Help AVG non funziona più e...

[R3wu0]

So che sembrerà assurdo ad alcuni ma da ieri sera, dopo aver riavviato il in quanto avevo installato photoshop CS4, ho soperto con orrore che AVG 8.5 FREE non funziona più, ho provato a reistallarlo ma nulla, ho provato la scansione con Windows defender e Malwarebytes ma nulla anzi con quest'ultimo il pc si riavvia con blue screen. Ho provato a fare una scnasione con 3 diversi titpi di antivirus on line ma nessuno dei tre ha funzionato, nel senso che non hanno nemmeno iniziato la scansione...davano errore.
ora la mia domanda è che fare?! Cosa mi consigliate?

[crazy.cat]

Ti sei preso un virus?

Prova a usare combofix e postarne il log, e magari una scansione anche con questo http://www.MegaLab.it/2894/kaspersky-virus-removal-tool.

[R3wu0]

Ok ho eseguito combofix e in allegato c'è il log, cose puoi dirmi da quello?
Ora provo con kaspersky e poi ti dico?

ComboFix 09-08-04.01 - Enrico 04/08/2009 19.29.17.1.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.39.1040.18.1791.743 [GMT 2:00]
Eseguito da: c:\users\Enrico\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
SP: AVG Anti-Virus Free *enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2152478756-3922319563-605102323-500
c:\users\Enrico\AppData\Local\emaao_nav.dat
c:\users\Enrico\AppData\Local\oeqagak.dat
c:\users\Enrico\AppData\Local\oeqagak_nav.dat
c:\users\Enrico\AppData\Local\oeqagak_navps.dat
c:\users\Enrico\AppData\Roaming\Drivers\11s11ro1s1a2.sys
c:\users\Enrico\AppData\Roaming\drivers\downld
c:\users\Enrico\AppData\Roaming\drivers\downld\128544.exe
c:\users\Enrico\AppData\Roaming\drivers\downld\15120880.exe
c:\users\Enrico\AppData\Roaming\drivers\downld\698775.exe
c:\users\Enrico\AppData\Roaming\drivers\downld\699399.exe
c:\users\Enrico\AppData\Roaming\drivers\downld\699414.exe
c:\users\Enrico\AppData\Roaming\inst.exe
c:\windows\system32\ban_list.txt

.
((((((((((((((((((((((((((((((((((((((( Driver/Servizi )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_111111S1RO1S1A
-------\Legacy_111111S1RO1S1A
-------\Legacy_111111S1RO1S1A
-------\Legacy_SK9OU0S


((((((((((((((((((((((((( Files Creati Da 2009-07-04 al 2009-08-04 )))))))))))))))))))))))))))))))))))
.

2009-08-04 17:10 . 2009-08-04 17:10 -------- d-----w- c:\programdata\is-UFTD0
2009-08-04 14:06 . 2009-08-04 14:06 -------- d-----w- c:\programdata\is-D4DIU
2009-08-04 14:06 . 2009-08-04 17:41 1292984352 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-08-04 14:06 . 2008-07-08 12:54 148496 ----a-w- c:\windows\system32\drivers\40742672.sys
2009-08-04 07:19 . 2009-08-04 07:19 1398 ----a-r- c:\users\Enrico\AppData\Roaming\Microsoft\Installer\{6EB0B97D-BCB7-46DA-BFE0-9024E431763F}\_3cdf22e7.exe
2009-08-03 16:34 . 2009-08-03 16:34 -------- d-----w- c:\programdata\Reflexive
2009-08-03 16:33 . 2009-08-03 16:33 -------- dc----w- c:\program files\ReflexiveArcade
2009-08-03 09:50 . 2009-08-04 17:38 -------- d--h--w- c:\users\Enrico\AppData\Roaming\drivers
2009-08-03 08:37 . 2009-08-03 08:37 -------- d-----w- c:\users\Enrico\AppData\Roaming\Canneverbe_Limited
2009-08-03 06:36 . 2009-08-03 06:36 -------- d-----w- c:\users\Enrico\AppData\Local\Copy Handler
2009-08-02 17:04 . 2009-08-02 17:04 -------- d-----w- c:\users\Enrico\AppData\Roaming\WirePilot
2009-08-02 17:00 . 2009-08-02 17:00 -------- dc----w- c:\program files\Two Pilots
2009-08-02 16:33 . 2009-08-02 18:11 413696 ----a-w- c:\windows\system32\wrap_oal.dll
2009-08-02 16:33 . 2009-08-02 18:11 110592 ----a-w- c:\windows\system32\OpenAL32.dll
2009-08-02 16:33 . 2009-08-02 16:33 -------- dc----w- c:\program files\OpenAL
2009-08-01 19:38 . 2009-08-01 19:38 -------- dc----w- c:\program files\Apple Software Update
2009-08-01 19:38 . 2009-08-01 19:38 -------- d-----w- c:\programdata\Apple
2009-07-24 11:43 . 1998-11-13 12:07 307712 ----a-w- c:\windows\IsUn0410.exe
2009-07-24 07:05 . 2009-08-02 06:48 -------- dc----w- c:\program files\MessengerDiscovery
2009-07-15 07:52 . 2009-06-15 14:53 156672 ----a-w- c:\windows\system32\t2embed.dll
2009-07-15 07:52 . 2009-06-15 14:52 23552 ----a-w- c:\windows\system32\lpk.dll
2009-07-15 07:52 . 2009-06-15 14:52 72704 ----a-w- c:\windows\system32\fontsub.dll
2009-07-15 07:52 . 2009-06-15 14:51 10240 ----a-w- c:\windows\system32\dciman32.dll
2009-07-15 07:52 . 2009-06-15 12:42 289792 ----a-w- c:\windows\system32\atmfd.dll
2009-07-12 13:04 . 2009-07-12 13:07 -------- dc-h--w- c:\program files\FX Uninstall Information
2009-07-11 08:26 . 2009-07-11 08:26 -------- d-----w- c:\users\Enrico\AppData\Roaming\Desktopicon
2009-07-11 08:26 . 2009-07-11 13:27 -------- dc----w- c:\program files\Unlocker
2009-07-11 08:11 . 2009-07-11 08:11 -------- dc----w- c:\program files\FileASSASSIN
2009-07-08 18:08 . 2009-07-08 18:08 -------- d-----w- c:\windows\Youda Marina
2009-07-07 17:34 . 2009-07-07 17:34 -------- d-----w- c:\users\Enrico\AppData\Roaming\MessengerDiscovery 2

