PC1
ComboFix 11-06-27.03 - TerminatoR 28/06/2011 10:31:37.1.8 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.39.1040.18.12286.9854 [GMT 2:00]
Eseguito da: d:\download\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Updated* {56547CC9-C9B2-849D-8FEF-A496150D6A06}
FW: Kaspersky Internet Security *Disabled* {6E6FFDEC-83DD-85C5-A4B0-0DA3EBDE2D7D}
SP: Kaspersky Internet Security *Disabled/Updated* {ED359D2D-EF88-8B13-B55F-9FE46E8A20BB}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Creati Da 2011-05-28 al 2011-06-28 )))))))))))))))))))))))))))))))))))
.
.
2011-06-28 08:41 . 2011-06-28 08:41 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-06-28 08:17 . 2011-06-28 08:17 794408 ----a-w- c:\windows\SysWow64\pbsvc.exe
2011-06-28 07:13 . 2011-06-20 06:57 8873296 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{1A0DFAE4-104F-4027-9FD1-95CF7B9E37D3}\mpengine.dll
2011-06-27 15:37 . 2011-06-27 15:37 -------- d-sh--w- c:\programdata\DSS
2011-06-27 15:29 . 2011-06-27 15:31 -------- d-----w- c:\programdata\Origin
2011-06-27 15:29 . 2011-06-27 15:29 -------- d-----w- c:\program files (x86)\Origin Games
2011-06-27 15:28 . 2011-06-27 15:29 -------- d-----w- c:\program files (x86)\Origin
2011-06-27 15:24 . 2010-09-16 19:03 2601752 ----a-w- c:\windows\SysWow64\pbsvc_moh.exe
2011-06-27 15:24 . 2011-06-27 15:24 -------- d-----w- c:\program files (x86)\Common Files\Adobe AIR
2011-06-27 15:23 . 2011-06-27 15:28 -------- d-----w- c:\program files (x86)\Electronic Arts
2011-06-27 14:18 . 2011-06-27 14:22 -------- d-----w- c:\programdata\Solidshield
2011-06-27 14:04 . 2011-06-27 14:04 -------- d-----w- c:\programdata\Electronic Arts
2011-06-27 14:04 . 2011-06-27 14:04 -------- d-----w- c:\programdata\EA Core
2011-06-26 20:55 . 2011-06-27 17:11 270856 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2011-06-26 20:52 . 2011-06-28 08:17 111928 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2011-06-26 20:52 . 2011-06-27 15:24 189248 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2011-06-26 20:52 . 2011-06-28 08:17 75064 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2011-06-26 20:52 . 2011-06-26 20:52 2434856 ----a-w- c:\windows\SysWow64\pbsvc_bc2.exe
2011-06-24 15:51 . 2010-06-02 02:55 74072 ----a-w- c:\windows\SysWow64\XAPOFX1_5.dll
2011-06-24 15:51 . 2010-06-02 02:55 527192 ----a-w- c:\windows\SysWow64\XAudio2_7.dll
2011-06-24 15:51 . 2010-06-02 02:55 239960 ----a-w- c:\windows\SysWow64\xactengine3_7.dll
2011-06-24 15:51 . 2010-05-26 09:41 2106216 ----a-w- c:\windows\SysWow64\D3DCompiler_43.dll
2011-06-24 15:51 . 2010-05-26 09:41 1868128 ----a-w- c:\windows\SysWow64\d3dcsx_43.dll
2011-06-24 15:51 . 2010-05-26 09:41 470880 ----a-w- c:\windows\SysWow64\d3dx10_43.dll
2011-06-24 15:51 . 2010-05-26 09:41 248672 ----a-w- c:\windows\SysWow64\d3dx11_43.dll
2011-06-24 15:51 . 2010-05-26 09:41 1998168 ----a-w- c:\windows\SysWow64\D3DX9_43.dll
2011-06-23 17:02 . 2009-09-04 15:44 517960 ----a-w- c:\windows\system32\XAudio2_5.dll
2011-06-23 17:02 . 2009-09-04 15:44 515416 ----a-w- c:\windows\SysWow64\XAudio2_5.dll
2011-06-23 17:02 . 2009-09-04 15:44 238936 ----a-w- c:\windows\SysWow64\xactengine3_5.dll
2011-06-23 17:02 . 2009-09-04 15:44 176968 ----a-w- c:\windows\system32\xactengine3_5.dll
2011-06-23 17:02 . 2009-09-04 15:29 1974616 ----a-w- c:\windows\SysWow64\D3DCompiler_42.dll
2011-06-23 17:02 . 2009-09-04 15:29 2582888 ----a-w- c:\windows\system32\D3DCompiler_42.dll
