Rank: AiutAmico
Iscritto dal : 11/5/2006
Posts: 114
|
ComboFix 09-08-06.01 - Administrator 06/08/2009 23.32.00.1.2 - NTFSx86
Microsoft® Windows Vista™ Ultimate 6.0.6002.2.1252.39.1040.18.3326.2207 [GMT 2:00]
Eseguito da: c:\users\Administrator\Desktop\ComboFix.exe
AV: AVG Anti-Virus *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
SP: AVG Anti-Virus *enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Creato nuovo punto di ripristino
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\$recycle.bin\S-1-5-21-51003140-4199384537-3980697693-500
c:\windows\Installer\187d4.msi
c:\windows\Installer\617657.msi
c:\windows\system32\2c682.vbs
.
((((((((((((((((((((((((((((((((((((((( Driver/Servizi )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_RelevantKnowledge
((((((((((((((((((((((((( Files Creati Da 2009-07-06 al 2009-08-06 )))))))))))))))))))))))))))))))))))
.
2009-08-06 19:57 . 2009-08-06 19:57 -------- d-----w- c:\users\Administrator\DoctorWeb
2009-08-06 18:21 . 2009-08-06 18:21 -------- d-----w- c:\program files\Softwin
2009-08-06 18:19 . 2009-08-06 18:19 -------- d-----w- c:\users\Administrator\Pavark
2009-08-06 18:15 . 2009-08-06 18:15 -------- d-----w- c:\program files\Sophos
2009-08-05 18:49 . 2009-08-06 11:08 -------- d-----w- c:\progra~2\NOS
2009-08-05 18:49 . 2009-08-06 11:08 -------- d-----w- c:\program files\NOS
2009-08-05 12:29 . 2009-08-06 17:19 -------- d-----w- c:\program files\Poker Club by Lottomatica
2009-08-04 16:11 . 2009-08-04 16:11 -------- d-----w- C:\Realtek_Audio_V6015591_Vista
2009-08-04 16:11 . 2009-08-04 16:11 -------- d-----w- C:\RealtekHD_Audio_V51005628_V6015628
2009-07-28 16:36 . 2009-07-28 16:37 5214320 ----a-w- c:\users\Administrator\AppData\Roaming\Maxthon2\Temp\MxSetup.exe
2009-07-27 20:37 . 2009-07-28 08:22 -------- d-----w- c:\program files\HomeKeylogger
2009-07-21 04:59 . 2009-07-21 04:59 3560880 ----a-w- c:\users\Administrator\AppData\Roaming\Maxthon2\Maxthon.exe
2009-07-15 17:14 . 2009-06-15 14:53 156672 ----a-w- c:\windows\system32\t2embed.dll
2009-07-15 17:14 . 2009-06-15 14:52 23552 ----a-w- c:\windows\system32\lpk.dll
2009-07-15 17:14 . 2009-06-15 14:52 72704 ----a-w- c:\windows\system32\fontsub.dll
2009-07-15 17:14 . 2009-06-15 14:51 10240 ----a-w- c:\windows\system32\dciman32.dll
2009-07-15 17:14 . 2009-06-15 12:42 289792 ----a-w- c:\windows\system32\atmfd.dll
2009-07-12 19:23 . 2009-07-12 19:23 -------- d-----w- c:\program files\WOT
2009-07-12 11:49 . 2009-07-12 11:51 -------- d-----w- c:\users\Administrator\AppData\Roaming\vlc
2009-07-12 11:49 . 2009-07-12 11:51 -------- d-----w- c:\users\ADMINI~1\AppData\Roaming\vlc
2009-07-11 07:33 . 2009-07-11 07:33 -------- d-----w- c:\program files\Unlocker
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-06 21:38 . 2008-07-21 17:27 9 ----a-w- c:\windows\mvraidver.dat
2009-08-06 21:37 . 2008-07-27 07:26 12 ----a-w- c:\windows\bthservsdp.dat
2009-08-06 21:30 . 2009-03-10 18:59 -------- d-----w- c:\users\Administrator\AppData\Roaming\MxBoost
2009-08-06 21:30 . 2009-03-10 18:59 -------- d-----w- c:\users\ADMINI~1\AppData\Roaming\MxBoost
2009-08-06 21:12 . 2006-11-06 01:51 709236 ----a-w- c:\windows\system32\perfh010.dat
2009-08-06 21:12 . 2006-11-06 01:51 141512 ----a-w- c:\windows\system32\perfc010.dat
2009-08-06 20:41 . 2009-03-27 20:33 117760 ----a-w- c:\users\Administrator\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-08-06 20:15 . 2008-10-30 18:33 -------- d-----w- c:\progra~2\avg8
2009-08-06 17:56 . 2008-07-26 17:02 -------- d-----w- c:\progra~2\Spybot - Search & Destroy
2009-08-06 17:44 . 2008-09-14 21:09 -------- d-----w- c:\program files\a-squared Free
2009-08-06 17:31 . 2009-05-31 09:11 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-06 15:01 . 2008-07-28 21:05 -------- d-----w- c:\program files\DC++
2009-08-05 13:47 . 2008-07-19 21:09 143512 ----a-w- c:\users\Administrator\AppData\Local\GDIPFONTCACHEV1.DAT
2009-08-05 13:47 . 2008-07-19 21:09 143512 ----a-w- c:\users\ADMINI~1\AppData\Local\GDIPFONTCACHEV1.DAT
2009-08-05 11:10 . 2008-07-28 16:16 -------- d-----w- c:\program files\Java
2009-08-05 08:23 . 2009-01-04 22:25 319456 ----a-w- c:\windows\DIFxAPI.dll
2009-08-03 11:36 . 2009-05-31 09:11 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-03 11:36 . 2009-05-31 09:11 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-01 06:59 . 2009-04-12 18:37 -------- d-----w- c:\program files\Microsoft Silverlight
2009-07-31 08:36 . 2008-10-30 18:33 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-07-31 08:36 . 2008-10-30 18:33 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-07-31 08:36 . 2008-10-30 18:33 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-07-29 17:34 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-07-28 16:37 . 2009-06-02 20:10 122843 ----a-w- c:\users\Administrator\AppData\Roaming\Maxthon2\MaxthonUINST.exe
2009-07-28 16:37 . 2009-03-10 18:58 -------- d-----w- c:\users\Administrator\AppData\Roaming\Maxthon2
2009-07-28 16:37 . 2009-03-10 18:58 -------- d-----w- c:\users\ADMINI~1\AppData\Roaming\Maxthon2
2009-07-28 11:22 . 2008-07-26 08:00 -------- d-----w- c:\users\Administrator\AppData\Roaming\uTorrent
2009-07-28 11:22 . 2008-07-26 08:00 -------- d-----w- c:\users\ADMINI~1\AppData\Roaming\uTorrent
2009-07-25 03:23 . 2008-11-23 17:58 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-21 21:52 . 2009-07-29 17:32 915456 ----a-w- c:\windows\system32\wininet.dll
2009-07-21 21:47 . 2009-07-29 17:32 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-07-21 21:47 . 2009-07-29 17:32 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-07-21 20:13 . 2009-07-29 17:32 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-07-20 17:10 . 2008-10-30 19:37 -------- d-----w- c:\program files\TVUPlayer