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-04 17:43 . 2009-02-13 19:39 -------- d-----w- c:\users\Enrico\AppData\Roaming\DNA
2009-08-04 17:43 . 2009-02-13 19:39 -------- d-----w- c:\program files\DNA
2009-08-04 17:41 . 2009-08-04 14:06 15156368 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-08-04 17:14 . 2009-02-13 08:39 -------- d-----w- c:\programdata\avg8
2009-08-04 17:11 . 2009-03-10 15:18 -------- d-----w- c:\users\Enrico\AppData\Roaming\uTorrent
2009-08-04 07:07 . 2006-11-06 01:52 665464 ----a-w- c:\windows\system32\perfh010.dat
2009-08-04 07:07 . 2006-11-06 01:52 121096 ----a-w- c:\windows\system32\perfc010.dat
2009-08-04 07:02 . 2009-02-13 19:44 -------- d-----w- c:\program files\Google
2009-08-03 10:02 . 2009-02-13 19:32 -------- d-----w- c:\program files\RocketDock
2009-08-03 08:29 . 2009-05-27 15:14 -------- d-----w- c:\users\Enrico\AppData\Roaming\Skype
2009-08-03 06:29 . 2009-05-27 15:15 -------- d-----w- c:\users\Enrico\AppData\Roaming\skypePM
2009-08-02 07:54 . 2009-02-16 17:53 1 ----a-w- c:\users\Enrico\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-08-02 06:45 . 2009-02-13 08:32 -------- d-----w- c:\program files\Common Files\Adobe
2009-08-01 20:00 . 2009-02-14 09:45 -------- d-----w- c:\users\Enrico\AppData\Roaming\Any Video Converter
2009-08-01 19:05 . 2009-06-20 07:13 -------- dc----w- c:\program files\Microsoft Silverlight
2009-07-24 11:36 . 2009-03-02 14:35 -------- d-----w- c:\users\Enrico\AppData\Roaming\gtk-2.0
2009-07-21 21:52 . 2009-08-01 14:37 915456 ----a-w- c:\windows\system32\wininet.dll
2009-07-21 21:47 . 2009-08-01 14:37 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-07-21 21:47 . 2009-08-01 14:37 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-07-21 20:13 . 2009-08-01 14:37 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-07-17 12:16 . 2009-07-17 12:16 4096 ----a-w- c:\windows\system32\0DF19.tmp
2009-07-15 14:51 . 2009-02-13 08:11 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-07-15 14:50 . 2009-06-12 08:32 -------- d-----w- c:\programdata\NETg
2009-07-15 08:28 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-07-11 13:45 . 2009-02-13 08:04 109648 ----a-w- c:\users\Enrico\AppData\Local\GDIPFONTCACHEV1.DAT
2009-07-09 12:00 . 2009-07-09 12:00 4096 ----a-w- c:\windows\system32\0D4DD.tmp
2009-07-08 18:09 . 2009-06-13 17:36 -------- d-----w- c:\users\Enrico\AppData\Roaming\Youdagames
2009-07-05 18:43 . 2009-02-14 15:58 -------- d-----w- c:\users\Enrico\AppData\Roaming\Vso
2009-07-05 11:27 . 2009-03-09 15:49 21840 ----atw- c:\windows\system32\SIntfNT.dll
2009-07-05 11:27 . 2009-03-09 15:49 17212 ----atw- c:\windows\system32\SIntf32.dll
2009-07-05 11:27 . 2009-03-09 15:49 12067 ----atw- c:\windows\system32\SIntf16.dll
2009-07-04 10:22 . 2009-02-13 08:39 335752 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-07-04 10:22 . 2009-07-04 10:26 2054424 ----a-w- c:\programdata\avg8\update\backup\avgcorex.dll
2009-07-04 10:22 . 2009-07-04 10:26 2167576 ----a-w- c:\programdata\avg8\update\backup\avgresf.dll
2009-07-03 12:45 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Calendar
2009-07-03 12:45 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Sidebar
2009-07-03 12:45 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Journal
2009-07-03 12:45 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Collaboration
2009-07-03 12:45 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Photo Gallery
2009-07-03 12:45 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Defender
2009-07-03 12:42 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-07-03 11:56 . 2006-11-02 12:37 37665 ----a-w- c:\windows\Fonts\GlobalUserInterface.CompositeFont
2009-06-30 12:13 . 2009-06-30 12:13 4096 ----a-w- c:\windows\system32\015C2.tmp
2009-06-28 17:39 . 2009-06-28 17:39 4096 ----a-w- c:\windows\system32\02550.tmp
2009-06-28 15:14 . 2009-06-28 15:14 -------- d-----w- c:\programdata\Cobian
2009-06-28 10:26 . 2009-06-20 12:45 91 ----a-w- c:\users\Enrico\AppData\Local\samwqgk.bat
2009-06-26 10:26 . 2009-06-26 10:26 4096 ----a-w- c:\windows\system32\03D6C.tmp
2009-06-25 17:23 . 2009-06-25 17:23 4096 ----a-w- c:\windows\system32\04874.tmp
2009-06-25 12:01 . 2009-06-25 12:01 4096 ----a-w- c:\windows\system32\04F29.tmp
2009-06-24 19:27 . 2009-06-24 19:27 4096 ----a-w- c:\windows\system32\0D605.tmp
2009-06-23 18:08 . 2009-02-13 08:39 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-06-23 18:08 . 2009-02-13 08:39 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-06-22 19:01 . 2009-06-22 19:01 4096 ----a-w- c:\windows\system32\0F09E.tmp
2009-06-21 09:53 . 2009-06-21 09:53 4096 ----a-w- c:\windows\system32\04990.tmp
2009-06-20 20:31 . 2009-06-20 20:31 4096 ----a-w- c:\windows\system32\01B8E.tmp
2009-06-18 19:05 . 2009-06-18 19:05 4096 ----a-w- c:\windows\system32\0ECD7.tmp
2009-06-18 11:37 . 2009-02-13 20:38 -------- d-----w- c:\program files\OpenOffice.org 3
2009-06-16 11:11 . 2009-06-16 11:11 4096 ----a-w- c:\windows\system32\021D2.tmp
2009-06-15 17:32 . 2009-06-15 17:32 4096 ----a-w- c:\windows\system32\0C59F.tmp
2009-06-13 07:55 . 2009-06-13 07:55 4096 ----a-w- c:\windows\system32\04C8C.tmp
2009-06-12 14:36 . 2009-06-12 14:36 -------- dc----w- c:\program files\MSECache
2009-06-12 13:19 . 2009-06-12 13:19 -------- d-----w- c:\programdata\QuickTime
2009-06-12 10:04 . 2009-06-12 10:02 -------- d-----w- c:\users\Enrico\AppData\Roaming\InfraRecorder
2009-06-10 10:22 . 2009-06-10 10:22 -------- d-----w- c:\users\Enrico\AppData\Roaming\Netscape
2009-06-10 06:34 . 2009-06-10 06:34 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2009-06-09 06:50 . 2009-06-09 06:50 -------- d-----w- c:\users\Enrico\AppData\Roaming\KeePass
2009-06-03 16:17 . 2009-06-03 16:17 4096 ----a-w- c:\windows\system32\0DCAB.tmp
2009-06-02 18:04 . 2009-06-02 18:04 4096 ----a-w- c:\windows\system32\059B5.tmp
2009-06-01 11:38 . 2009-06-01 11:38 4096 ----a-w- c:\windows\system32\01529.tmp
2009-05-30 18:26 . 2009-05-30 18:26 40960 ----a-r- c:\users\Enrico\AppData\Roaming\Microsoft\Installer\{9527450C-64B3-11D5-9B31-000021116B62}\_BD2ECD14F979_4870_B280_91C063F08E29.exe
2009-05-29 14:01 . 2009-04-11 17:33 89 ----a-w- c:\users\Enrico\AppData\Local\aoaqmos.bat
2009-05-28 13:22 . 2009-05-27 17:41 514 -c-ha-w- C:\os629005.bin
2009-05-27 17:14 . 2009-05-27 17:14 4096 ----a-w- c:\windows\system32\0AD91.tmp
2009-05-27 15:15 . 2009-05-27 15:15 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-05-26 11:20 . 2009-05-29 19:33 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-26 11:19 . 2009-05-29 19:33 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-05-25 15:16 . 2009-05-25 15:16 4096 ----a-w- c:\windows\system32\098C7.tmp
2009-05-14 13:29 . 2009-05-13 17:03 8 ----a-w- c:\windows\system32\sparkleflashendocder_lu.bin
2009-05-13 17:03 . 2009-05-13 17:03 8 ----a-w- c:\windows\system32\sparkleflashendocder_fu.bin
2009-05-09 10:38 . 2009-02-13 09:16 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-07-17 12:00 . 2009-04-24 14:12 137208 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
2009-02-16 15:26 . 2009-02-16 14:22 24 --sh--w- c:\windows\SD40354A1.tmp
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-02-13 342848]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-09-20 202024]
"Google Update"="c:\users\Enrico\AppData\Local\Google\Update\GoogleUpdate.exe" [2009-02-13 133104]
"DAEMON Tools Pro Agent"="d:\daemon tools pro\DTProAgent.exe" [2007-09-06 136136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SiSTray"="c:\program files\SiS VGA Utilities\SiSTray.exe" [2007-06-05 548864]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 1836328]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2009-08-04 319488]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2009-08-04 15872]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-06-20 4493312]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2008-10-10 69632]

