Antivirus non s'installa

[ciccibomber]

Ciao a tutti....da 2 giorni ho un problema: non riesco ad installare nessun antivirus ( ok gli altri programmi).
Ho anche qualche problema con la modalita' provvisoria che ogni tanto s'impalla.
Cercando in giro ho visto che potrebbe trattarsi del virus Bagle, ma nel mio caso non e' cosi', non c'e' traccia di cartelle o file facenti riferimento al virus.
Tutto e' iniziato non appena e' scaduto il trial di KIS 7 che avevo installato nel mio pc, decido di provare PANDA AV, lo installo e va' tutto ok solo che non si aggiorna: scarico cioe' i kb dell'aggiornamento senza che questi vengano in effetti installati.
Il PANDA nel frattempo mi trova ed elimina il file sospetto "RESTART.EXE", e contemporaneamente HijackThis mi evidenzia i file REBOOT.EXE e LANZAR2007 ( o qualcosa del genere) che mi consigliano di fixare, e cosi' faccio. Alla fine di tutto cio' non riesco piu' ad installare alcun antivirus.
Per favore spero che qualcuno possa aiutarmi.

[ciccibomber]

Allego, in ritardo scusate, il report della scansione on line su Kaspersky.
Sunday, November 18, 2007 11:48:44 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 18/11/2007
Kaspersky Anti-Virus database records: 461375


Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Statistics
Total number of scanned objects 50903
Number of viruses found 1
Number of infected objects 2
Number of suspicious objects 0
Duration of the scan process 01:10:21

C:\Programmi\AdunanzA\Incoming\DAP_v8.6_Crack_Premium.rar/DAP v8.5.5.5 Build 292+Crack Premium/CRACK/DAP.exe Infected: Trojan-Spy.Win32.Banker.fzf skipped

C:\Programmi\AdunanzA\Incoming\DAP_v8.6_Crack_Premium.rar RAR: infected - 1 skipped

Scan process completed.

[crazy.cat]

Prova lo stesso a far girare lo script con avenger, poi posta il txt che ti esce al riavvio, e poi vediamo anche il log di hijackthis.
Se tenti di installare un qualsiasi antivirus ti da qualche messaggio di errore?

Files to delete:
C:\WINDOWS\system32\drivers\hidr.exe
C:\WINDOWS\system32\drivers\srosa.sys
C:\WINDOWS\system32\wintems.exe
C:\WINDOWS\system32\hldrrr.exe
C:\WINDOWS\system32\trusted.exe
C:\WINDOWS\system32\drivers\pci32.sys
C:\Programmi\AdunanzA\Incoming\DAP_v8.6_Crack_Premium.rar

folders to delete:
C:\WINDOWS\exefnd
C:\WINDOWS\exefld

registry keys to delete:
HKLM\SYSTEM\CurrentControlSet\Services\srosa
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
HKLM\SYSTEM\CurrentControlSet\Services\pci32
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32

[ciccibomber]

Ciao, grazie per l'interessamento.
Sto cercando di scaricare avenger ma ho difficolta': il file zippato e' danneggiato, ed ho provato da due link differenti ....puoi darmi tutti i link possibili? ( Non so se questa difficolta' ha a che fare col mio problema).
Ecco il report di hijakthis:
Logfile of HijackThis v1.99.1
Scan saved at 12.55.48, on 19/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmi\Raxco\PerfectDisk\PDAgent.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programmi\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
C:\Programmi\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Programmi\ZyXEL\G360\Gcc.exe
C:\Programmi\ZyXEL\G360\OdHost.exe
C:\Programmi\Raxco\PerfectDisk\PDEngine.exe
C:\Programmi\File comuni\Ahead\Lib\NMIndexingService.exe
C:\Programmi\File comuni\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\AdunanzA\eMule_AdnzA.exe
C:\Programmi\Steam\Steam.exe
c:\programmi\steam\steamapps\ciccibomber\portal\hl2.exe
C:\Programmi\Steam\GameOverlayUI.exe
C:\Documents and Settings\Amministratore\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Programmi\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programmi\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CTSysVol] C:\Programmi\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [CTDVDDet] C:\Programmi\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [SBDrvDet] C:\Programmi\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Utilità adattatore senza fili ZyXEL G-360.lnk = C:\Programmi\ZyXEL\G360\Gcc.exe
O8 - Extra context menu item: Aggiungi all'elenco di stampa Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Anteprima Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Stampa ad alta velocità Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Stampa Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partne ... nicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 2616758968
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Programmi\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programmi\File comuni\Ahead\Lib\NMIndexingService.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Programmi\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Programmi\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

[crazy.cat]

Il log di hijackthis non mostra niente di pericoloso

Dimmi quando hai scaricato avenger dall'allegato alla discussione che poi lo rimuovo.

[ciccibomber]

Non riesco a scaricare nessun file zippato......il risultato e' un file danneggiato.
Ma ho scaricato avenger in formato .exe direttamente sul sito del produttore.
Appena lo avvio dice: " CRC error! File content has been modified. If you run a system debugger, clear all breakpoints before running this program!"
Se fa riferimento al ripr.conf.sis. l'ho disattivato ieri sera.

[ste_95]

usa elibagla:

scarica elibagla
aprilo
assicurati che la casella eliminar ficheros automaticamente sia spuntata
quindi avvia la scansione
al termine in C.\Infosat.txt troverai il log, copia e incollalo qui

[ciccibomber]

[quote="ste_95"]usa elibagla

Gia' fatto, nulla, ecco il log:

Sun Nov 18 22:54:00 2007
EliBagle v10.71 (c)2007 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):

Sun Nov 18 22:54:05 2007
EliBagle v10.71 (c)2007 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\

Nº Total de Directorios: 2826
Nº Total de Ficheros: 37114
Nº de Ficheros Analizados: 8233
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0

Sun Nov 18 22:57:35 2007
EliBagle v10.71 (c)2007 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\

Nº Total de Directorios: 2826
Nº Total de Ficheros: 37115
Nº de Ficheros Analizados: 8233
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0

Sun Nov 18 23:05:09 2007
EliBagle v10.71 (c)2007 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):

Sun Nov 18 23:05:24 2007
EliBagle v10.71 (c)2007 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\

Nº Total de Directorios: 2826
Nº Total de Ficheros: 37215
Nº de Ficheros Analizados: 8233
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0

Mon Nov 19 00:01:53 2007
EliBagle v10.71 (c)2007 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):

Mon Nov 19 00:02:03 2007
EliBagle v10.71 (c)2007 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad M:\

Nº Total de Directorios: 259
Nº Total de Ficheros: 6218
Nº de Ficheros Analizados: 637
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0

Mon Nov 19 00:02:14 2007
EliBagle v10.71 (c)2007 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad L:\

Nº Total de Directorios: 10
Nº Total de Ficheros: 391
Nº de Ficheros Analizados: 0
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0

Mon Nov 19 00:02:18 2007
EliBagle v10.71 (c)2007 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad J:\

Nº Total de Directorios: 20
Nº Total de Ficheros: 1001
Nº de Ficheros Analizados: 10
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0

Mon Nov 19 00:02:22 2007
EliBagle v10.71 (c)2007 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad H:\

Nº Total de Directorios: 0
Nº Total de Ficheros: 0
Nº de Ficheros Analizados: 0
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0

Mon Nov 19 00:02:27 2007
EliBagle v10.71 (c)2007 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad G:\

Nº Total de Directorios: 44
Nº Total de Ficheros: 7431
Nº de Ficheros Analizados: 0
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0

Mon Nov 19 00:02:34 2007
EliBagle v10.71 (c)2007 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad F:\

Nº Total de Directorios: 20
Nº Total de Ficheros: 1534
Nº de Ficheros Analizados: 3
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0

Mon Nov 19 00:02:42 2007
EliBagle v10.71 (c)2007 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad E:\

Nº Total de Directorios: 223
Nº Total de Ficheros: 3221
Nº de Ficheros Analizados: 248
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0

Mon Nov 19 00:03:40 2007
EliBagle v10.71 (c)2007 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad D:\

Nº Total de Directorios: 40
Nº Total de Ficheros: 90
Nº de Ficheros Analizados: 22
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0

Mon Nov 19 00:03:53 2007
EliBagle v10.71 (c)2007 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\

Nº Total de Directorios: 2826
Nº Total de Ficheros: 37413
Nº de Ficheros Analizados: 8234
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0

[ste_95]

la versione è aggiornata? nelle nuove si introducono nuove "rivelazioni"

[ciccibomber]

la versione è aggiornata? nelle nuove si introducono nuove "rivelazioni"

E' la v10.71...dovrebbe essere l'ultima.

[ste_95]

riesci a fare le scansioni con gmer delle sezioni autostart e rootkit?

[ciccibomber]

riesci a fare le scansioni con gmer delle sezioni autostart e rootkit?

Si eccole:
GMER 1.0.13.12551 - http://www.gmer.net
Rootkit scan 2007-11-19 15:12:06
Windows 5.1.2600 Service Pack 2


---- System - GMER 1.0.13 ----

SSDT sptd.sys ZwCreateKey
SSDT sptd.sys ZwEnumerateKey
SSDT sptd.sys ZwEnumerateValueKey
SSDT sptd.sys ZwOpenKey
SSDT sptd.sys ZwQueryKey
SSDT sptd.sys ZwQueryValueKey
SSDT sptd.sys ZwSetValueKey

---- Kernel code sections - GMER 1.0.13 ----

? C:\WINDOWS\system32\drivers\sptd.sys Impossibile accedere al file. Il file è utilizzato da un altro processo.
.text USBPORT.SYS!DllUnload F723762C 5 Bytes JMP 8669F770
? System32\Drivers\abj87j76.SYS Impossibile trovare il file specificato.