2009-07-14 19:07 . 2008-07-29 08:43 -------- d-----w- c:\program files\Messenger Plus! Live
2009-07-07 17:07 . 2009-05-10 22:07 -------- d-----w- c:\users\Administrator\AppData\Roaming\IrfanView
2009-07-07 17:07 . 2009-05-10 22:07 -------- d-----w- c:\users\ADMINI~1\AppData\Roaming\IrfanView
2009-07-07 17:07 . 2008-08-07 19:07 -------- d-----w- c:\users\Administrator\AppData\Roaming\DAEMON Tools
2009-07-07 17:07 . 2008-08-07 19:07 -------- d-----w- c:\users\ADMINI~1\AppData\Roaming\DAEMON Tools
2009-07-07 17:07 . 2009-07-05 07:02 -------- d--h--w- c:\progra~2\~0
2009-07-07 17:07 . 2009-01-04 22:25 -------- d-----w- c:\program files\Realtek
2009-07-07 17:07 . 2008-07-21 15:23 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-07-07 16:52 . 2009-07-07 16:52 -------- d--h--w- c:\program files\Temp
2009-07-05 14:03 . 2009-07-05 14:03 -------- d-----w- c:\program files\THQ
2009-07-05 07:02 . 2009-07-05 07:02 -------- d-----w- c:\users\Administrator\AppData\Roaming\Uniblue
2009-07-05 07:02 . 2009-07-05 07:02 -------- d-----w- c:\users\ADMINI~1\AppData\Roaming\Uniblue
2009-07-03 19:37 . 2009-07-03 19:37 -------- d-----w- c:\program files\Smart PC Solutions
2009-07-03 17:41 . 2009-07-03 17:38 -------- d-----w- c:\program files\Video Strip Poker
2009-07-02 17:50 . 2009-07-02 17:50 -------- d-----w- c:\program files\Formosoft
2009-07-01 21:35 . 2009-06-27 08:59 -------- d-----w- c:\progra~2\Messenger Plus!
2009-06-30 20:05 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Calendar
2009-06-30 20:05 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Sidebar
2009-06-30 20:05 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Collaboration
2009-06-30 20:05 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Journal
2009-06-30 20:05 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Photo Gallery
2009-06-30 20:05 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Defender
2009-06-30 20:03 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-06-30 19:53 . 2006-11-02 12:35 37665 ----a-w- c:\windows\Fonts\GlobalUserInterface.CompositeFont
2009-06-30 19:12 . 2009-06-24 14:04 -------- d-----w- c:\program files\Electronic Arts
2009-06-30 17:14 . 2009-06-30 17:14 -------- d-----w- c:\program files\Infogrames
2009-06-30 02:22 . 2009-06-30 02:22 95488 ----a-w- c:\users\Administrator\AppData\Roaming\Maxthon2\MxHttpRq.dll
2009-06-30 02:22 . 2009-06-30 02:22 91392 ----a-w- c:\users\Administrator\AppData\Roaming\Maxthon2\mxtool.dll
2009-06-30 02:22 . 2009-06-30 02:22 87376 ----a-w- c:\users\Administrator\AppData\Roaming\Maxthon2\MxSk.dll
2009-06-30 02:22 . 2009-06-30 02:22 87296 ----a-w- c:\users\Administrator\AppData\Roaming\Maxthon2\mxtool2.dll
2009-06-30 02:22 . 2009-06-30 02:22 797440 ----a-w- c:\users\Administrator\AppData\Roaming\Maxthon2\MxUI.dll
2009-06-30 02:22 . 2009-06-30 02:22 79104 ----a-w- c:\users\Administrator\AppData\Roaming\Maxthon2\maxzlib.dll
2009-06-30 02:22 . 2009-06-30 02:22 78136 ----a-w- c:\users\Administrator\AppData\Roaming\Maxthon2\maxupdate.exe
2009-06-30 02:22 . 2009-06-30 02:22 615680 ----a-w- c:\users\Administrator\AppData\Roaming\Maxthon2\MxProxy2.dll
2009-06-30 02:22 . 2009-06-30 02:22 54528 ----a-w- c:\users\Administrator\AppData\Roaming\Maxthon2\MxExt.dll
2009-06-30 02:22 . 2009-06-30 02:22 50512 ----a-w- c:\users\Administrator\AppData\Roaming\Maxthon2\mxpp.dll
2009-06-30 02:22 . 2009-06-30 02:22 398592 ----a-w- c:\users\Administrator\AppData\Roaming\Maxthon2\mxdb.dll
2009-06-30 02:22 . 2009-06-30 02:22 107856 ----a-w- c:\users\Administrator\AppData\Roaming\Maxthon2\MxFav.dll
2009-06-27 09:04 . 2008-07-29 08:43 -------- d-----w- c:\program files\Windows Live
2009-06-27 08:43 . 2009-06-27 08:43 -------- d-----w- c:\program files\Messenger Plus! Live(13)
2009-06-27 08:41 . 2009-06-27 06:40 -------- d-----w- c:\program files\Windows Live(16)
2009-06-27 08:35 . 2009-06-27 06:19 -------- d-----w- c:\progra~2\WLInstaller
2009-06-27 06:40 . 2009-06-27 06:40 -------- dcsh--w- c:\program files\Common Files\WindowsLiveInstaller
2009-06-27 06:31 . 2009-06-27 06:31 -------- d-----w- c:\program files\VS Revo Group
2009-06-24 14:17 . 2009-06-24 14:16 -------- d-----w- c:\progra~2\Electronic Arts
2009-06-24 14:12 . 2009-06-24 14:12 10134 ----a-r- c:\users\Administrator\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
2009-06-24 14:12 . 2009-06-24 14:12 -------- d-----w- c:\program files\Microsoft WSE
2009-06-24 09:54 . 2009-06-24 09:54 427384 ----a-w- c:\users\Administrator\AppData\Roaming\Maxthon2\Modules\MxWebBoost\MxWebBoost.dll
2009-06-16 19:58 . 2008-10-28 18:02 -------- d-----w- c:\users\Administrator\AppData\Roaming\Azureus
2009-06-16 19:58 . 2008-10-28 18:02 -------- d-----w- c:\users\ADMINI~1\AppData\Roaming\Azureus
2009-06-16 19:58 . 2008-07-21 08:15 -------- d-----w- c:\users\Administrator\AppData\Roaming\Ahead
2009-06-16 19:58 . 2008-07-21 08:15 -------- d-----w- c:\users\ADMINI~1\AppData\Roaming\Ahead
2009-06-16 19:58 . 2009-05-15 20:03 -------- d-----w- c:\program files\CrystalDiskInfo27
2009-06-16 19:58 . 2009-05-03 16:13 -------- d-----w- c:\program files\Rohos
2009-06-16 19:58 . 2009-01-04 14:52 -------- d-----w- c:\program files\VirtualDJ
2009-06-16 19:58 . 2008-10-28 18:01 -------- d-----w- c:\program files\Vuze
2009-06-16 19:58 . 2008-08-31 20:08 -------- d-----w- c:\program files\TVAnts
2009-06-16 19:58 . 2008-08-06 05:07 -------- d-----w- c:\program files\ENCICLOPEDIA MEDICA 2007
2009-06-16 19:58 . 2008-07-21 17:23 -------- d-----w- c:\progra~2\ASUS