c:\users\Enrico\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
is-D4DIU.lnk - j:\programmi\Virus Removal Tool\is-D4DIU\startup.exe [2009-8-4 65536]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-2-24 809488]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLUA"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoFileAssociate"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):d5,9e,98,7d,29,15,ca,01

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2232847502-1444760326-1672518796-1000]
"EnableNotifications"=dword:00000001
"EnableNotificationsRef"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{6F0C04BD-4880-4A32-808E-688447B7A3A5}"= c:\program files\AVG\AVG8\avgemc.exe:avgemc.exe
"{CE583CB2-5CEB-4AAD-B263-A946C4D37B87}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe
"TCP Query User{F3CEDB05-2C68-46DD-9D5A-7C3C109E01CE}c:\\program files\\messengerdiscovery\\messengerdiscovery live.exe"= UDP:c:\program files\messengerdiscovery\messengerdiscovery live.exe:MessengerDiscovery Live the Windows Live Messenger addon
"UDP Query User{D3DCA296-220E-4685-B4F4-C162A46B153E}c:\\program files\\messengerdiscovery\\messengerdiscovery live.exe"= TCP:c:\program files\messengerdiscovery\messengerdiscovery live.exe:MessengerDiscovery Live the Windows Live Messenger addon
"TCP Query User{3B52B331-1D43-4D4D-9845-6A41F83D4E1D}c:\\users\\enrico\\program files\\dna\\btdna.exe"= UDP:c:\users\enrico\program files\dna\btdna.exe:btdna.exe
"UDP Query User{2DD2468F-0420-40C6-97BB-692DCBEDCF60}c:\\users\\enrico\\program files\\dna\\btdna.exe"= TCP:c:\users\enrico\program files\dna\btdna.exe:btdna.exe
"TCP Query User{0763939E-7EA3-4C74-8F33-FDCED709FBFF}c:\\users\\enrico\\appdata\\local\\opera\\opera\\profile\\cache4\\temporary_download\\installer-207-15it-shrinkto5-italian.exe"= UDP:c:\users\enrico\appdata\local\opera\opera\profile\cache4\temporary_download\installer-207-15it-shrinkto5-italian.exe:installer-207-15it-shrinkto5-italian.exe
"UDP Query User{423375C5-E331-4150-B6E1-50C49466392D}c:\\users\\enrico\\appdata\\local\\opera\\opera\\profile\\cache4\\temporary_download\\installer-207-15it-shrinkto5-italian.exe"= TCP:c:\users\enrico\appdata\local\opera\opera\profile\cache4\temporary_download\installer-207-15it-shrinkto5-italian.exe:installer-207-15it-shrinkto5-italian.exe
"TCP Query User{B523FE70-F550-4685-B27E-ADFDB91A1E64}c:\\program files\\opera\\opera.exe"= UDP:c:\program files\opera\opera.exe:Opera Internet Browser
"UDP Query User{1E3202DF-70DE-487C-A337-A6EFBDE03E37}c:\\program files\\opera\\opera.exe"= TCP:c:\program files\opera\opera.exe:Opera Internet Browser
"TCP Query User{0F8F38C9-7908-42BB-8725-652A55AEFF19}l:\\programmi\\pyton\\pythonw.exe"= UDP:l:\programmi\pyton\pythonw.exe:pythonw
"UDP Query User{367EC847-816E-4AC7-BD24-7441E8E2B111}l:\\programmi\\pyton\\pythonw.exe"= TCP:l:\programmi\pyton\pythonw.exe:pythonw
"TCP Query User{40973EE5-94CA-4701-96E5-AB876A7DDF57}l:\\programmi\\emule adunanza\\emule_adnza.exe"= UDP:l:\programmi\emule adunanza\emule_adnza.exe:eMule
"UDP Query User{7E3B5341-797E-432A-B167-D5F7921AE304}l:\\programmi\\emule adunanza\\emule_adnza.exe"= TCP:l:\programmi\emule adunanza\emule_adnza.exe:eMule
"{F5BE0340-EC69-4680-A2BB-B2F89BE90E67}"= UDP:l:\programmi\VideoSpin\Programs\RM.exe:Render Manager
"{79EDB377-820D-4B42-A2E6-63832BE5F324}"= TCP:l:\programmi\VideoSpin\Programs\RM.exe:Render Manager
"{CDD10296-3301-422C-B1C7-51E090900EF9}"= UDP:l:\programmi\VideoSpin\Programs\PMSRegisterFile.exe:PMSRegisterFile
"{2F1E3B39-03AD-48FC-A58E-4C944697DD38}"= TCP:l:\programmi\VideoSpin\Programs\PMSRegisterFile.exe:PMSRegisterFile
"{D35076DF-6F9C-429D-BC12-85FACCD4EE48}"= UDP:l:\programmi\VideoSpin\Programs\umi.exe:umi
"{EEE8DBBF-63F5-47C1-BBE1-03E841564A02}"= TCP:l:\programmi\VideoSpin\Programs\umi.exe:umi
"{C98F65D4-E005-4E5B-9592-20D54C242CEB}"= UDP:l:\programmi\VideoSpin\Programs\VideoSpin.exe:Pinnacle VideoSpin
"{C130F40C-886D-41A7-86F2-D3F4815FC71B}"= TCP:l:\programmi\VideoSpin\Programs\VideoSpin.exe:Pinnacle VideoSpin
"TCP Query User{766B2188-63BC-4031-99AA-3EB429005D54}l:\\programmi\\virtualbox\\virtualbox.exe"= UDP:l:\programmi\virtualbox\virtualbox.exe:VirtualBox
"UDP Query User{9302ECC6-84BF-4BFD-B08F-F8C822903D79}l:\\programmi\\virtualbox\\virtualbox.exe"= TCP:l:\programmi\virtualbox\virtualbox.exe:VirtualBox
"TCP Query User{0BBCD41F-9CEF-449F-89EB-90090D6365F5}l:\\download\\emule adunanza\\emule_adnza.exe"= UDP:l:\download\emule adunanza\emule_adnza.exe:eMule
"UDP Query User{D77C09FC-DE82-4A99-917D-FA7F941674BB}l:\\download\\emule adunanza\\emule_adnza.exe"= TCP:l:\download\emule adunanza\emule_adnza.exe:eMule
"TCP Query User{DD2C963C-CF4B-49C0-82A5-CD7F4A51E700}c:\\program files\\sun\\xvm virtualbox\\virtualbox.exe"= UDP:c:\program files\sun\xvm virtualbox\virtualbox.exe:VirtualBox
"UDP Query User{9BCA891F-97FF-4373-9947-349EA06042E6}c:\\program files\\sun\\xvm virtualbox\\virtualbox.exe"= TCP:c:\program files\sun\xvm virtualbox\virtualbox.exe:VirtualBox
"{1E9D8F39-DA33-4997-A70F-1AD230581F8F}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{886C79CE-23E8-4016-AB04-2C9D87DD6176}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"TCP Query User{B991BC37-C99C-4140-873A-EECC395646F1}l:\\programmi\\starcraft\\starcraft.exe"= UDP:l:\programmi\starcraft\starcraft.exe:Starcraft
"UDP Query User{58593D27-A353-4500-B9B7-48EF66B4AD43}l:\\programmi\\starcraft\\starcraft.exe"= TCP:l:\programmi\starcraft\starcraft.exe:Starcraft
"{E18E5B2F-61A0-44C8-AE4A-612A9D075BB4}"= UDP:c:\users\Enrico\AppData\Local\Opera\Opera\profile\cache4\temporary_download\utorrent.exe:µTorrent (TCP-In)