---- User code sections - GMER 1.0.13 ----

.text C:\Programmi\Internet Explorer\iexplore.exe[328] USER32.dll!DialogBoxParamW 7E3A555F 5 Bytes JMP 435FF2C1 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Programmi\Internet Explorer\iexplore.exe[328] USER32.dll!DialogBoxIndirectParamW 7E3B2032 5 Bytes JMP 4379030F C:\WINDOWS\system32\IEFRAME.dll
.text C:\Programmi\Internet Explorer\iexplore.exe[328] USER32.dll!MessageBoxIndirectA 7E3BA04A 5 Bytes JMP 43790290 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Programmi\Internet Explorer\iexplore.exe[328] USER32.dll!DialogBoxParamA 7E3BB10C 5 Bytes JMP 437902D4 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Programmi\Internet Explorer\iexplore.exe[328] USER32.dll!MessageBoxExW 7E3D05D8 5 Bytes JMP 4379021C C:\WINDOWS\system32\IEFRAME.dll
.text C:\Programmi\Internet Explorer\iexplore.exe[328] USER32.dll!MessageBoxExA 7E3D05FC 5 Bytes JMP 43790256 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Programmi\Internet Explorer\iexplore.exe[328] USER32.dll!DialogBoxIndirectParamA 7E3D6B50 5 Bytes JMP 4379034A C:\WINDOWS\system32\IEFRAME.dll
.text C:\Programmi\Internet Explorer\iexplore.exe[328] USER32.dll!MessageBoxIndirectW 7E3E62AB 5 Bytes JMP 43621676 C:\WINDOWS\system32\IEFRAME.dll

---- Kernel IAT/EAT - GMER 1.0.13 ----

IAT \WINDOWS\System32\Drivers\SCSIPORT.SYS[ntoskrnl.exe!IoConnectInterrupt] [F773B06C] sptd.sys
IAT pci.sys[ntoskrnl.exe!IoDetachDevice] [F773B018] sptd.sys
IAT pci.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F775D9AE] sptd.sys
IAT atapi.sys[ntoskrnl.exe!IoConnectInterrupt] [F773B06C] sptd.sys
IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [F7724AD4] sptd.sys
IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [F7724C1A] sptd.sys
IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [F7724B9C] sptd.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [F7725748] sptd.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [F772561E] sptd.sys
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [F773A29A] sptd.sys

---- User IAT/EAT - GMER 1.0.13 ----

IAT C:\Programmi\Internet Explorer\iexplore.exe[328] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA] [02452070] C:\Programmi\Canon\Easy-WebPrint\EWPCore.dll
IAT C:\Programmi\Internet Explorer\iexplore.exe[328] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [024520B0] C:\Programmi\Canon\Easy-WebPrint\EWPCore.dll
IAT C:\Programmi\Internet Explorer\iexplore.exe[328] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [02452030] C:\Programmi\Canon\Easy-WebPrint\EWPCore.dll
IAT C:\Programmi\Internet Explorer\iexplore.exe[328] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [02452000] C:\Programmi\Canon\Easy-WebPrint\EWPCore.dll
IAT C:\Programmi\Internet Explorer\iexplore.exe[328] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [02454C50] C:\Programmi\Canon\Easy-WebPrint\EWPCore.dll

[ste_95]

questo è pulito....manca però l'autostart

[ciccibomber]

questo è pulito....manca però l'autostart

Azzz eccolo
GMER 1.0.13.12551 - http://www.gmer.net
Autostart scan 2007-11-19 15:44:16
Windows 5.1.2600 Service Pack 2


HKLM\SYSTEM\CurrentControlSet\Control\Session Manager@BootExecute = PDBoot.exe autocheck autochk * lsdelete

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems@Windows = %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon@Userinit = C:\WINDOWS\system32\userinit.exe,

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent@DLLName = Ati2evxx.dll

HKLM\SYSTEM\CurrentControlSet\Services\ >>>
aawservice /*Ad-Aware 2007 Service*/@ = "C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe"
Ati HotKey Poller@ = %SystemRoot%\system32\Ati2evxx.exe
ATI Smart /*ATI Smart*/@ = C:\WINDOWS\system32\ati2sgag.exe
Creative Service for CDROM Access /*Creative Service for CDROM Access*/@ = C:\WINDOWS\system32\CTsvcCDA.exe
LightScribeService /*LightScribeService Direct Disc Labeling Service*/@ = "C:\Programmi\File comuni\LightScribe\LSSrvc.exe"
MDM /*Machine Debug Manager*/@ = "C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE"
PDAgent /*PDAgent*/@ = C:\Programmi\Raxco\PerfectDisk\PDAgent.exe
Spooler /*Spooler di stampa*/@ = %SystemRoot%\system32\spoolsv.exe
StarWindServiceAE /*StarWind AE Service*/@ = C:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
UMWdf /*Windows User Mode Driver Framework*/@ = C:\WINDOWS\system32\wdfmgr.exe
WMDM PMSP Service /*WMDM PMSP Service*/@ = C:\WINDOWS\system32\MsPMSPSv.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\Run >>>
@SoundManSOUNDMAN.EXE = SOUNDMAN.EXE
@CTSysVolC:\Programmi\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe = C:\Programmi\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
@CTDVDDetC:\Programmi\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE = C:\Programmi\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
@CTHelperCTHELPER.EXE = CTHELPER.EXE
@AsioRegREGSVR32.EXE /S CTASIO.DLL = REGSVR32.EXE /S CTASIO.DLL
@SBDrvDetC:\Programmi\Creative\SB Drive Det\SBDrvDet.exe /r /*file not found*/ = C:\Programmi\Creative\SB Drive Det\SBDrvDet.exe /r /*file not found*/
@UpdRegC:\WINDOWS\UpdReg.EXE = C:\WINDOWS\UpdReg.EXE
@Adobe Reader Speed Launcher"C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe" = "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"

HKCU\Software\Microsoft\Windows\CurrentVersion\Run >>>
@BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe" = "C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe"
@ctfmon.exeC:\WINDOWS\system32\ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe
@SpybotSD TeaTimerC:\Programmi\Spybot - Search & Destroy\TeaTimer.exe = C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved >>>
@{42071714-76d4-11d1-8b24-00a0c9068ff3} /*Estensione panoramica video del Pannello di controllo*/deskpan.dll /*file not found*/ = deskpan.dll /*file not found*/
@{596AB062-B4D2-4215-9F74-E9109B0A8153} /*Pagina proprietà versioni precedenti*/%SystemRoot%\system32\twext.dll = %SystemRoot%\system32\twext.dll
@{9DB7A13C-F208-4981-8353-73CC61AE2783} /*Versioni precedenti*/%SystemRoot%\system32\twext.dll = %SystemRoot%\system32\twext.dll
@{30D02401-6A81-11d0-8274-00C04FD5AE38} /*IE Search Band*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} /*Shell DocObject Viewer*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{FBF23B40-E3F0-101B-8488-00AA003E56F8} /*InternetShortcut*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{3C374A40-BAE4-11CF-BF7D-00AA006946EE} /*Microsoft Url History Service*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{FF393560-C2A7-11CF-BFF4-444553540000} /*History*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{7BD29E00-76C1-11CF-9DD0-00A0C9034933} /*Temporary Internet Files*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{7BD29E01-76C1-11CF-9DD0-00A0C9034933} /*Temporary Internet Files*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{CFBFAE00-17A6-11D0-99CB-00C04FD64497} /*Microsoft Url Search Hook*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{3DC7A020-0ACD-11CF-A9BB-00AA004AE837} /*The Internet*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{871C5380-42A0-1069-A2EA-08002B30309D} /*Internet Name Space*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{00E7B358-F65B-4dcf-83DF-CD026B94BFD4} /*Autoplay for SlideShow*/(null) =
@{692F0339-CBAA-47e6-B5B5-3B84DB604E87} /*Extensions Manager Folder*/C:\WINDOWS\system32\extmgr.dll = C:\WINDOWS\system32\extmgr.dll
@{B41DB860-8EE4-11D2-9906-E49FADC173CA} /*WinRAR shell extension*/C:\Programmi\WinRAR\rarext.dll = C:\Programmi\WinRAR\rarext.dll
@{BDEADF00-C265-11D0-BCED-00A0C90AB50F} /*Cartelle Web*/C:\PROGRA~1\FILECO~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL = C:\PROGRA~1\FILECO~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
@{42042206-2D85-11D3-8CFF-005004838597} /*Microsoft Office HTML Icon Handler*/C:\Programmi\Microsoft Office\OFFICE11\msohev.dll = C:\Programmi\Microsoft Office\OFFICE11\msohev.dll
@{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D} /*Messenger Sharing Folders*/C:\Programmi\MSN Messenger\fsshext.8.1.0178.00.dll = C:\Programmi\MSN Messenger\fsshext.8.1.0178.00.dll
@{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83} /*UnlockerShellExtension*/C:\Programmi\Unlocker\UnlockerCOM.dll = C:\Programmi\Unlocker\UnlockerCOM.dll
@{E0D79304-84BE-11CE-9641-444553540000} /*WinZip*/C:\Programmi\WinZip\wzshlstb.dll = C:\Programmi\WinZip\wzshlstb.dll
@{E0D79305-84BE-11CE-9641-444553540000} /*WinZip*/C:\Programmi\WinZip\wzshlstb.dll = C:\Programmi\WinZip\wzshlstb.dll
@{E0D79306-84BE-11CE-9641-444553540000} /*WinZip*/C:\Programmi\WinZip\wzshlstb.dll = C:\Programmi\WinZip\wzshlstb.dll
@{E0D79307-84BE-11CE-9641-444553540000} /*WinZip*/C:\Programmi\WinZip\wzshlstb.dll = C:\Programmi\WinZip\wzshlstb.dll
@{4858E7D9-8E12-45a3-B6A3-1CD128C9D403} /*TuneUp Shredder Shell Extension*/C:\Programmi\TuneUp Utilities 2007\SDShelEx-win32.dll = C:\Programmi\TuneUp Utilities 2007\SDShelEx-win32.dll
@{44440D00-FF19-4AFC-B765-9A0970567D97} /*TuneUp Theme Extension*/%SystemRoot%\system32\uxtuneup.dll = %SystemRoot%\system32\uxtuneup.dll
@ImageResizer Shell Extension /*ImageResizer Shell Extension*/(null) =
@{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2} /*NeroCoverEd Live Icons*/C:\Programmi\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll = C:\Programmi\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll
@{07C45BB1-4A8C-4642-A1F5-237E7215FF66} /*IE Microsoft BrowserBand*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{1C1EDB47-CE22-4bbb-B608-77B48F83C823} /*IE Fade Task*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{205D7A97-F16D-4691-86EF-F3075DCCA57D} /*IE Menu Desk Bar*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{3028902F-6374-48b2-8DC6-9725E775B926} /*IE AutoComplete*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{43886CD5-6529-41c4-A707-7B3C92C05E68} /*IE Navigation Bar*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{44C76ECD-F7FA-411c-9929-1B77BA77F524} /*IE Menu Site*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{4B78D326-D922-44f9-AF2A-07805C2A3560} /*IE Menu Band*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{6038EF75-ABFC-4e59-AB6F-12D397F6568D} /*IE Microsoft History AutoComplete List*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{6B4ECC4F-16D1-4474-94AB-5A763F2A54AE} /*IE Tracking Shell Menu*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{6CF48EF8-44CD-45d2-8832-A16EA016311B} /*IE IShellFolderBand*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{73CFD649-CD48-4fd8-A272-2070EA56526B} /*IE BandProxy*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{98FF6D4B-6387-4b0a-8FBD-C5C4BB17B4F8} /*IE MRU AutoComplete List*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{9A096BB5-9DC3-4D1C-8526-C3CBF991EA4E} /*IE RSS Feeder Folder*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{9D958C62-3954-4b44-8FAB-C4670C1DB4C2} /*IE Microsoft Shell Folder AutoComplete List*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{B31C5FAE-961F-415b-BAF0-E697A5178B94} /*IE Microsoft Multiple AutoComplete List Container*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{BC476F4C-D9D7-4100-8D4E-E043F6DEC409} /*Microsoft Browser Architecture*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{BFAD62EE-9D54-4b2a-BF3B-76F90697BD2A} /*IE Shell Rebar BandSite*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{E6EE9AAC-F76B-4947-8260-A9F136138E11} /*IE Shell Band Site Menu*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{F2CF5485-4E02-4f68-819C-B92DE9277049} /*&Links*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{F83DAC1C-9BB9-4f2b-B619-09819DA81B0E} /*IE Registry Tree Options Utility*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} /*IE User Assist*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{FDE7673D-2E19-4145-8376-BBD58C4BC7BA} /*IE Custom MRU AutoCompleted List*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ >>>
Cover Designer@{73FCA462-9BD5-4065-A73F-A8E5F6904EF7} = C:\Programmi\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll
TuneUp Shredder Shell Extension@{4858E7D9-8E12-45a3-B6A3-1CD128C9D403} = C:\Programmi\TuneUp Utilities 2007\SDShelEx-win32.dll
WinRAR@{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Programmi\WinRAR\rarext.dll
WinZip@{E0D79304-84BE-11CE-9641-444553540000} = C:\Programmi\WinZip\wzshlstb.dll