2009-06-16 19:41 . 2008-11-25 20:23 -------- d-----w- c:\users\Administrator\AppData\Roaming\Digital Support
2009-06-16 19:41 . 2008-11-25 20:23 -------- d-----w- c:\users\ADMINI~1\AppData\Roaming\Digital Support
2009-06-16 18:07 . 2009-06-16 18:01 -------- d-----w- c:\users\Administrator\AppData\Roaming\Nimi
2009-06-16 18:07 . 2009-06-16 18:01 -------- d-----w- c:\users\ADMINI~1\AppData\Roaming\Nimi
2009-06-16 18:04 . 2009-06-16 18:04 8192 ---h--w- c:\users\Administrator\AppData\Roaming\Maxthon2\niminovc.dll
2009-06-16 17:40 . 2009-06-16 17:33 -------- d-----w- c:\progra~2\Pinnacle VideoSpin
2009-06-16 17:33 . 2008-10-20 17:58 -------- d-----w- c:\program files\Pinnacle
2008-07-21 08:21 . 2008-07-21 08:21 24 --sha-w- c:\windows\SD845C329(124).tmp
2008-07-21 08:21 . 2008-07-21 08:21 24 --sha-w- c:\windows\SD845C329(130).tmp
2008-07-21 08:21 . 2008-07-21 08:21 24 --sh--w- c:\windows\SD845C329.tmp
2007-05-20 22:01 . 2007-05-20 21:24 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-18 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-18 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVFX Engine"="c:\program files\Creative\Creative Live! Cam\VideoFX\StartFX.exe" [2006-06-08 24576]
"V0220Mon.exe"="c:\windows\V0220Mon.exe" [2006-06-28 32768]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-07-31 2000152]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-27 13687328]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-27 92704]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"HomeKeyLogger"="c:\program files\HomeKeylogger\KeyLogger.exe" [2007-08-04 28160]
"AsioReg"="CTASIO.DLL" - c:\windows\System32\ctasio.dll [2007-04-09 79872]
"CTHelper"="CTHELPER.EXE" - c:\windows\System32\CtHelper.exe [2007-04-09 19456]
"CTxfiHlp"="CTXFIHLP.EXE" - c:\windows\System32\Ctxfihlp.exe [2007-04-09 19968]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-05-20 6144000]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 c:\windows\system32\nnnoOffd
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):b2,a8,17,76,bf,f9,c9,01
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1978596039-4068159482-2631118307-500]
"EnableNotificationsRef"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{91629DFA-3C92-48B0-80CC-8CAFC83C99F9}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{F7E1AF7E-BE6C-43A8-9754-01D07305EFD8}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{18A20360-D42D-474A-B8A8-E6522F692BFB}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{987C5954-0232-4185-910B-94DFAA45A95F}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{DCA1A2E0-B470-4D0C-95BF-4EB79F84F472}"= UDP:c:\program files\KONAMI\Pro Evolution Soccer 2008\PES2008.exe:Pro Evolution Soccer 2008
"{931B8578-C2C2-4C35-805F-7D4501B10411}"= TCP:c:\program files\KONAMI\Pro Evolution Soccer 2008\PES2008.exe:Pro Evolution Soccer 2008
"TCP Query User{D64DC4AB-CEFF-468E-A205-C38E09B03A46}c:\\program files\\marvell\\61xx\\apache2\\bin\\apache.exe"= UDP:c:\program files\marvell\61xx\apache2\bin\apache.exe:Apache HTTP Server
"UDP Query User{4AE9C2E7-C710-4509-9A5B-0E4FD48FEFAA}c:\\program files\\marvell\\61xx\\apache2\\bin\\apache.exe"= TCP:c:\program files\marvell\61xx\apache2\bin\apache.exe:Apache HTTP Server
"{7B587EB7-155A-4CB0-B479-6A88A1B78575}"= UDP:c:\program files\KONAMI\Pro Evolution Soccer 2008\PES2008.exe:Pro Evolution Soccer 2008
"{B5EA20AD-CA88-4CB3-9ED0-51EA4DD0787E}"= TCP:c:\program files\KONAMI\Pro Evolution Soccer 2008\PES2008.exe:Pro Evolution Soccer 2008
"{EC761CF1-7347-4001-914A-7A37E2A9DADA}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent
"{EA671EE8-E8AC-4E12-8A7E-9F6B391980A1}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent
"{31499527-AA7A-4AC1-BEA3-EA491AF5B929}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{1A70DB6D-EECA-4E07-9301-B2DF11E287FB}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"{70C1BC5C-CFC2-48AB-B9F7-245B1D812F6E}"= UDP:c:\program files\SightSpeed\SightSpeed.exe:SightSpeed
"{F12BBE8A-3A73-4EA6-8537-D2DA7294D3DE}"= TCP:c:\program files\SightSpeed\SightSpeed.exe:SightSpeed
"{FBA86C94-9929-44FF-8B68-0EC5CC22828B}"= UDP:c:\program files\Pinnacle\Studio 11\programs\RM.exe:Render Manager
"{3036EE7F-38CC-4E29-946F-3BD324FD638B}"= TCP:c:\program files\Pinnacle\Studio 11\programs\RM.exe:Render Manager
"{242FA4CF-01CF-4AF2-A1AB-F3352045B497}"= UDP:c:\program files\Pinnacle\Studio 11\programs\Studio.exe:Studio
"{5DBF1098-B52C-4132-9F11-CDF6321D2A62}"= TCP:c:\program files\Pinnacle\Studio 11\programs\Studio.exe:Studio
"{56387049-CD5E-4868-A6BD-6A2D8FFA3C2C}"= UDP:c:\program files\Pinnacle\Studio 11\programs\PMSRegisterFile.exe:PMSRegisterFile
"{36660081-23AD-4549-BAD6-7B4F08FDF2B9}"= TCP:c:\program files\Pinnacle\Studio 11\programs\PMSRegisterFile.exe:PMSRegisterFile
"{53A97603-D6D0-4579-A864-49AC9BECB864}"= UDP:c:\program files\Pinnacle\Studio 11\programs\umi.exe:umi
"{DAEBBBE3-950F-4695-9E72-6568C207174F}"= TCP:c:\program files\Pinnacle\Studio 11\programs\umi.exe:umi
"{8E63B63F-C149-41EA-9E97-F5D631145FCC}"= UDP:c:\program files\Pinnacle\Studio 12\Programs\RM.exe:Render Manager
"{BC09ADE7-CD84-4177-BB6B-B8D685096470}"= TCP:c:\program files\Pinnacle\Studio 12\Programs\RM.exe:Render Manager
"{557AB44C-F409-4346-886C-8C76D7D3B519}"= UDP:c:\program files\Pinnacle\Studio 12\Programs\Studio.exe:Studio
"{C78D968B-A1D9-4112-B951-2B3A8DCE37A5}"= TCP:c:\program files\Pinnacle\Studio 12\Programs\Studio.exe:Studio
"{BE6275B8-C889-4C1F-A6E0-48F79E5B448A}"= UDP:c:\program files\Pinnacle\Studio 12\Programs\umi.exe:umi
"{525E8B15-C32F-4C51-99F6-FDE36DD61E2C}"= TCP:c:\program files\Pinnacle\Studio 12\Programs\umi.exe:umi