"{3530337A-9A77-43FD-93DD-F0AC76B589B4}"= TCP:c:\users\Enrico\AppData\Local\Opera\Opera\profile\cache4\temporary_download\utorrent.exe:µTorrent (UDP-In)
"{C70AB7D8-9E2E-4D25-9319-6DA4548DA884}"= UDP:l:\programmi\ZT2\zt.exe:Zoo Tycoon 2 Executable
"{225C7154-4E94-470B-A26E-C577755CD871}"= TCP:l:\programmi\ZT2\zt.exe:Zoo Tycoon 2 Executable
"{06BD736D-7077-45AE-A828-181928A311A6}"= UDP:c:\program files\DNA\btdna.exe:DNA (TCP-In)
"{3C1E878E-D642-4B3A-A731-7B99ABE9CE84}"= TCP:c:\program files\DNA\btdna.exe:DNA (UDP-In)
"TCP Query User{A749E1B4-02A9-4BBE-A37C-F09CB611A553}l:\\programmi\\msn backup\\msnbackup.exe"= UDP:l:\programmi\msn backup\msnbackup.exe:MSN BackUp
"UDP Query User{25B5B677-21D1-4308-A15F-EBFEB56D82B6}l:\\programmi\\msn backup\\msnbackup.exe"= TCP:l:\programmi\msn backup\msnbackup.exe:MSN BackUp
"TCP Query User{150B9F20-85DA-4942-B25D-3095171E5C88}j:\\programmi\\emule adunanza\\emule_adnza.exe"= UDP:j:\programmi\emule adunanza\emule_adnza.exe:eMule
"UDP Query User{FAE95A33-B194-4B6E-9C29-7135EFBDE589}j:\\programmi\\emule adunanza\\emule_adnza.exe"= TCP:j:\programmi\emule adunanza\emule_adnza.exe:eMule
"TCP Query User{450F5341-8193-4DB7-AFD2-6AB11DEB5C82}j:\\programmi\\starcraft\\starcraft.exe"= UDP:j:\programmi\starcraft\starcraft.exe:StarCraft
"UDP Query User{78FFCBBA-7B78-492D-9887-3D71C13A3FA9}j:\\programmi\\starcraft\\starcraft.exe"= TCP:j:\programmi\starcraft\starcraft.exe:StarCraft
"{EDFB14F6-19D7-4B92-887E-C6BC1356FB85}"= UDP:j:\programmi\µTorrent\uTorrent.exe:µTorrent (TCP-In)
"{99F56069-D29F-4B2A-BE74-9FFD23F73E81}"= TCP:j:\programmi\µTorrent\uTorrent.exe:µTorrent (UDP-In)
"{0751C4BA-B9DC-4FB4-AE94-C787806F2D19}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{109AC256-9B8F-4821-8344-CC13D3DB61AB}"= UDP:d:\atomic newsgroup explorer\AtomicNewsgroupExplorer.exe:Atomic Newsgroup Explorer
"{80882923-9409-4D26-A9D2-A59A50320FC9}"= TCP:d:\atomic newsgroup explorer\AtomicNewsgroupExplorer.exe:Atomic Newsgroup Explorer
"TCP Query User{632FF7C8-393C-4ED0-83B8-50679B407E50}j:\\programmi\\µtorrent\\utorrent.exe"= UDP:j:\programmi\µtorrent\utorrent.exe:µTorrent
"UDP Query User{A6D1E39A-51C0-4BC1-BAE0-C2249A5DEADE}j:\\programmi\\µtorrent\\utorrent.exe"= TCP:j:\programmi\µtorrent\utorrent.exe:µTorrent
"{D0984255-1C28-4687-8B9F-2BBDF719F23A}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{CA23249D-7767-4560-BD3A-1440D4AA36BB}"= c:\program files\Skype\Phone\Skype.exe:Skype
"TCP Query User{45025C58-356F-497D-B14F-567053C5F38C}j:\\programmi\\emule adunanza\\emule_adnza.exe"= UDP:j:\programmi\emule adunanza\emule_adnza.exe:eMule
"UDP Query User{4273084C-F9F7-4FFB-90EA-28A93C5C1A0D}j:\\programmi\\emule adunanza\\emule_adnza.exe"= TCP:j:\programmi\emule adunanza\emule_adnza.exe:eMule
"{34B6C8CF-0B6E-4ED1-8CFD-54D2A02503EA}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{3787A042-5C16-4B8E-8BD0-C382D608876F}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{32FF4D1F-17AF-46CC-ABCF-0D744E1B294E}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{E8D629EE-37CF-45CB-95C6-1EF2B0E6C581}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{8CF9F5FF-16D2-4506-B168-C0A9E8480F02}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{EF2FFD3E-48B3-4A75-908E-4DF97D38D782}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{2D509D71-A161-4C5C-9422-B112DBB13E9D}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{6C2ABFB9-0A17-479E-A3E2-7C6B61E11399}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{BA084DA3-B285-4981-985E-62ADC236AF12}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{A2923DF9-E74C-4907-AF77-B683DD8D8DF5}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{23DE3BB6-F151-42F4-8DF5-439AE2098C8D}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{D718EB1D-BB45-4F87-9DD9-B6241C7EB998}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{DF18D1F6-1A4E-4CB3-A454-316A966715CB}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{5CCBCC13-5FBC-4479-A3C5-CBD624911EB8}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{6BAE68E3-92BE-4C2F-B2F3-D337E30A6F3E}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{37562735-63A0-4C5E-8CFA-1204EFDE269D}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{CFE96BDB-8D6C-48E7-83C1-7005DB19C926}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{376DE4FF-1930-40EF-A0B6-D2B6048B70CF}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{2BF9087A-7328-4841-9568-DDB3CBCA67B6}"= c:\program files\Skype\Phone\Skype.exe:Skype
"TCP Query User{61E49468-5F65-41FE-B48D-7A8242B35885}j:\\programmi\\msn backup\\msnbackup.exe"= UDP:j:\programmi\msn backup\msnbackup.exe:MSN BackUp
"UDP Query User{FD13B5A0-419F-418A-A8A4-6ECA1CBDA171}j:\\programmi\\msn backup\\msnbackup.exe"= TCP:j:\programmi\msn backup\msnbackup.exe:MSN BackUp
"{2A814D3A-E762-4615-94EC-8CD359D8EAAD}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{E2D44A4B-D478-423A-B4A3-9EEF2D6AF108}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{C3DE2F96-2E46-4476-97DD-56A5FB90BE4E}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{145993E8-A966-40E3-9089-FD29D173DD34}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{6207927B-E41D-498E-B8E1-E927E1E43FCE}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{23AE494B-1576-4E18-9C81-32FB29D6B02E}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{16E8065A-D795-44A4-95C0-CD115F135F25}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{190921C4-8007-4178-B99F-C83E1222822F}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{5B909875-20AC-46AF-8A59-11A026D14616}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{C5186F91-D744-4CE2-AFB6-3C1D1F0F15CF}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{7C4DC08C-11FD-499D-A582-5FEF5F001C94}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{44CBBA6D-F54B-4F69-BDD2-217C8019F60B}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{A7480017-E8D0-41B7-87E1-319F90892244}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{6454D569-2EC6-4333-B5BF-32D94189363C}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{77D8A9A3-C8D1-480F-ADA8-D4B0B0DCA55C}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{88085BC9-0A73-4023-A2C8-BDD3FABD1D84}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{3F861A0C-3477-4EF3-8657-A701014C2C83}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{0FB41F94-7DF7-4BEC-B8CB-FFD2EE06C584}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{A47FDB69-7A72-48DB-A110-08040F9692CE}"= c:\program