HKLM\Software\Classes\*\shellex\ContextMenuHandlers@{EB4D3CFE-E2AA-4C6E-B2FE-2A749F95D208} = C:\Programmi\Nero\Nero 7\Nero BackItUp\NBShell.dll

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ >>>
TuneUp Shredder Shell Extension@{4858E7D9-8E12-45a3-B6A3-1CD128C9D403} = C:\Programmi\TuneUp Utilities 2007\SDShelEx-win32.dll
WinRAR@{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Programmi\WinRAR\rarext.dll
WinZip@{E0D79304-84BE-11CE-9641-444553540000} = C:\Programmi\WinZip\wzshlstb.dll

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ >>>
ImageResizer@{2BB59FC0-31E8-42DA-9D3C-E9A52953853B} = C:\PROGRA~1\VSO\IMAGER~1\RSZShell.dll
UnlockerShellExtension@{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83} = C:\Programmi\Unlocker\UnlockerCOM.dll
WinRAR@{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Programmi\WinRAR\rarext.dll
WinZip@{E0D79304-84BE-11CE-9641-444553540000} = C:\Programmi\WinZip\wzshlstb.dll

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers@{EB4D3CFE-E2AA-4C6E-B2FE-2A749F95D208} = C:\Programmi\Nero\Nero 7\Nero BackItUp\NBShell.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects >>>
@{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll = C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
@{53707962-6F74-2D53-2644-206D7942484F}C:\PROGRA~1\SPYBOT~1\SDHelper.dll = C:\PROGRA~1\SPYBOT~1\SDHelper.dll
@{68F9551E-0411-48E4-9AAF-4BC42A6A46BE}C:\Programmi\Canon\Easy-WebPrint\EWPBrowseLoader.dll = C:\Programmi\Canon\Easy-WebPrint\EWPBrowseLoader.dll
@{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll = C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll

HKLM\Software\Microsoft\Internet Explorer\Main >>>
@Default_Page_URLhttp://go.microsoft.com/fwlink/?LinkId=69157 = http://go.microsoft.com/fwlink/?LinkId=69157
@Start Pagehttp://go.microsoft.com/fwlink/?LinkId=69157 = http://go.microsoft.com/fwlink/?LinkId=69157

HKCU\Software\Microsoft\Internet Explorer\Main@Start Page = about:blank

HKLM\Software\Classes\PROTOCOLS\Filter\text/xml@CLSID = C:\Programmi\File comuni\Microsoft Shared\OFFICE11\MSOXMLMF.DLL

HKLM\Software\Classes\PROTOCOLS\Handler\ >>>
dvd@CLSID = C:\WINDOWS\system32\msvidctl.dll
its@CLSID = C:\WINDOWS\system32\itss.dll
livecall@CLSID = C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
mhtml@CLSID = %SystemRoot%\system32\inetcomm.dll
ms-its@CLSID = C:\WINDOWS\system32\itss.dll
ms-itss@CLSID = C:\Programmi\File comuni\Microsoft Shared\Information Retrieval\MSITSS.DLL
msnim@CLSID = C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
mso-offdap@CLSID = C:\PROGRA~1\FILECO~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
mso-offdap11@CLSID = C:\PROGRA~1\FILECO~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
tv@CLSID = C:\WINDOWS\system32\msvidctl.dll

HKLM\Software\Classes\PROTOCOLS\Handler\wia@CLSID = C:\WINDOWS\system32\wiascr.dll

C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica = Utilità adattatore senza fili ZyXEL G-360.lnk

---- EOF - GMER 1.0.13 ----

[ste_95]

anche questo è pulito...

hai provato a reinstallare l'AV?

[ciccibomber]

anche questo è pulito...hai provato a reinstallare l'AV?

Si parecchie volte.....niente da fare, solo con gli AV.
Tutto il resto e' ok.

[ste_95]

scarica system scan, fai la scansione e alla fin posta il log

[ciccibomber]

scarica system scan, fai la scansione e alla fin posta il log

Eccolo
[code]SystemScan - www.suspectfile.com - ver. 3.2.2

Running on: Windows XP PROFESSIONAL Edition, Service Pack 2 (2600.5.1)
System directory: C:\WINDOWS

Date: 19/11/2007
Time: 17.56.11

Output limited to:
-Recent files
-PC accounts
-Registry Run Keys
-Autoplay settings (autorun.inf)
-Scheduled jobs
-Services and Drivers (all)
-Duplicates in BAK folders
-Svchost.exe instances
-Network settings
-Include HOSTS file
-Loaded Dlls
-Alternate Data Sreams
-Encrypted Files
-Hidden objects
-Suspicious Files
-Include hijackthis.log
-Installed Applications

===================== Accounts on this PC =====================


Users on this computer:
Is Admin? | Username
------------------
Yes | Administrator
Yes | Amministratore
| Guest (Disabled)
| HelpAssistant (Disabled)
| SUPPORT_388945a0 (Disabled)

### users folders

17/10/2007 10.17.24 (DIR) 0 byte 33 days old -- All Users
17/10/2007 10.18.20 (DIR) 0 byte 33 days old -- Default User
18/11/2007 10.47.01 (DIR) 0 byte 1 days old -- LocalService
18/11/2007 10.47.02 (DIR) 0 byte 1 days old -- NetworkService
19/11/2007 15.22.54 (DIR) 0 byte 0 days old -- Amministratore

### startup files in users folders

C:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\desktop.ini
C:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\Utilità adattatore senza fili ZyXEL G-360.lnk
C:\documents and settings\Amministratore\Menu Avvio\Programmi\Esecuzione automatica\desktop.ini
C:\documents and settings\Default User\Menu Avvio\Programmi\Esecuzione automatica\desktop.ini

===================== Recent files (60 days old)=====================

----- recent files in C:\
17/10/2007 10.18.14 0 byte 33 days old -- CONFIG.SYS
17/10/2007 10.18.14 0 byte 33 days old -- IO.SYS
17/10/2007 10.18.14 0 byte 33 days old -- MSDOS.SYS
17/10/2007 10.18.14 0 byte 33 days old -- AUTOEXEC.BAT
17/10/2007 15.27.41 (DIR) 0 byte 33 days old -- MSOCache
18/10/2007 16.21.22 146 byte 32 days old -- YServer.txt
18/10/2007 17.07.34 (DIR) 0 byte 32 days old -- WebCamGoPlus
18/10/2007 17.22.58 (DIR) 0 byte 32 days old -- WebCamGo
18/10/2007 17.23.07 (DIR) 0 byte 32 days old -- CtDriverInstTemp
21/10/2007 09.47.01 (DIR) 0 byte 29 days old -- BJPrinter
21/10/2007 22.42.57 (DIR) 0 byte 29 days old -- ATI
01/11/2007 17.38.12 211 byte 18 days old -- boot.ini
07/11/2007 14.06.36 (DIR) 0 byte 12 days old -- Ubisoft
14/11/2007 18.00.16 (DIR) 0 byte 5 days old -- RECYCLER
15/11/2007 19.39.48 (DIR) 0 byte 4 days old -- Documents and Settings
17/11/2007 21.28.59 (DIR) 0 byte 2 days old -- Config.Msi
19/11/2007 00.38.00 (DIR) 0 byte 0 days old -- System Volume Information
19/11/2007 14.47.44 4825 byte 0 days old -- InfoSat.txt
19/11/2007 14.57.02 1610612736 byte 0 days old -- pagefile.sys
19/11/2007 15.46.14 (DIR) 0 byte 0 days old -- Programmi
19/11/2007 16.53.25 (DIR) 0 byte 0 days old -- WINDOWS
19/11/2007 17.56.10 (DIR) 0 byte 0 days old -- suspectfile

