Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 18:11:09, on 24/03/2019
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18098)


Boot mode: Normal

Running processes:
C:\Program Files (x86)\Elex-tech\YAC\iSafeTray.exe
C:\Users\Baldan\AppData\Local\Microsoft\OneDrive\OneDrive.exe
C:\Users\Baldan\AppData\Local\Dropbox\Update\DropboxUpdate.exe
C:\Program Files (x86)\FirmaCerta\fchttpserver.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Users\Baldan\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Users\BALDAN~1\AppData\Local\Temp\websgd_2940\WebSGD.exe
C:\Users\Baldan\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Users\Baldan\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
C:\Users\Baldan\AppData\Roaming\Dropbox\bin\QtWebEngineProcess.exe
C:\Users\Baldan\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.istartsurf.com/?type=hppp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.delta-homes.com/web/?type=ds&ts=1428928871&from=ient04130&uid=TOSHIBAXMK3265GSXN_X0L2S99RSXXX0L2S99RS&q={searchTerms}
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.delta-homes.com/web/?type=ds&ts=1428928871&from=ient04130&uid=TOSHIBAXMK3265GSXN_X0L2S99RSXXX0L2S99RS&q={searchTerms}
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.istartsurf.com/?type=hppp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.istartsurf.com/?type=hppp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.istartsurf.com/?type=hppp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: 0.0.0.1 mssplus.mcafee.com
O2 - BHO: Skype for Business Click to Call BHO - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\OCHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\URLREDIR.DLL
O2 - BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [bit4id csp store register (M)] "C:\Windows\SysWOW64\RUNDLL32.EXE" "C:\Windows\system32\bit4upki-store.dll",RunImportServer
O4 - HKLM\..\Run: [SafeDiveCertMgm] rundll32.exe CNSUtil.dll,DeleteCertStore
O4 - HKLM\..\Run: [FirmaCertaHTTP] "C:\Program Files (x86)\FirmaCerta\fchttpserver.exe"
O4 - HKCU\..\Run: [WebSGD] C:\TCE\bin\WebSGD.exe
O4 - HKCU\..\Run: [OneDrive] "C:\Users\Baldan Massimo\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
O4 - HKCU\..\Run: [Dropbox Update] "C:\Users\Baldan Massimo\AppData\Local\Dropbox\Update\DropboxUpdate.exe" /c
O4 - HKCU\..\Run: [FirmaCertaHTTP] C:\PROGRA~2\FIRMAC~1\FCHTTP~1.EXE
O4 - HKCU\..\RunOnce: [Uninstall C:\Users\Baldan Massimo\AppData\Local\Microsoft\SkyDrive\17.0.4041.0512] C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Baldan Massimo\AppData\Local\Microsoft\SkyDrive\17.0.4041.0512"
O4 - HKCU\..\RunOnce: [Uninstall C:\Users\Baldan Massimo\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714] C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Baldan Massimo\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714"
O4 - HKCU\..\RunOnce: [Uninstall C:\Users\Baldan Massimo\AppData\Local\Microsoft\OneDrive\17.3.4724.0224] C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Baldan Massimo\AppData\Local\Microsoft\OneDrive\17.3.4724.0224"
O4 - HKCU\..\RunOnce: [Uninstall C:\Users\Baldan Massimo\AppData\Local\Microsoft\OneDrive\17.3.4726.0226] C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Baldan Massimo\AppData\Local\Microsoft\OneDrive\17.3.4726.0226"
O4 - HKCU\..\RunOnce: [Uninstall C:\Users\Baldan Massimo\AppData\Local\Microsoft\OneDrive\17.3.5849.0427] C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Baldan Massimo\AppData\Local\Microsoft\OneDrive\17.3.5849.0427"
O4 - HKCU\..\RunOnce: [Uninstall C:\Users\Baldan Massimo\AppData\Local\Microsoft\OneDrive\17.3.5860.0512] C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Baldan Massimo\AppData\Local\Microsoft\OneDrive\17.3.5860.0512"
