verificate grazie Logfile of HiJackThis Fork by Alex Dragokas v.2.9.0.18
Platform: x64 Windows 10 (Pro), 10.0.17763.253 (ReleaseId: 1809), Service Pack: 0
Time: 25.01.2019 - 12:09 (UTC+01:00)
Language: OS: Italian (0x410). Display: Italian (0x410). Non-Unicode: Italian (0x410)
Elevated: Yes
Ran by: utente (group: Administrator) on DESKTOP-S27M32K, FirstRun: yes
Chrome: 71.0.3578.98
Firefox: 64.0.2.6947
Edge: 11.0.17763.253
Internet Explorer: 11.0.17763.1
Default: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Chrome)
Boot mode: Normal
Running processes:
Number | Path
1 C:\Program Files (x86)\AVG Driver Updater\AVG Driver Updater.exe
1 C:\Program Files (x86)\AVG\AVG TuneUp\TuneupSvc.exe
1 C:\Program Files (x86)\AVG\Antivirus\AVGSvc.exe
1 C:\Program Files (x86)\AVG\Antivirus\AVGUI.exe
1 C:\Program Files (x86)\AVG\Antivirus\afwServ.exe
1 C:\Program Files (x86)\AVG\Antivirus\aswidsagent.exe
1 C:\Program Files (x86)\Google\Update\1.3.33.23\GoogleCrashHandler.exe
1 C:\Program Files (x86)\Google\Update\1.3.33.23\GoogleCrashHandler64.exe
1 C:\Program Files\CCleaner\CCleaner64.exe
1 C:\Program Files\Classic Shell\ClassicStartMenu.exe
5 C:\Program Files\Mozilla Firefox\firefox.exe
2 C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
1 C:\Program Files\SAMSUNG\USB Drivers\25_escape\conn\ss_conn_service.exe
1 C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.37.98.0_x64__kzf8qxf38zg5c\SkypeApp.exe
1 C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.37.98.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe
1 C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.37.98.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe
1 C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.18112.20010.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
1 C:\Program Files\WindowsApps\Microsoft.WindowsStore_11810.1001.12.0_x64__8wekyb3d8bbwe\WinStore.App.exe
1 C:\Program Files\WindowsApps\Microsoft.YourPhone_1.0.20094.0_x64__8wekyb3d8bbwe\YourPhone.exe
1 C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.18112.14311.0_x64__8wekyb3d8bbwe\Video.UI.exe
1 C:\Users\utente\Desktop\HiJackThis\HiJackThis.exe
1 C:\Windows\ImmersiveControlPanel\SystemSettings.exe
1 C:\Windows\System32\ApplicationFrameHost.exe
1 C:\Windows\System32\CompPkgSrv.exe
1 C:\Windows\System32\MicrosoftEdgeCP.exe
1 C:\Windows\System32\MicrosoftEdgeSH.exe
10 C:\Windows\System32\RuntimeBroker.exe
1 C:\Windows\System32\SearchFilterHost.exe
1 C:\Windows\System32\SearchIndexer.exe
1 C:\Windows\System32\SearchProtocolHost.exe
1 C:\Windows\System32\SecurityHealthService.exe
1 C:\Windows\System32\SettingSyncHost.exe
1 C:\Windows\System32\SgrmBroker.exe
3 C:\Windows\System32\WUDFHost.exe
1 C:\Windows\System32\WirelessKB850NotificationService.exe
1 C:\Windows\System32\audiodg.exe
1 C:\Windows\System32\browser_broker.exe
2 C:\Windows\System32\csrss.exe
1 C:\Windows\System32\ctfmon.exe
1 C:\Windows\System32\dasHost.exe
1 C:\Windows\System32\dllhost.exe
1 C:\Windows\System32\dwm.exe
2 C:\Windows\System32\fontdrvhost.exe
1 C:\Windows\System32\lsass.exe
1 C:\Windows\System32\services.exe
1 C:\Windows\System32\sihost.exe
1 C:\Windows\System32\smartscreen.exe
1 C:\Windows\System32\smss.exe
1 C:\Windows\System32\spool\drivers\x64\3\NetFaxServer64.exe
1 C:\Windows\System32\spoolsv.exe
75 C:\Windows\System32\svchost.exe
1 C:\Windows\System32\taskhostw.exe
1 C:\Windows\System32\wbem\WmiPrvSE.exe