----- recent files in C:\WINDOWS\
17/10/2007 10.14.37 (DIR) 0 byte 33 days old -- Cursors
17/10/2007 10.15.00 37 byte 33 days old -- vbaddin.ini
17/10/2007 10.15.00 36 byte 33 days old -- vb.ini
17/10/2007 10.15.53 (DIR) 0 byte 33 days old -- pchealth
17/10/2007 10.16.56 (DIR) 0 byte 33 days old -- srchasst
17/10/2007 10.17.11 749 byte 33 days old -- WindowsShell.Manifest
17/10/2007 10.17.16 (DIR) 0 byte 33 days old -- Offline Web Pages
17/10/2007 10.17.18 (DIR) 0 byte 33 days old -- Web
17/10/2007 10.17.58 (DIR) 0 byte 33 days old -- Registration
17/10/2007 10.18.01 4161 byte 33 days old -- ODBCINST.INI
17/10/2007 10.18.14 0 byte 33 days old -- control.ini
17/10/2007 10.18.30 (DIR) 0 byte 33 days old -- repair
17/10/2007 10.18.31 (DIR) 0 byte 33 days old -- ime
17/10/2007 10.21.11 8192 byte 33 days old -- REGLOCS.OLD
17/10/2007 11.28.27 (DIR) 0 byte 33 days old -- $MSI31Uninstall_KB893803v2$
17/10/2007 11.28.42 (DIR) 0 byte 33 days old -- $NtUninstallKB898461$
17/10/2007 11.43.30 (DIR) 0 byte 33 days old -- $NtUninstallKB873339$
17/10/2007 11.43.36 (DIR) 0 byte 33 days old -- $NtUninstallKB886185$
17/10/2007 11.43.40 (DIR) 0 byte 33 days old -- $NtUninstallKB885836$
17/10/2007 11.43.44 (DIR) 0 byte 33 days old -- $NtUninstallKB888302$
17/10/2007 11.43.48 (DIR) 0 byte 33 days old -- $NtUninstallKB887472$
17/10/2007 11.43.52 (DIR) 0 byte 33 days old -- $NtUninstallKB891781$
17/10/2007 11.43.56 (DIR) 0 byte 33 days old -- $NtUninstallKB885835$
17/10/2007 11.44.02 (DIR) 0 byte 33 days old -- $NtUninstallKB896428$
17/10/2007 11.44.06 (DIR) 0 byte 33 days old -- $NtUninstallKB901214$
17/10/2007 11.44.10 (DIR) 0 byte 33 days old -- $NtUninstallKB890859$
17/10/2007 11.44.16 (DIR) 0 byte 33 days old -- $NtUninstallKB896358$
17/10/2007 11.44.21 (DIR) 0 byte 33 days old -- $NtUninstallKB893756$
17/10/2007 11.44.25 (DIR) 0 byte 33 days old -- $NtUninstallKB899591$
17/10/2007 11.44.29 (DIR) 0 byte 33 days old -- $NtUninstallKB899587$
17/10/2007 11.44.33 (DIR) 0 byte 33 days old -- $NtUninstallKB896423$
17/10/2007 11.44.38 (DIR) 0 byte 33 days old -- $NtUninstallKB894391$
17/10/2007 11.44.45 (DIR) 0 byte 33 days old -- $NtUninstallKB902400$
17/10/2007 11.44.54 (DIR) 0 byte 33 days old -- $NtUninstallKB901017$
17/10/2007 11.44.58 (DIR) 0 byte 33 days old -- $NtUninstallKB905414$
17/10/2007 11.45.02 (DIR) 0 byte 33 days old -- $NtUninstallKB905749$
17/10/2007 11.45.07 (DIR) 0 byte 33 days old -- $NtUninstallKB900725$
17/10/2007 11.45.14 (DIR) 0 byte 33 days old -- $NtUninstallKB910437$
17/10/2007 11.45.19 (DIR) 0 byte 33 days old -- $NtUninstallKB904706$
17/10/2007 11.45.23 (DIR) 0 byte 33 days old -- $NtUninstallKB908519$
17/10/2007 11.45.28 (DIR) 0 byte 33 days old -- $NtUninstallKB911927$
17/10/2007 11.45.42 (DIR) 0 byte 33 days old -- $NtUninstallKB911564$
17/10/2007 11.45.48 (DIR) 0 byte 33 days old -- $NtUninstallKB911562$
17/10/2007 11.45.54 (DIR) 0 byte 33 days old -- $NtUninstallKB900485$
17/10/2007 11.45.59 (DIR) 0 byte 33 days old -- $NtUninstallKB908531$
17/10/2007 11.46.05 (DIR) 0 byte 33 days old -- $NtUninstallKB914389$
17/10/2007 11.46.10 (DIR) 0 byte 33 days old -- $NtUninstallKB917344$
17/10/2007 11.46.14 (DIR) 0 byte 33 days old -- $NtUninstallKB918439$
17/10/2007 11.46.19 (DIR) 0 byte 33 days old -- $NtUninstallKB913580$
17/10/2007 11.46.23 (DIR) 0 byte 33 days old -- $NtUninstallKB917953$
17/10/2007 11.46.28 (DIR) 0 byte 33 days old -- $NtUninstallKB911280$
17/10/2007 11.46.33 (DIR) 0 byte 33 days old -- $NtUninstallKB914388$
17/10/2007 11.46.37 (DIR) 0 byte 33 days old -- $NtUninstallKB920670$
17/10/2007 11.46.43 (DIR) 0 byte 33 days old -- $NtUninstallKB920683$
17/10/2007 11.46.49 (DIR) 0 byte 33 days old -- $NtUninstallKB922582$
17/10/2007 11.46.54 (DIR) 0 byte 33 days old -- $NtUninstallKB916595$
17/10/2007 11.46.58 (DIR) 0 byte 33 days old -- $NtUninstallKB919007$
17/10/2007 11.47.04 (DIR) 0 byte 33 days old -- $NtUninstallKB920685$
17/10/2007 11.47.10 (DIR) 0 byte 33 days old -- $NtUninstallKB920872$
17/10/2007 11.47.15 (DIR) 0 byte 33 days old -- $NtUninstallKB923414$
17/10/2007 11.47.21 (DIR) 0 byte 33 days old -- $NtUninstallKB924496$
17/10/2007 11.47.25 (DIR) 0 byte 33 days old -- $NtUninstallKB923191$
17/10/2007 11.47.32 (DIR) 0 byte 33 days old -- $NtUninstallKB922819$
17/10/2007 11.47.37 (DIR) 0 byte 33 days old -- $NtUninstallKB924270$
17/10/2007 11.47.47 (DIR) 0 byte 33 days old -- $NtUninstallKB923980$
17/10/2007 11.47.51 (DIR) 0 byte 33 days old -- $NtUninstallKB926255$
17/10/2007 11.47.57 (DIR) 0 byte 33 days old -- $NtUninstallKB928255$
17/10/2007 11.48.04 (DIR) 0 byte 33 days old -- $NtUninstallKB928843$
17/10/2007 11.48.08 (DIR) 0 byte 33 days old -- $NtUninstallKB927802$
17/10/2007 11.48.12 (DIR) 0 byte 33 days old -- $NtUninstallKB924667$
17/10/2007 11.48.18 (DIR) 0 byte 33 days old -- $NtUninstallKB927779$
17/10/2007 11.48.23 (DIR) 0 byte 33 days old -- $NtUninstallKB918118$
17/10/2007 11.48.27 (DIR) 0 byte 33 days old -- $NtUninstallKB926436$
17/10/2007 11.48.33 (DIR) 0 byte 33 days old -- $NtUninstallKB925902$
17/10/2007 11.48.39 (DIR) 0 byte 33 days old -- $NtUninstallKB931784$
17/10/2007 11.48.46 (DIR) 0 byte 33 days old -- $NtUninstallKB930178$
17/10/2007 11.48.49 (DIR) 0 byte 33 days old -- $NtUninstallKB931261$
17/10/2007 11.48.54 (DIR) 0 byte 33 days old -- $NtUninstallKB932168$
17/10/2007 11.48.59 (DIR) 0 byte 33 days old -- $NtUninstallKB890046$
17/10/2007 11.49.05 (DIR) 0 byte 33 days old -- $NtUninstallKB920213$
17/10/2007 11.49.08 (DIR) 0 byte 33 days old -- $NtUninstallKB930916$
17/10/2007 11.49.13 (DIR) 0 byte 33 days old -- $NtUninstallKB927891$
17/10/2007 11.49.20 (DIR) 0 byte 33 days old -- $NtUninstallKB929123$
17/10/2007 11.49.24 (DIR) 0 byte 33 days old -- $NtUninstallKB935840$
17/10/2007 11.49.29 (DIR) 0 byte 33 days old -- $NtUninstallKB935839$
17/10/2007 11.49.43 (DIR) 0 byte 33 days old -- $NtUninstallKB925398_WMP64$
17/10/2007 11.49.46 (DIR) 0 byte 33 days old -- $NtUninstallKB936357$
17/10/2007 11.49.51 (DIR) 0 byte 33 days old -- $NtUninstallKB938828$
17/10/2007 11.49.56 (DIR) 0 byte 33 days old -- $NtUninstallKB921503$
17/10/2007 11.50.02 (DIR) 0 byte 33 days old -- $NtUninstallKB938829$
17/10/2007 11.50.13 (DIR) 0 byte 33 days old -- $NtUninstallKB936782_WMP9$
17/10/2007 11.50.19 (DIR) 0 byte 33 days old -- $NtUninstallKB938127$
17/10/2007 11.50.24 (DIR) 0 byte 33 days old -- $NtUninstallKB933360$
17/10/2007 11.50.29 (DIR) 0 byte 33 days old -- $NtUninstallKB936021$
17/10/2007 11.50.41 (DIR) 0 byte 33 days old -- $NtUninstallKB923689$
17/10/2007 11.50.47 (DIR) 0 byte 33 days old -- $NtUninstallKB933729$
17/10/2007 11.50.56 (DIR) 0 byte 33 days old -- $NtUninstallKB939653$
17/10/2007 11.51.04 (DIR) 0 byte 33 days old -- $NtUninstallKB941202$
17/10/2007 12.02.27 (DIR) 0 byte 33 days old -- msagent
17/10/2007 12.04.15 (DIR) 0 byte 33 days old -- Driver Cache
17/10/2007 12.04.15 (DIR) 0 byte 33 days old -- java
17/10/2007 12.04.15 (DIR) 0 byte 33 days old -- Resources
17/10/2007 12.04.15 (DIR) 0 byte 33 days old -- msapps
17/10/2007 12.04.15 (DIR) 0 byte 33 days old -- Provisioning
17/10/2007 12.04.15 (DIR) 0 byte 33 days old -- addins
17/10/2007 12.04.15 (DIR) 0 byte 33 days old -- mui
17/10/2007 12.04.15 (DIR) 0 byte 33 days old -- Connection Wizard
17/10/2007 12.04.15 (DIR) 0 byte 33 days old -- Config
17/10/2007 12.07.02 (DIR) 0 byte 33 days old -- PeerNet
17/10/2007 12.07.11 (DIR) 0 byte 33 days old -- ehome
17/10/2007 15.27.50 (DIR) 0 byte 33 days old -- system
17/10/2007 15.34.43 (DIR) 0 byte 33 days old -- SHELLNEW
17/10/2007 15.34.51 (DIR) 0 byte 33 days old -- Fonts
17/10/2007 15.36.21 424 byte 33 days old -- ODBC.INI
17/10/2007 16.31.00 136 byte 33 days old -- SBWIN.INI
17/10/2007 16.37.06 64 byte 33 days old -- init.ini
17/10/2007 20.33.40 316640 byte 33 days old -- WMSysPr9.prx
18/10/2007 14.52.06 (DIR) 0 byte 32 days old -- Sun
18/10/2007 15.36.51 (DIR) 0 byte 32 days old -- RegisteredPackages
18/10/2007 17.25.40 (DIR) 0 byte 32 days old -- twain_32
18/10/2007 22.38.54 (DIR) 0 byte 32 days old -- security
18/10/2007 22.44.38 (DIR) 0 byte 32 days old -- $NtUninstallKB936782_WMP10$
18/10/2007 22.45.58 (DIR) 0 byte 32 days old -- pss
21/10/2007 13.29.56 (DIR) 0 byte 29 days old -- Tasks
21/10/2007 22.45.00 10 byte 29 days old -- WININIT.INI
21/10/2007 22.51.10 0 byte 29 days old -- ativpsrm.bin
23/10/2007 04.16.32 169 byte 27 days old -- RtlRack.ini
25/10/2007 10.26.48 453 byte 25 days old -- bdoscandellang.ini
25/10/2007 10.26.48 53248 byte 25 days old -- bdoscandel.exe
27/10/2007 22.50.50 5871 byte 23 days old -- DEFAULT.SRC
28/10/2007 06.10.34 (DIR) 0 byte 22 days old -- WinSxS
01/11/2007 17.38.12 227 byte 18 days old -- system.ini
09/11/2007 21.03.48 16 byte 10 days old -- popcinfo.dat
14/11/2007 22.02.45 23 byte 5 days old -- popcinfot.dat
16/11/2007 08.38.44 (DIR) 0 byte 3 days old -- $NtUninstallKB943460_0$
17/11/2007 19.59.41 69 byte 2 days old -- NeroDigital.ini
17/11/2007 21.24.12 (DIR) 0 byte 2 days old -- Installer
18/11/2007 08.29.58 0 byte 1 days old -- Sti_Trace.log
18/11/2007 10.43.15 578 byte 1 days old -- win.ini
18/11/2007 11.04.47 (DIR) 0 byte 1 days old -- AppPatch
18/11/2007 11.07.11 (DIR) 0 byte 1 days old -- SoftwareDistribution
18/11/2007 11.45.51 (DIR) 0 byte 1 days old -- $NtUninstallKB904942$
18/11/2007 11.45.57 (DIR) 0 byte 1 days old -- $NtUninstallKB914440$
18/11/2007 11.46.03 (DIR) 0 byte 1 days old -- $NtUninstallKB943460$
18/11/2007 11.46.51 (DIR) 0 byte 1 days old -- $NtUninstallKB915865$
18/11/2007 11.47.20 (DIR) 0 byte 1 days old -- $NtServicePackUninstallNLSDownlevelMapping$
18/11/2007 11.47.44 (DIR) 0 byte 1 days old -- $NtServicePackUninstallIDNMitigationAPIs$
18/11/2007 11.48.53 (DIR) 0 byte 1 days old -- ie7
18/11/2007 11.49.06 (DIR) 0 byte 1 days old -- Media
18/11/2007 11.49.11 (DIR) 0 byte 1 days old -- WBEM
18/11/2007 11.57.02 (DIR) 0 byte 1 days old -- Help
18/11/2007 13.10.42 (DIR) 0 byte 1 days old -- Debug
18/11/2007 14.34.06 (DIR) 0 byte 1 days old -- network diagnostic
18/11/2007 15.09.35 (DIR) 0 byte 1 days old -- $hf_mig$
18/11/2007 16.31.47 (DIR) 0 byte 1 days old -- ie7updates
18/11/2007 20.10.58 2356 byte 1 days old -- SchedLgU.Txt
18/11/2007 21.41.03 585791 byte 1 days old -- gmer.dll
18/11/2007 21.41.03 80 byte 1 days old -- gmer_uninstall.cmd
19/11/2007 14.57.09 2048 byte 0 days old -- bootstat.dat
19/11/2007 14.57.30 50 byte 0 days old -- wiaservc.log
19/11/2007 14.57.35 159 byte 0 days old -- wiadebug.log
19/11/2007 14.57.39 4990228 byte 0 days old -- {00000002-00000000-00000003-00001102-00000004-10071102}.CDF
19/11/2007 14.58.23 136985 byte 0 days old -- WindowsUpdate.log
19/11/2007 15.01.34 (DIR) 0 byte 0 days old -- system32
19/11/2007 15.44.00 250 byte 0 days old -- gmer.ini
19/11/2007 16.53.22 (DIR) 0 byte 0 days old -- LastGood
19/11/2007 16.53.23 (DIR) 0 byte 0 days old -- inf
19/11/2007 16.53.26 8904 byte 0 days old -- setupapi.log
19/11/2007 16.53.27 (DIR) 0 byte 0 days old -- Downloaded Program Files
19/11/2007 16.58.53 (DIR) 0 byte 0 days old -- Prefetch
19/11/2007 16.59.34 (DIR) 0 byte 0 days old -- Temp
19/11/2007 17.44.14 (DIR) 0 byte 0 days old -- BDOSCAN8