2011-06-23 16:36 . 2011-06-23 16:36 -------- d-----w- c:\windows\system32\SPReview
2011-06-23 16:36 . 2011-06-23 16:36 -------- d-----w- c:\windows\system32\EventProviders
2011-06-23 16:28 . 2010-11-20 13:27 1225216 ----a-w- c:\windows\system32\wbem\wbemcore.dll
2011-06-23 16:27 . 2010-11-20 13:27 37376 ----a-w- c:\windows\system32\wups2.dll
2011-06-23 15:30 . 2011-06-23 15:30 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-06-23 15:30 . 2011-06-23 15:30 -------- d-----w- c:\windows\SysWow64\Macromed
2011-06-23 15:02 . 2011-06-10 14:32 34624 ----a-w- c:\windows\system32\TURegOpt.exe
2011-06-23 15:02 . 2011-06-10 14:19 25920 ----a-w- c:\windows\system32\authuitu.dll
2011-06-23 15:02 . 2011-06-10 14:19 21312 ----a-w- c:\windows\SysWow64\authuitu.dll
2011-06-23 15:02 . 2011-06-10 14:18 36160 ----a-w- c:\windows\system32\uxtuneup.dll
2011-06-23 15:02 . 2011-06-10 14:18 29504 ----a-w- c:\windows\SysWow64\uxtuneup.dll
2011-06-23 15:02 . 2011-06-23 15:04 -------- d-----w- c:\program files (x86)\TuneUp Utilities 2011
2011-06-23 15:01 . 2011-06-23 15:02 -------- d-----w- c:\programdata\TuneUp Software
2011-06-23 15:01 . 2011-06-23 15:01 -------- d-sh--w- c:\programdata\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
2011-06-23 14:58 . 2011-06-23 14:58 -------- d-----w- c:\program files (x86)\Disktrix
2011-06-23 14:26 . 2011-06-28 07:09 -------- d-----w- c:\program files (x86)\EVGA Precision
2011-06-23 14:25 . 2011-06-23 14:25 -------- d-----w- c:\program files (x86)\EMET
2011-06-23 14:16 . 2011-06-23 14:19 -------- d-----w- c:\program files\TeamSpeak 3 Client
2011-06-23 13:48 . 2011-06-23 13:48 285280 ----a-w- c:\windows\system32\drivers\afcdp.sys
2011-06-23 13:48 . 2011-06-23 13:48 1263200 ----a-w- c:\windows\system32\drivers\tdrpm273.sys
2011-06-23 13:48 . 2011-06-23 13:48 970336 ----a-w- c:\windows\system32\drivers\timntr.sys
2011-06-23 13:48 . 2011-06-23 13:48 277088 ----a-w- c:\windows\system32\drivers\snapman.sys
2011-06-23 13:47 . 2011-06-23 13:47 -------- d-----w- c:\program files (x86)\Acronis
2011-06-23 13:47 . 2011-06-23 13:48 -------- d-----w- c:\program files (x86)\Common Files\Acronis
2011-06-23 13:39 . 2011-06-23 13:39 -------- d-----w- c:\program files (x86)\Microsoft.NET
2011-06-23 13:31 . 2011-06-23 13:31 -------- d-----w- c:\windows\SysWow64\wbem\en-US
2011-06-23 13:31 . 2011-06-23 13:31 -------- d-----w- c:\windows\system32\wbem\en-US
2011-06-23 13:20 . 2011-06-23 13:20 995328 ----a-w- c:\program files\Common Files\Microsoft Shared\VGX\VGX.dll
2011-06-23 13:19 . 2011-06-23 13:19 -------- d-----w- C:\NVIDIA
2011-06-23 13:17 . 2011-02-19 12:05 1139200 ----a-w- c:\windows\system32\FntCache.dll
2011-06-23 13:17 . 2011-02-19 12:04 1544192 ----a-w- c:\windows\system32\DWrite.dll
2011-06-23 13:17 . 2011-02-19 12:04 902656 ----a-w- c:\windows\system32\d2d1.dll
2011-06-23 13:17 . 2011-02-19 06:30 1076736 ----a-w- c:\windows\SysWow64\DWrite.dll
2011-06-23 13:17 . 2011-02-19 06:30 739840 ----a-w- c:\windows\SysWow64\d2d1.dll
2011-06-23 12:51 . 2011-06-23 12:51 319488 ----a-w- c:\windows\HideWin.exe
2011-06-23 12:51 . 2008-07-15 05:58 524288 ------r- c:\windows\RtlExUpd.dll
2011-06-23 12:49 . 2011-06-23 12:54 -------- d-----w- c:\program files (x86)\Intel
2011-06-23 12:49 . 2008-08-19 02:56 53248 ----a-r- c:\windows\SysWow64\CSVer.dll
2011-06-23 12:49 . 2011-06-23 12:49 -------- d-----w- c:\program files (x86)\Browser Configuration Utility