2 C:\Windows\System32\wbem\unsecapp.exe
1 C:\Windows\System32\wininit.exe
1 C:\Windows\System32\winlogon.exe
1 C:\Windows\SystemApps\InputApp_cw5n1h2txyewy\WindowsInternal.ComposableShell.Experiences.TextInput.InputApp.exe
1 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
1 C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
1 C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
2 C:\Windows\explorer.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main: [Start Page] =
https://www.google.it/webhp?hl=it&sa=X&ved=0ahUKEwiGiNrB6qHTAhUCSJoKHahTCakQPAgD#spf=1
R4 - SearchScopes: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6fcad291-2f36-47d8-a77e-d4a611fa774a}: [URL] =
https://search.gmx.com/web/result?q={searchTerms}&origin=p_jkld_es&p=jkld&p_brw=ie&p_mkt=it&p_tsrc=301&p_w=y0w39 - GMX
O1 - Hosts: Reset contents to default
O1 - Hosts: 111.118.212.124 pagead2.googlesyndication.com
O1 - Hosts: 111.118.212.124 tpc.googlesyndication.com
O1 - Hosts: 111.118.212.124 s7.addthis.com
O1 - Hosts: 111.118.212.124 contextual.media.net
O1 - Hosts: 111.118.212.124 connect.facebook.net
O1 - Hosts: 111.118.212.124 s3.buysellads.com
O1 - Hosts: 111.118.212.124 resources.infolinks.com
O1 - Hosts: 111.118.212.124 stats.g.doubleclick.net
O1 - Hosts: 111.118.212.124
www.googletagmanager.comO1 - Hosts: 111.118.212.124 google-analytics.com
O2 - HKLM\..\BHO: ClassicIEBHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIEDLL_64.dll
O2 - HKLM\..\BHO: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer64.dll
O2 - HKLM\..\BHO: ExplorerWnd Helper - {10921475-03CE-4E04-90CE-E2E7EF20C814} - C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer.dll
O2-32 - HKLM\..\BHO: ClassicIEBHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIEDLL_32.dll
O2-32 - HKLM\..\BHO: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll
O2-32 - HKLM\..\BHO: IObit Surfing Protection - {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} - C:\Program Files (x86)\IObit\Advanced SystemCare\Surfing Protection\BrowerProtect\ASCPlugin_Protection.dll
O2-32 - HKLM\..\BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_191\bin\jp2ssv.dll
O2-32 - HKLM\..\BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_191\bin\ssv.dll
O3 - HKLM\..\Toolbar: Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll
O3-32 - HKLM\..\Toolbar: Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll
O4 - HKCU\..\Run: [CCleaner Smart Cleaning] = C:\Program Files\CCleaner\CCleaner64.exe /MONITOR
O4 - HKCU\..\Run: [clnspc 7 check updates and quit] = C:\Program Files (x86)\Clean Space 7\cleanspace.exe protocol3
O4 - HKCU\..\StartupApproved\Run: [GUDelayStartup] = C:\Program Files (x86)\Glary Utilities 5\StartupManager.exe -delayrun (2019/01/03)
O4 - HKLM\..\Run: [AVGUI.exe] = C:\Program Files (x86)\AVG\Antivirus\AvLaunch.exe /gui
O4 - HKLM\..\Session Manager: [BootExecute] = C:\WINDOWS\system32\autochk.exe *
O4 - HKLM\..\StartupApproved\Run32: [IObit Malware Fighter] = C:\Program Files (x86)\IObit\IObit Malware Fighter\IMF.exe /autostart (2017/05/13)
O4 - HKU\S-1-5-19\..\StartupApproved\Run: [OneDriveSetup] = C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (2019/01/03)
O4 - HKU\S-1-5-20\..\StartupApproved\Run: [OneDriveSetup] = C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (2019/01/03)
O4-32 - HKLM\..\Run: [AVGUI.exe] = C:\Program Files (x86)\AVG\Antivirus\AvLaunch.exe /gui