"{AD149124-FF29-4A5E-932E-F83E93038850}"= c:\program files\AVG\AVG8\avgam.exe:avgam.exe
"{89B5C6AE-90E6-4C5B-8127-5DAEB3069861}"= c:\program files\AVG\AVG8\avgemc.exe:avgemc.exe
"{A094EA17-AEAB-4D64-B8FC-57ED37D7C116}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe
"{0AA940FA-8BE8-4104-805C-268D2FEDC4B2}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe
"TCP Query User{4BFF9CD9-4B18-4B04-93B1-A532E976E0BF}c:\\program files\\sopcast\\adv\\sopadver.exe"= UDP:c:\program files\sopcast\adv\sopadver.exe:SopCast Adver
"UDP Query User{2A55BE56-02D2-4F02-ACBA-CC8EDF43018F}c:\\program files\\sopcast\\adv\\sopadver.exe"= TCP:c:\program files\sopcast\adv\sopadver.exe:SopCast Adver
"TCP Query User{CE830121-90E3-4377-93A9-7B9BA0953949}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{CED4F1D0-DAC8-4CC7-8CE6-68ABD9DDA7EC}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{E886C83C-5681-4344-9787-CF7537D78DF0}c:\\program files\\vuze\\azureus.exe"= UDP:c:\program files\vuze\azureus.exe:Azureus
"UDP Query User{F97DB21C-2BF5-4950-8597-6ADE1838725A}c:\\program files\\vuze\\azureus.exe"= TCP:c:\program files\vuze\azureus.exe:Azureus
"TCP Query User{FB3E1863-EE1A-4A0B-A12C-294990CF0708}c:\\program files\\camfrog\\camfrog video chat\\camfrog video chat.exe"= UDP:c:\program files\camfrog\camfrog video chat\camfrog video chat.exe:Camfrog Client Module
"UDP Query User{E1063D23-EE38-4B50-9D8C-6260B938549A}c:\\program files\\camfrog\\camfrog video chat\\camfrog video chat.exe"= TCP:c:\program files\camfrog\camfrog video chat\camfrog video chat.exe:Camfrog Client Module
"TCP Query User{AB0D69AF-E780-4590-894F-AEFDB924344C}c:\\program files\\tvuplayer\\tvuplayer.exe"= UDP:c:\program files\tvuplayer\tvuplayer.exe:TVUPlayer Component
"UDP Query User{ED0C665C-53E6-4E56-A1AA-E499DE0C9718}c:\\program files\\tvuplayer\\tvuplayer.exe"= TCP:c:\program files\tvuplayer\tvuplayer.exe:TVUPlayer Component
"TCP Query User{972B6805-4B1B-4E1B-B615-B2827C28181C}c:\\program files\\videolan\\vlc\\vlc.exe"= UDP:c:\program files\videolan\vlc\vlc.exe:VLC media player
"UDP Query User{0B132BA0-0E84-4EF1-B2A7-D3D98A96B573}c:\\program files\\videolan\\vlc\\vlc.exe"= TCP:c:\program files\videolan\vlc\vlc.exe:VLC media player
"TCP Query User{8C92FCFF-8B0E-49F8-AA03-47098F535D96}c:\\users\\administrator\\desktop\\radioplay.exe"= UDP:c:\users\administrator\desktop\radioplay.exe:radioplay.exe
"UDP Query User{7A4B2FBA-15D7-4044-BF6B-9D0B3CCE418D}c:\\users\\administrator\\desktop\\radioplay.exe"= TCP:c:\users\administrator\desktop\radioplay.exe:radioplay.exe
"TCP Query User{B1B3769C-2E92-45D1-B3C9-1D85DA098E56}c:\\program files\\java\\jre6\\bin\\java.exe"= UDP:c:\program files\java\jre6\bin\java.exe:Java(TM) Platform SE binary
"UDP Query User{F8E9C419-7900-4604-8CD4-CF34D1C8F257}c:\\program files\\java\\jre6\\bin\\java.exe"= TCP:c:\program files\java\jre6\bin\java.exe:Java(TM) Platform SE binary
"{7F00955E-082D-4955-B293-761E1EA9C1E9}"= UDP:c:\program files\KONAMI\Pro Evolution Soccer 2009\pes2009.exe:Pro Evolution Soccer 2009
"{B2091610-B97E-4B8B-9FEA-BFFC1E0F4E6B}"= TCP:c:\program files\KONAMI\Pro Evolution Soccer 2009\pes2009.exe:Pro Evolution Soccer 2009
"TCP Query User{9EE76E6A-9F5A-4F02-A5F3-B44B6F8CEF3C}c:\\users\\administrator\\appdata\\local\\temp\\arc51eb\\mirc6.21-italiano-tuttoirc\\mirc.exe"= UDP:c:\users\administrator\appdata\local\temp\arc51eb\mirc6.21-italiano-tuttoirc\mirc.exe:mirc.exe
"UDP Query User{D2DB817D-0169-4167-96CC-72B2E56F7090}c:\\users\\administrator\\appdata\\local\\temp\\arc51eb\\mirc6.21-italiano-tuttoirc\\mirc.exe"= TCP:c:\users\administrator\appdata\local\temp\arc51eb\mirc6.21-italiano-tuttoirc\mirc.exe:mirc.exe
"TCP Query User{46926EB1-21CD-47F6-8F0D-282728F93939}c:\\users\\administrator\\appdata\\local\\temp\\arcf566\\mirc6.21-italiano-tuttoirc\\mirc.exe"= UDP:c:\users\administrator\appdata\local\temp\arcf566\mirc6.21-italiano-tuttoirc\mirc.exe:mirc.exe
"UDP Query User{8789738A-B9DB-4022-9339-112BF616054E}c:\\users\\administrator\\appdata\\local\\temp\\arcf566\\mirc6.21-italiano-tuttoirc\\mirc.exe"= TCP:c:\users\administrator\appdata\local\temp\arcf566\mirc6.21-italiano-tuttoirc\mirc.exe:mirc.exe
"TCP Query User{EF03B01B-45AB-44D0-8904-7F92AD147A10}c:\\users\\administrator\\appdata\\local\\temp\\arc27bd\\ldcplusplus.exe"= UDP:c:\users\administrator\appdata\local\temp\arc27bd\ldcplusplus.exe:ldcplusplus.exe
"UDP Query User{4666F2A9-513F-41D3-BE24-C345A8E629B4}c:\\users\\administrator\\appdata\\local\\temp\\arc27bd\\ldcplusplus.exe"= TCP:c:\users\administrator\appdata\local\temp\arc27bd\ldcplusplus.exe:ldcplusplus.exe
"TCP Query User{65A8F9AF-8F7B-42AA-AB99-22AE5B503EC6}c:\\program files\\opera\\opera.exe"= UDP:c:\program files\opera\opera.exe:Opera Internet Browser
"UDP Query User{5C26A183-9ED5-45D1-B335-783E0A97CABA}c:\\program files\\opera\\opera.exe"= TCP:c:\program files\opera\opera.exe:Opera Internet Browser
"TCP Query User{D6B3BF4C-CF1E-41D3-B878-3C85FB36FE62}c:\\program files\\easymule\\emule.exe"= UDP:c:\program files\easymule\emule.exe:easyMule
"UDP Query User{0A580C7C-5D65-4362-BB6D-D43AC3DF37F9}c:\\program files\\easymule\\emule.exe"= TCP:c:\program files\easymule\emule.exe:easyMule
"{42DE6624-B609-416B-BBE5-5E0D47AA20F3}"= UDP:c:\program files\FrostWire\FrostWire.exe:FrostWire
"{D754F787-538D-4EDC-9CAF-14D452FDD0CE}"= TCP:c:\program files\FrostWire\FrostWire.exe:FrostWire
"TCP Query User{4D688F56-DAC4-4204-BC79-C785C72CFAC9}c:\\program files\\java\\jre6\\bin\\javaw.exe"= UDP:c:\program files\java\jre6\bin\javaw.exe:Java(TM) Platform SE binary
"UDP Query User{6B847FBE-2B0B-4ACA-AA9A-63B72C8B18E6}c:\\program files\\java\\jre6\\bin\\javaw.exe"= TCP:c:\program files\java\jre6\bin\javaw.exe:Java(TM) Platform SE binary