2011-06-23 12:49 . 2008-05-02 13:08 146528 ----a-w- c:\windows\SysWow64\dvmurl.dll
2011-06-23 12:48 . 2011-06-23 12:48 -------- d-----w- c:\program files (x86)\GIGABYTE
2011-06-23 12:48 . 2011-06-23 13:27 -------- d--h--w- c:\program files (x86)\InstallShield Installation Information
2011-06-23 12:48 . 2011-06-23 12:48 -------- d-----w- c:\program files (x86)\Common Files\InstallShield
2011-06-23 12:48 . 2011-06-28 08:42 24072 ----a-w- c:\windows\gdrv.sys
2011-06-23 12:45 . 2011-06-27 07:20 23112 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2011-06-23 12:45 . 2011-06-23 12:45 -------- d-----w- c:\program files\Hitman Pro 3.5
2011-06-23 12:45 . 2011-06-23 14:40 -------- d-----w- c:\programdata\Hitman Pro
2011-06-23 12:41 . 2011-06-28 08:42 -------- d-----w- c:\programdata\NVIDIA
2011-06-23 12:38 . 2011-06-23 12:38 -------- d-----w- c:\windows\SysWow64\Wat
2011-06-23 12:38 . 2011-06-23 12:38 -------- d-----w- c:\windows\system32\Wat
2011-06-23 12:14 . 2010-02-23 08:16 294912 ----a-w- c:\windows\system32\browserchoice.exe
2011-06-23 12:11 . 2011-06-23 12:11 -------- d-----w- c:\programdata\NVIDIA Corporation
2011-06-23 12:11 . 2011-06-23 13:27 -------- d-----w- c:\program files\NVIDIA Corporation
2011-06-23 10:37 . 2011-03-12 12:08 1465344 ----a-w- c:\windows\system32\XpsPrint.dll
2011-06-23 10:36 . 2011-02-05 17:10 642944 ----a-w- c:\windows\system32\winload.efi
2011-06-23 10:34 . 2011-05-24 17:14 270720 ------w- c:\windows\system32\MpSigStub.exe
2011-06-23 10:29 . 2011-06-23 09:49 -------- d-----w- c:\windows\Panther
2011-06-23 10:21 . 2011-06-23 10:21 -------- d-----w- C:\Windows.old
2011-06-23 10:06 . 2011-06-28 08:42 -------- d-----w- c:\programdata\Kaspersky Lab
2011-06-23 10:06 . 2011-06-23 10:06 -------- d-----w- c:\program files (x86)\Kaspersky Lab
2011-06-23 10:04 . 2011-06-28 08:12 -------- d-sh--w- c:\windows\Installer
2011-06-23 10:03 . 2011-06-23 10:03 -------- d-----w- c:\programdata\Kaspersky Lab Setup Files
2011-06-23 06:31 . 2011-06-23 07:52 -------- d-----w- C:\RaidTool
2011-06-23 06:29 . 2011-06-23 06:29 -------- d-----w- C:\Intel
2011-06-23 00:35 . 2011-06-23 09:49 -------- d-----w- C:\Recovery
2011-06-23 00:35 . 2011-06-23 00:35 -------- d-sh--we C:\Programmi
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-23 16:39 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
2011-06-23 16:39 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
2011-05-25 07:25 . 2011-02-22 23:38 1016936 ----a-w- c:\windows\system32\nvvsvc.exe
2011-05-25 07:25 . 2011-02-22 23:39 3040872 ----a-w- c:\windows\system32\nvsvc64.dll
2011-05-25 07:25 . 2011-02-22 23:38 61544 ----a-w- c:\windows\system32\nvshext.dll
2011-05-25 07:25 . 2011-02-22 23:38 117864 ----a-w- c:\windows\system32\nvmctray.dll
2011-05-25 07:25 . 2011-02-22 23:39 6300776 ----a-w- c:\windows\system32\nvcpl.dll
2011-05-25 07:25 . 2011-02-22 23:39 739432 ----a-w- c:\windows\system32\easyUpdatusAPIU64.dll
2011-05-25 07:25 . 2011-02-23 00:58 8863336 ----a-w- c:\windows\system32\nvwgf2umx.dll
2011-05-25 07:25 . 2011-02-23 00:58 2644584 ----a-w- c:\windows\system32\nvapi64.dll
2011-05-20 20:35 . 2011-05-20 20:35 304744 ----a-w- c:\windows\SysWow64\nvStreaming.exe
2011-05-18 07:50 . 2011-05-18 07:50 49488 ----a-w- c:\windows\apppatch\AppPatch64\EMET64.dll
2011-05-18 07:49 . 2011-05-18 07:49 44368 ----a-w- c:\windows\apppatch\EMET.dll
2011-05-10 22:12 . 2011-05-10 22:12 105800 ----a-w- c:\windows\system32\UDBDef.exe
.