O9 - Button: HKLM\..\{56753E59-AF1D-4FBA-9E15-31557124ADA2}: (no name) - C:\Program Files\Classic Shell\ClassicIE_32.exe
O9 - Tools menu item: HKLM\..\{56753E59-AF1D-4FBA-9E15-31557124ADA2}: Classic IE Settings - C:\Program Files\Classic Shell\ClassicIE_32.exe
O9-32 - Button: HKLM\..\{2670000A-7350-4f3c-8081-5663EE0C6C49}: Invia a OneNote - (no file)
O9-32 - Button: HKLM\..\{56753E59-AF1D-4FBA-9E15-31557124ADA2}: (no name) - C:\Program Files\Classic Shell\ClassicIE_32.exe
O9-32 - Button: HKLM\..\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}: &Note collegate di OneNote - (no file)
O9-32 - Tools menu item: HKLM\..\{2670000A-7350-4f3c-8081-5663EE0C6C49}: I&nvia a OneNote - (no file)
O9-32 - Tools menu item: HKLM\..\{56753E59-AF1D-4FBA-9E15-31557124ADA2}: Classic IE Settings - C:\Program Files\Classic Shell\ClassicIE_32.exe
O9-32 - Tools menu item: HKLM\..\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}: &Note collegate di OneNote - (no file)
O15 - Trusted Zone: *.localhost
O17 - DHCP DNS 1: 212.224.121.155
O17 - DHCP DNS 2: 212.224.71.116
O17 - DHCP DNS 3: 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{14769212-1377-45ef-acda-5526395f6991}: [NameServer] = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{14769212-1377-45ef-acda-5526395f6991}: [NameServer] = 212.224.121.155
O17 - HKLM\System\CCS\Services\Tcpip\..\{14769212-1377-45ef-acda-5526395f6991}: [NameServer] = 212.224.71.116
O17 - HKLM\System\ControlSet002\Services\Tcpip\..\{14769212-1377-45EF-ACDA-5526395F6991}: [NameServer] = 192.168.1.1
O17 - HKLM\System\ControlSet002\Services\Tcpip\..\{14769212-1377-45EF-ACDA-5526395F6991}: [NameServer] = 212.224.121.155
O17 - HKLM\System\ControlSet002\Services\Tcpip\..\{14769212-1377-45EF-ACDA-5526395F6991}: [NameServer] = 212.224.71.116
O21 - HKLM\..\ShellIconOverlayIdentifiers\ IMFSafeBox: BlueBirdShell Class - {0BB81440-5F42-4480-A5F7-770A6F439FC8} - C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFShellExt.dll
O21 - HKLM\..\ShellIconOverlayIdentifiers\00avg: (no name) - {472083B0-C522-11CF-8763-00608CC02F24} - (no file)
O21 - HKLM\..\ShellIconOverlayIdentifiers\ShareOverlay: ShareOverlay Class - {594D4122-1F87-41E2-96C7-825FB4796516} - C:\Program Files\Classic Shell\ClassicExplorer64.dll
O21-32 - HKLM\..\ShellExecuteHooks: [{B5A7F190-DDA6-4420-B3BA-52453494E6CD}] - Groove GFS Stub Execution Hook - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (disabled)
O21-32 - HKLM\..\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 1 (GFS Unread Stub): Groove Explorer Icon Overlay 1 (GFS Unread Stub) - {99FD978C-D287-4F50-827F-B2C658EDA8E7} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O21-32 - HKLM\..\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2 (GFS Stub): Groove Explorer Icon Overlay 2 (GFS Stub) - {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O21-32 - HKLM\..\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2.5 (GFS Unread Folder): Groove Explorer Icon Overlay 2.5 (GFS Unread Folder) - {920E6DB1-9907-4370-B3A0-BAFC03D81399} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O21-32 - HKLM\..\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 3 (GFS Folder): Groove Explorer Icon Overlay 3 (GFS Folder) - {16F3DD56-1AF5-4347-846D-7C10C4192619} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O21-32 - HKLM\..\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 4 (GFS Unread Mark): Groove Explorer Icon Overlay 4 (GFS Unread Mark) - {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O21-32 - HKLM\..\ShellIconOverlayIdentifiers\ShareOverlay: ShareOverlay Class - {594D4122-1F87-41E2-96C7-825FB4796516} - C:\Program Files\Classic Shell\ClassicExplorer32.dll