----- recent files in C:\WINDOWS\Downloaded Program Files\
25/09/2007 00.33.20 1055 byte 55 days old -- jinstall-6u3.inf
17/10/2007 10.17.16 65 byte 33 days old -- desktop.ini
25/10/2007 10.26.48 6828 byte 25 days old -- scanoptions.tsi
25/10/2007 10.26.48 32 byte 25 days old -- libfn.dll
25/10/2007 10.26.48 126 byte 25 days old -- live.ini
25/10/2007 10.26.48 6742 byte 25 days old -- lang.ini
25/10/2007 10.26.48 32 byte 25 days old -- bdcore.dll
25/10/2007 10.26.48 118784 byte 25 days old -- bdupd.dll
25/10/2007 10.26.48 53248 byte 25 days old -- ipsupd.dll
25/10/2007 16.54.18 471040 byte 25 days old -- oscan8.ocx
29/10/2007 16.45.58 1244 byte 21 days old -- oscan8.inf

----- recent files in C:\WINDOWS\system\

----- recent files in C:\WINDOWS\system32\
24/09/2007 21.30.28 135168 byte 56 days old -- java.exe
24/09/2007 21.30.30 135168 byte 56 days old -- javaw.exe
24/09/2007 22.31.42 139264 byte 56 days old -- javaws.exe
24/09/2007 22.31.42 69632 byte 56 days old -- javacpl.cpl
28/09/2007 17.05.08 12288 byte 52 days old -- DivXWMPExtType.dll
28/09/2007 17.05.34 352401 byte 52 days old -- DivXMedia.ax
28/09/2007 17.05.36 729088 byte 52 days old -- divxdec.ax
28/09/2007 17.05.40 802816 byte 52 days old -- divx_xx11.dll
28/09/2007 17.05.40 739840 byte 52 days old -- DivX.dll
28/09/2007 17.05.40 823296 byte 52 days old -- divx_xx07.dll
28/09/2007 17.05.40 823296 byte 52 days old -- divx_xx0c.dll
28/09/2007 17.05.42 294912 byte 52 days old -- dpu10.dll
28/09/2007 17.05.42 593920 byte 52 days old -- dpuGUI11.dll
28/09/2007 17.05.42 57344 byte 52 days old -- dpv11.dll
28/09/2007 17.05.42 344064 byte 52 days old -- dpus11.dll
28/09/2007 17.05.42 294912 byte 52 days old -- dpu11.dll
28/09/2007 17.05.44 53248 byte 52 days old -- dpuGUI10.dll
28/09/2007 17.05.50 416 byte 52 days old -- dpl100.dll.manifest
28/09/2007 17.05.50 81920 byte 52 days old -- dpl100.dll
28/09/2007 17.05.50 416 byte 52 days old -- dtu100.dll.manifest
28/09/2007 17.05.50 196608 byte 52 days old -- dtu100.dll
28/09/2007 17.07.44 1044480 byte 52 days old -- libdivx.dll
28/09/2007 17.07.44 200704 byte 52 days old -- ssldivx.dll
28/09/2007 17.07.48 129784 byte 52 days old -- pxafs.dll
28/09/2007 17.07.48 120056 byte 52 days old -- pxcpyi64.exe
28/09/2007 17.07.48 66296 byte 52 days old -- pxcpya64.exe
28/09/2007 17.07.48 88824 byte 52 days old -- vxblock.dll
28/09/2007 17.07.48 64760 byte 52 days old -- pxinsa64.exe
28/09/2007 17.07.48 118520 byte 52 days old -- pxinsi64.exe
28/09/2007 17.07.48 551672 byte 52 days old -- px.dll
28/09/2007 17.07.48 518904 byte 52 days old -- pxdrv.dll
28/09/2007 17.07.50 1628920 byte 52 days old -- pxsfs.dll
28/09/2007 17.07.50 379640 byte 52 days old -- pxwave.dll
28/09/2007 17.07.50 187128 byte 52 days old -- pxmas.dll
28/09/2007 17.07.50 72440 byte 52 days old -- pxhpinst.exe
28/09/2007 17.07.52 3596288 byte 52 days old -- qt-dx331.dll
28/09/2007 17.07.54 4816 byte 52 days old -- divxsm.tlb
28/09/2007 17.07.54 524288 byte 52 days old -- DivXsm.exe
28/09/2007 17.08.18 156992 byte 52 days old -- DivXCodecVersionChecker.exe
28/09/2007 20.05.00 593920 byte 52 days old -- ati2sgag.exe
29/09/2007 03.14.14 499712 byte 51 days old -- ati2cqag.dll
29/09/2007 03.14.14 499712 byte 51 days old -- SETF6.tmp
29/09/2007 03.20.14 17408 byte 51 days old -- atitvo32.dll
29/09/2007 03.22.08 376832 byte 51 days old -- atikvmag.dll
29/09/2007 03.23.23 5435392 byte 51 days old -- atioglxx.dll
29/09/2007 03.36.05 3107788 byte 51 days old -- ativvaxx.dat
29/09/2007 03.36.05 972072 byte 51 days old -- ativva6x.dat
29/09/2007 03.36.05 3107788 byte 51 days old -- ativva5x.dat
29/09/2007 03.36.24 1593600 byte 51 days old -- SETFF.tmp
29/09/2007 03.36.24 1593600 byte 51 days old -- ativvaxx.dll
29/09/2007 03.47.26 3130720 byte 51 days old -- ati3duag.dll
29/09/2007 03.47.26 3130720 byte 51 days old -- SETFC.tmp
29/09/2007 03.47.38 172032 byte 51 days old -- atiok3x2.dll
29/09/2007 03.49.19 307200 byte 51 days old -- atiiiexx.dll
29/09/2007 03.55.43 53248 byte 51 days old -- ATIDDC.DLL
29/09/2007 03.56.32 483328 byte 51 days old -- ati2evxx.exe
29/09/2007 03.56.32 483328 byte 51 days old -- SET10E.tmp
29/09/2007 03.57.55 122880 byte 51 days old -- SET111.tmp
29/09/2007 03.57.55 122880 byte 51 days old -- ati2evxx.dll
29/09/2007 03.58.07 43520 byte 51 days old -- ati2edxx.dll
29/09/2007 03.58.07 43520 byte 51 days old -- SET11A.tmp
29/09/2007 03.58.15 26112 byte 51 days old -- Ati2mdxx.exe
29/09/2007 03.58.22 122880 byte 51 days old -- Oemdspif.dll
29/09/2007 03.58.34 143360 byte 51 days old -- atipdlxx.dll
29/09/2007 04.06.17 268800 byte 51 days old -- SETF3.tmp
29/09/2007 04.06.17 268800 byte 51 days old -- ati2dvag.dll
29/09/2007 04.07.23 356352 byte 51 days old -- ATIDEMGX.dll
29/09/2007 04.21.29 9854976 byte 51 days old -- atioglx2.dll
17/10/2007 10.13.07 (DIR) 0 byte 33 days old -- spool
17/10/2007 10.14.55 (DIR) 0 byte 33 days old -- MsDtc
17/10/2007 10.15.10 21840 byte 33 days old -- emptyregdb.dat
17/10/2007 10.16.04 (DIR) 0 byte 33 days old -- Macromed
17/10/2007 10.16.36 (DIR) 0 byte 33 days old -- oobe
17/10/2007 10.17.11 749 byte 33 days old -- cdplayer.exe.manifest
17/10/2007 10.17.11 749 byte 33 days old -- sapi.cpl.manifest
17/10/2007 10.17.11 749 byte 33 days old -- ncpa.cpl.manifest
17/10/2007 10.17.11 749 byte 33 days old -- wuaucpl.cpl.manifest
17/10/2007 10.17.11 749 byte 33 days old -- nwc.cpl.manifest
17/10/2007 10.17.16 488 byte 33 days old -- logonui.exe.manifest
17/10/2007 10.17.16 488 byte 33 days old -- WindowsLogon.manifest
17/10/2007 10.17.48 (DIR) 0 byte 33 days old -- ias
17/10/2007 10.18.14 2885 byte 33 days old -- CONFIG.NT
17/10/2007 10.18.31 (DIR) 0 byte 33 days old -- xircom
17/10/2007 10.20.31 261 byte 33 days old -- $winnt$.inf
17/10/2007 10.22.39 (DIR) 0 byte 33 days old -- Microsoft
17/10/2007 10.33.53 (DIR) 0 byte 33 days old -- ReinstallBackups
17/10/2007 11.26.00 (DIR) 0 byte 33 days old -- SoftwareDistribution
17/10/2007 11.28.43 (DIR) 0 byte 33 days old -- PreInstall
17/10/2007 11.44.49 (DIR) 0 byte 33 days old -- Com
17/10/2007 11.50.24 129208 byte 33 days old -- TZLog.log
17/10/2007 12.04.15 (DIR) 0 byte 33 days old -- dhcp
17/10/2007 12.04.15 (DIR) 0 byte 33 days old -- 1042
17/10/2007 12.04.15 (DIR) 0 byte 33 days old -- 1054
17/10/2007 12.04.15 (DIR) 0 byte 33 days old -- mui
17/10/2007 12.04.15 (DIR) 0 byte 33 days old -- wins
17/10/2007 12.04.15 (DIR) 0 byte 33 days old -- 2052
17/10/2007 12.04.15 (DIR) 0 byte 33 days old -- IME
17/10/2007 12.04.15 (DIR) 0 byte 33 days old -- 1041
17/10/2007 12.04.15 (DIR) 0 byte 33 days old -- ShellExt
17/10/2007 12.04.15 (DIR) 0 byte 33 days old -- inetsrv
17/10/2007 12.04.15 (DIR) 0 byte 33 days old -- 1028
17/10/2007 12.04.15 (DIR) 0 byte 33 days old -- 1025
17/10/2007 12.04.15 (DIR) 0 byte 33 days old -- 3com_dmi
17/10/2007 12.04.15 (DIR) 0 byte 33 days old -- 1031
17/10/2007 12.04.15 (DIR) 0 byte 33 days old -- 3076
17/10/2007 12.04.15 (DIR) 0 byte 33 days old -- 1037
17/10/2007 12.04.15 (DIR) 0 byte 33 days old -- export
17/10/2007 12.04.59 (DIR) 0 byte 33 days old -- 1033
17/10/2007 12.05.16 (DIR) 0 byte 33 days old -- icsxml
17/10/2007 12.05.20 (DIR) 0 byte 33 days old -- ras
17/10/2007 12.05.27 (DIR) 0 byte 33 days old -- 1040
17/10/2007 12.06.55 (DIR) 0 byte 33 days old -- npp
17/10/2007 12.07.17 (DIR) 0 byte 33 days old -- usmt
17/10/2007 12.07.23 (DIR) 0 byte 33 days old -- Setup
17/10/2007 12.12.47 0 byte 33 days old -- h323log.txt
17/10/2007 16.29.24 184 byte 33 days old -- e000001.dat
17/10/2007 16.29.59 (DIR) 0 byte 33 days old -- Data
17/10/2007 16.30.53 (DIR) 0 byte 33 days old -- Defaults
18/10/2007 14.50.29 5677 byte 32 days old -- jupdate-1.6.0_03-b05.log
18/10/2007 15.36.36 23392 byte 32 days old -- nscompat.tlb
18/10/2007 15.36.36 16832 byte 32 days old -- amcompat.tlb
18/10/2007 16.36.48 (DIR) 0 byte 32 days old -- DRVSTORE
21/10/2007 13.32.47 10752 byte 29 days old -- BASSMOD.dll
25/10/2007 17.42.45 8489472 byte 25 days old -- shell32.dll
25/10/2007 20.32.38 (DIR) 0 byte 25 days old -- DirectX
25/10/2007 22.17.14 (DIR) 0 byte 25 days old -- appmgmt
29/10/2007 16.07.18 366592 byte 21 days old -- xpsp3res.dll
02/11/2007 08.12.57 18238072 byte 17 days old -- MRT.exe
06/11/2007 08.37.50 227592 byte 13 days old -- PDBoot.exe
13/11/2007 14.07.14 108144 byte 6 days old -- CmdLineExt.dll
18/11/2007 01.44.15 (DIR) 0 byte 1 days old -- Tools
18/11/2007 10.31.33 1406 byte 1 days old -- Help.ico
18/11/2007 10.31.33 2550 byte 1 days old -- Uninstall.ico
18/11/2007 10.43.25 0 byte 1 days old -- asfiles.txt
18/11/2007 11.09.34 (DIR) 0 byte 1 days old -- wbem
18/11/2007 11.46.05 (DIR) 0 byte 1 days old -- CatRoot
18/11/2007 11.47.52 2206 byte 1 days old -- wpa.dbl
18/11/2007 11.49.16 (DIR) 0 byte 1 days old -- config
18/11/2007 11.49.55 (DIR) 0 byte 1 days old -- it-it
18/11/2007 16.31.48 (DIR) 0 byte 1 days old -- dllcache
18/11/2007 18.29.36 239144 byte 1 days old -- FNTCACHE.DAT
18/11/2007 20.11.19 30168 byte 1 days old -- BMXBkpCtrlState-{00000002-00000000-00000003-00001102-00000004-10071102}.rfx
18/11/2007 20.11.19 292 byte 1 days old -- DVCState-{00000002-00000000-00000003-00001102-00000004-10071102}.dat
18/11/2007 20.11.19 292 byte 1 days old -- DVCStateBkp-{00000002-00000000-00000003-00001102-00000004-10071102}.dat
18/11/2007 20.11.19 30168 byte 1 days old -- BMXCtrlState-{00000002-00000000-00000003-00001102-00000004-10071102}.rfx
18/11/2007 20.11.19 30132 byte 1 days old -- BMXStateBkp-{00000002-00000000-00000003-00001102-00000004-10071102}.rfx
18/11/2007 20.11.19 30132 byte 1 days old -- BMXState-{00000002-00000000-00000003-00001102-00000004-10071102}.rfx
18/11/2007 20.11.19 1080 byte 1 days old -- settingsbkup.sfm
18/11/2007 20.11.19 1080 byte 1 days old -- settings.sfm
18/11/2007 21.41.03 (DIR) 0 byte 1 days old -- drivers
18/11/2007 22.27.14 (DIR) 0 byte 1 days old -- Kaspersky Lab
19/11/2007 13.21.53 (DIR) 0 byte 0 days old -- Restore
19/11/2007 14.57.41 280 byte 0 days old -- PDBootState
19/11/2007 15.01.34 47592 byte 0 days old -- perfc010.dat
19/11/2007 15.01.34 39992 byte 0 days old -- perfc009.dat
19/11/2007 15.01.34 311604 byte 0 days old -- perfh009.dat
19/11/2007 15.01.34 751592 byte 0 days old -- PerfStringBackup.INI
19/11/2007 15.01.34 345010 byte 0 days old -- perfh010.dat
19/11/2007 16.53.22 (DIR) 0 byte 0 days old -- CatRoot2