files\Skype\Phone\Skype.exe:Skype
"TCP Query User{3DA56E52-BC55-4E02-8AFD-3604884121A1}j:\\programmi\\american conquest - edizione oro\\fight back\\dmcr.exe"= UDP:j:\programmi\american conquest - edizione oro\fight back\dmcr.exe:dmcr
"UDP Query User{B14C56D0-F87B-41DE-B997-10CAD42CB69A}j:\\programmi\\american conquest - edizione oro\\fight back\\dmcr.exe"= TCP:j:\programmi\american conquest - edizione oro\fight back\dmcr.exe:dmcr
"{9FF3811B-8B4D-4315-A836-AC3050319EBD}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{A01FD5CA-B31A-4104-B33D-E025E01A04B5}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{530F4E80-BEA2-488C-B550-206281616903}"= c:\program files\Skype\Phone\Skype.exe:Skype
"TCP Query User{B7E2688C-F99F-440D-855E-60AF31371201}c:\\program files\\free download manager\\fdm.exe"= UDP:c:\program files\free download manager\fdm.exe:Free Download Manager
"UDP Query User{8F333A64-F5AB-4596-A06A-B02E7919C6A1}c:\\program files\\free download manager\\fdm.exe"= TCP:c:\program files\free download manager\fdm.exe:Free Download Manager
"{343F2BA6-FD7D-496F-B1BF-DA28863C6D4E}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{58F0A592-FA75-421A-8C14-1974A18B5E8D}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{C7847FCB-1401-4F33-812D-652D18B2D9FF}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{0D859DA4-F8B5-49A3-9ED8-769970FAAC63}"= UDP:7036:gfkbtuzv
"{5B5A9BF8-9ACC-4DBA-9507-8F5F24E9667A}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{3B4B72A4-73F6-4CB0-A6C0-3AF9A74A3648}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{9BA9269C-83CB-40DB-9450-47C3A495A8FF}j:\\programmi\\empire earth\\empire earth.exe"= UDP:j:\programmi\empire earth\empire earth.exe:Empire Earth
"UDP Query User{A67D373B-29B5-41E4-BB15-48623CB9CC9D}j:\\programmi\\empire earth\\empire earth.exe"= TCP:j:\programmi\empire earth\empire earth.exe:Empire Earth
"{056FB9E8-83A7-4766-90D3-D8E5A740B02D}"= c:\program files\Skype\Phone\Skype.exe:Skype
"TCP Query User{2D4C068A-7D71-411E-B0C4-1EBD6C7BBA6C}j:\\programmi\\age of empires\\empires2.icd"= UDP:j:\programmi\age of empires\empires2.icd:Age of Empires II
"UDP Query User{8BF3195D-6FC4-4B26-A64C-09C0DC378597}j:\\programmi\\age of empires\\empires2.icd"= TCP:j:\programmi\age of empires\empires2.icd:Age of Empires II
"TCP Query User{CBE45685-0C8A-429C-900C-7D7EF42E9838}j:\\programmi\\empires2.icd"= UDP:j:\programmi\empires2.icd:Age of Empires II
"UDP Query User{53133E82-23FF-4107-B0B3-6F7258D212B6}j:\\programmi\\empires2.icd"= TCP:j:\programmi\empires2.icd:Age of Empires II
"TCP Query User{79181BDA-3BF4-40A8-A915-3D28178EA149}j:\\programmi\\age2_x1\\age2_x1.icd"= UDP:j:\programmi\age2_x1\age2_x1.icd:Age of Empires II Expansion
"UDP Query User{4352B040-BBDF-49AA-9D50-6BFEF0CE1640}j:\\programmi\\age2_x1\\age2_x1.icd"= TCP:j:\programmi\age2_x1\age2_x1.icd:Age of Empires II Expansion
"TCP Query User{0AC0F719-D2B6-4EF8-8356-B3B02CDA83EE}j:\\programmi\\age2_x1.exe"= UDP:j:\programmi\age2_x1.exe:Age of Empires II Expansion
"UDP Query User{632CD135-E0B3-4F61-A984-F09F6655C2A1}j:\\programmi\\age2_x1.exe"= TCP:j:\programmi\age2_x1.exe:Age of Empires II Expansion
"{7AAE5DC7-5EAF-400C-8AC9-3C9089987459}"= c:\program files\Skype\Phone\Skype.exe:Skype
"TCP Query User{B5F5D29B-700F-496C-88DB-D21664320F55}j:\\programmi\\age of empires 2\\age2_x1\\age2_x1.icd"= UDP:j:\programmi\age of empires 2\age2_x1\age2_x1.icd:Age of Empires II Expansion
"UDP Query User{E5B7B34F-E0E0-4C15-B1B5-53C0050AC78E}j:\\programmi\\age of empires 2\\age2_x1\\age2_x1.icd"= TCP:j:\programmi\age of empires 2\age2_x1\age2_x1.icd:Age of Empires II Expansion
"TCP Query User{D8AE0FDC-D331-4D26-8540-68D42C3CBFB3}j:\\programmi\\age of empires 2\\empires2.icd"= UDP:j:\programmi\age of empires 2\empires2.icd:Age of Empires II
"UDP Query User{35B8AD69-5771-49CA-845D-828DFF8361DD}j:\\programmi\\age of empires 2\\empires2.icd"= TCP:j:\programmi\age of empires 2\empires2.icd:Age of Empires II
"{DE100E95-D856-45DA-9BB5-0172165BB596}"= c:\program files\Skype\Phone\Skype.exe:Skype
"TCP Query User{4C888D03-FE8C-440F-A31E-648FD1052783}j:\\download\\emule adunanza\\emule_adnza.exe"= UDP:j:\download\emule adunanza\emule_adnza.exe:eMule
"UDP Query User{47182736-9308-46E0-B539-59FB35576D74}j:\\download\\emule adunanza\\emule_adnza.exe"= TCP:j:\download\emule adunanza\emule_adnza.exe:eMule
"{18A1C735-AAE5-4CA4-A792-200135B6D832}"= c:\program files\Skype\Phone\Skype.exe:Skype
"TCP Query User{438C86F9-A3C1-4B99-B773-3B4314A57D7F}j:\\programmi\\age of empires 2\\age2_x1.exe"= UDP:j:\programmi\age of empires 2\age2_x1.exe:Age of Empires II Expansion
"UDP Query User{A88E7276-7F3C-417D-AE9A-02F92023F454}j:\\programmi\\age of empires 2\\age2_x1.exe"= TCP:j:\programmi\age of empires 2\age2_x1.exe:Age of Empires II Expansion

