ComboFix 11-04-17.03 - Gilberto 18/04/2011 15:48:14.1.2 - x86
Eseguito da: c:\users\Gilberto\Downloads\ComboFix.exe
* Creato nuovo punto di ripristino
.
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\formatfactoryportable\FormatFactoryPortable.exe
C:\InfoSat.txt
c:\portablevirtualbox\PortableVirtualBox.exe
c:\users\Gilberto\AppData\Roaming\ImgBurn.exe
c:\users\Gilberto\AppData\Roaming\Local
c:\users\Gilberto\AppData\Roaming\Local\Temp\DDM\Settings\(2).ddr
c:\users\Gilberto\AppData\Roaming\Local\Temp\DDM\Settings\(3).ddr
c:\users\Gilberto\AppData\Roaming\Local\Temp\DDM\Settings\.ddr
c:\users\Gilberto\AppData\Roaming\Local\Temp\DDM\Settings\0.ddi
c:\users\Gilberto\AppData\Roaming\Local\Temp\DDM\Settings\1.ddi
c:\users\Gilberto\AppData\Roaming\Local\Temp\DDM\Settings\2.ddi
c:\users\Gilberto\AppData\Roaming\Local\Temp\DDM\Settings\5.ddi
c:\users\Gilberto\AppData\Roaming\Local\Temp\DDM\Settings\Inception_Trailer_592.divx.ddr
c:\users\Gilberto\AppData\Roaming\Local\Temp\DDM\Settings\settings.ddi
c:\users\Gilberto\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\(10).ddp
c:\users\Gilberto\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\(11).ddp
c:\users\Gilberto\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\(12).ddp
c:\users\Gilberto\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\(13).ddp
c:\users\Gilberto\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\(2)
c:\users\Gilberto\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\(2).ddp
c:\users\Gilberto\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\(3)
c:\users\Gilberto\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\(3).ddp
c:\users\Gilberto\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\(4).ddp
c:\users\Gilberto\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\(5).ddp
c:\users\Gilberto\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\(6).ddp
c:\users\Gilberto\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\(7).ddp
c:\users\Gilberto\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\(8).ddp
c:\users\Gilberto\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\(9).ddp
c:\users\Gilberto\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\.ddp
c:\users\Gilberto\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Inception_Trailer_592.divx
c:\users\Gilberto\AppData\Roaming\Microsoft\~DFK3ca46.tmp
c:\users\Gilberto\AppData\Roaming\Microsoft\1eaadjc.dll
c:\users\Gilberto\AppData\Roaming\Microsoft\bass.dll
c:\users\Gilberto\AppData\Roaming\Microsoft\kfgresk.dll
c:\users\Gilberto\AppData\Roaming\Microsoft\mjcriu.dll
c:\users\Gilberto\AppData\Roaming\Microsoft\peaadje.dll
c:\users\Gilberto\AppData\Roaming\Microsoft\qwadjb.dll
c:\users\Gilberto\AppData\Roaming\Microsoft\rsaadjd.dll
c:\users\Gilberto\AppData\Roaming\OfferBox
c:\users\Gilberto\AppData\Roaming\OfferBox\config.dat
c:\users\Gilberto\AppData\Roaming\OfferBox\config.xml
c:\virtualdubmod\virtualdubmod.exe
c:\windows\system32\office.exe
c:\windows\XSxS
.
.
((((((((((((((((((((((((( Files Creati Da 2011-03-18 al 2011-04-18 )))))))))))))))))))))))))))))))))))
.
.