----- recent files in C:\WINDOWS\system32\drivers\
29/09/2007 03.19.30 49152 byte 51 days old -- ati2erec.dll
29/09/2007 04.05.59 2456064 byte 51 days old -- ati2mtag.sys
29/09/2007 06.46.52 47376 byte 51 days old -- ativvpxx.vp
17/10/2007 12.04.15 (DIR) 0 byte 33 days old -- disdn
18/10/2007 20.13.50 8320 byte 32 days old -- AWRTRD.sys
18/10/2007 20.13.52 9344 byte 32 days old -- NSDriver.sys
22/10/2007 05.33.40 68624 byte 28 days old -- DefragFs.sys
25/10/2007 17.08.57 47360 byte 25 days old -- pcouffin.sys
25/10/2007 20.01.25 685816 byte 25 days old -- sptd.sys
18/11/2007 19.38.05 (DIR) 0 byte 1 days old -- etc
18/11/2007 21.41.03 70001 byte 1 days old -- gmer.sys

----- recent files in C:\WINDOWS\temp\
19/11/2007 15.49.34 (DIR) 0 byte 0 days old -- a2temp

----- recent files in C:\Programmi\
17/10/2007 10.14.30 (DIR) 0 byte 33 days old -- Windows NT
17/10/2007 10.14.41 (DIR) 0 byte 33 days old -- MSN Gaming Zone
17/10/2007 10.15.01 (DIR) 0 byte 33 days old -- ComPlus Applications
17/10/2007 10.16.00 (DIR) 0 byte 33 days old -- Movie Maker
17/10/2007 10.16.14 (DIR) 0 byte 33 days old -- NetMeeting
17/10/2007 10.17.03 (DIR) 0 byte 33 days old -- Servizi in linea
17/10/2007 10.17.07 (DIR) 0 byte 33 days old -- WindowsUpdate
17/10/2007 10.18.31 (DIR) 0 byte 33 days old -- xerox
17/10/2007 10.18.31 (DIR) 0 byte 33 days old -- microsoft frontpage
17/10/2007 10.23.23 (DIR) 0 byte 33 days old -- Uninstall Information
17/10/2007 10.34.19 (DIR) 0 byte 33 days old -- Intel
17/10/2007 10.41.15 (DIR) 0 byte 33 days old -- AvRack
17/10/2007 10.41.15 (DIR) 0 byte 33 days old -- Realtek Sound Manager
17/10/2007 11.43.49 (DIR) 0 byte 33 days old -- Messenger
17/10/2007 11.49.21 (DIR) 0 byte 33 days old -- Outlook Express
17/10/2007 15.33.55 (DIR) 0 byte 33 days old -- Microsoft Visual Studio
17/10/2007 15.34.02 (DIR) 0 byte 33 days old -- Microsoft Works
17/10/2007 15.34.07 (DIR) 0 byte 33 days old -- Microsoft Office
17/10/2007 15.34.45 (DIR) 0 byte 33 days old -- Microsoft.NET
17/10/2007 15.50.04 (DIR) 0 byte 33 days old -- CyberLink DVD Solution
17/10/2007 15.50.06 (DIR) 0 byte 33 days old -- CyberLink
17/10/2007 16.31.12 (DIR) 0 byte 33 days old -- Creative
17/10/2007 16.37.07 (DIR) 0 byte 33 days old -- Funk Software
17/10/2007 16.37.55 (DIR) 0 byte 33 days old -- ZyXEL
17/10/2007 20.34.46 (DIR) 0 byte 33 days old -- Winamp
17/10/2007 21.02.07 (DIR) 0 byte 33 days old -- VideoLAN
18/10/2007 14.50.29 (DIR) 0 byte 32 days old -- Java
18/10/2007 15.36.50 (DIR) 0 byte 32 days old -- Windows Media Player
18/10/2007 16.20.58 (DIR) 0 byte 32 days old -- Yahoo!
18/10/2007 16.36.28 (DIR) 0 byte 32 days old -- MSN Messenger
18/10/2007 18.21.51 (DIR) 0 byte 32 days old -- DivX
18/10/2007 20.00.28 (DIR) 0 byte 32 days old -- Lavasoft
19/10/2007 22.28.59 (DIR) 0 byte 31 days old -- AC3Filter
21/10/2007 10.00.34 (DIR) 0 byte 29 days old -- Canon
21/10/2007 14.05.41 (DIR) 0 byte 29 days old -- Google
21/10/2007 22.45.09 (DIR) 0 byte 29 days old -- ATI Technologies
24/10/2007 17.22.23 (DIR) 0 byte 26 days old -- SoftUncloner
25/10/2007 14.57.49 (DIR) 0 byte 25 days old -- Raxco
25/10/2007 17.08.53 (DIR) 0 byte 25 days old -- VSO
25/10/2007 20.09.29 (DIR) 0 byte 25 days old -- Alcohol Soft
25/10/2007 23.04.34 (DIR) 0 byte 25 days old -- Nero
25/10/2007 23.14.47 (DIR) 0 byte 25 days old -- GoldEsel
25/10/2007 23.14.59 (DIR) 0 byte 25 days old -- Ahead
28/10/2007 06.10.34 (DIR) 0 byte 22 days old -- MSXML 4.0
01/11/2007 14.58.39 (DIR) 0 byte 18 days old -- File comuni
01/11/2007 14.58.39 (DIR) 0 byte 18 days old -- Adobe
03/11/2007 11.01.03 (DIR) 0 byte 16 days old -- Tunatic
06/11/2007 11.46.03 (DIR) 0 byte 13 days old -- Ubisoft
15/11/2007 19.39.50 (DIR) 0 byte 4 days old -- Grisoft
17/11/2007 23.44.33 (DIR) 0 byte 2 days old -- CCleaner
18/11/2007 08.50.40 (DIR) 0 byte 1 days old -- InstallShield Installation Information
18/11/2007 11.02.50 (DIR) 0 byte 1 days old -- TuneUp Utilities 2007
18/11/2007 11.03.11 (DIR) 0 byte 1 days old -- Unlocker
18/11/2007 11.03.39 (DIR) 0 byte 1 days old -- WinRAR
18/11/2007 11.03.44 (DIR) 0 byte 1 days old -- WinZip
18/11/2007 11.57.02 (DIR) 0 byte 1 days old -- Internet Explorer
18/11/2007 18.40.56 (DIR) 0 byte 1 days old -- Spybot - Search & Destroy
19/11/2007 00.35.35 (DIR) 0 byte 0 days old -- AdunanzA
19/11/2007 12.05.24 (DIR) 0 byte 0 days old -- Steam
19/11/2007 16.55.01 (DIR) 0 byte 0 days old -- a-squared Free