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\BitTorrent\\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [13/02/2009 10.39.24 335752]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [13/02/2009 11.16.42 108552]
R1 is-D4DIUdrv;is-D4DIUdrv;c:\windows\System32\drivers\40742672.sys [04/08/2009 16.06.24 148496]
R1 VBoxDrv;VirtualBox Service;c:\windows\System32\drivers\VBoxDrv.sys [13/05/2009 19.05.34 100944]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\System32\drivers\VBoxUSBMon.sys [13/05/2009 19.02.54 41424]
R3 PAC207;SoC PC-Camera;c:\windows\System32\drivers\PFC027.SYS [05/12/2006 11.34.42 507136]
R3 SiS6350;SiS6350;c:\windows\System32\drivers\SISGRKMD.sys [13/02/2009 10.19.35 454520]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\System32\drivers\SiSGB6.sys [13/02/2009 10.06.11 46592]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\System32\drivers\VBoxNetAdp.sys [27/04/2009 20.39.08 79888]
R3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\System32\drivers\VBoxNetFlt.sys [27/04/2009 20.39.08 87696]
S2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe c:\progra~1\AVG\AVG8\avgemc.exe
S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe c:\progra~1\AVG\AVG8\avgwdsvc.exe
S2 bubbo;Boot Security;c:\windows\system32\svchost.exe -k netsvcs [13/02/2009 13.39.01 21504]
S2 eyejmoikz;Manager Installer;c:\windows\system32\svchost.exe -k netsvcs [13/02/2009 13.39.01 21504]
S2 gajwxpy;Manager Image;c:\windows\system32\svchost.exe -k netsvcs [13/02/2009 13.39.01 21504]
S2 gupdate1c9eac81fe1de63;Servizio di Google Update (gupdate1c9eac81fe1de63);c:\program files\Google\Update\GoogleUpdate.exe [11/06/2009 21.09.19 133104]
S2 jufqmhrv;Universal Network;c:\windows\system32\svchost.exe -k netsvcs [13/02/2009 13.39.01 21504]
S2 lorbcuh;Update Installer;c:\windows\system32\svchost.exe -k netsvcs [13/02/2009 13.39.01 21504]
S2 mckeeo;Microsoft Driver;c:\windows\system32\svchost.exe -k netsvcs [13/02/2009 13.39.01 21504]
S2 mmuxmgtci;Security System;c:\windows\system32\svchost.exe -k netsvcs [13/02/2009 13.39.01 21504]
S2 mxpwzk;Time Monitor;c:\windows\system32\svchost.exe -k netsvcs [13/02/2009 13.39.01 21504]
S2 orhuy;Shell Helper;c:\windows\system32\svchost.exe -k netsvcs [13/02/2009 13.39.01 21504]
S2 pbinpv;Task Manager;c:\windows\system32\svchost.exe -k netsvcs [13/02/2009 13.39.01 21504]
S2 rdsdqccj;Boot Update;c:\windows\system32\svchost.exe -k netsvcs [13/02/2009 13.39.01 21504]
S2 rqmkz;Server Driver;c:\windows\system32\svchost.exe -k netsvcs [13/02/2009 13.39.01 21504]
S2 tduqq;System Universal;c:\windows\system32\svchost.exe -k netsvcs [13/02/2009 13.39.01 21504]
S2 ticwlhim;Time Update;c:\windows\system32\svchost.exe -k netsvcs [13/02/2009 13.39.01 21504]
S2 uygtpuh;Driver Manager;c:\windows\system32\svchost.exe -k netsvcs [13/02/2009 13.39.01 21504]
S2 vdqkricyr;Image Center;c:\windows\system32\svchost.exe -k netsvcs [13/02/2009 13.39.01 21504]
S2 vfekc;Shell Security;c:\windows\system32\svchost.exe -k netsvcs [13/02/2009 13.39.01 21504]
S2 wmurn;Monitor Update;c:\windows\system32\svchost.exe -k netsvcs [13/02/2009 13.39.01 21504]
S2 xhidlzbmy;Microsoft Image;c:\windows\system32\svchost.exe -k netsvcs [13/02/2009 13.39.01 21504]
S2 zytggij;Driver Time;c:\windows\system32\svchost.exe -k netsvcs [13/02/2009 13.39.01 21504]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\System32\drivers\mbamswissarmy.sys [29/05/2009 21.33.16 40160]
S3 VBoxUSB;VirtualBox USB;c:\windows\System32\drivers\VBoxUSB.sys [16/02/2009 18.47.00 31824]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
jufqmhrv
rdsdqccj
tduqq
orhuy
eyejmoikz
uygtpuh
vdqkricyr
rqmkz
mckeeo
mxpwzk
pbinpv
zytggij
gajwxpy
ticwlhim
vfekc
xhidlzbmy
mmuxmgtci
wmurn
bubbo
lorbcuh

