.exe
032) "Netman" - Connessioni di rete
---> STAT = (NOT RUNNING) Started manually
---> FILE = D:\WINDOWS\System32\svchost.exe -k netsvcs
033) "Nla" - NLA (Network Location Awareness)
---> STAT = (NOT RUNNING) Started manually
---> FILE = D:\WINDOWS\system32\svchost.exe -k netsvcs
034) "NtLmSsp" - Provider supporto protezione LM NT
---> STAT = (NOT RUNNING) Started manually
---> FILE = D:\WINDOWS\system32\lsass.exe
035) "NtmsSvc" - Archivi rimovibili
---> STAT = (NOT RUNNING) Started manually
---> FILE = D:\WINDOWS\system32\svchost.exe -k netsvcs
036) "NVSvc" - NVIDIA Driver Helper Service
---> STAT = (NOT RUNNING) Started automatically
---> FILE = D:\WINDOWS\system32\nvsvc32.exe
037) "ose" - Office Source Engine
---> STAT = (NOT RUNNING) Started manually
---> FILE = "D:\Programmi\File comuni\Microsoft Shared\Source Engine\OSE.EXE"
038) "PolicyAgent" - Servizi IPSEC
---> STAT = (NOT RUNNING) Started automatically
---> FILE = D:\WINDOWS\system32\lsass.exe
039) "ProtectedStorage" - Archiviazione protetta
---> STAT = (NOT RUNNING) Started automatically
---> FILE = D:\WINDOWS\system32\lsass.exe
040) "RasAuto" - Auto Connection Manager di Accesso remoto
---> STAT = (NOT RUNNING) Started manually
---> FILE = D:\WINDOWS\system32\svchost.exe -k netsvcs
041) "RasMan" - Connection Manager di Accesso remoto
---> STAT = (NOT RUNNING) Started manually
---> FILE = D:\WINDOWS\system32\svchost.exe -k netsvcs
042) "RDSessMgr" - Gestione sessione di assistenza mediante desktop remoto
---> STAT = (NOT RUNNING) Started manually
---> FILE = D:\WINDOWS\system32\sessmgr.exe
043) "RemoteAccess" - Routing e Accesso remoto
---> STAT = (NOT RUNNING) Disabled
---> FILE = D:\WINDOWS\system32\svchost.exe -k netsvcs
044) "RemoteRegistry" - Registro di sistema remoto
---> STAT = (NOT RUNNING) Started automatically
---> FILE = D:\WINDOWS\system32\svchost.exe -k LocalService
045) "RpcLocator" - RPC Locator
---> STAT = (NOT RUNNING) Started manually
---> FILE = D:\WINDOWS\system32\locator.exe
046) "RSVP" - QoS RSVP
---> STAT = (NOT RUNNING) Started manually
---> FILE = D:\WINDOWS\system32\rsvp.exe
047) "SamSs" - Gestione account di protezione (SAM)
---> STAT = (NOT RUNNING) Started automatically
---> FILE = D:\WINDOWS\system32\lsass.exe
048) "SCardSvr" - smart card
---> STAT = (NOT RUNNING) Started manually
---> FILE = D:\WINDOWS\System32\SCardSvr.exe
049) "Schedule" - Utilità di pianificazione
---> STAT = (NOT RUNNING) Started automatically
---> FILE = D:\WINDOWS\System32\svchost.exe -k netsvcs
050) "seclogon" - Accesso secondario
---> STAT = (NOT RUNNING) Started automatically
---> FILE = D:\WINDOWS\System32\svchost.exe -k netsvcs
051) "SENS" - Notifica eventi di sistema
---> STAT = (NOT RUNNING) Started automatically
---> FILE = D:\WINDOWS\system32\svchost.exe -k netsvcs
052) "SharedAccess" - Windows Firewall / Condivisione connessione Internet (ICS)
---> STAT = (NOT RUNNING) Started automatically
---> FILE = D:\WINDOWS\system32\svchost.exe -k netsvcs
053) "ShellHWDetection" - Rilevamento hardware shell
---> STAT = (NOT RUNNING) Started automatically
---> FILE = D:\WINDOWS\System32\svchost.exe -k netsvcs
054) "Spooler" - Spooler di stampa
---> STAT = (NOT RUNNING) Started automatically
---> FILE = D:\WINDOWS\system32\spoolsv.exe
055) "srservice" - Servizio Ripristino configurazione di sistema
---> STAT = (NOT RUNNING) Started automatically