----- recent files in C:\Programmi\File comuni\
17/10/2007 10.16.08 (DIR) 0 byte 33 days old -- MSSoap
17/10/2007 10.16.13 (DIR) 0 byte 33 days old -- Services
17/10/2007 11.49.20 (DIR) 0 byte 33 days old -- System
17/10/2007 12.09.22 (DIR) 0 byte 33 days old -- SpeechEngines
17/10/2007 12.09.25 (DIR) 0 byte 33 days old -- ODBC
17/10/2007 15.34.05 (DIR) 0 byte 33 days old -- DESIGNER
17/10/2007 15.34.52 (DIR) 0 byte 33 days old -- Microsoft Shared
18/10/2007 14.42.51 (DIR) 0 byte 32 days old -- Java
21/10/2007 13.28.54 (DIR) 0 byte 29 days old -- Wise Installation Wizard
23/10/2007 20.06.11 (DIR) 0 byte 27 days old -- Raxco
25/10/2007 23.14.09 (DIR) 0 byte 25 days old -- InstallShield
27/10/2007 23.39.41 (DIR) 0 byte 23 days old -- Ahead
01/11/2007 14.58.57 (DIR) 0 byte 18 days old -- Adobe
18/11/2007 10.55.36 (DIR) 0 byte 1 days old -- Funk Software
18/11/2007 10.55.45 (DIR) 0 byte 1 days old -- LightScribe

----- recent files in C:\Documents and Settings\Amministratore\Dati applicazioni\
17/10/2007 10.23.25 (DIR) 0 byte 33 days old -- Identities
17/10/2007 10.49.10 (DIR) 0 byte 33 days old -- Adobe
17/10/2007 10.52.32 (DIR) 0 byte 33 days old -- Help
17/10/2007 12.08.52 62 byte 33 days old -- desktop.ini
17/10/2007 20.36.09 (DIR) 0 byte 33 days old -- Winamp
17/10/2007 21.03.16 (DIR) 0 byte 33 days old -- vlc
18/10/2007 14.52.06 (DIR) 0 byte 32 days old -- Sun
18/10/2007 18.25.07 (DIR) 0 byte 32 days old -- WinRAR
18/10/2007 18.30.21 (DIR) 0 byte 32 days old -- DivX
21/10/2007 11.29.52 (DIR) 0 byte 29 days old -- Google
21/10/2007 13.29.34 (DIR) 0 byte 29 days old -- TuneUp Software
21/10/2007 14.20.18 (DIR) 0 byte 29 days old -- Microsoft
25/10/2007 17.08.57 47360 byte 25 days old -- pcouffin.sys
25/10/2007 17.08.57 7887 byte 25 days old -- pcouffin.cat
25/10/2007 17.08.57 87608 byte 25 days old -- inst.exe
25/10/2007 17.08.57 1144 byte 25 days old -- pcouffin.inf
25/10/2007 17.09.05 34 byte 25 days old -- pcouffin.log
25/10/2007 19.28.46 (DIR) 0 byte 25 days old -- Vso
27/10/2007 22.36.38 (DIR) 0 byte 23 days old -- Real
27/10/2007 22.42.19 (DIR) 0 byte 23 days old -- Ahead
15/11/2007 19.39.49 (DIR) 0 byte 4 days old -- Macromedia

----- recent files in C:\DOCUME~1\AMMINI~1\IMPOST~1\Temp\
19/11/2007 17.54.35 16384 byte 0 days old -- ~DF1BFE.tmp
19/11/2007 17.56.11 (DIR) 0 byte 0 days old -- nsd19.tmp

===================== Duplicates in BAK folders =====================

No BAK folders found

===================== REGISTRY SCAN =====================


-----HKLM\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]
"SoundMan"="SOUNDMAN.EXE"
"CTSysVol"="C:\Programmi\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe"
"CTDVDDet"="C:\Programmi\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE"
"CTHelper"="CTHELPER.EXE"
"AsioReg"="REGSVR32.EXE /S CTASIO.DLL"
"SBDrvDet"="C:\Programmi\Creative\SB Drive Det\SBDrvDet.exe /r"
"Adobe Reader Speed Launcher"=""C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe""

[Run\OptionalComponents]
@=""

[Run\OptionalComponents\IMAIL]
"Installed"="1"
@=""

[Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"
@=""

[Run\OptionalComponents\MSFS]
"Installed"="1"
@=""

-----HKCU\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=""C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe""
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe"
"SpybotSD TeaTimer"="C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe"

-----HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE"

-----HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run-----

-----HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows-----

[Windows]
"AppInit_DLLs"=""

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad-----

[ShellServiceObjectDelayLoad]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
#### HKCR\CLSID\{7849596a-48ea-486e-8937-a2a3009f31a9}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
#### HKCR\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
#### HKCR\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32 @=expand:"C:\WINDOWS\system32\webcheck.dll"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
#### HKCR\CLSID\{35CEC8A3-2BE6-11D2-8773-92E220524153}\InprocServer32 @="C:\WINDOWS\system32\stobject.dll"

-----HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks-----

[ShellExecuteHooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
#### HKCR\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\InprocServer32 @="shell32.dll"

-----HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon-----

[Winlogon]
"Shell"="Explorer.exe"
"System"=""
"Userinit"="C:\WINDOWS\system32\userinit.exe,"
"VmApplet"="rundll32 shell32,Control_RunDLL "sysdm.cpl""
"UIHost"=expand:"logonui.exe"
"LogonType"=dword:00000001
"WinStationsDisabled"="0"

[Winlogon\GPExtensions]

[Winlogon\GPExtensions\{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}]
"@="Senza fili"
"DllName"=expand:"gptext.dll"

[Winlogon\GPExtensions\{25537BA6-77A8-11D2-9B6C-0000F8080861}]
"@="Folder Redirection"
"DllName"=expand:"fdeploy.dll"

[Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}]
"@="Quota disco Microsoft"
"DllName"=expand:"dskquota.dll"

[Winlogon\GPExtensions\{426031c0-0b47-4852-b0ca-ac3d37bfcb39}]
"@="Utilità di pianificazione pacchetti QoS"
"DllName"=expand:"gptext.dll"

[Winlogon\GPExtensions\{42B5FAAE-6536-11d2-AE5A-0000F87571E3}]
"@="Script"
"DllName"=expand:"gptext.dll"

[Winlogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}]
"@="Internet Explorer Zonemapping"
"DllName"=expand:"iedkcs32.dll"

[Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}]
"DllName"=expand:"scecli.dll"
"@="Security"

[Winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}]
"DllName"="iedkcs32.dll"
"@="Internet Explorer Branding"

[Winlogon\GPExtensions\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}]
"DllName"=expand:"scecli.dll"
"@="EFS recovery"

[Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}]
"@="Microsoft Offline Files"
"DllName"=expand:"%SystemRoot%\System32\cscui.dll"

[Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}]
"@="Installazione software"
"DllName"=expand:"appmgmts.dll"

[Winlogon\GPExtensions\{e437bc1c-aa7d-11d2-a382-00c04f991e27}]
"@="Protezione IP"
"DllName"=expand:"gptext.dll"

[Winlogon\Notify]

[Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"

[Winlogon\Notify\crypt32chain]
"DllName"=expand:"crypt32.dll"

[Winlogon\Notify\cryptnet]
"DllName"=expand:"cryptnet.dll"

[Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"

[Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"

[Winlogon\Notify\Schedule]
"DllName"=expand:"wlnotify.dll"

[Winlogon\Notify\sclgntfy]
"DllName"=expand:"sclgntfy.dll"

[Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"

[Winlogon\Notify\termsrv]
"DllName"=expand:"wlnotify.dll"

[Winlogon\Notify\WgaLogon]

[Winlogon\Notify\WgaLogon\Settings]

[Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"

[Winlogon\SpecialAccounts]

[Winlogon\SpecialAccounts\UserList]
"HelpAssistant"=dword:00000000
"TsInternetUser"=dword:00000000
"SQLAgentCmdExec"=dword:00000000
"NetShowServices"=dword:00000000
"IWAM_"=dword:00010000
"IUSR_"=dword:00010000
"VUSR_"=dword:00010000

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon-----

[Winlogon]
"ParseAutoexec"="1"
"ExcludeProfileDirs"="Impostazioni locali;Temporary Internet Files;Cronologia;Temp"
"BuildNumber"=dword:00000a28

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options-----

[Image File Execution Options\Your Image File Name Here without a path]
"Debugger"="ntsd -d"

-----HKLM\System\CurrentControlSet\Control\Session Manager\-----

[Session Manager]
"BootExecute"=multi:"PDBoot.exe\00autocheck autochk *\00lsdelete\00\00"

[Session Manager\SubSystems]
"Windows"=expand:"%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16"

-----HKLM\SYSTEM\CurrentControlSet\Control\WOW-----

[WOW]
"cmdline"=expand:"%SystemRoot%\system32\ntvdm.exe"
"wowcmdline"=expand:"%SystemRoot%\system32\ntvdm.exe -a %SystemRoot%\system32\krnl386"