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"Steam"="d:\program files (x86)\Steam\Steam.exe" [2011-06-23 1242448]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AVP"="c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe" [2010-11-02 365336]
"SAOB Monitor"="c:\program files (x86)\Acronis\TrueImageHome\OnlineBackupStandalone\TrueImageMonitor.exe" [2010-11-16 2564096]
"TrueImageMonitor.exe"="c:\program files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe" [2010-12-16 5571008]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~2\KASPER~1\KASPER~1\sbhook.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 GEST Service;GEST Service for program management.;c:\program files (x86)\GIGABYTE\EnergySaver\GSvr.exe [2008-12-08 68136]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Servizio Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 tdrpman273;Acronis Try&Decide and Restore Points filter (build 273);c:\windows\system32\DRIVERS\tdrpm273.sys [x]
S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [x]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [x]
S2 afcdpsrv;Servizio Acronis Nonstop Backup;c:\program files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe [2011-06-23 3246040]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-05-25 2214504]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-05-20 378472]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe [2011-06-10 2026304]
S3 afcdp;afcdp;c:\windows\system32\DRIVERS\afcdp.sys [x]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [x]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]
S3 RTCore64;RTCore64;c:\program files (x86)\EVGA Precision\RTCore64.sys [2011-01-17 14440]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys [2011-02-10 11856]
.
.
Contenuto della cartella 'Scheduled Tasks'
.
2011-06-24 c:\windows\Tasks\Defrag Job 00.job
- c:\program files (x86)\Disktrix\UltimateDefrag\Udefrag.exe [2011-05-10 22:12]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RAVCpl64.exe" [2008-07-24 6452256]
"Skytel"="Skytel.exe" [2008-07-24 1833504]
"Servizio Acronis Scheduler2"="c:\program files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe" [2010-12-16 391008]
.
------- Scansione supplementare -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\TerminatoR\AppData\Roaming\Mozilla\Firefox\Profiles\nub3o554.default\
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - CHIAVI ORFANE RIMOSSE - - - -
.
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe
.
.
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
.
[HKEY_USERS\S-1-5-21-2183938321-3593089046-1023333521-1000\Software\SecuROM\License information*]
"datasecu"=hex:a9,68,da,00,1a,9b,10,07,a4,8d,04,7e,b7,1b,a9,57,d2,77,a4,1b,52,
87,47,c4,4e,d9,2b,55,f5,02,0a,35,ad,13,15,42,fd,c0,77,2e,ba,41,b6,e2,c0,bb,\
"rkeysecu"=hex:07,ed,d9,eb,25,58,8a,42,24,8b,9c,4a,93,ef,a7,cc
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\program files (x86)\EVGA Precision\EVGAPrecision.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\EVGA Precision\Bundle\OSDServer\RTSS.exe
.
**************************************************************************
.
Ora fine scansione: 2011-06-28 10:46:09 - Il pc è stato riavviato
ComboFix-quarantined-files.txt 2011-06-28 08:46
.
Pre-Run: 91.396.427.776 byte disponibili
Post-Run: 91.626.676.224 byte disponibili
.