"TCP Query User{117887F9-1FB7-46DB-A226-5307A24467D2}c:\\program files\\sopcast\\sopcast.exe"= UDP:c:\program files\sopcast\sopcast.exe:SopCast Main Application
"UDP Query User{9FA642B0-D2E0-435B-B54C-AA39512186FE}c:\\program files\\sopcast\\sopcast.exe"= TCP:c:\program files\sopcast\sopcast.exe:SopCast Main Application
"{66EAD8BF-E323-4C13-A398-84DBDAAD1706}"= Disabled:UDP:c:\program files\PhotoJoy\Bin\PjImp.exe:PhotoJoy
"{4611F687-9AA6-49CF-B924-C112497EE637}"= Disabled:TCP:c:\program files\PhotoJoy\Bin\PjImp.exe:PhotoJoy
"{26D2EAB5-5C23-43D4-B99B-F940C80BC5F0}"= Disabled:UDP:c:\program files\PhotoJoy\Bin\PhotoJoy.exe:PhotoJoy
"{BD9400D9-3410-4B15-9925-F1645E6CBD1B}"= Disabled:TCP:c:\program files\PhotoJoy\Bin\PhotoJoy.exe:PhotoJoy
"{806F0B0C-E76E-4A6C-A13D-1E6E870D306B}"= Disabled:UDP:c:\program files\PhotoJoy\Bin\PjApp.exe:PhotoJoy
"{04904D03-AE58-4640-816F-891D0BFA638D}"= Disabled:TCP:c:\program files\PhotoJoy\Bin\PjApp.exe:PhotoJoy
"TCP Query User{B1104376-B8C3-4C08-921C-518499E928C6}c:\\users\\administrator\\appdata\\roaming\\maxthon2\\maxthon.exe"= UDP:c:\users\administrator\appdata\roaming\maxthon2\maxthon.exe:maxthon.exe
"UDP Query User{24B0474D-675C-4C0A-B787-A278D87FB87E}c:\\users\\administrator\\appdata\\roaming\\maxthon2\\maxthon.exe"= TCP:c:\users\administrator\appdata\roaming\maxthon2\maxthon.exe:maxthon.exe
"TCP Query User{1000E284-6C9C-44CD-AE30-33A17BFD20EA}c:\\users\\administrator\\appdata\\roaming\\maxthon2\\modules\\mxdownloader\\mxdownloadserver.exe"= UDP:c:\users\administrator\appdata\roaming\maxthon2\modules\mxdownloader\mxdownloadserver.exe:mxdownloadserver.exe
"UDP Query User{D771BD7E-E742-4A90-93F0-40E23F929B09}c:\\users\\administrator\\appdata\\roaming\\maxthon2\\modules\\mxdownloader\\mxdownloadserver.exe"= TCP:c:\users\administrator\appdata\roaming\maxthon2\modules\mxdownloader\mxdownloadserver.exe:mxdownloadserver.exe
"{EF9D000D-D3CE-43FF-8B58-70A4BB31B0EC}"= UDP:c:\program files\VoipCheapCom\VoipCheapCom.exe:VoipCheapCom
"{CEBA69B7-8769-45D1-AF09-6886A6F0EEF3}"= TCP:c:\program files\VoipCheapCom\VoipCheapCom.exe:VoipCheapCom
"{99235EEB-8370-4F44-B013-85E0F111842C}"= UDP:c:\program files\VoipCheapCom\VoipCheapCom.exe:VoipCheapCom
"{AB5B37A6-D93E-4E2A-AEDC-342AF176B775}"= TCP:c:\program files\VoipCheapCom\VoipCheapCom.exe:VoipCheapCom
"{9185FA0C-6AE2-4D9E-8BF1-BB6FD8729C47}"= UDP:c:\users\ADMINI~1\AppData\Local\Temp\ARCE4E8\utorrent.exe:µTorrent (TCP-In)
"{A7654280-3E27-4C50-9AE0-59C7CDD2452F}"= TCP:c:\users\ADMINI~1\AppData\Local\Temp\ARCE4E8\utorrent.exe:µTorrent (UDP-In)
"TCP Query User{C6A84A7D-7697-4581-A92D-D4289B2EF207}c:\\users\\administrator\\appdata\\local\\temp\\arce4e8\\utorrent.exe"= UDP:c:\users\administrator\appdata\local\temp\arce4e8\utorrent.exe:utorrent.exe
"UDP Query User{B25BE730-B091-43BC-BB2D-EEA2AA50E6AA}c:\\users\\administrator\\appdata\\local\\temp\\arce4e8\\utorrent.exe"= TCP:c:\users\administrator\appdata\local\temp\arce4e8\utorrent.exe:utorrent.exe
"{9C54922F-ADF7-4318-9C82-EE3F27612BF9}"= UDP:c:\users\ADMINI~1\AppData\Local\Temp\ARCE4E8\utorrent.exe:µTorrent (TCP-In)
"{C1B55348-8D6C-415C-A876-98F94C76E5FE}"= TCP:c:\users\ADMINI~1\AppData\Local\Temp\ARCE4E8\utorrent.exe:µTorrent (UDP-In)
"TCP Query User{A05D741A-A3DD-4B10-B1D2-B630B101C6B7}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{F2D698AA-722E-4497-BF13-56B9B2E2752F}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule
"{7EA673C9-1244-4D01-9AD7-305C19CDFC1A}"= UDP:c:\program files\KONAMI\Pro Evolution Soccer 2009\pes2009.exe:Pro Evolution Soccer 2009
"{37D471C3-C070-49DE-96FC-7D445682F536}"= TCP:c:\program files\KONAMI\Pro Evolution Soccer 2009\pes2009.exe:Pro Evolution Soccer 2009
"TCP Query User{66205A2C-22D9-4B6E-B64D-4F452C3D82CD}c:\\program files\\nokia\\nokia software updater\\nsu_ui_client.exe"= UDP:c:\program files\nokia\nokia software updater\nsu_ui_client.exe:Nokia Software Updater
"UDP Query User{1991A6EF-8B1E-46CF-BA1E-45BF820B35F5}c:\\program files\\nokia\\nokia software updater\\nsu_ui_client.exe"= TCP:c:\program files\nokia\nokia software updater\nsu_ui_client.exe:Nokia Software Updater
"TCP Query User{9BA53811-1FF3-4DEB-AD8A-927F40BEA509}c:\\program files\\common files\\nokia\\service layer\\a\\nsl_host_process.exe"= UDP:c:\program files\common files\nokia\service layer\a\nsl_host_process.exe:Nokia Service Layer Host Process
"UDP Query User{E29F5604-126F-45EC-971D-C7324B526FCA}c:\\program files\\common files\\nokia\\service layer\\a\\nsl_host_process.exe"= TCP:c:\program files\common files\nokia\service layer\a\nsl_host_process.exe:Nokia Service Layer Host Process
"{33801D00-BDDC-4B1A-9D25-BEE33EDE58CC}"= UDP:4662:eMule
"{2F39E12F-AEEF-47B7-A736-8E75B73ABF6C}"= TCP:4672:eMule
"TCP Query User{99591E3E-7DF6-4F36-BCCD-8D665AF25B60}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{E8EF139C-FA0A-4FC1-81EC-506E4F6D79D6}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule
"TCP Query User{012CB50D-2A6E-4CB3-B5D4-4089F2472D50}c:\\users\\administrator\\appdata\\roaming\\maxthon2\\modules\\mxdownloader\\mxdownloadserver.exe"= UDP:c:\users\administrator\appdata\roaming\maxthon2\modules\mxdownloader\mxdownloadserver.exe:mxdownloadserver.exe
"UDP Query User{5DD8D983-04FF-496C-A4F4-C704BDC48A16}c:\\users\\administrator\\appdata\\roaming\\maxthon2\\modules\\mxdownloader\\mxdownloadserver.exe"= TCP:c:\users\administrator\appdata\roaming\maxthon2\modules\mxdownloader\mxdownloadserver.exe:mxdownloadserver.exe
"TCP Query User{9381E056-53B7-491B-A6D7-410EBC9ED5C9}c:\\program files\\vuze\\azureus.exe"= UDP:c:\program files\vuze\azureus.exe:Azureus