---> FILE = D:\WINDOWS\system32\svchost.exe -k netsvcs
056) "SSDPSRV" - Servizio di rilevamento SSDP
---> STAT = (NOT RUNNING) Started manually
---> FILE = D:\WINDOWS\system32\svchost.exe -k LocalService
057) "stisvc" - Acquisizione di immagini di Windows (WIA)
---> STAT = (NOT RUNNING) Started automatically
---> FILE = D:\WINDOWS\system32\svchost.exe -k imgsvc
058) "SwPrv" - MS Software Shadow Copy Provider
---> STAT = (NOT RUNNING) Started manually
---> FILE = D:\WINDOWS\system32\dllhost.exe /Processid:{CF2AF6D8-A997-47FE-8E56-E8A7134C61E4}
059) "SysmonLog" - Avvisi e registri di prestazioni
---> STAT = (NOT RUNNING) Started manually
---> FILE = D:\WINDOWS\system32\smlogsvc.exe
060) "TapiSrv" - Telefonia
---> STAT = (NOT RUNNING) Started manually
---> FILE = D:\WINDOWS\System32\svchost.exe -k netsvcs
061) "TermService" - Servizi terminal
---> STAT = (NOT RUNNING) Started manually
---> FILE = D:\WINDOWS\System32\svchost -k DComLaunch
062) "Themes" - Temi
---> STAT = (NOT RUNNING) Started automatically
---> FILE = D:\WINDOWS\System32\svchost.exe -k netsvcs
063) "TlntSvr" - Telnet
---> STAT = (NOT RUNNING) Disabled
---> FILE = D:\WINDOWS\system32\tlntsvr.exe
064) "TrkWks" - Manutenzione collegamenti distribuiti client
---> STAT = (NOT RUNNING) Started automatically
---> FILE = D:\WINDOWS\system32\svchost.exe -k netsvcs
065) "upnphost" - Host di periferiche Plug and Play universali
---> STAT = (NOT RUNNING) Started manually
---> FILE = D:\WINDOWS\system32\svchost.exe -k LocalService
066) "UPS" - Gruppo di continuità
---> STAT = (NOT RUNNING) Started manually
---> FILE = D:\WINDOWS\System32\ups.exe
067) "usnjsvc" - Servizio Messenger Sharing Folders USN Journal Reader
---> STAT = (NOT RUNNING) Started manually
---> FILE = "D:\Programmi\MSN Messenger\usnsvc.exe"
068) "VSS" - Copia replicata del volume
---> STAT = (NOT RUNNING) Started manually
---> FILE = D:\WINDOWS\System32\vssvc.exe
069) "VSSERV" - BitDefender Virus Shield
---> STAT = (NOT RUNNING) Started automatically
---> FILE = "D:\Programmi\Softwin\BitDefender9\vsserv.exe" /service
070) "W32Time" - Ora di Windows
---> STAT = (NOT RUNNING) Started automatically
---> FILE = D:\WINDOWS\System32\svchost.exe -k netsvcs
071) "WebClient" - WebClient
---> STAT = (NOT RUNNING) Started automatically
---> FILE = D:\WINDOWS\system32\svchost.exe -k LocalService
072) "WmdmPmSN" - Servizio Numero di serie per dispositivi multimediali portatili
---> STAT = (NOT RUNNING) Started manually
---> FILE = D:\WINDOWS\System32\svchost.exe -k netsvcs
073) "Wmi" - Estensioni driver di Strumentazione gestione Windows
---> STAT = (NOT RUNNING) Started manually
---> FILE = D:\WINDOWS\System32\svchost.exe -k netsvcs
074) "WmiApSrv" - Scheda WMI Performance
---> STAT = (NOT RUNNING) Started manually
---> FILE = D:\WINDOWS\system32\wbem\wmiapsrv.exe
075) "wscsvc" - Centro sicurezza PC
---> STAT = (NOT RUNNING) Started automatically
---> FILE = D:\WINDOWS\System32\svchost.exe -k netsvcs
076) "wuauserv" - Aggiornamenti automatici
---> STAT = (NOT RUNNING) Started automatically
---> FILE = D:\WINDOWS\system32\svchost.exe -k netsvcs
077) "WZCSVC" - Zero Configuration reti senza fili
---> STAT = (NOT RUNNING) Started automatically
---> FILE = D:\WINDOWS\System32\svchost.exe -k netsvcs
078) "XCOMM" - BitDefender Communicator
---> STAT = (NOT RUNNING) Started automatically