O22 - Task (.job): (Not scheduled) AVG Driver Updater Scan.job - C:\Program Files (x86)\AVG Driver Updater\AVG Driver Updater.exe scheduled
O22 - Task (.job): (disabled) (Not scheduled) CreateExplorerShellUnelevatedTask.job - C:\WINDOWS\explorer.exe /NOUACCHECK
O22 - Task (.job): (disabled) Uninstaller_SkipUac_utente.job - C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe /UninstallExplorer
O22 - Task (.job): AVG Driver Updater Startup.job - C:\Program Files (x86)\AVG Driver Updater\AVG Driver Updater.exe -boot
O23 - Service R2: AVG Antivirus - C:\Program Files (x86)\AVG\Antivirus\AVGSvc.exe
O23 - Service R2: AVG Firewall Service - (AVG Firewall) - C:\Program Files (x86)\AVG\Antivirus\afwServ.exe
O23 - Service R2: AVG TuneUp - (CleanupPSvc) - C:\Program Files (x86)\AVG\AVG TuneUp\TuneupSvc.exe
O23 - Service R2: NVIDIA Display Container LS - (NVDisplay.ContainerLocalSystem) - C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe -s NVDisplay.ContainerLocalSystem -f "C:\ProgramData\NVIDIA\NVDisplay.ContainerLocalSystem.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\Display.NvContainer\plugins\LocalSystem" -r -p 30000
O23 - Service R2: SAMSUNG Mobile Connectivity Service - (ss_conn_service) - C:\Program Files\SAMSUNG\USB Drivers\25_escape\conn\ss_conn_service.exe
O23 - Service R2: Wireless Keyboard 850 Notification Service - (WirelessKB850NotificationService) - C:\WINDOWS\system32\WirelessKB850NotificationService.exe
O23 - Service R3: Samsung Network Fax Server - C:\Windows\system32\spool\drivers\x64\3\NetFaxServer64.exe
O23 - Service R3: avgbIDSAgent - C:\Program Files (x86)\AVG\Antivirus\aswidsagent.exe
O23 - Service S2: Genesys Logic Service - (GeneStorSvc) - C:\WINDOWS\System32\DriverStore\FileRepository\genestor.inf_amd64_312a8313e431fea0\GLCRIconSvc.exe
O23 - Service S2: Servizio Google Update (gupdate) - (gupdate) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /svc
O23 - Service S3: ASUS Com Service - (asComSvc) - C:\Program Files (x86)\ASUS\AXSP\1.01.02\atkexComSvc.exe
O23 - Service S3: Adobe Flash Player Update Service - (AdobeFlashPlayerUpdateSvc) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service S3: AvgWscReporter - C:\Program Files (x86)\AVG\Antivirus\wsc_proxy.exe /runassvc
O23 - Service S3: Google Chrome Elevation Service - (GoogleChromeElevationService) - C:\Program Files (x86)\Google\Chrome\Application\71.0.3578.98\elevation_service.exe
O23 - Service S3: Nero Update - (NAUpdate) - C:\Program Files (x86)\Nero\Update\NASvc.exe
O23 - Service S3: Office 64 Source Engine - (ose64) - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
O23 - Service S3: PDF Architect 5 Creator - C:\Program Files\PDF Architect 5\creator\common\creator-ws.exe
O23 - Service S3: PDF Architect 6 Creator - C:\Program Files\PDF Architect 6\creator\common\creator-ws.exe
O23 - Service S3: Servizio Google Update (gupdatem) - (gupdatem) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /medsvc
O23 - Service S3: Wondershare Application Framework Service - (WsAppService) - C:\Program Files (x86)\Wondershare\WAF\2.4.3.229\WsAppService.exe
--
End of file - Time spent: 19,5 sec. - 29740 bytes, CRC32: FFFFFFFF. Sign: 拌貉