2011-04-18 13:56 . 2011-04-18 13:56 -------- d-----w- c:\users\Gilberto\AppData\Local\temp
2011-04-18 13:56 . 2011-04-18 13:56 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-04-15 12:59 . 2011-04-15 12:59 -------- d-----w- c:\users\Gilberto\AppData\Local\{B4CF318C-9CD8-4782-A007-96C0F1366962}
2011-04-15 00:02 . 2011-04-15 00:02 -------- d-----w- c:\users\Gilberto\AppData\Roaming\KeePass
2011-04-14 14:20 . 2011-04-14 14:20 -------- d-----w- c:\users\Gilberto\AppData\Local\{77600C73-A7B0-47EA-864A-87B79CC654C9}
2011-04-13 23:17 . 2004-06-11 13:33 290304 ----a-w- c:\windows\system32\subinacl.exe
2011-04-13 23:09 . 2011-04-13 23:09 -------- d-----w- c:\program files\Windows Resource Kits
2011-04-13 20:41 . 2011-04-13 20:41 -------- d-----w- C:\AnalyzeProduct
2011-04-13 00:02 . 2011-04-14 23:24 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2011-04-13 00:02 . 2011-04-13 00:05 -------- d-----w- c:\program files\Spybot - Search & Destroy
2011-04-12 18:34 . 2011-04-12 18:35 -------- d-----w- c:\program files\SUPERAntiSpyware
2011-04-12 13:18 . 2011-04-12 13:18 118784 --sha-r- c:\windows\system32\sdrsvca.dll
2011-04-08 23:37 . 2011-04-08 23:37 -------- d-----w- c:\users\Gilberto\AppData\Roaming\QuickScan
2011-04-08 23:15 . 2011-04-08 23:15 -------- d-----w- c:\users\Gilberto\AppData\Roaming\f-secure
2011-04-08 23:15 . 2011-04-08 23:15 -------- d-----w- c:\programdata\F-Secure
2011-04-08 10:25 . 2011-04-08 10:25 -------- d-----w- c:\users\Gilberto\AppData\Roaming\ParetoLogic
2011-04-08 10:25 . 2011-04-08 10:25 -------- d-----w- c:\users\Gilberto\AppData\Roaming\DriverCure
2011-04-08 10:25 . 2011-04-08 10:37 -------- d-----w- c:\programdata\ParetoLogic
2011-04-07 21:15 . 2011-04-07 21:15 -------- d-----w- c:\program files\CCleaner
2011-04-07 18:52 . 2011-04-07 18:52 -------- d-----w- c:\users\Gilberto\AppData\Roaming\Malwarebytes
2011-04-07 18:52 . 2010-12-20 16:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-04-07 18:52 . 2011-04-07 18:52 -------- d-----w- c:\programdata\Malwarebytes
2011-04-07 18:52 . 2011-04-09 00:54 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-04-07 18:52 . 2010-12-20 16:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-04-07 00:21 . 2011-04-07 00:28 98304 ----a-w- c:\windows\Secure.dll
2011-04-06 23:26 . 2011-04-06 23:26 -------- d-----w- c:\users\Gilberto\AppData\Local\{8F8000AF-002A-4666-852C-6AACB59E3F19}
2011-04-06 21:11 . 2011-04-06 21:13 -------- d-----w- c:\program files\Protect Folder Plus
2011-04-04 11:31 . 2011-04-04 23:32 -------- d-----w- c:\users\Gilberto\AppData\Local\{A51DC558-8100-4EAC-8F26-519C0D102A53}
2011-04-01 20:51 . 2011-04-01 20:52 -------- d-----w- C:\GDPoker
2011-03-26 23:26 . 2011-03-26 23:26 -------- d-----w- c:\program files\Smart Projects
2011-03-26 15:18 . 2011-03-26 15:18 -------- d-----w- c:\program files\Auslogics
2011-03-25 11:42 . 2011-03-21 13:58 152064 ----a-w- c:\windows\system32\xvid.ax
2011-03-25 11:42 . 2011-03-19 15:04 650752 ----a-w- c:\windows\system32\xvidcore.dll
2011-03-25 11:41 . 2011-03-19 15:06 240640 ----a-w- c:\windows\system32\xvidvfw.dll
2011-03-25 11:41 . 2011-03-25 11:41 -------- d-----w- c:\users\Gilberto\.bitrock
2011-03-24 14:32 . 2011-03-24 14:33 -------- d-----w- c:\program files\Portrait Professional Studio 9
2011-03-24 13:42 . 2011-03-24 13:42 -------- d-----w- c:\users\Gilberto\AppData\Roaming\Anthropics
2011-03-23 13:11 . 2011-03-23 13:11 -------- d-----w- c:\users\Gilberto\AppData\Local\{553B97A2-ABCC-4FAA-A3EF-78A79B1F8659}
2011-03-19 15:41 . 2011-03-19 15:45 -------- d-----w- c:\program files\MIDIRenderer
2011-03-19 14:56 . 2011-03-19 14:58 -------- d-----w- C:\temp
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-31 13:49 . 2011-01-20 23:03 137656 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-03-15 15:19 . 2011-03-15 15:19 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2011-03-15 15:19 . 2011-03-15 15:19 161792 ----a-w- c:\windows\system32\msls31.dll