- - End Of File - - FAB5ECCC196CF9104C4E04B4E3747128
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.39.1040.18.12286.9854 [GMT 2:00]
Eseguito da: d:\download\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Updated* {56547CC9-C9B2-849D-8FEF-A496150D6A06}
FW: Kaspersky Internet Security *Disabled* {6E6FFDEC-83DD-85C5-A4B0-0DA3EBDE2D7D}
SP: Kaspersky Internet Security *Disabled/Updated* {ED359D2D-EF88-8B13-B55F-9FE46E8A20BB}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Creati Da 2011-05-28 al 2011-06-28 )))))))))))))))))))))))))))))))))))
.
.
2011-06-28 08:41 . 2011-06-28 08:41 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-06-28 08:17 . 2011-06-28 08:17 794408 ----a-w- c:\windows\SysWow64\pbsvc.exe
2011-06-28 07:13 . 2011-06-20 06:57 8873296 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{1A0DFAE4-104F-4027-9FD1-95CF7B9E37D3}\mpengine.dll
2011-06-27 15:37 . 2011-06-27 15:37 -------- d-sh--w- c:\programdata\DSS
2011-06-27 15:29 . 2011-06-27 15:31 -------- d-----w- c:\programdata\Origin
2011-06-27 15:29 . 2011-06-27 15:29 -------- d-----w- c:\program files (x86)\Origin Games
2011-06-27 15:28 . 2011-06-27 15:29 -------- d-----w- c:\program files (x86)\Origin
2011-06-27 15:24 . 2010-09-16 19:03 2601752 ----a-w- c:\windows\SysWow64\pbsvc_moh.exe
2011-06-27 15:24 . 2011-06-27 15:24 -------- d-----w- c:\program files (x86)\Common Files\Adobe AIR
2011-06-27 15:23 . 2011-06-27 15:28 -------- d-----w- c:\program files (x86)\Electronic Arts
2011-06-27 14:18 . 2011-06-27 14:22 -------- d-----w- c:\programdata\Solidshield
2011-06-27 14:04 . 2011-06-27 14:04 -------- d-----w- c:\programdata\Electronic Arts
2011-06-27 14:04 . 2011-06-27 14:04 -------- d-----w- c:\programdata\EA Core
2011-06-26 20:55 . 2011-06-27 17:11 270856 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2011-06-26 20:52 . 2011-06-28 08:17 111928 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2011-06-26 20:52 . 2011-06-27 15:24 189248 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2011-06-26 20:52 . 2011-06-28 08:17 75064 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2011-06-26 20:52 . 2011-06-26 20:52 2434856 ----a-w- c:\windows\SysWow64\pbsvc_bc2.exe
2011-06-24 15:51 . 2010-06-02 02:55 74072 ----a-w- c:\windows\SysWow64\XAPOFX1_5.dll
2011-06-24 15:51 . 2010-06-02 02:55 527192 ----a-w- c:\windows\SysWow64\XAudio2_7.dll
2011-06-24 15:51 . 2010-06-02 02:55 239960 ----a-w- c:\windows\SysWow64\xactengine3_7.dll
2011-06-24 15:51 . 2010-05-26 09:41 2106216 ----a-w- c:\windows\SysWow64\D3DCompiler_43.dll
2011-06-24 15:51 . 2010-05-26 09:41 1868128 ----a-w- c:\windows\SysWow64\d3dcsx_43.dll
2011-06-24 15:51 . 2010-05-26 09:41 470880 ----a-w- c:\windows\SysWow64\d3dx10_43.dll
2011-06-24 15:51 . 2010-05-26 09:41 248672 ----a-w- c:\windows\SysWow64\d3dx11_43.dll
2011-06-24 15:51 . 2010-05-26 09:41 1998168 ----a-w- c:\windows\SysWow64\D3DX9_43.dll
2011-06-23 17:02 . 2009-09-04 15:44 517960 ----a-w- c:\windows\system32\XAudio2_5.dll
2011-06-23 17:02 . 2009-09-04 15:44 515416 ----a-w- c:\windows\SysWow64\XAudio2_5.dll
2011-06-23 17:02 . 2009-09-04 15:44 238936 ----a-w- c:\windows\SysWow64\xactengine3_5.dll
2011-06-23 17:02 . 2009-09-04 15:44 176968 ----a-w- c:\windows\system32\xactengine3_5.dll
2011-06-23 17:02 . 2009-09-04 15:29 1974616 ----a-w- c:\windows\SysWow64\D3DCompiler_42.dll
2011-06-23 17:02 . 2009-09-04 15:29 2582888 ----a-w- c:\windows\system32\D3DCompiler_42.dll