"UDP Query User{24B04C5B-3435-49AA-99C9-B9B0739EB544}c:\\program files\\vuze\\azureus.exe"= TCP:c:\program files\vuze\azureus.exe:Azureus
"{61BFF70D-9F15-4642-BE06-09539D58CE12}"= Disabled:UDP:c:\program files\PhotoJoy\Bin\PhotoJoy.exe:PhotoJoy
"{BEA7A251-0266-4091-BB4B-31C934DC7271}"= Disabled:TCP:c:\program files\PhotoJoy\Bin\PhotoJoy.exe:PhotoJoy
"{7B0D9E9E-C2EF-4336-B39E-67F6C343A0C3}"= Disabled:UDP:c:\program files\PhotoJoy\Bin\PjApp.exe:PhotoJoy
"{7B13D1F9-4520-4E0C-9465-592AAA2B8F05}"= Disabled:TCP:c:\program files\PhotoJoy\Bin\PjApp.exe:PhotoJoy
"TCP Query User{3548E94B-847B-4D6E-9144-B3936AD76512}c:\\program files\\java\\jre6\\bin\\java.exe"= UDP:c:\program files\java\jre6\bin\java.exe:Java(TM) Platform SE binary
"UDP Query User{B1534CAC-1A69-4ED7-8C59-EB58AC96F777}c:\\program files\\java\\jre6\\bin\\java.exe"= TCP:c:\program files\java\jre6\bin\java.exe:Java(TM) Platform SE binary
"{76BBF3B9-741B-4FBB-8002-8EC0841EF2FB}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{9E615DC4-88C6-4956-B045-215E145E1FAF}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{03024A1B-E9EE-4B8E-8623-2E991DF15E18}"= UDP:c:\program files\RelevantKnowledge\rlvknlg.exe:rlvknlg.exe
"{F96B2E75-9B22-4F02-BEB2-EEFAEAF9E47E}"= TCP:c:\program files\RelevantKnowledge\rlvknlg.exe:rlvknlg.exe
"{333C7BC0-D654-476F-9FD5-EC50F937893E}"= UDP:c:\program files\Pinnacle\VideoSpin\Programs\RM.exe:Render Manager
"{2DEFB16A-AA09-47D7-882E-DDF9EE39B1D2}"= TCP:c:\program files\Pinnacle\VideoSpin\Programs\RM.exe:Render Manager
"{8FB47BFE-C65E-4B87-96BC-DDC674E164C6}"= UDP:c:\program files\Pinnacle\VideoSpin\Programs\umi.exe:umi
"{49796183-5F20-4158-A5BC-A646A7A5B9C7}"= TCP:c:\program files\Pinnacle\VideoSpin\Programs\umi.exe:umi
"{E8F4B28A-A716-4292-BC8D-14515489D188}"= UDP:c:\program files\Pinnacle\VideoSpin\Programs\VideoSpin.exe:Pinnacle VideoSpin
"{8C54B674-CAA0-4682-8990-D93AF004F3EC}"= TCP:c:\program files\Pinnacle\VideoSpin\Programs\VideoSpin.exe:Pinnacle VideoSpin
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
R0 AvgRkx86;avgrkx86.sys;c:\windows\System32\drivers\avgrkx86.sys [30/10/2008 20.33.23 12552]
R0 mv61xx;mv61xx;c:\windows\System32\drivers\mv61xx.sys [15/06/2007 9.52.18 143256]
R0 pavboot;pavboot;c:\windows\System32\drivers\pavboot.sys [05/05/2009 19.56.22 28544]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [30/10/2008 20.33.17 335240]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [30/10/2008 20.33.21 108552]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [03/09/2008 14.07.14 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [03/09/2008 14.07.12 55024]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [08/01/2009 18.25.49 908056]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [08/01/2009 18.25.53 297752]
R2 Marvell RAID;Marvell RAID Event Agent;c:\program files\Marvell\61xx\svc\mvraidsvc.exe [12/06/2007 20.54.12 61440]
R2 MRUWebService;MRU Web Service;c:\program files\Marvell\61xx\Apache2\bin\Apache.exe [23/05/2007 2.17.02 20539]
R2 RHDISK;RHDISK;c:\program files\Rohos\rhdisk.sys [03/05/2009 18.13.25 38264]
R3 V0220Dev;Live! Cam Video IM;c:\windows\System32\drivers\V0220Dev.sys [02/08/2008 10.02.35 146112]
R3 V0220Vfx;V0220VFX;c:\windows\System32\drivers\V0220Vfx.sys [02/08/2008 10.02.35 6272]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [03/09/2008 14.07.16 7408]
S4 HAQDE;HAQDE;c:\users\ADMINI~1\AppData\Local\Temp\HAQDE.exe [06/08/2009 20.57.41 404352]
S4 IJZFAJ;IJZFAJ;c:\users\ADMINI~1\AppData\Local\Temp\IJZFAJ.exe [06/08/2009 20.58.04 375680]
S4 Rohos Disk;Rohos Disk service;c:\program files\Rohos\agent.exe [03/05/2009 18.13.25 785448]
S4 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [26/07/2008 19.02.38 1153368]
S4 VundoFixSvc;VundoFix Service;VundoFixSVC.exe --> VundoFixSVC.exe [?]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7070D8E0-650A-46b3-B03C-9497582E6A74}]
%SystemRoot%\system32\soundschemes.exe /AddRegistration
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B3688A53-AB2A-4b1d-8CEF-8F93D8C51C24}]
%SystemRoot%\system32\soundschemes2.exe /AddRegistration
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
uInternet Settings,ProxyOverride = *.local
TCP: {4D7F5B01-3478-4ADD-A227-4856158B1F73} = 192.168.0.1
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
.
**************************************************************************
scansione processi nascosti ...
scansione entrate autostart nascoste ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTHelper = CTHELPER.EXE?
CTxfiHlp = CTXFIHLP.EXE?
Scansione files nascosti ...
Scansione completata con successo
Files nascosti:
**************************************************************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,b4,d8,3c,13,69,96,0f,48,94,c6,30,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,b4,d8,3c,13,69,96,0f,48,94,c6,30,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,b4,d8,3c,13,69,96,0f,48,94,c6,30,\
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\UserChoice]
@Denied: (2) (Administrator)
"Progid"="3gpfile"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\UserChoice]
@Denied: (2) (Administrator)
"Progid"="3gpfile"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ac3\UserChoice]
@Denied: (2) (Administrator)
"Progid"="ac3file"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.AIFF"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.AIFF"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.alac\UserChoice]
@Denied: (2) (Administrator)
"Progid"="alacfile"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ape\UserChoice]
@Denied: (2) (Administrator)