2011-03-15 15:19 . 2011-03-15 15:19 1126912 ----a-w- c:\windows\system32\wininet.dll
2011-03-15 15:19 . 2011-03-15 15:19 86528 ----a-w- c:\windows\system32\iesysprep.dll
2011-03-15 15:19 . 2011-03-15 15:19 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2011-03-15 15:19 . 2011-03-15 15:19 74752 ----a-w- c:\windows\system32\iesetup.dll
2011-03-15 15:19 . 2011-03-15 15:19 63488 ----a-w- c:\windows\system32\tdc.ocx
2011-03-15 15:19 . 2011-03-15 15:19 48640 ----a-w- c:\windows\system32\mshtmler.dll
2011-03-15 15:19 . 2011-03-15 15:19 367104 ----a-w- c:\windows\system32\html.iec
2011-03-15 15:19 . 2011-03-15 15:19 23552 ----a-w- c:\windows\system32\licmgr10.dll
2011-03-15 15:19 . 2011-03-15 15:19 152064 ----a-w- c:\windows\system32\wextract.exe
2011-03-15 15:19 . 2011-03-15 15:19 150528 ----a-w- c:\windows\system32\iexpress.exe
2011-03-15 15:19 . 2011-03-15 15:19 1427456 ----a-w- c:\windows\system32\inetcpl.cpl
2011-03-15 15:19 . 2011-03-15 15:19 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2011-03-15 15:19 . 2011-03-15 15:19 420864 ----a-w- c:\windows\system32\vbscript.dll
2011-03-15 15:19 . 2011-03-15 15:19 35840 ----a-w- c:\windows\system32\imgutil.dll
2011-03-15 15:19 . 2011-03-15 15:19 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2011-03-15 15:19 . 2011-03-15 15:19 1797632 ----a-w- c:\windows\system32\jscript9.dll
2011-03-15 15:19 . 2011-03-15 15:19 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2011-03-15 15:19 . 2011-03-15 15:19 11776 ----a-w- c:\windows\system32\mshta.exe
2011-03-15 15:19 . 2011-03-15 15:19 101888 ----a-w- c:\windows\system32\admparse.dll
2011-03-12 00:59 . 2011-03-11 22:10 673546 ----a-w- c:\windows\unins000.exe
2011-03-12 00:49 . 2010-06-24 10:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-03-01 11:26 . 2011-03-01 11:27 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-02-24 09:56 . 2011-02-24 09:55 441064 ----a-w- c:\windows\Gd2x0401.zip
2011-02-23 15:50 . 2011-03-18 13:54 16184 ----a-w- c:\windows\system32\drivers\SmartDefragDriver.sys
2011-02-23 15:50 . 2011-03-18 13:54 29008 ----a-w- c:\windows\system32\SmartDefragBootTime.exe
2011-02-23 11:01 . 2009-07-14 02:05 152576 ----a-w- c:\windows\system32\msclmd.dll
2011-02-13 00:09 . 2011-02-13 00:09 253952 ------w- c:\windows\Setup1.exe
2011-02-13 00:09 . 2011-02-13 00:09 74752 ----a-w- c:\windows\ST6UNST.EXE
2011-02-11 12:53 . 2011-02-11 12:53 69632 ----a-w- c:\windows\system32\realbap1.dll
2011-02-11 12:53 . 2011-02-11 12:53 45568 ----a-w- c:\windows\system32\realbsf1.dll
2011-02-11 00:30 . 2011-02-11 00:30 2560 ----a-w- c:\windows\_MSRSTRT.EXE
2011-02-11 00:05 . 2011-02-03 17:28 81920 ----a-w- c:\users\Gilberto\AppData\Roaming\ezpinst.exe
2011-02-11 00:05 . 2011-02-03 17:28 47360 ----a-w- c:\users\Gilberto\AppData\Roaming\pcouffin.sys
2011-02-05 18:52 . 2011-01-26 13:54 7760687 ----a-w- c:\users\Gilberto\AppData\Roaming\SetupGFD.exe
2011-02-05 18:51 . 2011-01-26 13:54 5243208 ----a-w- c:\users\Gilberto\AppData\Roaming\AvsP.exe
2011-02-05 18:51 . 2011-01-26 13:53 4284535 ----a-w- c:\users\Gilberto\AppData\Roaming\ffdshow.exe
2011-02-05 18:50 . 2011-01-26 13:53 642685 ----a-w- c:\users\Gilberto\AppData\Roaming\xvid.exe
2011-02-05 18:50 . 2011-01-26 13:53 4182178 ----a-w- c:\users\Gilberto\AppData\Roaming\Avisynth.exe
2011-02-04 12:49 . 2011-03-12 13:03 17712 ----a-w- c:\windows\system32\nitrolocalui.dll
2011-02-04 12:49 . 2011-03-12 13:03 26416 ----a-w- c:\windows\system32\nitrolocalmon.dll
2011-02-03 17:28 . 2011-02-03 17:28 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2011-02-03 05:54 . 2011-02-09 13:10 219008 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2011-02-01 11:25 . 2011-02-01 11:25 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\Markup.dll
2011-01-27 18:20 . 2011-01-27 18:20 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2011-01-27 18:20 . 2011-01-27 18:20 375616 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-01-21 18:51 . 2011-01-20 23:32 1251944 ----a-w- c:\windows\RtlExUpd.dll
.