O4 - HKCU\..\RunOnce: [Uninstall C:\Users\Baldan Massimo\AppData\Local\Microsoft\OneDrive\17.3.5907.0716] C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Baldan Massimo\AppData\Local\Microsoft\OneDrive\17.3.5907.0716"
O4 - HKCU\..\RunOnce: [Uninstall C:\Users\Baldan Massimo\AppData\Local\Microsoft\OneDrive\17.3.5930.0814] C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Baldan Massimo\AppData\Local\Microsoft\OneDrive\17.3.5930.0814"
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_32_0_0_142_Plugin.exe -update plugin
O4 - Startup: Dropbox.lnk = Baldan Massimo\AppData\Roaming\Dropbox\bin\Dropbox.exe
O4 - Global Startup: McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\3.11.961\SSScheduler.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\ONBttnIE.dll
O9 - Extra button: Skype for Business Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\OCHelper.dll
O9 - Extra 'Tools' menuitem: Skype for Business Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\OCHelper.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: http://servizi.assistenzatelematica.it
O15 - Trusted Zone: http://guida.comunicaec.it
O15 - Trusted Zone: http://cafmanagercndl.namirial.com
O15 - Trusted Zone: http://cafmanagersbase.namirial.com
O15 - Trusted Zone: http://cafmanagertfdc.namirial.com
O15 - Trusted Zone: http://cafmanageruci.namirial.com
O15 - Trusted Zone: http://cafmanagerzc.namirial.com
O15 - Trusted Zone: http://servizicaf.namirial.com
O15 - Trusted Zone: http://servizicndl.namirial.com
O15 - Trusted Zone: http://servizisbase.namirial.com
O15 - Trusted Zone: http://serviziuci.namirial.com
O15 - Trusted Zone: http://servizizc.namirial.com
O15 - Trusted Zone: http://sm1.namirial.com
O15 - Trusted Zone: http://sm2.namirial.com
O15 - Trusted Zone: http://srvfsc1.namirial.com
O15 - Trusted Zone: http://srvfsc2.namirial.com
O15 - Trusted Zone: http://srvfsc3.namirial.com
O15 - Trusted Zone: http://srvfsc4.namirial.com
O15 - Trusted Zone: http://srvise.namirial.com
O15 - Trusted Zone: http://srvtel1.namirial.com
O15 - Trusted Zone: http://testweb2.namirial.com
O15 - Trusted Zone: http://uploadcndl.namirial.com
O15 - Trusted Zone: http://uploadtfdc.namirial.com
O15 - Trusted Zone: http://webservices1.namirial.com
O15 - Trusted Zone: http://webservices2.namirial.com
O15 - Trusted Zone: http://webservicescndl.namirial.com
O15 - Trusted Zone: http://webservicessbase.namirial.com
O15 - Trusted Zone: http://webservicestfdc.namirial.com
O15 - Trusted Zone: http://webservicesuci.namirial.com
O15 - Trusted Zone: http://webserviceszc.namirial.com
O15 - Trusted Zone: http://b2b.namirial.it
O15 - Trusted Zone: http://www.samsungsetup.com
O15 - Trusted Zone: http://pecweb.sicurezzapostale.it
O15 - Trusted Zone: http://servizi.assistenzatelematica.it (HKLM)
O15 - Trusted Zone: http://guida.comunicaec.it (HKLM)
O15 - Trusted Zone: http://cafmanagercndl.namirial.com (HKLM)
O15 - Trusted Zone: http://cafmanagersbase.namirial.com (HKLM)
O15 - Trusted Zone: http://cafmanagertfdc.namirial.com (HKLM)
O15 - Trusted Zone: http://cafmanageruci.namirial.com (HKLM)
O15 - Trusted Zone: http://cafmanagerzc.namirial.com (HKLM)
O15 - Trusted Zone: http://servizicaf.namirial.com (HKLM)
O15 - Trusted Zone: http://servizicndl.namirial.com (HKLM)
O15 - Trusted Zone: http://servizisbase.namirial.com (HKLM)
O15 - Trusted Zone: http://serviziuci.namirial.com (HKLM)
O15 - Trusted Zone: http://servizizc.namirial.com (HKLM)
O15 - Trusted Zone: http://sm1.namirial.com (HKLM)
O15 - Trusted Zone: http://sm2.namirial.com (HKLM)
O15 - Trusted Zone: http://srvfsc1.namirial.com (HKLM)