"Progid"="apefile"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.ASX"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aup\UserChoice]
@Denied: (2) (Administrator)
"Progid"="Applications\\wmplayer.exe"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\UserChoice]
@Denied: (2) (Administrator)
"Progid"="avifile"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cda\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.CDA"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.divx\UserChoice]
@Denied: (2) (Administrator)
"Progid"="AVIfile"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc\UserChoice]
@Denied: (2) (Administrator)
"Progid"="Applications\\AbiWord.exe"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.docx\UserChoice]
@Denied: (2) (Administrator)
"Progid"="Applications\\wordpad.exe"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (Administrator)
"Progid"="Microsoft Internet Mail Message"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.EVO\UserChoice]
@Denied: (2) (Administrator)
"Progid"="evofile"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.flac\UserChoice]
@Denied: (2) (Administrator)
"Progid"="flacfile"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hdmov\UserChoice]
@Denied: (2) (Administrator)
"Progid"="hdmovfile"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.HTM"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.HTM"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ifo\UserChoice]
@Denied: (2) (Administrator)
"Progid"="ifofile"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m2ts\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.M3U"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\UserChoice]
@Denied: (2) (Administrator)
"Progid"="m4afile"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.MHT"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.MHT"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.midi\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MIDI"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mka\UserChoice]
@Denied: (2) (Administrator)
"Progid"="MatroskaVideo"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mkv\UserChoice]
@Denied: (2) (Administrator)
"Progid"="MatroskaVideo"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\UserChoice]
@Denied: (2) (Administrator)
"Progid"="MP3File"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\UserChoice]
@Denied: (2) (Administrator)
"Progid"="mp4file"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpc\UserChoice]
@Denied: (2) (Administrator)
"Progid"="mpcfile"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\UserChoice]
@Denied: (2) (Administrator)
"Progid"="MPEGFile"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MSWMM\UserChoice]
@Denied: (2) (Administrator)
"Progid"="Applications\\vlc.exe"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ogm\UserChoice]
@Denied: (2) (Administrator)
"Progid"="ogmfile"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pps\UserChoice]
@Denied: (2) (Administrator)
"Progid"="OpenOffice.org.Pps"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rm\UserChoice]
@Denied: (2) (Administrator)
"Progid"="RealMedia"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmvb\UserChoice]
@Denied: (2) (Administrator)
"Progid"="RealMedia"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ts\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tta\UserChoice]
@Denied: (2) (Administrator)
"Progid"="ttafile"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.url\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.URL"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wax\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WAX"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.ASF"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMAFile"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmd\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WMD"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wms\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WMS"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmx\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.ASX"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmz\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WMZ"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WPL"
[HKEY_USERS\S-1-5-21-1978596039-4068159482-2631118307-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WVX"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10c.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\Windows\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:2e,e8,e1,00,eb,16,2b,de,dd,f0,3d,5b,10,
e5,e5,7d,c8,28,51,af,b0,29,a3,98,3e,af,63,4b,26,6b,a3,5d,e2,63,26,f1,3f,c8,\
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\Windows\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:71,3b,04,66,8b,46,0d,96,54,83,3d,f7,52,
2b,e1,df,71,3b,04,66,8b,46,0d,96,71,ba,ce,41,24,fc,b2,ec,6a,9c,d6,61,af,45,\
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\Windows\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:25,da,ec,7e,55,20,c9,26,a3,9e,86,f2,e8,
74,f4,72,25,da,ec,7e,55,20,c9,26,29,d3,de,f6,e4,e5,15,ac,ff,7c,85,e0,43,d4,\
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\Windows\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:3e,1e,9e,e0,57,5a,93,61,c1,3a,e7,a4,df,
fa,40,ea,3e,1e,9e,e0,57,5a,93,61,b3,b5,c6,12,17,25,0c,38,86,8c,21,01,be,91,\
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\Windows\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:cd,44,cd,b9,a6,33,6c,cd,27,05,aa,bc,d6,
ff,40,b6,cd,44,cd,b9,a6,33,6c,cd,c4,46,a4,e4,85,89,f3,22,f5,1d,4d,73,a8,13,\