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-12-06 281768]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-22 150528]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"midi2"=mapledxp.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dmboot.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dmio.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dmload.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys]
@="FSFilter System Recovery"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivX Download Manager]
2010-12-08 21:15 63360 ----a-w- c:\program files\DivX\DivX Plus Web Player\DDMService.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2011-01-10 23:25 1230704 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DriverMax_RESTART]
2011-02-15 09:50 9224104 ----a-w- c:\program files\Innovative Solutions\DriverMax\devices.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-05-08 15:24 54840 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Xvid]
2011-01-17 19:41 8192 ----a-w- c:\program files\Xvid\CheckUpdate.exe
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Servizio di Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-01-20 136176]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;WatAdminSvc;c:\windows\system32\Wat\WatAdminSvc.exe [2011-01-21 1343400]
S0 SmartDefragDriver;SmartDefragDriver;c:\windows\System32\Drivers\SmartDefragDriver.sys [2011-02-23 16184]
S1 mapledxp;mapledxp;c:\windows\System32\drivers\mapledxp.SYS [2004-04-05 24720]
S2 CFSDrv;CFSDrv;c:\program files\Protect Folder Plus\CFSDrv.sys [2005-06-16 10240]
S2 CFSService;CFSService;c:\program files\Protect Folder Plus\CFSSvc.exe [2005-06-16 179712]
S2 NitroReaderDriverReadSpool;NitroPDFReaderDriverCreatorReadSpool;c:\program files\Nitro PDF\Reader\NitroPDFReaderDriverService.exe [2011-02-04 196912]
S2 PfFilter;PfFilter;c:\program files\IObit\Protected Folder\pffilter.sys [2011-03-16 32672]
S3 cmudax;C-Media High Definition Audio Interface;c:\windows\system32\drivers\cmudax.sys [2005-05-11 1287296]
S3 Ph3xIB32;Philips 713x Inbox PCI TV Card;c:\windows\system32\DRIVERS\Ph3xIB32.sys [2007-04-03 1131136]
S3 TotRec8;Total Recorder WDM audio filter driver;c:\windows\system32\drivers\TotRec8.sys [2010-11-23 91728]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-09-28 315392]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contenuto della cartella 'Scheduled Tasks'
.
2011-04-18 c:\windows\Tasks\Final Media Player Update Checker.job
- c:\program files\FinalMediaPlayer\FMPCheckForUpdates.exe [2011-03-03 15:50]
.
2011-04-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-14 22:40]
.
2011-04-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-14 22:40]
.
2011-04-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1093936880-3266294500-1679983877-1000Core.job
- c:\users\Gilberto\AppData\Local\Google\Update\GoogleUpdate.exe [2011-01-20 22:40]
.
2011-04-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1093936880-3266294500-1679983877-1000UA.job
- c:\users\Gilberto\AppData\Local\Google\Update\GoogleUpdate.exe [2011-01-20 22:40]
.
.
------- Scansione supplementare -------
.
uStart Page = about:blank
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000
IE: I&nvia a OneNote - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105
Trusted Zone: microsoft.com\update
.
- - - - CHIAVI ORFANE RIMOSSE - - - -
.
WebBrowser-{37483B40-C254-4A72-BDA4-22EE90182C1E} - (no file)
WebBrowser-{90B49673-5506-483E-B92B-CA0265BD9CA8} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKLM-Run-Cmaudio - cmicnfg.cpl
SafeBoot-dmadmin
SafeBoot-dmserver
SafeBoot-SRService
.
.