2011-06-23 16:36 . 2011-06-23 16:36 -------- d-----w- c:\windows\system32\SPReview
2011-06-23 16:36 . 2011-06-23 16:36 -------- d-----w- c:\windows\system32\EventProviders
2011-06-23 16:28 . 2010-11-20 13:27 1225216 ----a-w- c:\windows\system32\wbem\wbemcore.dll
2011-06-23 16:27 . 2010-11-20 13:27 37376 ----a-w- c:\windows\system32\wups2.dll
2011-06-23 15:30 . 2011-06-23 15:30 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-06-23 15:30 . 2011-06-23 15:30 -------- d-----w- c:\windows\SysWow64\Macromed
2011-06-23 15:02 . 2011-06-10 14:32 34624 ----a-w- c:\windows\system32\TURegOpt.exe
2011-06-23 15:02 . 2011-06-10 14:19 25920 ----a-w- c:\windows\system32\authuitu.dll
2011-06-23 15:02 . 2011-06-10 14:19 21312 ----a-w- c:\windows\SysWow64\authuitu.dll
2011-06-23 15:02 . 2011-06-10 14:18 36160 ----a-w- c:\windows\system32\uxtuneup.dll
2011-06-23 15:02 . 2011-06-10 14:18 29504 ----a-w- c:\windows\SysWow64\uxtuneup.dll
2011-06-23 15:02 . 2011-06-23 15:04 -------- d-----w- c:\program files (x86)\TuneUp Utilities 2011
2011-06-23 15:01 . 2011-06-23 15:02 -------- d-----w- c:\programdata\TuneUp Software
2011-06-23 15:01 . 2011-06-23 15:01 -------- d-sh--w- c:\programdata\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
2011-06-23 14:58 . 2011-06-23 14:58 -------- d-----w- c:\program files (x86)\Disktrix
2011-06-23 14:26 . 2011-06-28 07:09 -------- d-----w- c:\program files (x86)\EVGA Precision
2011-06-23 14:25 . 2011-06-23 14:25 -------- d-----w- c:\program files (x86)\EMET
2011-06-23 14:16 . 2011-06-23 14:19 -------- d-----w- c:\program files\TeamSpeak 3 Client
2011-06-23 13:48 . 2011-06-23 13:48 285280 ----a-w- c:\windows\system32\drivers\afcdp.sys
2011-06-23 13:48 . 2011-06-23 13:48 1263200 ----a-w- c:\windows\system32\drivers\tdrpm273.sys
2011-06-23 13:48 . 2011-06-23 13:48 970336 ----a-w- c:\windows\system32\drivers\timntr.sys
2011-06-23 13:48 . 2011-06-23 13:48 277088 ----a-w- c:\windows\system32\drivers\snapman.sys
2011-06-23 13:47 . 2011-06-23 13:47 -------- d-----w- c:\program files (x86)\Acronis
2011-06-23 13:47 . 2011-06-23 13:48 -------- d-----w- c:\program files (x86)\Common Files\Acronis
2011-06-23 13:39 . 2011-06-23 13:39 -------- d-----w- c:\program files (x86)\Microsoft.NET
2011-06-23 13:31 . 2011-06-23 13:31 -------- d-----w- c:\windows\SysWow64\wbem\en-US
2011-06-23 13:31 . 2011-06-23 13:31 -------- d-----w- c:\windows\system32\wbem\en-US
2011-06-23 13:20 . 2011-06-23 13:20 995328 ----a-w- c:\program files\Common Files\Microsoft Shared\VGX\VGX.dll
2011-06-23 13:19 . 2011-06-23 13:19 -------- d-----w- C:\NVIDIA
2011-06-23 13:17 . 2011-02-19 12:05 1139200 ----a-w- c:\windows\system32\FntCache.dll
2011-06-23 13:17 . 2011-02-19 12:04 1544192 ----a-w- c:\windows\system32\DWrite.dll
2011-06-23 13:17 . 2011-02-19 12:04 902656 ----a-w- c:\windows\system32\d2d1.dll
2011-06-23 13:17 . 2011-02-19 06:30 1076736 ----a-w- c:\windows\SysWow64\DWrite.dll
2011-06-23 13:17 . 2011-02-19 06:30 739840 ----a-w- c:\windows\SysWow64\d2d1.dll
2011-06-23 12:51 . 2011-06-23 12:51 319488 ----a-w- c:\windows\HideWin.exe
2011-06-23 12:51 . 2008-07-15 05:58 524288 ------r- c:\windows\RtlExUpd.dll
2011-06-23 12:49 . 2011-06-23 12:54 -------- d-----w- c:\program files (x86)\Intel
2011-06-23 12:49 . 2008-08-19 02:56 53248 ----a-r- c:\windows\SysWow64\CSVer.dll
2011-06-23 12:49 . 2011-06-23 12:49 -------- d-----w- c:\program files (x86)\Browser Configuration Utility