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contenuto della cartella 'Scheduled Tasks'

2009-08-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-11 19:09]

2009-08-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-11 19:09]

2009-08-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2232847502-1444760326-1672518796-1000Core.job
- c:\users\Enrico\AppData\Local\Google\Update\GoogleUpdate.exe [2009-02-13 19:41]

2009-08-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2232847502-1444760326-1672518796-1000UA.job
- c:\users\Enrico\AppData\Local\Google\Update\GoogleUpdate.exe [2009-02-13 19:41]

2009-07-11 c:\windows\Tasks\Schedule Task Weekly.job
- j:\programmi\Registry Easy\RE.exe [2009-06-27 14:08]
.
- - - - CHIAVI ORFANE RIMOSSE - - - -

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
HKCU-Run-Copy Handler - j:\programmi\Copy Handler\ch.exe
HKCU-Run-CubeDesktop - (no file)
HKLM-Run-AVG8_TRAY - c:\progra~1\AVG\AVG8\avgtray.exe
HKLM-Run-Copy Handler - (no file)


.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&sporta in Microsoft Excel - d:\office\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Enrico\AppData\Roaming\Mozilla\Firefox\Profiles\xmc30l97.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.fastbrowsersearch.com/result ... EF&v=18&q=
FF - prefs.js: browser.search.selectedEngine - Fast Browser Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.it/
FF - prefs.js: network.proxy.type - 2
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Opera\program\plugins\npmmaud.dll
FF - plugin: c:\program files\Opera\program\plugins\npmmprog.dll
FF - plugin: c:\program files\Opera\program\plugins\npmmvid.dll
FF - plugin: c:\program files\Opera\program\plugins\npmmzip.dll
FF - plugin: c:\program files\VistaCodecPack\rm\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\VistaCodecPack\rm\browser\plugins\nprpjplug.dll
FF - plugin: c:\users\Enrico\AppData\Local\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: network.prefetch-next - true
FF - user.js: nglayout.initialpaint.delay - 50
FF - user.js: layout.spellcheckDefault - 1
FF - user.js: browser.urlbar.autoFill - false
FF - user.js: browser.search.openintab - false
FF - user.js: browser.tabs.closeButtons - 1
FF - user.js: browser.tabs.opentabfor.middleclick - true
FF - user.js: browser.tabs.tabMinWidth - 100
FF - user.js: browser.urlbar.hideGoButton - true
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-04 19:42
Windows 6.0.6002 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\bubbo]
"ServiceDll"="c:\windows\system32\gfsbzgt.dll"
--

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\eyejmoikz]
"ServiceDll"="c:\windows\system32\gfsbzgt.dll"
--

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\gajwxpy]
"ServiceDll"="c:\windows\system32\gfsbzgt.dll"
--

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\jufqmhrv]
"ServiceDll"="c:\windows\system32\gfsbzgt.dll"
--

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\lorbcuh]
"ServiceDll"="c:\windows\system32\gfsbzgt.dll"
--