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{0347C33E-8762-4905-BF09-768834316C61}"=hex:51,66,7a,6c,4c,1d,38,12,50,c0,54,
07,50,c9,6b,0c,c0,1f,35,c8,31,6f,28,75
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{326E768D-4182-46FD-9C16-1449A49795F4}"=hex:51,66,7a,6c,4c,1d,38,12,e3,75,7d,
36,b0,0f,93,03,e3,00,57,09,a1,c9,d1,e0
"{593DDEC6-7468-4CDD-90E1-42DADAA222E9}"=hex:51,66,7a,6c,4c,1d,38,12,a8,dd,2e,
5d,5a,3a,b3,09,ef,f7,01,9a,df,fc,66,fd
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
94,30,02,d1,0f,f1,da,12,24,73,56,27,d2
"{B4F3A835-0E21-4959-BA22-42B3008E02FF}"=hex:51,66,7a,6c,4c,1d,38,12,5b,ab,e0,
b0,13,40,37,0c,c5,34,01,f3,05,d0,46,eb
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
"{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856}"=hex:51,66,7a,6c,4c,1d,38,12,91,fc,ec,
fb,7c,81,45,0a,c2,d4,4d,32,e4,48,ec,42
"{555D4D79-4BD2-4094-A395-CFC534424A05}"=hex:51,66,7a,6c,4c,1d,38,12,17,4e,4e,
51,e0,05,fa,05,dc,83,8c,85,31,1c,0e,11
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:8e,04,fb,ce,73,e5,cb,01
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,b2,83,5d,4e,ca,54,84,4f,92,7f,44,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,b2,83,5d,4e,ca,54,84,4f,92,7f,44,\
.
[HKEY_USERS\S-1-5-21-1093936880-3266294500-1679983877-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{0739A8BA-A3CA-1DDF-73F3-65D56926B178}*]
@Allowed: (Read) (RestrictedCode)
"oamjjnmncconoackeochpijadnfjac"=hex:64,61,6c,6c,6b,68,6d,6b,00,fc
"oailbhiankdoikaokjeipncnmogbdp"=hex:69,61,66,6d,6a,66,69,6a,70,6a,66,63,6f,66,
68,66,6d,66,00,00
"naclhcgddjoddjgihpjlgfdpldfi"=hex:69,61,66,6d,6a,66,66,6a,69,68,6f,70,6d,69,
69,66,6c,6e,00,00
"eaalbockbm"=hex:66,61,66,6a,6f,68,69,6a,6c,64,61,66,00,d8
"cajknb"=hex:6b,62,6b,6d,6d,6b,62,6e,69,61,62,62,63,61,62,64,68,67,65,70,67,63,
64,65,68,6e,61,6c,61,68,6f,63,67,70,65,61,63,66,6a,66,68,6f,68,6b,68,6d,70,\
.
[HKEY_USERS\S-1-5-21-1093936880-3266294500-1679983877-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{5BF15D7E-E274-656A-87A5-6AB6E4242F93}*]
@Allowed: (Read) (RestrictedCode)
"oabhfmbolhpdmooongpjbgjoeenoko"=hex:6a,61,6b,62,70,6f,62,6c,64,68,6a,6c,6d,65,
64,6c,6d,6e,6c,6f,00,00
"nalkpokecbdfmhjmdjnhjmoiahga"=hex:6a,61,6b,62,70,6f,62,6c,64,68,6a,6c,6d,65,
64,6c,6d,6e,6c,6f,00,00
"eajkfjoaoj"=hex:66,61,65,66,65,62,6e,6d,61,64,70,61,00,01
"caihpc"=hex:65,63,63,62,65,6b,68,69,69,6b,6d,67,6b,69,61,68,68,6d,62,65,61,68,
6c,63,6f,6d,67,6e,6c,66,6d,66,64,65,6c,70,6f,66,66,6c,69,6d,6f,6e,6a,6c,66,\
"oafhpodmpfdnphnnmcoicfianohejl"=hex:64,61,6b,62,6f,6f,70,6c,00,fc
.
[HKEY_USERS\S-1-5-21-1093936880-3266294500-1679983877-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{BE8707C6-2068-853A-FEBC-829BE8F93FB1}*]
@Allowed: (Read) (RestrictedCode)
"ialcedodmdloodnihd"=hex:6b,61,67,6a,67,6a,66,67,65,6d,6f,63,69,61,66,70,66,68,
62,67,67,68,00,00
"habeoeeipimkcofn"=hex:6b,61,67,6a,67,6a,66,67,65,6d,6f,63,69,61,66,70,66,68,
62,67,67,68,00,00
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Ora fine scansione: 2011-04-18 16:00:48
ComboFix-quarantined-files.txt 2011-04-18 14:00
.
Pre-Run: 192.838.893.568 byte disponibili
Post-Run: 192.780.533.760 byte disponibili
.
- - End Of File - - 487090262A4816BC0CAEBDC05B084323
Esegui 
![[MLI]](http://www.megalab.it/forum/images/smilies/mli.gif "MegaLab.it")
Power User.