---> FILE = "D:\Programmi\File comuni\Softwin\BitDefender Communicator\xcommsvr.exe" /service
079) "xmlprov" - Servizio Provisioning di rete
---> STAT = (NOT RUNNING) Started manually
---> FILE = D:\WINDOWS\System32\svchost.exe -k netsvcs
-------------List of running device driver services -------------
000) "ACPI" - Driver ACPI Microsoft
---> STAT = (RUNNING) Started by operating system loader
---> FILE = \SystemRoot\system32\DRIVERS\ACPI.sys
001) "ACPIEC" - Driver del controller integrato Microsoft
---> STAT = (RUNNING) Started by operating system loader
---> FILE = \SystemRoot\system32\DRIVERS\ACPIEC.sys
002) "agp440" - Filtro bus Intel AGP
---> STAT = (RUNNING) Started by operating system loader
---> FILE = \SystemRoot\system32\DRIVERS\agp440.sys
003) "ApfiltrService" - Alps Pointing-device Filter Driver
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\Apfiltr.sys
004) "atapi" - Controller disco rigido IDE/ESDI standard
---> STAT = (RUNNING) Started by operating system loader
---> FILE = \SystemRoot\system32\DRIVERS\atapi.sys
005) "Beep" - Beep
---> STAT = (RUNNING) Started by "IoInitSystem" function
006) "Cdrom" - Driver del CD-ROM
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> FILE = system32\DRIVERS\cdrom.sys
007) "Compbatt" - Driver della batteria composita Microsoft
---> STAT = (RUNNING) Started by operating system loader
---> FILE = \SystemRoot\system32\DRIVERS\compbatt.sys
008) "Disk" - Driver del disco
---> STAT = (RUNNING) Started by operating system loader
---> FILE = \SystemRoot\system32\DRIVERS\disk.sys
009) "DKbFltr" - Dritek HotKey Keyboard Filter Driver
---> STAT = (RUNNING) Started manually
---> FILE = System32\Drivers\DKbFltr.sys
010) "dmio" - Driver Gestione dischi logici
---> STAT = (RUNNING) Started by operating system loader
---> FILE = \SystemRoot\System32\drivers\dmio.sys
011) "dmload" - dmload
---> STAT = (RUNNING) Started by operating system loader
---> FILE = \SystemRoot\System32\drivers\dmload.sys
012) "Fdc" - Driver controller disco floppy
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\fdc.sys
013) "FltMgr" - FltMgr
---> STAT = (RUNNING) Started by operating system loader
---> FILE = \SystemRoot\system32\DRIVERS\fltMgr.sys
014) "Ftdisk" - Driver archiviazione volumi
---> STAT = (RUNNING) Started by operating system loader
---> FILE = \SystemRoot\system32\DRIVERS\ftdisk.sys
015) "hidusb" - Driver di classe HID Microsoft
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\hidusb.sys
016) "i8042prt" - Driver di porta mouse PS/2 e tastiera i8042
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> FILE = system32\DRIVERS\i8042prt.sys
017) "Imapi" - Driver filtro masterizzazione CD
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> FILE = system32\DRIVERS\imapi.sys
018) "IntelIde" - IntelIde
---> STAT = (RUNNING) Started by operating system loader
---> FILE = \SystemRoot\system32\DRIVERS\intelide.sys
019) "isapnp" - Driver bus PnP ISA/EISA
---> STAT = (RUNNING) Started by operating system loader
---> FILE = \SystemRoot\system32\DRIVERS\isapnp.sys
020) "Kbdclass" - Driver classe tastiera
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> FILE = system32\DRIVERS\kbdclass.sys
021) "KSecDD" - KSecDD
---> STAT = (RUNNING) Started by operating system loader
022) "meiudf" - meiudf
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> FILE = System32\Drivers\meiudf.sys
023) "Mouclass" - Driver classe mouse