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\mckeeo]
"ServiceDll"="c:\windows\system32\gfsbzgt.dll"
--

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\mmuxmgtci]
"ServiceDll"="c:\windows\system32\gfsbzgt.dll"
--

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\mxpwzk]
"ServiceDll"="c:\windows\system32\gfsbzgt.dll"
--

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\orhuy]
"ServiceDll"="c:\windows\system32\gfsbzgt.dll"
--

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\pbinpv]
"ServiceDll"="c:\windows\system32\gfsbzgt.dll"
--

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\rdsdqccj]
"ServiceDll"="c:\windows\system32\gfsbzgt.dll"
--

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\rqmkz]
"ServiceDll"="c:\windows\system32\gfsbzgt.dll"
--

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\tduqq]
"ServiceDll"="c:\windows\system32\gfsbzgt.dll"
--

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\ticwlhim]
"ServiceDll"="c:\windows\system32\gfsbzgt.dll"
--

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\uygtpuh]
"ServiceDll"="c:\windows\system32\gfsbzgt.dll"
--

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\vdqkricyr]
"ServiceDll"="c:\windows\system32\gfsbzgt.dll"
--

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\vfekc]
"ServiceDll"="c:\windows\system32\gfsbzgt.dll"
--

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\wmurn]
"ServiceDll"="c:\windows\system32\gfsbzgt.dll"
--

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\xhidlzbmy]
"ServiceDll"="c:\program files\Internet Explorer\gfsbzgt.dll"
--

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\zytggij]
"ServiceDll"="c:\windows\system32\gfsbzgt.dll"
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------

[HKEY_USERS\S-1-5-21-2232847502-1444760326-1672518796-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{E3DD3687-B37C-9CFC-D317-0AE861EC55FF}*]
"jaijaklplpoeikonihlo"=hex:66,61,70,6c,6f,6b,6b,61,70,66,66,65,00,aa
"paakhmcmjmcbjbandncobldilebchnna"=hex:65,61,70,6c,70,6b,61,62,63,64,00,65
"haijaklplpoeikon"=hex:6e,62,70,6c,6d,6b,66,69,6f,70,6f,6a,67,68,6a,6a,64,6a,
6b,64,62,66,63,6a,6d,69,70,61,66,6d,6a,64,63,62,6e,66,64,6a,66,70,68,65,65,\

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:00000000
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------

- - - - - - - > 'Explorer.exe'(2276)
c:\program files\RocketDock\RocketDock.dll
c:\program files\Logitech\SetPoint\lgscroll.dll
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\windows\System32\audiodg.exe
c:\program files\Google\Update\1.2.183.7\GoogleCrashHandler.exe
c:\windows\System32\conime.exe
c:\program files\Common Files\microsoft shared\VS7DEBUG\MDM.EXE
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
j:\programmi\CDBurnerXP\NMSAccessU.exe
c:\program files\Common Files\Nero\Lib\NMIndexingService.exe
c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
c:\program files\Windows Media Player\wmpnscfg.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Ora fine scansione: 2009-08-04 19.50.28 - Il pc è stato riavviato
ComboFix-quarantined-files.txt 2009-08-04 17:49

Pre-Run: 27.453.784.064 byte disponibili
Post-Run: 29.482.102.784 byte disponibili

804 --- E O F --- 2009-08-01 16:59

[crazy.cat]

ho accorciato il log per poterlo allegare meglio alla discussione.

Ti sei beccato un bel bagle e forse anche qualche altro virus.
Scansione con kaspersky e poi c'è una dll che ha creato un mucchio di servizi fasulli.
Usa anche findykill e magari un passaggio con malwarebytes non fa mai male.

Se riesco a trovare il tempo provo a prepararti lo script per rimuovere i servizi, ma oggi la giornata è piuttosto incasinata.

Dopo i passaggi con i tools precenti prova a reinstallare un vero antivirus come avira e butta via avg.

[R3wu0]

Fatta la scansione con kaspersky e ho reinstallato, l'antivirus che ora funziona a meraviglia c'è siolo una cosa che ancora non va...ovvero la barra degli strumenti, non riesco a impostrare gli strumenti da isualizzare. o meglio li imposto ma quando faccio apllica e poi ok sembra tutto ok ma se poi riapro le impostazione non ha preso le modifiche...adesso faccio la scansione con findykill e malwarebytes

[R3wu0]

adesso faccio la scansione con findykill e malwarebytes

scansione fatta ma il problema persiste che faccio?

[crazy.cat]

se stai parlando della barra degli strumenti, apri una discussione a parte nella sezione windows.
Francamente non avrei idee al momento.

[R3wu0]

va bene grazie...

[Amantide]

Vediamo di rimuovere i residui delle schifezze che c'erano nel tuo pc, così può darsi che si risolverà anche il problema con la barra degli strumenti.

Copia ed incolla il seguente testo su blocconote e salva il file su desktop con il nome CFScript.txt.

Codice: Seleziona tutto

File::
c:\users\Enrico\AppData\Local\samwqgk.bat
c:\users\Enrico\AppData\Local\aoaqmos.bat
c:\windows\system32\gfsbzgt.dll
c:\program files\Internet Explorer\gfsbzgt.dll

Driver::
bubbo
eyejmoikz
gajwxpy
jufqmhrv
lorbcuh
mckeeo
mmuxmgtci
mxpwzk
orhuy
pbinpv
rdsdqccj
rqmkz
tduqq
ticwlhim
uygtpuh
vdqkricyr
vfekc
wmurn
xhidlzbmy
zytggij


Ora trascina il file CFScript.txt sull'icona di ComboFix. Aspetta il termine della scansione e posta il nuovo log di Combofix.

[R3wu0]

Fatto...copiato e incollato...ora provo a vedere che succede...
in allegato c'è il log...

ComboFix.zip

P.S. è normale che ora facendo proprietà della barra degli strumenti non compaia proprio l'opzione di WMP?

[Amantide]

Fatto...copiato e incollato...ora provo a vedere che succede...
in allegato c'è il log...

ComboFix.zip

Per quanto riguarda i virus, è stato rimosso tutto.

P.S. è normale che ora facendo proprietà della barra degli strumenti non compaia proprio l'opzione di WMP?

Guarda, non avendo installato Vista non so che dirti Però mi sta venendo il dubbio che potrebbe essere anche la colpa di RocketDock di tutte queste disgrazie con la barra dgli strumenti

[R3wu0]

no non credo xk anche prima di prendere il bagle avevo rocket dock e la barra degli strumenti funzionava...misteri di windows...uff...voglio linux