2011-06-23 12:49 . 2008-05-02 13:08 146528 ----a-w- c:\windows\SysWow64\dvmurl.dll
2011-06-23 12:48 . 2011-06-23 12:48 -------- d-----w- c:\program files (x86)\GIGABYTE
2011-06-23 12:48 . 2011-06-23 13:27 -------- d--h--w- c:\program files (x86)\InstallShield Installation Information
2011-06-23 12:48 . 2011-06-23 12:48 -------- d-----w- c:\program files (x86)\Common Files\InstallShield
2011-06-23 12:48 . 2011-06-28 08:42 24072 ----a-w- c:\windows\gdrv.sys
2011-06-23 12:45 . 2011-06-27 07:20 23112 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2011-06-23 12:45 . 2011-06-23 12:45 -------- d-----w- c:\program files\Hitman Pro 3.5
2011-06-23 12:45 . 2011-06-23 14:40 -------- d-----w- c:\programdata\Hitman Pro
2011-06-23 12:41 . 2011-06-28 08:42 -------- d-----w- c:\programdata\NVIDIA
2011-06-23 12:38 . 2011-06-23 12:38 -------- d-----w- c:\windows\SysWow64\Wat
2011-06-23 12:38 . 2011-06-23 12:38 -------- d-----w- c:\windows\system32\Wat
2011-06-23 12:14 . 2010-02-23 08:16 294912 ----a-w- c:\windows\system32\browserchoice.exe
2011-06-23 12:11 . 2011-06-23 12:11 -------- d-----w- c:\programdata\NVIDIA Corporation
2011-06-23 12:11 . 2011-06-23 13:27 -------- d-----w- c:\program files\NVIDIA Corporation
2011-06-23 10:37 . 2011-03-12 12:08 1465344 ----a-w- c:\windows\system32\XpsPrint.dll
2011-06-23 10:36 . 2011-02-05 17:10 642944 ----a-w- c:\windows\system32\winload.efi
2011-06-23 10:34 . 2011-05-24 17:14 270720 ------w- c:\windows\system32\MpSigStub.exe
2011-06-23 10:29 . 2011-06-23 09:49 -------- d-----w- c:\windows\Panther
2011-06-23 10:21 . 2011-06-23 10:21 -------- d-----w- C:\Windows.old
2011-06-23 10:06 . 2011-06-28 08:42 -------- d-----w- c:\programdata\Kaspersky Lab
2011-06-23 10:06 . 2011-06-23 10:06 -------- d-----w- c:\program files (x86)\Kaspersky Lab
2011-06-23 10:04 . 2011-06-28 08:12 -------- d-sh--w- c:\windows\Installer
2011-06-23 10:03 . 2011-06-23 10:03 -------- d-----w- c:\programdata\Kaspersky Lab Setup Files
2011-06-23 06:31 . 2011-06-23 07:52 -------- d-----w- C:\RaidTool
2011-06-23 06:29 . 2011-06-23 06:29 -------- d-----w- C:\Intel
2011-06-23 00:35 . 2011-06-23 09:49 -------- d-----w- C:\Recovery
2011-06-23 00:35 . 2011-06-23 00:35 -------- d-sh--we C:\Programmi
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-23 16:39 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
2011-06-23 16:39 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
2011-05-25 07:25 . 2011-02-22 23:38 1016936 ----a-w- c:\windows\system32\nvvsvc.exe
2011-05-25 07:25 . 2011-02-22 23:39 3040872 ----a-w- c:\windows\system32\nvsvc64.dll
2011-05-25 07:25 . 2011-02-22 23:38 61544 ----a-w- c:\windows\system32\nvshext.dll
2011-05-25 07:25 . 2011-02-22 23:38 117864 ----a-w- c:\windows\system32\nvmctray.dll
2011-05-25 07:25 . 2011-02-22 23:39 6300776 ----a-w- c:\windows\system32\nvcpl.dll
2011-05-25 07:25 . 2011-02-22 23:39 739432 ----a-w- c:\windows\system32\easyUpdatusAPIU64.dll
2011-05-25 07:25 . 2011-02-23 00:58 8863336 ----a-w- c:\windows\system32\nvwgf2umx.dll
2011-05-25 07:25 . 2011-02-23 00:58 2644584 ----a-w- c:\windows\system32\nvapi64.dll
2011-05-20 20:35 . 2011-05-20 20:35 304744 ----a-w- c:\windows\SysWow64\nvStreaming.exe
2011-05-18 07:50 . 2011-05-18 07:50 49488 ----a-w- c:\windows\apppatch\AppPatch64\EMET64.dll
2011-05-18 07:49 . 2011-05-18 07:49 44368 ----a-w- c:\windows\apppatch\EMET.dll
2011-05-10 22:12 . 2011-05-10 22:12 105800 ----a-w- c:\windows\system32\UDBDef.exe
.