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\Windows\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:df,20,58,62,78,6b,cf,c8,a2,b6,d1,5f,84,
47,53,9d,b0,18,ed,a7,3f,8d,37,a4,4e,4b,b5,38,90,ec,87,63,df,20,58,62,78,6b,\
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\Windows\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:fb,a7,78,e6,12,2f,9a,ea,3d,b4,39,e9,3b,
e3,13,15,31,77,e1,ba,b1,f8,68,02,9b,09,be,b7,b2,db,2a,89,fb,a7,78,e6,12,2f,\
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\Windows\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,af,45,a2,47,11,
40,3e,16,83,6c,56,8b,a0,85,96,ab,70,b4,84,1b,a2,5f,15,ea,01,3a,48,fc,e8,04,\
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\Windows\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:51,fa,6e,91,28,9e,14,cc,b9,da,04,2b,88,
e4,f0,9a,51,fa,6e,91,28,9e,14,cc,de,d1,41,a0,c4,42,59,28,f6,0f,4e,58,98,5b,\
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\Windows\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:3d,ce,ea,26,2d,45,aa,78,f1,cb,ce,b4,6a,
ed,7e,7e,b1,cd,45,5a,a8,c4,f8,b9,56,25,c7,96,b8,08,13,a9,3d,ce,ea,26,2d,45,\
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\Windows\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:f8,31,0f,a9,5f,a0,ec,fb,31,78,57,83,5c,
75,c0,09,e3,0e,66,d5,eb,bc,2f,6b,c0,47,62,f7,d1,20,4e,e9,2a,b7,cc,b5,b9,7f,\
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\Windows\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:fa,ea,66,7f,d4,3b,6b,70,6b,c3,8a,ce,d7,
38,e7,c1,fa,ea,66,7f,d4,3b,6b,70,c6,09,64,e1,b1,18,10,6f,6c,43,2d,1e,aa,22,\
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\DISPLAY\ABO7087\5&284a51da&0&UID256\Properties\{83da6326-97a6-4088-9453-a1923f573b29}]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\DISPLAY\ABO7087\5&284a51da&0&UID256\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\DISPLAY\ABO7087\5&284a51da&0&UID257\Properties\{83da6326-97a6-4088-9453-a1923f573b29}]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\DISPLAY\ABO7087\5&284a51da&0&UID257\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\DISPLAY\Default_Monitor\5&10e4041b&0&UID256\Properties\{83da6326-97a6-4088-9453-a1923f573b29}]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\DISPLAY\Default_Monitor\5&10e4041b&0&UID256\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\DISPLAY\Default_Monitor\5&10e4041b&0&UID257\Properties\{83da6326-97a6-4088-9453-a1923f573b29}]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\DISPLAY\Default_Monitor\5&10e4041b&0&UID257\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\DISPLAY\Default_Monitor\5&284a51da&0&UID256\Properties\{83da6326-97a6-4088-9453-a1923f573b29}]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\DISPLAY\Default_Monitor\5&284a51da&0&UID256\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\DISPLAY\GSM42B9\5&284a51da&0&UID256\Properties\{83da6326-97a6-4088-9453-a1923f573b29}]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\DISPLAY\GSM42B9\5&284a51da&0&UID256\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\DISPLAY\HRT1701\5&284a51da&0&12345678&01&00\Properties\{83da6326-97a6-4088-9453-a1923f573b29}]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\DISPLAY\HRT1701\5&284a51da&0&12345678&01&00\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\DISPLAY\HRT1701\5&284a51da&0&UID272\Properties\{83da6326-97a6-4088-9453-a1923f573b29}]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\DISPLAY\HRT1701\5&284a51da&0&UID272\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\DISPLAY\HWP0B05\5&284a51da&0&UID256\Properties\{83da6326-97a6-4088-9453-a1923f573b29}]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\DISPLAY\HWP0B05\5&284a51da&0&UID256\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\DISPLAY\HWP0B05\5&97d0555&0&UID256\Properties\{83da6326-97a6-4088-9453-a1923f573b29}]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\DISPLAY\HWP0B05\5&97d0555&0&UID256\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\DISPLAY\HWP26A8\5&10e4041b&0&UID256\Properties\{83da6326-97a6-4088-9453-a1923f573b29}]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\DISPLAY\HWP26A8\5&10e4041b&0&UID256\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\DISPLAY\HWP26A8\5&284a51da&0&UID256\Properties\{83da6326-97a6-4088-9453-a1923f573b29}]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\DISPLAY\HWP26A8\5&284a51da&0&UID256\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\DISPLAY\HWP26A8\5&284a51da&0&UID257\Properties\{83da6326-97a6-4088-9453-a1923f573b29}]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\DISPLAY\HWP26A8\5&284a51da&0&UID257\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}]
@DACL=(02 0000)
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\windows\System32\nvvsvc.exe
c:\windows\System32\audiodg.exe
c:\windows\System32\rundll32.exe
c:\program files\Common Files\Portrait Displays\Shared\DTSRVC.exe
c:\program files\Common Files\microsoft shared\VS7DEBUG\mdm.exe
c:\progra~1\AVG\AVG8\avgam.exe
c:\progra~1\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\AVG\AVG8\avgtray.exe
c:\windows\System32\rundll32.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\ehome\ehmsas.exe
.
**************************************************************************
.
Ora fine scansione: 2009-08-06 23.47.23 - Il pc è stato riavviato
ComboFix-quarantined-files.txt 2009-08-06 21:47
Pre-Run: 301.638.098.944 byte disponibili
Post-Run: 301.882.671.104 byte disponibili
718 --- E O F --- 2009-07-31 16:21
fiuuuuuuuuuu riavviando internet si è aperto e anche il log sto' dgt adesso dal pc di prima
|