O15 - Trusted Zone: http://srvfsc2.namirial.com (HKLM)
O15 - Trusted Zone: http://srvfsc3.namirial.com (HKLM)
O15 - Trusted Zone: http://srvfsc4.namirial.com (HKLM)
O15 - Trusted Zone: http://srvise.namirial.com (HKLM)
O15 - Trusted Zone: http://srvtel1.namirial.com (HKLM)
O15 - Trusted Zone: http://testweb2.namirial.com (HKLM)
O15 - Trusted Zone: http://uploadcndl.namirial.com (HKLM)
O15 - Trusted Zone: http://uploadtfdc.namirial.com (HKLM)
O15 - Trusted Zone: http://webservices1.namirial.com (HKLM)
O15 - Trusted Zone: http://webservices2.namirial.com (HKLM)
O15 - Trusted Zone: http://webservicescndl.namirial.com (HKLM)
O15 - Trusted Zone: http://webservicessbase.namirial.com (HKLM)
O15 - Trusted Zone: http://webservicestfdc.namirial.com (HKLM)
O15 - Trusted Zone: http://webservicesuci.namirial.com (HKLM)
O15 - Trusted Zone: http://webserviceszc.namirial.com (HKLM)
O15 - Trusted Zone: http://b2b.namirial.it (HKLM)
O15 - Trusted Zone: http://pecweb.sicurezzapostale.it (HKLM)
O16 - DPF: {0006F063-0000-0000-C000-000000000046} (Microsoft Outlook View Control) - http://activex.microsoft.com/activex/controls/office/outlctlx.CAB
O18 - Protocol: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\MSOSB.DLL
O20 - AppInit_DLLs: C:\PROGRA~2\Amazon\AMAZON~1\AMAZON~3.DLL
O23 - Service: ABBYY FineReader 11 PE Licensing Service (ABBYY.Licensing.FineReader.Professional.11.0) - ABBYY - C:\Program Files (x86)\ABBYY FineReader 11\NetworkLicenseServer.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: AK910SwitchService - Unknown owner - C:\Program Files (x86)\ArubaKey\AKSwitcher\ak910switchservice.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service:  Servizio Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DYMO PnP Service (DymoPnpService) - Sanford, L.P. - C:\Program Files (x86)\DYMO\DYMO Label Software\DymoPnpService.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Google Chrome Elevation Service (GoogleChromeElevationService) - Google Inc. - C:\Program Files (x86)\Google\Chrome\Application\72.0.3626.119\elevation_service.exe
O23 - Service: Servizio Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Servizio Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: HP LaserJet Service - HP - C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe
O23 - Service: HP SI Service (HPSIService) - Unknown owner - C:\Windows\system32\HPSIsvc.exe (file missing)
O23 - Service: Tecnologia Intel(R) Rapid Storage (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: YAC Service (iSafeService) - Elex do Brasil Participações Ltda - C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe
O23 - Service: Key4SwitchService - bit4id srl - http://www.bit4id.com - C:\Program Files (x86)\Key4SwitchService\svc\k4swsvc.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Malwarebytes Service (MBAMService) - Malwarebytes - C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\3.11.961\McCHSvc.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Panasonic Local Printer Service - Panasonic Communications Co., Ltd. - C:\PROGRA~2\PANASO~1\LocalCom\lmsrvnt.exe
O23 - Service: Panasonic Trap Monitor Service - Panasonic - C:\PROGRA~2\PANASO~1\TRAPMO~1\Trapmnnt.exe
O23 - Service: PDF Architect Helper Service - pdfforge GbR - C:\Program Files (x86)\PDF Architect\HelperService.exe
O23 - Service: PDF Architect Service - pdfforge GbR - C:\Program Files (x86)\PDF Architect\ConversionService.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Management Service smart card embedded in a MicroSD (SCSD_Service) - Unknown owner - C:\Program Files\Oberthur Technologies\ID-One Cosmo microSD Driver 2.1.3\SC_SD_Service.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 17979 bytes