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"Steam"="d:\program files (x86)\Steam\Steam.exe" [2011-06-23 1242448]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AVP"="c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe" [2010-11-02 365336]
"SAOB Monitor"="c:\program files (x86)\Acronis\TrueImageHome\OnlineBackupStandalone\TrueImageMonitor.exe" [2010-11-16 2564096]
"TrueImageMonitor.exe"="c:\program files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe" [2010-12-16 5571008]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~2\KASPER~1\KASPER~1\sbhook.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 GEST Service;GEST Service for program management.;c:\program files (x86)\GIGABYTE\EnergySaver\GSvr.exe [2008-12-08 68136]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Servizio Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 tdrpman273;Acronis Try&Decide and Restore Points filter (build 273);c:\windows\system32\DRIVERS\tdrpm273.sys [x]
S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [x]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [x]
S2 afcdpsrv;Servizio Acronis Nonstop Backup;c:\program files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe [2011-06-23 3246040]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-05-25 2214504]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-05-20 378472]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe [2011-06-10 2026304]
S3 afcdp;afcdp;c:\windows\system32\DRIVERS\afcdp.sys [x]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [x]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]
S3 RTCore64;RTCore64;c:\program files (x86)\EVGA Precision\RTCore64.sys [2011-01-17 14440]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys [2011-02-10 11856]
.
.
Contenuto della cartella 'Scheduled Tasks'
.
2011-06-24 c:\windows\Tasks\Defrag Job 00.job
- c:\program files (x86)\Disktrix\UltimateDefrag\Udefrag.exe [2011-05-10 22:12]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RAVCpl64.exe" [2008-07-24 6452256]
"Skytel"="Skytel.exe" [2008-07-24 1833504]
"Servizio Acronis Scheduler2"="c:\program files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe" [2010-12-16 391008]
.
------- Scansione supplementare -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\TerminatoR\AppData\Roaming\Mozilla\Firefox\Profiles\nub3o554.default\
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - CHIAVI ORFANE RIMOSSE - - - -
.
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe
.
.
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
.
[HKEY_USERS\S-1-5-21-2183938321-3593089046-1023333521-1000\Software\SecuROM\License information*]
"datasecu"=hex:a9,68,da,00,1a,9b,10,07,a4,8d,04,7e,b7,1b,a9,57,d2,77,a4,1b,52,
87,47,c4,4e,d9,2b,55,f5,02,0a,35,ad,13,15,42,fd,c0,77,2e,ba,41,b6,e2,c0,bb,\
"rkeysecu"=hex:07,ed,d9,eb,25,58,8a,42,24,8b,9c,4a,93,ef,a7,cc
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\program files (x86)\EVGA Precision\EVGAPrecision.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\EVGA Precision\Bundle\OSDServer\RTSS.exe
.
**************************************************************************
.
Ora fine scansione: 2011-06-28 10:46:09 - Il pc è stato riavviato
ComboFix-quarantined-files.txt 2011-06-28 08:46
.
Pre-Run: 91.396.427.776 byte disponibili
Post-Run: 91.626.676.224 byte disponibili
.
- - End Of File - - FAB5ECCC196CF9104C4E04B4E3747128