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> FILE = system32\DRIVERS\mouclass.sys
024) "mouhid" - Driver di mouse HID
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\mouhid.sys
025) "MountMgr" - MountMgr
---> STAT = (RUNNING) Started by operating system loader
026) "Msfs" - Msfs
---> STAT = (RUNNING) Started by "IoInitSystem" function
027) "mssmbios" - Driver BIOS Microsoft System Management
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\mssmbios.sys
028) "Mup" - Mup
---> STAT = (RUNNING) Started by operating system loader
029) "NDIS" - Driver di sistema NDIS
---> STAT = (RUNNING) Started by operating system loader
030) "Npfs" - Npfs
---> STAT = (RUNNING) Started by "IoInitSystem" function
031) "Ntfs" - Ntfs
---> STAT = (RUNNING) Disabled
032) "Null" - Null
---> STAT = (RUNNING) Started by "IoInitSystem" function
033) "ohci1394" - Controller host Texas Instruments IEEE 1394 compatibile OHCI
---> STAT = (RUNNING) Started by operating system loader
---> FILE = \SystemRoot\system32\DRIVERS\ohci1394.sys
034) "PartMgr" - PartMgr
---> STAT = (RUNNING) Started by operating system loader
035) "PCI" - Driver bus PCI
---> STAT = (RUNNING) Started by operating system loader
---> FILE = \SystemRoot\system32\DRIVERS\pci.sys
036) "PCIIde" - PCIIde
---> STAT = (RUNNING) Started by operating system loader
037) "Pcmcia" - Pcmcia
---> STAT = (RUNNING) Started by operating system loader
---> FILE = \SystemRoot\system32\DRIVERS\pcmcia.sys
038) "rdpdr" - Driver redirector periferica Terminal Server
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\rdpdr.sys
039) "redbook" - Driver filtro riproduzione CD-ROM audio digitale
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> FILE = system32\DRIVERS\redbook.sys
040) "swenum" - Driver bus software
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\swenum.sys
041) "TermDD" - Driver della periferica terminale
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> FILE = system32\DRIVERS\termdd.sys
042) "Udfs" - Udfs
---> STAT = (RUNNING) Disabled
043) "Update" - Driver aggiornamento microcodice
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\update.sys
044) "usbehci" - Driver Miniport controller enhanced host USB 2.0 Microsoft
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\usbehci.sys
045) "usbhub" - Hub abilitato USB2
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\usbhub.sys
046) "usbuhci" - Driver Miniport Controller Universal Host USB Microsoft
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\usbuhci.sys
047) "VgaSave" - VgaSave
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> FILE = \SystemRoot\System32\drivers\vga.sys
048) "VolSnap" - VolSnap
---> STAT = (RUNNING) Started by operating system loader
-------------List of NOT running device driver services -------------
000) "abp480n5" - abp480n5
---> STAT = (NOT RUNNING) Disabled
001) "adpu160m" - adpu160m
---> STAT = (NOT RUNNING) Disabled
002) "aec" - Eliminatore di eco acustico del kernel Microsoft
---> STAT = (NOT RUNNING) Started manually
---> FILE = system32\drivers\aec.sys
003) "AFD" - AFD
---> STAT = (NOT RUNNING) Started by "IoInitSystem" function
---> FILE = \SystemRoot\System32\drivers\afd.sys
004) "Aha154x" - Aha154x
---> STAT = (NOT RUNNING) Disabled
005) "aic78u2" - aic78u2
---> STAT = (NOT RUNNING) Disabled
006) "aic78xx" - aic78xx
---> STAT = (NOT RUNNING) Dis