-----HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run-----

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce-----

[RunOnce]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx-----

[RunOnceEx]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices-----

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce-----

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce-----

[RunOnce]

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx-----

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices-----

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run-----

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce-----

-----HKLM\Software\Microsoft\Command Processor\Autorun-----

-----HKCU\Software\Microsoft\Command Processor\Autorun-----

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load-----

-----HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Startup-----

-----HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logon-----

-----HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Logon-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Runonce-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Run-----

-----HKLM\System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\StartupPrograms-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Runonce-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler-----

[SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Precaricatore Browseui"
#### HKCR\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InprocServer32 @=expand:"%SystemRoot%\system32\browseui.dll"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Daemon di cache delle categorie di componenti"
#### HKCR\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InprocServer32 @=expand:"%SystemRoot%\system32\browseui.dll"

-----HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects-----

[Browser Helper Objects]

[Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
@=""

[Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
#### HKCR\CLSID\{53707962-6F74-2D53-2644-206D7942484F}\InprocServer32 @="C:\PROGRA~1\SPYBOT~1\SDHelper.dll"

[Browser Helper Objects\{68F9551E-0411-48E4-9AAF-4BC42A6A46BE}]
#### HKCR\CLSID\{68F9551E-0411-48E4-9AAF-4BC42A6A46BE}\InprocServer32 @="C:\Programmi\Canon\Easy-WebPrint\EWPBrowseLoader.dll"
@="Canon Easy Web Print Helper"

[Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
#### HKCR\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\InprocServer32 @="C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll"
"NoExplorer"=dword:00000001

-----HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks-----

[URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""
#### HKCR\CLSID\{CFBFAE00-17A6-11D0-99CB-00C04FD64497}\InprocServer32 @="C:\WINDOWS\system32\ieframe.dll"

-----HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder-----

[startupfolder]

[startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^Adobe Reader Synchronizer.lnk]
"location"="Common Startup"
"command"="C:\PROGRA~1\Adobe\READER~1.0\Reader\ADOBEC~1.EXE "
"item"="Adobe Reader Synchronizer"

[startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^Avvio veloce di Adobe Reader.lnk]
"location"="Common Startup"
"command"="C:\PROGRA~1\Adobe\READER~1.0\Reader\READER~1.EXE "
"item"="Avvio veloce di Adobe Reader"

-----HKCU\Control Panel\Desktop\-----

[Desktop]

[Desktop\WindowMetrics]

-----HKEY_CLASSES_ROOT\exefile\shell\open\command-----

[command]
@=""%1" %*"

-----HKEY_CLASSES_ROOT\comfile\shell\open\command-----

[command]
@=""%1" %*"

-----HKEY_CLASSES_ROOT\batfile\shell\open\command-----

[command]
@=""%1" %*"

-----HKEY_CLASSES_ROOT\piffile\shell\open\command-----

[command]
@=""%1" %*"

-----HKEY_CLASSES_ROOT\scrFile\shell\open\command-----

[command]
@=""%1" /S"

-----HKEY_CLASSES_ROOT\htafile\shell\open\command-----

[Command]
@="C:\WINDOWS\system32\mshta.exe "%1" %*"

-----HKEY_CLASSES_ROOT\logfile\shell\open\command-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL-----

[URL]

[URL\DefaultPrefix]
@="http://"

[URL\Prefixes]
"ftp"="ftp://"
"gopher"="gopher://"
"home"="http://"
"mosaic"="http://"
"www"="http://"

-----HKLM\SYSTEM\CurrentControlSet\Control\Lsa-----

[Lsa]

[Lsa\AccessProviders]

[Lsa\AccessProviders\Windows NT Access Provider]
"ProviderPath"=expand:"%SystemRoot%\system32\ntmarta.dll"

[Lsa\Audit]

[Lsa\Audit\PerUserAuditing]

[Lsa\Audit\PerUserAuditing\System]

[Lsa\Data]

[Lsa\SSO]

[Lsa\SSO\Passport1.4]
"SSOURL"="http://www.passport.com"

[Lsa\SspiCache]

[Lsa\SspiCache\digest.dll]
"Name"="Digest"
"Comment"="Digest SSPI Authentication Package"

[Lsa\SspiCache\msapsspc.dll]
"Name"="DPA"
"Comment"="DPA Security Package"

[Lsa\SspiCache\msnsspc.dll]
"Name"="MSN"
"Comment"="MSN Security Package"

-----HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess-----

[SharedAccess]
"DependOnGroup"=multi:"\00"
"DependOnService"=multi:"Netman\00WinMgmt\00\00"
"Description"="Fornisce servizi di conversione indirizzi di rete, indirizzamento e risoluzione nomi e/o servizi di prevenzione intrusione per una rete domestica o una piccola rete aziendale."
"DisplayName"="Windows Firewall / Condivisione connessione Internet (ICS)"
"ErrorControl"=dword:00000001
"ImagePath"=expand:"%SystemRoot%\system32\svchost.exe -k netsvcs"
"ObjectName"="LocalSystem"
"Start"=dword:00000002
"Type"=dword:00000020

[SharedAccess\Epoch]
"Epoch"=dword:000002f4

[SharedAccess\Parameters]
"ServiceDll"=expand:"%SystemRoot%\System32\ipnathlp.dll"

[SharedAccess\Parameters\FirewallPolicy]

[SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications]

[SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enaxxxxx@xxxxxres.dll,-22019"
"C:\Programmi\MSN Messenger\msnmsgr.exe"="C:\Programmi\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Programmi\MSN Messenger\livecall.exe"="C:\Programmi\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000"

[SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=dword:00000000

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications]

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enaxxxxx@xxxxxres.dll,-22019"
"C:\Programmi\Yahoo!\Messenger\YahooMessenger.exe"="C:\Programmi\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\Programmi\Yahoo!\Messenger\YServer.exe"="C:\Programmi\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\Programmi\MSN Messenger\msnmsgr.exe"="C:\Programmi\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Programmi\MSN Messenger\livecall.exe"="C:\Programmi\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000"

[SharedAccess\Setup]
"ServiceUpgrade"=dword:00000001

[SharedAccess\Setup\InterfacesUnfirewalledAtUpdate]
"All"=dword:00000001

-----HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Firewall\-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Winsock2-----

-----HKLM\Software\Microsoft\Ole-----

[Ole]
"DefaultLaunchPermission"=hex:01,00,04,80,5c,00,00,00,6c,00,00,00,00,00,00,00,\
"MachineLaunchRestriction"=hex:01,00,04,80,48,00,00,00,58,00,00,00,00,00,00,00,\
"MachineAccessRestriction"=hex:01,00,04,80,44,00,00,00,54,00,00,00,00,00,00,00,\
"EnableDCOM"="Y"

[Ole\AppCompat]

[Ole\AppCompat\ActivationSecurityCheckExemptionList]
"{A50398B8-9075-4FBF-A7A1-456BF21937AD}"="1"
"{AD65A69D-3831-40D7-9629-9B0B50A93843}"="1"
"{0040D221-54A1-11D1-9DE0-006097042D69}"="1"
"{2A6D72F1-6E7E-4702-B99C-E40D3DED33C3}"="1"

-----HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\-----

[Security Center]
"FirstRunDisabled"=dword:00000001
"AntiVirusDisableNotify"=dword:00000000
"FirewallDisableNotify"=dword:00000000
"UpdatesDisableNotify"=dword:00000000
"AntiVirusOverride"=dword:00000000
"FirewallOverride"=dword:00000000

[Security Center\Monitoring]

[Security Center\Monitoring\AhnlabAntiVirus]

[Security Center\Monitoring\ComputerAssociatesAntiVirus]

[Security Center\Monitoring\KasperskyAntiVirus]

[Security Center\Monitoring\McAfeeAntiVirus]

[Security Center\Monitoring\McAfeeFirewall]

[Security Center\Monitoring\PandaAntiVirus]
"DisableMonitoring"=dword:00000000

[Security Center\Monitoring\PandaFirewall]

[Security Center\Monitoring\SophosAntiVirus]

[Security Center\Monitoring\SymantecAntiVirus]

[Security Center\Monitoring\SymantecFirewall]

[Security Center\Monitoring\TinyFirewall]

[Security Center\Monitoring\TrendAntiVirus]

[Security Center\Monitoring\TrendFirewall]

[Security Center\Monitoring\ZoneLabsFirewall]

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\-----

[SystemRestore]
"DisableSR"=dword:00000001
"CreateFirstRunRp"=dword:00000001
"DSMin"=dword:000000c8
"DSMax"=dword:00000190
"RPSessionInterval"=dword:00000000
"RPGlobalInterval"=dword:00015180
"RPLifeInterval"=dword:0076a700
"CompressionBurst"=dword:0000003c
"TimerInterval"=dword:00000078
"DiskPercent"=dword:0000000c
"ThawInterval"=dword:00000384
"RestoreDiskSpaceError"=dword:00000000

[SystemRestore\Cfg]
"DiskPercent"=dword:0000000c
"MachineGuid"="{F0780216-5059-4B67-B4B7-63127638B4D6}"

[SystemRestore\SnapshotCallbacks]
@=""

-----HKEY_CURRENT_USER\Software\VB and VBA Program Settings-----

[VB and VBA Program Settings]

[VB and VBA Program Settings\CCleaner]

[VB and VBA Program Settings\CCleaner\Options]

[VB and VBA Program Settings\Euro Add-in]

[VB and VBA Program Settings\Euro Add-in\Wizard Options]

-----HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions-----

[AdvancedOptions]

-----HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions-----

-----HKLM\Software\Microsoft\Active Setup\Installed Components-----

[Installed Components]

[Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
"@="IE7 Uninstall Stub"
"ComponentID"="IEUDINIT"
"StubPath"="C:\WINDOWS\system32\ieudinit.exe"

[Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
#### HKCR\CLSID\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll"
"Stubpath"="C:\WINDOWS\inf\unregmp2.exe /ShowWMP"
"@="Microsoft Windows Media Player"
"ComponentID"="WMPACCESS"

[Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
"@="Internet Explorer"
"ComponentID"="IEACCESS"
"StubPath"="C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig"

[Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"@="Browser Customizations"
"ComponentiD"="BRANDING.CAB"
"StubPath"="RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP"

[Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
"@="Personalizzazione del browser"
"ComponentID"="BRANDING.CAB"
"StubPath"="RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP"

[Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
"@="Outlook Express"
"ComponentID"="OEACCESS"
"StubPath"=expand:"%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE"

[Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
"@="Java (Sun)"
"ComponentID"="JAVAVM"
"KeyFileName"="C:\Programmi\Java\jre1.6.0_03\bin\regutils.dll"

[Installed Components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}]
"@="Rendering grafica vettoriale (VML)"
"ComponentID"="MSVML"

[Installed Compone

[ste_95]

metti il log pe rintero qui:

www.freefilehosting.net

riesci a entrare in provvisoria?

[ciccibomber]

In modalita' provvisoria male ( 3 volte su 5 non entro) pero' sono riuscito ad installare Antivir.
Ecco il link con il log:
http://www.freefilehosting.net/download/Mzc0Njg=